From ef7db203f7b3ad3cf5097c01f3bba30c93fd714d Mon Sep 17 00:00:00 2001 From: Jiri Slaby Date: Mar 10 2023 08:59:40 +0000 Subject: - Linux 6.2.3 (bsc#1012628). - HID: asus: use spinlock to protect concurrent accesses (bsc#1012628). - HID: asus: use spinlock to safely schedule workers (bsc#1012628). - iommu/amd: Fix error handling for pdev_pri_ats_enable() (bsc#1012628). - iommu/amd: Skip attach device domain is same as new domain (bsc#1012628). - iommu/amd: Improve page fault error reporting (bsc#1012628). - iommu: Attach device group to old domain in error path (bsc#1012628). - powerpc/mm: Rearrange if-else block to avoid clang warning (bsc#1012628). - ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller" (bsc#1012628). - ARM: OMAP2+: Fix memory leak in realtime_counter_init() (bsc#1012628). - arm64: dts: qcom: qcs404: use symbol names for PCIe resets (bsc#1012628). - arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up (bsc#1012628). - arm64: dts: qcom: sm6115: Fix UFS node (bsc#1012628). - arm64: dts: qcom: sm6115: Provide xo clk to rpmcc (bsc#1012628). - arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k (bsc#1012628). - arm64: dts: qcom: pmi8950: Correct rev_1250v channel label to mv (bsc#1012628). - arm64: dts: qcom: sm6350: Fix up the ramoops node (bsc#1012628). - arm64: dts: qcom: sdm670-google-sargo: keep pm660 ldo8 on (bsc#1012628). - arm64: dts: qcom: Re-enable resin on MSM8998 and SDM845 boards (bsc#1012628). - arm64: dts: qcom: sm8350-sagami: Configure SLG51000 PMIC on PDX215 (bsc#1012628). - arm64: dts: qcom: sm8350-sagami: Add GPIO line names for PMIC GPIOs (bsc#1012628). - arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys (bsc#1012628). - arm64: dts: qcom: sm6350-lena: Flatten gpio-keys pinctrl state (bsc#1012628). - arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings (bsc#1012628). - arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume down) (bsc#1012628). - arm64: dts: imx8m: Align SoC unique ID node unit address (bsc#1012628). - ARM: zynq: Fix refcount leak in zynq_early_slcr_init (bsc#1012628). - fs: dlm: fix return value check in dlm_memory_init() (bsc#1012628). - arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 T-PHY (bsc#1012628). - arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description (bsc#1012628). - arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock description (bsc#1012628). - arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock description (bsc#1012628). - arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock description (bsc#1012628). - arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name (bsc#1012628). - arm64: dts: qcom: sdm845-xiaomi-beryllium: fix audio codec interrupt pin name (bsc#1012628). - x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC (bsc#1012628). - arm64: dts: qcom: sc7180: correct SPMI bus address cells (bsc#1012628). - arm64: dts: qcom: sc7280: correct SPMI bus address cells (bsc#1012628). - arm64: dts: qcom: sc8280xp: correct SPMI bus address cells (bsc#1012628). - arm64: dts: qcom: sm8450: correct Soundwire wakeup interrupt name (bsc#1012628). - arm64: dts: qcom: sdm845: make DP node follow the schema (bsc#1012628). - arm64: dts: qcom: msm8996-oneplus-common: drop vdda-supply from DSI PHY (bsc#1012628). - arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers (bsc#1012628). - arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node (bsc#1012628). - arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name (bsc#1012628). - arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node names (bsc#1012628). - arm64: dts: meson-gx: Fix Ethernet MAC address unit name (bsc#1012628). - arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name (bsc#1012628). - arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address (bsc#1012628). - cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again* (bsc#1012628). - arm64: dts: ti: k3-am62-main: Fix clocks for McSPI (bsc#1012628). - arm64: tegra: Fix duplicate regulator on Jetson TX1 (bsc#1012628). - arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size (bsc#1012628). - arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem (bsc#1012628). - arm64: dts: qcom: msm8956: use SoC-specific compat for tsens (bsc#1012628). - arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names (bsc#1012628). - arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY (bsc#1012628). - arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY (bsc#1012628). - arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges (bsc#1012628). - arm64: dts: qcom: ipq8074: fix Gen3 PCIe node (bsc#1012628). - arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names (bsc#1012628). - arm64: dts: meson: remove CPU opps below 1GHz for G12A boards (bsc#1012628). - ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() (bsc#1012628). - arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken (bsc#1012628). - ARM: bcm2835_defconfig: Enable the framebuffer (bsc#1012628). - ARM: s3c: fix s3c64xx_set_timer_source prototype (bsc#1012628). - arm64: dts: ti: k3-j7200: Fix wakeup pinmux range (bsc#1012628). - ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato (bsc#1012628). - ARM: imx: Call ida_simple_remove() for ida_simple_get (bsc#1012628). - arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name (bsc#1012628). - arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name (bsc#1012628). - arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible (bsc#1012628). - arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix supply name of USB controller node (bsc#1012628). - arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property (bsc#1012628). - arm64: dts: amlogic: meson-gx: add missing unit address to rng node name (bsc#1012628). - arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix invalid rtc node name (bsc#1012628). - arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix invalid rtc node name (bsc#1012628). - arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name (bsc#1012628). - arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name (bsc#1012628). - arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names (bsc#1012628). - arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name (bsc#1012628). - arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name (bsc#1012628). - arm64: dts: amlogic: meson-g12b-odroid-go-ultra: fix rk818 pmic properties (bsc#1012628). - arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip (bsc#1012628). - locking/rwsem: Disable preemption in all down_read*() and up_read() code paths (bsc#1012628). - arm64: tegra: Mark host1x as dma-coherent on Tegra194/234 (bsc#1012628). - arm64: dts: renesas: beacon-renesom: Fix gpio expander reference (bsc#1012628). - arm64: dts: meson: radxa-zero: allow usb otg mode (bsc#1012628). - arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN (bsc#1012628). - ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference (bsc#1012628). - ublk_drv: remove nr_aborted_queues from ublk_device (bsc#1012628). - ublk_drv: don't probe partitions if the ubq daemon isn't trusted (bsc#1012628). - ARM: dts: imx7s: correct iomuxc gpr mux controller cells (bsc#1012628). - sbitmap: remove redundant check in __sbitmap_queue_get_batch (bsc#1012628). - sbitmap: correct wake_batch recalculation to avoid potential IO hung (bsc#1012628). - arm64: dts: mt8195: Fix CPU map for single-cluster SoC (bsc#1012628). - arm64: dts: mt8192: Fix CPU map for single-cluster SoC (bsc#1012628). - arm64: dts: mt8186: Fix CPU map for single-cluster SoC (bsc#1012628). - arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node (bsc#1012628). - arm64: dts: mediatek: mt8186: Fix watchdog compatible (bsc#1012628). - arm64: dts: mediatek: mt8195: Fix watchdog compatible (bsc#1012628). - arm64: dts: mediatek: mt7986: Fix watchdog compatible (bsc#1012628). - ARM: dts: stm32: Update part number NVMEM description on stm32mp131 (bsc#1012628). - arm64: dts: qcom: sm8450-nagara: Correct firmware paths (bsc#1012628). - blk-mq: avoid sleep in blk_mq_alloc_request_hctx (bsc#1012628). - blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx (bsc#1012628). - blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait (bsc#1012628). - blk-mq: Fix potential io hung for shared sbitmap per tagset (bsc#1012628). - blk-mq: correct stale comment of .get_budget (bsc#1012628). - arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input (bsc#1012628). - arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC (bsc#1012628). - arm64: dts: qcom: sm8350: drop incorrect cells from serial (bsc#1012628). - arm64: dts: qcom: sm8450: drop incorrect cells from serial (bsc#1012628). - arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions (bsc#1012628). - arm64: dts: qcom: msm8953: correct TLMM gpio-ranges (bsc#1012628). - arm64: dts: qcom: sm6115: correct TLMM gpio-ranges (bsc#1012628). - arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators (bsc#1012628). - s390/dasd: Fix potential memleak in dasd_eckd_init() (bsc#1012628). - io_uring,audit: don't log IORING_OP_MADVISE (bsc#1012628). - sched/rt: pick_next_rt_entity(): check list_entry (bsc#1012628). - perf/x86/intel/ds: Fix the conversion from TSC to perf time (bsc#1012628). - x86/perf/zhaoxin: Add stepping check for ZXC (bsc#1012628). - KEYS: asymmetric: Fix ECDSA use via keyctl uapi (bsc#1012628). - block: ublk: check IO buffer based on flag need_get_data (bsc#1012628). - arm64: dts: qcom: pmk8350: Use the correct PON compatible (bsc#1012628). - erofs: relinquish volume with mutex held (bsc#1012628). - block: sync mixed merged request's failfast with 1st bio's (bsc#1012628). - block: Fix io statistics for cgroup in throttle path (bsc#1012628). - block: bio-integrity: Copy flags when bio_integrity_payload is cloned (bsc#1012628). - block: use proper return value from bio_failfast() (bsc#1012628). - wifi: mt76: mt7915: add missing of_node_put() (bsc#1012628). - wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host (bsc#1012628). - wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks (bsc#1012628). - wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_ie_countdown() (bsc#1012628). - wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_rx_radar_detected() (bsc#1012628). - wifi: mt76: mt7996: fix integer handling issue of mt7996_rf_regval_set() (bsc#1012628). - wifi: mt76: mt7915: check return value before accessing free_block_num (bsc#1012628). - wifi: mt76: mt7996: check return value before accessing free_block_num (bsc#1012628). - wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr() (bsc#1012628). - wifi: mt76: mt7996: drop always true condition of __mt7996_reg_addr() (bsc#1012628). - wifi: mt76: mt7996: fix endianness warning in mt7996_mcu_sta_he_tlv (bsc#1012628). - wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power (bsc#1012628). - wifi: mt76: mt7996: fix unintended sign extension of mt7996_hw_queue_read() (bsc#1012628). - wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read() (bsc#1012628). - wifi: mt76: fix coverity uninit_use_in_call in mt76_connac2_reverse_frag0_hdr_trans() (bsc#1012628). - wifi: mt76: mt7921: resource leaks at mt7921_check_offload_capability() (bsc#1012628). - wifi: rsi: Fix memory leak in rsi_coex_attach() (bsc#1012628). - wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: libertas: fix memory leak in lbs_init_adapter() (bsc#1012628). - wifi: rtl8xxxu: Fix assignment to bit field priv->pi_enabled (bsc#1012628). - wifi: rtl8xxxu: Fix assignment to bit field priv->cck_agc_report_type (bsc#1012628). - wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: rtw89: 8852c: rfk: correct DACK setting (bsc#1012628). - wifi: rtw89: 8852c: rfk: correct DPK settings (bsc#1012628). - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() (bsc#1012628). - libbpf: Fix single-line struct definition output in btf_dump (bsc#1012628). - libbpf: Fix btf__align_of() by taking into account field offsets (bsc#1012628). - wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: ipw2200: fix memory leak in ipw_wdev_init() (bsc#1012628). - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() (bsc#1012628). - wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init() (bsc#1012628). - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (bsc#1012628). - wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() (bsc#1012628). - wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() (bsc#1012628). - wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() (bsc#1012628). - libbpf: Fix invalid return address register in s390 (bsc#1012628). - crypto: x86/ghash - fix unaligned access in ghash_setkey() (bsc#1012628). - crypto: ux500 - update debug config after ux500 cryp driver removal (bsc#1012628). - ACPICA: Drop port I/O validation for some regions (bsc#1012628). - genirq: Fix the return type of kstat_cpu_irqs_sum() (bsc#1012628). - rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose (bsc#1012628). - rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls (bsc#1012628). - rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() (bsc#1012628). - lib/mpi: Fix buffer overrun when SG is too long (bsc#1012628). - crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 (bsc#1012628). - platform/chrome: cros_ec_typec: Update port DP VDO (bsc#1012628). - ACPICA: nsrepair: handle cases without a return value correctly (bsc#1012628). - libbpf: Fix map creation flags sanitization (bsc#1012628). - selftests/xsk: print correct payload for packet dump (bsc#1012628). - selftests/xsk: print correct error codes when exiting (bsc#1012628). - arm64/cpufeature: Fix field sign for DIT hwcap detection (bsc#1012628). - arm64/sysreg: Fix errors in 32 bit enumeration values (bsc#1012628). - kselftest/arm64: Fix syscall-abi for systems without 128 bit SME (bsc#1012628). - workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex (bsc#1012628). - s390/early: fix sclp_early_sccb variable lifetime (bsc#1012628). - s390/vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue() (bsc#1012628). - x86/signal: Fix the value returned by strict_sas_size() (bsc#1012628). - thermal/drivers/tsens: Drop msm8976-specific defines (bsc#1012628). - thermal/drivers/tsens: Sort out msm8976 vs msm8956 data (bsc#1012628). - thermal/drivers/tsens: fix slope values for msm8939 (bsc#1012628). - thermal/drivers/tsens: limit num_sensors to 9 for msm8939 (bsc#1012628). - wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie() (bsc#1012628). - wifi: rtw89: Add missing check for alloc_workqueue (bsc#1012628). - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU (bsc#1012628). - wifi: orinoco: check return value of hermes_write_wordrec() (bsc#1012628). - wifi: rtw88: Use rtw_iterate_vifs() for rtw_vif_watch_dog_iter() (bsc#1012628). - wifi: rtw88: Use non-atomic sta iterator in rtw_ra_mask_info_update() (bsc#1012628). - thermal/drivers/imx_sc_thermal: Fix the loop condition (bsc#1012628). - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function (bsc#1012628). - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (bsc#1012628). - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (bsc#1012628). - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup (bsc#1012628). - wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() (bsc#1012628). - ACPI: battery: Fix missing NUL-termination with large strings (bsc#1012628). - selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m (bsc#1012628). - crypto: ccp - Failure on re-initialization due to duplicate sysfs filename (bsc#1012628). - crypto: essiv - Handle EBUSY correctly (bsc#1012628). - crypto: seqiv - Handle EBUSY correctly (bsc#1012628). - powercap: fix possible name leak in powercap_register_zone() (bsc#1012628). - bpf: Fix state pruning for STACK_DYNPTR stack slots (bsc#1012628). - bpf: Fix missing var_off check for ARG_PTR_TO_DYNPTR (bsc#1012628). - bpf: Fix partial dynptr stack slot reads/writes (bsc#1012628). - x86/microcode: Add a parameter to microcode_check() to store CPU capabilities (bsc#1012628). - x86/microcode: Check CPU capabilities after late microcode update correctly (bsc#1012628). - x86/microcode: Adjust late loading result reporting message (bsc#1012628). - net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action (bsc#1012628). - selftests/bpf: Fix vmtest static compilation error (bsc#1012628). - crypto: xts - Handle EBUSY correctly (bsc#1012628). - leds: led-class: Add missing put_device() to led_put() (bsc#1012628). - drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size (bsc#1012628). - s390/bpf: Add expoline to tail calls (bsc#1012628). - wifi: iwlwifi: mei: fix compilation errors in rfkill() (bsc#1012628). - kselftest/arm64: Fix enumeration of systems without 128 bit SME (bsc#1012628). - can: rcar_canfd: Fix R-Car V3U CAN mode selection (bsc#1012628). - can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses (bsc#1012628). - selftests/bpf: Initialize tc in xdp_synproxy (bsc#1012628). - crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware (bsc#1012628). - bpftool: profile online CPUs instead of possible (bsc#1012628). - wifi: mt76: mt7921: fix deadlock in mt7921_abort_roc (bsc#1012628). - wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after init_work (bsc#1012628). - wifi: mt76: mt7915: rework mt7915_mcu_set_thermal_throttling (bsc#1012628). - wifi: mt76: mt7915: rework mt7915_thermal_temp_store() (bsc#1012628). - wifi: mt76: mt7921: fix channel switch fail in monitor mode (bsc#1012628). - wifi: mt76: mt7996: fix chainmask calculation in mt7996_set_antenna() (bsc#1012628). - wifi: mt76: mt7996: update register for CFEND_RATE (bsc#1012628). - wifi: mt76: connac: fix POWER_CTRL command name typo (bsc#1012628). - wifi: mt76: mt7921: fix invalid remain_on_channel duration (bsc#1012628). - wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit (bsc#1012628). - wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit (bsc#1012628). - wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup (bsc#1012628). - wifi: mt76: fix switch default case in mt7996_reverse_frag0_hdr_trans (bsc#1012628). - wifi: mt76: mt7915: fix WED TxS reporting (bsc#1012628). - wifi: mt76: add memory barrier to SDIO queue kick (bsc#1012628). - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read (bsc#1012628). - wifi: mt76: mt7996: rely on mt76_connac2_mac_tx_rate_val (bsc#1012628). - net/mlx5: Enhance debug print in page allocation failure (bsc#1012628). - irqchip: Fix refcount leak in platform_irqchip_probe (bsc#1012628). - irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (bsc#1012628). - irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe (bsc#1012628). - irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe (bsc#1012628). - s390/mem_detect: fix detect_memory() error handling (bsc#1012628). - s390/vmem: fix empty page tables cleanup under KASAN (bsc#1012628). - s390/boot: cleanup decompressor header files (bsc#1012628). - s390/mem_detect: rely on diag260() if sclp_early_get_memsize() fails (bsc#1012628). - s390/boot: fix mem_detect extended area allocation (bsc#1012628). - net: add sock_init_data_uid() (bsc#1012628). - tun: tun_chr_open(): correctly initialize socket uid (bsc#1012628). - tap: tap_open(): correctly initialize socket uid (bsc#1012628). - rxrpc: Fix overwaking on call poking (bsc#1012628). - OPP: fix error checking in opp_migrate_dentry() (bsc#1012628). - cpufreq: davinci: Fix clk use after free (bsc#1012628). - Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds (bsc#1012628). - Bluetooth: L2CAP: Fix potential user-after-free (bsc#1012628). - Bluetooth: hci_qca: get wakeup status from serdev device handle (bsc#1012628). - net: ipa: generic command param fix (bsc#1012628). - s390: vfio-ap: tighten the NIB validity check (bsc#1012628). - s390/ap: fix status returned by ap_aqic() (bsc#1012628). - s390/ap: fix status returned by ap_qact() (bsc#1012628). - libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() (bsc#1012628). - xen/grant-dma-iommu: Implement a dummy probe_device() callback (bsc#1012628). - rds: rds_rm_zerocopy_callback() correct order for list_add_tail() (bsc#1012628). - crypto: rsa-pkcs1pad - Use akcipher_request_complete (bsc#1012628). - m68k: /proc/hardware should depend on PROC_FS (bsc#1012628). - RISC-V: time: initialize hrtimer based broadcast clock event device (bsc#1012628). - clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first use (bsc#1012628). - wifi: iwl3945: Add missing check for create_singlethread_workqueue (bsc#1012628). - wifi: iwl4965: Add missing check for create_singlethread_workqueue() (bsc#1012628). - wifi: brcmfmac: Rename Cypress 89459 to BCM4355 (bsc#1012628). - wifi: brcmfmac: pcie: Add IDs/properties for BCM4355 (bsc#1012628). - wifi: brcmfmac: pcie: Add IDs/properties for BCM4377 (bsc#1012628). - wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection (bsc#1012628). - wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() (bsc#1012628). - wifi: rtw89: fix parsing offset for MCC C2H (bsc#1012628). - selftests/bpf: Fix out-of-srctree build (bsc#1012628). - ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models (bsc#1012628). - ACPI: resource: Do IRQ override on all TongFang GMxRGxx (bsc#1012628). - crypto: octeontx2 - Fix objects shared between several modules (bsc#1012628). - crypto: crypto4xx - Call dma_unmap_page when done (bsc#1012628). - vfio/ccw: remove WARN_ON during shutdown (bsc#1012628). - wifi: mac80211: move color collision detection report in a delayed work (bsc#1012628). - wifi: mac80211: make rate u32 in sta_set_rate_info_rx() (bsc#1012628). - wifi: mac80211: fix non-MLO station association (bsc#1012628). - wifi: mac80211: Don't translate MLD addresses for multicast (bsc#1012628). - wifi: mac80211: avoid u32_encode_bits() warning (bsc#1012628). - wifi: mac80211: fix off-by-one link setting (bsc#1012628). - tools/lib/thermal: Fix thermal_sampling_exit() (bsc#1012628). - thermal/drivers/hisi: Drop second sensor hi3660 (bsc#1012628). - selftests/bpf: Fix map_kptr test (bsc#1012628). - wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() (bsc#1012628). - bpf: Zeroing allocated object from slab in bpf memory allocator (bsc#1012628). - selftests/bpf: Fix xdp_do_redirect on s390x (bsc#1012628). - can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error (bsc#1012628). - can: esd_usb: Make use of can_change_state() and relocate checking skb for NULL (bsc#1012628). - xsk: check IFF_UP earlier in Tx path (bsc#1012628). - LoongArch, bpf: Use 4 instructions for function address in JIT (bsc#1012628). - bpf: Fix global subprog context argument resolution logic (bsc#1012628). - irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts (bsc#1012628). - irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts (bsc#1012628). - net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() (bsc#1012628). - net/smc: fix application data exception (bsc#1012628). - selftests/net: Interpret UDP_GRO cmsg data as an int value (bsc#1012628). - l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() (bsc#1012628). - net: bcmgenet: fix MoCA LED control (bsc#1012628). - net: lan966x: Fix possible deadlock inside PTP (bsc#1012628). - net/mlx4_en: Introduce flexible array to silence overflow warning (bsc#1012628). - net/mlx5e: Align IPsec ASO result memory to be as required by hardware (bsc#1012628). - selftest: fib_tests: Always cleanup before exit (bsc#1012628). - sefltests: netdevsim: wait for devlink instance after netns removal (bsc#1012628). - drm: Fix potential null-ptr-deref due to drmm_mode_config_init() (bsc#1012628). - drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats (bsc#1012628). - drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec (bsc#1012628). - drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC (bsc#1012628). - drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC (bsc#1012628). - drm/bridge: megachips: Fix error handling in i2c_register_driver() (bsc#1012628). - drm/vkms: Fix memory leak in vkms_init() (bsc#1012628). - drm/vkms: Fix null-ptr-deref in vkms_release() (bsc#1012628). - drm/modes: Use strscpy() to copy command-line mode name (bsc#1012628). - drm/vc4: dpi: Fix format mapping for RGB565 (bsc#1012628). - drm/bridge: it6505: Guard bridge power in IRQ handler (bsc#1012628). - drm: tidss: Fix pixel format definition (bsc#1012628). - gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() (bsc#1012628). - drm/ast: Init iosys_map pointer as I/O memory for damage handling (bsc#1012628). - drm/vc4: drop all currently held locks if deadlock happens (bsc#1012628). - hwmon: (ftsteutates) Fix scaling of measurements (bsc#1012628). - drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init() (bsc#1012628). - drm/msm/hdmi: Add missing check for alloc_ordered_workqueue (bsc#1012628). - pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins (bsc#1012628). - pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain (bsc#1012628). - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (bsc#1012628). - drm/vc4: hvs: Configure the HVS COB allocations (bsc#1012628). - drm/vc4: hvs: Set AXI panic modes (bsc#1012628). - drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4 (bsc#1012628). - drm/vc4: hvs: Correct interrupt masking bit assignment for HVS5 (bsc#1012628). - drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 (bsc#1012628). - drm/vc4: hdmi: Correct interlaced timings again (bsc#1012628). - drm/msm: clean event_thread->worker in case of an error (bsc#1012628). - drm/panel-edp: fix name for IVO product id 854b (bsc#1012628). - scsi: qla2xxx: Fix exchange oversubscription (bsc#1012628). - scsi: qla2xxx: Fix exchange oversubscription for management commands (bsc#1012628). - scsi: qla2xxx: edif: Fix clang warning (bsc#1012628). - ASoC: fsl_sai: initialize is_dsp_mode flag (bsc#1012628). - drm/bridge: tc358767: Set default CLRSIPO count (bsc#1012628). - drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() (bsc#1012628). - ALSA: hda/ca0132: minor fix for allocation size (bsc#1012628). - drm/amdgpu: Use the sched from entity for amdgpu_cs trace (bsc#1012628). - drm/msm/gem: Add check for kmalloc (bsc#1012628). - drm/msm/dpu: Disallow unallocated resources to be returned (bsc#1012628). - drm/bridge: lt9611: fix sleep mode setup (bsc#1012628). - drm/bridge: lt9611: fix HPD reenablement (bsc#1012628). - drm/bridge: lt9611: fix polarity programming (bsc#1012628). - drm/bridge: lt9611: fix programming of video modes (bsc#1012628). - drm/bridge: lt9611: fix clock calculation (bsc#1012628). - drm/bridge: lt9611: pass a pointer to the of node (bsc#1012628). - regulator: tps65219: use IS_ERR() to detect an error pointer (bsc#1012628). - drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness (bsc#1012628). - drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags (bsc#1012628). - drm/msm/dsi: Allow 2 CTRLs on v2.5.0 (bsc#1012628). - scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096 (bsc#1012628). - drm/msm/dpu: sc7180: add missing WB2 clock control (bsc#1012628). - drm/msm: use strscpy instead of strncpy (bsc#1012628). - drm/msm/dpu: Add check for cstate (bsc#1012628). - drm/msm/dpu: Add check for pstates (bsc#1012628). - drm/msm/mdp5: Add check for kzalloc (bsc#1012628). - habanalabs: bugs fixes in timestamps buff alloc (bsc#1012628). - pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback() (bsc#1012628). - pinctrl: mediatek: Initialize variable pullen and pullup to zero (bsc#1012628). - pinctrl: mediatek: Initialize variable *buf to zero (bsc#1012628). - gpu: host1x: Fix mask for syncpoint increment register (bsc#1012628). - gpu: host1x: Don't skip assigning syncpoints to channels (bsc#1012628). - drm/tegra: firewall: Check for is_addr_reg existence in IMM check (bsc#1012628). - drm/i915/mtl: Add initial gt workarounds (bsc#1012628). - drm/i915/xehp: GAM registers don't need to be re-applied on engine resets (bsc#1012628). - pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as interrupts (bsc#1012628). - drm/i915/xehp: Annotate a couple more workaround registers as MCR (bsc#1012628). - drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update() (bsc#1012628). - drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd (bsc#1012628). - drm/mediatek: Use NULL instead of 0 for NULL pointer (bsc#1012628). - drm/mediatek: Drop unbalanced obj unref (bsc#1012628). - drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc (bsc#1012628). - drm/mediatek: Clean dangling pointer on bind error path (bsc#1012628). - ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() (bsc#1012628). - dt-bindings: display: mediatek: Fix the fallback for mediatek,mt8186-disp-ccorr (bsc#1012628). - gpio: pca9570: rename platform_data to chip_data (bsc#1012628). - gpio: vf610: connect GPIO label to dev name (bsc#1012628). - ASoC: topology: Properly access value coming from topology file (bsc#1012628). - spi: dw_bt1: fix MUX_MMIO dependencies (bsc#1012628). - ASoC: mchp-spdifrx: fix controls which rely on rsr register (bsc#1012628). - ASoC: mchp-spdifrx: fix return value in case completion times out (bsc#1012628). - ASoC: mchp-spdifrx: fix controls that works with completion mechanism (bsc#1012628). - ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove() (bsc#1012628). - dm: improve shrinker debug names (bsc#1012628). - regmap: apply reg_base and reg_downshift for single register ops (bsc#1012628). - accel: fix CONFIG_DRM dependencies (bsc#1012628). - ASoC: rsnd: fixup #endif position (bsc#1012628). - ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params() (bsc#1012628). - ASoC: dt-bindings: meson: fix gx-card codec node regex (bsc#1012628). - regulator: tps65219: use generic set_bypass() (bsc#1012628). - hwmon: (asus-ec-sensors) add missing mutex path (bsc#1012628). - hwmon: (ltc2945) Handle error case in ltc2945_value_store (bsc#1012628). - ALSA: hda: Fix the control element identification for multiple codecs (bsc#1012628). - drm/amdgpu: fix enum odm_combine_mode mismatch (bsc#1012628). - scsi: mpt3sas: Fix a memory leak (bsc#1012628). - scsi: aic94xx: Add missing check for dma_map_single() (bsc#1012628). - HID: multitouch: Add quirks for flipped axes (bsc#1012628). - HID: retain initial quirks set up when creating HID devices (bsc#1012628). - ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared (bsc#1012628). - ASoC: qcom: q6apm-dai: fix race condition while updating the position pointer (bsc#1012628). - ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag (bsc#1012628). - ASoC: codecs: lpass: register mclk after runtime pm (bsc#1012628). - ASoC: codecs: lpass: fix incorrect mclk rate (bsc#1012628). - drm/amd/display: don't call dc_interrupt_set() for disabled crtcs (bsc#1012628). - HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support (bsc#1012628). - spi: bcm63xx-hsspi: Fix multi-bit mode setting (bsc#1012628). - hwmon: (mlxreg-fan) Return zero speed for broken fan (bsc#1012628). - ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init (bsc#1012628). - dm: remove flush_scheduled_work() during local_exit() (bsc#1012628). - nfs4trace: fix state manager flag printing (bsc#1012628). - NFS: fix disabling of swap (bsc#1012628). - drm/i915/pvc: Implement recommended caching policy (bsc#1012628). - drm/i915/pvc: Annotate two more workaround/tuning registers as MCR (bsc#1012628). - drm/i915: Fix GEN8_MISCCPCTL (bsc#1012628). - spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() (bsc#1012628). - ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared (bsc#1012628). - HID: bigben: use spinlock to protect concurrent accesses (bsc#1012628). - HID: bigben_worker() remove unneeded check on report_field (bsc#1012628). - HID: bigben: use spinlock to safely schedule workers (bsc#1012628). - hid: bigben_probe(): validate report count (bsc#1012628). - ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks (bsc#1012628). - drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() (bsc#1012628). - NFSD: enhance inter-server copy cleanup (bsc#1012628). - NFSD: fix leaked reference count of nfsd4_ssc_umount_item (bsc#1012628). - nfsd: fix race to check ls_layouts (bsc#1012628). - nfsd: clean up potential nfsd_file refcount leaks in COPY codepath (bsc#1012628). - NFSD: fix problems with cleanup on errors in nfsd4_copy (bsc#1012628). - nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open (bsc#1012628). - nfsd: don't fsync nfsd_files on last close (bsc#1012628). - NFSD: copy the whole verifier in nfsd_copy_write_verifier (bsc#1012628). - cifs: Fix lost destroy smbd connection when MR allocate failed (bsc#1012628). - cifs: Fix warning and UAF when destroy the MR list (bsc#1012628). - cifs: use tcon allocation functions even for dummy tcon (bsc#1012628). - gfs2: jdata writepage fix (bsc#1012628). - perf llvm: Fix inadvertent file creation (bsc#1012628). - leds: led-core: Fix refcount leak in of_led_get() (bsc#1012628). - leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest() (bsc#1012628). - leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing driver (bsc#1012628). - tools/tracing/rtla: osnoise_hist: use total duration for average calculation (bsc#1012628). - perf inject: Use perf_data__read() for auxtrace (bsc#1012628). - perf intel-pt: Do not try to queue auxtrace data on pipe (bsc#1012628). - perf stat: Hide invalid uncore event output for aggr mode (bsc#1012628). - perf jevents: Correct bad character encoding (bsc#1012628). - perf test bpf: Skip test if kernel-debuginfo is not present (bsc#1012628). - perf tools: Fix auto-complete on aarch64 (bsc#1012628). - perf stat: Avoid merging/aggregating metric counts twice (bsc#1012628). - sparc: allow PM configs for sparc32 COMPILE_TEST (bsc#1012628). - selftests: find echo binary to use -ne options (bsc#1012628). - selftests/ftrace: Fix bash specific "==" operator (bsc#1012628). - selftests: use printf instead of echo -ne (bsc#1012628). - perf record: Fix segfault with --overwrite and --max-size (bsc#1012628). - printf: fix errname.c list (bsc#1012628). - perf tests stat_all_metrics: Change true workload to sleep workload for system wide check (bsc#1012628). - objtool: add UACCESS exceptions for __tsan_volatile_read/write (bsc#1012628). - selftests/ftrace: Fix probepoint testcase to ignore __pfx_* symbols (bsc#1012628). - sysctl: fix proc_dobool() usability (bsc#1012628). - mfd: rk808: Re-add rk808-clkout to RK818 (bsc#1012628). - mfd: cs5535: Don't build on UML (bsc#1012628). - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() (bsc#1012628). - dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 (bsc#1012628). - RDMA/erdma: Fix refcount leak in erdma_mmap (bsc#1012628). - dmaengine: HISI_DMA should depend on ARCH_HISI (bsc#1012628). - RDMA/hns: Fix refcount leak in hns_roce_mmap (bsc#1012628). - iio: light: tsl2563: Do not hardcode interrupt trigger type (bsc#1012628). - usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe() (bsc#1012628). - i2c: designware: fix i2c_dw_clk_rate() return size to be u32 (bsc#1012628). - i2c: qcom-geni: change i2c_master_hub to static (bsc#1012628). - soundwire: cadence: Don't overflow the command FIFOs (bsc#1012628). - driver core: fix potential null-ptr-deref in device_add() (bsc#1012628). - kobject: Fix slab-out-of-bounds in fill_kobj_path() (bsc#1012628). - alpha/boot/tools/objstrip: fix the check for ELF header (bsc#1012628). - media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible() (bsc#1012628). - media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU (bsc#1012628). - media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX (bsc#1012628). - media: uvcvideo: Refactor power_line_frequency_controls_limited (bsc#1012628). - coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR (bsc#1012628). - coresight: cti: Prevent negative values of enable count (bsc#1012628). - coresight: cti: Add PM runtime call in enable_store (bsc#1012628). - usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count (bsc#1012628). - PCI/IOV: Enlarge virtfn sysfs name buffer (bsc#1012628). - PCI: switchtec: Return -EFAULT for copy_to_user() errors (bsc#1012628). - PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws kernel-doc (bsc#1012628). - hwtracing: hisi_ptt: Only add the supported devices to the filters list (bsc#1012628). - tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() (bsc#1012628). - tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown() (bsc#1012628). - serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init() (bsc#1012628). - Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol" (bsc#1012628). - eeprom: idt_89hpesx: Fix error handling in idt_init() (bsc#1012628). - applicom: Fix PCI device refcount leak in applicom_init() (bsc#1012628). - firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() (bsc#1012628). - firmware: stratix10-svc: fix error handle while alloc/add device failed (bsc#1012628). - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (bsc#1012628). - mei: pxp: Use correct macros to initialize uuid_le (bsc#1012628). - misc/mei/hdcp: Use correct macros to initialize uuid_le (bsc#1012628). - misc: fastrpc: Fix an error handling path in fastrpc_rpmsg_probe() (bsc#1012628). - iommu/exynos: Fix error handling in exynos_iommu_init() (bsc#1012628). - driver core: fix resource leak in device_add() (bsc#1012628). - driver core: location: Free struct acpi_pld_info *pld before return false (bsc#1012628). - drivers: base: transport_class: fix possible memory leak (bsc#1012628). - drivers: base: transport_class: fix resource leak when transport_add_device() fails (bsc#1012628). - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (bsc#1012628). - selftests: iommu: Fix test_cmd_destroy_access() call in user_copy (bsc#1012628). - iommufd: Add three missing structures in ucmd_buffer (bsc#1012628). - fotg210-udc: Add missing completion handler (bsc#1012628). - dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers (bsc#1012628). - fpga: microchip-spi: move SPI I/O buffers out of stack (bsc#1012628). - fpga: microchip-spi: rewrite status polling in a time measurable way (bsc#1012628). - usb: early: xhci-dbc: Fix a potential out-of-bound memory access (bsc#1012628). - tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case (bsc#1012628). - RDMA/cxgb4: add null-ptr-check after ip_dev_find() (bsc#1012628). - usb: musb: mediatek: don't unregister something that wasn't registered (bsc#1012628). - usb: gadget: configfs: Restrict symlink creation is UDC already binded (bsc#1012628). - phy: mediatek: remove temporary variable @mask_ (bsc#1012628). - PCI: mt7621: Delay phy ports initialization (bsc#1012628). - iommu/vt-d: Set No Execute Enable bit in PASID table entry (bsc#1012628). - power: supply: remove faulty cooling logic (bsc#1012628). - RDMA/siw: Fix user page pinning accounting (bsc#1012628). - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() (bsc#1012628). - usb: max-3421: Fix setting of I/O pins (bsc#1012628). - RDMA/irdma: Cap MSIX used to online CPUs + 1 (bsc#1012628). - serial: fsl_lpuart: fix RS485 RTS polariy inverse issue (bsc#1012628). - tty: serial: imx: disable Ageing Timer interrupt request irq (bsc#1012628). - driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links (bsc#1012628). - driver core: fw_devlink: Don't purge child fwnode's consumer links (bsc#1012628). - driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle (bsc#1012628). - driver core: fw_devlink: Consolidate device link flag computation (bsc#1012628). - driver core: fw_devlink: Improve check for fwnode with no device/driver (bsc#1012628). - driver core: fw_devlink: Make cycle detection more robust (bsc#1012628). - mtd: mtdpart: Don't create platform device that'll never probe (bsc#1012628). - usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev (bsc#1012628). - dmaengine: dw-edma: Fix readq_ch() return value truncation (bsc#1012628). - PCI: Fix dropping valid root bus resources with .end = zero (bsc#1012628). - phy: rockchip-typec: fix tcphy_get_mode error case (bsc#1012628). - PCI: qcom: Fix host-init error handling (bsc#1012628). - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (bsc#1012628). - iommu: Fix error unwind in iommu_group_alloc() (bsc#1012628). - iommu/amd: Do not identity map v2 capable device when snp is enabled (bsc#1012628). - dmaengine: sf-pdma: pdma_desc memory leak fix (bsc#1012628). - dmaengine: dw-axi-dmac: Do not dereference NULL structure (bsc#1012628). - dmaengine: ptdma: check for null desc before calling pt_cmd_callback (bsc#1012628). - iommu/vt-d: Fix error handling in sva enable/disable paths (bsc#1012628). - iommu/vt-d: Allow to use flush-queue when first level is default (bsc#1012628). - RDMA/rxe: Cleanup mr_check_range (bsc#1012628). - RDMA/rxe: Move rxe_map_mr_sg to rxe_mr.c (bsc#1012628). - RDMA-rxe: Isolate mr code from atomic_reply() (bsc#1012628). - RDMA-rxe: Isolate mr code from atomic_write_reply() (bsc#1012628). - RDMA/rxe: Cleanup page variables in rxe_mr.c (bsc#1012628). - RDMA/rxe: Replace rxe_map and rxe_phys_buf by xarray (bsc#1012628). - Subject: RDMA/rxe: Handle zero length rdma (bsc#1012628). - RDMA/mana_ib: Fix a bug when the PF indicates more entries for registering memory on first packet (bsc#1012628). - RDMA/rxe: Fix missing memory barriers in rxe_queue.h (bsc#1012628). - IB/hfi1: Fix math bugs in hfi1_can_pin_pages() (bsc#1012628). - IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors (bsc#1012628). - Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after use" (bsc#1012628). - remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers (bsc#1012628). - media: ti: cal: fix possible memory leak in cal_ctx_create() (bsc#1012628). - media: platform: ti: Add missing check for devm_regulator_get (bsc#1012628). - media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in imx7_csi_init() (bsc#1012628). - powerpc: Remove linker flag from KBUILD_AFLAGS (bsc#1012628). - s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64 (bsc#1012628). - builddeb: clean generated package content (bsc#1012628). - media: max9286: Fix memleak in max9286_v4l2_register() (bsc#1012628). - media: ov2740: Fix memleak in ov2740_init_controls() (bsc#1012628). - media: ov5675: Fix memleak in ov5675_init_controls() (bsc#1012628). - media: i2c: tc358746: fix missing return assignment (bsc#1012628). - media: i2c: tc358746: fix ignoring read error in g_register callback (bsc#1012628). - media: i2c: tc358746: fix possible endianness issue (bsc#1012628). - media: ov5640: Fix soft reset sequence and timings (bsc#1012628). - media: ov5640: Handle delays when no reset_gpio set (bsc#1012628). - media: mc: Get media_device directly from pad (bsc#1012628). - media: i2c: ov772x: Fix memleak in ov772x_probe() (bsc#1012628). - media: i2c: imx219: Split common registers from mode tables (bsc#1012628). - media: i2c: imx219: Fix binning for RAW8 capture (bsc#1012628). - media: platform: mtk-mdp3: Fix return value check in mdp_probe() (bsc#1012628). - media: camss: csiphy-3ph: avoid undefined behavior (bsc#1012628). - media: platform: mtk-mdp3: fix Kconfig dependencies (bsc#1012628). - media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data (bsc#1012628). - media: v4l2-jpeg: ignore the unknown APP14 marker (bsc#1012628). - media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399 (bsc#1012628). - media: imx-jpeg: Apply clk_bulk api instead of operating specific clk (bsc#1012628). - media: amphion: correct the unspecified color space (bsc#1012628). - media: drivers/media/v4l2-core/v4l2-h264 : add detection of null pointers (bsc#1012628). - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (bsc#1012628). - media: atomisp: fix videobuf2 Kconfig depenendency (bsc#1012628). - media: atomisp: Only set default_run_mode on first open of a stream/asd (bsc#1012628). - media: i2c: ov7670: 0 instead of -EINVAL was returned (bsc#1012628). - media: usb: siano: Fix use after free bugs caused by do_submit_urb (bsc#1012628). - media: saa7134: Use video_unregister_device for radio_dev (bsc#1012628). - rpmsg: glink: Avoid infinite loop on intent for missing channel (bsc#1012628). - rpmsg: glink: Release driver_override (bsc#1012628). - ARM: OMAP2+: omap4-common: Fix refcount leak bug (bsc#1012628). - arm64: dts: qcom: msm8996: Add additional A2NoC clocks (bsc#1012628). - udf: Define EFSCORRUPTED error code (bsc#1012628). - context_tracking: Fix noinstr vs KASAN (bsc#1012628). - exit: Detect and fix irq disabled state in oops (bsc#1012628). - ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy (bsc#1012628). - fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected (bsc#1012628). - blk-iocost: fix divide by 0 error in calc_lcoefs() (bsc#1012628). - blk-cgroup: dropping parent refcount after pd_free_fn() is done (bsc#1012628). - blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy() (bsc#1012628). - trace/blktrace: fix memory leak with using debugfs_lookup() (bsc#1012628). - btrfs: scrub: improve tree block error reporting (bsc#1012628). - arm64: zynqmp: Enable hs termination flag for USB dwc3 controller (bsc#1012628). - cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE (bsc#1012628). - x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads (bsc#1012628). - cpuidle: drivers: firmware: psci: Dont instrument suspend code (bsc#1012628). - cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG (bsc#1012628). - perf/x86/intel/uncore: Add Meteor Lake support (bsc#1012628). - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() (bsc#1012628). - wifi: ath11k: fix monitor mode bringup crash (bsc#1012628). - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1012628). - rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks (bsc#1012628). - rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() (bsc#1012628). - srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL (bsc#1012628). - rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug (bsc#1012628). - rcu-tasks: Handle queue-shrink/callback-enqueue race condition (bsc#1012628). - wifi: ath11k: debugfs: fix to work with multiple PCI devices (bsc#1012628). - thermal: intel: Fix unsigned comparison with less than zero (bsc#1012628). - timers: Prevent union confusion from unexpected restart_syscall() (bsc#1012628). - x86/bugs: Reset speculation control settings on init (bsc#1012628). - bpftool: Always disable stack protection for BPF objects (bsc#1012628). - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds (bsc#1012628). - wifi: rtw89: fix assignation of TX BD RAM table (bsc#1012628). - wifi: mt7601u: fix an integer underflow (bsc#1012628). - inet: fix fast path in __inet_hash_connect() (bsc#1012628). - ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB (bsc#1012628). - ice: add missing checks for PF vsi type (bsc#1012628). - Compiler attributes: GCC cold function alignment workarounds (bsc#1012628). - ACPI: Don't build ACPICA with '-Os' (bsc#1012628). - bpf, docs: Fix modulo zero, division by zero, overflow, and underflow (bsc#1012628). - thermal: intel: intel_pch: Add support for Wellsburg PCH (bsc#1012628). - clocksource: Suspend the watchdog temporarily when high read latency detected (bsc#1012628). - crypto: hisilicon: Wipe entire pool on error (bsc#1012628). - net: bcmgenet: Add a check for oversized packets (bsc#1012628). - m68k: Check syscall_trace_enter() return code (bsc#1012628). - s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping (bsc#1012628). - netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() (bsc#1012628). - can: isotp: check CAN address family in isotp_bind() (bsc#1012628). - gcc-plugins: drop -std=gnu++11 to fix GCC 13 build (bsc#1012628). - tools/power/x86/intel-speed-select: Add Emerald Rapid quirk (bsc#1012628). - platform/x86: dell-ddv: Add support for interface version 3 (bsc#1012628). - wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup (bsc#1012628). - ACPI: video: Fix Lenovo Ideapad Z570 DMI match (bsc#1012628). - net/mlx5: fw_tracer: Fix debug print (bsc#1012628). - coda: Avoid partial allocation of sig_inputArgs (bsc#1012628). - uaccess: Add minimum bounds check on kernel buffer size (bsc#1012628). - s390/idle: mark arch_cpu_idle() noinstr (bsc#1012628). - time/debug: Fix memory leak with using debugfs_lookup() (bsc#1012628). - PM: domains: fix memory leak with using debugfs_lookup() (bsc#1012628). - PM: EM: fix memory leak with using debugfs_lookup() (bsc#1012628). - Bluetooth: Fix issue with Actions Semi ATS2851 based devices (bsc#1012628). - Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921 (bsc#1012628). - Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE (bsc#1012628). - wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30 (bsc#1012628). - hv_netvsc: Check status in SEND_RNDIS_PKT completion message (bsc#1012628). - s390/kfence: fix page fault reporting (bsc#1012628). - devlink: Fix TP_STRUCT_entry in trace of devlink health report (bsc#1012628). - scm: add user copy checks to put_cmsg() (bsc#1012628). - drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F (bsc#1012628). - drm: panel-orientation-quirks: Add quirk for DynaBook K50 (bsc#1012628). - drm/amd/display: Reduce expected sdp bandwidth for dcn321 (bsc#1012628). - drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write (bsc#1012628). - drm/amd/display: Fix potential null-deref in dm_resume (bsc#1012628). - drm/omap: dsi: Fix excessive stack usage (bsc#1012628). - HID: Add Mapping for System Microphone Mute (bsc#1012628). - drm/tiny: ili9486: Do not assume 8-bit only SPI controllers (bsc#1012628). - drm/amd/display: Defer DIG FIFO disable after VID stream enable (bsc#1012628). - drm/radeon: free iio for atombios when driver shutdown (bsc#1012628). - drm/amd: Avoid BUG() for case of SRIOV missing IP version (bsc#1012628). - drm/amdkfd: Page aligned memory reserve size (bsc#1012628). - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (bsc#1012628). - Revert "fbcon: don't lose the console font across generic->chip driver switch" (bsc#1012628). - drm/amd: Avoid ASSERT for some message failures (bsc#1012628). - drm: amd: display: Fix memory leakage (bsc#1012628). - drm/amd/display: fix mapping to non-allocated address (bsc#1012628). - HID: uclogic: Add frame type quirk (bsc#1012628). - HID: uclogic: Add battery quirk (bsc#1012628). - HID: uclogic: Add support for XP-PEN Deco Pro SW (bsc#1012628). - HID: uclogic: Add support for XP-PEN Deco Pro MW (bsc#1012628). - drm/msm/dsi: Add missing check for alloc_ordered_workqueue (bsc#1012628). - drm: rcar-du: Add quirk for H3 ES1.x pclk workaround (bsc#1012628). - drm: rcar-du: Fix setting a reserved bit in DPLLCR (bsc#1012628). - drm/drm_print: correct format problem (bsc#1012628). - drm/amd/display: Set hvm_enabled flag for S/G mode (bsc#1012628). - drm/client: Test for connectors before sending hotplug event (bsc#1012628). - habanalabs: extend fatal messages to contain PCI info (bsc#1012628). - habanalabs: fix bug in timestamps registration code (bsc#1012628). - docs/scripts/gdb: add necessary make scripts_gdb step (bsc#1012628). - drm/msm/dpu: Add DSC hardware blocks to register snapshot (bsc#1012628). - ASoC: soc-compress: Reposition and add pcm_mutex (bsc#1012628). - ASoC: kirkwood: Iterate over array indexes instead of using pointer math (bsc#1012628). - regulator: max77802: Bounds check regulator id against opmode (bsc#1012628). - regulator: s5m8767: Bounds check id indexing into arrays (bsc#1012628). - Revert "drm/amdgpu: TA unload messages are not actually sent to psp when amdgpu is uninstalled" (bsc#1012628). - drm/amd/display: fix FCLK pstate change underflow (bsc#1012628). - gfs2: Improve gfs2_make_fs_rw error handling (bsc#1012628). - hwmon: (coretemp) Simplify platform device handling (bsc#1012628). - hwmon: (nct6775) Directly call ASUS ACPI WMI method (bsc#1012628). - hwmon: (nct6775) B650/B660/X670 ASUS boards support (bsc#1012628). - pinctrl: at91: use devm_kasprintf() to avoid potential leaks (bsc#1012628). - drm/amd/display: Do not commit pipe when updating DRR (bsc#1012628). - scsi: snic: Fix memory leak with using debugfs_lookup() (bsc#1012628). - scsi: ufs: core: Fix device management cmd timeout flow (bsc#1012628). - HID: logitech-hidpp: Don't restart communication if not necessary (bsc#1012628). - drm/amd/display: Enable P-state validation checks for DCN314 (bsc#1012628). - drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 (bsc#1012628). - drm/amd/display: Disable HUBP/DPP PG on DCN314 for now (bsc#1012628). - drm/amd/display: disable SubVP + DRR to prevent underflow (bsc#1012628). - dm thin: add cond_resched() to various workqueue loops (bsc#1012628). - dm cache: add cond_resched() to various workqueue loops (bsc#1012628). - nfsd: zero out pointers after putting nfsd_files on COPY setup error (bsc#1012628). - nfsd: don't hand out delegation on setuid files being opened for write (bsc#1012628). - cifs: prevent data race in smb2_reconnect() (bsc#1012628). - drm/i915/mtl: Correct implementation of Wa_18018781329 (bsc#1012628). - drm/shmem-helper: Revert accidental non-GPL export (bsc#1012628). - driver core: fw_devlink: Avoid spurious error message (bsc#1012628). - wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu (bsc#1012628). - firmware: coreboot: framebuffer: Ignore reserved pixel color bits (bsc#1012628). - block: don't allow multiple bios for IOCB_NOWAIT issue (bsc#1012628). - block: clear bio->bi_bdev when putting a bio back in the cache (bsc#1012628). - block: be a bit more careful in checking for NULL bdev while polling (bsc#1012628). - rtc: pm8xxx: fix set-alarm race (bsc#1012628). - ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms' (bsc#1012628). - ipmi:ssif: resend_msg() cannot fail (bsc#1012628). - ipmi_ssif: Rename idle state and check (bsc#1012628). - ipmi:ssif: Add a timer between request retries (bsc#1012628). - io_uring: Replace 0-length array with flexible array (bsc#1012628). - io_uring: use user visible tail in io_uring_poll() (bsc#1012628). - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work (bsc#1012628). - io_uring: add a conditional reschedule to the IOPOLL cancelation loop (bsc#1012628). - io_uring: add reschedule point to handle_tw_list() (bsc#1012628). - io_uring/rsrc: disallow multi-source reg buffers (bsc#1012628). - io_uring: remove MSG_NOSIGNAL from recvmsg (bsc#1012628). - io_uring/poll: allow some retries for poll triggering spuriously (bsc#1012628). - io_uring: fix fget leak when fs don't support nowait buffered read (bsc#1012628). - s390/extmem: return correct segment type in __segment_load() (bsc#1012628). - s390: discard .interp section (bsc#1012628). - s390/ipl: add DEFINE_GENERIC_LOADPARM() (bsc#1012628). - s390/ipl: add loadparm parameter to eckd ipl/reipl data (bsc#1012628). - s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler (bsc#1012628). - s390/kprobes: fix current_kprobe never cleared after kprobes reenter (bsc#1012628). - KVM: s390: disable migration mode when dirty tracking is disabled (bsc#1012628). - cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID (bsc#1012628). - cifs: Fix uninitialized memory read in smb3_qfs_tcon() (bsc#1012628). - cifs: Fix uninitialized memory reads for oparms.mode (bsc#1012628). - cifs: fix mount on old smb servers (bsc#1012628). - cifs: introduce cifs_io_parms in smb2_async_writev() (bsc#1012628). - cifs: split out smb3_use_rdma_offload() helper (bsc#1012628). - cifs: don't try to use rdma offload on encrypted connections (bsc#1012628). - cifs: Check the lease context if we actually got a lease (bsc#1012628). - cifs: return a single-use cfid if we did not get a lease (bsc#1012628). - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization (bsc#1012628). - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() (bsc#1012628). - scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi (bsc#1012628). - btrfs: hold block group refcount during async discard (bsc#1012628). - btrfs: sysfs: update fs features directory asynchronously (bsc#1012628). - locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath (bsc#1012628). - ksmbd: fix wrong data area length for smb2 lock request (bsc#1012628). - ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length (bsc#1012628). - ksmbd: fix possible memory leak in smb2_lock() (bsc#1012628). - torture: Fix hang during kthread shutdown phase (bsc#1012628). - ARM: dts: exynos: correct HDMI phy compatible in Exynos4 (bsc#1012628). - io_uring: mark task TASK_RUNNING before handling resume/task work (bsc#1012628). - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create (bsc#1012628). - fs: hfsplus: fix UAF issue in hfsplus_put_super (bsc#1012628). - exfat: fix reporting fs error when reading dir beyond EOF (bsc#1012628). - exfat: fix unexpected EOF while reading dir (bsc#1012628). - exfat: redefine DIR_DELETED as the bad cluster number (bsc#1012628). - exfat: fix inode->i_blocks for non-512 byte sector size device (bsc#1012628). - fs: dlm: start midcomms before scand (bsc#1012628). - fs: dlm: fix use after free in midcomms commit (bsc#1012628). - fs: dlm: be sure to call dlm_send_queue_flush() (bsc#1012628). - fs: dlm: fix race setting stop tx flag (bsc#1012628). - fs: dlm: don't set stop rx flag after node reset (bsc#1012628). - fs: dlm: move sending fin message into state change handling (bsc#1012628). - fs: dlm: send FIN ack back in right cases (bsc#1012628). - f2fs: fix information leak in f2fs_move_inline_dirents() (bsc#1012628). - f2fs: retry to update the inode page given data corruption (bsc#1012628). - f2fs: fix cgroup writeback accounting with fs-layer encryption (bsc#1012628). - f2fs: fix kernel crash due to null io->bio (bsc#1012628). - f2fs: Revert "f2fs: truncate blocks in batch in __complete_revoke_list()" (bsc#1012628). - ocfs2: fix defrag path triggering jbd2 ASSERT (bsc#1012628). - ocfs2: fix non-auto defrag path not working issue (bsc#1012628). - fs/cramfs/inode.c: initialize file_ra_state (bsc#1012628). - selftests/landlock: Skip overlayfs tests when not supported (bsc#1012628). - selftests/landlock: Test ptrace as much as possible with Yama (bsc#1012628). - udf: Truncate added extents on failed expansion (bsc#1012628). - udf: Do not bother merging very long extents (bsc#1012628). - udf: Do not update file length for failed writes to inline files (bsc#1012628). - udf: Preserve link count of system files (bsc#1012628). - udf: Detect system inodes linked into directory hierarchy (bsc#1012628). - udf: Fix file corruption when appending just after end of preallocated extent (bsc#1012628). - md: don't update recovery_cp when curr_resync is ACTIVE (bsc#1012628). - KVM: Destroy target device if coalesced MMIO unregistration fails (bsc#1012628). - KVM: VMX: Fix crash due to uninitialized current_vmcs (bsc#1012628). - KVM: Register /dev/kvm as the _very_ last thing during initialization (bsc#1012628). - KVM: x86: Purge "highest ISR" cache when updating APICv state (bsc#1012628). - KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps (bsc#1012628). - KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is disabled (bsc#1012628). - KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID (bsc#1012628). - KVM: SVM: Flush the "current" TLB when activating AVIC (bsc#1012628). - KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target (bsc#1012628). - KVM: SVM: Don't put/load AVIC when setting virtual APIC mode (bsc#1012628). - KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI (bsc#1012628). - KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32 (bsc#1012628). - KVM: SVM: Fix potential overflow in SEV's send|receive_update_data() (bsc#1012628). - KVM: SVM: hyper-v: placate modpost section mismatch error (bsc#1012628). - selftests: x86: Fix incorrect kernel headers search path (bsc#1012628). - x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) (bsc#1012628). - x86/crash: Disable virt in core NMI crash handler to avoid double shootdown (bsc#1012628). - x86/reboot: Disable virtualization in an emergency if SVM is supported (bsc#1012628). - x86/reboot: Disable SVM, not just VMX, when stopping CPUs (bsc#1012628). - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic (bsc#1012628). - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range (bsc#1012628). - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter (bsc#1012628). - x86/microcode/AMD: Add a @cpu parameter to the reloading functions (bsc#1012628). - x86/microcode/AMD: Fix mixed steppings support (bsc#1012628). - x86/speculation: Allow enabling STIBP with legacy IBRS (bsc#1012628). - Documentation/hw-vuln: Document the interaction between IBRS and STIBP (bsc#1012628). - virt/sev-guest: Return -EIO if certificate buffer is not large enough (bsc#1012628). - brd: mark as nowait compatible (bsc#1012628). - brd: return 0/-error from brd_insert_page() (bsc#1012628). - brd: check for REQ_NOWAIT and set correct page allocation mask (bsc#1012628). - ima: fix error handling logic when file measurement failed (bsc#1012628). - ima: Align ima_file_mmap() parameters with mmap_file LSM hook (bsc#1012628). - selftests/powerpc: Fix incorrect kernel headers search path (bsc#1012628). - selftests/ftrace: Fix eprobe syntax test case to check filter support (bsc#1012628). - selftests: sched: Fix incorrect kernel headers search path (bsc#1012628). - selftests: core: Fix incorrect kernel headers search path (bsc#1012628). - selftests: pid_namespace: Fix incorrect kernel headers search path (bsc#1012628). - selftests: arm64: Fix incorrect kernel headers search path (bsc#1012628). - selftests: clone3: Fix incorrect kernel headers search path (bsc#1012628). - selftests: pidfd: Fix incorrect kernel headers search path (bsc#1012628). - selftests: membarrier: Fix incorrect kernel headers search path (bsc#1012628). - selftests: kcmp: Fix incorrect kernel headers search path (bsc#1012628). - selftests: media_tests: Fix incorrect kernel headers search path (bsc#1012628). - selftests: gpio: Fix incorrect kernel headers search path (bsc#1012628). - selftests: filesystems: Fix incorrect kernel headers search path (bsc#1012628). - selftests: user_events: Fix incorrect kernel headers search path (bsc#1012628). - selftests: ptp: Fix incorrect kernel headers search path (bsc#1012628). - selftests: sync: Fix incorrect kernel headers search path (bsc#1012628). - selftests: rseq: Fix incorrect kernel headers search path (bsc#1012628). - selftests: move_mount_set_group: Fix incorrect kernel headers search path (bsc#1012628). - selftests: mount_setattr: Fix incorrect kernel headers search path (bsc#1012628). - selftests: perf_events: Fix incorrect kernel headers search path (bsc#1012628). - selftests: ipc: Fix incorrect kernel headers search path (bsc#1012628). - selftests: futex: Fix incorrect kernel headers search path (bsc#1012628). - selftests: drivers: Fix incorrect kernel headers search path (bsc#1012628). - selftests: dmabuf-heaps: Fix incorrect kernel headers search path (bsc#1012628). - selftests: vm: Fix incorrect kernel headers search path (bsc#1012628). - selftests: seccomp: Fix incorrect kernel headers search path (bsc#1012628). - irqdomain: Fix association race (bsc#1012628). - irqdomain: Fix disassociation race (bsc#1012628). - irqdomain: Look for existing mapping only once (bsc#1012628). - irqdomain: Drop bogus fwspec-mapping error handling (bsc#1012628). - irqdomain: Refactor __irq_domain_alloc_irqs() (bsc#1012628). - irqdomain: Fix mapping-creation race (bsc#1012628). - irqdomain: Fix domain registration race (bsc#1012628). - crypto: qat - fix out-of-bounds read (bsc#1012628). - mm/damon/paddr: fix missing folio_put() (bsc#1012628). - ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() (bsc#1012628). - ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC (bsc#1012628). - jbd2: fix data missing when reusing bh which is ready to be checkpointed (bsc#1012628). - ext4: optimize ea_inode block expansion (bsc#1012628). - ext4: refuse to create ea block when umounted (bsc#1012628). - cxl/pmem: Fix nvdimm registration races (bsc#1012628). - Input: exc3000 - properly stop timer on shutdown (bsc#1012628). - mtd: spi-nor: sfdp: Fix index value for SCCR dwords (bsc#1012628). - mtd: spi-nor: spansion: Consider reserved bits in CFR5 register (bsc#1012628). - mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type (bsc#1012628). - dm: send just one event on resize, not two (bsc#1012628). - dm: add cond_resched() to dm_wq_work() (bsc#1012628). - dm: add cond_resched() to dm_wq_requeue_work() (bsc#1012628). - wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice (bsc#1012628). - wifi: rtl8xxxu: Use a longer retry limit of 48 (bsc#1012628). - wifi: ath11k: allow system suspend to survive ath11k (bsc#1012628). - wifi: cfg80211: Fix use after free for wext (bsc#1012628). - wifi: cfg80211: Set SSID if it is not already set (bsc#1012628). - cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies (bsc#1012628). - qede: fix interrupt coalescing configuration (bsc#1012628). - thermal: intel: powerclamp: Fix cur_state for multi package system (bsc#1012628). - dm flakey: fix logic when corrupting a bio (bsc#1012628). - dm cache: free background tracker's queued work in btracker_destroy (bsc#1012628). - dm flakey: don't corrupt the zero page (bsc#1012628). - dm flakey: fix a bug with 32-bit highmem systems (bsc#1012628). - hwmon: (peci/cputemp) Fix off-by-one in coretemp_label allocation (bsc#1012628). - hwmon: (nct6775) Fix incorrect parenthesization in nct6775_write_fan_div() (bsc#1012628). - spi: intel: Check number of chip selects after reading the descriptor (bsc#1012628). - ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for IOMMU node (bsc#1012628). - ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node (bsc#1012628). - ARM: dts: exynos: correct TMU phandle in Exynos4210 (bsc#1012628). - ARM: dts: exynos: correct TMU phandle in Exynos4 (bsc#1012628). - ARM: dts: exynos: correct TMU phandle in Odroid XU3 family (bsc#1012628). - ARM: dts: exynos: correct TMU phandle in Exynos5250 (bsc#1012628). - ARM: dts: exynos: correct TMU phandle in Odroid XU (bsc#1012628). - ARM: dts: exynos: correct TMU phandle in Odroid HC1 (bsc#1012628). - arm64: acpi: Fix possible memory leak of ffh_ctxt (bsc#1012628). - arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP (bsc#1012628). - arm64: Reset KASAN tag in copy_highpage with HW tags only (bsc#1012628). - fuse: add inode/permission checks to fileattr_get/fileattr_set (bsc#1012628). - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (bsc#1012628). - ceph: update the time stamps and try to drop the suid/sgid (bsc#1012628). - regulator: core: Use ktime_get_boottime() to determine how long a regulator was off (bsc#1012628). - panic: fix the panic_print NMI backtrace setting (bsc#1012628). - mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON (bsc#1012628). - genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced (bsc#1012628). - genirq/msi: Take the per-device MSI lock before validating the control structure (bsc#1012628). - spi: spi-sn-f-ospi: fix duplicate flag while assigning to mode_bits (bsc#1012628). - alpha: fix FEN fault handling (bsc#1012628). - dax/kmem: Fix leak of memory-hotplug resources (bsc#1012628). - mips: fix syscall_get_nr (bsc#1012628). - media: ipu3-cio2: Fix PM runtime usage_count in driver unbind (bsc#1012628). - remoteproc/mtk_scp: Move clk ops outside send_lock (bsc#1012628). - vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd (bsc#1012628). - docs: gdbmacros: print newest record (bsc#1012628). - mm: memcontrol: deprecate charge moving (bsc#1012628). - mm/thp: check and bail out if page in deferred queue already (bsc#1012628). - ktest.pl: Give back console on Ctrt^C on monitor (bsc#1012628). - kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list (bsc#1012628). - ktest.pl: Fix missing "end_monitor" when machine check fails (bsc#1012628). - ktest.pl: Add RUN_TIMEOUT option with default unlimited (bsc#1012628). - memory tier: release the new_memtier in find_create_memory_tier() (bsc#1012628). - ring-buffer: Handle race between rb_move_tail and rb_check_pages (bsc#1012628). - tools/bootconfig: fix single & used for logical condition (bsc#1012628). - tracing/eprobe: Fix to add filter on eprobe description in README file (bsc#1012628). - iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (bsc#1012628). - scsi: aacraid: Allocate cmd_priv with scsicmd (bsc#1012628). - scsi: qla2xxx: Fix link failure in NPIV environment (bsc#1012628). - scsi: qla2xxx: Check if port is online before sending ELS (bsc#1012628). - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests (bsc#1012628). - scsi: qla2xxx: Remove unintended flag clearing (bsc#1012628). - scsi: qla2xxx: Fix erroneous link down (bsc#1012628). - scsi: qla2xxx: Remove increment of interface err cnt (bsc#1012628). - scsi: ses: Don't attach if enclosure has no components (bsc#1012628). - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() (bsc#1012628). - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (bsc#1012628). - scsi: ses: Fix possible desc_ptr out-of-bounds accesses (bsc#1012628). - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (bsc#1012628). - RISC-V: add a spin_shadow_stack declaration (bsc#1012628). - riscv: Avoid enabling interrupts in die() (bsc#1012628). - riscv: mm: fix regression due to update_mmu_cache change (bsc#1012628). - riscv: jump_label: Fixup unaligned arch_static_branch function (bsc#1012628). - riscv: ftrace: Fixup panic by disabling preemption (bsc#1012628). - riscv, mm: Perform BPF exhandler fixup on page fault (bsc#1012628). - riscv: ftrace: Remove wasted nops for !RISCV_ISA_C (bsc#1012628). - riscv: ftrace: Reduce the detour code size to half (bsc#1012628). - MIPS: DTS: CI20: fix otg power gpio (bsc#1012628). - PCI/PM: Observe reset delay irrespective of bridge_d3 (bsc#1012628). - PCI: Unify delay handling for reset and resume (bsc#1012628). - PCI: hotplug: Allow marking devices as disconnected during bind/unbind (bsc#1012628). - PCI: Avoid FLR for AMD FCH AHCI adapters (bsc#1012628). - PCI/DPC: Await readiness of secondary bus after reset (bsc#1012628). - bus: mhi: ep: Only send -ENOTCONN status if client driver is available (bsc#1012628). - bus: mhi: ep: Move chan->lock to the start of processing queued ch ring (bsc#1012628). - bus: mhi: ep: Save channel state locally during suspend and resume (bsc#1012628). - iommufd: Make sure to zero vfio_iommu_type1_info before copying to user (bsc#1012628). - iommufd: Do not add the same hwpt to the ioas->hwpt_list twice (bsc#1012628). - iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode (bsc#1012628). - iommu/vt-d: Fix PASID directory pointer coherency (bsc#1012628). - vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR (bsc#1012628). - vfio/type1: prevent underflow of locked_vm via exec() (bsc#1012628). - vfio/type1: track locked_vm per dma (bsc#1012628). - vfio/type1: restore locked_vm (bsc#1012628). - drm/amd: Fix initialization for nbio 7.5.1 (bsc#1012628). - drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv (bsc#1012628). - drm/radeon: Fix eDP for single-display iMac11,2 (bsc#1012628). - drm/i915: Don't use stolen memory for ring buffers with LLC (bsc#1012628). - drm/i915: Don't use BAR mappings for ring buffers with LLC (bsc#1012628). - drm/gud: Fix UBSAN warning (bsc#1012628). - drm/edid: fix AVI infoframe aspect ratio handling (bsc#1012628). - drm/edid: fix parsing of 3D modes from HDMI VSDB (bsc#1012628). - qede: avoid uninitialized entries in coal_entry array (bsc#1012628). - brd: use radix_tree_maybe_preload instead of radix_tree_preload (bsc#1012628). - net: avoid double iput when sock_alloc_file fails (bsc#1012628). - Update config files. --- diff --git a/config/arm64/default b/config/arm64/default index eefda83..198c16e 100644 --- a/config/arm64/default +++ b/config/arm64/default @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.2.1 Kernel Configuration +# Linux/arm64 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -7896,6 +7896,7 @@ CONFIG_SND_HDA_CODEC_SI3054=m CONFIG_SND_HDA_GENERIC=m CONFIG_SND_HDA_POWER_SAVE_DEFAULT=1 # CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set +# CONFIG_SND_HDA_CTL_DEV_ID is not set # end of HD-Audio CONFIG_SND_HDA_CORE=m @@ -11889,9 +11890,6 @@ CONFIG_TMPFS_INODE64=y CONFIG_ARCH_SUPPORTS_HUGETLBFS=y CONFIG_HUGETLBFS=y CONFIG_HUGETLB_PAGE=y -CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y -CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y -# CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON is not set CONFIG_MEMFD_CREATE=y CONFIG_ARCH_HAS_GIGANTIC_PAGE=y CONFIG_CONFIGFS_FS=y diff --git a/config/armv6hl/default b/config/armv6hl/default index db5a84e..450e8cf 100644 --- a/config/armv6hl/default +++ b/config/armv6hl/default @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 6.2.1 Kernel Configuration +# Linux/arm 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -4064,7 +4064,6 @@ CONFIG_SENSORS_PC87427=m CONFIG_SENSORS_NTC_THERMISTOR=m CONFIG_SENSORS_NCT6683=m CONFIG_SENSORS_NCT6775_CORE=m -CONFIG_SENSORS_NCT6775=m CONFIG_SENSORS_NCT6775_I2C=m CONFIG_SENSORS_NCT7802=m CONFIG_SENSORS_NCT7904=m diff --git a/config/armv7hl/default b/config/armv7hl/default index dad2c41..d0fdd3a 100644 --- a/config/armv7hl/default +++ b/config/armv7hl/default @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 6.2.1 Kernel Configuration +# Linux/arm 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -5492,7 +5492,6 @@ CONFIG_SENSORS_PC87427=m # CONFIG_SENSORS_NTC_THERMISTOR is not set CONFIG_SENSORS_NCT6683=m CONFIG_SENSORS_NCT6775_CORE=m -# CONFIG_SENSORS_NCT6775 is not set CONFIG_SENSORS_NCT6775_I2C=m # CONFIG_SENSORS_NCT7802 is not set CONFIG_SENSORS_NCT7904=m @@ -7736,6 +7735,7 @@ CONFIG_SND_HDA_CODEC_SI3054=m CONFIG_SND_HDA_GENERIC=m CONFIG_SND_HDA_POWER_SAVE_DEFAULT=1 # CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set +# CONFIG_SND_HDA_CTL_DEV_ID is not set # end of HD-Audio CONFIG_SND_HDA_CORE=m @@ -9319,6 +9319,7 @@ CONFIG_DMA_SUN6I=m CONFIG_DW_AXI_DMAC=m CONFIG_FSL_EDMA=m CONFIG_FSL_QDMA=m +# CONFIG_HISI_DMA is not set CONFIG_IMX_DMA=m CONFIG_IMX_SDMA=m # CONFIG_INTEL_IDMA64 is not set diff --git a/config/i386/pae b/config/i386/pae index 3d6d88e..a939036 100644 --- a/config/i386/pae +++ b/config/i386/pae @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/i386 6.2.1 Kernel Configuration +# Linux/i386 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -6820,8 +6820,6 @@ CONFIG_DRM_I2C_ADV7511_CEC=y # CONFIG_DRM_ETNAVIV is not set # CONFIG_DRM_LOGICVC is not set -# CONFIG_DRM_MXSFB is not set -# CONFIG_DRM_IMX_LCDIF is not set # CONFIG_DRM_ARCPGU is not set CONFIG_DRM_BOCHS=m CONFIG_DRM_CIRRUS_QEMU=m @@ -7154,6 +7152,7 @@ CONFIG_SND_HDA_CODEC_SI3054=m CONFIG_SND_HDA_GENERIC=m CONFIG_SND_HDA_POWER_SAVE_DEFAULT=1 # CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set +# CONFIG_SND_HDA_CTL_DEV_ID is not set # end of HD-Audio CONFIG_SND_HDA_CORE=m diff --git a/config/ppc64/default b/config/ppc64/default index ca494a2..f3b9e20 100644 --- a/config/ppc64/default +++ b/config/ppc64/default @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/powerpc 6.2.1 Kernel Configuration +# Linux/powerpc 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -6085,8 +6085,6 @@ CONFIG_DRM_I2C_ADV7511_CEC=y # CONFIG_DRM_ETNAVIV is not set # CONFIG_DRM_LOGICVC is not set -# CONFIG_DRM_MXSFB is not set -# CONFIG_DRM_IMX_LCDIF is not set # CONFIG_DRM_ARCPGU is not set CONFIG_DRM_BOCHS=m CONFIG_DRM_CIRRUS_QEMU=m diff --git a/config/ppc64le/default b/config/ppc64le/default index 8d2635c..85fe5bd 100644 --- a/config/ppc64le/default +++ b/config/ppc64le/default @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/powerpc 6.2.1 Kernel Configuration +# Linux/powerpc 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -5974,8 +5974,6 @@ CONFIG_DRM_I2C_ADV7511_CEC=y # CONFIG_DRM_ETNAVIV is not set # CONFIG_DRM_LOGICVC is not set -# CONFIG_DRM_MXSFB is not set -# CONFIG_DRM_IMX_LCDIF is not set # CONFIG_DRM_ARCPGU is not set CONFIG_DRM_BOCHS=m CONFIG_DRM_CIRRUS_QEMU=m diff --git a/config/riscv64/default b/config/riscv64/default index a722243..becacc1 100644 --- a/config/riscv64/default +++ b/config/riscv64/default @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/riscv 6.2.1 Kernel Configuration +# Linux/riscv 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -4768,7 +4768,6 @@ CONFIG_SENSORS_PC87427=m # CONFIG_SENSORS_NTC_THERMISTOR is not set CONFIG_SENSORS_NCT6683=m CONFIG_SENSORS_NCT6775_CORE=m -CONFIG_SENSORS_NCT6775=m CONFIG_SENSORS_NCT6775_I2C=m CONFIG_SENSORS_NCT7802=m CONFIG_SENSORS_NCT7904=m @@ -6187,8 +6186,6 @@ CONFIG_DRM_DW_HDMI=m # CONFIG_DRM_ETNAVIV is not set # CONFIG_DRM_LOGICVC is not set -# CONFIG_DRM_MXSFB is not set -# CONFIG_DRM_IMX_LCDIF is not set # CONFIG_DRM_ARCPGU is not set CONFIG_DRM_BOCHS=m CONFIG_DRM_CIRRUS_QEMU=m @@ -6478,6 +6475,7 @@ CONFIG_SND_HDA_CODEC_SI3054=m CONFIG_SND_HDA_GENERIC=m CONFIG_SND_HDA_POWER_SAVE_DEFAULT=1 # CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set +# CONFIG_SND_HDA_CTL_DEV_ID is not set # end of HD-Audio CONFIG_SND_HDA_CORE=m diff --git a/config/s390x/default b/config/s390x/default index cbc47e8..1fa6aa6 100644 --- a/config/s390x/default +++ b/config/s390x/default @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/s390 6.2.1 Kernel Configuration +# Linux/s390 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -2748,7 +2748,6 @@ CONFIG_SENSORS_MR75203=m # CONFIG_SENSORS_PC87427 is not set # CONFIG_SENSORS_NCT6683 is not set CONFIG_SENSORS_NCT6775_CORE=m -# CONFIG_SENSORS_NCT6775 is not set CONFIG_SENSORS_NCT6775_I2C=m # CONFIG_SENSORS_NCT7802 is not set # CONFIG_SENSORS_NCT7904 is not set diff --git a/config/s390x/zfcpdump b/config/s390x/zfcpdump index 6addda7..b0d63c2 100644 --- a/config/s390x/zfcpdump +++ b/config/s390x/zfcpdump @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/s390 6.2.1 Kernel Configuration +# Linux/s390 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y diff --git a/config/x86_64/default b/config/x86_64/default index eae6f28..88c021e 100644 --- a/config/x86_64/default +++ b/config/x86_64/default @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 6.2.1 Kernel Configuration +# Linux/x86_64 6.2.3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (scripts/dummy-tools/gcc)" CONFIG_CC_IS_GCC=y @@ -6973,6 +6973,7 @@ CONFIG_SND_HDA_CODEC_SI3054=m CONFIG_SND_HDA_GENERIC=m CONFIG_SND_HDA_POWER_SAVE_DEFAULT=1 # CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set +# CONFIG_SND_HDA_CTL_DEV_ID is not set # end of HD-Audio CONFIG_SND_HDA_CORE=m diff --git a/patches.kernel.org/6.2.3-001-HID-asus-use-spinlock-to-protect-concurrent-acc.patch b/patches.kernel.org/6.2.3-001-HID-asus-use-spinlock-to-protect-concurrent-acc.patch new file mode 100644 index 0000000..3432394 --- /dev/null +++ b/patches.kernel.org/6.2.3-001-HID-asus-use-spinlock-to-protect-concurrent-acc.patch @@ -0,0 +1,104 @@ +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:02 +0000 +Subject: [PATCH] HID: asus: use spinlock to protect concurrent accesses +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 315c537068a13f0b5681d33dd045a912f4bece6f + +commit 315c537068a13f0b5681d33dd045a912f4bece6f upstream. + +asus driver has a worker that may access data concurrently. +Proct the accesses using a spinlock. + +Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-4-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-asus.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index f99752b9..9f767baf 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -98,6 +98,7 @@ struct asus_kbd_leds { + struct hid_device *hdev; + struct work_struct work; + unsigned int brightness; ++ spinlock_t lock; + bool removed; + }; + +@@ -495,7 +496,12 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, + { + struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, + cdev); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&led->lock, flags); + led->brightness = brightness; ++ spin_unlock_irqrestore(&led->lock, flags); ++ + schedule_work(&led->work); + } + +@@ -503,8 +509,14 @@ static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev) + { + struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, + cdev); ++ enum led_brightness brightness; ++ unsigned long flags; + +- return led->brightness; ++ spin_lock_irqsave(&led->lock, flags); ++ brightness = led->brightness; ++ spin_unlock_irqrestore(&led->lock, flags); ++ ++ return brightness; + } + + static void asus_kbd_backlight_work(struct work_struct *work) +@@ -512,11 +524,14 @@ static void asus_kbd_backlight_work(struct work_struct *work) + struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work); + u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 }; + int ret; ++ unsigned long flags; + + if (led->removed) + return; + ++ spin_lock_irqsave(&led->lock, flags); + buf[4] = led->brightness; ++ spin_unlock_irqrestore(&led->lock, flags); + + ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf)); + if (ret < 0) +@@ -584,6 +599,7 @@ static int asus_kbd_register_leds(struct hid_device *hdev) + drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set; + drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get; + INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work); ++ spin_lock_init(&drvdata->kbd_backlight->lock); + + ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev); + if (ret < 0) { +@@ -1119,9 +1135,13 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) + static void asus_remove(struct hid_device *hdev) + { + struct asus_drvdata *drvdata = hid_get_drvdata(hdev); ++ unsigned long flags; + + if (drvdata->kbd_backlight) { ++ spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags); + drvdata->kbd_backlight->removed = true; ++ spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags); ++ + cancel_work_sync(&drvdata->kbd_backlight->work); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-002-HID-asus-use-spinlock-to-safely-schedule-worker.patch b/patches.kernel.org/6.2.3-002-HID-asus-use-spinlock-to-safely-schedule-worker.patch new file mode 100644 index 0000000..5602a2f --- /dev/null +++ b/patches.kernel.org/6.2.3-002-HID-asus-use-spinlock-to-safely-schedule-worker.patch @@ -0,0 +1,68 @@ +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:03 +0000 +Subject: [PATCH] HID: asus: use spinlock to safely schedule workers +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4ab3a086d10eeec1424f2e8a968827a6336203df + +commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream. + +Use spinlocks to deal with workers introducing a wrapper +asus_schedule_work(), and several spinlock checks. +Otherwise, asus_kbd_backlight_set() may schedule led->work after the +structure has been freed, causing a use-after-free. + +Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-asus.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index 9f767baf..d1094bb1 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -491,6 +491,16 @@ static int rog_nkey_led_init(struct hid_device *hdev) + return ret; + } + ++static void asus_schedule_work(struct asus_kbd_leds *led) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&led->lock, flags); ++ if (!led->removed) ++ schedule_work(&led->work); ++ spin_unlock_irqrestore(&led->lock, flags); ++} ++ + static void asus_kbd_backlight_set(struct led_classdev *led_cdev, + enum led_brightness brightness) + { +@@ -502,7 +512,7 @@ static void asus_kbd_backlight_set(struct led_classdev *led_cdev, + led->brightness = brightness; + spin_unlock_irqrestore(&led->lock, flags); + +- schedule_work(&led->work); ++ asus_schedule_work(led); + } + + static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev) +@@ -526,9 +536,6 @@ static void asus_kbd_backlight_work(struct work_struct *work) + int ret; + unsigned long flags; + +- if (led->removed) +- return; +- + spin_lock_irqsave(&led->lock, flags); + buf[4] = led->brightness; + spin_unlock_irqrestore(&led->lock, flags); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-003-iommu-amd-Fix-error-handling-for-pdev_pri_ats_e.patch b/patches.kernel.org/6.2.3-003-iommu-amd-Fix-error-handling-for-pdev_pri_ats_e.patch new file mode 100644 index 0000000..645779e --- /dev/null +++ b/patches.kernel.org/6.2.3-003-iommu-amd-Fix-error-handling-for-pdev_pri_ats_e.patch @@ -0,0 +1,68 @@ +From: Vasant Hegde +Date: Wed, 11 Jan 2023 12:15:03 +0000 +Subject: [PATCH] iommu/amd: Fix error handling for pdev_pri_ats_enable() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 080920e52148b4fbbf9360d5345fdcd7846e4841 + +commit 080920e52148b4fbbf9360d5345fdcd7846e4841 upstream. + +Current code throws kernel warning if it fails to enable pasid/pri [1]. +Do not call pci_disable_[pasid/pri] if pci_enable_[pasid/pri] failed. + +[1] https://lore.kernel.org/linux-iommu/15d0f9ff-2a56-b3e9-5b45-e6b23300ae3b@leemhuis.info/ + +Reported-by: Matt Fagnani +Signed-off-by: Vasant Hegde +Reviewed-by: Suravee Suthikulpanit +Link: https://lore.kernel.org/r/20230111121503.5931-1-vasant.hegde@amd.com +Signed-off-by: Joerg Roedel +Cc: "Limonciello, Mario" +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/amd/iommu.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index cbeaab55..2f8c018e 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1702,27 +1702,29 @@ static int pdev_pri_ats_enable(struct pci_dev *pdev) + /* Only allow access to user-accessible pages */ + ret = pci_enable_pasid(pdev, 0); + if (ret) +- goto out_err; ++ return ret; + + /* First reset the PRI state of the device */ + ret = pci_reset_pri(pdev); + if (ret) +- goto out_err; ++ goto out_err_pasid; + + /* Enable PRI */ + /* FIXME: Hardcode number of outstanding requests for now */ + ret = pci_enable_pri(pdev, 32); + if (ret) +- goto out_err; ++ goto out_err_pasid; + + ret = pci_enable_ats(pdev, PAGE_SHIFT); + if (ret) +- goto out_err; ++ goto out_err_pri; + + return 0; + +-out_err: ++out_err_pri: + pci_disable_pri(pdev); ++ ++out_err_pasid: + pci_disable_pasid(pdev); + + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-004-iommu-amd-Skip-attach-device-domain-is-same-as-.patch b/patches.kernel.org/6.2.3-004-iommu-amd-Skip-attach-device-domain-is-same-as-.patch new file mode 100644 index 0000000..23d4674 --- /dev/null +++ b/patches.kernel.org/6.2.3-004-iommu-amd-Skip-attach-device-domain-is-same-as-.patch @@ -0,0 +1,43 @@ +From: Vasant Hegde +Date: Wed, 15 Feb 2023 05:26:41 +0000 +Subject: [PATCH] iommu/amd: Skip attach device domain is same as new domain +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f451c7a5a3b818ecfeba2ba258570769998baf3a + +commit f451c7a5a3b818ecfeba2ba258570769998baf3a upstream. + +If device->domain is same as new domain then we can skip the +device attach process. + +Signed-off-by: Vasant Hegde +Link: https://lore.kernel.org/r/20230215052642.6016-2-vasant.hegde@amd.com +Signed-off-by: Joerg Roedel +Cc: "Limonciello, Mario" +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/amd/iommu.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 2f8c018e..26c96b82 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -2161,6 +2161,13 @@ static int amd_iommu_attach_device(struct iommu_domain *dom, + struct amd_iommu *iommu = rlookup_amd_iommu(dev); + int ret; + ++ /* ++ * Skip attach device to domain if new domain is same as ++ * devices current domain ++ */ ++ if (dev_data->domain == domain) ++ return 0; ++ + dev_data->defer_attach = false; + + if (dev_data->domain) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-005-iommu-amd-Improve-page-fault-error-reporting.patch b/patches.kernel.org/6.2.3-005-iommu-amd-Improve-page-fault-error-reporting.patch new file mode 100644 index 0000000..e39185a --- /dev/null +++ b/patches.kernel.org/6.2.3-005-iommu-amd-Improve-page-fault-error-reporting.patch @@ -0,0 +1,80 @@ +From: Vasant Hegde +Date: Wed, 15 Feb 2023 05:26:42 +0000 +Subject: [PATCH] iommu/amd: Improve page fault error reporting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 996d120b4de2b0d6b592bd9fbbe6e244b81ab3cc + +commit 996d120b4de2b0d6b592bd9fbbe6e244b81ab3cc upstream. + +If IOMMU domain for device group is not setup properly then we may hit +IOMMU page fault. Current page fault handler assumes that domain is +always setup and it will hit NULL pointer derefence (see below sample log). + +Lets check whether domain is setup or not and log appropriate message. + +Sample log: +---------- + amdgpu 0000:00:01.0: amdgpu: SE 1, SH per SE 1, CU per SH 8, active_cu_number 6 + BUG: kernel NULL pointer dereference, address: 0000000000000058 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP NOPTI + CPU: 2 PID: 56 Comm: irq/24-AMD-Vi Not tainted 6.2.0-rc2+ #89 + Hardware name: xxx + RIP: 0010:report_iommu_fault+0x11/0x90 + [...] + Call Trace: + + amd_iommu_int_thread+0x60c/0x760 + ? __pfx_irq_thread_fn+0x10/0x10 + irq_thread_fn+0x1f/0x60 + irq_thread+0xea/0x1a0 + ? preempt_count_add+0x6a/0xa0 + ? __pfx_irq_thread_dtor+0x10/0x10 + ? __pfx_irq_thread+0x10/0x10 + kthread+0xe9/0x110 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x2c/0x50 + + +Reported-by: Matt Fagnani +Suggested-by: Joerg Roedel +Signed-off-by: Vasant Hegde +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216865 +Link: https://lore.kernel.org/lkml/15d0f9ff-2a56-b3e9-5b45-e6b23300ae3b@leemhuis.info/ +Link: https://lore.kernel.org/r/20230215052642.6016-3-vasant.hegde@amd.com +Cc: stable@vger.kernel.org +[joro: Edit commit message] +Signed-off-by: Joerg Roedel +Cc: "Limonciello, Mario" +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/amd/iommu.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 26c96b82..9dc41c48 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -558,6 +558,15 @@ static void amd_iommu_report_page_fault(struct amd_iommu *iommu, + * prevent logging it. + */ + if (IS_IOMMU_MEM_TRANSACTION(flags)) { ++ /* Device not attached to domain properly */ ++ if (dev_data->domain == NULL) { ++ pr_err_ratelimited("Event logged [Device not attached to domain properly]\n"); ++ pr_err_ratelimited(" device=%04x:%02x:%02x.%x domain=0x%04x\n", ++ iommu->pci_seg->id, PCI_BUS_NUM(devid), PCI_SLOT(devid), ++ PCI_FUNC(devid), domain_id); ++ goto out; ++ } ++ + if (!report_iommu_fault(&dev_data->domain->domain, + &pdev->dev, address, + IS_WRITE_REQUEST(flags) ? +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-006-iommu-Attach-device-group-to-old-domain-in-erro.patch b/patches.kernel.org/6.2.3-006-iommu-Attach-device-group-to-old-domain-in-erro.patch new file mode 100644 index 0000000..a5e0da6 --- /dev/null +++ b/patches.kernel.org/6.2.3-006-iommu-Attach-device-group-to-old-domain-in-erro.patch @@ -0,0 +1,77 @@ +From: Vasant Hegde +Date: Wed, 15 Feb 2023 05:26:40 +0000 +Subject: [PATCH] iommu: Attach device group to old domain in error path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2cc73c5712f97de98c38c2fafc1f288354a9f3c3 + +commit 2cc73c5712f97de98c38c2fafc1f288354a9f3c3 upstream. + +iommu_attach_group() attaches all devices in a group to domain and then +sets group domain (group->domain). Current code (__iommu_attach_group()) +does not handle error path. This creates problem as devices to domain +attachment is in inconsistent state. + +Flow: + - During boot iommu attach devices to default domain + - Later some device driver (like amd/iommu_v2 or vfio) tries to attach + device to new domain. + - In iommu_attach_group() path we detach device from current domain. + Then it tries to attach devices to new domain. + - If it fails to attach device to new domain then device to domain link + is broken. + - iommu_attach_group() returns error. + - At this stage iommu_attach_group() caller thinks, attaching device to + new domain failed and devices are still attached to old domain. + - But in reality device to old domain link is broken. It will result + in all sort of failures (like IO page fault) later. + +To recover from this situation, we need to attach all devices back to the +old domain. Also log warning if it fails attach device back to old domain. + +Suggested-by: Lu Baolu +Reported-by: Matt Fagnani +Signed-off-by: Vasant Hegde +Reviewed-by: Jason Gunthorpe +Tested-by: Matt Fagnani +Link: https://lore.kernel.org/r/20230215052642.6016-1-vasant.hegde@amd.com +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216865 +Link: https://lore.kernel.org/lkml/15d0f9ff-2a56-b3e9-5b45-e6b23300ae3b@leemhuis.info/ +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/iommu.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 5f6a85ae..9ff8cda2 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -2124,8 +2124,22 @@ static int __iommu_attach_group(struct iommu_domain *domain, + + ret = __iommu_group_for_each_dev(group, domain, + iommu_group_do_attach_device); +- if (ret == 0) ++ if (ret == 0) { + group->domain = domain; ++ } else { ++ /* ++ * To recover from the case when certain device within the ++ * group fails to attach to the new domain, we need force ++ * attaching all devices back to the old domain. The old ++ * domain is compatible for all devices in the group, ++ * hence the iommu driver should always return success. ++ */ ++ struct iommu_domain *old_domain = group->domain; ++ ++ group->domain = NULL; ++ WARN(__iommu_group_set_domain(group, old_domain), ++ "iommu driver failed to attach a compatible domain"); ++ } + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-007-powerpc-mm-Rearrange-if-else-block-to-avoid-cla.patch b/patches.kernel.org/6.2.3-007-powerpc-mm-Rearrange-if-else-block-to-avoid-cla.patch new file mode 100644 index 0000000..656f128 --- /dev/null +++ b/patches.kernel.org/6.2.3-007-powerpc-mm-Rearrange-if-else-block-to-avoid-cla.patch @@ -0,0 +1,67 @@ +From: Anders Roxell +Date: Wed, 10 Aug 2022 13:43:18 +0200 +Subject: [PATCH] powerpc/mm: Rearrange if-else block to avoid clang warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d78c8e32890ef7eca79ffd67c96022c7f9d8cce4 + +commit d78c8e32890ef7eca79ffd67c96022c7f9d8cce4 upstream. + +Clang warns: + + arch/powerpc/mm/book3s64/radix_tlb.c:1191:23: error: variable 'hstart' is uninitialized when used here + __tlbiel_va_range(hstart, hend, pid, + ^~~~~~ + arch/powerpc/mm/book3s64/radix_tlb.c:1191:31: error: variable 'hend' is uninitialized when used here + __tlbiel_va_range(hstart, hend, pid, + ^~~~ + +Rework the 'if (IS_ENABLE(CONFIG_TRANSPARENT_HUGEPAGE))' so hstart/hend +is always initialized to silence the warnings. That will also simplify +the 'else' path. Clang is getting confused with these warnings, but the +warnings is a false-positive. + +Suggested-by: Arnd Bergmann +Suggested-by: Nathan Chancellor +Reviewed-by: Christophe Leroy +Reviewed-by: Nathan Chancellor +Signed-off-by: Anders Roxell +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220810114318.3220630-1-anders.roxell@linaro.org +Signed-off-by: Daniel Díaz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/powerpc/mm/book3s64/radix_tlb.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/arch/powerpc/mm/book3s64/radix_tlb.c b/arch/powerpc/mm/book3s64/radix_tlb.c +index 4e29b619..6d7a1ef7 100644 +--- a/arch/powerpc/mm/book3s64/radix_tlb.c ++++ b/arch/powerpc/mm/book3s64/radix_tlb.c +@@ -1179,15 +1179,12 @@ static inline void __radix__flush_tlb_range(struct mm_struct *mm, + } + } + } else { +- bool hflush = false; ++ bool hflush; + unsigned long hstart, hend; + +- if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) { +- hstart = (start + PMD_SIZE - 1) & PMD_MASK; +- hend = end & PMD_MASK; +- if (hstart < hend) +- hflush = true; +- } ++ hstart = (start + PMD_SIZE - 1) & PMD_MASK; ++ hend = end & PMD_MASK; ++ hflush = IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && hstart < hend; + + if (type == FLUSH_TYPE_LOCAL) { + asm volatile("ptesync": : :"memory"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-008-ata-ahci-Revert-ata-ahci-Add-Tiger-Lake-UP-3-4-.patch b/patches.kernel.org/6.2.3-008-ata-ahci-Revert-ata-ahci-Add-Tiger-Lake-UP-3-4-.patch new file mode 100644 index 0000000..1cd9297 --- /dev/null +++ b/patches.kernel.org/6.2.3-008-ata-ahci-Revert-ata-ahci-Add-Tiger-Lake-UP-3-4-.patch @@ -0,0 +1,40 @@ +From: Damien Le Moal +Date: Fri, 3 Mar 2023 18:29:07 +0900 +Subject: [PATCH] ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI + controller" +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6210038aeaf49c395c2da57572246d93ec67f6d4 + +commit 6210038aeaf49c395c2da57572246d93ec67f6d4 upstream. + +Commit 104ff59af73a ("ata: ahci: Add Tiger Lake UP{3,4} AHCI +controller") enabled low power mode for the Tiger Lake AHIC adapter in +the author system but created regressions for others. Revert this patch +for now until a better solution is found to make this adapter +eco-friendly. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217114 +CC: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/ata/ahci.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 3bb9bb48..14a1c0d1 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -421,7 +421,6 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x34d3), board_ahci_low_power }, /* Ice Lake LP AHCI */ + { PCI_VDEVICE(INTEL, 0x02d3), board_ahci_low_power }, /* Comet Lake PCH-U AHCI */ + { PCI_VDEVICE(INTEL, 0x02d7), board_ahci_low_power }, /* Comet Lake PCH RAID */ +- { PCI_VDEVICE(INTEL, 0xa0d3), board_ahci_low_power }, /* Tiger Lake UP{3,4} AHCI */ + + /* JMicron 360/1/3/5/6, match class to avoid IDE function */ + { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-009-ARM-OMAP2-Fix-memory-leak-in-realtime_counter_i.patch b/patches.kernel.org/6.2.3-009-ARM-OMAP2-Fix-memory-leak-in-realtime_counter_i.patch new file mode 100644 index 0000000..142e3d1 --- /dev/null +++ b/patches.kernel.org/6.2.3-009-ARM-OMAP2-Fix-memory-leak-in-realtime_counter_i.patch @@ -0,0 +1,37 @@ +From: Chen Hui +Date: Tue, 8 Nov 2022 22:19:17 +0800 +Subject: [PATCH] ARM: OMAP2+: Fix memory leak in realtime_counter_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac + +[ Upstream commit ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac ] + +The "sys_clk" resource is malloced by clk_get(), +it is not released when the function return. + +Fixes: fa6d79d27614 ("ARM: OMAP: Add initialisation for the real-time counter.") +Signed-off-by: Chen Hui +Message-Id: <20221108141917.46796-1-judy.chenhui@huawei.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/mach-omap2/timer.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c +index 620ba69c..5677c4a0 100644 +--- a/arch/arm/mach-omap2/timer.c ++++ b/arch/arm/mach-omap2/timer.c +@@ -76,6 +76,7 @@ static void __init realtime_counter_init(void) + } + + rate = clk_get_rate(sys_clk); ++ clk_put(sys_clk); + + if (soc_is_dra7xx()) { + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-010-arm64-dts-qcom-qcs404-use-symbol-names-for-PCIe.patch b/patches.kernel.org/6.2.3-010-arm64-dts-qcom-qcs404-use-symbol-names-for-PCIe.patch new file mode 100644 index 0000000..8a83ba4 --- /dev/null +++ b/patches.kernel.org/6.2.3-010-arm64-dts-qcom-qcs404-use-symbol-names-for-PCIe.patch @@ -0,0 +1,59 @@ +From: Dmitry Baryshkov +Date: Mon, 26 Dec 2022 06:21:51 +0200 +Subject: [PATCH] arm64: dts: qcom: qcs404: use symbol names for PCIe resets +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 41a37d157a613444c97e8f71a5fb2a21116b70d7 + +[ Upstream commit 41a37d157a613444c97e8f71a5fb2a21116b70d7 ] + +The commit e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") added names +for PCIe resets, but it did not change the existing qcs404.dtsi to use +these names. Do it now and use symbol names to make it easier to check +and modify the dtsi in future. + +Fixes: e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221226042154.2666748-14-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/qcs404.dtsi b/arch/arm64/boot/dts/qcom/qcs404.dtsi +index a5324eec..502dd6db 100644 +--- a/arch/arm64/boot/dts/qcom/qcs404.dtsi ++++ b/arch/arm64/boot/dts/qcom/qcs404.dtsi +@@ -806,7 +806,7 @@ pcie_phy: phy@7786000 { + + clocks = <&gcc GCC_PCIE_0_PIPE_CLK>; + resets = <&gcc GCC_PCIEPHY_0_PHY_BCR>, +- <&gcc 21>; ++ <&gcc GCC_PCIE_0_PIPE_ARES>; + reset-names = "phy", "pipe"; + + clock-output-names = "pcie_0_pipe_clk"; +@@ -1336,12 +1336,12 @@ pcie: pci@10000000 { + <&gcc GCC_PCIE_0_SLV_AXI_CLK>; + clock-names = "iface", "aux", "master_bus", "slave_bus"; + +- resets = <&gcc 18>, +- <&gcc 17>, +- <&gcc 15>, +- <&gcc 19>, ++ resets = <&gcc GCC_PCIE_0_AXI_MASTER_ARES>, ++ <&gcc GCC_PCIE_0_AXI_SLAVE_ARES>, ++ <&gcc GCC_PCIE_0_AXI_MASTER_STICKY_ARES>, ++ <&gcc GCC_PCIE_0_CORE_STICKY_ARES>, + <&gcc GCC_PCIE_0_BCR>, +- <&gcc 16>; ++ <&gcc GCC_PCIE_0_AHB_ARES>; + reset-names = "axi_m", + "axi_s", + "axi_m_sticky", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-011-arm64-dts-qcom-msm8996-tone-Fix-USB-taking-6-mi.patch b/patches.kernel.org/6.2.3-011-arm64-dts-qcom-msm8996-tone-Fix-USB-taking-6-mi.patch new file mode 100644 index 0000000..aa98c0c --- /dev/null +++ b/patches.kernel.org/6.2.3-011-arm64-dts-qcom-msm8996-tone-Fix-USB-taking-6-mi.patch @@ -0,0 +1,53 @@ +From: Konrad Dybcio +Date: Thu, 24 Nov 2022 23:01:47 +0100 +Subject: [PATCH] arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to + wake up +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 43069b9cd358aebc692e654de91ee06ff66e26af + +[ Upstream commit 43069b9cd358aebc692e654de91ee06ff66e26af ] + +The hardware turns out to be pretty sluggish at assuming it can only +do USB2 with just a USB2 phy assigned to it - before it needed about +6 minutes to acknowledge that. + +Limit it to USB-HS explicitly to make USB come up about 720x faster. + +Fixes: 9da65e441d4d ("arm64: dts: qcom: Add support for SONY Xperia X Performance / XZ / XZs (msm8996, Tone platform)") +Signed-off-by: Konrad Dybcio +Reviewed-by: Neil Armstrong +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221124220147.102611-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi +index dec361b9..be62899e 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi +@@ -943,10 +943,6 @@ touch_int_sleep: touch-int-sleep-state { + }; + }; + +-/* +- * For reasons that are currently unknown (but probably related to fusb301), USB takes about +- * 6 minutes to wake up (nothing interesting in kernel logs), but then it works as it should. +- */ + &usb3 { + status = "okay"; + qcom,select-utmi-as-pipe-clk; +@@ -955,6 +951,7 @@ &usb3 { + &usb3_dwc3 { + extcon = <&usb3_id>; + dr_mode = "peripheral"; ++ maximum-speed = "high-speed"; + phys = <&hsusb_phy1>; + phy-names = "usb2-phy"; + snps,hird-threshold = /bits/ 8 <0>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-012-arm64-dts-qcom-sm6115-Fix-UFS-node.patch b/patches.kernel.org/6.2.3-012-arm64-dts-qcom-sm6115-Fix-UFS-node.patch new file mode 100644 index 0000000..3ac6a4d --- /dev/null +++ b/patches.kernel.org/6.2.3-012-arm64-dts-qcom-sm6115-Fix-UFS-node.patch @@ -0,0 +1,55 @@ +From: Konrad Dybcio +Date: Thu, 8 Dec 2022 21:13:57 +0100 +Subject: [PATCH] arm64: dts: qcom: sm6115: Fix UFS node +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 01b6041454e8bc4f5feb76e6bcdc83a48cea21f2 + +[ Upstream commit 01b6041454e8bc4f5feb76e6bcdc83a48cea21f2 ] + +In its current form, UFS did not even probe successfully - it failed +when trying to set XO (ref_clk) to 300 MHz instead of doing so to +the ICE clk. Moreover, the missing reg-names prevented ICE from +working or being discovered at all. Fix both of these issues. + +As a sidenote, the log reveals that this SoC uses UFS ICE v3.1.0. + +Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi") +Signed-off-by: Konrad Dybcio +Reviewed-by: Iskren Chernev +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221208201401.530555-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm6115.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi +index 572bf04a..3f4017bc 100644 +--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi +@@ -704,6 +704,7 @@ opp-202000000 { + ufs_mem_hc: ufs@4804000 { + compatible = "qcom,sm6115-ufshc", "qcom,ufshc", "jedec,ufs-2.0"; + reg = <0x04804000 0x3000>, <0x04810000 0x8000>; ++ reg-names = "std", "ice"; + interrupts = ; + phys = <&ufs_mem_phy_lanes>; + phy-names = "ufsphy"; +@@ -736,10 +737,10 @@ ufs_mem_hc: ufs@4804000 { + <0 0>, + <0 0>, + <37500000 150000000>, +- <75000000 300000000>, + <0 0>, + <0 0>, +- <0 0>; ++ <0 0>, ++ <75000000 300000000>; + + status = "disabled"; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-013-arm64-dts-qcom-sm6115-Provide-xo-clk-to-rpmcc.patch b/patches.kernel.org/6.2.3-013-arm64-dts-qcom-sm6115-Provide-xo-clk-to-rpmcc.patch new file mode 100644 index 0000000..f6b91fe --- /dev/null +++ b/patches.kernel.org/6.2.3-013-arm64-dts-qcom-sm6115-Provide-xo-clk-to-rpmcc.patch @@ -0,0 +1,43 @@ +From: Konrad Dybcio +Date: Thu, 8 Dec 2022 21:13:58 +0100 +Subject: [PATCH] arm64: dts: qcom: sm6115: Provide xo clk to rpmcc +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ad9514be8ddb9d3a8c262aa415c2f1c1f4cc97f9 + +[ Upstream commit ad9514be8ddb9d3a8c262aa415c2f1c1f4cc97f9 ] + +rpmcc used to rely on global clock lookup (and still does so for +backwards compat reasons) of "xo_board", which was common back +when we did not care about things like underscores in node names. +Nowadays it expects to be fed a reference to the fixed clock. +Satisfy that requirement to make sure rpm clock rates are not all +stuck at zero. + +Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi") +Reported-by: Adam Skladowski +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221208201401.530555-2-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi +index 3f4017bc..81523ab7 100644 +--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi +@@ -296,6 +296,8 @@ rpm_requests: rpm-requests { + + rpmcc: clock-controller { + compatible = "qcom,rpmcc-sm6115", "qcom,rpmcc"; ++ clocks = <&xo_board>; ++ clock-names = "xo"; + #clock-cells = <1>; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-014-arm64-dts-qcom-sm8150-kumano-Panel-framebuffer-.patch b/patches.kernel.org/6.2.3-014-arm64-dts-qcom-sm8150-kumano-Panel-framebuffer-.patch new file mode 100644 index 0000000..e4065b3 --- /dev/null +++ b/patches.kernel.org/6.2.3-014-arm64-dts-qcom-sm8150-kumano-Panel-framebuffer-.patch @@ -0,0 +1,49 @@ +From: Marijn Suijten +Date: Fri, 9 Dec 2022 20:17:33 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k + instead of 4k +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: be8de06dc397c45cb0f3fe04084089c3f06c419f + +[ Upstream commit be8de06dc397c45cb0f3fe04084089c3f06c419f ] + +The framebuffer configuration for kumano griffin, written in kumano dtsi +(which is overwritten in bahamut dts for its smaller panel) has to use a +1096x2560 configuration as this is what the panel (and framebuffer area) +has been initialized to. Downstream userspace also has access to (and +uses) this 2.5k mode by default, and only switches the panel to 4k when +requested. + +Fixes: d0a6ce59ea4e ("arm64: dts: qcom: sm8150: Add support for SONY Xperia 1 / 5 (Kumano platform)") +Signed-off-by: Marijn Suijten +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221209191733.1458031-1-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +index c958a8b1..fd8c0097 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +@@ -33,9 +33,10 @@ chosen { + framebuffer: framebuffer@9c000000 { + compatible = "simple-framebuffer"; + reg = <0 0x9c000000 0 0x2300000>; +- width = <1644>; +- height = <3840>; +- stride = <(1644 * 4)>; ++ /* Griffin BL initializes in 2.5k mode, not 4k */ ++ width = <1096>; ++ height = <2560>; ++ stride = <(1096 * 4)>; + format = "a8r8g8b8"; + /* + * That's (going to be) a lot of clocks, but it's necessary due +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-015-arm64-dts-qcom-pmi8950-Correct-rev_1250v-channe.patch b/patches.kernel.org/6.2.3-015-arm64-dts-qcom-pmi8950-Correct-rev_1250v-channe.patch new file mode 100644 index 0000000..bd68dce --- /dev/null +++ b/patches.kernel.org/6.2.3-015-arm64-dts-qcom-pmi8950-Correct-rev_1250v-channe.patch @@ -0,0 +1,41 @@ +From: Marijn Suijten +Date: Fri, 9 Dec 2022 22:54:37 +0100 +Subject: [PATCH] arm64: dts: qcom: pmi8950: Correct rev_1250v channel label to + mv +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3c3d2cb221b8647d1c547b4c44d2d6060cc742a9 + +[ Upstream commit 3c3d2cb221b8647d1c547b4c44d2d6060cc742a9 ] + +This was pointed out in review but never followed up on thanks to +sidetracked discussions about labels vs node names. + +Fixes: 0d97fdf380b4 ("arm64: dts: qcom: Add configuration for PMI8950 peripheral") +Signed-off-by: Marijn Suijten +Reviewed-by: Konrad Dybcio +Reviewed-by: Luca Weiss +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221209215437.1783067-1-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/pmi8950.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pmi8950.dtsi b/arch/arm64/boot/dts/qcom/pmi8950.dtsi +index 32d27e21..8008f024 100644 +--- a/arch/arm64/boot/dts/qcom/pmi8950.dtsi ++++ b/arch/arm64/boot/dts/qcom/pmi8950.dtsi +@@ -47,7 +47,7 @@ adc-chan@9 { + adc-chan@a { + reg = ; + qcom,pre-scaling = <1 1>; +- label = "ref_1250v"; ++ label = "ref_1250mv"; + }; + + adc-chan@d { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-016-arm64-dts-qcom-sm6350-Fix-up-the-ramoops-node.patch b/patches.kernel.org/6.2.3-016-arm64-dts-qcom-sm6350-Fix-up-the-ramoops-node.patch new file mode 100644 index 0000000..3c5e826 --- /dev/null +++ b/patches.kernel.org/6.2.3-016-arm64-dts-qcom-sm6350-Fix-up-the-ramoops-node.patch @@ -0,0 +1,52 @@ +From: Konrad Dybcio +Date: Sat, 10 Dec 2022 11:25:59 +0100 +Subject: [PATCH] arm64: dts: qcom: sm6350: Fix up the ramoops node +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3b2ff50da499178cc418f4b319e279d1b52958ed + +[ Upstream commit 3b2ff50da499178cc418f4b319e279d1b52958ed ] + +Fix up the ramoops node to make it match bindings and style: + +- remove "removed-dma-pool" +- don't pad size to 8 hex digits +- change cc-size to ecc-size so that it's used +- increase ecc-size from to 16 +- remove the zeroed ftrace-size + +Fixes: 5f82b9cda61e ("arm64: dts: qcom: Add SM6350 device tree") +Reported-by: Luca Weiss +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221210102600.589028-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm6350.dtsi | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi +index 43324bf2..00e43a0d 100644 +--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi +@@ -342,13 +342,12 @@ last_log_region: memory@ffbc0000 { + }; + + ramoops: ramoops@ffc00000 { +- compatible = "removed-dma-pool", "ramoops"; +- reg = <0 0xffc00000 0 0x00100000>; ++ compatible = "ramoops"; ++ reg = <0 0xffc00000 0 0x100000>; + record-size = <0x1000>; + console-size = <0x40000>; +- ftrace-size = <0x0>; + msg-size = <0x20000 0x20000>; +- cc-size = <0x0>; ++ ecc-size = <16>; + no-map; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-017-arm64-dts-qcom-sdm670-google-sargo-keep-pm660-l.patch b/patches.kernel.org/6.2.3-017-arm64-dts-qcom-sdm670-google-sargo-keep-pm660-l.patch new file mode 100644 index 0000000..4635b10 --- /dev/null +++ b/patches.kernel.org/6.2.3-017-arm64-dts-qcom-sdm670-google-sargo-keep-pm660-l.patch @@ -0,0 +1,39 @@ +From: Richard Acayan +Date: Mon, 5 Dec 2022 17:52:37 -0500 +Subject: [PATCH] arm64: dts: qcom: sdm670-google-sargo: keep pm660 ldo8 on +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 861b67fbdccd62a9319d7350b1924d95f597db09 + +[ Upstream commit 861b67fbdccd62a9319d7350b1924d95f597db09 ] + +According to the downstream device tree, the regulator that powers the +I/O for eMMC should not be turned off. Keep it always on just in case +the eMMC driver fails and doesn't enable it, or unloads and disables it. + +Fixes: 07c8ded6e373 ("arm64: dts: qcom: add sdm670 and pixel 3a device trees") +Link: https://android.googlesource.com/kernel/msm/+/9ed6ddbe955d3b84d1416a1cf77e83904d1e8421/arch/arm64/boot/dts/google/sdm670-bonito-common.dtsi#105 +Signed-off-by: Richard Acayan +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221205225237.200564-1-mailingradian@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts b/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts +index cf2ae540..e3e61b9d 100644 +--- a/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts ++++ b/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts +@@ -256,6 +256,7 @@ vreg_l8a_1p8: ldo8 { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-enable-ramp-delay = <250>; ++ regulator-always-on; + }; + + vreg_l9a_1p8: ldo9 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-018-arm64-dts-qcom-Re-enable-resin-on-MSM8998-and-S.patch b/patches.kernel.org/6.2.3-018-arm64-dts-qcom-Re-enable-resin-on-MSM8998-and-S.patch new file mode 100644 index 0000000..1ccafc5 --- /dev/null +++ b/patches.kernel.org/6.2.3-018-arm64-dts-qcom-Re-enable-resin-on-MSM8998-and-S.patch @@ -0,0 +1,191 @@ +From: Dzmitry Sankouski +Date: Wed, 28 Dec 2022 14:52:43 +0300 +Subject: [PATCH] arm64: dts: qcom: Re-enable resin on MSM8998 and SDM845 + boards +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4c881ab73a64cdbf8691e258ef17b740d27040a0 + +[ Upstream commit 4c881ab73a64cdbf8691e258ef17b740d27040a0 ] + +resin node declaration was moved to pm8998.dtsi file (in disabled state). +MSM8998 and SDM845 boards defining resin node did not previously have +status="okay" and ended up disabled. +Re-enable it by using resin node link from pm8998.dtsi with status="okay". + +Fixes: f86ae6f23a9e ("arm64: dts: qcom: sagit: add initial device tree for sagit") +Signed-off-by: Dzmitry Sankouski +Reviewed-by: Marijn Suijten +Reported-by: Marijn Suijten +Link: https://lore.kernel.org/linux-arm-msm/20221222115922.jlachctn4lxopp7a@SoMainline.org/ +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221228115243.201038-1-dsankouski@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts | 11 +++-------- + .../boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi | 11 +++-------- + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 11 +++-------- + arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi | 11 +++-------- + arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts | 11 +++-------- + .../boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 11 +++-------- + arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 11 +++-------- + 7 files changed, 21 insertions(+), 56 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts b/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts +index 310f7a2d..510d12c8 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts ++++ b/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts +@@ -364,14 +364,9 @@ cam_snapshot_pin_a: cam-snapshot-btn-active-state { + }; + }; + +-&pm8998_pon { +- resin { +- compatible = "qcom,pm8941-resin"; +- interrupts = ; +- bias-pull-up; +- debounce = <15625>; +- linux,code = ; +- }; ++&pm8998_resin { ++ linux,code = ; ++ status = "okay"; + }; + + &qusb2phy { +diff --git a/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi b/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi +index 5da87baa..3bbd5df1 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi +@@ -357,14 +357,9 @@ vib_default: vib-en-state { + }; + }; + +-&pm8998_pon { +- resin { +- compatible = "qcom,pm8941-resin"; +- interrupts = ; +- debounce = <15625>; +- bias-pull-up; +- linux,code = ; +- }; ++&pm8998_resin { ++ linux,code = ; ++ status = "okay"; + }; + + &qusb2phy { +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +index f41c6d60..878801f5 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +@@ -615,14 +615,9 @@ vol_up_pin_a: vol-up-active-state { + }; + }; + +-&pm8998_pon { +- resin { +- compatible = "qcom,pm8941-resin"; +- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; +- debounce = <15625>; +- bias-pull-up; +- linux,code = ; +- }; ++&pm8998_resin { ++ linux,code = ; ++ status = "okay"; + }; + + &pmi8998_lpg { +diff --git a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi +index 1eb423e4..94328780 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi +@@ -482,14 +482,9 @@ &mss_pil { + status = "okay"; + }; + +-&pm8998_pon { +- resin { +- compatible = "qcom,pm8941-resin"; +- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; +- debounce = <15625>; +- bias-pull-up; +- linux,code = ; +- }; ++&pm8998_resin { ++ linux,code = ; ++ status = "okay"; + }; + + &sdhc_2 { +diff --git a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts +index bb77ccfd..e6191602 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts +@@ -522,14 +522,9 @@ pinconf { + }; + }; + +-&pm8998_pon { +- volume_down_resin: resin { +- compatible = "qcom,pm8941-resin"; +- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; +- debounce = <15625>; +- bias-pull-up; +- linux,code = ; +- }; ++&pm8998_resin { ++ linux,code = ; ++ status = "okay"; + }; + + &pmi8998_lpg { +diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +index eb6b2b67..1b12b1a4 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +@@ -325,14 +325,9 @@ &pmi8998_wled { + qcom,cabc; + }; + +-&pm8998_pon { +- resin { +- compatible = "qcom,pm8941-resin"; +- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; +- debounce = <15625>; +- bias-pull-up; +- linux,code = ; +- }; ++&pm8998_resin { ++ linux,code = ; ++ status = "okay"; + }; + + &pmi8998_rradc { +diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts +index 38ba809a..fba229d0 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts +@@ -530,14 +530,9 @@ pinconf { + }; + }; + +-&pm8998_pon { +- resin { +- interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; +- compatible = "qcom,pm8941-resin"; +- linux,code = ; +- debounce = <15625>; +- bias-pull-up; +- }; ++&pm8998_resin { ++ linux,code = ; ++ status = "okay"; + }; + + &q6afedai { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-019-arm64-dts-qcom-sm8350-sagami-Configure-SLG51000.patch b/patches.kernel.org/6.2.3-019-arm64-dts-qcom-sm8350-sagami-Configure-SLG51000.patch new file mode 100644 index 0000000..1206d1d --- /dev/null +++ b/patches.kernel.org/6.2.3-019-arm64-dts-qcom-sm8350-sagami-Configure-SLG51000.patch @@ -0,0 +1,124 @@ +From: Konrad Dybcio +Date: Fri, 18 Nov 2022 16:20:27 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8350-sagami: Configure SLG51000 PMIC on + PDX215 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8875b1d71f112b30e4c7e65ed337096bc0cc396b + +[ Upstream commit 8875b1d71f112b30e4c7e65ed337096bc0cc396b ] + +Remove the mention of this PMIC from the common DTSI, as it's not +used on PDX214. Add the required nodes to support it on PDX215. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221118152028.59312-2-konrad.dybcio@linaro.org +Stable-dep-of: dcc7cd5c46ca ("arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../qcom/sm8350-sony-xperia-sagami-pdx215.dts | 66 +++++++++++++++++++ + .../dts/qcom/sm8350-sony-xperia-sagami.dtsi | 2 +- + 2 files changed, 67 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts +index c74c973a..d4afaa39 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts ++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts +@@ -12,6 +12,72 @@ / { + compatible = "sony,pdx215-generic", "qcom,sm8350"; + }; + ++&i2c13 { ++ pmic@75 { ++ compatible = "dlg,slg51000"; ++ reg = <0x75>; ++ dlg,cs-gpios = <&pm8350b_gpios 1 GPIO_ACTIVE_HIGH>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&cam_pwr_a_cs>; ++ ++ regulators { ++ slg51000_a_ldo1: ldo1 { ++ regulator-name = "slg51000_a_ldo1"; ++ regulator-min-microvolt = <2400000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ ++ slg51000_a_ldo2: ldo2 { ++ regulator-name = "slg51000_a_ldo2"; ++ regulator-min-microvolt = <2400000>; ++ regulator-max-microvolt = <3300000>; ++ }; ++ ++ slg51000_a_ldo3: ldo3 { ++ regulator-name = "slg51000_a_ldo3"; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <3750000>; ++ }; ++ ++ slg51000_a_ldo4: ldo4 { ++ regulator-name = "slg51000_a_ldo4"; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <3750000>; ++ }; ++ ++ slg51000_a_ldo5: ldo5 { ++ regulator-name = "slg51000_a_ldo5"; ++ regulator-min-microvolt = <500000>; ++ regulator-max-microvolt = <1200000>; ++ }; ++ ++ slg51000_a_ldo6: ldo6 { ++ regulator-name = "slg51000_a_ldo6"; ++ regulator-min-microvolt = <500000>; ++ regulator-max-microvolt = <1200000>; ++ }; ++ ++ slg51000_a_ldo7: ldo7 { ++ regulator-name = "slg51000_a_ldo7"; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <3750000>; ++ }; ++ }; ++ }; ++}; ++ ++&pm8350b_gpios { ++ cam_pwr_a_cs: cam-pwr-a-cs-state { ++ pins = "gpio1"; ++ function = "normal"; ++ qcom,drive-strength = ; ++ power-source = <1>; ++ drive-push-pull; ++ output-high; ++ }; ++}; ++ + &tlmm { + gpio-line-names = "APPS_I2C_0_SDA", /* GPIO_0 */ + "APPS_I2C_0_SCL", +diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi +index 1f2d660f..a10306d8 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi +@@ -3,6 +3,7 @@ + * Copyright (c) 2021, Konrad Dybcio + */ + ++#include + #include + #include "sm8350.dtsi" + #include "pm8350.dtsi" +@@ -506,7 +507,6 @@ &i2c13 { + clock-frequency = <100000>; + + /* Qualcomm PM8008i/PM8008j (?) @ 8, 9, c, d */ +- /* Dialog SLG51000 CMIC @ 75 */ + }; + + &i2c15 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-020-arm64-dts-qcom-sm8350-sagami-Add-GPIO-line-name.patch b/patches.kernel.org/6.2.3-020-arm64-dts-qcom-sm8350-sagami-Add-GPIO-line-name.patch new file mode 100644 index 0000000..a4b5798 --- /dev/null +++ b/patches.kernel.org/6.2.3-020-arm64-dts-qcom-sm8350-sagami-Add-GPIO-line-name.patch @@ -0,0 +1,147 @@ +From: Konrad Dybcio +Date: Fri, 18 Nov 2022 16:20:28 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8350-sagami: Add GPIO line names for PMIC + GPIOs +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7c679f2a2af84edbec0c28171af8c42c6da9af14 + +[ Upstream commit 7c679f2a2af84edbec0c28171af8c42c6da9af14 ] + +Sony ever so graciously provides GPIO line names in their downstream +kernel (though sometimes they are not 100% accurate and you can judge +that by simply looking at them and with what drivers they are used). + +Add these to the PDX213&214 DTSIs to better document the hardware. + +Diff between 223 and 224: + +pm8350b +< gpio-line-names = "NC", /* GPIO_1 */ +> gpio-line-names = "CAM_PWR_A_CS", /* GPIO_1 */ +< "NC", +> "CAM_PWR_LD_EN", + +pm8350c +< "NC", +> "WLC_TXPWR_EN", + +Which is due to different camera power wiring on 213 and lack of an +additional SLG51000 PMIC on 214. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221118152028.59312-3-konrad.dybcio@linaro.org +Stable-dep-of: dcc7cd5c46ca ("arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../qcom/sm8350-sony-xperia-sagami-pdx214.dts | 23 +++++++++++++++++++ + .../qcom/sm8350-sony-xperia-sagami-pdx215.dts | 21 +++++++++++++++++ + .../dts/qcom/sm8350-sony-xperia-sagami.dtsi | 20 ++++++++++++++++ + 3 files changed, 64 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts +index cc650508..e6824c8c 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts ++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts +@@ -17,3 +17,26 @@ &framebuffer { + height = <2520>; + stride = <(1080 * 4)>; + }; ++ ++&pm8350b_gpios { ++ gpio-line-names = "NC", /* GPIO_1 */ ++ "NC", ++ "NC", ++ "NC", ++ "SNAPSHOT_N", ++ "NC", ++ "NC", ++ "FOCUS_N"; ++}; ++ ++&pm8350c_gpios { ++ gpio-line-names = "FL_STROBE_TRIG_WIDE", /* GPIO_1 */ ++ "FL_STROBE_TRIG_TELE", ++ "NC", ++ "NC", ++ "NC", ++ "RGBC_IR_PWR_EN", ++ "NC", ++ "NC", ++ "WIDEC_PWR_EN"; ++}; +diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts +index d4afaa39..c6f402c3 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts ++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts +@@ -68,6 +68,15 @@ slg51000_a_ldo7: ldo7 { + }; + + &pm8350b_gpios { ++ gpio-line-names = "CAM_PWR_A_CS", /* GPIO_1 */ ++ "NC", ++ "NC", ++ "NC", ++ "SNAPSHOT_N", ++ "CAM_PWR_LD_EN", ++ "NC", ++ "FOCUS_N"; ++ + cam_pwr_a_cs: cam-pwr-a-cs-state { + pins = "gpio1"; + function = "normal"; +@@ -78,6 +87,18 @@ cam_pwr_a_cs: cam-pwr-a-cs-state { + }; + }; + ++&pm8350c_gpios { ++ gpio-line-names = "FL_STROBE_TRIG_WIDE", /* GPIO_1 */ ++ "FL_STROBE_TRIG_TELE", ++ "NC", ++ "WLC_TXPWR_EN", ++ "NC", ++ "RGBC_IR_PWR_EN", ++ "NC", ++ "NC", ++ "WIDEC_PWR_EN"; ++}; ++ + &tlmm { + gpio-line-names = "APPS_I2C_0_SDA", /* GPIO_0 */ + "APPS_I2C_0_SCL", +diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi +index a10306d8..41c4101e 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi +@@ -534,6 +534,26 @@ &mpss { + firmware-name = "qcom/sm8350/Sony/sagami/modem.mbn"; + }; + ++&pm8350_gpios { ++ gpio-line-names = "ASSIGN1_THERM", /* GPIO_1 */ ++ "LCD_ID", ++ "SDR_MMW_THERM", ++ "RF_ID", ++ "NC", ++ "FP_LDO_EN", ++ "SP_ARI_PWR_ALARM", ++ "NC", ++ "G_ASSIST_N", ++ "PM8350_OPTION"; /* GPIO_10 */ ++}; ++ ++&pmk8350_gpios { ++ gpio-line-names = "NC", /* GPIO_1 */ ++ "NC", ++ "VOL_DOWN_N", ++ "PMK8350_OPTION"; ++}; ++ + &pmk8350_rtc { + status = "okay"; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-021-arm64-dts-qcom-sm8350-sagami-Rectify-GPIO-keys.patch b/patches.kernel.org/6.2.3-021-arm64-dts-qcom-sm8350-sagami-Rectify-GPIO-keys.patch new file mode 100644 index 0000000..434e0fa --- /dev/null +++ b/patches.kernel.org/6.2.3-021-arm64-dts-qcom-sm8350-sagami-Rectify-GPIO-keys.patch @@ -0,0 +1,125 @@ +From: Konrad Dybcio +Date: Thu, 29 Dec 2022 11:27:12 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dcc7cd5c46ca5e7bb8e4910ed8259597439c7246 + +[ Upstream commit dcc7cd5c46ca5e7bb8e4910ed8259597439c7246 ] + +With enough pins set properly, the hardware buttons now also work +like a charm. + +Fixes: c2721b0c23d9 ("arm64: dts: qcom: Add support for Xperia 1 III / 5 III") +Tested-by: Marijn Suijten # On Xperia 1 III and Xperia 5 III +Reviewed-by: Marijn Suijten +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221229102712.983306-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../dts/qcom/sm8350-sony-xperia-sagami.dtsi | 66 ++++++++++++++++++- + 1 file changed, 64 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi +index 41c4101e..8df6ccbe 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi +@@ -49,7 +49,35 @@ framebuffer: framebuffer@e1000000 { + gpio-keys { + compatible = "gpio-keys"; + +- /* For reasons still unknown, GAssist key and Camera Focus/Shutter don't work.. */ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&focus_n &snapshot_n &vol_down_n &g_assist_n>; ++ ++ key-camera-focus { ++ label = "Camera Focus"; ++ linux,code = ; ++ gpios = <&pm8350b_gpios 8 GPIO_ACTIVE_LOW>; ++ debounce-interval = <15>; ++ linux,can-disable; ++ wakeup-source; ++ }; ++ ++ key-camera-snapshot { ++ label = "Camera Snapshot"; ++ linux,code = ; ++ gpios = <&pm8350b_gpios 5 GPIO_ACTIVE_LOW>; ++ debounce-interval = <15>; ++ linux,can-disable; ++ wakeup-source; ++ }; ++ ++ key-google-assist { ++ label = "Google Assistant Key"; ++ gpios = <&pm8350_gpios 9 GPIO_ACTIVE_LOW>; ++ linux,code = ; ++ debounce-interval = <15>; ++ linux,can-disable; ++ wakeup-source; ++ }; + + key-vol-down { + label = "Volume Down"; +@@ -57,7 +85,7 @@ key-vol-down { + gpios = <&pmk8350_gpios 3 GPIO_ACTIVE_LOW>; + debounce-interval = <15>; + linux,can-disable; +- gpio-key,wakeup; ++ wakeup-source; + }; + }; + +@@ -545,6 +573,32 @@ &pm8350_gpios { + "NC", + "G_ASSIST_N", + "PM8350_OPTION"; /* GPIO_10 */ ++ ++ g_assist_n: g-assist-n-state { ++ pins = "gpio9"; ++ function = "normal"; ++ power-source = <1>; ++ bias-pull-up; ++ input-enable; ++ }; ++}; ++ ++&pm8350b_gpios { ++ snapshot_n: snapshot-n-state { ++ pins = "gpio5"; ++ function = "normal"; ++ power-source = <0>; ++ bias-pull-up; ++ input-enable; ++ }; ++ ++ focus_n: focus-n-state { ++ pins = "gpio8"; ++ function = "normal"; ++ power-source = <0>; ++ input-enable; ++ bias-pull-up; ++ }; + }; + + &pmk8350_gpios { +@@ -552,6 +606,14 @@ &pmk8350_gpios { + "NC", + "VOL_DOWN_N", + "PMK8350_OPTION"; ++ ++ vol_down_n: vol-down-n-state { ++ pins = "gpio3"; ++ function = "normal"; ++ power-source = <0>; ++ bias-pull-up; ++ input-enable; ++ }; + }; + + &pmk8350_rtc { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-022-arm64-dts-qcom-sm6350-lena-Flatten-gpio-keys-pi.patch b/patches.kernel.org/6.2.3-022-arm64-dts-qcom-sm6350-lena-Flatten-gpio-keys-pi.patch new file mode 100644 index 0000000..46e9ae8 --- /dev/null +++ b/patches.kernel.org/6.2.3-022-arm64-dts-qcom-sm6350-lena-Flatten-gpio-keys-pi.patch @@ -0,0 +1,71 @@ +From: Marijn Suijten +Date: Thu, 22 Dec 2022 22:59:06 +0100 +Subject: [PATCH] arm64: dts: qcom: sm6350-lena: Flatten gpio-keys pinctrl + state +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a40f5ae1ea64ab9e981faf47c31817dc4d7923e4 + +[ Upstream commit a40f5ae1ea64ab9e981faf47c31817dc4d7923e4 ] + +Pinctrl states typically collate multiple related pins. In the case of +gpio-keys there's no hardware-defined relation at all except all pins +representing a key; and especially on Sony's lena board there's only one +pin regardless. Flatten it similar to other boards [1]. + +As a drive-by fix, clean up the label string. + +[1]: https://lore.kernel.org/linux-arm-msm/11174eb6-0a9d-7df1-6f06-da4010f76453@linaro.org/ + +Fixes: 2b8bbe985659 ("arm64: dts: qcom: sm6350-lena: Include pm6350 and configure buttons") +Signed-off-by: Marijn Suijten +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221222215906.324092-1-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../qcom/sm6350-sony-xperia-lena-pdx213.dts | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts b/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts +index 94f77d37..4916d0db 100644 +--- a/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts ++++ b/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts +@@ -35,10 +35,10 @@ framebuffer: framebuffer@a0000000 { + gpio-keys { + compatible = "gpio-keys"; + pinctrl-names = "default"; +- pinctrl-0 = <&gpio_keys_state>; ++ pinctrl-0 = <&vol_down_n>; + + key-volume-down { +- label = "volume_down"; ++ label = "Volume Down"; + linux,code = ; + gpios = <&pm6350_gpios 2 GPIO_ACTIVE_LOW>; + }; +@@ -305,14 +305,12 @@ touchscreen@48 { + }; + + &pm6350_gpios { +- gpio_keys_state: gpio-keys-state { +- key-volume-down-pins { +- pins = "gpio2"; +- function = PMIC_GPIO_FUNC_NORMAL; +- power-source = <0>; +- bias-disable; +- input-enable; +- }; ++ vol_down_n: vol-down-n-state { ++ pins = "gpio2"; ++ function = PMIC_GPIO_FUNC_NORMAL; ++ power-source = <0>; ++ bias-disable; ++ input-enable; + }; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-023-arm64-dts-qcom-sm6125-Reorder-HSUSB-PHY-clocks-.patch b/patches.kernel.org/6.2.3-023-arm64-dts-qcom-sm6125-Reorder-HSUSB-PHY-clocks-.patch new file mode 100644 index 0000000..a884dff --- /dev/null +++ b/patches.kernel.org/6.2.3-023-arm64-dts-qcom-sm6125-Reorder-HSUSB-PHY-clocks-.patch @@ -0,0 +1,50 @@ +From: Marijn Suijten +Date: Fri, 16 Dec 2022 22:33:43 +0100 +Subject: [PATCH] arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match + bindings +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8416262b0ea46d84767141b074748f4d4f37736a + +[ Upstream commit 8416262b0ea46d84767141b074748f4d4f37736a ] + +Reorder the clocks and corresponding names to match the QUSB2 phy +schema, fixing the following CHECK_DTBS errors: + + arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:0: 'cfg_ahb' was expected + From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml + arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:1: 'ref' was expected + From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml + +Fixes: cff4bbaf2a2d ("arm64: dts: qcom: Add support for SM6125") +Signed-off-by: Marijn Suijten +Reviewed-by: Martin Botka +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221216213343.1140143-1-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm6125.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi +index 7e25a4f8..bf9e8d45 100644 +--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi +@@ -442,9 +442,9 @@ hsusb_phy1: phy@1613000 { + reg = <0x01613000 0x180>; + #phy-cells = <0>; + +- clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>, +- <&gcc GCC_AHB2PHY_USB_CLK>; +- clock-names = "ref", "cfg_ahb"; ++ clocks = <&gcc GCC_AHB2PHY_USB_CLK>, ++ <&rpmcc RPM_SMD_XO_CLK_SRC>; ++ clock-names = "cfg_ahb", "ref"; + + resets = <&gcc GCC_QUSB2PHY_PRIM_BCR>; + status = "disabled"; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-024-arm64-dts-qcom-sm6125-seine-Clean-up-gpio-keys-.patch b/patches.kernel.org/6.2.3-024-arm64-dts-qcom-sm6125-seine-Clean-up-gpio-keys-.patch new file mode 100644 index 0000000..8742dd6 --- /dev/null +++ b/patches.kernel.org/6.2.3-024-arm64-dts-qcom-sm6125-seine-Clean-up-gpio-keys-.patch @@ -0,0 +1,77 @@ +From: Marijn Suijten +Date: Thu, 22 Dec 2022 20:24:43 +0100 +Subject: [PATCH] arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume + down) +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a9f6a13da473bb6c7406d2784d9e3792f6763cba + +[ Upstream commit a9f6a13da473bb6c7406d2784d9e3792f6763cba ] + +- Remove autorepeat (leave key repetition to userspace); +- Remove unneeded status = "okay" (this is the default); +- Remove unneeded linux,input-type (this is the default for + gpio-keys); +- Allow the interrupt line for this button to be disabled; +- Use a full, descriptive node name; +- Set proper bias on the GPIO via pinctrl; +- Sort properties; +- Replace deprecated gpio-key,wakeup property with wakeup-source. + +Fixes: 82e1783890b7 ("arm64: dts: qcom: sm6125: Add support for Sony Xperia 10II") +Signed-off-by: Marijn Suijten +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221222192443.119103-1-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../qcom/sm6125-sony-xperia-seine-pdx201.dts | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts b/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts +index 0de6c5b7..09cff5d1 100644 +--- a/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts ++++ b/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts +@@ -41,17 +41,18 @@ extcon_usb: extcon-usb { + }; + + gpio-keys { +- status = "okay"; + compatible = "gpio-keys"; +- autorepeat; + +- key-vol-dn { ++ pinctrl-0 = <&vol_down_n>; ++ pinctrl-names = "default"; ++ ++ key-volume-down { + label = "Volume Down"; + gpios = <&tlmm 47 GPIO_ACTIVE_LOW>; +- linux,input-type = <1>; + linux,code = ; +- gpio-key,wakeup; + debounce-interval = <15>; ++ linux,can-disable; ++ wakeup-source; + }; + }; + +@@ -270,6 +271,14 @@ &sdhc_1 { + + &tlmm { + gpio-reserved-ranges = <22 2>, <28 6>; ++ ++ vol_down_n: vol-down-n-state { ++ pins = "gpio47"; ++ function = "gpio"; ++ drive-strength = <2>; ++ bias-disable; ++ input-enable; ++ }; + }; + + &usb3 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-025-arm64-dts-imx8m-Align-SoC-unique-ID-node-unit-a.patch b/patches.kernel.org/6.2.3-025-arm64-dts-imx8m-Align-SoC-unique-ID-node-unit-a.patch new file mode 100644 index 0000000..e55efcf --- /dev/null +++ b/patches.kernel.org/6.2.3-025-arm64-dts-imx8m-Align-SoC-unique-ID-node-unit-a.patch @@ -0,0 +1,79 @@ +From: Marek Vasut +Date: Fri, 2 Dec 2022 17:23:50 +0100 +Subject: [PATCH] arm64: dts: imx8m: Align SoC unique ID node unit address +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ee0d68f219be8618f53d3f8808952e20525e3f30 + +[ Upstream commit ee0d68f219be8618f53d3f8808952e20525e3f30 ] + +Align the SoC unique ID DT node unit address with its reg property. + +Reviewed-by: Peng Fan +Fixes: cbff23797fa1 ("arm64: dts: imx8m: add NVMEM provider and consumer to read soc unique ID") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +index 4ee89fdc..b45852e8 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +@@ -563,7 +563,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mm_uid: unique-id@410 { ++ imx8mm_uid: unique-id@4 { + reg = <0x4 0x8>; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index b7d91df7..7601a031 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -564,7 +564,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mn_uid: unique-id@410 { ++ imx8mn_uid: unique-id@4 { + reg = <0x4 0x8>; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index 03034b43..bafe0a57 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -425,7 +425,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mp_uid: unique-id@420 { ++ imx8mp_uid: unique-id@8 { + reg = <0x8 0x8>; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +index 7ce99c08..6eb5a98b 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +@@ -593,7 +593,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mq_uid: soc-uid@410 { ++ imx8mq_uid: soc-uid@4 { + reg = <0x4 0x8>; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-026-ARM-zynq-Fix-refcount-leak-in-zynq_early_slcr_i.patch b/patches.kernel.org/6.2.3-026-ARM-zynq-Fix-refcount-leak-in-zynq_early_slcr_i.patch new file mode 100644 index 0000000..2ac9f3a --- /dev/null +++ b/patches.kernel.org/6.2.3-026-ARM-zynq-Fix-refcount-leak-in-zynq_early_slcr_i.patch @@ -0,0 +1,38 @@ +From: Qiheng Lin +Date: Tue, 29 Nov 2022 22:05:44 +0800 +Subject: [PATCH] ARM: zynq: Fix refcount leak in zynq_early_slcr_init +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9eedb910a3be0005b88c696a8552c0d4c9937cd4 + +[ Upstream commit 9eedb910a3be0005b88c696a8552c0d4c9937cd4 ] + +of_find_compatible_node() returns a node pointer with refcount incremented, +we should use of_node_put() on error path. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 3329659df030 ("ARM: zynq: Simplify SLCR initialization") +Signed-off-by: Qiheng Lin +Link: https://lore.kernel.org/r/20221129140544.41293-1-linqiheng@huawei.com +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/mach-zynq/slcr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-zynq/slcr.c b/arch/arm/mach-zynq/slcr.c +index 37707614..9765b3f4 100644 +--- a/arch/arm/mach-zynq/slcr.c ++++ b/arch/arm/mach-zynq/slcr.c +@@ -213,6 +213,7 @@ int __init zynq_early_slcr_init(void) + zynq_slcr_regmap = syscon_regmap_lookup_by_compatible("xlnx,zynq-slcr"); + if (IS_ERR(zynq_slcr_regmap)) { + pr_err("%s: failed to find zynq-slcr\n", __func__); ++ of_node_put(np); + return -ENODEV; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-027-fs-dlm-fix-return-value-check-in-dlm_memory_ini.patch b/patches.kernel.org/6.2.3-027-fs-dlm-fix-return-value-check-in-dlm_memory_ini.patch new file mode 100644 index 0000000..c5bb306 --- /dev/null +++ b/patches.kernel.org/6.2.3-027-fs-dlm-fix-return-value-check-in-dlm_memory_ini.patch @@ -0,0 +1,36 @@ +From: Yang Yingliang +Date: Tue, 3 Jan 2023 19:37:49 +0800 +Subject: [PATCH] fs: dlm: fix return value check in dlm_memory_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8113aa91360a013ebe00763bb0823b5a41b11c4d + +[ Upstream commit 8113aa91360a013ebe00763bb0823b5a41b11c4d ] + +It should check 'cb_cache', after calling kmem_cache_create("dlm_cb"). + +Fixes: 61bed0baa4db ("fs: dlm: use a non-static queue for callbacks") +Signed-off-by: Yang Yingliang +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/dlm/memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c +index eb7a0864..cdbaa452 100644 +--- a/fs/dlm/memory.c ++++ b/fs/dlm/memory.c +@@ -51,7 +51,7 @@ int __init dlm_memory_init(void) + cb_cache = kmem_cache_create("dlm_cb", sizeof(struct dlm_callback), + __alignof__(struct dlm_callback), 0, + NULL); +- if (!rsb_cache) ++ if (!cb_cache) + goto cb; + + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-028-arm64-dts-mediatek-mt8195-Add-power-domain-to-U.patch b/patches.kernel.org/6.2.3-028-arm64-dts-mediatek-mt8195-Add-power-domain-to-U.patch new file mode 100644 index 0000000..fe1180b --- /dev/null +++ b/patches.kernel.org/6.2.3-028-arm64-dts-mediatek-mt8195-Add-power-domain-to-U.patch @@ -0,0 +1,40 @@ +From: AngeloGioacchino Del Regno +Date: Wed, 14 Dec 2022 14:11:17 +0100 +Subject: [PATCH] arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 + T-PHY +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a9f6721a3c92764582ed12296292fda4a7f2dd25 + +[ Upstream commit a9f6721a3c92764582ed12296292fda4a7f2dd25 ] + +Assign power domain to the U3PHY1 T-PHY in otder to keep this PHY +alive after unused PD shutdown and to be able to completely cut +and restore power to it, for example, to save some power during +system suspend/sleep. + +Fixes: 2b515194bf0c ("arm64: dts: mt8195: Add power domains controller") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221214131117.108008-2-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index c10cfeb1..d6856691 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -1549,6 +1549,7 @@ u3phy1: t-phy@11e30000 { + #address-cells = <1>; + #size-cells = <1>; + ranges = <0 0 0x11e30000 0xe00>; ++ power-domains = <&spm MT8195_POWER_DOMAIN_SSUSB_PCIE_PHY>; + status = "disabled"; + + u2port1: usb-phy@0 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-029-arm64-dts-mediatek-mt8183-Fix-systimer-13-MHz-c.patch b/patches.kernel.org/6.2.3-029-arm64-dts-mediatek-mt8183-Fix-systimer-13-MHz-c.patch new file mode 100644 index 0000000..3dac327 --- /dev/null +++ b/patches.kernel.org/6.2.3-029-arm64-dts-mediatek-mt8183-Fix-systimer-13-MHz-c.patch @@ -0,0 +1,67 @@ +From: Chen-Yu Tsai +Date: Thu, 1 Dec 2022 16:42:26 +0800 +Subject: [PATCH] arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock + description +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ce8a06b5bac75ccce99c0cf91b96b767d64f28a7 + +[ Upstream commit ce8a06b5bac75ccce99c0cf91b96b767d64f28a7 ] + +The systimer block derives its 13 MHz clock by dividing the main 26 MHz +oscillator clock by 2 internally, not through the TOPCKGEN clock +controller. + +On the MT8183 this divider is set either by power-on-reset or by the +bootloader. The bootloader may then make the divider unconfigurable to, +but can be read out by, the operating system. + +Making the systimer block take the 26 MHz clock directly requires +changing the implementations. As an ABI compatible fix, change the +input clock of the systimer block a fixed factor divide-by-2 clock +that takes the 26 MHz oscillator as its input. + +Fixes: 5bc8e2875ffb ("arm64: dts: mt8183: add systimer0 device node") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221201084229.3464449-2-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +index 402136bf..268a1f28 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +@@ -585,6 +585,15 @@ psci { + method = "smc"; + }; + ++ clk13m: fixed-factor-clock-13m { ++ compatible = "fixed-factor-clock"; ++ #clock-cells = <0>; ++ clocks = <&clk26m>; ++ clock-div = <2>; ++ clock-mult = <1>; ++ clock-output-names = "clk13m"; ++ }; ++ + clk26m: oscillator { + compatible = "fixed-clock"; + #clock-cells = <0>; +@@ -968,8 +977,7 @@ systimer: timer@10017000 { + "mediatek,mt6765-timer"; + reg = <0 0x10017000 0 0x1000>; + interrupts = ; +- clocks = <&topckgen CLK_TOP_CLK13M>; +- clock-names = "clk13m"; ++ clocks = <&clk13m>; + }; + + iommu: iommu@10205000 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-030-arm64-dts-mediatek-mt8192-Fix-systimer-13-MHz-c.patch b/patches.kernel.org/6.2.3-030-arm64-dts-mediatek-mt8192-Fix-systimer-13-MHz-c.patch new file mode 100644 index 0000000..e90f437 --- /dev/null +++ b/patches.kernel.org/6.2.3-030-arm64-dts-mediatek-mt8192-Fix-systimer-13-MHz-c.patch @@ -0,0 +1,65 @@ +From: Chen-Yu Tsai +Date: Thu, 1 Dec 2022 16:42:27 +0800 +Subject: [PATCH] arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock + description +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f19f68e56b0c6631984a9f5023035d4bd09612bb + +[ Upstream commit f19f68e56b0c6631984a9f5023035d4bd09612bb ] + +The systimer block derives its 13 MHz clock by dividing the main 26 MHz +oscillator clock by 2 internally, not through the TOPCKGEN clock +controller. + +On the MT8192 this divider is fixed to /2 and is not configurable. + +Making the systimer block take the 26 MHz clock directly requires +changing the implementations. As an ABI compatible fix, change the +input clock of the systimer block a fixed factor divide-by-2 clock +that takes the 26 MHz oscillator as its input. + +Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221201084229.3464449-3-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 424fc89c..0d43a327 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -29,6 +29,15 @@ aliases { + rdma4 = &rdma4; + }; + ++ clk13m: fixed-factor-clock-13m { ++ compatible = "fixed-factor-clock"; ++ #clock-cells = <0>; ++ clocks = <&clk26m>; ++ clock-div = <2>; ++ clock-mult = <1>; ++ clock-output-names = "clk13m"; ++ }; ++ + clk26m: oscillator0 { + compatible = "fixed-clock"; + #clock-cells = <0>; +@@ -534,8 +543,7 @@ systimer: timer@10017000 { + "mediatek,mt6765-timer"; + reg = <0 0x10017000 0 0x1000>; + interrupts = ; +- clocks = <&topckgen CLK_TOP_CSW_F26M_D2>; +- clock-names = "clk13m"; ++ clocks = <&clk13m>; + }; + + pwrap: pwrap@10026000 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-031-arm64-dts-mediatek-mt8195-Fix-systimer-13-MHz-c.patch b/patches.kernel.org/6.2.3-031-arm64-dts-mediatek-mt8195-Fix-systimer-13-MHz-c.patch new file mode 100644 index 0000000..6628b2a --- /dev/null +++ b/patches.kernel.org/6.2.3-031-arm64-dts-mediatek-mt8195-Fix-systimer-13-MHz-c.patch @@ -0,0 +1,66 @@ +From: Chen-Yu Tsai +Date: Thu, 1 Dec 2022 16:42:28 +0800 +Subject: [PATCH] arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock + description +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0f1c806b65d136a5fe0b88adad5ff1cb451fc401 + +[ Upstream commit 0f1c806b65d136a5fe0b88adad5ff1cb451fc401 ] + +The systimer block derives its 13 MHz clock by dividing the main 26 MHz +oscillator clock by 2 internally, not through the TOPCKGEN clock +controller. + +On the MT8195 this divider is set either by power-on-reset or by the +bootloader. The bootloader may then make the divider unconfigurable to, +but can be read out by, the operating system. + +Making the systimer block take the 26 MHz clock directly requires +changing the implementations. As an ABI compatible fix, change the +input clock of the systimer block a fixed factor divide-by-2 clock +that takes the 26 MHz oscillator as its input. + +Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221201084229.3464449-4-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index d6856691..d8d846a5 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -248,6 +248,15 @@ sound: mt8195-sound { + status = "disabled"; + }; + ++ clk13m: fixed-factor-clock-13m { ++ compatible = "fixed-factor-clock"; ++ #clock-cells = <0>; ++ clocks = <&clk26m>; ++ clock-div = <2>; ++ clock-mult = <1>; ++ clock-output-names = "clk13m"; ++ }; ++ + clk26m: oscillator-26m { + compatible = "fixed-clock"; + #clock-cells = <0>; +@@ -705,7 +714,7 @@ systimer: timer@10017000 { + "mediatek,mt6765-timer"; + reg = <0 0x10017000 0 0x1000>; + interrupts = ; +- clocks = <&topckgen CLK_TOP_CLK26M_D2>; ++ clocks = <&clk13m>; + }; + + pwrap: pwrap@10024000 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-032-arm64-dts-mediatek-mt8186-Fix-systimer-13-MHz-c.patch b/patches.kernel.org/6.2.3-032-arm64-dts-mediatek-mt8186-Fix-systimer-13-MHz-c.patch new file mode 100644 index 0000000..e2020a7 --- /dev/null +++ b/patches.kernel.org/6.2.3-032-arm64-dts-mediatek-mt8186-Fix-systimer-13-MHz-c.patch @@ -0,0 +1,51 @@ +From: Chen-Yu Tsai +Date: Thu, 1 Dec 2022 16:42:29 +0800 +Subject: [PATCH] arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock + description +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b391efba57ff085233d5ead5e01817bf4b71d999 + +[ Upstream commit b391efba57ff085233d5ead5e01817bf4b71d999 ] + +The systimer block derives its 13 MHz clock by dividing the main 26 MHz +oscillator clock by 2 internally. The 13 MHz clock is not a separate +oscillator. + +Fix this by making the 13 MHz clock a divide-by-2 fixed factor clock, +taking its input from the main 26 MHz oscillator. + +Fixes: 2e78620b1350 ("arm64: dts: Add MediaTek MT8186 dts and evaluation board and Makefile") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221201084229.3464449-5-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8186.dtsi | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +index c326aeb3..857b0c22 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +@@ -214,10 +214,12 @@ l3_0: l3-cache { + }; + }; + +- clk13m: oscillator-13m { +- compatible = "fixed-clock"; ++ clk13m: fixed-factor-clock-13m { ++ compatible = "fixed-factor-clock"; + #clock-cells = <0>; +- clock-frequency = <13000000>; ++ clocks = <&clk26m>; ++ clock-div = <2>; ++ clock-mult = <1>; + clock-output-names = "clk13m"; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-033-arm64-dts-qcom-sdm845-db845c-fix-audio-codec-in.patch b/patches.kernel.org/6.2.3-033-arm64-dts-qcom-sdm845-db845c-fix-audio-codec-in.patch new file mode 100644 index 0000000..a8bd052 --- /dev/null +++ b/patches.kernel.org/6.2.3-033-arm64-dts-qcom-sdm845-db845c-fix-audio-codec-in.patch @@ -0,0 +1,42 @@ +From: Krzysztof Kozlowski +Date: Thu, 22 Dec 2022 16:13:16 +0100 +Subject: [PATCH] arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt + pin name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 740862bb5f59b93efb390a417995f88a64bdc323 + +[ Upstream commit 740862bb5f59b93efb390a417995f88a64bdc323 ] + +The pin config entry should have a string, not number, for the GPIO used +as WCD9340 audio codec interrupt. + +Fixes: 89a32a4e769c ("arm64: dts: qcom: db845c: add analog audio support") +Reported-by: Doug Anderson +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221222151319.122398-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +index 878801f5..75a46459 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +@@ -974,7 +974,7 @@ sdc2_card_det_n: sd-card-det-n { + }; + + wcd_intr_default: wcd_intr_default { +- pins = <54>; ++ pins = "gpio54"; + function = "gpio"; + + input-enable; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-034-arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-audi.patch b/patches.kernel.org/6.2.3-034-arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-audi.patch new file mode 100644 index 0000000..eff1e25 --- /dev/null +++ b/patches.kernel.org/6.2.3-034-arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-audi.patch @@ -0,0 +1,42 @@ +From: Krzysztof Kozlowski +Date: Thu, 22 Dec 2022 16:13:17 +0100 +Subject: [PATCH] arm64: dts: qcom: sdm845-xiaomi-beryllium: fix audio codec + interrupt pin name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e5011447376e1b050847ccb2ef7933176ce4de41 + +[ Upstream commit e5011447376e1b050847ccb2ef7933176ce4de41 ] + +The pin config entry should have a string, not number, for the GPIO used +as WCD9340 audio codec interrupt. + +Fixes: dd6459a0890a ("arm64: dts: qcom: split beryllium dts into common dtsi and tianma dts") +Reported-by: Doug Anderson +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221222151319.122398-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +index 1b12b1a4..d2866155 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +@@ -467,7 +467,7 @@ sdc2_card_det_n: sd-card-det-n { + }; + + wcd_intr_default: wcd_intr_default { +- pins = <54>; ++ pins = "gpio54"; + function = "gpio"; + + input-enable; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-035-x86-acpi-boot-Do-not-register-processors-that-c.patch b/patches.kernel.org/6.2.3-035-x86-acpi-boot-Do-not-register-processors-that-c.patch new file mode 100644 index 0000000..8ef6ac8 --- /dev/null +++ b/patches.kernel.org/6.2.3-035-x86-acpi-boot-Do-not-register-processors-that-c.patch @@ -0,0 +1,83 @@ +From: Kishon Vijay Abraham I +Date: Thu, 5 Jan 2023 04:10:59 +0000 +Subject: [PATCH] x86/acpi/boot: Do not register processors that cannot be + onlined for x2APIC +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e2869bd7af608c343988429ceb1c2fe99644a01f + +[ Upstream commit e2869bd7af608c343988429ceb1c2fe99644a01f ] + +Section 5.2.12.12 Processor Local x2APIC Structure in the ACPI v6.5 +spec mandates that both "enabled" and "online capable" Local APIC Flags +should be used to determine if the processor is usable or not. + +However, Linux doesn't use the "online capable" flag for x2APIC to +determine if the processor is usable. As a result, cpu_possible_mask has +incorrect value and results in more memory getting allocated for per_cpu +variables than it is going to be used. + +Make sure Linux parses both "enabled" and "online capable" flags for +x2APIC to correctly determine if the processor is usable. + +Fixes: aa06e20f1be6 ("x86/ACPI: Don't add CPUs that are not online capable") +Reported-by: Leo Duran +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Borislav Petkov (AMD) +Reviewed-by: Zhang Rui +Acked-by: Rafael J. Wysocki +Link: https://lore.kernel.org/r/20230105041059.39366-1-kvijayab@amd.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/acpi/boot.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c +index 907cc98b..518bda50 100644 +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -188,6 +188,17 @@ static int acpi_register_lapic(int id, u32 acpiid, u8 enabled) + return cpu; + } + ++static bool __init acpi_is_processor_usable(u32 lapic_flags) ++{ ++ if (lapic_flags & ACPI_MADT_ENABLED) ++ return true; ++ ++ if (acpi_support_online_capable && (lapic_flags & ACPI_MADT_ONLINE_CAPABLE)) ++ return true; ++ ++ return false; ++} ++ + static int __init + acpi_parse_x2apic(union acpi_subtable_headers *header, const unsigned long end) + { +@@ -212,6 +223,10 @@ acpi_parse_x2apic(union acpi_subtable_headers *header, const unsigned long end) + if (apic_id == 0xffffffff) + return 0; + ++ /* don't register processors that cannot be onlined */ ++ if (!acpi_is_processor_usable(processor->lapic_flags)) ++ return 0; ++ + /* + * We need to register disabled CPU as well to permit + * counting disabled CPUs. This allows us to size +@@ -250,9 +265,7 @@ acpi_parse_lapic(union acpi_subtable_headers * header, const unsigned long end) + return 0; + + /* don't register processors that can not be onlined */ +- if (acpi_support_online_capable && +- !(processor->lapic_flags & ACPI_MADT_ENABLED) && +- !(processor->lapic_flags & ACPI_MADT_ONLINE_CAPABLE)) ++ if (!acpi_is_processor_usable(processor->lapic_flags)) + return 0; + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-036-arm64-dts-qcom-sc7180-correct-SPMI-bus-address-.patch b/patches.kernel.org/6.2.3-036-arm64-dts-qcom-sc7180-correct-SPMI-bus-address-.patch new file mode 100644 index 0000000..eea2b69 --- /dev/null +++ b/patches.kernel.org/6.2.3-036-arm64-dts-qcom-sc7180-correct-SPMI-bus-address-.patch @@ -0,0 +1,44 @@ +From: Krzysztof Kozlowski +Date: Tue, 13 Dec 2022 11:19:17 +0100 +Subject: [PATCH] arm64: dts: qcom: sc7180: correct SPMI bus address cells +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1f75745537222172f84783d369bbd1fb2d4b6414 + +[ Upstream commit 1f75745537222172f84783d369bbd1fb2d4b6414 ] + +The SPMI bus uses two address cells and zero size cells (second reg +entry - SPMI_USID - is not the size): + + spmi@c440000: #address-cells:0:0: 2 was expected + +Fixes: 0f9dc5f09fbd ("arm64: dts: qcom: sc7180: Add SPMI PMIC arbiter device") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221213101921.47924-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index f71cf21a..e45726be 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -3274,8 +3274,8 @@ spmi_bus: spmi@c440000 { + interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; + qcom,ee = <0>; + qcom,channel = <0>; +- #address-cells = <1>; +- #size-cells = <1>; ++ #address-cells = <2>; ++ #size-cells = <0>; + interrupt-controller; + #interrupt-cells = <4>; + cell-index = <0>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-037-arm64-dts-qcom-sc7280-correct-SPMI-bus-address-.patch b/patches.kernel.org/6.2.3-037-arm64-dts-qcom-sc7280-correct-SPMI-bus-address-.patch new file mode 100644 index 0000000..c2ec780 --- /dev/null +++ b/patches.kernel.org/6.2.3-037-arm64-dts-qcom-sc7280-correct-SPMI-bus-address-.patch @@ -0,0 +1,44 @@ +From: Krzysztof Kozlowski +Date: Tue, 13 Dec 2022 11:19:18 +0100 +Subject: [PATCH] arm64: dts: qcom: sc7280: correct SPMI bus address cells +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8da3786a91e56fe0c4aeb2c2209744474af6e517 + +[ Upstream commit 8da3786a91e56fe0c4aeb2c2209744474af6e517 ] + +The SPMI bus uses two address cells and zero size cells (second reg +entry - SPMI_USID - is not the size): + + spmi@c440000: #address-cells:0:0: 2 was expected + +Fixes: 14abf8dfe364 ("arm64: dts: qcom: sc7280: Add SPMI PMIC arbiter device for SC7280") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221213101921.47924-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 0adf1339..3bedd45e 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -4246,8 +4246,8 @@ spmi_bus: spmi@c440000 { + interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; + qcom,ee = <0>; + qcom,channel = <0>; +- #address-cells = <1>; +- #size-cells = <1>; ++ #address-cells = <2>; ++ #size-cells = <0>; + interrupt-controller; + #interrupt-cells = <4>; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-038-arm64-dts-qcom-sc8280xp-correct-SPMI-bus-addres.patch b/patches.kernel.org/6.2.3-038-arm64-dts-qcom-sc8280xp-correct-SPMI-bus-addres.patch new file mode 100644 index 0000000..c122702 --- /dev/null +++ b/patches.kernel.org/6.2.3-038-arm64-dts-qcom-sc8280xp-correct-SPMI-bus-addres.patch @@ -0,0 +1,45 @@ +From: Krzysztof Kozlowski +Date: Tue, 13 Dec 2022 11:19:19 +0100 +Subject: [PATCH] arm64: dts: qcom: sc8280xp: correct SPMI bus address cells +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 76d9e8b4d54ae2cb91a68f0cb82624887de767a7 + +[ Upstream commit 76d9e8b4d54ae2cb91a68f0cb82624887de767a7 ] + +The SPMI bus uses two address cells and zero size cells (second reg +entry - SPMI_USID - is not the size): + + spmi@c440000: #address-cells:0:0: 2 was expected + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Stephen Boyd +Reviewed-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221213101921.47924-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 71cf81a8..d1bc0e60 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -2051,8 +2051,8 @@ spmi_bus: spmi@c440000 { + interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; + qcom,ee = <0>; + qcom,channel = <0>; +- #address-cells = <1>; +- #size-cells = <1>; ++ #address-cells = <2>; ++ #size-cells = <0>; + interrupt-controller; + #interrupt-cells = <4>; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-039-arm64-dts-qcom-sm8450-correct-Soundwire-wakeup-.patch b/patches.kernel.org/6.2.3-039-arm64-dts-qcom-sm8450-correct-Soundwire-wakeup-.patch new file mode 100644 index 0000000..d66dc0f --- /dev/null +++ b/patches.kernel.org/6.2.3-039-arm64-dts-qcom-sm8450-correct-Soundwire-wakeup-.patch @@ -0,0 +1,42 @@ +From: Krzysztof Kozlowski +Date: Fri, 23 Dec 2022 14:21:21 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8450: correct Soundwire wakeup interrupt + name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5eafe69af43d77cb117f27201076ee50f48363f1 + +[ Upstream commit 5eafe69af43d77cb117f27201076ee50f48363f1 ] + +The bindings expect second Soundwire interrupt to be "wakeup" (Linux +driver takes by index): + + sm8450-hdk.dtb: soundwire-controller@33b0000: interrupt-names:1: 'wakeup' was expected + +Fixes: 14341e76dbc7 ("arm64: dts: qcom: sm8450: add Soundwire and LPASS") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221223132121.81130-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index 57047504..eb331851 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -2263,7 +2263,7 @@ swr2: soundwire-controller@33b0000 { + reg = <0 0x33b0000 0 0x2000>; + interrupts-extended = <&intc GIC_SPI 496 IRQ_TYPE_LEVEL_HIGH>, + <&intc GIC_SPI 520 IRQ_TYPE_LEVEL_HIGH>; +- interrupt-names = "core", "wake"; ++ interrupt-names = "core", "wakeup"; + + clocks = <&vamacro>; + clock-names = "iface"; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-040-arm64-dts-qcom-sdm845-make-DP-node-follow-the-s.patch b/patches.kernel.org/6.2.3-040-arm64-dts-qcom-sdm845-make-DP-node-follow-the-s.patch new file mode 100644 index 0000000..efda00c --- /dev/null +++ b/patches.kernel.org/6.2.3-040-arm64-dts-qcom-sdm845-make-DP-node-follow-the-s.patch @@ -0,0 +1,38 @@ +From: Dmitry Baryshkov +Date: Tue, 10 Jan 2023 06:21:26 +0200 +Subject: [PATCH] arm64: dts: qcom: sdm845: make DP node follow the schema +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 19e509d5ea229244b9205f8671bb75b13738a1f9 + +[ Upstream commit 19e509d5ea229244b9205f8671bb75b13738a1f9 ] + +Drop the #clock-cells (probably a leftover from the times before the DP +PHY split) + +Fixes: eaac4e55a6f4 ("arm64: dts: qcom: sdm845: add displayport node") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230110042126.702147-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 65032b94..f36c23e7 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -4593,7 +4593,6 @@ mdss_dp: displayport-controller@ae90000 { + <&dispcc DISP_CC_MDSS_DP_PIXEL_CLK>; + clock-names = "core_iface", "core_aux", "ctrl_link", + "ctrl_link_iface", "stream_pixel"; +- #clock-cells = <1>; + assigned-clocks = <&dispcc DISP_CC_MDSS_DP_LINK_CLK_SRC>, + <&dispcc DISP_CC_MDSS_DP_PIXEL_CLK_SRC>; + assigned-clock-parents = <&dp_phy 0>, <&dp_phy 1>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-041-arm64-dts-qcom-msm8996-oneplus-common-drop-vdda.patch b/patches.kernel.org/6.2.3-041-arm64-dts-qcom-msm8996-oneplus-common-drop-vdda.patch new file mode 100644 index 0000000..1848d5b --- /dev/null +++ b/patches.kernel.org/6.2.3-041-arm64-dts-qcom-msm8996-oneplus-common-drop-vdda.patch @@ -0,0 +1,38 @@ +From: Dmitry Baryshkov +Date: Mon, 9 Jan 2023 06:24:06 +0200 +Subject: [PATCH] arm64: dts: qcom: msm8996-oneplus-common: drop vdda-supply + from DSI PHY +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1de4e112b97c77efb5cbee39db8541e33dd2b0d5 + +[ Upstream commit 1de4e112b97c77efb5cbee39db8541e33dd2b0d5 ] + +14nm DSI PHY has the only supply, vcca. Drop the extra vdda-supply. + +Fixes: 5a134c940cd3 ("arm64: dts: qcom: msm8996: add support for oneplus3(t)") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230109042406.312047-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi +index 20f5c103..2994337c 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi +@@ -179,7 +179,6 @@ &dsi0_out { + }; + + &dsi0_phy { +- vdda-supply = <&vreg_l2a_1p25>; + vcca-supply = <&vreg_l28a_0p925>; + status = "okay"; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-042-arm64-dts-qcom-sc8280xp-Vote-for-CX-in-USB-cont.patch b/patches.kernel.org/6.2.3-042-arm64-dts-qcom-sc8280xp-Vote-for-CX-in-USB-cont.patch new file mode 100644 index 0000000..24738ac --- /dev/null +++ b/patches.kernel.org/6.2.3-042-arm64-dts-qcom-sc8280xp-Vote-for-CX-in-USB-cont.patch @@ -0,0 +1,48 @@ +From: Bjorn Andersson +Date: Thu, 12 Jan 2023 05:51:17 -0800 +Subject: [PATCH] arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fe07640280cd29ac2997a617a1fb5487feef9387 + +[ Upstream commit fe07640280cd29ac2997a617a1fb5487feef9387 ] + +Running GCC_USB30_*_MASTER_CLK at 200MHz requires CX at nominal level, +not doing so results in occasional lockups. This was previously hidden +by the fact that the display stack incorrectly voted for CX (instead of +MMCX). + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Bjorn Andersson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230112135117.3836655-1-quic_bjorande@quicinc.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index d1bc0e60..8363e823 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -1863,6 +1863,7 @@ usb_0: usb@a6f8800 { + "ss_phy_irq"; + + power-domains = <&gcc USB30_PRIM_GDSC>; ++ required-opps = <&rpmhpd_opp_nom>; + + resets = <&gcc GCC_USB30_PRIM_BCR>; + +@@ -1917,6 +1918,7 @@ usb_1: usb@a8f8800 { + "ss_phy_irq"; + + power-domains = <&gcc USB30_SEC_GDSC>; ++ required-opps = <&rpmhpd_opp_nom>; + + resets = <&gcc GCC_USB30_SEC_BCR>; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-043-arm64-dts-meson-gxl-jethub-j80-Fix-WiFi-MAC-add.patch b/patches.kernel.org/6.2.3-043-arm64-dts-meson-gxl-jethub-j80-Fix-WiFi-MAC-add.patch new file mode 100644 index 0000000..d42842a --- /dev/null +++ b/patches.kernel.org/6.2.3-043-arm64-dts-meson-gxl-jethub-j80-Fix-WiFi-MAC-add.patch @@ -0,0 +1,46 @@ +From: Martin Blumenstingl +Date: Wed, 11 Jan 2023 22:13:45 +0100 +Subject: [PATCH] arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f95acdb2b4af21caae2c76a48e565158181386ca + +[ Upstream commit f95acdb2b4af21caae2c76a48e565158181386ca ] + +Unit addresses should be written using lower-case hex characters. Use +wifi_mac@c to fix a yaml schema validation error once the eFuse +dt-bindings have been converted to a yaml schema: + efuse: Unevaluated properties are not allowed ('wifi_mac@C' was + unexpected) + +Also node names should use hyphens instead of underscores as the latter +can also cause warnings. + +Fixes: abfaae24ecf3 ("arm64: dts: meson-gxl: add support for JetHub H1") +Acked-by: Vyacheslav Bocharov +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-2-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts +index 6831137c..270483e0 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts +@@ -90,7 +90,7 @@ bt_mac: bt_mac@6 { + reg = <0x6 0x6>; + }; + +- wifi_mac: wifi_mac@C { ++ wifi_mac: wifi-mac@c { + reg = <0xc 0x6>; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-044-arm64-dts-meson-gxl-jethub-j80-Fix-Bluetooth-MA.patch b/patches.kernel.org/6.2.3-044-arm64-dts-meson-gxl-jethub-j80-Fix-Bluetooth-MA.patch new file mode 100644 index 0000000..a89502d --- /dev/null +++ b/patches.kernel.org/6.2.3-044-arm64-dts-meson-gxl-jethub-j80-Fix-Bluetooth-MA.patch @@ -0,0 +1,41 @@ +From: Martin Blumenstingl +Date: Wed, 11 Jan 2023 22:13:46 +0100 +Subject: [PATCH] arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node + name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cb199de1d3aecb02556d8a6e26393015effa0a9f + +[ Upstream commit cb199de1d3aecb02556d8a6e26393015effa0a9f ] + +Node names should use hyphens instead of underscores to not cause +warnings. + +Fixes: abfaae24ecf3 ("arm64: dts: meson-gxl: add support for JetHub H1") +Suggested-by: Vyacheslav Bocharov +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-3-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts +index 270483e0..bb741207 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts +@@ -86,7 +86,7 @@ sdio_pwrseq: sdio-pwrseq { + }; + + &efuse { +- bt_mac: bt_mac@6 { ++ bt_mac: bt-mac@6 { + reg = <0x6 0x6>; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-045-arm64-dts-meson-axg-jethub-j1xx-Fix-MAC-address.patch b/patches.kernel.org/6.2.3-045-arm64-dts-meson-axg-jethub-j1xx-Fix-MAC-address.patch new file mode 100644 index 0000000..2f413b5 --- /dev/null +++ b/patches.kernel.org/6.2.3-045-arm64-dts-meson-axg-jethub-j1xx-Fix-MAC-address.patch @@ -0,0 +1,50 @@ +From: Martin Blumenstingl +Date: Wed, 11 Jan 2023 22:13:47 +0100 +Subject: [PATCH] arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node + names +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2f66eeb06e3e8b1cac9e9093be3baadbac2709eb + +[ Upstream commit 2f66eeb06e3e8b1cac9e9093be3baadbac2709eb ] + +Node names should use hyphens instead of underscores to not cause +warnings. + +Fixes: 59ec069d5055 ("arm64: dts: meson-axg: add support for JetHub D1p (j110)") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-4-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi +index 5836b003..22fd43b5 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi +@@ -168,15 +168,15 @@ sn: sn@32 { + reg = <0x32 0x20>; + }; + +- eth_mac: eth_mac@0 { ++ eth_mac: eth-mac@0 { + reg = <0x0 0x6>; + }; + +- bt_mac: bt_mac@6 { ++ bt_mac: bt-mac@6 { + reg = <0x6 0x6>; + }; + +- wifi_mac: wifi_mac@c { ++ wifi_mac: wifi-mac@c { + reg = <0xc 0x6>; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-046-arm64-dts-meson-gx-Fix-Ethernet-MAC-address-uni.patch b/patches.kernel.org/6.2.3-046-arm64-dts-meson-gx-Fix-Ethernet-MAC-address-uni.patch new file mode 100644 index 0000000..29d583a --- /dev/null +++ b/patches.kernel.org/6.2.3-046-arm64-dts-meson-gx-Fix-Ethernet-MAC-address-uni.patch @@ -0,0 +1,40 @@ +From: Martin Blumenstingl +Date: Wed, 11 Jan 2023 22:13:48 +0100 +Subject: [PATCH] arm64: dts: meson-gx: Fix Ethernet MAC address unit name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 + +[ Upstream commit 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 ] + +Unit names should use hyphens instead of underscores to not cause +warnings. + +Fixes: bfe59f92d306 ("ARM64: dts: amlogic: gxbb: Enable NVMEM") +Suggested-by: Vyacheslav Bocharov +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-5-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index 5eed1503..4371230b 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -233,7 +233,7 @@ sn: sn@14 { + reg = <0x14 0x10>; + }; + +- eth_mac: eth_mac@34 { ++ eth_mac: eth-mac@34 { + reg = <0x34 0x10>; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-047-arm64-dts-meson-g12a-Fix-internal-Ethernet-PHY-.patch b/patches.kernel.org/6.2.3-047-arm64-dts-meson-g12a-Fix-internal-Ethernet-PHY-.patch new file mode 100644 index 0000000..ec63b04 --- /dev/null +++ b/patches.kernel.org/6.2.3-047-arm64-dts-meson-g12a-Fix-internal-Ethernet-PHY-.patch @@ -0,0 +1,42 @@ +From: Martin Blumenstingl +Date: Wed, 11 Jan 2023 22:13:49 +0100 +Subject: [PATCH] arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e7303651bbc76c848007f1cfac1fbeaa65f600d1 + +[ Upstream commit e7303651bbc76c848007f1cfac1fbeaa65f600d1 ] + +Documentation/devicetree/bindings/net/ethernet-phy.yaml defines that the +node name for Ethernet PHYs should match the following pattern: + ^ethernet-phy(@[a-f0-9]+)?$ + +Replace the underscore with a hyphen to adhere to this binding. + +Fixes: 280c17df8fbf ("arm64: dts: meson: g12a: add mdio multiplexer") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-6-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +index 7f55d97f..c063a144 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +@@ -1694,7 +1694,7 @@ int_mdio: mdio@1 { + #address-cells = <1>; + #size-cells = <0>; + +- internal_ephy: ethernet_phy@8 { ++ internal_ephy: ethernet-phy@8 { + compatible = "ethernet-phy-id0180.3301", + "ethernet-phy-ieee802.3-c22"; + interrupts = ; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-048-arm64-dts-meson-gx-Fix-the-SCPI-DVFS-node-name-.patch b/patches.kernel.org/6.2.3-048-arm64-dts-meson-gx-Fix-the-SCPI-DVFS-node-name-.patch new file mode 100644 index 0000000..ff654b6 --- /dev/null +++ b/patches.kernel.org/6.2.3-048-arm64-dts-meson-gx-Fix-the-SCPI-DVFS-node-name-.patch @@ -0,0 +1,42 @@ +From: Martin Blumenstingl +Date: Wed, 11 Jan 2023 22:13:50 +0100 +Subject: [PATCH] arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit + address +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f189c869ad92787ddd753558bcbae89d75825bb6 + +[ Upstream commit f189c869ad92787ddd753558bcbae89d75825bb6 ] + +Node names should be generic and use hyphens instead of underscores to +not cause warnings. Also nodes without a reg property should not have a +unit-address. Change the scpi_dvfs node to use clock-controller as node +name without a unit address (since it does not have a reg property). + +Fixes: 70db166a2baa ("ARM64: dts: meson-gxbb: Add SCPI with cpufreq & sensors Nodes") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-7-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index 4371230b..09a016fd 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -250,7 +250,7 @@ scpi { + scpi_clocks: clocks { + compatible = "arm,scpi-clocks"; + +- scpi_dvfs: scpi_clocks@0 { ++ scpi_dvfs: clock-controller { + compatible = "arm,scpi-dvfs-clocks"; + #clock-cells = <1>; + clock-indices = <0>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-049-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_IRQ_ENABLE-.patch b/patches.kernel.org/6.2.3-049-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_IRQ_ENABLE-.patch new file mode 100644 index 0000000..8cee30a --- /dev/null +++ b/patches.kernel.org/6.2.3-049-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_IRQ_ENABLE-.patch @@ -0,0 +1,60 @@ +From: Peter Zijlstra +Date: Thu, 12 Jan 2023 20:43:32 +0100 +Subject: [PATCH] cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again* +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6d9c7f51b1d9179bf7c3542267c656a934e8af23 + +[ Upstream commit 6d9c7f51b1d9179bf7c3542267c656a934e8af23 ] + +So objtool found this bug: + + vmlinux.o: warning: objtool: intel_idle_irq+0x10c: call to trace_hardirqs_off() leaves .noinstr.text section + +As per commit 32d4fd5751ea ("cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE"): + + "must not have tracing in idle functions" + +Clearly people can't read and tinker along until splat dissapears. +This straight up reverts commit d295ad34f236 ("intel_idle: Fix false +positive RCU splats due to incorrect hardirqs state"). + +It doesn't re-introduce the problem because preceding patches fixed it +properly. + +Fixes: d295ad34f236 ("intel_idle: Fix false positive RCU splats due to incorrect hardirqs state") +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Tested-by: Tony Lindgren +Tested-by: Ulf Hansson +Acked-by: Rafael J. Wysocki +Acked-by: Frederic Weisbecker +Link: https://lore.kernel.org/r/20230112195540.434302128@infradead.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/idle/intel_idle.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c +index cfeb24d4..f060ac73 100644 +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -168,13 +168,7 @@ static __cpuidle int intel_idle_irq(struct cpuidle_device *dev, + + raw_local_irq_enable(); + ret = __intel_idle(dev, drv, index); +- +- /* +- * The lockdep hardirqs state may be changed to 'on' with timer +- * tick interrupt followed by __do_softirq(). Use local_irq_disable() +- * to keep the hardirqs state correct. +- */ +- local_irq_disable(); ++ raw_local_irq_disable(); + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-050-arm64-dts-ti-k3-am62-main-Fix-clocks-for-McSPI.patch b/patches.kernel.org/6.2.3-050-arm64-dts-ti-k3-am62-main-Fix-clocks-for-McSPI.patch new file mode 100644 index 0000000..5b2e5b5 --- /dev/null +++ b/patches.kernel.org/6.2.3-050-arm64-dts-ti-k3-am62-main-Fix-clocks-for-McSPI.patch @@ -0,0 +1,57 @@ +From: Dhruva Gole +Date: Tue, 3 Jan 2023 11:18:40 +0530 +Subject: [PATCH] arm64: dts: ti: k3-am62-main: Fix clocks for McSPI +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6be5d8e5d1804eb4cec29cd8a85dc9cb18683b5d + +[ Upstream commit 6be5d8e5d1804eb4cec29cd8a85dc9cb18683b5d ] + +Fixes the clock Device ID's in the DT according to the tisci docs clock +identifiers for AM62x + +Fixes: c37c58fdeb8a ("arm64: dts: ti: k3-am62: Add more peripheral nodes") +Reviewed-by: Bryan Brattlof +Signed-off-by: Dhruva Gole +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20230103054840.1133711-1-d-gole@ti.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +index 07290364..ae1ec581 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +@@ -413,7 +413,7 @@ main_spi0: spi@20100000 { + #address-cells = <1>; + #size-cells = <0>; + power-domains = <&k3_pds 141 TI_SCI_PD_EXCLUSIVE>; +- clocks = <&k3_clks 172 0>; ++ clocks = <&k3_clks 141 0>; + status = "disabled"; + }; + +@@ -424,7 +424,7 @@ main_spi1: spi@20110000 { + #address-cells = <1>; + #size-cells = <0>; + power-domains = <&k3_pds 142 TI_SCI_PD_EXCLUSIVE>; +- clocks = <&k3_clks 173 0>; ++ clocks = <&k3_clks 142 0>; + status = "disabled"; + }; + +@@ -435,7 +435,7 @@ main_spi2: spi@20120000 { + #address-cells = <1>; + #size-cells = <0>; + power-domains = <&k3_pds 143 TI_SCI_PD_EXCLUSIVE>; +- clocks = <&k3_clks 174 0>; ++ clocks = <&k3_clks 143 0>; + status = "disabled"; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-051-arm64-tegra-Fix-duplicate-regulator-on-Jetson-T.patch b/patches.kernel.org/6.2.3-051-arm64-tegra-Fix-duplicate-regulator-on-Jetson-T.patch new file mode 100644 index 0000000..b2c113f --- /dev/null +++ b/patches.kernel.org/6.2.3-051-arm64-tegra-Fix-duplicate-regulator-on-Jetson-T.patch @@ -0,0 +1,37 @@ +From: Thierry Reding +Date: Fri, 18 Nov 2022 07:35:31 +0100 +Subject: [PATCH] arm64: tegra: Fix duplicate regulator on Jetson TX1 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 29bcc1eaca315326d1cc883fbe9b451d1f9e3fa5 + +[ Upstream commit 29bcc1eaca315326d1cc883fbe9b451d1f9e3fa5 ] + +When the top-level regulators were renamed, the 1.2V camera regulator +accidentally ended up with the same DT node name as the 1.8V camera +regulator. + +Fixes: 097e01c61015 ("arm64: tegra: Rename top-level regulators") +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +index dd9a1792..a87e103f 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +@@ -1667,7 +1667,7 @@ vdd_hdmi: regulator-vdd-hdmi { + vin-supply = <&vdd_5v0_sys>; + }; + +- vdd_cam_1v2: regulator-vdd-cam-1v8 { ++ vdd_cam_1v2: regulator-vdd-cam-1v2 { + compatible = "regulator-fixed"; + regulator-name = "vdd-cam-1v2"; + regulator-min-microvolt = <1200000>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-052-arm64-dts-qcom-msm8992-bullhead-Fix-cont_splash.patch b/patches.kernel.org/6.2.3-052-arm64-dts-qcom-msm8992-bullhead-Fix-cont_splash.patch new file mode 100644 index 0000000..3c984c5 --- /dev/null +++ b/patches.kernel.org/6.2.3-052-arm64-dts-qcom-msm8992-bullhead-Fix-cont_splash.patch @@ -0,0 +1,59 @@ +From: Petr Vorel +Date: Mon, 26 Dec 2022 19:54:38 +0100 +Subject: [PATCH] arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 26a91359aea4d89e7d3646d806eed0f3755b74bd + +[ Upstream commit 26a91359aea4d89e7d3646d806eed0f3755b74bd ] + +Original google firmware reports 12 MiB: +[ 0.000000] cma: Found cont_splash_mem@0, memory base 0x0000000003400000, size 12 MiB, limit 0xffffffffffffffff + +which is actually 12*1024*1024 = 0xc00000. + +This matches the aosp source [1]: +&cont_splash_mem { + reg = <0 0x03400000 0 0xc00000>; +}; + +Fixes: 3cb6a271f4b0 ("arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem mapping") +Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994") + +[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/arm64/boot/dts/lge/msm8992-bullhead.dtsi#141 + +Signed-off-by: Petr Vorel +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221226185440.440968-2-pevik@seznam.cz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +index 79de9cc3..123ec67f 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +@@ -2,7 +2,7 @@ + /* + * Copyright (c) 2015, LGE Inc. All rights reserved. + * Copyright (c) 2016, The Linux Foundation. All rights reserved. +- * Copyright (c) 2021, Petr Vorel ++ * Copyright (c) 2021-2022, Petr Vorel + * Copyright (c) 2022, Dominik Kobinski + */ + +@@ -49,7 +49,7 @@ ramoops@1ff00000 { + }; + + cont_splash_mem: memory@3400000 { +- reg = <0 0x03400000 0 0x1200000>; ++ reg = <0 0x03400000 0 0xc00000>; + no-map; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-053-arm64-dts-qcom-msm8992-bullhead-Disable-dfps_da.patch b/patches.kernel.org/6.2.3-053-arm64-dts-qcom-msm8992-bullhead-Disable-dfps_da.patch new file mode 100644 index 0000000..a506a75 --- /dev/null +++ b/patches.kernel.org/6.2.3-053-arm64-dts-qcom-msm8992-bullhead-Disable-dfps_da.patch @@ -0,0 +1,47 @@ +From: Petr Vorel +Date: Mon, 26 Dec 2022 19:54:39 +0100 +Subject: [PATCH] arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4dee5aa44b924036511a744ceb3abb1ceeb96bb6 + +[ Upstream commit 4dee5aa44b924036511a744ceb3abb1ceeb96bb6 ] + +It's disabled on downstream [1] thus not shown on downstream dmesg. + +Removing it fixes warnings on v6.1: + +[ 0.000000] OF: reserved mem: OVERLAP DETECTED! +[ 0.000000] dfps_data_mem@3400000 (0x0000000003400000--0x0000000003401000) overlaps with memory@3400000 (0x0000000003400000--0x0000000004600000) + +[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/arm64/boot/dts/lge/msm8992-bullhead.dtsi#137 + +Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994") + +Signed-off-by: Petr Vorel +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221226185440.440968-3-pevik@seznam.cz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +index 123ec67f..4bceb362 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +@@ -15,6 +15,9 @@ + /* cont_splash_mem has different memory mapping */ + /delete-node/ &cont_splash_mem; + ++/* disabled on downstream, conflicts with cont_splash_mem */ ++/delete-node/ &dfps_data_mem; ++ + / { + model = "LG Nexus 5X"; + compatible = "lg,bullhead", "qcom,msm8992"; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-054-arm64-dts-qcom-msm8956-use-SoC-specific-compat-.patch b/patches.kernel.org/6.2.3-054-arm64-dts-qcom-msm8956-use-SoC-specific-compat-.patch new file mode 100644 index 0000000..48a6155 --- /dev/null +++ b/patches.kernel.org/6.2.3-054-arm64-dts-qcom-msm8956-use-SoC-specific-compat-.patch @@ -0,0 +1,41 @@ +From: Dmitry Baryshkov +Date: Sun, 1 Jan 2023 21:40:29 +0200 +Subject: [PATCH] arm64: dts: qcom: msm8956: use SoC-specific compat for tsens +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0b3aa9aa629c10928e86f6c9666a5e0b14655b2a + +[ Upstream commit 0b3aa9aa629c10928e86f6c9666a5e0b14655b2a ] + +The slope values used during tsens calibration differ between msm8976 +and msm8956 SoCs. Use SoC-specific compat value for the msm8956 SoC. + +Fixes: 0484d3ce0902 ("arm64: dts: qcom: Add DTS for MSM8976 and MSM8956 SoCs") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230101194034.831222-16-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8956.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8956.dtsi b/arch/arm64/boot/dts/qcom/msm8956.dtsi +index e432512d..668e0518 100644 +--- a/arch/arm64/boot/dts/qcom/msm8956.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8956.dtsi +@@ -12,6 +12,10 @@ &pmu { + interrupts = ; + }; + ++&tsens { ++ compatible = "qcom,msm8956-tsens", "qcom,tsens-v1"; ++}; ++ + /* + * You might be wondering.. why is it so empty out there? + * Well, the SoCs are almost identical. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-055-arm64-dts-qcom-ipq8074-correct-USB3-QMP-PHY-s-c.patch b/patches.kernel.org/6.2.3-055-arm64-dts-qcom-ipq8074-correct-USB3-QMP-PHY-s-c.patch new file mode 100644 index 0000000..5138429 --- /dev/null +++ b/patches.kernel.org/6.2.3-055-arm64-dts-qcom-ipq8074-correct-USB3-QMP-PHY-s-c.patch @@ -0,0 +1,66 @@ +From: Robert Marko +Date: Sun, 8 Jan 2023 14:04:40 +0100 +Subject: [PATCH] arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock + output names +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 877cff3568c0f54511d77918ae16b2d6e9a0dfce + +[ Upstream commit 877cff3568c0f54511d77918ae16b2d6e9a0dfce ] + +It seems that clock-output-names for the USB3 QMP PHY-s where set without +actually checking what is the GCC clock driver expecting, so clock core +could never actually find the parents for usb0_pipe_clk_src and +usb1_pipe_clk_src clocks in the GCC driver. + +So, correct the names to be what the driver expects so that parenting +works. + +Before: +gcc_usb0_pipe_clk_src 0 0 0 125000000 0 0 50000 Y +gcc_usb1_pipe_clk_src 0 0 0 125000000 0 0 50000 Y + +After: + usb3phy_0_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y + usb0_pipe_clk_src 1 1 0 125000000 0 0 50000 Y + gcc_usb0_pipe_clk 1 1 0 125000000 0 0 50000 Y + usb3phy_1_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y + usb1_pipe_clk_src 1 1 0 125000000 0 0 50000 Y + gcc_usb1_pipe_clk 1 1 0 125000000 0 0 50000 Y + +Fixes: 5e09bc51d07b ("arm64: dts: ipq8074: enable USB support") +Signed-off-by: Robert Marko +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230108130440.670181-2-robimarko@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 4e51d8e3..9dcb48eb 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -137,7 +137,7 @@ usb1_ssphy: phy@58200 { + #clock-cells = <0>; + clocks = <&gcc GCC_USB1_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "gcc_usb1_pipe_clk_src"; ++ clock-output-names = "usb3phy_1_cc_pipe_clk"; + }; + }; + +@@ -180,7 +180,7 @@ usb0_ssphy: phy@78200 { + #clock-cells = <0>; + clocks = <&gcc GCC_USB0_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "gcc_usb0_pipe_clk_src"; ++ clock-output-names = "usb3phy_0_cc_pipe_clk"; + }; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-056-arm64-dts-qcom-ipq8074-fix-Gen2-PCIe-QMP-PHY.patch b/patches.kernel.org/6.2.3-056-arm64-dts-qcom-ipq8074-fix-Gen2-PCIe-QMP-PHY.patch new file mode 100644 index 0000000..6708b1a --- /dev/null +++ b/patches.kernel.org/6.2.3-056-arm64-dts-qcom-ipq8074-fix-Gen2-PCIe-QMP-PHY.patch @@ -0,0 +1,41 @@ +From: Robert Marko +Date: Fri, 13 Jan 2023 17:44:41 +0100 +Subject: [PATCH] arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 100d9c94ccf15b02742c326cd04f422ab729153b + +[ Upstream commit 100d9c94ccf15b02742c326cd04f422ab729153b ] + +Serdes register space sizes are incorrect, update them to match the +actual sizes from downstream QCA 5.4 kernel. + +Fixes: 942bcd33ed45 ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-1-robimarko@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 9dcb48eb..90b0abf8 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -242,9 +242,9 @@ pcie_qmp1: phy@8e000 { + status = "disabled"; + + pcie_phy1: phy@8e200 { +- reg = <0x8e200 0x16c>, ++ reg = <0x8e200 0x130>, + <0x8e400 0x200>, +- <0x8e800 0x4f4>; ++ <0x8e800 0x1f8>; + #phy-cells = <0>; + #clock-cells = <0>; + clocks = <&gcc GCC_PCIE1_PIPE_CLK>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-057-arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-QMP-PHY.patch b/patches.kernel.org/6.2.3-057-arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-QMP-PHY.patch new file mode 100644 index 0000000..683dca5 --- /dev/null +++ b/patches.kernel.org/6.2.3-057-arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-QMP-PHY.patch @@ -0,0 +1,68 @@ +From: Robert Marko +Date: Fri, 13 Jan 2023 17:44:42 +0100 +Subject: [PATCH] arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7ba33591b45f9d547a317e42f1c2acd19c925eb6 + +[ Upstream commit 7ba33591b45f9d547a317e42f1c2acd19c925eb6 ] + +IPQ8074 comes in 2 silicon versions: +* v1 with 2x Gen2 PCIe ports and QMP PHY-s +* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s + +v2 is the final and production version that is actually supported by the +kernel, however it looks like PCIe related nodes were added for the v1 SoC. + +Now that we have Gen3 QMP PHY support, we can start fixing the PCIe support +by fixing the Gen3 QMP PHY node first. + +Change the compatible to the Gen3 QMP PHY, correct the register space start +and size, add the missing misc PCS register space. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-2-robimarko@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 90b0abf8..f099785f 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -197,9 +197,9 @@ qusb_phy_0: phy@79000 { + status = "disabled"; + }; + +- pcie_qmp0: phy@86000 { +- compatible = "qcom,ipq8074-qmp-pcie-phy"; +- reg = <0x00086000 0x1c4>; ++ pcie_qmp0: phy@84000 { ++ compatible = "qcom,ipq8074-qmp-gen3-pcie-phy"; ++ reg = <0x00084000 0x1bc>; + #address-cells = <1>; + #size-cells = <1>; + ranges; +@@ -213,10 +213,11 @@ pcie_qmp0: phy@86000 { + "common"; + status = "disabled"; + +- pcie_phy0: phy@86200 { +- reg = <0x86200 0x16c>, +- <0x86400 0x200>, +- <0x86800 0x4f4>; ++ pcie_phy0: phy@84200 { ++ reg = <0x84200 0x16c>, ++ <0x84400 0x200>, ++ <0x84800 0x1f0>, ++ <0x84c00 0xf4>; + #phy-cells = <0>; + #clock-cells = <0>; + clocks = <&gcc GCC_PCIE0_PIPE_CLK>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-058-arm64-dts-qcom-ipq8074-correct-Gen2-PCIe-ranges.patch b/patches.kernel.org/6.2.3-058-arm64-dts-qcom-ipq8074-correct-Gen2-PCIe-ranges.patch new file mode 100644 index 0000000..5206d42 --- /dev/null +++ b/patches.kernel.org/6.2.3-058-arm64-dts-qcom-ipq8074-correct-Gen2-PCIe-ranges.patch @@ -0,0 +1,42 @@ +From: Robert Marko +Date: Fri, 13 Jan 2023 17:44:43 +0100 +Subject: [PATCH] arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2055cb7dccea16bafa3adf9c5e3216949512c34a + +[ Upstream commit 2055cb7dccea16bafa3adf9c5e3216949512c34a ] + +Current ranges property set in Gen2 PCIe node is incorrect, replace it +with the downstream 5.4 QCA kernel value. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-3-robimarko@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index f099785f..df16ef5a 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -773,9 +773,9 @@ pcie1: pci@10000000 { + phy-names = "pciephy"; + + ranges = <0x81000000 0 0x10200000 0x10200000 +- 0 0x100000 /* downstream I/O */ +- 0x82000000 0 0x10300000 0x10300000 +- 0 0xd00000>; /* non-prefetchable memory */ ++ 0 0x10000>, /* downstream I/O */ ++ <0x82000000 0 0x10220000 0x10220000 ++ 0 0xfde0000>; /* non-prefetchable memory */ + + interrupts = ; + interrupt-names = "msi"; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-059-arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-node.patch b/patches.kernel.org/6.2.3-059-arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-node.patch new file mode 100644 index 0000000..d3a49e0 --- /dev/null +++ b/patches.kernel.org/6.2.3-059-arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-node.patch @@ -0,0 +1,110 @@ +From: Robert Marko +Date: Fri, 13 Jan 2023 17:44:48 +0100 +Subject: [PATCH] arm64: dts: qcom: ipq8074: fix Gen3 PCIe node +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3e83a9c41ab0244a45a4a2800b9adb8de0d15f82 + +[ Upstream commit 3e83a9c41ab0244a45a4a2800b9adb8de0d15f82 ] + +IPQ8074 comes in 2 silicon versions: +* v1 with 2x Gen2 PCIe ports and QMP PHY-s +* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s + +v2 is the final and production version that is actually supported by the +kernel, however it looks like PCIe related nodes were added for the v1 SoC. + +Finish the PCIe fixup by using the correct compatible, adding missing ATU +register space, declaring max-link-speed, use correct ranges, add missing +clocks and resets. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-8-robimarko@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 30 +++++++++++++++------------ + 1 file changed, 17 insertions(+), 13 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index df16ef5a..e38aa76e 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -818,16 +818,18 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ + }; + + pcie0: pci@20000000 { +- compatible = "qcom,pcie-ipq8074"; ++ compatible = "qcom,pcie-ipq8074-gen3"; + reg = <0x20000000 0xf1d>, + <0x20000f20 0xa8>, +- <0x00080000 0x2000>, ++ <0x20001000 0x1000>, ++ <0x00080000 0x4000>, + <0x20100000 0x1000>; +- reg-names = "dbi", "elbi", "parf", "config"; ++ reg-names = "dbi", "elbi", "atu", "parf", "config"; + device_type = "pci"; + linux,pci-domain = <0>; + bus-range = <0x00 0xff>; + num-lanes = <1>; ++ max-link-speed = <3>; + #address-cells = <3>; + #size-cells = <2>; + +@@ -835,9 +837,9 @@ pcie0: pci@20000000 { + phy-names = "pciephy"; + + ranges = <0x81000000 0 0x20200000 0x20200000 +- 0 0x100000 /* downstream I/O */ +- 0x82000000 0 0x20300000 0x20300000 +- 0 0xd00000>; /* non-prefetchable memory */ ++ 0 0x10000>, /* downstream I/O */ ++ <0x82000000 0 0x20220000 0x20220000 ++ 0 0xfde0000>; /* non-prefetchable memory */ + + interrupts = ; + interrupt-names = "msi"; +@@ -855,28 +857,30 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ + clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, + <&gcc GCC_PCIE0_AXI_M_CLK>, + <&gcc GCC_PCIE0_AXI_S_CLK>, +- <&gcc GCC_PCIE0_AHB_CLK>, +- <&gcc GCC_PCIE0_AUX_CLK>; +- ++ <&gcc GCC_PCIE0_AXI_S_BRIDGE_CLK>, ++ <&gcc GCC_PCIE0_RCHNG_CLK>; + clock-names = "iface", + "axi_m", + "axi_s", +- "ahb", +- "aux"; ++ "axi_bridge", ++ "rchng"; ++ + resets = <&gcc GCC_PCIE0_PIPE_ARES>, + <&gcc GCC_PCIE0_SLEEP_ARES>, + <&gcc GCC_PCIE0_CORE_STICKY_ARES>, + <&gcc GCC_PCIE0_AXI_MASTER_ARES>, + <&gcc GCC_PCIE0_AXI_SLAVE_ARES>, + <&gcc GCC_PCIE0_AHB_ARES>, +- <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>; ++ <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>, ++ <&gcc GCC_PCIE0_AXI_SLAVE_STICKY_ARES>; + reset-names = "pipe", + "sleep", + "sticky", + "axi_m", + "axi_s", + "ahb", +- "axi_m_sticky"; ++ "axi_m_sticky", ++ "axi_s_sticky"; + status = "disabled"; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-060-arm64-dts-qcom-ipq8074-correct-PCIe-QMP-PHY-out.patch b/patches.kernel.org/6.2.3-060-arm64-dts-qcom-ipq8074-correct-PCIe-QMP-PHY-out.patch new file mode 100644 index 0000000..f805f38 --- /dev/null +++ b/patches.kernel.org/6.2.3-060-arm64-dts-qcom-ipq8074-correct-PCIe-QMP-PHY-out.patch @@ -0,0 +1,53 @@ +From: Robert Marko +Date: Fri, 13 Jan 2023 17:44:49 +0100 +Subject: [PATCH] arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock + names +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0e8b90c0256cf9c9589e2cee517dedc987a34355 + +[ Upstream commit 0e8b90c0256cf9c9589e2cee517dedc987a34355 ] + +Current PCIe QMP PHY output name were changed in ("arm64: dts: qcom: Fix +IPQ8074 PCIe PHY nodes") however it did not account for the fact that GCC +driver is relying on the old names to match them as they are being used as +the parent for the gcc_pcie0_pipe_clk and gcc_pcie1_pipe_clk. + +This broke parenting as GCC could not find the parent clock, so fix it by +changing to the names that driver is expecting. + +Fixes: 942bcd33ed45 ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-9-robimarko@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index e38aa76e..4294beeb 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -222,7 +222,7 @@ pcie_phy0: phy@84200 { + #clock-cells = <0>; + clocks = <&gcc GCC_PCIE0_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "pcie_0_pipe_clk"; ++ clock-output-names = "pcie20_phy0_pipe_clk"; + }; + }; + +@@ -250,7 +250,7 @@ pcie_phy1: phy@8e200 { + #clock-cells = <0>; + clocks = <&gcc GCC_PCIE1_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "pcie_1_pipe_clk"; ++ clock-output-names = "pcie20_phy1_pipe_clk"; + }; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-061-arm64-dts-meson-remove-CPU-opps-below-1GHz-for-.patch b/patches.kernel.org/6.2.3-061-arm64-dts-meson-remove-CPU-opps-below-1GHz-for-.patch new file mode 100644 index 0000000..2db92e9 --- /dev/null +++ b/patches.kernel.org/6.2.3-061-arm64-dts-meson-remove-CPU-opps-below-1GHz-for-.patch @@ -0,0 +1,60 @@ +From: Christian Hewitt +Date: Thu, 19 Jan 2023 05:30:31 +0000 +Subject: [PATCH] arm64: dts: meson: remove CPU opps below 1GHz for G12A boards +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3cbd431c2b34d84605d358c8c57654193fd661fb + +[ Upstream commit 3cbd431c2b34d84605d358c8c57654193fd661fb ] + +Amlogic G12A devices experience CPU stalls and random board wedges when +the system idles and CPU cores clock down to lower opp points. Recent +vendor kernels include a change to remove 100-250MHz and other distro +sources also remove the 500/667MHz points. Unless all 100-667Mhz opps +are removed or the CPU governor forced to performance stalls are still +observed, so let's remove them to improve stability and uptime. + +Fixes: b190056fa9ee ("arm64: dts: meson-g12a: add cpus OPP table") +Signed-off-by: Christian Hewitt +Link: https://lore.kernel.org/r/20230119053031.21400-1-christianshewitt@gmail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 -------------------- + 1 file changed, 20 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +index 7677764e..f58fd2a6 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +@@ -58,26 +58,6 @@ cpu_opp_table: opp-table { + compatible = "operating-points-v2"; + opp-shared; + +- opp-100000000 { +- opp-hz = /bits/ 64 <100000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-250000000 { +- opp-hz = /bits/ 64 <250000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-500000000 { +- opp-hz = /bits/ 64 <500000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-667000000 { +- opp-hz = /bits/ 64 <666666666>; +- opp-microvolt = <731000>; +- }; +- + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; + opp-microvolt = <731000>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-062-ARM-OMAP1-call-platform_device_put-in-error-cas.patch b/patches.kernel.org/6.2.3-062-ARM-OMAP1-call-platform_device_put-in-error-cas.patch new file mode 100644 index 0000000..6eea345 --- /dev/null +++ b/patches.kernel.org/6.2.3-062-ARM-OMAP1-call-platform_device_put-in-error-cas.patch @@ -0,0 +1,40 @@ +From: Yang Yingliang +Date: Thu, 19 Jan 2023 11:57:54 +0200 +Subject: [PATCH] ARM: OMAP1: call platform_device_put() in error case in + omap1_dm_timer_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0414a100d6ab32721efa70ab55524540fdfe0ede + +[ Upstream commit 0414a100d6ab32721efa70ab55524540fdfe0ede ] + +If platform_device_add() is not called or failed, it should call +platform_device_put() in error case. + +Fixes: 97933d6ced60 ("ARM: OMAP1: dmtimer: conversion to platform devices") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Message-Id: <20220701094602.2365099-1-yangyingliang@huawei.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/mach-omap1/timer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c +index f5cd4bbf..81a912c1 100644 +--- a/arch/arm/mach-omap1/timer.c ++++ b/arch/arm/mach-omap1/timer.c +@@ -158,7 +158,7 @@ static int __init omap1_dm_timer_init(void) + kfree(pdata); + + err_free_pdev: +- platform_device_unregister(pdev); ++ platform_device_put(pdev); + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-063-arm64-dts-mediatek-mt8192-Mark-scp_adsp-clock-a.patch b/patches.kernel.org/6.2.3-063-arm64-dts-mediatek-mt8192-Mark-scp_adsp-clock-a.patch new file mode 100644 index 0000000..b2de96c --- /dev/null +++ b/patches.kernel.org/6.2.3-063-arm64-dts-mediatek-mt8192-Mark-scp_adsp-clock-a.patch @@ -0,0 +1,46 @@ +From: Chen-Yu Tsai +Date: Thu, 29 Dec 2022 18:12:02 +0800 +Subject: [PATCH] arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 089cd717e6ef03cf9cf7865777d67775de41339b + +[ Upstream commit 089cd717e6ef03cf9cf7865777d67775de41339b ] + +The scp_adsp clock controller is under the SCP_ADSP power domain. This +power domain is currently not supported nor defined. + +Mark the clock controller as broken for now, to avoid the system from +trying to access it, and causing the CPU or bus to stall. + +Fixes: 5d2b897bc6f5 ("arm64: dts: mediatek: Add mt8192 clock controllers") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20221229101202.1655924-1-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 0d43a327..46a1e457 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -586,6 +586,8 @@ scp_adsp: clock-controller@10720000 { + compatible = "mediatek,mt8192-scp_adsp"; + reg = <0 0x10720000 0 0x1000>; + #clock-cells = <1>; ++ /* power domain dependency not upstreamed */ ++ status = "fail"; + }; + + uart0: serial@11002000 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-064-ARM-bcm2835_defconfig-Enable-the-framebuffer.patch b/patches.kernel.org/6.2.3-064-ARM-bcm2835_defconfig-Enable-the-framebuffer.patch new file mode 100644 index 0000000..ddc7ee9 --- /dev/null +++ b/patches.kernel.org/6.2.3-064-ARM-bcm2835_defconfig-Enable-the-framebuffer.patch @@ -0,0 +1,40 @@ +From: Stefan Wahren +Date: Fri, 13 Jan 2023 21:58:41 +0100 +Subject: [PATCH] ARM: bcm2835_defconfig: Enable the framebuffer +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: afc8dd99840b7fb7190e769a893cda673bc3a907 + +[ Upstream commit afc8dd99840b7fb7190e769a893cda673bc3a907 ] + +Booting Linux on a Raspberry Pi based on bcm2835_defconfig there is +no display activity. + +Enable CONFIG_FB which is nowadays required for CONFIG_FB_SIMPLE +and CONFIG_FRAMEBUFFER_CONSOLE. + +Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20230113205842.17051-1-stefan.wahren@i2se.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/configs/bcm2835_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/configs/bcm2835_defconfig b/arch/arm/configs/bcm2835_defconfig +index a51babd1..be0c984a 100644 +--- a/arch/arm/configs/bcm2835_defconfig ++++ b/arch/arm/configs/bcm2835_defconfig +@@ -107,6 +107,7 @@ CONFIG_MEDIA_CAMERA_SUPPORT=y + CONFIG_DRM=y + CONFIG_DRM_V3D=y + CONFIG_DRM_VC4=y ++CONFIG_FB=y + CONFIG_FB_SIMPLE=y + CONFIG_FRAMEBUFFER_CONSOLE=y + CONFIG_SOUND=y +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-065-ARM-s3c-fix-s3c64xx_set_timer_source-prototype.patch b/patches.kernel.org/6.2.3-065-ARM-s3c-fix-s3c64xx_set_timer_source-prototype.patch new file mode 100644 index 0000000..1e06529 --- /dev/null +++ b/patches.kernel.org/6.2.3-065-ARM-s3c-fix-s3c64xx_set_timer_source-prototype.patch @@ -0,0 +1,47 @@ +From: Arnd Bergmann +Date: Wed, 18 Jan 2023 10:02:12 +0100 +Subject: [PATCH] ARM: s3c: fix s3c64xx_set_timer_source prototype +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5bf52f5e4d12b8109f348cab60cb7d51092c4270 + +[ Upstream commit 5bf52f5e4d12b8109f348cab60cb7d51092c4270 ] + +The prototype does not match the definition, as gcc-13 points +out: + +arch/arm/mach-s3c/s3c64xx.c:169:13: error: conflicting types for 's3c64xx_set_timer_source' due to enum/integer mismatch; have 'void(unsigned int, unsigned int)' [-Werror=enum-int-mismatch] + 169 | void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source) + | ^~~~~~~~~~~~~~~~~~~~~~~~ +In file included from arch/arm/mach-s3c/s3c64xx.c:50: +arch/arm/mach-s3c/s3c64xx.h:62:20: note: previous declaration of 's3c64xx_set_timer_source' with type 'void(enum s3c64xx_timer_mode, enum s3c64xx_timer_mode)' + 62 | extern void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event, + | ^~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: 4280506ac9bb ("ARM: SAMSUNG: Move all platforms to new clocksource driver") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230118090224.2162863-1-arnd@kernel.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/mach-s3c/s3c64xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-s3c/s3c64xx.c b/arch/arm/mach-s3c/s3c64xx.c +index 0a8116c1..dce2b0e9 100644 +--- a/arch/arm/mach-s3c/s3c64xx.c ++++ b/arch/arm/mach-s3c/s3c64xx.c +@@ -173,7 +173,8 @@ static struct samsung_pwm_variant s3c64xx_pwm_variant = { + .tclk_mask = (1 << 7) | (1 << 6) | (1 << 5), + }; + +-void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source) ++void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event, ++ enum s3c64xx_timer_mode source) + { + s3c64xx_pwm_variant.output_mask = BIT(SAMSUNG_PWM_NUM) - 1; + s3c64xx_pwm_variant.output_mask &= ~(BIT(event) | BIT(source)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-066-arm64-dts-ti-k3-j7200-Fix-wakeup-pinmux-range.patch b/patches.kernel.org/6.2.3-066-arm64-dts-ti-k3-j7200-Fix-wakeup-pinmux-range.patch new file mode 100644 index 0000000..8b9af63 --- /dev/null +++ b/patches.kernel.org/6.2.3-066-arm64-dts-ti-k3-j7200-Fix-wakeup-pinmux-range.patch @@ -0,0 +1,91 @@ +From: Vaishnav Achath +Date: Thu, 19 Jan 2023 09:56:22 +0530 +Subject: [PATCH] arm64: dts: ti: k3-j7200: Fix wakeup pinmux range +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9ae21ac445e911e3541985c20052fc05d60f6879 + +[ Upstream commit 9ae21ac445e911e3541985c20052fc05d60f6879 ] + +The WKUP_PADCONFIG register region in J7200 has multiple non-addressable +regions, split the existing wkup_pmx region as follows to avoid the +non-addressable regions and include all valid WKUP_PADCONFIG registers. +Also update references to old nodes with new ones. + +wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12) +wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15) +wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84) +wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100) + +J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) : + https://www.ti.com/lit/ds/symlink/dra821u.pdf + +Fixes: d361ed88455f ("arm64: dts: ti: Add support for J7200 SoC") + +Signed-off-by: Vaishnav Achath +Reviewed-by: Jayesh Choudhary +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20230119042622.22310-1-vaishnav.a@ti.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../dts/ti/k3-j7200-common-proc-board.dts | 2 +- + .../boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 ++++++++++++++++++- + 2 files changed, 29 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +index 6240856e..0d39d6b8 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +@@ -80,7 +80,7 @@ vdd_sd_dv: gpio-regulator-TLV71033 { + }; + }; + +-&wkup_pmx0 { ++&wkup_pmx2 { + mcu_cpsw_pins_default: mcu-cpsw-pins-default { + pinctrl-single,pins = < + J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */ +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi +index fe669deb..de56a016 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi +@@ -56,7 +56,34 @@ chipid@43000014 { + wkup_pmx0: pinctrl@4301c000 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ +- reg = <0x00 0x4301c000 0x00 0x178>; ++ reg = <0x00 0x4301c000 0x00 0x34>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ wkup_pmx1: pinctrl@0x4301c038 { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x4301c038 0x00 0x8>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ wkup_pmx2: pinctrl@0x4301c068 { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x4301c068 0x00 0xec>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ wkup_pmx3: pinctrl@0x4301c174 { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x4301c174 0x00 0x20>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-067-ARM-dts-exynos-correct-wr-active-property-in-Ex.patch b/patches.kernel.org/6.2.3-067-ARM-dts-exynos-correct-wr-active-property-in-Ex.patch new file mode 100644 index 0000000..f100a49 --- /dev/null +++ b/patches.kernel.org/6.2.3-067-ARM-dts-exynos-correct-wr-active-property-in-Ex.patch @@ -0,0 +1,39 @@ +From: Krzysztof Kozlowski +Date: Fri, 20 Jan 2023 16:53:54 +0100 +Subject: [PATCH] ARM: dts: exynos: correct wr-active property in Exynos3250 + Rinato +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d15d2a617499882971ddb773a583015bf36fa492 + +[ Upstream commit d15d2a617499882971ddb773a583015bf36fa492 ] + +The property is wr-active: + + exynos3250-rinato.dtb: fimd@11c00000: i80-if-timings: 'wr-act' does not match any of the regexes: 'pinctrl-[0-9]+' + +Fixes: b59b3afb94d4 ("ARM: dts: add fimd device support for exynos3250-rinato") +Link: https://lore.kernel.org/r/20230120155404.323386-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts +index 6d2c7bb1..2eb68200 100644 +--- a/arch/arm/boot/dts/exynos3250-rinato.dts ++++ b/arch/arm/boot/dts/exynos3250-rinato.dts +@@ -250,7 +250,7 @@ &fimd { + i80-if-timings { + cs-setup = <0>; + wr-setup = <0>; +- wr-act = <1>; ++ wr-active = <1>; + wr-hold = <0>; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-068-ARM-imx-Call-ida_simple_remove-for-ida_simple_g.patch b/patches.kernel.org/6.2.3-068-ARM-imx-Call-ida_simple_remove-for-ida_simple_g.patch new file mode 100644 index 0000000..6fcaf8e --- /dev/null +++ b/patches.kernel.org/6.2.3-068-ARM-imx-Call-ida_simple_remove-for-ida_simple_g.patch @@ -0,0 +1,103 @@ +From: Angus Chen +Date: Thu, 5 Jan 2023 14:11:23 +0800 +Subject: [PATCH] ARM: imx: Call ida_simple_remove() for ida_simple_get +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 + +[ Upstream commit ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 ] + +The function call ida_simple_get maybe fail,we should deal with it. +And if ida_simple_get success ,it need to call ida_simple_remove also. +BTW,devm_kasprintf can handle id is zero for consistency. + +Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") +Signed-off-by: Angus Chen +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/mach-imx/mmdc.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c +index af12668d..b9efe9da 100644 +--- a/arch/arm/mach-imx/mmdc.c ++++ b/arch/arm/mach-imx/mmdc.c +@@ -99,6 +99,7 @@ struct mmdc_pmu { + cpumask_t cpu; + struct hrtimer hrtimer; + unsigned int active_events; ++ int id; + struct device *dev; + struct perf_event *mmdc_events[MMDC_NUM_COUNTERS]; + struct hlist_node node; +@@ -433,8 +434,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer) + static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, + void __iomem *mmdc_base, struct device *dev) + { +- int mmdc_num; +- + *pmu_mmdc = (struct mmdc_pmu) { + .pmu = (struct pmu) { + .task_ctx_nr = perf_invalid_context, +@@ -452,15 +451,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, + .active_events = 0, + }; + +- mmdc_num = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL); ++ pmu_mmdc->id = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL); + +- return mmdc_num; ++ return pmu_mmdc->id; + } + + static int imx_mmdc_remove(struct platform_device *pdev) + { + struct mmdc_pmu *pmu_mmdc = platform_get_drvdata(pdev); + ++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + perf_pmu_unregister(&pmu_mmdc->pmu); + iounmap(pmu_mmdc->mmdc_base); +@@ -474,7 +474,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + { + struct mmdc_pmu *pmu_mmdc; + char *name; +- int mmdc_num; + int ret; + const struct of_device_id *of_id = + of_match_device(imx_mmdc_dt_ids, &pdev->dev); +@@ -497,14 +496,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + cpuhp_mmdc_state = ret; + } + +- mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); +- pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; +- if (mmdc_num == 0) +- name = "mmdc"; +- else +- name = devm_kasprintf(&pdev->dev, +- GFP_KERNEL, "mmdc%d", mmdc_num); ++ ret = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); ++ if (ret < 0) ++ goto pmu_free; + ++ name = devm_kasprintf(&pdev->dev, ++ GFP_KERNEL, "mmdc%d", ret); ++ ++ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; + pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data; + + hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC, +@@ -525,6 +524,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + + pmu_register_err: + pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret); ++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + hrtimer_cancel(&pmu_mmdc->hrtimer); + pmu_free: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-069-arm64-dts-amlogic-meson-gx-fix-SCPI-clock-dvfs-.patch b/patches.kernel.org/6.2.3-069-arm64-dts-amlogic-meson-gx-fix-SCPI-clock-dvfs-.patch new file mode 100644 index 0000000..0ce2507 --- /dev/null +++ b/patches.kernel.org/6.2.3-069-arm64-dts-amlogic-meson-gx-fix-SCPI-clock-dvfs-.patch @@ -0,0 +1,36 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:22 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 127f79212b07c5d9a6657a87e3eafdd889335814 + +[ Upstream commit 127f79212b07c5d9a6657a87e3eafdd889335814 ] + +Fixes: +scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-1-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index 09a016fd..467d2eaf 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -250,7 +250,7 @@ scpi { + scpi_clocks: clocks { + compatible = "arm,scpi-clocks"; + +- scpi_dvfs: clock-controller { ++ scpi_dvfs: clocks-0 { + compatible = "arm,scpi-dvfs-clocks"; + #clock-cells = <1>; + clock-indices = <0>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-070-arm64-dts-amlogic-meson-axg-fix-SCPI-clock-dvfs.patch b/patches.kernel.org/6.2.3-070-arm64-dts-amlogic-meson-axg-fix-SCPI-clock-dvfs.patch new file mode 100644 index 0000000..ec6fbe2 --- /dev/null +++ b/patches.kernel.org/6.2.3-070-arm64-dts-amlogic-meson-axg-fix-SCPI-clock-dvfs.patch @@ -0,0 +1,36 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:23 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5b7069d72f03c92a0ab919725017394ebce03a81 + +[ Upstream commit 5b7069d72f03c92a0ab919725017394ebce03a81 ] + +Fixes: +scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-2-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +index 417523dc..c87df0b2 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +@@ -153,7 +153,7 @@ scpi { + scpi_clocks: clocks { + compatible = "arm,scpi-clocks"; + +- scpi_dvfs: clock-controller { ++ scpi_dvfs: clocks-0 { + compatible = "arm,scpi-dvfs-clocks"; + #clock-cells = <1>; + clock-indices = <0>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-071-arm64-dts-amlogic-meson-gx-add-missing-SCPI-sen.patch b/patches.kernel.org/6.2.3-071-arm64-dts-amlogic-meson-gx-add-missing-SCPI-sen.patch new file mode 100644 index 0000000..acdc8ce --- /dev/null +++ b/patches.kernel.org/6.2.3-071-arm64-dts-amlogic-meson-gx-add-missing-SCPI-sen.patch @@ -0,0 +1,39 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:24 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-gx: add missing SCPI sensors + compatible +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2ff650051493d5bdb6dd09d4c2850bb37db6be31 + +[ Upstream commit 2ff650051493d5bdb6dd09d4c2850bb37db6be31 ] + +Fixes: +scpi: sensors:compatible: 'oneOf' conditional failed, one must be fixed: + ['amlogic,meson-gxbb-scpi-sensors'] is too short + 'arm,scpi-sensors' was expected + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-3-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +index c87df0b2..ff2b3331 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +@@ -162,7 +162,7 @@ scpi_dvfs: clocks-0 { + }; + + scpi_sensors: sensors { +- compatible = "amlogic,meson-gxbb-scpi-sensors"; ++ compatible = "amlogic,meson-gxbb-scpi-sensors", "arm,scpi-sensors"; + #thermal-sensor-cells = <1>; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-072-arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx.patch b/patches.kernel.org/6.2.3-072-arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx.patch new file mode 100644 index 0000000..54b94e7 --- /dev/null +++ b/patches.kernel.org/6.2.3-072-arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx.patch @@ -0,0 +1,37 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:25 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix + supply name of USB controller node +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a69cb1042cea840bc7b60fea1c26a6b259e68bf2 + +[ Upstream commit a69cb1042cea840bc7b60fea1c26a6b259e68bf2 ] + +Fixes: +usb@ffe09080: 'phy-supply' does not match any of the regexes: '^usb@[0-9a-f]+$', 'pinctrl-[0-9]+' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-4-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi +index 22fd43b5..1916c007 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi +@@ -303,7 +303,7 @@ &uart_AO_B { + + &usb { + status = "okay"; +- phy-supply = <&usb_pwr>; ++ vbus-supply = <&usb_pwr>; + }; + + &spicc1 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-073-arm64-dts-amlogic-meson-gxl-s905d-sml5442tw-dro.patch b/patches.kernel.org/6.2.3-073-arm64-dts-amlogic-meson-gxl-s905d-sml5442tw-dro.patch new file mode 100644 index 0000000..a46f882 --- /dev/null +++ b/patches.kernel.org/6.2.3-073-arm64-dts-amlogic-meson-gxl-s905d-sml5442tw-dro.patch @@ -0,0 +1,35 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:26 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid + clock-names property +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e3bd275ccbacf5eb18eaa311cea39f8bf8655feb + +[ Upstream commit e3bd275ccbacf5eb18eaa311cea39f8bf8655feb ] + +Fixes: +bluetooth: 'clock-names' does not match any of the regexes: 'pinctrl-[0-9]+' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-5-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts +index b331a013..c490dbbf 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts +@@ -79,6 +79,5 @@ bluetooth { + enable-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; + max-speed = <2000000>; + clocks = <&wifi32k>; +- clock-names = "lpo"; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-074-arm64-dts-amlogic-meson-gx-add-missing-unit-add.patch b/patches.kernel.org/6.2.3-074-arm64-dts-amlogic-meson-gx-add-missing-unit-add.patch new file mode 100644 index 0000000..62e5799 --- /dev/null +++ b/patches.kernel.org/6.2.3-074-arm64-dts-amlogic-meson-gx-add-missing-unit-add.patch @@ -0,0 +1,37 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:27 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-gx: add missing unit address to + rng node name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 61ff70708b98a85516eccb3755084ac97b42cf48 + +[ Upstream commit 61ff70708b98a85516eccb3755084ac97b42cf48 ] + +Fixes: +bus@c8834000: rng: {...} should not be valid under {'type': 'object'} + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-6-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index 467d2eaf..11f89bfe 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -532,7 +532,7 @@ periphs: bus@c8834000 { + #size-cells = <2>; + ranges = <0x0 0x0 0x0 0xc8834000 0x0 0x2000>; + +- hwrng: rng { ++ hwrng: rng@0 { + compatible = "amlogic,meson-rng"; + reg = <0x0 0x0 0x0 0x4>; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-075-arm64-dts-amlogic-meson-gxl-s905w-jethome-jethu.patch b/patches.kernel.org/6.2.3-075-arm64-dts-amlogic-meson-gxl-s905w-jethome-jethu.patch new file mode 100644 index 0000000..1859829 --- /dev/null +++ b/patches.kernel.org/6.2.3-075-arm64-dts-amlogic-meson-gxl-s905w-jethome-jethu.patch @@ -0,0 +1,37 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:28 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix + invalid rtc node name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 11172a97c092eaeb0a65c6434df0fc73f886a495 + +[ Upstream commit 11172a97c092eaeb0a65c6434df0fc73f886a495 ] + +Fixes: +pcf8563@51: $nodename:0: 'pcf8563@51' does not match '^rtc(@.*|-[0-9a-f])*$' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-7-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts +index bb741207..a18d6d24 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts +@@ -239,7 +239,7 @@ &i2c_B { + pinctrl-names = "default"; + pinctrl-0 = <&i2c_b_pins>; + +- pcf8563: pcf8563@51 { ++ pcf8563: rtc@51 { + compatible = "nxp,pcf8563"; + reg = <0x51>; + status = "okay"; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-076-arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx.patch b/patches.kernel.org/6.2.3-076-arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx.patch new file mode 100644 index 0000000..0b8150e --- /dev/null +++ b/patches.kernel.org/6.2.3-076-arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx.patch @@ -0,0 +1,37 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:29 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix + invalid rtc node name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 956f52025c5dd92c80c12e31c99c854086a6fc55 + +[ Upstream commit 956f52025c5dd92c80c12e31c99c854086a6fc55 ] + +Fixes: +pcf8563@51: $nodename:0: 'pcf8563@51' does not match '^rtc(@.*|-[0-9a-f])*$' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-8-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi +index 1916c007..e1605a9b 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi +@@ -217,7 +217,7 @@ &i2c1 { + pinctrl-names = "default"; + + /* RTC */ +- pcf8563: pcf8563@51 { ++ pcf8563: rtc@51 { + compatible = "nxp,pcf8563"; + reg = <0x51>; + status = "okay"; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-077-arm64-dts-amlogic-meson-gxl-add-missing-unit-ad.patch b/patches.kernel.org/6.2.3-077-arm64-dts-amlogic-meson-gxl-add-missing-unit-ad.patch new file mode 100644 index 0000000..977bda9 --- /dev/null +++ b/patches.kernel.org/6.2.3-077-arm64-dts-amlogic-meson-gxl-add-missing-unit-ad.patch @@ -0,0 +1,37 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:30 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-gxl: add missing unit address to + eth-phy-mux node name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d19189f70ba596798ea49166d2d1ef36a8df5289 + +[ Upstream commit d19189f70ba596798ea49166d2d1ef36a8df5289 ] + +Fixes: +bus@c8834000: eth-phy-mux: {...} should not be valid under {'type': 'object'} + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-9-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +index 04e9d0f1..5905a6df 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +@@ -773,7 +773,7 @@ mux { + }; + }; + +- eth-phy-mux { ++ eth-phy-mux@55c { + compatible = "mdio-mux-mmioreg", "mdio-mux"; + #address-cells = <1>; + #size-cells = <0>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-078-arm64-dts-amlogic-meson-gx-libretech-pc-fix-upd.patch b/patches.kernel.org/6.2.3-078-arm64-dts-amlogic-meson-gx-libretech-pc-fix-upd.patch new file mode 100644 index 0000000..a506fbb --- /dev/null +++ b/patches.kernel.org/6.2.3-078-arm64-dts-amlogic-meson-gx-libretech-pc-fix-upd.patch @@ -0,0 +1,37 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:31 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-gx-libretech-pc: fix update button + name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6bb506ed36968207a8832f0143ebc127f0770eef + +[ Upstream commit 6bb506ed36968207a8832f0143ebc127f0770eef ] + +Fixes: + adc-keys: 'update-button' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-10-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi +index bcdf55f4..4e84ab87 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi +@@ -17,7 +17,7 @@ adc-keys { + io-channel-names = "buttons"; + keyup-threshold-microvolt = <1800000>; + +- update-button { ++ button-update { + label = "update"; + linux,code = ; + press-threshold-microvolt = <1300000>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-079-arm64-dts-amlogic-meson-sm1-bananapi-m5-fix-adc.patch b/patches.kernel.org/6.2.3-079-arm64-dts-amlogic-meson-sm1-bananapi-m5-fix-adc.patch new file mode 100644 index 0000000..98e4baa --- /dev/null +++ b/patches.kernel.org/6.2.3-079-arm64-dts-amlogic-meson-sm1-bananapi-m5-fix-adc.patch @@ -0,0 +1,46 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:32 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node + names +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d519a73332b6c3d14e15f8fd20d7c6f29ed13d41 + +[ Upstream commit d519a73332b6c3d14e15f8fd20d7c6f29ed13d41 ] + +Fixes: +adc_keys: 'key' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+' + +Also fix the invalid "adc_keys" node name. + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-11-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +index cadba194..6d0db667 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +@@ -17,13 +17,13 @@ / { + compatible = "bananapi,bpi-m5", "amlogic,sm1"; + model = "Banana Pi BPI-M5"; + +- adc_keys { ++ adc-keys { + compatible = "adc-keys"; + io-channels = <&saradc 2>; + io-channel-names = "buttons"; + keyup-threshold-microvolt = <1800000>; + +- key { ++ button-sw3 { + label = "SW3"; + linux,code = ; + press-threshold-microvolt = <1700000>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-080-arm64-dts-amlogic-meson-gxl-s905d-phicomm-n1-fi.patch b/patches.kernel.org/6.2.3-080-arm64-dts-amlogic-meson-gxl-s905d-phicomm-n1-fi.patch new file mode 100644 index 0000000..7287e51 --- /dev/null +++ b/patches.kernel.org/6.2.3-080-arm64-dts-amlogic-meson-gxl-s905d-phicomm-n1-fi.patch @@ -0,0 +1,37 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:33 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node + name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: eee64d8fbbdaab72bbab3e462f3a7b742d20c8c2 + +[ Upstream commit eee64d8fbbdaab72bbab3e462f3a7b742d20c8c2 ] + +Fixes: +leds: status: {...} is not of type 'array' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-12-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts +index 9ef210f1..393d3cb3 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts +@@ -18,7 +18,7 @@ cvbs-connector { + leds { + compatible = "gpio-leds"; + +- status { ++ led { + label = "n1:white:status"; + gpios = <&gpio_ao GPIOAO_9 GPIO_ACTIVE_HIGH>; + default-state = "on"; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-081-arm64-dts-amlogic-meson-gxbb-kii-pro-fix-led-no.patch b/patches.kernel.org/6.2.3-081-arm64-dts-amlogic-meson-gxbb-kii-pro-fix-led-no.patch new file mode 100644 index 0000000..8d3eaed --- /dev/null +++ b/patches.kernel.org/6.2.3-081-arm64-dts-amlogic-meson-gxbb-kii-pro-fix-led-no.patch @@ -0,0 +1,36 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:34 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: afdef3b188c934f79ad4b0a7bd8c692742f9b5af + +[ Upstream commit afdef3b188c934f79ad4b0a7bd8c692742f9b5af ] + +Fixes: +leds: status: {...} is not of type 'array' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-13-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts +index 6d8cc00f..5f2d4317 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts +@@ -16,7 +16,7 @@ / { + + leds { + compatible = "gpio-leds"; +- status { ++ led { + gpios = <&gpio_ao GPIOAO_13 GPIO_ACTIVE_LOW>; + default-state = "off"; + color = ; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-082-arm64-dts-amlogic-meson-g12b-odroid-go-ultra-fi.patch b/patches.kernel.org/6.2.3-082-arm64-dts-amlogic-meson-g12b-odroid-go-ultra-fi.patch new file mode 100644 index 0000000..ca27525 --- /dev/null +++ b/patches.kernel.org/6.2.3-082-arm64-dts-amlogic-meson-g12b-odroid-go-ultra-fi.patch @@ -0,0 +1,47 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 11:34:35 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-g12b-odroid-go-ultra: fix rk818 + pmic properties +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ce9999722656f2433af9029571bc2b99448dda74 + +[ Upstream commit ce9999722656f2433af9029571bc2b99448dda74 ] + +Fixes: +pmic@1c: '#clock-cells' is a required property +pmic@1c: 'switch-supply' does not match any of the regexes: 'pinctrl-[0-9]+' + +The switch supply is described by vcc9-supply per bindings documentation. + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-14-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts +index 1e407096..c8e5a0a4 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts +@@ -381,6 +381,7 @@ rk818: pmic@1c { + reg = <0x1c>; + interrupt-parent = <&gpio_intc>; + interrupts = <7 IRQ_TYPE_LEVEL_LOW>; /* GPIOAO_7 */ ++ #clock-cells = <1>; + + vcc1-supply = <&vdd_sys>; + vcc2-supply = <&vdd_sys>; +@@ -391,7 +392,6 @@ rk818: pmic@1c { + vcc8-supply = <&vcc_2v3>; + vcc9-supply = <&vddao_3v3>; + boost-supply = <&vdd_sys>; +- switch-supply = <&vdd_sys>; + + regulators { + vddcpu_a: DCDC_REG1 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-083-arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-acti.patch b/patches.kernel.org/6.2.3-083-arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-acti.patch new file mode 100644 index 0000000..e9a473a --- /dev/null +++ b/patches.kernel.org/6.2.3-083-arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-acti.patch @@ -0,0 +1,51 @@ +From: Neil Armstrong +Date: Tue, 24 Jan 2023 12:39:08 +0100 +Subject: [PATCH] arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan + thermal trip +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1d2f14117aa7773efff50f832b85fc7779e586e0 + +[ Upstream commit 1d2f14117aa7773efff50f832b85fc7779e586e0 ] + +Add an active trip tied to the on-board fan cooling device, which is better +than describing it along the passive cooling maps. + +Fixes: 33b14f663df8 ("arm64: dts: meson: add initial device-tree for ODROID-HC4") +Reported-by: Ricardo Pardini +Link: https://lore.kernel.org/r/20230124-topic-odroid-hc4-upstream-fix-fan-trip-v1-1-b0c6aa355d93@linaro.org +Tested-by: Ricardo Pardini +[narmstrong: added Ricardo's tested-by from off-list chat] +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts +index a1f0c38c..74088e72 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts +@@ -76,9 +76,17 @@ sound { + }; + + &cpu_thermal { ++ trips { ++ cpu_active: cpu-active { ++ temperature = <60000>; /* millicelsius */ ++ hysteresis = <2000>; /* millicelsius */ ++ type = "active"; ++ }; ++ }; ++ + cooling-maps { + map { +- trip = <&cpu_passive>; ++ trip = <&cpu_active>; + cooling-device = <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-084-locking-rwsem-Disable-preemption-in-all-down_re.patch b/patches.kernel.org/6.2.3-084-locking-rwsem-Disable-preemption-in-all-down_re.patch new file mode 100644 index 0000000..8e2a07f --- /dev/null +++ b/patches.kernel.org/6.2.3-084-locking-rwsem-Disable-preemption-in-all-down_re.patch @@ -0,0 +1,136 @@ +From: Waiman Long +Date: Wed, 25 Jan 2023 19:36:26 -0500 +Subject: [PATCH] locking/rwsem: Disable preemption in all down_read*() and + up_read() code paths +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3f5245538a1964ae186ab7e1636020a41aa63143 + +[ Upstream commit 3f5245538a1964ae186ab7e1636020a41aa63143 ] + +Commit: + + 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") + +... assumes that when the owner field is changed to NULL, the lock will +become free soon. But commit: + + 48dfb5d2560d ("locking/rwsem: Disable preemption while trying for rwsem lock") + +... disabled preemption when acquiring rwsem for write. + +However, preemption has not yet been disabled when acquiring a read lock +on a rwsem. So a reader can add a RWSEM_READER_BIAS to count without +setting owner to signal a reader, got preempted out by a RT task which +then spins in the writer slowpath as owner remains NULL leading to live lock. + +One easy way to fix this problem is to disable preemption at all the +down_read*() and up_read() code paths as implemented in this patch. + +Fixes: 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") +Reported-by: Mukesh Ojha +Suggested-by: Peter Zijlstra +Signed-off-by: Waiman Long +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230126003628.365092-3-longman@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/locking/rwsem.c | 30 ++++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 44873594..324fc370 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -1092,7 +1092,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + /* Ordered by sem->wait_lock against rwsem_mark_wake(). */ + break; + } +- schedule(); ++ schedule_preempt_disabled(); + lockevent_inc(rwsem_sleep_reader); + } + +@@ -1254,14 +1254,20 @@ static struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem) + */ + static inline int __down_read_common(struct rw_semaphore *sem, int state) + { ++ int ret = 0; + long count; + ++ preempt_disable(); + if (!rwsem_read_trylock(sem, &count)) { +- if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) +- return -EINTR; ++ if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) { ++ ret = -EINTR; ++ goto out; ++ } + DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem); + } +- return 0; ++out: ++ preempt_enable(); ++ return ret; + } + + static inline void __down_read(struct rw_semaphore *sem) +@@ -1281,19 +1287,23 @@ static inline int __down_read_killable(struct rw_semaphore *sem) + + static inline int __down_read_trylock(struct rw_semaphore *sem) + { ++ int ret = 0; + long tmp; + + DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem); + ++ preempt_disable(); + tmp = atomic_long_read(&sem->count); + while (!(tmp & RWSEM_READ_FAILED_MASK)) { + if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp, + tmp + RWSEM_READER_BIAS)) { + rwsem_set_reader_owned(sem); +- return 1; ++ ret = 1; ++ break; + } + } +- return 0; ++ preempt_enable(); ++ return ret; + } + + /* +@@ -1335,6 +1345,7 @@ static inline void __up_read(struct rw_semaphore *sem) + DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem); + DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem); + ++ preempt_disable(); + rwsem_clear_reader_owned(sem); + tmp = atomic_long_add_return_release(-RWSEM_READER_BIAS, &sem->count); + DEBUG_RWSEMS_WARN_ON(tmp < 0, sem); +@@ -1343,6 +1354,7 @@ static inline void __up_read(struct rw_semaphore *sem) + clear_nonspinnable(sem); + rwsem_wake(sem); + } ++ preempt_enable(); + } + + /* +@@ -1662,6 +1674,12 @@ void down_read_non_owner(struct rw_semaphore *sem) + { + might_sleep(); + __down_read(sem); ++ /* ++ * The owner value for a reader-owned lock is mostly for debugging ++ * purpose only and is not critical to the correct functioning of ++ * rwsem. So it is perfectly fine to set it in a preempt-enabled ++ * context here. ++ */ + __rwsem_set_reader_owned(sem, NULL); + } + EXPORT_SYMBOL(down_read_non_owner); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-085-arm64-tegra-Mark-host1x-as-dma-coherent-on-Tegr.patch b/patches.kernel.org/6.2.3-085-arm64-tegra-Mark-host1x-as-dma-coherent-on-Tegr.patch new file mode 100644 index 0000000..45e6502 --- /dev/null +++ b/patches.kernel.org/6.2.3-085-arm64-tegra-Mark-host1x-as-dma-coherent-on-Tegr.patch @@ -0,0 +1,49 @@ +From: Mikko Perttunen +Date: Thu, 19 Jan 2023 15:38:58 +0200 +Subject: [PATCH] arm64: tegra: Mark host1x as dma-coherent on Tegra194/234 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 361238cdc52523fd7b1f3aa447c0579f42448b00 + +[ Upstream commit 361238cdc52523fd7b1f3aa447c0579f42448b00 ] + +Ensure appropriate configuration is done to make the host1x device +and context devices DMA coherent by adding the dma-coherent flag. + +Fixes: b35f5b53a87b ("arm64: tegra: Add context isolation domains on Tegra234") +Signed-off-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 1 + + arch/arm64/boot/dts/nvidia/tegra234.dtsi | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +index 4afcbd60..d8169920 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +@@ -1918,6 +1918,7 @@ host1x@13e00000 { + interconnects = <&mc TEGRA194_MEMORY_CLIENT_HOST1XDMAR &emc>; + interconnect-names = "dma-mem"; + iommus = <&smmu TEGRA194_SID_HOST1X>; ++ dma-coherent; + + /* Context isolation domains */ + iommu-map = <0 &smmu TEGRA194_SID_HOST1X_CTX0 1>, +diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi +index eaf05ee9..77ceed61 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi +@@ -571,6 +571,7 @@ host1x@13e00000 { + interconnects = <&mc TEGRA234_MEMORY_CLIENT_HOST1XDMAR &emc>; + interconnect-names = "dma-mem"; + iommus = <&smmu_niso1 TEGRA234_SID_HOST1X>; ++ dma-coherent; + + /* Context isolation domains */ + iommu-map = <0 &smmu_niso0 TEGRA234_SID_HOST1X_CTX0 1>, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-086-arm64-dts-renesas-beacon-renesom-Fix-gpio-expan.patch b/patches.kernel.org/6.2.3-086-arm64-dts-renesas-beacon-renesom-Fix-gpio-expan.patch new file mode 100644 index 0000000..876e86f --- /dev/null +++ b/patches.kernel.org/6.2.3-086-arm64-dts-renesas-beacon-renesom-Fix-gpio-expan.patch @@ -0,0 +1,78 @@ +From: Adam Ford +Date: Sat, 14 Jan 2023 16:56:45 -0600 +Subject: [PATCH] arm64: dts: renesas: beacon-renesom: Fix gpio expander + reference +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d7f9492dfc03153ac56ab59066a196558748f575 + +[ Upstream commit d7f9492dfc03153ac56ab59066a196558748f575 ] + +The board used to originally introduce the Beacon Embedded RZ/G2[M/N/H] +boards had a GPIO expander with address 20, but this was changed when +the final board went to production. + +The production boards changed both the part itself and the address. +With the incorrect address, the LCD cannot come up. If the LCD fails, +the rcar-du driver fails to come up, and that also breaks HDMI. + +Pre-release board were not shipped to the general public, so it should +be safe to push this as a fix. Anyone with a production board would +have video fail due to this GPIO expander change. + +Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit") +Signed-off-by: Adam Ford +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230114225647.227972-1-aford173@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../dts/renesas/beacon-renesom-baseboard.dtsi | 24 ++++++++----------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi +index 8166e3c1..cafde91b 100644 +--- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi ++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi +@@ -437,20 +437,6 @@ wm8962_endpoint: endpoint { + }; + }; + +- /* 0 - lcd_reset */ +- /* 1 - lcd_pwr */ +- /* 2 - lcd_select */ +- /* 3 - backlight-enable */ +- /* 4 - Touch_shdwn */ +- /* 5 - LCD_H_pol */ +- /* 6 - lcd_V_pol */ +- gpio_exp1: gpio@20 { +- compatible = "onnn,pca9654"; +- reg = <0x20>; +- gpio-controller; +- #gpio-cells = <2>; +- }; +- + touchscreen@26 { + compatible = "ilitek,ili2117"; + reg = <0x26>; +@@ -482,6 +468,16 @@ hd3ss3220_out_ep: endpoint { + }; + }; + }; ++ ++ gpio_exp1: gpio@70 { ++ compatible = "nxp,pca9538"; ++ reg = <0x70>; ++ gpio-controller; ++ #gpio-cells = <2>; ++ gpio-line-names = "lcd_reset", "lcd_pwr", "lcd_select", ++ "backlight-enable", "Touch_shdwn", ++ "LCD_H_pol", "lcd_V_pol"; ++ }; + }; + + &lvds0 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-087-arm64-dts-meson-radxa-zero-allow-usb-otg-mode.patch b/patches.kernel.org/6.2.3-087-arm64-dts-meson-radxa-zero-allow-usb-otg-mode.patch new file mode 100644 index 0000000..04def4b --- /dev/null +++ b/patches.kernel.org/6.2.3-087-arm64-dts-meson-radxa-zero-allow-usb-otg-mode.patch @@ -0,0 +1,36 @@ +From: Christian Hewitt +Date: Fri, 27 Jan 2023 10:39:13 +0000 +Subject: [PATCH] arm64: dts: meson: radxa-zero: allow usb otg mode +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ce43ea00b927805c1fd0450ccc9b4b6069e292c5 + +[ Upstream commit ce43ea00b927805c1fd0450ccc9b4b6069e292c5 ] + +Setting dr_mode to "host" prevents otg which can be useful on a board +with limited connectivity options. So don't force host mode. + +Fixes: 26d1400f7457 ("arm64: dts: amlogic: add support for Radxa Zero") +Signed-off-by: Christian Hewitt +Acked-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230127103913.3386435-1-christianshewitt@gmail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts +index e3bb6df4..cf0a9be8 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts +@@ -401,5 +401,4 @@ &uart_AO { + + &usb { + status = "okay"; +- dr_mode = "host"; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-088-arm64-dts-meson-bananapi-m5-switch-VDDIO_C-pin-.patch b/patches.kernel.org/6.2.3-088-arm64-dts-meson-bananapi-m5-switch-VDDIO_C-pin-.patch new file mode 100644 index 0000000..ff5795e --- /dev/null +++ b/patches.kernel.org/6.2.3-088-arm64-dts-meson-bananapi-m5-switch-VDDIO_C-pin-.patch @@ -0,0 +1,47 @@ +From: Christian Hewitt +Date: Fri, 27 Jan 2023 14:22:17 +0000 +Subject: [PATCH] arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to + OPEN_DRAIN +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 856968e066bd77b113965f1a355ec7401edff65f + +[ Upstream commit 856968e066bd77b113965f1a355ec7401edff65f ] + +For proper warm (re)boot from SD card the BPI-M5 board requires TFLASH_VDD_EN +and VDDIO_C pins to be switched to high impedance mode. This can be achieved +using OPEN_DRAIN instead of ACTIVE_HIGH to leave the GPIO pins in input mode +and retain high state (pin has the pull-up). + +This change is inspired by meson-sm1-odroid.dtsi where OPEN_DRAIN has been +used to resolve similar problems with the Odroid C4 board (TF_IO in the C4 +dts is the equivalent regulator). + +Fixes: 976e920183e4 ("arm64: dts: meson-sm1: add Banana PI BPI-M5 board dts") +Suggested-by: Neil Armstrong +Signed-off-by: Christian Hewitt +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230127142221.3718184-2-christianshewitt@gmail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +index 6d0db667..38ebe98b 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +@@ -123,7 +123,7 @@ vddio_c: regulator-vddio_c { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + +- enable-gpio = <&gpio_ao GPIOE_2 GPIO_ACTIVE_HIGH>; ++ enable-gpio = <&gpio_ao GPIOE_2 GPIO_OPEN_DRAIN>; + enable-active-high; + regulator-always-on; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-089-ARM-dts-sun8i-nanopi-duo2-Fix-regulator-GPIO-re.patch b/patches.kernel.org/6.2.3-089-ARM-dts-sun8i-nanopi-duo2-Fix-regulator-GPIO-re.patch new file mode 100644 index 0000000..4e97acb --- /dev/null +++ b/patches.kernel.org/6.2.3-089-ARM-dts-sun8i-nanopi-duo2-Fix-regulator-GPIO-re.patch @@ -0,0 +1,41 @@ +From: Samuel Holland +Date: Sat, 31 Dec 2022 16:58:54 -0600 +Subject: [PATCH] ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2177d4ae971f79b4a9a3c411f2fb8ae6113d1430 + +[ Upstream commit 2177d4ae971f79b4a9a3c411f2fb8ae6113d1430 ] + +The property named in the schema is 'enable-gpios', not 'enable-gpio'. +This makes no difference at runtime, because the regulator is marked as +always-on, but it breaks validation. + +Fixes: 4701fc6e5dd9 ("ARM: dts: sun8i: add FriendlyARM NanoPi Duo2") +Reviewed-by: Andre Przywara +Acked-by: Jernej Skrabec +Signed-off-by: Samuel Holland +Link: https://lore.kernel.org/r/20221231225854.16320-2-samuel@sholland.org +Signed-off-by: Jernej Skrabec +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts +index 43641cb8..343b02b9 100644 +--- a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts ++++ b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts +@@ -57,7 +57,7 @@ reg_vdd_cpux: vdd-cpux-regulator { + regulator-ramp-delay = <50>; /* 4ms */ + + enable-active-high; +- enable-gpio = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ ++ enable-gpios = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ + gpios = <&r_pio 0 6 GPIO_ACTIVE_HIGH>; /* PL6 */ + gpios-states = <0x1>; + states = <1100000 0>, <1300000 1>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-090-ublk_drv-remove-nr_aborted_queues-from-ublk_dev.patch b/patches.kernel.org/6.2.3-090-ublk_drv-remove-nr_aborted_queues-from-ublk_dev.patch new file mode 100644 index 0000000..3ae48f8 --- /dev/null +++ b/patches.kernel.org/6.2.3-090-ublk_drv-remove-nr_aborted_queues-from-ublk_dev.patch @@ -0,0 +1,37 @@ +From: Ming Lei +Date: Fri, 6 Jan 2023 12:17:06 +0800 +Subject: [PATCH] ublk_drv: remove nr_aborted_queues from ublk_device +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ed878d1c1c641c4a6bd366658fc8e6bc842b80d1 + +[ Upstream commit ed878d1c1c641c4a6bd366658fc8e6bc842b80d1 ] + +No one uses 'nr_aborted_queues' any more, so remove it. + +Reviewed-by: ZiyangZhang +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20230106041711.914434-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Stable-dep-of: 73a166d97492 ("ublk_drv: don't probe partitions if the ubq daemon isn't trusted") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/block/ublk_drv.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c +index 6368b56e..f44b9467 100644 +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -159,7 +159,6 @@ struct ublk_device { + + struct completion completion; + unsigned int nr_queues_ready; +- atomic_t nr_aborted_queues; + + /* + * Our ubq->daemon may be killed without any notification, so +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-091-ublk_drv-don-t-probe-partitions-if-the-ubq-daem.patch b/patches.kernel.org/6.2.3-091-ublk_drv-don-t-probe-partitions-if-the-ubq-daem.patch new file mode 100644 index 0000000..8944d94 --- /dev/null +++ b/patches.kernel.org/6.2.3-091-ublk_drv-don-t-probe-partitions-if-the-ubq-daem.patch @@ -0,0 +1,69 @@ +From: Ming Lei +Date: Fri, 6 Jan 2023 12:17:07 +0800 +Subject: [PATCH] ublk_drv: don't probe partitions if the ubq daemon isn't + trusted +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 73a166d9749230d598320fdae3b687cdc0e2e205 + +[ Upstream commit 73a166d9749230d598320fdae3b687cdc0e2e205 ] + +If any ubq daemon is unprivileged, the ublk char device is allowed +for unprivileged user actually, and we can't trust the current user, +so not probe partitions. + +Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") +Reviewed-by: ZiyangZhang +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20230106041711.914434-3-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/block/ublk_drv.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c +index f44b9467..450bd54f 100644 +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -159,6 +159,7 @@ struct ublk_device { + + struct completion completion; + unsigned int nr_queues_ready; ++ unsigned int nr_privileged_daemon; + + /* + * Our ubq->daemon may be killed without any notification, so +@@ -1178,6 +1179,9 @@ static void ublk_mark_io_ready(struct ublk_device *ub, struct ublk_queue *ubq) + ubq->ubq_daemon = current; + get_task_struct(ubq->ubq_daemon); + ub->nr_queues_ready++; ++ ++ if (capable(CAP_SYS_ADMIN)) ++ ub->nr_privileged_daemon++; + } + if (ub->nr_queues_ready == ub->dev_info.nr_hw_queues) + complete_all(&ub->completion); +@@ -1534,6 +1538,10 @@ static int ublk_ctrl_start_dev(struct io_uring_cmd *cmd) + if (ret) + goto out_put_disk; + ++ /* don't probe partitions if any one ubq daemon is un-trusted */ ++ if (ub->nr_privileged_daemon != ub->nr_queues_ready) ++ set_bit(GD_SUPPRESS_PART_SCAN, &disk->state); ++ + get_device(&ub->cdev_dev); + ret = add_disk(disk); + if (ret) { +@@ -1935,6 +1943,7 @@ static int ublk_ctrl_start_recovery(struct io_uring_cmd *cmd) + /* set to NULL, otherwise new ubq_daemon cannot mmap the io_cmd_buf */ + ub->mm = NULL; + ub->nr_queues_ready = 0; ++ ub->nr_privileged_daemon = 0; + init_completion(&ub->completion); + ret = 0; + out_unlock: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-092-ARM-dts-imx7s-correct-iomuxc-gpr-mux-controller.patch b/patches.kernel.org/6.2.3-092-ARM-dts-imx7s-correct-iomuxc-gpr-mux-controller.patch new file mode 100644 index 0000000..62084db --- /dev/null +++ b/patches.kernel.org/6.2.3-092-ARM-dts-imx7s-correct-iomuxc-gpr-mux-controller.patch @@ -0,0 +1,37 @@ +From: Peng Fan +Date: Fri, 23 Dec 2022 11:04:33 +0800 +Subject: [PATCH] ARM: dts: imx7s: correct iomuxc gpr mux controller cells +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 + +[ Upstream commit 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 ] + +Per binding doc reg-mux.yaml, the #mux-control-cells should be 1 + +Signed-off-by: Peng Fan +Reviewed-by: Marco Felsch +Fixes: 94a905a79f2c ("ARM: dts: imx7s: add multiplexer controls") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/imx7s.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi +index 0fc9e6b8..11b9321b 100644 +--- a/arch/arm/boot/dts/imx7s.dtsi ++++ b/arch/arm/boot/dts/imx7s.dtsi +@@ -513,7 +513,7 @@ gpr: iomuxc-gpr@30340000 { + + mux: mux-controller { + compatible = "mmio-mux"; +- #mux-control-cells = <0>; ++ #mux-control-cells = <1>; + mux-reg-masks = <0x14 0x00000010>; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-093-sbitmap-remove-redundant-check-in-__sbitmap_que.patch b/patches.kernel.org/6.2.3-093-sbitmap-remove-redundant-check-in-__sbitmap_que.patch new file mode 100644 index 0000000..bc067e8 --- /dev/null +++ b/patches.kernel.org/6.2.3-093-sbitmap-remove-redundant-check-in-__sbitmap_que.patch @@ -0,0 +1,55 @@ +From: Kemeng Shi +Date: Tue, 17 Jan 2023 04:50:56 +0800 +Subject: [PATCH] sbitmap: remove redundant check in __sbitmap_queue_get_batch +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 903e86f3a64d9573352bbab2f211fdbbaa5772b7 + +[ Upstream commit 903e86f3a64d9573352bbab2f211fdbbaa5772b7 ] + +Commit fbb564a557809 ("lib/sbitmap: Fix invalid loop in +__sbitmap_queue_get_batch()") mentioned that "Checking free bits when +setting the target bits. Otherwise, it may reuse the busying bits." +This commit add check to make sure all masked bits in word before +cmpxchg is zero. Then the existing check after cmpxchg to check any +zero bit is existing in masked bits in word is redundant. + +Actually, old value of word before cmpxchg is stored in val and we +will filter out busy bits in val by "(get_mask & ~val)" after cmpxchg. +So we will not reuse busy bits methioned in commit fbb564a557809 +("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()"). Revert +new-added check to remove redundant check. + +Fixes: fbb564a55780 ("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()") +Reviewed-by: Jan Kara +Signed-off-by: Kemeng Shi +Link: https://lore.kernel.org/r/20230116205059.3821738-3-shikemeng@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + lib/sbitmap.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/lib/sbitmap.c b/lib/sbitmap.c +index 1fcede22..2281fbb4 100644 +--- a/lib/sbitmap.c ++++ b/lib/sbitmap.c +@@ -521,11 +521,9 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags, + + get_mask = ((1UL << nr_tags) - 1) << nr; + val = READ_ONCE(map->word); +- do { +- if ((val & ~get_mask) != val) +- goto next; +- } while (!atomic_long_try_cmpxchg(ptr, &val, +- get_mask | val)); ++ while (!atomic_long_try_cmpxchg(ptr, &val, ++ get_mask | val)) ++ ; + get_mask = (get_mask & ~val) >> nr; + if (get_mask) { + *offset = nr + (index << sb->shift); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-094-sbitmap-correct-wake_batch-recalculation-to-avo.patch b/patches.kernel.org/6.2.3-094-sbitmap-correct-wake_batch-recalculation-to-avo.patch new file mode 100644 index 0000000..8ccc36b --- /dev/null +++ b/patches.kernel.org/6.2.3-094-sbitmap-correct-wake_batch-recalculation-to-avo.patch @@ -0,0 +1,65 @@ +From: Kemeng Shi +Date: Tue, 17 Jan 2023 04:50:59 +0800 +Subject: [PATCH] sbitmap: correct wake_batch recalculation to avoid potential + IO hung +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b5fcf7871acb7f9a3a8ed341a68bd86aba3e254a + +[ Upstream commit b5fcf7871acb7f9a3a8ed341a68bd86aba3e254a ] + +Commit 180dccb0dba4f ("blk-mq: fix tag_get wait task can't be awakened") +mentioned that in case of shared tags, there could be just one real +active hctx(queue) because of lazy detection of tag idle. Then driver tag +allocation may wait forever on this real active hctx(queue) if wake_batch +is > hctx_max_depth where hctx_max_depth is available tags depth for the +actve hctx(queue). However, the condition wake_batch > hctx_max_depth is +not strong enough to avoid IO hung as the sbitmap_queue_wake_up will only +wake up one wait queue for each wake_batch even though there is only one +waiter in the woken wait queue. After this, there is only one tag to free +and wake_batch may not be reached anymore. Commit 180dccb0dba4f ("blk-mq: +fix tag_get wait task can't be awakened") methioned that driver tag +allocation may wait forever. Actually, the inactive hctx(queue) will be +truely idle after at most 30 seconds and will call blk_mq_tag_wakeup_all +to wake one waiter per wait queue to break the hung. But IO hung for 30 +seconds is also not acceptable. Set batch size to small enough that depth +of the shared hctx(queue) is enough to wake up all of the queues like +sbq_calc_wake_batch do to fix this potential IO hung. + +Although hctx_max_depth will be clamped to at least 4 while wake_batch +recalculation does not do the clamp, the wake_batch will be always +recalculated to 1 when hctx_max_depth <= 4. + +Fixes: 180dccb0dba4 ("blk-mq: fix tag_get wait task can't be awakened") +Reviewed-by: Jan Kara +Signed-off-by: Kemeng Shi +Link: https://lore.kernel.org/r/20230116205059.3821738-6-shikemeng@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + lib/sbitmap.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/lib/sbitmap.c b/lib/sbitmap.c +index 2281fbb4..888c5123 100644 +--- a/lib/sbitmap.c ++++ b/lib/sbitmap.c +@@ -464,13 +464,10 @@ void sbitmap_queue_recalculate_wake_batch(struct sbitmap_queue *sbq, + unsigned int users) + { + unsigned int wake_batch; +- unsigned int min_batch; + unsigned int depth = (sbq->sb.depth + users - 1) / users; + +- min_batch = sbq->sb.depth >= (4 * SBQ_WAIT_QUEUES) ? 4 : 1; +- + wake_batch = clamp_val(depth / SBQ_WAIT_QUEUES, +- min_batch, SBQ_WAKE_BATCH); ++ 1, SBQ_WAKE_BATCH); + + WRITE_ONCE(sbq->wake_batch, wake_batch); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-095-arm64-dts-mt8195-Fix-CPU-map-for-single-cluster.patch b/patches.kernel.org/6.2.3-095-arm64-dts-mt8195-Fix-CPU-map-for-single-cluster.patch new file mode 100644 index 0000000..10838ab --- /dev/null +++ b/patches.kernel.org/6.2.3-095-arm64-dts-mt8195-Fix-CPU-map-for-single-cluster.patch @@ -0,0 +1,57 @@ +From: AngeloGioacchino Del Regno +Date: Thu, 26 Jan 2023 11:35:21 +0100 +Subject: [PATCH] arm64: dts: mt8195: Fix CPU map for single-cluster SoC +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cc4f0b13a887b483faa45084616998a21b63889d + +[ Upstream commit cc4f0b13a887b483faa45084616998a21b63889d ] + +MT8195 features the ARM DynamIQ technology and combines both four +Cortex-A78 (big) and four Cortex-A55 (LITTLE) CPUs in one cluster: +fix the CPU map to reflect that. + +Signed-off-by: AngeloGioacchino Del Regno +Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board") +Link: https://lore.kernel.org/r/20230126103526.417039-2-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index d8d846a5..f0bd5754 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -151,22 +151,20 @@ core2 { + core3 { + cpu = <&cpu3>; + }; +- }; + +- cluster1 { +- core0 { ++ core4 { + cpu = <&cpu4>; + }; + +- core1 { ++ core5 { + cpu = <&cpu5>; + }; + +- core2 { ++ core6 { + cpu = <&cpu6>; + }; + +- core3 { ++ core7 { + cpu = <&cpu7>; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-096-arm64-dts-mt8192-Fix-CPU-map-for-single-cluster.patch b/patches.kernel.org/6.2.3-096-arm64-dts-mt8192-Fix-CPU-map-for-single-cluster.patch new file mode 100644 index 0000000..135cbc6 --- /dev/null +++ b/patches.kernel.org/6.2.3-096-arm64-dts-mt8192-Fix-CPU-map-for-single-cluster.patch @@ -0,0 +1,54 @@ +From: AngeloGioacchino Del Regno +Date: Thu, 26 Jan 2023 11:35:22 +0100 +Subject: [PATCH] arm64: dts: mt8192: Fix CPU map for single-cluster SoC +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 160ce54d635455ffb5e9b42c5ba9cb9aaa98cdb2 + +[ Upstream commit 160ce54d635455ffb5e9b42c5ba9cb9aaa98cdb2 ] + +MT8192 features the ARM DynamIQ technology and combines both four +Cortex-A76 (big) and four Cortex-A55 (LITTLE) CPUs in one cluster: +fix the CPU map to reflect that. + +Signed-off-by: AngeloGioacchino Del Regno +Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile") +Link: https://lore.kernel.org/r/20230126103526.417039-3-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 46a1e457..627e3bf1 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -158,19 +158,16 @@ core2 { + core3 { + cpu = <&cpu3>; + }; +- }; +- +- cluster1 { +- core0 { ++ core4 { + cpu = <&cpu4>; + }; +- core1 { ++ core5 { + cpu = <&cpu5>; + }; +- core2 { ++ core6 { + cpu = <&cpu6>; + }; +- core3 { ++ core7 { + cpu = <&cpu7>; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-097-arm64-dts-mt8186-Fix-CPU-map-for-single-cluster.patch b/patches.kernel.org/6.2.3-097-arm64-dts-mt8186-Fix-CPU-map-for-single-cluster.patch new file mode 100644 index 0000000..f32fef8 --- /dev/null +++ b/patches.kernel.org/6.2.3-097-arm64-dts-mt8186-Fix-CPU-map-for-single-cluster.patch @@ -0,0 +1,47 @@ +From: AngeloGioacchino Del Regno +Date: Thu, 26 Jan 2023 11:35:23 +0100 +Subject: [PATCH] arm64: dts: mt8186: Fix CPU map for single-cluster SoC +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1c473804b0c8a68c6ef2cf519b38ec6725ca4aa5 + +[ Upstream commit 1c473804b0c8a68c6ef2cf519b38ec6725ca4aa5 ] + +MT8186 features the ARM DynamIQ technology and combines both two +Cortex-A76 (big) and six Cortex-A55 (LITTLE) CPUs in one cluster: +fix the CPU map to reflect that. + +Signed-off-by: AngeloGioacchino Del Regno +Fixes: 2e78620b1350 ("arm64: dts: Add MediaTek MT8186 dts and evaluation board and Makefile") +Link: https://lore.kernel.org/r/20230126103526.417039-4-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8186.dtsi | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +index 857b0c22..0d8d2799 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +@@ -47,14 +47,12 @@ core4 { + core5 { + cpu = <&cpu5>; + }; +- }; + +- cluster1 { +- core0 { ++ core6 { + cpu = <&cpu6>; + }; + +- core1 { ++ core7 { + cpu = <&cpu7>; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-098-arm64-dts-mediatek-mt7622-Add-missing-pwm-cells.patch b/patches.kernel.org/6.2.3-098-arm64-dts-mediatek-mt7622-Add-missing-pwm-cells.patch new file mode 100644 index 0000000..e05f78f --- /dev/null +++ b/patches.kernel.org/6.2.3-098-arm64-dts-mediatek-mt7622-Add-missing-pwm-cells.patch @@ -0,0 +1,37 @@ +From: AngeloGioacchino Del Regno +Date: Mon, 28 Nov 2022 12:20:27 +0100 +Subject: [PATCH] arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm + node +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 22925af785fa3470efdf566339616d801119d348 + +[ Upstream commit 22925af785fa3470efdf566339616d801119d348 ] + +Specify #pwm-cells on pwm@11006000 to make it actually usable. + +Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221128112028.58021-2-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 146e18b5..7bb31692 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -435,6 +435,7 @@ uart3: serial@11005000 { + pwm: pwm@11006000 { + compatible = "mediatek,mt7622-pwm"; + reg = <0 0x11006000 0 0x1000>; ++ #pwm-cells = <2>; + interrupts = ; + clocks = <&topckgen CLK_TOP_PWM_SEL>, + <&pericfg CLK_PERI_PWM_PD>, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-099-arm64-dts-mediatek-mt8186-Fix-watchdog-compatib.patch b/patches.kernel.org/6.2.3-099-arm64-dts-mediatek-mt8186-Fix-watchdog-compatib.patch new file mode 100644 index 0000000..6548411 --- /dev/null +++ b/patches.kernel.org/6.2.3-099-arm64-dts-mediatek-mt8186-Fix-watchdog-compatib.patch @@ -0,0 +1,46 @@ +From: AngeloGioacchino Del Regno +Date: Tue, 8 Nov 2022 11:32:03 +0800 +Subject: [PATCH] arm64: dts: mediatek: mt8186: Fix watchdog compatible +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e5e961628d696237ddc3d53d9d5ac11f43e0bf67 + +[ Upstream commit e5e961628d696237ddc3d53d9d5ac11f43e0bf67 ] + +MT8186's watchdog embeds a reset controller and needs only the +mediatek,mt8186-wdt compatible string as the MT6589 one is there +for watchdogs that don't have any reset controller capability. + +Fixes: 2e78620b1350 ("arm64: dts: Add MediaTek MT8186 dts and evaluation board and Makefile") +Signed-off-by: AngeloGioacchino Del Regno +Co-developed-by: Allen-KH Cheng +Signed-off-by: Allen-KH Cheng +Reviewed-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20221108033209.22751-2-allen-kh.cheng@mediatek.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8186.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +index 0d8d2799..a02bf4ab 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi +@@ -333,8 +333,7 @@ pio: pinctrl@10005000 { + }; + + watchdog: watchdog@10007000 { +- compatible = "mediatek,mt8186-wdt", +- "mediatek,mt6589-wdt"; ++ compatible = "mediatek,mt8186-wdt"; + mediatek,disable-extrst; + reg = <0 0x10007000 0 0x1000>; + #reset-cells = <1>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-100-arm64-dts-mediatek-mt8195-Fix-watchdog-compatib.patch b/patches.kernel.org/6.2.3-100-arm64-dts-mediatek-mt8195-Fix-watchdog-compatib.patch new file mode 100644 index 0000000..76390b6 --- /dev/null +++ b/patches.kernel.org/6.2.3-100-arm64-dts-mediatek-mt8195-Fix-watchdog-compatib.patch @@ -0,0 +1,46 @@ +From: AngeloGioacchino Del Regno +Date: Tue, 8 Nov 2022 11:32:04 +0800 +Subject: [PATCH] arm64: dts: mediatek: mt8195: Fix watchdog compatible +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 02938f460cde0d360dde48056c4d1c0a4bd49230 + +[ Upstream commit 02938f460cde0d360dde48056c4d1c0a4bd49230 ] + +MT8195's watchdog embeds a reset controller and needs only the +mediatek,mt8195-wdt compatible string as the MT6589 one is there +for watchdogs that don't have any reset controller capability. + +Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board") +Signed-off-by: AngeloGioacchino Del Regno +Co-developed-by: Allen-KH Cheng +Signed-off-by: Allen-KH Cheng +Reviewed-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20221108033209.22751-3-allen-kh.cheng@mediatek.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index f0bd5754..c5b8abc0 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -694,8 +694,7 @@ power-domain@MT8195_POWER_DOMAIN_AUDIO { + }; + + watchdog: watchdog@10007000 { +- compatible = "mediatek,mt8195-wdt", +- "mediatek,mt6589-wdt"; ++ compatible = "mediatek,mt8195-wdt"; + mediatek,disable-extrst; + reg = <0 0x10007000 0 0x100>; + #reset-cells = <1>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-101-arm64-dts-mediatek-mt7986-Fix-watchdog-compatib.patch b/patches.kernel.org/6.2.3-101-arm64-dts-mediatek-mt7986-Fix-watchdog-compatib.patch new file mode 100644 index 0000000..ec01fd3 --- /dev/null +++ b/patches.kernel.org/6.2.3-101-arm64-dts-mediatek-mt7986-Fix-watchdog-compatib.patch @@ -0,0 +1,45 @@ +From: Allen-KH Cheng +Date: Tue, 8 Nov 2022 11:32:05 +0800 +Subject: [PATCH] arm64: dts: mediatek: mt7986: Fix watchdog compatible +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 70d24df30d06e5c822ba94751166ef55d0e28a89 + +[ Upstream commit 70d24df30d06e5c822ba94751166ef55d0e28a89 ] + +MT7986's watchdog embeds a reset controller and needs only the +mediatek,mt7986-wdt compatible string as the MT6589 one is there +for watchdogs that don't have any reset controller capability. + +Fixes: 50137c150f5f ("arm64: dts: mediatek: add basic mt7986 support") +Signed-off-by: Allen-KH Cheng +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20221108033209.22751-4-allen-kh.cheng@mediatek.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +index 0e9406fc..0ed5e067 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +@@ -167,8 +167,7 @@ topckgen: topckgen@1001b000 { + }; + + watchdog: watchdog@1001c000 { +- compatible = "mediatek,mt7986-wdt", +- "mediatek,mt6589-wdt"; ++ compatible = "mediatek,mt7986-wdt"; + reg = <0 0x1001c000 0 0x1000>; + interrupts = ; + #reset-cells = <1>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-102-ARM-dts-stm32-Update-part-number-NVMEM-descript.patch b/patches.kernel.org/6.2.3-102-ARM-dts-stm32-Update-part-number-NVMEM-descript.patch new file mode 100644 index 0000000..95e7feb --- /dev/null +++ b/patches.kernel.org/6.2.3-102-ARM-dts-stm32-Update-part-number-NVMEM-descript.patch @@ -0,0 +1,39 @@ +From: Patrick Delaunay +Date: Wed, 18 Jan 2023 13:49:51 +0100 +Subject: [PATCH] ARM: dts: stm32: Update part number NVMEM description on + stm32mp131 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 366384e495511bea8583e44173629a3012d62db0 + +[ Upstream commit 366384e495511bea8583e44173629a3012d62db0 ] + +The STM32MP13x Device Part Number (also named RPN in reference manual) +only uses the first 12 bits in OTP4, all the other bit are reserved and +they can be different of zero; they must be masked in NVMEM result, so +the number of bits must be defined in the nvmem cell description. + +Fixes: 1da8779c0029 ("ARM: dts: stm32: add STM32MP13 SoCs support") +Signed-off-by: Patrick Delaunay +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/stm32mp131.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/stm32mp131.dtsi b/arch/arm/boot/dts/stm32mp131.dtsi +index accc3824..99d88096 100644 +--- a/arch/arm/boot/dts/stm32mp131.dtsi ++++ b/arch/arm/boot/dts/stm32mp131.dtsi +@@ -527,6 +527,7 @@ bsec: efuse@5c005000 { + + part_number_otp: part_number_otp@4 { + reg = <0x4 0x2>; ++ bits = <0 12>; + }; + ts_cal1: calib@5c { + reg = <0x5c 0x2>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-103-arm64-dts-qcom-sm8450-nagara-Correct-firmware-p.patch b/patches.kernel.org/6.2.3-103-arm64-dts-qcom-sm8450-nagara-Correct-firmware-p.patch new file mode 100644 index 0000000..7c1b96a --- /dev/null +++ b/patches.kernel.org/6.2.3-103-arm64-dts-qcom-sm8450-nagara-Correct-firmware-p.patch @@ -0,0 +1,49 @@ +From: Konrad Dybcio +Date: Fri, 3 Feb 2023 15:23:09 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8450-nagara: Correct firmware paths +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e27f38e6255306527e32af85592d805f3360ff94 + +[ Upstream commit e27f38e6255306527e32af85592d805f3360ff94 ] + +Nagara is definitely not SM8350, fix it! + +Fixes: c53532f7825c ("arm64: dts: qcom: pdx223: correct firmware paths") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230203142309.1106349-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi b/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi +index 38256226..e437e9a1 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi +@@ -534,17 +534,17 @@ &pcie0_phy { + }; + + &remoteproc_adsp { +- firmware-name = "qcom/sm8350/Sony/nagara/adsp.mbn"; ++ firmware-name = "qcom/sm8450/Sony/nagara/adsp.mbn"; + status = "okay"; + }; + + &remoteproc_cdsp { +- firmware-name = "qcom/sm8350/Sony/nagara/cdsp.mbn"; ++ firmware-name = "qcom/sm8450/Sony/nagara/cdsp.mbn"; + status = "okay"; + }; + + &remoteproc_slpi { +- firmware-name = "qcom/sm8350/Sony/nagara/slpi.mbn"; ++ firmware-name = "qcom/sm8450/Sony/nagara/slpi.mbn"; + status = "okay"; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-104-blk-mq-avoid-sleep-in-blk_mq_alloc_request_hctx.patch b/patches.kernel.org/6.2.3-104-blk-mq-avoid-sleep-in-blk_mq_alloc_request_hctx.patch new file mode 100644 index 0000000..2a453fc --- /dev/null +++ b/patches.kernel.org/6.2.3-104-blk-mq-avoid-sleep-in-blk_mq_alloc_request_hctx.patch @@ -0,0 +1,54 @@ +From: Kemeng Shi +Date: Wed, 18 Jan 2023 17:37:13 +0800 +Subject: [PATCH] blk-mq: avoid sleep in blk_mq_alloc_request_hctx +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6ee858a3d3270a68902d66bb47c151a83622535c + +[ Upstream commit 6ee858a3d3270a68902d66bb47c151a83622535c ] + +Commit 1f5bd336b9150 ("blk-mq: add blk_mq_alloc_request_hctx") add +blk_mq_alloc_request_hctx to send commands to a specific queue. If +BLK_MQ_REQ_NOWAIT is not set in tag allocation, we may change to different +hctx after sleep and get tag from unexpected hctx. So BLK_MQ_REQ_NOWAIT +must be set in flags for blk_mq_alloc_request_hctx. +After commit 600c3b0cea784 ("blk-mq: open code __blk_mq_alloc_request in +blk_mq_alloc_request_hctx"), blk_mq_alloc_request_hctx return -EINVAL +if both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED are not set instead of +if BLK_MQ_REQ_NOWAIT is not set. So if BLK_MQ_REQ_NOWAIT is not set and +BLK_MQ_REQ_RESERVED is set, blk_mq_alloc_request_hctx could alloc tag +from unexpected hctx. I guess what we need here is that return -EINVAL +if either BLK_MQ_REQ_NOWAIT or BLK_MQ_REQ_RESERVED is not set. + +Currently both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED will be set if +specific hctx is needed in nvme_auth_submit, nvmf_connect_io_queue +and nvmf_connect_admin_queue. Fix the potential BLK_MQ_REQ_NOWAIT missed +case in future. + +Fixes: 600c3b0cea78 ("blk-mq: open code __blk_mq_alloc_request in blk_mq_alloc_request_hctx") +Reviewed-by: Christoph Hellwig +Signed-off-by: Kemeng Shi +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-mq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 9c8dc700..dc29a7c8 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -658,7 +658,8 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, + * allocator for this for the rare use case of a command tied to + * a specific queue. + */ +- if (WARN_ON_ONCE(!(flags & (BLK_MQ_REQ_NOWAIT | BLK_MQ_REQ_RESERVED)))) ++ if (WARN_ON_ONCE(!(flags & BLK_MQ_REQ_NOWAIT)) || ++ WARN_ON_ONCE(!(flags & BLK_MQ_REQ_RESERVED))) + return ERR_PTR(-EINVAL); + + if (hctx_idx >= q->nr_hw_queues) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-105-blk-mq-remove-stale-comment-for-blk_mq_sched_ma.patch b/patches.kernel.org/6.2.3-105-blk-mq-remove-stale-comment-for-blk_mq_sched_ma.patch new file mode 100644 index 0000000..36d48fe --- /dev/null +++ b/patches.kernel.org/6.2.3-105-blk-mq-remove-stale-comment-for-blk_mq_sched_ma.patch @@ -0,0 +1,43 @@ +From: Kemeng Shi +Date: Wed, 18 Jan 2023 17:37:14 +0800 +Subject: [PATCH] blk-mq: remove stale comment for + blk_mq_sched_mark_restart_hctx +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c31e76bcc379182fe67a82c618493b7b8868c672 + +[ Upstream commit c31e76bcc379182fe67a82c618493b7b8868c672 ] + +Commit 97889f9ac24f8 ("blk-mq: remove synchronize_rcu() from +blk_mq_del_queue_tag_set()") remove handle of TAG_SHARED in restart, +then shared_hctx_restart counted for how many hardware queues are marked +for restart is removed too. +Remove the stale comment that we still count hardware queues need restart. + +Fixes: 97889f9ac24f ("blk-mq: remove synchronize_rcu() from blk_mq_del_queue_tag_set()") +Reviewed-by: Christoph Hellwig +Signed-off-by: Kemeng Shi +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-mq-sched.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index 23d1a90f..ae40cdb7 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -19,8 +19,7 @@ + #include "blk-wbt.h" + + /* +- * Mark a hardware queue as needing a restart. For shared queues, maintain +- * a count of how many hardware queues are marked for restart. ++ * Mark a hardware queue as needing a restart. + */ + void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx) + { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-106-blk-mq-wait-on-correct-sbitmap_queue-in-blk_mq_.patch b/patches.kernel.org/6.2.3-106-blk-mq-wait-on-correct-sbitmap_queue-in-blk_mq_.patch new file mode 100644 index 0000000..feb4b84 --- /dev/null +++ b/patches.kernel.org/6.2.3-106-blk-mq-wait-on-correct-sbitmap_queue-in-blk_mq_.patch @@ -0,0 +1,54 @@ +From: Kemeng Shi +Date: Wed, 18 Jan 2023 17:37:15 +0800 +Subject: [PATCH] blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 98b99e9412d0cde8c7b442bf5efb09528a2ede8b + +[ Upstream commit 98b99e9412d0cde8c7b442bf5efb09528a2ede8b ] + +For shared queues case, we will only wait on bitmap_tags if we fail to get +driver tag. However, rq could be from breserved_tags, then two problems +will occur: +1. io hung if no tag is currently allocated from bitmap_tags. +2. unnecessary wakeup when tag is freed to bitmap_tags while no tag is +freed to breserved_tags. +Wait on the bitmap which rq from to fix this. + +Fixes: f906a6a0f426 ("blk-mq: improve tag waiting setup for non-shared tags") +Reviewed-by: Christoph Hellwig +Signed-off-by: Kemeng Shi +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-mq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index dc29a7c8..8bc67784 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1826,7 +1826,7 @@ static int blk_mq_dispatch_wake(wait_queue_entry_t *wait, unsigned mode, + static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, + struct request *rq) + { +- struct sbitmap_queue *sbq = &hctx->tags->bitmap_tags; ++ struct sbitmap_queue *sbq; + struct wait_queue_head *wq; + wait_queue_entry_t *wait; + bool ret; +@@ -1849,6 +1849,10 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, + if (!list_empty_careful(&wait->entry)) + return false; + ++ if (blk_mq_tag_is_reserved(rq->mq_hctx->sched_tags, rq->internal_tag)) ++ sbq = &hctx->tags->breserved_tags; ++ else ++ sbq = &hctx->tags->bitmap_tags; + wq = &bt_wait_ptr(sbq, hctx)->wait; + + spin_lock_irq(&wq->lock); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-107-blk-mq-Fix-potential-io-hung-for-shared-sbitmap.patch b/patches.kernel.org/6.2.3-107-blk-mq-Fix-potential-io-hung-for-shared-sbitmap.patch new file mode 100644 index 0000000..bed632e --- /dev/null +++ b/patches.kernel.org/6.2.3-107-blk-mq-Fix-potential-io-hung-for-shared-sbitmap.patch @@ -0,0 +1,57 @@ +From: Kemeng Shi +Date: Wed, 18 Jan 2023 17:37:16 +0800 +Subject: [PATCH] blk-mq: Fix potential io hung for shared sbitmap per tagset +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 47df9ce95cd568d3f84218c4f65e9fbd4dfeda55 + +[ Upstream commit 47df9ce95cd568d3f84218c4f65e9fbd4dfeda55 ] + +Commit f906a6a0f4268 ("blk-mq: improve tag waiting setup for non-shared +tags") mark restart for unshared tags for improvement. At that time, +tags is only shared betweens queues and we can check if tags is shared +by test BLK_MQ_F_TAG_SHARED. +Afterwards, commit 32bc15afed04b ("blk-mq: Facilitate a shared sbitmap per +tagset") enabled tags share betweens hctxs inside a queue. We only +mark restart for shared hctxs inside a queue and may cause io hung if +there is no tag currently allocated by hctxs going to be marked restart. +Wait on sbitmap_queue instead of mark restart for shared hctxs case to +fix this. + +Fixes: 32bc15afed04 ("blk-mq: Facilitate a shared sbitmap per tagset") +Signed-off-by: Kemeng Shi +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-mq.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 8bc67784..b9e3b558 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1831,7 +1831,8 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, + wait_queue_entry_t *wait; + bool ret; + +- if (!(hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED)) { ++ if (!(hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED) && ++ !(blk_mq_is_shared_tags(hctx->flags))) { + blk_mq_sched_mark_restart_hctx(hctx); + + /* +@@ -2101,7 +2102,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list, + bool needs_restart; + /* For non-shared tags, the RESTART check will suffice */ + bool no_tag = prep == PREP_DISPATCH_NO_TAG && +- (hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED); ++ ((hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED) || ++ blk_mq_is_shared_tags(hctx->flags)); + + if (nr_budgets) + blk_mq_release_budgets(q, list); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-108-blk-mq-correct-stale-comment-of-.get_budget.patch b/patches.kernel.org/6.2.3-108-blk-mq-correct-stale-comment-of-.get_budget.patch new file mode 100644 index 0000000..3bcf8e5 --- /dev/null +++ b/patches.kernel.org/6.2.3-108-blk-mq-correct-stale-comment-of-.get_budget.patch @@ -0,0 +1,50 @@ +From: Kemeng Shi +Date: Wed, 18 Jan 2023 17:37:26 +0800 +Subject: [PATCH] blk-mq: correct stale comment of .get_budget +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 01542f651a9f58a9b176c3d3dc3eefbacee53b78 + +[ Upstream commit 01542f651a9f58a9b176c3d3dc3eefbacee53b78 ] + +Commit 88022d7201e96 ("blk-mq: don't handle failure in .get_budget") +remove BLK_STS_RESOURCE return value and we only check if we can get +the budget from .get_budget() now. +Correct stale comment that ".get_budget() returns BLK_STS_NO_RESOURCE" +to ".get_budget() fails to get the budget". + +Fixes: 88022d7201e9 ("blk-mq: don't handle failure in .get_budget") +Signed-off-by: Kemeng Shi +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-mq-sched.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index ae40cdb7..06b312c6 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -81,7 +81,7 @@ static bool blk_mq_dispatch_hctx_list(struct list_head *rq_list) + /* + * Only SCSI implements .get_budget and .put_budget, and SCSI restarts + * its queue by itself in its completion handler, so we don't need to +- * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. ++ * restart queue if .get_budget() fails to get the budget. + * + * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to + * be run again. This is necessary to avoid starving flushes. +@@ -209,7 +209,7 @@ static struct blk_mq_ctx *blk_mq_next_ctx(struct blk_mq_hw_ctx *hctx, + /* + * Only SCSI implements .get_budget and .put_budget, and SCSI restarts + * its queue by itself in its completion handler, so we don't need to +- * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. ++ * restart queue if .get_budget() fails to get the budget. + * + * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to + * be run again. This is necessary to avoid starving flushes. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-109-arm64-dts-qcom-msm8996-support-using-GPLL0-as-k.patch b/patches.kernel.org/6.2.3-109-arm64-dts-qcom-msm8996-support-using-GPLL0-as-k.patch new file mode 100644 index 0000000..00e73d9 --- /dev/null +++ b/patches.kernel.org/6.2.3-109-arm64-dts-qcom-msm8996-support-using-GPLL0-as-k.patch @@ -0,0 +1,41 @@ +From: Dmitry Baryshkov +Date: Fri, 13 Jan 2023 14:05:44 +0200 +Subject: [PATCH] arm64: dts: qcom: msm8996: support using GPLL0 as kryocc + input +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ac0d84d4556cecf81ba0b1631d25d9a395235a5c + +[ Upstream commit ac0d84d4556cecf81ba0b1631d25d9a395235a5c ] + +In some cases the driver might need using GPLL0 to drive CPU clocks. +Bring it in through the sys_apcs_aux clock. + +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113120544.59320-15-dmitry.baryshkov@linaro.org +Stable-dep-of: 8ae72166c2b7 ("arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index d3146420..286f7b44 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -2940,8 +2940,8 @@ kryocc: clock-controller@6400000 { + compatible = "qcom,msm8996-apcc"; + reg = <0x06400000 0x90000>; + +- clock-names = "xo"; +- clocks = <&rpmcc RPM_SMD_BB_CLK1>; ++ clock-names = "xo", "sys_apcs_aux"; ++ clocks = <&rpmcc RPM_SMD_BB_CLK1>, <&apcs_glb>; + + #clock-cells = <1>; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-110-arm64-dts-qcom-msm8996-switch-from-RPM_SMD_BB_C.patch b/patches.kernel.org/6.2.3-110-arm64-dts-qcom-msm8996-switch-from-RPM_SMD_BB_C.patch new file mode 100644 index 0000000..d64c413 --- /dev/null +++ b/patches.kernel.org/6.2.3-110-arm64-dts-qcom-msm8996-switch-from-RPM_SMD_BB_C.patch @@ -0,0 +1,96 @@ +From: Dmitry Baryshkov +Date: Fri, 20 Jan 2023 08:14:15 +0200 +Subject: [PATCH] arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to + RPM_SMD_XO_CLK_SRC +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8ae72166c2b73b0f2ce498ea15d4feceb9fef50e + +[ Upstream commit 8ae72166c2b73b0f2ce498ea15d4feceb9fef50e ] + +The vendor kernel uses RPM_SMD_XO_CLK_SRC clock as an CXO clock rather +than using the RPM_SMD_BB_CLK1 directly. Follow this example and switch +msm8996.dtsi to use RPM_SMD_XO_CLK_SRC clock instead of RPM_SMB_BB_CLK1. + +Fixes: 2b8c9c77c268 ("arm64: dts: qcom: msm8996: convert xo_board to RPM_SMD_BB_CLK1") +Suggested-by: Konrad Dybcio +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230120061417.2623751-7-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 286f7b44..a444d9b5 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -713,7 +713,7 @@ gcc: clock-controller@300000 { + #power-domain-cells = <1>; + reg = <0x00300000 0x90000>; + +- clocks = <&rpmcc RPM_SMD_BB_CLK1>, ++ clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>, + <&rpmcc RPM_SMD_LN_BB_CLK>, + <&sleep_clk>, + <&pciephy_0>, +@@ -1050,7 +1050,7 @@ dsi0_phy: phy@994400 { + #clock-cells = <1>; + #phy-cells = <0>; + +- clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_BB_CLK1>; ++ clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_XO_CLK_SRC>; + clock-names = "iface", "ref"; + status = "disabled"; + }; +@@ -1117,7 +1117,7 @@ dsi1_phy: phy@996400 { + #clock-cells = <1>; + #phy-cells = <0>; + +- clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_BB_CLK1>; ++ clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_XO_CLK_SRC>; + clock-names = "iface", "ref"; + status = "disabled"; + }; +@@ -2941,7 +2941,7 @@ kryocc: clock-controller@6400000 { + reg = <0x06400000 0x90000>; + + clock-names = "xo", "sys_apcs_aux"; +- clocks = <&rpmcc RPM_SMD_BB_CLK1>, <&apcs_glb>; ++ clocks = <&rpmcc RPM_SMD_XO_A_CLK_SRC>, <&apcs_glb>; + + #clock-cells = <1>; + }; +@@ -3060,7 +3060,7 @@ sdhc1: mmc@7464900 { + clock-names = "iface", "core", "xo"; + clocks = <&gcc GCC_SDCC1_AHB_CLK>, + <&gcc GCC_SDCC1_APPS_CLK>, +- <&rpmcc RPM_SMD_BB_CLK1>; ++ <&rpmcc RPM_SMD_XO_CLK_SRC>; + resets = <&gcc GCC_SDCC1_BCR>; + + pinctrl-names = "default", "sleep"; +@@ -3084,7 +3084,7 @@ sdhc2: mmc@74a4900 { + clock-names = "iface", "core", "xo"; + clocks = <&gcc GCC_SDCC2_AHB_CLK>, + <&gcc GCC_SDCC2_APPS_CLK>, +- <&rpmcc RPM_SMD_BB_CLK1>; ++ <&rpmcc RPM_SMD_XO_CLK_SRC>; + resets = <&gcc GCC_SDCC2_BCR>; + + pinctrl-names = "default", "sleep"; +@@ -3406,7 +3406,7 @@ adsp_pil: remoteproc@9300000 { + interrupt-names = "wdog", "fatal", "ready", + "handover", "stop-ack"; + +- clocks = <&rpmcc RPM_SMD_BB_CLK1>; ++ clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>; + clock-names = "xo"; + + memory-region = <&adsp_mem>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-111-arm64-dts-qcom-sm8350-drop-incorrect-cells-from.patch b/patches.kernel.org/6.2.3-111-arm64-dts-qcom-sm8350-drop-incorrect-cells-from.patch new file mode 100644 index 0000000..4e41792 --- /dev/null +++ b/patches.kernel.org/6.2.3-111-arm64-dts-qcom-sm8350-drop-incorrect-cells-from.patch @@ -0,0 +1,39 @@ +From: Krzysztof Kozlowski +Date: Tue, 24 Jan 2023 09:49:49 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8350: drop incorrect cells from serial +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6027331e6eae9eb957d1b73a7e3255f4151d6163 + +[ Upstream commit 6027331e6eae9eb957d1b73a7e3255f4151d6163 ] + +The serial/UART device node does not have children with unit addresses, +so address/size cells are not correct. + +Fixes: cf03cd7e12bd ("arm64: dts: qcom: sm8350: Set up WRAP0 QUPs") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230124084951.38195-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index fb3cd20a..646c64f0 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -1043,8 +1043,6 @@ uart2: serial@98c000 { + interrupts = ; + power-domains = <&rpmhpd SM8350_CX>; + operating-points-v2 = <&qup_opp_table_100mhz>; +- #address-cells = <1>; +- #size-cells = <0>; + status = "disabled"; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-112-arm64-dts-qcom-sm8450-drop-incorrect-cells-from.patch b/patches.kernel.org/6.2.3-112-arm64-dts-qcom-sm8450-drop-incorrect-cells-from.patch new file mode 100644 index 0000000..fa8d225 --- /dev/null +++ b/patches.kernel.org/6.2.3-112-arm64-dts-qcom-sm8450-drop-incorrect-cells-from.patch @@ -0,0 +1,49 @@ +From: Krzysztof Kozlowski +Date: Tue, 24 Jan 2023 09:49:50 +0100 +Subject: [PATCH] arm64: dts: qcom: sm8450: drop incorrect cells from serial +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 60d2da2c916956535cf37b7bf1ae8fefbf432e55 + +[ Upstream commit 60d2da2c916956535cf37b7bf1ae8fefbf432e55 ] + +The serial/UART device node does not have children with unit addresses, +so address/size cells are not correct. + +Fixes: f5837418479a ("arm64: dts: qcom: sm8450: add uart20 node") +Fixes: 5188049c9b36 ("arm64: dts: qcom: Add base SM8450 DTSI") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230124084951.38195-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index eb331851..f57980a3 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -997,8 +997,6 @@ uart20: serial@894000 { + pinctrl-names = "default"; + pinctrl-0 = <&qup_uart20_default>; + interrupts = ; +- #address-cells = <1>; +- #size-cells = <0>; + status = "disabled"; + }; + +@@ -1391,8 +1389,6 @@ uart7: serial@99c000 { + pinctrl-names = "default"; + pinctrl-0 = <&qup_uart7_tx>, <&qup_uart7_rx>; + interrupts = ; +- #address-cells = <1>; +- #size-cells = <0>; + status = "disabled"; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-113-arm64-dts-qcom-msm8992-lg-bullhead-Correct-memo.patch b/patches.kernel.org/6.2.3-113-arm64-dts-qcom-msm8992-lg-bullhead-Correct-memo.patch new file mode 100644 index 0000000..333b250 --- /dev/null +++ b/patches.kernel.org/6.2.3-113-arm64-dts-qcom-msm8992-lg-bullhead-Correct-memo.patch @@ -0,0 +1,63 @@ +From: Jamie Douglass +Date: Thu, 2 Feb 2023 16:48:19 +1100 +Subject: [PATCH] arm64: dts: qcom: msm8992-lg-bullhead: Correct memory + overlaps with the SMEM and MPSS memory regions +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d44106883d74992343710f18c4aaae937c7cefab + +[ Upstream commit d44106883d74992343710f18c4aaae937c7cefab ] + +The memory region reserved by a previous commit (see fixes tag below) +overlaps with the SMEM and MPSS memory regions, causing error messages in +dmesg: + OF: reserved mem: OVERLAP DETECTED! + reserved@5000000 (0x0000000005000000--0x0000000007200000) + overlaps with smem_region@6a00000 + (0x0000000006a00000--0x0000000006c00000) + + OF: reserved mem: OVERLAP DETECTED! + reserved@6c00000 (0x0000000006c00000--0x0000000007200000) + overlaps with memory@7000000 + (0x0000000007000000--0x000000000ca00000) + +This patch resolves both of these by splitting the previously reserved +memory region into two sections either side of the SMEM region and by +cutting off the second memory region to 0x7000000. + +Fixes: 22c7e1a0fa45 ("arm64: dts: msm8992-bullhead: add memory hole region") +Signed-off-by: Jamie Douglass +Reviewed-by: Petr Vorel +Tested-by: Petr Vorel +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230202054819.16079-1-jamiemdouglass@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +index 4bceb362..cdd79604 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +@@ -56,8 +56,13 @@ cont_splash_mem: memory@3400000 { + no-map; + }; + +- removed_region: reserved@5000000 { +- reg = <0 0x05000000 0 0x2200000>; ++ reserved@5000000 { ++ reg = <0x0 0x05000000 0x0 0x1a00000>; ++ no-map; ++ }; ++ ++ reserved@6c00000 { ++ reg = <0x0 0x06c00000 0x0 0x400000>; + no-map; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-114-arm64-dts-qcom-msm8953-correct-TLMM-gpio-ranges.patch b/patches.kernel.org/6.2.3-114-arm64-dts-qcom-msm8953-correct-TLMM-gpio-ranges.patch new file mode 100644 index 0000000..be0b9f4 --- /dev/null +++ b/patches.kernel.org/6.2.3-114-arm64-dts-qcom-msm8953-correct-TLMM-gpio-ranges.patch @@ -0,0 +1,39 @@ +From: Krzysztof Kozlowski +Date: Thu, 2 Feb 2023 11:44:51 +0100 +Subject: [PATCH] arm64: dts: qcom: msm8953: correct TLMM gpio-ranges +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a4fb71497df23cb0d02d70fa2b8f8786328e325d + +[ Upstream commit a4fb71497df23cb0d02d70fa2b8f8786328e325d ] + +Correct the number of GPIOs in TLMM pin controller. + +Fixes: 9fb08c801923 ("arm64: dts: qcom: Add MSM8953 device tree") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Luca Weiss +Acked-by: Linus Walleij +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230202104452.299048-10-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8953.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8953.dtsi b/arch/arm64/boot/dts/qcom/msm8953.dtsi +index 32349174..70f03365 100644 +--- a/arch/arm64/boot/dts/qcom/msm8953.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8953.dtsi +@@ -455,7 +455,7 @@ tlmm: pinctrl@1000000 { + reg = <0x1000000 0x300000>; + interrupts = ; + gpio-controller; +- gpio-ranges = <&tlmm 0 0 155>; ++ gpio-ranges = <&tlmm 0 0 142>; + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-115-arm64-dts-qcom-sm6115-correct-TLMM-gpio-ranges.patch b/patches.kernel.org/6.2.3-115-arm64-dts-qcom-sm6115-correct-TLMM-gpio-ranges.patch new file mode 100644 index 0000000..b754106 --- /dev/null +++ b/patches.kernel.org/6.2.3-115-arm64-dts-qcom-sm6115-correct-TLMM-gpio-ranges.patch @@ -0,0 +1,39 @@ +From: Krzysztof Kozlowski +Date: Thu, 2 Feb 2023 11:44:52 +0100 +Subject: [PATCH] arm64: dts: qcom: sm6115: correct TLMM gpio-ranges +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 272fc52431611d779de132c4e03de6e0c1199731 + +[ Upstream commit 272fc52431611d779de132c4e03de6e0c1199731 ] + +Correct the number of GPIOs in TLMM pin controller. + +Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Iskren Chernev +Acked-by: Linus Walleij +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230202104452.299048-11-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi +index 81523ab7..9de56365 100644 +--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi +@@ -363,7 +363,7 @@ tlmm: pinctrl@500000 { + reg-names = "west", "south", "east"; + interrupts = ; + gpio-controller; +- gpio-ranges = <&tlmm 0 0 121>; ++ gpio-ranges = <&tlmm 0 0 114>; /* GPIOs + ufs_reset */ + #gpio-cells = <2>; + interrupt-controller; + #interrupt-cells = <2>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-116-arm64-dts-qcom-msm8992-lg-bullhead-Enable-regul.patch b/patches.kernel.org/6.2.3-116-arm64-dts-qcom-msm8992-lg-bullhead-Enable-regul.patch new file mode 100644 index 0000000..71807d2 --- /dev/null +++ b/patches.kernel.org/6.2.3-116-arm64-dts-qcom-msm8992-lg-bullhead-Enable-regul.patch @@ -0,0 +1,107 @@ +From: Petr Vorel +Date: Fri, 3 Feb 2023 11:09:52 +0100 +Subject: [PATCH] arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2866527093ddbc6356bb31f560f0b4b4decf3e2e + +[ Upstream commit 2866527093ddbc6356bb31f560f0b4b4decf3e2e ] + +Enable pm8994_s1, pm8994_l{26,29,30,32} regulators. +Use values from downstream kernel on bullhead rev 1.01. + +NOTE: downstream kernel on angler rev 1.01 differences: +* pm8994_l29: regulator-min-microvolt = <2700000> +* pm8994_l{20,28,31}: use regulator-boot-on + +Verification: +[ 1.832460] s1: Bringing 0uV into 1025000-1025000uV +... +[ 2.057667] l26: Bringing 0uV into 987500-987500uV +... +[ 2.075722] l29: Bringing 0uV into 2800000-2800000uV +[ 2.076604] l30: Bringing 0uV into 1800000-1800000uV +[ 2.082431] l31: Bringing 0uV into 1262500-1262500uV +[ 2.095767] l32: Bringing 0uV into 1800000-1800000uV + +Fixes: f3b2c99e73be ("arm64: dts: Enable onboard SDHCI on msm8992") +Signed-off-by: Petr Vorel +Tested-by: Jamie Douglass +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230203100952.13857-1-pvorel@suse.cz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../boot/dts/qcom/msm8992-lg-bullhead.dtsi | 32 ++++++------------- + 1 file changed, 10 insertions(+), 22 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +index cdd79604..cd77dcb5 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +@@ -94,8 +94,8 @@ pm8994_regulators: regulators-0 { + /* S1, S2, S6 and S12 are managed by RPMPD */ + + pm8994_s1: s1 { +- regulator-min-microvolt = <800000>; +- regulator-max-microvolt = <800000>; ++ regulator-min-microvolt = <1025000>; ++ regulator-max-microvolt = <1025000>; + }; + + pm8994_s2: s2 { +@@ -251,11 +251,8 @@ pm8994_l25: l25 { + }; + + pm8994_l26: l26 { +- /* +- * TODO: value from downstream +- * regulator-min-microvolt = <987500>; +- * fails to apply +- */ ++ regulator-min-microvolt = <987500>; ++ regulator-max-microvolt = <987500>; + }; + + pm8994_l27: l27 { +@@ -269,19 +266,13 @@ pm8994_l28: l28 { + }; + + pm8994_l29: l29 { +- /* +- * TODO: Unsupported voltage range. +- * regulator-min-microvolt = <2800000>; +- * regulator-max-microvolt = <2800000>; +- */ ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; + }; + + pm8994_l30: l30 { +- /* +- * TODO: get this verified +- * regulator-min-microvolt = <1800000>; +- * regulator-max-microvolt = <1800000>; +- */ ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; + }; + + pm8994_l31: l31 { +@@ -290,11 +281,8 @@ pm8994_l31: l31 { + }; + + pm8994_l32: l32 { +- /* +- * TODO: get this verified +- * regulator-min-microvolt = <1800000>; +- * regulator-max-microvolt = <1800000>; +- */ ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; + }; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-117-s390-dasd-Fix-potential-memleak-in-dasd_eckd_in.patch b/patches.kernel.org/6.2.3-117-s390-dasd-Fix-potential-memleak-in-dasd_eckd_in.patch new file mode 100644 index 0000000..6992a2c --- /dev/null +++ b/patches.kernel.org/6.2.3-117-s390-dasd-Fix-potential-memleak-in-dasd_eckd_in.patch @@ -0,0 +1,44 @@ +From: Qiheng Lin +Date: Fri, 10 Feb 2023 01:02:53 +0100 +Subject: [PATCH] s390/dasd: Fix potential memleak in dasd_eckd_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 460e9bed82e49db1b823dcb4e421783854d86c40 + +[ Upstream commit 460e9bed82e49db1b823dcb4e421783854d86c40 ] + +`dasd_reserve_req` is allocated before `dasd_vol_info_req`, and it +also needs to be freed before the error returns, just like the other +cases in this function. + +Fixes: 9e12e54c7a8f ("s390/dasd: Handle out-of-space constraint") +Signed-off-by: Qiheng Lin +Link: https://lore.kernel.org/r/20221208133809.16796-1-linqiheng@huawei.com +Signed-off-by: Stefan Haberland +Link: https://lore.kernel.org/r/20230210000253.1644903-3-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/s390/block/dasd_eckd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index 5d0b9991..b20ce86b 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -6956,8 +6956,10 @@ dasd_eckd_init(void) + return -ENOMEM; + dasd_vol_info_req = kmalloc(sizeof(*dasd_vol_info_req), + GFP_KERNEL | GFP_DMA); +- if (!dasd_vol_info_req) ++ if (!dasd_vol_info_req) { ++ kfree(dasd_reserve_req); + return -ENOMEM; ++ } + pe_handler_worker = kmalloc(sizeof(*pe_handler_worker), + GFP_KERNEL | GFP_DMA); + if (!pe_handler_worker) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-118-io_uring-audit-don-t-log-IORING_OP_MADVISE.patch b/patches.kernel.org/6.2.3-118-io_uring-audit-don-t-log-IORING_OP_MADVISE.patch new file mode 100644 index 0000000..0289261 --- /dev/null +++ b/patches.kernel.org/6.2.3-118-io_uring-audit-don-t-log-IORING_OP_MADVISE.patch @@ -0,0 +1,38 @@ +From: Richard Guy Briggs +Date: Wed, 1 Feb 2023 15:33:33 -0500 +Subject: [PATCH] io_uring,audit: don't log IORING_OP_MADVISE +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fbe870a72fd1ddc5e08c23764e23e5766f54aa87 + +[ Upstream commit fbe870a72fd1ddc5e08c23764e23e5766f54aa87 ] + +fadvise and madvise both provide hints for caching or access pattern for +file and memory respectively. Skip them. + +Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring") +Signed-off-by: Richard Guy Briggs +Link: https://lore.kernel.org/r/b5dfdcd541115c86dbc774aa9dd502c964849c5f.1675282642.git.rgb@redhat.com +Acked-by: Paul Moore +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + io_uring/opdef.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/io_uring/opdef.c b/io_uring/opdef.c +index 3aa0d65c..be45b766 100644 +--- a/io_uring/opdef.c ++++ b/io_uring/opdef.c +@@ -313,6 +313,7 @@ const struct io_op_def io_op_defs[] = { + }, + [IORING_OP_MADVISE] = { + .name = "MADVISE", ++ .audit_skip = 1, + .prep = io_madvise_prep, + .issue = io_madvise, + }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-119-sched-rt-pick_next_rt_entity-check-list_entry.patch b/patches.kernel.org/6.2.3-119-sched-rt-pick_next_rt_entity-check-list_entry.patch new file mode 100644 index 0000000..291dae2 --- /dev/null +++ b/patches.kernel.org/6.2.3-119-sched-rt-pick_next_rt_entity-check-list_entry.patch @@ -0,0 +1,56 @@ +From: Pietro Borrello +Date: Mon, 6 Feb 2023 22:33:54 +0000 +Subject: [PATCH] sched/rt: pick_next_rt_entity(): check list_entry +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 + +[ Upstream commit 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 ] + +Commit 326587b84078 ("sched: fix goto retry in pick_next_task_rt()") +removed any path which could make pick_next_rt_entity() return NULL. +However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of +pick_next_rt_entity()) still checks the error condition, which can +never happen, since list_entry() never returns NULL. +Remove the BUG_ON check, and instead emit a warning in the only +possible error condition here: the queue being empty which should +never happen. + +Fixes: 326587b84078 ("sched: fix goto retry in pick_next_task_rt()") +Signed-off-by: Pietro Borrello +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Phil Auld +Reviewed-by: Steven Rostedt (Google) +Link: https://lore.kernel.org/r/20230128-list-entry-null-check-sched-v3-1-b1a71bd1ac6b@diag.uniroma1.it +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/sched/rt.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index ed2a47e4..0a11f44a 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -1777,6 +1777,8 @@ static struct sched_rt_entity *pick_next_rt_entity(struct rt_rq *rt_rq) + BUG_ON(idx >= MAX_RT_PRIO); + + queue = array->queue + idx; ++ if (SCHED_WARN_ON(list_empty(queue))) ++ return NULL; + next = list_entry(queue->next, struct sched_rt_entity, run_list); + + return next; +@@ -1789,7 +1791,8 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq) + + do { + rt_se = pick_next_rt_entity(rt_rq); +- BUG_ON(!rt_se); ++ if (unlikely(!rt_se)) ++ return NULL; + rt_rq = group_rt_rq(rt_se); + } while (rt_rq); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-120-perf-x86-intel-ds-Fix-the-conversion-from-TSC-t.patch b/patches.kernel.org/6.2.3-120-perf-x86-intel-ds-Fix-the-conversion-from-TSC-t.patch new file mode 100644 index 0000000..412ef84 --- /dev/null +++ b/patches.kernel.org/6.2.3-120-perf-x86-intel-ds-Fix-the-conversion-from-TSC-t.patch @@ -0,0 +1,119 @@ +From: Kan Liang +Date: Wed, 25 Jan 2023 12:49:25 -0800 +Subject: [PATCH] perf/x86/intel/ds: Fix the conversion from TSC to perf time +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 89e97eb8cec0f1af5ebf2380308913256ca7915a + +[ Upstream commit 89e97eb8cec0f1af5ebf2380308913256ca7915a ] + +The time order is incorrect when the TSC in a PEBS record is used. + + $perf record -e cycles:upp dd if=/dev/zero of=/dev/null + count=10000 + $ perf script --show-task-events + perf-exec 0 0.000000: PERF_RECORD_COMM: perf-exec:915/915 + dd 915 106.479872: PERF_RECORD_COMM exec: dd:915/915 + dd 915 106.483270: PERF_RECORD_EXIT(915:915):(914:914) + dd 915 106.512429: 1 cycles:upp: + ffffffff96c011b7 [unknown] ([unknown]) + ... ... + +The perf time is from sched_clock_cpu(). The current PEBS code +unconditionally convert the TSC to native_sched_clock(). There is a +shift between the two clocks. If the TSC is stable, the shift is +consistent, __sched_clock_offset. If the TSC is unstable, the shift has +to be calculated at runtime. + +This patch doesn't support the conversion when the TSC is unstable. The +TSC unstable case is a corner case and very unlikely to happen. If it +happens, the TSC in a PEBS record will be dropped and fall back to +perf_event_clock(). + +Fixes: 47a3aeb39e8d ("perf/x86/intel/pebs: Fix PEBS timestamps overwritten") +Reported-by: Namhyung Kim +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/all/CAM9d7cgWDVAq8-11RbJ2uGfwkKD6fA-OMwOKDrNUrU_=8MgEjg@mail.gmail.com/ +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/events/intel/ds.c | 35 ++++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c +index 88e58b6e..91b21423 100644 +--- a/arch/x86/events/intel/ds.c ++++ b/arch/x86/events/intel/ds.c +@@ -2,12 +2,14 @@ + #include + #include + #include ++#include + + #include + #include + #include + #include + #include ++#include + + #include "../perf_event.h" + +@@ -1519,6 +1521,27 @@ static u64 get_data_src(struct perf_event *event, u64 aux) + return val; + } + ++static void setup_pebs_time(struct perf_event *event, ++ struct perf_sample_data *data, ++ u64 tsc) ++{ ++ /* Converting to a user-defined clock is not supported yet. */ ++ if (event->attr.use_clockid != 0) ++ return; ++ ++ /* ++ * Doesn't support the conversion when the TSC is unstable. ++ * The TSC unstable case is a corner case and very unlikely to ++ * happen. If it happens, the TSC in a PEBS record will be ++ * dropped and fall back to perf_event_clock(). ++ */ ++ if (!using_native_sched_clock() || !sched_clock_stable()) ++ return; ++ ++ data->time = native_sched_clock_from_tsc(tsc) + __sched_clock_offset; ++ data->sample_flags |= PERF_SAMPLE_TIME; ++} ++ + #define PERF_SAMPLE_ADDR_TYPE (PERF_SAMPLE_ADDR | \ + PERF_SAMPLE_PHYS_ADDR | \ + PERF_SAMPLE_DATA_PAGE_SIZE) +@@ -1668,11 +1691,8 @@ static void setup_pebs_fixed_sample_data(struct perf_event *event, + * + * We can only do this for the default trace clock. + */ +- if (x86_pmu.intel_cap.pebs_format >= 3 && +- event->attr.use_clockid == 0) { +- data->time = native_sched_clock_from_tsc(pebs->tsc); +- data->sample_flags |= PERF_SAMPLE_TIME; +- } ++ if (x86_pmu.intel_cap.pebs_format >= 3) ++ setup_pebs_time(event, data, pebs->tsc); + + if (has_branch_stack(event)) { + data->br_stack = &cpuc->lbr_stack; +@@ -1735,10 +1755,7 @@ static void setup_pebs_adaptive_sample_data(struct perf_event *event, + perf_sample_data_init(data, 0, event->hw.last_period); + data->period = event->hw.last_period; + +- if (event->attr.use_clockid == 0) { +- data->time = native_sched_clock_from_tsc(basic->tsc); +- data->sample_flags |= PERF_SAMPLE_TIME; +- } ++ setup_pebs_time(event, data, basic->tsc); + + /* + * We must however always use iregs for the unwinder to stay sane; the +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-121-x86-perf-zhaoxin-Add-stepping-check-for-ZXC.patch b/patches.kernel.org/6.2.3-121-x86-perf-zhaoxin-Add-stepping-check-for-ZXC.patch new file mode 100644 index 0000000..0dcce71 --- /dev/null +++ b/patches.kernel.org/6.2.3-121-x86-perf-zhaoxin-Add-stepping-check-for-ZXC.patch @@ -0,0 +1,55 @@ +From: silviazhao +Date: Wed, 8 Feb 2023 16:27:22 +0800 +Subject: [PATCH] x86/perf/zhaoxin: Add stepping check for ZXC +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fd636b6a9bc6034f2e5bb869658898a2b472c037 + +[ Upstream commit fd636b6a9bc6034f2e5bb869658898a2b472c037 ] + +Some of Nano series processors will lead GP when accessing +PMC fixed counter. Meanwhile, their hardware support for PMC +has not announced externally. So exclude Nano CPUs from ZXC +by checking stepping information. This is an unambiguous way +to differentiate between ZXC and Nano CPUs. + +Following are Nano and ZXC FMS information: +Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D] +ZXC FMS: Family=6, Model=F, Stepping=E-F OR + Family=6, Model=0x19, Stepping=0-3 + +Fixes: 3a4ac121c2ca ("x86/perf: Add hardware performance events support for Zhaoxin CPU.") + +Reported-by: Arjan <8vvbbqzo567a@nospam.xutrox.com> +Reported-by: Kevin Brace +Signed-off-by: silviazhao +Signed-off-by: Peter Zijlstra (Intel) +Link: https://bugzilla.kernel.org/show_bug.cgi?id=212389 +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/events/zhaoxin/core.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/events/zhaoxin/core.c b/arch/x86/events/zhaoxin/core.c +index 949d845c..3e9acdae 100644 +--- a/arch/x86/events/zhaoxin/core.c ++++ b/arch/x86/events/zhaoxin/core.c +@@ -541,7 +541,13 @@ __init int zhaoxin_pmu_init(void) + + switch (boot_cpu_data.x86) { + case 0x06: +- if (boot_cpu_data.x86_model == 0x0f || boot_cpu_data.x86_model == 0x19) { ++ /* ++ * Support Zhaoxin CPU from ZXC series, exclude Nano series through FMS. ++ * Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D] ++ * ZXC FMS: Family=6, Model=F, Stepping=E-F OR Family=6, Model=0x19, Stepping=0-3 ++ */ ++ if ((boot_cpu_data.x86_model == 0x0f && boot_cpu_data.x86_stepping >= 0x0e) || ++ boot_cpu_data.x86_model == 0x19) { + + x86_pmu.max_period = x86_pmu.cntval_mask >> 1; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-122-KEYS-asymmetric-Fix-ECDSA-use-via-keyctl-uapi.patch b/patches.kernel.org/6.2.3-122-KEYS-asymmetric-Fix-ECDSA-use-via-keyctl-uapi.patch new file mode 100644 index 0000000..7f74558 --- /dev/null +++ b/patches.kernel.org/6.2.3-122-KEYS-asymmetric-Fix-ECDSA-use-via-keyctl-uapi.patch @@ -0,0 +1,66 @@ +From: Denis Kenzior +Date: Fri, 26 Aug 2022 09:51:19 -0500 +Subject: [PATCH] KEYS: asymmetric: Fix ECDSA use via keyctl uapi +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 10de7b54293995368c52d9aa153f3e7a359f04a1 + +[ Upstream commit 10de7b54293995368c52d9aa153f3e7a359f04a1 ] + +When support for ECDSA keys was added, constraints for data & signature +sizes were never updated. This makes it impossible to use such keys via +keyctl API from userspace. + +Update constraint on max_data_size to 64 bytes in order to support +SHA512-based signatures. Also update the signature length constraints +per ECDSA signature encoding described in RFC 5480. + +Fixes: 299f561a6693 ("x509: Add support for parsing x509 certs with ECDSA keys") +Signed-off-by: Denis Kenzior +Reviewed-by: Stefan Berger +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + crypto/asymmetric_keys/public_key.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c +index 2f8352e8..eca5671a 100644 +--- a/crypto/asymmetric_keys/public_key.c ++++ b/crypto/asymmetric_keys/public_key.c +@@ -186,8 +186,28 @@ static int software_key_query(const struct kernel_pkey_params *params, + + len = crypto_akcipher_maxsize(tfm); + info->key_size = len * 8; +- info->max_data_size = len; +- info->max_sig_size = len; ++ ++ if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) { ++ /* ++ * ECDSA key sizes are much smaller than RSA, and thus could ++ * operate on (hashed) inputs that are larger than key size. ++ * For example SHA384-hashed input used with secp256r1 ++ * based keys. Set max_data_size to be at least as large as ++ * the largest supported hash size (SHA512) ++ */ ++ info->max_data_size = 64; ++ ++ /* ++ * Verify takes ECDSA-Sig (described in RFC 5480) as input, ++ * which is actually 2 'key_size'-bit integers encoded in ++ * ASN.1. Account for the ASN.1 encoding overhead here. ++ */ ++ info->max_sig_size = 2 * (len + 3) + 2; ++ } else { ++ info->max_data_size = len; ++ info->max_sig_size = len; ++ } ++ + info->max_enc_size = len; + info->max_dec_size = len; + info->supported_ops = (KEYCTL_SUPPORTS_ENCRYPT | +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-123-block-ublk-check-IO-buffer-based-on-flag-need_g.patch b/patches.kernel.org/6.2.3-123-block-ublk-check-IO-buffer-based-on-flag-need_g.patch new file mode 100644 index 0000000..1a1884c --- /dev/null +++ b/patches.kernel.org/6.2.3-123-block-ublk-check-IO-buffer-based-on-flag-need_g.patch @@ -0,0 +1,78 @@ +From: Liu Xiaodong +Date: Fri, 10 Feb 2023 09:13:56 -0500 +Subject: [PATCH] block: ublk: check IO buffer based on flag need_get_data +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2f1e07dda1e1310873647abc40bbc49eaf3b10e3 + +[ Upstream commit 2f1e07dda1e1310873647abc40bbc49eaf3b10e3 ] + +Currently, uring_cmd with UBLK_IO_FETCH_REQ or +UBLK_IO_COMMIT_AND_FETCH_REQ is always checked whether +userspace server has provided IO buffer even flag +UBLK_F_NEED_GET_DATA is configured. + +This is a excessive check. If UBLK_F_NEED_GET_DATA is +configured, FETCH_RQ doesn't need to provide IO buffer; +COMMIT_AND_FETCH_REQ also doesn't need to do that if +the IO type is not READ. + +Check ub_cmd->addr together with ublk_need_get_data() +and IO type in ublk_ch_uring_cmd(). + +With this fix, userspace server doesn't need to preserve +buffers for every ublk_io when flag UBLK_F_NEED_GET_DATA +is configured, in order to save memory. + +Signed-off-by: Liu Xiaodong +Fixes: c86019ff75c1 ("ublk_drv: add support for UBLK_IO_NEED_GET_DATA") +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20230210141356.112321-1-xiaodong.liu@intel.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/block/ublk_drv.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c +index 450bd54f..4aec9be0 100644 +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -1206,6 +1206,7 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) + u32 cmd_op = cmd->cmd_op; + unsigned tag = ub_cmd->tag; + int ret = -EINVAL; ++ struct request *req; + + pr_devel("%s: received: cmd op %d queue %d tag %d result %d\n", + __func__, cmd->cmd_op, ub_cmd->q_id, tag, +@@ -1256,8 +1257,8 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) + */ + if (io->flags & UBLK_IO_FLAG_OWNED_BY_SRV) + goto out; +- /* FETCH_RQ has to provide IO buffer */ +- if (!ub_cmd->addr) ++ /* FETCH_RQ has to provide IO buffer if NEED GET DATA is not enabled */ ++ if (!ub_cmd->addr && !ublk_need_get_data(ubq)) + goto out; + io->cmd = cmd; + io->flags |= UBLK_IO_FLAG_ACTIVE; +@@ -1266,8 +1267,12 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) + ublk_mark_io_ready(ub, ubq); + break; + case UBLK_IO_COMMIT_AND_FETCH_REQ: +- /* FETCH_RQ has to provide IO buffer */ +- if (!ub_cmd->addr) ++ req = blk_mq_tag_to_rq(ub->tag_set.tags[ub_cmd->q_id], tag); ++ /* ++ * COMMIT_AND_FETCH_REQ has to provide IO buffer if NEED GET DATA is ++ * not enabled or it is Read IO. ++ */ ++ if (!ub_cmd->addr && (!ublk_need_get_data(ubq) || req_op(req) == REQ_OP_READ)) + goto out; + if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV)) + goto out; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-124-arm64-dts-qcom-pmk8350-Use-the-correct-PON-comp.patch b/patches.kernel.org/6.2.3-124-arm64-dts-qcom-pmk8350-Use-the-correct-PON-comp.patch new file mode 100644 index 0000000..47f25de --- /dev/null +++ b/patches.kernel.org/6.2.3-124-arm64-dts-qcom-pmk8350-Use-the-correct-PON-comp.patch @@ -0,0 +1,38 @@ +From: Konrad Dybcio +Date: Mon, 13 Feb 2023 22:29:30 +0100 +Subject: [PATCH] arm64: dts: qcom: pmk8350: Use the correct PON compatible +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c0ee8e0ba5cc17623e63349a168b41e407b1eef0 + +[ Upstream commit c0ee8e0ba5cc17623e63349a168b41e407b1eef0 ] + +A special compatible was introduced for PMK8350 both in the driver and +the bindings to facilitate for 2 base registers (PBS & HLOS). Use it. + +Fixes: b2de43136058 ("arm64: dts: qcom: pmk8350: Add peripherals for pmk8350") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230213212930.2115182-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/pmk8350.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pmk8350.dtsi b/arch/arm64/boot/dts/qcom/pmk8350.dtsi +index 32f5e6af..f26fb7d3 100644 +--- a/arch/arm64/boot/dts/qcom/pmk8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/pmk8350.dtsi +@@ -21,7 +21,7 @@ pmk8350: pmic@PMK8350_SID { + #size-cells = <0>; + + pmk8350_pon: pon@1300 { +- compatible = "qcom,pm8998-pon"; ++ compatible = "qcom,pmk8350-pon"; + reg = <0x1300>, <0x800>; + reg-names = "hlos", "pbs"; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-125-erofs-relinquish-volume-with-mutex-held.patch b/patches.kernel.org/6.2.3-125-erofs-relinquish-volume-with-mutex-held.patch new file mode 100644 index 0000000..cb34548 --- /dev/null +++ b/patches.kernel.org/6.2.3-125-erofs-relinquish-volume-with-mutex-held.patch @@ -0,0 +1,41 @@ +From: Jingbo Xu +Date: Thu, 9 Feb 2023 14:39:12 +0800 +Subject: [PATCH] erofs: relinquish volume with mutex held +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7032809a44d752b9e2275833787e0aa88a7540af + +[ Upstream commit 7032809a44d752b9e2275833787e0aa88a7540af ] + +Relinquish fscache volume with mutex held. Otherwise if a new domain is +registered when the old domain with the same name gets removed from the +list but not relinquished yet, fscache may complain the collision. + +Fixes: 8b7adf1dff3d ("erofs: introduce fscache-based domain") +Signed-off-by: Jingbo Xu +Reviewed-by: Jia Zhu +Link: https://lore.kernel.org/r/20230209063913.46341-4-jefflexu@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/erofs/fscache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c +index 014e2096..a7923d66 100644 +--- a/fs/erofs/fscache.c ++++ b/fs/erofs/fscache.c +@@ -337,8 +337,8 @@ static void erofs_fscache_domain_put(struct erofs_domain *domain) + kern_unmount(erofs_pseudo_mnt); + erofs_pseudo_mnt = NULL; + } +- mutex_unlock(&erofs_domain_list_lock); + fscache_relinquish_volume(domain->volume, NULL, false); ++ mutex_unlock(&erofs_domain_list_lock); + kfree(domain->domain_id); + kfree(domain); + return; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-126-block-sync-mixed-merged-request-s-failfast-with.patch b/patches.kernel.org/6.2.3-126-block-sync-mixed-merged-request-s-failfast-with.patch new file mode 100644 index 0000000..b97be8e --- /dev/null +++ b/patches.kernel.org/6.2.3-126-block-sync-mixed-merged-request-s-failfast-with.patch @@ -0,0 +1,124 @@ +From: Ming Lei +Date: Thu, 9 Feb 2023 20:55:27 +0800 +Subject: [PATCH] block: sync mixed merged request's failfast with 1st bio's +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3ce6a115980c019928fcd06e01f64003886af79c + +[ Upstream commit 3ce6a115980c019928fcd06e01f64003886af79c ] + +We support mixed merge for requests/bios with different fastfail +settings. When request fails, each time we only handle the portion +with same failfast setting, then bios with failfast can be failed +immediately, and bios without failfast can be retried. + +The idea is pretty good, but the current implementation has several +defects: + +1) initially RA bio doesn't set failfast, however bio merge code +doesn't consider this point, and just check its failfast setting for +deciding if mixed merge is required. Fix this issue by adding helper +of bio_failfast(). + +2) when merging bio to request front, if this request is mixed +merged, we have to sync request's faifast setting with 1st bio's +failfast. Fix it by calling blk_update_mixed_merge(). + +3) when merging bio to request back, if this request is mixed +merged, we have to mark the bio as failfast, because blk_update_request +simply updates request failfast with 1st bio's failfast. Fix +it by calling blk_update_mixed_merge(). + +Fixes one normal EXT4 READ IO failure issue, because it is observed +that the normal READ IO is merged with RA IO, and the mixed merged +request has different failfast setting with 1st bio's, so finally +the normal READ IO doesn't get retried. + +Cc: Tejun Heo +Fixes: 80a761fd33cf ("block: implement mixed merge of different failfast requests") +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20230209125527.667004-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-merge.c | 35 +++++++++++++++++++++++++++++++++-- + 1 file changed, 33 insertions(+), 2 deletions(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index b7c193d6..30e4a99c 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -757,6 +757,33 @@ void blk_rq_set_mixed_merge(struct request *rq) + rq->rq_flags |= RQF_MIXED_MERGE; + } + ++static inline unsigned int bio_failfast(const struct bio *bio) ++{ ++ if (bio->bi_opf & REQ_RAHEAD) ++ return REQ_FAILFAST_MASK; ++ ++ return bio->bi_opf & REQ_FAILFAST_MASK; ++} ++ ++/* ++ * After we are marked as MIXED_MERGE, any new RA bio has to be updated ++ * as failfast, and request's failfast has to be updated in case of ++ * front merge. ++ */ ++static inline void blk_update_mixed_merge(struct request *req, ++ struct bio *bio, bool front_merge) ++{ ++ if (req->rq_flags & RQF_MIXED_MERGE) { ++ if (bio->bi_opf & REQ_RAHEAD) ++ bio->bi_opf |= REQ_FAILFAST_MASK; ++ ++ if (front_merge) { ++ req->cmd_flags &= ~REQ_FAILFAST_MASK; ++ req->cmd_flags |= bio->bi_opf & REQ_FAILFAST_MASK; ++ } ++ } ++} ++ + static void blk_account_io_merge_request(struct request *req) + { + if (blk_do_io_stat(req)) { +@@ -954,7 +981,7 @@ enum bio_merge_status { + static enum bio_merge_status bio_attempt_back_merge(struct request *req, + struct bio *bio, unsigned int nr_segs) + { +- const blk_opf_t ff = bio->bi_opf & REQ_FAILFAST_MASK; ++ const blk_opf_t ff = bio_failfast(bio); + + if (!ll_back_merge_fn(req, bio, nr_segs)) + return BIO_MERGE_FAILED; +@@ -965,6 +992,8 @@ static enum bio_merge_status bio_attempt_back_merge(struct request *req, + if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff) + blk_rq_set_mixed_merge(req); + ++ blk_update_mixed_merge(req, bio, false); ++ + req->biotail->bi_next = bio; + req->biotail = bio; + req->__data_len += bio->bi_iter.bi_size; +@@ -978,7 +1007,7 @@ static enum bio_merge_status bio_attempt_back_merge(struct request *req, + static enum bio_merge_status bio_attempt_front_merge(struct request *req, + struct bio *bio, unsigned int nr_segs) + { +- const blk_opf_t ff = bio->bi_opf & REQ_FAILFAST_MASK; ++ const blk_opf_t ff = bio_failfast(bio); + + if (!ll_front_merge_fn(req, bio, nr_segs)) + return BIO_MERGE_FAILED; +@@ -989,6 +1018,8 @@ static enum bio_merge_status bio_attempt_front_merge(struct request *req, + if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff) + blk_rq_set_mixed_merge(req); + ++ blk_update_mixed_merge(req, bio, true); ++ + bio->bi_next = req->bio; + req->bio = bio; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-127-block-Fix-io-statistics-for-cgroup-in-throttle-.patch b/patches.kernel.org/6.2.3-127-block-Fix-io-statistics-for-cgroup-in-throttle-.patch new file mode 100644 index 0000000..20c756c --- /dev/null +++ b/patches.kernel.org/6.2.3-127-block-Fix-io-statistics-for-cgroup-in-throttle-.patch @@ -0,0 +1,70 @@ +From: Jinke Han +Date: Thu, 16 Feb 2023 11:22:50 +0800 +Subject: [PATCH] block: Fix io statistics for cgroup in throttle path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0f7c8f0f7934c389b0f9fa1f151e753d8de6348f + +[ Upstream commit 0f7c8f0f7934c389b0f9fa1f151e753d8de6348f ] + +In the current code, io statistics are missing for cgroup when bio +was throttled by blk-throttle. Fix it by moving the unreaching code +to submit_bio_noacct_nocheck. + +Fixes: 3f98c753717c ("block: don't check bio in blk_throtl_dispatch_work_fn") +Signed-off-by: Jinke Han +Reviewed-by: Ming Lei +Acked-by: Muchun Song +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20230216032250.74230-1-hanjinke.666@bytedance.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-core.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index b5098355..0a55844d 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -684,6 +684,18 @@ static void __submit_bio_noacct_mq(struct bio *bio) + + void submit_bio_noacct_nocheck(struct bio *bio) + { ++ blk_cgroup_bio_start(bio); ++ blkcg_bio_issue_init(bio); ++ ++ if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) { ++ trace_block_bio_queue(bio); ++ /* ++ * Now that enqueuing has been traced, we need to trace ++ * completion as well. ++ */ ++ bio_set_flag(bio, BIO_TRACE_COMPLETION); ++ } ++ + /* + * We only want one ->submit_bio to be active at a time, else stack + * usage with stacked devices could be a problem. Use current->bio_list +@@ -788,17 +800,6 @@ void submit_bio_noacct(struct bio *bio) + + if (blk_throtl_bio(bio)) + return; +- +- blk_cgroup_bio_start(bio); +- blkcg_bio_issue_init(bio); +- +- if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) { +- trace_block_bio_queue(bio); +- /* Now that enqueuing has been traced, we need to trace +- * completion as well. +- */ +- bio_set_flag(bio, BIO_TRACE_COMPLETION); +- } + submit_bio_noacct_nocheck(bio); + return; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-128-block-bio-integrity-Copy-flags-when-bio_integri.patch b/patches.kernel.org/6.2.3-128-block-bio-integrity-Copy-flags-when-bio_integri.patch new file mode 100644 index 0000000..f9db93a --- /dev/null +++ b/patches.kernel.org/6.2.3-128-block-bio-integrity-Copy-flags-when-bio_integri.patch @@ -0,0 +1,46 @@ +From: "Martin K. Petersen" +Date: Wed, 15 Feb 2023 12:18:01 -0500 +Subject: [PATCH] block: bio-integrity: Copy flags when bio_integrity_payload + is cloned +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 + +[ Upstream commit b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 ] + +Make sure to copy the flags when a bio_integrity_payload is cloned. +Otherwise per-I/O properties such as IP checksum flag will not be +passed down to the HBA driver. Since the integrity buffer is owned by +the original bio, the BIP_BLOCK_INTEGRITY flag needs to be masked off +to avoid a double free in the completion path. + +Fixes: aae7df50190a ("block: Integrity checksum flag") +Fixes: b1f01388574c ("block: Relocate bio integrity flags") +Reported-by: Saurav Kashyap +Tested-by: Saurav Kashyap +Signed-off-by: Martin K. Petersen +Reviewed-by: Christoph Hellwig +Reviewed-by: Chaitanya Kulkarni +Link: https://lore.kernel.org/r/20230215171801.21062-1-martin.petersen@oracle.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/bio-integrity.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index 3f5685c0..91ffee6f 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -418,6 +418,7 @@ int bio_integrity_clone(struct bio *bio, struct bio *bio_src, + + bip->bip_vcnt = bip_src->bip_vcnt; + bip->bip_iter = bip_src->bip_iter; ++ bip->bip_flags = bip_src->bip_flags & ~BIP_BLOCK_INTEGRITY; + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-129-block-use-proper-return-value-from-bio_failfast.patch b/patches.kernel.org/6.2.3-129-block-use-proper-return-value-from-bio_failfast.patch new file mode 100644 index 0000000..2860d3a --- /dev/null +++ b/patches.kernel.org/6.2.3-129-block-use-proper-return-value-from-bio_failfast.patch @@ -0,0 +1,46 @@ +From: Jens Axboe +Date: Thu, 16 Feb 2023 19:39:15 -0700 +Subject: [PATCH] block: use proper return value from bio_failfast() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f3ca73862453ac1e64fc6968a14bf66d839cd2d8 + +[ Upstream commit f3ca73862453ac1e64fc6968a14bf66d839cd2d8 ] + +kernel test robot complains about a type mismatch: + + block/blk-merge.c:984:42: sparse: expected restricted blk_opf_t const [usertype] ff + block/blk-merge.c:984:42: sparse: got unsigned int + block/blk-merge.c:1010:42: sparse: sparse: incorrect type in initializer (different base types) @@ expected restricted blk_opf_t const [usertype] ff @@ got unsigned int @@ + block/blk-merge.c:1010:42: sparse: expected restricted blk_opf_t const [usertype] ff + block/blk-merge.c:1010:42: sparse: got unsigned int + +because bio_failfast() is return an unsigned int rather than the +appropriate blk_opt_f type. Fix it up. + +Fixes: 3ce6a115980c ("block: sync mixed merged request's failfast with 1st bio's") +Reported-by: kernel test robot +Link: https://lore.kernel.org/oe-kbuild-all/202302170743.GXypM9Rt-lkp@intel.com/ +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-merge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 30e4a99c..808b5812 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -757,7 +757,7 @@ void blk_rq_set_mixed_merge(struct request *rq) + rq->rq_flags |= RQF_MIXED_MERGE; + } + +-static inline unsigned int bio_failfast(const struct bio *bio) ++static inline blk_opf_t bio_failfast(const struct bio *bio) + { + if (bio->bi_opf & REQ_RAHEAD) + return REQ_FAILFAST_MASK; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-130-wifi-mt76-mt7915-add-missing-of_node_put.patch b/patches.kernel.org/6.2.3-130-wifi-mt76-mt7915-add-missing-of_node_put.patch new file mode 100644 index 0000000..63405d5 --- /dev/null +++ b/patches.kernel.org/6.2.3-130-wifi-mt76-mt7915-add-missing-of_node_put.patch @@ -0,0 +1,35 @@ +From: Wang Yufen +Date: Fri, 25 Nov 2022 17:06:07 +0800 +Subject: [PATCH] wifi: mt76: mt7915: add missing of_node_put() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 18425d7d74c5be88b13b970a21e52e2498abf4ba + +[ Upstream commit 18425d7d74c5be88b13b970a21e52e2498abf4ba ] + +Add missing of_node_put() after of_reserved_mem_lookup() + +Fixes: 99ad32a4ca3a ("mt76: mt7915: add support for MT7986") +Signed-off-by: Wang Yufen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c +index c06c56a0..686c9bbd 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c +@@ -278,6 +278,7 @@ static int mt7986_wmac_coninfra_setup(struct mt7915_dev *dev) + return -EINVAL; + + rmem = of_reserved_mem_lookup(np); ++ of_node_put(np); + if (!rmem) + return -EINVAL; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-131-wifi-mt76-mt7921s-fix-slab-out-of-bounds-access.patch b/patches.kernel.org/6.2.3-131-wifi-mt76-mt7921s-fix-slab-out-of-bounds-access.patch new file mode 100644 index 0000000..56d02cd --- /dev/null +++ b/patches.kernel.org/6.2.3-131-wifi-mt76-mt7921s-fix-slab-out-of-bounds-access.patch @@ -0,0 +1,99 @@ +From: Deren Wu +Date: Thu, 1 Dec 2022 23:53:37 +0800 +Subject: [PATCH] wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio + host +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aec4cf2ea0797e28f18f8dbe01943a56d987fe56 + +[ Upstream commit aec4cf2ea0797e28f18f8dbe01943a56d987fe56 ] + +SDIO may need addtional 511 bytes to align bus operation. If the tailroom +of this skb is not big enough, we would access invalid memory region. +For low level operation, increase skb size to keep valid memory access in +SDIO host. + +Error message: +[69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0 +[69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451 +[69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1 +[69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300] +[69.951] Call Trace: +[69.951] +[69.952] dump_stack_lvl+0x49/0x63 +[69.952] print_report+0x171/0x4a8 +[69.952] kasan_report+0xb4/0x130 +[69.952] kasan_check_range+0x149/0x1e0 +[69.952] memcpy+0x24/0x70 +[69.952] sg_copy_buffer+0xe9/0x1a0 +[69.952] sg_copy_to_buffer+0x12/0x20 +[69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300] +[69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300] +[69.952] process_one_work+0x7ee/0x1320 +[69.952] worker_thread+0x53c/0x1240 +[69.952] kthread+0x2b8/0x370 +[69.952] ret_from_fork+0x1f/0x30 +[69.952] + +[69.952] Allocated by task 854: +[69.952] kasan_save_stack+0x26/0x50 +[69.952] kasan_set_track+0x25/0x30 +[69.952] kasan_save_alloc_info+0x1b/0x30 +[69.952] __kasan_kmalloc+0x87/0xa0 +[69.952] __kmalloc_node_track_caller+0x63/0x150 +[69.952] kmalloc_reserve+0x31/0xd0 +[69.952] __alloc_skb+0xfc/0x2b0 +[69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76] +[69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76] +[69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76] +[69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib] +[69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib] +[69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common] +[69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s] +[69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common] +[69.953] process_one_work+0x7ee/0x1320 +[69.953] worker_thread+0x53c/0x1240 +[69.953] kthread+0x2b8/0x370 +[69.953] ret_from_fork+0x1f/0x30 +[69.953] The buggy address belongs to the object at ffff88811c9ce800 + which belongs to the cache kmalloc-2k of size 2048 +[69.953] The buggy address is located 0 bytes to the right of + 2048-byte region [ffff88811c9ce800, ffff88811c9cf000) + +[69.953] Memory state around the buggy address: +[69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[69.953] ^ +[69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + +Fixes: 764dee47e2c1 ("mt76: sdio: move common code in mt76_sdio module") +Suggested-by: Lorenzo Bianconi +Tested-by: YN Chen +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/sdio_txrx.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/sdio_txrx.c +index bfc4de50..ddd8c0cc 100644 +--- a/drivers/net/wireless/mediatek/mt76/sdio_txrx.c ++++ b/drivers/net/wireless/mediatek/mt76/sdio_txrx.c +@@ -254,6 +254,10 @@ static int mt76s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q) + + if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->phy.state)) { + __skb_put_zero(e->skb, 4); ++ err = __skb_grow(e->skb, roundup(e->skb->len, ++ sdio->func->cur_blksize)); ++ if (err) ++ return err; + err = __mt76s_xmit_queue(dev, e->skb->data, + e->skb->len); + if (err) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-132-wifi-mt76-mt7915-fix-mt7915_rate_txpower_get-re.patch b/patches.kernel.org/6.2.3-132-wifi-mt76-mt7915-fix-mt7915_rate_txpower_get-re.patch new file mode 100644 index 0000000..4ec133a --- /dev/null +++ b/patches.kernel.org/6.2.3-132-wifi-mt76-mt7915-fix-mt7915_rate_txpower_get-re.patch @@ -0,0 +1,48 @@ +From: Ryder Lee +Date: Sat, 3 Dec 2022 11:22:22 +0800 +Subject: [PATCH] wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource + leaks +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8b25301af01566f4b5a301fc1ad7c5d2b1788d7f + +[ Upstream commit 8b25301af01566f4b5a301fc1ad7c5d2b1788d7f ] + +Coverity message: variable "buf" going out of scope leaks the storage. + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1527799 ("Resource leaks") +Fixes: e3296759f347 ("wifi: mt76: mt7915: enable per bandwidth power limit support") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +index fb46c2c1..a7fdcd1f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +@@ -996,7 +996,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf, + + ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr)); + if (ret) +- return ret; ++ goto out; + + /* Txpower propagation path: TMAC -> TXV -> BBP */ + len += scnprintf(buf + len, sz - len, +@@ -1047,6 +1047,8 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf, + mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER)); + + ret = simple_read_from_buffer(user_buf, count, ppos, buf, len); ++ ++out: + kfree(buf); + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-133-wifi-mt76-mt7996-fix-insecure-data-handling-of-.patch b/patches.kernel.org/6.2.3-133-wifi-mt76-mt7996-fix-insecure-data-handling-of-.patch new file mode 100644 index 0000000..ed6e2b6 --- /dev/null +++ b/patches.kernel.org/6.2.3-133-wifi-mt76-mt7996-fix-insecure-data-handling-of-.patch @@ -0,0 +1,41 @@ +From: Ryder Lee +Date: Sat, 3 Dec 2022 11:22:23 +0800 +Subject: [PATCH] wifi: mt76: mt7996: fix insecure data handling of + mt7996_mcu_ie_countdown() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5202b983f9894d31110e49c4ec6b57955b5eaa1a + +[ Upstream commit 5202b983f9894d31110e49c4ec6b57955b5eaa1a ] + +Coverity message: +using tainted "hdr->band" variable as an index into an array "(*dev).mt76.phys". + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1527797 ("Insecure data handling") +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index 04e1d10b..a90b7ca2 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -412,6 +412,9 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb) + struct header *hdr = (struct header *)data; + struct tlv *tlv = (struct tlv *)(data + 4); + ++ if (hdr->band >= ARRAY_SIZE(dev->mt76.phys)) ++ return; ++ + if (hdr->band && dev->mt76.phys[hdr->band]) + mphy = dev->mt76.phys[hdr->band]; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-134-wifi-mt76-mt7996-fix-insecure-data-handling-of-.patch b/patches.kernel.org/6.2.3-134-wifi-mt76-mt7996-fix-insecure-data-handling-of-.patch new file mode 100644 index 0000000..2b6fa8f --- /dev/null +++ b/patches.kernel.org/6.2.3-134-wifi-mt76-mt7996-fix-insecure-data-handling-of-.patch @@ -0,0 +1,41 @@ +From: Ryder Lee +Date: Sat, 3 Dec 2022 11:22:24 +0800 +Subject: [PATCH] wifi: mt76: mt7996: fix insecure data handling of + mt7996_mcu_rx_radar_detected() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f37c6e5c75029443bc72c45acf92b2f2de2945be + +[ Upstream commit f37c6e5c75029443bc72c45acf92b2f2de2945be ] + +Coverity message: +using tainted "r->band_idx" variable as an index into an array "(*dev).mt76.phys". + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1527812 ("Insecure data handling") +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index a90b7ca2..efb245c8 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -335,6 +335,9 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb) + + r = (struct mt7996_mcu_rdd_report *)skb->data; + ++ if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys)) ++ return; ++ + mphy = dev->mt76.phys[r->band_idx]; + if (!mphy) + return; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-135-wifi-mt76-mt7996-fix-integer-handling-issue-of-.patch b/patches.kernel.org/6.2.3-135-wifi-mt76-mt7996-fix-integer-handling-issue-of-.patch new file mode 100644 index 0000000..9d90dae --- /dev/null +++ b/patches.kernel.org/6.2.3-135-wifi-mt76-mt7996-fix-integer-handling-issue-of-.patch @@ -0,0 +1,42 @@ +From: Ryder Lee +Date: Sat, 3 Dec 2022 11:22:25 +0800 +Subject: [PATCH] wifi: mt76: mt7996: fix integer handling issue of + mt7996_rf_regval_set() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aab169ad3a7aa8678aed90d7fdbc243e3d4b32a6 + +[ Upstream commit aab169ad3a7aa8678aed90d7fdbc243e3d4b32a6 ] + +This code is supposed to set a u32 value, but casting will not work on +big endian systems. + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1527816 ("Integer handling issues") +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c +index 2e4a8909..99b23aef 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c +@@ -653,8 +653,9 @@ static int + mt7996_rf_regval_set(void *data, u64 val) + { + struct mt7996_dev *dev = data; ++ u32 val32 = val; + +- return mt7996_mcu_rf_regval(dev, dev->mt76.debugfs_reg, (u32 *)&val, true); ++ return mt7996_mcu_rf_regval(dev, dev->mt76.debugfs_reg, &val32, true); + } + + DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7996_rf_regval_get, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-136-wifi-mt76-mt7915-check-return-value-before-acce.patch b/patches.kernel.org/6.2.3-136-wifi-mt76-mt7915-check-return-value-before-acce.patch new file mode 100644 index 0000000..9d40a67 --- /dev/null +++ b/patches.kernel.org/6.2.3-136-wifi-mt76-mt7915-check-return-value-before-acce.patch @@ -0,0 +1,89 @@ +From: Ryder Lee +Date: Sun, 4 Dec 2022 05:33:17 +0800 +Subject: [PATCH] wifi: mt76: mt7915: check return value before accessing + free_block_num +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 59b27a7d472f100ac8998e15a63c47a03cced12a + +[ Upstream commit 59b27a7d472f100ac8998e15a63c47a03cced12a ] + +Check return value of mt7915_mcu_get_eeprom_free_block() first before +accessing free_block_num. + +Fixes: bbc1d4154ec1 ("mt76: mt7915: add default calibrated data support") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../wireless/mediatek/mt76/mt7915/eeprom.c | 19 ++++++++++++------- + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 10 ++++++---- + 2 files changed, 18 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c +index 59069fb8..24efa280 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c +@@ -110,18 +110,23 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev) + } else { + u8 free_block_num; + u32 block_num, i; ++ u32 eeprom_blk_size = MT7915_EEPROM_BLOCK_SIZE; + +- mt7915_mcu_get_eeprom_free_block(dev, &free_block_num); +- /* efuse info not enough */ ++ ret = mt7915_mcu_get_eeprom_free_block(dev, &free_block_num); ++ if (ret < 0) ++ return ret; ++ ++ /* efuse info isn't enough */ + if (free_block_num >= 29) + return -EINVAL; + + /* read eeprom data from efuse */ +- block_num = DIV_ROUND_UP(eeprom_size, +- MT7915_EEPROM_BLOCK_SIZE); +- for (i = 0; i < block_num; i++) +- mt7915_mcu_get_eeprom(dev, +- i * MT7915_EEPROM_BLOCK_SIZE); ++ block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size); ++ for (i = 0; i < block_num; i++) { ++ ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size); ++ if (ret < 0) ++ return ret; ++ } + } + + return mt7915_check_eeprom(dev); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index b2652de0..d9d6846b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -2792,8 +2792,9 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset) + int ret; + u8 *buf; + +- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req, +- sizeof(req), true, &skb); ++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, ++ MCU_EXT_QUERY(EFUSE_ACCESS), ++ &req, sizeof(req), true, &skb); + if (ret) + return ret; + +@@ -2818,8 +2819,9 @@ int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num) + struct sk_buff *skb; + int ret; + +- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req, +- sizeof(req), true, &skb); ++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, ++ MCU_EXT_QUERY(EFUSE_FREE_BLOCK), ++ &req, sizeof(req), true, &skb); + if (ret) + return ret; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-137-wifi-mt76-mt7996-check-return-value-before-acce.patch b/patches.kernel.org/6.2.3-137-wifi-mt76-mt7996-check-return-value-before-acce.patch new file mode 100644 index 0000000..19e97d6 --- /dev/null +++ b/patches.kernel.org/6.2.3-137-wifi-mt76-mt7996-check-return-value-before-acce.patch @@ -0,0 +1,76 @@ +From: Ryder Lee +Date: Sun, 4 Dec 2022 05:33:18 +0800 +Subject: [PATCH] wifi: mt76: mt7996: check return value before accessing + free_block_num +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 783ef7da7a53c7ab98471f47fbabab6cf6f45c8f + +[ Upstream commit 783ef7da7a53c7ab98471f47fbabab6cf6f45c8f ] + +Check return value of mt7996_mcu_get_eeprom_free_block() first before +accessing free_block_num. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/wireless/mediatek/mt76/mt7996/eeprom.c | 18 ++++++++++++------ + .../net/wireless/mediatek/mt76/mt7996/mcu.c | 5 +++-- + 2 files changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c +index b9f62bedb..5d8e0353 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c +@@ -65,17 +65,23 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev) + } else { + u8 free_block_num; + u32 block_num, i; ++ u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE; + +- /* TODO: check free block event */ +- mt7996_mcu_get_eeprom_free_block(dev, &free_block_num); +- /* efuse info not enough */ ++ ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num); ++ if (ret < 0) ++ return ret; ++ ++ /* efuse info isn't enough */ + if (free_block_num >= 59) + return -EINVAL; + + /* read eeprom data from efuse */ +- block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, MT7996_EEPROM_BLOCK_SIZE); +- for (i = 0; i < block_num; i++) +- mt7996_mcu_get_eeprom(dev, i * MT7996_EEPROM_BLOCK_SIZE); ++ block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size); ++ for (i = 0; i < block_num; i++) { ++ ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size); ++ if (ret < 0) ++ return ret; ++ } + } + + return mt7996_check_eeprom(dev); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index efb245c8..da72684e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -2927,8 +2927,9 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset) + bool valid; + int ret; + +- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL), &req, +- sizeof(req), true, &skb); ++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, ++ MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL), ++ &req, sizeof(req), true, &skb); + if (ret) + return ret; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-138-wifi-mt76-mt7915-drop-always-true-condition-of-.patch b/patches.kernel.org/6.2.3-138-wifi-mt76-mt7915-drop-always-true-condition-of-.patch new file mode 100644 index 0000000..bfa9b15 --- /dev/null +++ b/patches.kernel.org/6.2.3-138-wifi-mt76-mt7915-drop-always-true-condition-of-.patch @@ -0,0 +1,53 @@ +From: Ryder Lee +Date: Sun, 4 Dec 2022 15:18:14 +0800 +Subject: [PATCH] wifi: mt76: mt7915: drop always true condition of + __mt7915_reg_addr() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b0f7b9563358493dfe70d3e4c3ebeffc92d4b494 + +[ Upstream commit b0f7b9563358493dfe70d3e4c3ebeffc92d4b494 ] + +smatch warnings: +addr <= MT_CBTOP2_PHY_END(0xffffffff) is always true (<= u32max), +so drop it. + +Fixes: cd4c314a65d3 ("mt76: mt7915: refine register definition") +Reported-by: kernel test robot +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 2 +- + drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 1 - + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +index 8388e2a6..afa558c9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +@@ -495,7 +495,7 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr) + + if (dev_is_pci(dev->mt76.dev) && + ((addr >= MT_CBTOP1_PHY_START && addr <= MT_CBTOP1_PHY_END) || +- (addr >= MT_CBTOP2_PHY_START && addr <= MT_CBTOP2_PHY_END))) ++ addr >= MT_CBTOP2_PHY_START)) + return mt7915_reg_map_l1(dev, addr); + + /* CONN_INFRA: covert to phyiscal addr and use layer 1 remap */ +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h +index aca1b2f1..7e0d8636 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h +@@ -803,7 +803,6 @@ enum offs_rev { + #define MT_CBTOP1_PHY_START 0x70000000 + #define MT_CBTOP1_PHY_END __REG(CBTOP1_PHY_END) + #define MT_CBTOP2_PHY_START 0xf0000000 +-#define MT_CBTOP2_PHY_END 0xffffffff + #define MT_INFRA_MCU_START 0x7c000000 + #define MT_INFRA_MCU_END __REG(INFRA_MCU_ADDR_END) + #define MT_CONN_INFRA_OFFSET(p) ((p) - MT_INFRA_BASE) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-139-wifi-mt76-mt7996-drop-always-true-condition-of-.patch b/patches.kernel.org/6.2.3-139-wifi-mt76-mt7996-drop-always-true-condition-of-.patch new file mode 100644 index 0000000..b764533 --- /dev/null +++ b/patches.kernel.org/6.2.3-139-wifi-mt76-mt7996-drop-always-true-condition-of-.patch @@ -0,0 +1,51 @@ +From: Ryder Lee +Date: Sun, 4 Dec 2022 15:18:15 +0800 +Subject: [PATCH] wifi: mt76: mt7996: drop always true condition of + __mt7996_reg_addr() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ef1ea24cb0ecfd42c1ff266d92613163792aec77 + +[ Upstream commit ef1ea24cb0ecfd42c1ff266d92613163792aec77 ] + +addr <= MT_CBTOP2_PHY_END(0xffffffff) is always true (<= u32max), +so drop it. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 2 +- + drivers/net/wireless/mediatek/mt76/mt7996/regs.h | 1 - + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +index 521769eb..60781d04 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +@@ -149,7 +149,7 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr) + + if (dev_is_pci(dev->mt76.dev) && + ((addr >= MT_CBTOP1_PHY_START && addr <= MT_CBTOP1_PHY_END) || +- (addr >= MT_CBTOP2_PHY_START && addr <= MT_CBTOP2_PHY_END))) ++ addr >= MT_CBTOP2_PHY_START)) + return mt7996_reg_map_l1(dev, addr); + + /* CONN_INFRA: covert to phyiscal addr and use layer 1 remap */ +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h +index 794f61b9..42980b97 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h +@@ -463,7 +463,6 @@ enum base_rev { + #define MT_CBTOP1_PHY_START 0x70000000 + #define MT_CBTOP1_PHY_END 0x77ffffff + #define MT_CBTOP2_PHY_START 0xf0000000 +-#define MT_CBTOP2_PHY_END 0xffffffff + #define MT_INFRA_MCU_START 0x7c000000 + #define MT_INFRA_MCU_END 0x7c3fffff + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-140-wifi-mt76-mt7996-fix-endianness-warning-in-mt79.patch b/patches.kernel.org/6.2.3-140-wifi-mt76-mt7996-fix-endianness-warning-in-mt79.patch new file mode 100644 index 0000000..12c952d --- /dev/null +++ b/patches.kernel.org/6.2.3-140-wifi-mt76-mt7996-fix-endianness-warning-in-mt79.patch @@ -0,0 +1,46 @@ +From: Lorenzo Bianconi +Date: Sun, 4 Dec 2022 23:01:37 +0100 +Subject: [PATCH] wifi: mt76: mt7996: fix endianness warning in + mt7996_mcu_sta_he_tlv +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 54ccb836ffb28eacba51b674cbe94cb5613f8441 + +[ Upstream commit 54ccb836ffb28eacba51b674cbe94cb5613f8441 ] + +Fix the following sparse warnings in mt7996_mcu_sta_he_tlv routine: + +warning: incorrect type in assignment (different base types) + expected unsigned char + got restricted __le16 [usertype] +warning: incorrect type in assignment (different base types) + expected unsigned char + got restricted __le16 [usertype] + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index da72684e..a88fc768 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -909,8 +909,8 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta) + he = (struct sta_rec_he_v2 *)tlv; + for (i = 0; i < 11; i++) { + if (i < 6) +- he->he_mac_cap[i] = cpu_to_le16(elem->mac_cap_info[i]); +- he->he_phy_cap[i] = cpu_to_le16(elem->phy_cap_info[i]); ++ he->he_mac_cap[i] = elem->mac_cap_info[i]; ++ he->he_phy_cap[i] = elem->phy_cap_info[i]; + } + + mcs_map = sta->deflink.he_cap.he_mcs_nss_supp; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-141-wifi-mt76-mt76x0-fix-oob-access-in-mt76x0_phy_g.patch b/patches.kernel.org/6.2.3-141-wifi-mt76-mt76x0-fix-oob-access-in-mt76x0_phy_g.patch new file mode 100644 index 0000000..4f87fb7 --- /dev/null +++ b/patches.kernel.org/6.2.3-141-wifi-mt76-mt76x0-fix-oob-access-in-mt76x0_phy_g.patch @@ -0,0 +1,45 @@ +From: Lorenzo Bianconi +Date: Mon, 5 Dec 2022 17:59:04 +0100 +Subject: [PATCH] wifi: mt76: mt76x0: fix oob access in + mt76x0_phy_get_target_power +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6e1abc51c945663bddebfa1beb9590ff5b250eb7 + +[ Upstream commit 6e1abc51c945663bddebfa1beb9590ff5b250eb7 ] + +After 'commit ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct +mt76x02_rate_power")', mt76x02 relies on ht[0-7] rate_power data for +vht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}. +Fix a possible out-of-bound access in mt76x0_phy_get_target_power routine. + +Fixes: ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct mt76x02_rate_power") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt76x0/phy.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c +index 6c6c8ada..d543ef3d 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c +@@ -642,7 +642,12 @@ mt76x0_phy_get_target_power(struct mt76x02_dev *dev, u8 tx_mode, + if (tx_rate > 9) + return -EINVAL; + +- *target_power = cur_power + dev->rate_power.vht[tx_rate]; ++ *target_power = cur_power; ++ if (tx_rate > 7) ++ *target_power += dev->rate_power.vht[tx_rate - 8]; ++ else ++ *target_power += dev->rate_power.ht[tx_rate]; ++ + *target_pa_power = mt76x0_phy_get_rf_pa_mode(dev, 1, tx_rate); + break; + default: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-142-wifi-mt76-mt7996-fix-unintended-sign-extension-.patch b/patches.kernel.org/6.2.3-142-wifi-mt76-mt7996-fix-unintended-sign-extension-.patch new file mode 100644 index 0000000..28a41ce --- /dev/null +++ b/patches.kernel.org/6.2.3-142-wifi-mt76-mt7996-fix-unintended-sign-extension-.patch @@ -0,0 +1,41 @@ +From: Ryder Lee +Date: Wed, 7 Dec 2022 15:30:04 +0800 +Subject: [PATCH] wifi: mt76: mt7996: fix unintended sign extension of + mt7996_hw_queue_read() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 063cca0252b46970e7e9ca423d5e930be3179aa1 + +[ Upstream commit 063cca0252b46970e7e9ca423d5e930be3179aa1 ] + +In the expression "map[i].qid << 24" starts as u8, but is promoted to +"signed int", then sign-extended to type "unsigned long", which is not +intended. Cast to u32 to avoid the sign extension. + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1527813 ("Integer handling issues") +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c +index 99b23aef..3d4fbbbc 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c +@@ -457,7 +457,7 @@ mt7996_hw_queue_read(struct seq_file *s, u32 size, + if (val & BIT(map[i].index)) + continue; + +- ctrl = BIT(31) | (map[i].pid << 10) | (map[i].qid << 24); ++ ctrl = BIT(31) | (map[i].pid << 10) | ((u32)map[i].qid << 24); + mt76_wr(dev, MT_FL_Q0_CTRL, ctrl); + + head = mt76_get_field(dev, MT_FL_Q2_CTRL, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-143-wifi-mt76-mt7915-fix-unintended-sign-extension-.patch b/patches.kernel.org/6.2.3-143-wifi-mt76-mt7915-fix-unintended-sign-extension-.patch new file mode 100644 index 0000000..ec8ccc3 --- /dev/null +++ b/patches.kernel.org/6.2.3-143-wifi-mt76-mt7915-fix-unintended-sign-extension-.patch @@ -0,0 +1,39 @@ +From: Ryder Lee +Date: Wed, 7 Dec 2022 15:30:05 +0800 +Subject: [PATCH] wifi: mt76: mt7915: fix unintended sign extension of + mt7915_hw_queue_read() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: edb0406bda4629ef496f52eb11cbea7e92ed301b + +[ Upstream commit edb0406bda4629ef496f52eb11cbea7e92ed301b ] + +In the expression "map[i].qid << 24" starts as u8, but is promoted to +"signed int", then sign-extended to type "unsigned long", which is not +intended. Cast to u32 to avoid the sign extension. + +Fixes: 776ec4e77aa6 ("mt76: mt7915: rework debugfs queue info") +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +index a7fdcd1f..5a46813a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +@@ -811,7 +811,7 @@ mt7915_hw_queue_read(struct seq_file *s, u32 size, + if (val & BIT(map[i].index)) + continue; + +- ctrl = BIT(31) | (map[i].pid << 10) | (map[i].qid << 24); ++ ctrl = BIT(31) | (map[i].pid << 10) | ((u32)map[i].qid << 24); + mt76_wr(dev, MT_FL_Q0_CTRL, ctrl); + + head = mt76_get_field(dev, MT_FL_Q2_CTRL, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-144-wifi-mt76-fix-coverity-uninit_use_in_call-in-mt.patch b/patches.kernel.org/6.2.3-144-wifi-mt76-fix-coverity-uninit_use_in_call-in-mt.patch new file mode 100644 index 0000000..ed6c3bb --- /dev/null +++ b/patches.kernel.org/6.2.3-144-wifi-mt76-fix-coverity-uninit_use_in_call-in-mt.patch @@ -0,0 +1,46 @@ +From: Deren Wu +Date: Thu, 8 Dec 2022 00:03:10 +0800 +Subject: [PATCH] wifi: mt76: fix coverity uninit_use_in_call in + mt76_connac2_reverse_frag0_hdr_trans() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0ffcb2a68b15bd63d5555a923ae7dfe8bfdb14a7 + +[ Upstream commit 0ffcb2a68b15bd63d5555a923ae7dfe8bfdb14a7 ] + +The default case for frame_contorl is invalid. We should always +assign addr3 of this frame properly. + +Coverity error message: +if (ieee80211_has_a4(hdr.frame_control)) +(19) Event uninit_use_in_call: Using uninitialized value "hdr". +Field "hdr.addr3" is uninitialized when calling "memcpy". + memcpy(skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr)); +else + memcpy(skb_push(skb, sizeof(hdr) - 6), &hdr, sizeof(hdr) - 6); + +Fixes: 0880d40871d1 ("mt76: connac: move mt76_connac2_reverse_frag0_hdr_trans in mt76-connac module") +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +index fd60123f..c8d0c84e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +@@ -930,7 +930,7 @@ int mt76_connac2_reverse_frag0_hdr_trans(struct ieee80211_vif *vif, + ether_addr_copy(hdr.addr4, eth_hdr->h_source); + break; + default: +- break; ++ return -EINVAL; + } + + skb_pull(skb, hdr_offset + sizeof(struct ethhdr) - 2); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-145-wifi-mt76-mt7921-resource-leaks-at-mt7921_check.patch b/patches.kernel.org/6.2.3-145-wifi-mt76-mt7921-resource-leaks-at-mt7921_check.patch new file mode 100644 index 0000000..7e8e3fa --- /dev/null +++ b/patches.kernel.org/6.2.3-145-wifi-mt76-mt7921-resource-leaks-at-mt7921_check.patch @@ -0,0 +1,48 @@ +From: Sean Wang +Date: Fri, 9 Dec 2022 07:01:57 +0800 +Subject: [PATCH] wifi: mt76: mt7921: resource leaks at + mt7921_check_offload_capability() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 47180ecf4541146836c5307c1d5526f8ac6a5a6d + +[ Upstream commit 47180ecf4541146836c5307c1d5526f8ac6a5a6d ] + +Fixed coverity issue with resource leaks at variable "fw" going out of +scope leaks the storage it points to mt7921_check_offload_capability(). + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1527806 ("Resource leaks") +Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") +Signed-off-by: Sean Wang +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7921/init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c +index 542dfd42..d4b681d7 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c +@@ -175,7 +175,7 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm) + + if (!fw || !fw->data || fw->size < sizeof(*hdr)) { + dev_err(dev, "Invalid firmware\n"); +- return -EINVAL; ++ goto out; + } + + data = fw->data; +@@ -206,6 +206,7 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm) + data += le16_to_cpu(rel_info->len) + rel_info->pad_len; + } + ++out: + release_firmware(fw); + + return features ? features->data : 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-146-wifi-rsi-Fix-memory-leak-in-rsi_coex_attach.patch b/patches.kernel.org/6.2.3-146-wifi-rsi-Fix-memory-leak-in-rsi_coex_attach.patch new file mode 100644 index 0000000..ca7f9db --- /dev/null +++ b/patches.kernel.org/6.2.3-146-wifi-rsi-Fix-memory-leak-in-rsi_coex_attach.patch @@ -0,0 +1,38 @@ +From: Yuan Can +Date: Mon, 5 Dec 2022 06:14:41 +0000 +Subject: [PATCH] wifi: rsi: Fix memory leak in rsi_coex_attach() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f + +[ Upstream commit 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f ] + +The coex_cb needs to be freed when rsi_create_kthread() failed in +rsi_coex_attach(). + +Fixes: 2108df3c4b18 ("rsi: add coex support") +Signed-off-by: Yuan Can +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221205061441.114632-1-yuancan@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_coex.c b/drivers/net/wireless/rsi/rsi_91x_coex.c +index 8a3d8689..45ac9371 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_coex.c ++++ b/drivers/net/wireless/rsi/rsi_91x_coex.c +@@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common) + rsi_coex_scheduler_thread, + "Coex-Tx-Thread")) { + rsi_dbg(ERR_ZONE, "%s: Unable to init tx thrd\n", __func__); ++ kfree(coex_cb); + return -EINVAL; + } + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-147-wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-und.patch b/patches.kernel.org/6.2.3-147-wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-und.patch new file mode 100644 index 0000000..cc0a16c --- /dev/null +++ b/patches.kernel.org/6.2.3-147-wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-und.patch @@ -0,0 +1,59 @@ +From: Yang Yingliang +Date: Wed, 7 Dec 2022 22:14:09 +0800 +Subject: [PATCH] wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 106031c1f4a850915190d7ec1026696282f9359b + +[ Upstream commit 106031c1f4a850915190d7ec1026696282f9359b ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. All the SKBs have +been dequeued from the old queue, so it's safe to enqueue these +SKBs to a free queue, then free them after spin_unlock_irqrestore() +at once. Compile tested only. + +Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14") +Signed-off-by: Yang Yingliang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207141411.46098-2-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +index 7e0f62d5..a7e32509 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +@@ -26,8 +26,10 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; ++ struct sk_buff_head free_list; + unsigned long flags; + ++ skb_queue_head_init(&free_list); + spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); + while (skb_queue_len(&ring->queue)) { + struct rtl_tx_desc *entry = &ring->desc[ring->idx]; +@@ -37,10 +39,12 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw) + rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, + true, HW_DESC_TXBUFF_ADDR), + skb->len, DMA_TO_DEVICE); +- kfree_skb(skb); ++ __skb_queue_tail(&free_list, skb); + ring->idx = (ring->idx + 1) % ring->entries; + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); ++ ++ __skb_queue_purge(&free_list); + } + + static void _rtl8821ae_set_bcn_ctrl_reg(struct ieee80211_hw *hw, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-148-wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-und.patch b/patches.kernel.org/6.2.3-148-wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-und.patch new file mode 100644 index 0000000..0c9befc --- /dev/null +++ b/patches.kernel.org/6.2.3-148-wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-und.patch @@ -0,0 +1,59 @@ +From: Yang Yingliang +Date: Wed, 7 Dec 2022 22:14:10 +0800 +Subject: [PATCH] wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2611687fa7ffc84190f92292de0b80468de17220 + +[ Upstream commit 2611687fa7ffc84190f92292de0b80468de17220 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. All the SKBs have +been dequeued from the old queue, so it's safe to enqueue these +SKBs to a free queue, then free them after spin_unlock_irqrestore() +at once. Compile tested only. + +Fixes: 7fe3b3abb5da ("rtlwifi: rtl8188ee: rtl8821ae: Fix a queue locking problem") +Signed-off-by: Yang Yingliang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207141411.46098-3-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c +index 58c2ab3d44..de61c9c0 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c +@@ -68,8 +68,10 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; ++ struct sk_buff_head free_list; + unsigned long flags; + ++ skb_queue_head_init(&free_list); + spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); + while (skb_queue_len(&ring->queue)) { + struct rtl_tx_desc *entry = &ring->desc[ring->idx]; +@@ -79,10 +81,12 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw) + rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, + true, HW_DESC_TXBUFF_ADDR), + skb->len, DMA_TO_DEVICE); +- kfree_skb(skb); ++ __skb_queue_tail(&free_list, skb); + ring->idx = (ring->idx + 1) % ring->entries; + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); ++ ++ __skb_queue_purge(&free_list); + } + + static void _rtl88ee_disable_bcn_sub_func(struct ieee80211_hw *hw) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-149-wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-und.patch b/patches.kernel.org/6.2.3-149-wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-und.patch new file mode 100644 index 0000000..50b9202 --- /dev/null +++ b/patches.kernel.org/6.2.3-149-wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-und.patch @@ -0,0 +1,59 @@ +From: Yang Yingliang +Date: Wed, 7 Dec 2022 22:14:11 +0800 +Subject: [PATCH] wifi: rtlwifi: rtl8723be: don't call kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 313950c2114e7051c4e3020fd82495fa1fb526a8 + +[ Upstream commit 313950c2114e7051c4e3020fd82495fa1fb526a8 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. All the SKBs have +been dequeued from the old queue, so it's safe to enqueue these +SKBs to a free queue, then free them after spin_unlock_irqrestore() +at once. Compile tested only. + +Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14") +Signed-off-by: Yang Yingliang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207141411.46098-4-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +index 189cc643..0ba3bbed 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +@@ -30,8 +30,10 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; ++ struct sk_buff_head free_list; + unsigned long flags; + ++ skb_queue_head_init(&free_list); + spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); + while (skb_queue_len(&ring->queue)) { + struct rtl_tx_desc *entry = &ring->desc[ring->idx]; +@@ -41,10 +43,12 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw) + rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, + true, HW_DESC_TXBUFF_ADDR), + skb->len, DMA_TO_DEVICE); +- kfree_skb(skb); ++ __skb_queue_tail(&free_list, skb); + ring->idx = (ring->idx + 1) % ring->entries; + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); ++ ++ __skb_queue_purge(&free_list); + } + + static void _rtl8723be_set_bcn_ctrl_reg(struct ieee80211_hw *hw, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-150-wifi-iwlegacy-common-don-t-call-dev_kfree_skb-u.patch b/patches.kernel.org/6.2.3-150-wifi-iwlegacy-common-don-t-call-dev_kfree_skb-u.patch new file mode 100644 index 0000000..dd8ee00 --- /dev/null +++ b/patches.kernel.org/6.2.3-150-wifi-iwlegacy-common-don-t-call-dev_kfree_skb-u.patch @@ -0,0 +1,50 @@ +From: Yang Yingliang +Date: Wed, 7 Dec 2022 22:40:13 +0800 +Subject: [PATCH] wifi: iwlegacy: common: don't call dev_kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 + +[ Upstream commit 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 ] + +It is not allowed to call consume_skb() from hardware interrupt context +or with interrupts being disabled. So replace dev_kfree_skb() with +dev_consume_skb_irq() under spin_lock_irqsave(). Compile tested only. + +Fixes: 4bc85c1324aa ("Revert "iwlwifi: split the drivers for agn and legacy devices 3945/4965"") +Signed-off-by: Yang Yingliang +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207144013.70210-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/intel/iwlegacy/common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c +index 341c17fe..96002121 100644 +--- a/drivers/net/wireless/intel/iwlegacy/common.c ++++ b/drivers/net/wireless/intel/iwlegacy/common.c +@@ -5174,7 +5174,7 @@ il_mac_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + memset(&il->current_ht_config, 0, sizeof(struct il_ht_config)); + + /* new association get rid of ibss beacon skb */ +- dev_kfree_skb(il->beacon_skb); ++ dev_consume_skb_irq(il->beacon_skb); + il->beacon_skb = NULL; + il->timestamp = 0; + +@@ -5293,7 +5293,7 @@ il_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + } + + spin_lock_irqsave(&il->lock, flags); +- dev_kfree_skb(il->beacon_skb); ++ dev_consume_skb_irq(il->beacon_skb); + il->beacon_skb = skb; + + timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-151-wifi-libertas-fix-memory-leak-in-lbs_init_adapt.patch b/patches.kernel.org/6.2.3-151-wifi-libertas-fix-memory-leak-in-lbs_init_adapt.patch new file mode 100644 index 0000000..fa6ef09 --- /dev/null +++ b/patches.kernel.org/6.2.3-151-wifi-libertas-fix-memory-leak-in-lbs_init_adapt.patch @@ -0,0 +1,38 @@ +From: Zhengchao Shao +Date: Thu, 8 Dec 2022 20:14:48 +0800 +Subject: [PATCH] wifi: libertas: fix memory leak in lbs_init_adapter() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 16a03958618fb91bb1bc7077cf3211055162cc2f + +[ Upstream commit 16a03958618fb91bb1bc7077cf3211055162cc2f ] + +When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not +released. Add free memory to processing error path. + +Fixes: 7919b89c8276 ("libertas: convert libertas driver to use an event/cmdresp queue") +Signed-off-by: Zhengchao Shao +Reviewed-by: Jiri Pirko +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221208121448.2845986-1-shaozhengchao@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/marvell/libertas/main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c +index 8f5220ce..ae975304 100644 +--- a/drivers/net/wireless/marvell/libertas/main.c ++++ b/drivers/net/wireless/marvell/libertas/main.c +@@ -869,6 +869,7 @@ static int lbs_init_adapter(struct lbs_private *priv) + ret = kfifo_alloc(&priv->event_fifo, sizeof(u32) * 16, GFP_KERNEL); + if (ret) { + pr_err("Out of memory allocating event FIFO buffer\n"); ++ lbs_free_cmd_buffer(priv); + goto out; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-152-wifi-rtl8xxxu-Fix-assignment-to-bit-field-priv-.patch b/patches.kernel.org/6.2.3-152-wifi-rtl8xxxu-Fix-assignment-to-bit-field-priv-.patch new file mode 100644 index 0000000..2a46bcd --- /dev/null +++ b/patches.kernel.org/6.2.3-152-wifi-rtl8xxxu-Fix-assignment-to-bit-field-priv-.patch @@ -0,0 +1,43 @@ +From: Bitterblue Smith +Date: Thu, 8 Dec 2022 21:32:18 +0200 +Subject: [PATCH] wifi: rtl8xxxu: Fix assignment to bit field priv->pi_enabled +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9e32b4a709f0f7b7adf5d9939c3bd47c78c4f003 + +[ Upstream commit 9e32b4a709f0f7b7adf5d9939c3bd47c78c4f003 ] + +Just because priv->pi_enabled is only one bit doesn't mean it works +like a bool. The value assigned to it loses all bits except bit 0, +so only assign 0 or 1 to it. + +This affects the RTL8188FU, but fixing the assignment didn't make +a difference for my device. + +Fixes: c888183b21f3 ("wifi: rtl8xxxu: Support new chip RTL8188FU") +Signed-off-by: Bitterblue Smith +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/4368d585-11ec-d3c7-ec12-7f0afdcedfda@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c +index 2c4f403b..97e7ff72 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c +@@ -1122,7 +1122,7 @@ static void rtl8188fu_phy_iqcalibrate(struct rtl8xxxu_priv *priv, + + if (t == 0) { + val32 = rtl8xxxu_read32(priv, REG_FPGA0_XA_HSSI_PARM1); +- priv->pi_enabled = val32 & FPGA0_HSSI_PARM1_PI; ++ priv->pi_enabled = u32_get_bits(val32, FPGA0_HSSI_PARM1_PI); + } + + /* save RF path */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-153-wifi-rtl8xxxu-Fix-assignment-to-bit-field-priv-.patch b/patches.kernel.org/6.2.3-153-wifi-rtl8xxxu-Fix-assignment-to-bit-field-priv-.patch new file mode 100644 index 0000000..569ece4 --- /dev/null +++ b/patches.kernel.org/6.2.3-153-wifi-rtl8xxxu-Fix-assignment-to-bit-field-priv-.patch @@ -0,0 +1,50 @@ +From: Bitterblue Smith +Date: Thu, 8 Dec 2022 21:34:02 +0200 +Subject: [PATCH] wifi: rtl8xxxu: Fix assignment to bit field + priv->cck_agc_report_type +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 639c26faf9b15922bc620af341545d6c5d6aab2d + +[ Upstream commit 639c26faf9b15922bc620af341545d6c5d6aab2d ] + +Just because priv->cck_agc_report_type is only one bit doesn't mean +it works like a bool. The value assigned to it loses all bits except +bit 0, so only assign 0 or 1 to it. + +This affects the RTL8192EU, but rtl8xxxu already can't connect to any +networks with this chip, so it probably didn't bother anyone. + +Fixes: 2ad2a813b803 ("wifi: rtl8xxxu: Fix the CCK RSSI calculation") +Signed-off-by: Bitterblue Smith +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/7bb4858c-5cef-9cae-5e08-7e8444e8ba89@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 3ed43540..799b03ec 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -4208,10 +4208,12 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) + * should be equal or CCK RSSI report may be incorrect + */ + val32 = rtl8xxxu_read32(priv, REG_FPGA0_XA_HSSI_PARM2); +- priv->cck_agc_report_type = val32 & FPGA0_HSSI_PARM2_CCK_HIGH_PWR; ++ priv->cck_agc_report_type = ++ u32_get_bits(val32, FPGA0_HSSI_PARM2_CCK_HIGH_PWR); + + val32 = rtl8xxxu_read32(priv, REG_FPGA0_XB_HSSI_PARM2); +- if (priv->cck_agc_report_type != (bool)(val32 & FPGA0_HSSI_PARM2_CCK_HIGH_PWR)) { ++ if (priv->cck_agc_report_type != ++ u32_get_bits(val32, FPGA0_HSSI_PARM2_CCK_HIGH_PWR)) { + if (priv->cck_agc_report_type) + val32 |= FPGA0_HSSI_PARM2_CCK_HIGH_PWR; + else +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-154-wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-sp.patch b/patches.kernel.org/6.2.3-154-wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-sp.patch new file mode 100644 index 0000000..5d5ad4b --- /dev/null +++ b/patches.kernel.org/6.2.3-154-wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-sp.patch @@ -0,0 +1,49 @@ +From: Yang Yingliang +Date: Thu, 8 Dec 2022 22:35:17 +0800 +Subject: [PATCH] wifi: rtl8xxxu: don't call dev_kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4c2005ac87685907b3719b4f40215b578efd27c4 + +[ Upstream commit 4c2005ac87685907b3719b4f40215b578efd27c4 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called to free and drop the SKB when +it's shutdown, so replace it with dev_kfree_skb_irq(). Compile tested +only. + +Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") +Signed-off-by: Yang Yingliang +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221208143517.2383424-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 799b03ec..c8b82c58 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5276,7 +5276,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv, + pending = priv->rx_urb_pending_count; + } else { + skb = (struct sk_buff *)rx_urb->urb.context; +- dev_kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + usb_free_urb(&rx_urb->urb); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-155-wifi-rtw89-8852c-rfk-correct-DACK-setting.patch b/patches.kernel.org/6.2.3-155-wifi-rtw89-8852c-rfk-correct-DACK-setting.patch new file mode 100644 index 0000000..ae6ea8c --- /dev/null +++ b/patches.kernel.org/6.2.3-155-wifi-rtw89-8852c-rfk-correct-DACK-setting.patch @@ -0,0 +1,39 @@ +From: Ping-Ke Shih +Date: Fri, 9 Dec 2022 10:09:38 +0800 +Subject: [PATCH] wifi: rtw89: 8852c: rfk: correct DACK setting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b2bab7b14098dcf5d405fa8c76b2c3f6ce9184f9 + +[ Upstream commit b2bab7b14098dcf5d405fa8c76b2c3f6ce9184f9 ] + +After filling calibration parameters, set BIT(0) to enable the hardware +circuit, but original set incorrect bit that affects a little TX +performance. + +Fixes: 76599a8d0b7d ("rtw89: 8852c: rfk: add DACK") +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221209020940.9573-2-pkshih@realtek.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c +index 60cd676f..f5b0b57f 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c +@@ -337,7 +337,7 @@ static void _dack_reload_by_path(struct rtw89_dev *rtwdev, + (dack->dadck_d[path][index] << 14); + addr = 0xc210 + offset; + rtw89_phy_write32(rtwdev, addr, val32); +- rtw89_phy_write32_set(rtwdev, addr, BIT(1)); ++ rtw89_phy_write32_set(rtwdev, addr, BIT(0)); + } + + static void _dack_reload(struct rtw89_dev *rtwdev, enum rtw89_rf_path path) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-156-wifi-rtw89-8852c-rfk-correct-DPK-settings.patch b/patches.kernel.org/6.2.3-156-wifi-rtw89-8852c-rfk-correct-DPK-settings.patch new file mode 100644 index 0000000..8d9ce57 --- /dev/null +++ b/patches.kernel.org/6.2.3-156-wifi-rtw89-8852c-rfk-correct-DPK-settings.patch @@ -0,0 +1,60 @@ +From: Ping-Ke Shih +Date: Fri, 9 Dec 2022 10:09:39 +0800 +Subject: [PATCH] wifi: rtw89: 8852c: rfk: correct DPK settings +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 21b5f159a2ee47d30f418559f6ece0088c80199f + +[ Upstream commit 21b5f159a2ee47d30f418559f6ece0088c80199f ] + +Some DPK settings are wrong, and causes bad TX performance occasionally. +So, fix them by internal suggestions. + +Fixes: da4cea16cb13 ("rtw89: 8852c: rfk: add DPK") +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221209020940.9573-3-pkshih@realtek.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw89/reg.h | 2 ++ + drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c | 9 ++++----- + 2 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h +index 5324e645..ca6f6c3e 100644 +--- a/drivers/net/wireless/realtek/rtw89/reg.h ++++ b/drivers/net/wireless/realtek/rtw89/reg.h +@@ -3671,6 +3671,8 @@ + #define RR_TXRSV_GAPK BIT(19) + #define RR_BIAS 0x5e + #define RR_BIAS_GAPK BIT(19) ++#define RR_TXAC 0x5f ++#define RR_TXAC_IQG GENMASK(3, 0) + #define RR_BIASA 0x60 + #define RR_BIASA_TXG GENMASK(15, 12) + #define RR_BIASA_TXA GENMASK(19, 16) +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c +index f5b0b57f..f3a07b0e 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c +@@ -1872,12 +1872,11 @@ static void _dpk_rf_setting(struct rtw89_dev *rtwdev, u8 gain, + 0x50101 | BIT(rtwdev->dbcc_en)); + rtw89_write_rf(rtwdev, path, RR_MOD_V1, RR_MOD_MASK, RF_DPK); + +- if (dpk->bp[path][kidx].band == RTW89_BAND_6G && dpk->bp[path][kidx].ch >= 161) { ++ if (dpk->bp[path][kidx].band == RTW89_BAND_6G && dpk->bp[path][kidx].ch >= 161) + rtw89_write_rf(rtwdev, path, RR_IQGEN, RR_IQGEN_BIAS, 0x8); +- rtw89_write_rf(rtwdev, path, RR_LOGEN, RR_LOGEN_RPT, 0xd); +- } else { +- rtw89_write_rf(rtwdev, path, RR_LOGEN, RR_LOGEN_RPT, 0xd); +- } ++ ++ rtw89_write_rf(rtwdev, path, RR_LOGEN, RR_LOGEN_RPT, 0xd); ++ rtw89_write_rf(rtwdev, path, RR_TXAC, RR_TXAC_IQG, 0x8); + + rtw89_write_rf(rtwdev, path, RR_RXA2, RR_RXA2_ATT, 0x0); + rtw89_write_rf(rtwdev, path, RR_TXIQK, RR_TXIQK_ATT2, 0x3); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-157-wifi-rtlwifi-Fix-global-out-of-bounds-bug-in-_r.patch b/patches.kernel.org/6.2.3-157-wifi-rtlwifi-Fix-global-out-of-bounds-bug-in-_r.patch new file mode 100644 index 0000000..1f97d17 --- /dev/null +++ b/patches.kernel.org/6.2.3-157-wifi-rtlwifi-Fix-global-out-of-bounds-bug-in-_r.patch @@ -0,0 +1,159 @@ +From: Li Zetao +Date: Mon, 12 Dec 2022 10:58:12 +0800 +Subject: [PATCH] wifi: rtlwifi: Fix global-out-of-bounds bug in + _rtl8812ae_phy_set_txpower_limit() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 117dbeda22ec5ea0918254d03b540ef8b8a64d53 + +[ Upstream commit 117dbeda22ec5ea0918254d03b540ef8b8a64d53 ] + +There is a global-out-of-bounds reported by KASAN: + + BUG: KASAN: global-out-of-bounds in + _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] + Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 + + CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D + 6.1.0-rc8+ #144 e15588508517267d37 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), + Call Trace: + + ... + kasan_report+0xbb/0x1c0 + _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] + rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] + rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] + ... + + +The root cause of the problem is that the comparison order of +"prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The +_rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two +strings from tail to head, which causes the problem. In the +_rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet +this requirement by carefully designing the comparison order. +For example, "pregulation" and "pbandwidth" are compared in order of +length from small to large, first is 3 and last is 4. However, the +comparison order of "prate_section" dose not obey such order requirement, +therefore when "prate_section" is "HT", when comparing from tail to head, +it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As +mentioned above, the _rtl8812ae_eq_n_byte() has the same function as +strcmp(), so just strcmp() is enough. + +Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. +Although it can be fixed by adjusting the comparison order of +"prate_section", this may cause the value of "rate_section" to not be +from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver +from staging to regular tree, but also added setting txpower limit +function during the driver config phase, so the problem was introduced +by this commit. + +Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree") +Signed-off-by: Li Zetao +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221212025812.1541311-1-lizetao1@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------ + 1 file changed, 20 insertions(+), 32 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +index a29321e2..5323ead3 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +@@ -1598,18 +1598,6 @@ static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint) + return true; + } + +-static bool _rtl8812ae_eq_n_byte(const char *str1, const char *str2, u32 num) +-{ +- if (num == 0) +- return false; +- while (num > 0) { +- num--; +- if (str1[num] != str2[num]) +- return false; +- } +- return true; +-} +- + static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw, + u8 band, u8 channel) + { +@@ -1659,42 +1647,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, + power_limit = power_limit > MAX_POWER_INDEX ? + MAX_POWER_INDEX : power_limit; + +- if (_rtl8812ae_eq_n_byte(pregulation, "FCC", 3)) ++ if (strcmp(pregulation, "FCC") == 0) + regulation = 0; +- else if (_rtl8812ae_eq_n_byte(pregulation, "MKK", 3)) ++ else if (strcmp(pregulation, "MKK") == 0) + regulation = 1; +- else if (_rtl8812ae_eq_n_byte(pregulation, "ETSI", 4)) ++ else if (strcmp(pregulation, "ETSI") == 0) + regulation = 2; +- else if (_rtl8812ae_eq_n_byte(pregulation, "WW13", 4)) ++ else if (strcmp(pregulation, "WW13") == 0) + regulation = 3; + +- if (_rtl8812ae_eq_n_byte(prate_section, "CCK", 3)) ++ if (strcmp(prate_section, "CCK") == 0) + rate_section = 0; +- else if (_rtl8812ae_eq_n_byte(prate_section, "OFDM", 4)) ++ else if (strcmp(prate_section, "OFDM") == 0) + rate_section = 1; +- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) && +- _rtl8812ae_eq_n_byte(prf_path, "1T", 2)) ++ else if (strcmp(prate_section, "HT") == 0 && ++ strcmp(prf_path, "1T") == 0) + rate_section = 2; +- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) && +- _rtl8812ae_eq_n_byte(prf_path, "2T", 2)) ++ else if (strcmp(prate_section, "HT") == 0 && ++ strcmp(prf_path, "2T") == 0) + rate_section = 3; +- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) && +- _rtl8812ae_eq_n_byte(prf_path, "1T", 2)) ++ else if (strcmp(prate_section, "VHT") == 0 && ++ strcmp(prf_path, "1T") == 0) + rate_section = 4; +- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) && +- _rtl8812ae_eq_n_byte(prf_path, "2T", 2)) ++ else if (strcmp(prate_section, "VHT") == 0 && ++ strcmp(prf_path, "2T") == 0) + rate_section = 5; + +- if (_rtl8812ae_eq_n_byte(pbandwidth, "20M", 3)) ++ if (strcmp(pbandwidth, "20M") == 0) + bandwidth = 0; +- else if (_rtl8812ae_eq_n_byte(pbandwidth, "40M", 3)) ++ else if (strcmp(pbandwidth, "40M") == 0) + bandwidth = 1; +- else if (_rtl8812ae_eq_n_byte(pbandwidth, "80M", 3)) ++ else if (strcmp(pbandwidth, "80M") == 0) + bandwidth = 2; +- else if (_rtl8812ae_eq_n_byte(pbandwidth, "160M", 4)) ++ else if (strcmp(pbandwidth, "160M") == 0) + bandwidth = 3; + +- if (_rtl8812ae_eq_n_byte(pband, "2.4G", 4)) { ++ if (strcmp(pband, "2.4G") == 0) { + ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, + BAND_ON_2_4G, + channel); +@@ -1718,7 +1706,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, + regulation, bandwidth, rate_section, channel_index, + rtlphy->txpwr_limit_2_4g[regulation][bandwidth] + [rate_section][channel_index][RF90_PATH_A]); +- } else if (_rtl8812ae_eq_n_byte(pband, "5G", 2)) { ++ } else if (strcmp(pband, "5G") == 0) { + ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, + BAND_ON_5G, + channel); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-158-libbpf-Fix-single-line-struct-definition-output.patch b/patches.kernel.org/6.2.3-158-libbpf-Fix-single-line-struct-definition-output.patch new file mode 100644 index 0000000..f7b0d8c --- /dev/null +++ b/patches.kernel.org/6.2.3-158-libbpf-Fix-single-line-struct-definition-output.patch @@ -0,0 +1,50 @@ +From: Andrii Nakryiko +Date: Mon, 12 Dec 2022 13:15:00 -0800 +Subject: [PATCH] libbpf: Fix single-line struct definition output in btf_dump +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 872aec4b5f635d94111d48ec3c57fbe078d64e7d + +[ Upstream commit 872aec4b5f635d94111d48ec3c57fbe078d64e7d ] + +btf_dump APIs emit unnecessary tabs when emitting struct/union +definition that fits on the single line. Before this patch we'd get: + +struct blah {}; + +This patch fixes this and makes sure that we get more natural: + +struct blah {}; + +Fixes: 44a726c3f23c ("bpftool: Print newline before '}' for struct with padding only fields") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20221212211505.558851-2-andrii@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/lib/bpf/btf_dump.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index deb2bc9a..69e80ee5 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -959,9 +959,12 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + * Keep `struct empty {}` on a single line, + * only print newline when there are regular or padding fields. + */ +- if (vlen || t->size) ++ if (vlen || t->size) { + btf_dump_printf(d, "\n"); +- btf_dump_printf(d, "%s}", pfx(lvl)); ++ btf_dump_printf(d, "%s}", pfx(lvl)); ++ } else { ++ btf_dump_printf(d, "}"); ++ } + if (packed) + btf_dump_printf(d, " __attribute__((packed))"); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-159-libbpf-Fix-btf__align_of-by-taking-into-account.patch b/patches.kernel.org/6.2.3-159-libbpf-Fix-btf__align_of-by-taking-into-account.patch new file mode 100644 index 0000000..bfaa5ec --- /dev/null +++ b/patches.kernel.org/6.2.3-159-libbpf-Fix-btf__align_of-by-taking-into-account.patch @@ -0,0 +1,61 @@ +From: Andrii Nakryiko +Date: Mon, 12 Dec 2022 13:15:03 -0800 +Subject: [PATCH] libbpf: Fix btf__align_of() by taking into account field + offsets +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 25a4481b4136af7794e1df2d6c90ed2f354d60ce + +[ Upstream commit 25a4481b4136af7794e1df2d6c90ed2f354d60ce ] + +btf__align_of() is supposed to be return alignment requirement of +a requested BTF type. For STRUCT/UNION it doesn't always return correct +value, because it calculates alignment only based on field types. But +for packed structs this is not enough, we need to also check field +offsets and struct size. If field offset isn't aligned according to +field type's natural alignment, then struct must be packed. Similarly, +if struct size is not a multiple of struct's natural alignment, then +struct must be packed as well. + +This patch fixes this issue precisely by additionally checking these +conditions. + +Fixes: 3d208f4ca111 ("libbpf: Expose btf__align_of() API") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20221212211505.558851-5-andrii@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/lib/bpf/btf.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c +index 71e165b0..8cbcef95 100644 +--- a/tools/lib/bpf/btf.c ++++ b/tools/lib/bpf/btf.c +@@ -688,8 +688,21 @@ int btf__align_of(const struct btf *btf, __u32 id) + if (align <= 0) + return libbpf_err(align); + max_align = max(max_align, align); ++ ++ /* if field offset isn't aligned according to field ++ * type's alignment, then struct must be packed ++ */ ++ if (btf_member_bitfield_size(t, i) == 0 && ++ (m->offset % (8 * align)) != 0) ++ return 1; + } + ++ /* if struct/union size isn't a multiple of its alignment, ++ * then struct must be packed ++ */ ++ if ((t->size % max_align) != 0) ++ return 1; ++ + return max_align; + } + default: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-160-wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spi.patch b/patches.kernel.org/6.2.3-160-wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spi.patch new file mode 100644 index 0000000..c3f411e --- /dev/null +++ b/patches.kernel.org/6.2.3-160-wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spi.patch @@ -0,0 +1,48 @@ +From: Yang Yingliang +Date: Thu, 8 Dec 2022 22:38:26 +0800 +Subject: [PATCH] wifi: ipw2x00: don't call dev_kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 45fc6d7461f18df2f238caf0cbc5acc4163203d1 + +[ Upstream commit 45fc6d7461f18df2f238caf0cbc5acc4163203d1 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called to free and drop the SKB when +it's reset, so replace it with dev_kfree_skb_irq(). Compile tested +only. + +Fixes: 43f66a6ce8da ("Add ipw2200 wireless driver.") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221208143826.2385218-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +index ca802af8..cc66fd92 100644 +--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c ++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +@@ -3427,7 +3427,7 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv, + dma_unmap_single(&priv->pci_dev->dev, + rxq->pool[i].dma_addr, + IPW_RX_BUF_SIZE, DMA_FROM_DEVICE); +- dev_kfree_skb(rxq->pool[i].skb); ++ dev_kfree_skb_irq(rxq->pool[i].skb); + rxq->pool[i].skb = NULL; + } + list_add_tail(&rxq->pool[i].list, &rxq->rx_used); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-161-wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch b/patches.kernel.org/6.2.3-161-wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch new file mode 100644 index 0000000..0f2fbad --- /dev/null +++ b/patches.kernel.org/6.2.3-161-wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch @@ -0,0 +1,48 @@ +From: Zhengchao Shao +Date: Fri, 9 Dec 2022 09:24:22 +0800 +Subject: [PATCH] wifi: ipw2200: fix memory leak in ipw_wdev_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9fe21dc626117fb44a8eb393713a86a620128ce3 + +[ Upstream commit 9fe21dc626117fb44a8eb393713a86a620128ce3 ] + +In the error path of ipw_wdev_init(), exception value is returned, and +the memory applied for in the function is not released. Also the memory +is not released in ipw_pci_probe(). As a result, memory leakage occurs. +So memory release needs to be added to the error path of ipw_wdev_init(). + +Fixes: a3caa99e6c68 ("libipw: initiate cfg80211 API conversion (v2)") +Signed-off-by: Zhengchao Shao +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221209012422.182669-1-shaozhengchao@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/intel/ipw2x00/ipw2200.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +index cc66fd92..d382f201 100644 +--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c ++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +@@ -11383,9 +11383,14 @@ static int ipw_wdev_init(struct net_device *dev) + set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev); + + /* With that information in place, we can now register the wiphy... */ +- if (wiphy_register(wdev->wiphy)) +- rc = -EIO; ++ rc = wiphy_register(wdev->wiphy); ++ if (rc) ++ goto out; ++ ++ return 0; + out: ++ kfree(priv->ieee->a_band.channels); ++ kfree(priv->ieee->bg_band.channels); + return rc; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-162-wifi-wilc1000-fix-potential-memory-leak-in-wilc.patch b/patches.kernel.org/6.2.3-162-wifi-wilc1000-fix-potential-memory-leak-in-wilc.patch new file mode 100644 index 0000000..83b39b9 --- /dev/null +++ b/patches.kernel.org/6.2.3-162-wifi-wilc1000-fix-potential-memory-leak-in-wilc.patch @@ -0,0 +1,37 @@ +From: Zhang Changzhong +Date: Thu, 17 Nov 2022 19:36:03 +0800 +Subject: [PATCH] wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: deb962ec9e1c9a81babd3d37542ad4bd6ac3396e + +[ Upstream commit deb962ec9e1c9a81babd3d37542ad4bd6ac3396e ] + +The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add +dev_kfree_skb() to fix it. Compile tested only. + +Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") +Signed-off-by: Zhang Changzhong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1668684964-48622-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/microchip/wilc1000/netdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c +index 9b319a45..6f3ae0df 100644 +--- a/drivers/net/wireless/microchip/wilc1000/netdev.c ++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c +@@ -730,6 +730,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev) + + if (skb->dev != ndev) { + netdev_err(ndev, "Packet not destined to this device\n"); ++ dev_kfree_skb(skb); + return NETDEV_TX_OK; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-163-wifi-wilc1000-add-missing-unregister_netdev-in-.patch b/patches.kernel.org/6.2.3-163-wifi-wilc1000-add-missing-unregister_netdev-in-.patch new file mode 100644 index 0000000..690cb8e --- /dev/null +++ b/patches.kernel.org/6.2.3-163-wifi-wilc1000-add-missing-unregister_netdev-in-.patch @@ -0,0 +1,67 @@ +From: Wang Yufen +Date: Thu, 24 Nov 2022 19:38:22 +0800 +Subject: [PATCH] wifi: wilc1000: add missing unregister_netdev() in + wilc_netdev_ifc_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2b88974ecb358990e1c33fabcd0b9e142bab7f21 + +[ Upstream commit 2b88974ecb358990e1c33fabcd0b9e142bab7f21 ] + +Fault injection test reports this issue: + +kernel BUG at net/core/dev.c:10731! +invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI +Call Trace: + + wilc_netdev_ifc_init+0x19f/0x220 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5] + wilc_cfg80211_init+0x30c/0x380 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5] + wilc_bus_probe+0xad/0x2b0 [wilc1000_spi 1520a7539b6589cc6cde2ae826a523a33f8bacff] + spi_probe+0xe4/0x140 + really_probe+0x17e/0x3f0 + __driver_probe_device+0xe3/0x170 + driver_probe_device+0x49/0x120 + +The root case here is alloc_ordered_workqueue() fails, but +cfg80211_unregister_netdevice() or unregister_netdev() not be called in +error handling path. To fix add unregister_netdev goto lable to add the +unregister operation in error handling path. + +Fixes: 09ed8bfc5215 ("wilc1000: Rename workqueue from "WILC_wq" to "NETDEV-wq"") +Signed-off-by: Wang Yufen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1669289902-23639-1-git-send-email-wangyufen@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/microchip/wilc1000/netdev.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c +index 6f3ae0df..e9f59de3 100644 +--- a/drivers/net/wireless/microchip/wilc1000/netdev.c ++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c +@@ -981,7 +981,7 @@ struct wilc_vif *wilc_netdev_ifc_init(struct wilc *wl, const char *name, + ndev->name); + if (!wl->hif_workqueue) { + ret = -ENOMEM; +- goto error; ++ goto unregister_netdev; + } + + ndev->needs_free_netdev = true; +@@ -996,6 +996,11 @@ struct wilc_vif *wilc_netdev_ifc_init(struct wilc *wl, const char *name, + + return vif; + ++unregister_netdev: ++ if (rtnl_locked) ++ cfg80211_unregister_netdevice(ndev); ++ else ++ unregister_netdev(ndev); + error: + free_netdev(ndev); + return ERR_PTR(ret); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-164-wifi-brcmfmac-fix-potential-memory-leak-in-brcm.patch b/patches.kernel.org/6.2.3-164-wifi-brcmfmac-fix-potential-memory-leak-in-brcm.patch new file mode 100644 index 0000000..78c876d --- /dev/null +++ b/patches.kernel.org/6.2.3-164-wifi-brcmfmac-fix-potential-memory-leak-in-brcm.patch @@ -0,0 +1,40 @@ +From: Zhang Changzhong +Date: Thu, 17 Nov 2022 19:33:01 +0800 +Subject: [PATCH] wifi: brcmfmac: fix potential memory leak in + brcmf_netdev_start_xmit() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 212fde3fe76e962598ce1d47b97cc78afdfc71b3 + +[ Upstream commit 212fde3fe76e962598ce1d47b97cc78afdfc71b3 ] + +The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb +in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. +Compile tested only. + +Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") +Signed-off-by: Zhang Changzhong +Reviewed-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1668684782-47422-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index 83ea251c..f599d5f8 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -336,6 +336,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, + bphy_err(drvr, "%s: failed to expand headroom\n", + brcmf_ifname(ifp)); + atomic_inc(&drvr->bus_if->stats.pktcow_failed); ++ dev_kfree_skb(skb); + goto done; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-165-wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_.patch b/patches.kernel.org/6.2.3-165-wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_.patch new file mode 100644 index 0000000..5f95d75 --- /dev/null +++ b/patches.kernel.org/6.2.3-165-wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_.patch @@ -0,0 +1,48 @@ +From: Zhengchao Shao +Date: Wed, 7 Dec 2022 09:31:14 +0800 +Subject: [PATCH] wifi: brcmfmac: unmap dma buffer in + brcmf_msgbuf_alloc_pktid() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b9f420032f2ba1e634b22ca7b433e5c40ea663af + +[ Upstream commit b9f420032f2ba1e634b22ca7b433e5c40ea663af ] + +After the DMA buffer is mapped to a physical address, address is stored +in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in +brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr +and later unmap the DMA buffer. But when count is always equal to +pktids->array_size, physaddr isn't stored in pktids and the DMA buffer +will not be unmapped anyway. + +Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.") +Signed-off-by: Zhengchao Shao +Reviewed-by: Sebastian Andrzej Siewior +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207013114.1748936-1-shaozhengchao@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +index cec53f93..45fbcbdc 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +@@ -347,8 +347,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev, + count++; + } while (count < pktids->array_size); + +- if (count == pktids->array_size) ++ if (count == pktids->array_size) { ++ dma_unmap_single(dev, *physaddr, skb->len - data_offset, ++ pktids->direction); + return -ENOMEM; ++ } + + array[*idx].data_offset = data_offset; + array[*idx].physaddr = *physaddr; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-166-wifi-libertas_tf-don-t-call-kfree_skb-under-spi.patch b/patches.kernel.org/6.2.3-166-wifi-libertas_tf-don-t-call-kfree_skb-under-spi.patch new file mode 100644 index 0000000..0ba3468 --- /dev/null +++ b/patches.kernel.org/6.2.3-166-wifi-libertas_tf-don-t-call-kfree_skb-under-spi.patch @@ -0,0 +1,41 @@ +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:00:05 +0800 +Subject: [PATCH] wifi: libertas_tf: don't call kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9388ce97b98216833c969191ee6df61a7201d797 + +[ Upstream commit 9388ce97b98216833c969191ee6df61a7201d797 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: fc75122fabb5 ("libertas_tf: use irqsave() in USB's complete callback") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-2-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +index 75b5319d..1750f5e9 100644 +--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +@@ -613,7 +613,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, + spin_lock_irqsave(&priv->driver_lock, flags); + memcpy(priv->cmd_resp_buff, recvbuff + MESSAGE_HEADER_LEN, + recvlength - MESSAGE_HEADER_LEN); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + lbtf_cmd_response_rx(priv); + spin_unlock_irqrestore(&priv->driver_lock, flags); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-167-wifi-libertas-if_usb-don-t-call-kfree_skb-under.patch b/patches.kernel.org/6.2.3-167-wifi-libertas-if_usb-don-t-call-kfree_skb-under.patch new file mode 100644 index 0000000..ba1c2e9 --- /dev/null +++ b/patches.kernel.org/6.2.3-167-wifi-libertas-if_usb-don-t-call-kfree_skb-under.patch @@ -0,0 +1,41 @@ +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:00:06 +0800 +Subject: [PATCH] wifi: libertas: if_usb: don't call kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3968e81ba644f10a7d45bae2539560db9edac501 + +[ Upstream commit 3968e81ba644f10a7d45bae2539560db9edac501 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: a3128feef6d5 ("libertas: use irqsave() in USB's complete callback") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-3-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 32fdc415..2240b4db 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -637,7 +637,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, + priv->resp_len[i] = (recvlength - MESSAGE_HEADER_LEN); + memcpy(priv->resp_buf[i], recvbuff + MESSAGE_HEADER_LEN, + priv->resp_len[i]); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + lbs_notify_command_response(priv, i); + + spin_unlock_irqrestore(&priv->driver_lock, flags); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-168-wifi-libertas-main-don-t-call-kfree_skb-under-s.patch b/patches.kernel.org/6.2.3-168-wifi-libertas-main-don-t-call-kfree_skb-under-s.patch new file mode 100644 index 0000000..55f4656 --- /dev/null +++ b/patches.kernel.org/6.2.3-168-wifi-libertas-main-don-t-call-kfree_skb-under-s.patch @@ -0,0 +1,41 @@ +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:00:07 +0800 +Subject: [PATCH] wifi: libertas: main: don't call kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f393df151540bf858effbd29ff572ab94e76a4c4 + +[ Upstream commit f393df151540bf858effbd29ff572ab94e76a4c4 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: d2e7b3425c47 ("libertas: disable functionality when interface is down") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-4-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/marvell/libertas/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c +index ae975304..78e8b5ae 100644 +--- a/drivers/net/wireless/marvell/libertas/main.c ++++ b/drivers/net/wireless/marvell/libertas/main.c +@@ -216,7 +216,7 @@ int lbs_stop_iface(struct lbs_private *priv) + + spin_lock_irqsave(&priv->driver_lock, flags); + priv->iface_running = false; +- kfree_skb(priv->currenttxskb); ++ dev_kfree_skb_irq(priv->currenttxskb); + priv->currenttxskb = NULL; + priv->tx_pending_len = 0; + spin_unlock_irqrestore(&priv->driver_lock, flags); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-169-wifi-libertas-cmdresp-don-t-call-kfree_skb-unde.patch b/patches.kernel.org/6.2.3-169-wifi-libertas-cmdresp-don-t-call-kfree_skb-unde.patch new file mode 100644 index 0000000..71f3dc6 --- /dev/null +++ b/patches.kernel.org/6.2.3-169-wifi-libertas-cmdresp-don-t-call-kfree_skb-unde.patch @@ -0,0 +1,41 @@ +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:00:08 +0800 +Subject: [PATCH] wifi: libertas: cmdresp: don't call kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 708a49a64237f19bd404852f297aaadbc9e7fee0 + +[ Upstream commit 708a49a64237f19bd404852f297aaadbc9e7fee0 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: f52b041aed77 ("libertas: Add spinlock to avoid race condition") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-5-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/cmdresp.c b/drivers/net/wireless/marvell/libertas/cmdresp.c +index cb515c55..74cb7551 100644 +--- a/drivers/net/wireless/marvell/libertas/cmdresp.c ++++ b/drivers/net/wireless/marvell/libertas/cmdresp.c +@@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv, + + /* Free Tx and Rx packets */ + spin_lock_irqsave(&priv->driver_lock, flags); +- kfree_skb(priv->currenttxskb); ++ dev_kfree_skb_irq(priv->currenttxskb); + priv->currenttxskb = NULL; + priv->tx_pending_len = 0; + spin_unlock_irqrestore(&priv->driver_lock, flags); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-170-wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_.patch b/patches.kernel.org/6.2.3-170-wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_.patch new file mode 100644 index 0000000..dbce8c5 --- /dev/null +++ b/patches.kernel.org/6.2.3-170-wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_.patch @@ -0,0 +1,41 @@ +From: Yang Yingliang +Date: Wed, 7 Dec 2022 23:04:53 +0800 +Subject: [PATCH] wifi: wl3501_cs: don't call kfree_skb() under + spin_lock_irqsave() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 44bacbdf9066c590423259dbd6d520baac99c1a8 + +[ Upstream commit 44bacbdf9066c590423259dbd6d520baac99c1a8 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150453.114742-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/wl3501_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 1b532e00..7fb2f951 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -1328,7 +1328,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb, + } else { + ++dev->stats.tx_packets; + dev->stats.tx_bytes += skb->len; +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + + if (this->tx_buffer_cnt < 2) + netif_stop_queue(dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-171-libbpf-Fix-invalid-return-address-register-in-s.patch b/patches.kernel.org/6.2.3-171-libbpf-Fix-invalid-return-address-register-in-s.patch new file mode 100644 index 0000000..a12e4a3 --- /dev/null +++ b/patches.kernel.org/6.2.3-171-libbpf-Fix-invalid-return-address-register-in-s.patch @@ -0,0 +1,43 @@ +From: "Daniel T. Lee" +Date: Sat, 24 Dec 2022 16:15:27 +0900 +Subject: [PATCH] libbpf: Fix invalid return address register in s390 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7244eb669397f309c3d014264823cdc9cb3f8e6b + +[ Upstream commit 7244eb669397f309c3d014264823cdc9cb3f8e6b ] + +There is currently an invalid register mapping in the s390 return +address register. As the manual[1] states, the return address can be +found at r14. In bpf_tracing.h, the s390 registers were named +gprs(general purpose registers). This commit fixes the problem by +correcting the mistyped mapping. + +[1]: https://uclibc.org/docs/psABI-s390x.pdf#page=14 + +Fixes: 3cc31d794097 ("libbpf: Normalize PT_REGS_xxx() macro definitions") +Signed-off-by: Daniel T. Lee +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20221224071527.2292-7-danieltimlee@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/lib/bpf/bpf_tracing.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h +index 2972dc25..9c1b1689 100644 +--- a/tools/lib/bpf/bpf_tracing.h ++++ b/tools/lib/bpf/bpf_tracing.h +@@ -137,7 +137,7 @@ struct pt_regs___s390 { + #define __PT_PARM3_REG gprs[4] + #define __PT_PARM4_REG gprs[5] + #define __PT_PARM5_REG gprs[6] +-#define __PT_RET_REG grps[14] ++#define __PT_RET_REG gprs[14] + #define __PT_FP_REG gprs[11] /* Works only with CONFIG_FRAME_POINTER */ + #define __PT_RC_REG gprs[2] + #define __PT_SP_REG gprs[15] +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-172-crypto-x86-ghash-fix-unaligned-access-in-ghash_.patch b/patches.kernel.org/6.2.3-172-crypto-x86-ghash-fix-unaligned-access-in-ghash_.patch new file mode 100644 index 0000000..a7f8fea --- /dev/null +++ b/patches.kernel.org/6.2.3-172-crypto-x86-ghash-fix-unaligned-access-in-ghash_.patch @@ -0,0 +1,53 @@ +From: Eric Biggers +Date: Mon, 19 Dec 2022 21:40:40 -0800 +Subject: [PATCH] crypto: x86/ghash - fix unaligned access in ghash_setkey() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 116db2704c193fff6d73ea6c2219625f0c9bdfc8 + +[ Upstream commit 116db2704c193fff6d73ea6c2219625f0c9bdfc8 ] + +The key can be unaligned, so use the unaligned memory access helpers. + +Fixes: 8ceee72808d1 ("crypto: ghash-clmulni-intel - use C implementation for setkey()") +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c +index 1f1a95f3..c0ab0ff4 100644 +--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c ++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + #define GHASH_BLOCK_SIZE 16 + #define GHASH_DIGEST_SIZE 16 +@@ -54,15 +55,14 @@ static int ghash_setkey(struct crypto_shash *tfm, + const u8 *key, unsigned int keylen) + { + struct ghash_ctx *ctx = crypto_shash_ctx(tfm); +- be128 *x = (be128 *)key; + u64 a, b; + + if (keylen != GHASH_BLOCK_SIZE) + return -EINVAL; + + /* perform multiplication by 'x' in GF(2^128) */ +- a = be64_to_cpu(x->a); +- b = be64_to_cpu(x->b); ++ a = get_unaligned_be64(key); ++ b = get_unaligned_be64(key + 8); + + ctx->shash.a = (b << 1) | (a >> 63); + ctx->shash.b = (a << 1) | (b >> 63); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-173-crypto-ux500-update-debug-config-after-ux500-cr.patch b/patches.kernel.org/6.2.3-173-crypto-ux500-update-debug-config-after-ux500-cr.patch new file mode 100644 index 0000000..60a63a1 --- /dev/null +++ b/patches.kernel.org/6.2.3-173-crypto-ux500-update-debug-config-after-ux500-cr.patch @@ -0,0 +1,45 @@ +From: Lukas Bulwahn +Date: Tue, 20 Dec 2022 09:05:36 +0100 +Subject: [PATCH] crypto: ux500 - update debug config after ux500 cryp driver + removal +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 49bc6a7786b7d03eab6912a88d09a7991a32174e + +[ Upstream commit 49bc6a7786b7d03eab6912a88d09a7991a32174e ] + +Commit 453de3eb08c4 ("crypto: ux500/cryp - delete driver") removes the +config CRYPTO_DEV_UX500_CRYP, but leaves an obsolete reference in the +dependencies of config CRYPTO_DEV_UX500_DEBUG. + +Remove that obsolete reference, and adjust the description while at it. + +Fixes: 453de3eb08c4 ("crypto: ux500/cryp - delete driver") +Signed-off-by: Lukas Bulwahn +Acked-by: Linus Walleij +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/crypto/ux500/Kconfig | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/ux500/Kconfig b/drivers/crypto/ux500/Kconfig +index dcbd7404..ac89cd2d 100644 +--- a/drivers/crypto/ux500/Kconfig ++++ b/drivers/crypto/ux500/Kconfig +@@ -15,8 +15,7 @@ config CRYPTO_DEV_UX500_HASH + Depends on UX500/STM DMA if running in DMA mode. + + config CRYPTO_DEV_UX500_DEBUG +- bool "Activate ux500 platform debug-mode for crypto and hash block" +- depends on CRYPTO_DEV_UX500_CRYP || CRYPTO_DEV_UX500_HASH ++ bool "Activate debug-mode for UX500 crypto driver for HASH block" ++ depends on CRYPTO_DEV_UX500_HASH + help +- Say Y if you want to add debug prints to ux500_hash and +- ux500_cryp devices. ++ Say Y if you want to add debug prints to ux500_hash devices. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-174-ACPICA-Drop-port-I-O-validation-for-some-region.patch b/patches.kernel.org/6.2.3-174-ACPICA-Drop-port-I-O-validation-for-some-region.patch new file mode 100644 index 0000000..f65cb75 --- /dev/null +++ b/patches.kernel.org/6.2.3-174-ACPICA-Drop-port-I-O-validation-for-some-region.patch @@ -0,0 +1,76 @@ +From: Mario Limonciello +Date: Thu, 15 Dec 2022 09:51:20 -0600 +Subject: [PATCH] ACPICA: Drop port I/O validation for some regions +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 + +[ Upstream commit e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 ] + +Microsoft introduced support in Windows XP for blocking port I/O +to various regions. For Windows compatibility ACPICA has adopted +the same protections and will disallow writes to those +(presumably) the same regions. + +On some systems the AML included with the firmware will issue 4 byte +long writes to 0x80. These writes aren't making it over because of this +blockage. The first 4 byte write attempt is rejected, and then +subsequently 1 byte at a time each offset is tried. The first at 0x80 +works, but then the next 3 bytes are rejected. + +This manifests in bizarre failures for devices that expected the AML to +write all 4 bytes. Trying the same AML on Windows 10 or 11 doesn't hit +this failure and all 4 bytes are written. + +Either some of these regions were wrong or some point after Windows XP +some of these regions blocks have been lifted. + +In the last 15 years there doesn't seem to be any reports popping up of +this error in the Windows event viewer anymore. There is no documentation +at Microsoft's developer site indicating that Windows ACPI interpreter +blocks these regions. Between the lack of documentation and the fact that +the writes actually do work in Windows 10 and 11, it's quite likely +Windows doesn't actually enforce this anymore. + +So to help the issue, only enforce Windows XP specific entries if the +latest _OSI supported is Windows XP. Continue to enforce the +ALWAYS_ILLEGAL entries. + +Link: https://github.com/acpica/acpica/pull/817 +Fixes: 7f0719039085 ("ACPICA: New: I/O port protection") +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/acpica/hwvalid.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c +index 915b2644..0d392e7b 100644 +--- a/drivers/acpi/acpica/hwvalid.c ++++ b/drivers/acpi/acpica/hwvalid.c +@@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width); + * + * The table is used to implement the Microsoft port access rules that + * first appeared in Windows XP. Some ports are always illegal, and some +- * ports are only illegal if the BIOS calls _OSI with a win_XP string or +- * later (meaning that the BIOS itelf is post-XP.) ++ * ports are only illegal if the BIOS calls _OSI with nothing newer than ++ * the specific _OSI strings. + * + * This provides ACPICA with the desired port protections and + * Microsoft compatibility. +@@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) + + /* Port illegality may depend on the _OSI calls made by the BIOS */ + +- if (acpi_gbl_osi_data >= port_info->osi_dependency) { ++ if (port_info->osi_dependency == ACPI_ALWAYS_ILLEGAL || ++ acpi_gbl_osi_data == port_info->osi_dependency) { + ACPI_DEBUG_PRINT((ACPI_DB_VALUES, + "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n", + ACPI_FORMAT_UINT64(address), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-175-genirq-Fix-the-return-type-of-kstat_cpu_irqs_su.patch b/patches.kernel.org/6.2.3-175-genirq-Fix-the-return-type-of-kstat_cpu_irqs_su.patch new file mode 100644 index 0000000..b2e37fe --- /dev/null +++ b/patches.kernel.org/6.2.3-175-genirq-Fix-the-return-type-of-kstat_cpu_irqs_su.patch @@ -0,0 +1,45 @@ +From: Zhen Lei +Date: Sat, 19 Nov 2022 17:25:03 +0800 +Subject: [PATCH] genirq: Fix the return type of kstat_cpu_irqs_sum() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 47904aed898a08f028572b9b5a5cc101ddfb2d82 + +[ Upstream commit 47904aed898a08f028572b9b5a5cc101ddfb2d82 ] + +The type of member ->irqs_sum is unsigned long, but kstat_cpu_irqs_sum() +returns int, which can result in truncation. Therefore, change the +kstat_cpu_irqs_sum() function's return value to unsigned long to avoid +truncation. + +Fixes: f2c66cd8eedd ("/proc/stat: scalability of irq num per cpu") +Reported-by: Elliott, Robert (Servers) +Signed-off-by: Zhen Lei +Cc: Tejun Heo +Cc: "Peter Zijlstra (Intel)" +Cc: Josh Don +Cc: Andrew Morton +Reviewed-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/kernel_stat.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h +index ddb5a358..90e2fdc1 100644 +--- a/include/linux/kernel_stat.h ++++ b/include/linux/kernel_stat.h +@@ -75,7 +75,7 @@ extern unsigned int kstat_irqs_usr(unsigned int irq); + /* + * Number of interrupts per cpu, since bootup + */ +-static inline unsigned int kstat_cpu_irqs_sum(unsigned int cpu) ++static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu) + { + return kstat_cpu(cpu).irqs_sum; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-176-rcu-tasks-Improve-comments-explaining-tasks_rcu.patch b/patches.kernel.org/6.2.3-176-rcu-tasks-Improve-comments-explaining-tasks_rcu.patch new file mode 100644 index 0000000..3e64f9e --- /dev/null +++ b/patches.kernel.org/6.2.3-176-rcu-tasks-Improve-comments-explaining-tasks_rcu.patch @@ -0,0 +1,101 @@ +From: Frederic Weisbecker +Date: Fri, 25 Nov 2022 14:54:58 +0100 +Subject: [PATCH] rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu + purpose +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e4e1e8089c5fd948da12cb9f4adc93821036945f + +[ Upstream commit e4e1e8089c5fd948da12cb9f4adc93821036945f ] + +Make sure we don't need to look again into the depths of git blame in +order not to miss a subtle part about how rcu-tasks is dealing with +exiting tasks. + +Suggested-by: Boqun Feng +Suggested-by: Neeraj Upadhyay +Suggested-by: Paul E. McKenney +Cc: Oleg Nesterov +Cc: Lai Jiangshan +Cc: Eric W. Biederman +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/rcu/tasks.h | 37 +++++++++++++++++++++++++++++-------- + 1 file changed, 29 insertions(+), 8 deletions(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index fe9840d9..488ba8ad 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -827,11 +827,21 @@ static void rcu_tasks_pertask(struct task_struct *t, struct list_head *hop) + static void rcu_tasks_postscan(struct list_head *hop) + { + /* +- * Wait for tasks that are in the process of exiting. This +- * does only part of the job, ensuring that all tasks that were +- * previously exiting reach the point where they have disabled +- * preemption, allowing the later synchronize_rcu() to finish +- * the job. ++ * Exiting tasks may escape the tasklist scan. Those are vulnerable ++ * until their final schedule() with TASK_DEAD state. To cope with ++ * this, divide the fragile exit path part in two intersecting ++ * read side critical sections: ++ * ++ * 1) An _SRCU_ read side starting before calling exit_notify(), ++ * which may remove the task from the tasklist, and ending after ++ * the final preempt_disable() call in do_exit(). ++ * ++ * 2) An _RCU_ read side starting with the final preempt_disable() ++ * call in do_exit() and ending with the final call to schedule() ++ * with TASK_DEAD state. ++ * ++ * This handles the part 1). And postgp will handle part 2) with a ++ * call to synchronize_rcu(). + */ + synchronize_srcu(&tasks_rcu_exit_srcu); + } +@@ -898,7 +908,10 @@ static void rcu_tasks_postgp(struct rcu_tasks *rtp) + * + * In addition, this synchronize_rcu() waits for exiting tasks + * to complete their final preempt_disable() region of execution, +- * cleaning up after the synchronize_srcu() above. ++ * cleaning up after synchronize_srcu(&tasks_rcu_exit_srcu), ++ * enforcing the whole region before tasklist removal until ++ * the final schedule() with TASK_DEAD state to be an RCU TASKS ++ * read side critical section. + */ + synchronize_rcu(); + } +@@ -988,7 +1001,11 @@ void show_rcu_tasks_classic_gp_kthread(void) + EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread); + #endif // !defined(CONFIG_TINY_RCU) + +-/* Do the srcu_read_lock() for the above synchronize_srcu(). */ ++/* ++ * Contribute to protect against tasklist scan blind spot while the ++ * task is exiting and may be removed from the tasklist. See ++ * corresponding synchronize_srcu() for further details. ++ */ + void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) + { + preempt_disable(); +@@ -996,7 +1013,11 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) + preempt_enable(); + } + +-/* Do the srcu_read_unlock() for the above synchronize_srcu(). */ ++/* ++ * Contribute to protect against tasklist scan blind spot while the ++ * task is exiting and may be removed from the tasklist. See ++ * corresponding synchronize_srcu() for further details. ++ */ + void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) + { + struct task_struct *t = current; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-177-rcu-tasks-Remove-preemption-disablement-around-.patch b/patches.kernel.org/6.2.3-177-rcu-tasks-Remove-preemption-disablement-around-.patch new file mode 100644 index 0000000..abf37ab --- /dev/null +++ b/patches.kernel.org/6.2.3-177-rcu-tasks-Remove-preemption-disablement-around-.patch @@ -0,0 +1,62 @@ +From: Frederic Weisbecker +Date: Fri, 25 Nov 2022 14:54:59 +0100 +Subject: [PATCH] rcu-tasks: Remove preemption disablement around + srcu_read_[un]lock() calls +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 44757092958bdd749775022f915b7ac974384c2a + +[ Upstream commit 44757092958bdd749775022f915b7ac974384c2a ] + +Ever since the following commit: + + 5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()") + +SRCU doesn't rely anymore on preemption to be disabled in order to +modify the per-CPU counter. And even then it used to be done from the API +itself. + +Therefore and after checking further, it appears to be safe to remove +the preemption disablement around __srcu_read_[un]lock() in +exit_tasks_rcu_start() and exit_tasks_rcu_finish() + +Suggested-by: Boqun Feng +Suggested-by: Paul E. McKenney +Suggested-by: Neeraj Upadhyay +Cc: Lai Jiangshan +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/rcu/tasks.h | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index 488ba8ad..20617a2d 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -1008,9 +1008,7 @@ EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread); + */ + void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) + { +- preempt_disable(); + current->rcu_tasks_idx = __srcu_read_lock(&tasks_rcu_exit_srcu); +- preempt_enable(); + } + + /* +@@ -1022,9 +1020,7 @@ void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) + { + struct task_struct *t = current; + +- preempt_disable(); + __srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx); +- preempt_enable(); + exit_tasks_rcu_finish_trace(t); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-178-rcu-tasks-Fix-synchronize_rcu_tasks-VS-zap_pid_.patch b/patches.kernel.org/6.2.3-178-rcu-tasks-Fix-synchronize_rcu_tasks-VS-zap_pid_.patch new file mode 100644 index 0000000..a3ef4eb --- /dev/null +++ b/patches.kernel.org/6.2.3-178-rcu-tasks-Fix-synchronize_rcu_tasks-VS-zap_pid_.patch @@ -0,0 +1,157 @@ +From: Frederic Weisbecker +Date: Fri, 25 Nov 2022 14:55:00 +0100 +Subject: [PATCH] rcu-tasks: Fix synchronize_rcu_tasks() VS + zap_pid_ns_processes() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 28319d6dc5e2ffefa452c2377dd0f71621b5bff0 + +[ Upstream commit 28319d6dc5e2ffefa452c2377dd0f71621b5bff0 ] + +RCU Tasks and PID-namespace unshare can interact in do_exit() in a +complicated circular dependency: + +1) TASK A calls unshare(CLONE_NEWPID), this creates a new PID namespace + that every subsequent child of TASK A will belong to. But TASK A + doesn't itself belong to that new PID namespace. + +2) TASK A forks() and creates TASK B. TASK A stays attached to its PID + namespace (let's say PID_NS1) and TASK B is the first task belonging + to the new PID namespace created by unshare() (let's call it PID_NS2). + +3) Since TASK B is the first task attached to PID_NS2, it becomes the + PID_NS2 child reaper. + +4) TASK A forks() again and creates TASK C which get attached to PID_NS2. + Note how TASK C has TASK A as a parent (belonging to PID_NS1) but has + TASK B (belonging to PID_NS2) as a pid_namespace child_reaper. + +5) TASK B exits and since it is the child reaper for PID_NS2, it has to + kill all other tasks attached to PID_NS2, and wait for all of them to + die before getting reaped itself (zap_pid_ns_process()). + +6) TASK A calls synchronize_rcu_tasks() which leads to + synchronize_srcu(&tasks_rcu_exit_srcu). + +7) TASK B is waiting for TASK C to get reaped. But TASK B is under a + tasks_rcu_exit_srcu SRCU critical section (exit_notify() is between + exit_tasks_rcu_start() and exit_tasks_rcu_finish()), blocking TASK A. + +8) TASK C exits and since TASK A is its parent, it waits for it to reap + TASK C, but it can't because TASK A waits for TASK B that waits for + TASK C. + +Pid_namespace semantics can hardly be changed at this point. But the +coverage of tasks_rcu_exit_srcu can be reduced instead. + +The current task is assumed not to be concurrently reapable at this +stage of exit_notify() and therefore tasks_rcu_exit_srcu can be +temporarily relaxed without breaking its constraints, providing a way +out of the deadlock scenario. + +[ paulmck: Fix build failure by adding additional declaration. ] + +Fixes: 3f95aa81d265 ("rcu: Make TASKS_RCU handle tasks that are almost done exiting") +Reported-by: Pengfei Xu +Suggested-by: Boqun Feng +Suggested-by: Neeraj Upadhyay +Suggested-by: Paul E. McKenney +Cc: Oleg Nesterov +Cc: Lai Jiangshan +Cc: Eric W . Biederman +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/rcupdate.h | 2 ++ + kernel/pid_namespace.c | 17 +++++++++++++++++ + kernel/rcu/tasks.h | 15 +++++++++++++-- + 3 files changed, 32 insertions(+), 2 deletions(-) + +diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h +index 03abf883..c0c79bea 100644 +--- a/include/linux/rcupdate.h ++++ b/include/linux/rcupdate.h +@@ -238,6 +238,7 @@ void synchronize_rcu_tasks_rude(void); + + #define rcu_note_voluntary_context_switch(t) rcu_tasks_qs(t, false) + void exit_tasks_rcu_start(void); ++void exit_tasks_rcu_stop(void); + void exit_tasks_rcu_finish(void); + #else /* #ifdef CONFIG_TASKS_RCU_GENERIC */ + #define rcu_tasks_classic_qs(t, preempt) do { } while (0) +@@ -246,6 +247,7 @@ void exit_tasks_rcu_finish(void); + #define call_rcu_tasks call_rcu + #define synchronize_rcu_tasks synchronize_rcu + static inline void exit_tasks_rcu_start(void) { } ++static inline void exit_tasks_rcu_stop(void) { } + static inline void exit_tasks_rcu_finish(void) { } + #endif /* #else #ifdef CONFIG_TASKS_RCU_GENERIC */ + +diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c +index f4f8cb04..fc21c5d5 100644 +--- a/kernel/pid_namespace.c ++++ b/kernel/pid_namespace.c +@@ -244,7 +244,24 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns) + set_current_state(TASK_INTERRUPTIBLE); + if (pid_ns->pid_allocated == init_pids) + break; ++ /* ++ * Release tasks_rcu_exit_srcu to avoid following deadlock: ++ * ++ * 1) TASK A unshare(CLONE_NEWPID) ++ * 2) TASK A fork() twice -> TASK B (child reaper for new ns) ++ * and TASK C ++ * 3) TASK B exits, kills TASK C, waits for TASK A to reap it ++ * 4) TASK A calls synchronize_rcu_tasks() ++ * -> synchronize_srcu(tasks_rcu_exit_srcu) ++ * 5) *DEADLOCK* ++ * ++ * It is considered safe to release tasks_rcu_exit_srcu here ++ * because we assume the current task can not be concurrently ++ * reaped at this point. ++ */ ++ exit_tasks_rcu_stop(); + schedule(); ++ exit_tasks_rcu_start(); + } + __set_current_state(TASK_RUNNING); + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index 20617a2d..03388e2e 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -1016,16 +1016,27 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) + * task is exiting and may be removed from the tasklist. See + * corresponding synchronize_srcu() for further details. + */ +-void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) ++void exit_tasks_rcu_stop(void) __releases(&tasks_rcu_exit_srcu) + { + struct task_struct *t = current; + + __srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx); +- exit_tasks_rcu_finish_trace(t); ++} ++ ++/* ++ * Contribute to protect against tasklist scan blind spot while the ++ * task is exiting and may be removed from the tasklist. See ++ * corresponding synchronize_srcu() for further details. ++ */ ++void exit_tasks_rcu_finish(void) ++{ ++ exit_tasks_rcu_stop(); ++ exit_tasks_rcu_finish_trace(current); + } + + #else /* #ifdef CONFIG_TASKS_RCU */ + void exit_tasks_rcu_start(void) { } ++void exit_tasks_rcu_stop(void) { } + void exit_tasks_rcu_finish(void) { exit_tasks_rcu_finish_trace(current); } + #endif /* #else #ifdef CONFIG_TASKS_RCU */ + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-179-lib-mpi-Fix-buffer-overrun-when-SG-is-too-long.patch b/patches.kernel.org/6.2.3-179-lib-mpi-Fix-buffer-overrun-when-SG-is-too-long.patch new file mode 100644 index 0000000..ca69814 --- /dev/null +++ b/patches.kernel.org/6.2.3-179-lib-mpi-Fix-buffer-overrun-when-SG-is-too-long.patch @@ -0,0 +1,42 @@ +From: Herbert Xu +Date: Tue, 27 Dec 2022 15:27:39 +0100 +Subject: [PATCH] lib/mpi: Fix buffer overrun when SG is too long +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7361d1bc307b926cbca214ab67b641123c2d6357 + +[ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ] + +The helper mpi_read_raw_from_sgl sets the number of entries in +the SG list according to nbytes. However, if the last entry +in the SG list contains more data than nbytes, then it may overrun +the buffer because it only allocates enough memory for nbytes. + +Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") +Reported-by: Roberto Sassu +Signed-off-by: Herbert Xu +Reviewed-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + lib/mpi/mpicoder.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c +index 39c4c673..3cb6bd14 100644 +--- a/lib/mpi/mpicoder.c ++++ b/lib/mpi/mpicoder.c +@@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) + + while (sg_miter_next(&miter)) { + buff = miter.addr; +- len = miter.length; ++ len = min_t(unsigned, miter.length, nbytes); ++ nbytes -= len; + + for (x = 0; x < len; x++) { + a <<= 8; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-180-crypto-ccp-Avoid-page-allocation-failure-warnin.patch b/patches.kernel.org/6.2.3-180-crypto-ccp-Avoid-page-allocation-failure-warnin.patch new file mode 100644 index 0000000..54586f2 --- /dev/null +++ b/patches.kernel.org/6.2.3-180-crypto-ccp-Avoid-page-allocation-failure-warnin.patch @@ -0,0 +1,54 @@ +From: David Rientjes +Date: Fri, 30 Dec 2022 14:18:46 -0800 +Subject: [PATCH] crypto: ccp - Avoid page allocation failure warning for + SEV_GET_ID2 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 91dfd98216d817ec5f1c55890bacb7b4fe9b068a + +[ Upstream commit 91dfd98216d817ec5f1c55890bacb7b4fe9b068a ] + +For SEV_GET_ID2, the user provided length does not have a specified +limitation because the length of the ID may change in the future. The +kernel memory allocation, however, is implicitly limited to 4MB on x86 by +the page allocator, otherwise the kzalloc() will fail. + +When this happens, it is best not to spam the kernel log with the warning. +Simply fail the allocation and return ENOMEM to the user. + +Fixes: d6112ea0cb34 ("crypto: ccp - introduce SEV_GET_ID2 command") +Reported-by: Andy Nguyen +Reported-by: Peter Gonda +Suggested-by: Herbert Xu +Signed-off-by: David Rientjes +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/crypto/ccp/sev-dev.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 06fc7156..56998bc5 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -881,7 +881,14 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) + input_address = (void __user *)input.address; + + if (input.address && input.length) { +- id_blob = kzalloc(input.length, GFP_KERNEL); ++ /* ++ * The length of the ID shouldn't be assumed by software since ++ * it may change in the future. The allocation size is limited ++ * to 1 << (PAGE_SHIFT + MAX_ORDER - 1) by the page allocator. ++ * If the allocation fails, simply return ENOMEM rather than ++ * warning in the kernel log. ++ */ ++ id_blob = kzalloc(input.length, GFP_KERNEL | __GFP_NOWARN); + if (!id_blob) + return -ENOMEM; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-181-platform-chrome-cros_ec_typec-Update-port-DP-VD.patch b/patches.kernel.org/6.2.3-181-platform-chrome-cros_ec_typec-Update-port-DP-VD.patch new file mode 100644 index 0000000..872fb9f --- /dev/null +++ b/patches.kernel.org/6.2.3-181-platform-chrome-cros_ec_typec-Update-port-DP-VD.patch @@ -0,0 +1,39 @@ +From: Prashant Malani +Date: Wed, 28 Dec 2022 00:45:08 +0000 +Subject: [PATCH] platform/chrome: cros_ec_typec: Update port DP VDO +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8d2b28df6c3dc1581d856f52d9f78059ef2a568f + +[ Upstream commit 8d2b28df6c3dc1581d856f52d9f78059ef2a568f ] + +The port advertising DP support is a Type-C receptacle. Fix the port's +DisplayPort VDO to reflect this. + +Fixes: 1903adae0464 ("platform/chrome: cros_ec_typec: Add bit offset for DP VDO") +Signed-off-by: Prashant Malani +Reviewed-by: Benson Leung +Acked-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20221228004648.793339-6-pmalani@chromium.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/chrome/cros_ec_typec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c +index 001b0de9..d1714b5d 100644 +--- a/drivers/platform/chrome/cros_ec_typec.c ++++ b/drivers/platform/chrome/cros_ec_typec.c +@@ -27,7 +27,7 @@ + #define DRV_NAME "cros-ec-typec" + + #define DP_PORT_VDO (DP_CONF_SET_PIN_ASSIGN(BIT(DP_PIN_ASSIGN_C) | BIT(DP_PIN_ASSIGN_D)) | \ +- DP_CAP_DFP_D) ++ DP_CAP_DFP_D | DP_CAP_RECEPTACLE) + + /* Supported alt modes. */ + enum { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-182-ACPICA-nsrepair-handle-cases-without-a-return-v.patch b/patches.kernel.org/6.2.3-182-ACPICA-nsrepair-handle-cases-without-a-return-v.patch new file mode 100644 index 0000000..eb13199 --- /dev/null +++ b/patches.kernel.org/6.2.3-182-ACPICA-nsrepair-handle-cases-without-a-return-v.patch @@ -0,0 +1,67 @@ +From: Daniil Tatianin +Date: Sat, 7 Jan 2023 02:53:08 +0300 +Subject: [PATCH] ACPICA: nsrepair: handle cases without a return value + correctly +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ca843a4c79486e99a19b859ef0b9887854afe146 + +[ Upstream commit ca843a4c79486e99a19b859ef0b9887854afe146 ] + +Previously acpi_ns_simple_repair() would crash if expected_btypes +contained any combination of ACPI_RTYPE_NONE with a different type, +e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the +!return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE +for such cases. + +Found by Linux Verification Center (linuxtesting.org) with the SVACE +static analysis tool. + +Link: https://github.com/acpica/acpica/pull/811 +Fixes: 61db45ca2163 ("ACPICA: Restore code that repairs NULL package elements in return values.") +Signed-off-by: Daniil Tatianin +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/acpica/nsrepair.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c +index 367fcd20..ec512e06 100644 +--- a/drivers/acpi/acpica/nsrepair.c ++++ b/drivers/acpi/acpica/nsrepair.c +@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info, + * Try to fix if there was no return object. Warning if failed to fix. + */ + if (!return_object) { +- if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) { +- if (package_index != ACPI_NOT_PACKAGE_ELEMENT) { ++ if (expected_btypes) { ++ if (!(expected_btypes & ACPI_RTYPE_NONE) && ++ package_index != ACPI_NOT_PACKAGE_ELEMENT) { + ACPI_WARN_PREDEFINED((AE_INFO, + info->full_pathname, + ACPI_WARN_ALWAYS, +@@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info, + if (ACPI_SUCCESS(status)) { + return (AE_OK); /* Repair was successful */ + } +- } else { ++ } ++ ++ if (expected_btypes != ACPI_RTYPE_NONE) { + ACPI_WARN_PREDEFINED((AE_INFO, + info->full_pathname, + ACPI_WARN_ALWAYS, + "Missing expected return value")); ++ return (AE_AML_NO_RETURN_VALUE); + } +- +- return (AE_AML_NO_RETURN_VALUE); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-183-libbpf-Fix-map-creation-flags-sanitization.patch b/patches.kernel.org/6.2.3-183-libbpf-Fix-map-creation-flags-sanitization.patch new file mode 100644 index 0000000..e50a385 --- /dev/null +++ b/patches.kernel.org/6.2.3-183-libbpf-Fix-map-creation-flags-sanitization.patch @@ -0,0 +1,39 @@ +From: Ludovic L'Hours +Date: Sun, 8 Jan 2023 19:20:18 +0100 +Subject: [PATCH] libbpf: Fix map creation flags sanitization +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6920b08661e3ad829206078b5c9879b24aea8dfc + +[ Upstream commit 6920b08661e3ad829206078b5c9879b24aea8dfc ] + +As BPF_F_MMAPABLE flag is now conditionnaly set (by map_is_mmapable), +it should not be toggled but disabled if not supported by kernel. + +Fixes: 4fcac46c7e10 ("libbpf: only add BPF_F_MMAPABLE flag for data maps with global vars") +Signed-off-by: Ludovic L'Hours +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20230108182018.24433-1-ludovic.lhours@gmail.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/lib/bpf/libbpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 2a82f49c..adf818da 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -7355,7 +7355,7 @@ static int bpf_object__sanitize_maps(struct bpf_object *obj) + if (!bpf_map__is_internal(m)) + continue; + if (!kernel_supports(obj, FEAT_ARRAY_MMAP)) +- m->def.map_flags ^= BPF_F_MMAPABLE; ++ m->def.map_flags &= ~BPF_F_MMAPABLE; + } + + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-184-bpf_doc-Fix-build-error-with-older-python-versi.patch b/patches.kernel.org/6.2.3-184-bpf_doc-Fix-build-error-with-older-python-versi.patch new file mode 100644 index 0000000..ece747d --- /dev/null +++ b/patches.kernel.org/6.2.3-184-bpf_doc-Fix-build-error-with-older-python-versi.patch @@ -0,0 +1,46 @@ +From: Michal Suchanek +Date: Mon, 9 Jan 2023 12:34:42 +0100 +Subject: [PATCH] bpf_doc: Fix build error with older python versions +Patch-mainline: 6.2.3 +References: '_sre.SRE_Match' TypeError: bsc#1012628 is not object subscriptable +Git-commit: 5fbea42387eba1c7517fcad79099df706def7054 + +[ Upstream commit 5fbea42387eba1c7517fcad79099df706def7054 ] + +The ability to subscript match result as an array is only available +since python 3.6. Existing code in bpf_doc uses the older group() +interface but commit 8a76145a2ec2 adds code using the new interface. + +Use the old interface consistently to avoid build error on older +distributions like the below: + ++ make -j48 -s -C /dev/shm/kbuild/linux.33946/current ARCH=powerpc HOSTCC=gcc CROSS_COMPILE=powerpc64-suse-linux- clean +TypeError: '_sre.SRE_Match' object is not subscriptable + +Fixes: 8a76145a2ec2 ("bpf: explicitly define BPF_FUNC_xxx integer values") +Signed-off-by: Michal Suchanek +Signed-off-by: Andrii Nakryiko +Acked-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20230109113442.20946-1-msuchanek@suse.de +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + scripts/bpf_doc.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/bpf_doc.py b/scripts/bpf_doc.py +index e8d90829..38d51e05 100755 +--- a/scripts/bpf_doc.py ++++ b/scripts/bpf_doc.py +@@ -271,7 +271,7 @@ class HeaderParser(object): + if capture: + fn_defines_str += self.line + helper_name = capture.expand(r'bpf_\1') +- self.helper_enum_vals[helper_name] = int(capture[2]) ++ self.helper_enum_vals[helper_name] = int(capture.group(2)) + self.helper_enum_pos[helper_name] = i + i += 1 + else: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-185-selftests-xsk-print-correct-payload-for-packet-.patch b/patches.kernel.org/6.2.3-185-selftests-xsk-print-correct-payload-for-packet-.patch new file mode 100644 index 0000000..2fbd06c --- /dev/null +++ b/patches.kernel.org/6.2.3-185-selftests-xsk-print-correct-payload-for-packet-.patch @@ -0,0 +1,49 @@ +From: Magnus Karlsson +Date: Wed, 11 Jan 2023 10:35:12 +0100 +Subject: [PATCH] selftests/xsk: print correct payload for packet dump +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2d0b2ae2871ae6d42a9f0a4280e0fb5bff8d38b8 + +[ Upstream commit 2d0b2ae2871ae6d42a9f0a4280e0fb5bff8d38b8 ] + +Print the correct payload when the packet dump option is selected. The +network to host conversion was forgotten and the payload was +erronously declared to be an int instead of an unsigned int. + +Fixes: facb7cb2e909 ("selftests/bpf: Xsk selftests - SKB POLL, NOPOLL") +Signed-off-by: Magnus Karlsson +Acked-by: Maciej Fijalkowski +Link: https://lore.kernel.org/r/20230111093526.11682-2-magnus.karlsson@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/xskxceiver.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c +index 162d3a51..2ff43b22 100644 +--- a/tools/testing/selftests/bpf/xskxceiver.c ++++ b/tools/testing/selftests/bpf/xskxceiver.c +@@ -767,7 +767,7 @@ static void pkt_dump(void *pkt, u32 len) + struct ethhdr *ethhdr; + struct udphdr *udphdr; + struct iphdr *iphdr; +- int payload, i; ++ u32 payload, i; + + ethhdr = pkt; + iphdr = pkt + sizeof(*ethhdr); +@@ -792,7 +792,7 @@ static void pkt_dump(void *pkt, u32 len) + fprintf(stdout, "DEBUG>> L4: udp_hdr->src: %d\n", ntohs(udphdr->source)); + fprintf(stdout, "DEBUG>> L4: udp_hdr->dst: %d\n", ntohs(udphdr->dest)); + /*extract L5 frame */ +- payload = *((uint32_t *)(pkt + PKT_HDR_SIZE)); ++ payload = ntohl(*((u32 *)(pkt + PKT_HDR_SIZE))); + + fprintf(stdout, "DEBUG>> L5: payload: %d\n", payload); + fprintf(stdout, "---------------------------------------\n"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-186-selftests-xsk-print-correct-error-codes-when-ex.patch b/patches.kernel.org/6.2.3-186-selftests-xsk-print-correct-error-codes-when-ex.patch new file mode 100644 index 0000000..f4e3e75 --- /dev/null +++ b/patches.kernel.org/6.2.3-186-selftests-xsk-print-correct-error-codes-when-ex.patch @@ -0,0 +1,107 @@ +From: Magnus Karlsson +Date: Wed, 11 Jan 2023 10:35:15 +0100 +Subject: [PATCH] selftests/xsk: print correct error codes when exiting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 085dcccfb7d3dc52ed708fc588587f319541bc83 + +[ Upstream commit 085dcccfb7d3dc52ed708fc588587f319541bc83 ] + +Print the correct error codes when exiting the test suite due to some +terminal error. Some of these had a switched sign and some of them +printed zero instead of errno. + +Fixes: facb7cb2e909 ("selftests/bpf: Xsk selftests - SKB POLL, NOPOLL") +Signed-off-by: Magnus Karlsson +Acked-by: Maciej Fijalkowski +Link: https://lore.kernel.org/r/20230111093526.11682-5-magnus.karlsson@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/xskxceiver.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c +index 2ff43b22..1b9f48da 100644 +--- a/tools/testing/selftests/bpf/xskxceiver.c ++++ b/tools/testing/selftests/bpf/xskxceiver.c +@@ -350,7 +350,7 @@ static bool ifobj_zc_avail(struct ifobject *ifobject) + umem = calloc(1, sizeof(struct xsk_umem_info)); + if (!umem) { + munmap(bufs, umem_sz); +- exit_with_error(-ENOMEM); ++ exit_with_error(ENOMEM); + } + umem->frame_size = XSK_UMEM__DEFAULT_FRAME_SIZE; + ret = xsk_configure_umem(umem, bufs, umem_sz); +@@ -936,7 +936,7 @@ static int receive_pkts(struct test_spec *test, struct pollfd *fds) + if (ifobj->use_poll) { + ret = poll(fds, 1, POLL_TMOUT); + if (ret < 0) +- exit_with_error(-ret); ++ exit_with_error(errno); + + if (!ret) { + if (!is_umem_valid(test->ifobj_tx)) +@@ -963,7 +963,7 @@ static int receive_pkts(struct test_spec *test, struct pollfd *fds) + if (xsk_ring_prod__needs_wakeup(&umem->fq)) { + ret = poll(fds, 1, POLL_TMOUT); + if (ret < 0) +- exit_with_error(-ret); ++ exit_with_error(errno); + } + ret = xsk_ring_prod__reserve(&umem->fq, rcvd, &idx_fq); + } +@@ -1015,7 +1015,7 @@ static int __send_pkts(struct ifobject *ifobject, u32 *pkt_nb, struct pollfd *fd + if (timeout) { + if (ret < 0) { + ksft_print_msg("ERROR: [%s] Poll error %d\n", +- __func__, ret); ++ __func__, errno); + return TEST_FAILURE; + } + if (ret == 0) +@@ -1024,7 +1024,7 @@ static int __send_pkts(struct ifobject *ifobject, u32 *pkt_nb, struct pollfd *fd + } + if (ret <= 0) { + ksft_print_msg("ERROR: [%s] Poll error %d\n", +- __func__, ret); ++ __func__, errno); + return TEST_FAILURE; + } + } +@@ -1323,18 +1323,18 @@ static void thread_common_ops(struct test_spec *test, struct ifobject *ifobject) + if (ifobject->xdp_flags & XDP_FLAGS_SKB_MODE) { + if (opts.attach_mode != XDP_ATTACHED_SKB) { + ksft_print_msg("ERROR: [%s] XDP prog not in SKB mode\n"); +- exit_with_error(-EINVAL); ++ exit_with_error(EINVAL); + } + } else if (ifobject->xdp_flags & XDP_FLAGS_DRV_MODE) { + if (opts.attach_mode != XDP_ATTACHED_DRV) { + ksft_print_msg("ERROR: [%s] XDP prog not in DRV mode\n"); +- exit_with_error(-EINVAL); ++ exit_with_error(EINVAL); + } + } + + ret = xsk_socket__update_xskmap(ifobject->xsk->xsk, ifobject->xsk_map_fd); + if (ret) +- exit_with_error(-ret); ++ exit_with_error(errno); + } + + static void *worker_testapp_validate_tx(void *arg) +@@ -1541,7 +1541,7 @@ static void swap_xsk_resources(struct ifobject *ifobj_tx, struct ifobject *ifobj + + ret = xsk_socket__update_xskmap(ifobj_rx->xsk->xsk, ifobj_rx->xsk_map_fd); + if (ret) +- exit_with_error(-ret); ++ exit_with_error(errno); + } + + static void testapp_bpf_res(struct test_spec *test) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-187-arm64-cpufeature-Fix-field-sign-for-DIT-hwcap-d.patch b/patches.kernel.org/6.2.3-187-arm64-cpufeature-Fix-field-sign-for-DIT-hwcap-d.patch new file mode 100644 index 0000000..ecec795 --- /dev/null +++ b/patches.kernel.org/6.2.3-187-arm64-cpufeature-Fix-field-sign-for-DIT-hwcap-d.patch @@ -0,0 +1,48 @@ +From: Mark Brown +Date: Tue, 27 Dec 2022 12:55:54 +0000 +Subject: [PATCH] arm64/cpufeature: Fix field sign for DIT hwcap detection +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 50daf5b7c4ec4efcaf49a4128930f872bec7dbc0 + +[ Upstream commit 50daf5b7c4ec4efcaf49a4128930f872bec7dbc0 ] + +Since it was added our hwcap for DIT has specified that DIT is a signed +field but this appears to be incorrect, the two values for the enumeration +are: + + 0b0000 NI + 0b0001 IMP + +which look like a normal unsigned enumeration and the in-kernel DIT usage +added by 01ab991fc0ee ("arm64: Enable data independent timing (DIT) in the +kernel") detects the feature with an unsigned enum. Fix the hwcap to specify +the field as unsigned. + +Fixes: 7206dc93a58f ("arm64: Expose Arm v8.4 features") +Reviewed-by: Mark Rutland +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20221207-arm64-sysreg-helpers-v3-1-0d71a7b174a8@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/kernel/cpufeature.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index a77315b3..ee40dca9 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -2777,7 +2777,7 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { + HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_FP_SHIFT, 4, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_FPHP), + HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_AdvSIMD_SHIFT, 4, FTR_SIGNED, 0, CAP_HWCAP, KERNEL_HWCAP_ASIMD), + HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_AdvSIMD_SHIFT, 4, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_ASIMDHP), +- HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_DIT_SHIFT, 4, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_DIT), ++ HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_DIT_SHIFT, 4, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_DIT), + HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_DPB_SHIFT, 4, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_DCPOP), + HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_DPB_SHIFT, 4, FTR_UNSIGNED, 2, CAP_HWCAP, KERNEL_HWCAP_DCPODP), + HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_JSCVT_SHIFT, 4, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_JSCVT), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-188-arm64-sysreg-Fix-errors-in-32-bit-enumeration-v.patch b/patches.kernel.org/6.2.3-188-arm64-sysreg-Fix-errors-in-32-bit-enumeration-v.patch new file mode 100644 index 0000000..d9268e8 --- /dev/null +++ b/patches.kernel.org/6.2.3-188-arm64-sysreg-Fix-errors-in-32-bit-enumeration-v.patch @@ -0,0 +1,62 @@ +From: Mark Brown +Date: Tue, 27 Dec 2022 12:55:55 +0000 +Subject: [PATCH] arm64/sysreg: Fix errors in 32 bit enumeration values +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8c6e105558628b63292ae770198f11a1d5535660 + +[ Upstream commit 8c6e105558628b63292ae770198f11a1d5535660 ] + +The recently converted 32 bit ID registers have errors in MVFR0_EL1.FPSP, +MVFR0_EL1.SIMDReg and MVFR1_EL1.SIMDHP where enumeration values which +should be 0b0010 are specified as 0b0001. Correct these. + +Fixes: e79c94a2a487 ("arm64/sysreg: Convert MVFR0_EL1 to automatic generation") +Fixes: c9b718eda706 ("arm64/sysreg: Convert MVFR1_EL1 to automatic generation") +Reviewed-by: Mark Rutland +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20221207-arm64-sysreg-helpers-v3-2-0d71a7b174a8@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/tools/sysreg | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg +index 184e58fd..e8fb6684 100644 +--- a/arch/arm64/tools/sysreg ++++ b/arch/arm64/tools/sysreg +@@ -689,17 +689,17 @@ EndEnum + Enum 11:8 FPDP + 0b0000 NI + 0b0001 VFPv2 +- 0b0001 VFPv3 ++ 0b0010 VFPv3 + EndEnum + Enum 7:4 FPSP + 0b0000 NI + 0b0001 VFPv2 +- 0b0001 VFPv3 ++ 0b0010 VFPv3 + EndEnum + Enum 3:0 SIMDReg + 0b0000 NI + 0b0001 IMP_16x64 +- 0b0001 IMP_32x64 ++ 0b0010 IMP_32x64 + EndEnum + EndSysreg + +@@ -718,7 +718,7 @@ EndEnum + Enum 23:20 SIMDHP + 0b0000 NI + 0b0001 SIMDHP +- 0b0001 SIMDHP_FLOAT ++ 0b0010 SIMDHP_FLOAT + EndEnum + Enum 19:16 SIMDSP + 0b0000 NI +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-189-kselftest-arm64-Fix-syscall-abi-for-systems-wit.patch b/patches.kernel.org/6.2.3-189-kselftest-arm64-Fix-syscall-abi-for-systems-wit.patch new file mode 100644 index 0000000..3fa2f25 --- /dev/null +++ b/patches.kernel.org/6.2.3-189-kselftest-arm64-Fix-syscall-abi-for-systems-wit.patch @@ -0,0 +1,53 @@ +From: Mark Brown +Date: Tue, 27 Dec 2022 13:06:35 +0000 +Subject: [PATCH] kselftest/arm64: Fix syscall-abi for systems without 128 bit + SME +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 97ec597b26df774a257e3f8e97353fd1b4471615 + +[ Upstream commit 97ec597b26df774a257e3f8e97353fd1b4471615 ] + +SME does not mandate any specific VL so we may not have 128 bit SME but +the algorithm used for enumerating VLs assumes that we will. Add the +required check to ensure that the algorithm terminates. + +Fixes: 43e3f85523e4 ("kselftest/arm64: Add SME support to syscall ABI test") +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20221223-arm64-syscall-abi-sme-only-v1-1-4fabfbd62087@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/arm64/abi/syscall-abi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/tools/testing/selftests/arm64/abi/syscall-abi.c b/tools/testing/selftests/arm64/abi/syscall-abi.c +index dd7ebe53..ffe719b5 100644 +--- a/tools/testing/selftests/arm64/abi/syscall-abi.c ++++ b/tools/testing/selftests/arm64/abi/syscall-abi.c +@@ -390,6 +390,10 @@ static void test_one_syscall(struct syscall_cfg *cfg) + + sme_vl &= PR_SME_VL_LEN_MASK; + ++ /* Found lowest VL */ ++ if (sve_vq_from_vl(sme_vl) > sme_vq) ++ break; ++ + if (sme_vq != sve_vq_from_vl(sme_vl)) + sme_vq = sve_vq_from_vl(sme_vl); + +@@ -461,6 +465,10 @@ int sme_count_vls(void) + + vl &= PR_SME_VL_LEN_MASK; + ++ /* Found lowest VL */ ++ if (sve_vq_from_vl(vl) > vq) ++ break; ++ + if (vq != sve_vq_from_vl(vl)) + vq = sve_vq_from_vl(vl); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-190-workqueue-Protects-wq_unbound_cpumask-with-wq_p.patch b/patches.kernel.org/6.2.3-190-workqueue-Protects-wq_unbound_cpumask-with-wq_p.patch new file mode 100644 index 0000000..f115da9 --- /dev/null +++ b/patches.kernel.org/6.2.3-190-workqueue-Protects-wq_unbound_cpumask-with-wq_p.patch @@ -0,0 +1,144 @@ +From: Lai Jiangshan +Date: Thu, 12 Jan 2023 16:14:27 +0000 +Subject: [PATCH] workqueue: Protects wq_unbound_cpumask with + wq_pool_attach_mutex +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 99c621ef243bda726fb8d982a274ded96570b410 + +[ Upstream commit 99c621ef243bda726fb8d982a274ded96570b410 ] + +When unbind_workers() reads wq_unbound_cpumask to set the affinity of +freshly-unbound kworkers, it only holds wq_pool_attach_mutex. This isn't +sufficient as wq_unbound_cpumask is only protected by wq_pool_mutex. + +Make wq_unbound_cpumask protected with wq_pool_attach_mutex and also +remove the need of temporary saved_cpumask. + +Fixes: 10a5a651e3af ("workqueue: Restrict kworker in the offline CPU pool running on housekeeping CPUs") +Reported-by: Valentin Schneider +Signed-off-by: Lai Jiangshan +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/workqueue.c | 41 ++++++++++++++++------------------------- + 1 file changed, 16 insertions(+), 25 deletions(-) + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 07895dec..76ea87b0 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -326,7 +326,7 @@ static struct rcuwait manager_wait = __RCUWAIT_INITIALIZER(manager_wait); + static LIST_HEAD(workqueues); /* PR: list of all workqueues */ + static bool workqueue_freezing; /* PL: have wqs started freezing? */ + +-/* PL: allowable cpus for unbound wqs and work items */ ++/* PL&A: allowable cpus for unbound wqs and work items */ + static cpumask_var_t wq_unbound_cpumask; + + /* CPU where unbound work was last round robin scheduled from this CPU */ +@@ -3952,7 +3952,8 @@ static void apply_wqattrs_cleanup(struct apply_wqattrs_ctx *ctx) + /* allocate the attrs and pwqs for later installation */ + static struct apply_wqattrs_ctx * + apply_wqattrs_prepare(struct workqueue_struct *wq, +- const struct workqueue_attrs *attrs) ++ const struct workqueue_attrs *attrs, ++ const cpumask_var_t unbound_cpumask) + { + struct apply_wqattrs_ctx *ctx; + struct workqueue_attrs *new_attrs, *tmp_attrs; +@@ -3968,14 +3969,15 @@ apply_wqattrs_prepare(struct workqueue_struct *wq, + goto out_free; + + /* +- * Calculate the attrs of the default pwq. ++ * Calculate the attrs of the default pwq with unbound_cpumask ++ * which is wq_unbound_cpumask or to set to wq_unbound_cpumask. + * If the user configured cpumask doesn't overlap with the + * wq_unbound_cpumask, we fallback to the wq_unbound_cpumask. + */ + copy_workqueue_attrs(new_attrs, attrs); +- cpumask_and(new_attrs->cpumask, new_attrs->cpumask, wq_unbound_cpumask); ++ cpumask_and(new_attrs->cpumask, new_attrs->cpumask, unbound_cpumask); + if (unlikely(cpumask_empty(new_attrs->cpumask))) +- cpumask_copy(new_attrs->cpumask, wq_unbound_cpumask); ++ cpumask_copy(new_attrs->cpumask, unbound_cpumask); + + /* + * We may create multiple pwqs with differing cpumasks. Make a +@@ -4072,7 +4074,7 @@ static int apply_workqueue_attrs_locked(struct workqueue_struct *wq, + wq->flags &= ~__WQ_ORDERED; + } + +- ctx = apply_wqattrs_prepare(wq, attrs); ++ ctx = apply_wqattrs_prepare(wq, attrs, wq_unbound_cpumask); + if (!ctx) + return -ENOMEM; + +@@ -5334,7 +5336,7 @@ void thaw_workqueues(void) + } + #endif /* CONFIG_FREEZER */ + +-static int workqueue_apply_unbound_cpumask(void) ++static int workqueue_apply_unbound_cpumask(const cpumask_var_t unbound_cpumask) + { + LIST_HEAD(ctxs); + int ret = 0; +@@ -5350,7 +5352,7 @@ static int workqueue_apply_unbound_cpumask(void) + if (wq->flags & __WQ_ORDERED) + continue; + +- ctx = apply_wqattrs_prepare(wq, wq->unbound_attrs); ++ ctx = apply_wqattrs_prepare(wq, wq->unbound_attrs, unbound_cpumask); + if (!ctx) { + ret = -ENOMEM; + break; +@@ -5365,6 +5367,11 @@ static int workqueue_apply_unbound_cpumask(void) + apply_wqattrs_cleanup(ctx); + } + ++ if (!ret) { ++ mutex_lock(&wq_pool_attach_mutex); ++ cpumask_copy(wq_unbound_cpumask, unbound_cpumask); ++ mutex_unlock(&wq_pool_attach_mutex); ++ } + return ret; + } + +@@ -5383,7 +5390,6 @@ static int workqueue_apply_unbound_cpumask(void) + int workqueue_set_unbound_cpumask(cpumask_var_t cpumask) + { + int ret = -EINVAL; +- cpumask_var_t saved_cpumask; + + /* + * Not excluding isolated cpus on purpose. +@@ -5397,23 +5403,8 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask) + goto out_unlock; + } + +- if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL)) { +- ret = -ENOMEM; +- goto out_unlock; +- } +- +- /* save the old wq_unbound_cpumask. */ +- cpumask_copy(saved_cpumask, wq_unbound_cpumask); +- +- /* update wq_unbound_cpumask at first and apply it to wqs. */ +- cpumask_copy(wq_unbound_cpumask, cpumask); +- ret = workqueue_apply_unbound_cpumask(); +- +- /* restore the wq_unbound_cpumask when failed. */ +- if (ret < 0) +- cpumask_copy(wq_unbound_cpumask, saved_cpumask); ++ ret = workqueue_apply_unbound_cpumask(cpumask); + +- free_cpumask_var(saved_cpumask); + out_unlock: + apply_wqattrs_unlock(); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-191-s390-early-fix-sclp_early_sccb-variable-lifetim.patch b/patches.kernel.org/6.2.3-191-s390-early-fix-sclp_early_sccb-variable-lifetim.patch new file mode 100644 index 0000000..10445ac --- /dev/null +++ b/patches.kernel.org/6.2.3-191-s390-early-fix-sclp_early_sccb-variable-lifetim.patch @@ -0,0 +1,72 @@ +From: Alexander Gordeev +Date: Thu, 15 Dec 2022 08:00:34 +0100 +Subject: [PATCH] s390/early: fix sclp_early_sccb variable lifetime +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 639886b71ddef085a0e7bb1f225b8ae3eda5c06f + +[ Upstream commit 639886b71ddef085a0e7bb1f225b8ae3eda5c06f ] + +Commit ada1da31ce34 ("s390/sclp: sort out physical vs +virtual pointers usage") fixed the notion of virtual +address for sclp_early_sccb pointer. However, it did +not take into account that kasan_early_init() can also +output messages and sclp_early_sccb should be adjusted +by the time kasan_early_init() is called. + +Currently it is not a problem, since virtual and physical +addresses on s390 are the same. Nevertheless, should they +ever differ, this would cause an invalid pointer access. + +Fixes: ada1da31ce34 ("s390/sclp: sort out physical vs virtual pointers usage") +Reviewed-by: Heiko Carstens +Signed-off-by: Alexander Gordeev +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/kernel/early.c | 1 - + arch/s390/kernel/head64.S | 1 + + drivers/s390/char/sclp_early.c | 2 +- + 3 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c +index 6030fdd6..9693c863 100644 +--- a/arch/s390/kernel/early.c ++++ b/arch/s390/kernel/early.c +@@ -288,7 +288,6 @@ static void __init sort_amode31_extable(void) + + void __init startup_init(void) + { +- sclp_early_adjust_va(); + reset_tod_clock(); + check_image_bootable(); + time_early_init(); +diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S +index d7b8b6ad..3b3bf832 100644 +--- a/arch/s390/kernel/head64.S ++++ b/arch/s390/kernel/head64.S +@@ -25,6 +25,7 @@ ENTRY(startup_continue) + larl %r14,init_task + stg %r14,__LC_CURRENT + larl %r15,init_thread_union+THREAD_SIZE-STACK_FRAME_OVERHEAD-__PT_SIZE ++ brasl %r14,sclp_early_adjust_va # allow sclp_early_printk + #ifdef CONFIG_KASAN + brasl %r14,kasan_early_init + #endif +diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c +index c1c70a16..f480d6c7 100644 +--- a/drivers/s390/char/sclp_early.c ++++ b/drivers/s390/char/sclp_early.c +@@ -163,7 +163,7 @@ static void __init sclp_early_console_detect(struct init_sccb *sccb) + sclp.has_linemode = 1; + } + +-void __init sclp_early_adjust_va(void) ++void __init __no_sanitize_address sclp_early_adjust_va(void) + { + sclp_early_sccb = __va((unsigned long)sclp_early_sccb); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-192-s390-vfio-ap-fix-an-error-handling-path-in-vfio.patch b/patches.kernel.org/6.2.3-192-s390-vfio-ap-fix-an-error-handling-path-in-vfio.patch new file mode 100644 index 0000000..237ba74 --- /dev/null +++ b/patches.kernel.org/6.2.3-192-s390-vfio-ap-fix-an-error-handling-path-in-vfio.patch @@ -0,0 +1,60 @@ +From: Christophe JAILLET +Date: Sun, 31 Jul 2022 18:09:14 +0200 +Subject: [PATCH] s390/vfio-ap: fix an error handling path in + vfio_ap_mdev_probe_queue() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 08866d34c7099e981918d34aab5d6a437436628f + +[ Upstream commit 08866d34c7099e981918d34aab5d6a437436628f ] + +The commit in Fixes: has switch the order of a sysfs_create_group() and a +kzalloc(). + +It correctly removed the now useless kfree() but forgot to add a +sysfs_remove_group() in case of (unlikely) memory allocation failure. + +Add it now. + +Fixes: 260f3ea14138 ("s390/vfio-ap: move probe and remove callbacks to vfio_ap_ops.c") +Signed-off-by: Christophe JAILLET +Signed-off-by: Alexander Gordeev +Link: https://lore.kernel.org/r/d0c0a35eec4fa87cb7f3910d8ac4dc0f7dc9008a.1659283738.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/s390/crypto/vfio_ap_ops.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c +index 9c01957e..b0b25bc9 100644 +--- a/drivers/s390/crypto/vfio_ap_ops.c ++++ b/drivers/s390/crypto/vfio_ap_ops.c +@@ -1857,8 +1857,10 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) + return ret; + + q = kzalloc(sizeof(*q), GFP_KERNEL); +- if (!q) +- return -ENOMEM; ++ if (!q) { ++ ret = -ENOMEM; ++ goto err_remove_group; ++ } + + q->apqn = to_ap_queue(&apdev->device)->qid; + q->saved_isc = VFIO_AP_ISC_INVALID; +@@ -1876,6 +1878,10 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) + release_update_locks_for_mdev(matrix_mdev); + + return 0; ++ ++err_remove_group: ++ sysfs_remove_group(&apdev->device.kobj, &vfio_queue_attr_group); ++ return ret; + } + + void vfio_ap_mdev_remove_queue(struct ap_device *apdev) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-193-x86-signal-Fix-the-value-returned-by-strict_sas.patch b/patches.kernel.org/6.2.3-193-x86-signal-Fix-the-value-returned-by-strict_sas.patch new file mode 100644 index 0000000..9b3ebc6 --- /dev/null +++ b/patches.kernel.org/6.2.3-193-x86-signal-Fix-the-value-returned-by-strict_sas.patch @@ -0,0 +1,50 @@ +From: Christophe JAILLET +Date: Sat, 14 Jan 2023 18:33:09 +0100 +Subject: [PATCH] x86/signal: Fix the value returned by strict_sas_size() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ef6dfc4b238a435ab552207ec09e4a82b6426d31 + +[ Upstream commit ef6dfc4b238a435ab552207ec09e4a82b6426d31 ] + +Functions used with __setup() return 1 when the argument has been +successfully parsed. + +Reverse the returned value so that 1 is returned when kstrtobool() is +successful (i.e. returns 0). + +My understanding of these __setup() functions is that returning 1 or 0 +does not change much anyway - so this is more of a cleanup than a +functional fix. + +I spot it and found it spurious while looking at something else. +Even if the output is not perfect, you'll get the idea with: + + $ git grep -B2 -A10 retu.*kstrtobool | grep __setup -B10 + +Fixes: 3aac3ebea08f ("x86/signal: Implement sigaltstack size validation") +Signed-off-by: Christophe JAILLET +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/73882d43ebe420c9d8fb82d0560021722b243000.1673717552.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/signal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c +index 1504eb8d..004cb30b 100644 +--- a/arch/x86/kernel/signal.c ++++ b/arch/x86/kernel/signal.c +@@ -360,7 +360,7 @@ static bool strict_sigaltstack_size __ro_after_init = false; + + static int __init strict_sas_size(char *arg) + { +- return kstrtobool(arg, &strict_sigaltstack_size); ++ return kstrtobool(arg, &strict_sigaltstack_size) == 0; + } + __setup("strict_sas_size", strict_sas_size); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-194-thermal-drivers-tsens-Drop-msm8976-specific-def.patch b/patches.kernel.org/6.2.3-194-thermal-drivers-tsens-Drop-msm8976-specific-def.patch new file mode 100644 index 0000000..356c338 --- /dev/null +++ b/patches.kernel.org/6.2.3-194-thermal-drivers-tsens-Drop-msm8976-specific-def.patch @@ -0,0 +1,53 @@ +From: Dmitry Baryshkov +Date: Sun, 1 Jan 2023 21:40:19 +0200 +Subject: [PATCH] thermal/drivers/tsens: Drop msm8976-specific defines +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3bf0ea99e2e32b0335106b86d84404cc85bcd113 + +[ Upstream commit 3bf0ea99e2e32b0335106b86d84404cc85bcd113 ] + +Drop msm8976-specific defines, which duplicate generic ones. + +Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976") +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230101194034.831222-6-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/thermal/qcom/tsens-v1.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c +index 1d7f8a80..a795b08b 100644 +--- a/drivers/thermal/qcom/tsens-v1.c ++++ b/drivers/thermal/qcom/tsens-v1.c +@@ -78,11 +78,6 @@ + + #define MSM8976_CAL_SEL_MASK 0x3 + +-#define MSM8976_CAL_DEGC_PT1 30 +-#define MSM8976_CAL_DEGC_PT2 120 +-#define MSM8976_SLOPE_FACTOR 1000 +-#define MSM8976_SLOPE_DEFAULT 3200 +- + /* eeprom layout data for qcs404/405 (v1) */ + #define BASE0_MASK 0x000007f8 + #define BASE1_MASK 0x0007f800 +@@ -160,8 +155,8 @@ static void compute_intercept_slope_8976(struct tsens_priv *priv, + priv->sensor[10].slope = 3286; + + for (i = 0; i < priv->num_sensors; i++) { +- priv->sensor[i].offset = (p1[i] * MSM8976_SLOPE_FACTOR) - +- (MSM8976_CAL_DEGC_PT1 * ++ priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) - ++ (CAL_DEGC_PT1 * + priv->sensor[i].slope); + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-195-thermal-drivers-tsens-Sort-out-msm8976-vs-msm89.patch b/patches.kernel.org/6.2.3-195-thermal-drivers-tsens-Sort-out-msm8976-vs-msm89.patch new file mode 100644 index 0000000..410b34f --- /dev/null +++ b/patches.kernel.org/6.2.3-195-thermal-drivers-tsens-Sort-out-msm8976-vs-msm89.patch @@ -0,0 +1,157 @@ +From: Dmitry Baryshkov +Date: Sun, 1 Jan 2023 21:40:20 +0200 +Subject: [PATCH] thermal/drivers/tsens: Sort out msm8976 vs msm8956 data +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a7d3006be5ca7b04e4b84b5ceaae55a700e511bd + +[ Upstream commit a7d3006be5ca7b04e4b84b5ceaae55a700e511bd ] + +Tsens driver mentions that msm8976 data should be used for both msm8976 +and msm8956 SoCs. This is not quite correct, as according to the +vendor kernels, msm8976 should use standard slope values (3200), while +msm8956 really uses the slope values found in the driver. + +Add separate compatibility string for msm8956, move slope value +overrides to the corresponding init function and use the standard +compute_intercept_slope() function for both platforms. + +Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976") +Cc: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230101194034.831222-7-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/thermal/qcom/tsens-v1.c | 56 ++++++++++++++++++--------------- + drivers/thermal/qcom/tsens.c | 3 ++ + drivers/thermal/qcom/tsens.h | 2 +- + 3 files changed, 34 insertions(+), 27 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c +index a795b08b..9c443a2f 100644 +--- a/drivers/thermal/qcom/tsens-v1.c ++++ b/drivers/thermal/qcom/tsens-v1.c +@@ -137,30 +137,6 @@ + #define CAL_SEL_MASK 7 + #define CAL_SEL_SHIFT 0 + +-static void compute_intercept_slope_8976(struct tsens_priv *priv, +- u32 *p1, u32 *p2, u32 mode) +-{ +- int i; +- +- priv->sensor[0].slope = 3313; +- priv->sensor[1].slope = 3275; +- priv->sensor[2].slope = 3320; +- priv->sensor[3].slope = 3246; +- priv->sensor[4].slope = 3279; +- priv->sensor[5].slope = 3257; +- priv->sensor[6].slope = 3234; +- priv->sensor[7].slope = 3269; +- priv->sensor[8].slope = 3255; +- priv->sensor[9].slope = 3239; +- priv->sensor[10].slope = 3286; +- +- for (i = 0; i < priv->num_sensors; i++) { +- priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) - +- (CAL_DEGC_PT1 * +- priv->sensor[i].slope); +- } +-} +- + static int calibrate_v1(struct tsens_priv *priv) + { + u32 base0 = 0, base1 = 0; +@@ -286,7 +262,7 @@ static int calibrate_8976(struct tsens_priv *priv) + break; + } + +- compute_intercept_slope_8976(priv, p1, p2, mode); ++ compute_intercept_slope(priv, p1, p2, mode); + kfree(qfprom_cdata); + + return 0; +@@ -360,6 +336,22 @@ static const struct reg_field tsens_v1_regfields[MAX_REGFIELDS] = { + [TRDY] = REG_FIELD(TM_TRDY_OFF, 0, 0), + }; + ++static int __init init_8956(struct tsens_priv *priv) { ++ priv->sensor[0].slope = 3313; ++ priv->sensor[1].slope = 3275; ++ priv->sensor[2].slope = 3320; ++ priv->sensor[3].slope = 3246; ++ priv->sensor[4].slope = 3279; ++ priv->sensor[5].slope = 3257; ++ priv->sensor[6].slope = 3234; ++ priv->sensor[7].slope = 3269; ++ priv->sensor[8].slope = 3255; ++ priv->sensor[9].slope = 3239; ++ priv->sensor[10].slope = 3286; ++ ++ return init_common(priv); ++} ++ + static const struct tsens_ops ops_generic_v1 = { + .init = init_common, + .calibrate = calibrate_v1, +@@ -372,13 +364,25 @@ struct tsens_plat_data data_tsens_v1 = { + .fields = tsens_v1_regfields, + }; + ++static const struct tsens_ops ops_8956 = { ++ .init = init_8956, ++ .calibrate = calibrate_8976, ++ .get_temp = get_temp_tsens_valid, ++}; ++ ++struct tsens_plat_data data_8956 = { ++ .num_sensors = 11, ++ .ops = &ops_8956, ++ .feat = &tsens_v1_feat, ++ .fields = tsens_v1_regfields, ++}; ++ + static const struct tsens_ops ops_8976 = { + .init = init_common, + .calibrate = calibrate_8976, + .get_temp = get_temp_tsens_valid, + }; + +-/* Valid for both MSM8956 and MSM8976. */ + struct tsens_plat_data data_8976 = { + .num_sensors = 11, + .ops = &ops_8976, +diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c +index b5b136ff..b191e19d 100644 +--- a/drivers/thermal/qcom/tsens.c ++++ b/drivers/thermal/qcom/tsens.c +@@ -983,6 +983,9 @@ static const struct of_device_id tsens_table[] = { + }, { + .compatible = "qcom,msm8939-tsens", + .data = &data_8939, ++ }, { ++ .compatible = "qcom,msm8956-tsens", ++ .data = &data_8956, + }, { + .compatible = "qcom,msm8960-tsens", + .data = &data_8960, +diff --git a/drivers/thermal/qcom/tsens.h b/drivers/thermal/qcom/tsens.h +index 899af128..7dd5fc24 100644 +--- a/drivers/thermal/qcom/tsens.h ++++ b/drivers/thermal/qcom/tsens.h +@@ -594,7 +594,7 @@ extern struct tsens_plat_data data_8960; + extern struct tsens_plat_data data_8916, data_8939, data_8974, data_9607; + + /* TSENS v1 targets */ +-extern struct tsens_plat_data data_tsens_v1, data_8976; ++extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956; + + /* TSENS v2 targets */ + extern struct tsens_plat_data data_8996, data_ipq8074, data_tsens_v2; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-196-thermal-drivers-tsens-fix-slope-values-for-msm8.patch b/patches.kernel.org/6.2.3-196-thermal-drivers-tsens-fix-slope-values-for-msm8.patch new file mode 100644 index 0000000..577d931 --- /dev/null +++ b/patches.kernel.org/6.2.3-196-thermal-drivers-tsens-fix-slope-values-for-msm8.patch @@ -0,0 +1,66 @@ +From: Dmitry Baryshkov +Date: Sun, 1 Jan 2023 21:40:21 +0200 +Subject: [PATCH] thermal/drivers/tsens: fix slope values for msm8939 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5aec3b035e0cbf3f042c2a03d654e5ad6748feb7 + +[ Upstream commit 5aec3b035e0cbf3f042c2a03d654e5ad6748feb7 ] + +According to the vendor kernels (msm-3.10, 3.14 and 3.18), msm8939 +uses non-standard slope values for calibrating the sensors. Fill them +accordingly. + +Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939") +Cc: Bryan O'Donoghue +Cc: Shawn Guo +Reviewed-by: Konrad Dybcio +Acked-by: Shawn Guo +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20230101194034.831222-8-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/thermal/qcom/tsens-v0_1.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c +index 04d012e4..af265903 100644 +--- a/drivers/thermal/qcom/tsens-v0_1.c ++++ b/drivers/thermal/qcom/tsens-v0_1.c +@@ -534,6 +534,21 @@ static int calibrate_9607(struct tsens_priv *priv) + return 0; + } + ++static int __init init_8939(struct tsens_priv *priv) { ++ priv->sensor[0].slope = 2911; ++ priv->sensor[1].slope = 2789; ++ priv->sensor[2].slope = 2906; ++ priv->sensor[3].slope = 2763; ++ priv->sensor[4].slope = 2922; ++ priv->sensor[5].slope = 2867; ++ priv->sensor[6].slope = 2833; ++ priv->sensor[7].slope = 2838; ++ priv->sensor[8].slope = 2840; ++ priv->sensor[9].slope = 2852; ++ ++ return init_common(priv); ++} ++ + /* v0.1: 8916, 8939, 8974, 9607 */ + + static struct tsens_features tsens_v0_1_feat = { +@@ -599,7 +614,7 @@ struct tsens_plat_data data_8916 = { + }; + + static const struct tsens_ops ops_8939 = { +- .init = init_common, ++ .init = init_8939, + .calibrate = calibrate_8939, + .get_temp = get_temp_common, + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-197-thermal-drivers-tsens-limit-num_sensors-to-9-fo.patch b/patches.kernel.org/6.2.3-197-thermal-drivers-tsens-limit-num_sensors-to-9-fo.patch new file mode 100644 index 0000000..bee0620 --- /dev/null +++ b/patches.kernel.org/6.2.3-197-thermal-drivers-tsens-limit-num_sensors-to-9-fo.patch @@ -0,0 +1,97 @@ +From: Dmitry Baryshkov +Date: Sun, 1 Jan 2023 21:40:22 +0200 +Subject: [PATCH] thermal/drivers/tsens: limit num_sensors to 9 for msm8939 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 903238a33c116edf5f64f7a3fd246e6169cccfa6 + +[ Upstream commit 903238a33c116edf5f64f7a3fd246e6169cccfa6 ] + +On msm8939 last (hwid=10) sensor was added in the hw revision 3.0. +Calibration data for it was placed outside of the main calibration data +blob, so it is not accessible by the current blob-parsing code. + +Moreover data for the sensor's p2 is not contiguous in the fuses. This +makes it hard to use nvmem_cell API to parse calibration data in a +generic way. + +Since the sensor doesn't seem to be actually used by the existing +hardware, disable the sensor for now. + +Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939") +Cc: Bryan O'Donoghue +Cc: Shawn Guo +Acked-by: Shawn Guo +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20230101194034.831222-9-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/thermal/qcom/tsens-v0_1.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c +index af265903..3158f13c 100644 +--- a/drivers/thermal/qcom/tsens-v0_1.c ++++ b/drivers/thermal/qcom/tsens-v0_1.c +@@ -285,7 +285,7 @@ static int calibrate_8939(struct tsens_priv *priv) + u32 p1[10], p2[10]; + int mode = 0; + u32 *qfprom_cdata; +- u32 cdata[6]; ++ u32 cdata[4]; + + qfprom_cdata = (u32 *)qfprom_read(priv->dev, "calib"); + if (IS_ERR(qfprom_cdata)) +@@ -296,8 +296,6 @@ static int calibrate_8939(struct tsens_priv *priv) + cdata[1] = qfprom_cdata[13]; + cdata[2] = qfprom_cdata[0]; + cdata[3] = qfprom_cdata[1]; +- cdata[4] = qfprom_cdata[22]; +- cdata[5] = qfprom_cdata[21]; + + mode = (cdata[0] & MSM8939_CAL_SEL_MASK) >> MSM8939_CAL_SEL_SHIFT; + dev_dbg(priv->dev, "calibration mode is %d\n", mode); +@@ -314,8 +312,6 @@ static int calibrate_8939(struct tsens_priv *priv) + p2[6] = (cdata[2] & MSM8939_S6_P2_MASK) >> MSM8939_S6_P2_SHIFT; + p2[7] = (cdata[3] & MSM8939_S7_P2_MASK) >> MSM8939_S7_P2_SHIFT; + p2[8] = (cdata[3] & MSM8939_S8_P2_MASK) >> MSM8939_S8_P2_SHIFT; +- p2[9] = (cdata[4] & MSM8939_S9_P2_MASK_0_4) >> MSM8939_S9_P2_SHIFT_0_4; +- p2[9] |= ((cdata[5] & MSM8939_S9_P2_MASK_5) >> MSM8939_S9_P2_SHIFT_5) << 5; + for (i = 0; i < priv->num_sensors; i++) + p2[i] = (base1 + p2[i]) << 2; + fallthrough; +@@ -331,7 +327,6 @@ static int calibrate_8939(struct tsens_priv *priv) + p1[6] = (cdata[2] & MSM8939_S6_P1_MASK) >> MSM8939_S6_P1_SHIFT; + p1[7] = (cdata[3] & MSM8939_S7_P1_MASK) >> MSM8939_S7_P1_SHIFT; + p1[8] = (cdata[3] & MSM8939_S8_P1_MASK) >> MSM8939_S8_P1_SHIFT; +- p1[9] = (cdata[4] & MSM8939_S9_P1_MASK) >> MSM8939_S9_P1_SHIFT; + for (i = 0; i < priv->num_sensors; i++) + p1[i] = ((base0) + p1[i]) << 2; + break; +@@ -544,7 +539,7 @@ static int __init init_8939(struct tsens_priv *priv) { + priv->sensor[6].slope = 2833; + priv->sensor[7].slope = 2838; + priv->sensor[8].slope = 2840; +- priv->sensor[9].slope = 2852; ++ /* priv->sensor[9].slope = 2852; */ + + return init_common(priv); + } +@@ -620,9 +615,9 @@ static const struct tsens_ops ops_8939 = { + }; + + struct tsens_plat_data data_8939 = { +- .num_sensors = 10, ++ .num_sensors = 9, + .ops = &ops_8939, +- .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, 10 }, ++ .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, /* 10 */ }, + + .feat = &tsens_v0_1_feat, + .fields = tsens_v0_1_regfields, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-198-wifi-rtw89-fix-potential-leak-in-rtw89_append_p.patch b/patches.kernel.org/6.2.3-198-wifi-rtw89-fix-potential-leak-in-rtw89_append_p.patch new file mode 100644 index 0000000..bf62d08 --- /dev/null +++ b/patches.kernel.org/6.2.3-198-wifi-rtw89-fix-potential-leak-in-rtw89_append_p.patch @@ -0,0 +1,42 @@ +From: Zong-Zhe Yang +Date: Tue, 3 Jan 2023 22:10:54 +0800 +Subject: [PATCH] wifi: rtw89: fix potential leak in + rtw89_append_probe_req_ie() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4a0e218cc9c42d1903ade8b5a371dcf48cf918c5 + +[ Upstream commit 4a0e218cc9c42d1903ade8b5a371dcf48cf918c5 ] + +Do `kfree_skb(new)` before `goto out` to prevent potential leak. + +Fixes: 895907779752 ("rtw89: 8852a: add ieee80211_ops::hw_scan") +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230103141054.17372-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw89/fw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c +index de1f2377..3b7af8fa 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.c ++++ b/drivers/net/wireless/realtek/rtw89/fw.c +@@ -2665,8 +2665,10 @@ static int rtw89_append_probe_req_ie(struct rtw89_dev *rtwdev, + + list_add_tail(&info->list, &scan_info->pkt_list[band]); + ret = rtw89_fw_h2c_add_pkt_offload(rtwdev, &info->id, new); +- if (ret) ++ if (ret) { ++ kfree_skb(new); + goto out; ++ } + + kfree_skb(new); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-199-wifi-rtw89-Add-missing-check-for-alloc_workqueu.patch b/patches.kernel.org/6.2.3-199-wifi-rtw89-Add-missing-check-for-alloc_workqueu.patch new file mode 100644 index 0000000..7b6950d --- /dev/null +++ b/patches.kernel.org/6.2.3-199-wifi-rtw89-Add-missing-check-for-alloc_workqueu.patch @@ -0,0 +1,49 @@ +From: Jiasheng Jiang +Date: Wed, 4 Jan 2023 22:29:01 +0800 +Subject: [PATCH] wifi: rtw89: Add missing check for alloc_workqueue +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ed9e6166eb0984b718facb7ca59296098cc3aa64 + +[ Upstream commit ed9e6166eb0984b718facb7ca59296098cc3aa64 ] + +Add check for the return value of alloc_workqueue since it may return +NULL pointer. +Moreover, add destroy_workqueue when rtw89_load_firmware fails. + +Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") +Signed-off-by: Jiasheng Jiang +Acked-by: Ping-Ke Shih +Reviewed-by: Leon Romanovsky +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104142901.1611-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw89/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index 931aff8b..e99eccf1 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -3124,6 +3124,8 @@ int rtw89_core_init(struct rtw89_dev *rtwdev) + INIT_DELAYED_WORK(&rtwdev->cfo_track_work, rtw89_phy_cfo_track_work); + INIT_DELAYED_WORK(&rtwdev->forbid_ba_work, rtw89_forbid_ba_work); + rtwdev->txq_wq = alloc_workqueue("rtw89_tx_wq", WQ_UNBOUND | WQ_HIGHPRI, 0); ++ if (!rtwdev->txq_wq) ++ return -ENOMEM; + spin_lock_init(&rtwdev->ba_lock); + spin_lock_init(&rtwdev->rpwm_lock); + mutex_init(&rtwdev->mutex); +@@ -3149,6 +3151,7 @@ int rtw89_core_init(struct rtw89_dev *rtwdev) + ret = rtw89_load_firmware(rtwdev); + if (ret) { + rtw89_warn(rtwdev, "no firmware loaded\n"); ++ destroy_workqueue(rtwdev->txq_wq); + return ret; + } + rtw89_ser_init(rtwdev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-200-wifi-rtl8xxxu-Fix-memory-leaks-with-RTL8723BU-R.patch b/patches.kernel.org/6.2.3-200-wifi-rtl8xxxu-Fix-memory-leaks-with-RTL8723BU-R.patch new file mode 100644 index 0000000..135b031 --- /dev/null +++ b/patches.kernel.org/6.2.3-200-wifi-rtl8xxxu-Fix-memory-leaks-with-RTL8723BU-R.patch @@ -0,0 +1,77 @@ +From: Bitterblue Smith +Date: Thu, 22 Dec 2022 13:48:04 +0200 +Subject: [PATCH] wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b39f662ce1648db0b9de32e6a849b098480793cb + +[ Upstream commit b39f662ce1648db0b9de32e6a849b098480793cb ] + +The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?) +when it's connected to a bluetooth audio device. The busy bluetooth +traffic generates lots of C2H (card to host) messages, which are not +freed correctly. + +To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback() +inside the loop where skb_dequeue() is called. + +The RTL8192EU leaks memory because the C2H messages are added to the +queue and left there forever. (This was fine in the past because it +probably wasn't sending any C2H messages until commit e542e66b7c2e +("wifi: rtl8xxxu: gen2: Turn on the rate control"). Since that commit +it sends a C2H message when the TX rate changes.) + +To fix this, delete the check for rf_paths > 1 and the goto. Let the +function process the C2H messages from RTL8192EU like the ones from +the other chips. + +Theoretically the RTL8188FU could also leak like RTL8723BU, but it +most likely doesn't send C2H messages frequently enough. + +This change was tested with RTL8723BU by Erhard F. I tested it with +RTL8188FU and RTL8192EU. + +Reported-by: Erhard F. +Tested-by: Erhard F. +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215197 +Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna") +Signed-off-by: Bitterblue Smith +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/03b099c1-c671-d252-36f4-57b70d721f9d@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index c8b82c58..75d393b5 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5552,9 +5552,6 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work) + btcoex = &priv->bt_coex; + rarpt = &priv->ra_report; + +- if (priv->rf_paths > 1) +- goto out; +- + while (!skb_queue_empty(&priv->c2hcmd_queue)) { + skb = skb_dequeue(&priv->c2hcmd_queue); + +@@ -5587,10 +5584,9 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work) + default: + break; + } +- } + +-out: +- dev_kfree_skb(skb); ++ dev_kfree_skb(skb); ++ } + } + + static void rtl8723bu_handle_c2h(struct rtl8xxxu_priv *priv, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-201-wifi-orinoco-check-return-value-of-hermes_write.patch b/patches.kernel.org/6.2.3-201-wifi-orinoco-check-return-value-of-hermes_write.patch new file mode 100644 index 0000000..5869af3 --- /dev/null +++ b/patches.kernel.org/6.2.3-201-wifi-orinoco-check-return-value-of-hermes_write.patch @@ -0,0 +1,44 @@ +From: Alexey Kodanev +Date: Tue, 27 Dec 2022 16:33:06 +0300 +Subject: [PATCH] wifi: orinoco: check return value of hermes_write_wordrec() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1e346cbb096a5351a637ec1992beffbf330547f0 + +[ Upstream commit 1e346cbb096a5351a637ec1992beffbf330547f0 ] + +There is currently no return check for writing an authentication +type (HERMES_AUTH_SHARED_KEY or HERMES_AUTH_OPEN). It looks like +it was accidentally skipped. + +This patch adds a return check similar to the other checks in +__orinoco_hw_setup_enc() for hermes_write_wordrec(). + +Detected using the static analysis tool - Svace. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Alexey Kodanev +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221227133306.201356-1-aleksei.kodanev@bell-sw.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/intersil/orinoco/hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intersil/orinoco/hw.c b/drivers/net/wireless/intersil/orinoco/hw.c +index 0aea35c9..4fcca08e 100644 +--- a/drivers/net/wireless/intersil/orinoco/hw.c ++++ b/drivers/net/wireless/intersil/orinoco/hw.c +@@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv) + err = hermes_write_wordrec(hw, USER_BAP, + HERMES_RID_CNFAUTHENTICATION_AGERE, + auth_flag); ++ if (err) ++ return err; + } + err = hermes_write_wordrec(hw, USER_BAP, + HERMES_RID_CNFWEPENABLED_AGERE, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-202-wifi-rtw88-Use-rtw_iterate_vifs-for-rtw_vif_wat.patch b/patches.kernel.org/6.2.3-202-wifi-rtw88-Use-rtw_iterate_vifs-for-rtw_vif_wat.patch new file mode 100644 index 0000000..05bd0cc --- /dev/null +++ b/patches.kernel.org/6.2.3-202-wifi-rtw88-Use-rtw_iterate_vifs-for-rtw_vif_wat.patch @@ -0,0 +1,50 @@ +From: Martin Blumenstingl +Date: Sun, 8 Jan 2023 22:13:23 +0100 +Subject: [PATCH] wifi: rtw88: Use rtw_iterate_vifs() for + rtw_vif_watch_dog_iter() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 313f6dc7c5ed723d0c5691553eff4c0090f16bb8 + +[ Upstream commit 313f6dc7c5ed723d0c5691553eff4c0090f16bb8 ] + +USB and (upcoming) SDIO support may sleep in the read/write handlers. +Make rtw_watch_dog_work() use rtw_iterate_vifs() to prevent "scheduling +while atomic" or "Voluntary context switch within RCU read-side +critical section!" warnings when accessing the registers using an SDIO +card (which is where this issue has been spotted in the real world but +it also affects USB cards). + +Fixes: 78d5bf925f30 ("wifi: rtw88: iterate over vif/sta list non-atomically") +Suggested-by: Ping-Ke Shih +Reviewed-by: Ping-Ke Shih +Tested-by: Sascha Hauer +Signed-off-by: Martin Blumenstingl +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230108211324.442823-3-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw88/main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 888427cf..b2e78737 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -241,8 +241,10 @@ static void rtw_watch_dog_work(struct work_struct *work) + rtw_phy_dynamic_mechanism(rtwdev); + + data.rtwdev = rtwdev; +- /* use atomic version to avoid taking local->iflist_mtx mutex */ +- rtw_iterate_vifs_atomic(rtwdev, rtw_vif_watch_dog_iter, &data); ++ /* rtw_iterate_vifs internally uses an atomic iterator which is needed ++ * to avoid taking local->iflist_mtx mutex ++ */ ++ rtw_iterate_vifs(rtwdev, rtw_vif_watch_dog_iter, &data); + + /* fw supports only one station associated to enter lps, if there are + * more than two stations associated to the AP, then we can not enter +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-203-wifi-rtw88-Use-non-atomic-sta-iterator-in-rtw_r.patch b/patches.kernel.org/6.2.3-203-wifi-rtw88-Use-non-atomic-sta-iterator-in-rtw_r.patch new file mode 100644 index 0000000..ca9a1e0 --- /dev/null +++ b/patches.kernel.org/6.2.3-203-wifi-rtw88-Use-non-atomic-sta-iterator-in-rtw_r.patch @@ -0,0 +1,58 @@ +From: Martin Blumenstingl +Date: Sun, 8 Jan 2023 22:13:24 +0100 +Subject: [PATCH] wifi: rtw88: Use non-atomic sta iterator in + rtw_ra_mask_info_update() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2931978cd74f4a643deeea5b211523001d95aa44 + +[ Upstream commit 2931978cd74f4a643deeea5b211523001d95aa44 ] + +USB and (upcoming) SDIO support may sleep in the read/write handlers. +Use non-atomic rtw_iterate_stas() in rtw_ra_mask_info_update() because +the iterator function rtw_ra_mask_info_update_iter() needs to read and +write registers from within rtw_update_sta_info(). Using the non-atomic +iterator ensures that we can sleep during USB and SDIO register reads +and writes. This fixes "scheduling while atomic" or "Voluntary context +switch within RCU read-side critical section!" warnings as seen by SDIO +card users (but it also affects USB cards). + +Fixes: 78d5bf925f30 ("wifi: rtw88: iterate over vif/sta list non-atomically") +Suggested-by: Ping-Ke Shih +Reviewed-by: Ping-Ke Shih +Tested-by: Sascha Hauer +Signed-off-by: Martin Blumenstingl +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230108211324.442823-4-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw88/mac80211.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c +index 776a9a98..3b92ac61 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c +@@ -737,7 +737,7 @@ static void rtw_ra_mask_info_update(struct rtw_dev *rtwdev, + br_data.rtwdev = rtwdev; + br_data.vif = vif; + br_data.mask = mask; +- rtw_iterate_stas_atomic(rtwdev, rtw_ra_mask_info_update_iter, &br_data); ++ rtw_iterate_stas(rtwdev, rtw_ra_mask_info_update_iter, &br_data); + } + + static int rtw_ops_set_bitrate_mask(struct ieee80211_hw *hw, +@@ -746,7 +746,9 @@ static int rtw_ops_set_bitrate_mask(struct ieee80211_hw *hw, + { + struct rtw_dev *rtwdev = hw->priv; + ++ mutex_lock(&rtwdev->mutex); + rtw_ra_mask_info_update(rtwdev, vif, mask); ++ mutex_unlock(&rtwdev->mutex); + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-204-thermal-drivers-imx_sc_thermal-Fix-the-loop-con.patch b/patches.kernel.org/6.2.3-204-thermal-drivers-imx_sc_thermal-Fix-the-loop-con.patch new file mode 100644 index 0000000..e31f2db --- /dev/null +++ b/patches.kernel.org/6.2.3-204-thermal-drivers-imx_sc_thermal-Fix-the-loop-con.patch @@ -0,0 +1,48 @@ +From: Viorel Suman +Date: Tue, 17 Jan 2023 11:19:55 +0200 +Subject: [PATCH] thermal/drivers/imx_sc_thermal: Fix the loop condition +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4b26b7c9cdefdcb478047c30901d2379ef9e50fc + +[ Upstream commit 4b26b7c9cdefdcb478047c30901d2379ef9e50fc ] + +The minimal resource ID is 0: IMX_SC_R_AP_0=0, so fix +the loop condition. Aside of this - constify the array. + +Fixes: 31fd4b9db13b ("thermal/drivers/imx_sc: Rely on the platform data to get the resource id") +Signed-off-by: Viorel Suman +Reviewed-by: Dong Aisheng +Link: https://lore.kernel.org/r/20230117091956.61729-1-viorel.suman@oss.nxp.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/thermal/imx_sc_thermal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/thermal/imx_sc_thermal.c b/drivers/thermal/imx_sc_thermal.c +index 4df925e3..dfadb035 100644 +--- a/drivers/thermal/imx_sc_thermal.c ++++ b/drivers/thermal/imx_sc_thermal.c +@@ -88,7 +88,7 @@ static int imx_sc_thermal_probe(struct platform_device *pdev) + if (!resource_id) + return -EINVAL; + +- for (i = 0; resource_id[i] > 0; i++) { ++ for (i = 0; resource_id[i] >= 0; i++) { + + sensor = devm_kzalloc(&pdev->dev, sizeof(*sensor), GFP_KERNEL); + if (!sensor) +@@ -127,7 +127,7 @@ static int imx_sc_thermal_probe(struct platform_device *pdev) + return 0; + } + +-static int imx_sc_sensors[] = { IMX_SC_R_SYSTEM, IMX_SC_R_PMIC_0, -1 }; ++static const int imx_sc_sensors[] = { IMX_SC_R_SYSTEM, IMX_SC_R_PMIC_0, -1 }; + + static const struct of_device_id imx_sc_thermal_table[] = { + { .compatible = "fsl,imx-sc-thermal", .data = imx_sc_sensors }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-205-wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg.patch b/patches.kernel.org/6.2.3-205-wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg.patch new file mode 100644 index 0000000..c743caa --- /dev/null +++ b/patches.kernel.org/6.2.3-205-wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg.patch @@ -0,0 +1,59 @@ +From: Fedor Pchelkin +Date: Wed, 4 Jan 2023 15:35:46 +0300 +Subject: [PATCH] wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there + is no callback function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 + +[ Upstream commit 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 ] + +It is stated that ath9k_htc_rx_msg() either frees the provided skb or +passes its management to another callback function. However, the skb is +not freed in case there is no another callback function, and Syzkaller was +able to cause a memory leak. Also minor comment fix. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Reported-by: syzbot+e008dccab31bd3647609@syzkaller.appspotmail.com +Reported-by: syzbot+6692c72009680f7c4eb2@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104123546.51427-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index ca05b07a..fe62ff66 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -391,7 +391,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle, + * HTC Messages are handled directly here and the obtained SKB + * is freed. + * +- * Service messages (Data, WMI) passed to the corresponding ++ * Service messages (Data, WMI) are passed to the corresponding + * endpoint RX handlers, which have to free the SKB. + */ + void ath9k_htc_rx_msg(struct htc_target *htc_handle, +@@ -478,6 +478,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle, + if (endpoint->ep_callbacks.rx) + endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv, + skb, epid); ++ else ++ goto invalid; + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-206-wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_u.patch b/patches.kernel.org/6.2.3-206-wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_u.patch new file mode 100644 index 0000000..87bbc61 --- /dev/null +++ b/patches.kernel.org/6.2.3-206-wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_u.patch @@ -0,0 +1,126 @@ +From: Fedor Pchelkin +Date: Wed, 4 Jan 2023 15:36:15 +0300 +Subject: [PATCH] wifi: ath9k: hif_usb: clean up skbs if + ath9k_hif_usb_rx_stream() fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0af54343a76263a12dbae7fafb64eb47c4a6ad38 + +[ Upstream commit 0af54343a76263a12dbae7fafb64eb47c4a6ad38 ] + +Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). +While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated +skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we +have an incorrect pkt_len or pkt_tag, the input skb is considered invalid +and dropped. All the associated packets already in skb_pool should be +dropped and freed. Added a comment describing this issue. + +The patch also makes remain_skb NULL after being processed so that it +cannot be referenced after potential free. The initialization of hif_dev +fields which are associated with remain_skb (rx_remain_len, +rx_transfer_len and rx_pad_len) is moved after a new remain_skb is +allocated. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: 6ce708f54cc8 ("ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream") +Fixes: 44b23b488d44 ("ath9k: hif_usb: Reduce indent 1 column") +Reported-by: syzbot+e9632e3eb038d93d6bc6@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104123615.51511-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 31 +++++++++++++++++------- + 1 file changed, 22 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index 1a2e0c7e..de6c0824 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -561,11 +561,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + memcpy(ptr, skb->data, rx_remain_len); + + rx_pkt_len += rx_remain_len; +- hif_dev->rx_remain_len = 0; + skb_put(remain_skb, rx_pkt_len); + + skb_pool[pool_index++] = remain_skb; +- ++ hif_dev->remain_skb = NULL; ++ hif_dev->rx_remain_len = 0; + } else { + index = rx_remain_len; + } +@@ -584,16 +584,21 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + pkt_len = get_unaligned_le16(ptr + index); + pkt_tag = get_unaligned_le16(ptr + index + 2); + ++ /* It is supposed that if we have an invalid pkt_tag or ++ * pkt_len then the whole input SKB is considered invalid ++ * and dropped; the associated packets already in skb_pool ++ * are dropped, too. ++ */ + if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) { + RX_STAT_INC(hif_dev, skb_dropped); +- return; ++ goto invalid_pkt; + } + + if (pkt_len > 2 * MAX_RX_BUF_SIZE) { + dev_err(&hif_dev->udev->dev, + "ath9k_htc: invalid pkt_len (%x)\n", pkt_len); + RX_STAT_INC(hif_dev, skb_dropped); +- return; ++ goto invalid_pkt; + } + + pad_len = 4 - (pkt_len & 0x3); +@@ -605,11 +610,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + + if (index > MAX_RX_BUF_SIZE) { + spin_lock(&hif_dev->rx_lock); +- hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE; +- hif_dev->rx_transfer_len = +- MAX_RX_BUF_SIZE - chk_idx - 4; +- hif_dev->rx_pad_len = pad_len; +- + nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC); + if (!nskb) { + dev_err(&hif_dev->udev->dev, +@@ -617,6 +617,12 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + spin_unlock(&hif_dev->rx_lock); + goto err; + } ++ ++ hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE; ++ hif_dev->rx_transfer_len = ++ MAX_RX_BUF_SIZE - chk_idx - 4; ++ hif_dev->rx_pad_len = pad_len; ++ + skb_reserve(nskb, 32); + RX_STAT_INC(hif_dev, skb_allocated); + +@@ -654,6 +660,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + skb_pool[i]->len, USB_WLAN_RX_PIPE); + RX_STAT_INC(hif_dev, skb_completed); + } ++ return; ++invalid_pkt: ++ for (i = 0; i < pool_index; i++) { ++ dev_kfree_skb_any(skb_pool[i]); ++ RX_STAT_INC(hif_dev, skb_dropped); ++ } ++ return; + } + + static void ath9k_hif_usb_rx_cb(struct urb *urb) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-207-wifi-ath9k-Fix-potential-stack-out-of-bounds-wr.patch b/patches.kernel.org/6.2.3-207-wifi-ath9k-Fix-potential-stack-out-of-bounds-wr.patch new file mode 100644 index 0000000..2041ab7 --- /dev/null +++ b/patches.kernel.org/6.2.3-207-wifi-ath9k-Fix-potential-stack-out-of-bounds-wr.patch @@ -0,0 +1,63 @@ +From: Minsuk Kang +Date: Wed, 4 Jan 2023 21:41:30 +0900 +Subject: [PATCH] wifi: ath9k: Fix potential stack-out-of-bounds write in + ath9k_wmi_rsp_callback() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8a2f35b9830692f7a616f2f627f943bc748af13a + +[ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ] + +Fix a stack-out-of-bounds write that occurs in a WMI response callback +function that is called after a timeout occurs in ath9k_wmi_cmd(). +The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that +could no longer be valid when a timeout occurs. Set wmi->last_seq_id to +0 when a timeout occurred. + +Found by a modified version of syzkaller. + +BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx +Write of size 4 +Call Trace: + memcpy + ath9k_wmi_ctrl_rx + ath9k_htc_rx_msg + ath9k_hif_usb_reg_in_cb + __usb_hcd_giveback_urb + usb_hcd_giveback_urb + dummy_timer + call_timer_fn + run_timer_softirq + __do_softirq + irq_exit_rcu + sysvec_apic_timer_interrupt + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Minsuk Kang +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104124130.10996-1-linuxlovemin@yonsei.ac.kr +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/ath/ath9k/wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index f315c54b..19345b8f7 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -341,6 +341,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + if (!time_left) { + ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", + wmi_cmd_to_name(cmd_id)); ++ wmi->last_seq_id = 0; + mutex_unlock(&wmi->op_mutex); + return -ETIMEDOUT; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-208-wifi-ath11k-Fix-memory-leak-in-ath11k_peer_rx_f.patch b/patches.kernel.org/6.2.3-208-wifi-ath11k-Fix-memory-leak-in-ath11k_peer_rx_f.patch new file mode 100644 index 0000000..4147388 --- /dev/null +++ b/patches.kernel.org/6.2.3-208-wifi-ath11k-Fix-memory-leak-in-ath11k_peer_rx_f.patch @@ -0,0 +1,39 @@ +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 12:11:42 +0400 +Subject: [PATCH] wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ed3f83b3459a67a3ab9d806490ac304b567b1c2d + +[ Upstream commit ed3f83b3459a67a3ab9d806490ac304b567b1c2d ] + +crypto_alloc_shash() allocates resources, which should be released by +crypto_free_shash(). When ath11k_peer_find() fails, there has memory +leak. Add missing crypto_free_shash() to fix this. + +Fixes: 243874c64c81 ("ath11k: handle RX fragments") +Signed-off-by: Miaoqian Lin +Reviewed-by: Leon Romanovsky +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230102081142.3937570-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/ath/ath11k/dp_rx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index c5a4c34d..0c53d882 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -3126,6 +3126,7 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id + if (!peer) { + ath11k_warn(ab, "failed to find the peer to set up fragment info\n"); + spin_unlock_bh(&ab->base_lock); ++ crypto_free_shash(tfm); + return -ENOENT; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-209-wifi-cfg80211-Fix-extended-KCK-key-length-check.patch b/patches.kernel.org/6.2.3-209-wifi-cfg80211-Fix-extended-KCK-key-length-check.patch new file mode 100644 index 0000000..461bba0 --- /dev/null +++ b/patches.kernel.org/6.2.3-209-wifi-cfg80211-Fix-extended-KCK-key-length-check.patch @@ -0,0 +1,43 @@ +From: Shivani Baranwal +Date: Tue, 6 Dec 2022 20:07:14 +0530 +Subject: [PATCH] wifi: cfg80211: Fix extended KCK key length check in + nl80211_set_rekey_data() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: df4969ca135b9b3b2c38c07514aaa775112ac835 + +[ Upstream commit df4969ca135b9b3b2c38c07514aaa775112ac835 ] + +The extended KCK key length check wrongly using the KEK key attribute +for validation. Due to this GTK rekey offload is failing when the KCK +key length is 24 bytes even though the driver advertising +WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK flag. Use correct attribute to fix the +same. + +Fixes: 093a48d2aa4b ("cfg80211: support bigger kek/kck key length") +Signed-off-by: Shivani Baranwal +Signed-off-by: Veerendranath Jakkam +Link: https://lore.kernel.org/r/20221206143715.1802987-2-quic_vjakkam@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/wireless/nl80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 33a82eca..02b9a028 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -13809,7 +13809,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) + return -ERANGE; + if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && + !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && +- nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN)) ++ nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN)) + return -ERANGE; + + rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-210-ACPI-battery-Fix-missing-NUL-termination-with-l.patch b/patches.kernel.org/6.2.3-210-ACPI-battery-Fix-missing-NUL-termination-with-l.patch new file mode 100644 index 0000000..70ff3fa --- /dev/null +++ b/patches.kernel.org/6.2.3-210-ACPI-battery-Fix-missing-NUL-termination-with-l.patch @@ -0,0 +1,45 @@ +From: Armin Wolf +Date: Sat, 14 Jan 2023 09:50:50 +0100 +Subject: [PATCH] ACPI: battery: Fix missing NUL-termination with large strings +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc + +[ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ] + +When encountering a string bigger than the destination buffer (32 bytes), +the string is not properly NUL-terminated, causing buffer overreads later. + +This for example happens on the Inspiron 3505, where the battery +model name is larger than 32 bytes, which leads to sysfs showing +the model name together with the serial number string (which is +NUL-terminated and thus prevents worse). + +Fix this by using strscpy() which ensures that the result is +always NUL-terminated. + +Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer") +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/battery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index f4badcdd..fb64bd21 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery, + + if (element->type == ACPI_TYPE_STRING || + element->type == ACPI_TYPE_BUFFER) +- strncpy(ptr, element->string.pointer, 32); ++ strscpy(ptr, element->string.pointer, 32); + else if (element->type == ACPI_TYPE_INTEGER) { + strncpy(ptr, (u8 *)&element->integer.value, + sizeof(u64)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-211-selftests-bpf-Fix-build-errors-if-CONFIG_NF_CON.patch b/patches.kernel.org/6.2.3-211-selftests-bpf-Fix-build-errors-if-CONFIG_NF_CON.patch new file mode 100644 index 0000000..91f7a98 --- /dev/null +++ b/patches.kernel.org/6.2.3-211-selftests-bpf-Fix-build-errors-if-CONFIG_NF_CON.patch @@ -0,0 +1,82 @@ +From: Tiezhu Yang +Date: Wed, 18 Jan 2023 15:56:44 +0800 +Subject: [PATCH] selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 92afc5329a5b23d876b215b783d200352d5aaea6 + +[ Upstream commit 92afc5329a5b23d876b215b783d200352d5aaea6 ] + +If CONFIG_NF_CONNTRACK=m, there are no definitions of NF_NAT_MANIP_SRC +and NF_NAT_MANIP_DST in vmlinux.h, build test_bpf_nf.c failed. + +$ make -C tools/testing/selftests/bpf/ + + CLNG-BPF [test_maps] test_bpf_nf.bpf.o +progs/test_bpf_nf.c:160:42: error: use of undeclared identifier 'NF_NAT_MANIP_SRC' + bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC); + ^ +progs/test_bpf_nf.c:163:42: error: use of undeclared identifier 'NF_NAT_MANIP_DST' + bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST); + ^ +2 errors generated. + +Copy the definitions in include/net/netfilter/nf_nat.h to test_bpf_nf.c, +in order to avoid redefinitions if CONFIG_NF_CONNTRACK=y, rename them with +___local suffix. This is similar with commit 1058b6a78db2 ("selftests/bpf: +Do not fail build if CONFIG_NF_CONNTRACK=m/n"). + +Fixes: b06b45e82b59 ("selftests/bpf: add tests for bpf_ct_set_nat_info kfunc") +Signed-off-by: Tiezhu Yang +Acked-by: Jiri Olsa +Tested-by: Jiri Olsa +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/1674028604-7113-1-git-send-email-yangtiezhu@loongson.cn +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/progs/test_bpf_nf.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_bpf_nf.c b/tools/testing/selftests/bpf/progs/test_bpf_nf.c +index 227e85e8..9fc603c9 100644 +--- a/tools/testing/selftests/bpf/progs/test_bpf_nf.c ++++ b/tools/testing/selftests/bpf/progs/test_bpf_nf.c +@@ -34,6 +34,11 @@ __be16 dport = 0; + int test_exist_lookup = -ENOENT; + u32 test_exist_lookup_mark = 0; + ++enum nf_nat_manip_type___local { ++ NF_NAT_MANIP_SRC___local, ++ NF_NAT_MANIP_DST___local ++}; ++ + struct nf_conn; + + struct bpf_ct_opts___local { +@@ -58,7 +63,7 @@ int bpf_ct_change_timeout(struct nf_conn *, u32) __ksym; + int bpf_ct_set_status(struct nf_conn *, u32) __ksym; + int bpf_ct_change_status(struct nf_conn *, u32) __ksym; + int bpf_ct_set_nat_info(struct nf_conn *, union nf_inet_addr *, +- int port, enum nf_nat_manip_type) __ksym; ++ int port, enum nf_nat_manip_type___local) __ksym; + + static __always_inline void + nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32, +@@ -157,10 +162,10 @@ nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32, + + /* snat */ + saddr.ip = bpf_get_prandom_u32(); +- bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC); ++ bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC___local); + /* dnat */ + daddr.ip = bpf_get_prandom_u32(); +- bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST); ++ bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST___local); + + ct_ins = bpf_ct_insert_entry(ct); + if (ct_ins) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-212-crypto-ccp-Failure-on-re-initialization-due-to-.patch b/patches.kernel.org/6.2.3-212-crypto-ccp-Failure-on-re-initialization-due-to-.patch new file mode 100644 index 0000000..6b22469 --- /dev/null +++ b/patches.kernel.org/6.2.3-212-crypto-ccp-Failure-on-re-initialization-due-to-.patch @@ -0,0 +1,116 @@ +From: Koba Ko +Date: Mon, 9 Jan 2023 10:15:02 +0800 +Subject: [PATCH] crypto: ccp - Failure on re-initialization due to duplicate + sysfs filename +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 299bf602b3f92f1456aef59c6413591fb02e762a + +[ Upstream commit 299bf602b3f92f1456aef59c6413591fb02e762a ] + +The following warning appears during the CCP module re-initialization: + +[ 140.965403] sysfs: cannot create duplicate filename +'/devices/pci0000:00/0000:00:07.1/0000:03:00.2/dma/dma0chan0' +[ 140.975736] CPU: 0 PID: 388 Comm: kworker/0:2 Kdump: loaded Not +tainted 6.2.0-0.rc2.18.eln124.x86_64 #1 +[ 140.985185] Hardware name: HPE ProLiant DL325 Gen10/ProLiant DL325 +Gen10, BIOS A41 07/17/2020 +[ 140.993761] Workqueue: events work_for_cpu_fn +[ 140.998151] Call Trace: +[ 141.000613] +[ 141.002726] dump_stack_lvl+0x33/0x46 +[ 141.006415] sysfs_warn_dup.cold+0x17/0x23 +[ 141.010542] sysfs_create_dir_ns+0xba/0xd0 +[ 141.014670] kobject_add_internal+0xba/0x260 +[ 141.018970] kobject_add+0x81/0xb0 +[ 141.022395] device_add+0xdc/0x7e0 +[ 141.025822] ? complete_all+0x20/0x90 +[ 141.029510] __dma_async_device_channel_register+0xc9/0x130 +[ 141.035119] dma_async_device_register+0x19e/0x3b0 +[ 141.039943] ccp_dmaengine_register+0x334/0x3f0 [ccp] +[ 141.045042] ccp5_init+0x662/0x6a0 [ccp] +[ 141.049000] ? devm_kmalloc+0x40/0xd0 +[ 141.052688] ccp_dev_init+0xbb/0xf0 [ccp] +[ 141.056732] ? __pci_set_master+0x56/0xd0 +[ 141.060768] sp_init+0x70/0x90 [ccp] +[ 141.064377] sp_pci_probe+0x186/0x1b0 [ccp] +[ 141.068596] local_pci_probe+0x41/0x80 +[ 141.072374] work_for_cpu_fn+0x16/0x20 +[ 141.076145] process_one_work+0x1c8/0x380 +[ 141.080181] worker_thread+0x1ab/0x380 +[ 141.083953] ? __pfx_worker_thread+0x10/0x10 +[ 141.088250] kthread+0xda/0x100 +[ 141.091413] ? __pfx_kthread+0x10/0x10 +[ 141.095185] ret_from_fork+0x2c/0x50 +[ 141.098788] +[ 141.100996] kobject_add_internal failed for dma0chan0 with -EEXIST, +don't try to register things with the same name in the same directory. +[ 141.113703] ccp 0000:03:00.2: ccp initialization failed + +The /dma/dma0chan0 sysfs file is not removed since dma_chan object +has been released in ccp_dma_release() before releasing dma device. +A correct procedure would be: release dma channels first => unregister +dma device => release ccp dma object. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216888 +Fixes: 68dbe80f5b51 ("crypto: ccp - Release dma channels before dmaengine unrgister") +Tested-by: Vladis Dronov +Signed-off-by: Koba Ko +Reviewed-by: Vladis Dronov +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/crypto/ccp/ccp-dmaengine.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index 9f753cb4..b386a706 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -642,14 +642,26 @@ static void ccp_dma_release(struct ccp_device *ccp) + chan = ccp->ccp_dma_chan + i; + dma_chan = &chan->dma_chan; + +- if (dma_chan->client_count) +- dma_release_channel(dma_chan); +- + tasklet_kill(&chan->cleanup_tasklet); + list_del_rcu(&dma_chan->device_node); + } + } + ++static void ccp_dma_release_channels(struct ccp_device *ccp) ++{ ++ struct ccp_dma_chan *chan; ++ struct dma_chan *dma_chan; ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) { ++ chan = ccp->ccp_dma_chan + i; ++ dma_chan = &chan->dma_chan; ++ ++ if (dma_chan->client_count) ++ dma_release_channel(dma_chan); ++ } ++} ++ + int ccp_dmaengine_register(struct ccp_device *ccp) + { + struct ccp_dma_chan *chan; +@@ -770,8 +782,9 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) + if (!dmaengine) + return; + +- ccp_dma_release(ccp); ++ ccp_dma_release_channels(ccp); + dma_async_device_unregister(dma_dev); ++ ccp_dma_release(ccp); + + kmem_cache_destroy(ccp->dma_desc_cache); + kmem_cache_destroy(ccp->dma_cmd_cache); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-213-crypto-essiv-Handle-EBUSY-correctly.patch b/patches.kernel.org/6.2.3-213-crypto-essiv-Handle-EBUSY-correctly.patch new file mode 100644 index 0000000..099c38d --- /dev/null +++ b/patches.kernel.org/6.2.3-213-crypto-essiv-Handle-EBUSY-correctly.patch @@ -0,0 +1,56 @@ +From: Herbert Xu +Date: Fri, 13 Jan 2023 18:24:09 +0800 +Subject: [PATCH] crypto: essiv - Handle EBUSY correctly +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b5a772adf45a32c68bef28e60621f12617161556 + +[ Upstream commit b5a772adf45a32c68bef28e60621f12617161556 ] + +As it is essiv only handles the special return value of EINPROGERSS, +which means that in all other cases it will free data related to the +request. + +However, as the caller of essiv may specify MAY_BACKLOG, we also need +to expect EBUSY and treat it in the same way. Otherwise backlogged +requests will trigger a use-after-free. + +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template...") +Signed-off-by: Herbert Xu +Acked-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + crypto/essiv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index e33369df..307eba74 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -171,7 +171,12 @@ static void essiv_aead_done(struct crypto_async_request *areq, int err) + struct aead_request *req = areq->data; + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + ++ if (err == -EINPROGRESS) ++ goto out; ++ + kfree(rctx->assoc); ++ ++out: + aead_request_complete(req, err); + } + +@@ -247,7 +252,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + err = enc ? crypto_aead_encrypt(subreq) : + crypto_aead_decrypt(subreq); + +- if (rctx->assoc && err != -EINPROGRESS) ++ if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY) + kfree(rctx->assoc); + return err; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-214-crypto-seqiv-Handle-EBUSY-correctly.patch b/patches.kernel.org/6.2.3-214-crypto-seqiv-Handle-EBUSY-correctly.patch new file mode 100644 index 0000000..d8a59c7 --- /dev/null +++ b/patches.kernel.org/6.2.3-214-crypto-seqiv-Handle-EBUSY-correctly.patch @@ -0,0 +1,41 @@ +From: Herbert Xu +Date: Fri, 13 Jan 2023 18:27:51 +0800 +Subject: [PATCH] crypto: seqiv - Handle EBUSY correctly +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 32e62025e5e52fbe4812ef044759de7010b15dbc + +[ Upstream commit 32e62025e5e52fbe4812ef044759de7010b15dbc ] + +As it is seqiv only handles the special return value of EINPROGERSS, +which means that in all other cases it will free data related to the +request. + +However, as the caller of seqiv may specify MAY_BACKLOG, we also need +to expect EBUSY and treat it in the same way. Otherwise backlogged +requests will trigger a use-after-free. + +Fixes: 0a270321dbf9 ("[CRYPTO] seqiv: Add Sequence Number IV Generator") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + crypto/seqiv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/seqiv.c b/crypto/seqiv.c +index 0899d527..b1bcfe53 100644 +--- a/crypto/seqiv.c ++++ b/crypto/seqiv.c +@@ -23,7 +23,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err) + struct aead_request *subreq = aead_request_ctx(req); + struct crypto_aead *geniv; + +- if (err == -EINPROGRESS) ++ if (err == -EINPROGRESS || err == -EBUSY) + return; + + if (err) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-215-powercap-fix-possible-name-leak-in-powercap_reg.patch b/patches.kernel.org/6.2.3-215-powercap-fix-possible-name-leak-in-powercap_reg.patch new file mode 100644 index 0000000..4c4da8f --- /dev/null +++ b/patches.kernel.org/6.2.3-215-powercap-fix-possible-name-leak-in-powercap_reg.patch @@ -0,0 +1,61 @@ +From: Yang Yingliang +Date: Tue, 3 Jan 2023 20:57:26 +0800 +Subject: [PATCH] powercap: fix possible name leak in powercap_register_zone() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1b6599f741a4525ca761ecde46e5885ff1e6ba58 + +[ Upstream commit 1b6599f741a4525ca761ecde46e5885ff1e6ba58 ] + +In the error path after calling dev_set_name(), the device +name is leaked. To fix this, calling dev_set_name() before +device_register(), and call put_device() if it returns error. + +All the resources is released in powercap_release(), so it +can return from powercap_register_zone() directly. + +Fixes: 75d2364ea0ca ("PowerCap: Add class driver") +Signed-off-by: Yang Yingliang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/powercap/powercap_sys.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c +index 1f968353..e180dee0 100644 +--- a/drivers/powercap/powercap_sys.c ++++ b/drivers/powercap/powercap_sys.c +@@ -530,9 +530,6 @@ struct powercap_zone *powercap_register_zone( + power_zone->name = kstrdup(name, GFP_KERNEL); + if (!power_zone->name) + goto err_name_alloc; +- dev_set_name(&power_zone->dev, "%s:%x", +- dev_name(power_zone->dev.parent), +- power_zone->id); + power_zone->constraints = kcalloc(nr_constraints, + sizeof(*power_zone->constraints), + GFP_KERNEL); +@@ -555,9 +552,16 @@ struct powercap_zone *powercap_register_zone( + power_zone->dev_attr_groups[0] = &power_zone->dev_zone_attr_group; + power_zone->dev_attr_groups[1] = NULL; + power_zone->dev.groups = power_zone->dev_attr_groups; ++ dev_set_name(&power_zone->dev, "%s:%x", ++ dev_name(power_zone->dev.parent), ++ power_zone->id); + result = device_register(&power_zone->dev); +- if (result) +- goto err_dev_ret; ++ if (result) { ++ put_device(&power_zone->dev); ++ mutex_unlock(&control_type->lock); ++ ++ return ERR_PTR(result); ++ } + + control_type->nr_zones++; + mutex_unlock(&control_type->lock); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-216-bpf-Fix-state-pruning-for-STACK_DYNPTR-stack-sl.patch b/patches.kernel.org/6.2.3-216-bpf-Fix-state-pruning-for-STACK_DYNPTR-stack-sl.patch new file mode 100644 index 0000000..57d617f --- /dev/null +++ b/patches.kernel.org/6.2.3-216-bpf-Fix-state-pruning-for-STACK_DYNPTR-stack-sl.patch @@ -0,0 +1,263 @@ +From: Kumar Kartikeya Dwivedi +Date: Sat, 21 Jan 2023 05:52:30 +0530 +Subject: [PATCH] bpf: Fix state pruning for STACK_DYNPTR stack slots +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d6fefa1105dacc8a742cdcf2f4bfb501c9e61349 + +[ Upstream commit d6fefa1105dacc8a742cdcf2f4bfb501c9e61349 ] + +The root of the problem is missing liveness marking for STACK_DYNPTR +slots. This leads to all kinds of problems inside stacksafe. + +The verifier by default inside stacksafe ignores spilled_ptr in stack +slots which do not have REG_LIVE_READ marks. Since this is being checked +in the 'old' explored state, it must have already done clean_live_states +for this old bpf_func_state. Hence, it won't be receiving any more +liveness marks from to be explored insns (it has received REG_LIVE_DONE +marking from liveness point of view). + +What this means is that verifier considers that it's safe to not compare +the stack slot if was never read by children states. While liveness +marks are usually propagated correctly following the parentage chain for +spilled registers (SCALAR_VALUE and PTR_* types), the same is not the +case for STACK_DYNPTR. + +clean_live_states hence simply rewrites these stack slots to the type +STACK_INVALID since it sees no REG_LIVE_READ marks. + +The end result is that we will never see STACK_DYNPTR slots in explored +state. Even if verifier was conservatively matching !REG_LIVE_READ +slots, very next check continuing the stacksafe loop on seeing +STACK_INVALID would again prevent further checks. + +Now as long as verifier stores an explored state which we can compare to +when reaching a pruning point, we can abuse this bug to make verifier +prune search for obviously unsafe paths using STACK_DYNPTR slots +thinking they are never used hence safe. + +Doing this in unprivileged mode is a bit challenging. add_new_state is +only set when seeing BPF_F_TEST_STATE_FREQ (which requires privileges) +or when jmps_processed difference is >= 2 and insn_processed difference +is >= 8. So coming up with the unprivileged case requires a little more +work, but it is still totally possible. The test case being discussed +below triggers the heuristic even in unprivileged mode. + +However, it no longer works since commit +8addbfc7b308 ("bpf: Gate dynptr API behind CAP_BPF"). + +Let's try to study the test step by step. + +Consider the following program (C style BPF ASM): + +0 r0 = 0; +1 r6 = &ringbuf_map; +3 r1 = r6; +4 r2 = 8; +5 r3 = 0; +6 r4 = r10; +7 r4 -= -16; +8 call bpf_ringbuf_reserve_dynptr; +9 if r0 == 0 goto pc+1; +10 goto pc+1; +11 *(r10 - 16) = 0xeB9F; +12 r1 = r10; +13 r1 -= -16; +14 r2 = 0; +15 call bpf_ringbuf_discard_dynptr; +16 r0 = 0; +17 exit; + +We know that insn 12 will be a pruning point, hence if we force +add_new_state for it, it will first verify the following path as +safe in straight line exploration: +0 1 3 4 5 6 7 8 9 -> 10 -> (12) 13 14 15 16 17 + +Then, when we arrive at insn 12 from the following path: +0 1 3 4 5 6 7 8 9 -> 11 (12) + +We will find a state that has been verified as safe already at insn 12. +Since register state is same at this point, regsafe will pass. Next, in +stacksafe, for spi = 0 and spi = 1 (location of our dynptr) is skipped +seeing !REG_LIVE_READ. The rest matches, so stacksafe returns true. +Next, refsafe is also true as reference state is unchanged in both +states. + +The states are considered equivalent and search is pruned. + +Hence, we are able to construct a dynptr with arbitrary contents and use +the dynptr API to operate on this arbitrary pointer and arbitrary size + +offset. + +To fix this, first define a mark_dynptr_read function that propagates +liveness marks whenever a valid initialized dynptr is accessed by dynptr +helpers. REG_LIVE_WRITTEN is marked whenever we initialize an +uninitialized dynptr. This is done in mark_stack_slots_dynptr. It allows +screening off mark_reg_read and not propagating marks upwards from that +point. + +This ensures that we either set REG_LIVE_READ64 on both dynptr slots, or +none, so clean_live_states either sets both slots to STACK_INVALID or +none of them. This is the invariant the checks inside stacksafe rely on. + +Next, do a complete comparison of both stack slots whenever they have +STACK_DYNPTR. Compare the dynptr type stored in the spilled_ptr, and +also whether both form the same first_slot. Only then is the later path +safe. + +Fixes: 97e03f521050 ("bpf: Add verifier support for dynptrs") +Acked-by: Eduard Zingerman +Signed-off-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/r/20230121002241.2113993-2-memxor@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/bpf/verifier.c | 88 +++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 84 insertions(+), 4 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 7ee21882..c42cb701 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -781,6 +781,9 @@ static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_ + state->stack[spi - 1].spilled_ptr.ref_obj_id = id; + } + ++ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; ++ state->stack[spi - 1].spilled_ptr.live |= REG_LIVE_WRITTEN; ++ + return 0; + } + +@@ -805,6 +808,31 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re + + __mark_reg_not_init(env, &state->stack[spi].spilled_ptr); + __mark_reg_not_init(env, &state->stack[spi - 1].spilled_ptr); ++ ++ /* Why do we need to set REG_LIVE_WRITTEN for STACK_INVALID slot? ++ * ++ * While we don't allow reading STACK_INVALID, it is still possible to ++ * do <8 byte writes marking some but not all slots as STACK_MISC. Then, ++ * helpers or insns can do partial read of that part without failing, ++ * but check_stack_range_initialized, check_stack_read_var_off, and ++ * check_stack_read_fixed_off will do mark_reg_read for all 8-bytes of ++ * the slot conservatively. Hence we need to prevent those liveness ++ * marking walks. ++ * ++ * This was not a problem before because STACK_INVALID is only set by ++ * default (where the default reg state has its reg->parent as NULL), or ++ * in clean_live_states after REG_LIVE_DONE (at which point ++ * mark_reg_read won't walk reg->parent chain), but not randomly during ++ * verifier state exploration (like we did above). Hence, for our case ++ * parentage chain will still be live (i.e. reg->parent may be ++ * non-NULL), while earlier reg->parent was NULL, so we need ++ * REG_LIVE_WRITTEN to screen off read marker propagation when it is ++ * done later on reads or by mark_dynptr_read as well to unnecessary ++ * mark registers in verifier state. ++ */ ++ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; ++ state->stack[spi - 1].spilled_ptr.live |= REG_LIVE_WRITTEN; ++ + return 0; + } + +@@ -2386,6 +2414,30 @@ static int mark_reg_read(struct bpf_verifier_env *env, + return 0; + } + ++static int mark_dynptr_read(struct bpf_verifier_env *env, struct bpf_reg_state *reg) ++{ ++ struct bpf_func_state *state = func(env, reg); ++ int spi, ret; ++ ++ /* For CONST_PTR_TO_DYNPTR, it must have already been done by ++ * check_reg_arg in check_helper_call and mark_btf_func_reg_size in ++ * check_kfunc_call. ++ */ ++ if (reg->type == CONST_PTR_TO_DYNPTR) ++ return 0; ++ spi = get_spi(reg->off); ++ /* Caller ensures dynptr is valid and initialized, which means spi is in ++ * bounds and spi is the first dynptr slot. Simply mark stack slot as ++ * read. ++ */ ++ ret = mark_reg_read(env, &state->stack[spi].spilled_ptr, ++ state->stack[spi].spilled_ptr.parent, REG_LIVE_READ64); ++ if (ret) ++ return ret; ++ return mark_reg_read(env, &state->stack[spi - 1].spilled_ptr, ++ state->stack[spi - 1].spilled_ptr.parent, REG_LIVE_READ64); ++} ++ + /* This function is supposed to be used by the following 32-bit optimization + * code only. It returns TRUE if the source or destination register operates + * on 64-bit, otherwise return FALSE. +@@ -5992,6 +6044,8 @@ int process_dynptr_func(struct bpf_verifier_env *env, int regno, + + meta->uninit_dynptr_regno = regno; + } else /* MEM_RDONLY and None case from above */ { ++ int err; ++ + /* For the reg->type == PTR_TO_STACK case, bpf_dynptr is never const */ + if (reg->type == CONST_PTR_TO_DYNPTR && !(arg_type & MEM_RDONLY)) { + verbose(env, "cannot pass pointer to const bpf_dynptr, the helper mutates it\n"); +@@ -6025,6 +6079,10 @@ int process_dynptr_func(struct bpf_verifier_env *env, int regno, + err_extra, regno); + return -EINVAL; + } ++ ++ err = mark_dynptr_read(env, reg); ++ if (err) ++ return err; + } + return 0; + } +@@ -13231,10 +13289,9 @@ static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old, + return false; + if (i % BPF_REG_SIZE != BPF_REG_SIZE - 1) + continue; +- if (!is_spilled_reg(&old->stack[spi])) +- continue; +- if (!regsafe(env, &old->stack[spi].spilled_ptr, +- &cur->stack[spi].spilled_ptr, idmap)) ++ /* Both old and cur are having same slot_type */ ++ switch (old->stack[spi].slot_type[BPF_REG_SIZE - 1]) { ++ case STACK_SPILL: + /* when explored and current stack slot are both storing + * spilled registers, check that stored pointers types + * are the same as well. +@@ -13245,7 +13302,30 @@ static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old, + * such verifier states are not equivalent. + * return false to continue verification of this path + */ ++ if (!regsafe(env, &old->stack[spi].spilled_ptr, ++ &cur->stack[spi].spilled_ptr, idmap)) ++ return false; ++ break; ++ case STACK_DYNPTR: ++ { ++ const struct bpf_reg_state *old_reg, *cur_reg; ++ ++ old_reg = &old->stack[spi].spilled_ptr; ++ cur_reg = &cur->stack[spi].spilled_ptr; ++ if (old_reg->dynptr.type != cur_reg->dynptr.type || ++ old_reg->dynptr.first_slot != cur_reg->dynptr.first_slot || ++ !check_ids(old_reg->ref_obj_id, cur_reg->ref_obj_id, idmap)) ++ return false; ++ break; ++ } ++ case STACK_MISC: ++ case STACK_ZERO: ++ case STACK_INVALID: ++ continue; ++ /* Ensure that new unhandled slot types return false by default */ ++ default: + return false; ++ } + } + return true; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-217-bpf-Fix-missing-var_off-check-for-ARG_PTR_TO_DY.patch b/patches.kernel.org/6.2.3-217-bpf-Fix-missing-var_off-check-for-ARG_PTR_TO_DY.patch new file mode 100644 index 0000000..cf548f7 --- /dev/null +++ b/patches.kernel.org/6.2.3-217-bpf-Fix-missing-var_off-check-for-ARG_PTR_TO_DY.patch @@ -0,0 +1,275 @@ +From: Kumar Kartikeya Dwivedi +Date: Sat, 21 Jan 2023 05:52:31 +0530 +Subject: [PATCH] bpf: Fix missing var_off check for ARG_PTR_TO_DYNPTR +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 79168a669d8125453c8a271115f1ffd4294e61f6 + +[ Upstream commit 79168a669d8125453c8a271115f1ffd4294e61f6 ] + +Currently, the dynptr function is not checking the variable offset part +of PTR_TO_STACK that it needs to check. The fixed offset is considered +when computing the stack pointer index, but if the variable offset was +not a constant (such that it could not be accumulated in reg->off), we +will end up a discrepency where runtime pointer does not point to the +actual stack slot we mark as STACK_DYNPTR. + +It is impossible to precisely track dynptr state when variable offset is +not constant, hence, just like bpf_timer, kptr, bpf_spin_lock, etc. +simply reject the case where reg->var_off is not constant. Then, +consider both reg->off and reg->var_off.value when computing the stack +pointer index. + +A new helper dynptr_get_spi is introduced to hide over these details +since the dynptr needs to be located in multiple places outside the +process_dynptr_func checks, hence once we know it's a PTR_TO_STACK, we +need to enforce these checks in all places. + +Note that it is disallowed for unprivileged users to have a non-constant +var_off, so this problem should only be possible to trigger from +programs having CAP_PERFMON. However, its effects can vary. + +Without the fix, it is possible to replace the contents of the dynptr +arbitrarily by making verifier mark different stack slots than actual +location and then doing writes to the actual stack address of dynptr at +runtime. + +Fixes: 97e03f521050 ("bpf: Add verifier support for dynptrs") +Acked-by: Joanne Koong +Signed-off-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/r/20230121002241.2113993-3-memxor@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/bpf/verifier.c | 84 +++++++++++++++---- + .../bpf/prog_tests/kfunc_dynptr_param.c | 2 +- + .../testing/selftests/bpf/progs/dynptr_fail.c | 4 +- + 3 files changed, 69 insertions(+), 21 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index c42cb701..749e7f7a 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -638,11 +638,34 @@ static void print_liveness(struct bpf_verifier_env *env, + verbose(env, "D"); + } + +-static int get_spi(s32 off) ++static int __get_spi(s32 off) + { + return (-off - 1) / BPF_REG_SIZE; + } + ++static int dynptr_get_spi(struct bpf_verifier_env *env, struct bpf_reg_state *reg) ++{ ++ int off, spi; ++ ++ if (!tnum_is_const(reg->var_off)) { ++ verbose(env, "dynptr has to be at a constant offset\n"); ++ return -EINVAL; ++ } ++ ++ off = reg->off + reg->var_off.value; ++ if (off % BPF_REG_SIZE) { ++ verbose(env, "cannot pass in dynptr at an offset=%d\n", off); ++ return -EINVAL; ++ } ++ ++ spi = __get_spi(off); ++ if (spi < 1) { ++ verbose(env, "cannot pass in dynptr at an offset=%d\n", off); ++ return -EINVAL; ++ } ++ return spi; ++} ++ + static bool is_spi_bounds_valid(struct bpf_func_state *state, int spi, int nr_slots) + { + int allocated_slots = state->allocated_stack / BPF_REG_SIZE; +@@ -754,7 +777,9 @@ static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_ + enum bpf_dynptr_type type; + int spi, i, id; + +- spi = get_spi(reg->off); ++ spi = dynptr_get_spi(env, reg); ++ if (spi < 0) ++ return spi; + + if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS)) + return -EINVAL; +@@ -792,7 +817,9 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re + struct bpf_func_state *state = func(env, reg); + int spi, i; + +- spi = get_spi(reg->off); ++ spi = dynptr_get_spi(env, reg); ++ if (spi < 0) ++ return spi; + + if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS)) + return -EINVAL; +@@ -844,7 +871,11 @@ static bool is_dynptr_reg_valid_uninit(struct bpf_verifier_env *env, struct bpf_ + if (reg->type == CONST_PTR_TO_DYNPTR) + return false; + +- spi = get_spi(reg->off); ++ spi = dynptr_get_spi(env, reg); ++ if (spi < 0) ++ return false; ++ ++ /* We will do check_mem_access to check and update stack bounds later */ + if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS)) + return true; + +@@ -860,14 +891,15 @@ static bool is_dynptr_reg_valid_uninit(struct bpf_verifier_env *env, struct bpf_ + static bool is_dynptr_reg_valid_init(struct bpf_verifier_env *env, struct bpf_reg_state *reg) + { + struct bpf_func_state *state = func(env, reg); +- int spi; +- int i; ++ int spi, i; + + /* This already represents first slot of initialized bpf_dynptr */ + if (reg->type == CONST_PTR_TO_DYNPTR) + return true; + +- spi = get_spi(reg->off); ++ spi = dynptr_get_spi(env, reg); ++ if (spi < 0) ++ return false; + if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS) || + !state->stack[spi].spilled_ptr.dynptr.first_slot) + return false; +@@ -896,7 +928,9 @@ static bool is_dynptr_type_expected(struct bpf_verifier_env *env, struct bpf_reg + if (reg->type == CONST_PTR_TO_DYNPTR) { + return reg->dynptr.type == dynptr_type; + } else { +- spi = get_spi(reg->off); ++ spi = dynptr_get_spi(env, reg); ++ if (spi < 0) ++ return false; + return state->stack[spi].spilled_ptr.dynptr.type == dynptr_type; + } + } +@@ -2425,7 +2459,9 @@ static int mark_dynptr_read(struct bpf_verifier_env *env, struct bpf_reg_state * + */ + if (reg->type == CONST_PTR_TO_DYNPTR) + return 0; +- spi = get_spi(reg->off); ++ spi = dynptr_get_spi(env, reg); ++ if (spi < 0) ++ return spi; + /* Caller ensures dynptr is valid and initialized, which means spi is in + * bounds and spi is the first dynptr slot. Simply mark stack slot as + * read. +@@ -6007,12 +6043,15 @@ int process_dynptr_func(struct bpf_verifier_env *env, int regno, + } + /* CONST_PTR_TO_DYNPTR already has fixed and var_off as 0 due to + * check_func_arg_reg_off's logic. We only need to check offset +- * alignment for PTR_TO_STACK. ++ * and its alignment for PTR_TO_STACK. + */ +- if (reg->type == PTR_TO_STACK && (reg->off % BPF_REG_SIZE)) { +- verbose(env, "cannot pass in dynptr at an offset=%d\n", reg->off); +- return -EINVAL; ++ if (reg->type == PTR_TO_STACK) { ++ int err = dynptr_get_spi(env, reg); ++ ++ if (err < 0) ++ return err; + } ++ + /* MEM_UNINIT - Points to memory that is an appropriate candidate for + * constructing a mutable bpf_dynptr object. + * +@@ -6420,15 +6459,16 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env, + } + } + +-static u32 dynptr_ref_obj_id(struct bpf_verifier_env *env, struct bpf_reg_state *reg) ++static int dynptr_ref_obj_id(struct bpf_verifier_env *env, struct bpf_reg_state *reg) + { + struct bpf_func_state *state = func(env, reg); + int spi; + + if (reg->type == CONST_PTR_TO_DYNPTR) + return reg->ref_obj_id; +- +- spi = get_spi(reg->off); ++ spi = dynptr_get_spi(env, reg); ++ if (spi < 0) ++ return spi; + return state->stack[spi].spilled_ptr.ref_obj_id; + } + +@@ -6502,7 +6542,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, + * PTR_TO_STACK. + */ + if (reg->type == PTR_TO_STACK) { +- spi = get_spi(reg->off); ++ spi = dynptr_get_spi(env, reg); ++ if (spi < 0) ++ return spi; + if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS) || + !state->stack[spi].spilled_ptr.ref_obj_id) { + verbose(env, "arg %d is an unacquired reference\n", regno); +@@ -7991,13 +8033,19 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn + for (i = 0; i < MAX_BPF_FUNC_REG_ARGS; i++) { + if (arg_type_is_dynptr(fn->arg_type[i])) { + struct bpf_reg_state *reg = ®s[BPF_REG_1 + i]; ++ int ref_obj_id; + + if (meta.ref_obj_id) { + verbose(env, "verifier internal error: meta.ref_obj_id already set\n"); + return -EFAULT; + } + +- meta.ref_obj_id = dynptr_ref_obj_id(env, reg); ++ ref_obj_id = dynptr_ref_obj_id(env, reg); ++ if (ref_obj_id < 0) { ++ verbose(env, "verifier internal error: failed to obtain dynptr ref_obj_id\n"); ++ return ref_obj_id; ++ } ++ meta.ref_obj_id = ref_obj_id; + break; + } + } +diff --git a/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c b/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c +index a9229260..72800b1e 100644 +--- a/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c ++++ b/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c +@@ -18,7 +18,7 @@ static struct { + const char *expected_verifier_err_msg; + int expected_runtime_err; + } kfunc_dynptr_tests[] = { +- {"not_valid_dynptr", "Expected an initialized dynptr as arg #1", 0}, ++ {"not_valid_dynptr", "cannot pass in dynptr at an offset=-8", 0}, + {"not_ptr_to_stack", "arg#0 expected pointer to stack or dynptr_ptr", 0}, + {"dynptr_data_null", NULL, -EBADMSG}, + }; +diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c +index 78debc1b..02d57b95 100644 +--- a/tools/testing/selftests/bpf/progs/dynptr_fail.c ++++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c +@@ -382,7 +382,7 @@ int invalid_helper1(void *ctx) + + /* A dynptr can't be passed into a helper function at a non-zero offset */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #3") ++__failure __msg("cannot pass in dynptr at an offset=-8") + int invalid_helper2(void *ctx) + { + struct bpf_dynptr ptr; +@@ -584,7 +584,7 @@ int invalid_read4(void *ctx) + + /* Initializing a dynptr on an offset should fail */ + SEC("?raw_tp") +-__failure __msg("invalid write to stack") ++__failure __msg("cannot pass in dynptr at an offset=0") + int invalid_offset(void *ctx) + { + struct bpf_dynptr ptr; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-218-bpf-Fix-partial-dynptr-stack-slot-reads-writes.patch b/patches.kernel.org/6.2.3-218-bpf-Fix-partial-dynptr-stack-slot-reads-writes.patch new file mode 100644 index 0000000..75df984 --- /dev/null +++ b/patches.kernel.org/6.2.3-218-bpf-Fix-partial-dynptr-stack-slot-reads-writes.patch @@ -0,0 +1,254 @@ +From: Kumar Kartikeya Dwivedi +Date: Sat, 21 Jan 2023 05:52:32 +0530 +Subject: [PATCH] bpf: Fix partial dynptr stack slot reads/writes +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ef8fc7a07c0e161841779d6fe3f6acd5a05c547c + +[ Upstream commit ef8fc7a07c0e161841779d6fe3f6acd5a05c547c ] + +Currently, while reads are disallowed for dynptr stack slots, writes are +not. Reads don't work from both direct access and helpers, while writes +do work in both cases, but have the effect of overwriting the slot_type. + +While this is fine, handling for a few edge cases is missing. Firstly, +a user can overwrite the stack slots of dynptr partially. + +Consider the following layout: +spi: [d][d][?] + 2 1 0 + +First slot is at spi 2, second at spi 1. +Now, do a write of 1 to 8 bytes for spi 1. + +This will essentially either write STACK_MISC for all slot_types or +STACK_MISC and STACK_ZERO (in case of size < BPF_REG_SIZE partial write +of zeroes). The end result is that slot is scrubbed. + +Now, the layout is: +spi: [d][m][?] + 2 1 0 + +Suppose if user initializes spi = 1 as dynptr. +We get: +spi: [d][d][d] + 2 1 0 + +But this time, both spi 2 and spi 1 have first_slot = true. + +Now, when passing spi 2 to dynptr helper, it will consider it as +initialized as it does not check whether second slot has first_slot == +false. And spi 1 should already work as normal. + +This effectively replaced size + offset of first dynptr, hence allowing +invalid OOB reads and writes. + +Make a few changes to protect against this: +When writing to PTR_TO_STACK using BPF insns, when we touch spi of a +STACK_DYNPTR type, mark both first and second slot (regardless of which +slot we touch) as STACK_INVALID. Reads are already prevented. + +Second, prevent writing to stack memory from helpers if the range may +contain any STACK_DYNPTR slots. Reads are already prevented. + +For helpers, we cannot allow it to destroy dynptrs from the writes as +depending on arguments, helper may take uninit_mem and dynptr both at +the same time. This would mean that helper may write to uninit_mem +before it reads the dynptr, which would be bad. + +PTR_TO_MEM: [?????dd] + +Depending on the code inside the helper, it may end up overwriting the +dynptr contents first and then read those as the dynptr argument. + +Verifier would only simulate destruction when it does byte by byte +access simulation in check_helper_call for meta.access_size, and +fail to catch this case, as it happens after argument checks. + +The same would need to be done for any other non-trivial objects created +on the stack in the future, such as bpf_list_head on stack, or +bpf_rb_root on stack. + +A common misunderstanding in the current code is that MEM_UNINIT means +writes, but note that writes may also be performed even without +MEM_UNINIT in case of helpers, in that case the code after handling meta +&& meta->raw_mode will complain when it sees STACK_DYNPTR. So that +invalid read case also covers writes to potential STACK_DYNPTR slots. +The only loophole was in case of meta->raw_mode which simulated writes +through instructions which could overwrite them. + +A future series sequenced after this will focus on the clean up of +helper access checks and bugs around that. + +Fixes: 97e03f521050 ("bpf: Add verifier support for dynptrs") +Signed-off-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/r/20230121002241.2113993-4-memxor@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/bpf/verifier.c | 88 +++++++++++++++++++ + .../testing/selftests/bpf/progs/dynptr_fail.c | 6 +- + 2 files changed, 91 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 749e7f7a..68455fd5 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -769,6 +769,8 @@ static void mark_dynptr_cb_reg(struct bpf_reg_state *reg, + __mark_dynptr_reg(reg, type, true); + } + ++static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env, ++ struct bpf_func_state *state, int spi); + + static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_state *reg, + enum bpf_arg_type arg_type, int insn_idx) +@@ -863,6 +865,55 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re + return 0; + } + ++static void __mark_reg_unknown(const struct bpf_verifier_env *env, ++ struct bpf_reg_state *reg); ++ ++static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env, ++ struct bpf_func_state *state, int spi) ++{ ++ int i; ++ ++ /* We always ensure that STACK_DYNPTR is never set partially, ++ * hence just checking for slot_type[0] is enough. This is ++ * different for STACK_SPILL, where it may be only set for ++ * 1 byte, so code has to use is_spilled_reg. ++ */ ++ if (state->stack[spi].slot_type[0] != STACK_DYNPTR) ++ return 0; ++ ++ /* Reposition spi to first slot */ ++ if (!state->stack[spi].spilled_ptr.dynptr.first_slot) ++ spi = spi + 1; ++ ++ if (dynptr_type_refcounted(state->stack[spi].spilled_ptr.dynptr.type)) { ++ verbose(env, "cannot overwrite referenced dynptr\n"); ++ return -EINVAL; ++ } ++ ++ mark_stack_slot_scratched(env, spi); ++ mark_stack_slot_scratched(env, spi - 1); ++ ++ /* Writing partially to one dynptr stack slot destroys both. */ ++ for (i = 0; i < BPF_REG_SIZE; i++) { ++ state->stack[spi].slot_type[i] = STACK_INVALID; ++ state->stack[spi - 1].slot_type[i] = STACK_INVALID; ++ } ++ ++ /* TODO: Invalidate any slices associated with this dynptr */ ++ ++ /* Do not release reference state, we are destroying dynptr on stack, ++ * not using some helper to release it. Just reset register. ++ */ ++ __mark_reg_not_init(env, &state->stack[spi].spilled_ptr); ++ __mark_reg_not_init(env, &state->stack[spi - 1].spilled_ptr); ++ ++ /* Same reason as unmark_stack_slots_dynptr above */ ++ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; ++ state->stack[spi - 1].spilled_ptr.live |= REG_LIVE_WRITTEN; ++ ++ return 0; ++} ++ + static bool is_dynptr_reg_valid_uninit(struct bpf_verifier_env *env, struct bpf_reg_state *reg) + { + struct bpf_func_state *state = func(env, reg); +@@ -3406,6 +3457,10 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, + env->insn_aux_data[insn_idx].sanitize_stack_spill = true; + } + ++ err = destroy_if_dynptr_stack_slot(env, state, spi); ++ if (err) ++ return err; ++ + mark_stack_slot_scratched(env, spi); + if (reg && !(off % BPF_REG_SIZE) && register_is_bounded(reg) && + !register_is_null(reg) && env->bpf_capable) { +@@ -3519,6 +3574,14 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env, + if (err) + return err; + ++ for (i = min_off; i < max_off; i++) { ++ int spi; ++ ++ spi = __get_spi(i); ++ err = destroy_if_dynptr_stack_slot(env, state, spi); ++ if (err) ++ return err; ++ } + + /* Variable offset writes destroy any spilled pointers in range. */ + for (i = min_off; i < max_off; i++) { +@@ -5546,6 +5609,31 @@ static int check_stack_range_initialized( + } + + if (meta && meta->raw_mode) { ++ /* Ensure we won't be overwriting dynptrs when simulating byte ++ * by byte access in check_helper_call using meta.access_size. ++ * This would be a problem if we have a helper in the future ++ * which takes: ++ * ++ * helper(uninit_mem, len, dynptr) ++ * ++ * Now, uninint_mem may overlap with dynptr pointer. Hence, it ++ * may end up writing to dynptr itself when touching memory from ++ * arg 1. This can be relaxed on a case by case basis for known ++ * safe cases, but reject due to the possibilitiy of aliasing by ++ * default. ++ */ ++ for (i = min_off; i < max_off + access_size; i++) { ++ int stack_off = -i - 1; ++ ++ spi = __get_spi(i); ++ /* raw_mode may write past allocated_stack */ ++ if (state->allocated_stack <= stack_off) ++ continue; ++ if (state->stack[spi].slot_type[stack_off % BPF_REG_SIZE] == STACK_DYNPTR) { ++ verbose(env, "potential write to dynptr at off=%d disallowed\n", i); ++ return -EACCES; ++ } ++ } + meta->access_size = access_size; + meta->regno = regno; + return 0; +diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c +index 02d57b95..9dc3f23a 100644 +--- a/tools/testing/selftests/bpf/progs/dynptr_fail.c ++++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c +@@ -420,7 +420,7 @@ int invalid_write1(void *ctx) + * offset + */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #3") ++__failure __msg("cannot overwrite referenced dynptr") + int invalid_write2(void *ctx) + { + struct bpf_dynptr ptr; +@@ -444,7 +444,7 @@ int invalid_write2(void *ctx) + * non-const offset + */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #1") ++__failure __msg("cannot overwrite referenced dynptr") + int invalid_write3(void *ctx) + { + struct bpf_dynptr ptr; +@@ -476,7 +476,7 @@ static int invalid_write4_callback(__u32 index, void *data) + * be invalidated as a dynptr + */ + SEC("?raw_tp") +-__failure __msg("arg 1 is an unacquired reference") ++__failure __msg("cannot overwrite referenced dynptr") + int invalid_write4(void *ctx) + { + struct bpf_dynptr ptr; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-219-x86-microcode-Add-a-parameter-to-microcode_chec.patch b/patches.kernel.org/6.2.3-219-x86-microcode-Add-a-parameter-to-microcode_chec.patch new file mode 100644 index 0000000..7ded56b --- /dev/null +++ b/patches.kernel.org/6.2.3-219-x86-microcode-Add-a-parameter-to-microcode_chec.patch @@ -0,0 +1,112 @@ +From: Ashok Raj +Date: Mon, 9 Jan 2023 07:35:50 -0800 +Subject: [PATCH] x86/microcode: Add a parameter to microcode_check() to store + CPU capabilities +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ab31c74455c64e69342ddab21fd9426fcbfefde7 + +[ Upstream commit ab31c74455c64e69342ddab21fd9426fcbfefde7 ] + +Add a parameter to store CPU capabilities before performing a microcode +update so that CPU capabilities can be compared before and after update. + + [ bp: Massage. ] + +Signed-off-by: Ashok Raj +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230109153555.4986-2-ashok.raj@intel.com +Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/include/asm/processor.h | 2 +- + arch/x86/kernel/cpu/common.c | 21 +++++++++++++-------- + arch/x86/kernel/cpu/microcode/core.c | 3 ++- + 3 files changed, 16 insertions(+), 10 deletions(-) + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 4e35c66e..f256a4dd 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -697,7 +697,7 @@ bool xen_set_default_idle(void); + #endif + + void __noreturn stop_this_cpu(void *dummy); +-void microcode_check(void); ++void microcode_check(struct cpuinfo_x86 *prev_info); + + enum l1tf_mitigations { + L1TF_MITIGATION_OFF, +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index f3cc7699..cda7ded2 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -2302,30 +2302,35 @@ void cpu_init_secondary(void) + #endif + + #ifdef CONFIG_MICROCODE_LATE_LOADING +-/* ++/** ++ * microcode_check() - Check if any CPU capabilities changed after an update. ++ * @prev_info: CPU capabilities stored before an update. ++ * + * The microcode loader calls this upon late microcode load to recheck features, + * only when microcode has been updated. Caller holds microcode_mutex and CPU + * hotplug lock. ++ * ++ * Return: None + */ +-void microcode_check(void) ++void microcode_check(struct cpuinfo_x86 *prev_info) + { +- struct cpuinfo_x86 info; +- + perf_check_microcode(); + + /* Reload CPUID max function as it might've changed. */ +- info.cpuid_level = cpuid_eax(0); ++ prev_info->cpuid_level = cpuid_eax(0); + + /* + * Copy all capability leafs to pick up the synthetic ones so that + * memcmp() below doesn't fail on that. The ones coming from CPUID will + * get overwritten in get_cpu_cap(). + */ +- memcpy(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability)); ++ memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability, ++ sizeof(prev_info->x86_capability)); + +- get_cpu_cap(&info); ++ get_cpu_cap(prev_info); + +- if (!memcmp(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability))) ++ if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability, ++ sizeof(prev_info->x86_capability))) + return; + + pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n"); +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index 712aafff..b2068ce2 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -438,6 +438,7 @@ static int __reload_late(void *info) + static int microcode_reload_late(void) + { + int old = boot_cpu_data.microcode, ret; ++ struct cpuinfo_x86 prev_info; + + pr_err("Attempting late microcode loading - it is dangerous and taints the kernel.\n"); + pr_err("You should switch to early loading, if possible.\n"); +@@ -447,7 +448,7 @@ static int microcode_reload_late(void) + + ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); + if (ret == 0) +- microcode_check(); ++ microcode_check(&prev_info); + + pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", + old, boot_cpu_data.microcode); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-220-x86-microcode-Check-CPU-capabilities-after-late.patch b/patches.kernel.org/6.2.3-220-x86-microcode-Check-CPU-capabilities-after-late.patch new file mode 100644 index 0000000..0e1a9fb --- /dev/null +++ b/patches.kernel.org/6.2.3-220-x86-microcode-Check-CPU-capabilities-after-late.patch @@ -0,0 +1,152 @@ +From: Ashok Raj +Date: Mon, 9 Jan 2023 07:35:51 -0800 +Subject: [PATCH] x86/microcode: Check CPU capabilities after late microcode + update correctly +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c0dd9245aa9e25a697181f6085692272c9ec61bc + +[ Upstream commit c0dd9245aa9e25a697181f6085692272c9ec61bc ] + +The kernel caches each CPU's feature bits at boot in an x86_capability[] +structure. However, the capabilities in the BSP's copy can be turned off +as a result of certain command line parameters or configuration +restrictions, for example the SGX bit. This can cause a mismatch when +comparing the values before and after the microcode update. + +Another example is X86_FEATURE_SRBDS_CTRL which gets added only after +microcode update: + +# --- cpuid.before 2023-01-21 14:54:15.652000747 +0100 +# +++ cpuid.after 2023-01-21 14:54:26.632001024 +0100 +# @@ -10,7 +10,7 @@ CPU: +# 0x00000004 0x04: eax=0x00000000 ebx=0x00000000 ecx=0x00000000 edx=0x00000000 +# 0x00000005 0x00: eax=0x00000040 ebx=0x00000040 ecx=0x00000003 edx=0x11142120 +# 0x00000006 0x00: eax=0x000027f7 ebx=0x00000002 ecx=0x00000001 edx=0x00000000 +# - 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002400 +# + 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002e00 + ^^^ + +and which proves for a gazillionth time that late loading is a bad bad +idea. + +microcode_check() is called after an update to report any previously +cached CPUID bits which might have changed due to the update. + +Therefore, store the cached CPU caps before the update and compare them +with the CPU caps after the microcode update has succeeded. + +Thus, the comparison is done between the CPUID *hardware* bits before +and after the upgrade instead of using the cached, possibly runtime +modified values in BSP's boot_cpu_data copy. + +As a result, false warnings about CPUID bits changes are avoided. + + [ bp: + - Massage. + - Add SRBDS_CTRL example. + - Add kernel-doc. + - Incorporate forgotten review feedback from dhansen. + ] + +Fixes: 1008c52c09dc ("x86/CPU: Add a microcode loader callback") +Signed-off-by: Ashok Raj +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230109153555.4986-3-ashok.raj@intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/include/asm/processor.h | 1 + + arch/x86/kernel/cpu/common.c | 36 ++++++++++++++++++---------- + arch/x86/kernel/cpu/microcode/core.c | 6 +++++ + 3 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index f256a4dd..a77dee6a 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -698,6 +698,7 @@ bool xen_set_default_idle(void); + + void __noreturn stop_this_cpu(void *dummy); + void microcode_check(struct cpuinfo_x86 *prev_info); ++void store_cpu_caps(struct cpuinfo_x86 *info); + + enum l1tf_mitigations { + L1TF_MITIGATION_OFF, +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index cda7ded2..6a25e93f 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -2302,6 +2302,25 @@ void cpu_init_secondary(void) + #endif + + #ifdef CONFIG_MICROCODE_LATE_LOADING ++/** ++ * store_cpu_caps() - Store a snapshot of CPU capabilities ++ * @curr_info: Pointer where to store it ++ * ++ * Returns: None ++ */ ++void store_cpu_caps(struct cpuinfo_x86 *curr_info) ++{ ++ /* Reload CPUID max function as it might've changed. */ ++ curr_info->cpuid_level = cpuid_eax(0); ++ ++ /* Copy all capability leafs and pick up the synthetic ones. */ ++ memcpy(&curr_info->x86_capability, &boot_cpu_data.x86_capability, ++ sizeof(curr_info->x86_capability)); ++ ++ /* Get the hardware CPUID leafs */ ++ get_cpu_cap(curr_info); ++} ++ + /** + * microcode_check() - Check if any CPU capabilities changed after an update. + * @prev_info: CPU capabilities stored before an update. +@@ -2314,22 +2333,13 @@ void cpu_init_secondary(void) + */ + void microcode_check(struct cpuinfo_x86 *prev_info) + { +- perf_check_microcode(); +- +- /* Reload CPUID max function as it might've changed. */ +- prev_info->cpuid_level = cpuid_eax(0); ++ struct cpuinfo_x86 curr_info; + +- /* +- * Copy all capability leafs to pick up the synthetic ones so that +- * memcmp() below doesn't fail on that. The ones coming from CPUID will +- * get overwritten in get_cpu_cap(). +- */ +- memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability, +- sizeof(prev_info->x86_capability)); ++ perf_check_microcode(); + +- get_cpu_cap(prev_info); ++ store_cpu_caps(&curr_info); + +- if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability, ++ if (!memcmp(&prev_info->x86_capability, &curr_info.x86_capability, + sizeof(prev_info->x86_capability))) + return; + +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index b2068ce2..a25ba851 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -446,6 +446,12 @@ static int microcode_reload_late(void) + atomic_set(&late_cpus_in, 0); + atomic_set(&late_cpus_out, 0); + ++ /* ++ * Take a snapshot before the microcode update in order to compare and ++ * check whether any bits changed after an update. ++ */ ++ store_cpu_caps(&prev_info); ++ + ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); + if (ret == 0) + microcode_check(&prev_info); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-221-x86-microcode-Adjust-late-loading-result-report.patch b/patches.kernel.org/6.2.3-221-x86-microcode-Adjust-late-loading-result-report.patch new file mode 100644 index 0000000..56d0c11 --- /dev/null +++ b/patches.kernel.org/6.2.3-221-x86-microcode-Adjust-late-loading-result-report.patch @@ -0,0 +1,54 @@ +From: Ashok Raj +Date: Mon, 9 Jan 2023 07:35:52 -0800 +Subject: [PATCH] x86/microcode: Adjust late loading result reporting message +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6eab3abac7043226e5375e9ead0c7607ced6767b + +[ Upstream commit 6eab3abac7043226e5375e9ead0c7607ced6767b ] + +During late microcode loading, the "Reload completed" message is issued +unconditionally, regardless of success or failure. + +Adjust the message to report the result of the update. + + [ bp: Massage. ] + +Fixes: 9bd681251b7c ("x86/microcode: Announce reload operation's completion") +Suggested-by: Thomas Gleixner +Signed-off-by: Ashok Raj +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Tony Luck +Link: https://lore.kernel.org/lkml/874judpqqd.ffs@tglx/ +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/cpu/microcode/core.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index a25ba851..3c4e732a 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -453,11 +453,14 @@ static int microcode_reload_late(void) + store_cpu_caps(&prev_info); + + ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); +- if (ret == 0) ++ if (!ret) { ++ pr_info("Reload succeeded, microcode revision: 0x%x -> 0x%x\n", ++ old, boot_cpu_data.microcode); + microcode_check(&prev_info); +- +- pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", +- old, boot_cpu_data.microcode); ++ } else { ++ pr_info("Reload failed, current microcode revision: 0x%x\n", ++ boot_cpu_data.microcode); ++ } + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-222-net-ethernet-ti-am65-cpsw-cpts-Fix-CPTS-release.patch b/patches.kernel.org/6.2.3-222-net-ethernet-ti-am65-cpsw-cpts-Fix-CPTS-release.patch new file mode 100644 index 0000000..a77c649 --- /dev/null +++ b/patches.kernel.org/6.2.3-222-net-ethernet-ti-am65-cpsw-cpts-Fix-CPTS-release.patch @@ -0,0 +1,135 @@ +From: Siddharth Vadapalli +Date: Fri, 20 Jan 2023 12:37:31 +0530 +Subject: [PATCH] net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4ad8766cd3982744e53f107f378d2c65b76ff9a8 + +[ Upstream commit 4ad8766cd3982744e53f107f378d2c65b76ff9a8 ] + +The am65_cpts_release() function is registered as a devm_action in the +am65_cpts_create() function in am65-cpts driver. When the am65-cpsw driver +invokes am65_cpts_create(), am65_cpts_release() is added in the set of devm +actions associated with the am65-cpsw driver's device. + +In the event of probe failure or probe deferral, the platform_drv_probe() +function invokes dev_pm_domain_detach() which powers off the CPSW and the +CPSW's CPTS hardware, both of which share the same power domain. Since the +am65_cpts_disable() function invoked by the am65_cpts_release() function +attempts to reset the CPTS hardware by writing to its registers, the CPTS +hardware is assumed to be powered on at this point. However, the hardware +is powered off before the devm actions are executed. + +Fix this by getting rid of the devm action for am65_cpts_release() and +invoking it directly on the cleanup and exit paths. + +Fixes: f6bd59526ca5 ("net: ethernet: ti: introduce am654 common platform time sync driver") +Signed-off-by: Siddharth Vadapalli +Reviewed-by: Leon Romanovsky +Reviewed-by: Tony Nguyen +Reviewed-by: Roger Quadros +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 ++ + drivers/net/ethernet/ti/am65-cpts.c | 15 +++++---------- + drivers/net/ethernet/ti/am65-cpts.h | 5 +++++ + 3 files changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 6cda4b7c..3e171527 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2852,6 +2852,7 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev) + + err_free_phylink: + am65_cpsw_nuss_phylink_cleanup(common); ++ am65_cpts_release(common->cpts); + err_of_clear: + of_platform_device_destroy(common->mdio_dev, NULL); + err_pm_clear: +@@ -2880,6 +2881,7 @@ static int am65_cpsw_nuss_remove(struct platform_device *pdev) + */ + am65_cpsw_nuss_cleanup_ndev(common); + am65_cpsw_nuss_phylink_cleanup(common); ++ am65_cpts_release(common->cpts); + + of_platform_device_destroy(common->mdio_dev, NULL); + +diff --git a/drivers/net/ethernet/ti/am65-cpts.c b/drivers/net/ethernet/ti/am65-cpts.c +index 9535396b..a2978901 100644 +--- a/drivers/net/ethernet/ti/am65-cpts.c ++++ b/drivers/net/ethernet/ti/am65-cpts.c +@@ -929,14 +929,13 @@ static int am65_cpts_of_parse(struct am65_cpts *cpts, struct device_node *node) + return cpts_of_mux_clk_setup(cpts, node); + } + +-static void am65_cpts_release(void *data) ++void am65_cpts_release(struct am65_cpts *cpts) + { +- struct am65_cpts *cpts = data; +- + ptp_clock_unregister(cpts->ptp_clock); + am65_cpts_disable(cpts); + clk_disable_unprepare(cpts->refclk); + } ++EXPORT_SYMBOL_GPL(am65_cpts_release); + + struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs, + struct device_node *node) +@@ -1014,18 +1013,12 @@ struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs, + } + cpts->phc_index = ptp_clock_index(cpts->ptp_clock); + +- ret = devm_add_action_or_reset(dev, am65_cpts_release, cpts); +- if (ret) { +- dev_err(dev, "failed to add ptpclk reset action %d", ret); +- return ERR_PTR(ret); +- } +- + ret = devm_request_threaded_irq(dev, cpts->irq, NULL, + am65_cpts_interrupt, + IRQF_ONESHOT, dev_name(dev), cpts); + if (ret < 0) { + dev_err(cpts->dev, "error attaching irq %d\n", ret); +- return ERR_PTR(ret); ++ goto reset_ptpclk; + } + + dev_info(dev, "CPTS ver 0x%08x, freq:%u, add_val:%u\n", +@@ -1034,6 +1027,8 @@ struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs, + + return cpts; + ++reset_ptpclk: ++ am65_cpts_release(cpts); + refclk_disable: + clk_disable_unprepare(cpts->refclk); + return ERR_PTR(ret); +diff --git a/drivers/net/ethernet/ti/am65-cpts.h b/drivers/net/ethernet/ti/am65-cpts.h +index bd08f4b2..6e14df0b 100644 +--- a/drivers/net/ethernet/ti/am65-cpts.h ++++ b/drivers/net/ethernet/ti/am65-cpts.h +@@ -18,6 +18,7 @@ struct am65_cpts_estf_cfg { + }; + + #if IS_ENABLED(CONFIG_TI_K3_AM65_CPTS) ++void am65_cpts_release(struct am65_cpts *cpts); + struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs, + struct device_node *node); + int am65_cpts_phc_index(struct am65_cpts *cpts); +@@ -31,6 +32,10 @@ void am65_cpts_estf_disable(struct am65_cpts *cpts, int idx); + void am65_cpts_suspend(struct am65_cpts *cpts); + void am65_cpts_resume(struct am65_cpts *cpts); + #else ++static inline void am65_cpts_release(struct am65_cpts *cpts) ++{ ++} ++ + static inline struct am65_cpts *am65_cpts_create(struct device *dev, + void __iomem *regs, + struct device_node *node) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-223-selftests-bpf-Fix-vmtest-static-compilation-err.patch b/patches.kernel.org/6.2.3-223-selftests-bpf-Fix-vmtest-static-compilation-err.patch new file mode 100644 index 0000000..39550dc --- /dev/null +++ b/patches.kernel.org/6.2.3-223-selftests-bpf-Fix-vmtest-static-compilation-err.patch @@ -0,0 +1,60 @@ +From: "Daniel T. Lee" +Date: Wed, 25 Jan 2023 19:04:40 +0900 +Subject: [PATCH] selftests/bpf: Fix vmtest static compilation error +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2514a31241e1e9067d379e0fbdb60e4bc2bf4659 + +[ Upstream commit 2514a31241e1e9067d379e0fbdb60e4bc2bf4659 ] + +As stated in README.rst, in order to resolve errors with linker errors, +'LDLIBS=-static' should be used. Most problems will be solved by this +option, but in the case of urandom_read, this won't fix the problem. So +the Makefile is currently implemented to strip the 'static' option when +compiling the urandom_read. However, stripping this static option isn't +configured properly on $(LDLIBS) correctly, which is now causing errors +on static compilation. + + # LDLIBS=-static ./vmtest.sh + ld.lld: error: attempted static link of dynamic object liburandom_read.so + clang: error: linker command failed with exit code 1 (use -v to see invocation) + make: *** [Makefile:190: /linux/tools/testing/selftests/bpf/urandom_read] Error 1 + make: *** Waiting for unfinished jobs.... + +This commit fixes this problem by configuring the strip with $(LDLIBS). + +Fixes: 68084a136420 ("selftests/bpf: Fix building bpf selftests statically") +Signed-off-by: Daniel T. Lee +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230125100440.21734-1-danieltimlee@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/Makefile | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index c22c43bb..2323a2b9 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -181,14 +181,15 @@ endif + # do not fail. Static builds leave urandom_read relying on system-wide shared libraries. + $(OUTPUT)/liburandom_read.so: urandom_read_lib1.c urandom_read_lib2.c + $(call msg,LIB,,$@) +- $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) $^ $(LDLIBS) \ ++ $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) \ ++ $^ $(filter-out -static,$(LDLIBS)) \ + -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 \ + -fPIC -shared -o $@ + + $(OUTPUT)/urandom_read: urandom_read.c urandom_read_aux.c $(OUTPUT)/liburandom_read.so + $(call msg,BINARY,,$@) + $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) $(filter %.c,$^) \ +- liburandom_read.so $(LDLIBS) \ ++ liburandom_read.so $(filter-out -static,$(LDLIBS)) \ + -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 \ + -Wl,-rpath=. -o $@ + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-224-crypto-xts-Handle-EBUSY-correctly.patch b/patches.kernel.org/6.2.3-224-crypto-xts-Handle-EBUSY-correctly.patch new file mode 100644 index 0000000..74820fc --- /dev/null +++ b/patches.kernel.org/6.2.3-224-crypto-xts-Handle-EBUSY-correctly.patch @@ -0,0 +1,64 @@ +From: Herbert Xu +Date: Sun, 22 Jan 2023 16:07:37 +0800 +Subject: [PATCH] crypto: xts - Handle EBUSY correctly +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 51c082514c2dedf2711c99d93c196cc4eedceb40 + +[ Upstream commit 51c082514c2dedf2711c99d93c196cc4eedceb40 ] + +As it is xts only handles the special return value of EINPROGRESS, +which means that in all other cases it will free data related to the +request. + +However, as the caller of xts may specify MAY_BACKLOG, we also need +to expect EBUSY and treat it in the same way. Otherwise backlogged +requests will trigger a use-after-free. + +Fixes: 8083b1bf8163 ("crypto: xts - add support for ciphertext stealing") +Signed-off-by: Herbert Xu +Acked-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + crypto/xts.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/crypto/xts.c b/crypto/xts.c +index 63c85b9e..de6cbcf6 100644 +--- a/crypto/xts.c ++++ b/crypto/xts.c +@@ -203,12 +203,12 @@ static void xts_encrypt_done(struct crypto_async_request *areq, int err) + if (!err) { + struct xts_request_ctx *rctx = skcipher_request_ctx(req); + +- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; ++ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; + err = xts_xor_tweak_post(req, true); + + if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) { + err = xts_cts_final(req, crypto_skcipher_encrypt); +- if (err == -EINPROGRESS) ++ if (err == -EINPROGRESS || err == -EBUSY) + return; + } + } +@@ -223,12 +223,12 @@ static void xts_decrypt_done(struct crypto_async_request *areq, int err) + if (!err) { + struct xts_request_ctx *rctx = skcipher_request_ctx(req); + +- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; ++ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; + err = xts_xor_tweak_post(req, false); + + if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) { + err = xts_cts_final(req, crypto_skcipher_decrypt); +- if (err == -EINPROGRESS) ++ if (err == -EINPROGRESS || err == -EBUSY) + return; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-225-leds-led-class-Add-missing-put_device-to-led_pu.patch b/patches.kernel.org/6.2.3-225-leds-led-class-Add-missing-put_device-to-led_pu.patch new file mode 100644 index 0000000..bea928f --- /dev/null +++ b/patches.kernel.org/6.2.3-225-leds-led-class-Add-missing-put_device-to-led_pu.patch @@ -0,0 +1,59 @@ +From: Hans de Goede +Date: Fri, 20 Jan 2023 12:45:14 +0100 +Subject: [PATCH] leds: led-class: Add missing put_device() to led_put() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 445110941eb94709216363f9d807d2508e64abd7 + +[ Upstream commit 445110941eb94709216363f9d807d2508e64abd7 ] + +led_put() is used to "undo" a successful of_led_get() call, +of_led_get() uses class_find_device_by_of_node() which returns +a reference to the device which must be free-ed with put_device() +when the caller is done with it. + +Add a put_device() call to led_put() to free the reference returned +by class_find_device_by_of_node(). + +And also add a put_device() in the error-exit case of try_module_get() +failing. + +Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()") +Reviewed-by: Andy Shevchenko +Reviewed-by: Linus Walleij +Signed-off-by: Hans de Goede +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230120114524.408368-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/leds/led-class.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index 6a8ea948..7391d2cf 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -241,8 +241,10 @@ struct led_classdev *of_led_get(struct device_node *np, int index) + + led_cdev = dev_get_drvdata(led_dev); + +- if (!try_module_get(led_cdev->dev->parent->driver->owner)) ++ if (!try_module_get(led_cdev->dev->parent->driver->owner)) { ++ put_device(led_cdev->dev); + return ERR_PTR(-ENODEV); ++ } + + return led_cdev; + } +@@ -255,6 +257,7 @@ EXPORT_SYMBOL_GPL(of_led_get); + void led_put(struct led_classdev *led_cdev) + { + module_put(led_cdev->dev->parent->driver->owner); ++ put_device(led_cdev->dev); + } + EXPORT_SYMBOL_GPL(led_put); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-226-drm-nouveau-disp-Fix-nvif_outp_acquire_dp-argum.patch b/patches.kernel.org/6.2.3-226-drm-nouveau-disp-Fix-nvif_outp_acquire_dp-argum.patch new file mode 100644 index 0000000..4ca5e8b --- /dev/null +++ b/patches.kernel.org/6.2.3-226-drm-nouveau-disp-Fix-nvif_outp_acquire_dp-argum.patch @@ -0,0 +1,87 @@ +From: Kees Cook +Date: Sun, 27 Nov 2022 10:30:41 -0800 +Subject: [PATCH] drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4076ea2419cf15bc1e1580f8b24ddf675fbdb02c + +[ Upstream commit 4076ea2419cf15bc1e1580f8b24ddf675fbdb02c ] + +Both Coverity and GCC with -Wstringop-overflow noticed that +nvif_outp_acquire_dp() accidentally defined its second argument with 1 +additional element: + +drivers/gpu/drm/nouveau/dispnv50/disp.c: In function 'nv50_pior_atomic_enable': +drivers/gpu/drm/nouveau/dispnv50/disp.c:1813:17: error: 'nvif_outp_acquire_dp' accessing 16 bytes in a region of size 15 [-Werror=stringop-overflow=] + 1813 | nvif_outp_acquire_dp(&nv_encoder->outp, nv_encoder->dp.dpcd, 0, 0, false, false); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/nouveau/dispnv50/disp.c:1813:17: note: referencing argument 2 of type 'u8[16]' {aka 'unsigned char[16]'} +drivers/gpu/drm/nouveau/include/nvif/outp.h:24:5: note: in a call to function 'nvif_outp_acquire_dp' + 24 | int nvif_outp_acquire_dp(struct nvif_outp *, u8 dpcd[16], + | ^~~~~~~~~~~~~~~~~~~~ + +Avoid these warnings by defining the argument size using the matching +define (DP_RECEIVER_CAP_SIZE, 15) instead of having it be a literal +(and incorrect) value (16). + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1527269 ("Memory - corruptions") +Addresses-Coverity-ID: 1527268 ("Memory - corruptions") +Link: https://lore.kernel.org/lkml/202211100848.FFBA2432@keescook/ +Link: https://lore.kernel.org/lkml/202211100848.F4C2819BB@keescook/ +Fixes: 813443721331 ("drm/nouveau/disp: move DP link config into acquire") +Reviewed-by: Lyude Paul +Cc: Ben Skeggs +Cc: Karol Herbst +Cc: David Airlie +Cc: Daniel Vetter +Cc: Dave Airlie +Cc: "Gustavo A. R. Silva" +Cc: dri-devel@lists.freedesktop.org +Cc: nouveau@lists.freedesktop.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20221127183036.never.139-kees@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/nouveau/include/nvif/outp.h | 3 ++- + drivers/gpu/drm/nouveau/nvif/outp.c | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/include/nvif/outp.h b/drivers/gpu/drm/nouveau/include/nvif/outp.h +index 45daadec3..fa76a7b5 100644 +--- a/drivers/gpu/drm/nouveau/include/nvif/outp.h ++++ b/drivers/gpu/drm/nouveau/include/nvif/outp.h +@@ -3,6 +3,7 @@ + #define __NVIF_OUTP_H__ + #include + #include ++#include + struct nvif_disp; + + struct nvif_outp { +@@ -21,7 +22,7 @@ int nvif_outp_acquire_rgb_crt(struct nvif_outp *); + int nvif_outp_acquire_tmds(struct nvif_outp *, int head, + bool hdmi, u8 max_ac_packet, u8 rekey, u8 scdc, bool hda); + int nvif_outp_acquire_lvds(struct nvif_outp *, bool dual, bool bpc8); +-int nvif_outp_acquire_dp(struct nvif_outp *, u8 dpcd[16], ++int nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIVER_CAP_SIZE], + int link_nr, int link_bw, bool hda, bool mst); + void nvif_outp_release(struct nvif_outp *); + int nvif_outp_infoframe(struct nvif_outp *, u8 type, struct nvif_outp_infoframe_v0 *, u32 size); +diff --git a/drivers/gpu/drm/nouveau/nvif/outp.c b/drivers/gpu/drm/nouveau/nvif/outp.c +index 7da39f1e..c24bc5ea 100644 +--- a/drivers/gpu/drm/nouveau/nvif/outp.c ++++ b/drivers/gpu/drm/nouveau/nvif/outp.c +@@ -127,7 +127,7 @@ nvif_outp_acquire(struct nvif_outp *outp, u8 proto, struct nvif_outp_acquire_v0 + } + + int +-nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[16], ++nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIVER_CAP_SIZE], + int link_nr, int link_bw, bool hda, bool mst) + { + struct nvif_outp_acquire_v0 args; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-227-s390-bpf-Add-expoline-to-tail-calls.patch b/patches.kernel.org/6.2.3-227-s390-bpf-Add-expoline-to-tail-calls.patch new file mode 100644 index 0000000..f87cd7f --- /dev/null +++ b/patches.kernel.org/6.2.3-227-s390-bpf-Add-expoline-to-tail-calls.patch @@ -0,0 +1,48 @@ +From: Ilya Leoshkevich +Date: Sun, 29 Jan 2023 20:04:55 +0100 +Subject: [PATCH] s390/bpf: Add expoline to tail calls +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: bb4ef8fc3d193ed8d5583fb47cbeff5d8fb8302f + +[ Upstream commit bb4ef8fc3d193ed8d5583fb47cbeff5d8fb8302f ] + +All the indirect jumps in the eBPF JIT already use expolines, except +for the tail call one. + +Fixes: de5cb6eb514e ("s390: use expoline thunks in the BPF JIT") +Signed-off-by: Ilya Leoshkevich +Link: https://lore.kernel.org/r/20230129190501.1624747-3-iii@linux.ibm.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/net/bpf_jit_comp.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index af35052d..fbdba4c3 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1393,8 +1393,16 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, + /* lg %r1,bpf_func(%r1) */ + EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, REG_1, REG_0, + offsetof(struct bpf_prog, bpf_func)); +- /* bc 0xf,tail_call_start(%r1) */ +- _EMIT4(0x47f01000 + jit->tail_call_start); ++ if (nospec_uses_trampoline()) { ++ jit->seen |= SEEN_FUNC; ++ /* aghi %r1,tail_call_start */ ++ EMIT4_IMM(0xa70b0000, REG_1, jit->tail_call_start); ++ /* brcl 0xf,__s390_indirect_jump_r1 */ ++ EMIT6_PCREL_RILC(0xc0040000, 0xf, jit->r1_thunk_ip); ++ } else { ++ /* bc 0xf,tail_call_start(%r1) */ ++ _EMIT4(0x47f01000 + jit->tail_call_start); ++ } + /* out: */ + if (jit->prg_buf) { + *(u16 *)(jit->prg_buf + patch_1_clrj + 2) = +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-228-wifi-iwlwifi-mei-fix-compilation-errors-in-rfki.patch b/patches.kernel.org/6.2.3-228-wifi-iwlwifi-mei-fix-compilation-errors-in-rfki.patch new file mode 100644 index 0000000..472f062 --- /dev/null +++ b/patches.kernel.org/6.2.3-228-wifi-iwlwifi-mei-fix-compilation-errors-in-rfki.patch @@ -0,0 +1,58 @@ +From: Gregory Greenman +Date: Fri, 27 Jan 2023 00:28:21 +0200 +Subject: [PATCH] wifi: iwlwifi: mei: fix compilation errors in rfkill() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9cbd5a8abca904441e36861e3a92961bec41d13f + +[ Upstream commit 9cbd5a8abca904441e36861e3a92961bec41d13f ] + +The rfkill() callback was invoked with wrong parameters. +It was missed since MEI is defined now as depending on BROKEN. +Fix that. + +Fixes: d288067ede4b ("wifi: iwlwifi: mei: avoid blocking sap messages handling due to rtnl lock") +Fixes: 5aa7ce31bd84 ("wifi: iwlwifi: mei: make sure ownership confirmed message is sent") +Fixes: 95170a46b7dd ("wifi: iwlwifi: mei: don't send SAP commands if AMT is disabled") +Link: https://lore.kernel.org/r/20230126222821.305122-2-gregory.greenman@intel.com +Signed-off-by: Gregory Greenman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/intel/iwlwifi/mei/main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mei/main.c b/drivers/net/wireless/intel/iwlwifi/mei/main.c +index f9d11935..67dfb77f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mei/main.c ++++ b/drivers/net/wireless/intel/iwlwifi/mei/main.c +@@ -788,7 +788,7 @@ static void iwl_mei_handle_amt_state(struct mei_cl_device *cldev, + if (mei->amt_enabled) + iwl_mei_set_init_conf(mei); + else if (iwl_mei_cache.ops) +- iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, false, false); ++ iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, false); + + schedule_work(&mei->netdev_work); + +@@ -829,7 +829,7 @@ static void iwl_mei_handle_csme_taking_ownership(struct mei_cl_device *cldev, + */ + mei->csme_taking_ownership = true; + +- iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, true, true); ++ iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, true); + } else { + iwl_mei_send_sap_msg(cldev, + SAP_MSG_NOTIF_CSME_OWNERSHIP_CONFIRMED); +@@ -1774,7 +1774,7 @@ int iwl_mei_register(void *priv, const struct iwl_mei_ops *ops) + if (mei->amt_enabled) + iwl_mei_send_sap_msg(mei->cldev, + SAP_MSG_NOTIF_WIFIDR_UP); +- ops->rfkill(priv, mei->link_prot_state, false); ++ ops->rfkill(priv, mei->link_prot_state); + } + } + ret = 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-229-kselftest-arm64-Fix-enumeration-of-systems-with.patch b/patches.kernel.org/6.2.3-229-kselftest-arm64-Fix-enumeration-of-systems-with.patch new file mode 100644 index 0000000..86bad8e --- /dev/null +++ b/patches.kernel.org/6.2.3-229-kselftest-arm64-Fix-enumeration-of-systems-with.patch @@ -0,0 +1,59 @@ +From: Mark Brown +Date: Tue, 31 Jan 2023 22:56:34 +0000 +Subject: [PATCH] kselftest/arm64: Fix enumeration of systems without 128 bit + SME +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5f389238534ac8ca4ee3ab12eeb89d3984d303a1 + +[ Upstream commit 5f389238534ac8ca4ee3ab12eeb89d3984d303a1 ] + +The current signal handling tests for SME do not account for the fact that +unlike SVE all SME vector lengths are optional so we can't guarantee that +we will encounter the minimum possible VL, they will hang enumerating VLs +on such systems. Abort enumeration when we find the lowest VL. + +Fixes: 4963aeb35a9e ("kselftest/arm64: signal: Add SME signal handling tests") +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20230131-arm64-kselftest-sig-sme-no-128-v1-1-d47c13dc8e1e@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/arm64/signal/testcases/ssve_regs.c | 4 ++++ + tools/testing/selftests/arm64/signal/testcases/za_regs.c | 4 ++++ + 2 files changed, 8 insertions(+) + +diff --git a/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c b/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c +index d0a17894..c6b17c47 100644 +--- a/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c ++++ b/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c +@@ -34,6 +34,10 @@ static bool sme_get_vls(struct tdescr *td) + + vl &= PR_SME_VL_LEN_MASK; + ++ /* Did we find the lowest supported VL? */ ++ if (vq < sve_vq_from_vl(vl)) ++ break; ++ + /* Skip missing VLs */ + vq = sve_vq_from_vl(vl); + +diff --git a/tools/testing/selftests/arm64/signal/testcases/za_regs.c b/tools/testing/selftests/arm64/signal/testcases/za_regs.c +index ea45acb1..174ad665 100644 +--- a/tools/testing/selftests/arm64/signal/testcases/za_regs.c ++++ b/tools/testing/selftests/arm64/signal/testcases/za_regs.c +@@ -34,6 +34,10 @@ static bool sme_get_vls(struct tdescr *td) + + vl &= PR_SME_VL_LEN_MASK; + ++ /* Did we find the lowest supported VL? */ ++ if (vq < sve_vq_from_vl(vl)) ++ break; ++ + /* Skip missing VLs */ + vq = sve_vq_from_vl(vl); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-230-can-rcar_canfd-Fix-R-Car-V3U-CAN-mode-selection.patch b/patches.kernel.org/6.2.3-230-can-rcar_canfd-Fix-R-Car-V3U-CAN-mode-selection.patch new file mode 100644 index 0000000..cae64e4 --- /dev/null +++ b/patches.kernel.org/6.2.3-230-can-rcar_canfd-Fix-R-Car-V3U-CAN-mode-selection.patch @@ -0,0 +1,75 @@ +From: Geert Uytterhoeven +Date: Mon, 23 Jan 2023 19:56:06 +0100 +Subject: [PATCH] can: rcar_canfd: Fix R-Car V3U CAN mode selection +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0a016639ef92b28eb74ba4fed21bee1f1328513a + +[ Upstream commit 0a016639ef92b28eb74ba4fed21bee1f1328513a ] + +When adding support for R-Car V3U, the Global FD Configuration register +(CFDGFDCFG) and the Channel-specific CAN-FD Configuration Registers +(CFDCmFDCFG) were mixed up. Use the correct register, and apply the +selected CAN mode to all available channels. + +Annotate the corresponding register bits, to make it clear they do +not exist on older variants. + +Fixes: 45721c406dcf50d4 ("can: rcar_canfd: Add support for r8a779a0 SoC") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/all/388ddf312917eb9f6cc460a481f68402a876f9b5.1674499048.git.geert+renesas@glider.be +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/can/rcar/rcar_canfd.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c +index f6fa7157..88de17d0 100644 +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -197,8 +197,8 @@ + #define RCANFD_DCFG_DBRP(x) (((x) & 0xff) << 0) + + /* RSCFDnCFDCmFDCFG */ +-#define RCANFD_FDCFG_CLOE BIT(30) +-#define RCANFD_FDCFG_FDOE BIT(28) ++#define RCANFD_V3U_FDCFG_CLOE BIT(30) ++#define RCANFD_V3U_FDCFG_FDOE BIT(28) + #define RCANFD_FDCFG_TDCE BIT(9) + #define RCANFD_FDCFG_TDCOC BIT(8) + #define RCANFD_FDCFG_TDCO(x) (((x) & 0x7f) >> 16) +@@ -429,8 +429,8 @@ + #define RCANFD_C_RPGACC(r) (0x1900 + (0x04 * (r))) + + /* R-Car V3U Classical and CAN FD mode specific register map */ +-#define RCANFD_V3U_CFDCFG (0x1314) + #define RCANFD_V3U_DCFG(m) (0x1400 + (0x20 * (m))) ++#define RCANFD_V3U_FDCFG(m) (0x1404 + (0x20 * (m))) + + #define RCANFD_V3U_GAFL_OFFSET (0x1800) + +@@ -689,12 +689,13 @@ static void rcar_canfd_tx_failure_cleanup(struct net_device *ndev) + static void rcar_canfd_set_mode(struct rcar_canfd_global *gpriv) + { + if (is_v3u(gpriv)) { +- if (gpriv->fdmode) +- rcar_canfd_set_bit(gpriv->base, RCANFD_V3U_CFDCFG, +- RCANFD_FDCFG_FDOE); +- else +- rcar_canfd_set_bit(gpriv->base, RCANFD_V3U_CFDCFG, +- RCANFD_FDCFG_CLOE); ++ u32 ch, val = gpriv->fdmode ? RCANFD_V3U_FDCFG_FDOE ++ : RCANFD_V3U_FDCFG_CLOE; ++ ++ for_each_set_bit(ch, &gpriv->channels_mask, ++ gpriv->info->max_channels) ++ rcar_canfd_set_bit(gpriv->base, RCANFD_V3U_FDCFG(ch), ++ val); + } else { + if (gpriv->fdmode) + rcar_canfd_set_bit(gpriv->base, RCANFD_GRMCFG, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-231-can-rcar_canfd-Fix-R-Car-V3U-GAFLCFG-field-acce.patch b/patches.kernel.org/6.2.3-231-can-rcar_canfd-Fix-R-Car-V3U-GAFLCFG-field-acce.patch new file mode 100644 index 0000000..39f6720 --- /dev/null +++ b/patches.kernel.org/6.2.3-231-can-rcar_canfd-Fix-R-Car-V3U-GAFLCFG-field-acce.patch @@ -0,0 +1,47 @@ +From: Geert Uytterhoeven +Date: Mon, 23 Jan 2023 19:56:07 +0100 +Subject: [PATCH] can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9be8c5583581244d8a77e41afa16b8b0a5ddabc0 + +[ Upstream commit 9be8c5583581244d8a77e41afa16b8b0a5ddabc0 ] + +Each Global Acceptance Filter List Configuration Register (GAFLCFG) +contains two fields, and stores the number of channel rules for one +channel pair. + +As R-Car V3U and later can have more than 2 channels, the field +selection should be based on the LSB (even or odd) of the channel +number, instead of on the full channel number. + +Fixes: 45721c406dcf50d4 ("can: rcar_canfd: Add support for r8a779a0 SoC") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/all/36bcf0ffb96d6aaed970751f9546b901af638bcf.1674499048.git.geert+renesas@glider.be +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/can/rcar/rcar_canfd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c +index 88de17d0..77b21c82 100644 +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -92,10 +92,10 @@ + /* RSCFDnCFDGAFLCFG0 / RSCFDnGAFLCFG0 */ + #define RCANFD_GAFLCFG_SETRNC(gpriv, n, x) \ + (((x) & reg_v3u(gpriv, 0x1ff, 0xff)) << \ +- (reg_v3u(gpriv, 16, 24) - (n) * reg_v3u(gpriv, 16, 8))) ++ (reg_v3u(gpriv, 16, 24) - ((n) & 1) * reg_v3u(gpriv, 16, 8))) + + #define RCANFD_GAFLCFG_GETRNC(gpriv, n, x) \ +- (((x) >> (reg_v3u(gpriv, 16, 24) - (n) * reg_v3u(gpriv, 16, 8))) & \ ++ (((x) >> (reg_v3u(gpriv, 16, 24) - ((n) & 1) * reg_v3u(gpriv, 16, 8))) & \ + reg_v3u(gpriv, 0x1ff, 0xff)) + + /* RSCFDnCFDGAFLECTR / RSCFDnGAFLECTR */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-232-selftests-bpf-Initialize-tc-in-xdp_synproxy.patch b/patches.kernel.org/6.2.3-232-selftests-bpf-Initialize-tc-in-xdp_synproxy.patch new file mode 100644 index 0000000..deac023 --- /dev/null +++ b/patches.kernel.org/6.2.3-232-selftests-bpf-Initialize-tc-in-xdp_synproxy.patch @@ -0,0 +1,44 @@ +From: Ilya Leoshkevich +Date: Fri, 3 Feb 2023 00:53:35 +0100 +Subject: [PATCH] selftests/bpf: Initialize tc in xdp_synproxy +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 354bb4a0e0b6be8f55bacbe7f08c94b4741f5658 + +[ Upstream commit 354bb4a0e0b6be8f55bacbe7f08c94b4741f5658 ] + +xdp_synproxy/xdp fails in CI with: + + Error: bpf_tc_hook_create: File exists + +The XDP version of the test should not be calling bpf_tc_hook_create(); +the reason it's happening anyway is that if we don't specify --tc on the +command line, tc variable remains uninitialized. + +Fixes: 784d5dc0efc2 ("selftests/bpf: Add selftests for raw syncookie helpers in TC mode") +Reported-by: Alexei Starovoitov +Reported-by: Joanne Koong +Signed-off-by: Ilya Leoshkevich +Link: https://lore.kernel.org/r/20230202235335.3403781-1-iii@linux.ibm.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/xdp_synproxy.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/xdp_synproxy.c b/tools/testing/selftests/bpf/xdp_synproxy.c +index 410a1385..6dbe0b74 100644 +--- a/tools/testing/selftests/bpf/xdp_synproxy.c ++++ b/tools/testing/selftests/bpf/xdp_synproxy.c +@@ -116,6 +116,7 @@ static void parse_options(int argc, char *argv[], unsigned int *ifindex, __u32 * + *tcpipopts = 0; + *ports = NULL; + *single = false; ++ *tc = false; + + while (true) { + int opt; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-233-crypto-ccp-Flush-the-SEV-ES-TMR-memory-before-g.patch b/patches.kernel.org/6.2.3-233-crypto-ccp-Flush-the-SEV-ES-TMR-memory-before-g.patch new file mode 100644 index 0000000..d81918c --- /dev/null +++ b/patches.kernel.org/6.2.3-233-crypto-ccp-Flush-the-SEV-ES-TMR-memory-before-g.patch @@ -0,0 +1,50 @@ +From: Tom Lendacky +Date: Mon, 23 Jan 2023 16:53:08 -0600 +Subject: [PATCH] crypto: ccp - Flush the SEV-ES TMR memory before giving it to + firmware +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 46a334a98f585ef78d51d8f5736596887bdd7f54 + +[ Upstream commit 46a334a98f585ef78d51d8f5736596887bdd7f54 ] + +Perform a cache flush on the SEV-ES TMR memory after allocation to prevent +any possibility of the firmware encountering an error should dirty cache +lines be present. Use clflush_cache_range() to flush the SEV-ES TMR memory. + +Fixes: 97f9ac3db661 ("crypto: ccp - Add support for SEV-ES to the PSP driver") +Signed-off-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/crypto/ccp/sev-dev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 56998bc5..3e583f03 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -26,6 +26,7 @@ + #include + + #include ++#include + + #include "psp-dev.h" + #include "sev-dev.h" +@@ -1334,7 +1335,10 @@ void sev_pci_init(void) + + /* Obtain the TMR memory area for SEV-ES use */ + sev_es_tmr = sev_fw_alloc(SEV_ES_TMR_SIZE); +- if (!sev_es_tmr) ++ if (sev_es_tmr) ++ /* Must flush the cache before giving it to the firmware */ ++ clflush_cache_range(sev_es_tmr, SEV_ES_TMR_SIZE); ++ else + dev_warn(sev->dev, + "SEV: TMR allocation failed, SEV-ES support unavailable\n"); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-234-bpftool-profile-online-CPUs-instead-of-possible.patch b/patches.kernel.org/6.2.3-234-bpftool-profile-online-CPUs-instead-of-possible.patch new file mode 100644 index 0000000..ef8c32b --- /dev/null +++ b/patches.kernel.org/6.2.3-234-bpftool-profile-online-CPUs-instead-of-possible.patch @@ -0,0 +1,117 @@ +From: Tonghao Zhang +Date: Thu, 2 Feb 2023 21:17:01 +0800 +Subject: [PATCH] bpftool: profile online CPUs instead of possible +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 377c16fa3f3c60d21e4b05314c8be034ce37f2eb + +[ Upstream commit 377c16fa3f3c60d21e4b05314c8be034ce37f2eb ] + +The number of online cpu may be not equal to possible cpu. +"bpftool prog profile" can not create pmu event on possible +but on online cpu. + +$ dmidecode -s system-product-name +PowerEdge R620 +$ cat /sys/devices/system/cpu/possible +0-47 +$ cat /sys/devices/system/cpu/online +0-31 + +Disable cpu dynamically: +$ echo 0 > /sys/devices/system/cpu/cpuX/online + +If one cpu is offline, perf_event_open will return ENODEV. +To fix this issue: +* check value returned and skip offline cpu. +* close pmu_fd immediately on error path, avoid fd leaking. + +Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command") +Signed-off-by: Tonghao Zhang +Cc: Quentin Monnet +Cc: Alexei Starovoitov +Cc: Daniel Borkmann +Cc: Andrii Nakryiko +Cc: Martin KaFai Lau +Cc: Song Liu +Cc: Yonghong Song +Cc: John Fastabend +Cc: KP Singh +Cc: Stanislav Fomichev +Cc: Hao Luo +Cc: Jiri Olsa +Acked-by: John Fastabend +Link: https://lore.kernel.org/r/20230202131701.29519-1-tong@infragraf.org +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/bpf/bpftool/prog.c | 38 ++++++++++++++++++++++++++++++-------- + 1 file changed, 30 insertions(+), 8 deletions(-) + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index cfc9fdc1..e87738db 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -2233,10 +2233,38 @@ static void profile_close_perf_events(struct profiler_bpf *obj) + profile_perf_event_cnt = 0; + } + ++static int profile_open_perf_event(int mid, int cpu, int map_fd) ++{ ++ int pmu_fd; ++ ++ pmu_fd = syscall(__NR_perf_event_open, &metrics[mid].attr, ++ -1 /*pid*/, cpu, -1 /*group_fd*/, 0); ++ if (pmu_fd < 0) { ++ if (errno == ENODEV) { ++ p_info("cpu %d may be offline, skip %s profiling.", ++ cpu, metrics[mid].name); ++ profile_perf_event_cnt++; ++ return 0; ++ } ++ return -1; ++ } ++ ++ if (bpf_map_update_elem(map_fd, ++ &profile_perf_event_cnt, ++ &pmu_fd, BPF_ANY) || ++ ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) { ++ close(pmu_fd); ++ return -1; ++ } ++ ++ profile_perf_events[profile_perf_event_cnt++] = pmu_fd; ++ return 0; ++} ++ + static int profile_open_perf_events(struct profiler_bpf *obj) + { + unsigned int cpu, m; +- int map_fd, pmu_fd; ++ int map_fd; + + profile_perf_events = calloc( + sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric); +@@ -2255,17 +2283,11 @@ static int profile_open_perf_events(struct profiler_bpf *obj) + if (!metrics[m].selected) + continue; + for (cpu = 0; cpu < obj->rodata->num_cpu; cpu++) { +- pmu_fd = syscall(__NR_perf_event_open, &metrics[m].attr, +- -1/*pid*/, cpu, -1/*group_fd*/, 0); +- if (pmu_fd < 0 || +- bpf_map_update_elem(map_fd, &profile_perf_event_cnt, +- &pmu_fd, BPF_ANY) || +- ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) { ++ if (profile_open_perf_event(m, cpu, map_fd)) { + p_err("failed to create event %s on cpu %d", + metrics[m].name, cpu); + return -1; + } +- profile_perf_events[profile_perf_event_cnt++] = pmu_fd; + } + } + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-235-wifi-mt76-mt7921-fix-deadlock-in-mt7921_abort_r.patch b/patches.kernel.org/6.2.3-235-wifi-mt76-mt7921-fix-deadlock-in-mt7921_abort_r.patch new file mode 100644 index 0000000..d85fd33 --- /dev/null +++ b/patches.kernel.org/6.2.3-235-wifi-mt76-mt7921-fix-deadlock-in-mt7921_abort_r.patch @@ -0,0 +1,81 @@ +From: Felix Fietkau +Date: Wed, 21 Dec 2022 11:47:47 +0100 +Subject: [PATCH] wifi: mt76: mt7921: fix deadlock in mt7921_abort_roc +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: de19b9c83654e323d83f839a550ca4af37fea15b + +[ Upstream commit de19b9c83654e323d83f839a550ca4af37fea15b ] + +When mt7921_abort_roc is called with dev->mutex held, it can deadlock while +calling cancel_work_sync(&phy->roc_work), because the work function could +be waiting to acquire the mutex. + +Fix this by flushing the work before taking the mutex + +Reported-by: Mikhail Gavrilov +Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") +Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support") +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/wireless/mediatek/mt76/mt7921/main.c | 22 ++++++------------- + 1 file changed, 7 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index 76ac5069..722df8ee 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -422,15 +422,15 @@ void mt7921_roc_timer(struct timer_list *timer) + + static int mt7921_abort_roc(struct mt7921_phy *phy, struct mt7921_vif *vif) + { +- int err; +- +- if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state)) +- return 0; ++ int err = 0; + + del_timer_sync(&phy->roc_timer); + cancel_work_sync(&phy->roc_work); +- err = mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id); +- clear_bit(MT76_STATE_ROC, &phy->mt76->state); ++ ++ mt7921_mutex_acquire(phy->dev); ++ if (test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state)) ++ err = mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id); ++ mt7921_mutex_release(phy->dev); + + return err; + } +@@ -487,13 +487,8 @@ static int mt7921_cancel_remain_on_channel(struct ieee80211_hw *hw, + { + struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv; + struct mt7921_phy *phy = mt7921_hw_phy(hw); +- int err; + +- mt7921_mutex_acquire(phy->dev); +- err = mt7921_abort_roc(phy, mvif); +- mt7921_mutex_release(phy->dev); +- +- return err; ++ return mt7921_abort_roc(phy, mvif); + } + + static int mt7921_set_channel(struct mt7921_phy *phy) +@@ -1778,11 +1773,8 @@ static void mt7921_mgd_complete_tx(struct ieee80211_hw *hw, + struct ieee80211_prep_tx_info *info) + { + struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv; +- struct mt7921_dev *dev = mt7921_hw_dev(hw); + +- mt7921_mutex_acquire(dev); + mt7921_abort_roc(mvif->phy, mvif); +- mt7921_mutex_release(dev); + } + + const struct ieee80211_ops mt7921_ops = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-236-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_th.patch b/patches.kernel.org/6.2.3-236-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_th.patch new file mode 100644 index 0000000..72ae129 --- /dev/null +++ b/patches.kernel.org/6.2.3-236-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_th.patch @@ -0,0 +1,59 @@ +From: Howard Hsu +Date: Wed, 14 Dec 2022 10:28:06 +0800 +Subject: [PATCH] wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() + only after init_work +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7d12b38ab6f6b77198cd3a66db19587bbdd3308c + +[ Upstream commit 7d12b38ab6f6b77198cd3a66db19587bbdd3308c ] + +Enable thermal management by default shall not be executed during mcu +init. This causes thermal configuration being reset to the firmware +default settings. + +Fixes: 0063b86c9120 ("mt76: mt7915e: Enable thermal management by default") +Reviewed-by: Ryder Lee +Signed-off-by: Howard Hsu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7915/init.c | 3 +-- + drivers/net/wireless/mediatek/mt76/mt7915/main.c | 6 ++++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +index c810c31f..41019ba2 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +@@ -201,8 +201,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) + phy->throttle_temp[0] = 110; + phy->throttle_temp[1] = 120; + +- return mt7915_mcu_set_thermal_throttling(phy, +- MT7915_THERMAL_THROTTLE_MAX); ++ return 0; + } + + static void mt7915_led_set_config(struct led_classdev *led_cdev, +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +index 0511d6a5..98af032e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +@@ -57,6 +57,12 @@ int mt7915_run(struct ieee80211_hw *hw) + mt7915_mac_enable_nf(dev, phy->mt76->band_idx); + } + ++ ret = mt7915_mcu_set_thermal_throttling(phy, ++ MT7915_THERMAL_THROTTLE_MAX); ++ ++ if (ret) ++ goto out; ++ + ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, 0x92b, + phy->mt76->band_idx); + if (ret) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-237-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_.patch b/patches.kernel.org/6.2.3-237-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_.patch new file mode 100644 index 0000000..13f7579 --- /dev/null +++ b/patches.kernel.org/6.2.3-237-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_.patch @@ -0,0 +1,157 @@ +From: Howard Hsu +Date: Wed, 14 Dec 2022 10:28:07 +0800 +Subject: [PATCH] wifi: mt76: mt7915: rework mt7915_mcu_set_thermal_throttling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5ad42d19f6596e54b091827c397fdb7c091d45f7 + +[ Upstream commit 5ad42d19f6596e54b091827c397fdb7c091d45f7 ] + +This patch includes 2 changes: +1. Firmware expects to disable thermal protect first before +reconfiguring. +2. Separate setting thermal_protect and setting thermal_tx_duty into +different functions. These two firmware commands do not need to send +together. + +Fixes: 34b877d972be ("mt76: mt7915: add thermal cooling device support") +Reviewed-by: Ryder Lee +Signed-off-by: Howard Hsu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/wireless/mediatek/mt76/mt7915/init.c | 3 -- + .../net/wireless/mediatek/mt76/mt7915/main.c | 5 ++ + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 54 +++++++++++-------- + .../wireless/mediatek/mt76/mt7915/mt7915.h | 1 + + 4 files changed, 37 insertions(+), 26 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +index 41019ba2..4c351bfd 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +@@ -134,9 +134,6 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev, + if (state > MT7915_CDEV_THROTTLE_MAX) + return -EINVAL; + +- if (phy->throttle_temp[0] > phy->throttle_temp[1]) +- return 0; +- + if (state == phy->cdev_state) + return 0; + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +index 98af032e..7589af4b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c +@@ -60,6 +60,11 @@ int mt7915_run(struct ieee80211_hw *hw) + ret = mt7915_mcu_set_thermal_throttling(phy, + MT7915_THERMAL_THROTTLE_MAX); + ++ if (ret) ++ goto out; ++ ++ ret = mt7915_mcu_set_thermal_protect(phy); ++ + if (ret) + goto out; + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index d9d6846b..a861312b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -3060,6 +3060,29 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy) + } + + int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state) ++{ ++ struct mt7915_dev *dev = phy->dev; ++ struct mt7915_mcu_thermal_ctrl req = { ++ .band_idx = phy->mt76->band_idx, ++ .ctrl_id = THERMAL_PROTECT_DUTY_CONFIG, ++ }; ++ int level, ret; ++ ++ /* set duty cycle and level */ ++ for (level = 0; level < 4; level++) { ++ req.duty.duty_level = level; ++ req.duty.duty_cycle = state; ++ state /= 2; ++ ++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT), ++ &req, sizeof(req), false); ++ if (ret) ++ return ret; ++ } ++ return 0; ++} ++ ++int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy) + { + struct mt7915_dev *dev = phy->dev; + struct { +@@ -3072,29 +3095,18 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state) + } __packed req = { + .ctrl = { + .band_idx = phy->mt76->band_idx, ++ .type.protect_type = 1, ++ .type.trigger_type = 1, + }, + }; +- int level; +- +- if (!state) { +- req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE; +- goto out; +- } +- +- /* set duty cycle and level */ +- for (level = 0; level < 4; level++) { +- int ret; ++ int ret; + +- req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG; +- req.ctrl.duty.duty_level = level; +- req.ctrl.duty.duty_cycle = state; +- state /= 2; ++ req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE; ++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT), ++ &req, sizeof(req.ctrl), false); + +- ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT), +- &req, sizeof(req.ctrl), false); +- if (ret) +- return ret; +- } ++ if (ret) ++ return ret; + + /* set high-temperature trigger threshold */ + req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE; +@@ -3103,10 +3115,6 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state) + req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]); + req.sustain_time = cpu_to_le16(10); + +-out: +- req.ctrl.type.protect_type = 1; +- req.ctrl.type.trigger_type = 1; +- + return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT), + &req, sizeof(req), false); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +index 6351feba..855779f8 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +@@ -543,6 +543,7 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy); + int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch); + int mt7915_mcu_get_temperature(struct mt7915_phy *phy); + int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state); ++int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy); + int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif, + struct ieee80211_sta *sta, struct rate_info *rate); + int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-238-wifi-mt76-mt7915-rework-mt7915_thermal_temp_sto.patch b/patches.kernel.org/6.2.3-238-wifi-mt76-mt7915-rework-mt7915_thermal_temp_sto.patch new file mode 100644 index 0000000..d335124 --- /dev/null +++ b/patches.kernel.org/6.2.3-238-wifi-mt76-mt7915-rework-mt7915_thermal_temp_sto.patch @@ -0,0 +1,80 @@ +From: Howard Hsu +Date: Wed, 14 Dec 2022 10:28:08 +0800 +Subject: [PATCH] wifi: mt76: mt7915: rework mt7915_thermal_temp_store() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ecaccdae7a7e8f76eeb6544295ca0593c2f65a33 + +[ Upstream commit ecaccdae7a7e8f76eeb6544295ca0593c2f65a33 ] + +Call mt7915_mcu_set_thermal_protect() through +mt7915_thermal_temp_store() to update firmware trigger/restore temp +directly. + +Fixes: 02ee68b95d81 ("mt76: mt7915: add control knobs for thermal throttling") +Reviewed-by: Ryder Lee +Signed-off-by: Howard Hsu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/wireless/mediatek/mt76/mt7915/init.c | 18 ++++++++++++++++-- + .../net/wireless/mediatek/mt76/mt7915/mt7915.h | 3 +++ + 2 files changed, 19 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +index 4c351bfd..a80ae31e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +@@ -83,9 +83,23 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev, + + mutex_lock(&phy->dev->mt76.mutex); + val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 60, 130); ++ ++ if ((i - 1 == MT7915_CRIT_TEMP_IDX && ++ val > phy->throttle_temp[MT7915_MAX_TEMP_IDX]) || ++ (i - 1 == MT7915_MAX_TEMP_IDX && ++ val < phy->throttle_temp[MT7915_CRIT_TEMP_IDX])) { ++ dev_err(phy->dev->mt76.dev, ++ "temp1_max shall be greater than temp1_crit."); ++ return -EINVAL; ++ } ++ + phy->throttle_temp[i - 1] = val; + mutex_unlock(&phy->dev->mt76.mutex); + ++ ret = mt7915_mcu_set_thermal_protect(phy); ++ if (ret) ++ return ret; ++ + return count; + } + +@@ -195,8 +209,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) + return PTR_ERR(hwmon); + + /* initialize critical/maximum high temperature */ +- phy->throttle_temp[0] = 110; +- phy->throttle_temp[1] = 120; ++ phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = 110; ++ phy->throttle_temp[MT7915_MAX_TEMP_IDX] = 120; + + return 0; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +index 855779f8..e58650bb 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +@@ -70,6 +70,9 @@ + + #define MT7915_WED_RX_TOKEN_SIZE 12288 + ++#define MT7915_CRIT_TEMP_IDX 0 ++#define MT7915_MAX_TEMP_IDX 1 ++ + struct mt7915_vif; + struct mt7915_sta; + struct mt7915_dfs_pulse; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-239-wifi-mt76-mt7921-fix-channel-switch-fail-in-mon.patch b/patches.kernel.org/6.2.3-239-wifi-mt76-mt7921-fix-channel-switch-fail-in-mon.patch new file mode 100644 index 0000000..4f35554 --- /dev/null +++ b/patches.kernel.org/6.2.3-239-wifi-mt76-mt7921-fix-channel-switch-fail-in-mon.patch @@ -0,0 +1,136 @@ +From: Deren Wu +Date: Fri, 16 Dec 2022 19:04:38 +0800 +Subject: [PATCH] wifi: mt76: mt7921: fix channel switch fail in monitor mode +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 914189af23b83c9a83a0137a3a40f17de7d2c618 + +[ Upstream commit 914189af23b83c9a83a0137a3a40f17de7d2c618 ] + +When the chanctx enabled, IEEE80211_CONF_CHANGE_CHANNEL in .config() +would not be called anymore. mt76 cannot control RF channel for monitor. +Add monitor type set-channel flow in .change_chanctx(). + +Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support") +Reviewed-by: Sean Wang +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/wireless/mediatek/mt76/mt7921/main.c | 5 +- + .../net/wireless/mediatek/mt76/mt7921/mcu.c | 68 +++++++++++++++++++ + .../wireless/mediatek/mt76/mt7921/mt7921.h | 2 + + 3 files changed, 74 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index 722df8ee..cdb0d619 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -1706,7 +1706,10 @@ static void mt7921_ctx_iter(void *priv, u8 *mac, + if (ctx != mvif->ctx) + return; + +- mt76_connac_mcu_uni_set_chctx(mvif->phy->mt76, &mvif->mt76, ctx); ++ if (vif->type & NL80211_IFTYPE_MONITOR) ++ mt7921_mcu_config_sniffer(mvif, ctx); ++ else ++ mt76_connac_mcu_uni_set_chctx(mvif->phy->mt76, &mvif->mt76, ctx); + } + + static void +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +index fb9c0f66..bd929b5f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +@@ -1093,6 +1093,74 @@ int mt7921_mcu_set_sniffer(struct mt7921_dev *dev, struct ieee80211_vif *vif, + true); + } + ++int mt7921_mcu_config_sniffer(struct mt7921_vif *vif, ++ struct ieee80211_chanctx_conf *ctx) ++{ ++ struct cfg80211_chan_def *chandef = &ctx->def; ++ int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2; ++ const u8 ch_band[] = { ++ [NL80211_BAND_2GHZ] = 1, ++ [NL80211_BAND_5GHZ] = 2, ++ [NL80211_BAND_6GHZ] = 3, ++ }; ++ const u8 ch_width[] = { ++ [NL80211_CHAN_WIDTH_20_NOHT] = 0, ++ [NL80211_CHAN_WIDTH_20] = 0, ++ [NL80211_CHAN_WIDTH_40] = 0, ++ [NL80211_CHAN_WIDTH_80] = 1, ++ [NL80211_CHAN_WIDTH_160] = 2, ++ [NL80211_CHAN_WIDTH_80P80] = 3, ++ [NL80211_CHAN_WIDTH_5] = 4, ++ [NL80211_CHAN_WIDTH_10] = 5, ++ [NL80211_CHAN_WIDTH_320] = 6, ++ }; ++ struct { ++ struct { ++ u8 band_idx; ++ u8 pad[3]; ++ } __packed hdr; ++ struct config_tlv { ++ __le16 tag; ++ __le16 len; ++ u16 aid; ++ u8 ch_band; ++ u8 bw; ++ u8 control_ch; ++ u8 sco; ++ u8 center_ch; ++ u8 center_ch2; ++ u8 drop_err; ++ u8 pad[3]; ++ } __packed tlv; ++ } __packed req = { ++ .hdr = { ++ .band_idx = vif->mt76.band_idx, ++ }, ++ .tlv = { ++ .tag = cpu_to_le16(1), ++ .len = cpu_to_le16(sizeof(req.tlv)), ++ .control_ch = chandef->chan->hw_value, ++ .center_ch = ieee80211_frequency_to_channel(freq1), ++ .drop_err = 1, ++ }, ++ }; ++ if (chandef->chan->band < ARRAY_SIZE(ch_band)) ++ req.tlv.ch_band = ch_band[chandef->chan->band]; ++ if (chandef->width < ARRAY_SIZE(ch_width)) ++ req.tlv.bw = ch_width[chandef->width]; ++ ++ if (freq2) ++ req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2); ++ ++ if (req.tlv.control_ch < req.tlv.center_ch) ++ req.tlv.sco = 1; /* SCA */ ++ else if (req.tlv.control_ch > req.tlv.center_ch) ++ req.tlv.sco = 3; /* SCB */ ++ ++ return mt76_mcu_send_msg(vif->phy->mt76->dev, MCU_UNI_CMD(SNIFFER), ++ &req, sizeof(req), true); ++} ++ + int + mt7921_mcu_uni_add_beacon_offload(struct mt7921_dev *dev, + struct ieee80211_hw *hw, +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h +index 15d6b7fe..d4cfa26c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h +@@ -529,6 +529,8 @@ void mt7921_set_ipv6_ns_work(struct work_struct *work); + + int mt7921_mcu_set_sniffer(struct mt7921_dev *dev, struct ieee80211_vif *vif, + bool enable); ++int mt7921_mcu_config_sniffer(struct mt7921_vif *vif, ++ struct ieee80211_chanctx_conf *ctx); + + int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + enum mt76_txq_id qid, struct mt76_wcid *wcid, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-240-wifi-mt76-mt7996-fix-chainmask-calculation-in-m.patch b/patches.kernel.org/6.2.3-240-wifi-mt76-mt7996-fix-chainmask-calculation-in-m.patch new file mode 100644 index 0000000..62734b7 --- /dev/null +++ b/patches.kernel.org/6.2.3-240-wifi-mt76-mt7996-fix-chainmask-calculation-in-m.patch @@ -0,0 +1,40 @@ +From: Shayne Chen +Date: Fri, 23 Dec 2022 18:13:45 +0800 +Subject: [PATCH] wifi: mt76: mt7996: fix chainmask calculation in + mt7996_set_antenna() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: eb1fdb9f5a2280de6820624cd02e0863babab683 + +[ Upstream commit eb1fdb9f5a2280de6820624cd02e0863babab683 ] + +Fix per-band chainmask when restoring from the dev chainmask. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Shayne Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/main.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index 4421cd54..c423b052 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -880,7 +880,10 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant) + phy->mt76->antenna_mask = tx_ant; + + /* restore to the origin chainmask which might have auxiliary path */ +- if (hweight8(tx_ant) == max_nss) ++ if (hweight8(tx_ant) == max_nss && band_idx < MT_BAND2) ++ phy->mt76->chainmask = ((dev->chainmask >> shift) & ++ (BIT(dev->chainshift[band_idx + 1] - shift) - 1)) << shift; ++ else if (hweight8(tx_ant) == max_nss) + phy->mt76->chainmask = (dev->chainmask >> shift) << shift; + else + phy->mt76->chainmask = tx_ant << shift; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-241-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch b/patches.kernel.org/6.2.3-241-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch new file mode 100644 index 0000000..91c5113 --- /dev/null +++ b/patches.kernel.org/6.2.3-241-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch @@ -0,0 +1,91 @@ +From: Shayne Chen +Date: Fri, 23 Dec 2022 18:13:46 +0800 +Subject: [PATCH] wifi: mt76: mt7996: update register for CFEND_RATE +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 793445cf812506375cbe4c59d0fb9f648f716e88 + +[ Upstream commit 793445cf812506375cbe4c59d0fb9f648f716e88 ] + +In newer chipsets, CFEND_RATE setting has been moved to different hw +module. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Shayne Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +- + drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 + + drivers/net/wireless/mediatek/mt76/mt7996/regs.h | 15 ++++++++------- + 3 files changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index 0b3e2874..ce4242f9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -1690,7 +1690,7 @@ void mt7996_mac_set_timing(struct mt7996_phy *phy) + else + val = MT7996_CFEND_RATE_11B; + +- mt76_rmw_field(dev, MT_AGG_ACR0(band_idx), MT_AGG_ACR_CFEND_RATE, val); ++ mt76_rmw_field(dev, MT_RATE_HRCR0(band_idx), MT_RATE_HRCR0_CFEND_RATE, val); + mt76_clear(dev, MT_ARB_SCR(band_idx), + MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +index 60781d04..d8a2c1a7 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +@@ -21,6 +21,7 @@ static const struct __base mt7996_reg_base[] = { + [WF_ETBF_BASE] = { { 0x820ea000, 0x820fa000, 0x830ea000 } }, + [WF_LPON_BASE] = { { 0x820eb000, 0x820fb000, 0x830eb000 } }, + [WF_MIB_BASE] = { { 0x820ed000, 0x820fd000, 0x830ed000 } }, ++ [WF_RATE_BASE] = { { 0x820ee000, 0x820fe000, 0x830ee000 } }, + }; + + static const struct __map mt7996_reg_map[] = { +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h +index 42980b97..7a28cae3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h +@@ -33,6 +33,7 @@ enum base_rev { + WF_ETBF_BASE, + WF_LPON_BASE, + WF_MIB_BASE, ++ WF_RATE_BASE, + __MT_REG_BASE_MAX, + }; + +@@ -235,13 +236,6 @@ enum base_rev { + FIELD_PREP(MT_WTBL_LMAC_ID, _id) | \ + FIELD_PREP(MT_WTBL_LMAC_DW, _dw)) + +-/* AGG: band 0(0x820e2000), band 1(0x820f2000), band 2(0x830e2000) */ +-#define MT_WF_AGG_BASE(_band) __BASE(WF_AGG_BASE, (_band)) +-#define MT_WF_AGG(_band, ofs) (MT_WF_AGG_BASE(_band) + (ofs)) +- +-#define MT_AGG_ACR0(_band) MT_WF_AGG(_band, 0x054) +-#define MT_AGG_ACR_CFEND_RATE GENMASK(13, 0) +- + /* ARB: band 0(0x820e3000), band 1(0x820f3000), band 2(0x830e3000) */ + #define MT_WF_ARB_BASE(_band) __BASE(WF_ARB_BASE, (_band)) + #define MT_WF_ARB(_band, ofs) (MT_WF_ARB_BASE(_band) + (ofs)) +@@ -300,6 +294,13 @@ enum base_rev { + #define MT_WF_RMAC_RSVD0(_band) MT_WF_RMAC(_band, 0x03e0) + #define MT_WF_RMAC_RSVD0_EIFS_CLR BIT(21) + ++/* RATE: band 0(0x820ee000), band 1(0x820fe000), band 2(0x830ee000) */ ++#define MT_WF_RATE_BASE(_band) __BASE(WF_RATE_BASE, (_band)) ++#define MT_WF_RATE(_band, ofs) (MT_WF_RATE_BASE(_band) + (ofs)) ++ ++#define MT_RATE_HRCR0(_band) MT_WF_RATE(_band, 0x050) ++#define MT_RATE_HRCR0_CFEND_RATE GENMASK(14, 0) ++ + /* WFDMA0 */ + #define MT_WFDMA0_BASE 0xd4000 + #define MT_WFDMA0(ofs) (MT_WFDMA0_BASE + (ofs)) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-242-wifi-mt76-connac-fix-POWER_CTRL-command-name-ty.patch b/patches.kernel.org/6.2.3-242-wifi-mt76-connac-fix-POWER_CTRL-command-name-ty.patch new file mode 100644 index 0000000..820491b --- /dev/null +++ b/patches.kernel.org/6.2.3-242-wifi-mt76-connac-fix-POWER_CTRL-command-name-ty.patch @@ -0,0 +1,50 @@ +From: Shayne Chen +Date: Fri, 23 Dec 2022 18:13:48 +0800 +Subject: [PATCH] wifi: mt76: connac: fix POWER_CTRL command name typo +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0d82fc956edb67b5755cc64ac6b9aee79cfbbff0 + +[ Upstream commit 0d82fc956edb67b5755cc64ac6b9aee79cfbbff0 ] + +Fix typo MCU_UNI_CMD_POWER_CREL to MCU_UNI_CMD_POWER_CTRL. + +Fixes: 779d34de055e ("wifi: mt76: connac: add more unified command IDs") +Signed-off-by: Shayne Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +index f1e942b9..82fdf6d7 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +@@ -1198,7 +1198,7 @@ enum { + MCU_UNI_CMD_REPT_MUAR = 0x09, + MCU_UNI_CMD_WSYS_CONFIG = 0x0b, + MCU_UNI_CMD_REG_ACCESS = 0x0d, +- MCU_UNI_CMD_POWER_CREL = 0x0f, ++ MCU_UNI_CMD_POWER_CTRL = 0x0f, + MCU_UNI_CMD_RX_HDR_TRANS = 0x12, + MCU_UNI_CMD_SER = 0x13, + MCU_UNI_CMD_TWT = 0x14, +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index a88fc768..d781c6e0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -2399,7 +2399,7 @@ mt7996_mcu_restart(struct mt76_dev *dev) + .power_mode = 1, + }; + +- return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CREL), &req, ++ return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CTRL), &req, + sizeof(req), false); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-243-wifi-mt76-mt7921-fix-invalid-remain_on_channel-.patch b/patches.kernel.org/6.2.3-243-wifi-mt76-mt7921-fix-invalid-remain_on_channel-.patch new file mode 100644 index 0000000..81d839b --- /dev/null +++ b/patches.kernel.org/6.2.3-243-wifi-mt76-mt7921-fix-invalid-remain_on_channel-.patch @@ -0,0 +1,38 @@ +From: Deren Wu +Date: Sat, 31 Dec 2022 17:01:10 +0800 +Subject: [PATCH] wifi: mt76: mt7921: fix invalid remain_on_channel duration +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c36457a8f34d1e0fc55fbbd7b8b2d716af3f6289 + +[ Upstream commit c36457a8f34d1e0fc55fbbd7b8b2d716af3f6289 ] + +round_jiffies_up() may change the duration reported from chip. We should +take the real timeout for current channel privilege. + +Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") +Signed-off-by: Deren Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +index bd929b5f..7253ce90 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +@@ -174,7 +174,7 @@ mt7921_mcu_uni_roc_event(struct mt7921_dev *dev, struct sk_buff *skb) + wake_up(&dev->phy.roc_wait); + duration = le32_to_cpu(grant->max_interval); + mod_timer(&dev->phy.roc_timer, +- round_jiffies_up(jiffies + msecs_to_jiffies(duration))); ++ jiffies + msecs_to_jiffies(duration)); + } + + static void +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-244-wifi-mt76-mt7915-fix-memory-leak-in-mt7915_mcu_.patch b/patches.kernel.org/6.2.3-244-wifi-mt76-mt7915-fix-memory-leak-in-mt7915_mcu_.patch new file mode 100644 index 0000000..a41b1f2 --- /dev/null +++ b/patches.kernel.org/6.2.3-244-wifi-mt76-mt7915-fix-memory-leak-in-mt7915_mcu_.patch @@ -0,0 +1,44 @@ +From: Lorenzo Bianconi +Date: Sun, 1 Jan 2023 12:42:04 +0100 +Subject: [PATCH] wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 49bd78282e79ad177d14f37f4049f0605bf92dad + +[ Upstream commit 49bd78282e79ad177d14f37f4049f0605bf92dad ] + +Always purge mcu skb queues in mt7915_mcu_exit routine even if +mt7915_firmware_state fails. + +Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index a861312b..f566ba77 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -2349,13 +2349,14 @@ void mt7915_mcu_exit(struct mt7915_dev *dev) + __mt76_mcu_restart(&dev->mt76); + if (mt7915_firmware_state(dev, false)) { + dev_err(dev->mt76.dev, "Failed to exit mcu\n"); +- return; ++ goto out; + } + + mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN); + if (dev->hif2) + mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1), + MT_TOP_LPCR_HOST_FW_OWN); ++out: + skb_queue_purge(&dev->mt76.mcu.res_q); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-245-wifi-mt76-mt7996-fix-memory-leak-in-mt7996_mcu_.patch b/patches.kernel.org/6.2.3-245-wifi-mt76-mt7996-fix-memory-leak-in-mt7996_mcu_.patch new file mode 100644 index 0000000..03a2676 --- /dev/null +++ b/patches.kernel.org/6.2.3-245-wifi-mt76-mt7996-fix-memory-leak-in-mt7996_mcu_.patch @@ -0,0 +1,44 @@ +From: Lorenzo Bianconi +Date: Sun, 1 Jan 2023 12:43:52 +0100 +Subject: [PATCH] wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: da5b4d93e141b52c5a71d0c41a042d1bcaf70d2e + +[ Upstream commit da5b4d93e141b52c5a71d0c41a042d1bcaf70d2e ] + +Always purge mcu skb queues in mt7996_mcu_exit routine even if +mt7996_firmware_state fails. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +index d781c6e0..d593ed9e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +@@ -2460,13 +2460,14 @@ void mt7996_mcu_exit(struct mt7996_dev *dev) + __mt76_mcu_restart(&dev->mt76); + if (mt7996_firmware_state(dev, false)) { + dev_err(dev->mt76.dev, "Failed to exit mcu\n"); +- return; ++ goto out; + } + + mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN); + if (dev->hif2) + mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1), + MT_TOP_LPCR_HOST_FW_OWN); ++out: + skb_queue_purge(&dev->mt76.mcu.res_q); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-246-wifi-mt76-dma-fix-memory-leak-running-mt76_dma_.patch b/patches.kernel.org/6.2.3-246-wifi-mt76-dma-fix-memory-leak-running-mt76_dma_.patch new file mode 100644 index 0000000..db3ed84 --- /dev/null +++ b/patches.kernel.org/6.2.3-246-wifi-mt76-dma-fix-memory-leak-running-mt76_dma_.patch @@ -0,0 +1,38 @@ +From: Lorenzo Bianconi +Date: Sun, 1 Jan 2023 12:50:05 +0100 +Subject: [PATCH] wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3f7dda36e0b6dfa2cd26191f754ba061ab8191f2 + +[ Upstream commit 3f7dda36e0b6dfa2cd26191f754ba061ab8191f2 ] + +Fix device unregister memory leak and alway cleanup all configured +rx queues in mt76_dma_tx_cleanup routine. + +Fixes: 52546e27787e ("wifi: mt76: add WED RX support to dma queue alloc") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/dma.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index 06161815c..dee4449d 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -975,8 +975,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev) + struct mt76_queue *q = &dev->q_rx[i]; + + netif_napi_del(&dev->napi[i]); +- if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags)) +- mt76_dma_rx_cleanup(dev, q); ++ mt76_dma_rx_cleanup(dev, q); + } + + mt76_free_pending_txwi(dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-247-wifi-mt76-fix-switch-default-case-in-mt7996_rev.patch b/patches.kernel.org/6.2.3-247-wifi-mt76-fix-switch-default-case-in-mt7996_rev.patch new file mode 100644 index 0000000..5d4dd14 --- /dev/null +++ b/patches.kernel.org/6.2.3-247-wifi-mt76-fix-switch-default-case-in-mt7996_rev.patch @@ -0,0 +1,38 @@ +From: Lorenzo Bianconi +Date: Tue, 3 Jan 2023 14:56:19 +0100 +Subject: [PATCH] wifi: mt76: fix switch default case in + mt7996_reverse_frag0_hdr_trans +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aed8d9b506c22848add261ffad8fdabc57f21964 + +[ Upstream commit aed8d9b506c22848add261ffad8fdabc57f21964 ] + +The switch default case for frame_contorl is invalid. Return -EINVAL +error for it. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index ce4242f9..96ced4c0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -469,7 +469,7 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap) + ether_addr_copy(hdr.addr4, eth_hdr->h_source); + break; + default: +- break; ++ return -EINVAL; + } + + skb_pull(skb, hdr_gap + sizeof(struct ethhdr) - 2); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-248-wifi-mt76-mt7915-fix-WED-TxS-reporting.patch b/patches.kernel.org/6.2.3-248-wifi-mt76-mt7915-fix-WED-TxS-reporting.patch new file mode 100644 index 0000000..a567258 --- /dev/null +++ b/patches.kernel.org/6.2.3-248-wifi-mt76-mt7915-fix-WED-TxS-reporting.patch @@ -0,0 +1,38 @@ +From: Ryder Lee +Date: Sat, 7 Jan 2023 05:40:42 +0800 +Subject: [PATCH] wifi: mt76: mt7915: fix WED TxS reporting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0d7084e209a9e2c924cb0d6e7f1f978db2a54127 + +[ Upstream commit 0d7084e209a9e2c924cb0d6e7f1f978db2a54127 ] + +The previous commit forgot to remove a leftover check. + +Fixes: 43eaa3689507 ("wifi: mt76: add PPDU based TxS support for WED device") +Reported-By: Sujuan Chen +Signed-off-by: Ryder Lee +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +index f0d5a360..1a6def77 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +@@ -1061,9 +1061,6 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data) + u16 wcidx; + u8 pid; + +- if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1) +- return; +- + wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID); + pid = le32_get_bits(txs_data[3], MT_TXS3_PID); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-249-wifi-mt76-add-memory-barrier-to-SDIO-queue-kick.patch b/patches.kernel.org/6.2.3-249-wifi-mt76-add-memory-barrier-to-SDIO-queue-kick.patch new file mode 100644 index 0000000..c7cd6a6 --- /dev/null +++ b/patches.kernel.org/6.2.3-249-wifi-mt76-add-memory-barrier-to-SDIO-queue-kick.patch @@ -0,0 +1,41 @@ +From: Deren Wu +Date: Sun, 15 Jan 2023 12:44:57 +0800 +Subject: [PATCH] wifi: mt76: add memory barrier to SDIO queue kick +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5f54237ad798f41cb6a503271aa9ca47188cfb9b + +[ Upstream commit 5f54237ad798f41cb6a503271aa9ca47188cfb9b ] + +Ensure the entry has been fully updated before SDIO bus worker access +it. This patch would fix potential memory risk in both mt7663s and +mt7921s. + +Fixes: 764dee47e2c1 ("mt76: sdio: move common code in mt76_sdio module") +Signed-off-by: Deren Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/sdio.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c +index 228bc7d4..41972311 100644 +--- a/drivers/net/wireless/mediatek/mt76/sdio.c ++++ b/drivers/net/wireless/mediatek/mt76/sdio.c +@@ -562,6 +562,10 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q, + + q->entry[q->head].buf_sz = len; + q->entry[q->head].skb = skb; ++ ++ /* ensure the entry fully updated before bus access */ ++ smp_wmb(); ++ + q->head = (q->head + 1) % q->ndesc; + q->queued++; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-250-wifi-mt76-mt7921-fix-error-code-of-return-in-mt.patch b/patches.kernel.org/6.2.3-250-wifi-mt76-mt7921-fix-error-code-of-return-in-mt.patch new file mode 100644 index 0000000..5ac471b --- /dev/null +++ b/patches.kernel.org/6.2.3-250-wifi-mt76-mt7921-fix-error-code-of-return-in-mt.patch @@ -0,0 +1,78 @@ +From: Aaron Ma +Date: Mon, 16 Jan 2023 23:22:35 +0800 +Subject: [PATCH] wifi: mt76: mt7921: fix error code of return in + mt7921_acpi_read +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 888d89034f9eaeab9b5b75f13dbe35376c7dd471 + +[ Upstream commit 888d89034f9eaeab9b5b75f13dbe35376c7dd471 ] + +Kernel NULL pointer dereference when ACPI SAR table isn't implemented well. +Fix the error code of return to mark the ACPI SAR table as invalid. + +[ 5.077128] mt7921e 0000:06:00.0: sar cnt = 0 +[ 5.077381] BUG: kernel NULL pointer dereference, address: +0000000000000004 +[ 5.077630] #PF: supervisor read access in kernel mode +[ 5.077883] #PF: error_code(0x0000) - not-present page +[ 5.078138] PGD 0 P4D 0 +[ 5.078398] Oops: 0000 [#1] PREEMPT SMP NOPTI +[ 5.079202] RIP: 0010:mt7921_init_acpi_sar+0x106/0x220 +[mt7921_common] +... +[ 5.080786] Call Trace: +[ 5.080786] +[ 5.080786] mt7921_register_device+0x37d/0x490 [mt7921_common] +[ 5.080786] mt7921_pci_probe.part.0+0x2ee/0x310 [mt7921e] +[ 5.080786] mt7921_pci_probe+0x52/0x70 [mt7921e] +[ 5.080786] local_pci_probe+0x47/0x90 +[ 5.080786] pci_call_probe+0x55/0x190 +[ 5.080786] pci_device_probe+0x84/0x120 + +Fixes: f965333e491e ("mt76: mt7921: introduce ACPI SAR support") +Signed-off-by: Aaron Ma +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c b/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c +index 47e034a9..ed9241d4 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c +@@ -33,14 +33,17 @@ mt7921_acpi_read(struct mt7921_dev *dev, u8 *method, u8 **tbl, u32 *len) + sar_root->package.elements[0].type != ACPI_TYPE_INTEGER) { + dev_err(mdev->dev, "sar cnt = %d\n", + sar_root->package.count); ++ ret = -EINVAL; + goto free; + } + + if (!*tbl) { + *tbl = devm_kzalloc(mdev->dev, sar_root->package.count, + GFP_KERNEL); +- if (!*tbl) ++ if (!*tbl) { ++ ret = -ENOMEM; + goto free; ++ } + } + if (len) + *len = sar_root->package.count; +@@ -52,9 +55,9 @@ mt7921_acpi_read(struct mt7921_dev *dev, u8 *method, u8 **tbl, u32 *len) + break; + *(*tbl + i) = (u8)sar_unit->integer.value; + } +-free: + ret = (i == sar_root->package.count) ? 0 : -EINVAL; + ++free: + kfree(sar_root); + + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-251-wifi-mt76-mt7996-rely-on-mt76_connac2_mac_tx_ra.patch b/patches.kernel.org/6.2.3-251-wifi-mt76-mt7996-rely-on-mt76_connac2_mac_tx_ra.patch new file mode 100644 index 0000000..00bb3a3 --- /dev/null +++ b/patches.kernel.org/6.2.3-251-wifi-mt76-mt7996-rely-on-mt76_connac2_mac_tx_ra.patch @@ -0,0 +1,133 @@ +From: Lorenzo Bianconi +Date: Tue, 17 Jan 2023 01:16:07 +0100 +Subject: [PATCH] wifi: mt76: mt7996: rely on mt76_connac2_mac_tx_rate_val +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0b8e2d69467f78a7c9d87b452220e87012435e33 + +[ Upstream commit 0b8e2d69467f78a7c9d87b452220e87012435e33 ] + +In order to fix a possible NULL pointer dereference in +mt7996_mac_write_txwi() of vif pointer, export +mt76_connac2_mac_tx_rate_val utility routine and reuse it +in mt7996 driver. + +Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/wireless/mediatek/mt76/mt76_connac.h | 3 ++ + .../wireless/mediatek/mt76/mt76_connac_mac.c | 7 +-- + .../net/wireless/mediatek/mt76/mt7996/mac.c | 48 +------------------ + 3 files changed, 9 insertions(+), 49 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac.h +index 8ba883b0..2ee9a3c8 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac.h +@@ -370,6 +370,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi, + struct sk_buff *skb, struct mt76_wcid *wcid, + struct ieee80211_key_conf *key, int pid, + enum mt76_txq_id qid, u32 changed); ++u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, ++ struct ieee80211_vif *vif, ++ bool beacon, bool mcast); + bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid, + __le32 *txs_data); + bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid, +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +index c8d0c84e..aed4ee95 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +@@ -267,9 +267,9 @@ int mt76_connac_init_tx_queues(struct mt76_phy *phy, int idx, int n_desc, + } + EXPORT_SYMBOL_GPL(mt76_connac_init_tx_queues); + +-static u16 +-mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif, +- bool beacon, bool mcast) ++u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, ++ struct ieee80211_vif *vif, ++ bool beacon, bool mcast) + { + u8 mode = 0, band = mphy->chandef.chan->band; + int rateidx = 0, mcast_rate; +@@ -319,6 +319,7 @@ mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif, + return FIELD_PREP(MT_TX_RATE_IDX, rateidx) | + FIELD_PREP(MT_TX_RATE_MODE, mode); + } ++EXPORT_SYMBOL_GPL(mt76_connac2_mac_tx_rate_val); + + static void + mt76_connac2_mac_write_txwi_8023(__le32 *txwi, struct sk_buff *skb, +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index 96ced4c0..0eb9e4d7 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -959,51 +959,6 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi, + } + } + +-static u16 +-mt7996_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif, +- bool beacon, bool mcast) +-{ +- u8 mode = 0, band = mphy->chandef.chan->band; +- int rateidx = 0, mcast_rate; +- +- if (beacon) { +- struct cfg80211_bitrate_mask *mask; +- +- mask = &vif->bss_conf.beacon_tx_rate; +- if (hweight16(mask->control[band].he_mcs[0]) == 1) { +- rateidx = ffs(mask->control[band].he_mcs[0]) - 1; +- mode = MT_PHY_TYPE_HE_SU; +- goto out; +- } else if (hweight16(mask->control[band].vht_mcs[0]) == 1) { +- rateidx = ffs(mask->control[band].vht_mcs[0]) - 1; +- mode = MT_PHY_TYPE_VHT; +- goto out; +- } else if (hweight8(mask->control[band].ht_mcs[0]) == 1) { +- rateidx = ffs(mask->control[band].ht_mcs[0]) - 1; +- mode = MT_PHY_TYPE_HT; +- goto out; +- } else if (hweight32(mask->control[band].legacy) == 1) { +- rateidx = ffs(mask->control[band].legacy) - 1; +- goto legacy; +- } +- } +- +- mcast_rate = vif->bss_conf.mcast_rate[band]; +- if (mcast && mcast_rate > 0) +- rateidx = mcast_rate - 1; +- else +- rateidx = ffs(vif->bss_conf.basic_rates) - 1; +- +-legacy: +- rateidx = mt76_calculate_default_rate(mphy, rateidx); +- mode = rateidx >> 8; +- rateidx &= GENMASK(7, 0); +- +-out: +- return FIELD_PREP(MT_TX_RATE_IDX, rateidx) | +- FIELD_PREP(MT_TX_RATE_MODE, mode); +-} +- + void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, + struct sk_buff *skb, struct mt76_wcid *wcid, int pid, + struct ieee80211_key_conf *key, u32 changed) +@@ -1091,7 +1046,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, + /* Fixed rata is available just for 802.11 txd */ + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + bool multicast = is_multicast_ether_addr(hdr->addr1); +- u16 rate = mt7996_mac_tx_rate_val(mphy, vif, beacon, multicast); ++ u16 rate = mt76_connac2_mac_tx_rate_val(mphy, vif, beacon, ++ multicast); + + /* fix to bw 20 */ + val = MT_TXD6_FIXED_BW | +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-252-net-mlx5-Enhance-debug-print-in-page-allocation.patch b/patches.kernel.org/6.2.3-252-net-mlx5-Enhance-debug-print-in-page-allocation.patch new file mode 100644 index 0000000..29071fe --- /dev/null +++ b/patches.kernel.org/6.2.3-252-net-mlx5-Enhance-debug-print-in-page-allocation.patch @@ -0,0 +1,39 @@ +From: Jack Morgenstein +Date: Wed, 18 Jan 2023 19:57:04 +0200 +Subject: [PATCH] net/mlx5: Enhance debug print in page allocation failure +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7eef93003e5d20e1a6a6e59e12d914b5431cbda2 + +[ Upstream commit 7eef93003e5d20e1a6a6e59e12d914b5431cbda2 ] + +Provide more details to aid debugging. + +Fixes: bf0bf77f6519 ("mlx5: Support communicating arbitrary host page size to firmware") +Signed-off-by: Eran Ben Elisha +Signed-off-by: Majd Dibbiny +Signed-off-by: Jack Morgenstein +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index 0eb50be1..64d4e712 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -219,7 +219,8 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u32 function) + + n = find_first_bit(&fp->bitmask, 8 * sizeof(fp->bitmask)); + if (n >= MLX5_NUM_4K_IN_PAGE) { +- mlx5_core_warn(dev, "alloc 4k bug\n"); ++ mlx5_core_warn(dev, "alloc 4k bug: fw page = 0x%llx, n = %u, bitmask: %lu, max num of 4K pages: %d\n", ++ fp->addr, n, fp->bitmask, MLX5_NUM_4K_IN_PAGE); + return -ENOENT; + } + clear_bit(n, &fp->bitmask); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-253-irqchip-Fix-refcount-leak-in-platform_irqchip_p.patch b/patches.kernel.org/6.2.3-253-irqchip-Fix-refcount-leak-in-platform_irqchip_p.patch new file mode 100644 index 0000000..cd27b7b --- /dev/null +++ b/patches.kernel.org/6.2.3-253-irqchip-Fix-refcount-leak-in-platform_irqchip_p.patch @@ -0,0 +1,54 @@ +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 16:13:18 +0400 +Subject: [PATCH] irqchip: Fix refcount leak in platform_irqchip_probe +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6caa5a2b78f5f53c433d3a3781e53325da22f0ac + +[ Upstream commit 6caa5a2b78f5f53c433d3a3781e53325da22f0ac ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: f8410e626569 ("irqchip: Add IRQCHIP_PLATFORM_DRIVER_BEGIN/END and IRQCHIP_MATCH helper macros") +Signed-off-by: Miaoqian Lin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230102121318.3990586-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/irqchip/irqchip.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/irqchip/irqchip.c b/drivers/irqchip/irqchip.c +index 3570f0a5..7899607f 100644 +--- a/drivers/irqchip/irqchip.c ++++ b/drivers/irqchip/irqchip.c +@@ -38,8 +38,10 @@ int platform_irqchip_probe(struct platform_device *pdev) + struct device_node *par_np = of_irq_find_parent(np); + of_irq_init_cb_t irq_init_cb = of_device_get_match_data(&pdev->dev); + +- if (!irq_init_cb) ++ if (!irq_init_cb) { ++ of_node_put(par_np); + return -EINVAL; ++ } + + if (par_np == np) + par_np = NULL; +@@ -52,8 +54,10 @@ int platform_irqchip_probe(struct platform_device *pdev) + * interrupt controller. The actual initialization callback of this + * interrupt controller can check for specific domains as necessary. + */ +- if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) ++ if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) { ++ of_node_put(par_np); + return -EPROBE_DEFER; ++ } + + return irq_init_cb(np, par_np); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-254-irqchip-alpine-msi-Fix-refcount-leak-in-alpine_.patch b/patches.kernel.org/6.2.3-254-irqchip-alpine-msi-Fix-refcount-leak-in-alpine_.patch new file mode 100644 index 0000000..b32fc87 --- /dev/null +++ b/patches.kernel.org/6.2.3-254-irqchip-alpine-msi-Fix-refcount-leak-in-alpine_.patch @@ -0,0 +1,39 @@ +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 12:28:10 +0400 +Subject: [PATCH] irqchip/alpine-msi: Fix refcount leak in + alpine_msix_init_domains +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 071d068b89e95d1b078aa6bbcb9d0961b77d6aa1 + +[ Upstream commit 071d068b89e95d1b078aa6bbcb9d0961b77d6aa1 ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller") +Signed-off-by: Miaoqian Lin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230102082811.3947760-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/irqchip/irq-alpine-msi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c +index 5ddb8e57..fc1ef7de 100644 +--- a/drivers/irqchip/irq-alpine-msi.c ++++ b/drivers/irqchip/irq-alpine-msi.c +@@ -199,6 +199,7 @@ static int alpine_msix_init_domains(struct alpine_msix_data *priv, + } + + gic_domain = irq_find_host(gic_node); ++ of_node_put(gic_node); + if (!gic_domain) { + pr_err("Failed to find the GIC domain\n"); + return -ENXIO; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-255-irqchip-irq-mvebu-gicp-Fix-refcount-leak-in-mve.patch b/patches.kernel.org/6.2.3-255-irqchip-irq-mvebu-gicp-Fix-refcount-leak-in-mve.patch new file mode 100644 index 0000000..5593bc7 --- /dev/null +++ b/patches.kernel.org/6.2.3-255-irqchip-irq-mvebu-gicp-Fix-refcount-leak-in-mve.patch @@ -0,0 +1,38 @@ +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 12:42:08 +0400 +Subject: [PATCH] irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9419e700021a393f67be36abd0c4f3acc6139041 + +[ Upstream commit 9419e700021a393f67be36abd0c4f3acc6139041 ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: a68a63cb4dfc ("irqchip/irq-mvebu-gicp: Add new driver for Marvell GICP") +Signed-off-by: Miaoqian Lin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230102084208.3951758-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/irqchip/irq-mvebu-gicp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/irq-mvebu-gicp.c b/drivers/irqchip/irq-mvebu-gicp.c +index fe88a782..c43a3450 100644 +--- a/drivers/irqchip/irq-mvebu-gicp.c ++++ b/drivers/irqchip/irq-mvebu-gicp.c +@@ -221,6 +221,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev) + } + + parent_domain = irq_find_host(irq_parent_dn); ++ of_node_put(irq_parent_dn); + if (!parent_domain) { + dev_err(&pdev->dev, "failed to find parent IRQ domain\n"); + return -ENODEV; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-256-irqchip-ti-sci-Fix-refcount-leak-in-ti_sci_intr.patch b/patches.kernel.org/6.2.3-256-irqchip-ti-sci-Fix-refcount-leak-in-ti_sci_intr.patch new file mode 100644 index 0000000..c49731b --- /dev/null +++ b/patches.kernel.org/6.2.3-256-irqchip-ti-sci-Fix-refcount-leak-in-ti_sci_intr.patch @@ -0,0 +1,39 @@ +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 12:56:10 +0400 +Subject: [PATCH] irqchip/ti-sci: Fix refcount leak in + ti_sci_intr_irq_domain_probe +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 02298b7bae12936ca313975b02e7f98b06670d37 + +[ Upstream commit 02298b7bae12936ca313975b02e7f98b06670d37 ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: cd844b0715ce ("irqchip/ti-sci-intr: Add support for Interrupt Router driver") +Signed-off-by: Miaoqian Lin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230102085611.3955984-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/irqchip/irq-ti-sci-intr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/irq-ti-sci-intr.c b/drivers/irqchip/irq-ti-sci-intr.c +index fe8fad22..020ddf29 100644 +--- a/drivers/irqchip/irq-ti-sci-intr.c ++++ b/drivers/irqchip/irq-ti-sci-intr.c +@@ -236,6 +236,7 @@ static int ti_sci_intr_irq_domain_probe(struct platform_device *pdev) + } + + parent_domain = irq_find_host(parent_node); ++ of_node_put(parent_node); + if (!parent_domain) { + dev_err(dev, "Failed to find IRQ parent domain\n"); + return -ENODEV; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-257-s390-mem_detect-fix-detect_memory-error-handlin.patch b/patches.kernel.org/6.2.3-257-s390-mem_detect-fix-detect_memory-error-handlin.patch new file mode 100644 index 0000000..c5bd649 --- /dev/null +++ b/patches.kernel.org/6.2.3-257-s390-mem_detect-fix-detect_memory-error-handlin.patch @@ -0,0 +1,42 @@ +From: Vasily Gorbik +Date: Fri, 27 Jan 2023 14:03:07 +0100 +Subject: [PATCH] s390/mem_detect: fix detect_memory() error handling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3400c35a4090704e6c465449616ab7e67a9209e7 + +[ Upstream commit 3400c35a4090704e6c465449616ab7e67a9209e7 ] + +Currently if for some reason sclp_early_read_info() fails, +sclp_early_get_memsize() will not set max_physmem_end and it +will stay uninitialized. Any garbage value other than 0 will lead +to detect_memory() taking wrong path or returning a garbage value +as max_physmem_end. To avoid that simply initialize max_physmem_end. + +Fixes: 73045a08cf55 ("s390: unify identity mapping limits handling") +Reported-by: Alexander Gordeev +Reviewed-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/boot/mem_detect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c +index 7fa1a32e..0a5821ef 100644 +--- a/arch/s390/boot/mem_detect.c ++++ b/arch/s390/boot/mem_detect.c +@@ -165,7 +165,7 @@ static void search_mem_end(void) + + unsigned long detect_memory(void) + { +- unsigned long max_physmem_end; ++ unsigned long max_physmem_end = 0; + + sclp_early_get_memsize(&max_physmem_end); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-258-s390-vmem-fix-empty-page-tables-cleanup-under-K.patch b/patches.kernel.org/6.2.3-258-s390-vmem-fix-empty-page-tables-cleanup-under-K.patch new file mode 100644 index 0000000..7943b75 --- /dev/null +++ b/patches.kernel.org/6.2.3-258-s390-vmem-fix-empty-page-tables-cleanup-under-K.patch @@ -0,0 +1,60 @@ +From: Vasily Gorbik +Date: Sat, 28 Jan 2023 17:35:12 +0100 +Subject: [PATCH] s390/vmem: fix empty page tables cleanup under KASAN +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 108303b0a2d27cb14eed565e33e64ad9eefe5d7e + +[ Upstream commit 108303b0a2d27cb14eed565e33e64ad9eefe5d7e ] + +Commit b9ff81003cf1 ("s390/vmem: cleanup empty page tables") introduced +empty page tables cleanup in vmem code, but when the kernel is built +with KASAN enabled the code has no effect due to wrong KASAN shadow +memory intersection condition, which effectively ignores any memory +range below KASAN shadow. Fix intersection condition to make code +work as anticipated. + +Fixes: b9ff81003cf1 ("s390/vmem: cleanup empty page tables") +Reviewed-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/mm/vmem.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c +index ee1a9707..9a0ce531 100644 +--- a/arch/s390/mm/vmem.c ++++ b/arch/s390/mm/vmem.c +@@ -297,7 +297,7 @@ static void try_free_pmd_table(pud_t *pud, unsigned long start) + if (end > VMALLOC_START) + return; + #ifdef CONFIG_KASAN +- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end) ++ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START) + return; + #endif + pmd = pmd_offset(pud, start); +@@ -372,7 +372,7 @@ static void try_free_pud_table(p4d_t *p4d, unsigned long start) + if (end > VMALLOC_START) + return; + #ifdef CONFIG_KASAN +- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end) ++ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START) + return; + #endif + +@@ -426,7 +426,7 @@ static void try_free_p4d_table(pgd_t *pgd, unsigned long start) + if (end > VMALLOC_START) + return; + #ifdef CONFIG_KASAN +- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end) ++ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START) + return; + #endif + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-259-s390-boot-cleanup-decompressor-header-files.patch b/patches.kernel.org/6.2.3-259-s390-boot-cleanup-decompressor-header-files.patch new file mode 100644 index 0000000..5920d22 --- /dev/null +++ b/patches.kernel.org/6.2.3-259-s390-boot-cleanup-decompressor-header-files.patch @@ -0,0 +1,135 @@ +From: Alexander Gordeev +Date: Thu, 5 May 2022 16:54:54 +0200 +Subject: [PATCH] s390/boot: cleanup decompressor header files +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9c3205b2b062420c26b33924b910880889acf832 + +[ Upstream commit 9c3205b2b062420c26b33924b910880889acf832 ] + +Move declarations to appropriate header files. Instead of cryptic +casting directly assign struct vmlinux_info type to _vmlinux_info +linker script variable - wich it actually is. + +Reviewed-by: Heiko Carstens +Signed-off-by: Alexander Gordeev +Signed-off-by: Heiko Carstens +Stable-dep-of: 22476f47b6b7 ("s390/boot: fix mem_detect extended area allocation") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/boot/boot.h | 24 ++++++++++++++++++++++-- + arch/s390/boot/decompressor.c | 1 + + arch/s390/boot/decompressor.h | 26 -------------------------- + 3 files changed, 23 insertions(+), 28 deletions(-) + +diff --git a/arch/s390/boot/boot.h b/arch/s390/boot/boot.h +index 70418389..f6e82cf7 100644 +--- a/arch/s390/boot/boot.h ++++ b/arch/s390/boot/boot.h +@@ -8,10 +8,26 @@ + + #ifndef __ASSEMBLY__ + ++struct vmlinux_info { ++ unsigned long default_lma; ++ void (*entry)(void); ++ unsigned long image_size; /* does not include .bss */ ++ unsigned long bss_size; /* uncompressed image .bss size */ ++ unsigned long bootdata_off; ++ unsigned long bootdata_size; ++ unsigned long bootdata_preserved_off; ++ unsigned long bootdata_preserved_size; ++ unsigned long dynsym_start; ++ unsigned long rela_dyn_start; ++ unsigned long rela_dyn_end; ++ unsigned long amode31_size; ++}; ++ + void startup_kernel(void); + unsigned long detect_memory(void); + bool is_ipl_block_dump(void); + void store_ipl_parmblock(void); ++unsigned long read_ipl_report(unsigned long safe_offset); + void setup_boot_command_line(void); + void parse_boot_command_line(void); + void verify_facilities(void); +@@ -20,6 +36,7 @@ void sclp_early_setup_buffer(void); + void print_pgm_check_info(void); + unsigned long get_random_base(unsigned long safe_addr); + void __printf(1, 2) decompressor_printk(const char *fmt, ...); ++void error(char *m); + + /* Symbols defined by linker scripts */ + extern const char kernel_version[]; +@@ -31,8 +48,11 @@ extern char __boot_data_start[], __boot_data_end[]; + extern char __boot_data_preserved_start[], __boot_data_preserved_end[]; + extern char _decompressor_syms_start[], _decompressor_syms_end[]; + extern char _stack_start[], _stack_end[]; +- +-unsigned long read_ipl_report(unsigned long safe_offset); ++extern char _end[]; ++extern unsigned char _compressed_start[]; ++extern unsigned char _compressed_end[]; ++extern struct vmlinux_info _vmlinux_info; ++#define vmlinux _vmlinux_info + + #endif /* __ASSEMBLY__ */ + #endif /* BOOT_BOOT_H */ +diff --git a/arch/s390/boot/decompressor.c b/arch/s390/boot/decompressor.c +index b519a1f0..d762733a 100644 +--- a/arch/s390/boot/decompressor.c ++++ b/arch/s390/boot/decompressor.c +@@ -11,6 +11,7 @@ + #include + #include + #include "decompressor.h" ++#include "boot.h" + + /* + * gzip declarations +diff --git a/arch/s390/boot/decompressor.h b/arch/s390/boot/decompressor.h +index f75cc31a..92b81d2e 100644 +--- a/arch/s390/boot/decompressor.h ++++ b/arch/s390/boot/decompressor.h +@@ -2,37 +2,11 @@ + #ifndef BOOT_COMPRESSED_DECOMPRESSOR_H + #define BOOT_COMPRESSED_DECOMPRESSOR_H + +-#include +- + #ifdef CONFIG_KERNEL_UNCOMPRESSED + static inline void *decompress_kernel(void) { return NULL; } + #else + void *decompress_kernel(void); + #endif + unsigned long mem_safe_offset(void); +-void error(char *m); +- +-struct vmlinux_info { +- unsigned long default_lma; +- void (*entry)(void); +- unsigned long image_size; /* does not include .bss */ +- unsigned long bss_size; /* uncompressed image .bss size */ +- unsigned long bootdata_off; +- unsigned long bootdata_size; +- unsigned long bootdata_preserved_off; +- unsigned long bootdata_preserved_size; +- unsigned long dynsym_start; +- unsigned long rela_dyn_start; +- unsigned long rela_dyn_end; +- unsigned long amode31_size; +-}; +- +-/* Symbols defined by linker scripts */ +-extern char _end[]; +-extern unsigned char _compressed_start[]; +-extern unsigned char _compressed_end[]; +-extern char _vmlinux_info[]; +- +-#define vmlinux (*(struct vmlinux_info *)_vmlinux_info) + + #endif /* BOOT_COMPRESSED_DECOMPRESSOR_H */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-260-s390-mem_detect-rely-on-diag260-if-sclp_early_g.patch b/patches.kernel.org/6.2.3-260-s390-mem_detect-rely-on-diag260-if-sclp_early_g.patch new file mode 100644 index 0000000..e037241 --- /dev/null +++ b/patches.kernel.org/6.2.3-260-s390-mem_detect-rely-on-diag260-if-sclp_early_g.patch @@ -0,0 +1,41 @@ +From: Vasily Gorbik +Date: Fri, 27 Jan 2023 14:57:43 +0100 +Subject: [PATCH] s390/mem_detect: rely on diag260() if + sclp_early_get_memsize() fails +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: eb33f9eb304a4c18beb5ba6362eaa5c4beaf40d8 + +[ Upstream commit eb33f9eb304a4c18beb5ba6362eaa5c4beaf40d8 ] + +In case sclp_early_get_memsize() fails but diag260() succeeds make sure +some sane value is returned. This error scenario is highly unlikely, +but this change makes system able to boot in such case. + +Suggested-by: Alexander Gordeev +Reviewed-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Stable-dep-of: 22476f47b6b7 ("s390/boot: fix mem_detect extended area allocation") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/boot/mem_detect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c +index 0a5821ef..41792a3a 100644 +--- a/arch/s390/boot/mem_detect.c ++++ b/arch/s390/boot/mem_detect.c +@@ -176,7 +176,7 @@ unsigned long detect_memory(void) + + if (!diag260()) { + mem_detect.info_source = MEM_DETECT_DIAG260; +- return max_physmem_end; ++ return max_physmem_end ?: get_mem_detect_end(); + } + + if (max_physmem_end) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-261-s390-boot-fix-mem_detect-extended-area-allocati.patch b/patches.kernel.org/6.2.3-261-s390-boot-fix-mem_detect-extended-area-allocati.patch new file mode 100644 index 0000000..57ec274 --- /dev/null +++ b/patches.kernel.org/6.2.3-261-s390-boot-fix-mem_detect-extended-area-allocati.patch @@ -0,0 +1,228 @@ +From: Vasily Gorbik +Date: Mon, 23 Jan 2023 12:49:47 +0100 +Subject: [PATCH] s390/boot: fix mem_detect extended area allocation +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 22476f47b6b7fb7d066c71f67ebc11892adb0849 + +[ Upstream commit 22476f47b6b7fb7d066c71f67ebc11892adb0849 ] + +Allocation of mem_detect extended area was not considered neither +in commit 9641b8cc733f ("s390/ipl: read IPL report at early boot") +nor in commit b2d24b97b2a9 ("s390/kernel: add support for kernel address +space layout randomization (KASLR)"). As a result mem_detect extended +theoretically may overlap with ipl report or randomized kernel image +position. But as mem_detect code will allocate extended area only +upon exceeding 255 online regions (which should alternate with offline +memory regions) it is not seen in practice. + +To make sure mem_detect extended area does not overlap with ipl report +or randomized kernel position extend usage of "safe_addr". Make initrd +handling and mem_detect extended area allocation code move it further +right and make KASLR takes in into consideration as well. + +Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot") +Fixes: b2d24b97b2a9 ("s390/kernel: add support for kernel address space layout randomization (KASLR)") +Reviewed-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/boot/boot.h | 4 +-- + arch/s390/boot/kaslr.c | 6 ----- + arch/s390/boot/mem_detect.c | 52 ++++++++++++------------------------- + arch/s390/boot/startup.c | 21 ++++++++------- + 4 files changed, 31 insertions(+), 52 deletions(-) + +diff --git a/arch/s390/boot/boot.h b/arch/s390/boot/boot.h +index f6e82cf7..939a1b78 100644 +--- a/arch/s390/boot/boot.h ++++ b/arch/s390/boot/boot.h +@@ -24,10 +24,10 @@ struct vmlinux_info { + }; + + void startup_kernel(void); +-unsigned long detect_memory(void); ++unsigned long detect_memory(unsigned long *safe_addr); + bool is_ipl_block_dump(void); + void store_ipl_parmblock(void); +-unsigned long read_ipl_report(unsigned long safe_offset); ++unsigned long read_ipl_report(unsigned long safe_addr); + void setup_boot_command_line(void); + void parse_boot_command_line(void); + void verify_facilities(void); +diff --git a/arch/s390/boot/kaslr.c b/arch/s390/boot/kaslr.c +index e8d74d4f..58a8d8c8 100644 +--- a/arch/s390/boot/kaslr.c ++++ b/arch/s390/boot/kaslr.c +@@ -174,7 +174,6 @@ unsigned long get_random_base(unsigned long safe_addr) + { + unsigned long memory_limit = get_mem_detect_end(); + unsigned long base_pos, max_pos, kernel_size; +- unsigned long kasan_needs; + int i; + + memory_limit = min(memory_limit, ident_map_size); +@@ -186,12 +185,7 @@ unsigned long get_random_base(unsigned long safe_addr) + */ + memory_limit -= kasan_estimate_memory_needs(memory_limit); + +- if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size) { +- if (safe_addr < initrd_data.start + initrd_data.size) +- safe_addr = initrd_data.start + initrd_data.size; +- } + safe_addr = ALIGN(safe_addr, THREAD_SIZE); +- + kernel_size = vmlinux.image_size + vmlinux.bss_size; + if (safe_addr + kernel_size > memory_limit) + return 0; +diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c +index 41792a3a..daa15931 100644 +--- a/arch/s390/boot/mem_detect.c ++++ b/arch/s390/boot/mem_detect.c +@@ -16,29 +16,10 @@ struct mem_detect_info __bootdata(mem_detect); + #define ENTRIES_EXTENDED_MAX \ + (256 * (1020 / 2) * sizeof(struct mem_detect_block)) + +-/* +- * To avoid corrupting old kernel memory during dump, find lowest memory +- * chunk possible either right after the kernel end (decompressed kernel) or +- * after initrd (if it is present and there is no hole between the kernel end +- * and initrd) +- */ +-static void *mem_detect_alloc_extended(void) +-{ +- unsigned long offset = ALIGN(mem_safe_offset(), sizeof(u64)); +- +- if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size && +- initrd_data.start < offset + ENTRIES_EXTENDED_MAX) +- offset = ALIGN(initrd_data.start + initrd_data.size, sizeof(u64)); +- +- return (void *)offset; +-} +- + static struct mem_detect_block *__get_mem_detect_block_ptr(u32 n) + { + if (n < MEM_INLINED_ENTRIES) + return &mem_detect.entries[n]; +- if (unlikely(!mem_detect.entries_extended)) +- mem_detect.entries_extended = mem_detect_alloc_extended(); + return &mem_detect.entries_extended[n - MEM_INLINED_ENTRIES]; + } + +@@ -147,7 +128,7 @@ static int tprot(unsigned long addr) + return rc; + } + +-static void search_mem_end(void) ++static unsigned long search_mem_end(void) + { + unsigned long range = 1 << (MAX_PHYSMEM_BITS - 20); /* in 1MB blocks */ + unsigned long offset = 0; +@@ -159,33 +140,34 @@ static void search_mem_end(void) + if (!tprot(pivot << 20)) + offset = pivot; + } +- +- add_mem_detect_block(0, (offset + 1) << 20); ++ return (offset + 1) << 20; + } + +-unsigned long detect_memory(void) ++unsigned long detect_memory(unsigned long *safe_addr) + { + unsigned long max_physmem_end = 0; + + sclp_early_get_memsize(&max_physmem_end); ++ mem_detect.entries_extended = (struct mem_detect_block *)ALIGN(*safe_addr, sizeof(u64)); + + if (!sclp_early_read_storage_info()) { + mem_detect.info_source = MEM_DETECT_SCLP_STOR_INFO; +- return max_physmem_end; +- } +- +- if (!diag260()) { ++ } else if (!diag260()) { + mem_detect.info_source = MEM_DETECT_DIAG260; +- return max_physmem_end ?: get_mem_detect_end(); +- } +- +- if (max_physmem_end) { ++ max_physmem_end = max_physmem_end ?: get_mem_detect_end(); ++ } else if (max_physmem_end) { + add_mem_detect_block(0, max_physmem_end); + mem_detect.info_source = MEM_DETECT_SCLP_READ_INFO; +- return max_physmem_end; ++ } else { ++ max_physmem_end = search_mem_end(); ++ add_mem_detect_block(0, max_physmem_end); ++ mem_detect.info_source = MEM_DETECT_BIN_SEARCH; ++ } ++ ++ if (mem_detect.count > MEM_INLINED_ENTRIES) { ++ *safe_addr += (mem_detect.count - MEM_INLINED_ENTRIES) * ++ sizeof(struct mem_detect_block); + } + +- search_mem_end(); +- mem_detect.info_source = MEM_DETECT_BIN_SEARCH; +- return get_mem_detect_end(); ++ return max_physmem_end; + } +diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c +index 47ca3264..e0863d28 100644 +--- a/arch/s390/boot/startup.c ++++ b/arch/s390/boot/startup.c +@@ -57,16 +57,17 @@ unsigned long mem_safe_offset(void) + } + #endif + +-static void rescue_initrd(unsigned long addr) ++static unsigned long rescue_initrd(unsigned long safe_addr) + { + if (!IS_ENABLED(CONFIG_BLK_DEV_INITRD)) +- return; ++ return safe_addr; + if (!initrd_data.start || !initrd_data.size) +- return; +- if (addr <= initrd_data.start) +- return; +- memmove((void *)addr, (void *)initrd_data.start, initrd_data.size); +- initrd_data.start = addr; ++ return safe_addr; ++ if (initrd_data.start < safe_addr) { ++ memmove((void *)safe_addr, (void *)initrd_data.start, initrd_data.size); ++ initrd_data.start = safe_addr; ++ } ++ return initrd_data.start + initrd_data.size; + } + + static void copy_bootdata(void) +@@ -250,6 +251,7 @@ static unsigned long reserve_amode31(unsigned long safe_addr) + + void startup_kernel(void) + { ++ unsigned long max_physmem_end; + unsigned long random_lma; + unsigned long safe_addr; + void *img; +@@ -265,12 +267,13 @@ void startup_kernel(void) + safe_addr = reserve_amode31(safe_addr); + safe_addr = read_ipl_report(safe_addr); + uv_query_info(); +- rescue_initrd(safe_addr); ++ safe_addr = rescue_initrd(safe_addr); + sclp_early_read_info(); + setup_boot_command_line(); + parse_boot_command_line(); + sanitize_prot_virt_host(); +- setup_ident_map_size(detect_memory()); ++ max_physmem_end = detect_memory(&safe_addr); ++ setup_ident_map_size(max_physmem_end); + setup_vmalloc_size(); + setup_kernel_memory_layout(); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-262-net-add-sock_init_data_uid.patch b/patches.kernel.org/6.2.3-262-net-add-sock_init_data_uid.patch new file mode 100644 index 0000000..5f9418d --- /dev/null +++ b/patches.kernel.org/6.2.3-262-net-add-sock_init_data_uid.patch @@ -0,0 +1,90 @@ +From: Pietro Borrello +Date: Sat, 4 Feb 2023 17:39:20 +0000 +Subject: [PATCH] net: add sock_init_data_uid() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 584f3742890e966d2f0a1f3c418c9ead70b2d99e + +[ Upstream commit 584f3742890e966d2f0a1f3c418c9ead70b2d99e ] + +Add sock_init_data_uid() to explicitly initialize the socket uid. +To initialise the socket uid, sock_init_data() assumes a the struct +socket* sock is always embedded in a struct socket_alloc, used to +access the corresponding inode uid. This may not be true. +Examples are sockets created in tun_chr_open() and tap_open(). + +Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") +Signed-off-by: Pietro Borrello +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/net/sock.h | 7 ++++++- + net/core/sock.c | 15 ++++++++++++--- + 2 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index 55620972..c6584a35 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1956,7 +1956,12 @@ void sk_common_release(struct sock *sk); + * Default socket callbacks and setup code + */ + +-/* Initialise core socket variables */ ++/* Initialise core socket variables using an explicit uid. */ ++void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid); ++ ++/* Initialise core socket variables. ++ * Assumes struct socket *sock is embedded in a struct socket_alloc. ++ */ + void sock_init_data(struct socket *sock, struct sock *sk); + + /* +diff --git a/net/core/sock.c b/net/core/sock.c +index 6f27c240..63680f99 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -3381,7 +3381,7 @@ void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer) + } + EXPORT_SYMBOL(sk_stop_timer_sync); + +-void sock_init_data(struct socket *sock, struct sock *sk) ++void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid) + { + sk_init_common(sk); + sk->sk_send_head = NULL; +@@ -3401,11 +3401,10 @@ void sock_init_data(struct socket *sock, struct sock *sk) + sk->sk_type = sock->type; + RCU_INIT_POINTER(sk->sk_wq, &sock->wq); + sock->sk = sk; +- sk->sk_uid = SOCK_INODE(sock)->i_uid; + } else { + RCU_INIT_POINTER(sk->sk_wq, NULL); +- sk->sk_uid = make_kuid(sock_net(sk)->user_ns, 0); + } ++ sk->sk_uid = uid; + + rwlock_init(&sk->sk_callback_lock); + if (sk->sk_kern_sock) +@@ -3463,6 +3462,16 @@ void sock_init_data(struct socket *sock, struct sock *sk) + refcount_set(&sk->sk_refcnt, 1); + atomic_set(&sk->sk_drops, 0); + } ++EXPORT_SYMBOL(sock_init_data_uid); ++ ++void sock_init_data(struct socket *sock, struct sock *sk) ++{ ++ kuid_t uid = sock ? ++ SOCK_INODE(sock)->i_uid : ++ make_kuid(sock_net(sk)->user_ns, 0); ++ ++ sock_init_data_uid(sock, sk, uid); ++} + EXPORT_SYMBOL(sock_init_data); + + void lock_sock_nested(struct sock *sk, int subclass) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-263-tun-tun_chr_open-correctly-initialize-socket-ui.patch b/patches.kernel.org/6.2.3-263-tun-tun_chr_open-correctly-initialize-socket-ui.patch new file mode 100644 index 0000000..fadda9a --- /dev/null +++ b/patches.kernel.org/6.2.3-263-tun-tun_chr_open-correctly-initialize-socket-ui.patch @@ -0,0 +1,48 @@ +From: Pietro Borrello +Date: Sat, 4 Feb 2023 17:39:21 +0000 +Subject: [PATCH] tun: tun_chr_open(): correctly initialize socket uid +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a096ccca6e503a5c575717ff8a36ace27510ab0a + +[ Upstream commit a096ccca6e503a5c575717ff8a36ace27510ab0a ] + +sock_init_data() assumes that the `struct socket` passed in input is +contained in a `struct socket_alloc` allocated with sock_alloc(). +However, tun_chr_open() passes a `struct socket` embedded in a `struct +tun_file` allocated with sk_alloc(). +This causes a type confusion when issuing a container_of() with +SOCK_INODE() in sock_init_data() which results in assigning a wrong +sk_uid to the `struct sock` in input. +On default configuration, the type confused field overlaps with the +high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`, +NULL at the time of call, which makes the uid of all tun sockets 0, +i.e., the root one. +Fix the assignment by using sock_init_data_uid(). + +Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") +Signed-off-by: Pietro Borrello +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/tun.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index a7d17c68..745131b2 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -3448,7 +3448,7 @@ static int tun_chr_open(struct inode *inode, struct file * file) + tfile->socket.file = file; + tfile->socket.ops = &tun_socket_ops; + +- sock_init_data(&tfile->socket, &tfile->sk); ++ sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid); + + tfile->sk.sk_write_space = tun_sock_write_space; + tfile->sk.sk_sndbuf = INT_MAX; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-264-tap-tap_open-correctly-initialize-socket-uid.patch b/patches.kernel.org/6.2.3-264-tap-tap_open-correctly-initialize-socket-uid.patch new file mode 100644 index 0000000..3e30011 --- /dev/null +++ b/patches.kernel.org/6.2.3-264-tap-tap_open-correctly-initialize-socket-uid.patch @@ -0,0 +1,48 @@ +From: Pietro Borrello +Date: Sat, 4 Feb 2023 17:39:22 +0000 +Subject: [PATCH] tap: tap_open(): correctly initialize socket uid +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 66b2c338adce580dfce2199591e65e2bab889cff + +[ Upstream commit 66b2c338adce580dfce2199591e65e2bab889cff ] + +sock_init_data() assumes that the `struct socket` passed in input is +contained in a `struct socket_alloc` allocated with sock_alloc(). +However, tap_open() passes a `struct socket` embedded in a `struct +tap_queue` allocated with sk_alloc(). +This causes a type confusion when issuing a container_of() with +SOCK_INODE() in sock_init_data() which results in assigning a wrong +sk_uid to the `struct sock` in input. +On default configuration, the type confused field overlaps with +padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu +*tap` in `struct tap_queue`, which makes the uid of all tap sockets 0, +i.e., the root one. +Fix the assignment by using sock_init_data_uid(). + +Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") +Signed-off-by: Pietro Borrello +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/tap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index a2be1994..8941aa19 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -533,7 +533,7 @@ static int tap_open(struct inode *inode, struct file *file) + q->sock.state = SS_CONNECTED; + q->sock.file = file; + q->sock.ops = &tap_socket_ops; +- sock_init_data(&q->sock, &q->sk); ++ sock_init_data_uid(&q->sock, &q->sk, inode->i_uid); + q->sk.sk_write_space = tap_sock_write_space; + q->sk.sk_destruct = tap_sock_destruct; + q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-265-rxrpc-Fix-overwaking-on-call-poking.patch b/patches.kernel.org/6.2.3-265-rxrpc-Fix-overwaking-on-call-poking.patch new file mode 100644 index 0000000..1fbc261 --- /dev/null +++ b/patches.kernel.org/6.2.3-265-rxrpc-Fix-overwaking-on-call-poking.patch @@ -0,0 +1,50 @@ +From: David Howells +Date: Tue, 29 Nov 2022 12:37:37 +0000 +Subject: [PATCH] rxrpc: Fix overwaking on call poking +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a33395ab85b9b9cff83948a03a1d6d96347935d8 + +[ Upstream commit a33395ab85b9b9cff83948a03a1d6d96347935d8 ] + +If an rxrpc call is given a poke, it will get woken up unconditionally, +even if there's already a poke pending (for which there will have been a +wake) or if the call refcount has gone to 0. + +Fix this by only waking the call if it is still referenced and if it +doesn't already have a poke pending. + +Fixes: 15f661dc95da ("rxrpc: Implement a mechanism to send an event notification to a call") +Signed-off-by: David Howells +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/rxrpc/call_object.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c +index f3c9f020..7ce562f6 100644 +--- a/net/rxrpc/call_object.c ++++ b/net/rxrpc/call_object.c +@@ -54,12 +54,14 @@ void rxrpc_poke_call(struct rxrpc_call *call, enum rxrpc_call_poke_trace what) + spin_lock_bh(&local->lock); + busy = !list_empty(&call->attend_link); + trace_rxrpc_poke_call(call, busy, what); ++ if (!busy && !rxrpc_try_get_call(call, rxrpc_call_get_poke)) ++ busy = true; + if (!busy) { +- rxrpc_get_call(call, rxrpc_call_get_poke); + list_add_tail(&call->attend_link, &local->call_attend_q); + } + spin_unlock_bh(&local->lock); +- rxrpc_wake_up_io_thread(local); ++ if (!busy) ++ rxrpc_wake_up_io_thread(local); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-266-OPP-fix-error-checking-in-opp_migrate_dentry.patch b/patches.kernel.org/6.2.3-266-OPP-fix-error-checking-in-opp_migrate_dentry.patch new file mode 100644 index 0000000..096cd13 --- /dev/null +++ b/patches.kernel.org/6.2.3-266-OPP-fix-error-checking-in-opp_migrate_dentry.patch @@ -0,0 +1,39 @@ +From: Qi Zheng +Date: Wed, 8 Feb 2023 12:00:37 +0800 +Subject: [PATCH] OPP: fix error checking in opp_migrate_dentry() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: eca4c0eea53432ec4b711b2a8ad282cbad231b4f + +[ Upstream commit eca4c0eea53432ec4b711b2a8ad282cbad231b4f ] + +Since commit ff9fb72bc077 ("debugfs: return error values, +not NULL") changed return value of debugfs_rename() in +error cases from %NULL to %ERR_PTR(-ERROR), we should +also check error values instead of NULL. + +Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") +Signed-off-by: Qi Zheng +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/opp/debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/opp/debugfs.c b/drivers/opp/debugfs.c +index 96a30a03..2c7fb683 100644 +--- a/drivers/opp/debugfs.c ++++ b/drivers/opp/debugfs.c +@@ -235,7 +235,7 @@ static void opp_migrate_dentry(struct opp_device *opp_dev, + + dentry = debugfs_rename(rootdir, opp_dev->dentry, rootdir, + opp_table->dentry_name); +- if (!dentry) { ++ if (IS_ERR(dentry)) { + dev_err(dev, "%s: Failed to rename link from: %s to %s\n", + __func__, dev_name(opp_dev->dev), dev_name(dev)); + return; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-267-cpufreq-davinci-Fix-clk-use-after-free.patch b/patches.kernel.org/6.2.3-267-cpufreq-davinci-Fix-clk-use-after-free.patch new file mode 100644 index 0000000..fd611fa --- /dev/null +++ b/patches.kernel.org/6.2.3-267-cpufreq-davinci-Fix-clk-use-after-free.patch @@ -0,0 +1,50 @@ +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 8 Feb 2023 10:26:54 +0100 +Subject: [PATCH] cpufreq: davinci: Fix clk use after free +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5d8f384a9b4fc50f6a18405f1c08e5a87a77b5b3 + +[ Upstream commit 5d8f384a9b4fc50f6a18405f1c08e5a87a77b5b3 ] + +The remove function first frees the clks and only then calls +cpufreq_unregister_driver(). If one of the cpufreq callbacks is called +just before cpufreq_unregister_driver() is run, the freed clks might be +used. + +Fixes: 6601b8030de3 ("davinci: add generic CPUFreq driver for DaVinci") +Signed-off-by: Uwe Kleine-König +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/cpufreq/davinci-cpufreq.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/davinci-cpufreq.c b/drivers/cpufreq/davinci-cpufreq.c +index 9e97f60f..ebb3a810 100644 +--- a/drivers/cpufreq/davinci-cpufreq.c ++++ b/drivers/cpufreq/davinci-cpufreq.c +@@ -133,12 +133,14 @@ static int __init davinci_cpufreq_probe(struct platform_device *pdev) + + static int __exit davinci_cpufreq_remove(struct platform_device *pdev) + { ++ cpufreq_unregister_driver(&davinci_driver); ++ + clk_put(cpufreq.armclk); + + if (cpufreq.asyncclk) + clk_put(cpufreq.asyncclk); + +- return cpufreq_unregister_driver(&davinci_driver); ++ return 0; + } + + static struct platform_driver davinci_cpufreq_driver = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-268-Bluetooth-hci_conn-Refactor-hci_bind_bis-since-.patch b/patches.kernel.org/6.2.3-268-Bluetooth-hci_conn-Refactor-hci_bind_bis-since-.patch new file mode 100644 index 0000000..e7485ee --- /dev/null +++ b/patches.kernel.org/6.2.3-268-Bluetooth-hci_conn-Refactor-hci_bind_bis-since-.patch @@ -0,0 +1,83 @@ +From: Kees Cook +Date: Fri, 27 Jan 2023 16:51:54 -0800 +Subject: [PATCH] Bluetooth: hci_conn: Refactor hci_bind_bis() since it always + succeeds +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a00a29b0eeea6caaaf9edc3dd284f81b072ee343 + +[ Upstream commit a00a29b0eeea6caaaf9edc3dd284f81b072ee343 ] + +The compiler thinks "conn" might be NULL after a call to hci_bind_bis(), +which cannot happen. Avoid any confusion by just making it not return a +value since it cannot fail. Fixes the warnings seen with GCC 13: + +In function 'arch_atomic_dec_and_test', + inlined from 'atomic_dec_and_test' at ../include/linux/atomic/atomic-instrumented.h:576:9, + inlined from 'hci_conn_drop' at ../include/net/bluetooth/hci_core.h:1391:6, + inlined from 'hci_connect_bis' at ../net/bluetooth/hci_conn.c:2124:3: +../arch/x86/include/asm/rmwcc.h:37:9: warning: array subscript 0 is outside array bounds of 'atomic_t[0]' [-Warray-bounds=] + 37 | asm volatile (fullop CC_SET(cc) \ + | ^~~ +... +In function 'hci_connect_bis': +cc1: note: source object is likely at address zero + +Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") +Cc: Luiz Augusto von Dentz +Cc: Marcel Holtmann +Cc: Johan Hedberg +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: linux-bluetooth@vger.kernel.org +Cc: netdev@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Simon Horman +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/hci_conn.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index acf563fb..61a34801 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1981,16 +1981,14 @@ static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn, + qos->latency = conn->le_conn_latency; + } + +-static struct hci_conn *hci_bind_bis(struct hci_conn *conn, +- struct bt_iso_qos *qos) ++static void hci_bind_bis(struct hci_conn *conn, ++ struct bt_iso_qos *qos) + { + /* Update LINK PHYs according to QoS preference */ + conn->le_tx_phy = qos->out.phy; + conn->le_tx_phy = qos->out.phy; + conn->iso_qos = *qos; + conn->state = BT_BOUND; +- +- return conn; + } + + static int create_big_sync(struct hci_dev *hdev, void *data) +@@ -2119,11 +2117,7 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst, + if (IS_ERR(conn)) + return conn; + +- conn = hci_bind_bis(conn, qos); +- if (!conn) { +- hci_conn_drop(conn); +- return ERR_PTR(-ENOMEM); +- } ++ hci_bind_bis(conn, qos); + + /* Add Basic Announcement into Peridic Adv Data if BASE is set */ + if (base_len && base) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-269-Bluetooth-L2CAP-Fix-potential-user-after-free.patch b/patches.kernel.org/6.2.3-269-Bluetooth-L2CAP-Fix-potential-user-after-free.patch new file mode 100644 index 0000000..8533d1e --- /dev/null +++ b/patches.kernel.org/6.2.3-269-Bluetooth-L2CAP-Fix-potential-user-after-free.patch @@ -0,0 +1,94 @@ +From: Luiz Augusto von Dentz +Date: Wed, 1 Feb 2023 14:01:11 -0800 +Subject: [PATCH] Bluetooth: L2CAP: Fix potential user-after-free +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: df5703348813235874d851934e957c3723d71644 + +[ Upstream commit df5703348813235874d851934e957c3723d71644 ] + +This fixes all instances of which requires to allocate a buffer calling +alloc_skb which may release the chan lock and reacquire later which +makes it possible that the chan is disconnected in the meantime. + +Fixes: a6a5568c03c4 ("Bluetooth: Lock the L2CAP channel when sending") +Reported-by: Alexander Coffin +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/bluetooth/l2cap_core.c | 24 ------------------------ + net/bluetooth/l2cap_sock.c | 8 ++++++++ + 2 files changed, 8 insertions(+), 24 deletions(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index a3e0dc6a..adfc3ea0 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -2683,14 +2683,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) + if (IS_ERR(skb)) + return PTR_ERR(skb); + +- /* Channel lock is released before requesting new skb and then +- * reacquired thus we need to recheck channel state. +- */ +- if (chan->state != BT_CONNECTED) { +- kfree_skb(skb); +- return -ENOTCONN; +- } +- + l2cap_do_send(chan, skb); + return len; + } +@@ -2735,14 +2727,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) + if (IS_ERR(skb)) + return PTR_ERR(skb); + +- /* Channel lock is released before requesting new skb and then +- * reacquired thus we need to recheck channel state. +- */ +- if (chan->state != BT_CONNECTED) { +- kfree_skb(skb); +- return -ENOTCONN; +- } +- + l2cap_do_send(chan, skb); + err = len; + break; +@@ -2763,14 +2747,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) + */ + err = l2cap_segment_sdu(chan, &seg_queue, msg, len); + +- /* The channel could have been closed while segmenting, +- * check that it is still connected. +- */ +- if (chan->state != BT_CONNECTED) { +- __skb_queue_purge(&seg_queue); +- err = -ENOTCONN; +- } +- + if (err) + break; + +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index ca8f07f3..eebe2561 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1624,6 +1624,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan, + if (!skb) + return ERR_PTR(err); + ++ /* Channel lock is released before requesting new skb and then ++ * reacquired thus we need to recheck channel state. ++ */ ++ if (chan->state != BT_CONNECTED) { ++ kfree_skb(skb); ++ return ERR_PTR(-ENOTCONN); ++ } ++ + skb->priority = sk->sk_priority; + + bt_cb(skb)->l2cap.chan = chan; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-270-Bluetooth-hci_qca-get-wakeup-status-from-serdev.patch b/patches.kernel.org/6.2.3-270-Bluetooth-hci_qca-get-wakeup-status-from-serdev.patch new file mode 100644 index 0000000..d3be2d5 --- /dev/null +++ b/patches.kernel.org/6.2.3-270-Bluetooth-hci_qca-get-wakeup-status-from-serdev.patch @@ -0,0 +1,45 @@ +From: Zhengping Jiang +Date: Thu, 2 Feb 2023 09:47:01 -0800 +Subject: [PATCH] Bluetooth: hci_qca: get wakeup status from serdev device + handle +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 03b0093f7b310493bc944a20f725228cfe0d3fea + +[ Upstream commit 03b0093f7b310493bc944a20f725228cfe0d3fea ] + +Bluetooth controller attached via the UART is handled by the serdev driver. +Get the wakeup status from the device handle through serdev, instead of the +parent path. + +Fixes: c1a74160eaf1 ("Bluetooth: hci_qca: Add device_may_wakeup support") +Signed-off-by: Zhengping Jiang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/bluetooth/hci_qca.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index bbe9cf1c..d3317728 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -1588,10 +1588,11 @@ static bool qca_wakeup(struct hci_dev *hdev) + struct hci_uart *hu = hci_get_drvdata(hdev); + bool wakeup; + +- /* UART driver handles the interrupt from BT SoC.So we need to use +- * device handle of UART driver to get the status of device may wakeup. ++ /* BT SoC attached through the serial bus is handled by the serdev driver. ++ * So we need to use the device handle of the serdev driver to get the ++ * status of device may wakeup. + */ +- wakeup = device_may_wakeup(hu->serdev->ctrl->dev.parent); ++ wakeup = device_may_wakeup(&hu->serdev->ctrl->dev); + bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup); + + return wakeup; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-271-net-ipa-generic-command-param-fix.patch b/patches.kernel.org/6.2.3-271-net-ipa-generic-command-param-fix.patch new file mode 100644 index 0000000..ec82dfb --- /dev/null +++ b/patches.kernel.org/6.2.3-271-net-ipa-generic-command-param-fix.patch @@ -0,0 +1,59 @@ +From: Alex Elder +Date: Wed, 8 Feb 2023 14:56:45 -0600 +Subject: [PATCH] net: ipa: generic command param fix +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2df181f09c961377a55510a864216d48d787fe49 + +[ Upstream commit 2df181f09c961377a55510a864216d48d787fe49 ] + +Starting at IPA v4.11, the GSI_GENERIC_COMMAND GSI register got a +new PARAMS field. The code that encodes a value into that field +sets it unconditionally, which is wrong. + +We currently only provide 0 as the field's value, so this error has +no real effect. Still, it's a bug, so let's fix it. + +Fix an (unrelated) incorrect comment as well. Fields in the +ERROR_LOG GSI register actually *are* defined for IPA versions +prior to v3.5.1. + +Fixes: fe68c43ce388 ("net: ipa: support enhanced channel flow control") +Signed-off-by: Alex Elder +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ipa/gsi.c | 3 ++- + drivers/net/ipa/gsi_reg.h | 1 - + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ipa/gsi.c b/drivers/net/ipa/gsi.c +index bea2da1c..f1a39382 100644 +--- a/drivers/net/ipa/gsi.c ++++ b/drivers/net/ipa/gsi.c +@@ -1666,7 +1666,8 @@ static int gsi_generic_command(struct gsi *gsi, u32 channel_id, + val = u32_encode_bits(opcode, GENERIC_OPCODE_FMASK); + val |= u32_encode_bits(channel_id, GENERIC_CHID_FMASK); + val |= u32_encode_bits(GSI_EE_MODEM, GENERIC_EE_FMASK); +- val |= u32_encode_bits(params, GENERIC_PARAMS_FMASK); ++ if (gsi->version >= IPA_VERSION_4_11) ++ val |= u32_encode_bits(params, GENERIC_PARAMS_FMASK); + + timeout = !gsi_command(gsi, GSI_GENERIC_CMD_OFFSET, val); + +diff --git a/drivers/net/ipa/gsi_reg.h b/drivers/net/ipa/gsi_reg.h +index 3763359f..e65f2f05 100644 +--- a/drivers/net/ipa/gsi_reg.h ++++ b/drivers/net/ipa/gsi_reg.h +@@ -372,7 +372,6 @@ enum gsi_general_id { + #define GSI_ERROR_LOG_OFFSET \ + (0x0001f200 + 0x4000 * GSI_EE_AP) + +-/* Fields below are present for IPA v3.5.1 and above */ + #define ERR_ARG3_FMASK GENMASK(3, 0) + #define ERR_ARG2_FMASK GENMASK(7, 4) + #define ERR_ARG1_FMASK GENMASK(11, 8) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-272-s390-vfio-ap-tighten-the-NIB-validity-check.patch b/patches.kernel.org/6.2.3-272-s390-vfio-ap-tighten-the-NIB-validity-check.patch new file mode 100644 index 0000000..c01718a --- /dev/null +++ b/patches.kernel.org/6.2.3-272-s390-vfio-ap-tighten-the-NIB-validity-check.patch @@ -0,0 +1,40 @@ +From: Halil Pasic +Date: Thu, 9 Feb 2023 00:00:22 +0100 +Subject: [PATCH] s390: vfio-ap: tighten the NIB validity check +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a64a6d23874c574d30a9816124b2dc37467f3811 + +[ Upstream commit a64a6d23874c574d30a9816124b2dc37467f3811 ] + +The NIB is architecturally invalid if the address designates a +storage location that is not installed or if it is zero. + +Signed-off-by: Halil Pasic +Reported-by: Janosch Frank +Fixes: ec89b55e3bce ("s390: ap: implement PAPQ AQIC interception in kernel") +Reviewed-by: Tony Krowiak +Reviewed-by: Pierre Morel +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/s390/crypto/vfio_ap_ops.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c +index b0b25bc9..2bba5ed8 100644 +--- a/drivers/s390/crypto/vfio_ap_ops.c ++++ b/drivers/s390/crypto/vfio_ap_ops.c +@@ -349,6 +349,8 @@ static int vfio_ap_validate_nib(struct kvm_vcpu *vcpu, dma_addr_t *nib) + { + *nib = vcpu->run->s.regs.gprs[2]; + ++ if (!*nib) ++ return -EINVAL; + if (kvm_is_error_hva(gfn_to_hva(vcpu->kvm, *nib >> PAGE_SHIFT))) + return -EINVAL; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-273-s390-ap-fix-status-returned-by-ap_aqic.patch b/patches.kernel.org/6.2.3-273-s390-ap-fix-status-returned-by-ap_aqic.patch new file mode 100644 index 0000000..32a9b0c --- /dev/null +++ b/patches.kernel.org/6.2.3-273-s390-ap-fix-status-returned-by-ap_aqic.patch @@ -0,0 +1,53 @@ +From: Halil Pasic +Date: Thu, 9 Feb 2023 00:00:23 +0100 +Subject: [PATCH] s390/ap: fix status returned by ap_aqic() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 394740d7645ea767795074287769dd26dbd4d782 + +[ Upstream commit 394740d7645ea767795074287769dd26dbd4d782 ] + +There function ap_aqic() tries to grab the status from the +wrong part of the register. Thus we always end up with +zeros. Which is wrong, among others, because we detect +failures via status.response_code. + +Signed-off-by: Halil Pasic +Reported-by: Janosch Frank +Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables") +Reviewed-by: Harald Freudenberger +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/include/asm/ap.h | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h +index f508f502..876afe46 100644 +--- a/arch/s390/include/asm/ap.h ++++ b/arch/s390/include/asm/ap.h +@@ -239,7 +239,10 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid, + union { + unsigned long value; + struct ap_qirq_ctrl qirqctrl; +- struct ap_queue_status status; ++ struct { ++ u32 _pad; ++ struct ap_queue_status status; ++ }; + } reg1; + unsigned long reg2 = pa_ind; + +@@ -253,7 +256,7 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid, + " lgr %[reg1],1\n" /* gr1 (status) into reg1 */ + : [reg1] "+&d" (reg1) + : [reg0] "d" (reg0), [reg2] "d" (reg2) +- : "cc", "0", "1", "2"); ++ : "cc", "memory", "0", "1", "2"); + + return reg1.status; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-274-s390-ap-fix-status-returned-by-ap_qact.patch b/patches.kernel.org/6.2.3-274-s390-ap-fix-status-returned-by-ap_qact.patch new file mode 100644 index 0000000..aa5ef12 --- /dev/null +++ b/patches.kernel.org/6.2.3-274-s390-ap-fix-status-returned-by-ap_qact.patch @@ -0,0 +1,45 @@ +From: Halil Pasic +Date: Thu, 9 Feb 2023 00:00:24 +0100 +Subject: [PATCH] s390/ap: fix status returned by ap_qact() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a2522c80f074c35254974fec39fffe8b8d75befe + +[ Upstream commit a2522c80f074c35254974fec39fffe8b8d75befe ] + +Since commit 159491f3b509 ("s390/ap: rework assembler functions to use +unions for in/out register variables") the function ap_qact() tries to +grab the status from the wrong part of the register. Thus we always end +up with zeros. Which is wrong, among others, because we detect failures +via status.response_code. + +Signed-off-by: Halil Pasic +Reported-by: Harald Freudenberger +Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables") +Reviewed-by: Harald Freudenberger +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/include/asm/ap.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h +index 876afe46..57a2d651 100644 +--- a/arch/s390/include/asm/ap.h ++++ b/arch/s390/include/asm/ap.h +@@ -293,7 +293,10 @@ static inline struct ap_queue_status ap_qact(ap_qid_t qid, int ifbit, + unsigned long reg0 = qid | (5UL << 24) | ((ifbit & 0x01) << 22); + union { + unsigned long value; +- struct ap_queue_status status; ++ struct { ++ u32 _pad; ++ struct ap_queue_status status; ++ }; + } reg1; + unsigned long reg2; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-275-libbpf-Fix-alen-calculation-in-libbpf_nla_dump_.patch b/patches.kernel.org/6.2.3-275-libbpf-Fix-alen-calculation-in-libbpf_nla_dump_.patch new file mode 100644 index 0000000..bbeb464 --- /dev/null +++ b/patches.kernel.org/6.2.3-275-libbpf-Fix-alen-calculation-in-libbpf_nla_dump_.patch @@ -0,0 +1,39 @@ +From: Ilya Leoshkevich +Date: Fri, 10 Feb 2023 01:12:01 +0100 +Subject: [PATCH] libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 17bcd27a08a21397698edf143084d7c87ce17946 + +[ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ] + +The code assumes that everything that comes after nlmsgerr are nlattrs. +When calculating their size, it does not account for the initial +nlmsghdr. This may lead to accessing uninitialized memory. + +Fixes: bbf48c18ee0c ("libbpf: add error reporting in XDP") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/lib/bpf/nlattr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c +index 3900d052..975e265e 100644 +--- a/tools/lib/bpf/nlattr.c ++++ b/tools/lib/bpf/nlattr.c +@@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh) + hlen += nlmsg_len(&err->msg); + + attr = (struct nlattr *) ((void *) err + hlen); +- alen = nlh->nlmsg_len - hlen; ++ alen = (void *)nlh + nlh->nlmsg_len - (void *)attr; + + if (libbpf_nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen, + extack_policy) != 0) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-276-xen-grant-dma-iommu-Implement-a-dummy-probe_dev.patch b/patches.kernel.org/6.2.3-276-xen-grant-dma-iommu-Implement-a-dummy-probe_dev.patch new file mode 100644 index 0000000..2501d45 --- /dev/null +++ b/patches.kernel.org/6.2.3-276-xen-grant-dma-iommu-Implement-a-dummy-probe_dev.patch @@ -0,0 +1,61 @@ +From: Oleksandr Tyshchenko +Date: Wed, 8 Feb 2023 17:36:49 +0200 +Subject: [PATCH] xen/grant-dma-iommu: Implement a dummy probe_device() + callback +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2062f9fb6445451b189595e295765c69f43bc12e + +[ Upstream commit 2062f9fb6445451b189595e295765c69f43bc12e ] + +Update stub IOMMU driver (which main purpose is to reuse generic +IOMMU device-tree bindings by Xen grant DMA-mapping layer on Arm) +according to the recent changes done in the following +commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration"). + +With probe_device() callback being called during IOMMU device registration, +the uninitialized callback just leads to the "kernel NULL pointer +dereference" issue during boot. Fix that by adding a dummy callback. + +Looks like the release_device() callback is not mandatory to be +implemented as IOMMU framework makes sure that callback is initialized +before dereferencing. + +Reported-by: Viresh Kumar +Fixes: 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") +Signed-off-by: Oleksandr Tyshchenko +Tested-by: Viresh Kumar +Reviewed-by: Stefano Stabellini +Link: https://lore.kernel.org/r/20230208153649.3604857-1-olekstysh@gmail.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/xen/grant-dma-iommu.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/xen/grant-dma-iommu.c b/drivers/xen/grant-dma-iommu.c +index 16b8bc0c..6a9fe02c 100644 +--- a/drivers/xen/grant-dma-iommu.c ++++ b/drivers/xen/grant-dma-iommu.c +@@ -16,8 +16,15 @@ struct grant_dma_iommu_device { + struct iommu_device iommu; + }; + +-/* Nothing is really needed here */ +-static const struct iommu_ops grant_dma_iommu_ops; ++static struct iommu_device *grant_dma_iommu_probe_device(struct device *dev) ++{ ++ return ERR_PTR(-ENODEV); ++} ++ ++/* Nothing is really needed here except a dummy probe_device callback */ ++static const struct iommu_ops grant_dma_iommu_ops = { ++ .probe_device = grant_dma_iommu_probe_device, ++}; + + static const struct of_device_id grant_dma_iommu_of_match[] = { + { .compatible = "xen,grant-dma" }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-277-rds-rds_rm_zerocopy_callback-correct-order-for-.patch b/patches.kernel.org/6.2.3-277-rds-rds_rm_zerocopy_callback-correct-order-for-.patch new file mode 100644 index 0000000..1c4edd1 --- /dev/null +++ b/patches.kernel.org/6.2.3-277-rds-rds_rm_zerocopy_callback-correct-order-for-.patch @@ -0,0 +1,40 @@ +From: Pietro Borrello +Date: Thu, 9 Feb 2023 12:26:23 +0000 +Subject: [PATCH] rds: rds_rm_zerocopy_callback() correct order for + list_add_tail() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 68762148d1b011d47bc2ceed7321739b5aea1e63 + +[ Upstream commit 68762148d1b011d47bc2ceed7321739b5aea1e63 ] + +rds_rm_zerocopy_callback() uses list_add_tail() with swapped +arguments. This links the list head with the new entry, losing +the references to the remaining part of the list. + +Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification") +Suggested-by: Paolo Abeni +Signed-off-by: Pietro Borrello +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/rds/message.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rds/message.c b/net/rds/message.c +index c19c9356..7af59d24 100644 +--- a/net/rds/message.c ++++ b/net/rds/message.c +@@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs, + ck = &info->zcookies; + memset(ck, 0, sizeof(*ck)); + WARN_ON(!rds_zcookie_add(info, cookie)); +- list_add_tail(&q->zcookie_head, &info->rs_zcookie_next); ++ list_add_tail(&info->rs_zcookie_next, &q->zcookie_head); + + spin_unlock_irqrestore(&q->lock, flags); + /* caller invokes rds_wake_sk_sleep() */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-278-crypto-rsa-pkcs1pad-Use-akcipher_request_comple.patch b/patches.kernel.org/6.2.3-278-crypto-rsa-pkcs1pad-Use-akcipher_request_comple.patch new file mode 100644 index 0000000..60ae6e4 --- /dev/null +++ b/patches.kernel.org/6.2.3-278-crypto-rsa-pkcs1pad-Use-akcipher_request_comple.patch @@ -0,0 +1,92 @@ +From: Herbert Xu +Date: Tue, 31 Jan 2023 16:02:04 +0800 +Subject: [PATCH] crypto: rsa-pkcs1pad - Use akcipher_request_complete +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 + +[ Upstream commit 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 ] + +Use the akcipher_request_complete helper instead of calling the +completion function directly. In fact the previous code was buggy +in that EINPROGRESS was never passed back to the original caller. + +Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + crypto/rsa-pkcs1pad.c | 34 +++++++++++++++------------------- + 1 file changed, 15 insertions(+), 19 deletions(-) + +diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c +index 6ee5b8a0..4e9d2244 100644 +--- a/crypto/rsa-pkcs1pad.c ++++ b/crypto/rsa-pkcs1pad.c +@@ -214,16 +214,14 @@ static void pkcs1pad_encrypt_sign_complete_cb( + struct crypto_async_request *child_async_req, int err) + { + struct akcipher_request *req = child_async_req->data; +- struct crypto_async_request async_req; + + if (err == -EINPROGRESS) +- return; ++ goto out; ++ ++ err = pkcs1pad_encrypt_sign_complete(req, err); + +- async_req.data = req->base.data; +- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); +- async_req.flags = child_async_req->flags; +- req->base.complete(&async_req, +- pkcs1pad_encrypt_sign_complete(req, err)); ++out: ++ akcipher_request_complete(req, err); + } + + static int pkcs1pad_encrypt(struct akcipher_request *req) +@@ -332,15 +330,14 @@ static void pkcs1pad_decrypt_complete_cb( + struct crypto_async_request *child_async_req, int err) + { + struct akcipher_request *req = child_async_req->data; +- struct crypto_async_request async_req; + + if (err == -EINPROGRESS) +- return; ++ goto out; ++ ++ err = pkcs1pad_decrypt_complete(req, err); + +- async_req.data = req->base.data; +- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); +- async_req.flags = child_async_req->flags; +- req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err)); ++out: ++ akcipher_request_complete(req, err); + } + + static int pkcs1pad_decrypt(struct akcipher_request *req) +@@ -513,15 +510,14 @@ static void pkcs1pad_verify_complete_cb( + struct crypto_async_request *child_async_req, int err) + { + struct akcipher_request *req = child_async_req->data; +- struct crypto_async_request async_req; + + if (err == -EINPROGRESS) +- return; ++ goto out; + +- async_req.data = req->base.data; +- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); +- async_req.flags = child_async_req->flags; +- req->base.complete(&async_req, pkcs1pad_verify_complete(req, err)); ++ err = pkcs1pad_verify_complete(req, err); ++ ++out: ++ akcipher_request_complete(req, err); + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-279-m68k-proc-hardware-should-depend-on-PROC_FS.patch b/patches.kernel.org/6.2.3-279-m68k-proc-hardware-should-depend-on-PROC_FS.patch new file mode 100644 index 0000000..c61ca84 --- /dev/null +++ b/patches.kernel.org/6.2.3-279-m68k-proc-hardware-should-depend-on-PROC_FS.patch @@ -0,0 +1,43 @@ +From: Randy Dunlap +Date: Wed, 8 Feb 2023 17:08:25 -0800 +Subject: [PATCH] m68k: /proc/hardware should depend on PROC_FS +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1e5b5df65af99013b4d31607ddb3ca5731dbe44d + +[ Upstream commit 1e5b5df65af99013b4d31607ddb3ca5731dbe44d ] + +When CONFIG_PROC_FS is not set, there is a build error for an unused +function. Make PROC_HARDWARE depend on PROC_FS to prevent this error. + +In file included from ../arch/m68k/kernel/setup.c:3: +../arch/m68k/kernel/setup_mm.c:477:12: error: 'hardware_proc_show' defined but not used [-Werror=unused-function] + 477 | static int hardware_proc_show(struct seq_file *m, void *v) + | ^~~~~~~~~~~~~~~~~~ + +Fixes: 66d857b08b8c ("m68k: merge m68k and m68knommu arch directories") # v3.0 +Signed-off-by: Randy Dunlap +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230209010825.24136-1-rdunlap@infradead.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/m68k/Kconfig.devices | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/m68k/Kconfig.devices b/arch/m68k/Kconfig.devices +index 6a87b4a5..e6e3efac 100644 +--- a/arch/m68k/Kconfig.devices ++++ b/arch/m68k/Kconfig.devices +@@ -19,6 +19,7 @@ config HEARTBEAT + # We have a dedicated heartbeat LED. :-) + config PROC_HARDWARE + bool "/proc/hardware support" ++ depends on PROC_FS + help + Say Y here to support the /proc/hardware file, which gives you + access to information about the machine you're running on, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-280-RISC-V-time-initialize-hrtimer-based-broadcast-.patch b/patches.kernel.org/6.2.3-280-RISC-V-time-initialize-hrtimer-based-broadcast-.patch new file mode 100644 index 0000000..4957eb3 --- /dev/null +++ b/patches.kernel.org/6.2.3-280-RISC-V-time-initialize-hrtimer-based-broadcast-.patch @@ -0,0 +1,67 @@ +From: Conor Dooley +Date: Tue, 3 Jan 2023 19:41:00 +0530 +Subject: [PATCH] RISC-V: time: initialize hrtimer based broadcast clock event + device +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8b3b8fbb4896984b5564789a42240e4b3caddb61 + +[ Upstream commit 8b3b8fbb4896984b5564789a42240e4b3caddb61 ] + +Similarly to commit 022eb8ae8b5e ("ARM: 8938/1: kernel: initialize +broadcast hrtimer based clock event device"), RISC-V needs to initiate +hrtimer based broadcast clock event device before C3STOP can be used. +Otherwise, the introduction of C3STOP for the RISC-V arch timer in +commit 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped +during CPU suspend") leaves us without any broadcast timer registered. +This prevents the kernel from entering oneshot mode, which breaks timer +behaviour, for example clock_nanosleep(). + +A test app that sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ=250 +& C3STOP enabled, the sleep times are rounded up to the next jiffy: +== CPU: 1 == == CPU: 2 == == CPU: 3 == == CPU: 4 == +Mean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179 +Std Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193 +Hi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000 +Lo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000 +Samples: 521 Samples: 521 Samples: 521 Samples: 521 + +Link: https://lore.kernel.org/linux-riscv/YzYTNQRxLr7Q9JR0@spud/ +Fixes: 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend") +Suggested-by: Samuel Holland +Signed-off-by: Conor Dooley +Signed-off-by: Anup Patel +Reviewed-by: Samuel Holland +Acked-by: Palmer Dabbelt +Link: https://lore.kernel.org/r/20230103141102.772228-2-apatel@ventanamicro.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/riscv/kernel/time.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/riscv/kernel/time.c b/arch/riscv/kernel/time.c +index 8217b0f6..1cf21db4 100644 +--- a/arch/riscv/kernel/time.c ++++ b/arch/riscv/kernel/time.c +@@ -5,6 +5,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -29,6 +30,8 @@ void __init time_init(void) + + of_clk_init(NULL); + timer_probe(); ++ ++ tick_setup_hrtimer_broadcast(); + } + + void clocksource_arch_init(struct clocksource *cs) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-281-clocksource-drivers-riscv-Patch-riscv_clock_nex.patch b/patches.kernel.org/6.2.3-281-clocksource-drivers-riscv-Patch-riscv_clock_nex.patch new file mode 100644 index 0000000..bee3cf3 --- /dev/null +++ b/patches.kernel.org/6.2.3-281-clocksource-drivers-riscv-Patch-riscv_clock_nex.patch @@ -0,0 +1,61 @@ +From: Matt Evans +Date: Wed, 1 Feb 2023 19:49:42 +0000 +Subject: [PATCH] clocksource/drivers/riscv: Patch riscv_clock_next_event() + jump before first use +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 225b9596cb0227c1c1b1e4a836dad43595c3e61a + +[ Upstream commit 225b9596cb0227c1c1b1e4a836dad43595c3e61a ] + +A static key is used to select between SBI and Sstc timer usage in +riscv_clock_next_event(), but currently the direction is resolved +after cpuhp_setup_state() is called (which sets the next event). The +first event will therefore fall through the sbi_set_timer() path; this +breaks Sstc-only systems. So, apply the jump patching before first +use. + +Fixes: 9f7a8ff6391f ("RISC-V: Prefer sstc extension if available") +Signed-off-by: Matt Evans +Reviewed-by: Palmer Dabbelt +Acked-by: Palmer Dabbelt +Reviewed-by: Anup Patel +Link: https://lore.kernel.org/r/CDDAB2D0-264E-42F3-8E31-BA210BEB8EC1@rivosinc.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/clocksource/timer-riscv.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c +index a0d66fab..a01c2bd2 100644 +--- a/drivers/clocksource/timer-riscv.c ++++ b/drivers/clocksource/timer-riscv.c +@@ -177,6 +177,11 @@ static int __init riscv_timer_init_dt(struct device_node *n) + return error; + } + ++ if (riscv_isa_extension_available(NULL, SSTC)) { ++ pr_info("Timer interrupt in S-mode is available via sstc extension\n"); ++ static_branch_enable(&riscv_sstc_available); ++ } ++ + error = cpuhp_setup_state(CPUHP_AP_RISCV_TIMER_STARTING, + "clockevents/riscv/timer:starting", + riscv_timer_starting_cpu, riscv_timer_dying_cpu); +@@ -184,11 +189,6 @@ static int __init riscv_timer_init_dt(struct device_node *n) + pr_err("cpu hp setup state failed for RISCV timer [%d]\n", + error); + +- if (riscv_isa_extension_available(NULL, SSTC)) { +- pr_info("Timer interrupt in S-mode is available via sstc extension\n"); +- static_branch_enable(&riscv_sstc_available); +- } +- + return error; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-282-wifi-iwl3945-Add-missing-check-for-create_singl.patch b/patches.kernel.org/6.2.3-282-wifi-iwl3945-Add-missing-check-for-create_singl.patch new file mode 100644 index 0000000..f297ff0 --- /dev/null +++ b/patches.kernel.org/6.2.3-282-wifi-iwl3945-Add-missing-check-for-create_singl.patch @@ -0,0 +1,87 @@ +From: Jiasheng Jiang +Date: Wed, 8 Feb 2023 14:30:32 +0800 +Subject: [PATCH] wifi: iwl3945: Add missing check for + create_singlethread_workqueue +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb + +[ Upstream commit 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb ] + +Add the check for the return value of the create_singlethread_workqueue +in order to avoid NULL pointer dereference. + +Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") +Signed-off-by: Jiasheng Jiang +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230208063032.42763-2-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index d7e99d50..9eaf5ec1 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3372,10 +3372,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log); + * + *****************************************************************************/ + +-static void ++static int + il3945_setup_deferred_work(struct il_priv *il) + { + il->workqueue = create_singlethread_workqueue(DRV_NAME); ++ if (!il->workqueue) ++ return -ENOMEM; + + init_waitqueue_head(&il->wait_command_queue); + +@@ -3392,6 +3394,8 @@ il3945_setup_deferred_work(struct il_priv *il) + timer_setup(&il->watchdog, il_bg_watchdog, 0); + + tasklet_setup(&il->irq_tasklet, il3945_irq_tasklet); ++ ++ return 0; + } + + static void +@@ -3712,7 +3716,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + } + + il_set_rxon_channel(il, &il->bands[NL80211_BAND_2GHZ].channels[5]); +- il3945_setup_deferred_work(il); ++ err = il3945_setup_deferred_work(il); ++ if (err) ++ goto out_remove_sysfs; ++ + il3945_setup_handlers(il); + il_power_initialize(il); + +@@ -3724,7 +3731,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + err = il3945_setup_mac(il); + if (err) +- goto out_remove_sysfs; ++ goto out_destroy_workqueue; + + il_dbgfs_register(il, DRV_NAME); + +@@ -3733,9 +3740,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + return 0; + +-out_remove_sysfs: ++out_destroy_workqueue: + destroy_workqueue(il->workqueue); + il->workqueue = NULL; ++out_remove_sysfs: + sysfs_remove_group(&pdev->dev.kobj, &il3945_attribute_group); + out_release_irq: + free_irq(il->pci_dev->irq, il); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-283-wifi-iwl4965-Add-missing-check-for-create_singl.patch b/patches.kernel.org/6.2.3-283-wifi-iwl4965-Add-missing-check-for-create_singl.patch new file mode 100644 index 0000000..046cec4 --- /dev/null +++ b/patches.kernel.org/6.2.3-283-wifi-iwl4965-Add-missing-check-for-create_singl.patch @@ -0,0 +1,74 @@ +From: Jiasheng Jiang +Date: Thu, 9 Feb 2023 09:07:48 +0800 +Subject: [PATCH] wifi: iwl4965: Add missing check for + create_singlethread_workqueue() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 + +[ Upstream commit 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 ] + +Add the check for the return value of the create_singlethread_workqueue() +in order to avoid NULL pointer dereference. + +Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") +Signed-off-by: Jiasheng Jiang +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230209010748.45454-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index 721b4042..4d3c544f 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -6211,10 +6211,12 @@ il4965_bg_txpower_work(struct work_struct *work) + mutex_unlock(&il->mutex); + } + +-static void ++static int + il4965_setup_deferred_work(struct il_priv *il) + { + il->workqueue = create_singlethread_workqueue(DRV_NAME); ++ if (!il->workqueue) ++ return -ENOMEM; + + init_waitqueue_head(&il->wait_command_queue); + +@@ -6233,6 +6235,8 @@ il4965_setup_deferred_work(struct il_priv *il) + timer_setup(&il->watchdog, il_bg_watchdog, 0); + + tasklet_setup(&il->irq_tasklet, il4965_irq_tasklet); ++ ++ return 0; + } + + static void +@@ -6618,7 +6622,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto out_disable_msi; + } + +- il4965_setup_deferred_work(il); ++ err = il4965_setup_deferred_work(il); ++ if (err) ++ goto out_free_irq; ++ + il4965_setup_handlers(il); + + /********************************************* +@@ -6656,6 +6663,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + out_destroy_workqueue: + destroy_workqueue(il->workqueue); + il->workqueue = NULL; ++out_free_irq: + free_irq(il->pci_dev->irq, il); + out_disable_msi: + pci_disable_msi(il->pci_dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-284-wifi-brcmfmac-Rename-Cypress-89459-to-BCM4355.patch b/patches.kernel.org/6.2.3-284-wifi-brcmfmac-Rename-Cypress-89459-to-BCM4355.patch new file mode 100644 index 0000000..692c19d --- /dev/null +++ b/patches.kernel.org/6.2.3-284-wifi-brcmfmac-Rename-Cypress-89459-to-BCM4355.patch @@ -0,0 +1,158 @@ +From: Hector Martin +Date: Sun, 12 Feb 2023 15:38:10 +0900 +Subject: [PATCH] wifi: brcmfmac: Rename Cypress 89459 to BCM4355 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 54f01f56cf63ebb92ac37450d65c7e4da379d4ca + +[ Upstream commit 54f01f56cf63ebb92ac37450d65c7e4da379d4ca ] + +The commit that introduced support for this chip incorrectly claimed it +is a Cypress-specific part, while in actuality it is just a variant of +BCM4355 silicon (as evidenced by the chip ID). + +The relationship between Cypress products and Broadcom products isn't +entirely clear but given what little information is available and prior +art in the driver, it seems the convention should be that originally +Broadcom parts should retain the Broadcom name. + +Thus, rename the relevant constants and firmware file. Also rename the +specific 89459 PCIe ID to BCM43596, which seems to be the original +subvariant name for this PCI ID (as defined in the out-of-tree bcmdhd +driver). + +Since Cypress added this part and will presumably be providing its +supported firmware, we keep the CYW designation for this device. + +We also drop the RAW device ID in this commit. We don't do this for the +other chips since apparently some devices with them exist in the wild, +but there is already a 4355 entry with the Broadcom subvendor and WCC +firmware vendor, so adding a generic fallback to Cypress seems +redundant (no reason why a device would have the raw device ID *and* an +explicitly programmed subvendor). + +Fixes: dce45ded7619 ("brcmfmac: Support 89459 pcie") +Reviewed-by: Arend van Spriel +Signed-off-by: Hector Martin +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230212063813.27622-2-marcan@marcan.st +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 5 ++--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 7 +++---- + .../net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 5 ++--- + 3 files changed, 7 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +index 121893bb..3e42c2bd 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +@@ -726,6 +726,7 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci) + case BRCM_CC_43664_CHIP_ID: + case BRCM_CC_43666_CHIP_ID: + return 0x200000; ++ case BRCM_CC_4355_CHIP_ID: + case BRCM_CC_4359_CHIP_ID: + return (ci->pub.chiprev < 9) ? 0x180000 : 0x160000; + case BRCM_CC_4364_CHIP_ID: +@@ -735,8 +736,6 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci) + return 0x170000; + case BRCM_CC_4378_CHIP_ID: + return 0x352000; +- case CY_CC_89459_CHIP_ID: +- return ((ci->pub.chiprev < 9) ? 0x180000 : 0x160000); + default: + brcmf_err("unknown chip: %s\n", ci->pub.name); + break; +@@ -1426,8 +1425,8 @@ bool brcmf_chip_sr_capable(struct brcmf_chip *pub) + addr = CORE_CC_REG(base, sr_control1); + reg = chip->ops->read32(chip->ctx, addr); + return reg != 0; ++ case BRCM_CC_4355_CHIP_ID: + case CY_CC_4373_CHIP_ID: +- case CY_CC_89459_CHIP_ID: + /* explicitly check SR engine enable bit */ + addr = CORE_CC_REG(base, sr_control0); + reg = chip->ops->read32(chip->ctx, addr); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index b67f6d08..8f8d605a 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -51,6 +51,7 @@ enum brcmf_pcie_state { + BRCMF_FW_DEF(43602, "brcmfmac43602-pcie"); + BRCMF_FW_DEF(4350, "brcmfmac4350-pcie"); + BRCMF_FW_DEF(4350C, "brcmfmac4350c2-pcie"); ++BRCMF_FW_CLM_DEF(4355, "brcmfmac4355-pcie"); + BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-pcie"); + BRCMF_FW_CLM_DEF(43570, "brcmfmac43570-pcie"); + BRCMF_FW_DEF(4358, "brcmfmac4358-pcie"); +@@ -62,7 +63,6 @@ BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie"); + BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie"); + BRCMF_FW_DEF(4371, "brcmfmac4371-pcie"); + BRCMF_FW_CLM_DEF(4378B1, "brcmfmac4378b1-pcie"); +-BRCMF_FW_DEF(4355, "brcmfmac89459-pcie"); + + /* firmware config files */ + MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-pcie.txt"); +@@ -78,6 +78,7 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { + BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C), + BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350), + BRCMF_FW_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C), ++ BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0xFFFFFFFF, 4355), + BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356), + BRCMF_FW_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570), + BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570), +@@ -93,7 +94,6 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { + BRCMF_FW_ENTRY(BRCM_CC_43666_CHIP_ID, 0xFFFFFFF0, 4366C), + BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371), + BRCMF_FW_ENTRY(BRCM_CC_4378_CHIP_ID, 0xFFFFFFFF, 4378B1), /* revision ID 3 */ +- BRCMF_FW_ENTRY(CY_CC_89459_CHIP_ID, 0xFFFFFFFF, 4355), + }; + + #define BRCMF_PCIE_FW_UP_TIMEOUT 5000 /* msec */ +@@ -2609,9 +2609,8 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { + BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_2G_DEVICE_ID, BCA), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID, BCA), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4371_DEVICE_ID, WCC), ++ BRCMF_PCIE_DEVICE(BRCM_PCIE_43596_DEVICE_ID, CYW), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4378_DEVICE_ID, WCC), +- BRCMF_PCIE_DEVICE(CY_PCIE_89459_DEVICE_ID, CYW), +- BRCMF_PCIE_DEVICE(CY_PCIE_89459_RAW_DEVICE_ID, CYW), + { /* end: all zeroes */ } + }; + +diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +index f4939cf6..28b6cf8f 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h ++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +@@ -37,6 +37,7 @@ + #define BRCM_CC_4350_CHIP_ID 0x4350 + #define BRCM_CC_43525_CHIP_ID 43525 + #define BRCM_CC_4354_CHIP_ID 0x4354 ++#define BRCM_CC_4355_CHIP_ID 0x4355 + #define BRCM_CC_4356_CHIP_ID 0x4356 + #define BRCM_CC_43566_CHIP_ID 43566 + #define BRCM_CC_43567_CHIP_ID 43567 +@@ -56,7 +57,6 @@ + #define CY_CC_43012_CHIP_ID 43012 + #define CY_CC_43439_CHIP_ID 43439 + #define CY_CC_43752_CHIP_ID 43752 +-#define CY_CC_89459_CHIP_ID 0x4355 + + /* USB Device IDs */ + #define BRCM_USB_43143_DEVICE_ID 0xbd1e +@@ -90,9 +90,8 @@ + #define BRCM_PCIE_4366_2G_DEVICE_ID 0x43c4 + #define BRCM_PCIE_4366_5G_DEVICE_ID 0x43c5 + #define BRCM_PCIE_4371_DEVICE_ID 0x440d ++#define BRCM_PCIE_43596_DEVICE_ID 0x4415 + #define BRCM_PCIE_4378_DEVICE_ID 0x4425 +-#define CY_PCIE_89459_DEVICE_ID 0x4415 +-#define CY_PCIE_89459_RAW_DEVICE_ID 0x4355 + + /* brcmsmac IDs */ + #define BCM4313_D11N2G_ID 0x4727 /* 4313 802.11n 2.4G device */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-285-wifi-brcmfmac-pcie-Add-IDs-properties-for-BCM43.patch b/patches.kernel.org/6.2.3-285-wifi-brcmfmac-pcie-Add-IDs-properties-for-BCM43.patch new file mode 100644 index 0000000..84fff2b --- /dev/null +++ b/patches.kernel.org/6.2.3-285-wifi-brcmfmac-pcie-Add-IDs-properties-for-BCM43.patch @@ -0,0 +1,89 @@ +From: Hector Martin +Date: Sun, 12 Feb 2023 15:38:11 +0900 +Subject: [PATCH] wifi: brcmfmac: pcie: Add IDs/properties for BCM4355 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 69005e67ce54cb837b8218b002c1bb868c83b7a9 + +[ Upstream commit 69005e67ce54cb837b8218b002c1bb868c83b7a9 ] + +This chip is present on at least these Apple T2 Macs: + +* hawaii: MacBook Air 13" (Late 2018) +* hawaii: MacBook Air 13" (True Tone, 2019) + +Users report seeing PCI revision ID 12 for this chip, which Arend +reports should be revision C2, but Apple has the firmware tagged as +revision C1. Assume the right cutoff point for firmware versions is +revision ID 11 then, and leave older revisions using the non-versioned +firmware filename (Apple only uses C1 firmware builds). + +Reviewed-by: Arend van Spriel +Signed-off-by: Hector Martin +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230212063813.27622-3-marcan@marcan.st +Stable-dep-of: 6a142f70774f ("wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 10 +++++++++- + .../wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 + + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index 8f8d605a..a8d77569 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -52,6 +52,7 @@ BRCMF_FW_DEF(43602, "brcmfmac43602-pcie"); + BRCMF_FW_DEF(4350, "brcmfmac4350-pcie"); + BRCMF_FW_DEF(4350C, "brcmfmac4350c2-pcie"); + BRCMF_FW_CLM_DEF(4355, "brcmfmac4355-pcie"); ++BRCMF_FW_CLM_DEF(4355C1, "brcmfmac4355c1-pcie"); + BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-pcie"); + BRCMF_FW_CLM_DEF(43570, "brcmfmac43570-pcie"); + BRCMF_FW_DEF(4358, "brcmfmac4358-pcie"); +@@ -78,7 +79,8 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { + BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C), + BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350), + BRCMF_FW_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C), +- BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0xFFFFFFFF, 4355), ++ BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0x000007FF, 4355), ++ BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0xFFFFF800, 4355C1), /* rev ID 12/C2 seen */ + BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356), + BRCMF_FW_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570), + BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570), +@@ -1994,6 +1996,11 @@ static int brcmf_pcie_read_otp(struct brcmf_pciedev_info *devinfo) + int ret; + + switch (devinfo->ci->chip) { ++ case BRCM_CC_4355_CHIP_ID: ++ coreid = BCMA_CORE_CHIPCOMMON; ++ base = 0x8c0; ++ words = 0xb2; ++ break; + case BRCM_CC_4378_CHIP_ID: + coreid = BCMA_CORE_GCI; + base = 0x1120; +@@ -2590,6 +2597,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { + BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_RAW_DEVICE_ID, WCC), ++ BRCMF_PCIE_DEVICE(BRCM_PCIE_4355_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID, WCC), +diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +index 28b6cf8f..6e27e396 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h ++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +@@ -72,6 +72,7 @@ + #define BRCM_PCIE_4350_DEVICE_ID 0x43a3 + #define BRCM_PCIE_4354_DEVICE_ID 0x43df + #define BRCM_PCIE_4354_RAW_DEVICE_ID 0x4354 ++#define BRCM_PCIE_4355_DEVICE_ID 0x43dc + #define BRCM_PCIE_4356_DEVICE_ID 0x43ec + #define BRCM_PCIE_43567_DEVICE_ID 0x43d3 + #define BRCM_PCIE_43570_DEVICE_ID 0x43d9 +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-286-wifi-brcmfmac-pcie-Add-IDs-properties-for-BCM43.patch b/patches.kernel.org/6.2.3-286-wifi-brcmfmac-pcie-Add-IDs-properties-for-BCM43.patch new file mode 100644 index 0000000..8930be1 --- /dev/null +++ b/patches.kernel.org/6.2.3-286-wifi-brcmfmac-pcie-Add-IDs-properties-for-BCM43.patch @@ -0,0 +1,102 @@ +From: Hector Martin +Date: Sun, 12 Feb 2023 15:38:12 +0900 +Subject: [PATCH] wifi: brcmfmac: pcie: Add IDs/properties for BCM4377 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: bf8bbd903f07aabfef8d4cb3b513163a3e974d2b + +[ Upstream commit bf8bbd903f07aabfef8d4cb3b513163a3e974d2b ] + +This chip is present on at least these Apple T2 Macs: + +* tahiti: MacBook Pro 13" (2020, 2 TB3) +* formosa: MacBook Pro 13" (Touch/2019) +* fiji: MacBook Air 13" (Scissor, 2020) + +Reviewed-by: Linus Walleij +Reviewed-by: Arend van Spriel +Signed-off-by: Hector Martin +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230212063813.27622-4-marcan@marcan.st +Stable-dep-of: 6a142f70774f ("wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 1 + + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 5 +++++ + .../net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 2 ++ + 3 files changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +index 3e42c2bd..8073f31b 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +@@ -733,6 +733,7 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci) + case CY_CC_4373_CHIP_ID: + return 0x160000; + case CY_CC_43752_CHIP_ID: ++ case BRCM_CC_4377_CHIP_ID: + return 0x170000; + case BRCM_CC_4378_CHIP_ID: + return 0x352000; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index a8d77569..b752a65d 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -63,6 +63,7 @@ BRCMF_FW_DEF(4365C, "brcmfmac4365c-pcie"); + BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie"); + BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie"); + BRCMF_FW_DEF(4371, "brcmfmac4371-pcie"); ++BRCMF_FW_CLM_DEF(4377B3, "brcmfmac4377b3-pcie"); + BRCMF_FW_CLM_DEF(4378B1, "brcmfmac4378b1-pcie"); + + /* firmware config files */ +@@ -95,6 +96,7 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { + BRCMF_FW_ENTRY(BRCM_CC_43664_CHIP_ID, 0xFFFFFFF0, 4366C), + BRCMF_FW_ENTRY(BRCM_CC_43666_CHIP_ID, 0xFFFFFFF0, 4366C), + BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371), ++ BRCMF_FW_ENTRY(BRCM_CC_4377_CHIP_ID, 0xFFFFFFFF, 4377B3), /* revision ID 4 */ + BRCMF_FW_ENTRY(BRCM_CC_4378_CHIP_ID, 0xFFFFFFFF, 4378B1), /* revision ID 3 */ + }; + +@@ -2001,6 +2003,7 @@ static int brcmf_pcie_read_otp(struct brcmf_pciedev_info *devinfo) + base = 0x8c0; + words = 0xb2; + break; ++ case BRCM_CC_4377_CHIP_ID: + case BRCM_CC_4378_CHIP_ID: + coreid = BCMA_CORE_GCI; + base = 0x1120; +@@ -2618,7 +2621,9 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { + BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID, BCA), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4371_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_43596_DEVICE_ID, CYW), ++ BRCMF_PCIE_DEVICE(BRCM_PCIE_4377_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4378_DEVICE_ID, WCC), ++ + { /* end: all zeroes */ } + }; + +diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +index 6e27e396..896615f5 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h ++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +@@ -52,6 +52,7 @@ + #define BRCM_CC_43664_CHIP_ID 43664 + #define BRCM_CC_43666_CHIP_ID 43666 + #define BRCM_CC_4371_CHIP_ID 0x4371 ++#define BRCM_CC_4377_CHIP_ID 0x4377 + #define BRCM_CC_4378_CHIP_ID 0x4378 + #define CY_CC_4373_CHIP_ID 0x4373 + #define CY_CC_43012_CHIP_ID 43012 +@@ -92,6 +93,7 @@ + #define BRCM_PCIE_4366_5G_DEVICE_ID 0x43c5 + #define BRCM_PCIE_4371_DEVICE_ID 0x440d + #define BRCM_PCIE_43596_DEVICE_ID 0x4415 ++#define BRCM_PCIE_4377_DEVICE_ID 0x4488 + #define BRCM_PCIE_4378_DEVICE_ID 0x4425 + + /* brcmsmac IDs */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-287-wifi-brcmfmac-pcie-Perform-correct-BCM4364-firm.patch b/patches.kernel.org/6.2.3-287-wifi-brcmfmac-pcie-Perform-correct-BCM4364-firm.patch new file mode 100644 index 0000000..e8f4231 --- /dev/null +++ b/patches.kernel.org/6.2.3-287-wifi-brcmfmac-pcie-Perform-correct-BCM4364-firm.patch @@ -0,0 +1,98 @@ +From: Hector Martin +Date: Sun, 12 Feb 2023 15:38:13 +0900 +Subject: [PATCH] wifi: brcmfmac: pcie: Perform correct BCM4364 firmware + selection +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6a142f70774fd10350a52a10ba1297d52da46780 + +[ Upstream commit 6a142f70774fd10350a52a10ba1297d52da46780 ] + +This chip exists in two revisions (B2=r3 and B3=r4) on different +platforms, and was added without regard to doing proper firmware +selection or differentiating between them. Fix this to have proper +per-revision firmwares and support Apple NVRAM selection. + +Revision B2 is present on at least these Apple T2 Macs: + +kauai: MacBook Pro 15" (Touch/2018-2019) +maui: MacBook Pro 13" (Touch/2018-2019) +lanai: Mac mini (Late 2018) +ekans: iMac Pro 27" (5K, Late 2017) + +And these non-T2 Macs: + +nihau: iMac 27" (5K, 2019) + +Revision B3 is present on at least these Apple T2 Macs: + +bali: MacBook Pro 16" (2019) +trinidad: MacBook Pro 13" (2020, 4 TB3) +borneo: MacBook Pro 16" (2019, 5600M) +kahana: Mac Pro (2019) +kahana: Mac Pro (2019, Rack) +hanauma: iMac 27" (5K, 2020) +kure: iMac 27" (5K, 2020, 5700/XT) + +Also fix the firmware interface for 4364, from BCA to WCC. + +Fixes: 24f0bd136264 ("brcmfmac: add the BRCM 4364 found in MacBook Pro 15,2") +Reviewed-by: Linus Walleij +Reviewed-by: Arend van Spriel +Signed-off-by: Hector Martin +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230212063813.27622-5-marcan@marcan.st +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index b752a65d..a9b9b2dc 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -57,7 +57,8 @@ BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-pcie"); + BRCMF_FW_CLM_DEF(43570, "brcmfmac43570-pcie"); + BRCMF_FW_DEF(4358, "brcmfmac4358-pcie"); + BRCMF_FW_DEF(4359, "brcmfmac4359-pcie"); +-BRCMF_FW_DEF(4364, "brcmfmac4364-pcie"); ++BRCMF_FW_CLM_DEF(4364B2, "brcmfmac4364b2-pcie"); ++BRCMF_FW_CLM_DEF(4364B3, "brcmfmac4364b3-pcie"); + BRCMF_FW_DEF(4365B, "brcmfmac4365b-pcie"); + BRCMF_FW_DEF(4365C, "brcmfmac4365c-pcie"); + BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie"); +@@ -88,7 +89,8 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { + BRCMF_FW_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570), + BRCMF_FW_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358), + BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359), +- BRCMF_FW_ENTRY(BRCM_CC_4364_CHIP_ID, 0xFFFFFFFF, 4364), ++ BRCMF_FW_ENTRY(BRCM_CC_4364_CHIP_ID, 0x0000000F, 4364B2), /* 3 */ ++ BRCMF_FW_ENTRY(BRCM_CC_4364_CHIP_ID, 0xFFFFFFF0, 4364B3), /* 4 */ + BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B), + BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C), + BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B), +@@ -2003,6 +2005,11 @@ static int brcmf_pcie_read_otp(struct brcmf_pciedev_info *devinfo) + base = 0x8c0; + words = 0xb2; + break; ++ case BRCM_CC_4364_CHIP_ID: ++ coreid = BCMA_CORE_CHIPCOMMON; ++ base = 0x8c0; ++ words = 0x1a0; ++ break; + case BRCM_CC_4377_CHIP_ID: + case BRCM_CC_4378_CHIP_ID: + coreid = BCMA_CORE_GCI; +@@ -2611,7 +2618,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { + BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_RAW_DEVICE_ID, WCC), +- BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, BCA), ++ BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID, BCA), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID, BCA), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID, BCA), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-288-wifi-mwifiex-fix-loop-iterator-in-mwifiex_updat.patch b/patches.kernel.org/6.2.3-288-wifi-mwifiex-fix-loop-iterator-in-mwifiex_updat.patch new file mode 100644 index 0000000..fd3fdfb --- /dev/null +++ b/patches.kernel.org/6.2.3-288-wifi-mwifiex-fix-loop-iterator-in-mwifiex_updat.patch @@ -0,0 +1,50 @@ +From: Dan Carpenter +Date: Mon, 6 Feb 2023 17:41:33 +0300 +Subject: [PATCH] wifi: mwifiex: fix loop iterator in + mwifiex_update_ampdu_txwinsize() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 + +[ Upstream commit 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 ] + +This code re-uses "i" to be the iterator for both the inside and outside +loops. It means the outside loop will exit earlier than intended. + +Fixes: d219b7eb3792 ("mwifiex: handle BT coex event to adjust Rx BA window size") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/Y+ERnaDaZD7RtLvX@kili +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/marvell/mwifiex/11n.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c +index 4af57e6d..90e40110 100644 +--- a/drivers/net/wireless/marvell/mwifiex/11n.c ++++ b/drivers/net/wireless/marvell/mwifiex/11n.c +@@ -878,7 +878,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid) + */ + void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter) + { +- u8 i; ++ u8 i, j; + u32 tx_win_size; + struct mwifiex_private *priv; + +@@ -909,8 +909,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter) + if (tx_win_size != priv->add_ba_param.tx_win_size) { + if (!priv->media_connected) + continue; +- for (i = 0; i < MAX_NUM_TID; i++) +- mwifiex_send_delba_txbastream_tbl(priv, i); ++ for (j = 0; j < MAX_NUM_TID; j++) ++ mwifiex_send_delba_txbastream_tbl(priv, j); + } + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-289-wifi-rtw89-fix-parsing-offset-for-MCC-C2H.patch b/patches.kernel.org/6.2.3-289-wifi-rtw89-fix-parsing-offset-for-MCC-C2H.patch new file mode 100644 index 0000000..8d99fe2 --- /dev/null +++ b/patches.kernel.org/6.2.3-289-wifi-rtw89-fix-parsing-offset-for-MCC-C2H.patch @@ -0,0 +1,96 @@ +From: Zong-Zhe Yang +Date: Thu, 19 Jan 2023 14:43:41 +0800 +Subject: [PATCH] wifi: rtw89: fix parsing offset for MCC C2H +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 24d72944d79e6795ba4330c114de0387386bf3aa + +[ Upstream commit 24d72944d79e6795ba4330c114de0387386bf3aa ] + +A 8-byte offset is missed during parsing C2Hs (chip to host packets) +of MCC (multi-channel concurrent) series. +So, we fix it. + +Fixes: ef9dff4cb491 ("wifi: rtw89: mac: process MCC related C2H") +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230119064342.65391-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw89/fw.h | 34 ++++++++++++------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h +index 4d2f9ea9..2e4ca1cc 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.h ++++ b/drivers/net/wireless/realtek/rtw89/fw.h +@@ -3209,16 +3209,16 @@ static inline struct rtw89_fw_c2h_attr *RTW89_SKB_C2H_CB(struct sk_buff *skb) + le32_get_bits(*((const __le32 *)(c2h) + 5), GENMASK(25, 24)) + + #define RTW89_GET_MAC_C2H_MCC_RCV_ACK_GROUP(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(1, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(1, 0)) + #define RTW89_GET_MAC_C2H_MCC_RCV_ACK_H2C_FUNC(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8)) + + #define RTW89_GET_MAC_C2H_MCC_REQ_ACK_GROUP(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(1, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(1, 0)) + #define RTW89_GET_MAC_C2H_MCC_REQ_ACK_H2C_RETURN(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(7, 2)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(7, 2)) + #define RTW89_GET_MAC_C2H_MCC_REQ_ACK_H2C_FUNC(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8)) + + struct rtw89_mac_mcc_tsf_rpt { + u32 macid_x; +@@ -3232,30 +3232,30 @@ struct rtw89_mac_mcc_tsf_rpt { + static_assert(sizeof(struct rtw89_mac_mcc_tsf_rpt) <= RTW89_COMPLETION_BUF_SIZE); + + #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_MACID_X(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(7, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(7, 0)) + #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_MACID_Y(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8)) + #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_GROUP(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(17, 16)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(17, 16)) + #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_LOW_X(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h) + 1), GENMASK(31, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 3), GENMASK(31, 0)) + #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_HIGH_X(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(31, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 4), GENMASK(31, 0)) + #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_LOW_Y(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h) + 3), GENMASK(31, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 5), GENMASK(31, 0)) + #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_HIGH_Y(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h) + 4), GENMASK(31, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 6), GENMASK(31, 0)) + + #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_STATUS(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(5, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(5, 0)) + #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_GROUP(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(7, 6)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(7, 6)) + #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_MACID(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8)) ++ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8)) + #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_TSF_LOW(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h) + 1), GENMASK(31, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 3), GENMASK(31, 0)) + #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_TSF_HIGH(c2h) \ +- le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(31, 0)) ++ le32_get_bits(*((const __le32 *)(c2h) + 4), GENMASK(31, 0)) + + #define RTW89_FW_HDR_SIZE 32 + #define RTW89_FW_SECTION_HDR_SIZE 16 +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-290-selftests-bpf-Fix-out-of-srctree-build.patch b/patches.kernel.org/6.2.3-290-selftests-bpf-Fix-out-of-srctree-build.patch new file mode 100644 index 0000000..b136ea6 --- /dev/null +++ b/patches.kernel.org/6.2.3-290-selftests-bpf-Fix-out-of-srctree-build.patch @@ -0,0 +1,50 @@ +From: Ilya Leoshkevich +Date: Thu, 9 Feb 2023 00:12:11 +0100 +Subject: [PATCH] selftests/bpf: Fix out-of-srctree build +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0b0757244754ea1d0721195c824770f5576e119e + +[ Upstream commit 0b0757244754ea1d0721195c824770f5576e119e ] + +Building BPF selftests out of srctree fails with: + + make: *** No rule to make target '/linux-build//ima_setup.sh', needed by 'ima_setup.sh'. Stop. + +The culprit is the rule that defines convenient shorthands like +"make test_progs", which builds $(OUTPUT)/test_progs. These shorthands +make sense only for binaries that are built though; scripts that live +in the source tree do not end up in $(OUTPUT). + +Therefore drop $(TEST_PROGS) and $(TEST_PROGS_EXTENDED) from the rule. + +The issue exists for a while, but it became a problem only after commit +d68ae4982cb7 ("selftests/bpf: Install all required files to run selftests"), +which added dependencies on these scripts. + +Fixes: 03dcb78460c2 ("selftests/bpf: Add simple per-test targets to Makefile") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230208231211.283606-1-iii@linux.ibm.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/Makefile | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index 2323a2b9..43c559b7 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -149,8 +149,6 @@ endif + # NOTE: Semicolon at the end is critical to override lib.mk's default static + # rule for binaries. + $(notdir $(TEST_GEN_PROGS) \ +- $(TEST_PROGS) \ +- $(TEST_PROGS_EXTENDED) \ + $(TEST_GEN_PROGS_EXTENDED) \ + $(TEST_CUSTOM_PROGS)): %: $(OUTPUT)/% ; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-291-ACPI-resource-Add-IRQ-overrides-for-MAINGEAR-Ve.patch b/patches.kernel.org/6.2.3-291-ACPI-resource-Add-IRQ-overrides-for-MAINGEAR-Ve.patch new file mode 100644 index 0000000..a22dd8d --- /dev/null +++ b/patches.kernel.org/6.2.3-291-ACPI-resource-Add-IRQ-overrides-for-MAINGEAR-Ve.patch @@ -0,0 +1,69 @@ +From: Adam Niederer +Date: Sat, 11 Feb 2023 15:13:33 -0500 +Subject: [PATCH] ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 + models +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cb18703c179713056bd7e3bdfc2260ab4e8658f0 + +[ Upstream commit cb18703c179713056bd7e3bdfc2260ab4e8658f0 ] + +Fix a regression introduced by commit 9946e39fe8d0 ("ACPI: resource: skip +IRQ override on AMD Zen platforms") on MAINGEAR Vector Pro 2 systems, which +causes the built-in keyboard to not work. This restores the functionality +by adding an IRQ override. + +No other IRQs were being overridden before, so this should be all that is +needed for these systems. I have personally tested this on the 15" model +(MG-VCP2-15A3070T), and I have confirmation that the issue is present on +the 17" model (MG-VCP2-17A3070T). + +Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") +Signed-off-by: Adam Niederer +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/resource.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 192d1784..1d9d3364 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -478,6 +478,24 @@ static const struct dmi_system_id schenker_gm_rg[] = { + { } + }; + ++static const struct dmi_system_id maingear_laptop[] = { ++ { ++ .ident = "MAINGEAR Vector Pro 2 15", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-15A3070T"), ++ } ++ }, ++ { ++ .ident = "MAINGEAR Vector Pro 2 17", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-17A3070T"), ++ }, ++ }, ++ { } ++}; ++ + struct irq_override_cmp { + const struct dmi_system_id *system; + unsigned char irq; +@@ -493,6 +511,7 @@ static const struct irq_override_cmp override_table[] = { + { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, + { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, + { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, ++ { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + }; + + static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-292-ACPI-resource-Do-IRQ-override-on-all-TongFang-G.patch b/patches.kernel.org/6.2.3-292-ACPI-resource-Do-IRQ-override-on-all-TongFang-G.patch new file mode 100644 index 0000000..2489e6a --- /dev/null +++ b/patches.kernel.org/6.2.3-292-ACPI-resource-Do-IRQ-override-on-all-TongFang-G.patch @@ -0,0 +1,51 @@ +From: Werner Sembach +Date: Mon, 13 Feb 2023 19:16:53 +0100 +Subject: [PATCH] ACPI: resource: Do IRQ override on all TongFang GMxRGxx +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 17bb7046e7ce038a73ee97eaa804e0300c5199e2 + +[ Upstream commit 17bb7046e7ce038a73ee97eaa804e0300c5199e2 ] + +Apply commit 7592b79ba4a9 ("ACPI: resource: do IRQ override on XMG Core 15") +override for all vendors using this mainboard. + +Signed-off-by: Werner Sembach +Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/resource.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 1d9d3364..a222bda7 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -467,11 +467,10 @@ static const struct dmi_system_id lenovo_laptop[] = { + { } + }; + +-static const struct dmi_system_id schenker_gm_rg[] = { ++static const struct dmi_system_id tongfang_gm_rg[] = { + { +- .ident = "XMG CORE 15 (M22)", ++ .ident = "TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD", + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), + DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"), + }, + }, +@@ -510,7 +509,7 @@ static const struct irq_override_cmp override_table[] = { + { asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false }, + { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, + { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, +- { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, ++ { tongfang_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-293-crypto-octeontx2-Fix-objects-shared-between-sev.patch b/patches.kernel.org/6.2.3-293-crypto-octeontx2-Fix-objects-shared-between-sev.patch new file mode 100644 index 0000000..39864be --- /dev/null +++ b/patches.kernel.org/6.2.3-293-crypto-octeontx2-Fix-objects-shared-between-sev.patch @@ -0,0 +1,294 @@ +From: Alexander Lobakin +Date: Mon, 6 Feb 2023 13:18:50 +0800 +Subject: [PATCH] crypto: octeontx2 - Fix objects shared between several + modules +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 72bc4e71dbeedee0a446bcbc37c9bb25449072b7 + +[ Upstream commit 72bc4e71dbeedee0a446bcbc37c9bb25449072b7 ] + +cn10k_cpt.o, otx2_cptlf.o and otx2_cpt_mbox_common.o are linked +into both rvu_cptpf and rvu_cptvf modules: + +> scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile: +> cn10k_cpt.o is added to multiple modules: rvu_cptpf rvu_cptvf +> scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile: +> otx2_cptlf.o is added to multiple modules: rvu_cptpf rvu_cptvf +> scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile: +> otx2_cpt_mbox_common.o is added to multiple modules: rvu_cptpf rvu_cptvf + +Despite they're build under the same Kconfig option +(CONFIG_CRYPTO_DEV_OCTEONTX2_CPT), it's better do link the common +code into a standalone module and export the shared functions. Under +certain circumstances, this can lead to the same situation as fixed +by commit 637a642f5ca5 ("zstd: Fixing mixed module-builtin objects"). +Plus, those three common object files are relatively big to duplicate +them several times. + +Introduce the new module, rvu_cptcommon, to provide the common +functions to both modules. + +Fixes: 19d8e8c7be15 ("crypto: octeontx2 - add virtual function driver support") +Suggested-by: Masahiro Yamada +Signed-off-by: Alexander Lobakin +Reviewed-by: Masahiro Yamada +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/crypto/marvell/octeontx2/Makefile | 11 +++++------ + drivers/crypto/marvell/octeontx2/cn10k_cpt.c | 9 +++++++-- + drivers/crypto/marvell/octeontx2/cn10k_cpt.h | 2 -- + drivers/crypto/marvell/octeontx2/otx2_cpt_common.h | 2 -- + .../marvell/octeontx2/otx2_cpt_mbox_common.c | 14 ++++++++++++-- + drivers/crypto/marvell/octeontx2/otx2_cptlf.c | 11 +++++++++++ + drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c | 2 ++ + drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 2 ++ + 8 files changed, 39 insertions(+), 14 deletions(-) + +diff --git a/drivers/crypto/marvell/octeontx2/Makefile b/drivers/crypto/marvell/octeontx2/Makefile +index 965297e9..f0f2942c 100644 +--- a/drivers/crypto/marvell/octeontx2/Makefile ++++ b/drivers/crypto/marvell/octeontx2/Makefile +@@ -1,11 +1,10 @@ + # SPDX-License-Identifier: GPL-2.0-only +-obj-$(CONFIG_CRYPTO_DEV_OCTEONTX2_CPT) += rvu_cptpf.o rvu_cptvf.o ++obj-$(CONFIG_CRYPTO_DEV_OCTEONTX2_CPT) += rvu_cptcommon.o rvu_cptpf.o rvu_cptvf.o + ++rvu_cptcommon-objs := cn10k_cpt.o otx2_cptlf.o otx2_cpt_mbox_common.o + rvu_cptpf-objs := otx2_cptpf_main.o otx2_cptpf_mbox.o \ +- otx2_cpt_mbox_common.o otx2_cptpf_ucode.o otx2_cptlf.o \ +- cn10k_cpt.o otx2_cpt_devlink.o +-rvu_cptvf-objs := otx2_cptvf_main.o otx2_cptvf_mbox.o otx2_cptlf.o \ +- otx2_cpt_mbox_common.o otx2_cptvf_reqmgr.o \ +- otx2_cptvf_algs.o cn10k_cpt.o ++ otx2_cptpf_ucode.o otx2_cpt_devlink.o ++rvu_cptvf-objs := otx2_cptvf_main.o otx2_cptvf_mbox.o \ ++ otx2_cptvf_reqmgr.o otx2_cptvf_algs.o + + ccflags-y += -I$(srctree)/drivers/net/ethernet/marvell/octeontx2/af +diff --git a/drivers/crypto/marvell/octeontx2/cn10k_cpt.c b/drivers/crypto/marvell/octeontx2/cn10k_cpt.c +index 1499ef75..93d22b32 100644 +--- a/drivers/crypto/marvell/octeontx2/cn10k_cpt.c ++++ b/drivers/crypto/marvell/octeontx2/cn10k_cpt.c +@@ -7,6 +7,9 @@ + #include "otx2_cptlf.h" + #include "cn10k_cpt.h" + ++static void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num, ++ struct otx2_cptlf_info *lf); ++ + static struct cpt_hw_ops otx2_hw_ops = { + .send_cmd = otx2_cpt_send_cmd, + .cpt_get_compcode = otx2_cpt_get_compcode, +@@ -19,8 +22,8 @@ static struct cpt_hw_ops cn10k_hw_ops = { + .cpt_get_uc_compcode = cn10k_cpt_get_uc_compcode, + }; + +-void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num, +- struct otx2_cptlf_info *lf) ++static void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num, ++ struct otx2_cptlf_info *lf) + { + void __iomem *lmtline = lf->lmtline; + u64 val = (lf->slot & 0x7FF); +@@ -68,6 +71,7 @@ int cn10k_cptpf_lmtst_init(struct otx2_cptpf_dev *cptpf) + + return 0; + } ++EXPORT_SYMBOL_NS_GPL(cn10k_cptpf_lmtst_init, CRYPTO_DEV_OCTEONTX2_CPT); + + int cn10k_cptvf_lmtst_init(struct otx2_cptvf_dev *cptvf) + { +@@ -91,3 +95,4 @@ int cn10k_cptvf_lmtst_init(struct otx2_cptvf_dev *cptvf) + + return 0; + } ++EXPORT_SYMBOL_NS_GPL(cn10k_cptvf_lmtst_init, CRYPTO_DEV_OCTEONTX2_CPT); +diff --git a/drivers/crypto/marvell/octeontx2/cn10k_cpt.h b/drivers/crypto/marvell/octeontx2/cn10k_cpt.h +index c091392b..aaefc7e3 100644 +--- a/drivers/crypto/marvell/octeontx2/cn10k_cpt.h ++++ b/drivers/crypto/marvell/octeontx2/cn10k_cpt.h +@@ -28,8 +28,6 @@ static inline u8 otx2_cpt_get_uc_compcode(union otx2_cpt_res_s *result) + return ((struct cn9k_cpt_res_s *)result)->uc_compcode; + } + +-void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num, +- struct otx2_cptlf_info *lf); + int cn10k_cptpf_lmtst_init(struct otx2_cptpf_dev *cptpf); + int cn10k_cptvf_lmtst_init(struct otx2_cptvf_dev *cptvf); + +diff --git a/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h b/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h +index 5012b7e6..6019066a 100644 +--- a/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h ++++ b/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h +@@ -145,8 +145,6 @@ int otx2_cpt_send_mbox_msg(struct otx2_mbox *mbox, struct pci_dev *pdev); + + int otx2_cpt_send_af_reg_requests(struct otx2_mbox *mbox, + struct pci_dev *pdev); +-int otx2_cpt_add_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, +- u64 reg, u64 *val, int blkaddr); + int otx2_cpt_add_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, + u64 reg, u64 val, int blkaddr); + int otx2_cpt_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, +diff --git a/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c b/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c +index a3173196..11599747 100644 +--- a/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c ++++ b/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c +@@ -19,6 +19,7 @@ int otx2_cpt_send_mbox_msg(struct otx2_mbox *mbox, struct pci_dev *pdev) + } + return ret; + } ++EXPORT_SYMBOL_NS_GPL(otx2_cpt_send_mbox_msg, CRYPTO_DEV_OCTEONTX2_CPT); + + int otx2_cpt_send_ready_msg(struct otx2_mbox *mbox, struct pci_dev *pdev) + { +@@ -36,14 +37,17 @@ int otx2_cpt_send_ready_msg(struct otx2_mbox *mbox, struct pci_dev *pdev) + + return otx2_cpt_send_mbox_msg(mbox, pdev); + } ++EXPORT_SYMBOL_NS_GPL(otx2_cpt_send_ready_msg, CRYPTO_DEV_OCTEONTX2_CPT); + + int otx2_cpt_send_af_reg_requests(struct otx2_mbox *mbox, struct pci_dev *pdev) + { + return otx2_cpt_send_mbox_msg(mbox, pdev); + } ++EXPORT_SYMBOL_NS_GPL(otx2_cpt_send_af_reg_requests, CRYPTO_DEV_OCTEONTX2_CPT); + +-int otx2_cpt_add_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, +- u64 reg, u64 *val, int blkaddr) ++static int otx2_cpt_add_read_af_reg(struct otx2_mbox *mbox, ++ struct pci_dev *pdev, u64 reg, ++ u64 *val, int blkaddr) + { + struct cpt_rd_wr_reg_msg *reg_msg; + +@@ -91,6 +95,7 @@ int otx2_cpt_add_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, + + return 0; + } ++EXPORT_SYMBOL_NS_GPL(otx2_cpt_add_write_af_reg, CRYPTO_DEV_OCTEONTX2_CPT); + + int otx2_cpt_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, + u64 reg, u64 *val, int blkaddr) +@@ -103,6 +108,7 @@ int otx2_cpt_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, + + return otx2_cpt_send_mbox_msg(mbox, pdev); + } ++EXPORT_SYMBOL_NS_GPL(otx2_cpt_read_af_reg, CRYPTO_DEV_OCTEONTX2_CPT); + + int otx2_cpt_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, + u64 reg, u64 val, int blkaddr) +@@ -115,6 +121,7 @@ int otx2_cpt_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, + + return otx2_cpt_send_mbox_msg(mbox, pdev); + } ++EXPORT_SYMBOL_NS_GPL(otx2_cpt_write_af_reg, CRYPTO_DEV_OCTEONTX2_CPT); + + int otx2_cpt_attach_rscrs_msg(struct otx2_cptlfs_info *lfs) + { +@@ -170,6 +177,7 @@ int otx2_cpt_detach_rsrcs_msg(struct otx2_cptlfs_info *lfs) + + return ret; + } ++EXPORT_SYMBOL_NS_GPL(otx2_cpt_detach_rsrcs_msg, CRYPTO_DEV_OCTEONTX2_CPT); + + int otx2_cpt_msix_offset_msg(struct otx2_cptlfs_info *lfs) + { +@@ -202,6 +210,7 @@ int otx2_cpt_msix_offset_msg(struct otx2_cptlfs_info *lfs) + } + return ret; + } ++EXPORT_SYMBOL_NS_GPL(otx2_cpt_msix_offset_msg, CRYPTO_DEV_OCTEONTX2_CPT); + + int otx2_cpt_sync_mbox_msg(struct otx2_mbox *mbox) + { +@@ -216,3 +225,4 @@ int otx2_cpt_sync_mbox_msg(struct otx2_mbox *mbox) + + return otx2_mbox_check_rsp_msgs(mbox, 0); + } ++EXPORT_SYMBOL_NS_GPL(otx2_cpt_sync_mbox_msg, CRYPTO_DEV_OCTEONTX2_CPT); +diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c +index c8350fcd..71e5f794 100644 +--- a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c ++++ b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c +@@ -274,6 +274,8 @@ void otx2_cptlf_unregister_interrupts(struct otx2_cptlfs_info *lfs) + } + cptlf_disable_intrs(lfs); + } ++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_unregister_interrupts, ++ CRYPTO_DEV_OCTEONTX2_CPT); + + static int cptlf_do_register_interrrupts(struct otx2_cptlfs_info *lfs, + int lf_num, int irq_offset, +@@ -321,6 +323,7 @@ int otx2_cptlf_register_interrupts(struct otx2_cptlfs_info *lfs) + otx2_cptlf_unregister_interrupts(lfs); + return ret; + } ++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_register_interrupts, CRYPTO_DEV_OCTEONTX2_CPT); + + void otx2_cptlf_free_irqs_affinity(struct otx2_cptlfs_info *lfs) + { +@@ -334,6 +337,7 @@ void otx2_cptlf_free_irqs_affinity(struct otx2_cptlfs_info *lfs) + free_cpumask_var(lfs->lf[slot].affinity_mask); + } + } ++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_free_irqs_affinity, CRYPTO_DEV_OCTEONTX2_CPT); + + int otx2_cptlf_set_irqs_affinity(struct otx2_cptlfs_info *lfs) + { +@@ -366,6 +370,7 @@ int otx2_cptlf_set_irqs_affinity(struct otx2_cptlfs_info *lfs) + otx2_cptlf_free_irqs_affinity(lfs); + return ret; + } ++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_set_irqs_affinity, CRYPTO_DEV_OCTEONTX2_CPT); + + int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri, + int lfs_num) +@@ -422,6 +427,7 @@ int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri, + lfs->lfs_num = 0; + return ret; + } ++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_init, CRYPTO_DEV_OCTEONTX2_CPT); + + void otx2_cptlf_shutdown(struct otx2_cptlfs_info *lfs) + { +@@ -431,3 +437,8 @@ void otx2_cptlf_shutdown(struct otx2_cptlfs_info *lfs) + /* Send request to detach LFs */ + otx2_cpt_detach_rsrcs_msg(lfs); + } ++EXPORT_SYMBOL_NS_GPL(otx2_cptlf_shutdown, CRYPTO_DEV_OCTEONTX2_CPT); ++ ++MODULE_AUTHOR("Marvell"); ++MODULE_DESCRIPTION("Marvell RVU CPT Common module"); ++MODULE_LICENSE("GPL"); +diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c +index a402ccfa..ddf6e913 100644 +--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c ++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c +@@ -831,6 +831,8 @@ static struct pci_driver otx2_cpt_pci_driver = { + + module_pci_driver(otx2_cpt_pci_driver); + ++MODULE_IMPORT_NS(CRYPTO_DEV_OCTEONTX2_CPT); ++ + MODULE_AUTHOR("Marvell"); + MODULE_DESCRIPTION(OTX2_CPT_DRV_STRING); + MODULE_LICENSE("GPL v2"); +diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c +index 3411e664..392e9fee 100644 +--- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c ++++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c +@@ -429,6 +429,8 @@ static struct pci_driver otx2_cptvf_pci_driver = { + + module_pci_driver(otx2_cptvf_pci_driver); + ++MODULE_IMPORT_NS(CRYPTO_DEV_OCTEONTX2_CPT); ++ + MODULE_AUTHOR("Marvell"); + MODULE_DESCRIPTION("Marvell RVU CPT Virtual Function Driver"); + MODULE_LICENSE("GPL v2"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-294-crypto-crypto4xx-Call-dma_unmap_page-when-done.patch b/patches.kernel.org/6.2.3-294-crypto-crypto4xx-Call-dma_unmap_page-when-done.patch new file mode 100644 index 0000000..c422d4f --- /dev/null +++ b/patches.kernel.org/6.2.3-294-crypto-crypto4xx-Call-dma_unmap_page-when-done.patch @@ -0,0 +1,65 @@ +From: Herbert Xu +Date: Mon, 6 Feb 2023 14:01:53 +0800 +Subject: [PATCH] crypto: crypto4xx - Call dma_unmap_page when done +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: bcdda4301bdc4955d45f7e1ffefb6207967b067e + +[ Upstream commit bcdda4301bdc4955d45f7e1ffefb6207967b067e ] + +In crypto4xx_cipher_done, we should be unmapping the dst page, not +mapping it. + +This was flagged by a sparse warning about the unused addr variable. +While we're at it, also fix a sparse warning regarding the unused +ctx variable in crypto4xx_ahash_done (by actually using it). + +Fixes: 049359d65527 ("crypto: amcc - Add crypt4xx driver") +Signed-off-by: Herbert Xu +Tested-by: Christian Lamparter +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/crypto/amcc/crypto4xx_core.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c +index 280f4b0e..50dc7838 100644 +--- a/drivers/crypto/amcc/crypto4xx_core.c ++++ b/drivers/crypto/amcc/crypto4xx_core.c +@@ -522,7 +522,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, + { + struct skcipher_request *req; + struct scatterlist *dst; +- dma_addr_t addr; + + req = skcipher_request_cast(pd_uinfo->async_req); + +@@ -531,8 +530,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, + req->cryptlen, req->dst); + } else { + dst = pd_uinfo->dest_va; +- addr = dma_map_page(dev->core_dev->device, sg_page(dst), +- dst->offset, dst->length, DMA_FROM_DEVICE); ++ dma_unmap_page(dev->core_dev->device, pd->dest, dst->length, ++ DMA_FROM_DEVICE); + } + + if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) { +@@ -557,10 +556,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev, + struct ahash_request *ahash_req; + + ahash_req = ahash_request_cast(pd_uinfo->async_req); +- ctx = crypto_tfm_ctx(ahash_req->base.tfm); ++ ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(ahash_req)); + +- crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, +- crypto_tfm_ctx(ahash_req->base.tfm)); ++ crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, ctx); + crypto4xx_ret_sg_desc(dev, pd_uinfo); + + if (pd_uinfo->state & PD_ENTRY_BUSY) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-295-vfio-ccw-remove-WARN_ON-during-shutdown.patch b/patches.kernel.org/6.2.3-295-vfio-ccw-remove-WARN_ON-during-shutdown.patch new file mode 100644 index 0000000..bec0645 --- /dev/null +++ b/patches.kernel.org/6.2.3-295-vfio-ccw-remove-WARN_ON-during-shutdown.patch @@ -0,0 +1,52 @@ +From: Eric Farman +Date: Fri, 10 Feb 2023 18:42:27 +0100 +Subject: [PATCH] vfio/ccw: remove WARN_ON during shutdown +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1c06bb87afb2d95b8e9f4f2e3d0d6772c68f3e76 + +[ Upstream commit 1c06bb87afb2d95b8e9f4f2e3d0d6772c68f3e76 ] + +The logic in vfio_ccw_sch_shutdown() always assumed that the input +subchannel would point to a vfio_ccw_private struct, without checking +that one exists. The blamed commit put in a check for this scenario, +to prevent the possibility of a missing private. + +The trouble is that check was put alongside a WARN_ON(), presuming +that such a scenario would be a cause for concern. But this can be +triggered by binding a subchannel to vfio-ccw, and rebooting the +system before starting the mdev (via "mdevctl start" or similar) +or after stopping it. In those cases, shutdown doesn't need to +worry because either the private was never allocated, or it was +cleaned up by vfio_ccw_mdev_remove(). + +Remove the WARN_ON() piece of this check, since there are plausible +scenarios where private would be NULL in this path. + +Fixes: 9e6f07cd1eaa ("vfio/ccw: create a parent struct") +Signed-off-by: Eric Farman +Reviewed-by: Matthew Rosato +Link: https://lore.kernel.org/r/20230210174227.2256424-1-farman@linux.ibm.com +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/s390/cio/vfio_ccw_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c +index 54aba7cc..ff538a08 100644 +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -225,7 +225,7 @@ static void vfio_ccw_sch_shutdown(struct subchannel *sch) + struct vfio_ccw_parent *parent = dev_get_drvdata(&sch->dev); + struct vfio_ccw_private *private = dev_get_drvdata(&parent->dev); + +- if (WARN_ON(!private)) ++ if (!private) + return; + + vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_CLOSE); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-296-wifi-mac80211-move-color-collision-detection-re.patch b/patches.kernel.org/6.2.3-296-wifi-mac80211-move-color-collision-detection-re.patch new file mode 100644 index 0000000..0cf31e7 --- /dev/null +++ b/patches.kernel.org/6.2.3-296-wifi-mac80211-move-color-collision-detection-re.patch @@ -0,0 +1,122 @@ +From: Lorenzo Bianconi +Date: Wed, 25 Jan 2023 12:01:02 +0100 +Subject: [PATCH] wifi: mac80211: move color collision detection report in a + delayed work +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9288188438d85e22c23cfd6657ee8a801babc83c + +[ Upstream commit 9288188438d85e22c23cfd6657ee8a801babc83c ] + +Move color collision report in a dedicated delayed work and do not run +it in interrupt context in order to rate-limit the number of events +reported to userspace. Moreover grab wdev mutex in +ieee80211_color_collision_detection_work routine since it is required +by cfg80211_obss_color_collision_notify(). + +Tested-by: Nicolas Cavallari +Signed-off-by: Lorenzo Bianconi +Fixes: 5f9404abdf2a ("mac80211: add support for BSS color change") +Link: https://lore.kernel.org/r/3f6cf60c892ad40c1cca4a55d62b1224ef1c6ce9.1674644379.git.lorenzo@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/cfg.c | 26 +++++++++++++++++++++++++- + net/mac80211/ieee80211_i.h | 3 +++ + net/mac80211/link.c | 3 +++ + 3 files changed, 31 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 672eff6f..d611e153 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -4622,6 +4622,20 @@ void ieee80211_color_change_finalize_work(struct work_struct *work) + sdata_unlock(sdata); + } + ++void ieee80211_color_collision_detection_work(struct work_struct *work) ++{ ++ struct delayed_work *delayed_work = to_delayed_work(work); ++ struct ieee80211_link_data *link = ++ container_of(delayed_work, struct ieee80211_link_data, ++ color_collision_detect_work); ++ struct ieee80211_sub_if_data *sdata = link->sdata; ++ ++ sdata_lock(sdata); ++ cfg80211_obss_color_collision_notify(sdata->dev, link->color_bitmap, ++ GFP_KERNEL); ++ sdata_unlock(sdata); ++} ++ + void ieee80211_color_change_finish(struct ieee80211_vif *vif) + { + struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); +@@ -4636,11 +4650,21 @@ ieeee80211_obss_color_collision_notify(struct ieee80211_vif *vif, + u64 color_bitmap, gfp_t gfp) + { + struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); ++ struct ieee80211_link_data *link = &sdata->deflink; + + if (sdata->vif.bss_conf.color_change_active || sdata->vif.bss_conf.csa_active) + return; + +- cfg80211_obss_color_collision_notify(sdata->dev, color_bitmap, gfp); ++ if (delayed_work_pending(&link->color_collision_detect_work)) ++ return; ++ ++ link->color_bitmap = color_bitmap; ++ /* queue the color collision detection event every 500 ms in order to ++ * avoid sending too much netlink messages to userspace. ++ */ ++ ieee80211_queue_delayed_work(&sdata->local->hw, ++ &link->color_collision_detect_work, ++ msecs_to_jiffies(500)); + } + EXPORT_SYMBOL_GPL(ieeee80211_obss_color_collision_notify); + +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index d16606e8..7ca9bde3 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -974,6 +974,8 @@ struct ieee80211_link_data { + struct cfg80211_chan_def csa_chandef; + + struct work_struct color_change_finalize_work; ++ struct delayed_work color_collision_detect_work; ++ u64 color_bitmap; + + /* context reservation -- protected with chanctx_mtx */ + struct ieee80211_chanctx *reserved_chanctx; +@@ -1929,6 +1931,7 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev, + + /* color change handling */ + void ieee80211_color_change_finalize_work(struct work_struct *work); ++void ieee80211_color_collision_detection_work(struct work_struct *work); + + /* interface handling */ + #define MAC80211_SUPPORTED_FEATURES_TX (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \ +diff --git a/net/mac80211/link.c b/net/mac80211/link.c +index d1f5a9f7..8c8869cc 100644 +--- a/net/mac80211/link.c ++++ b/net/mac80211/link.c +@@ -39,6 +39,8 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata, + ieee80211_csa_finalize_work); + INIT_WORK(&link->color_change_finalize_work, + ieee80211_color_change_finalize_work); ++ INIT_DELAYED_WORK(&link->color_collision_detect_work, ++ ieee80211_color_collision_detection_work); + INIT_LIST_HEAD(&link->assigned_chanctx_list); + INIT_LIST_HEAD(&link->reserved_chanctx_list); + INIT_DELAYED_WORK(&link->dfs_cac_timer_work, +@@ -66,6 +68,7 @@ void ieee80211_link_stop(struct ieee80211_link_data *link) + if (link->sdata->vif.type == NL80211_IFTYPE_STATION) + ieee80211_mgd_stop_link(link); + ++ cancel_delayed_work_sync(&link->color_collision_detect_work); + ieee80211_link_release_channel(link); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-297-wifi-mac80211-make-rate-u32-in-sta_set_rate_inf.patch b/patches.kernel.org/6.2.3-297-wifi-mac80211-make-rate-u32-in-sta_set_rate_inf.patch new file mode 100644 index 0000000..0b86575 --- /dev/null +++ b/patches.kernel.org/6.2.3-297-wifi-mac80211-make-rate-u32-in-sta_set_rate_inf.patch @@ -0,0 +1,39 @@ +From: Shayne Chen +Date: Thu, 9 Feb 2023 19:06:59 +0800 +Subject: [PATCH] wifi: mac80211: make rate u32 in sta_set_rate_info_rx() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 59336e07b287d91dc4ec265e07724e8f7e3d0209 + +[ Upstream commit 59336e07b287d91dc4ec265e07724e8f7e3d0209 ] + +The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to +u16 after being assigned to rate variable, which causes information loss +in STA_STATS_FIELD_TYPE and later bitfields. + +Signed-off-by: Shayne Chen +Link: https://lore.kernel.org/r/20230209110659.25447-1-shayne.chen@mediatek.com +Fixes: 41cbb0f5a295 ("mac80211: add support for HE") +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/sta_info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 04e0f132..34cb833d 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2411,7 +2411,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate, + + static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo) + { +- u16 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate); ++ u32 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate); + + if (rate == STA_STATS_RATE_INVALID) + return -EINVAL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-298-wifi-mac80211-fix-non-MLO-station-association.patch b/patches.kernel.org/6.2.3-298-wifi-mac80211-fix-non-MLO-station-association.patch new file mode 100644 index 0000000..a63b5ab --- /dev/null +++ b/patches.kernel.org/6.2.3-298-wifi-mac80211-fix-non-MLO-station-association.patch @@ -0,0 +1,49 @@ +From: Karthikeyan Periyasamy +Date: Mon, 6 Feb 2023 21:33:30 +0530 +Subject: [PATCH] wifi: mac80211: fix non-MLO station association +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aaacf1740f2f95e0c5449ff3bbcff252d69cf952 + +[ Upstream commit aaacf1740f2f95e0c5449ff3bbcff252d69cf952 ] + +Non-MLO station frames are dropped in Rx path due to the condition +check in ieee80211_rx_is_valid_sta_link_id(). In multi-link AP scenario, +non-MLO stations try to connect in any of the valid links in the ML AP, +where the station valid_links and link_id params are valid in the +ieee80211_sta object. But ieee80211_rx_is_valid_sta_link_id() always +return false for the non-MLO stations by the assumption taken is +valid_links and link_id are not valid in non-MLO stations object +(ieee80211_sta), this assumption is wrong. Due to this assumption, +non-MLO station frames are dropped which leads to failure in association. + +Fix it by removing the condition check and allow the link validation +check for the non-MLO stations. + +Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") +Signed-off-by: Karthikeyan Periyasamy +Link: https://lore.kernel.org/r/20230206160330.1613-1-quic_periyasa@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/rx.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index c6562a6d..3c4541ee 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -4052,9 +4052,6 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) + static bool + ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id) + { +- if (!sta->mlo) +- return false; +- + return !!(sta->valid_links & BIT(link_id)); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-299-wifi-mac80211-Don-t-translate-MLD-addresses-for.patch b/patches.kernel.org/6.2.3-299-wifi-mac80211-Don-t-translate-MLD-addresses-for.patch new file mode 100644 index 0000000..88b485e --- /dev/null +++ b/patches.kernel.org/6.2.3-299-wifi-mac80211-Don-t-translate-MLD-addresses-for.patch @@ -0,0 +1,40 @@ +From: Andrei Otcheretianski +Date: Tue, 14 Feb 2023 12:10:48 +0200 +Subject: [PATCH] wifi: mac80211: Don't translate MLD addresses for multicast +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: daf8fb4295dccc032515cdc1bd3873370063542b + +[ Upstream commit daf8fb4295dccc032515cdc1bd3873370063542b ] + +MLD address translation should be done only for individually addressed +frames. Otherwise, AAD calculation would be wrong and the decryption +would fail. + +Fixes: e66b7920aa5ac ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") +Signed-off-by: Andrei Otcheretianski +Link: https://lore.kernel.org/r/20230214101048.792414-1-andrei.otcheretianski@intel.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/rx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 3c4541ee..870b8d04 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -4840,7 +4840,8 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, + hdr = (struct ieee80211_hdr *)rx->skb->data; + } + +- if (unlikely(rx->sta && rx->sta->sta.mlo)) { ++ if (unlikely(rx->sta && rx->sta->sta.mlo) && ++ is_unicast_ether_addr(hdr->addr1)) { + /* translate to MLD addresses */ + if (ether_addr_equal(link->conf->addr, hdr->addr1)) + ether_addr_copy(hdr->addr1, rx->sdata->vif.addr); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-300-wifi-mac80211-avoid-u32_encode_bits-warning.patch b/patches.kernel.org/6.2.3-300-wifi-mac80211-avoid-u32_encode_bits-warning.patch new file mode 100644 index 0000000..a99671f --- /dev/null +++ b/patches.kernel.org/6.2.3-300-wifi-mac80211-avoid-u32_encode_bits-warning.patch @@ -0,0 +1,64 @@ +From: Arnd Bergmann +Date: Tue, 14 Feb 2023 14:20:21 +0100 +Subject: [PATCH] wifi: mac80211: avoid u32_encode_bits() warning +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1d8d4af4347420d657be448f8be4c39c558f3b5d + +[ Upstream commit 1d8d4af4347420d657be448f8be4c39c558f3b5d ] + +gcc-9 triggers a false-postive warning in ieee80211_mlo_multicast_tx() +for u32_encode_bits(ffs(links) - 1, ...), since ffs() can return zero +on an empty bitmask, and the negative argument to u32_encode_bits() +is then out of range: + +In file included from include/linux/ieee80211.h:21, + from include/net/cfg80211.h:23, + from net/mac80211/tx.c:23: +In function 'u32_encode_bits', + inlined from 'ieee80211_mlo_multicast_tx' at net/mac80211/tx.c:4437:17, + inlined from 'ieee80211_subif_start_xmit' at net/mac80211/tx.c:4485:3: +include/linux/bitfield.h:177:3: error: call to '__field_overflow' declared with attribute error: value doesn't fit into mask + 177 | __field_overflow(); \ + | ^~~~~~~~~~~~~~~~~~ +include/linux/bitfield.h:197:2: note: in expansion of macro '____MAKE_OP' + 197 | ____MAKE_OP(u##size,u##size,,) + | ^~~~~~~~~~~ +include/linux/bitfield.h:200:1: note: in expansion of macro '__MAKE_OP' + 200 | __MAKE_OP(32) + | ^~~~~~~~~ + +Newer compiler versions do not cause problems with the zero argument +because they do not consider this a __builtin_constant_p(). +It's also harmless since the hweight16() check already guarantees +that this cannot be 0. + +Replace the ffs() with an equivalent find_first_bit() check that +matches the later for_each_set_bit() style and avoids the warning. + +Fixes: 963d0e8d08d9 ("wifi: mac80211: optionally implement MLO multicast TX") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230214132025.1532147-1-arnd@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index defe97a3..118648af 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -4434,7 +4434,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device *dev, + u32 ctrl_flags = IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX; + + if (hweight16(links) == 1) { +- ctrl_flags |= u32_encode_bits(ffs(links) - 1, ++ ctrl_flags |= u32_encode_bits(find_first_bit(&links, 16) - 1, + IEEE80211_TX_CTRL_MLO_LINK); + + __ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-301-wifi-mac80211-fix-off-by-one-link-setting.patch b/patches.kernel.org/6.2.3-301-wifi-mac80211-fix-off-by-one-link-setting.patch new file mode 100644 index 0000000..2d77459 --- /dev/null +++ b/patches.kernel.org/6.2.3-301-wifi-mac80211-fix-off-by-one-link-setting.patch @@ -0,0 +1,39 @@ +From: Johannes Berg +Date: Tue, 14 Feb 2023 20:08:15 +0100 +Subject: [PATCH] wifi: mac80211: fix off-by-one link setting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cf08e29db760b144bde51e2444f3430c75763e26 + +[ Upstream commit cf08e29db760b144bde51e2444f3430c75763e26 ] + +The convention for find_first_bit() is 0-based, while ffs() +is 1-based, so this is now off-by-one. I cannot reproduce the +gcc-9 problem, but since the -1 is now removed, I'm hoping it +will still avoid the original issue. + +Reported-by: Alexander Lobakin +Fixes: 1d8d4af43474 ("wifi: mac80211: avoid u32_encode_bits() warning") +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 118648af..7699fb41 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -4434,7 +4434,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device *dev, + u32 ctrl_flags = IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX; + + if (hweight16(links) == 1) { +- ctrl_flags |= u32_encode_bits(find_first_bit(&links, 16) - 1, ++ ctrl_flags |= u32_encode_bits(__ffs(links), + IEEE80211_TX_CTRL_MLO_LINK); + + __ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-302-tools-lib-thermal-Fix-thermal_sampling_exit.patch b/patches.kernel.org/6.2.3-302-tools-lib-thermal-Fix-thermal_sampling_exit.patch new file mode 100644 index 0000000..0868bbf --- /dev/null +++ b/patches.kernel.org/6.2.3-302-tools-lib-thermal-Fix-thermal_sampling_exit.patch @@ -0,0 +1,39 @@ +From: Vincent Guittot +Date: Thu, 2 Feb 2023 11:28:12 +0100 +Subject: [PATCH] tools/lib/thermal: Fix thermal_sampling_exit() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a29cbd76aaf63f5493e962aa2fbaadcdc4615143 + +[ Upstream commit a29cbd76aaf63f5493e962aa2fbaadcdc4615143 ] + +thermal_sampling_init() suscribes to THERMAL_GENL_SAMPLING_GROUP_NAME group +so thermal_sampling_exit() should unsubscribe from the same group. + +Fixes: 47c4b0de080a ("tools/lib/thermal: Add a thermal library") +Signed-off-by: Vincent Guittot +Link: https://lore.kernel.org/r/20230202102812.453357-1-vincent.guittot@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/lib/thermal/sampling.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/thermal/sampling.c b/tools/lib/thermal/sampling.c +index ee818f4e..70577423 100644 +--- a/tools/lib/thermal/sampling.c ++++ b/tools/lib/thermal/sampling.c +@@ -54,7 +54,7 @@ int thermal_sampling_fd(struct thermal_handler *th) + thermal_error_t thermal_sampling_exit(struct thermal_handler *th) + { + if (nl_unsubscribe_thermal(th->sk_sampling, th->cb_sampling, +- THERMAL_GENL_EVENT_GROUP_NAME)) ++ THERMAL_GENL_SAMPLING_GROUP_NAME)) + return THERMAL_ERROR; + + nl_thermal_disconnect(th->sk_sampling, th->cb_sampling); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-303-thermal-drivers-hisi-Drop-second-sensor-hi3660.patch b/patches.kernel.org/6.2.3-303-thermal-drivers-hisi-Drop-second-sensor-hi3660.patch new file mode 100644 index 0000000..f4595d2 --- /dev/null +++ b/patches.kernel.org/6.2.3-303-thermal-drivers-hisi-Drop-second-sensor-hi3660.patch @@ -0,0 +1,47 @@ +From: Yongqin Liu +Date: Fri, 10 Feb 2023 22:15:07 +0800 +Subject: [PATCH] thermal/drivers/hisi: Drop second sensor hi3660 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 15cc25829a97c3957e520e971868aacc84341317 + +[ Upstream commit 15cc25829a97c3957e520e971868aacc84341317 ] + +The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm +allocators") exposes a panic "BRK handler: Fatal exception" on the +hi3660_thermal_probe funciton. +This is because the function allocates memory for only one +sensors array entry, but tries to fill up a second one. + +Fix this by removing the unneeded second access. + +Fixes: 7d3a2a2bbadb ("thermal/drivers/hisi: Fix number of sensors on hi3660") +Signed-off-by: Yongqin Liu +Link: https://lore.kernel.org/linux-mm/20221101223321.1326815-5-keescook@chromium.org/ +Link: https://lore.kernel.org/r/20230210141507.71014-1-yongqin.liu@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/thermal/hisi_thermal.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c +index d6974db7..15af90f5 100644 +--- a/drivers/thermal/hisi_thermal.c ++++ b/drivers/thermal/hisi_thermal.c +@@ -427,10 +427,6 @@ static int hi3660_thermal_probe(struct hisi_thermal_data *data) + data->sensor[0].irq_name = "tsensor_a73"; + data->sensor[0].data = data; + +- data->sensor[1].id = HI3660_LITTLE_SENSOR; +- data->sensor[1].irq_name = "tsensor_a53"; +- data->sensor[1].data = data; +- + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-304-selftests-bpf-Fix-map_kptr-test.patch b/patches.kernel.org/6.2.3-304-selftests-bpf-Fix-map_kptr-test.patch new file mode 100644 index 0000000..aaaf8be --- /dev/null +++ b/patches.kernel.org/6.2.3-304-selftests-bpf-Fix-map_kptr-test.patch @@ -0,0 +1,79 @@ +From: Alexei Starovoitov +Date: Tue, 14 Feb 2023 15:50:51 -0800 +Subject: [PATCH] selftests/bpf: Fix map_kptr test. +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 62d101d5f422cde39b269f7eb4cbbe2f1e26f9d4 + +[ Upstream commit 62d101d5f422cde39b269f7eb4cbbe2f1e26f9d4 ] + +The compiler is optimizing out majority of unref_ptr read/writes, so the test +wasn't testing much. For example, one could delete '__kptr' tag from +'struct prog_test_ref_kfunc __kptr *unref_ptr;' and the test would still "pass". + +Convert it to volatile stores. Confirmed by comparing bpf asm before/after. + +Fixes: 2cbc469a6fc3 ("selftests/bpf: Add C tests for kptr") +Signed-off-by: Alexei Starovoitov +Acked-by: Stanislav Fomichev +Acked-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/r/20230214235051.22938-1-alexei.starovoitov@gmail.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/progs/map_kptr.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/map_kptr.c b/tools/testing/selftests/bpf/progs/map_kptr.c +index eb821780..228ec453 100644 +--- a/tools/testing/selftests/bpf/progs/map_kptr.c ++++ b/tools/testing/selftests/bpf/progs/map_kptr.c +@@ -62,21 +62,23 @@ extern struct prog_test_ref_kfunc * + bpf_kfunc_call_test_kptr_get(struct prog_test_ref_kfunc **p, int a, int b) __ksym; + extern void bpf_kfunc_call_test_release(struct prog_test_ref_kfunc *p) __ksym; + ++#define WRITE_ONCE(x, val) ((*(volatile typeof(x) *) &(x)) = (val)) ++ + static void test_kptr_unref(struct map_value *v) + { + struct prog_test_ref_kfunc *p; + + p = v->unref_ptr; + /* store untrusted_ptr_or_null_ */ +- v->unref_ptr = p; ++ WRITE_ONCE(v->unref_ptr, p); + if (!p) + return; + if (p->a + p->b > 100) + return; + /* store untrusted_ptr_ */ +- v->unref_ptr = p; ++ WRITE_ONCE(v->unref_ptr, p); + /* store NULL */ +- v->unref_ptr = NULL; ++ WRITE_ONCE(v->unref_ptr, NULL); + } + + static void test_kptr_ref(struct map_value *v) +@@ -85,7 +87,7 @@ static void test_kptr_ref(struct map_value *v) + + p = v->ref_ptr; + /* store ptr_or_null_ */ +- v->unref_ptr = p; ++ WRITE_ONCE(v->unref_ptr, p); + if (!p) + return; + if (p->a + p->b > 100) +@@ -99,7 +101,7 @@ static void test_kptr_ref(struct map_value *v) + return; + } + /* store ptr_ */ +- v->unref_ptr = p; ++ WRITE_ONCE(v->unref_ptr, p); + bpf_kfunc_call_test_release(p); + + p = bpf_kfunc_call_test_acquire(&(unsigned long){0}); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-305-wifi-mac80211-pass-sta-to-ieee80211_rx_data_set.patch b/patches.kernel.org/6.2.3-305-wifi-mac80211-pass-sta-to-ieee80211_rx_data_set.patch new file mode 100644 index 0000000..914a51d --- /dev/null +++ b/patches.kernel.org/6.2.3-305-wifi-mac80211-pass-sta-to-ieee80211_rx_data_set.patch @@ -0,0 +1,122 @@ +From: Johannes Berg +Date: Wed, 15 Feb 2023 10:07:05 +0100 +Subject: [PATCH] wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0d846bdc11101ac0ba4d89c2be359af08cb9379b + +[ Upstream commit 0d846bdc11101ac0ba4d89c2be359af08cb9379b ] + +There's at least one case in ieee80211_rx_for_interface() +where we might pass &((struct sta_info *)NULL)->sta to it +only to then do container_of(), and then checking the +result for NULL, but checking the result of container_of() +for NULL looks really odd. + +Fix this by just passing the struct sta_info * instead. + +Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/mac80211/rx.c | 26 +++++++++++--------------- + 1 file changed, 11 insertions(+), 15 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 870b8d04..1ed345d0 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -4073,13 +4073,8 @@ static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx, + } + + static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx, +- struct ieee80211_sta *pubsta, +- int link_id) ++ struct sta_info *sta, int link_id) + { +- struct sta_info *sta; +- +- sta = container_of(pubsta, struct sta_info, sta); +- + rx->link_id = link_id; + rx->sta = sta; + +@@ -4117,7 +4112,7 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) + if (sta->sta.valid_links) + link_id = ffs(sta->sta.valid_links) - 1; + +- if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id)) ++ if (!ieee80211_rx_data_set_sta(&rx, sta, link_id)) + return; + + tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); +@@ -4163,7 +4158,7 @@ void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid, + + sta = container_of(pubsta, struct sta_info, sta); + +- if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1)) ++ if (!ieee80211_rx_data_set_sta(&rx, sta, -1)) + return; + + rcu_read_lock(); +@@ -4871,6 +4866,7 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw, + struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); + struct ieee80211_fast_rx *fast_rx; + struct ieee80211_rx_data rx; ++ struct sta_info *sta; + int link_id = -1; + + memset(&rx, 0, sizeof(rx)); +@@ -4898,7 +4894,8 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw, + * link_id is used only for stats purpose and updating the stats on + * the deflink is fine? + */ +- if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id)) ++ sta = container_of(pubsta, struct sta_info, sta); ++ if (!ieee80211_rx_data_set_sta(&rx, sta, link_id)) + goto drop; + + fast_rx = rcu_dereference(rx.sta->fast_rx); +@@ -4938,7 +4935,7 @@ static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx, + link_id = status->link_id; + } + +- if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id)) ++ if (!ieee80211_rx_data_set_sta(rx, sta, link_id)) + return false; + + return ieee80211_prepare_and_rx_handle(rx, skb, consume); +@@ -5005,7 +5002,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + link_id = status->link_id; + + if (pubsta) { +- if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id)) ++ sta = container_of(pubsta, struct sta_info, sta); ++ if (!ieee80211_rx_data_set_sta(&rx, sta, link_id)) + goto out; + + /* +@@ -5042,8 +5040,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + } + + rx.sdata = prev_sta->sdata; +- if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta, +- link_id)) ++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + + if (!status->link_valid && prev_sta->sta.mlo) +@@ -5056,8 +5053,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, + + if (prev_sta) { + rx.sdata = prev_sta->sdata; +- if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta, +- link_id)) ++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) + goto out; + + if (!status->link_valid && prev_sta->sta.mlo) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-306-bpf-Zeroing-allocated-object-from-slab-in-bpf-m.patch b/patches.kernel.org/6.2.3-306-bpf-Zeroing-allocated-object-from-slab-in-bpf-m.patch new file mode 100644 index 0000000..c3a1c6d --- /dev/null +++ b/patches.kernel.org/6.2.3-306-bpf-Zeroing-allocated-object-from-slab-in-bpf-m.patch @@ -0,0 +1,114 @@ +From: Hou Tao +Date: Wed, 15 Feb 2023 16:21:31 +0800 +Subject: [PATCH] bpf: Zeroing allocated object from slab in bpf memory + allocator +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 997849c4b969034e225153f41026657def66d286 + +[ Upstream commit 997849c4b969034e225153f41026657def66d286 ] + +Currently the freed element in bpf memory allocator may be immediately +reused, for htab map the reuse will reinitialize special fields in map +value (e.g., bpf_spin_lock), but lookup procedure may still access +these special fields, and it may lead to hard-lockup as shown below: + + NMI backtrace for cpu 16 + CPU: 16 PID: 2574 Comm: htab.bin Tainted: G L 6.1.0+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), + RIP: 0010:queued_spin_lock_slowpath+0x283/0x2c0 + ...... + Call Trace: + + copy_map_value_locked+0xb7/0x170 + bpf_map_copy_value+0x113/0x3c0 + __sys_bpf+0x1c67/0x2780 + __x64_sys_bpf+0x1c/0x20 + do_syscall_64+0x30/0x60 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + ...... + + +For htab map, just like the preallocated case, these is no need to +initialize these special fields in map value again once these fields +have been initialized. For preallocated htab map, these fields are +initialized through __GFP_ZERO in bpf_map_area_alloc(), so do the +similar thing for non-preallocated htab in bpf memory allocator. And +there is no need to use __GFP_ZERO for per-cpu bpf memory allocator, +because __alloc_percpu_gfp() does it implicitly. + +Fixes: 0fd7c5d43339 ("bpf: Optimize call_rcu in non-preallocated hash map.") +Signed-off-by: Hou Tao +Link: https://lore.kernel.org/r/20230215082132.3856544-2-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/bpf.h | 7 +++++++ + kernel/bpf/hashtab.c | 4 ++-- + kernel/bpf/memalloc.c | 2 +- + 3 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 634d37a5..cf0d8810 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -346,6 +346,13 @@ static inline void bpf_obj_init(const struct btf_field_offs *foffs, void *obj) + memset(obj + foffs->field_off[i], 0, foffs->field_sz[i]); + } + ++/* 'dst' must be a temporary buffer and should not point to memory that is being ++ * used in parallel by a bpf program or bpf syscall, otherwise the access from ++ * the bpf program or bpf syscall may be corrupted by the reinitialization, ++ * leading to weird problems. Even 'dst' is newly-allocated from bpf memory ++ * allocator, it is still possible for 'dst' to be used in parallel by a bpf ++ * program or bpf syscall. ++ */ + static inline void check_and_init_map_value(struct bpf_map *map, void *dst) + { + bpf_obj_init(map->field_offs, dst); +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index 66bded14..5dfcb5ad 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -1004,8 +1004,6 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, + l_new = ERR_PTR(-ENOMEM); + goto dec_count; + } +- check_and_init_map_value(&htab->map, +- l_new->key + round_up(key_size, 8)); + } + + memcpy(l_new->key, key, key_size); +@@ -1592,6 +1590,7 @@ static int __htab_map_lookup_and_delete_elem(struct bpf_map *map, void *key, + else + copy_map_value(map, value, l->key + + roundup_key_size); ++ /* Zeroing special fields in the temp buffer */ + check_and_init_map_value(map, value); + } + +@@ -1792,6 +1791,7 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map, + true); + else + copy_map_value(map, dst_val, value); ++ /* Zeroing special fields in the temp buffer */ + check_and_init_map_value(map, dst_val); + } + if (do_delete) { +diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c +index 1db15640..7b784823 100644 +--- a/kernel/bpf/memalloc.c ++++ b/kernel/bpf/memalloc.c +@@ -143,7 +143,7 @@ static void *__alloc(struct bpf_mem_cache *c, int node) + return obj; + } + +- return kmalloc_node(c->unit_size, flags, node); ++ return kmalloc_node(c->unit_size, flags | __GFP_ZERO, node); + } + + static struct mem_cgroup *get_memcg(const struct bpf_mem_cache *c) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-307-selftests-bpf-Fix-xdp_do_redirect-on-s390x.patch b/patches.kernel.org/6.2.3-307-selftests-bpf-Fix-xdp_do_redirect-on-s390x.patch new file mode 100644 index 0000000..8a81f8c --- /dev/null +++ b/patches.kernel.org/6.2.3-307-selftests-bpf-Fix-xdp_do_redirect-on-s390x.patch @@ -0,0 +1,42 @@ +From: Ilya Leoshkevich +Date: Sat, 28 Jan 2023 01:06:29 +0100 +Subject: [PATCH] selftests/bpf: Fix xdp_do_redirect on s390x +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 06c1865b0b0c7820ea53af2394dd7aff31100295 + +[ Upstream commit 06c1865b0b0c7820ea53af2394dd7aff31100295 ] + +s390x cache line size is 256 bytes, so skb_shared_info must be aligned +on a much larger boundary than for x86. This makes the maximum packet +size smaller. + +Signed-off-by: Ilya Leoshkevich +Link: https://lore.kernel.org/r/20230128000650.1516334-11-iii@linux.ibm.com +Signed-off-by: Alexei Starovoitov +Stable-dep-of: 6c20822fada1 ("bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c +index a50971c6..ac70e871 100644 +--- a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c ++++ b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c +@@ -65,7 +65,11 @@ static int attach_tc_prog(struct bpf_tc_hook *hook, int fd) + /* The maximum permissible size is: PAGE_SIZE - sizeof(struct xdp_page_head) - + * sizeof(struct skb_shared_info) - XDP_PACKET_HEADROOM = 3368 bytes + */ ++#if defined(__s390x__) ++#define MAX_PKT_SIZE 3176 ++#else + #define MAX_PKT_SIZE 3368 ++#endif + static void test_max_pkt_size(int fd) + { + char data[MAX_PKT_SIZE + 1] = {}; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-308-can-esd_usb-Move-mislocated-storage-of-SJA1000_.patch b/patches.kernel.org/6.2.3-308-can-esd_usb-Move-mislocated-storage-of-SJA1000_.patch new file mode 100644 index 0000000..49ad538 --- /dev/null +++ b/patches.kernel.org/6.2.3-308-can-esd_usb-Move-mislocated-storage-of-SJA1000_.patch @@ -0,0 +1,50 @@ +From: Frank Jungclaus +Date: Thu, 16 Feb 2023 20:04:48 +0100 +Subject: [PATCH] can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits + in case of a bus error +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 118469f88180438ef43dee93d71f77c00e7b425d + +[ Upstream commit 118469f88180438ef43dee93d71f77c00e7b425d ] + +Move the supply for cf->data[3] (bit stream position of CAN error), in +case of a bus- or protocol-error, outside of the "switch (ecc & +SJA1000_ECC_MASK){}"-statement, because this bit stream position is +independent of the error type. + +Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") +Signed-off-by: Frank Jungclaus +Link: https://lore.kernel.org/all/20230216190450.3901254-2-frank.jungclaus@esd.eu +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/can/usb/esd_usb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c +index 42323f5e..5e182fad 100644 +--- a/drivers/net/can/usb/esd_usb.c ++++ b/drivers/net/can/usb/esd_usb.c +@@ -286,7 +286,6 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv, + cf->data[2] |= CAN_ERR_PROT_STUFF; + break; + default: +- cf->data[3] = ecc & SJA1000_ECC_SEG; + break; + } + +@@ -294,6 +293,9 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv, + if (!(ecc & SJA1000_ECC_DIR)) + cf->data[2] |= CAN_ERR_PROT_TX; + ++ /* Bit stream position in CAN frame as the error was detected */ ++ cf->data[3] = ecc & SJA1000_ECC_SEG; ++ + if (priv->can.state == CAN_STATE_ERROR_WARNING || + priv->can.state == CAN_STATE_ERROR_PASSIVE) { + cf->data[1] = (txerr > rxerr) ? +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-309-can-esd_usb-Make-use-of-can_change_state-and-re.patch b/patches.kernel.org/6.2.3-309-can-esd_usb-Make-use-of-can_change_state-and-re.patch new file mode 100644 index 0000000..8a04da6 --- /dev/null +++ b/patches.kernel.org/6.2.3-309-can-esd_usb-Make-use-of-can_change_state-and-re.patch @@ -0,0 +1,132 @@ +From: Frank Jungclaus +Date: Thu, 16 Feb 2023 20:04:49 +0100 +Subject: [PATCH] can: esd_usb: Make use of can_change_state() and relocate + checking skb for NULL +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9684b000a86299b5968fef8ffbf1484def37452a + +[ Upstream commit 9684b000a86299b5968fef8ffbf1484def37452a ] + +Start a rework initiated by Vincents remarks "You should not report +the greatest of txerr and rxerr but the one which actually increased." +[1] and "As far as I understand, those flags should be set only when +the threshold is reached" [2] . + +Therefore make use of can_change_state() to (among others) set the +flags CAN_ERR_CRTL_[RT]X_WARNING and CAN_ERR_CRTL_[RT]X_PASSIVE, +maintain CAN statistic counters for error_warning, error_passive and +bus_off. + +Relocate testing alloc_can_err_skb() for NULL to the end of +esd_usb_rx_event(), to have things like can_bus_off(), +can_change_state() working even in out of memory conditions. + +Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") +Signed-off-by: Frank Jungclaus +Link: [1] https://lore.kernel.org/all/CAMZ6RqKGBWe15aMkf8-QLf-cOQg99GQBebSm+1wEzTqHgvmNuw@mail.gmail.com/ +Link: [2] https://lore.kernel.org/all/CAMZ6Rq+QBO1yTX_o6GV0yhdBj-RzZSRGWDZBS0fs7zbSTy4hmA@mail.gmail.com/ +Link: https://lore.kernel.org/all/20230216190450.3901254-3-frank.jungclaus@esd.eu +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/can/usb/esd_usb.c | 50 +++++++++++++++++------------------ + 1 file changed, 25 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c +index 5e182fad..578b25f8 100644 +--- a/drivers/net/can/usb/esd_usb.c ++++ b/drivers/net/can/usb/esd_usb.c +@@ -239,41 +239,42 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv, + msg->msg.rx.dlc, state, ecc, rxerr, txerr); + + skb = alloc_can_err_skb(priv->netdev, &cf); +- if (skb == NULL) { +- stats->rx_dropped++; +- return; +- } + + if (state != priv->old_state) { ++ enum can_state tx_state, rx_state; ++ enum can_state new_state = CAN_STATE_ERROR_ACTIVE; ++ + priv->old_state = state; + + switch (state & ESD_BUSSTATE_MASK) { + case ESD_BUSSTATE_BUSOFF: +- priv->can.state = CAN_STATE_BUS_OFF; +- cf->can_id |= CAN_ERR_BUSOFF; +- priv->can.can_stats.bus_off++; ++ new_state = CAN_STATE_BUS_OFF; + can_bus_off(priv->netdev); + break; + case ESD_BUSSTATE_WARN: +- priv->can.state = CAN_STATE_ERROR_WARNING; +- priv->can.can_stats.error_warning++; ++ new_state = CAN_STATE_ERROR_WARNING; + break; + case ESD_BUSSTATE_ERRPASSIVE: +- priv->can.state = CAN_STATE_ERROR_PASSIVE; +- priv->can.can_stats.error_passive++; ++ new_state = CAN_STATE_ERROR_PASSIVE; + break; + default: +- priv->can.state = CAN_STATE_ERROR_ACTIVE; ++ new_state = CAN_STATE_ERROR_ACTIVE; + txerr = 0; + rxerr = 0; + break; + } +- } else { ++ ++ if (new_state != priv->can.state) { ++ tx_state = (txerr >= rxerr) ? new_state : 0; ++ rx_state = (txerr <= rxerr) ? new_state : 0; ++ can_change_state(priv->netdev, cf, ++ tx_state, rx_state); ++ } ++ } else if (skb) { + priv->can.can_stats.bus_error++; + stats->rx_errors++; + +- cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR | +- CAN_ERR_CNT; ++ cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR; + + switch (ecc & SJA1000_ECC_MASK) { + case SJA1000_ECC_BIT: +@@ -295,21 +296,20 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv, + + /* Bit stream position in CAN frame as the error was detected */ + cf->data[3] = ecc & SJA1000_ECC_SEG; +- +- if (priv->can.state == CAN_STATE_ERROR_WARNING || +- priv->can.state == CAN_STATE_ERROR_PASSIVE) { +- cf->data[1] = (txerr > rxerr) ? +- CAN_ERR_CRTL_TX_PASSIVE : +- CAN_ERR_CRTL_RX_PASSIVE; +- } +- cf->data[6] = txerr; +- cf->data[7] = rxerr; + } + + priv->bec.txerr = txerr; + priv->bec.rxerr = rxerr; + +- netif_rx(skb); ++ if (skb) { ++ cf->can_id |= CAN_ERR_CNT; ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ ++ netif_rx(skb); ++ } else { ++ stats->rx_dropped++; ++ } + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-310-xsk-check-IFF_UP-earlier-in-Tx-path.patch b/patches.kernel.org/6.2.3-310-xsk-check-IFF_UP-earlier-in-Tx-path.patch new file mode 100644 index 0000000..26bd4be --- /dev/null +++ b/patches.kernel.org/6.2.3-310-xsk-check-IFF_UP-earlier-in-Tx-path.patch @@ -0,0 +1,221 @@ +From: Maciej Fijalkowski +Date: Wed, 15 Feb 2023 15:33:09 +0100 +Subject: [PATCH] xsk: check IFF_UP earlier in Tx path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1596dae2f17ec5c6e8c8f0e3fec78c5ae55c1e0b + +[ Upstream commit 1596dae2f17ec5c6e8c8f0e3fec78c5ae55c1e0b ] + +Xsk Tx can be triggered via either sendmsg() or poll() syscalls. These +two paths share a call to common function xsk_xmit() which has two +sanity checks within. A pseudo code example to show the two paths: + +__xsk_sendmsg() : xsk_poll(): +if (unlikely(!xsk_is_bound(xs))) if (unlikely(!xsk_is_bound(xs))) + return -ENXIO; return mask; +if (unlikely(need_wait)) (...) + return -EOPNOTSUPP; xsk_xmit() +mark napi id +(...) +xsk_xmit() + +xsk_xmit(): +if (unlikely(!(xs->dev->flags & IFF_UP))) + return -ENETDOWN; +if (unlikely(!xs->tx)) + return -ENOBUFS; + +As it can be observed above, in sendmsg() napi id can be marked on +interface that was not brought up and this causes a NULL ptr +dereference: + +[31757.505631] BUG: kernel NULL pointer dereference, address: 0000000000000018 +[31757.512710] #PF: supervisor read access in kernel mode +[31757.517936] #PF: error_code(0x0000) - not-present page +[31757.523149] PGD 0 P4D 0 +[31757.525726] Oops: 0000 [#1] PREEMPT SMP NOPTI +[31757.530154] CPU: 26 PID: 95641 Comm: xdpsock Not tainted 6.2.0-rc5+ #40 +[31757.536871] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 +[31757.547457] RIP: 0010:xsk_sendmsg+0xde/0x180 +[31757.551799] Code: 00 75 a2 48 8b 00 a8 04 75 9b 84 d2 74 69 8b 85 14 01 00 00 85 c0 75 1b 48 8b 85 28 03 00 00 48 8b 80 98 00 00 00 48 8b 40 20 <8b> 40 18 89 85 14 01 00 00 8b bd 14 01 00 00 81 ff 00 01 00 00 0f +[31757.570840] RSP: 0018:ffffc90034f27dc0 EFLAGS: 00010246 +[31757.576143] RAX: 0000000000000000 RBX: ffffc90034f27e18 RCX: 0000000000000000 +[31757.583389] RDX: 0000000000000001 RSI: ffffc90034f27e18 RDI: ffff88984cf3c100 +[31757.590631] RBP: ffff88984714a800 R08: ffff88984714a800 R09: 0000000000000000 +[31757.597877] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000fffffffa +[31757.605123] R13: 0000000000000000 R14: 0000000000000003 R15: 0000000000000000 +[31757.612364] FS: 00007fb4c5931180(0000) GS:ffff88afdfa00000(0000) knlGS:0000000000000000 +[31757.620571] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[31757.626406] CR2: 0000000000000018 CR3: 000000184b41c003 CR4: 00000000007706e0 +[31757.633648] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[31757.640894] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[31757.648139] PKRU: 55555554 +[31757.650894] Call Trace: +[31757.653385] +[31757.655524] sock_sendmsg+0x8f/0xa0 +[31757.659077] ? sockfd_lookup_light+0x12/0x70 +[31757.663416] __sys_sendto+0xfc/0x170 +[31757.667051] ? do_sched_setscheduler+0xdb/0x1b0 +[31757.671658] __x64_sys_sendto+0x20/0x30 +[31757.675557] do_syscall_64+0x38/0x90 +[31757.679197] entry_SYSCALL_64_after_hwframe+0x72/0xdc +[31757.687969] Code: 8e f6 ff 44 8b 4c 24 2c 4c 8b 44 24 20 41 89 c4 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 3a 44 89 e7 48 89 44 24 08 e8 b5 8e f6 ff 48 +[31757.707007] RSP: 002b:00007ffd49c73c70 EFLAGS: 00000293 ORIG_RAX: 000000000000002c +[31757.714694] RAX: ffffffffffffffda RBX: 000055a996565380 RCX: 00007fb4c5727c16 +[31757.721939] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 +[31757.729184] RBP: 0000000000000040 R08: 0000000000000000 R09: 0000000000000000 +[31757.736429] R10: 0000000000000040 R11: 0000000000000293 R12: 0000000000000000 +[31757.743673] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +[31757.754940] + +To fix this, let's make xsk_xmit a function that will be responsible for +generic Tx, where RCU is handled accordingly and pull out sanity checks +and xs->zc handling. Populate sanity checks to __xsk_sendmsg() and +xsk_poll(). + +Fixes: ca2e1a627035 ("xsk: Mark napi_id on sendmsg()") +Fixes: 18b1ab7aa76b ("xsk: Fix race at socket teardown") +Signed-off-by: Maciej Fijalkowski +Reviewed-by: Alexander Lobakin +Link: https://lore.kernel.org/r/20230215143309.13145-1-maciej.fijalkowski@intel.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/xdp/xsk.c | 59 ++++++++++++++++++++++++++++----------------------- + 1 file changed, 33 insertions(+), 26 deletions(-) + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 9f0561b6..13f62d24 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -511,7 +511,7 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs, + return skb; + } + +-static int xsk_generic_xmit(struct sock *sk) ++static int __xsk_generic_xmit(struct sock *sk) + { + struct xdp_sock *xs = xdp_sk(sk); + u32 max_batch = TX_BATCH_SIZE; +@@ -594,22 +594,13 @@ static int xsk_generic_xmit(struct sock *sk) + return err; + } + +-static int xsk_xmit(struct sock *sk) ++static int xsk_generic_xmit(struct sock *sk) + { +- struct xdp_sock *xs = xdp_sk(sk); + int ret; + +- if (unlikely(!(xs->dev->flags & IFF_UP))) +- return -ENETDOWN; +- if (unlikely(!xs->tx)) +- return -ENOBUFS; +- +- if (xs->zc) +- return xsk_wakeup(xs, XDP_WAKEUP_TX); +- + /* Drop the RCU lock since the SKB path might sleep. */ + rcu_read_unlock(); +- ret = xsk_generic_xmit(sk); ++ ret = __xsk_generic_xmit(sk); + /* Reaquire RCU lock before going into common code. */ + rcu_read_lock(); + +@@ -627,17 +618,31 @@ static bool xsk_no_wakeup(struct sock *sk) + #endif + } + ++static int xsk_check_common(struct xdp_sock *xs) ++{ ++ if (unlikely(!xsk_is_bound(xs))) ++ return -ENXIO; ++ if (unlikely(!(xs->dev->flags & IFF_UP))) ++ return -ENETDOWN; ++ ++ return 0; ++} ++ + static int __xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) + { + bool need_wait = !(m->msg_flags & MSG_DONTWAIT); + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); + struct xsk_buff_pool *pool; ++ int err; + +- if (unlikely(!xsk_is_bound(xs))) +- return -ENXIO; ++ err = xsk_check_common(xs); ++ if (err) ++ return err; + if (unlikely(need_wait)) + return -EOPNOTSUPP; ++ if (unlikely(!xs->tx)) ++ return -ENOBUFS; + + if (sk_can_busy_loop(sk)) { + if (xs->zc) +@@ -649,8 +654,11 @@ static int __xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len + return 0; + + pool = xs->pool; +- if (pool->cached_need_wakeup & XDP_WAKEUP_TX) +- return xsk_xmit(sk); ++ if (pool->cached_need_wakeup & XDP_WAKEUP_TX) { ++ if (xs->zc) ++ return xsk_wakeup(xs, XDP_WAKEUP_TX); ++ return xsk_generic_xmit(sk); ++ } + return 0; + } + +@@ -670,11 +678,11 @@ static int __xsk_recvmsg(struct socket *sock, struct msghdr *m, size_t len, int + bool need_wait = !(flags & MSG_DONTWAIT); + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); ++ int err; + +- if (unlikely(!xsk_is_bound(xs))) +- return -ENXIO; +- if (unlikely(!(xs->dev->flags & IFF_UP))) +- return -ENETDOWN; ++ err = xsk_check_common(xs); ++ if (err) ++ return err; + if (unlikely(!xs->rx)) + return -ENOBUFS; + if (unlikely(need_wait)) +@@ -713,21 +721,20 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock, + sock_poll_wait(file, sock, wait); + + rcu_read_lock(); +- if (unlikely(!xsk_is_bound(xs))) { +- rcu_read_unlock(); +- return mask; +- } ++ if (xsk_check_common(xs)) ++ goto skip_tx; + + pool = xs->pool; + + if (pool->cached_need_wakeup) { + if (xs->zc) + xsk_wakeup(xs, pool->cached_need_wakeup); +- else ++ else if (xs->tx) + /* Poll needs to drive Tx also in copy mode */ +- xsk_xmit(sk); ++ xsk_generic_xmit(sk); + } + ++skip_tx: + if (xs->rx && !xskq_prod_is_empty(xs->rx)) + mask |= EPOLLIN | EPOLLRDNORM; + if (xs->tx && xsk_tx_writeable(xs)) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-311-LoongArch-bpf-Use-4-instructions-for-function-a.patch b/patches.kernel.org/6.2.3-311-LoongArch-bpf-Use-4-instructions-for-function-a.patch new file mode 100644 index 0000000..5a92695 --- /dev/null +++ b/patches.kernel.org/6.2.3-311-LoongArch-bpf-Use-4-instructions-for-function-a.patch @@ -0,0 +1,85 @@ +From: Hengqi Chen +Date: Tue, 14 Feb 2023 15:26:33 +0000 +Subject: [PATCH] LoongArch, bpf: Use 4 instructions for function address in + JIT +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 64f50f6575721ef03d001e907455cbe3baa2a5b1 + +[ Upstream commit 64f50f6575721ef03d001e907455cbe3baa2a5b1 ] + +This patch fixes the following issue of function calls in JIT, like: + + [ 29.346981] multi-func JIT bug 105 != 103 + +The issus can be reproduced by running the "inline simple bpf_loop call" +verifier test. + +This is because we are emiting 2-4 instructions for 64-bit immediate moves. +During the first pass of JIT, the placeholder address is zero, emiting two +instructions for it. In the extra pass, the function address is in XKVRANGE, +emiting four instructions for it. This change the instruction index in +JIT context. Let's always use 4 instructions for function address in JIT. +So that the instruction sequences don't change between the first pass and +the extra pass for function calls. + +Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") +Signed-off-by: Hengqi Chen +Signed-off-by: Daniel Borkmann +Tested-by: Tiezhu Yang +Link: https://lore.kernel.org/bpf/20230214152633.2265699-1-hengqi.chen@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/loongarch/net/bpf_jit.c | 2 +- + arch/loongarch/net/bpf_jit.h | 21 +++++++++++++++++++++ + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c +index c4b1947e..288003a9 100644 +--- a/arch/loongarch/net/bpf_jit.c ++++ b/arch/loongarch/net/bpf_jit.c +@@ -841,7 +841,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext + if (ret < 0) + return ret; + +- move_imm(ctx, t1, func_addr, is32); ++ move_addr(ctx, t1, func_addr); + emit_insn(ctx, jirl, t1, LOONGARCH_GPR_RA, 0); + move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); + break; +diff --git a/arch/loongarch/net/bpf_jit.h b/arch/loongarch/net/bpf_jit.h +index ca708024..c335dc4e 100644 +--- a/arch/loongarch/net/bpf_jit.h ++++ b/arch/loongarch/net/bpf_jit.h +@@ -82,6 +82,27 @@ static inline void emit_sext_32(struct jit_ctx *ctx, enum loongarch_gpr reg, boo + emit_insn(ctx, addiw, reg, reg, 0); + } + ++static inline void move_addr(struct jit_ctx *ctx, enum loongarch_gpr rd, u64 addr) ++{ ++ u64 imm_11_0, imm_31_12, imm_51_32, imm_63_52; ++ ++ /* lu12iw rd, imm_31_12 */ ++ imm_31_12 = (addr >> 12) & 0xfffff; ++ emit_insn(ctx, lu12iw, rd, imm_31_12); ++ ++ /* ori rd, rd, imm_11_0 */ ++ imm_11_0 = addr & 0xfff; ++ emit_insn(ctx, ori, rd, rd, imm_11_0); ++ ++ /* lu32id rd, imm_51_32 */ ++ imm_51_32 = (addr >> 32) & 0xfffff; ++ emit_insn(ctx, lu32id, rd, imm_51_32); ++ ++ /* lu52id rd, rd, imm_63_52 */ ++ imm_63_52 = (addr >> 52) & 0xfff; ++ emit_insn(ctx, lu52id, rd, rd, imm_63_52); ++} ++ + static inline void move_imm(struct jit_ctx *ctx, enum loongarch_gpr rd, long imm, bool is32) + { + long imm_11_0, imm_31_12, imm_51_32, imm_63_52, imm_51_0, imm_51_31; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-312-bpf-Fix-global-subprog-context-argument-resolut.patch b/patches.kernel.org/6.2.3-312-bpf-Fix-global-subprog-context-argument-resolut.patch new file mode 100644 index 0000000..cab1400 --- /dev/null +++ b/patches.kernel.org/6.2.3-312-bpf-Fix-global-subprog-context-argument-resolut.patch @@ -0,0 +1,71 @@ +From: Andrii Nakryiko +Date: Wed, 15 Feb 2023 20:59:52 -0800 +Subject: [PATCH] bpf: Fix global subprog context argument resolution logic +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d384dce281ed1b504fae2e279507827638d56fa3 + +[ Upstream commit d384dce281ed1b504fae2e279507827638d56fa3 ] + +KPROBE program's user-facing context type is defined as typedef +bpf_user_pt_regs_t. This leads to a problem when trying to passing +kprobe/uprobe/usdt context argument into global subprog, as kernel +always strip away mods and typedefs of user-supplied type, but takes +expected type from bpf_ctx_convert as is, which causes mismatch. + +Current way to work around this is to define a fake struct with the same +name as expected typedef: + + struct bpf_user_pt_regs_t {}; + + __noinline my_global_subprog(struct bpf_user_pt_regs_t *ctx) { ... } + +This patch fixes the issue by resolving expected type, if it's not +a struct. It still leaves the above work-around working for backwards +compatibility. + +Fixes: 91cc1a99740e ("bpf: Annotate context types") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/bpf/20230216045954.3002473-2-andrii@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/bpf/btf.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index b7017cae..530e200f 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -5573,6 +5573,7 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf, + if (!ctx_struct) + /* should not happen */ + return NULL; ++again: + ctx_tname = btf_name_by_offset(btf_vmlinux, ctx_struct->name_off); + if (!ctx_tname) { + /* should not happen */ +@@ -5586,8 +5587,16 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf, + * int socket_filter_bpf_prog(struct __sk_buff *skb) + * { // no fields of skb are ever used } + */ +- if (strcmp(ctx_tname, tname)) +- return NULL; ++ if (strcmp(ctx_tname, tname)) { ++ /* bpf_user_pt_regs_t is a typedef, so resolve it to ++ * underlying struct and check name again ++ */ ++ if (!btf_type_is_modifier(ctx_struct)) ++ return NULL; ++ while (btf_type_is_modifier(ctx_struct)) ++ ctx_struct = btf_type_by_id(btf_vmlinux, ctx_struct->type); ++ goto again; ++ } + return ctx_type; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-313-irqchip-irq-brcmstb-l2-Set-IRQ_LEVEL-for-level-.patch b/patches.kernel.org/6.2.3-313-irqchip-irq-brcmstb-l2-Set-IRQ_LEVEL-for-level-.patch new file mode 100644 index 0000000..d42d22f --- /dev/null +++ b/patches.kernel.org/6.2.3-313-irqchip-irq-brcmstb-l2-Set-IRQ_LEVEL-for-level-.patch @@ -0,0 +1,59 @@ +From: Florian Fainelli +Date: Fri, 16 Dec 2022 15:09:33 -0800 +Subject: [PATCH] irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered + interrupts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 94debe03e8afa1267f95a9001786a6aa506b9ff3 + +[ Upstream commit 94debe03e8afa1267f95a9001786a6aa506b9ff3 ] + +When support for the level triggered interrupt controller flavor was +added with c0ca7262088e, we forgot to update the flags to be set to +contain IRQ_LEVEL. While the flow handler is correct, the output from +/proc/interrupts does not show such interrupts as being level triggered +when they are, correct that. + +Fixes: c0ca7262088e ("irqchip/brcmstb-l2: Add support for the BCM7271 L2 controller") +Signed-off-by: Florian Fainelli +Reviewed-by: Philippe Mathieu-Daudé +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20221216230934.2478345-2-f.fainelli@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/irqchip/irq-brcmstb-l2.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c +index e4efc08a..091b0fe7 100644 +--- a/drivers/irqchip/irq-brcmstb-l2.c ++++ b/drivers/irqchip/irq-brcmstb-l2.c +@@ -161,6 +161,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np, + *init_params) + { + unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN; ++ unsigned int set = 0; + struct brcmstb_l2_intc_data *data; + struct irq_chip_type *ct; + int ret; +@@ -208,9 +209,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np, + if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) + flags |= IRQ_GC_BE_IO; + ++ if (init_params->handler == handle_level_irq) ++ set |= IRQ_LEVEL; ++ + /* Allocate a single Generic IRQ chip for this node */ + ret = irq_alloc_domain_generic_chips(data->domain, 32, 1, +- np->full_name, init_params->handler, clr, 0, flags); ++ np->full_name, init_params->handler, clr, set, flags); + if (ret) { + pr_err("failed to allocate generic irq chip\n"); + goto out_free_domain; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-314-irqchip-irq-bcm7120-l2-Set-IRQ_LEVEL-for-level-.patch b/patches.kernel.org/6.2.3-314-irqchip-irq-bcm7120-l2-Set-IRQ_LEVEL-for-level-.patch new file mode 100644 index 0000000..6c4f6d1 --- /dev/null +++ b/patches.kernel.org/6.2.3-314-irqchip-irq-bcm7120-l2-Set-IRQ_LEVEL-for-level-.patch @@ -0,0 +1,46 @@ +From: Florian Fainelli +Date: Fri, 16 Dec 2022 15:09:34 -0800 +Subject: [PATCH] irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered + interrupts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 13a157b38ca5b4f9eed81442b8821db293755961 + +[ Upstream commit 13a157b38ca5b4f9eed81442b8821db293755961 ] + +When support for the interrupt controller was added with a5042de2688d, +we forgot to update the flags to be set to contain IRQ_LEVEL. While the +flow handler is correct, the output from /proc/interrupts does not show +such interrupts as being level triggered when they are, correct that. + +Fixes: a5042de2688d ("irqchip: bcm7120-l2: Add Broadcom BCM7120-style Level 2 interrupt controller") +Signed-off-by: Florian Fainelli +Reviewed-by: Philippe Mathieu-Daudé +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20221216230934.2478345-3-f.fainelli@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/irqchip/irq-bcm7120-l2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c +index bb6609ce..1e9dab6e 100644 +--- a/drivers/irqchip/irq-bcm7120-l2.c ++++ b/drivers/irqchip/irq-bcm7120-l2.c +@@ -279,7 +279,8 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn, + flags |= IRQ_GC_BE_IO; + + ret = irq_alloc_domain_generic_chips(data->domain, IRQS_PER_WORD, 1, +- dn->full_name, handle_level_irq, clr, 0, flags); ++ dn->full_name, handle_level_irq, clr, ++ IRQ_LEVEL, flags); + if (ret) { + pr_err("failed to allocate generic irq chip\n"); + goto out_free_domain; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-315-net-smc-fix-potential-panic-dues-to-unprotected.patch b/patches.kernel.org/6.2.3-315-net-smc-fix-potential-panic-dues-to-unprotected.patch new file mode 100644 index 0000000..47be7a0 --- /dev/null +++ b/patches.kernel.org/6.2.3-315-net-smc-fix-potential-panic-dues-to-unprotected.patch @@ -0,0 +1,66 @@ +From: "D. Wythe" +Date: Thu, 16 Feb 2023 14:37:36 +0800 +Subject: [PATCH] net/smc: fix potential panic dues to unprotected + smc_llc_srv_add_link() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e40b801b3603a8f90b46acbacdea3505c27f01c0 + +[ Upstream commit e40b801b3603a8f90b46acbacdea3505c27f01c0 ] + +There is a certain chance to trigger the following panic: + +PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48" + #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7 + #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a + #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60 + #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7 + #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715 + #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654 + #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62 + [exception RIP: ib_alloc_mr+19] + RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202 + RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004 + RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20 + R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 + R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc] + #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc] + #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc] + +The reason here is that when the server tries to create a second link, +smc_llc_srv_add_link() has no protection and may add a new link to +link group. This breaks the security environment protected by +llc_conf_mutex. + +Fixes: 2d2209f20189 ("net/smc: first part of add link processing as SMC server") +Signed-off-by: D. Wythe +Reviewed-by: Larysa Zaremba +Reviewed-by: Wenjia Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/smc/af_smc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index e12d4fa5..d9413d43 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1826,8 +1826,10 @@ static int smcr_serv_conf_first_link(struct smc_sock *smc) + smc_llc_link_active(link); + smcr_lgr_set_type(link->lgr, SMC_LGR_SINGLE); + ++ mutex_lock(&link->lgr->llc_conf_mutex); + /* initial contact - try to establish second link */ + smc_llc_srv_add_link(link, NULL); ++ mutex_unlock(&link->lgr->llc_conf_mutex); + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-316-net-smc-fix-application-data-exception.patch b/patches.kernel.org/6.2.3-316-net-smc-fix-application-data-exception.patch new file mode 100644 index 0000000..1668fdd --- /dev/null +++ b/patches.kernel.org/6.2.3-316-net-smc-fix-application-data-exception.patch @@ -0,0 +1,94 @@ +From: "D. Wythe" +Date: Thu, 16 Feb 2023 14:39:05 +0800 +Subject: [PATCH] net/smc: fix application data exception +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 475f9ff63ee8c296aa46c6e9e9ad9bdd301c6bdf + +[ Upstream commit 475f9ff63ee8c296aa46c6e9e9ad9bdd301c6bdf ] + +There is a certain probability that following +exceptions will occur in the wrk benchmark test: + +Running 10s test @ http://11.213.45.6:80 + 8 threads and 64 connections + Thread Stats Avg Stdev Max +/- Stdev + Latency 3.72ms 13.94ms 245.33ms 94.17% + Req/Sec 1.96k 713.67 5.41k 75.16% + 155262 requests in 10.10s, 23.10MB read +Non-2xx or 3xx responses: 3 + +We will find that the error is HTTP 400 error, which is a serious +exception in our test, which means the application data was +corrupted. + +Consider the following scenarios: + +CPU0 CPU1 + +buf_desc->used = 0; + cmpxchg(buf_desc->used, 0, 1) + deal_with(buf_desc) + +memset(buf_desc->cpu_addr,0); + +This will cause the data received by a victim connection to be cleared, +thus triggering an HTTP 400 error in the server. + +This patch exchange the order between clear used and memset, add +barrier to ensure memory consistency. + +Fixes: 1c5526968e27 ("net/smc: Clear memory when release and reuse buffer") +Signed-off-by: D. Wythe +Reviewed-by: Wenjia Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/smc/smc_core.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index c305d8dd..c19d4b7c 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -1120,8 +1120,9 @@ static void smcr_buf_unuse(struct smc_buf_desc *buf_desc, bool is_rmb, + + smc_buf_free(lgr, is_rmb, buf_desc); + } else { +- buf_desc->used = 0; +- memset(buf_desc->cpu_addr, 0, buf_desc->len); ++ /* memzero_explicit provides potential memory barrier semantics */ ++ memzero_explicit(buf_desc->cpu_addr, buf_desc->len); ++ WRITE_ONCE(buf_desc->used, 0); + } + } + +@@ -1132,19 +1133,17 @@ static void smc_buf_unuse(struct smc_connection *conn, + if (!lgr->is_smcd && conn->sndbuf_desc->is_vm) { + smcr_buf_unuse(conn->sndbuf_desc, false, lgr); + } else { +- conn->sndbuf_desc->used = 0; +- memset(conn->sndbuf_desc->cpu_addr, 0, +- conn->sndbuf_desc->len); ++ memzero_explicit(conn->sndbuf_desc->cpu_addr, conn->sndbuf_desc->len); ++ WRITE_ONCE(conn->sndbuf_desc->used, 0); + } + } + if (conn->rmb_desc) { + if (!lgr->is_smcd) { + smcr_buf_unuse(conn->rmb_desc, true, lgr); + } else { +- conn->rmb_desc->used = 0; +- memset(conn->rmb_desc->cpu_addr, 0, +- conn->rmb_desc->len + +- sizeof(struct smcd_cdc_msg)); ++ memzero_explicit(conn->rmb_desc->cpu_addr, ++ conn->rmb_desc->len + sizeof(struct smcd_cdc_msg)); ++ WRITE_ONCE(conn->rmb_desc->used, 0); + } + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-317-selftests-net-Interpret-UDP_GRO-cmsg-data-as-an.patch b/patches.kernel.org/6.2.3-317-selftests-net-Interpret-UDP_GRO-cmsg-data-as-an.patch new file mode 100644 index 0000000..7fa9f5c --- /dev/null +++ b/patches.kernel.org/6.2.3-317-selftests-net-Interpret-UDP_GRO-cmsg-data-as-an.patch @@ -0,0 +1,67 @@ +From: Jakub Sitnicki +Date: Thu, 16 Feb 2023 13:43:40 +0100 +Subject: [PATCH] selftests/net: Interpret UDP_GRO cmsg data as an int value +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 436864095a95fcc611c20c44a111985fa9848730 + +[ Upstream commit 436864095a95fcc611c20c44a111985fa9848730 ] + +Data passed to user-space with a (SOL_UDP, UDP_GRO) cmsg carries an +int (see udp_cmsg_recv), not a u16 value, as strace confirms: + + recvmsg(8, {msg_name=..., + msg_iov=[{iov_base="\0\0..."..., iov_len=96000}], + msg_iovlen=1, + msg_control=[{cmsg_len=20, <-- sizeof(cmsghdr) + 4 + cmsg_level=SOL_UDP, + cmsg_type=0x68}], <-- UDP_GRO + msg_controllen=24, + msg_flags=0}, 0) = 11200 + +Interpreting the data as an u16 value won't work on big-endian platforms. +Since it is too late to back out of this API decision [1], fix the test. + +[1]: https://lore.kernel.org/netdev/20230131174601.203127-1-jakub@cloudflare.com/ + +Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO") +Suggested-by: Eric Dumazet +Signed-off-by: Jakub Sitnicki +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/net/udpgso_bench_rx.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c +index 4058c745..f35a924d 100644 +--- a/tools/testing/selftests/net/udpgso_bench_rx.c ++++ b/tools/testing/selftests/net/udpgso_bench_rx.c +@@ -214,11 +214,10 @@ static void do_verify_udp(const char *data, int len) + + static int recv_msg(int fd, char *buf, int len, int *gso_size) + { +- char control[CMSG_SPACE(sizeof(uint16_t))] = {0}; ++ char control[CMSG_SPACE(sizeof(int))] = {0}; + struct msghdr msg = {0}; + struct iovec iov = {0}; + struct cmsghdr *cmsg; +- uint16_t *gsosizeptr; + int ret; + + iov.iov_base = buf; +@@ -237,8 +236,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size) + cmsg = CMSG_NXTHDR(&msg, cmsg)) { + if (cmsg->cmsg_level == SOL_UDP + && cmsg->cmsg_type == UDP_GRO) { +- gsosizeptr = (uint16_t *) CMSG_DATA(cmsg); +- *gso_size = *gsosizeptr; ++ *gso_size = *(int *)CMSG_DATA(cmsg); + break; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-318-l2tp-Avoid-possible-recursive-deadlock-in-l2tp_.patch b/patches.kernel.org/6.2.3-318-l2tp-Avoid-possible-recursive-deadlock-in-l2tp_.patch new file mode 100644 index 0000000..e021398 --- /dev/null +++ b/patches.kernel.org/6.2.3-318-l2tp-Avoid-possible-recursive-deadlock-in-l2tp_.patch @@ -0,0 +1,304 @@ +From: Shigeru Yoshida +Date: Fri, 17 Feb 2023 01:37:10 +0900 +Subject: [PATCH] l2tp: Avoid possible recursive deadlock in + l2tp_tunnel_register() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9ca5e7ecab064f1f47da07f7c1ddf40e4bc0e5ac + +[ Upstream commit 9ca5e7ecab064f1f47da07f7c1ddf40e4bc0e5ac ] + +When a file descriptor of pppol2tp socket is passed as file descriptor +of UDP socket, a recursive deadlock occurs in l2tp_tunnel_register(). +This situation is reproduced by the following program: + +int main(void) +{ + int sock; + struct sockaddr_pppol2tp addr; + + sock = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); + if (sock < 0) { + perror("socket"); + return 1; + } + + addr.sa_family = AF_PPPOX; + addr.sa_protocol = PX_PROTO_OL2TP; + addr.pppol2tp.pid = 0; + addr.pppol2tp.fd = sock; + addr.pppol2tp.addr.sin_family = PF_INET; + addr.pppol2tp.addr.sin_port = htons(0); + addr.pppol2tp.addr.sin_addr.s_addr = inet_addr("192.168.0.1"); + addr.pppol2tp.s_tunnel = 1; + addr.pppol2tp.s_session = 0; + addr.pppol2tp.d_tunnel = 0; + addr.pppol2tp.d_session = 0; + + if (connect(sock, (const struct sockaddr *)&addr, sizeof(addr)) < 0) { + perror("connect"); + return 1; + } + + return 0; +} + +This program causes the following lockdep warning: + + ============================================ + WARNING: possible recursive locking detected + 6.2.0-rc5-00205-gc96618275234 #56 Not tainted + -------------------------------------------- + repro/8607 is trying to acquire lock: + ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: l2tp_tunnel_register+0x2b7/0x11c0 + + but task is already holding lock: + ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(sk_lock-AF_PPPOX); + lock(sk_lock-AF_PPPOX); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + + 1 lock held by repro/8607: + #0: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30 + + stack backtrace: + CPU: 0 PID: 8607 Comm: repro Not tainted 6.2.0-rc5-00205-gc96618275234 #56 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 + Call Trace: + + dump_stack_lvl+0x100/0x178 + __lock_acquire.cold+0x119/0x3b9 + ? lockdep_hardirqs_on_prepare+0x410/0x410 + lock_acquire+0x1e0/0x610 + ? l2tp_tunnel_register+0x2b7/0x11c0 + ? lock_downgrade+0x710/0x710 + ? __fget_files+0x283/0x3e0 + lock_sock_nested+0x3a/0xf0 + ? l2tp_tunnel_register+0x2b7/0x11c0 + l2tp_tunnel_register+0x2b7/0x11c0 + ? sprintf+0xc4/0x100 + ? l2tp_tunnel_del_work+0x6b0/0x6b0 + ? debug_object_deactivate+0x320/0x320 + ? lockdep_init_map_type+0x16d/0x7a0 + ? lockdep_init_map_type+0x16d/0x7a0 + ? l2tp_tunnel_create+0x2bf/0x4b0 + ? l2tp_tunnel_create+0x3c6/0x4b0 + pppol2tp_connect+0x14e1/0x1a30 + ? pppol2tp_put_sk+0xd0/0xd0 + ? aa_sk_perm+0x2b7/0xa80 + ? aa_af_perm+0x260/0x260 + ? bpf_lsm_socket_connect+0x9/0x10 + ? pppol2tp_put_sk+0xd0/0xd0 + __sys_connect_file+0x14f/0x190 + __sys_connect+0x133/0x160 + ? __sys_connect_file+0x190/0x190 + ? lockdep_hardirqs_on+0x7d/0x100 + ? ktime_get_coarse_real_ts64+0x1b7/0x200 + ? ktime_get_coarse_real_ts64+0x147/0x200 + ? __audit_syscall_entry+0x396/0x500 + __x64_sys_connect+0x72/0xb0 + do_syscall_64+0x38/0xb0 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +This patch fixes the issue by getting/creating the tunnel before +locking the pppol2tp socket. + +Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()") +Cc: Cong Wang +Signed-off-by: Shigeru Yoshida +Reviewed-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/l2tp/l2tp_ppp.c | 125 ++++++++++++++++++++++++-------------------- + 1 file changed, 67 insertions(+), 58 deletions(-) + +diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c +index db2e584c..f011af66 100644 +--- a/net/l2tp/l2tp_ppp.c ++++ b/net/l2tp/l2tp_ppp.c +@@ -650,54 +650,22 @@ static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) + return mtu - PPPOL2TP_HEADER_OVERHEAD; + } + +-/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket +- */ +-static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, +- int sockaddr_len, int flags) ++static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net, ++ const struct l2tp_connect_info *info, ++ bool *new_tunnel) + { +- struct sock *sk = sock->sk; +- struct pppox_sock *po = pppox_sk(sk); +- struct l2tp_session *session = NULL; +- struct l2tp_connect_info info; + struct l2tp_tunnel *tunnel; +- struct pppol2tp_session *ps; +- struct l2tp_session_cfg cfg = { 0, }; +- bool drop_refcnt = false; +- bool drop_tunnel = false; +- bool new_session = false; +- bool new_tunnel = false; + int error; + +- error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); +- if (error < 0) +- return error; ++ *new_tunnel = false; + +- lock_sock(sk); +- +- /* Check for already bound sockets */ +- error = -EBUSY; +- if (sk->sk_state & PPPOX_CONNECTED) +- goto end; +- +- /* We don't supporting rebinding anyway */ +- error = -EALREADY; +- if (sk->sk_user_data) +- goto end; /* socket is already attached */ +- +- /* Don't bind if tunnel_id is 0 */ +- error = -EINVAL; +- if (!info.tunnel_id) +- goto end; +- +- tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); +- if (tunnel) +- drop_tunnel = true; ++ tunnel = l2tp_tunnel_get(net, info->tunnel_id); + + /* Special case: create tunnel context if session_id and + * peer_session_id is 0. Otherwise look up tunnel using supplied + * tunnel id. + */ +- if (!info.session_id && !info.peer_session_id) { ++ if (!info->session_id && !info->peer_session_id) { + if (!tunnel) { + struct l2tp_tunnel_cfg tcfg = { + .encap = L2TP_ENCAPTYPE_UDP, +@@ -706,40 +674,82 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + /* Prevent l2tp_tunnel_register() from trying to set up + * a kernel socket. + */ +- if (info.fd < 0) { +- error = -EBADF; +- goto end; +- } ++ if (info->fd < 0) ++ return ERR_PTR(-EBADF); + +- error = l2tp_tunnel_create(info.fd, +- info.version, +- info.tunnel_id, +- info.peer_tunnel_id, &tcfg, ++ error = l2tp_tunnel_create(info->fd, ++ info->version, ++ info->tunnel_id, ++ info->peer_tunnel_id, &tcfg, + &tunnel); + if (error < 0) +- goto end; ++ return ERR_PTR(error); + + l2tp_tunnel_inc_refcount(tunnel); +- error = l2tp_tunnel_register(tunnel, sock_net(sk), +- &tcfg); ++ error = l2tp_tunnel_register(tunnel, net, &tcfg); + if (error < 0) { + kfree(tunnel); +- goto end; ++ return ERR_PTR(error); + } +- drop_tunnel = true; +- new_tunnel = true; ++ ++ *new_tunnel = true; + } + } else { + /* Error if we can't find the tunnel */ +- error = -ENOENT; + if (!tunnel) +- goto end; ++ return ERR_PTR(-ENOENT); + + /* Error if socket is not prepped */ +- if (!tunnel->sock) +- goto end; ++ if (!tunnel->sock) { ++ l2tp_tunnel_dec_refcount(tunnel); ++ return ERR_PTR(-ENOENT); ++ } + } + ++ return tunnel; ++} ++ ++/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket ++ */ ++static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, ++ int sockaddr_len, int flags) ++{ ++ struct sock *sk = sock->sk; ++ struct pppox_sock *po = pppox_sk(sk); ++ struct l2tp_session *session = NULL; ++ struct l2tp_connect_info info; ++ struct l2tp_tunnel *tunnel; ++ struct pppol2tp_session *ps; ++ struct l2tp_session_cfg cfg = { 0, }; ++ bool drop_refcnt = false; ++ bool new_session = false; ++ bool new_tunnel = false; ++ int error; ++ ++ error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); ++ if (error < 0) ++ return error; ++ ++ /* Don't bind if tunnel_id is 0 */ ++ if (!info.tunnel_id) ++ return -EINVAL; ++ ++ tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel); ++ if (IS_ERR(tunnel)) ++ return PTR_ERR(tunnel); ++ ++ lock_sock(sk); ++ ++ /* Check for already bound sockets */ ++ error = -EBUSY; ++ if (sk->sk_state & PPPOX_CONNECTED) ++ goto end; ++ ++ /* We don't supporting rebinding anyway */ ++ error = -EALREADY; ++ if (sk->sk_user_data) ++ goto end; /* socket is already attached */ ++ + if (tunnel->peer_tunnel_id == 0) + tunnel->peer_tunnel_id = info.peer_tunnel_id; + +@@ -840,8 +850,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + } + if (drop_refcnt) + l2tp_session_dec_refcount(session); +- if (drop_tunnel) +- l2tp_tunnel_dec_refcount(tunnel); ++ l2tp_tunnel_dec_refcount(tunnel); + release_sock(sk); + + return error; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-319-net-bcmgenet-fix-MoCA-LED-control.patch b/patches.kernel.org/6.2.3-319-net-bcmgenet-fix-MoCA-LED-control.patch new file mode 100644 index 0000000..d4006a9 --- /dev/null +++ b/patches.kernel.org/6.2.3-319-net-bcmgenet-fix-MoCA-LED-control.patch @@ -0,0 +1,55 @@ +From: Doug Berger +Date: Thu, 16 Feb 2023 11:41:28 -0800 +Subject: [PATCH] net: bcmgenet: fix MoCA LED control +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a7515af9fb8f0890fe540b108def4a86b9e8330a + +[ Upstream commit a7515af9fb8f0890fe540b108def4a86b9e8330a ] + +When the bcmgenet_mii_config() code was refactored it was missed +that the LED control for the MoCA interface got overwritten by +the port_ctrl value. Its previous programming is restored here. + +Fixes: 4f8d81b77e66 ("net: bcmgenet: Refactor register access in bcmgenet_mii_config") +Signed-off-by: Doug Berger +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/broadcom/genet/bcmmii.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index b6151763..be042905 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -176,15 +176,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable) + + static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv) + { +- u32 reg; +- +- if (!GENET_IS_V5(priv)) { +- /* Speed settings are set in bcmgenet_mii_setup() */ +- reg = bcmgenet_sys_readl(priv, SYS_PORT_CTRL); +- reg |= LED_ACT_SOURCE_MAC; +- bcmgenet_sys_writel(priv, reg, SYS_PORT_CTRL); +- } +- + if (priv->hw_params->flags & GENET_HAS_MOCA_LINK_DET) + fixed_phy_set_link_update(priv->dev->phydev, + bcmgenet_fixed_phy_link_update); +@@ -217,6 +208,8 @@ int bcmgenet_mii_config(struct net_device *dev, bool init) + + if (!phy_name) { + phy_name = "MoCA"; ++ if (!GENET_IS_V5(priv)) ++ port_ctrl |= LED_ACT_SOURCE_MAC; + bcmgenet_moca_phy_setup(priv); + } + break; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-320-net-lan966x-Fix-possible-deadlock-inside-PTP.patch b/patches.kernel.org/6.2.3-320-net-lan966x-Fix-possible-deadlock-inside-PTP.patch new file mode 100644 index 0000000..01794f2 --- /dev/null +++ b/patches.kernel.org/6.2.3-320-net-lan966x-Fix-possible-deadlock-inside-PTP.patch @@ -0,0 +1,225 @@ +From: Horatiu Vultur +Date: Fri, 17 Feb 2023 22:09:17 +0100 +Subject: [PATCH] net: lan966x: Fix possible deadlock inside PTP +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3a70e0d4c9d74cb00f7c0ec022f5599f9f7ba07d + +[ Upstream commit 3a70e0d4c9d74cb00f7c0ec022f5599f9f7ba07d ] + +When doing timestamping in lan966x and having PROVE_LOCKING +enabled the following warning is shown. + +======================================================== +WARNING: possible irq lock inversion dependency detected +6.2.0-rc7-01749-gc54e1f7f7e36 #2786 Tainted: G N +-------------------------------------------------------- +swapper/0/0 just changed the state of lock: +c2609f50 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x16c/0x2e8 +but this lock took another, SOFTIRQ-unsafe lock in the past: + (&lan966x->ptp_ts_id_lock){+.+.}-{2:2} + +and interrupts could create inverse lock ordering between them. + +other info that might help us debug this: + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&lan966x->ptp_ts_id_lock); + local_irq_disable(); + lock(_xmit_ETHER#2); + lock(&lan966x->ptp_ts_id_lock); + + lock(_xmit_ETHER#2); + + *** DEADLOCK *** + +5 locks held by swapper/0/0: + #0: c1001e18 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0x0/0x33c + #1: c105e7c4 (rcu_read_lock){....}-{1:2}, at: ndisc_send_skb+0x134/0x81c + #2: c105e7d8 (rcu_read_lock_bh){....}-{1:2}, at: ip6_finish_output2+0x17c/0xc64 + #3: c105e7d8 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x4c/0x1224 + #4: c3056174 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x354/0x1224 + +the shortest dependencies between 2nd lock and 1st lock: + -> (&lan966x->ptp_ts_id_lock){+.+.}-{2:2} { + HARDIRQ-ON-W at: + lock_acquire.part.0+0xb0/0x248 + _raw_spin_lock+0x38/0x48 + lan966x_ptp_irq_handler+0x164/0x2a8 + irq_thread_fn+0x1c/0x78 + irq_thread+0x130/0x278 + kthread+0xec/0x110 + ret_from_fork+0x14/0x28 + SOFTIRQ-ON-W at: + lock_acquire.part.0+0xb0/0x248 + _raw_spin_lock+0x38/0x48 + lan966x_ptp_irq_handler+0x164/0x2a8 + irq_thread_fn+0x1c/0x78 + irq_thread+0x130/0x278 + kthread+0xec/0x110 + ret_from_fork+0x14/0x28 + INITIAL USE at: + lock_acquire.part.0+0xb0/0x248 + _raw_spin_lock_irqsave+0x4c/0x68 + lan966x_ptp_txtstamp_request+0x128/0x1cc + lan966x_port_xmit+0x224/0x43c + dev_hard_start_xmit+0xa8/0x2f0 + sch_direct_xmit+0x108/0x2e8 + __dev_queue_xmit+0x41c/0x1224 + packet_sendmsg+0xdb4/0x134c + __sys_sendto+0xd0/0x154 + sys_send+0x18/0x20 + ret_fast_syscall+0x0/0x1c + } + ... key at: [] __key.2+0x0/0x8 + ... acquired at: + _raw_spin_lock_irqsave+0x4c/0x68 + lan966x_ptp_txtstamp_request+0x128/0x1cc + lan966x_port_xmit+0x224/0x43c + dev_hard_start_xmit+0xa8/0x2f0 + sch_direct_xmit+0x108/0x2e8 + __dev_queue_xmit+0x41c/0x1224 + packet_sendmsg+0xdb4/0x134c + __sys_sendto+0xd0/0x154 + sys_send+0x18/0x20 + ret_fast_syscall+0x0/0x1c + +-> (_xmit_ETHER#2){+.-.}-{2:2} { + HARDIRQ-ON-W at: + lock_acquire.part.0+0xb0/0x248 + _raw_spin_lock+0x38/0x48 + netif_freeze_queues+0x38/0x68 + dev_deactivate_many+0xac/0x388 + dev_deactivate+0x38/0x6c + linkwatch_do_dev+0x70/0x8c + __linkwatch_run_queue+0xd4/0x1e8 + linkwatch_event+0x24/0x34 + process_one_work+0x284/0x744 + worker_thread+0x28/0x4bc + kthread+0xec/0x110 + ret_from_fork+0x14/0x28 + IN-SOFTIRQ-W at: + lock_acquire.part.0+0xb0/0x248 + _raw_spin_lock+0x38/0x48 + sch_direct_xmit+0x16c/0x2e8 + __dev_queue_xmit+0x41c/0x1224 + ip6_finish_output2+0x5f4/0xc64 + ndisc_send_skb+0x4cc/0x81c + addrconf_rs_timer+0xb0/0x2f8 + call_timer_fn+0xb4/0x33c + expire_timers+0xb4/0x10c + run_timer_softirq+0xf8/0x2a8 + __do_softirq+0xd4/0x5fc + __irq_exit_rcu+0x138/0x17c + irq_exit+0x8/0x28 + __irq_svc+0x90/0xbc + arch_cpu_idle+0x30/0x3c + default_idle_call+0x44/0xac + do_idle+0xc8/0x138 + cpu_startup_entry+0x18/0x1c + rest_init+0xcc/0x168 + arch_post_acpi_subsys_init+0x0/0x8 + INITIAL USE at: + lock_acquire.part.0+0xb0/0x248 + _raw_spin_lock+0x38/0x48 + netif_freeze_queues+0x38/0x68 + dev_deactivate_many+0xac/0x388 + dev_deactivate+0x38/0x6c + linkwatch_do_dev+0x70/0x8c + __linkwatch_run_queue+0xd4/0x1e8 + linkwatch_event+0x24/0x34 + process_one_work+0x284/0x744 + worker_thread+0x28/0x4bc + kthread+0xec/0x110 + ret_from_fork+0x14/0x28 + } + ... key at: [] netdev_xmit_lock_key+0x8/0x1c8 + ... acquired at: + __lock_acquire+0x978/0x2978 + lock_acquire.part.0+0xb0/0x248 + _raw_spin_lock+0x38/0x48 + sch_direct_xmit+0x16c/0x2e8 + __dev_queue_xmit+0x41c/0x1224 + ip6_finish_output2+0x5f4/0xc64 + ndisc_send_skb+0x4cc/0x81c + addrconf_rs_timer+0xb0/0x2f8 + call_timer_fn+0xb4/0x33c + expire_timers+0xb4/0x10c + run_timer_softirq+0xf8/0x2a8 + __do_softirq+0xd4/0x5fc + __irq_exit_rcu+0x138/0x17c + irq_exit+0x8/0x28 + __irq_svc+0x90/0xbc + arch_cpu_idle+0x30/0x3c + default_idle_call+0x44/0xac + do_idle+0xc8/0x138 + cpu_startup_entry+0x18/0x1c + rest_init+0xcc/0x168 + arch_post_acpi_subsys_init+0x0/0x8 + +stack backtrace: +CPU: 0 PID: 0 Comm: swapper/0 Tainted: G N 6.2.0-rc7-01749-gc54e1f7f7e36 #2786 +Hardware name: Generic DT based system + unwind_backtrace from show_stack+0x10/0x14 + show_stack from dump_stack_lvl+0x58/0x70 + dump_stack_lvl from mark_lock.part.0+0x59c/0x93c + mark_lock.part.0 from __lock_acquire+0x978/0x2978 + __lock_acquire from lock_acquire.part.0+0xb0/0x248 + lock_acquire.part.0 from _raw_spin_lock+0x38/0x48 + _raw_spin_lock from sch_direct_xmit+0x16c/0x2e8 + sch_direct_xmit from __dev_queue_xmit+0x41c/0x1224 + __dev_queue_xmit from ip6_finish_output2+0x5f4/0xc64 + ip6_finish_output2 from ndisc_send_skb+0x4cc/0x81c + ndisc_send_skb from addrconf_rs_timer+0xb0/0x2f8 + addrconf_rs_timer from call_timer_fn+0xb4/0x33c + call_timer_fn from expire_timers+0xb4/0x10c + expire_timers from run_timer_softirq+0xf8/0x2a8 + run_timer_softirq from __do_softirq+0xd4/0x5fc + __do_softirq from __irq_exit_rcu+0x138/0x17c + __irq_exit_rcu from irq_exit+0x8/0x28 + irq_exit from __irq_svc+0x90/0xbc +Exception stack(0xc1001f20 to 0xc1001f68) +1f20: ffffffff ffffffff 00000001 c011f840 c100e000 c100e000 c1009314 c1009370 +1f40: c10f0c1a c0d5e564 c0f5da8c 00000000 00000000 c1001f70 c010f0bc c010f0c0 +1f60: 600f0013 ffffffff + __irq_svc from arch_cpu_idle+0x30/0x3c + arch_cpu_idle from default_idle_call+0x44/0xac + default_idle_call from do_idle+0xc8/0x138 + do_idle from cpu_startup_entry+0x18/0x1c + cpu_startup_entry from rest_init+0xcc/0x168 + rest_init from arch_post_acpi_subsys_init+0x0/0x8 + +Fix this by using spin_lock_irqsave/spin_lock_irqrestore also +inside lan966x_ptp_irq_handler. + +Fixes: e85a96e48e33 ("net: lan966x: Add support for ptp interrupts") +Signed-off-by: Horatiu Vultur +Link: https://lore.kernel.org/r/20230217210917.2649365-1-horatiu.vultur@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c +index a8348437..61fbabf5 100644 +--- a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c ++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c +@@ -524,9 +524,9 @@ irqreturn_t lan966x_ptp_irq_handler(int irq, void *args) + if (WARN_ON(!skb_match)) + continue; + +- spin_lock(&lan966x->ptp_ts_id_lock); ++ spin_lock_irqsave(&lan966x->ptp_ts_id_lock, flags); + lan966x->ptp_skbs--; +- spin_unlock(&lan966x->ptp_ts_id_lock); ++ spin_unlock_irqrestore(&lan966x->ptp_ts_id_lock, flags); + + /* Get the h/w timestamp */ + lan966x_get_hwtimestamp(lan966x, &ts, delay); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-321-net-mlx4_en-Introduce-flexible-array-to-silence.patch b/patches.kernel.org/6.2.3-321-net-mlx4_en-Introduce-flexible-array-to-silence.patch new file mode 100644 index 0000000..63411e1 --- /dev/null +++ b/patches.kernel.org/6.2.3-321-net-mlx4_en-Introduce-flexible-array-to-silence.patch @@ -0,0 +1,124 @@ +From: Kees Cook +Date: Sat, 18 Feb 2023 10:38:50 -0800 +Subject: [PATCH] net/mlx4_en: Introduce flexible array to silence overflow + warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f8f185e39b4de91bc5235e5be0d829bea69d9b06 + +[ Upstream commit f8f185e39b4de91bc5235e5be0d829bea69d9b06 ] + +The call "skb_copy_from_linear_data(skb, inl + 1, spc)" triggers a FORTIFY +memcpy() warning on ppc64 platform: + +In function ‘fortify_memcpy_chk’, + inlined from ‘skb_copy_from_linear_data’ at ./include/linux/skbuff.h:4029:2, + inlined from ‘build_inline_wqe’ at drivers/net/ethernet/mellanox/mlx4/en_tx.c:722:4, + inlined from ‘mlx4_en_xmit’ at drivers/net/ethernet/mellanox/mlx4/en_tx.c:1066:3: +./include/linux/fortify-string.h:513:25: error: call to ‘__write_overflow_field’ declared with +attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? +[-Werror=attribute-warning] + 513 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Same behaviour on x86 you can get if you use "__always_inline" instead of +"inline" for skb_copy_from_linear_data() in skbuff.h + +The call here copies data into inlined tx destricptor, which has 104 +bytes (MAX_INLINE) space for data payload. In this case "spc" is known +in compile-time but the destination is used with hidden knowledge +(real structure of destination is different from that the compiler +can see). That cause the fortify warning because compiler can check +bounds, but the real bounds are different. "spc" can't be bigger than +64 bytes (MLX4_INLINE_ALIGN), so the data can always fit into inlined +tx descriptor. The fact that "inl" points into inlined tx descriptor is +determined earlier in mlx4_en_xmit(). + +Avoid confusing the compiler with "inl + 1" constructions to get to past +the inl header by introducing a flexible array "data" to the struct so +that the compiler can see that we are not dealing with an array of inl +structs, but rather, arbitrary data following the structure. There are +no changes to the structure layout reported by pahole, and the resulting +machine code is actually smaller. + +Reported-by: Josef Oskera +Link: https://lore.kernel.org/lkml/20230217094541.2362873-1-joskera@redhat.com +Fixes: f68f2ff91512 ("fortify: Detect struct member overflows in memcpy() at compile-time") +Cc: Yishai Hadas +Signed-off-by: Kees Cook +Reviewed-by: Tariq Toukan +Link: https://lore.kernel.org/r/20230218183842.never.954-kees@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlx4/en_tx.c | 22 +++++++++++----------- + include/linux/mlx4/qp.h | 1 + + 2 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c +index c5758637..2f79378f 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c +@@ -699,32 +699,32 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc, + inl->byte_count = cpu_to_be32(1 << 31 | skb->len); + } else { + inl->byte_count = cpu_to_be32(1 << 31 | MIN_PKT_LEN); +- memset(((void *)(inl + 1)) + skb->len, 0, ++ memset(inl->data + skb->len, 0, + MIN_PKT_LEN - skb->len); + } +- skb_copy_from_linear_data(skb, inl + 1, hlen); ++ skb_copy_from_linear_data(skb, inl->data, hlen); + if (shinfo->nr_frags) +- memcpy(((void *)(inl + 1)) + hlen, fragptr, ++ memcpy(inl->data + hlen, fragptr, + skb_frag_size(&shinfo->frags[0])); + + } else { + inl->byte_count = cpu_to_be32(1 << 31 | spc); + if (hlen <= spc) { +- skb_copy_from_linear_data(skb, inl + 1, hlen); ++ skb_copy_from_linear_data(skb, inl->data, hlen); + if (hlen < spc) { +- memcpy(((void *)(inl + 1)) + hlen, ++ memcpy(inl->data + hlen, + fragptr, spc - hlen); + fragptr += spc - hlen; + } +- inl = (void *) (inl + 1) + spc; +- memcpy(((void *)(inl + 1)), fragptr, skb->len - spc); ++ inl = (void *)inl->data + spc; ++ memcpy(inl->data, fragptr, skb->len - spc); + } else { +- skb_copy_from_linear_data(skb, inl + 1, spc); +- inl = (void *) (inl + 1) + spc; +- skb_copy_from_linear_data_offset(skb, spc, inl + 1, ++ skb_copy_from_linear_data(skb, inl->data, spc); ++ inl = (void *)inl->data + spc; ++ skb_copy_from_linear_data_offset(skb, spc, inl->data, + hlen - spc); + if (shinfo->nr_frags) +- memcpy(((void *)(inl + 1)) + hlen - spc, ++ memcpy(inl->data + hlen - spc, + fragptr, + skb_frag_size(&shinfo->frags[0])); + } +diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h +index 9db93e48..b6b62615 100644 +--- a/include/linux/mlx4/qp.h ++++ b/include/linux/mlx4/qp.h +@@ -446,6 +446,7 @@ enum { + + struct mlx4_wqe_inline_seg { + __be32 byte_count; ++ __u8 data[]; + }; + + enum mlx4_update_qp_attr { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-322-net-mlx5e-Align-IPsec-ASO-result-memory-to-be-a.patch b/patches.kernel.org/6.2.3-322-net-mlx5e-Align-IPsec-ASO-result-memory-to-be-a.patch new file mode 100644 index 0000000..3e45af9 --- /dev/null +++ b/patches.kernel.org/6.2.3-322-net-mlx5e-Align-IPsec-ASO-result-memory-to-be-a.patch @@ -0,0 +1,41 @@ +From: Leon Romanovsky +Date: Sun, 19 Feb 2023 11:09:10 +0200 +Subject: [PATCH] net/mlx5e: Align IPsec ASO result memory to be as required by + hardware +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f2b6cfda76d2119871e10fa01ecdc7178401ef22 + +[ Upstream commit f2b6cfda76d2119871e10fa01ecdc7178401ef22 ] + +Hardware requires an alignment to 64 bytes to return ASO data. Missing +this alignment caused to unpredictable results while ASO events were +generated. + +Fixes: 8518d05b8f9a ("net/mlx5e: Create Advanced Steering Operation object for IPsec") +Reported-by: Emeel Hakim +Signed-off-by: Leon Romanovsky +Link: https://lore.kernel.org/r/de0302c572b90c9224a72868d4e0d657b6313c4b.1676797613.git.leon@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +index 8bed9c36..d739d77d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +@@ -119,7 +119,7 @@ struct mlx5e_ipsec_work { + }; + + struct mlx5e_ipsec_aso { +- u8 ctx[MLX5_ST_SZ_BYTES(ipsec_aso)]; ++ u8 __aligned(64) ctx[MLX5_ST_SZ_BYTES(ipsec_aso)]; + dma_addr_t dma_addr; + struct mlx5_aso *aso; + /* Protect ASO WQ access, as it is global to whole IPsec */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-323-selftest-fib_tests-Always-cleanup-before-exit.patch b/patches.kernel.org/6.2.3-323-selftest-fib_tests-Always-cleanup-before-exit.patch new file mode 100644 index 0000000..83778f6 --- /dev/null +++ b/patches.kernel.org/6.2.3-323-selftest-fib_tests-Always-cleanup-before-exit.patch @@ -0,0 +1,43 @@ +From: Roxana Nicolescu +Date: Mon, 20 Feb 2023 12:04:00 +0100 +Subject: [PATCH] selftest: fib_tests: Always cleanup before exit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b60417a9f2b890a8094477b2204d4f73c535725e + +[ Upstream commit b60417a9f2b890a8094477b2204d4f73c535725e ] + +Usage of `set -e` before executing a command causes immediate exit +on failure, without cleanup up the resources allocated at setup. +This can affect the next tests that use the same resources, +leading to a chain of failures. + +A simple fix is to always call cleanup function when the script exists. +This approach is already used by other existing tests. + +Fixes: 1056691b2680 ("selftests: fib_tests: Make test results more verbose") +Signed-off-by: Roxana Nicolescu +Link: https://lore.kernel.org/r/20230220110400.26737-2-roxana.nicolescu@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/net/fib_tests.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh +index 5637b5da..70ea8798 100755 +--- a/tools/testing/selftests/net/fib_tests.sh ++++ b/tools/testing/selftests/net/fib_tests.sh +@@ -2065,6 +2065,8 @@ EOF + ################################################################################ + # main + ++trap cleanup EXIT ++ + while getopts :t:pPhv o + do + case $o in +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-324-sefltests-netdevsim-wait-for-devlink-instance-a.patch b/patches.kernel.org/6.2.3-324-sefltests-netdevsim-wait-for-devlink-instance-a.patch new file mode 100644 index 0000000..88b04cb --- /dev/null +++ b/patches.kernel.org/6.2.3-324-sefltests-netdevsim-wait-for-devlink-instance-a.patch @@ -0,0 +1,77 @@ +From: Jiri Pirko +Date: Mon, 20 Feb 2023 14:23:36 +0100 +Subject: [PATCH] sefltests: netdevsim: wait for devlink instance after netns + removal +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f922c7b1c1c45740d329bf248936fdb78c0cff6e + +[ Upstream commit f922c7b1c1c45740d329bf248936fdb78c0cff6e ] + +When devlink instance is put into network namespace and that network +namespace gets deleted, devlink instance is moved back into init_ns. +This is done as a part of cleanup_net() routine. Since cleanup_net() +is called asynchronously from workqueue, there is no guarantee that +the devlink instance move is done after "ip netns del" returns. + +So fix this race by making sure that the devlink instance is present +before any other operation. + +Reported-by: Amir Tzin +Fixes: b74c37fd35a2 ("selftests: netdevsim: add tests for devlink reload with resources") +Signed-off-by: Jiri Pirko +Reviewed-by: Pavan Chebbi +Link: https://lore.kernel.org/r/20230220132336.198597-1-jiri@resnulli.us +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../selftests/drivers/net/netdevsim/devlink.sh | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh +index a08c02ab..7f7d20f2 100755 +--- a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh ++++ b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh +@@ -17,6 +17,18 @@ SYSFS_NET_DIR=/sys/bus/netdevsim/devices/$DEV_NAME/net/ + DEBUGFS_DIR=/sys/kernel/debug/netdevsim/$DEV_NAME/ + DL_HANDLE=netdevsim/$DEV_NAME + ++wait_for_devlink() ++{ ++ "$@" | grep -q $DL_HANDLE ++} ++ ++devlink_wait() ++{ ++ local timeout=$1 ++ ++ busywait "$timeout" wait_for_devlink devlink dev ++} ++ + fw_flash_test() + { + RET=0 +@@ -256,6 +268,9 @@ netns_reload_test() + ip netns del testns2 + ip netns del testns1 + ++ # Wait until netns async cleanup is done. ++ devlink_wait 2000 ++ + log_test "netns reload test" + } + +@@ -348,6 +363,9 @@ resource_test() + ip netns del testns2 + ip netns del testns1 + ++ # Wait until netns async cleanup is done. ++ devlink_wait 2000 ++ + log_test "resource test" + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-325-drm-Fix-potential-null-ptr-deref-due-to-drmm_mo.patch b/patches.kernel.org/6.2.3-325-drm-Fix-potential-null-ptr-deref-due-to-drmm_mo.patch new file mode 100644 index 0000000..294150a --- /dev/null +++ b/patches.kernel.org/6.2.3-325-drm-Fix-potential-null-ptr-deref-due-to-drmm_mo.patch @@ -0,0 +1,82 @@ +From: Shang XiaoJing +Date: Fri, 18 Nov 2022 10:16:51 +0800 +Subject: [PATCH] drm: Fix potential null-ptr-deref due to + drmm_mode_config_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 834c23e4f798dcdc8af251b3c428ceef94741991 + +[ Upstream commit 834c23e4f798dcdc8af251b3c428ceef94741991 ] + +drmm_mode_config_init() will call drm_mode_create_standard_properties() +and won't check the ret value. When drm_mode_create_standard_properties() +failed due to alloc, property will be a NULL pointer and may causes the +null-ptr-deref. Fix the null-ptr-deref by adding the ret value check. + +Found null-ptr-deref while testing insert module bochs: +general protection fault, probably for non-canonical address + 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI +KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] +CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 +RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm] +Call Trace: + + __drm_connector_init+0xb6c/0x1100 [drm] + bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs] + pci_device_probe+0x17d/0x340 + really_probe+0x1db/0x5d0 + __driver_probe_device+0x1e7/0x250 + driver_probe_device+0x4a/0x120 + __driver_attach+0xcd/0x2c0 + bus_for_each_dev+0x11a/0x1b0 + bus_add_driver+0x3d7/0x500 + driver_register+0x18e/0x320 + do_one_initcall+0xc4/0x3e0 + do_init_module+0x1b4/0x630 + load_module+0x5dca/0x7230 + __do_sys_finit_module+0x100/0x170 + do_syscall_64+0x3f/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7ff65af9f839 + +Fixes: 6b4959f43a04 ("drm/atomic: atomic plane properties") +Signed-off-by: Shang XiaoJing +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20221118021651.2460-1-shangxiaojing@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_mode_config.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c +index 688c8afe..8525ef85 100644 +--- a/drivers/gpu/drm/drm_mode_config.c ++++ b/drivers/gpu/drm/drm_mode_config.c +@@ -399,6 +399,8 @@ static void drm_mode_config_init_release(struct drm_device *dev, void *ptr) + */ + int drmm_mode_config_init(struct drm_device *dev) + { ++ int ret; ++ + mutex_init(&dev->mode_config.mutex); + drm_modeset_lock_init(&dev->mode_config.connection_mutex); + mutex_init(&dev->mode_config.idr_mutex); +@@ -420,7 +422,11 @@ int drmm_mode_config_init(struct drm_device *dev) + init_llist_head(&dev->mode_config.connector_free_list); + INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn); + +- drm_mode_create_standard_properties(dev); ++ ret = drm_mode_create_standard_properties(dev); ++ if (ret) { ++ drm_mode_config_cleanup(dev); ++ return ret; ++ } + + /* Just to be sure */ + dev->mode_config.num_fb = 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-326-drm-fourcc-Add-missing-big-endian-XRGB1555-and-.patch b/patches.kernel.org/6.2.3-326-drm-fourcc-Add-missing-big-endian-XRGB1555-and-.patch new file mode 100644 index 0000000..e49d132 --- /dev/null +++ b/patches.kernel.org/6.2.3-326-drm-fourcc-Add-missing-big-endian-XRGB1555-and-.patch @@ -0,0 +1,52 @@ +From: Geert Uytterhoeven +Date: Wed, 23 Nov 2022 17:43:10 +0100 +Subject: [PATCH] drm/fourcc: Add missing big-endian XRGB1555 and RGB565 + formats +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6fb6c979ca628583d4d0c59a0f8ff977e581ecc0 + +[ Upstream commit 6fb6c979ca628583d4d0c59a0f8ff977e581ecc0 ] + +As of commit eae06120f1974e1a ("drm: refuse ADDFB2 ioctl for broken +bigendian drivers"), drivers must set the +quirk_addfb_prefer_host_byte_order quirk to make the drm_mode_addfb() +compat code work correctly on big-endian machines. + +While that works fine for big-endian XRGB8888 and ARGB8888, which are +mapped to the existing little-endian BGRX8888 and BGRA8888 formats, it +does not work for big-endian XRGB1555 and RGB565, as the latter are not +listed in the format database. + +Fix this by adding the missing formats. Limit this to big-endian +platforms, as there is currently no need to support these formats on +little-endian platforms. + +Fixes: 6960e6da9cec3f66 ("drm: fix drm_mode_addfb() on big endian machines.") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/3ee1f8144feb96c28742b22384189f1f83bcfc1a.1669221671.git.geert@linux-m68k.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_fourcc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c +index 6242dfbe..0f17dfa8 100644 +--- a/drivers/gpu/drm/drm_fourcc.c ++++ b/drivers/gpu/drm/drm_fourcc.c +@@ -190,6 +190,10 @@ const struct drm_format_info *__drm_format_info(u32 format) + { .format = DRM_FORMAT_BGRA5551, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1, .has_alpha = true }, + { .format = DRM_FORMAT_RGB565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_BGR565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, ++#ifdef __BIG_ENDIAN ++ { .format = DRM_FORMAT_XRGB1555 | DRM_FORMAT_BIG_ENDIAN, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, ++ { .format = DRM_FORMAT_RGB565 | DRM_FORMAT_BIG_ENDIAN, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, ++#endif + { .format = DRM_FORMAT_RGB888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_BGR888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_XRGB8888, .depth = 24, .num_planes = 1, .cpp = { 4, 0, 0 }, .hsub = 1, .vsub = 1 }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-327-drm-bridge-ti-sn65dsi83-Fix-delay-after-reset-d.patch b/patches.kernel.org/6.2.3-327-drm-bridge-ti-sn65dsi83-Fix-delay-after-reset-d.patch new file mode 100644 index 0000000..f374777 --- /dev/null +++ b/patches.kernel.org/6.2.3-327-drm-bridge-ti-sn65dsi83-Fix-delay-after-reset-d.patch @@ -0,0 +1,41 @@ +From: Frieder Schrempf +Date: Tue, 22 Nov 2022 09:12:18 +0100 +Subject: [PATCH] drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to + match spec +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4b03d5e0d3e86ee492d54254927d020dc0fe8acf + +[ Upstream commit 4b03d5e0d3e86ee492d54254927d020dc0fe8acf ] + +The datasheet specifies a delay of 10 milliseconds, but the current +driver only waits for 1 ms. Fix this to make sure the initialization +sequence meets the spec. + +Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver") +Signed-off-by: Frieder Schrempf +Reviewed-by: Alexander Stein +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20221122081219.20143-1-frieder@fris.de +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +index 7ba9467f..047c14dd 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +@@ -346,7 +346,7 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge, + + /* Deassert reset */ + gpiod_set_value_cansleep(ctx->enable_gpio, 1); +- usleep_range(1000, 1100); ++ usleep_range(10000, 11000); + + /* Get the LVDS format from the bridge state. */ + bridge_state = drm_atomic_get_new_bridge_state(state, bridge); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-328-drm-mxsfb-DRM_IMX_LCDIF-should-depend-on-ARCH_M.patch b/patches.kernel.org/6.2.3-328-drm-mxsfb-DRM_IMX_LCDIF-should-depend-on-ARCH_M.patch new file mode 100644 index 0000000..131060c --- /dev/null +++ b/patches.kernel.org/6.2.3-328-drm-mxsfb-DRM_IMX_LCDIF-should-depend-on-ARCH_M.patch @@ -0,0 +1,40 @@ +From: Geert Uytterhoeven +Date: Mon, 21 Nov 2022 17:00:48 +0100 +Subject: [PATCH] drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 10ef5f2992006720318b9886961820155b3750fd + +[ Upstream commit 10ef5f2992006720318b9886961820155b3750fd ] + +The Freescale/NXP i.MX LCDIFv3 LCD controller is only present on +Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXC, to prevent +asking the user about this driver when configuring a kernel without +Freescale/NXP i.MX support. + +Fixes: 9db35bb349a0ef32 ("drm: lcdif: Add support for i.MX8MP LCDIF variant") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Marek Vasut +Signed-off-by: Marek Vasut +Link: https://patchwork.freedesktop.org/patch/msgid/6103c1aa65a7888c12d351ae63f29850f29f42b9.1669046403.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/mxsfb/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig +index 116f8168..aa4b0eb2 100644 +--- a/drivers/gpu/drm/mxsfb/Kconfig ++++ b/drivers/gpu/drm/mxsfb/Kconfig +@@ -24,6 +24,7 @@ config DRM_IMX_LCDIF + tristate "i.MX LCDIFv3 LCD controller" + depends on DRM && OF + depends on COMMON_CLK ++ depends on ARCH_MXC || COMPILE_TEST + select DRM_MXS + select DRM_KMS_HELPER + select DRM_GEM_DMA_HELPER +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-329-drm-mxsfb-DRM_MXSFB-should-depend-on-ARCH_MXS-A.patch b/patches.kernel.org/6.2.3-329-drm-mxsfb-DRM_MXSFB-should-depend-on-ARCH_MXS-A.patch new file mode 100644 index 0000000..a8266ca --- /dev/null +++ b/patches.kernel.org/6.2.3-329-drm-mxsfb-DRM_MXSFB-should-depend-on-ARCH_MXS-A.patch @@ -0,0 +1,40 @@ +From: Geert Uytterhoeven +Date: Mon, 21 Nov 2022 16:59:55 +0100 +Subject: [PATCH] drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7783cc67862f9166c901bfa0f80b717aa8d354dd + +[ Upstream commit 7783cc67862f9166c901bfa0f80b717aa8d354dd ] + +Freescale/NXP i.MX LCDIF and eLCDIF LCD controllers are only present on +Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXS || +ARCH_MXC, to prevent asking the user about this driver when configuring +a kernel without Freescale/NXP i.MX support. + +Fixes: 45d59d704080cc0c ("drm: Add new driver for MXSFB controller") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Marek Vasut +Signed-off-by: Marek Vasut +Link: https://patchwork.freedesktop.org/patch/msgid/98e74779ca2bc575d91afff03369e86b080c01ac.1669046358.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/mxsfb/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig +index aa4b0eb2..518b5334 100644 +--- a/drivers/gpu/drm/mxsfb/Kconfig ++++ b/drivers/gpu/drm/mxsfb/Kconfig +@@ -8,6 +8,7 @@ config DRM_MXSFB + tristate "i.MX (e)LCDIF LCD controller" + depends on DRM && OF + depends on COMMON_CLK ++ depends on ARCH_MXS || ARCH_MXC || COMPILE_TEST + select DRM_MXS + select DRM_KMS_HELPER + select DRM_GEM_DMA_HELPER +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-330-drm-bridge-megachips-Fix-error-handling-in-i2c_.patch b/patches.kernel.org/6.2.3-330-drm-bridge-megachips-Fix-error-handling-in-i2c_.patch new file mode 100644 index 0000000..d051199 --- /dev/null +++ b/patches.kernel.org/6.2.3-330-drm-bridge-megachips-Fix-error-handling-in-i2c_.patch @@ -0,0 +1,67 @@ +From: Yuan Can +Date: Tue, 8 Nov 2022 09:12:26 +0000 +Subject: [PATCH] drm/bridge: megachips: Fix error handling in + i2c_register_driver() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4ecff954c370b82bce45bdca2846c5c5563e8a8a + +[ Upstream commit 4ecff954c370b82bce45bdca2846c5c5563e8a8a ] + +A problem about insmod megachips-stdpxxxx-ge-b850v3-fw.ko failed is +triggered with the following log given: + +[ 4497.981497] Error: Driver 'stdp4028-ge-b850v3-fw' is already registered, aborting... +insmod: ERROR: could not insert module megachips-stdpxxxx-ge-b850v3-fw.ko: Device or resource busy + +The reason is that stdpxxxx_ge_b850v3_init() returns i2c_add_driver() +directly without checking its return value, if i2c_add_driver() failed, +it returns without calling i2c_del_driver() on the previous i2c driver, +resulting the megachips-stdpxxxx-ge-b850v3-fw can never be installed +later. +A simple call graph is shown as below: + + stdpxxxx_ge_b850v3_init() + i2c_add_driver(&stdp4028_ge_b850v3_fw_driver) + i2c_add_driver(&stdp2690_ge_b850v3_fw_driver) + i2c_register_driver() + driver_register() + bus_add_driver() + priv = kzalloc(...) # OOM happened + # return without delete stdp4028_ge_b850v3_fw_driver + +Fix by calling i2c_del_driver() on stdp4028_ge_b850v3_fw_driver when +i2c_add_driver() returns error. + +Fixes: fcfa0ddc18ed ("drm/bridge: Drivers for megachips-stdpxxxx-ge-b850v3-fw (LVDS-DP++)") +Signed-off-by: Yuan Can +Reviewed-by: Andrzej Hajda +Tested-by: Ian Ray +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20221108091226.114524-1-yuancan@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +index 97359f80..cbfa05a6 100644 +--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c ++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +@@ -440,7 +440,11 @@ static int __init stdpxxxx_ge_b850v3_init(void) + if (ret) + return ret; + +- return i2c_add_driver(&stdp2690_ge_b850v3_fw_driver); ++ ret = i2c_add_driver(&stdp2690_ge_b850v3_fw_driver); ++ if (ret) ++ i2c_del_driver(&stdp4028_ge_b850v3_fw_driver); ++ ++ return ret; + } + module_init(stdpxxxx_ge_b850v3_init); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-331-drm-vkms-Fix-memory-leak-in-vkms_init.patch b/patches.kernel.org/6.2.3-331-drm-vkms-Fix-memory-leak-in-vkms_init.patch new file mode 100644 index 0000000..6cdf4ce --- /dev/null +++ b/patches.kernel.org/6.2.3-331-drm-vkms-Fix-memory-leak-in-vkms_init.patch @@ -0,0 +1,76 @@ +From: Yuan Can +Date: Tue, 1 Nov 2022 06:51:55 +0000 +Subject: [PATCH] drm/vkms: Fix memory leak in vkms_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0d0b368b9d104b437e1f4850ae94bdb9a3601e89 + +[ Upstream commit 0d0b368b9d104b437e1f4850ae94bdb9a3601e89 ] + +A memory leak was reported after the vkms module install failed. + +unreferenced object 0xffff88810bc28520 (size 16): + comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s) + hex dump (first 16 bytes): + 01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff ...d............ + backtrace: + [<00000000e7561ff8>] kmalloc_trace+0x27/0x60 + [<000000000b1954a0>] 0xffffffffc45200a9 + [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0 + [<000000001505ee87>] do_init_module+0x1a4/0x680 + [<00000000958079ad>] load_module+0x6249/0x7110 + [<00000000117e4696>] __do_sys_finit_module+0x140/0x200 + [<00000000f74b12d2>] do_syscall_64+0x35/0x80 + [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +The reason is that the vkms_init() returns without checking the return +value of vkms_create(), and if the vkms_create() failed, the config +allocated at the beginning of vkms_init() is leaked. + + vkms_init() + config = kmalloc(...) # config allocated + ... + return vkms_create() # vkms_create failed and config is leaked + +Fix this problem by checking return value of vkms_create() and free the +config if error happened. + +Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type") +Signed-off-by: Yuan Can +Reviewed-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-2-yuancan@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vkms/vkms_drv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c +index 293dbca5..8a74f37d 100644 +--- a/drivers/gpu/drm/vkms/vkms_drv.c ++++ b/drivers/gpu/drm/vkms/vkms_drv.c +@@ -218,6 +218,7 @@ static int vkms_create(struct vkms_config *config) + + static int __init vkms_init(void) + { ++ int ret; + struct vkms_config *config; + + config = kmalloc(sizeof(*config), GFP_KERNEL); +@@ -230,7 +231,11 @@ static int __init vkms_init(void) + config->writeback = enable_writeback; + config->overlay = enable_overlay; + +- return vkms_create(config); ++ ret = vkms_create(config); ++ if (ret) ++ kfree(config); ++ ++ return ret; + } + + static void vkms_destroy(struct vkms_config *config) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-332-drm-vkms-Fix-null-ptr-deref-in-vkms_release.patch b/patches.kernel.org/6.2.3-332-drm-vkms-Fix-null-ptr-deref-in-vkms_release.patch new file mode 100644 index 0000000..e679657 --- /dev/null +++ b/patches.kernel.org/6.2.3-332-drm-vkms-Fix-null-ptr-deref-in-vkms_release.patch @@ -0,0 +1,80 @@ +From: Yuan Can +Date: Tue, 1 Nov 2022 06:51:56 +0000 +Subject: [PATCH] drm/vkms: Fix null-ptr-deref in vkms_release() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5 + +[ Upstream commit 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5 ] + +A null-ptr-deref is triggered when it tries to destroy the workqueue in +vkms->output.composer_workq in vkms_release(). + + KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] + CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24 + RIP: 0010:destroy_workqueue+0x2f/0x710 + ... + Call Trace: + + ? vkms_config_debugfs_init+0x50/0x50 [vkms] + __devm_drm_dev_alloc+0x15a/0x1c0 [drm] + vkms_init+0x245/0x1000 [vkms] + do_one_initcall+0xd0/0x4f0 + do_init_module+0x1a4/0x680 + load_module+0x6249/0x7110 + __do_sys_finit_module+0x140/0x200 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +The reason is that an OOM happened which triggers the destroy of the +workqueue, however, the workqueue is alloced in the later process, +thus a null-ptr-deref happened. A simple call graph is shown as below: + + vkms_init() + vkms_create() + devm_drm_dev_alloc() + __devm_drm_dev_alloc() + devm_drm_dev_init() + devm_add_action_or_reset() + devm_add_action() # an error happened + devm_drm_dev_init_release() + drm_dev_put() + kref_put() + drm_dev_release() + vkms_release() + destroy_workqueue() # null-ptr-deref happened + vkms_modeset_init() + vkms_output_init() + vkms_crtc_init() # where the workqueue get allocated + +Fix this by checking if composer_workq is NULL before passing it to +the destroy_workqueue() in vkms_release(). + +Fixes: 6c234fe37c57 ("drm/vkms: Implement CRC debugfs API") +Signed-off-by: Yuan Can +Reviewed-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-3-yuancan@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vkms/vkms_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c +index 8a74f37d..69346906 100644 +--- a/drivers/gpu/drm/vkms/vkms_drv.c ++++ b/drivers/gpu/drm/vkms/vkms_drv.c +@@ -57,7 +57,8 @@ static void vkms_release(struct drm_device *dev) + { + struct vkms_device *vkms = drm_device_to_vkms_device(dev); + +- destroy_workqueue(vkms->output.composer_workq); ++ if (vkms->output.composer_workq) ++ destroy_workqueue(vkms->output.composer_workq); + } + + static void vkms_atomic_commit_tail(struct drm_atomic_state *old_state) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-333-drm-modes-Use-strscpy-to-copy-command-line-mode.patch b/patches.kernel.org/6.2.3-333-drm-modes-Use-strscpy-to-copy-command-line-mode.patch new file mode 100644 index 0000000..687a730 --- /dev/null +++ b/patches.kernel.org/6.2.3-333-drm-modes-Use-strscpy-to-copy-command-line-mode.patch @@ -0,0 +1,41 @@ +From: Maxime Ripard +Date: Mon, 28 Nov 2022 09:19:37 +0100 +Subject: [PATCH] drm/modes: Use strscpy() to copy command-line mode name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0f9aa074c92dd9274b811c1c3fa93736814a4b0d + +[ Upstream commit 0f9aa074c92dd9274b811c1c3fa93736814a4b0d ] + +The mode name in struct drm_cmdline_mode can hold 32 characters at most, +which can easily get overrun. Switch to strscpy() to prevent such a +thing. + +Reported-by: coverity-bot +Addresses-Coverity-ID: 1527354 ("Security best practices violations") +Fixes: a7ab155397dd ("drm/modes: Switch to named mode descriptors") +Reviewed-by: Javier Martinez Canillas +Link: https://lore.kernel.org/r/20221128081938.742410-2-maxime@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_modes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c +index 3c8034a8..951afe82 100644 +--- a/drivers/gpu/drm/drm_modes.c ++++ b/drivers/gpu/drm/drm_modes.c +@@ -1809,7 +1809,7 @@ static int drm_mode_parse_cmdline_named_mode(const char *name, + if (ret != name_end) + continue; + +- strcpy(cmdline_mode->name, mode->name); ++ strscpy(cmdline_mode->name, mode->name, sizeof(cmdline_mode->name)); + cmdline_mode->pixel_clock = mode->pixel_clock_khz; + cmdline_mode->xres = mode->xres; + cmdline_mode->yres = mode->yres; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-334-drm-vc4-dpi-Fix-format-mapping-for-RGB565.patch b/patches.kernel.org/6.2.3-334-drm-vc4-dpi-Fix-format-mapping-for-RGB565.patch new file mode 100644 index 0000000..5e5e5f7 --- /dev/null +++ b/patches.kernel.org/6.2.3-334-drm-vc4-dpi-Fix-format-mapping-for-RGB565.patch @@ -0,0 +1,39 @@ +From: Dave Stevenson +Date: Thu, 1 Dec 2022 09:42:52 +0100 +Subject: [PATCH] drm/vc4: dpi: Fix format mapping for RGB565 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0870d86eac8a9abd89a0be1b719d5dc5bac936f0 + +[ Upstream commit 0870d86eac8a9abd89a0be1b719d5dc5bac936f0 ] + +The mapping is incorrect for RGB565_1X16 as it should be +DPI_FORMAT_18BIT_666_RGB_1 instead of DPI_FORMAT_18BIT_666_RGB_3. + +Fixes: 08302c35b59d ("drm/vc4: Add DPI driver") +Signed-off-by: Dave Stevenson +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20221013-rpi-dpi-improvements-v3-7-eb76e26a772d@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vc4/vc4_dpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c +index 1f8f44b7..61ef7d23 100644 +--- a/drivers/gpu/drm/vc4/vc4_dpi.c ++++ b/drivers/gpu/drm/vc4/vc4_dpi.c +@@ -179,7 +179,7 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) + DPI_FORMAT); + break; + case MEDIA_BUS_FMT_RGB565_1X16: +- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3, ++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_1, + DPI_FORMAT); + break; + default: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-335-drm-bridge-it6505-Guard-bridge-power-in-IRQ-han.patch b/patches.kernel.org/6.2.3-335-drm-bridge-it6505-Guard-bridge-power-in-IRQ-han.patch new file mode 100644 index 0000000..b84e5ea --- /dev/null +++ b/patches.kernel.org/6.2.3-335-drm-bridge-it6505-Guard-bridge-power-in-IRQ-han.patch @@ -0,0 +1,84 @@ +From: Pin-yen Lin +Date: Wed, 9 Nov 2022 17:52:27 +0800 +Subject: [PATCH] drm/bridge: it6505: Guard bridge power in IRQ handler +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5eb9a4314053bda7642643f70f49a2b415920812 + +[ Upstream commit 5eb9a4314053bda7642643f70f49a2b415920812 ] + +Add a pair of pm_runtime_get_if_in_use and pm_runtime_put_sync in the +interrupt handler to make sure the bridge won't be powered off during +the interrupt handlings. Also remove the irq_lock mutex because it's not +guarding anything now. + +Fixes: ab28896f1a83 ("drm/bridge: it6505: Improve synchronization between extcon subsystem") +Signed-off-by: Pin-yen Lin +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20221109095227.3320919-1-treapking@chromium.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/ite-it6505.c | 22 ++++++++-------------- + 1 file changed, 8 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index 21a9b842..e7f7d0ce 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -412,7 +412,6 @@ struct it6505 { + * Mutex protects extcon and interrupt functions from interfering + * each other. + */ +- struct mutex irq_lock; + struct mutex extcon_lock; + struct mutex mode_lock; /* used to bridge_detect */ + struct mutex aux_lock; /* used to aux data transfers */ +@@ -2494,10 +2493,8 @@ static irqreturn_t it6505_int_threaded_handler(int unused, void *data) + }; + int int_status[3], i; + +- mutex_lock(&it6505->irq_lock); +- +- if (it6505->enable_drv_hold || !it6505->powered) +- goto unlock; ++ if (it6505->enable_drv_hold || pm_runtime_get_if_in_use(dev) <= 0) ++ return IRQ_HANDLED; + + int_status[0] = it6505_read(it6505, INT_STATUS_01); + int_status[1] = it6505_read(it6505, INT_STATUS_02); +@@ -2515,16 +2512,14 @@ static irqreturn_t it6505_int_threaded_handler(int unused, void *data) + if (it6505_test_bit(irq_vec[0].bit, (unsigned int *)int_status)) + irq_vec[0].handler(it6505); + +- if (!it6505->hpd_state) +- goto unlock; +- +- for (i = 1; i < ARRAY_SIZE(irq_vec); i++) { +- if (it6505_test_bit(irq_vec[i].bit, (unsigned int *)int_status)) +- irq_vec[i].handler(it6505); ++ if (it6505->hpd_state) { ++ for (i = 1; i < ARRAY_SIZE(irq_vec); i++) { ++ if (it6505_test_bit(irq_vec[i].bit, (unsigned int *)int_status)) ++ irq_vec[i].handler(it6505); ++ } + } + +-unlock: +- mutex_unlock(&it6505->irq_lock); ++ pm_runtime_put_sync(dev); + + return IRQ_HANDLED; + } +@@ -3277,7 +3272,6 @@ static int it6505_i2c_probe(struct i2c_client *client, + if (!it6505) + return -ENOMEM; + +- mutex_init(&it6505->irq_lock); + mutex_init(&it6505->extcon_lock); + mutex_init(&it6505->mode_lock); + mutex_init(&it6505->aux_lock); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-336-drm-tidss-Fix-pixel-format-definition.patch b/patches.kernel.org/6.2.3-336-drm-tidss-Fix-pixel-format-definition.patch new file mode 100644 index 0000000..6f59292 --- /dev/null +++ b/patches.kernel.org/6.2.3-336-drm-tidss-Fix-pixel-format-definition.patch @@ -0,0 +1,46 @@ +From: Randolph Sapp +Date: Thu, 1 Dec 2022 18:18:03 -0600 +Subject: [PATCH] drm: tidss: Fix pixel format definition +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2df0433b18f2735a49d2c3a968b40fa2881137c0 + +[ Upstream commit 2df0433b18f2735a49d2c3a968b40fa2881137c0 ] + +There was a long-standing bug from a typo that created 2 ARGB1555 and +ABGR1555 pixel format entries. Weston 10 has a sanity check that alerted +me to this issue. + +According to the Supported Pixel Data formats table we have the later +entries should have been for Alpha-X instead. + +Signed-off-by: Randolph Sapp +Fixes: 32a1795f57eecc ("drm/tidss: New driver for TI Keystone platform Display SubSystem") +Reviewed-by: Aradhya Bhatia +Acked-by: Andrew Davis +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20221202001803.1765805-1-rs@ti.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/tidss/tidss_dispc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c +index ad93acc9..16301bdf 100644 +--- a/drivers/gpu/drm/tidss/tidss_dispc.c ++++ b/drivers/gpu/drm/tidss/tidss_dispc.c +@@ -1858,8 +1858,8 @@ static const struct { + { DRM_FORMAT_XBGR4444, 0x21, }, + { DRM_FORMAT_RGBX4444, 0x22, }, + +- { DRM_FORMAT_ARGB1555, 0x25, }, +- { DRM_FORMAT_ABGR1555, 0x26, }, ++ { DRM_FORMAT_XRGB1555, 0x25, }, ++ { DRM_FORMAT_XBGR1555, 0x26, }, + + { DRM_FORMAT_XRGB8888, 0x27, }, + { DRM_FORMAT_XBGR8888, 0x28, }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-337-gpu-ipu-v3-common-Add-of_node_put-for-reference.patch b/patches.kernel.org/6.2.3-337-gpu-ipu-v3-common-Add-of_node_put-for-reference.patch new file mode 100644 index 0000000..d53a503 --- /dev/null +++ b/patches.kernel.org/6.2.3-337-gpu-ipu-v3-common-Add-of_node_put-for-reference.patch @@ -0,0 +1,40 @@ +From: Liang He +Date: Wed, 20 Jul 2022 23:22:27 +0800 +Subject: [PATCH] gpu: ipu-v3: common: Add of_node_put() for reference returned + by of_graph_get_port_by_id() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f + +[ Upstream commit 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f ] + +In ipu_add_client_devices(), we need to call of_node_put() for +reference returned by of_graph_get_port_by_id() in fail path. + +Fixes: 17e052175039 ("gpu: ipu-v3: Do not bail out on missing optional port nodes") +Signed-off-by: Liang He +Reviewed-by: Philipp Zabel +Link: https://lore.kernel.org/r/20220720152227.1288413-1-windhl@126.com +Signed-off-by: Philipp Zabel +Link: https://patchwork.freedesktop.org/patch/msgid/20220720152227.1288413-1-windhl@126.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/ipu-v3/ipu-common.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c +index 11831851..c35eac11 100644 +--- a/drivers/gpu/ipu-v3/ipu-common.c ++++ b/drivers/gpu/ipu-v3/ipu-common.c +@@ -1165,6 +1165,7 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) + pdev = platform_device_alloc(reg->name, id++); + if (!pdev) { + ret = -ENOMEM; ++ of_node_put(of_node); + goto err_register; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-338-drm-ast-Init-iosys_map-pointer-as-I-O-memory-fo.patch b/patches.kernel.org/6.2.3-338-drm-ast-Init-iosys_map-pointer-as-I-O-memory-fo.patch new file mode 100644 index 0000000..a8969a9 --- /dev/null +++ b/patches.kernel.org/6.2.3-338-drm-ast-Init-iosys_map-pointer-as-I-O-memory-fo.patch @@ -0,0 +1,51 @@ +From: Thomas Zimmermann +Date: Fri, 16 Dec 2022 20:30:05 +0100 +Subject: [PATCH] drm/ast: Init iosys_map pointer as I/O memory for damage + handling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b1def7fadfa544bd2467581ce40b659583eb7e79 + +[ Upstream commit b1def7fadfa544bd2467581ce40b659583eb7e79 ] + +Ast hardware scans out the primary plane from video memory, which +is in I/O-memory space. Hence init the damage handler's iosys_map +pointer as I/O memory. + +Not all platforms support accessing I/O memory as system memory, +although it's usually not a problem in ast's x86-based systems. + +The error report is at [1]. + +Reported-by: kernel test robot +Signed-off-by: Thomas Zimmermann +Reviewed-by: Jocelyn Falempe +Fixes: f2fa5a99ca81 ("drm/ast: Convert ast to SHMEM") +Cc: Thomas Zimmermann +Cc: Jocelyn Falempe +Cc: Dave Airlie +Cc: dri-devel@lists.freedesktop.org +Link: https://lore.kernel.org/lkml/202212170111.eInM0unS-lkp@intel.com/T/#u # 1 +Link: https://patchwork.freedesktop.org/patch/msgid/20221216193005.30280-1-tzimmermann@suse.de +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/ast/ast_mode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c +index 66a4a41c..d314b9e7 100644 +--- a/drivers/gpu/drm/ast/ast_mode.c ++++ b/drivers/gpu/drm/ast/ast_mode.c +@@ -636,7 +636,7 @@ static void ast_handle_damage(struct ast_plane *ast_plane, struct iosys_map *src + struct drm_framebuffer *fb, + const struct drm_rect *clip) + { +- struct iosys_map dst = IOSYS_MAP_INIT_VADDR(ast_plane->vaddr); ++ struct iosys_map dst = IOSYS_MAP_INIT_VADDR_IOMEM(ast_plane->vaddr); + + iosys_map_incr(&dst, drm_fb_clip_offset(fb->pitches[0], fb->format, clip)); + drm_fb_memcpy(&dst, fb->pitches, src, fb, clip); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-339-drm-vc4-drop-all-currently-held-locks-if-deadlo.patch b/patches.kernel.org/6.2.3-339-drm-vc4-drop-all-currently-held-locks-if-deadlo.patch new file mode 100644 index 0000000..df71156 --- /dev/null +++ b/patches.kernel.org/6.2.3-339-drm-vc4-drop-all-currently-held-locks-if-deadlo.patch @@ -0,0 +1,107 @@ +From: =?UTF-8?q?Ma=C3=ADra=20Canal?= +Date: Thu, 29 Dec 2022 16:46:38 -0300 +Subject: [PATCH] drm/vc4: drop all currently held locks if deadlock happens +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 479d4f0be4237ba33bc9432787aeb62c90e30f95 + +[ Upstream commit 479d4f0be4237ba33bc9432787aeb62c90e30f95 ] + +If vc4_hdmi_reset_link() returns -EDEADLK, it means that a deadlock +happened in the locking context. This situation should be addressed by +dropping all currently held locks and block until the contended lock +becomes available. Currently, vc4 is not dealing with the deadlock +properly, producing the following output when PROVE_LOCKING is enabled: + +[ 825.612809] ------------[ cut here ]------------ +[ 825.612852] WARNING: CPU: 1 PID: 116 at drivers/gpu/drm/drm_modeset_lock.c:276 drm_modeset_drop_locks+0x60/0x68 [drm] +[ 825.613458] Modules linked in: 8021q mrp garp stp llc +raspberrypi_cpufreq brcmfmac brcmutil crct10dif_ce hci_uart cfg80211 +btqca btbcm bluetooth vc4 raspberrypi_hwmon snd_soc_hdmi_codec cec +clk_raspberrypi ecdh_generic drm_display_helper ecc rfkill +drm_dma_helper drm_kms_helper pwm_bcm2835 bcm2835_thermal bcm2835_rng +rng_core i2c_bcm2835 drm fuse ip_tables x_tables ipv6 +[ 825.613735] CPU: 1 PID: 116 Comm: kworker/1:2 Tainted: G W 6.1.0-rc6-01399-g941aae326315 #3 +[ 825.613759] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) +[ 825.613777] Workqueue: events output_poll_execute [drm_kms_helper] +[ 825.614038] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 825.614063] pc : drm_modeset_drop_locks+0x60/0x68 [drm] +[ 825.614603] lr : drm_helper_probe_detect+0x120/0x1b4 [drm_kms_helper] +[ 825.614829] sp : ffff800008313bf0 +[ 825.614844] x29: ffff800008313bf0 x28: ffffcd7778b8b000 x27: 0000000000000000 +[ 825.614883] x26: 0000000000000001 x25: 0000000000000001 x24: ffff677cc35c2758 +[ 825.614920] x23: ffffcd7707d01430 x22: ffffcd7707c3edc7 x21: 0000000000000001 +[ 825.614958] x20: 0000000000000000 x19: ffff800008313c10 x18: 000000000000b6d3 +[ 825.614995] x17: ffffcd777835e214 x16: ffffcd7777cef870 x15: fffff81000000000 +[ 825.615033] x14: 0000000000000000 x13: 0000000000000099 x12: 0000000000000002 +[ 825.615070] x11: 72917988020af800 x10: 72917988020af800 x9 : 72917988020af800 +[ 825.615108] x8 : ffff677cc665e0a8 x7 : d00a8c180000110c x6 : ffffcd77774c0054 +[ 825.615145] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 +[ 825.615181] x2 : ffff677cc55e1880 x1 : ffffcd7777cef8ec x0 : ffff800008313c10 +[ 825.615219] Call trace: +[ 825.615232] drm_modeset_drop_locks+0x60/0x68 [drm] +[ 825.615773] drm_helper_probe_detect+0x120/0x1b4 [drm_kms_helper] +[ 825.616003] output_poll_execute+0xe4/0x224 [drm_kms_helper] +[ 825.616233] process_one_work+0x2b4/0x618 +[ 825.616264] worker_thread+0x24c/0x464 +[ 825.616288] kthread+0xec/0x110 +[ 825.616310] ret_from_fork+0x10/0x20 +[ 825.616335] irq event stamp: 7634 +[ 825.616349] hardirqs last enabled at (7633): [] _raw_spin_unlock_irq+0x3c/0x78 +[ 825.616384] hardirqs last disabled at (7634): [] __schedule+0x134/0x9f0 +[ 825.616411] softirqs last enabled at (7630): [] local_bh_enable+0x4/0x30 [ipv6] +[ 825.617019] softirqs last disabled at (7618): [] local_bh_disable+0x4/0x30 [ipv6] +[ 825.617586] ---[ end trace 0000000000000000 ]--- + +Therefore, deal with the deadlock as suggested by [1], using the +function drm_modeset_backoff(). + +[1] https://docs.kernel.org/gpu/drm-kms.html?highlight=kms#kms-locking + +Fixes: 6bed2ea3cb38 ("drm/vc4: hdmi: Reset link on hotplug") +Reported-by: Stefan Wahren +Signed-off-by: Maíra Canal +Tested-by: Stefan Wahren +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20221229194638.178712-1-mcanal@igalia.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 7546103f..21338e6a 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -406,6 +406,7 @@ static void vc4_hdmi_handle_hotplug(struct vc4_hdmi *vc4_hdmi, + { + struct drm_connector *connector = &vc4_hdmi->connector; + struct edid *edid; ++ int ret; + + /* + * NOTE: This function should really be called with +@@ -434,7 +435,15 @@ static void vc4_hdmi_handle_hotplug(struct vc4_hdmi *vc4_hdmi, + cec_s_phys_addr_from_edid(vc4_hdmi->cec_adap, edid); + kfree(edid); + +- vc4_hdmi_reset_link(connector, ctx); ++ for (;;) { ++ ret = vc4_hdmi_reset_link(connector, ctx); ++ if (ret == -EDEADLK) { ++ drm_modeset_backoff(ctx); ++ continue; ++ } ++ ++ break; ++ } + } + + static int vc4_hdmi_connector_detect_ctx(struct drm_connector *connector, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-340-hwmon-ftsteutates-Fix-scaling-of-measurements.patch b/patches.kernel.org/6.2.3-340-hwmon-ftsteutates-Fix-scaling-of-measurements.patch new file mode 100644 index 0000000..e0fb719 --- /dev/null +++ b/patches.kernel.org/6.2.3-340-hwmon-ftsteutates-Fix-scaling-of-measurements.patch @@ -0,0 +1,125 @@ +From: Armin Wolf +Date: Sat, 24 Dec 2022 05:18:53 +0100 +Subject: [PATCH] hwmon: (ftsteutates) Fix scaling of measurements +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ca8fd8c16a8b77dfcf7f6ce52d2c863220693a78 + +[ Upstream commit ca8fd8c16a8b77dfcf7f6ce52d2c863220693a78 ] + +A user complained that the ftsteutates driver was displaying +bogus values since its introduction. This happens because the +sensor measurements need to be scaled in order to produce +meaningful results: +- the fan speed needs to be multiplied by 60 since its in RPS +- the temperature is in degrees celsius and needs an offset of 64 +- the voltage is in 1/256 of 3.3V + +The offical datasheet says the voltage needs to be divided by 256, +but this is likely an off-by-one-error, since even the BIOS +devides by 255 (otherwise 3.3V could not be measured). + +The voltage channels additionally need a board-specific multiplier, +however this can be done by the driver since its board-specific. + +The reason the missing scaling of measurements is the way Fujitsu +used this driver when it was still out-of-tree. Back then, all +scaling was done in userspace by libsensors, even the generic one. + +Tested on a Fujitsu DS3401-B1. + +Fixes: 08426eda58e0 ("hwmon: Add driver for FTS BMC chip "Teutates"") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20221224041855.83981-2-W_Armin@gmx.de +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + Documentation/hwmon/ftsteutates.rst | 4 ++++ + drivers/hwmon/ftsteutates.c | 19 +++++++++++++------ + 2 files changed, 17 insertions(+), 6 deletions(-) + +diff --git a/Documentation/hwmon/ftsteutates.rst b/Documentation/hwmon/ftsteutates.rst +index 58a2483d..198fa8e2 100644 +--- a/Documentation/hwmon/ftsteutates.rst ++++ b/Documentation/hwmon/ftsteutates.rst +@@ -22,6 +22,10 @@ enhancements. It can monitor up to 4 voltages, 16 temperatures and + 8 fans. It also contains an integrated watchdog which is currently + implemented in this driver. + ++The 4 voltages require a board-specific multiplier, since the BMC can ++only measure voltages up to 3.3V and thus relies on voltage dividers. ++Consult your motherboard manual for details. ++ + To clear a temperature or fan alarm, execute the following command with the + correct path to the alarm file:: + +diff --git a/drivers/hwmon/ftsteutates.c b/drivers/hwmon/ftsteutates.c +index f5b8e724..ffa0bb36 100644 +--- a/drivers/hwmon/ftsteutates.c ++++ b/drivers/hwmon/ftsteutates.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -347,13 +348,15 @@ static ssize_t in_value_show(struct device *dev, + { + struct fts_data *data = dev_get_drvdata(dev); + int index = to_sensor_dev_attr(devattr)->index; +- int err; ++ int value, err; + + err = fts_update_device(data); + if (err < 0) + return err; + +- return sprintf(buf, "%u\n", data->volt[index]); ++ value = DIV_ROUND_CLOSEST(data->volt[index] * 3300, 255); ++ ++ return sprintf(buf, "%d\n", value); + } + + static ssize_t temp_value_show(struct device *dev, +@@ -361,13 +364,15 @@ static ssize_t temp_value_show(struct device *dev, + { + struct fts_data *data = dev_get_drvdata(dev); + int index = to_sensor_dev_attr(devattr)->index; +- int err; ++ int value, err; + + err = fts_update_device(data); + if (err < 0) + return err; + +- return sprintf(buf, "%u\n", data->temp_input[index]); ++ value = (data->temp_input[index] - 64) * 1000; ++ ++ return sprintf(buf, "%d\n", value); + } + + static ssize_t temp_fault_show(struct device *dev, +@@ -436,13 +441,15 @@ static ssize_t fan_value_show(struct device *dev, + { + struct fts_data *data = dev_get_drvdata(dev); + int index = to_sensor_dev_attr(devattr)->index; +- int err; ++ int value, err; + + err = fts_update_device(data); + if (err < 0) + return err; + +- return sprintf(buf, "%u\n", data->fan_input[index]); ++ value = data->fan_input[index] * 60; ++ ++ return sprintf(buf, "%d\n", value); + } + + static ssize_t fan_source_show(struct device *dev, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-341-drm-msm-dpu-check-for-null-return-of-devm_kzall.patch b/patches.kernel.org/6.2.3-341-drm-msm-dpu-check-for-null-return-of-devm_kzall.patch new file mode 100644 index 0000000..2b7008b --- /dev/null +++ b/patches.kernel.org/6.2.3-341-drm-msm-dpu-check-for-null-return-of-devm_kzall.patch @@ -0,0 +1,44 @@ +From: Hui Tang +Date: Sat, 19 Nov 2022 13:55:18 +0800 +Subject: [PATCH] drm/msm/dpu: check for null return of devm_kzalloc() in + dpu_writeback_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 21e9a838f505178e109ccb3bf19d7808eb0326f4 + +[ Upstream commit 21e9a838f505178e109ccb3bf19d7808eb0326f4 ] + +Because of the possilble failure of devm_kzalloc(), dpu_wb_conn might +be NULL and will cause null pointer dereference later. + +Therefore, it might be better to check it and directly return -ENOMEM. + +Fixes: 77b001acdcfe ("drm/msm/dpu: add the writeback connector layer") +Signed-off-by: Hui Tang +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/512277/ +Link: https://lore.kernel.org/r/20221119055518.179937-1-tanghui20@huawei.com +[DB: fixed typo in commit message] +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c +index 088ec990..2a5a6836 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c +@@ -70,6 +70,8 @@ int dpu_writeback_init(struct drm_device *dev, struct drm_encoder *enc, + int rc = 0; + + dpu_wb_conn = devm_kzalloc(dev->dev, sizeof(*dpu_wb_conn), GFP_KERNEL); ++ if (!dpu_wb_conn) ++ return -ENOMEM; + + drm_connector_helper_add(&dpu_wb_conn->base.base, &dpu_wb_conn_helper_funcs); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-342-drm-msm-hdmi-Add-missing-check-for-alloc_ordere.patch b/patches.kernel.org/6.2.3-342-drm-msm-hdmi-Add-missing-check-for-alloc_ordere.patch new file mode 100644 index 0000000..a23f378 --- /dev/null +++ b/patches.kernel.org/6.2.3-342-drm-msm-hdmi-Add-missing-check-for-alloc_ordere.patch @@ -0,0 +1,43 @@ +From: Jiasheng Jiang +Date: Fri, 6 Jan 2023 10:30:11 +0800 +Subject: [PATCH] drm/msm/hdmi: Add missing check for alloc_ordered_workqueue +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: afe4cb96153a0d8003e4e4ebd91b5c543e10df84 + +[ Upstream commit afe4cb96153a0d8003e4e4ebd91b5c543e10df84 ] + +Add check for the return value of alloc_ordered_workqueue as it may return +NULL pointer and cause NULL pointer dereference in `hdmi_hdcp.c` and +`hdmi_hpd.c`. + +Fixes: c6a57a50ad56 ("drm/msm/hdmi: add hdmi hdcp support (V3)") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/517211/ +Link: https://lore.kernel.org/r/20230106023011.3985-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c +index 97372bb2..4ad36bc8 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -120,6 +120,10 @@ static int msm_hdmi_init(struct hdmi *hdmi) + int ret; + + hdmi->workq = alloc_ordered_workqueue("msm_hdmi", 0); ++ if (!hdmi->workq) { ++ ret = -ENOMEM; ++ goto fail; ++ } + + hdmi->i2c = msm_hdmi_i2c_init(hdmi); + if (IS_ERR(hdmi->i2c)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-343-pinctrl-qcom-pinctrl-msm8976-Correct-function-n.patch b/patches.kernel.org/6.2.3-343-pinctrl-qcom-pinctrl-msm8976-Correct-function-n.patch new file mode 100644 index 0000000..e2362b6 --- /dev/null +++ b/patches.kernel.org/6.2.3-343-pinctrl-qcom-pinctrl-msm8976-Correct-function-n.patch @@ -0,0 +1,52 @@ +From: Adam Skladowski +Date: Sat, 31 Dec 2022 17:42:50 +0100 +Subject: [PATCH] pinctrl: qcom: pinctrl-msm8976: Correct function names for + wcss pins +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a7cc0e2685082a0d79baec02df184dfa83cbfac3 + +[ Upstream commit a7cc0e2685082a0d79baec02df184dfa83cbfac3 ] + +Adjust names of function for wcss pins, also fix third gpio in bt group. + +Fixes: bcd11493f0ab ("pinctrl: qcom: Add a pinctrl driver for MSM8976 and 8956") +Signed-off-by: Adam Skladowski +Reviewed-by: Marijn Suijten +Link: https://lore.kernel.org/r/20221231164250.74550-1-a39.skl@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/qcom/pinctrl-msm8976.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm8976.c b/drivers/pinctrl/qcom/pinctrl-msm8976.c +index ec43edf9..e11d8458 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm8976.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm8976.c +@@ -733,7 +733,7 @@ static const char * const codec_int2_groups[] = { + "gpio74", + }; + static const char * const wcss_bt_groups[] = { +- "gpio39", "gpio47", "gpio88", ++ "gpio39", "gpio47", "gpio48", + }; + static const char * const sdc3_groups[] = { + "gpio39", "gpio40", "gpio41", +@@ -958,9 +958,9 @@ static const struct msm_pingroup msm8976_groups[] = { + PINGROUP(37, NA, NA, NA, qdss_tracedata_b, NA, NA, NA, NA, NA), + PINGROUP(38, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b, NA), + PINGROUP(39, wcss_bt, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), +- PINGROUP(40, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), +- PINGROUP(41, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), +- PINGROUP(42, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), ++ PINGROUP(40, wcss_wlan2, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), ++ PINGROUP(41, wcss_wlan1, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), ++ PINGROUP(42, wcss_wlan0, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), + PINGROUP(43, wcss_wlan, sdc3, NA, NA, qdss_tracedata_a, NA, NA, NA, NA), + PINGROUP(44, wcss_wlan, sdc3, NA, NA, NA, NA, NA, NA, NA), + PINGROUP(45, wcss_fm, NA, qdss_tracectl_a, NA, NA, NA, NA, NA, NA), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-344-pinctrl-stm32-Fix-refcount-leak-in-stm32_pctrl_.patch b/patches.kernel.org/6.2.3-344-pinctrl-stm32-Fix-refcount-leak-in-stm32_pctrl_.patch new file mode 100644 index 0000000..dd21a6d --- /dev/null +++ b/patches.kernel.org/6.2.3-344-pinctrl-stm32-Fix-refcount-leak-in-stm32_pctrl_.patch @@ -0,0 +1,39 @@ +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 12:24:56 +0400 +Subject: [PATCH] pinctrl: stm32: Fix refcount leak in + stm32_pctrl_get_irq_domain +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dcef18c8ac40aa85bb339f64c1dd31dd458b06fb + +[ Upstream commit dcef18c8ac40aa85bb339f64c1dd31dd458b06fb ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: d86f4d71e42a ("pinctrl: stm32: check irq controller availability at probe") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20230102082503.3944927-1-linmq006@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index 1cddca50..cb33a23a 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -1382,6 +1382,7 @@ static struct irq_domain *stm32_pctrl_get_irq_domain(struct platform_device *pde + return ERR_PTR(-ENXIO); + + domain = irq_find_host(parent); ++ of_node_put(parent); + if (!domain) + /* domain not registered yet */ + return ERR_PTR(-EPROBE_DEFER); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-345-pinctrl-rockchip-Fix-refcount-leak-in-rockchip_.patch b/patches.kernel.org/6.2.3-345-pinctrl-rockchip-Fix-refcount-leak-in-rockchip_.patch new file mode 100644 index 0000000..29293ba --- /dev/null +++ b/patches.kernel.org/6.2.3-345-pinctrl-rockchip-Fix-refcount-leak-in-rockchip_.patch @@ -0,0 +1,39 @@ +From: Miaoqian Lin +Date: Mon, 2 Jan 2023 15:28:45 +0400 +Subject: [PATCH] pinctrl: rockchip: Fix refcount leak in + rockchip_pinctrl_parse_groups +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c818ae563bf99457f02e8170aabd6b174f629f65 + +[ Upstream commit c818ae563bf99457f02e8170aabd6b174f629f65 ] + +of_find_node_by_phandle() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: d3e5116119bd ("pinctrl: add pinctrl driver for Rockchip SoCs") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20230102112845.3982407-1-linmq006@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/pinctrl-rockchip.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index 5eeac92f..0276b52f 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -3045,6 +3045,7 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np, + np_config = of_find_node_by_phandle(be32_to_cpup(phandle)); + ret = pinconf_generic_parse_dt_config(np_config, NULL, + &grp->data[j].configs, &grp->data[j].nconfigs); ++ of_node_put(np_config); + if (ret) + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-346-drm-vc4-hvs-Configure-the-HVS-COB-allocations.patch b/patches.kernel.org/6.2.3-346-drm-vc4-hvs-Configure-the-HVS-COB-allocations.patch new file mode 100644 index 0000000..a768564 --- /dev/null +++ b/patches.kernel.org/6.2.3-346-drm-vc4-hvs-Configure-the-HVS-COB-allocations.patch @@ -0,0 +1,108 @@ +From: Dave Stevenson +Date: Wed, 7 Dec 2022 12:53:12 +0100 +Subject: [PATCH] drm/vc4: hvs: Configure the HVS COB allocations +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1284365e3e8cc33849f90cae20bca36fd7544e24 + +[ Upstream commit 1284365e3e8cc33849f90cae20bca36fd7544e24 ] + +The HVS Composite Output Buffer (COB) is the memory used to +generate the output pixel data. +Until now the vc4 driver has been relying on the firmware to +have set these to sensible values. + +In testing triple screen support it has been noted that only +1 line was being assigned to HVS channel 2. Whilst that is fine +for the transposer (TXP), and indeed needed as only some pixels +have an alpha channel, it is insufficient to run a live display. + +Split the COB more evenly between the 3 HVS channels. + +Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-1-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vc4/vc4_hvs.c | 56 ++++++++++++++++++++++++++++++++++- + 1 file changed, 55 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c +index c4453a5a..d615ba7d 100644 +--- a/drivers/gpu/drm/vc4/vc4_hvs.c ++++ b/drivers/gpu/drm/vc4/vc4_hvs.c +@@ -776,7 +776,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) + struct vc4_hvs *hvs = NULL; + int ret; + u32 dispctrl; +- u32 reg; ++ u32 reg, top; + + hvs = drmm_kzalloc(drm, sizeof(*hvs), GFP_KERNEL); + if (!hvs) +@@ -912,6 +912,60 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) + + HVS_WRITE(SCALER_DISPCTRL, dispctrl); + ++ /* Recompute Composite Output Buffer (COB) allocations for the displays ++ */ ++ if (!vc4->is_vc5) { ++ /* The COB is 20736 pixels, or just over 10 lines at 2048 wide. ++ * The bottom 2048 pixels are full 32bpp RGBA (intended for the ++ * TXP composing RGBA to memory), whilst the remainder are only ++ * 24bpp RGB. ++ * ++ * Assign 3 lines to channels 1 & 2, and just over 4 lines to ++ * channel 0. ++ */ ++ #define VC4_COB_SIZE 20736 ++ #define VC4_COB_LINE_WIDTH 2048 ++ #define VC4_COB_NUM_LINES 3 ++ reg = 0; ++ top = VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES; ++ reg |= (top - 1) << 16; ++ HVS_WRITE(SCALER_DISPBASE2, reg); ++ reg = top; ++ top += VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES; ++ reg |= (top - 1) << 16; ++ HVS_WRITE(SCALER_DISPBASE1, reg); ++ reg = top; ++ top = VC4_COB_SIZE; ++ reg |= (top - 1) << 16; ++ HVS_WRITE(SCALER_DISPBASE0, reg); ++ } else { ++ /* The COB is 44416 pixels, or 10.8 lines at 4096 wide. ++ * The bottom 4096 pixels are full RGBA (intended for the TXP ++ * composing RGBA to memory), whilst the remainder are only ++ * RGB. Addressing is always pixel wide. ++ * ++ * Assign 3 lines of 4096 to channels 1 & 2, and just over 4 ++ * lines. to channel 0. ++ */ ++ #define VC5_COB_SIZE 44416 ++ #define VC5_COB_LINE_WIDTH 4096 ++ #define VC5_COB_NUM_LINES 3 ++ reg = 0; ++ top = VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES; ++ reg |= top << 16; ++ HVS_WRITE(SCALER_DISPBASE2, reg); ++ top += 16; ++ reg = top; ++ top += VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES; ++ reg |= top << 16; ++ HVS_WRITE(SCALER_DISPBASE1, reg); ++ top += 16; ++ reg = top; ++ top = VC5_COB_SIZE; ++ reg |= top << 16; ++ HVS_WRITE(SCALER_DISPBASE0, reg); ++ } ++ + ret = devm_request_irq(dev, platform_get_irq(pdev, 0), + vc4_hvs_irq_handler, 0, "vc4 hvs", drm); + if (ret) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-347-drm-vc4-hvs-Set-AXI-panic-modes.patch b/patches.kernel.org/6.2.3-347-drm-vc4-hvs-Set-AXI-panic-modes.patch new file mode 100644 index 0000000..91a9088 --- /dev/null +++ b/patches.kernel.org/6.2.3-347-drm-vc4-hvs-Set-AXI-panic-modes.patch @@ -0,0 +1,71 @@ +From: Dave Stevenson +Date: Wed, 7 Dec 2022 12:53:13 +0100 +Subject: [PATCH] drm/vc4: hvs: Set AXI panic modes +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: df993fced230daa8452892406f3180c93ebf7e7b + +[ Upstream commit df993fced230daa8452892406f3180c93ebf7e7b ] + +The HVS can change AXI request mode based on how full the COB +FIFOs are. +Until now the vc4 driver has been relying on the firmware to +have set these to sensible values. + +With HVS channel 2 now being used for live video, change the +panic mode for all channels to be explicitly set by the driver, +and the same for all channels. + +Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-2-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++ + drivers/gpu/drm/vc4/vc4_regs.h | 6 ++++++ + 2 files changed, 17 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c +index d615ba7d..b335815e 100644 +--- a/drivers/gpu/drm/vc4/vc4_hvs.c ++++ b/drivers/gpu/drm/vc4/vc4_hvs.c +@@ -910,6 +910,17 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) + SCALER_DISPCTRL_DSPEISLUR(2) | + SCALER_DISPCTRL_SCLEIRQ); + ++ /* Set AXI panic mode. ++ * VC4 panics when < 2 lines in FIFO. ++ * VC5 panics when less than 1 line in the FIFO. ++ */ ++ dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK | ++ SCALER_DISPCTRL_PANIC1_MASK | ++ SCALER_DISPCTRL_PANIC2_MASK); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2); ++ + HVS_WRITE(SCALER_DISPCTRL, dispctrl); + + /* Recompute Composite Output Buffer (COB) allocations for the displays +diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h +index f0290fad..f121905c 100644 +--- a/drivers/gpu/drm/vc4/vc4_regs.h ++++ b/drivers/gpu/drm/vc4/vc4_regs.h +@@ -220,6 +220,12 @@ + #define SCALER_DISPCTRL 0x00000000 + /* Global register for clock gating the HVS */ + # define SCALER_DISPCTRL_ENABLE BIT(31) ++# define SCALER_DISPCTRL_PANIC0_MASK VC4_MASK(25, 24) ++# define SCALER_DISPCTRL_PANIC0_SHIFT 24 ++# define SCALER_DISPCTRL_PANIC1_MASK VC4_MASK(27, 26) ++# define SCALER_DISPCTRL_PANIC1_SHIFT 26 ++# define SCALER_DISPCTRL_PANIC2_MASK VC4_MASK(29, 28) ++# define SCALER_DISPCTRL_PANIC2_SHIFT 28 + # define SCALER_DISPCTRL_DSP3_MUX_MASK VC4_MASK(19, 18) + # define SCALER_DISPCTRL_DSP3_MUX_SHIFT 18 + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-348-drm-vc4-hvs-SCALER_DISPBKGND_AUTOHS-is-only-val.patch b/patches.kernel.org/6.2.3-348-drm-vc4-hvs-SCALER_DISPBKGND_AUTOHS-is-only-val.patch new file mode 100644 index 0000000..7df2c47 --- /dev/null +++ b/patches.kernel.org/6.2.3-348-drm-vc4-hvs-SCALER_DISPBKGND_AUTOHS-is-only-val.patch @@ -0,0 +1,81 @@ +From: Dave Stevenson +Date: Wed, 7 Dec 2022 12:53:14 +0100 +Subject: [PATCH] drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 982ee94486863a41c6af9f2ab3f6681f72bc5c48 + +[ Upstream commit 982ee94486863a41c6af9f2ab3f6681f72bc5c48 ] + +The bit used for SCALER_DISPBKGND_AUTOHS in SCALER_DISPBKGNDX +has been repurposed on HVS5 to configure whether a display can +win back-to-back arbitration wins for the COB. + +This is not desirable, therefore only select this bit on HVS4, +and explicitly clear it on HVS5. + +Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-3-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vc4/vc4_hvs.c | 10 ++++++---- + drivers/gpu/drm/vc4/vc4_regs.h | 1 + + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c +index b335815e..57d99e71 100644 +--- a/drivers/gpu/drm/vc4/vc4_hvs.c ++++ b/drivers/gpu/drm/vc4/vc4_hvs.c +@@ -370,28 +370,30 @@ static int vc4_hvs_init_channel(struct vc4_hvs *hvs, struct drm_crtc *crtc, + * mode. + */ + dispctrl = SCALER_DISPCTRLX_ENABLE; ++ dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(chan)); + +- if (!vc4->is_vc5) ++ if (!vc4->is_vc5) { + dispctrl |= VC4_SET_FIELD(mode->hdisplay, + SCALER_DISPCTRLX_WIDTH) | + VC4_SET_FIELD(mode->vdisplay, + SCALER_DISPCTRLX_HEIGHT) | + (oneshot ? SCALER_DISPCTRLX_ONESHOT : 0); +- else ++ dispbkgndx |= SCALER_DISPBKGND_AUTOHS; ++ } else { + dispctrl |= VC4_SET_FIELD(mode->hdisplay, + SCALER5_DISPCTRLX_WIDTH) | + VC4_SET_FIELD(mode->vdisplay, + SCALER5_DISPCTRLX_HEIGHT) | + (oneshot ? SCALER5_DISPCTRLX_ONESHOT : 0); ++ dispbkgndx &= ~SCALER5_DISPBKGND_BCK2BCK; ++ } + + HVS_WRITE(SCALER_DISPCTRLX(chan), dispctrl); + +- dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(chan)); + dispbkgndx &= ~SCALER_DISPBKGND_GAMMA; + dispbkgndx &= ~SCALER_DISPBKGND_INTERLACE; + + HVS_WRITE(SCALER_DISPBKGNDX(chan), dispbkgndx | +- SCALER_DISPBKGND_AUTOHS | + ((!vc4->is_vc5) ? SCALER_DISPBKGND_GAMMA : 0) | + (interlace ? SCALER_DISPBKGND_INTERLACE : 0)); + +diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h +index f121905c..95deacdc 100644 +--- a/drivers/gpu/drm/vc4/vc4_regs.h ++++ b/drivers/gpu/drm/vc4/vc4_regs.h +@@ -366,6 +366,7 @@ + + #define SCALER_DISPBKGND0 0x00000044 + # define SCALER_DISPBKGND_AUTOHS BIT(31) ++# define SCALER5_DISPBKGND_BCK2BCK BIT(31) + # define SCALER_DISPBKGND_INTERLACE BIT(30) + # define SCALER_DISPBKGND_GAMMA BIT(29) + # define SCALER_DISPBKGND_TESTMODE_MASK VC4_MASK(28, 25) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-349-drm-vc4-hvs-Correct-interrupt-masking-bit-assig.patch b/patches.kernel.org/6.2.3-349-drm-vc4-hvs-Correct-interrupt-masking-bit-assig.patch new file mode 100644 index 0000000..0ff6552 --- /dev/null +++ b/patches.kernel.org/6.2.3-349-drm-vc4-hvs-Correct-interrupt-masking-bit-assig.patch @@ -0,0 +1,149 @@ +From: Dave Stevenson +Date: Wed, 7 Dec 2022 12:53:15 +0100 +Subject: [PATCH] drm/vc4: hvs: Correct interrupt masking bit assignment for + HVS5 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 87551ec650bb87d35f1b29bba6a2430896e08da0 + +[ Upstream commit 87551ec650bb87d35f1b29bba6a2430896e08da0 ] + +HVS5 has moved the interrupt enable bits around within the +DISPCTRL register, therefore the configuration has to be updated +to account for this. + +Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-4-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vc4/vc4_hvs.c | 52 +++++++++++++++++++++++----------- + drivers/gpu/drm/vc4/vc4_regs.h | 10 +++++-- + 2 files changed, 44 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c +index 57d99e71..d9fc0d03 100644 +--- a/drivers/gpu/drm/vc4/vc4_hvs.c ++++ b/drivers/gpu/drm/vc4/vc4_hvs.c +@@ -660,7 +660,8 @@ void vc4_hvs_mask_underrun(struct vc4_hvs *hvs, int channel) + return; + + dispctrl = HVS_READ(SCALER_DISPCTRL); +- dispctrl &= ~SCALER_DISPCTRL_DSPEISLUR(channel); ++ dispctrl &= ~(hvs->vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) : ++ SCALER_DISPCTRL_DSPEISLUR(channel)); + + HVS_WRITE(SCALER_DISPCTRL, dispctrl); + +@@ -677,7 +678,8 @@ void vc4_hvs_unmask_underrun(struct vc4_hvs *hvs, int channel) + return; + + dispctrl = HVS_READ(SCALER_DISPCTRL); +- dispctrl |= SCALER_DISPCTRL_DSPEISLUR(channel); ++ dispctrl |= (hvs->vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) : ++ SCALER_DISPCTRL_DSPEISLUR(channel)); + + HVS_WRITE(SCALER_DISPSTAT, + SCALER_DISPSTAT_EUFLOW(channel)); +@@ -703,6 +705,7 @@ static irqreturn_t vc4_hvs_irq_handler(int irq, void *data) + int channel; + u32 control; + u32 status; ++ u32 dspeislur; + + /* + * NOTE: We don't need to protect the register access using +@@ -719,9 +722,11 @@ static irqreturn_t vc4_hvs_irq_handler(int irq, void *data) + control = HVS_READ(SCALER_DISPCTRL); + + for (channel = 0; channel < SCALER_CHANNELS_COUNT; channel++) { ++ dspeislur = vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) : ++ SCALER_DISPCTRL_DSPEISLUR(channel); + /* Interrupt masking is not always honored, so check it here. */ + if (status & SCALER_DISPSTAT_EUFLOW(channel) && +- control & SCALER_DISPCTRL_DSPEISLUR(channel)) { ++ control & dspeislur) { + vc4_hvs_mask_underrun(hvs, channel); + vc4_hvs_report_underrun(dev); + +@@ -898,19 +903,34 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) + SCALER_DISPCTRL_DISPEIRQ(1) | + SCALER_DISPCTRL_DISPEIRQ(2); + +- dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ | +- SCALER_DISPCTRL_SLVWREIRQ | +- SCALER_DISPCTRL_SLVRDEIRQ | +- SCALER_DISPCTRL_DSPEIEOF(0) | +- SCALER_DISPCTRL_DSPEIEOF(1) | +- SCALER_DISPCTRL_DSPEIEOF(2) | +- SCALER_DISPCTRL_DSPEIEOLN(0) | +- SCALER_DISPCTRL_DSPEIEOLN(1) | +- SCALER_DISPCTRL_DSPEIEOLN(2) | +- SCALER_DISPCTRL_DSPEISLUR(0) | +- SCALER_DISPCTRL_DSPEISLUR(1) | +- SCALER_DISPCTRL_DSPEISLUR(2) | +- SCALER_DISPCTRL_SCLEIRQ); ++ if (!vc4->is_vc5) ++ dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ | ++ SCALER_DISPCTRL_SLVWREIRQ | ++ SCALER_DISPCTRL_SLVRDEIRQ | ++ SCALER_DISPCTRL_DSPEIEOF(0) | ++ SCALER_DISPCTRL_DSPEIEOF(1) | ++ SCALER_DISPCTRL_DSPEIEOF(2) | ++ SCALER_DISPCTRL_DSPEIEOLN(0) | ++ SCALER_DISPCTRL_DSPEIEOLN(1) | ++ SCALER_DISPCTRL_DSPEIEOLN(2) | ++ SCALER_DISPCTRL_DSPEISLUR(0) | ++ SCALER_DISPCTRL_DSPEISLUR(1) | ++ SCALER_DISPCTRL_DSPEISLUR(2) | ++ SCALER_DISPCTRL_SCLEIRQ); ++ else ++ dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ | ++ SCALER5_DISPCTRL_SLVEIRQ | ++ SCALER5_DISPCTRL_DSPEIEOF(0) | ++ SCALER5_DISPCTRL_DSPEIEOF(1) | ++ SCALER5_DISPCTRL_DSPEIEOF(2) | ++ SCALER5_DISPCTRL_DSPEIEOLN(0) | ++ SCALER5_DISPCTRL_DSPEIEOLN(1) | ++ SCALER5_DISPCTRL_DSPEIEOLN(2) | ++ SCALER5_DISPCTRL_DSPEISLUR(0) | ++ SCALER5_DISPCTRL_DSPEISLUR(1) | ++ SCALER5_DISPCTRL_DSPEISLUR(2) | ++ SCALER_DISPCTRL_SCLEIRQ); ++ + + /* Set AXI panic mode. + * VC4 panics when < 2 lines in FIFO. +diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h +index 95deacdc..1256f087 100644 +--- a/drivers/gpu/drm/vc4/vc4_regs.h ++++ b/drivers/gpu/drm/vc4/vc4_regs.h +@@ -234,15 +234,21 @@ + * always enabled. + */ + # define SCALER_DISPCTRL_DSPEISLUR(x) BIT(13 + (x)) ++# define SCALER5_DISPCTRL_DSPEISLUR(x) BIT(9 + ((x) * 4)) + /* Enables Display 0 end-of-line-N contribution to + * SCALER_DISPSTAT_IRQDISP0 + */ + # define SCALER_DISPCTRL_DSPEIEOLN(x) BIT(8 + ((x) * 2)) ++# define SCALER5_DISPCTRL_DSPEIEOLN(x) BIT(8 + ((x) * 4)) + /* Enables Display 0 EOF contribution to SCALER_DISPSTAT_IRQDISP0 */ + # define SCALER_DISPCTRL_DSPEIEOF(x) BIT(7 + ((x) * 2)) ++# define SCALER5_DISPCTRL_DSPEIEOF(x) BIT(7 + ((x) * 4)) + +-# define SCALER_DISPCTRL_SLVRDEIRQ BIT(6) +-# define SCALER_DISPCTRL_SLVWREIRQ BIT(5) ++# define SCALER5_DISPCTRL_DSPEIVST(x) BIT(6 + ((x) * 4)) ++ ++# define SCALER_DISPCTRL_SLVRDEIRQ BIT(6) /* HVS4 only */ ++# define SCALER_DISPCTRL_SLVWREIRQ BIT(5) /* HVS4 only */ ++# define SCALER5_DISPCTRL_SLVEIRQ BIT(5) + # define SCALER_DISPCTRL_DMAEIRQ BIT(4) + /* Enables interrupt generation on the enabled EOF/EOLN/EISLUR + * bits and short frames.. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-350-drm-vc4-hvs-Fix-colour-order-for-xRGB1555-on-HV.patch b/patches.kernel.org/6.2.3-350-drm-vc4-hvs-Fix-colour-order-for-xRGB1555-on-HV.patch new file mode 100644 index 0000000..e5db060 --- /dev/null +++ b/patches.kernel.org/6.2.3-350-drm-vc4-hvs-Fix-colour-order-for-xRGB1555-on-HV.patch @@ -0,0 +1,44 @@ +From: Dave Stevenson +Date: Wed, 7 Dec 2022 12:53:17 +0100 +Subject: [PATCH] drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 902973dc1a049c0d7bf0c222b8f2b3876f01b4a2 + +[ Upstream commit 902973dc1a049c0d7bf0c222b8f2b3876f01b4a2 ] + +Same as the xRGB8888 formats, HVS5 has managed to swap the colour +channels for the xRGB1555 formats as well. Add the relevant +config for pixel_order_hvs5. + +Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-6-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vc4/vc4_plane.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index bd5acc4a..eb080201 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -75,11 +75,13 @@ static const struct hvs_format { + .drm = DRM_FORMAT_ARGB1555, + .hvs = HVS_PIXEL_FORMAT_RGBA5551, + .pixel_order = HVS_PIXEL_ORDER_ABGR, ++ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB, + }, + { + .drm = DRM_FORMAT_XRGB1555, + .hvs = HVS_PIXEL_FORMAT_RGBA5551, + .pixel_order = HVS_PIXEL_ORDER_ABGR, ++ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB, + }, + { + .drm = DRM_FORMAT_RGB888, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-351-drm-vc4-hdmi-Correct-interlaced-timings-again.patch b/patches.kernel.org/6.2.3-351-drm-vc4-hdmi-Correct-interlaced-timings-again.patch new file mode 100644 index 0000000..f8e7509 --- /dev/null +++ b/patches.kernel.org/6.2.3-351-drm-vc4-hdmi-Correct-interlaced-timings-again.patch @@ -0,0 +1,45 @@ +From: Dave Stevenson +Date: Wed, 7 Dec 2022 12:53:25 +0100 +Subject: [PATCH] drm/vc4: hdmi: Correct interlaced timings again +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 771d6539f27bd55f43d8a95d53a7eeaaffa2681c + +[ Upstream commit 771d6539f27bd55f43d8a95d53a7eeaaffa2681c ] + +The back porch timings were correct, only the sync offset was wrong. +Correct timing is now reported for 1080i and 576i, but the h offset is +incorrect for 480i for non-obvious reasons. + +Fixes: fb10dc451c0f ("drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-14-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 21338e6a..3f3f94e7 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -1311,11 +1311,12 @@ static void vc5_hdmi_set_timings(struct vc4_hdmi *vc4_hdmi, + VC4_SET_FIELD(mode->crtc_vdisplay, VC5_HDMI_VERTA_VAL)); + u32 vertb = (VC4_SET_FIELD(mode->htotal >> (2 - pixel_rep), + VC5_HDMI_VERTB_VSPO) | +- VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end, ++ VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end + ++ interlaced, + VC4_HDMI_VERTB_VBP)); + u32 vertb_even = (VC4_SET_FIELD(0, VC5_HDMI_VERTB_VSPO) | + VC4_SET_FIELD(mode->crtc_vtotal - +- mode->crtc_vsync_end - interlaced, ++ mode->crtc_vsync_end, + VC4_HDMI_VERTB_VBP)); + unsigned long flags; + unsigned char gcp; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-352-drm-msm-clean-event_thread-worker-in-case-of-an.patch b/patches.kernel.org/6.2.3-352-drm-msm-clean-event_thread-worker-in-case-of-an.patch new file mode 100644 index 0000000..19b2026 --- /dev/null +++ b/patches.kernel.org/6.2.3-352-drm-msm-clean-event_thread-worker-in-case-of-an.patch @@ -0,0 +1,41 @@ +From: Dmitry Baryshkov +Date: Sat, 18 Jun 2022 02:33:25 +0300 +Subject: [PATCH] drm/msm: clean event_thread->worker in case of an error +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c79bb6b92defdcb834ceeeed9c1cf591beb1b71a + +[ Upstream commit c79bb6b92defdcb834ceeeed9c1cf591beb1b71a ] + +If worker creation fails, nullify the event_thread->worker, so that +msm_drm_uninit() doesn't try accessing invalid memory location. While we +are at it, remove duplicate assignment to the ret variable. + +Fixes: 1041dee2178f ("drm/msm: use kthread_create_worker instead of kthread_run") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/490106/ +Link: https://lore.kernel.org/r/20220617233328.1143665-2-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/msm_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 45e81eb1..ee2f60b6 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -491,7 +491,7 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) + if (IS_ERR(priv->event_thread[i].worker)) { + ret = PTR_ERR(priv->event_thread[i].worker); + DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n"); +- ret = PTR_ERR(priv->event_thread[i].worker); ++ priv->event_thread[i].worker = NULL; + goto err_msm_uninit; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-353-drm-panel-edp-fix-name-for-IVO-product-id-854b.patch b/patches.kernel.org/6.2.3-353-drm-panel-edp-fix-name-for-IVO-product-id-854b.patch new file mode 100644 index 0000000..ada3979 --- /dev/null +++ b/patches.kernel.org/6.2.3-353-drm-panel-edp-fix-name-for-IVO-product-id-854b.patch @@ -0,0 +1,40 @@ +From: Abel Vesa +Date: Sat, 31 Dec 2022 16:27:20 +0200 +Subject: [PATCH] drm/panel-edp: fix name for IVO product id 854b +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9cce08cadc6ce8670280d0a042cf0b6d2987d9f9 + +[ Upstream commit 9cce08cadc6ce8670280d0a042cf0b6d2987d9f9 ] + +The actual name is R133NW4K-R0. + +Fixes: 0f9fa5f58c78 ("drm/panel-edp: add IVO M133NW4J-R3 panel entry") +Signed-off-by: Abel Vesa +Reviewed-by: Johan Hovold +Tested-by: Steev Klimaszewski +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20221231142721.338643-1-abel.vesa@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/panel/panel-edp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c +index 5cb8dc2e..ef70928c 100644 +--- a/drivers/gpu/drm/panel/panel-edp.c ++++ b/drivers/gpu/drm/panel/panel-edp.c +@@ -1891,7 +1891,7 @@ static const struct edp_panel_entry edp_panels[] = { + EDP_PANEL_ENTRY('C', 'M', 'N', 0x1247, &delay_200_500_e80_d50, "N120ACA-EA1"), + + EDP_PANEL_ENTRY('I', 'V', 'O', 0x057d, &delay_200_500_e200, "R140NWF5 RH"), +- EDP_PANEL_ENTRY('I', 'V', 'O', 0x854b, &delay_200_500_p2e100, "M133NW4J-R3"), ++ EDP_PANEL_ENTRY('I', 'V', 'O', 0x854b, &delay_200_500_p2e100, "R133NW4K-R0"), + + EDP_PANEL_ENTRY('K', 'D', 'B', 0x0624, &kingdisplay_kd116n21_30nv_a010.delay, "116N21-30NV-A010"), + EDP_PANEL_ENTRY('K', 'D', 'B', 0x1120, &delay_200_500_e80_d50, "116N29-30NK-C007"), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-354-scsi-qla2xxx-Fix-exchange-oversubscription.patch b/patches.kernel.org/6.2.3-354-scsi-qla2xxx-Fix-exchange-oversubscription.patch new file mode 100644 index 0000000..ca8370f --- /dev/null +++ b/patches.kernel.org/6.2.3-354-scsi-qla2xxx-Fix-exchange-oversubscription.patch @@ -0,0 +1,385 @@ +From: Quinn Tran +Date: Mon, 19 Dec 2022 03:07:41 -0800 +Subject: [PATCH] scsi: qla2xxx: Fix exchange oversubscription +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 41e5afe51f75f2858f5563145348f6c26d307b8f + +[ Upstream commit 41e5afe51f75f2858f5563145348f6c26d307b8f ] + +In large environment, it is possible to experience command timeout and +escalation of path recovery. Currently the driver does not track the number +of exchanges/commands sent to FW. If there is a delay for commands at the +head of the queue, then this will create back pressure for commands at the +back of the queue. + +Check for exchange availability before command submission. + +Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking") +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_def.h | 6 +++- + drivers/scsi/qla2xxx/qla_edif.c | 7 +++-- + drivers/scsi/qla2xxx/qla_init.c | 13 ++++++++ + drivers/scsi/qla2xxx/qla_inline.h | 52 +++++++++++++++++++++---------- + drivers/scsi/qla2xxx/qla_iocb.c | 28 ++++++++++------- + drivers/scsi/qla2xxx/qla_isr.c | 3 +- + drivers/scsi/qla2xxx/qla_nvme.c | 15 ++++++++- + 7 files changed, 88 insertions(+), 36 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index a26a373b..cd4eb11b 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -660,7 +660,7 @@ enum { + + struct iocb_resource { + u8 res_type; +- u8 pad; ++ u8 exch_cnt; + u16 iocb_cnt; + }; + +@@ -3721,6 +3721,10 @@ struct qla_fw_resources { + u16 iocbs_limit; + u16 iocbs_qp_limit; + u16 iocbs_used; ++ u16 exch_total; ++ u16 exch_limit; ++ u16 exch_used; ++ u16 pad; + }; + + #define QLA_IOCB_PCT_LIMIT 95 +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index e4240aae..53186a14 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -2989,9 +2989,10 @@ qla28xx_start_scsi_edif(srb_t *sp) + tot_dsds = nseg; + req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = req_cnt; +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -3185,7 +3186,7 @@ qla28xx_start_scsi_edif(srb_t *sp) + mempool_free(sp->u.scmd.ct6_ctx, ha->ctx_mempool); + sp->u.scmd.ct6_ctx = NULL; + } +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(lock, flags); + + return QLA_FUNCTION_FAILED; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 8d9ecabb..fd27fb51 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -128,12 +128,14 @@ static void qla24xx_abort_iocb_timeout(void *data) + sp->cmd_sp)) { + qpair->req->outstanding_cmds[handle] = NULL; + cmdsp_found = 1; ++ qla_put_fw_resources(qpair, &sp->cmd_sp->iores); + } + + /* removing the abort */ + if (qpair->req->outstanding_cmds[handle] == sp) { + qpair->req->outstanding_cmds[handle] = NULL; + sp_found = 1; ++ qla_put_fw_resources(qpair, &sp->iores); + break; + } + } +@@ -2000,6 +2002,7 @@ qla2x00_tmf_iocb_timeout(void *data) + for (h = 1; h < sp->qpair->req->num_outstanding_cmds; h++) { + if (sp->qpair->req->outstanding_cmds[h] == sp) { + sp->qpair->req->outstanding_cmds[h] = NULL; ++ qla_put_fw_resources(sp->qpair, &sp->iores); + break; + } + } +@@ -3943,6 +3946,12 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha) + ha->base_qpair->fwres.iocbs_limit = limit; + ha->base_qpair->fwres.iocbs_qp_limit = limit / num_qps; + ha->base_qpair->fwres.iocbs_used = 0; ++ ++ ha->base_qpair->fwres.exch_total = ha->orig_fw_xcb_count; ++ ha->base_qpair->fwres.exch_limit = (ha->orig_fw_xcb_count * ++ QLA_IOCB_PCT_LIMIT) / 100; ++ ha->base_qpair->fwres.exch_used = 0; ++ + for (i = 0; i < ha->max_qpairs; i++) { + if (ha->queue_pair_map[i]) { + ha->queue_pair_map[i]->fwres.iocbs_total = +@@ -3951,6 +3960,10 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha) + ha->queue_pair_map[i]->fwres.iocbs_qp_limit = + limit / num_qps; + ha->queue_pair_map[i]->fwres.iocbs_used = 0; ++ ha->queue_pair_map[i]->fwres.exch_total = ha->orig_fw_xcb_count; ++ ha->queue_pair_map[i]->fwres.exch_limit = ++ (ha->orig_fw_xcb_count * QLA_IOCB_PCT_LIMIT) / 100; ++ ha->queue_pair_map[i]->fwres.exch_used = 0; + } + } + } +diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h +index 5185dc5d..2d5a275d 100644 +--- a/drivers/scsi/qla2xxx/qla_inline.h ++++ b/drivers/scsi/qla2xxx/qla_inline.h +@@ -380,13 +380,16 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha) + + enum { + RESOURCE_NONE, +- RESOURCE_INI, ++ RESOURCE_IOCB = BIT_0, ++ RESOURCE_EXCH = BIT_1, /* exchange */ ++ RESOURCE_FORCE = BIT_2, + }; + + static inline int +-qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) ++qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) + { + u16 iocbs_used, i; ++ u16 exch_used; + struct qla_hw_data *ha = qp->vha->hw; + + if (!ql2xenforce_iocb_limit) { +@@ -394,10 +397,7 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) + return 0; + } + +- if ((iores->iocb_cnt + qp->fwres.iocbs_used) < qp->fwres.iocbs_qp_limit) { +- qp->fwres.iocbs_used += iores->iocb_cnt; +- return 0; +- } else { ++ if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) { + /* no need to acquire qpair lock. It's just rough calculation */ + iocbs_used = ha->base_qpair->fwres.iocbs_used; + for (i = 0; i < ha->max_qpairs; i++) { +@@ -405,30 +405,48 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) + iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used; + } + +- if ((iores->iocb_cnt + iocbs_used) < qp->fwres.iocbs_limit) { +- qp->fwres.iocbs_used += iores->iocb_cnt; +- return 0; +- } else { ++ if ((iores->iocb_cnt + iocbs_used) >= qp->fwres.iocbs_limit) { ++ iores->res_type = RESOURCE_NONE; ++ return -ENOSPC; ++ } ++ } ++ ++ if (iores->res_type & RESOURCE_EXCH) { ++ exch_used = ha->base_qpair->fwres.exch_used; ++ for (i = 0; i < ha->max_qpairs; i++) { ++ if (ha->queue_pair_map[i]) ++ exch_used += ha->queue_pair_map[i]->fwres.exch_used; ++ } ++ ++ if ((exch_used + iores->exch_cnt) >= qp->fwres.exch_limit) { + iores->res_type = RESOURCE_NONE; + return -ENOSPC; + } + } ++ qp->fwres.iocbs_used += iores->iocb_cnt; ++ qp->fwres.exch_used += iores->exch_cnt; ++ return 0; + } + + static inline void +-qla_put_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) ++qla_put_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) + { +- switch (iores->res_type) { +- case RESOURCE_NONE: +- break; +- default: ++ if (iores->res_type & RESOURCE_IOCB) { + if (qp->fwres.iocbs_used >= iores->iocb_cnt) { + qp->fwres.iocbs_used -= iores->iocb_cnt; + } else { +- // should not happen ++ /* should not happen */ + qp->fwres.iocbs_used = 0; + } +- break; ++ } ++ ++ if (iores->res_type & RESOURCE_EXCH) { ++ if (qp->fwres.exch_used >= iores->exch_cnt) { ++ qp->fwres.exch_used -= iores->exch_cnt; ++ } else { ++ /* should not happen */ ++ qp->fwres.exch_used = 0; ++ } + } + iores->res_type = RESOURCE_NONE; + } +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 42ce4e1f..399ec8da 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -1589,9 +1589,10 @@ qla24xx_start_scsi(srb_t *sp) + tot_dsds = nseg; + req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = req_cnt; +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -1678,7 +1679,7 @@ qla24xx_start_scsi(srb_t *sp) + if (tot_dsds) + scsi_dma_unmap(cmd); + +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + return QLA_FUNCTION_FAILED; +@@ -1793,9 +1794,10 @@ qla24xx_dif_start_scsi(srb_t *sp) + tot_prot_dsds = nseg; + tot_dsds += nseg; + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds); +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -1883,7 +1885,7 @@ qla24xx_dif_start_scsi(srb_t *sp) + } + /* Cleanup will be performed by the caller (queuecommand) */ + +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + return QLA_FUNCTION_FAILED; +@@ -1952,9 +1954,10 @@ qla2xxx_start_scsi_mq(srb_t *sp) + tot_dsds = nseg; + req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = req_cnt; +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -2041,7 +2044,7 @@ qla2xxx_start_scsi_mq(srb_t *sp) + if (tot_dsds) + scsi_dma_unmap(cmd); + +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&qpair->qp_lock, flags); + + return QLA_FUNCTION_FAILED; +@@ -2171,9 +2174,10 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp) + tot_prot_dsds = nseg; + tot_dsds += nseg; + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds); +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -2260,7 +2264,7 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp) + } + /* Cleanup will be performed by the caller (queuecommand) */ + +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&qpair->qp_lock, flags); + + return QLA_FUNCTION_FAILED; +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index e19fde30..42d3d2de 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3197,7 +3197,7 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) + } + return; + } +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + + if (sp->cmd_type != TYPE_SRB) { + req->outstanding_cmds[handle] = NULL; +@@ -3618,7 +3618,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt) + default: + sp = qla2x00_get_sp_from_handle(vha, func, req, pkt); + if (sp) { +- qla_put_iocbs(sp->qpair, &sp->iores); + sp->done(sp, res); + return 0; + } +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 02fdeb0d..582d88dd 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -445,13 +445,24 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp) + goto queuing_error; + } + req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); ++ ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; ++ sp->iores.iocb_cnt = req_cnt; ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) { ++ rval = -EBUSY; ++ goto queuing_error; ++ } ++ + if (req->cnt < (req_cnt + 2)) { + if (IS_SHADOW_REG_CAPABLE(ha)) { + cnt = *req->out_ptr; + } else { + cnt = rd_reg_dword_relaxed(req->req_q_out); +- if (qla2x00_check_reg16_for_disconnect(vha, cnt)) ++ if (qla2x00_check_reg16_for_disconnect(vha, cnt)) { ++ rval = -EBUSY; + goto queuing_error; ++ } + } + + if (req->ring_index < cnt) +@@ -600,6 +611,8 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp) + qla24xx_process_response_queue(vha, rsp); + + queuing_error: ++ if (rval) ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&qpair->qp_lock, flags); + + return rval; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-355-scsi-qla2xxx-Fix-exchange-oversubscription-for-.patch b/patches.kernel.org/6.2.3-355-scsi-qla2xxx-Fix-exchange-oversubscription-for-.patch new file mode 100644 index 0000000..f195ed2 --- /dev/null +++ b/patches.kernel.org/6.2.3-355-scsi-qla2xxx-Fix-exchange-oversubscription-for-.patch @@ -0,0 +1,196 @@ +From: Quinn Tran +Date: Mon, 19 Dec 2022 03:07:42 -0800 +Subject: [PATCH] scsi: qla2xxx: Fix exchange oversubscription for management + commands +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5f63a163ed2f12c34dd4ae9b2757962ec7bb86e5 + +[ Upstream commit 5f63a163ed2f12c34dd4ae9b2757962ec7bb86e5 ] + +Add resource checking for management (non-I/O) commands. + +Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking") +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_dfs.c | 10 ++++- + drivers/scsi/qla2xxx/qla_inline.h | 5 ++- + drivers/scsi/qla2xxx/qla_iocb.c | 67 +++++++++++++++++++++++++++++++ + drivers/scsi/qla2xxx/qla_isr.c | 1 + + 4 files changed, 80 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c +index 777808af..1925cc68 100644 +--- a/drivers/scsi/qla2xxx/qla_dfs.c ++++ b/drivers/scsi/qla2xxx/qla_dfs.c +@@ -235,7 +235,7 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused) + uint16_t mb[MAX_IOCB_MB_REG]; + int rc; + struct qla_hw_data *ha = vha->hw; +- u16 iocbs_used, i; ++ u16 iocbs_used, i, exch_used; + + rc = qla24xx_res_count_wait(vha, mb, SIZEOF_IOCB_MB_REG); + if (rc != QLA_SUCCESS) { +@@ -263,13 +263,19 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused) + if (ql2xenforce_iocb_limit) { + /* lock is not require. It's an estimate. */ + iocbs_used = ha->base_qpair->fwres.iocbs_used; ++ exch_used = ha->base_qpair->fwres.exch_used; + for (i = 0; i < ha->max_qpairs; i++) { +- if (ha->queue_pair_map[i]) ++ if (ha->queue_pair_map[i]) { + iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used; ++ exch_used += ha->queue_pair_map[i]->fwres.exch_used; ++ } + } + + seq_printf(s, "Driver: estimate iocb used [%d] high water limit [%d]\n", + iocbs_used, ha->base_qpair->fwres.iocbs_limit); ++ ++ seq_printf(s, "estimate exchange used[%d] high water limit [%d] n", ++ exch_used, ha->base_qpair->fwres.exch_limit); + } + + return 0; +diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h +index 2d5a275d..b0ee307b 100644 +--- a/drivers/scsi/qla2xxx/qla_inline.h ++++ b/drivers/scsi/qla2xxx/qla_inline.h +@@ -380,7 +380,7 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha) + + enum { + RESOURCE_NONE, +- RESOURCE_IOCB = BIT_0, ++ RESOURCE_IOCB = BIT_0, + RESOURCE_EXCH = BIT_1, /* exchange */ + RESOURCE_FORCE = BIT_2, + }; +@@ -396,6 +396,8 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) + iores->res_type = RESOURCE_NONE; + return 0; + } ++ if (iores->res_type & RESOURCE_FORCE) ++ goto force; + + if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) { + /* no need to acquire qpair lock. It's just rough calculation */ +@@ -423,6 +425,7 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) + return -ENOSPC; + } + } ++force: + qp->fwres.iocbs_used += iores->iocb_cnt; + qp->fwres.exch_used += iores->exch_cnt; + return 0; +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 399ec8da..4f48f098 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -3817,6 +3817,65 @@ qla24xx_prlo_iocb(srb_t *sp, struct logio_entry_24xx *logio) + logio->vp_index = sp->fcport->vha->vp_idx; + } + ++int qla_get_iocbs_resource(struct srb *sp) ++{ ++ bool get_exch; ++ bool push_it_through = false; ++ ++ if (!ql2xenforce_iocb_limit) { ++ sp->iores.res_type = RESOURCE_NONE; ++ return 0; ++ } ++ sp->iores.res_type = RESOURCE_NONE; ++ ++ switch (sp->type) { ++ case SRB_TM_CMD: ++ case SRB_PRLI_CMD: ++ case SRB_ADISC_CMD: ++ push_it_through = true; ++ fallthrough; ++ case SRB_LOGIN_CMD: ++ case SRB_ELS_CMD_RPT: ++ case SRB_ELS_CMD_HST: ++ case SRB_ELS_CMD_HST_NOLOGIN: ++ case SRB_CT_CMD: ++ case SRB_NVME_LS: ++ case SRB_ELS_DCMD: ++ get_exch = true; ++ break; ++ ++ case SRB_FXIOCB_DCMD: ++ case SRB_FXIOCB_BCMD: ++ sp->iores.res_type = RESOURCE_NONE; ++ return 0; ++ ++ case SRB_SA_UPDATE: ++ case SRB_SA_REPLACE: ++ case SRB_MB_IOCB: ++ case SRB_ABT_CMD: ++ case SRB_NACK_PLOGI: ++ case SRB_NACK_PRLI: ++ case SRB_NACK_LOGO: ++ case SRB_LOGOUT_CMD: ++ case SRB_CTRL_VP: ++ push_it_through = true; ++ fallthrough; ++ default: ++ get_exch = false; ++ } ++ ++ sp->iores.res_type |= RESOURCE_IOCB; ++ sp->iores.iocb_cnt = 1; ++ if (get_exch) { ++ sp->iores.res_type |= RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; ++ } ++ if (push_it_through) ++ sp->iores.res_type |= RESOURCE_FORCE; ++ ++ return qla_get_fw_resources(sp->qpair, &sp->iores); ++} ++ + int + qla2x00_start_sp(srb_t *sp) + { +@@ -3831,6 +3890,12 @@ qla2x00_start_sp(srb_t *sp) + return -EIO; + + spin_lock_irqsave(qp->qp_lock_ptr, flags); ++ rval = qla_get_iocbs_resource(sp); ++ if (rval) { ++ spin_unlock_irqrestore(qp->qp_lock_ptr, flags); ++ return -EAGAIN; ++ } ++ + pkt = __qla2x00_alloc_iocbs(sp->qpair, sp); + if (!pkt) { + rval = EAGAIN; +@@ -3931,6 +3996,8 @@ qla2x00_start_sp(srb_t *sp) + wmb(); + qla2x00_start_iocbs(vha, qp->req); + done: ++ if (rval) ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(qp->qp_lock_ptr, flags); + return rval; + } +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 42d3d2de..759bea69 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3112,6 +3112,7 @@ qla25xx_process_bidir_status_iocb(scsi_qla_host_t *vha, void *pkt, + } + bsg_reply->reply_payload_rcv_len = 0; + ++ qla_put_fw_resources(sp->qpair, &sp->iores); + done: + /* Return the vendor specific reply to API */ + bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = rval; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-356-scsi-qla2xxx-edif-Fix-clang-warning.patch b/patches.kernel.org/6.2.3-356-scsi-qla2xxx-edif-Fix-clang-warning.patch new file mode 100644 index 0000000..1bbf181 --- /dev/null +++ b/patches.kernel.org/6.2.3-356-scsi-qla2xxx-edif-Fix-clang-warning.patch @@ -0,0 +1,77 @@ +From: Quinn Tran +Date: Wed, 21 Dec 2022 20:39:31 -0800 +Subject: [PATCH] scsi: qla2xxx: edif: Fix clang warning +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2f5fab1b6c3a8efc93ba52c28539c45a8d0142ad + +[ Upstream commit 2f5fab1b6c3a8efc93ba52c28539c45a8d0142ad ] + +clang warning: + + drivers/scsi/qla2xxx/qla_edif_bsg.h:93:12: warning: field remote_pid + within 'struct app_pinfo_req' is less aligned than 'port_id_t' and is + usually due to 'struct app_pinfo_req' being packed, which can lead to + unaligned accesses [-Wunaligned-access] + port_id_t remote_pid; + ^ + 2 warnings generated. + +Remove u32 field in remote_pid to silence warning. + +Reported-by: kernel test robot +Fixes: 7ebb336e45ef ("scsi: qla2xxx: edif: Add start + stop bsgs") +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_edif.c | 4 +++- + drivers/scsi/qla2xxx/qla_edif_bsg.h | 15 ++++++++++++++- + 2 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index 53186a14..38d5bda1 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -925,7 +925,9 @@ qla_edif_app_getfcinfo(scsi_qla_host_t *vha, struct bsg_job *bsg_job) + if (!(fcport->flags & FCF_FCSP_DEVICE)) + continue; + +- tdid = app_req.remote_pid; ++ tdid.b.domain = app_req.remote_pid.domain; ++ tdid.b.area = app_req.remote_pid.area; ++ tdid.b.al_pa = app_req.remote_pid.al_pa; + + ql_dbg(ql_dbg_edif, vha, 0x2058, + "APP request entry - portid=%06x.\n", tdid.b24); +diff --git a/drivers/scsi/qla2xxx/qla_edif_bsg.h b/drivers/scsi/qla2xxx/qla_edif_bsg.h +index 0931f4e4..514c265b 100644 +--- a/drivers/scsi/qla2xxx/qla_edif_bsg.h ++++ b/drivers/scsi/qla2xxx/qla_edif_bsg.h +@@ -89,7 +89,20 @@ struct app_plogi_reply { + struct app_pinfo_req { + struct app_id app_info; + uint8_t num_ports; +- port_id_t remote_pid; ++ struct { ++#ifdef __BIG_ENDIAN ++ uint8_t domain; ++ uint8_t area; ++ uint8_t al_pa; ++#elif defined(__LITTLE_ENDIAN) ++ uint8_t al_pa; ++ uint8_t area; ++ uint8_t domain; ++#else ++#error "__BIG_ENDIAN or __LITTLE_ENDIAN must be defined!" ++#endif ++ uint8_t rsvd_1; ++ } remote_pid; + uint8_t version; + uint8_t pad[VND_CMD_PAD_SIZE]; + uint8_t reserved[VND_CMD_APP_RESERVED_SIZE]; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-357-ASoC-fsl_sai-initialize-is_dsp_mode-flag.patch b/patches.kernel.org/6.2.3-357-ASoC-fsl_sai-initialize-is_dsp_mode-flag.patch new file mode 100644 index 0000000..b100df0 --- /dev/null +++ b/patches.kernel.org/6.2.3-357-ASoC-fsl_sai-initialize-is_dsp_mode-flag.patch @@ -0,0 +1,43 @@ +From: Shengjiu Wang +Date: Mon, 16 Jan 2023 15:07:54 +0800 +Subject: [PATCH] ASoC: fsl_sai: initialize is_dsp_mode flag +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a23924b7dd7b748fff8e305e1daf590fed2af21b + +[ Upstream commit a23924b7dd7b748fff8e305e1daf590fed2af21b ] + +Initialize is_dsp_mode flag in the beginning of function +fsl_sai_set_dai_fmt_tr(). + +When the DAIFMT is DAIFMT_DSP_B the first time, is_dsp_mode is +true, then the second time DAIFMT is DAIFMT_I2S, is_dsp_mode +still true, which is a wrong state. So need to initialize +is_dsp_mode flag every time. + +Fixes: a3f7dcc9cc03 ("ASoC: fsl-sai: Add SND_SOC_DAIFMT_DSP_A/B support.") +Signed-off-by: Shengjiu Wang +Reviewed-by: Iuliana Prodan +Link: https://lore.kernel.org/r/1673852874-32200-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/fsl/fsl_sai.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index 35a52c3a..4967f2da 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -281,6 +281,7 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai, + val_cr4 |= FSL_SAI_CR4_MF; + + sai->is_pdm_mode = false; ++ sai->is_dsp_mode = false; + /* DAI mode */ + switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_I2S: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-358-drm-bridge-tc358767-Set-default-CLRSIPO-count.patch b/patches.kernel.org/6.2.3-358-drm-bridge-tc358767-Set-default-CLRSIPO-count.patch new file mode 100644 index 0000000..bb7d885 --- /dev/null +++ b/patches.kernel.org/6.2.3-358-drm-bridge-tc358767-Set-default-CLRSIPO-count.patch @@ -0,0 +1,46 @@ +From: Marek Vasut +Date: Sun, 16 Oct 2022 02:35:56 +0200 +Subject: [PATCH] drm/bridge: tc358767: Set default CLRSIPO count +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 01338bb82fed40a6a234c2b36a92367c8671adf0 + +[ Upstream commit 01338bb82fed40a6a234c2b36a92367c8671adf0 ] + +The current CLRSIPO count is still marginal and does not work with high +DSI clock rates in burst mode. Increase it further to allow the DSI link +to work at up to 1Gbps lane speed. This returns the counts to defaults +as provided by datasheet. + +Fixes: ea6490b02240b ("drm/bridge: tc358767: increase CLRSIPO count") +Signed-off-by: Marek Vasut +Acked-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20221016003556.406441-1-marex@denx.de +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/tc358767.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index 2a58eb27..b9b68108 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -1264,10 +1264,10 @@ static int tc_dsi_rx_enable(struct tc_data *tc) + u32 value; + int ret; + +- regmap_write(tc->regmap, PPI_D0S_CLRSIPOCOUNT, 5); +- regmap_write(tc->regmap, PPI_D1S_CLRSIPOCOUNT, 5); +- regmap_write(tc->regmap, PPI_D2S_CLRSIPOCOUNT, 5); +- regmap_write(tc->regmap, PPI_D3S_CLRSIPOCOUNT, 5); ++ regmap_write(tc->regmap, PPI_D0S_CLRSIPOCOUNT, 25); ++ regmap_write(tc->regmap, PPI_D1S_CLRSIPOCOUNT, 25); ++ regmap_write(tc->regmap, PPI_D2S_CLRSIPOCOUNT, 25); ++ regmap_write(tc->regmap, PPI_D3S_CLRSIPOCOUNT, 25); + regmap_write(tc->regmap, PPI_D0S_ATMR, 0); + regmap_write(tc->regmap, PPI_D1S_ATMR, 0); + regmap_write(tc->regmap, PPI_TX_RX_TA, TTA_GET | TTA_SURE); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-359-drm-msm-adreno-Fix-null-ptr-access-in-adreno_gp.patch b/patches.kernel.org/6.2.3-359-drm-msm-adreno-Fix-null-ptr-access-in-adreno_gp.patch new file mode 100644 index 0000000..c6ac96b --- /dev/null +++ b/patches.kernel.org/6.2.3-359-drm-msm-adreno-Fix-null-ptr-access-in-adreno_gp.patch @@ -0,0 +1,87 @@ +From: Akhil P Oommen +Date: Wed, 21 Dec 2022 20:39:56 +0530 +Subject: [PATCH] drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dbeedbcb268d055d8895aceca427f897e12c2b50 + +[ Upstream commit dbeedbcb268d055d8895aceca427f897e12c2b50 ] + +Fix the below kernel panic due to null pointer access: +[ 18.504431] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 +[ 18.513464] Mem abort info: +[ 18.516346] ESR = 0x0000000096000005 +[ 18.520204] EC = 0x25: DABT (current EL), IL = 32 bits +[ 18.525706] SET = 0, FnV = 0 +[ 18.528878] EA = 0, S1PTW = 0 +[ 18.532117] FSC = 0x05: level 1 translation fault +[ 18.537138] Data abort info: +[ 18.540110] ISV = 0, ISS = 0x00000005 +[ 18.544060] CM = 0, WnR = 0 +[ 18.547109] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000112826000 +[ 18.553738] [0000000000000048] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 +[ 18.562690] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP +**Snip** +[ 18.696758] Call trace: +[ 18.699278] adreno_gpu_cleanup+0x30/0x88 +[ 18.703396] a6xx_destroy+0xc0/0x130 +[ 18.707066] a6xx_gpu_init+0x308/0x424 +[ 18.710921] adreno_bind+0x178/0x288 +[ 18.714590] component_bind_all+0xe0/0x214 +[ 18.718797] msm_drm_bind+0x1d4/0x614 +[ 18.722566] try_to_bring_up_aggregate_device+0x16c/0x1b8 +[ 18.728105] __component_add+0xa0/0x158 +[ 18.732048] component_add+0x20/0x2c +[ 18.735719] adreno_probe+0x40/0xc0 +[ 18.739300] platform_probe+0xb4/0xd4 +[ 18.743068] really_probe+0xfc/0x284 +[ 18.746738] __driver_probe_device+0xc0/0xec +[ 18.751129] driver_probe_device+0x48/0x110 +[ 18.755421] __device_attach_driver+0xa8/0xd0 +[ 18.759900] bus_for_each_drv+0x90/0xdc +[ 18.763843] __device_attach+0xfc/0x174 +[ 18.767786] device_initial_probe+0x20/0x2c +[ 18.772090] bus_probe_device+0x40/0xa0 +[ 18.776032] deferred_probe_work_func+0x94/0xd0 +[ 18.780686] process_one_work+0x190/0x3d0 +[ 18.784805] worker_thread+0x280/0x3d4 +[ 18.788659] kthread+0x104/0x1c0 +[ 18.791981] ret_from_fork+0x10/0x20 +[ 18.795654] Code: f9400408 aa0003f3 aa1f03f4 91142015 (f9402516) +[ 18.801913] ---[ end trace 0000000000000000 ]--- +[ 18.809039] Kernel panic - not syncing: Oops: Fatal exception + +Fixes: 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}") +Signed-off-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/515605/ +Link: https://lore.kernel.org/r/20221221203925.v2.1.Ib978de92c4bd000b515486aad72e96c2481f84d0@changeid +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 3605f095..81759976 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -1083,13 +1083,13 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, + void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu) + { + struct msm_gpu *gpu = &adreno_gpu->base; +- struct msm_drm_private *priv = gpu->dev->dev_private; ++ struct msm_drm_private *priv = gpu->dev ? gpu->dev->dev_private : NULL; + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++) + release_firmware(adreno_gpu->fw[i]); + +- if (pm_runtime_enabled(&priv->gpu_pdev->dev)) ++ if (priv && pm_runtime_enabled(&priv->gpu_pdev->dev)) + pm_runtime_disable(&priv->gpu_pdev->dev); + + msm_gpu_cleanup(&adreno_gpu->base); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-360-ALSA-hda-ca0132-minor-fix-for-allocation-size.patch b/patches.kernel.org/6.2.3-360-ALSA-hda-ca0132-minor-fix-for-allocation-size.patch new file mode 100644 index 0000000..459c0d9 --- /dev/null +++ b/patches.kernel.org/6.2.3-360-ALSA-hda-ca0132-minor-fix-for-allocation-size.patch @@ -0,0 +1,41 @@ +From: "Alexey V. Vissarionov" +Date: Tue, 17 Jan 2023 14:15:23 +0300 +Subject: [PATCH] ALSA: hda/ca0132: minor fix for allocation size +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 + +[ Upstream commit 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 ] + +Although the "dma_chan" pointer occupies more or equal space compared +to "*dma_chan", the allocation size should use the size of variable +itself. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 01ef7dbffb41 ("ALSA: hda - Update CA0132 codec to load DSP firmware binary") +Signed-off-by: Alexey V. Vissarionov +Link: https://lore.kernel.org/r/20230117111522.GA15213@altlinux.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_ca0132.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 0a292bf2..acde4cd5 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -2455,7 +2455,7 @@ static int dspio_set_uint_param(struct hda_codec *codec, int mod_id, + static int dspio_alloc_dma_chan(struct hda_codec *codec, unsigned int *dma_chan) + { + int status = 0; +- unsigned int size = sizeof(dma_chan); ++ unsigned int size = sizeof(*dma_chan); + + codec_dbg(codec, " dspio_alloc_dma_chan() -- begin\n"); + status = dspio_scp(codec, MASTERCONTROL, 0x20, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-361-drm-amdgpu-Use-the-sched-from-entity-for-amdgpu.patch b/patches.kernel.org/6.2.3-361-drm-amdgpu-Use-the-sched-from-entity-for-amdgpu.patch new file mode 100644 index 0000000..8cc8cc5 --- /dev/null +++ b/patches.kernel.org/6.2.3-361-drm-amdgpu-Use-the-sched-from-entity-for-amdgpu.patch @@ -0,0 +1,50 @@ +From: Leo Liu +Date: Mon, 16 Jan 2023 09:55:57 -0500 +Subject: [PATCH] drm/amdgpu: Use the sched from entity for amdgpu_cs trace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cf22ef78f22ce4df4757472c5dbd33c430c5b659 + +[ Upstream commit cf22ef78f22ce4df4757472c5dbd33c430c5b659 ] + +The problem is that base sched hasn't been assigned yet at this moment, +causing something like "ring=0" all the time from trace. + +mpv:cs0-3473 [002] ..... 129.047431: amdgpu_cs: ring=0, dw=48, fences=0 +mpv:cs0-3473 [002] ..... 129.089125: amdgpu_cs: ring=0, dw=48, fences=0 +mpv:cs0-3473 [002] ..... 129.130987: amdgpu_cs: ring=0, dw=48, fences=0 +mpv:cs0-3473 [002] ..... 129.172478: amdgpu_cs: ring=0, dw=48, fences=0 + +Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6") +Signed-off-by: Leo Liu +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h +index 677ad201..98d91ebf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h +@@ -153,10 +153,10 @@ TRACE_EVENT(amdgpu_cs, + + TP_fast_assign( + __entry->bo_list = p->bo_list; +- __entry->ring = to_amdgpu_ring(job->base.sched)->idx; ++ __entry->ring = to_amdgpu_ring(job->base.entity->rq->sched)->idx; + __entry->dw = ib->length_dw; + __entry->fences = amdgpu_fence_count_emitted( +- to_amdgpu_ring(job->base.sched)); ++ to_amdgpu_ring(job->base.entity->rq->sched)); + ), + TP_printk("bo_list=%p, ring=%u, dw=%u, fences=%u", + __entry->bo_list, __entry->ring, __entry->dw, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-362-drm-msm-gem-Add-check-for-kmalloc.patch b/patches.kernel.org/6.2.3-362-drm-msm-gem-Add-check-for-kmalloc.patch new file mode 100644 index 0000000..15d4166 --- /dev/null +++ b/patches.kernel.org/6.2.3-362-drm-msm-gem-Add-check-for-kmalloc.patch @@ -0,0 +1,42 @@ +From: Jiasheng Jiang +Date: Mon, 12 Dec 2022 17:11:17 +0800 +Subject: [PATCH] drm/msm/gem: Add check for kmalloc +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d839f0811a31322c087a859c2b181e2383daa7be + +[ Upstream commit d839f0811a31322c087a859c2b181e2383daa7be ] + +Add the check for the return value of kmalloc in order to avoid +NULL pointer dereference in copy_from_user. + +Fixes: 20224d715a88 ("drm/msm/submit: Move copy_from_user ahead of locking bos") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/514678/ +Link: https://lore.kernel.org/r/20221212091117.43511-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/msm_gem_submit.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c +index 73a2ca12..1c4be193 100644 +--- a/drivers/gpu/drm/msm/msm_gem_submit.c ++++ b/drivers/gpu/drm/msm/msm_gem_submit.c +@@ -209,6 +209,10 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit, + goto out; + } + submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL); ++ if (!submit->cmd[i].relocs) { ++ ret = -ENOMEM; ++ goto out; ++ } + ret = copy_from_user(submit->cmd[i].relocs, userptr, sz); + if (ret) { + ret = -EFAULT; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-363-drm-msm-dpu-Disallow-unallocated-resources-to-b.patch b/patches.kernel.org/6.2.3-363-drm-msm-dpu-Disallow-unallocated-resources-to-b.patch new file mode 100644 index 0000000..9d5220c --- /dev/null +++ b/patches.kernel.org/6.2.3-363-drm-msm-dpu-Disallow-unallocated-resources-to-b.patch @@ -0,0 +1,58 @@ +From: Marijn Suijten +Date: Tue, 10 Jan 2023 00:15:55 +0100 +Subject: [PATCH] drm/msm/dpu: Disallow unallocated resources to be returned +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: abc40122d9a69f56c04efb5a7485795f5ac799d1 + +[ Upstream commit abc40122d9a69f56c04efb5a7485795f5ac799d1 ] + +In the event that the topology requests resources that have not been +created by the system (because they are typically not represented in +dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC +blocks, until their allocation/assignment is being sanity-checked in +"drm/msm/dpu: Reject topologies for which no DSC blocks are available") +remain NULL but will still be returned out of +dpu_rm_get_assigned_resources, where the caller expects to get an array +containing num_blks valid pointers (but instead gets these NULLs). + +To prevent this from happening, where null-pointer dereferences +typically result in a hard-to-debug platform lockup, num_blks shouldn't +increase past NULL blocks and will print an error and break instead. +After all, max_blks represents the static size of the maximum number of +blocks whereas the actual amount varies per platform. + +^1: which can happen after a git rebase ended up moving additions to +_dpu_cfg to a different struct which has the same patch context. + +Fixes: bb00a452d6f7 ("drm/msm/dpu: Refactor resource manager") +Signed-off-by: Marijn Suijten +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/517636/ +Link: https://lore.kernel.org/r/20230109231556.344977-1-marijn.suijten@somainline.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c +index 73b3442e..7ada957a 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c +@@ -660,6 +660,11 @@ int dpu_rm_get_assigned_resources(struct dpu_rm *rm, + blks_size, enc_id); + break; + } ++ if (!hw_blks[i]) { ++ DPU_ERROR("Allocated resource %d unavailable to assign to enc %d\n", ++ type, enc_id); ++ break; ++ } + blks[num_blks++] = hw_blks[i]; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-364-drm-bridge-lt9611-fix-sleep-mode-setup.patch b/patches.kernel.org/6.2.3-364-drm-bridge-lt9611-fix-sleep-mode-setup.patch new file mode 100644 index 0000000..109bf18 --- /dev/null +++ b/patches.kernel.org/6.2.3-364-drm-bridge-lt9611-fix-sleep-mode-setup.patch @@ -0,0 +1,47 @@ +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:46 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix sleep mode setup +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ae2d329f104b75a0a78dcaded29fe6283289cdf9 + +[ Upstream commit ae2d329f104b75a0a78dcaded29fe6283289cdf9 ] + +On atomic_post_disable the bridge goes to the low power state. However +the code disables too much of the chip, so the HPD event is not being +detected and delivered to the host. Reduce the power saving in order to +get the HPD event. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-2-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 7c0a9917..2714184c 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -448,12 +448,11 @@ static void lt9611_sleep_setup(struct lt9611 *lt9611) + { 0x8023, 0x01 }, + { 0x8157, 0x03 }, /* set addr pin as output */ + { 0x8149, 0x0b }, +- { 0x8151, 0x30 }, /* disable IRQ */ ++ + { 0x8102, 0x48 }, /* MIPI Rx power down */ + { 0x8123, 0x80 }, + { 0x8130, 0x00 }, +- { 0x8100, 0x01 }, /* bandgap power down */ +- { 0x8101, 0x00 }, /* system clk power down */ ++ { 0x8011, 0x0a }, + }; + + regmap_multi_reg_write(lt9611->regmap, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-365-drm-bridge-lt9611-fix-HPD-reenablement.patch b/patches.kernel.org/6.2.3-365-drm-bridge-lt9611-fix-HPD-reenablement.patch new file mode 100644 index 0000000..8955b9d --- /dev/null +++ b/patches.kernel.org/6.2.3-365-drm-bridge-lt9611-fix-HPD-reenablement.patch @@ -0,0 +1,53 @@ +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:47 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix HPD reenablement +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a7790f6bd38f3642b60ae3504a2c749135b89451 + +[ Upstream commit a7790f6bd38f3642b60ae3504a2c749135b89451 ] + +The driver will reset the bridge in the atomic_pre_enable(). However +this will also drop the HPD interrupt state. Instead of resetting the +bridge, properly wake it up. This fixes the HPD interrupt delivery after +the disable/enable cycle. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-3-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 2714184c..58f39b27 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -856,12 +856,18 @@ static enum drm_mode_status lt9611_bridge_mode_valid(struct drm_bridge *bridge, + static void lt9611_bridge_pre_enable(struct drm_bridge *bridge) + { + struct lt9611 *lt9611 = bridge_to_lt9611(bridge); ++ static const struct reg_sequence reg_cfg[] = { ++ { 0x8102, 0x12 }, ++ { 0x8123, 0x40 }, ++ { 0x8130, 0xea }, ++ { 0x8011, 0xfa }, ++ }; + + if (!lt9611->sleep) + return; + +- lt9611_reset(lt9611); +- regmap_write(lt9611->regmap, 0x80ee, 0x01); ++ regmap_multi_reg_write(lt9611->regmap, ++ reg_cfg, ARRAY_SIZE(reg_cfg)); + + lt9611->sleep = false; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-366-drm-bridge-lt9611-fix-polarity-programming.patch b/patches.kernel.org/6.2.3-366-drm-bridge-lt9611-fix-polarity-programming.patch new file mode 100644 index 0000000..624807c --- /dev/null +++ b/patches.kernel.org/6.2.3-366-drm-bridge-lt9611-fix-polarity-programming.patch @@ -0,0 +1,69 @@ +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:48 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix polarity programming +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0b157efa384ea417304b1da284ee2f603c607fc3 + +[ Upstream commit 0b157efa384ea417304b1da284ee2f603c607fc3 ] + +Fix programming of hsync and vsync polarities + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-4-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 58f39b27..deb503ca 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -207,7 +207,6 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + + /* stage 2 */ + { 0x834a, 0x40 }, +- { 0x831d, 0x10 }, + + /* MK limit */ + { 0x832d, 0x38 }, +@@ -222,11 +221,19 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + { 0x8325, 0x00 }, + { 0x832a, 0x01 }, + { 0x834a, 0x10 }, +- { 0x831d, 0x10 }, +- { 0x8326, 0x37 }, + }; ++ u8 pol = 0x10; + +- regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); ++ if (mode->flags & DRM_MODE_FLAG_NHSYNC) ++ pol |= 0x2; ++ if (mode->flags & DRM_MODE_FLAG_NVSYNC) ++ pol |= 0x1; ++ regmap_write(lt9611->regmap, 0x831d, pol); ++ ++ if (mode->hdisplay == 3840) ++ regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2)); ++ else ++ regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + + switch (mode->hdisplay) { + case 640: +@@ -236,7 +243,7 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + regmap_write(lt9611->regmap, 0x8326, 0x37); + break; + case 3840: +- regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2)); ++ regmap_write(lt9611->regmap, 0x8326, 0x37); + break; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-367-drm-bridge-lt9611-fix-programming-of-video-mode.patch b/patches.kernel.org/6.2.3-367-drm-bridge-lt9611-fix-programming-of-video-mode.patch new file mode 100644 index 0000000..6b25c31 --- /dev/null +++ b/patches.kernel.org/6.2.3-367-drm-bridge-lt9611-fix-programming-of-video-mode.patch @@ -0,0 +1,39 @@ +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:49 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix programming of video modes +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ad188aa47edaa033a270e1a3efae43836ff47569 + +[ Upstream commit ad188aa47edaa033a270e1a3efae43836ff47569 ] + +Program the upper part of the hfront_porch into the proper register. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-5-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index deb503ca..f377052a 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -187,7 +187,8 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611, + + regmap_write(lt9611->regmap, 0x8319, (u8)(hfront_porch % 256)); + +- regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256)); ++ regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256) | ++ ((hfront_porch / 256) << 4)); + regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256)); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-368-drm-bridge-lt9611-fix-clock-calculation.patch b/patches.kernel.org/6.2.3-368-drm-bridge-lt9611-fix-clock-calculation.patch new file mode 100644 index 0000000..597fc84 --- /dev/null +++ b/patches.kernel.org/6.2.3-368-drm-bridge-lt9611-fix-clock-calculation.patch @@ -0,0 +1,107 @@ +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:50 +0200 +Subject: [PATCH] drm/bridge: lt9611: fix clock calculation +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2576eb26494eb0509dd9ceb0cd27771a7a5e3674 + +[ Upstream commit 2576eb26494eb0509dd9ceb0cd27771a7a5e3674 ] + +Instead of having several fixed values for the pcr register, calculate +it before programming. This allows the bridge to support most of the +display modes. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-6-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 32 +++++++++++-------------- + 1 file changed, 14 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index f377052a..e2799a0d 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -192,8 +192,9 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611, + regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256)); + } + +-static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode) ++static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int postdiv) + { ++ unsigned int pcr_m = mode->clock * 5 * postdiv / 27000; + const struct reg_sequence reg_cfg[] = { + { 0x830b, 0x01 }, + { 0x830c, 0x10 }, +@@ -236,24 +237,14 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + else + regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + +- switch (mode->hdisplay) { +- case 640: +- regmap_write(lt9611->regmap, 0x8326, 0x14); +- break; +- case 1920: +- regmap_write(lt9611->regmap, 0x8326, 0x37); +- break; +- case 3840: +- regmap_write(lt9611->regmap, 0x8326, 0x37); +- break; +- } ++ regmap_write(lt9611->regmap, 0x8326, pcr_m); + + /* pcr rst */ + regmap_write(lt9611->regmap, 0x8011, 0x5a); + regmap_write(lt9611->regmap, 0x8011, 0xfa); + } + +-static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode) ++static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int *postdiv) + { + unsigned int pclk = mode->clock; + const struct reg_sequence reg_cfg[] = { +@@ -271,12 +262,16 @@ static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode + + regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + +- if (pclk > 150000) ++ if (pclk > 150000) { + regmap_write(lt9611->regmap, 0x812d, 0x88); +- else if (pclk > 70000) ++ *postdiv = 1; ++ } else if (pclk > 70000) { + regmap_write(lt9611->regmap, 0x812d, 0x99); +- else ++ *postdiv = 2; ++ } else { + regmap_write(lt9611->regmap, 0x812d, 0xaa); ++ *postdiv = 4; ++ } + + /* + * first divide pclk by 2 first +@@ -895,14 +890,15 @@ static void lt9611_bridge_mode_set(struct drm_bridge *bridge, + { + struct lt9611 *lt9611 = bridge_to_lt9611(bridge); + struct hdmi_avi_infoframe avi_frame; ++ unsigned int postdiv; + int ret; + + lt9611_bridge_pre_enable(bridge); + + lt9611_mipi_input_digital(lt9611, mode); +- lt9611_pll_setup(lt9611, mode); ++ lt9611_pll_setup(lt9611, mode, &postdiv); + lt9611_mipi_video_setup(lt9611, mode); +- lt9611_pcr_setup(lt9611, mode); ++ lt9611_pcr_setup(lt9611, mode, postdiv); + + ret = drm_hdmi_avi_infoframe_from_display_mode(&avi_frame, + <9611->connector, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-369-drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch b/patches.kernel.org/6.2.3-369-drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch new file mode 100644 index 0000000..3e92af2 --- /dev/null +++ b/patches.kernel.org/6.2.3-369-drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch @@ -0,0 +1,38 @@ +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 10:16:51 +0200 +Subject: [PATCH] drm/bridge: lt9611: pass a pointer to the of node +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b0a7f8736789935f62d6df32d441cdf05a5c05d2 + +[ Upstream commit b0a7f8736789935f62d6df32d441cdf05a5c05d2 ] + +Pass a pointer to the OF node while registering lt9611 MIPI device. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-7-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index e2799a0d..3b77238c 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -769,7 +769,7 @@ static const struct drm_connector_funcs lt9611_bridge_connector_funcs = { + static struct mipi_dsi_device *lt9611_attach_dsi(struct lt9611 *lt9611, + struct device_node *dsi_node) + { +- const struct mipi_dsi_device_info info = { "lt9611", 0, NULL }; ++ const struct mipi_dsi_device_info info = { "lt9611", 0, lt9611->dev->of_node}; + struct mipi_dsi_device *dsi; + struct mipi_dsi_host *host; + struct device *dev = lt9611->dev; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-370-regulator-tps65219-use-IS_ERR-to-detect-an-erro.patch b/patches.kernel.org/6.2.3-370-regulator-tps65219-use-IS_ERR-to-detect-an-erro.patch new file mode 100644 index 0000000..d12a0ff --- /dev/null +++ b/patches.kernel.org/6.2.3-370-regulator-tps65219-use-IS_ERR-to-detect-an-erro.patch @@ -0,0 +1,52 @@ +From: Randy Dunlap +Date: Sat, 14 Jan 2023 10:57:36 -0800 +Subject: [PATCH] regulator: tps65219: use IS_ERR() to detect an error pointer +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2bbba115c3c9a647bcb3201b014fcc3728fe75c8 + +[ Upstream commit 2bbba115c3c9a647bcb3201b014fcc3728fe75c8 ] + +Fix pointer comparison to integer warning from gcc & sparse: + +GCC: +../drivers/regulator/tps65219-regulator.c:370:26: warning: ordered comparison of pointer with integer zero [-Wextra] + 370 | if (rdev < 0) { + | ^ + +sparse warning: +drivers/regulator/tps65219-regulator.c:370:26: sparse: error: incompatible types for operation (<): +drivers/regulator/tps65219-regulator.c:370:26: sparse: struct regulator_dev *[assigned] rdev +drivers/regulator/tps65219-regulator.c:370:26: sparse: int + +Fixes: c12ac5fc3e0a ("regulator: drivers: Add TI TPS65219 PMIC regulators support") +Signed-off-by: Randy Dunlap +Cc: Jerome Neanne +Cc: Tony Lindgren +Cc: linux-omap@vger.kernel.org +Cc: Liam Girdwood +Cc: Mark Brown +Link: https://lore.kernel.org/r/20230114185736.2076-1-rdunlap@infradead.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/regulator/tps65219-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/tps65219-regulator.c b/drivers/regulator/tps65219-regulator.c +index c484c943..070159cb 100644 +--- a/drivers/regulator/tps65219-regulator.c ++++ b/drivers/regulator/tps65219-regulator.c +@@ -367,7 +367,7 @@ static int tps65219_regulator_probe(struct platform_device *pdev) + irq_data[i].type = irq_type; + + tps65219_get_rdev_by_name(irq_type->regulator_name, rdevtbl, rdev); +- if (rdev < 0) { ++ if (IS_ERR(rdev)) { + dev_err(tps->dev, "Failed to get rdev for %s\n", + irq_type->regulator_name); + return -EINVAL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-371-drm-mipi-dsi-Fix-byte-order-of-16-bit-DCS-set-g.patch b/patches.kernel.org/6.2.3-371-drm-mipi-dsi-Fix-byte-order-of-16-bit-DCS-set-g.patch new file mode 100644 index 0000000..0746b57 --- /dev/null +++ b/patches.kernel.org/6.2.3-371-drm-mipi-dsi-Fix-byte-order-of-16-bit-DCS-set-g.patch @@ -0,0 +1,118 @@ +From: Daniel Mentz +Date: Mon, 16 Jan 2023 17:49:07 -0500 +Subject: [PATCH] drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c9d27c6be518b4ef2966d9564654ef99292ea1b3 + +[ Upstream commit c9d27c6be518b4ef2966d9564654ef99292ea1b3 ] + +The MIPI DCS specification demands that brightness values are sent in +big endian byte order. It also states that one parameter (i.e. one byte) +shall be sent/received for 8 bit wide values, and two parameters shall +be used for values that are between 9 and 16 bits wide. + +Add new functions to properly handle 16-bit brightness in big endian, +since the two 8- and 16-bit cases are distinct from each other. + +[richard: use separate functions instead of switch/case] +[richard: split into 16-bit component] + +Fixes: 1a9d759331b8 ("drm/dsi: Implement DCS set/get display brightness") +Signed-off-by: Daniel Mentz +Link: https://android.googlesource.com/kernel/msm/+/754affd62d0ee268c686c53169b1dbb7deac8550 +[richard: fix 16-bit brightness_get] +Signed-off-by: Richard Acayan +Tested-by: Caleb Connolly +Reviewed-by: Neil Armstrong +Reviewed-by: Sam Ravnborg +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230116224909.23884-2-mailingradian@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_mipi_dsi.c | 52 ++++++++++++++++++++++++++++++++++ + include/drm/drm_mipi_dsi.h | 4 +++ + 2 files changed, 56 insertions(+) + +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index 497ef4b6..4bc15fbd 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -1224,6 +1224,58 @@ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi, + } + EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness); + ++/** ++ * mipi_dsi_dcs_set_display_brightness_large() - sets the 16-bit brightness value ++ * of the display ++ * @dsi: DSI peripheral device ++ * @brightness: brightness value ++ * ++ * Return: 0 on success or a negative error code on failure. ++ */ ++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 brightness) ++{ ++ u8 payload[2] = { brightness >> 8, brightness & 0xff }; ++ ssize_t err; ++ ++ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_DISPLAY_BRIGHTNESS, ++ payload, sizeof(payload)); ++ if (err < 0) ++ return err; ++ ++ return 0; ++} ++EXPORT_SYMBOL(mipi_dsi_dcs_set_display_brightness_large); ++ ++/** ++ * mipi_dsi_dcs_get_display_brightness_large() - gets the current 16-bit ++ * brightness value of the display ++ * @dsi: DSI peripheral device ++ * @brightness: brightness value ++ * ++ * Return: 0 on success or a negative error code on failure. ++ */ ++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 *brightness) ++{ ++ u8 brightness_be[2]; ++ ssize_t err; ++ ++ err = mipi_dsi_dcs_read(dsi, MIPI_DCS_GET_DISPLAY_BRIGHTNESS, ++ brightness_be, sizeof(brightness_be)); ++ if (err <= 0) { ++ if (err == 0) ++ err = -ENODATA; ++ ++ return err; ++ } ++ ++ *brightness = (brightness_be[0] << 8) | brightness_be[1]; ++ ++ return 0; ++} ++EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness_large); ++ + static int mipi_dsi_drv_probe(struct device *dev) + { + struct mipi_dsi_driver *drv = to_mipi_dsi_driver(dev->driver); +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index 20b21b57..9054a518 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -296,6 +296,10 @@ int mipi_dsi_dcs_set_display_brightness(struct mipi_dsi_device *dsi, + u16 brightness); + int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi, + u16 *brightness); ++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 brightness); ++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 *brightness); + + /** + * mipi_dsi_dcs_write_seq - transmit a DCS command with payload +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-372-drm-exynos-dsi-Fix-MIPI_DSI-_NO_-mode-flags.patch b/patches.kernel.org/6.2.3-372-drm-exynos-dsi-Fix-MIPI_DSI-_NO_-mode-flags.patch new file mode 100644 index 0000000..f305a30 --- /dev/null +++ b/patches.kernel.org/6.2.3-372-drm-exynos-dsi-Fix-MIPI_DSI-_NO_-mode-flags.patch @@ -0,0 +1,107 @@ +From: Jagan Teki +Date: Mon, 12 Dec 2022 20:27:44 +0530 +Subject: [PATCH] drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 996e1defca34485dd2bd70b173f069aab5f21a65 + +[ Upstream commit 996e1defca34485dd2bd70b173f069aab5f21a65 ] + +HFP/HBP/HSA/EOT_PACKET modes in Exynos DSI host specifies +0 = Enable and 1 = Disable. + +The logic for checking these mode flags was correct before +the MIPI_DSI*_NO_* mode flag conversion. + +This patch is trying to fix this MIPI_DSI*_NO_* mode flags handling +Exynos DSI host and update the mode_flags in relevant panel drivers. + +Fixes: 0f3b68b66a6d ("drm/dsi: Add _NO_ to MIPI_DSI_* flags disabling features") +Reviewed-by: Marek Vasut +Reviewed-by: Nicolas Boichat +Reported-by: Sébastien Szymanski +Signed-off-by: Jagan Teki +Reviewed-by: Frieder Schrempf +Signed-off-by: Marek Vasut +Link: https://patchwork.freedesktop.org/patch/msgid/20221212145745.15387-1-jagan@amarulasolutions.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 ++++---- + drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c | 4 +++- + drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c | 3 ++- + drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 -- + 4 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +index ec673223..b5305b14 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +@@ -805,15 +805,15 @@ static int exynos_dsi_init_link(struct exynos_dsi *dsi) + reg |= DSIM_AUTO_MODE; + if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_HSE) + reg |= DSIM_HSE_MODE; +- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP)) ++ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP) + reg |= DSIM_HFP_MODE; +- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP)) ++ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP) + reg |= DSIM_HBP_MODE; +- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA)) ++ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA) + reg |= DSIM_HSA_MODE; + } + +- if (!(dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET)) ++ if (dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET) + reg |= DSIM_EOT_DISABLE; + + switch (dsi->format) { +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c +index 5c621b15..439ef307 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c +@@ -692,7 +692,9 @@ static int s6e3ha2_probe(struct mipi_dsi_device *dsi) + + dsi->lanes = 4; + dsi->format = MIPI_DSI_FMT_RGB888; +- dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS; ++ dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS | ++ MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP | ++ MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET; + + ctx->supplies[0].supply = "vdd3"; + ctx->supplies[1].supply = "vci"; +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c +index e06fd35d..9c3e7617 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c +@@ -446,7 +446,8 @@ static int s6e63j0x03_probe(struct mipi_dsi_device *dsi) + + dsi->lanes = 1; + dsi->format = MIPI_DSI_FMT_RGB888; +- dsi->mode_flags = MIPI_DSI_MODE_NO_EOT_PACKET; ++ dsi->mode_flags = MIPI_DSI_MODE_VIDEO_NO_HFP | ++ MIPI_DSI_MODE_VIDEO_NO_HBP | MIPI_DSI_MODE_VIDEO_NO_HSA; + + ctx->supplies[0].supply = "vdd3"; + ctx->supplies[1].supply = "vci"; +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +index 54213bea..ebf4c2d3 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +@@ -990,8 +990,6 @@ static int s6e8aa0_probe(struct mipi_dsi_device *dsi) + dsi->lanes = 4; + dsi->format = MIPI_DSI_FMT_RGB888; + dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST +- | MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP +- | MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET + | MIPI_DSI_MODE_VSYNC_FLUSH | MIPI_DSI_MODE_VIDEO_AUTO_VERT; + + ret = s6e8aa0_parse_dt(ctx); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-373-drm-msm-dsi-Allow-2-CTRLs-on-v2.5.0.patch b/patches.kernel.org/6.2.3-373-drm-msm-dsi-Allow-2-CTRLs-on-v2.5.0.patch new file mode 100644 index 0000000..fd359cf --- /dev/null +++ b/patches.kernel.org/6.2.3-373-drm-msm-dsi-Allow-2-CTRLs-on-v2.5.0.patch @@ -0,0 +1,46 @@ +From: Konrad Dybcio +Date: Fri, 20 Jan 2023 22:00:53 +0100 +Subject: [PATCH] drm/msm/dsi: Allow 2 CTRLs on v2.5.0 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1ae654ded7c5a19dc13f57a4fe4434fef879b6f9 + +[ Upstream commit 1ae654ded7c5a19dc13f57a4fe4434fef879b6f9 ] + +v2.5.0 support was originally added for SC7280, but this hw is also +present on SM8350, which has one more DSI host. Bump up the dsi count +and fill in the register of the secondary host to allow it to probe. + +This should not have any adverse effects on SC7280, as the secondary +CTRL will only be touched if it's defined, anyway. + +Fixes: 65c391b31994 ("drm/msm/dsi: Add DSI support for SC7280") +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/519513/ +Link: https://lore.kernel.org/r/20230120210101.2146852-1-konrad.dybcio@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c +index 7e97c239..e0bd452a 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c +@@ -209,8 +209,8 @@ static const struct msm_dsi_config sc7280_dsi_cfg = { + .num_regulators = ARRAY_SIZE(sc7280_dsi_regulators), + .bus_clk_names = dsi_sc7280_bus_clk_names, + .num_bus_clks = ARRAY_SIZE(dsi_sc7280_bus_clk_names), +- .io_start = { 0xae94000 }, +- .num_dsi = 1, ++ .io_start = { 0xae94000, 0xae96000 }, ++ .num_dsi = 2, + }; + + static const char * const dsi_qcm2290_bus_clk_names[] = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-374-scsi-ufs-exynos-Fix-DMA-alignment-for-PAGE_SIZE.patch b/patches.kernel.org/6.2.3-374-scsi-ufs-exynos-Fix-DMA-alignment-for-PAGE_SIZE.patch new file mode 100644 index 0000000..6c56dfc --- /dev/null +++ b/patches.kernel.org/6.2.3-374-scsi-ufs-exynos-Fix-DMA-alignment-for-PAGE_SIZE.patch @@ -0,0 +1,75 @@ +From: Bart Van Assche +Date: Thu, 12 Jan 2023 15:42:13 -0800 +Subject: [PATCH] scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 86bd0c4a2a5dc4265884648cb92c681646509692 + +[ Upstream commit 86bd0c4a2a5dc4265884648cb92c681646509692 ] + +The Exynos UFS controller only supports scatter/gather list elements that +are aligned on a 4 KiB boundary. Fix DMA alignment in case PAGE_SIZE != +4096. Rename UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE into +UFSHCD_QUIRK_4KB_DMA_ALIGNMENT. + +Cc: Kiwoong Kim +Fixes: 2b2bfc8aa519 ("scsi: ufs: Introduce a quirk to allow only page-aligned sg entries") +Signed-off-by: Bart Van Assche +Reviewed-by: Alim Akhtar +Tested-by: Alim Akhtar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/ufs/core/ufshcd.c | 4 ++-- + drivers/ufs/host/ufs-exynos.c | 2 +- + include/ufs/ufshcd.h | 4 ++-- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 3a1c4d31..fd6f421f 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -5030,8 +5030,8 @@ static int ufshcd_slave_configure(struct scsi_device *sdev) + ufshcd_hpb_configure(hba, sdev); + + blk_queue_update_dma_pad(q, PRDT_DATA_BYTE_COUNT_PAD - 1); +- if (hba->quirks & UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE) +- blk_queue_update_dma_alignment(q, PAGE_SIZE - 1); ++ if (hba->quirks & UFSHCD_QUIRK_4KB_DMA_ALIGNMENT) ++ blk_queue_update_dma_alignment(q, 4096 - 1); + /* + * Block runtime-pm until all consumers are added. + * Refer ufshcd_setup_links(). +diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c +index c3628a86..3cdac89a 100644 +--- a/drivers/ufs/host/ufs-exynos.c ++++ b/drivers/ufs/host/ufs-exynos.c +@@ -1673,7 +1673,7 @@ static const struct exynos_ufs_drv_data exynos_ufs_drvs = { + UFSHCD_QUIRK_BROKEN_OCS_FATAL_ERROR | + UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL | + UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING | +- UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE, ++ UFSHCD_QUIRK_4KB_DMA_ALIGNMENT, + .opts = EXYNOS_UFS_OPT_HAS_APB_CLK_CTRL | + EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL | + EXYNOS_UFS_OPT_BROKEN_RX_SEL_IDX | +diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h +index 727084cd..97a09a14 100644 +--- a/include/ufs/ufshcd.h ++++ b/include/ufs/ufshcd.h +@@ -566,9 +566,9 @@ enum ufshcd_quirks { + UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING = 1 << 13, + + /* +- * This quirk allows only sg entries aligned with page size. ++ * Align DMA SG entries on a 4 KiB boundary. + */ +- UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE = 1 << 14, ++ UFSHCD_QUIRK_4KB_DMA_ALIGNMENT = 1 << 14, + + /* + * This quirk needs to be enabled if the host controller does not +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-375-drm-msm-dpu-sc7180-add-missing-WB2-clock-contro.patch b/patches.kernel.org/6.2.3-375-drm-msm-dpu-sc7180-add-missing-WB2-clock-contro.patch new file mode 100644 index 0000000..a4a7fc0 --- /dev/null +++ b/patches.kernel.org/6.2.3-375-drm-msm-dpu-sc7180-add-missing-WB2-clock-contro.patch @@ -0,0 +1,40 @@ +From: Dmitry Baryshkov +Date: Mon, 16 Jan 2023 12:30:55 +0200 +Subject: [PATCH] drm/msm/dpu: sc7180: add missing WB2 clock control +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 255f056181ac69278dcd8778f0be32a21b2d2a6a + +[ Upstream commit 255f056181ac69278dcd8778f0be32a21b2d2a6a ] + +Add missing DPU_CLK_CTRL_WB2 to sc7180_mdp clocks array. + +Fixes: 51e4d60e6ba5 ("drm/msm/dpu: add writeback support for sc7180") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Tested-by: Jessica Zhang # Trogdor (sc7180) +Patchwork: https://patchwork.freedesktop.org/patch/518504/ +Link: https://lore.kernel.org/r/20230116103055.780767-1-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +index 2196e205..83f1dd2c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +@@ -459,6 +459,8 @@ static const struct dpu_mdp_cfg sc7180_mdp[] = { + .reg_off = 0x2B4, .bit_off = 8}, + .clk_ctrls[DPU_CLK_CTRL_CURSOR1] = { + .reg_off = 0x2C4, .bit_off = 8}, ++ .clk_ctrls[DPU_CLK_CTRL_WB2] = { ++ .reg_off = 0x3B8, .bit_off = 24}, + }, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-376-drm-msm-use-strscpy-instead-of-strncpy.patch b/patches.kernel.org/6.2.3-376-drm-msm-use-strscpy-instead-of-strncpy.patch new file mode 100644 index 0000000..315052c --- /dev/null +++ b/patches.kernel.org/6.2.3-376-drm-msm-use-strscpy-instead-of-strncpy.patch @@ -0,0 +1,48 @@ +From: Dmitry Baryshkov +Date: Wed, 18 Jan 2023 04:01:52 +0200 +Subject: [PATCH] drm/msm: use strscpy instead of strncpy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d7fd8634f48d76aa799ed57beb7d87dab91bde80 + +[ Upstream commit d7fd8634f48d76aa799ed57beb7d87dab91bde80 ] + +Using strncpy can result in non-NULL-terminated destination string. Use +strscpy instead. This fixes following warning: + +drivers/gpu/drm/msm/msm_fence.c: In function ‘msm_fence_context_alloc’: +drivers/gpu/drm/msm/msm_fence.c:25:9: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation] + 25 | strncpy(fctx->name, name, sizeof(fctx->name)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/518787/ +Link: https://lore.kernel.org/r/20230118020152.1689213-1-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/msm_fence.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c +index a47e5837..56641408 100644 +--- a/drivers/gpu/drm/msm/msm_fence.c ++++ b/drivers/gpu/drm/msm/msm_fence.c +@@ -22,7 +22,7 @@ msm_fence_context_alloc(struct drm_device *dev, volatile uint32_t *fenceptr, + return ERR_PTR(-ENOMEM); + + fctx->dev = dev; +- strncpy(fctx->name, name, sizeof(fctx->name)); ++ strscpy(fctx->name, name, sizeof(fctx->name)); + fctx->context = dma_fence_context_alloc(1); + fctx->index = index++; + fctx->fenceptr = fenceptr; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-377-drm-msm-dpu-Add-check-for-cstate.patch b/patches.kernel.org/6.2.3-377-drm-msm-dpu-Add-check-for-cstate.patch new file mode 100644 index 0000000..27cdc46 --- /dev/null +++ b/patches.kernel.org/6.2.3-377-drm-msm-dpu-Add-check-for-cstate.patch @@ -0,0 +1,46 @@ +From: Jiasheng Jiang +Date: Tue, 6 Dec 2022 16:05:17 +0800 +Subject: [PATCH] drm/msm/dpu: Add check for cstate +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c96988b7d99327bb08bd9efd29a203b22cd88ace + +[ Upstream commit c96988b7d99327bb08bd9efd29a203b22cd88ace ] + +As kzalloc may fail and return NULL pointer, +it should be better to check cstate +in order to avoid the NULL pointer dereference +in __drm_atomic_helper_crtc_reset. + +Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Abhinav Kumar +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/514163/ +Link: https://lore.kernel.org/r/20221206080517.43786-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index 13ce3212..22c2787b 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -968,7 +968,10 @@ static void dpu_crtc_reset(struct drm_crtc *crtc) + if (crtc->state) + dpu_crtc_destroy_state(crtc, crtc->state); + +- __drm_atomic_helper_crtc_reset(crtc, &cstate->base); ++ if (cstate) ++ __drm_atomic_helper_crtc_reset(crtc, &cstate->base); ++ else ++ __drm_atomic_helper_crtc_reset(crtc, NULL); + } + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-378-drm-msm-dpu-Add-check-for-pstates.patch b/patches.kernel.org/6.2.3-378-drm-msm-dpu-Add-check-for-pstates.patch new file mode 100644 index 0000000..622e447 --- /dev/null +++ b/patches.kernel.org/6.2.3-378-drm-msm-dpu-Add-check-for-pstates.patch @@ -0,0 +1,41 @@ +From: Jiasheng Jiang +Date: Tue, 6 Dec 2022 16:02:36 +0800 +Subject: [PATCH] drm/msm/dpu: Add check for pstates +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 93340e10b9c5fc86730d149636e0aa8b47bb5a34 + +[ Upstream commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 ] + +As kzalloc may fail and return NULL pointer, +it should be better to check pstates +in order to avoid the NULL pointer dereference. + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/514160/ +Link: https://lore.kernel.org/r/20221206080236.43687-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index 22c2787b..c9d1c412 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -1153,6 +1153,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, + bool needs_dirtyfb = dpu_crtc_needs_dirtyfb(crtc_state); + + pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL); ++ if (!pstates) ++ return -ENOMEM; + + if (!crtc_state->enable || !crtc_state->active) { + DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-379-drm-msm-mdp5-Add-check-for-kzalloc.patch b/patches.kernel.org/6.2.3-379-drm-msm-mdp5-Add-check-for-kzalloc.patch new file mode 100644 index 0000000..b15383d --- /dev/null +++ b/patches.kernel.org/6.2.3-379-drm-msm-mdp5-Add-check-for-kzalloc.patch @@ -0,0 +1,44 @@ +From: Jiasheng Jiang +Date: Tue, 6 Dec 2022 15:48:19 +0800 +Subject: [PATCH] drm/msm/mdp5: Add check for kzalloc +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 13fcfcb2a9a4787fe4e49841d728f6f2e9fa6911 + +[ Upstream commit 13fcfcb2a9a4787fe4e49841d728f6f2e9fa6911 ] + +As kzalloc may fail and return NULL pointer, +it should be better to check the return value +in order to avoid the NULL pointer dereference. + +Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/514154/ +Link: https://lore.kernel.org/r/20221206074819.18134-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +index e86421c6..86036dd4 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +@@ -1139,7 +1139,10 @@ static void mdp5_crtc_reset(struct drm_crtc *crtc) + if (crtc->state) + mdp5_crtc_destroy_state(crtc, crtc->state); + +- __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base); ++ if (mdp5_cstate) ++ __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base); ++ else ++ __drm_atomic_helper_crtc_reset(crtc, NULL); + } + + static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-380-habanalabs-bugs-fixes-in-timestamps-buff-alloc.patch b/patches.kernel.org/6.2.3-380-habanalabs-bugs-fixes-in-timestamps-buff-alloc.patch new file mode 100644 index 0000000..7cedf8e --- /dev/null +++ b/patches.kernel.org/6.2.3-380-habanalabs-bugs-fixes-in-timestamps-buff-alloc.patch @@ -0,0 +1,46 @@ +From: farah kassabri +Date: Sun, 8 Jan 2023 17:33:44 +0200 +Subject: [PATCH] habanalabs: bugs fixes in timestamps buff alloc +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1693fef9e95dbe8ab767d208a02328fff13fbb94 + +[ Upstream commit 1693fef9e95dbe8ab767d208a02328fff13fbb94 ] + +use argument instead of fixed GFP value for allocation +in Timestamps buffers alloc function. +change data type of size to size_t. + +Fixes: 9158bf69e74f ("habanalabs: Timestamps buffers registration") +Signed-off-by: farah kassabri +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/misc/habanalabs/common/memory.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/habanalabs/common/memory.c b/drivers/misc/habanalabs/common/memory.c +index 5e9ae760..047306e3 100644 +--- a/drivers/misc/habanalabs/common/memory.c ++++ b/drivers/misc/habanalabs/common/memory.c +@@ -2089,12 +2089,13 @@ static int hl_ts_mmap(struct hl_mmap_mem_buf *buf, struct vm_area_struct *vma, v + static int hl_ts_alloc_buf(struct hl_mmap_mem_buf *buf, gfp_t gfp, void *args) + { + struct hl_ts_buff *ts_buff = NULL; +- u32 size, num_elements; ++ u32 num_elements; ++ size_t size; + void *p; + + num_elements = *(u32 *)args; + +- ts_buff = kzalloc(sizeof(*ts_buff), GFP_KERNEL); ++ ts_buff = kzalloc(sizeof(*ts_buff), gfp); + if (!ts_buff) + return -ENOMEM; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-381-pinctrl-bcm2835-Remove-of_node_put-in-bcm2835_o.patch b/patches.kernel.org/6.2.3-381-pinctrl-bcm2835-Remove-of_node_put-in-bcm2835_o.patch new file mode 100644 index 0000000..5e5df5c --- /dev/null +++ b/patches.kernel.org/6.2.3-381-pinctrl-bcm2835-Remove-of_node_put-in-bcm2835_o.patch @@ -0,0 +1,44 @@ +From: Andy Shevchenko +Date: Fri, 13 Jan 2023 23:53:50 +0200 +Subject: [PATCH] pinctrl: bcm2835: Remove of_node_put() in + bcm2835_of_gpio_ranges_fallback() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2d578dd27871372f7159dd3206149ec616700d87 + +[ Upstream commit 2d578dd27871372f7159dd3206149ec616700d87 ] + +Remove wrong of_node_put() in bcm2835_of_gpio_ranges_fallback(), +there is no counterpart of_node_get() for it. + +Fixes: d2b67744fd99 ("pinctrl: bcm2835: implement hook for missing gpio-ranges") +Signed-off-by: Andy Shevchenko +Reviewed-by: Stefan Wahren +Tested-by: Stefan Wahren +Tested-by: Florian Fainelli +Reviewed-by: Florian Fainelli +Acked-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20230113215352.44272-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +index 7857e612..c7cdccdb 100644 +--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +@@ -363,8 +363,6 @@ static int bcm2835_of_gpio_ranges_fallback(struct gpio_chip *gc, + { + struct pinctrl_dev *pctldev = of_pinctrl_get(np); + +- of_node_put(np); +- + if (!pctldev) + return 0; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-382-pinctrl-mediatek-Initialize-variable-pullen-and.patch b/patches.kernel.org/6.2.3-382-pinctrl-mediatek-Initialize-variable-pullen-and.patch new file mode 100644 index 0000000..ca11b56 --- /dev/null +++ b/patches.kernel.org/6.2.3-382-pinctrl-mediatek-Initialize-variable-pullen-and.patch @@ -0,0 +1,43 @@ +From: Guodong Liu +Date: Wed, 18 Jan 2023 14:20:35 +0800 +Subject: [PATCH] pinctrl: mediatek: Initialize variable pullen and pullup to + zero +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a298c70a10c604a6b3df5a0aa56597b705ba0f6b + +[ Upstream commit a298c70a10c604a6b3df5a0aa56597b705ba0f6b ] + +Coverity spotted that pullen and pullup is not initialized to zero in +mtk_pctrl_show_one_pin. The uninitialized variable pullen is used in +assignment statement "rsel = pullen;" in mtk_pctrl_show_one_pin, and +Uninitialized variable pullup is used when calling scnprintf. Fix this +coverity by initializing pullen and pullup as zero. + +Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.") +Signed-off-by: Guodong Liu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230118062036.26258-2-Guodong.Liu@mediatek.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index 475f4172..3330f0ce 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -640,7 +640,7 @@ static int mtk_hw_get_value_wrap(struct mtk_pinctrl *hw, unsigned int gpio, int + ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, + unsigned int gpio, char *buf, unsigned int buf_len) + { +- int pinmux, pullup, pullen, len = 0, r1 = -1, r0 = -1, rsel = -1; ++ int pinmux, pullup = 0, pullen = 0, len = 0, r1 = -1, r0 = -1, rsel = -1; + const struct mtk_pin_desc *desc; + u32 try_all_type = 0; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-383-pinctrl-mediatek-Initialize-variable-buf-to-zer.patch b/patches.kernel.org/6.2.3-383-pinctrl-mediatek-Initialize-variable-buf-to-zer.patch new file mode 100644 index 0000000..cb929dc --- /dev/null +++ b/patches.kernel.org/6.2.3-383-pinctrl-mediatek-Initialize-variable-buf-to-zer.patch @@ -0,0 +1,40 @@ +From: Guodong Liu +Date: Wed, 18 Jan 2023 14:20:36 +0800 +Subject: [PATCH] pinctrl: mediatek: Initialize variable *buf to zero +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2e34f82ba214134ecf590fbe0cdbd87401645a8a + +[ Upstream commit 2e34f82ba214134ecf590fbe0cdbd87401645a8a ] + +Coverity spotted that *buf is not initialized to zero in +mtk_pctrl_dbg_show. Using uninitialized variable *buf as argument to %s +when calling seq_printf. Fix this coverity by initializing *buf as zero. + +Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.") +Signed-off-by: Guodong Liu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230118062036.26258-3-Guodong.Liu@mediatek.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index 3330f0ce..37761a8e 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -717,7 +717,7 @@ static void mtk_pctrl_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s, + unsigned int gpio) + { + struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); +- char buf[PIN_DBG_BUF_SZ]; ++ char buf[PIN_DBG_BUF_SZ] = { 0 }; + + (void)mtk_pctrl_show_one_pin(hw, gpio, buf, PIN_DBG_BUF_SZ); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-384-gpu-host1x-Fix-mask-for-syncpoint-increment-reg.patch b/patches.kernel.org/6.2.3-384-gpu-host1x-Fix-mask-for-syncpoint-increment-reg.patch new file mode 100644 index 0000000..535c370 --- /dev/null +++ b/patches.kernel.org/6.2.3-384-gpu-host1x-Fix-mask-for-syncpoint-increment-reg.patch @@ -0,0 +1,65 @@ +From: Mikko Perttunen +Date: Thu, 19 Jan 2023 15:38:59 +0200 +Subject: [PATCH] gpu: host1x: Fix mask for syncpoint increment register +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 79aad29c7d2d2cd64790115d3a6ebac28c00a8ec + +[ Upstream commit 79aad29c7d2d2cd64790115d3a6ebac28c00a8ec ] + +On Tegra186+, the syncpoint ID has 10 bits of space. To allow +using more than 256 syncpoints, fix the mask. + +Fixes: 9abdd497cd0a ("gpu: host1x: Tegra234 device data and headers") +Signed-off-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/host1x/hw/hw_host1x06_uclass.h | 2 +- + drivers/gpu/host1x/hw/hw_host1x07_uclass.h | 2 +- + drivers/gpu/host1x/hw/hw_host1x08_uclass.h | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h +index 5f831438..50c32de4 100644 +--- a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h ++++ b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h +@@ -53,7 +53,7 @@ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v) + host1x_uclass_incr_syncpt_cond_f(v) + static inline u32 host1x_uclass_incr_syncpt_indx_f(u32 v) + { +- return (v & 0xff) << 0; ++ return (v & 0x3ff) << 0; + } + #define HOST1X_UCLASS_INCR_SYNCPT_INDX_F(v) \ + host1x_uclass_incr_syncpt_indx_f(v) +diff --git a/drivers/gpu/host1x/hw/hw_host1x07_uclass.h b/drivers/gpu/host1x/hw/hw_host1x07_uclass.h +index 8cd2ef08..887b878f 100644 +--- a/drivers/gpu/host1x/hw/hw_host1x07_uclass.h ++++ b/drivers/gpu/host1x/hw/hw_host1x07_uclass.h +@@ -53,7 +53,7 @@ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v) + host1x_uclass_incr_syncpt_cond_f(v) + static inline u32 host1x_uclass_incr_syncpt_indx_f(u32 v) + { +- return (v & 0xff) << 0; ++ return (v & 0x3ff) << 0; + } + #define HOST1X_UCLASS_INCR_SYNCPT_INDX_F(v) \ + host1x_uclass_incr_syncpt_indx_f(v) +diff --git a/drivers/gpu/host1x/hw/hw_host1x08_uclass.h b/drivers/gpu/host1x/hw/hw_host1x08_uclass.h +index 724cccd7..4fb1d090 100644 +--- a/drivers/gpu/host1x/hw/hw_host1x08_uclass.h ++++ b/drivers/gpu/host1x/hw/hw_host1x08_uclass.h +@@ -53,7 +53,7 @@ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v) + host1x_uclass_incr_syncpt_cond_f(v) + static inline u32 host1x_uclass_incr_syncpt_indx_f(u32 v) + { +- return (v & 0xff) << 0; ++ return (v & 0x3ff) << 0; + } + #define HOST1X_UCLASS_INCR_SYNCPT_INDX_F(v) \ + host1x_uclass_incr_syncpt_indx_f(v) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-385-gpu-host1x-Don-t-skip-assigning-syncpoints-to-c.patch b/patches.kernel.org/6.2.3-385-gpu-host1x-Don-t-skip-assigning-syncpoints-to-c.patch new file mode 100644 index 0000000..c35f78d --- /dev/null +++ b/patches.kernel.org/6.2.3-385-gpu-host1x-Don-t-skip-assigning-syncpoints-to-c.patch @@ -0,0 +1,41 @@ +From: Mikko Perttunen +Date: Thu, 19 Jan 2023 15:39:00 +0200 +Subject: [PATCH] gpu: host1x: Don't skip assigning syncpoints to channels +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: eb258cc1fd458e584082be987dbc6ec42668c05e + +[ Upstream commit eb258cc1fd458e584082be987dbc6ec42668c05e ] + +The code to write the syncpoint channel assignment register +incorrectly skips the write if hypervisor registers are not available. + +The register, however, is within the guest aperture so remove the +check and assign syncpoints properly even on virtualized systems. + +Fixes: c3f52220f276 ("gpu: host1x: Enable Tegra186 syncpoint protection") +Signed-off-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/host1x/hw/syncpt_hw.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/host1x/hw/syncpt_hw.c b/drivers/gpu/host1x/hw/syncpt_hw.c +index dd39d67c..8cf35b2e 100644 +--- a/drivers/gpu/host1x/hw/syncpt_hw.c ++++ b/drivers/gpu/host1x/hw/syncpt_hw.c +@@ -106,9 +106,6 @@ static void syncpt_assign_to_channel(struct host1x_syncpt *sp, + #if HOST1X_HW >= 6 + struct host1x *host = sp->host; + +- if (!host->hv_regs) +- return; +- + host1x_sync_writel(host, + HOST1X_SYNC_SYNCPT_CH_APP_CH(ch ? ch->id : 0xff), + HOST1X_SYNC_SYNCPT_CH_APP(sp->id)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-386-drm-tegra-firewall-Check-for-is_addr_reg-existe.patch b/patches.kernel.org/6.2.3-386-drm-tegra-firewall-Check-for-is_addr_reg-existe.patch new file mode 100644 index 0000000..4936fab --- /dev/null +++ b/patches.kernel.org/6.2.3-386-drm-tegra-firewall-Check-for-is_addr_reg-existe.patch @@ -0,0 +1,38 @@ +From: Mikko Perttunen +Date: Thu, 19 Jan 2023 15:39:01 +0200 +Subject: [PATCH] drm/tegra: firewall: Check for is_addr_reg existence in IMM + check +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1b5c09de25e8c08655c270a70e5e74e93b6bad1f + +[ Upstream commit 1b5c09de25e8c08655c270a70e5e74e93b6bad1f ] + +In the IMM opcode check, don't call is_addr_reg if it's not set. + +Fixes: 8cc95f3fd35e ("drm/tegra: Add job firewall") +Signed-off-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/tegra/firewall.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/tegra/firewall.c b/drivers/gpu/drm/tegra/firewall.c +index 1824d2db..d53f890f 100644 +--- a/drivers/gpu/drm/tegra/firewall.c ++++ b/drivers/gpu/drm/tegra/firewall.c +@@ -97,6 +97,9 @@ static int fw_check_regs_imm(struct tegra_drm_firewall *fw, u32 offset) + { + bool is_addr; + ++ if (!fw->client->ops->is_addr_reg) ++ return 0; ++ + is_addr = fw->client->ops->is_addr_reg(fw->client->base.dev, fw->class, + offset); + if (is_addr) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-387-drm-i915-mtl-Add-initial-gt-workarounds.patch b/patches.kernel.org/6.2.3-387-drm-i915-mtl-Add-initial-gt-workarounds.patch new file mode 100644 index 0000000..8a5db5c --- /dev/null +++ b/patches.kernel.org/6.2.3-387-drm-i915-mtl-Add-initial-gt-workarounds.patch @@ -0,0 +1,382 @@ +From: Matt Roper +Date: Thu, 5 Jan 2023 15:44:08 -0800 +Subject: [PATCH] drm/i915/mtl: Add initial gt workarounds +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 41bb543f5598fb44e0e8dbd723f5821be83b466b + +[ Upstream commit 41bb543f5598fb44e0e8dbd723f5821be83b466b ] + +This patch introduces initial gt workarounds for the MTL platform. + +v2: drop redundant/stale comments specifying wa platforms affected +(Lucas). +v3: drop additional redundant stale comments (MattR) + +Bspec: 66622 + +Signed-off-by: Matt Roper +Signed-off-by: Matt Atwood +Reviewed-by: Rodrigo Vivi +Signed-off-by: Radhakrishna Sripada +Link: https://patchwork.freedesktop.org/patch/msgid/20230105234408.277750-1-matthew.s.atwood@intel.com +Stable-dep-of: 49cbda6386ef ("drm/i915/xehp: GAM registers don't need to be re-applied on engine resets") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 +- + .../drm/i915/gt/intel_execlists_submission.c | 6 +- + drivers/gpu/drm/i915/gt/intel_gt_mcr.c | 11 +- + drivers/gpu/drm/i915/gt/intel_gt_regs.h | 4 + + drivers/gpu/drm/i915/gt/intel_workarounds.c | 115 +++++++++++++----- + drivers/gpu/drm/i915/gt/uc/intel_guc.c | 9 +- + .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 8 +- + drivers/gpu/drm/i915/intel_device_info.c | 6 + + 8 files changed, 123 insertions(+), 42 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +index d37931e1..34b0a9da 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c ++++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +@@ -1476,10 +1476,12 @@ static int __intel_engine_stop_cs(struct intel_engine_cs *engine, + intel_uncore_write_fw(uncore, mode, _MASKED_BIT_ENABLE(STOP_RING)); + + /* +- * Wa_22011802037 : gen11, gen12, Prior to doing a reset, ensure CS is ++ * Wa_22011802037: Prior to doing a reset, ensure CS is + * stopped, set ring stop bit and prefetch disable bit to halt CS + */ +- if (IS_GRAPHICS_VER(engine->i915, 11, 12)) ++ if (IS_MTL_GRAPHICS_STEP(engine->i915, M, STEP_A0, STEP_B0) || ++ (GRAPHICS_VER(engine->i915) >= 11 && ++ GRAPHICS_VER_FULL(engine->i915) < IP_VER(12, 70))) + intel_uncore_write_fw(uncore, RING_MODE_GEN7(engine->mmio_base), + _MASKED_BIT_ENABLE(GEN12_GFX_PREFETCH_DISABLE)); + +diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +index 21cb5b69..3c573d41 100644 +--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c ++++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +@@ -2989,10 +2989,12 @@ static void execlists_reset_prepare(struct intel_engine_cs *engine) + intel_engine_stop_cs(engine); + + /* +- * Wa_22011802037:gen11/gen12: In addition to stopping the cs, we need ++ * Wa_22011802037: In addition to stopping the cs, we need + * to wait for any pending mi force wakeups + */ +- if (IS_GRAPHICS_VER(engine->i915, 11, 12)) ++ if (IS_MTL_GRAPHICS_STEP(engine->i915, M, STEP_A0, STEP_B0) || ++ (GRAPHICS_VER(engine->i915) >= 11 && ++ GRAPHICS_VER_FULL(engine->i915) < IP_VER(12, 70))) + intel_engine_wait_for_pending_mi_fw(engine); + + engine->execlists.reset_ccid = active_ccid(engine); +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_mcr.c b/drivers/gpu/drm/i915/gt/intel_gt_mcr.c +index ea86c1ab..58ea3325 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_mcr.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt_mcr.c +@@ -162,8 +162,15 @@ void intel_gt_mcr_init(struct intel_gt *gt) + if (MEDIA_VER(i915) >= 13 && gt->type == GT_MEDIA) { + gt->steering_table[OADDRM] = xelpmp_oaddrm_steering_table; + } else if (GRAPHICS_VER_FULL(i915) >= IP_VER(12, 70)) { +- fuse = REG_FIELD_GET(GT_L3_EXC_MASK, +- intel_uncore_read(gt->uncore, XEHP_FUSE4)); ++ /* Wa_14016747170 */ ++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || ++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0)) ++ fuse = REG_FIELD_GET(MTL_GT_L3_EXC_MASK, ++ intel_uncore_read(gt->uncore, ++ MTL_GT_ACTIVITY_FACTOR)); ++ else ++ fuse = REG_FIELD_GET(GT_L3_EXC_MASK, ++ intel_uncore_read(gt->uncore, XEHP_FUSE4)); + + /* + * Despite the register field being named "exclude mask" the +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +index a5454af2..c525fc07 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h ++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +@@ -413,6 +413,7 @@ + #define TBIMR_FAST_CLIP REG_BIT(5) + + #define VFLSKPD MCR_REG(0x62a8) ++#define VF_PREFETCH_TLB_DIS REG_BIT(5) + #define DIS_OVER_FETCH_CACHE REG_BIT(1) + #define DIS_MULT_MISS_RD_SQUASH REG_BIT(0) + +@@ -1528,6 +1529,9 @@ + + #define MTL_MEDIA_MC6 _MMIO(0x138048) + ++#define MTL_GT_ACTIVITY_FACTOR _MMIO(0x138010) ++#define MTL_GT_L3_EXC_MASK REG_GENMASK(5, 3) ++ + #define GEN6_GT_THREAD_STATUS_REG _MMIO(0x13805c) + #define GEN6_GT_THREAD_STATUS_CORE_MASK 0x7 + +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index a0740308..09d533f6 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -786,6 +786,32 @@ static void dg2_ctx_workarounds_init(struct intel_engine_cs *engine, + wa_masked_en(wal, CACHE_MODE_1, MSAA_OPTIMIZATION_REDUC_DISABLE); + } + ++static void mtl_ctx_workarounds_init(struct intel_engine_cs *engine, ++ struct i915_wa_list *wal) ++{ ++ struct drm_i915_private *i915 = engine->i915; ++ ++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || ++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0)) { ++ /* Wa_14014947963 */ ++ wa_masked_field_set(wal, VF_PREEMPTION, ++ PREEMPTION_VERTEX_COUNT, 0x4000); ++ ++ /* Wa_16013271637 */ ++ wa_mcr_masked_en(wal, XEHP_SLICE_COMMON_ECO_CHICKEN1, ++ MSC_MSAA_REODER_BUF_BYPASS_DISABLE); ++ ++ /* Wa_18019627453 */ ++ wa_mcr_masked_en(wal, VFLSKPD, VF_PREFETCH_TLB_DIS); ++ ++ /* Wa_18018764978 */ ++ wa_masked_en(wal, PSS_MODE2, SCOREBOARD_STALL_FLUSH_CONTROL); ++ } ++ ++ /* Wa_18019271663 */ ++ wa_masked_en(wal, CACHE_MODE_1, MSAA_OPTIMIZATION_REDUC_DISABLE); ++} ++ + static void fakewa_disable_nestedbb_mode(struct intel_engine_cs *engine, + struct i915_wa_list *wal) + { +@@ -872,7 +898,9 @@ __intel_engine_init_ctx_wa(struct intel_engine_cs *engine, + if (engine->class != RENDER_CLASS) + goto done; + +- if (IS_PONTEVECCHIO(i915)) ++ if (IS_METEORLAKE(i915)) ++ mtl_ctx_workarounds_init(engine, wal); ++ else if (IS_PONTEVECCHIO(i915)) + ; /* noop; none at this time */ + else if (IS_DG2(i915)) + dg2_ctx_workarounds_init(engine, wal); +@@ -1635,7 +1663,10 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + static void + xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + { +- /* FIXME: Actual workarounds will be added in future patch(es) */ ++ /* Wa_14014830051 */ ++ if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) || ++ IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0)) ++ wa_mcr_write_clr(wal, SARB_CHICKEN1, COMP_CKN_IN); + + /* + * Unlike older platforms, we no longer setup implicit steering here; +@@ -2171,7 +2202,9 @@ void intel_engine_init_whitelist(struct intel_engine_cs *engine) + + wa_init_start(w, engine->gt, "whitelist", engine->name); + +- if (IS_PONTEVECCHIO(i915)) ++ if (IS_METEORLAKE(i915)) ++ ; /* noop; none at this time */ ++ else if (IS_PONTEVECCHIO(i915)) + pvc_whitelist_build(engine); + else if (IS_DG2(i915)) + dg2_whitelist_build(engine); +@@ -2281,6 +2314,34 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) + { + struct drm_i915_private *i915 = engine->i915; + ++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || ++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0)) { ++ /* Wa_22014600077 */ ++ wa_mcr_masked_en(wal, GEN10_CACHE_MODE_SS, ++ ENABLE_EU_COUNT_FOR_TDL_FLUSH); ++ } ++ ++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || ++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) || ++ IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) || ++ IS_DG2_G11(i915) || IS_DG2_G12(i915)) { ++ /* Wa_1509727124 */ ++ wa_mcr_masked_en(wal, GEN10_SAMPLER_MODE, ++ SC_DISABLE_POWER_OPTIMIZATION_EBB); ++ ++ /* Wa_22013037850 */ ++ wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0_UDW, ++ DISABLE_128B_EVICTION_COMMAND_UDW); ++ } ++ ++ if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) || ++ IS_DG2_G11(i915) || IS_DG2_G12(i915) || ++ IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0)) { ++ /* Wa_22012856258 */ ++ wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, ++ GEN12_DISABLE_READ_SUPPRESSION); ++ } ++ + if (IS_DG2(i915)) { + /* Wa_1509235366:dg2 */ + wa_write_or(wal, GEN12_GAMCNTRL_CTRL, INVALIDATION_BROADCAST_MODE_DIS | +@@ -2292,13 +2353,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) + wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, GEN12_ENABLE_LARGE_GRF_MODE); + } + +- if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) || +- IS_DG2_G11(i915) || IS_DG2_G12(i915)) { +- /* Wa_1509727124:dg2 */ +- wa_mcr_masked_en(wal, GEN10_SAMPLER_MODE, +- SC_DISABLE_POWER_OPTIMIZATION_EBB); +- } +- + if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_A0, STEP_B0) || + IS_DG2_GRAPHICS_STEP(i915, G11, STEP_A0, STEP_B0)) { + /* Wa_14012419201:dg2 */ +@@ -2330,14 +2384,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) + + if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) || + IS_DG2_G11(i915) || IS_DG2_G12(i915)) { +- /* Wa_22013037850:dg2 */ +- wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0_UDW, +- DISABLE_128B_EVICTION_COMMAND_UDW); +- +- /* Wa_22012856258:dg2 */ +- wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, +- GEN12_DISABLE_READ_SUPPRESSION); +- + /* + * Wa_22010960976:dg2 + * Wa_14013347512:dg2 +@@ -2950,6 +2996,27 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li + + add_render_compute_tuning_settings(i915, wal); + ++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || ++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) || ++ IS_PONTEVECCHIO(i915) || ++ IS_DG2(i915)) { ++ /* Wa_18018781329 */ ++ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); ++ ++ /* Wa_22014226127 */ ++ wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0, DISABLE_D8_D16_COASLESCE); ++ } ++ ++ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || ++ IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) || ++ IS_DG2(i915)) { ++ /* Wa_18017747507 */ ++ wa_masked_en(wal, VFG_PREEMPTION_CHICKEN, POLYGON_TRIFAN_LINELOOP_DISABLE); ++ } ++ + if (IS_PONTEVECCHIO(i915)) { + /* Wa_16016694945 */ + wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_OVRLSCCC); +@@ -2991,17 +3058,8 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li + /* Wa_14015227452:dg2,pvc */ + wa_mcr_masked_en(wal, GEN9_ROW_CHICKEN4, XEHP_DIS_BBL_SYSPIPE); + +- /* Wa_22014226127:dg2,pvc */ +- wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0, DISABLE_D8_D16_COASLESCE); +- + /* Wa_16015675438:dg2,pvc */ + wa_masked_en(wal, FF_SLICE_CS_CHICKEN2, GEN12_PERF_FIX_BALANCING_CFE_DISABLE); +- +- /* Wa_18018781329:dg2,pvc */ +- wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); + } + + if (IS_DG2(i915)) { +@@ -3010,9 +3068,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li + * Wa_22015475538:dg2 + */ + wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0_UDW, DIS_CHAIN_2XSIMD8); +- +- /* Wa_18017747507:dg2 */ +- wa_masked_en(wal, VFG_PREEMPTION_CHICKEN, POLYGON_TRIFAN_LINELOOP_DISABLE); + } + } + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc.c b/drivers/gpu/drm/i915/gt/uc/intel_guc.c +index 52aede32..ca940a00 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc.c +@@ -274,8 +274,9 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc) + if (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_B0)) + flags |= GUC_WA_GAM_CREDITS; + +- /* Wa_14014475959:dg2 */ +- if (IS_DG2(gt->i915)) ++ /* Wa_14014475959 */ ++ if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) || ++ IS_DG2(gt->i915)) + flags |= GUC_WA_HOLD_CCS_SWITCHOUT; + + /* +@@ -289,7 +290,9 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc) + flags |= GUC_WA_DUAL_QUEUE; + + /* Wa_22011802037: graphics version 11/12 */ +- if (IS_GRAPHICS_VER(gt->i915, 11, 12)) ++ if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) || ++ (GRAPHICS_VER(gt->i915) >= 11 && ++ GRAPHICS_VER_FULL(gt->i915) < IP_VER(12, 70))) + flags |= GUC_WA_PRE_PARSER; + + /* Wa_16011777198:dg2 */ +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index c10977cb..ddf07186 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -1621,7 +1621,7 @@ static void guc_engine_reset_prepare(struct intel_engine_cs *engine) + intel_engine_stop_cs(engine); + + /* +- * Wa_22011802037:gen11/gen12: In addition to stopping the cs, we need ++ * Wa_22011802037: In addition to stopping the cs, we need + * to wait for any pending mi force wakeups + */ + intel_engine_wait_for_pending_mi_fw(engine); +@@ -4203,8 +4203,10 @@ static void guc_default_vfuncs(struct intel_engine_cs *engine) + engine->flags |= I915_ENGINE_HAS_TIMESLICES; + + /* Wa_14014475959:dg2 */ +- if (IS_DG2(engine->i915) && engine->class == COMPUTE_CLASS) +- engine->flags |= I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT; ++ if (engine->class == COMPUTE_CLASS) ++ if (IS_MTL_GRAPHICS_STEP(engine->i915, M, STEP_A0, STEP_B0) || ++ IS_DG2(engine->i915)) ++ engine->flags |= I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT; + + /* + * TODO: GuC supports timeslicing and semaphores as well, but they're +diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c +index 849baf6c..05e90d09 100644 +--- a/drivers/gpu/drm/i915/intel_device_info.c ++++ b/drivers/gpu/drm/i915/intel_device_info.c +@@ -343,6 +343,12 @@ static void intel_ipver_early_init(struct drm_i915_private *i915) + + ip_ver_read(i915, i915_mmio_reg_offset(GMD_ID_GRAPHICS), + &runtime->graphics.ip); ++ /* Wa_22012778468 */ ++ if (runtime->graphics.ip.ver == 0x0 && ++ INTEL_INFO(i915)->platform == INTEL_METEORLAKE) { ++ RUNTIME_INFO(i915)->graphics.ip.ver = 12; ++ RUNTIME_INFO(i915)->graphics.ip.rel = 70; ++ } + ip_ver_read(i915, i915_mmio_reg_offset(GMD_ID_DISPLAY), + &runtime->display.ip); + ip_ver_read(i915, i915_mmio_reg_offset(GMD_ID_MEDIA), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-388-drm-i915-xehp-GAM-registers-don-t-need-to-be-re.patch b/patches.kernel.org/6.2.3-388-drm-i915-xehp-GAM-registers-don-t-need-to-be-re.patch new file mode 100644 index 0000000..88a7660 --- /dev/null +++ b/patches.kernel.org/6.2.3-388-drm-i915-xehp-GAM-registers-don-t-need-to-be-re.patch @@ -0,0 +1,194 @@ +From: Matt Roper +Date: Wed, 25 Jan 2023 15:41:57 -0800 +Subject: [PATCH] drm/i915/xehp: GAM registers don't need to be re-applied on + engine resets +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 49cbda6386efc5f023f396dca087aaba5d4f885e + +[ Upstream commit 49cbda6386efc5f023f396dca087aaba5d4f885e ] + +Register reset characteristics (i.e., whether the register maintains or +loses its value on engine reset) is an important factor that determines +which wa_list we want to add workarounds to. We recently found out that +the bspec documentation for the Xe_HP's "GAM" registers in the 0xC800 - +0xCFFF range was misleading; these registers do not actually lose their +value on engine resets as the documentation implied. This means there's +no need to re-apply workarounds touching these registers after a reset, +and the corresponding workarounds should be moved from the 'engine' +lists back to the 'gt' list. + +v2: + - Don't add Wa_18018781329 to xehpsdv; the original condition didn't + include that platform. (Gustavo) + - Move the MTL code to the GT function as-is for now; we'll take care + of the additional fixes needed in a follow-up patch. + +Cc: Gustavo Sousa +Fixes: edf176f48d87 ("drm/i915/dg2: Move misplaced 'ctx' & 'gt' wa's to engine wa list") +Fixes: b2006061ae28 ("drm/i915/xehpsdv: Move render/compute engine reset domains related workarounds") +Fixes: 41bb543f5598 ("drm/i915/mtl: Add initial gt workarounds") +Signed-off-by: Matt Roper +Reviewed-by: Gustavo Sousa +Link: https://patchwork.freedesktop.org/patch/msgid/20230125234159.3015385-1-matthew.d.roper@intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 77 ++++++++++++--------- + 1 file changed, 44 insertions(+), 33 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index 09d533f6..9932d748 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -1550,6 +1550,13 @@ xehpsdv_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + + /* Wa_14011060649:xehpsdv */ + wa_14011060649(gt, wal); ++ ++ /* Wa_14012362059:xehpsdv */ ++ wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB); ++ ++ /* Wa_14014368820:xehpsdv */ ++ wa_write_or(wal, GEN12_GAMCNTRL_CTRL, ++ INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); + } + + static void +@@ -1590,6 +1597,12 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + DSS_ROUTER_CLKGATE_DIS); + } + ++ if (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_B0) || ++ IS_DG2_GRAPHICS_STEP(gt->i915, G11, STEP_A0, STEP_B0)) { ++ /* Wa_14012362059:dg2 */ ++ wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB); ++ } ++ + if (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_B0)) { + /* Wa_14010948348:dg2_g10 */ + wa_write_or(wal, UNSLCGCTL9430, MSQDUNIT_CLKGATE_DIS); +@@ -1635,6 +1648,12 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + + /* Wa_14011028019:dg2_g10 */ + wa_mcr_write_or(wal, SSMCGCTL9530, RTFUNIT_CLKGATE_DIS); ++ ++ /* Wa_14010680813:dg2_g10 */ ++ wa_write_or(wal, GEN12_GAMSTLB_CTRL, ++ CONTROL_BLOCK_CLKGATE_DIS | ++ EGRESS_BLOCK_CLKGATE_DIS | ++ TAG_BLOCK_CLKGATE_DIS); + } + + /* Wa_14014830051:dg2 */ +@@ -1649,6 +1668,16 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + + /* Wa_14015795083 */ + wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); ++ ++ /* Wa_18018781329 */ ++ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); ++ ++ /* Wa_1509235366:dg2 */ ++ wa_write_or(wal, GEN12_GAMCNTRL_CTRL, ++ INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); + } + + static void +@@ -1658,16 +1687,29 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + + /* Wa_14015795083 */ + wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); ++ ++ /* Wa_18018781329 */ ++ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); + } + + static void + xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + { +- /* Wa_14014830051 */ + if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) || +- IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0)) ++ IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0)) { ++ /* Wa_14014830051 */ + wa_mcr_write_clr(wal, SARB_CHICKEN1, COMP_CKN_IN); + ++ /* Wa_18018781329 */ ++ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); ++ } ++ + /* + * Unlike older platforms, we no longer setup implicit steering here; + * all MCR accesses are explicitly steered. +@@ -2342,12 +2384,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) + GEN12_DISABLE_READ_SUPPRESSION); + } + +- if (IS_DG2(i915)) { +- /* Wa_1509235366:dg2 */ +- wa_write_or(wal, GEN12_GAMCNTRL_CTRL, INVALIDATION_BROADCAST_MODE_DIS | +- GLOBAL_INVALIDATION_MODE); +- } +- + if (IS_DG2_GRAPHICS_STEP(i915, G11, STEP_A0, STEP_B0)) { + /* Wa_14013392000:dg2_g11 */ + wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, GEN12_ENABLE_LARGE_GRF_MODE); +@@ -2432,18 +2468,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) + wa_mcr_masked_en(wal, GEN9_HALF_SLICE_CHICKEN7, + DG2_DISABLE_ROUND_ENABLE_ALLOW_FOR_SSLA); + +- if (IS_DG2_GRAPHICS_STEP(engine->i915, G10, STEP_A0, STEP_B0)) { +- /* Wa_14010680813:dg2_g10 */ +- wa_write_or(wal, GEN12_GAMSTLB_CTRL, CONTROL_BLOCK_CLKGATE_DIS | +- EGRESS_BLOCK_CLKGATE_DIS | TAG_BLOCK_CLKGATE_DIS); +- } +- +- if (IS_DG2_GRAPHICS_STEP(engine->i915, G10, STEP_A0, STEP_B0) || +- IS_DG2_GRAPHICS_STEP(engine->i915, G11, STEP_A0, STEP_B0)) { +- /* Wa_14012362059:dg2 */ +- wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB); +- } +- + if (IS_DG2_GRAPHICS_STEP(i915, G11, STEP_B0, STEP_FOREVER) || + IS_DG2_G10(i915)) { + /* Wa_22014600077:dg2 */ +@@ -3000,12 +3024,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li + IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) || + IS_PONTEVECCHIO(i915) || + IS_DG2(i915)) { +- /* Wa_18018781329 */ +- wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); +- + /* Wa_22014226127 */ + wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0, DISABLE_D8_D16_COASLESCE); + } +@@ -3045,13 +3063,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li + wa_mcr_masked_dis(wal, MLTICTXCTL, TDONRENDER); + wa_mcr_write_or(wal, L3SQCREG1_CCS0, FLUSHALLNONCOH); + } +- +- /* Wa_14012362059:xehpsdv */ +- wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB); +- +- /* Wa_14014368820:xehpsdv */ +- wa_write_or(wal, GEN12_GAMCNTRL_CTRL, INVALIDATION_BROADCAST_MODE_DIS | +- GLOBAL_INVALIDATION_MODE); + } + + if (IS_DG2(i915) || IS_PONTEVECCHIO(i915)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-389-pinctrl-renesas-rzg2l-Fix-configuring-the-GPIO-.patch b/patches.kernel.org/6.2.3-389-pinctrl-renesas-rzg2l-Fix-configuring-the-GPIO-.patch new file mode 100644 index 0000000..6012ae2 --- /dev/null +++ b/patches.kernel.org/6.2.3-389-pinctrl-renesas-rzg2l-Fix-configuring-the-GPIO-.patch @@ -0,0 +1,105 @@ +From: Lad Prabhakar +Date: Mon, 2 Jan 2023 22:18:11 +0000 +Subject: [PATCH] pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as + interrupts +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 00dfe29887761405ccd23cc0aa07cb86623bb2b7 + +[ Upstream commit 00dfe29887761405ccd23cc0aa07cb86623bb2b7 ] + +On the RZ/G2UL SoC we have less number of pins compared to RZ/G2L and also +the pin configs are completely different. This patch makes sure we use the +appropriate pin configs for each SoC (which is passed as part of the OF +data) while configuring the GPIO pin as interrupts instead of using +rzg2l_gpio_configs[] for all the SoCs. + +Fixes: bfc69bdbaad1 ("pinctrl: renesas: rzg2l: Add RZ/G2UL support") +Signed-off-by: Lad Prabhakar +Reviewed-by: Geert Uytterhoeven +Acked-by: Linus Walleij +Link: https://lore.kernel.org/r/20230102221815.273719-3-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +index 5aa3836d..6f762097 100644 +--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c ++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c +@@ -130,6 +130,7 @@ struct rzg2l_dedicated_configs { + struct rzg2l_pinctrl_data { + const char * const *port_pins; + const u32 *port_pin_configs; ++ unsigned int n_ports; + struct rzg2l_dedicated_configs *dedicated_pins; + unsigned int n_port_pins; + unsigned int n_dedicated_pins; +@@ -1124,7 +1125,7 @@ static struct { + } + }; + +-static int rzg2l_gpio_get_gpioint(unsigned int virq) ++static int rzg2l_gpio_get_gpioint(unsigned int virq, const struct rzg2l_pinctrl_data *data) + { + unsigned int gpioint; + unsigned int i; +@@ -1133,13 +1134,13 @@ static int rzg2l_gpio_get_gpioint(unsigned int virq) + port = virq / 8; + bit = virq % 8; + +- if (port >= ARRAY_SIZE(rzg2l_gpio_configs) || +- bit >= RZG2L_GPIO_PORT_GET_PINCNT(rzg2l_gpio_configs[port])) ++ if (port >= data->n_ports || ++ bit >= RZG2L_GPIO_PORT_GET_PINCNT(data->port_pin_configs[port])) + return -EINVAL; + + gpioint = bit; + for (i = 0; i < port; i++) +- gpioint += RZG2L_GPIO_PORT_GET_PINCNT(rzg2l_gpio_configs[i]); ++ gpioint += RZG2L_GPIO_PORT_GET_PINCNT(data->port_pin_configs[i]); + + return gpioint; + } +@@ -1239,7 +1240,7 @@ static int rzg2l_gpio_child_to_parent_hwirq(struct gpio_chip *gc, + unsigned long flags; + int gpioint, irq; + +- gpioint = rzg2l_gpio_get_gpioint(child); ++ gpioint = rzg2l_gpio_get_gpioint(child, pctrl->data); + if (gpioint < 0) + return gpioint; + +@@ -1313,8 +1314,8 @@ static void rzg2l_init_irq_valid_mask(struct gpio_chip *gc, + port = offset / 8; + bit = offset % 8; + +- if (port >= ARRAY_SIZE(rzg2l_gpio_configs) || +- bit >= RZG2L_GPIO_PORT_GET_PINCNT(rzg2l_gpio_configs[port])) ++ if (port >= pctrl->data->n_ports || ++ bit >= RZG2L_GPIO_PORT_GET_PINCNT(pctrl->data->port_pin_configs[port])) + clear_bit(offset, valid_mask); + } + } +@@ -1519,6 +1520,7 @@ static int rzg2l_pinctrl_probe(struct platform_device *pdev) + static struct rzg2l_pinctrl_data r9a07g043_data = { + .port_pins = rzg2l_gpio_names, + .port_pin_configs = r9a07g043_gpio_configs, ++ .n_ports = ARRAY_SIZE(r9a07g043_gpio_configs), + .dedicated_pins = rzg2l_dedicated_pins.common, + .n_port_pins = ARRAY_SIZE(r9a07g043_gpio_configs) * RZG2L_PINS_PER_PORT, + .n_dedicated_pins = ARRAY_SIZE(rzg2l_dedicated_pins.common), +@@ -1527,6 +1529,7 @@ static struct rzg2l_pinctrl_data r9a07g043_data = { + static struct rzg2l_pinctrl_data r9a07g044_data = { + .port_pins = rzg2l_gpio_names, + .port_pin_configs = rzg2l_gpio_configs, ++ .n_ports = ARRAY_SIZE(rzg2l_gpio_configs), + .dedicated_pins = rzg2l_dedicated_pins.common, + .n_port_pins = ARRAY_SIZE(rzg2l_gpio_names), + .n_dedicated_pins = ARRAY_SIZE(rzg2l_dedicated_pins.common) + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-390-drm-i915-xehp-Annotate-a-couple-more-workaround.patch b/patches.kernel.org/6.2.3-390-drm-i915-xehp-Annotate-a-couple-more-workaround.patch new file mode 100644 index 0000000..7b98233 --- /dev/null +++ b/patches.kernel.org/6.2.3-390-drm-i915-xehp-Annotate-a-couple-more-workaround.patch @@ -0,0 +1,93 @@ +From: Matt Roper +Date: Wed, 25 Jan 2023 15:41:59 -0800 +Subject: [PATCH] drm/i915/xehp: Annotate a couple more workaround registers as + MCR +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7649a5d1f263b8cc5c2827ef0443ead9bee9ae0e + +[ Upstream commit 7649a5d1f263b8cc5c2827ef0443ead9bee9ae0e ] + +GAMSTLB_CTRL and GAMCNTRL_CTRL became multicast/replicated registers on +Xe_HP. They should be defined accordingly and use MCR-aware operations. + +These registers have only been used for some dg2/xehpsdv workarounds, so +this fix is mostly just for consistency/future-proofing; even lacking +the MCR annotation, workarounds will always be properly applied in a +multicast manner on these platforms. + +Cc: Gustavo Sousa +Fixes: 58bc2453ab8a ("drm/i915: Define multicast registers as a new type") +Signed-off-by: Matt Roper +Reviewed-by: Gustavo Sousa +Link: https://patchwork.freedesktop.org/patch/msgid/20230125234159.3015385-3-matthew.d.roper@intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_gt_regs.h | 4 ++-- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 16 ++++++++-------- + 2 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +index c525fc07..0c7e7972 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h ++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +@@ -1093,12 +1093,12 @@ + #define VEBX_MOD_CTRL MCR_REG(0xcf38) + #define FORCE_MISS_FTLB REG_BIT(3) + +-#define GEN12_GAMSTLB_CTRL _MMIO(0xcf4c) ++#define XEHP_GAMSTLB_CTRL MCR_REG(0xcf4c) + #define CONTROL_BLOCK_CLKGATE_DIS REG_BIT(12) + #define EGRESS_BLOCK_CLKGATE_DIS REG_BIT(11) + #define TAG_BLOCK_CLKGATE_DIS REG_BIT(7) + +-#define GEN12_GAMCNTRL_CTRL _MMIO(0xcf54) ++#define XEHP_GAMCNTRL_CTRL MCR_REG(0xcf54) + #define INVALIDATION_BROADCAST_MODE_DIS REG_BIT(12) + #define GLOBAL_INVALIDATION_MODE REG_BIT(2) + +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index 9932d748..dcc694b8 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -1555,8 +1555,8 @@ xehpsdv_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB); + + /* Wa_14014368820:xehpsdv */ +- wa_write_or(wal, GEN12_GAMCNTRL_CTRL, +- INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); ++ wa_mcr_write_or(wal, XEHP_GAMCNTRL_CTRL, ++ INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); + } + + static void +@@ -1650,10 +1650,10 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + wa_mcr_write_or(wal, SSMCGCTL9530, RTFUNIT_CLKGATE_DIS); + + /* Wa_14010680813:dg2_g10 */ +- wa_write_or(wal, GEN12_GAMSTLB_CTRL, +- CONTROL_BLOCK_CLKGATE_DIS | +- EGRESS_BLOCK_CLKGATE_DIS | +- TAG_BLOCK_CLKGATE_DIS); ++ wa_mcr_write_or(wal, XEHP_GAMSTLB_CTRL, ++ CONTROL_BLOCK_CLKGATE_DIS | ++ EGRESS_BLOCK_CLKGATE_DIS | ++ TAG_BLOCK_CLKGATE_DIS); + } + + /* Wa_14014830051:dg2 */ +@@ -1676,8 +1676,8 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); + + /* Wa_1509235366:dg2 */ +- wa_write_or(wal, GEN12_GAMCNTRL_CTRL, +- INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); ++ wa_mcr_write_or(wal, XEHP_GAMCNTRL_CTRL, ++ INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); + } + + static void +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-391-drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_pl.patch b/patches.kernel.org/6.2.3-391-drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_pl.patch new file mode 100644 index 0000000..3207081 --- /dev/null +++ b/patches.kernel.org/6.2.3-391-drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_pl.patch @@ -0,0 +1,72 @@ +From: Dmitry Baryshkov +Date: Thu, 29 Dec 2022 21:18:30 +0200 +Subject: [PATCH] drm/msm/dpu: set pdpu->is_rt_pipe early in + dpu_plane_sspp_atomic_update() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1d233b1cb149ec78c20fac58331b27bb460f9558 + +[ Upstream commit 1d233b1cb149ec78c20fac58331b27bb460f9558 ] + +The function dpu_plane_sspp_atomic_update() updates pdpu->is_rt_pipe +flag, but after the commit 854f6f1c653b ("drm/msm/dpu: update the qos +remap only if the client type changes") it sets the flag late, after all +the qos functions have updated QoS programming. Move the flag update +back to the place where it happened before the mentioned commit to let +the pipe be programmed according to its current RT/non-RT state. + +Fixes: 854f6f1c653b ("drm/msm/dpu: update the qos remap only if the client type changes") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/516239/ +Link: https://lore.kernel.org/r/20221229191856.3508092-2-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +index 86719020..bfd5be89 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +@@ -1126,7 +1126,7 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane) + struct dpu_plane_state *pstate = to_dpu_plane_state(state); + struct drm_crtc *crtc = state->crtc; + struct drm_framebuffer *fb = state->fb; +- bool is_rt_pipe, update_qos_remap; ++ bool is_rt_pipe; + const struct dpu_format *fmt = + to_dpu_format(msm_framebuffer_format(fb)); + struct dpu_hw_pipe_cfg pipe_cfg; +@@ -1138,6 +1138,9 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane) + pstate->pending = true; + + is_rt_pipe = (dpu_crtc_get_client_type(crtc) != NRT_CLIENT); ++ pstate->needs_qos_remap |= (is_rt_pipe != pdpu->is_rt_pipe); ++ pdpu->is_rt_pipe = is_rt_pipe; ++ + _dpu_plane_set_qos_ctrl(plane, false, DPU_PLANE_QOS_PANIC_CTRL); + + DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT +@@ -1219,14 +1222,8 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane) + _dpu_plane_set_ot_limit(plane, crtc, &pipe_cfg); + } + +- update_qos_remap = (is_rt_pipe != pdpu->is_rt_pipe) || +- pstate->needs_qos_remap; +- +- if (update_qos_remap) { +- if (is_rt_pipe != pdpu->is_rt_pipe) +- pdpu->is_rt_pipe = is_rt_pipe; +- else if (pstate->needs_qos_remap) +- pstate->needs_qos_remap = false; ++ if (pstate->needs_qos_remap) { ++ pstate->needs_qos_remap = false; + _dpu_plane_set_qos_remap(plane); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-392-drm-mediatek-dsi-Reduce-the-time-of-dsi-from-LP.patch b/patches.kernel.org/6.2.3-392-drm-mediatek-dsi-Reduce-the-time-of-dsi-from-LP.patch new file mode 100644 index 0000000..bd3a70c --- /dev/null +++ b/patches.kernel.org/6.2.3-392-drm-mediatek-dsi-Reduce-the-time-of-dsi-from-LP.patch @@ -0,0 +1,53 @@ +From: Xinlei Lee +Date: Tue, 10 Jan 2023 13:54:51 +0800 +Subject: [PATCH] drm/mediatek: dsi: Reduce the time of dsi from LP11 to + sending cmd +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 91aeaed2c1147e3b1157dc084d23f190856a6c23 + +[ Upstream commit 91aeaed2c1147e3b1157dc084d23f190856a6c23 ] + +According to Figure 16 Turnaround Procedure on page 36 in [1], you +can see the status of LP-00 -> LP10 -> LP11. This state can correspond +to the state of DSI from LP00 -> LP11 in mtk_dsi_lane_ready function +in mtk_dsi.c. + +LP-00 -> LP10 -> LP11 takes about 2*TLPX time (refer to [1] page 51 +to see that TLPX is 50ns) + +The delay at the end of the mtk_dsi_lane_ready function should be +greater than the 2*TLPX specified by the DSI spec, and less than +the time specified by the DSI_RX (generally 6ms to 40ms), to avoid +problems caused by the RX specification + +[1]:mipi_D-PHY_specification_v1-1 + +Fixes: 39e8d062b03c ("drm/mediatek: Keep dsi as LP00 before dcs cmds transfer") +Signed-off-by: Xinlei Lee +Acked-by: Sam Ravnborg +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1673330093-6771-2-git-send-email-xinlei.lee@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 3b7d1302..9e1363c9 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -721,7 +721,7 @@ static void mtk_dsi_lane_ready(struct mtk_dsi *dsi) + mtk_dsi_clk_ulp_mode_leave(dsi); + mtk_dsi_lane0_ulp_mode_leave(dsi); + mtk_dsi_clk_hs_mode(dsi, 0); +- msleep(20); ++ usleep_range(1000, 3000); + /* The reaction time after pulling up the mipi signal for dsi_rx */ + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-393-drm-mediatek-Use-NULL-instead-of-0-for-NULL-poi.patch b/patches.kernel.org/6.2.3-393-drm-mediatek-Use-NULL-instead-of-0-for-NULL-poi.patch new file mode 100644 index 0000000..1c979eb --- /dev/null +++ b/patches.kernel.org/6.2.3-393-drm-mediatek-Use-NULL-instead-of-0-for-NULL-poi.patch @@ -0,0 +1,38 @@ +From: Miles Chen +Date: Wed, 11 Jan 2023 10:44:41 +0800 +Subject: [PATCH] drm/mediatek: Use NULL instead of 0 for NULL pointer +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4744cde06f57dd6fbaac468663b1fe2f653eaa16 + +[ Upstream commit 4744cde06f57dd6fbaac468663b1fe2f653eaa16 ] + +Use NULL for NULL pointer to fix the following sparse warning: +drivers/gpu/drm/mediatek/mtk_drm_gem.c:265:27: sparse: warning: Using plain integer as NULL pointer + +Fixes: 3df64d7b0a4f ("drm/mediatek: Implement gem prime vmap/vunmap function") +Signed-off-by: Miles Chen +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230111024443.24559-1-miles.chen@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index 47e96b02..06aadd5e 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -262,6 +262,6 @@ void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, + return; + + vunmap(vaddr); +- mtk_gem->kvaddr = 0; ++ mtk_gem->kvaddr = NULL; + kfree(mtk_gem->pages); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-394-drm-mediatek-Drop-unbalanced-obj-unref.patch b/patches.kernel.org/6.2.3-394-drm-mediatek-Drop-unbalanced-obj-unref.patch new file mode 100644 index 0000000..4d3b329 --- /dev/null +++ b/patches.kernel.org/6.2.3-394-drm-mediatek-Drop-unbalanced-obj-unref.patch @@ -0,0 +1,38 @@ +From: Rob Clark +Date: Thu, 19 Jan 2023 15:12:55 -0800 +Subject: [PATCH] drm/mediatek: Drop unbalanced obj unref +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4deef811828e87e26a978d5d6433b261d4713849 + +[ Upstream commit 4deef811828e87e26a978d5d6433b261d4713849 ] + +In the error path, mtk_drm_gem_object_mmap() is dropping an obj +reference that it doesn't own. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Rob Clark +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230119231255.2883365-1-robdclark@gmail.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index 06aadd5e..6c204ccf 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -164,8 +164,6 @@ static int mtk_drm_gem_object_mmap(struct drm_gem_object *obj, + + ret = dma_mmap_attrs(priv->dma_dev, vma, mtk_gem->cookie, + mtk_gem->dma_addr, obj->size, mtk_gem->dma_attrs); +- if (ret) +- drm_gem_vm_close(vma); + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-395-drm-mediatek-mtk_drm_crtc-Add-checks-for-devm_k.patch b/patches.kernel.org/6.2.3-395-drm-mediatek-mtk_drm_crtc-Add-checks-for-devm_k.patch new file mode 100644 index 0000000..96e1d54 --- /dev/null +++ b/patches.kernel.org/6.2.3-395-drm-mediatek-mtk_drm_crtc-Add-checks-for-devm_k.patch @@ -0,0 +1,39 @@ +From: ruanjinjie +Date: Mon, 5 Dec 2022 17:51:15 +0800 +Subject: [PATCH] drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c + +[ Upstream commit 5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c ] + +As the devm_kcalloc may return NULL, the return value needs to be checked +to avoid NULL poineter dereference. + +Fixes: 31c5558dae05 ("drm/mediatek: Refactor plane init") +Signed-off-by: ruanjinjie +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221205095115.2905090-1-ruanjinjie@huawei.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index 11261581..5071f126 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -945,6 +945,8 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev, + + mtk_crtc->planes = devm_kcalloc(dev, num_comp_planes, + sizeof(struct drm_plane), GFP_KERNEL); ++ if (!mtk_crtc->planes) ++ return -ENOMEM; + + for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) { + ret = mtk_drm_crtc_init_comp_planes(drm_dev, mtk_crtc, i, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-396-drm-mediatek-Clean-dangling-pointer-on-bind-err.patch b/patches.kernel.org/6.2.3-396-drm-mediatek-Clean-dangling-pointer-on-bind-err.patch new file mode 100644 index 0000000..833e847 --- /dev/null +++ b/patches.kernel.org/6.2.3-396-drm-mediatek-Clean-dangling-pointer-on-bind-err.patch @@ -0,0 +1,46 @@ +From: =?UTF-8?q?N=C3=ADcolas=20F=2E=20R=2E=20A=2E=20Prado?= + +Date: Tue, 22 Nov 2022 09:39:49 -0500 +Subject: [PATCH] drm/mediatek: Clean dangling pointer on bind error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 36aa8c61af55675ed967900fbe5deb32d776f051 + +[ Upstream commit 36aa8c61af55675ed967900fbe5deb32d776f051 ] + +mtk_drm_bind() can fail, in which case drm_dev_put() is called, +destroying the drm_device object. However a pointer to it was still +being held in the private object, and that pointer would be passed along +to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that +point, resulting in a panic. Clean the pointer when destroying the +object in the error path to prevent this from happening. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221122143949.3493104-1-nfraprado@collabora.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index cd5b18ef..d3e57dd7 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -520,6 +520,7 @@ static int mtk_drm_bind(struct device *dev) + err_deinit: + mtk_drm_kms_deinit(drm); + err_free: ++ private->drm = NULL; + drm_dev_put(drm); + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-397-ASoC-soc-compress.c-fixup-private_data-on-snd_s.patch b/patches.kernel.org/6.2.3-397-ASoC-soc-compress.c-fixup-private_data-on-snd_s.patch new file mode 100644 index 0000000..5487b49 --- /dev/null +++ b/patches.kernel.org/6.2.3-397-ASoC-soc-compress.c-fixup-private_data-on-snd_s.patch @@ -0,0 +1,43 @@ +From: Kuninori Morimoto +Date: Mon, 23 Jan 2023 23:17:20 +0000 +Subject: [PATCH] ASoC: soc-compress.c: fixup private_data on + snd_soc_new_compress() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 + +[ Upstream commit ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 ] + +commit d3268a40d4b19f ("ASoC: soc-compress.c: fix NULL dereference") +enables DPCM capture, but it should independent from playback. +This patch fixup it. + +Fixes: d3268a40d4b1 ("ASoC: soc-compress.c: fix NULL dereference") +Link: https://lore.kernel.org/r/87tu0i6j7j.wl-kuninori.morimoto.gx@renesas.com +Acked-by: Charles Keepax +Acked-by: Pierre-Louis Bossart +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/871qnkvo1s.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/soc-compress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c +index 870f13e1..cb0ed2fe 100644 +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -623,7 +623,7 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) + rtd->fe_compr = 1; + if (rtd->dai_link->dpcm_playback) + be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd; +- else if (rtd->dai_link->dpcm_capture) ++ if (rtd->dai_link->dpcm_capture) + be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd; + memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops)); + } else { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-398-dt-bindings-display-mediatek-Fix-the-fallback-f.patch b/patches.kernel.org/6.2.3-398-dt-bindings-display-mediatek-Fix-the-fallback-f.patch new file mode 100644 index 0000000..d1a4340 --- /dev/null +++ b/patches.kernel.org/6.2.3-398-dt-bindings-display-mediatek-Fix-the-fallback-f.patch @@ -0,0 +1,44 @@ +From: Allen-KH Cheng +Date: Wed, 18 Jan 2023 17:18:28 +0800 +Subject: [PATCH] dt-bindings: display: mediatek: Fix the fallback for + mediatek,mt8186-disp-ccorr +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 137272ef1b0f17a1815fec00d583515a0163f85e + +[ Upstream commit 137272ef1b0f17a1815fec00d583515a0163f85e ] + +The mt8186-disp-ccorr is not fully compatible with the mt8183-disp-ccorr +implementation. It causes a crash when system resumes if it binds to the +device. + +We should use mt8192-disp-ccorr as fallback of mt8186-disp-ccorr. + +Fixes: 8a26ea19d4dc ("dt-bindings: display: mediatek: add MT8186 SoC binding") +Signed-off-by: Allen-KH Cheng +Reviewed-by: Rob Herring +Reviewed-by: Matthias Brugger +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230118091829.755-10-allen-kh.cheng@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../devicetree/bindings/display/mediatek/mediatek,ccorr.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml b/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml +index 63fb0201..117e3db4 100644 +--- a/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml ++++ b/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml +@@ -32,7 +32,7 @@ properties: + - items: + - enum: + - mediatek,mt8186-disp-ccorr +- - const: mediatek,mt8183-disp-ccorr ++ - const: mediatek,mt8192-disp-ccorr + + reg: + maxItems: 1 +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-399-gpio-pca9570-rename-platform_data-to-chip_data.patch b/patches.kernel.org/6.2.3-399-gpio-pca9570-rename-platform_data-to-chip_data.patch new file mode 100644 index 0000000..48d8980 --- /dev/null +++ b/patches.kernel.org/6.2.3-399-gpio-pca9570-rename-platform_data-to-chip_data.patch @@ -0,0 +1,108 @@ +From: Bartosz Golaszewski +Date: Fri, 30 Dec 2022 11:00:44 +0100 +Subject: [PATCH] gpio: pca9570: rename platform_data to chip_data +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a3f7c1d6ddcbd487964c58ff246506a781e5be8f + +[ Upstream commit a3f7c1d6ddcbd487964c58ff246506a781e5be8f ] + +By convention platform_data refers to structures passed to drivers by +code that registers devices. When talking about model-specific data +structures associated with OF compatibles, we usually call them chip_data. + +In order to avoid confusion rename all mentions of platform_data to +chip_data. + +Fixes: fbb19fe17eae ("gpio: pca9570: add slg7xl45106 support") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Andy Shevchenko +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpio/gpio-pca9570.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpio/gpio-pca9570.c b/drivers/gpio/gpio-pca9570.c +index 6c07a881..6a5a8e59 100644 +--- a/drivers/gpio/gpio-pca9570.c ++++ b/drivers/gpio/gpio-pca9570.c +@@ -18,11 +18,11 @@ + #define SLG7XL45106_GPO_REG 0xDB + + /** +- * struct pca9570_platform_data - GPIO platformdata ++ * struct pca9570_chip_data - GPIO platformdata + * @ngpio: no of gpios + * @command: Command to be sent + */ +-struct pca9570_platform_data { ++struct pca9570_chip_data { + u16 ngpio; + u32 command; + }; +@@ -36,7 +36,7 @@ struct pca9570_platform_data { + */ + struct pca9570 { + struct gpio_chip chip; +- const struct pca9570_platform_data *p_data; ++ const struct pca9570_chip_data *chip_data; + struct mutex lock; + u8 out; + }; +@@ -46,8 +46,8 @@ static int pca9570_read(struct pca9570 *gpio, u8 *value) + struct i2c_client *client = to_i2c_client(gpio->chip.parent); + int ret; + +- if (gpio->p_data->command != 0) +- ret = i2c_smbus_read_byte_data(client, gpio->p_data->command); ++ if (gpio->chip_data->command != 0) ++ ret = i2c_smbus_read_byte_data(client, gpio->chip_data->command); + else + ret = i2c_smbus_read_byte(client); + +@@ -62,8 +62,8 @@ static int pca9570_write(struct pca9570 *gpio, u8 value) + { + struct i2c_client *client = to_i2c_client(gpio->chip.parent); + +- if (gpio->p_data->command != 0) +- return i2c_smbus_write_byte_data(client, gpio->p_data->command, value); ++ if (gpio->chip_data->command != 0) ++ return i2c_smbus_write_byte_data(client, gpio->chip_data->command, value); + + return i2c_smbus_write_byte(client, value); + } +@@ -127,8 +127,8 @@ static int pca9570_probe(struct i2c_client *client) + gpio->chip.get = pca9570_get; + gpio->chip.set = pca9570_set; + gpio->chip.base = -1; +- gpio->p_data = device_get_match_data(&client->dev); +- gpio->chip.ngpio = gpio->p_data->ngpio; ++ gpio->chip_data = device_get_match_data(&client->dev); ++ gpio->chip.ngpio = gpio->chip_data->ngpio; + gpio->chip.can_sleep = true; + + mutex_init(&gpio->lock); +@@ -141,15 +141,15 @@ static int pca9570_probe(struct i2c_client *client) + return devm_gpiochip_add_data(&client->dev, &gpio->chip, gpio); + } + +-static const struct pca9570_platform_data pca9570_gpio = { ++static const struct pca9570_chip_data pca9570_gpio = { + .ngpio = 4, + }; + +-static const struct pca9570_platform_data pca9571_gpio = { ++static const struct pca9570_chip_data pca9571_gpio = { + .ngpio = 8, + }; + +-static const struct pca9570_platform_data slg7xl45106_gpio = { ++static const struct pca9570_chip_data slg7xl45106_gpio = { + .ngpio = 8, + .command = SLG7XL45106_GPO_REG, + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-400-gpio-vf610-connect-GPIO-label-to-dev-name.patch b/patches.kernel.org/6.2.3-400-gpio-vf610-connect-GPIO-label-to-dev-name.patch new file mode 100644 index 0000000..fe08b5a --- /dev/null +++ b/patches.kernel.org/6.2.3-400-gpio-vf610-connect-GPIO-label-to-dev-name.patch @@ -0,0 +1,39 @@ +From: Haibo Chen +Date: Tue, 20 Dec 2022 17:02:47 +0800 +Subject: [PATCH] gpio: vf610: connect GPIO label to dev name +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e + +[ Upstream commit 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e ] + +Current GPIO label is fixed, so can't distinguish different GPIO +controllers through labels. Use dev name instead. + +Fixes: 7f2691a19627 ("gpio: vf610: add gpiolib/IRQ chip driver for Vybrid") +Signed-off-by: Clark Wang +Signed-off-by: Haibo Chen +Reviewed-by: Linus Walleij +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpio/gpio-vf610.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c +index 9033db00..d3f3a69d 100644 +--- a/drivers/gpio/gpio-vf610.c ++++ b/drivers/gpio/gpio-vf610.c +@@ -317,7 +317,7 @@ static int vf610_gpio_probe(struct platform_device *pdev) + + gc = &port->gc; + gc->parent = dev; +- gc->label = "vf610-gpio"; ++ gc->label = dev_name(dev); + gc->ngpio = VF610_GPIO_PER_PORT; + gc->base = of_alias_get_id(np, "gpio") * VF610_GPIO_PER_PORT; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-401-ASoC-topology-Properly-access-value-coming-from.patch b/patches.kernel.org/6.2.3-401-ASoC-topology-Properly-access-value-coming-from.patch new file mode 100644 index 0000000..a3121fd --- /dev/null +++ b/patches.kernel.org/6.2.3-401-ASoC-topology-Properly-access-value-coming-from.patch @@ -0,0 +1,45 @@ +From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= + +Date: Sat, 28 Jan 2023 00:11:01 +0100 +Subject: [PATCH] ASoC: topology: Properly access value coming from topology + file +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c5d184c92df2b631fb81fe2ce6e96bfc5ba720e5 + +[ Upstream commit c5d184c92df2b631fb81fe2ce6e96bfc5ba720e5 ] + +When accessing values coming from topology, le32_to_cpu should be used. +One of recent commits missed that. + +Fixes: 86e2d14b6d1a ("ASoC: topology: Add header payload_size verification") +Reviewed-by: Cezary Rojewski +Reviewed-by: Ranjani Sridharan +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230127231111.937721-2-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/soc-topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index a79a2fb2..d68c4855 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -2408,7 +2408,7 @@ static int soc_valid_header(struct soc_tplg *tplg, + return -EINVAL; + } + +- if (soc_tplg_get_hdr_offset(tplg) + hdr->payload_size >= tplg->fw->size) { ++ if (soc_tplg_get_hdr_offset(tplg) + le32_to_cpu(hdr->payload_size) >= tplg->fw->size) { + dev_err(tplg->dev, + "ASoC: invalid header of type %d at offset %ld payload_size %d\n", + le32_to_cpu(hdr->type), soc_tplg_get_hdr_offset(tplg), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-402-spi-dw_bt1-fix-MUX_MMIO-dependencies.patch b/patches.kernel.org/6.2.3-402-spi-dw_bt1-fix-MUX_MMIO-dependencies.patch new file mode 100644 index 0000000..85d62a8 --- /dev/null +++ b/patches.kernel.org/6.2.3-402-spi-dw_bt1-fix-MUX_MMIO-dependencies.patch @@ -0,0 +1,49 @@ +From: Arnd Bergmann +Date: Mon, 30 Jan 2023 15:01:40 +0100 +Subject: [PATCH] spi: dw_bt1: fix MUX_MMIO dependencies +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d4bde04318c0d33705e9a77d4c7df72f262011e0 + +[ Upstream commit d4bde04318c0d33705e9a77d4c7df72f262011e0 ] + +Selecting a symbol with additional dependencies requires +adding the same dependency here: + +WARNING: unmet direct dependencies detected for MUX_MMIO + Depends on [n]: MULTIPLEXER [=y] && OF [=n] + Selected by [y]: + - SPI_DW_BT1 [=y] && SPI [=y] && SPI_MASTER [=y] && SPI_DESIGNWARE [=y] && (MIPS_BAIKAL_T1 || COMPILE_TEST [=y]) + +Drop the 'select' here to avoid the problem. Anyone using +the dw-bt1 SPI driver should make sure they include the +mux driver as well now. + +Fixes: 7218838109fe ("spi: dw-bt1: Fix undefined devm_mux_control_get symbol") +Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver") +Link: https://lore.kernel.org/all/20221218192523.c6vnfo26ua6xqf26@mobilestation/ +Signed-off-by: Arnd Bergmann +Reviewed-by: Serge Semin +Link: https://lore.kernel.org/r/20230130140156.3620863-1-arnd@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/spi/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig +index 3b1c0878..930c6075 100644 +--- a/drivers/spi/Kconfig ++++ b/drivers/spi/Kconfig +@@ -295,7 +295,6 @@ config SPI_DW_BT1 + tristate "Baikal-T1 SPI driver for DW SPI core" + depends on MIPS_BAIKAL_T1 || COMPILE_TEST + select MULTIPLEXER +- select MUX_MMIO + help + Baikal-T1 SoC is equipped with three DW APB SSI-based MMIO SPI + controllers. Two of them are pretty much normal: with IRQ, DMA, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-403-ASoC-mchp-spdifrx-fix-controls-which-rely-on-rs.patch b/patches.kernel.org/6.2.3-403-ASoC-mchp-spdifrx-fix-controls-which-rely-on-rs.patch new file mode 100644 index 0000000..b19be87 --- /dev/null +++ b/patches.kernel.org/6.2.3-403-ASoC-mchp-spdifrx-fix-controls-which-rely-on-rs.patch @@ -0,0 +1,366 @@ +From: Claudiu Beznea +Date: Mon, 30 Jan 2023 14:06:40 +0200 +Subject: [PATCH] ASoC: mchp-spdifrx: fix controls which rely on rsr register +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fa09fa60385abbf99342494b280da8b4aebbc0e9 + +[ Upstream commit fa09fa60385abbf99342494b280da8b4aebbc0e9 ] + +The SPDIFRX block is clocked by 2 clocks: peripheral and generic clocks. +Peripheral clock feeds user interface (registers) and generic clock feeds +the receiver. + +To enable the receiver the generic clock needs to be enabled and also the +ENABLE bit of MCHP_SPDIFRX_MR register need to be set. + +The signal control exported by mchp-spdifrx driver reports wrong status +when the receiver is disabled. This can happen when requesting the signal +and the capture was not previously started. To solve this the receiver +needs to be enabled (by enabling generic clock and setting ENABLE bit of +MR register) before reading the signal status. + +As with this fix there are 2 paths now that need to control the generic +clock and ENABLE bit of SPDIFRX_MR register (one path though controls, one +path though configuration) a mutex has been introduced. We can't rely on +subsystem locking as the controls are protected by +struct snd_card::controls_rwsem semaphore and configuration is protected +by a different lock (embedded in snd_pcm_stream_lock_irq()). + +The introduction of mutex is also extended to other controls which rely on +SPDIFRX_RSR.ULOCK bit as it has been discovered experimentally that having +both clocks enabled but not the receiver (through ENABLE bit of SPDIFRX.MR) +leads to inconsistent values of SPDIFRX_RSR.ULOCK. Thus on some controls we +rely on software state (dev->trigger_enabled protected by mutex) to +retrieve proper values. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-2-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/atmel/mchp-spdifrx.c | 192 ++++++++++++++++++++++++--------- + 1 file changed, 142 insertions(+), 50 deletions(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index ec0705cc..2d86e0ec 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -233,11 +233,13 @@ struct mchp_spdifrx_dev { + struct mchp_spdifrx_mixer_control control; + spinlock_t blockend_lock; /* protect access to blockend_refcount */ + int blockend_refcount; ++ struct mutex mlock; + struct device *dev; + struct regmap *regmap; + struct clk *pclk; + struct clk *gclk; + unsigned int fmt; ++ unsigned int trigger_enabled; + unsigned int gclk_enabled:1; + }; + +@@ -353,47 +355,40 @@ static int mchp_spdifrx_trigger(struct snd_pcm_substream *substream, int cmd, + struct snd_soc_dai *dai) + { + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); +- u32 mr; +- int running; +- int ret; +- +- regmap_read(dev->regmap, SPDIFRX_MR, &mr); +- running = !!(mr & SPDIFRX_MR_RXEN_ENABLE); ++ int ret = 0; + + switch (cmd) { + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: +- if (!running) { +- mr &= ~SPDIFRX_MR_RXEN_MASK; +- mr |= SPDIFRX_MR_RXEN_ENABLE; +- /* enable overrun interrupts */ +- regmap_write(dev->regmap, SPDIFRX_IER, +- SPDIFRX_IR_OVERRUN); +- } ++ mutex_lock(&dev->mlock); ++ /* Enable overrun interrupts */ ++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_OVERRUN); ++ ++ /* Enable receiver. */ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_ENABLE); ++ dev->trigger_enabled = true; ++ mutex_unlock(&dev->mlock); + break; + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: +- if (running) { +- mr &= ~SPDIFRX_MR_RXEN_MASK; +- mr |= SPDIFRX_MR_RXEN_DISABLE; +- /* disable overrun interrupts */ +- regmap_write(dev->regmap, SPDIFRX_IDR, +- SPDIFRX_IR_OVERRUN); +- } ++ mutex_lock(&dev->mlock); ++ /* Disable overrun interrupts */ ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_OVERRUN); ++ ++ /* Disable receiver. */ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_DISABLE); ++ dev->trigger_enabled = false; ++ mutex_unlock(&dev->mlock); + break; + default: +- return -EINVAL; ++ ret = -EINVAL; + } + +- ret = regmap_write(dev->regmap, SPDIFRX_MR, mr); +- if (ret) { +- dev_err(dev->dev, "unable to enable/disable RX: %d\n", ret); +- return ret; +- } +- +- return 0; ++ return ret; + } + + static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, +@@ -413,13 +408,6 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + return -EINVAL; + } + +- regmap_read(dev->regmap, SPDIFRX_MR, &mr); +- +- if (mr & SPDIFRX_MR_RXEN_ENABLE) { +- dev_err(dev->dev, "PCM already running\n"); +- return -EBUSY; +- } +- + if (params_channels(params) != SPDIFRX_CHANNELS) { + dev_err(dev->dev, "unsupported number of channels: %d\n", + params_channels(params)); +@@ -445,6 +433,13 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + return -EINVAL; + } + ++ mutex_lock(&dev->mlock); ++ if (dev->trigger_enabled) { ++ dev_err(dev->dev, "PCM already running\n"); ++ ret = -EBUSY; ++ goto unlock; ++ } ++ + if (dev->gclk_enabled) { + clk_disable_unprepare(dev->gclk); + dev->gclk_enabled = 0; +@@ -455,19 +450,24 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + dev_err(dev->dev, + "unable to set gclk min rate: rate %u * ratio %u + 1\n", + params_rate(params), SPDIFRX_GCLK_RATIO_MIN); +- return ret; ++ goto unlock; + } + ret = clk_prepare_enable(dev->gclk); + if (ret) { + dev_err(dev->dev, "unable to enable gclk: %d\n", ret); +- return ret; ++ goto unlock; + } + dev->gclk_enabled = 1; + + dev_dbg(dev->dev, "GCLK range min set to %d\n", + params_rate(params) * SPDIFRX_GCLK_RATIO_MIN + 1); + +- return regmap_write(dev->regmap, SPDIFRX_MR, mr); ++ ret = regmap_write(dev->regmap, SPDIFRX_MR, mr); ++ ++unlock: ++ mutex_unlock(&dev->mlock); ++ ++ return ret; + } + + static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream, +@@ -475,10 +475,12 @@ static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream, + { + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); + ++ mutex_lock(&dev->mlock); + if (dev->gclk_enabled) { + clk_disable_unprepare(dev->gclk); + dev->gclk_enabled = 0; + } ++ mutex_unlock(&dev->mlock); + return 0; + } + +@@ -627,10 +629,24 @@ static int mchp_spdifrx_ulock_get(struct snd_kcontrol *kcontrol, + u32 val; + bool ulock_old = ctrl->ulock; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK); ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled ++ * and the receiver is disabled. Thus we take into account the ++ * dev->trigger_enabled here to return a real status. ++ */ ++ if (dev->trigger_enabled) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK); ++ } else { ++ ctrl->ulock = 0; ++ } ++ + uvalue->value.integer.value[0] = ctrl->ulock; + ++ mutex_unlock(&dev->mlock); ++ + return ulock_old != ctrl->ulock; + } + +@@ -643,8 +659,22 @@ static int mchp_spdifrx_badf_get(struct snd_kcontrol *kcontrol, + u32 val; + bool badf_old = ctrl->badf; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- ctrl->badf = !!(val & SPDIFRX_RSR_BADF); ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled ++ * and the receiver is disabled. Thus we take into account the ++ * dev->trigger_enabled here to return a real status. ++ */ ++ if (dev->trigger_enabled) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ ctrl->badf = !!(val & SPDIFRX_RSR_BADF); ++ } else { ++ ctrl->badf = 0; ++ } ++ ++ mutex_unlock(&dev->mlock); ++ + uvalue->value.integer.value[0] = ctrl->badf; + + return badf_old != ctrl->badf; +@@ -656,11 +686,48 @@ static int mchp_spdifrx_signal_get(struct snd_kcontrol *kcontrol, + struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol); + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); + struct mchp_spdifrx_mixer_control *ctrl = &dev->control; +- u32 val; ++ u32 val = ~0U, loops = 10; ++ int ret; + bool signal_old = ctrl->signal; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL); ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * To get the signal we need to have receiver enabled. This ++ * could be enabled also from trigger() function thus we need to ++ * take care of not disabling the receiver when it runs. ++ */ ++ if (!dev->trigger_enabled) { ++ ret = clk_prepare_enable(dev->gclk); ++ if (ret) ++ goto unlock; ++ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_ENABLE); ++ ++ /* Wait for RSR.ULOCK bit. */ ++ while (--loops) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ if (!(val & SPDIFRX_RSR_ULOCK)) ++ break; ++ usleep_range(100, 150); ++ } ++ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_DISABLE); ++ ++ clk_disable_unprepare(dev->gclk); ++ } else { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ } ++ ++unlock: ++ mutex_unlock(&dev->mlock); ++ ++ if (!(val & SPDIFRX_RSR_ULOCK)) ++ ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL); ++ else ++ ctrl->signal = 0; + uvalue->value.integer.value[0] = ctrl->signal; + + return signal_old != ctrl->signal; +@@ -685,18 +752,32 @@ static int mchp_spdifrx_rate_get(struct snd_kcontrol *kcontrol, + u32 val; + int rate; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- +- /* if the receiver is not locked, ISF data is invalid */ +- if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) { ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled ++ * and the receiver is disabled. Thus we take into account the ++ * dev->trigger_enabled here to return a real status. ++ */ ++ if (dev->trigger_enabled) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ /* If the receiver is not locked, ISF data is invalid. */ ++ if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) { ++ ucontrol->value.integer.value[0] = 0; ++ goto unlock; ++ } ++ } else { ++ /* Reveicer is not locked, IFS data is invalid. */ + ucontrol->value.integer.value[0] = 0; +- return 0; ++ goto unlock; + } + + rate = clk_get_rate(dev->gclk); + + ucontrol->value.integer.value[0] = rate / (32 * SPDIFRX_RSR_IFS(val)); + ++unlock: ++ mutex_unlock(&dev->mlock); + return 0; + } + +@@ -913,7 +994,18 @@ static int mchp_spdifrx_probe(struct platform_device *pdev) + "failed to get the PMC generated clock: %d\n", err); + return err; + } ++ ++ /* ++ * Signal control need a valid rate on gclk. hw_params() configures ++ * it propertly but requesting signal before any hw_params() has been ++ * called lead to invalid value returned for signal. Thus, configure ++ * gclk at a valid rate, here, in initialization, to simplify the ++ * control path. ++ */ ++ clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1); ++ + spin_lock_init(&dev->blockend_lock); ++ mutex_init(&dev->mlock); + + dev->dev = &pdev->dev; + dev->regmap = regmap; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-404-ASoC-mchp-spdifrx-fix-return-value-in-case-comp.patch b/patches.kernel.org/6.2.3-404-ASoC-mchp-spdifrx-fix-return-value-in-case-comp.patch new file mode 100644 index 0000000..4097e93 --- /dev/null +++ b/patches.kernel.org/6.2.3-404-ASoC-mchp-spdifrx-fix-return-value-in-case-comp.patch @@ -0,0 +1,51 @@ +From: Claudiu Beznea +Date: Mon, 30 Jan 2023 14:06:41 +0200 +Subject: [PATCH] ASoC: mchp-spdifrx: fix return value in case completion times + out +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a4c4161d6eae3ef5f486d1638ef452d9bc1376b0 + +[ Upstream commit a4c4161d6eae3ef5f486d1638ef452d9bc1376b0 ] + +wait_for_completion_interruptible_timeout() returns 0 in case of +timeout. Check this into account when returning from function. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-3-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/atmel/mchp-spdifrx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index 2d86e0ec..7f359371 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -524,9 +524,10 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev, + ret = wait_for_completion_interruptible_timeout(&ch_stat->done, + msecs_to_jiffies(100)); + /* IP might not be started or valid stream might not be present */ +- if (ret < 0) { ++ if (ret <= 0) { + dev_dbg(dev->dev, "channel status for channel %d timeout\n", + channel); ++ return ret ? : -ETIMEDOUT; + } + + memcpy(uvalue->value.iec958.status, ch_stat->data, +@@ -580,7 +581,7 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev, + dev_dbg(dev->dev, "user data for channel %d timeout\n", + channel); + mchp_spdifrx_isr_blockend_dis(dev); +- return ret; ++ return ret ? : -ETIMEDOUT; + } + + spin_lock_irqsave(&user_data->lock, flags); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-405-ASoC-mchp-spdifrx-fix-controls-that-works-with-.patch b/patches.kernel.org/6.2.3-405-ASoC-mchp-spdifrx-fix-controls-that-works-with-.patch new file mode 100644 index 0000000..147f391 --- /dev/null +++ b/patches.kernel.org/6.2.3-405-ASoC-mchp-spdifrx-fix-controls-that-works-with-.patch @@ -0,0 +1,284 @@ +From: Claudiu Beznea +Date: Mon, 30 Jan 2023 14:06:42 +0200 +Subject: [PATCH] ASoC: mchp-spdifrx: fix controls that works with completion + mechanism +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d3681df44e856aab523a6eb7ba15b5e41efcbb1c + +[ Upstream commit d3681df44e856aab523a6eb7ba15b5e41efcbb1c ] + +Channel status get and channel subcode get controls relies on data +returned by controls when certain IRQs are raised. To achieve that +completions are used b/w controls and interrupt service routine. The +concurrent accesses to these controls are protected by +struct snd_card::controls_rwsem. + +Issues identified: +- reinit_completion() may be called while waiting for completion + which should be avoided +- in case of multiple threads waiting, the complete() call in interrupt + will signal only one waiting thread per interrupt which may lead to + timeout for the others +- in case of channel status get as the CSC interrupt is not refcounted + ISR may disable interrupt for threads that were just enabled it. + +To solve these the access to controls were protected by a mutex. Along +with this there is no need for spinlock to protect the software cache +reads/updates b/w controls and ISR as the update is happening only when +requested from control, and only one reader can reach the control. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-4-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/atmel/mchp-spdifrx.c | 143 ++++++++++++++++++--------------- + 1 file changed, 77 insertions(+), 66 deletions(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index 7f359371..31ffaaf4 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -217,7 +217,6 @@ struct mchp_spdifrx_ch_stat { + struct mchp_spdifrx_user_data { + unsigned char data[SPDIFRX_UD_BITS / 8]; + struct completion done; +- spinlock_t lock; /* protect access to user data */ + }; + + struct mchp_spdifrx_mixer_control { +@@ -231,8 +230,6 @@ struct mchp_spdifrx_mixer_control { + struct mchp_spdifrx_dev { + struct snd_dmaengine_dai_dma_data capture; + struct mchp_spdifrx_mixer_control control; +- spinlock_t blockend_lock; /* protect access to blockend_refcount */ +- int blockend_refcount; + struct mutex mlock; + struct device *dev; + struct regmap *regmap; +@@ -277,37 +274,11 @@ static void mchp_spdifrx_channel_user_data_read(struct mchp_spdifrx_dev *dev, + } + } + +-/* called from non-atomic context only */ +-static void mchp_spdifrx_isr_blockend_en(struct mchp_spdifrx_dev *dev) +-{ +- unsigned long flags; +- +- spin_lock_irqsave(&dev->blockend_lock, flags); +- dev->blockend_refcount++; +- /* don't enable BLOCKEND interrupt if it's already enabled */ +- if (dev->blockend_refcount == 1) +- regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND); +- spin_unlock_irqrestore(&dev->blockend_lock, flags); +-} +- +-/* called from atomic/non-atomic context */ +-static void mchp_spdifrx_isr_blockend_dis(struct mchp_spdifrx_dev *dev) +-{ +- unsigned long flags; +- +- spin_lock_irqsave(&dev->blockend_lock, flags); +- dev->blockend_refcount--; +- /* don't enable BLOCKEND interrupt if it's already enabled */ +- if (dev->blockend_refcount == 0) +- regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND); +- spin_unlock_irqrestore(&dev->blockend_lock, flags); +-} +- + static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) + { + struct mchp_spdifrx_dev *dev = dev_id; + struct mchp_spdifrx_mixer_control *ctrl = &dev->control; +- u32 sr, imr, pending, idr = 0; ++ u32 sr, imr, pending; + irqreturn_t ret = IRQ_NONE; + int ch; + +@@ -322,13 +293,10 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) + + if (pending & SPDIFRX_IR_BLOCKEND) { + for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) { +- spin_lock(&ctrl->user_data[ch].lock); + mchp_spdifrx_channel_user_data_read(dev, ch); +- spin_unlock(&ctrl->user_data[ch].lock); +- + complete(&ctrl->user_data[ch].done); + } +- mchp_spdifrx_isr_blockend_dis(dev); ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND); + ret = IRQ_HANDLED; + } + +@@ -336,7 +304,7 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) + if (pending & SPDIFRX_IR_CSC(ch)) { + mchp_spdifrx_channel_status_read(dev, ch); + complete(&ctrl->ch_stat[ch].done); +- idr |= SPDIFRX_IR_CSC(ch); ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(ch)); + ret = IRQ_HANDLED; + } + } +@@ -346,8 +314,6 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) + ret = IRQ_HANDLED; + } + +- regmap_write(dev->regmap, SPDIFRX_IDR, idr); +- + return ret; + } + +@@ -517,23 +483,51 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev, + { + struct mchp_spdifrx_mixer_control *ctrl = &dev->control; + struct mchp_spdifrx_ch_stat *ch_stat = &ctrl->ch_stat[channel]; +- int ret; ++ int ret = 0; ++ ++ mutex_lock(&dev->mlock); + +- regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel)); +- /* check for new data available */ +- ret = wait_for_completion_interruptible_timeout(&ch_stat->done, +- msecs_to_jiffies(100)); +- /* IP might not be started or valid stream might not be present */ +- if (ret <= 0) { +- dev_dbg(dev->dev, "channel status for channel %d timeout\n", +- channel); +- return ret ? : -ETIMEDOUT; ++ /* ++ * We may reach this point with both clocks enabled but the receiver ++ * still disabled. To void waiting for completion and return with ++ * timeout check the dev->trigger_enabled. ++ * ++ * To retrieve data: ++ * - if the receiver is enabled CSC IRQ will update the data in software ++ * caches (ch_stat->data) ++ * - otherwise we just update it here the software caches with latest ++ * available information and return it; in this case we don't need ++ * spin locking as the IRQ is disabled and will not be raised from ++ * anywhere else. ++ */ ++ ++ if (dev->trigger_enabled) { ++ reinit_completion(&ch_stat->done); ++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel)); ++ /* Check for new data available */ ++ ret = wait_for_completion_interruptible_timeout(&ch_stat->done, ++ msecs_to_jiffies(100)); ++ /* Valid stream might not be present */ ++ if (ret <= 0) { ++ dev_dbg(dev->dev, "channel status for channel %d timeout\n", ++ channel); ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(channel)); ++ ret = ret ? : -ETIMEDOUT; ++ goto unlock; ++ } else { ++ ret = 0; ++ } ++ } else { ++ /* Update software cache with latest channel status. */ ++ mchp_spdifrx_channel_status_read(dev, channel); + } + + memcpy(uvalue->value.iec958.status, ch_stat->data, + sizeof(ch_stat->data)); + +- return 0; ++unlock: ++ mutex_unlock(&dev->mlock); ++ return ret; + } + + static int mchp_spdifrx_cs1_get(struct snd_kcontrol *kcontrol, +@@ -567,29 +561,49 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev, + int channel, + struct snd_ctl_elem_value *uvalue) + { +- unsigned long flags; + struct mchp_spdifrx_mixer_control *ctrl = &dev->control; + struct mchp_spdifrx_user_data *user_data = &ctrl->user_data[channel]; +- int ret; ++ int ret = 0; ++ ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * We may reach this point with both clocks enabled but the receiver ++ * still disabled. To void waiting for completion to just timeout we ++ * check here the dev->trigger_enabled flag. ++ * ++ * To retrieve data: ++ * - if the receiver is enabled we need to wait for blockend IRQ to read ++ * data to and update it for us in software caches ++ * - otherwise reading the SPDIFRX_CHUD() registers is enough. ++ */ + +- reinit_completion(&user_data->done); +- mchp_spdifrx_isr_blockend_en(dev); +- ret = wait_for_completion_interruptible_timeout(&user_data->done, +- msecs_to_jiffies(100)); +- /* IP might not be started or valid stream might not be present */ +- if (ret <= 0) { +- dev_dbg(dev->dev, "user data for channel %d timeout\n", +- channel); +- mchp_spdifrx_isr_blockend_dis(dev); +- return ret ? : -ETIMEDOUT; ++ if (dev->trigger_enabled) { ++ reinit_completion(&user_data->done); ++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND); ++ ret = wait_for_completion_interruptible_timeout(&user_data->done, ++ msecs_to_jiffies(100)); ++ /* Valid stream might not be present. */ ++ if (ret <= 0) { ++ dev_dbg(dev->dev, "user data for channel %d timeout\n", ++ channel); ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND); ++ ret = ret ? : -ETIMEDOUT; ++ goto unlock; ++ } else { ++ ret = 0; ++ } ++ } else { ++ /* Update software cache with last available data. */ ++ mchp_spdifrx_channel_user_data_read(dev, channel); + } + +- spin_lock_irqsave(&user_data->lock, flags); + memcpy(uvalue->value.iec958.subcode, user_data->data, + sizeof(user_data->data)); +- spin_unlock_irqrestore(&user_data->lock, flags); + +- return 0; ++unlock: ++ mutex_unlock(&dev->mlock); ++ return ret; + } + + static int mchp_spdifrx_subcode_ch1_get(struct snd_kcontrol *kcontrol, +@@ -890,11 +904,9 @@ static int mchp_spdifrx_dai_probe(struct snd_soc_dai *dai) + SPDIFRX_MR_AUTORST_NOACTION | + SPDIFRX_MR_PACK_DISABLED); + +- dev->blockend_refcount = 0; + for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) { + init_completion(&ctrl->ch_stat[ch].done); + init_completion(&ctrl->user_data[ch].done); +- spin_lock_init(&ctrl->user_data[ch].lock); + } + + /* Add controls */ +@@ -1005,7 +1017,6 @@ static int mchp_spdifrx_probe(struct platform_device *pdev) + */ + clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1); + +- spin_lock_init(&dev->blockend_lock); + mutex_init(&dev->mlock); + + dev->dev = &pdev->dev; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-406-ASoC-mchp-spdifrx-disable-all-interrupts-in-mch.patch b/patches.kernel.org/6.2.3-406-ASoC-mchp-spdifrx-disable-all-interrupts-in-mch.patch new file mode 100644 index 0000000..59f3546 --- /dev/null +++ b/patches.kernel.org/6.2.3-406-ASoC-mchp-spdifrx-disable-all-interrupts-in-mch.patch @@ -0,0 +1,40 @@ +From: Claudiu Beznea +Date: Mon, 30 Jan 2023 14:06:43 +0200 +Subject: [PATCH] ASoC: mchp-spdifrx: disable all interrupts in + mchp_spdifrx_dai_remove() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aaecdc32b7e35b4f9b457fb3509414aa9a932589 + +[ Upstream commit aaecdc32b7e35b4f9b457fb3509414aa9a932589 ] + +CSC interrupts which might be used in controls are on bits 8 and 9 of +SPDIFRX_IDR register. Thus disable all the interrupts that are exported +by driver. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-5-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/atmel/mchp-spdifrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index 31ffaaf4..b81fc777 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -921,7 +921,7 @@ static int mchp_spdifrx_dai_remove(struct snd_soc_dai *dai) + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); + + /* Disable interrupts */ +- regmap_write(dev->regmap, SPDIFRX_IDR, 0xFF); ++ regmap_write(dev->regmap, SPDIFRX_IDR, GENMASK(14, 0)); + + clk_disable_unprepare(dev->pclk); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-407-dm-improve-shrinker-debug-names.patch b/patches.kernel.org/6.2.3-407-dm-improve-shrinker-debug-names.patch new file mode 100644 index 0000000..f90071b --- /dev/null +++ b/patches.kernel.org/6.2.3-407-dm-improve-shrinker-debug-names.patch @@ -0,0 +1,50 @@ +From: Mike Snitzer +Date: Wed, 25 Jan 2023 13:01:46 -0500 +Subject: [PATCH] dm: improve shrinker debug names +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c87791bcc455a91e51ca9800faaacc21c8d67785 + +[ Upstream commit c87791bcc455a91e51ca9800faaacc21c8d67785 ] + +Commit e33c267ab70d ("mm: shrinkers: provide shrinkers with names") +chose some fairly bad names for DM's shrinkers. + +Fixes: e33c267ab70d ("mm: shrinkers: provide shrinkers with names") +Signed-off-by : Mike Snitzer +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-bufio.c | 2 +- + drivers/md/dm-zoned-metadata.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c +index bb786c39..19caaf68 100644 +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -1833,7 +1833,7 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign + c->shrinker.scan_objects = dm_bufio_shrink_scan; + c->shrinker.seeks = 1; + c->shrinker.batch = 0; +- r = register_shrinker(&c->shrinker, "md-%s:(%u:%u)", slab_name, ++ r = register_shrinker(&c->shrinker, "dm-bufio:(%u:%u)", + MAJOR(bdev->bd_dev), MINOR(bdev->bd_dev)); + if (r) + goto bad; +diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c +index 0278482f..c795ea7d 100644 +--- a/drivers/md/dm-zoned-metadata.c ++++ b/drivers/md/dm-zoned-metadata.c +@@ -2945,7 +2945,7 @@ int dmz_ctr_metadata(struct dmz_dev *dev, int num_dev, + zmd->mblk_shrinker.seeks = DEFAULT_SEEKS; + + /* Metadata cache shrinker */ +- ret = register_shrinker(&zmd->mblk_shrinker, "md-meta:(%u:%u)", ++ ret = register_shrinker(&zmd->mblk_shrinker, "dm-zoned-meta:(%u:%u)", + MAJOR(dev->bdev->bd_dev), + MINOR(dev->bdev->bd_dev)); + if (ret) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-408-regmap-apply-reg_base-and-reg_downshift-for-sin.patch b/patches.kernel.org/6.2.3-408-regmap-apply-reg_base-and-reg_downshift-for-sin.patch new file mode 100644 index 0000000..1e418e7 --- /dev/null +++ b/patches.kernel.org/6.2.3-408-regmap-apply-reg_base-and-reg_downshift-for-sin.patch @@ -0,0 +1,68 @@ +From: Daniel Golle +Date: Mon, 30 Jan 2023 02:04:57 +0000 +Subject: [PATCH] regmap: apply reg_base and reg_downshift for single register + ops +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 697c3892d825fb78f42ec8e53bed065dd728db3e + +[ Upstream commit 697c3892d825fb78f42ec8e53bed065dd728db3e ] + +reg_base and reg_downshift currently don't have any effect if used with +a regmap_bus or regmap_config which only offers single register +operations (ie. reg_read, reg_write and optionally reg_update_bits). + +Fix that and take them into account also for regmap_bus with only +reg_read and read_write operations by applying reg_base and +reg_downshift in _regmap_bus_reg_write, _regmap_bus_reg_read. + +Also apply reg_base and reg_downshift in _regmap_update_bits, but only +in case the operation is carried out with a reg_update_bits call +defined in either regmap_bus or regmap_config. + +Fixes: 0074f3f2b1e43d ("regmap: allow a defined reg_base to be added to every address") +Fixes: 86fc59ef818beb ("regmap: add configurable downshift for addresses") +Signed-off-by: Daniel Golle +Tested-by: Colin Foster +Link: https://lore.kernel.org/r/Y9clyVS3tQEHlUhA@makrotopia.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/regmap/regmap.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index d12d6691..d2a54eb0 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1942,6 +1942,8 @@ static int _regmap_bus_reg_write(void *context, unsigned int reg, + { + struct regmap *map = context; + ++ reg += map->reg_base; ++ reg >>= map->format.reg_downshift; + return map->bus->reg_write(map->bus_context, reg, val); + } + +@@ -2840,6 +2842,8 @@ static int _regmap_bus_reg_read(void *context, unsigned int reg, + { + struct regmap *map = context; + ++ reg += map->reg_base; ++ reg >>= map->format.reg_downshift; + return map->bus->reg_read(map->bus_context, reg, val); + } + +@@ -3231,6 +3235,8 @@ static int _regmap_update_bits(struct regmap *map, unsigned int reg, + *change = false; + + if (regmap_volatile(map, reg) && map->reg_update_bits) { ++ reg += map->reg_base; ++ reg >>= map->format.reg_downshift; + ret = map->reg_update_bits(map->bus_context, reg, mask, val); + if (ret == 0 && change) + *change = true; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-409-accel-fix-CONFIG_DRM-dependencies.patch b/patches.kernel.org/6.2.3-409-accel-fix-CONFIG_DRM-dependencies.patch new file mode 100644 index 0000000..8f3bf9e --- /dev/null +++ b/patches.kernel.org/6.2.3-409-accel-fix-CONFIG_DRM-dependencies.patch @@ -0,0 +1,67 @@ +From: Arnd Bergmann +Date: Fri, 27 Jan 2023 23:14:55 +0100 +Subject: [PATCH] accel: fix CONFIG_DRM dependencies +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9f20c9f4b1e17e83e9ccc247cfdc0b61041bff3d + +[ Upstream commit 9f20c9f4b1e17e83e9ccc247cfdc0b61041bff3d ] + +At the moment, accel drivers can be built-in even with CONFIG_DRM=m, +but this causes a link failure: + +x86_64-linux-ld: drivers/accel/ivpu/ivpu_drv.o: in function `ivpu_dev_init': +ivpu_drv.c:(.text+0x1535): undefined reference to `drmm_kmalloc' +x86_64-linux-ld: ivpu_drv.c:(.text+0x1562): undefined reference to `drmm_kmalloc' +x86_64-linux-ld: drivers/accel/ivpu/ivpu_drv.o: in function `ivpu_remove': +ivpu_drv.c:(.text+0x1faa): undefined reference to `drm_dev_unregister' +x86_64-linux-ld: drivers/accel/ivpu/ivpu_drv.o: in function `ivpu_probe': +ivpu_drv.c:(.text+0x1fef): undefined reference to `__devm_drm_dev_alloc' + +The problem is that DRM_ACCEL is a 'bool' symbol, so driver that +only depend on DRM_ACCEL but not also on DRM do not see the restriction +to =m configs. + +To ensure that each accel driver has an implied dependency on CONFIG_DRM, +enclose the entire Kconfig file in an if/endif check. + +Fixes: 8bf4889762a8 ("drivers/accel: define kconfig and register a new major") +Signed-off-by: Arnd Bergmann +Reviewed-by: Stanislaw Gruszka +Reviewed-by: Jeffrey Hugo +Reviewed-by: Oded Gabbay +Signed-off-by: Jacek Lawrynowicz +Link: https://patchwork.freedesktop.org/patch/msgid/20230127221504.2522909-1-arnd@kernel.org +(cherry picked from commit 3524c96a121952f214271622bb372661ced86101) +Signed-off-by: Thomas Zimmermann +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/accel/Kconfig | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/accel/Kconfig b/drivers/accel/Kconfig +index c9ce849b..c8177ae4 100644 +--- a/drivers/accel/Kconfig ++++ b/drivers/accel/Kconfig +@@ -6,9 +6,10 @@ + # as, but not limited to, Machine-Learning and Deep-Learning acceleration + # devices + # ++if DRM ++ + menuconfig DRM_ACCEL + bool "Compute Acceleration Framework" +- depends on DRM + help + Framework for device drivers of compute acceleration devices, such + as, but not limited to, Machine-Learning and Deep-Learning +@@ -22,3 +23,5 @@ menuconfig DRM_ACCEL + major number than GPUs, and will be exposed to user-space using + different device files, called accel/accel* (in /dev, sysfs + and debugfs). ++ ++endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-410-ASoC-rsnd-fixup-endif-position.patch b/patches.kernel.org/6.2.3-410-ASoC-rsnd-fixup-endif-position.patch new file mode 100644 index 0000000..06f3d05 --- /dev/null +++ b/patches.kernel.org/6.2.3-410-ASoC-rsnd-fixup-endif-position.patch @@ -0,0 +1,45 @@ +From: Kuninori Morimoto +Date: Wed, 1 Feb 2023 01:59:52 +0000 +Subject: [PATCH] ASoC: rsnd: fixup #endif position +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 49123b51cd896e00b256a27c2ce9e6bfe1bbc22f + +[ Upstream commit 49123b51cd896e00b256a27c2ce9e6bfe1bbc22f ] + +commit 1f9c82b5ab83ff2 ("ASoC: rsnd: add debugfs support") added +CONFIG_DEBUG_FS related definitions on rsnd.h, but it should be +added inside of RSND_H. This patch fixup it. + +Fixes: 1f9c82b5ab83 ("ASoC: rsnd: add debugfs support") +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/877cx26t7r.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/sh/rcar/rsnd.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index d9cd190d..f8ef6836 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -901,8 +901,6 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type); + if (!IS_BUILTIN(RSND_DEBUG_NO_DAI_CALL)) \ + dev_dbg(dev, param) + +-#endif +- + #ifdef CONFIG_DEBUG_FS + int rsnd_debugfs_probe(struct snd_soc_component *component); + void rsnd_debugfs_reg_show(struct seq_file *m, phys_addr_t _addr, +@@ -913,3 +911,5 @@ void rsnd_debugfs_mod_reg_show(struct seq_file *m, struct rsnd_mod *mod, + #else + #define rsnd_debugfs_probe NULL + #endif ++ ++#endif /* RSND_H */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-411-ASoC-mchp-spdifrx-Fix-uninitialized-use-of-mr-i.patch b/patches.kernel.org/6.2.3-411-ASoC-mchp-spdifrx-Fix-uninitialized-use-of-mr-i.patch new file mode 100644 index 0000000..701c1cb --- /dev/null +++ b/patches.kernel.org/6.2.3-411-ASoC-mchp-spdifrx-Fix-uninitialized-use-of-mr-i.patch @@ -0,0 +1,52 @@ +From: Nathan Chancellor +Date: Thu, 2 Feb 2023 09:34:19 -0700 +Subject: [PATCH] ASoC: mchp-spdifrx: Fix uninitialized use of mr in + mchp_spdifrx_hw_params() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 218674a45930c700486d27b765bf2f1b43f8cbf7 + +[ Upstream commit 218674a45930c700486d27b765bf2f1b43f8cbf7 ] + +Clang warns: + + ../sound/soc/atmel/mchp-spdifrx.c:455:3: error: variable 'mr' is uninitialized when used here [-Werror,-Wuninitialized] + mr |= SPDIFRX_MR_ENDIAN_BIG; + ^~ + ../sound/soc/atmel/mchp-spdifrx.c:432:8: note: initialize the variable 'mr' to silence this warning + u32 mr; + ^ + = 0 + 1 error generated. + +Zero initialize mr so that these bitwise OR and assignment operation +works unconditionally. + +Fixes: fa09fa60385a ("ASoC: mchp-spdifrx: fix controls which rely on rsr register") +Link: https://github.com/ClangBuiltLinux/linux/issues/1797 +Signed-off-by: Nathan Chancellor +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230202-mchp-spdifrx-fix-uninit-mr-v1-1-629a045d7a2f@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/atmel/mchp-spdifrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index b81fc777..76ce37f6 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -362,7 +362,7 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); +- u32 mr; ++ u32 mr = 0; + int ret; + + dev_dbg(dev->dev, "%s() rate=%u format=%#x width=%u channels=%u\n", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-412-ASoC-dt-bindings-meson-fix-gx-card-codec-node-r.patch b/patches.kernel.org/6.2.3-412-ASoC-dt-bindings-meson-fix-gx-card-codec-node-r.patch new file mode 100644 index 0000000..bf0f6d5 --- /dev/null +++ b/patches.kernel.org/6.2.3-412-ASoC-dt-bindings-meson-fix-gx-card-codec-node-r.patch @@ -0,0 +1,39 @@ +From: Jerome Brunet +Date: Thu, 2 Feb 2023 19:36:46 +0100 +Subject: [PATCH] ASoC: dt-bindings: meson: fix gx-card codec node regex +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 480b26226873c88e482575ceb0d0a38d76e1be57 + +[ Upstream commit 480b26226873c88e482575ceb0d0a38d76e1be57 ] + +'codec' is a valid node name when there is a single codec +in the link. Fix the node regular expression to apply this. + +Fixes: fd00366b8e41 ("ASoC: meson: gx: add sound card dt-binding documentation") +Signed-off-by: Jerome Brunet +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230202183653.486216-3-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../devicetree/bindings/sound/amlogic,gx-sound-card.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml +index 5b8d5924..b358fd60 100644 +--- a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml ++++ b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml +@@ -62,7 +62,7 @@ patternProperties: + description: phandle of the CPU DAI + + patternProperties: +- "^codec-[0-9]+$": ++ "^codec(-[0-9]+)?$": + type: object + additionalProperties: false + description: |- +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-413-regulator-tps65219-use-generic-set_bypass.patch b/patches.kernel.org/6.2.3-413-regulator-tps65219-use-generic-set_bypass.patch new file mode 100644 index 0000000..4dd686f --- /dev/null +++ b/patches.kernel.org/6.2.3-413-regulator-tps65219-use-generic-set_bypass.patch @@ -0,0 +1,67 @@ +From: Jerome Neanne +Date: Fri, 3 Feb 2023 15:01:19 +0100 +Subject: [PATCH] regulator: tps65219: use generic set_bypass() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0365df81145a4cfaae5f4da896160de512256e6d + +[ Upstream commit 0365df81145a4cfaae5f4da896160de512256e6d ] + +Due to wrong interpretation of the specification, +custom implementation was used instead of standard regmap helper. +LINK: https://lore.kernel.org/all/c2014039-f1e8-6976-33d6-52e2dd4e7b66@baylibre.com/ + +Fixes: c12ac5fc3e0a ("regulator: drivers: Add TI TPS65219 PMIC regulators support") + +Regulator does NOT require to be off to be switched to bypass mode. + +Signed-off-by: Jerome Neanne +Link: https://lore.kernel.org/r/20230203140119.13029-1-jneanne@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/regulator/tps65219-regulator.c | 20 +------------------- + 1 file changed, 1 insertion(+), 19 deletions(-) + +diff --git a/drivers/regulator/tps65219-regulator.c b/drivers/regulator/tps65219-regulator.c +index 070159cb..58f6541b 100644 +--- a/drivers/regulator/tps65219-regulator.c ++++ b/drivers/regulator/tps65219-regulator.c +@@ -173,24 +173,6 @@ static unsigned int tps65219_get_mode(struct regulator_dev *dev) + return REGULATOR_MODE_NORMAL; + } + +-/* +- * generic regulator_set_bypass_regmap does not fully match requirements +- * TPS65219 Requires explicitly that regulator is disabled before switch +- */ +-static int tps65219_set_bypass(struct regulator_dev *dev, bool enable) +-{ +- struct tps65219 *tps = rdev_get_drvdata(dev); +- unsigned int rid = rdev_get_id(dev); +- +- if (dev->desc->ops->is_enabled(dev)) { +- dev_err(tps->dev, +- "%s LDO%d enabled, must be shut down to set bypass ", +- __func__, rid); +- return -EBUSY; +- } +- return regulator_set_bypass_regmap(dev, enable); +-} +- + /* Operations permitted on BUCK1/2/3 */ + static const struct regulator_ops tps65219_bucks_ops = { + .is_enabled = regulator_is_enabled_regmap, +@@ -217,7 +199,7 @@ static const struct regulator_ops tps65219_ldos_1_2_ops = { + .set_voltage_sel = regulator_set_voltage_sel_regmap, + .list_voltage = regulator_list_voltage_linear_range, + .map_voltage = regulator_map_voltage_linear_range, +- .set_bypass = tps65219_set_bypass, ++ .set_bypass = regulator_set_bypass_regmap, + .get_bypass = regulator_get_bypass_regmap, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-414-hwmon-asus-ec-sensors-add-missing-mutex-path.patch b/patches.kernel.org/6.2.3-414-hwmon-asus-ec-sensors-add-missing-mutex-path.patch new file mode 100644 index 0000000..3a44469 --- /dev/null +++ b/patches.kernel.org/6.2.3-414-hwmon-asus-ec-sensors-add-missing-mutex-path.patch @@ -0,0 +1,36 @@ +From: Eugene Shalygin +Date: Sat, 21 Jan 2023 12:17:28 +0100 +Subject: [PATCH] hwmon: (asus-ec-sensors) add missing mutex path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e2de0e6abd91b05411cb1f0953115dbbbe9b11ce + +[ Upstream commit e2de0e6abd91b05411cb1f0953115dbbbe9b11ce ] + +Add missing mutex path for ProArt X570-CREATOR WIFI. + +Fixes: de8fbac5e59e (hwmon: (asus-ec-sensors) implement locking via the ACPI global lock) +Signed-off-by: Eugene Shalygin +Link: https://lore.kernel.org/r/20230121111728.168514-2-eugene.shalygin@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/asus-ec-sensors.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c +index a901e4e3..b4d65916 100644 +--- a/drivers/hwmon/asus-ec-sensors.c ++++ b/drivers/hwmon/asus-ec-sensors.c +@@ -299,6 +299,7 @@ static const struct ec_board_info board_info_pro_art_x570_creator_wifi = { + .sensors = SENSOR_SET_TEMP_CHIPSET_CPU_MB | SENSOR_TEMP_VRM | + SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT | + SENSOR_CURR_CPU | SENSOR_IN_CPU_CORE, ++ .mutex_path = ASUS_HW_ACCESS_MUTEX_ASMX, + .family = family_amd_500_series, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-415-hwmon-ltc2945-Handle-error-case-in-ltc2945_valu.patch b/patches.kernel.org/6.2.3-415-hwmon-ltc2945-Handle-error-case-in-ltc2945_valu.patch new file mode 100644 index 0000000..709fc3b --- /dev/null +++ b/patches.kernel.org/6.2.3-415-hwmon-ltc2945-Handle-error-case-in-ltc2945_valu.patch @@ -0,0 +1,39 @@ +From: Jonathan Cormier +Date: Thu, 26 Jan 2023 17:32:25 -0500 +Subject: [PATCH] hwmon: (ltc2945) Handle error case in ltc2945_value_store +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 178b01eccfb0b8149682f61388400bd3d903dddc + +[ Upstream commit 178b01eccfb0b8149682f61388400bd3d903dddc ] + +ltc2945_val_to_reg errors were not being handled +which would have resulted in register being set to +0 (clamped) instead of being left alone. + +Fixes: 6700ce035f83 ("hwmon: Driver for Linear Technologies LTC2945") + +Signed-off-by: Jonathan Cormier +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/ltc2945.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hwmon/ltc2945.c b/drivers/hwmon/ltc2945.c +index 9adebb59..c06ab731 100644 +--- a/drivers/hwmon/ltc2945.c ++++ b/drivers/hwmon/ltc2945.c +@@ -248,6 +248,8 @@ static ssize_t ltc2945_value_store(struct device *dev, + + /* convert to register value, then clamp and write result */ + regval = ltc2945_val_to_reg(dev, reg, val); ++ if (regval < 0) ++ return regval; + if (is_power_reg(reg)) { + regval = clamp_val(regval, 0, 0xffffff); + regbuf[0] = regval >> 16; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-416-ALSA-hda-Fix-the-control-element-identification.patch b/patches.kernel.org/6.2.3-416-ALSA-hda-Fix-the-control-element-identification.patch new file mode 100644 index 0000000..8e008c7 --- /dev/null +++ b/patches.kernel.org/6.2.3-416-ALSA-hda-Fix-the-control-element-identification.patch @@ -0,0 +1,171 @@ +From: Jaroslav Kysela +Date: Thu, 2 Feb 2023 10:20:13 +0100 +Subject: [PATCH] ALSA: hda: Fix the control element identification for + multiple codecs +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d045bceff5a904bd79d71dede9f927c00ce4906f + +[ Upstream commit d045bceff5a904bd79d71dede9f927c00ce4906f ] + +Some motherboards have multiple HDA codecs connected to the serial bus. +The current code may create multiple mixer controls with the almost +identical identification. + +The current code use id.device field from the control element structure +to store the codec address to avoid such clashes for multiple codecs. +Unfortunately, the user space do not handle this correctly. For mixer +controls, only name and index are used for the identifiers. + +This patch fixes this problem to compose the index using the codec +address as an offset in case, when the control already exists. It is +really unlikely that one codec will create 10 similar controls. + +This patch adds new kernel module parameter 'ctl_dev_id' to allow +select the old behaviour, too. The CONFIG_SND_HDA_CTL_DEV_ID Kconfig +option sets the default value. + +BugLink: https://github.com/alsa-project/alsa-lib/issues/294 +BugLink: https://github.com/alsa-project/alsa-lib/issues/205 +Fixes: 54d174031576 ("[ALSA] hda-codec - Fix connection list parsing") +Fixes: 1afe206ab699 ("ALSA: hda - Try to find an empty control index when it's occupied") +Signed-off-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20230202092013.4066998-1-perex@perex.cz +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/sound/hda_codec.h | 1 + + sound/pci/hda/Kconfig | 14 ++++++++++++++ + sound/pci/hda/hda_codec.c | 13 ++++++++++--- + sound/pci/hda/hda_controller.c | 1 + + sound/pci/hda/hda_controller.h | 1 + + sound/pci/hda/hda_intel.c | 5 +++++ + 6 files changed, 32 insertions(+), 3 deletions(-) + +diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h +index eba23daf..bbb7805e 100644 +--- a/include/sound/hda_codec.h ++++ b/include/sound/hda_codec.h +@@ -259,6 +259,7 @@ struct hda_codec { + unsigned int relaxed_resume:1; /* don't resume forcibly for jack */ + unsigned int forced_resume:1; /* forced resume for jack */ + unsigned int no_stream_clean_at_suspend:1; /* do not clean streams at suspend */ ++ unsigned int ctl_dev_id:1; /* old control element id build behaviour */ + + #ifdef CONFIG_PM + unsigned long power_on_acct; +diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig +index 06d304db..886255a0 100644 +--- a/sound/pci/hda/Kconfig ++++ b/sound/pci/hda/Kconfig +@@ -302,6 +302,20 @@ config SND_HDA_INTEL_HDMI_SILENT_STREAM + This feature can impact power consumption as resources + are kept reserved both at transmitter and receiver. + ++config SND_HDA_CTL_DEV_ID ++ bool "Use the device identifier field for controls" ++ depends on SND_HDA_INTEL ++ help ++ Say Y to use the device identifier field for (mixer) ++ controls (old behaviour until this option is available). ++ ++ When enabled, the multiple HDA codecs may set the device ++ field in control (mixer) element identifiers. The use ++ of this field is not recommended and defined for mixer controls. ++ ++ The old behaviour (Y) is obsolete and will be removed. Consider ++ to not enable this option. ++ + endif + + endmenu +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 2e728aad..9f79c0ac 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -3389,7 +3389,12 @@ int snd_hda_add_new_ctls(struct hda_codec *codec, + kctl = snd_ctl_new1(knew, codec); + if (!kctl) + return -ENOMEM; +- if (addr > 0) ++ /* Do not use the id.device field for MIXER elements. ++ * This field is for real device numbers (like PCM) but codecs ++ * are hidden components from the user space view (unrelated ++ * to the mixer element identification). ++ */ ++ if (addr > 0 && codec->ctl_dev_id) + kctl->id.device = addr; + if (idx > 0) + kctl->id.index = idx; +@@ -3400,9 +3405,11 @@ int snd_hda_add_new_ctls(struct hda_codec *codec, + * the codec addr; if it still fails (or it's the + * primary codec), then try another control index + */ +- if (!addr && codec->core.addr) ++ if (!addr && codec->core.addr) { + addr = codec->core.addr; +- else if (!idx && !knew->index) { ++ if (!codec->ctl_dev_id) ++ idx += 10 * addr; ++ } else if (!idx && !knew->index) { + idx = find_empty_mixer_ctl_idx(codec, + knew->name, 0); + if (idx <= 0) +diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c +index 0ff286b7..083df287 100644 +--- a/sound/pci/hda/hda_controller.c ++++ b/sound/pci/hda/hda_controller.c +@@ -1231,6 +1231,7 @@ int azx_probe_codecs(struct azx *chip, unsigned int max_slots) + continue; + codec->jackpoll_interval = chip->jackpoll_interval; + codec->beep_mode = chip->beep_mode; ++ codec->ctl_dev_id = chip->ctl_dev_id; + codecs++; + } + } +diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h +index f5bf295e..8556031b 100644 +--- a/sound/pci/hda/hda_controller.h ++++ b/sound/pci/hda/hda_controller.h +@@ -124,6 +124,7 @@ struct azx { + /* HD codec */ + int codec_probe_mask; /* copied from probe_mask option */ + unsigned int beep_mode; ++ bool ctl_dev_id; + + #ifdef CONFIG_SND_HDA_PATCH_LOADER + const struct firmware *fw; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 87002670..2dbc0820 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -119,6 +119,7 @@ static bool beep_mode[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS-1)] = + CONFIG_SND_HDA_INPUT_BEEP_MODE}; + #endif + static bool dmic_detect = 1; ++static bool ctl_dev_id = IS_ENABLED(CONFIG_SND_HDA_CTL_DEV_ID) ? 1 : 0; + + module_param_array(index, int, NULL, 0444); + MODULE_PARM_DESC(index, "Index value for Intel HD audio interface."); +@@ -157,6 +158,8 @@ module_param(dmic_detect, bool, 0444); + MODULE_PARM_DESC(dmic_detect, "Allow DSP driver selection (bypass this driver) " + "(0=off, 1=on) (default=1); " + "deprecated, use snd-intel-dspcfg.dsp_driver option instead"); ++module_param(ctl_dev_id, bool, 0444); ++MODULE_PARM_DESC(ctl_dev_id, "Use control device identifier (based on codec address)."); + + #ifdef CONFIG_PM + static int param_set_xint(const char *val, const struct kernel_param *kp); +@@ -2278,6 +2281,8 @@ static int azx_probe_continue(struct azx *chip) + chip->beep_mode = beep_mode[dev]; + #endif + ++ chip->ctl_dev_id = ctl_dev_id; ++ + /* create codec instances */ + if (bus->codec_mask) { + err = azx_probe_codecs(chip, azx_max_codecs[chip->driver_type]); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-417-drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch b/patches.kernel.org/6.2.3-417-drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch new file mode 100644 index 0000000..4771824 --- /dev/null +++ b/patches.kernel.org/6.2.3-417-drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch @@ -0,0 +1,145 @@ +From: Arnd Bergmann +Date: Mon, 6 Feb 2023 20:36:02 +0100 +Subject: [PATCH] drm/amdgpu: fix enum odm_combine_mode mismatch +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 087bad7eb1f6945f8232f132953ecc2bda8bd38d + +[ Upstream commit 087bad7eb1f6945f8232f132953ecc2bda8bd38d ] + +A conversion from 'bool' to 'enum odm_combine_mode' was incomplete, +and gcc warns about this with many instances of + +display/dc/dml/dcn20/display_mode_vba_20.c:3899:44: warning: implicit conversion from 'enum ' to 'enum +odm_combine_mode' [-Wenum-conversion] + 3899 | locals->ODMCombineEnablePerState[i][k] = false; + +Change the ones that we get a warning for, using the same numerical +values to leave the behavior unchanged. + +Fixes: 5fc11598166d ("drm/amd/display: expand dml structs") +Link: https://lore.kernel.org/all/20201026210039.3884312-3-arnd@kernel.org/ +Link: https://lore.kernel.org/all/20210927100659.1431744-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 8 ++++---- + .../amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 10 +++++----- + .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 12 ++++++------ + 3 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +index d3b5b6fe..6266b078 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +@@ -3897,14 +3897,14 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 + * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0); + +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; + if (mode_lib->vba.ODMCapability) { + if (locals->PlaneRequiredDISPCLKWithoutODMCombine > mode_lib->vba.MaxDispclkRoundedDownToDFSGranularity) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } + } +@@ -3957,7 +3957,7 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + locals->RequiredDISPCLK[i][j] = 0.0; + locals->DISPCLK_DPPCLK_Support[i][j] = true; + for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { + locals->NoOfDPP[i][j][k] = 1; + locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +index edd098c7..989d83ee 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +@@ -4008,17 +4008,17 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode + mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 + * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0); + +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; + if (mode_lib->vba.ODMCapability) { + if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN20_MAX_DSC_IMAGE_WIDTH)) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } + } +@@ -4071,7 +4071,7 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode + locals->RequiredDISPCLK[i][j] = 0.0; + locals->DISPCLK_DPPCLK_Support[i][j] = true; + for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { + locals->NoOfDPP[i][j][k] = 1; + locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +index 1d84ae50..b7c2844d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +@@ -4102,17 +4102,17 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 + * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0); + +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; + if (mode_lib->vba.ODMCapability) { + if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN21_MAX_DSC_IMAGE_WIDTH)) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->HActive[k] > DCN21_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } + } +@@ -4165,7 +4165,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + locals->RequiredDISPCLK[i][j] = 0.0; + locals->DISPCLK_DPPCLK_Support[i][j] = true; + for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { + locals->NoOfDPP[i][j][k] = 1; + locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] +@@ -5230,7 +5230,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.ODMCombineEnabled[k] = + locals->ODMCombineEnablePerState[mode_lib->vba.VoltageLevel][k]; + } else { +- mode_lib->vba.ODMCombineEnabled[k] = false; ++ mode_lib->vba.ODMCombineEnabled[k] = dm_odm_combine_mode_disabled; + } + mode_lib->vba.DSCEnabled[k] = + locals->RequiresDSC[mode_lib->vba.VoltageLevel][k]; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-418-scsi-mpt3sas-Fix-a-memory-leak.patch b/patches.kernel.org/6.2.3-418-scsi-mpt3sas-Fix-a-memory-leak.patch new file mode 100644 index 0000000..9defa18 --- /dev/null +++ b/patches.kernel.org/6.2.3-418-scsi-mpt3sas-Fix-a-memory-leak.patch @@ -0,0 +1,38 @@ +From: Tomas Henzl +Date: Tue, 7 Feb 2023 16:21:59 +0100 +Subject: [PATCH] scsi: mpt3sas: Fix a memory leak +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 54dd96015e8d7a2a07359e2dfebf05b529d1780c + +[ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] + +Add a forgotten kfree(). + +Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") +Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 69061545..2ee9ea57 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -5849,6 +5849,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) + } + dma_pool_destroy(ioc->pcie_sgl_dma_pool); + } ++ kfree(ioc->pcie_sg_lookup); ++ ioc->pcie_sg_lookup = NULL; ++ + if (ioc->config_page) { + dexitprintk(ioc, + ioc_info(ioc, "config_page(0x%p): free\n", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-419-scsi-aic94xx-Add-missing-check-for-dma_map_sing.patch b/patches.kernel.org/6.2.3-419-scsi-aic94xx-Add-missing-check-for-dma_map_sing.patch new file mode 100644 index 0000000..42fa50e --- /dev/null +++ b/patches.kernel.org/6.2.3-419-scsi-aic94xx-Add-missing-check-for-dma_map_sing.patch @@ -0,0 +1,40 @@ +From: Jiasheng Jiang +Date: Sat, 28 Jan 2023 19:08:32 +0800 +Subject: [PATCH] scsi: aic94xx: Add missing check for dma_map_single() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 32fe45274edb5926abc0fac7263d9f889d02d9cf + +[ Upstream commit 32fe45274edb5926abc0fac7263d9f889d02d9cf ] + +Add check for dma_map_single() and return error if it fails in order to +avoid invalid DMA address. + +Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") +Link: https://lore.kernel.org/r/20230128110832.6792-1-jiasheng@iscas.ac.cn +Signed-off-by: Jiasheng Jiang +Reviewed-by: Jason Yan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/aic94xx/aic94xx_task.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c +index ed119a3f..7f020830 100644 +--- a/drivers/scsi/aic94xx/aic94xx_task.c ++++ b/drivers/scsi/aic94xx/aic94xx_task.c +@@ -50,6 +50,9 @@ static int asd_map_scatterlist(struct sas_task *task, + dma_addr_t dma = dma_map_single(&asd_ha->pcidev->dev, p, + task->total_xfer_len, + task->data_dir); ++ if (dma_mapping_error(&asd_ha->pcidev->dev, dma)) ++ return -ENOMEM; ++ + sg_arr[0].bus_addr = cpu_to_le64((u64)dma); + sg_arr[0].size = cpu_to_le32(task->total_xfer_len); + sg_arr[0].flags |= ASD_SG_EL_LIST_EOL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-420-HID-multitouch-Add-quirks-for-flipped-axes.patch b/patches.kernel.org/6.2.3-420-HID-multitouch-Add-quirks-for-flipped-axes.patch new file mode 100644 index 0000000..fef5d75 --- /dev/null +++ b/patches.kernel.org/6.2.3-420-HID-multitouch-Add-quirks-for-flipped-axes.patch @@ -0,0 +1,229 @@ +From: Allen Ballway +Date: Tue, 10 Jan 2023 20:25:50 +0000 +Subject: [PATCH] HID: multitouch: Add quirks for flipped axes +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a2f416bf062a38bb76cccd526d2d286b8e4db4d9 + +[ Upstream commit a2f416bf062a38bb76cccd526d2d286b8e4db4d9 ] + +Certain touchscreen devices, such as the ELAN9034, are oriented +incorrectly and report touches on opposite points on the X and Y axes. +For example, a 100x200 screen touched at (10,20) would report (90, 180) +and vice versa. + +This is fixed by adding device quirks to transform the touch points +into the correct spaces, from X -> MAX(X) - X, and Y -> MAX(Y) - Y. + +Signed-off-by: Allen Ballway +Signed-off-by: Jiri Kosina +Stable-dep-of: 03a86105556e ("HID: retain initial quirks set up when creating HID devices") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-multitouch.c | 39 ++++++++++++++++++--- + drivers/hid/hid-quirks.c | 6 ++++ + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 43 ++++++++++++++++++++++++ + drivers/hid/i2c-hid/i2c-hid.h | 3 ++ + 4 files changed, 87 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 372cbdd2..e31be0cb 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -71,6 +71,7 @@ MODULE_LICENSE("GPL"); + #define MT_QUIRK_SEPARATE_APP_REPORT BIT(19) + #define MT_QUIRK_FORCE_MULTI_INPUT BIT(20) + #define MT_QUIRK_DISABLE_WAKEUP BIT(21) ++#define MT_QUIRK_ORIENTATION_INVERT BIT(22) + + #define MT_INPUTMODE_TOUCHSCREEN 0x02 + #define MT_INPUTMODE_TOUCHPAD 0x03 +@@ -1009,6 +1010,7 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, + struct mt_usages *slot) + { + struct input_mt *mt = input->mt; ++ struct hid_device *hdev = td->hdev; + __s32 quirks = app->quirks; + bool valid = true; + bool confidence_state = true; +@@ -1086,6 +1088,10 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, + int orientation = wide; + int max_azimuth; + int azimuth; ++ int x; ++ int y; ++ int cx; ++ int cy; + + if (slot->a != DEFAULT_ZERO) { + /* +@@ -1104,6 +1110,9 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, + if (azimuth > max_azimuth * 2) + azimuth -= max_azimuth * 4; + orientation = -azimuth; ++ if (quirks & MT_QUIRK_ORIENTATION_INVERT) ++ orientation = -orientation; ++ + } + + if (quirks & MT_QUIRK_TOUCH_SIZE_SCALING) { +@@ -1115,10 +1124,23 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, + minor = minor >> 1; + } + +- input_event(input, EV_ABS, ABS_MT_POSITION_X, *slot->x); +- input_event(input, EV_ABS, ABS_MT_POSITION_Y, *slot->y); +- input_event(input, EV_ABS, ABS_MT_TOOL_X, *slot->cx); +- input_event(input, EV_ABS, ABS_MT_TOOL_Y, *slot->cy); ++ x = hdev->quirks & HID_QUIRK_X_INVERT ? ++ input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->x : ++ *slot->x; ++ y = hdev->quirks & HID_QUIRK_Y_INVERT ? ++ input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->y : ++ *slot->y; ++ cx = hdev->quirks & HID_QUIRK_X_INVERT ? ++ input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->cx : ++ *slot->cx; ++ cy = hdev->quirks & HID_QUIRK_Y_INVERT ? ++ input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->cy : ++ *slot->cy; ++ ++ input_event(input, EV_ABS, ABS_MT_POSITION_X, x); ++ input_event(input, EV_ABS, ABS_MT_POSITION_Y, y); ++ input_event(input, EV_ABS, ABS_MT_TOOL_X, cx); ++ input_event(input, EV_ABS, ABS_MT_TOOL_Y, cy); + input_event(input, EV_ABS, ABS_MT_DISTANCE, !*slot->tip_state); + input_event(input, EV_ABS, ABS_MT_ORIENTATION, orientation); + input_event(input, EV_ABS, ABS_MT_PRESSURE, *slot->p); +@@ -1735,6 +1757,15 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) + if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID) + td->serial_maybe = true; + ++ ++ /* Orientation is inverted if the X or Y axes are ++ * flipped, but normalized if both are inverted. ++ */ ++ if (hdev->quirks & (HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT) && ++ !((hdev->quirks & HID_QUIRK_X_INVERT) ++ && (hdev->quirks & HID_QUIRK_Y_INVERT))) ++ td->mtclass.quirks = MT_QUIRK_ORIENTATION_INVERT; ++ + /* This allows the driver to correctly support devices + * that emit events over several HID messages. + */ +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 5bc91f68..30e35f79 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -19,6 +19,7 @@ + #include + + #include "hid-ids.h" ++#include "i2c-hid/i2c-hid.h" + + /* + * Alphabetically sorted by vendor then product. +@@ -1298,6 +1299,11 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev) + quirks = hid_gets_squirk(hdev); + mutex_unlock(&dquirks_lock); + ++ /* Get quirks specific to I2C devices */ ++ if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) && ++ hdev->bus == BUS_I2C) ++ quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product); ++ + return quirks; + } + EXPORT_SYMBOL_GPL(hid_lookup_quirk); +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 8e0f6745..554a7dc2 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -10,8 +10,10 @@ + #include + #include + #include ++#include + + #include "i2c-hid.h" ++#include "../hid-ids.h" + + + struct i2c_hid_desc_override { +@@ -416,6 +418,28 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + { } /* Terminate list */ + }; + ++static const struct hid_device_id i2c_hid_elan_flipped_quirks = { ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, USB_VENDOR_ID_ELAN, 0x2dcd), ++ HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT ++}; ++ ++/* ++ * This list contains devices which have specific issues based on the system ++ * they're on and not just the device itself. The driver_data will have a ++ * specific hid device to match against. ++ */ ++static const struct dmi_system_id i2c_hid_dmi_quirk_table[] = { ++ { ++ .ident = "DynaBook K50/FR", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dynabook Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "dynabook K50/FR"), ++ }, ++ .driver_data = (void *)&i2c_hid_elan_flipped_quirks, ++ }, ++ { } /* Terminate list */ ++}; ++ + + struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name) + { +@@ -450,3 +474,22 @@ char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name, + *size = override->hid_report_desc_size; + return override->hid_report_desc; + } ++ ++u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product) ++{ ++ u32 quirks = 0; ++ const struct dmi_system_id *system_id = ++ dmi_first_match(i2c_hid_dmi_quirk_table); ++ ++ if (system_id) { ++ const struct hid_device_id *device_id = ++ (struct hid_device_id *)(system_id->driver_data); ++ ++ if (device_id && device_id->vendor == vendor && ++ device_id->product == product) ++ quirks = device_id->driver_data; ++ } ++ ++ return quirks; ++} ++EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks); +diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h +index 96c75510..2c7b66d5 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.h ++++ b/drivers/hid/i2c-hid/i2c-hid.h +@@ -9,6 +9,7 @@ + struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name); + char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name, + unsigned int *size); ++u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product); + #else + static inline struct i2c_hid_desc + *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name) +@@ -16,6 +17,8 @@ static inline struct i2c_hid_desc + static inline char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name, + unsigned int *size) + { return NULL; } ++static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product) ++{ return 0; } + #endif + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-421-HID-retain-initial-quirks-set-up-when-creating-.patch b/patches.kernel.org/6.2.3-421-HID-retain-initial-quirks-set-up-when-creating-.patch new file mode 100644 index 0000000..7df5a37 --- /dev/null +++ b/patches.kernel.org/6.2.3-421-HID-retain-initial-quirks-set-up-when-creating-.patch @@ -0,0 +1,120 @@ +From: Dmitry Torokhov +Date: Tue, 7 Feb 2023 15:03:30 -0800 +Subject: [PATCH] HID: retain initial quirks set up when creating HID devices +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 03a86105556e23650e4470c09f91cf7c360d5e28 + +[ Upstream commit 03a86105556e23650e4470c09f91cf7c360d5e28 ] + +In certain circumstances, such as when creating I2C-connected HID +devices, we want to pass and retain some quirks (axis inversion, etc). +The source of such quirks may be device tree, or DMI data, or something +else not readily available to the HID core itself and therefore cannot +be reconstructed easily. To allow this, introduce "initial_quirks" field +in hid_device structure and use it when determining the final set of +quirks. + +This fixes the problem with i2c-hid setting up device-tree sourced +quirks too late and losing them on device rebind, and also allows to +sever the tie between hid-code and i2c-hid when applying DMI-based +quirks. + +Fixes: b60d3c803d76 ("HID: i2c-hid-of: Expose the touchscreen-inverted properties") +Fixes: a2f416bf062a ("HID: multitouch: Add quirks for flipped axes") +Reviewed-by: Guenter Roeck +Tested-by: Allen Ballway +Signed-off-by: Dmitry Torokhov +Reviewed-by: Alistair Francis +Link: https://lore.kernel.org/r/Y+LYwu3Zs13hdVDy@google.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-quirks.c | 8 +------- + drivers/hid/i2c-hid/i2c-hid-core.c | 6 ++++-- + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 1 - + include/linux/hid.h | 1 + + 4 files changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 30e35f79..66e64350 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -19,7 +19,6 @@ + #include + + #include "hid-ids.h" +-#include "i2c-hid/i2c-hid.h" + + /* + * Alphabetically sorted by vendor then product. +@@ -1238,7 +1237,7 @@ EXPORT_SYMBOL_GPL(hid_quirks_exit); + static unsigned long hid_gets_squirk(const struct hid_device *hdev) + { + const struct hid_device_id *bl_entry; +- unsigned long quirks = 0; ++ unsigned long quirks = hdev->initial_quirks; + + if (hid_match_id(hdev, hid_ignore_list)) + quirks |= HID_QUIRK_IGNORE; +@@ -1299,11 +1298,6 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev) + quirks = hid_gets_squirk(hdev); + mutex_unlock(&dquirks_lock); + +- /* Get quirks specific to I2C devices */ +- if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) && +- hdev->bus == BUS_I2C) +- quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product); +- + return quirks; + } + EXPORT_SYMBOL_GPL(hid_lookup_quirk); +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index b86b62f9..72f2c379 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -1035,6 +1035,10 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, + hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID); + hid->product = le16_to_cpu(ihid->hdesc.wProductID); + ++ hid->initial_quirks = quirks; ++ hid->initial_quirks |= i2c_hid_get_dmi_quirks(hid->vendor, ++ hid->product); ++ + snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", + client->name, (u16)hid->vendor, (u16)hid->product); + strscpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys)); +@@ -1048,8 +1052,6 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, + goto err_mem_free; + } + +- hid->quirks |= quirks; +- + return 0; + + err_mem_free: +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 554a7dc2..210f17c3 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -492,4 +492,3 @@ u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product) + + return quirks; + } +-EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks); +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 8677ae38..48563dc0 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -619,6 +619,7 @@ struct hid_device { /* device report descriptor */ + unsigned long status; /* see STAT flags above */ + unsigned claimed; /* Claimed by hidinput, hiddev? */ + unsigned quirks; /* Various quirks the device can pull on us */ ++ unsigned initial_quirks; /* Initial set of quirks supplied when creating device */ + bool io_started; /* If IO has started */ + + struct list_head inputs; /* The list of inputs */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-422-ASoC-qcom-q6apm-lpass-dai-unprepare-stream-if-i.patch b/patches.kernel.org/6.2.3-422-ASoC-qcom-q6apm-lpass-dai-unprepare-stream-if-i.patch new file mode 100644 index 0000000..a56d972 --- /dev/null +++ b/patches.kernel.org/6.2.3-422-ASoC-qcom-q6apm-lpass-dai-unprepare-stream-if-i.patch @@ -0,0 +1,45 @@ +From: Srinivas Kandagatla +Date: Thu, 9 Feb 2023 12:27:59 +0000 +Subject: [PATCH] ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already + prepared +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c2ac3aec474da0455df79c4a182f19687bc98d1d + +[ Upstream commit c2ac3aec474da0455df79c4a182f19687bc98d1d ] + +prepare callback can be called multiple times, so unprepare the stream +if its already prepared. + +Without this DSP is not happy to setting the params on a already +prepared graph. + +Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230209122806.18923-2-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +index ce9e5646..23d23bc6 100644 +--- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c ++++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +@@ -127,6 +127,11 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s + int graph_id = dai->id; + int rc; + ++ if (dai_data->is_port_started[dai->id]) { ++ q6apm_graph_stop(dai_data->graph[dai->id]); ++ dai_data->is_port_started[dai->id] = false; ++ } ++ + /** + * It is recommend to load DSP with source graph first and then sink + * graph, so sequence for playback and capture will be different +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-423-ASoC-qcom-q6apm-dai-fix-race-condition-while-up.patch b/patches.kernel.org/6.2.3-423-ASoC-qcom-q6apm-dai-fix-race-condition-while-up.patch new file mode 100644 index 0000000..3903ec4 --- /dev/null +++ b/patches.kernel.org/6.2.3-423-ASoC-qcom-q6apm-dai-fix-race-condition-while-up.patch @@ -0,0 +1,101 @@ +From: Srinivas Kandagatla +Date: Thu, 9 Feb 2023 12:28:00 +0000 +Subject: [PATCH] ASoC: qcom: q6apm-dai: fix race condition while updating the + position pointer +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 84222ef54bfd8f043c23c8603fd5257a64b00780 + +[ Upstream commit 84222ef54bfd8f043c23c8603fd5257a64b00780 ] + +It is noticed that the position pointer value seems to get a get corrupted +due to missing locking between updating and reading. + +Fix this by adding a spinlock around the position pointer. + +Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230209122806.18923-3-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/qcom/qdsp6/q6apm-dai.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c +index ee59ef36..bd35067a 100644 +--- a/sound/soc/qcom/qdsp6/q6apm-dai.c ++++ b/sound/soc/qcom/qdsp6/q6apm-dai.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -53,6 +54,7 @@ struct q6apm_dai_rtd { + uint16_t session_id; + enum stream_state state; + struct q6apm_graph *graph; ++ spinlock_t lock; + }; + + struct q6apm_dai_data { +@@ -99,20 +101,25 @@ static void event_handler(uint32_t opcode, uint32_t token, uint32_t *payload, vo + { + struct q6apm_dai_rtd *prtd = priv; + struct snd_pcm_substream *substream = prtd->substream; ++ unsigned long flags; + + switch (opcode) { + case APM_CLIENT_EVENT_CMD_EOS_DONE: + prtd->state = Q6APM_STREAM_STOPPED; + break; + case APM_CLIENT_EVENT_DATA_WRITE_DONE: ++ spin_lock_irqsave(&prtd->lock, flags); + prtd->pos += prtd->pcm_count; ++ spin_unlock_irqrestore(&prtd->lock, flags); + snd_pcm_period_elapsed(substream); + if (prtd->state == Q6APM_STREAM_RUNNING) + q6apm_write_async(prtd->graph, prtd->pcm_count, 0, 0, 0); + + break; + case APM_CLIENT_EVENT_DATA_READ_DONE: ++ spin_lock_irqsave(&prtd->lock, flags); + prtd->pos += prtd->pcm_count; ++ spin_unlock_irqrestore(&prtd->lock, flags); + snd_pcm_period_elapsed(substream); + if (prtd->state == Q6APM_STREAM_RUNNING) + q6apm_read(prtd->graph); +@@ -253,6 +260,7 @@ static int q6apm_dai_open(struct snd_soc_component *component, + if (prtd == NULL) + return -ENOMEM; + ++ spin_lock_init(&prtd->lock); + prtd->substream = substream; + prtd->graph = q6apm_graph_open(dev, (q6apm_cb)event_handler, prtd, graph_id); + if (IS_ERR(prtd->graph)) { +@@ -332,11 +340,17 @@ static snd_pcm_uframes_t q6apm_dai_pointer(struct snd_soc_component *component, + { + struct snd_pcm_runtime *runtime = substream->runtime; + struct q6apm_dai_rtd *prtd = runtime->private_data; ++ snd_pcm_uframes_t ptr; ++ unsigned long flags; + ++ spin_lock_irqsave(&prtd->lock, flags); + if (prtd->pos == prtd->pcm_size) + prtd->pos = 0; + +- return bytes_to_frames(runtime, prtd->pos); ++ ptr = bytes_to_frames(runtime, prtd->pos); ++ spin_unlock_irqrestore(&prtd->lock, flags); ++ ++ return ptr; + } + + static int q6apm_dai_hw_params(struct snd_soc_component *component, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-424-ASoC-qcom-q6apm-dai-Add-SNDRV_PCM_INFO_BATCH-fl.patch b/patches.kernel.org/6.2.3-424-ASoC-qcom-q6apm-dai-Add-SNDRV_PCM_INFO_BATCH-fl.patch new file mode 100644 index 0000000..f75a91f --- /dev/null +++ b/patches.kernel.org/6.2.3-424-ASoC-qcom-q6apm-dai-Add-SNDRV_PCM_INFO_BATCH-fl.patch @@ -0,0 +1,72 @@ +From: Srinivas Kandagatla +Date: Thu, 9 Feb 2023 12:28:01 +0000 +Subject: [PATCH] ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aa759f3f9f4394a3af65ad1772fca6cb9dd9e4cc + +[ Upstream commit aa759f3f9f4394a3af65ad1772fca6cb9dd9e4cc ] + +At the moment, playing audio with PulseAudio with the qdsp6 driver +results in distorted sound. It seems like its timer-based scheduling +does not work properly with qdsp6 since setting tsched=0 in +the PulseAudio configuration avoids the issue. + +Apparently this happens when the pointer() callback is not accurate +enough. There is a SNDRV_PCM_INFO_BATCH flag that can be used to stop +PulseAudio from using timer-based scheduling by default. + +According to https://www.alsa-project.org/pipermail/alsa-devel/2014-March/073816.html: + +The flag is being used in the sense explained in the previous audio +meeting -- the data transfer granularity isn't fine enough but aligned +to the period size (or less). + +q6apm-dai reports the position as multiple of + +prtd->pcm_count = snd_pcm_lib_period_bytes(substream) + +so it indeed just a multiple of the period size. + +Therefore adding the flag here seems appropriate and makes audio +work out of the box. + +Comment log inspired by Stephan Gerhold sent for q6asm-dai.c few years back. + +Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230209122806.18923-4-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/qcom/qdsp6/q6apm-dai.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c +index bd35067a..7f02f5b2 100644 +--- a/sound/soc/qcom/qdsp6/q6apm-dai.c ++++ b/sound/soc/qcom/qdsp6/q6apm-dai.c +@@ -64,7 +64,8 @@ struct q6apm_dai_data { + static struct snd_pcm_hardware q6apm_dai_hardware_capture = { + .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_BLOCK_TRANSFER | + SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_INTERLEAVED | +- SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME), ++ SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME | ++ SNDRV_PCM_INFO_BATCH), + .formats = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE), + .rates = SNDRV_PCM_RATE_8000_48000, + .rate_min = 8000, +@@ -82,7 +83,8 @@ static struct snd_pcm_hardware q6apm_dai_hardware_capture = { + static struct snd_pcm_hardware q6apm_dai_hardware_playback = { + .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_BLOCK_TRANSFER | + SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_INTERLEAVED | +- SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME), ++ SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME | ++ SNDRV_PCM_INFO_BATCH), + .formats = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE), + .rates = SNDRV_PCM_RATE_8000_192000, + .rate_min = 8000, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-425-ASoC-codecs-lpass-register-mclk-after-runtime-p.patch b/patches.kernel.org/6.2.3-425-ASoC-codecs-lpass-register-mclk-after-runtime-p.patch new file mode 100644 index 0000000..7f0dbff --- /dev/null +++ b/patches.kernel.org/6.2.3-425-ASoC-codecs-lpass-register-mclk-after-runtime-p.patch @@ -0,0 +1,148 @@ +From: Srinivas Kandagatla +Date: Thu, 9 Feb 2023 12:28:03 +0000 +Subject: [PATCH] ASoC: codecs: lpass: register mclk after runtime pm +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1dc3459009c33e335f0d62b84dd39a6bbd7fd5d2 + +[ Upstream commit 1dc3459009c33e335f0d62b84dd39a6bbd7fd5d2 ] + +move mclk out registration after runtime pm is enabled so that the +clk framework can resume the codec if it requires to enable the mclk out. + +Fixes: c96baa2949b2 ("ASoC: codecs: wsa-macro: add runtime pm support") +Fixes: 72ad25eabda0 ("ASoC: codecs: va-macro: add runtime pm support") +Fixes: 366ff79ed539 ("ASoC: codecs: rx-macro: add runtime pm support") +Fixes: 1fb83bc5cf64 ("ASoC: codecs: tx-macro: add runtime pm support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230209122806.18923-6-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/codecs/lpass-rx-macro.c | 8 ++++---- + sound/soc/codecs/lpass-tx-macro.c | 8 ++++---- + sound/soc/codecs/lpass-va-macro.c | 20 ++++++++++---------- + sound/soc/codecs/lpass-wsa-macro.c | 9 ++++----- + 4 files changed, 22 insertions(+), 23 deletions(-) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index a9ef9d5f..dd6970d5 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -3601,10 +3601,6 @@ static int rx_macro_probe(struct platform_device *pdev) + if (ret) + goto err_fsgen; + +- ret = rx_macro_register_mclk_output(rx); +- if (ret) +- goto err_clkout; +- + ret = devm_snd_soc_register_component(dev, &rx_macro_component_drv, + rx_macro_dai, + ARRAY_SIZE(rx_macro_dai)); +@@ -3618,6 +3614,10 @@ static int rx_macro_probe(struct platform_device *pdev) + pm_runtime_set_active(dev); + pm_runtime_enable(dev); + ++ ret = rx_macro_register_mclk_output(rx); ++ if (ret) ++ goto err_clkout; ++ + return 0; + + err_clkout: +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index 2ef62d6e..b9475ba5 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -2036,10 +2036,6 @@ static int tx_macro_probe(struct platform_device *pdev) + if (ret) + goto err_fsgen; + +- ret = tx_macro_register_mclk_output(tx); +- if (ret) +- goto err_clkout; +- + ret = devm_snd_soc_register_component(dev, &tx_macro_component_drv, + tx_macro_dai, + ARRAY_SIZE(tx_macro_dai)); +@@ -2052,6 +2048,10 @@ static int tx_macro_probe(struct platform_device *pdev) + pm_runtime_set_active(dev); + pm_runtime_enable(dev); + ++ ret = tx_macro_register_mclk_output(tx); ++ if (ret) ++ goto err_clkout; ++ + return 0; + + err_clkout: +diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c +index b0b6cf29..1623ba78 100644 +--- a/sound/soc/codecs/lpass-va-macro.c ++++ b/sound/soc/codecs/lpass-va-macro.c +@@ -1524,16 +1524,6 @@ static int va_macro_probe(struct platform_device *pdev) + if (ret) + goto err_mclk; + +- ret = va_macro_register_fsgen_output(va); +- if (ret) +- goto err_clkout; +- +- va->fsgen = clk_hw_get_clk(&va->hw, "fsgen"); +- if (IS_ERR(va->fsgen)) { +- ret = PTR_ERR(va->fsgen); +- goto err_clkout; +- } +- + if (va->has_swr_master) { + /* Set default CLK div to 1 */ + regmap_update_bits(va->regmap, CDC_VA_TOP_CSR_SWR_MIC_CTL0, +@@ -1560,6 +1550,16 @@ static int va_macro_probe(struct platform_device *pdev) + pm_runtime_set_active(dev); + pm_runtime_enable(dev); + ++ ret = va_macro_register_fsgen_output(va); ++ if (ret) ++ goto err_clkout; ++ ++ va->fsgen = clk_hw_get_clk(&va->hw, "fsgen"); ++ if (IS_ERR(va->fsgen)) { ++ ret = PTR_ERR(va->fsgen); ++ goto err_clkout; ++ } ++ + return 0; + + err_clkout: +diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c +index 5cfe96f6..c0b86d69 100644 +--- a/sound/soc/codecs/lpass-wsa-macro.c ++++ b/sound/soc/codecs/lpass-wsa-macro.c +@@ -2451,11 +2451,6 @@ static int wsa_macro_probe(struct platform_device *pdev) + if (ret) + goto err_fsgen; + +- ret = wsa_macro_register_mclk_output(wsa); +- if (ret) +- goto err_clkout; +- +- + ret = devm_snd_soc_register_component(dev, &wsa_macro_component_drv, + wsa_macro_dai, + ARRAY_SIZE(wsa_macro_dai)); +@@ -2468,6 +2463,10 @@ static int wsa_macro_probe(struct platform_device *pdev) + pm_runtime_set_active(dev); + pm_runtime_enable(dev); + ++ ret = wsa_macro_register_mclk_output(wsa); ++ if (ret) ++ goto err_clkout; ++ + return 0; + + err_clkout: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-426-ASoC-codecs-lpass-fix-incorrect-mclk-rate.patch b/patches.kernel.org/6.2.3-426-ASoC-codecs-lpass-fix-incorrect-mclk-rate.patch new file mode 100644 index 0000000..d312fd6 --- /dev/null +++ b/patches.kernel.org/6.2.3-426-ASoC-codecs-lpass-fix-incorrect-mclk-rate.patch @@ -0,0 +1,74 @@ +From: Srinivas Kandagatla +Date: Thu, 9 Feb 2023 12:28:04 +0000 +Subject: [PATCH] ASoC: codecs: lpass: fix incorrect mclk rate +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e7621434378c40b62ef858c14ae6415fb6469a8e + +[ Upstream commit e7621434378c40b62ef858c14ae6415fb6469a8e ] + +For some reason we ended up with incorrect mclk rate which should be +1920000 instead of 96000, So far we were getting lucky as the same clk +is set to 192000 by wsa and va macro. This issue is discovered when there +is no wsa macro active and only rx or tx path is tested. +Fix this by setting correct rate. + +Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro") +Fixes: af3d54b99764 ("ASoC: codecs: lpass-rx-macro: add support for lpass rx macro") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230209122806.18923-7-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/codecs/lpass-rx-macro.c | 4 ++-- + sound/soc/codecs/lpass-tx-macro.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index dd6970d5..8621cfab 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -366,7 +366,7 @@ + #define CDC_RX_DSD1_CFG2 (0x0F8C) + #define RX_MAX_OFFSET (0x0F8C) + +-#define MCLK_FREQ 9600000 ++#define MCLK_FREQ 19200000 + + #define RX_MACRO_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\ + SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\ +@@ -3579,7 +3579,7 @@ static int rx_macro_probe(struct platform_device *pdev) + + /* set MCLK and NPL rates */ + clk_set_rate(rx->mclk, MCLK_FREQ); +- clk_set_rate(rx->npl, 2 * MCLK_FREQ); ++ clk_set_rate(rx->npl, MCLK_FREQ); + + ret = clk_prepare_enable(rx->macro); + if (ret) +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index b9475ba5..2449a2df 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -203,7 +203,7 @@ + #define TX_MACRO_AMIC_UNMUTE_DELAY_MS 100 + #define TX_MACRO_DMIC_HPF_DELAY_MS 300 + #define TX_MACRO_AMIC_HPF_DELAY_MS 300 +-#define MCLK_FREQ 9600000 ++#define MCLK_FREQ 19200000 + + enum { + TX_MACRO_AIF_INVALID = 0, +@@ -2014,7 +2014,7 @@ static int tx_macro_probe(struct platform_device *pdev) + + /* set MCLK and NPL rates */ + clk_set_rate(tx->mclk, MCLK_FREQ); +- clk_set_rate(tx->npl, 2 * MCLK_FREQ); ++ clk_set_rate(tx->npl, MCLK_FREQ); + + ret = clk_prepare_enable(tx->macro); + if (ret) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-427-drm-amd-display-don-t-call-dc_interrupt_set-for.patch b/patches.kernel.org/6.2.3-427-drm-amd-display-don-t-call-dc_interrupt_set-for.patch new file mode 100644 index 0000000..9e458ad --- /dev/null +++ b/patches.kernel.org/6.2.3-427-drm-amd-display-don-t-call-dc_interrupt_set-for.patch @@ -0,0 +1,61 @@ +From: Hamza Mahfooz +Date: Wed, 8 Feb 2023 13:25:49 -0500 +Subject: [PATCH] drm/amd/display: don't call dc_interrupt_set() for disabled + crtcs +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4936458bf989d168f5a89015dd81067c4c2bdc64 + +[ Upstream commit 4936458bf989d168f5a89015dd81067c4c2bdc64 ] + +As made mention of in commit 4ea7fc09539b ("drm/amd/display: Do not +program interrupt status on disabled crtc"), we shouldn't program +disabled crtcs. So, filter out disabled crtcs in dm_set_vupdate_irq() +and dm_set_vblank(). + +Reviewed-by: Harry Wentland +Fixes: 589d2739332d ("drm/amd/display: Use crtc enable/disable_vblank hooks") +Fixes: d2574c33bb71 ("drm/amd/display: In VRR mode, do DRM core vblank handling at end of vblank. (v2)") +Signed-off-by: Hamza Mahfooz +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +index 22125daf..78c2ed59 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +@@ -77,6 +77,9 @@ int dm_set_vupdate_irq(struct drm_crtc *crtc, bool enable) + struct amdgpu_device *adev = drm_to_adev(crtc->dev); + int rc; + ++ if (acrtc->otg_inst == -1) ++ return 0; ++ + irq_source = IRQ_TYPE_VUPDATE + acrtc->otg_inst; + + rc = dc_interrupt_set(adev->dm.dc, irq_source, enable) ? 0 : -EBUSY; +@@ -152,6 +155,9 @@ static inline int dm_set_vblank(struct drm_crtc *crtc, bool enable) + struct vblank_control_work *work; + int rc = 0; + ++ if (acrtc->otg_inst == -1) ++ goto skip; ++ + if (enable) { + /* vblank irq on -> Only need vupdate irq in vrr mode */ + if (amdgpu_dm_vrr_active(acrtc_state)) +@@ -169,6 +175,7 @@ static inline int dm_set_vblank(struct drm_crtc *crtc, bool enable) + if (!dc_interrupt_set(adev->dm.dc, irq_source, enable)) + return -EBUSY; + ++skip: + if (amdgpu_in_reset(adev)) + return 0; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-428-HID-logitech-hidpp-Hard-code-HID-1.0-fast-scrol.patch b/patches.kernel.org/6.2.3-428-HID-logitech-hidpp-Hard-code-HID-1.0-fast-scrol.patch new file mode 100644 index 0000000..74cac5d --- /dev/null +++ b/patches.kernel.org/6.2.3-428-HID-logitech-hidpp-Hard-code-HID-1.0-fast-scrol.patch @@ -0,0 +1,72 @@ +From: Bastien Nocera +Date: Mon, 16 Jan 2023 14:09:37 +0100 +Subject: [PATCH] HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 719acb4d3b7accc9cfbaf21c1c2d51dc7384aee2 + +[ Upstream commit 719acb4d3b7accc9cfbaf21c1c2d51dc7384aee2 ] + +HID++ 1.0 devices only export whether Fast Scrolling is enabled, not +whether they are capable of it. Reinstate the original quirks for the 3 +supported mice so fast scrolling works again on those devices. + +Fixes: 908d325e1665 ("HID: logitech-hidpp: Detect hi-res scrolling support") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216903 +Signed-off-by: Bastien Nocera +Signed-off-by: Benjamin Tissoires +Link: https://lore.kernel.org/r/20230116130937.391441-1-hadess@hadess.net +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-logitech-hidpp.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 9c1ee8e9..0c024ec1 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -77,6 +77,7 @@ MODULE_PARM_DESC(disable_tap_to_click, + #define HIDPP_QUIRK_HIDPP_WHEELS BIT(26) + #define HIDPP_QUIRK_HIDPP_EXTRA_MOUSE_BTNS BIT(27) + #define HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS BIT(28) ++#define HIDPP_QUIRK_HI_RES_SCROLL_1P0 BIT(29) + + /* These are just aliases for now */ + #define HIDPP_QUIRK_KBD_SCROLL_WHEEL HIDPP_QUIRK_HIDPP_WHEELS +@@ -3472,14 +3473,8 @@ static int hidpp_initialize_hires_scroll(struct hidpp_device *hidpp) + hid_dbg(hidpp->hid_dev, "Detected HID++ 2.0 hi-res scrolling\n"); + } + } else { +- struct hidpp_report response; +- +- ret = hidpp_send_rap_command_sync(hidpp, +- REPORT_ID_HIDPP_SHORT, +- HIDPP_GET_REGISTER, +- HIDPP_ENABLE_FAST_SCROLL, +- NULL, 0, &response); +- if (!ret) { ++ /* We cannot detect fast scrolling support on HID++ 1.0 devices */ ++ if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_1P0) { + hidpp->capabilities |= HIDPP_CAPABILITY_HIDPP10_FAST_SCROLL; + hid_dbg(hidpp->hid_dev, "Detected HID++ 1.0 fast scroll\n"); + } +@@ -4297,9 +4292,15 @@ static const struct hid_device_id hidpp_devices[] = { + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, + USB_DEVICE_ID_LOGITECH_T651), + .driver_data = HIDPP_QUIRK_CLASS_WTP }, ++ { /* Mouse Logitech Anywhere MX */ ++ LDJ_DEVICE(0x1017), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 }, + { /* Mouse logitech M560 */ + LDJ_DEVICE(0x402d), + .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560 }, ++ { /* Mouse Logitech M705 (firmware RQM17) */ ++ LDJ_DEVICE(0x101b), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 }, ++ { /* Mouse Logitech Performance MX */ ++ LDJ_DEVICE(0x101a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 }, + { /* Keyboard logitech K400 */ + LDJ_DEVICE(0x4024), + .driver_data = HIDPP_QUIRK_CLASS_K400 }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-429-spi-bcm63xx-hsspi-Fix-multi-bit-mode-setting.patch b/patches.kernel.org/6.2.3-429-spi-bcm63xx-hsspi-Fix-multi-bit-mode-setting.patch new file mode 100644 index 0000000..55301c2 --- /dev/null +++ b/patches.kernel.org/6.2.3-429-spi-bcm63xx-hsspi-Fix-multi-bit-mode-setting.patch @@ -0,0 +1,62 @@ +From: William Zhang +Date: Thu, 9 Feb 2023 12:02:41 -0800 +Subject: [PATCH] spi: bcm63xx-hsspi: Fix multi-bit mode setting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 811ff802aaf878ebbbaeac0307a0164fa21e7d40 + +[ Upstream commit 811ff802aaf878ebbbaeac0307a0164fa21e7d40 ] + +Currently the driver always sets the controller to dual data bit mode +for both tx and rx data in the profile mode control register even for +single data bit transfer. Luckily the opcode is set correctly according +to SPI transfer data bit width so it does not actually cause issues. + +This change fixes the problem by setting tx and rx data bit mode field +correctly according to the actual SPI transfer tx and rx data bit width. + +Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver") +Signed-off-by: William Zhang +Link: https://lore.kernel.org/r/20230209200246.141520-11-william.zhang@broadcom.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/spi/spi-bcm63xx-hsspi.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c +index b871fd81..02f56fc0 100644 +--- a/drivers/spi/spi-bcm63xx-hsspi.c ++++ b/drivers/spi/spi-bcm63xx-hsspi.c +@@ -163,6 +163,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) + int step_size = HSSPI_BUFFER_LEN; + const u8 *tx = t->tx_buf; + u8 *rx = t->rx_buf; ++ u32 val = 0; + + bcm63xx_hsspi_set_clk(bs, spi, t->speed_hz); + bcm63xx_hsspi_set_cs(bs, spi->chip_select, true); +@@ -178,11 +179,16 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) + step_size -= HSSPI_OPCODE_LEN; + + if ((opcode == HSSPI_OP_READ && t->rx_nbits == SPI_NBITS_DUAL) || +- (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL)) ++ (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL)) { + opcode |= HSSPI_OP_MULTIBIT; + +- __raw_writel(1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT | +- 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT | 0xff, ++ if (t->rx_nbits == SPI_NBITS_DUAL) ++ val |= 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT; ++ if (t->tx_nbits == SPI_NBITS_DUAL) ++ val |= 1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT; ++ } ++ ++ __raw_writel(val | 0xff, + bs->regs + HSSPI_PROFILE_MODE_CTRL_REG(chip_select)); + + while (pending > 0) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-430-hwmon-mlxreg-fan-Return-zero-speed-for-broken-f.patch b/patches.kernel.org/6.2.3-430-hwmon-mlxreg-fan-Return-zero-speed-for-broken-f.patch new file mode 100644 index 0000000..62f22cb --- /dev/null +++ b/patches.kernel.org/6.2.3-430-hwmon-mlxreg-fan-Return-zero-speed-for-broken-f.patch @@ -0,0 +1,47 @@ +From: Vadim Pasternak +Date: Sun, 12 Feb 2023 16:57:30 +0200 +Subject: [PATCH] hwmon: (mlxreg-fan) Return zero speed for broken fan +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a1ffd3c46267ee5c807acd780e15df9bb692223f + +[ Upstream commit a1ffd3c46267ee5c807acd780e15df9bb692223f ] + +Currently for broken fan driver returns value calculated based on error +code (0xFF) in related fan speed register. +Thus, for such fan user gets fan{n}_fault to 1 and fan{n}_input with +misleading value. + +Add check for fan fault prior return speed value and return zero if +fault is detected. + +Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20230212145730.24247-1-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/mlxreg-fan.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index b48bd7c9..96017cc8 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -155,6 +155,12 @@ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, + if (err) + return err; + ++ if (MLXREG_FAN_GET_FAULT(regval, tacho->mask)) { ++ /* FAN is broken - return zero for FAN speed. */ ++ *val = 0; ++ return 0; ++ } ++ + *val = MLXREG_FAN_GET_RPM(regval, fan->divider, + fan->samples); + break; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-431-ASoC-tlv320adcx140-fix-ti-gpio-config-DT-proper.patch b/patches.kernel.org/6.2.3-431-ASoC-tlv320adcx140-fix-ti-gpio-config-DT-proper.patch new file mode 100644 index 0000000..4f854c8 --- /dev/null +++ b/patches.kernel.org/6.2.3-431-ASoC-tlv320adcx140-fix-ti-gpio-config-DT-proper.patch @@ -0,0 +1,51 @@ +From: Steffen Aschbacher +Date: Mon, 13 Feb 2023 09:38:05 +0200 +Subject: [PATCH] ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 771725efe5e2e5396dd9d1220437e5f9d6b9ca9d + +[ Upstream commit 771725efe5e2e5396dd9d1220437e5f9d6b9ca9d ] + +When the 'ti,gpio-config' property is not defined, the +device_property_count_u32() will return an error, rather than zero. + +The current check, only handles a return value of zero, which assumes that +the property is defined and has nothing defined. + +This change extends the check to also check for an error case (most likely +to be hit by the case that the 'ti,gpio-config' is not defined). + +In case that the 'ti,gpio-config' and the returned 'gpio_count' is not +correct, there is a 'if (gpio_count != ADCX140_NUM_GPIO_CFGS)' check, a few +lines lower that will return -EINVAL. +This means that someone tried to define 'ti,gpio-config', but with the +wrong number of GPIOs. + +Fixes: d5214321498a ("ASoC: tlv320adcx140: Add support for configuring GPIO pin") +Signed-off-by: Steffen Aschbacher +Signed-off-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/20230213073805.14640-1-alex@shruggie.ro +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/codecs/tlv320adcx140.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c +index 91a22d92..530f321d 100644 +--- a/sound/soc/codecs/tlv320adcx140.c ++++ b/sound/soc/codecs/tlv320adcx140.c +@@ -925,7 +925,7 @@ static int adcx140_configure_gpio(struct adcx140_priv *adcx140) + + gpio_count = device_property_count_u32(adcx140->dev, + "ti,gpio-config"); +- if (gpio_count == 0) ++ if (gpio_count <= 0) + return 0; + + if (gpio_count != ADCX140_NUM_GPIO_CFGS) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-432-dm-remove-flush_scheduled_work-during-local_exi.patch b/patches.kernel.org/6.2.3-432-dm-remove-flush_scheduled_work-during-local_exi.patch new file mode 100644 index 0000000..7a439a8 --- /dev/null +++ b/patches.kernel.org/6.2.3-432-dm-remove-flush_scheduled_work-during-local_exi.patch @@ -0,0 +1,44 @@ +From: Mike Snitzer +Date: Tue, 14 Feb 2023 13:06:05 -0500 +Subject: [PATCH] dm: remove flush_scheduled_work() during local_exit() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0b22ff5360f5c4e11050b89206370fdf7dc0a226 + +[ Upstream commit 0b22ff5360f5c4e11050b89206370fdf7dc0a226 ] + +Commit acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred +device removal") switched from using system workqueue to a single +workqueue local to DM. But it didn't eliminate the call to +flush_scheduled_work() that was introduced purely for the benefit of +deferred device removal with commit 2c140a246dc ("dm: allow remove to +be deferred"). + +Since DM core uses its own workqueue (and queue_work) there is no need +to call flush_scheduled_work() from local_exit(). local_exit()'s +destroy_workqueue(deferred_remove_workqueue) handles flushing work +started with queue_work(). + +Fixes: acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal") +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/md/dm.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index b424a6ee..eba9bc06 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -231,7 +231,6 @@ static int __init local_init(void) + + static void local_exit(void) + { +- flush_scheduled_work(); + destroy_workqueue(deferred_remove_workqueue); + + unregister_blkdev(_major, _name); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-433-nfs4trace-fix-state-manager-flag-printing.patch b/patches.kernel.org/6.2.3-433-nfs4trace-fix-state-manager-flag-printing.patch new file mode 100644 index 0000000..02cf83f --- /dev/null +++ b/patches.kernel.org/6.2.3-433-nfs4trace-fix-state-manager-flag-printing.patch @@ -0,0 +1,82 @@ +From: Benjamin Coddington +Date: Tue, 14 Feb 2023 08:18:23 -0500 +Subject: [PATCH] nfs4trace: fix state manager flag printing +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b46d80bd2d6e7e063c625a20de54248afe8d4889 + +[ Upstream commit b46d80bd2d6e7e063c625a20de54248afe8d4889 ] + +__print_flags wants a mask, not the enum value. Add two more flags. + +Fixes: 511ba52e4c01 ("NFS4: Trace state recovery operation") +Signed-off-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfs/nfs4trace.h | 42 ++++++++++++++++++++++-------------------- + 1 file changed, 22 insertions(+), 20 deletions(-) + +diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h +index 214bc56f..d27919d7 100644 +--- a/fs/nfs/nfs4trace.h ++++ b/fs/nfs/nfs4trace.h +@@ -292,32 +292,34 @@ TRACE_DEFINE_ENUM(NFS4CLNT_MOVED); + TRACE_DEFINE_ENUM(NFS4CLNT_LEASE_MOVED); + TRACE_DEFINE_ENUM(NFS4CLNT_DELEGATION_EXPIRED); + TRACE_DEFINE_ENUM(NFS4CLNT_RUN_MANAGER); ++TRACE_DEFINE_ENUM(NFS4CLNT_MANAGER_AVAILABLE); + TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_RUNNING); + TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_READ); + TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_RW); ++TRACE_DEFINE_ENUM(NFS4CLNT_DELEGRETURN_DELAYED); + + #define show_nfs4_clp_state(state) \ + __print_flags(state, "|", \ +- { NFS4CLNT_MANAGER_RUNNING, "MANAGER_RUNNING" }, \ +- { NFS4CLNT_CHECK_LEASE, "CHECK_LEASE" }, \ +- { NFS4CLNT_LEASE_EXPIRED, "LEASE_EXPIRED" }, \ +- { NFS4CLNT_RECLAIM_REBOOT, "RECLAIM_REBOOT" }, \ +- { NFS4CLNT_RECLAIM_NOGRACE, "RECLAIM_NOGRACE" }, \ +- { NFS4CLNT_DELEGRETURN, "DELEGRETURN" }, \ +- { NFS4CLNT_SESSION_RESET, "SESSION_RESET" }, \ +- { NFS4CLNT_LEASE_CONFIRM, "LEASE_CONFIRM" }, \ +- { NFS4CLNT_SERVER_SCOPE_MISMATCH, \ +- "SERVER_SCOPE_MISMATCH" }, \ +- { NFS4CLNT_PURGE_STATE, "PURGE_STATE" }, \ +- { NFS4CLNT_BIND_CONN_TO_SESSION, \ +- "BIND_CONN_TO_SESSION" }, \ +- { NFS4CLNT_MOVED, "MOVED" }, \ +- { NFS4CLNT_LEASE_MOVED, "LEASE_MOVED" }, \ +- { NFS4CLNT_DELEGATION_EXPIRED, "DELEGATION_EXPIRED" }, \ +- { NFS4CLNT_RUN_MANAGER, "RUN_MANAGER" }, \ +- { NFS4CLNT_RECALL_RUNNING, "RECALL_RUNNING" }, \ +- { NFS4CLNT_RECALL_ANY_LAYOUT_READ, "RECALL_ANY_LAYOUT_READ" }, \ +- { NFS4CLNT_RECALL_ANY_LAYOUT_RW, "RECALL_ANY_LAYOUT_RW" }) ++ { BIT(NFS4CLNT_MANAGER_RUNNING), "MANAGER_RUNNING" }, \ ++ { BIT(NFS4CLNT_CHECK_LEASE), "CHECK_LEASE" }, \ ++ { BIT(NFS4CLNT_LEASE_EXPIRED), "LEASE_EXPIRED" }, \ ++ { BIT(NFS4CLNT_RECLAIM_REBOOT), "RECLAIM_REBOOT" }, \ ++ { BIT(NFS4CLNT_RECLAIM_NOGRACE), "RECLAIM_NOGRACE" }, \ ++ { BIT(NFS4CLNT_DELEGRETURN), "DELEGRETURN" }, \ ++ { BIT(NFS4CLNT_SESSION_RESET), "SESSION_RESET" }, \ ++ { BIT(NFS4CLNT_LEASE_CONFIRM), "LEASE_CONFIRM" }, \ ++ { BIT(NFS4CLNT_SERVER_SCOPE_MISMATCH), "SERVER_SCOPE_MISMATCH" }, \ ++ { BIT(NFS4CLNT_PURGE_STATE), "PURGE_STATE" }, \ ++ { BIT(NFS4CLNT_BIND_CONN_TO_SESSION), "BIND_CONN_TO_SESSION" }, \ ++ { BIT(NFS4CLNT_MOVED), "MOVED" }, \ ++ { BIT(NFS4CLNT_LEASE_MOVED), "LEASE_MOVED" }, \ ++ { BIT(NFS4CLNT_DELEGATION_EXPIRED), "DELEGATION_EXPIRED" }, \ ++ { BIT(NFS4CLNT_RUN_MANAGER), "RUN_MANAGER" }, \ ++ { BIT(NFS4CLNT_MANAGER_AVAILABLE), "MANAGER_AVAILABLE" }, \ ++ { BIT(NFS4CLNT_RECALL_RUNNING), "RECALL_RUNNING" }, \ ++ { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_READ), "RECALL_ANY_LAYOUT_READ" }, \ ++ { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_RW), "RECALL_ANY_LAYOUT_RW" }, \ ++ { BIT(NFS4CLNT_DELEGRETURN_DELAYED), "DELERETURN_DELAYED" }) + + TRACE_EVENT(nfs4_state_mgr, + TP_PROTO( +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-434-NFS-fix-disabling-of-swap.patch b/patches.kernel.org/6.2.3-434-NFS-fix-disabling-of-swap.patch new file mode 100644 index 0000000..557d493 --- /dev/null +++ b/patches.kernel.org/6.2.3-434-NFS-fix-disabling-of-swap.patch @@ -0,0 +1,70 @@ +From: NeilBrown +Date: Wed, 8 Feb 2023 15:45:38 +1100 +Subject: [PATCH] NFS: fix disabling of swap +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5bab56fff53ce161ed859d9559a10361d4f79578 + +[ Upstream commit 5bab56fff53ce161ed859d9559a10361d4f79578 ] + +When swap is activated to a file on an NFSv4 mount we arrange that the +state manager thread is always present as starting a new thread requires +memory allocations that might block waiting for swap. + +Unfortunately the code for allowing the state manager thread to exit when +swap is disabled was not tested properly and does not work. +This can be seen by examining /proc/fs/nfsfs/servers after disabling swap +and unmounting the filesystem. The servers file will still list one +entry. Also a "ps" listing will show the state manager thread is still +present. + +There are two problems. + 1/ rpc_clnt_swap_deactivate() doesn't walk up the ->cl_parent list to + find the primary client on which the state manager runs. + + 2/ The thread is not woken up properly and it immediately goes back to + sleep without checking whether it is really needed. Using + nfs4_schedule_state_manager() ensures a proper wake-up. + +Reported-by: Olga Kornievskaia +Fixes: 4dc73c679114 ("NFSv4: keep state manager thread active if swap is enabled") +Signed-off-by: NeilBrown +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfs/nfs4proc.c | 4 +++- + net/sunrpc/clnt.c | 2 ++ + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 40d749f2..4214286e 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -10604,7 +10604,9 @@ static void nfs4_disable_swap(struct inode *inode) + /* The state manager thread will now exit once it is + * woken. + */ +- wake_up_var(&NFS_SERVER(inode)->nfs_client->cl_state); ++ struct nfs_client *clp = NFS_SERVER(inode)->nfs_client; ++ ++ nfs4_schedule_state_manager(clp); + } + + static const struct inode_operations nfs4_dir_inode_operations = { +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 0b0b9f1e..fd7e1c63 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -3350,6 +3350,8 @@ rpc_clnt_swap_deactivate_callback(struct rpc_clnt *clnt, + void + rpc_clnt_swap_deactivate(struct rpc_clnt *clnt) + { ++ while (clnt != clnt->cl_parent) ++ clnt = clnt->cl_parent; + if (atomic_dec_if_positive(&clnt->cl_swapper) == 0) + rpc_clnt_iterate_for_each_xprt(clnt, + rpc_clnt_swap_deactivate_callback, NULL); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-435-drm-i915-pvc-Implement-recommended-caching-poli.patch b/patches.kernel.org/6.2.3-435-drm-i915-pvc-Implement-recommended-caching-poli.patch new file mode 100644 index 0000000..e90488b --- /dev/null +++ b/patches.kernel.org/6.2.3-435-drm-i915-pvc-Implement-recommended-caching-poli.patch @@ -0,0 +1,51 @@ +From: Wayne Boyer +Date: Wed, 30 Nov 2022 09:07:23 -0800 +Subject: [PATCH] drm/i915/pvc: Implement recommended caching policy +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e3995e08a39a41691742b380023a0d480247afb0 + +[ Upstream commit e3995e08a39a41691742b380023a0d480247afb0 ] + +As per the performance tuning guide, set the HOSTCACHEEN bit to +implement the recommended caching policy on PVC. + +Signed-off-by: Wayne Boyer +Reviewed-by: Matt Roper +Signed-off-by: Matt Roper +Link: https://patchwork.freedesktop.org/patch/msgid/20221130170723.2460014-1-wayne.boyer@intel.com +Stable-dep-of: effc0905d741 ("drm/i915/pvc: Annotate two more workaround/tuning registers as MCR") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_gt_regs.h | 1 + + drivers/gpu/drm/i915/gt/intel_workarounds.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +index 0c7e7972..838f7316 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h ++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +@@ -970,6 +970,7 @@ + #define GEN7_L3AGDIS (1 << 19) + + #define XEHPC_LNCFMISCCFGREG0 _MMIO(0xb01c) ++#define XEHPC_HOSTCACHEEN REG_BIT(1) + #define XEHPC_OVRLSCCC REG_BIT(0) + + #define GEN7_L3CNTLREG2 _MMIO(0xb020) +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index dcc694b8..c2d9d07a 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -2973,6 +2973,7 @@ add_render_compute_tuning_settings(struct drm_i915_private *i915, + if (IS_PONTEVECCHIO(i915)) { + wa_write(wal, XEHPC_L3SCRUB, + SCRUB_CL_DWNGRADE_SHARED | SCRUB_RATE_4B_PER_CLK); ++ wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_HOSTCACHEEN); + } + + if (IS_DG2(i915)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-436-drm-i915-pvc-Annotate-two-more-workaround-tunin.patch b/patches.kernel.org/6.2.3-436-drm-i915-pvc-Annotate-two-more-workaround-tunin.patch new file mode 100644 index 0000000..29423c0 --- /dev/null +++ b/patches.kernel.org/6.2.3-436-drm-i915-pvc-Annotate-two-more-workaround-tunin.patch @@ -0,0 +1,98 @@ +From: Matt Roper +Date: Wed, 1 Feb 2023 14:28:28 -0800 +Subject: [PATCH] drm/i915/pvc: Annotate two more workaround/tuning registers + as MCR +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: effc0905d741b4138806747407baf8de98390c72 + +[ Upstream commit effc0905d741b4138806747407baf8de98390c72 ] + +XEHPC_LNCFMISCCFGREG0 and XEHPC_L3SCRUB are both in MCR register ranges +on PVC (with HALFBSLICE and L3BANK replication respectively), so they +should be explicitly declared as MCR registers and use MCR-aware +workaround handlers. + +The workarounds/tuning settings should still be applied properly on PVC +even without the MCR annotation, but readback verification on +CONFIG_DRM_I915_DEBUG_GEM builds could potentitally give false positive +"workaround lost on load" warnings on parts fused such that a unicast +read targets a terminated register instance. + +Fixes: a9e69428b1b4 ("drm/i915: Define MCR registers explicitly") +Signed-off-by: Matt Roper +Reviewed-by: Gustavo Sousa +Link: https://patchwork.freedesktop.org/patch/msgid/20230201222831.608281-1-matthew.d.roper@intel.com +(cherry picked from commit 4039e44237e8ebb06f0e4af549fbedf7c41df9db) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_gt_regs.h | 4 ++-- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 14 ++++++++++---- + 2 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +index 838f7316..0d47c930 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h ++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +@@ -969,7 +969,7 @@ + #define GEN7_WA_FOR_GEN7_L3_CONTROL 0x3C47FF8C + #define GEN7_L3AGDIS (1 << 19) + +-#define XEHPC_LNCFMISCCFGREG0 _MMIO(0xb01c) ++#define XEHPC_LNCFMISCCFGREG0 MCR_REG(0xb01c) + #define XEHPC_HOSTCACHEEN REG_BIT(1) + #define XEHPC_OVRLSCCC REG_BIT(0) + +@@ -1032,7 +1032,7 @@ + #define XEHP_L3SCQREG7 MCR_REG(0xb188) + #define BLEND_FILL_CACHING_OPT_DIS REG_BIT(3) + +-#define XEHPC_L3SCRUB _MMIO(0xb18c) ++#define XEHPC_L3SCRUB MCR_REG(0xb18c) + #define SCRUB_CL_DWNGRADE_SHARED REG_BIT(12) + #define SCRUB_RATE_PER_BANK_MASK REG_GENMASK(2, 0) + #define SCRUB_RATE_4B_PER_CLK REG_FIELD_PREP(SCRUB_RATE_PER_BANK_MASK, 0x6) +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index c2d9d07a..80b0e9a5 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -224,6 +224,12 @@ wa_write(struct i915_wa_list *wal, i915_reg_t reg, u32 set) + wa_write_clr_set(wal, reg, ~0, set); + } + ++static void ++wa_mcr_write(struct i915_wa_list *wal, i915_mcr_reg_t reg, u32 set) ++{ ++ wa_mcr_write_clr_set(wal, reg, ~0, set); ++} ++ + static void + wa_write_or(struct i915_wa_list *wal, i915_reg_t reg, u32 set) + { +@@ -2971,9 +2977,9 @@ add_render_compute_tuning_settings(struct drm_i915_private *i915, + struct i915_wa_list *wal) + { + if (IS_PONTEVECCHIO(i915)) { +- wa_write(wal, XEHPC_L3SCRUB, +- SCRUB_CL_DWNGRADE_SHARED | SCRUB_RATE_4B_PER_CLK); +- wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_HOSTCACHEEN); ++ wa_mcr_write(wal, XEHPC_L3SCRUB, ++ SCRUB_CL_DWNGRADE_SHARED | SCRUB_RATE_4B_PER_CLK); ++ wa_mcr_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_HOSTCACHEEN); + } + + if (IS_DG2(i915)) { +@@ -3038,7 +3044,7 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li + + if (IS_PONTEVECCHIO(i915)) { + /* Wa_16016694945 */ +- wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_OVRLSCCC); ++ wa_mcr_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_OVRLSCCC); + } + + if (IS_XEHPSDV(i915)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-437-drm-i915-Fix-GEN8_MISCCPCTL.patch b/patches.kernel.org/6.2.3-437-drm-i915-Fix-GEN8_MISCCPCTL.patch new file mode 100644 index 0000000..d273b06 --- /dev/null +++ b/patches.kernel.org/6.2.3-437-drm-i915-Fix-GEN8_MISCCPCTL.patch @@ -0,0 +1,140 @@ +From: Lucas De Marchi +Date: Mon, 6 Feb 2023 08:54:09 -0800 +Subject: [PATCH] drm/i915: Fix GEN8_MISCCPCTL +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6a8b2e4984f73f8d00c8c16b87a8b115d34088e4 + +[ Upstream commit 6a8b2e4984f73f8d00c8c16b87a8b115d34088e4 ] + +Register 0x9424 is not replicated on any platform, so it shouldn't be +declared with REG_MCR(). Declaring it with _MMIO() is basically +duplicate of the GEN7 version, so just remove the GEN8 and change all +the callers to use the right functions. + +Old versions of the gen8 bspec page used to contain a table with MCR +registers, apparently implying 0x9400 - 0x94ff registers were +replicated. However that table went away and there is no information +related to the ranges for gen8 anymore. Moreover the current behavior of +the driver wouldn't do anything special for 0x9424 since there is no +equivalent table in intel_gt_mcr.c: the driver would just fallback to +intel_uncore_{read,write}(). Therefore, do not care about the possible +special case for gen8 and just use the register as non-MCR for all the +platforms. + +One place doing read + write is also converted to intel_uncore_rmw(). + +v2: Reword commit message adding the justification wrt gen8 + +Fixes: a9e69428b1b4 ("drm/i915: Define MCR registers explicitly") +Cc: Balasubramani Vivekanandan +Cc: Rodrigo Vivi +Cc: Gustavo Sousa +Cc: Matt Atwood +Cc: Ashutosh Dixit +Signed-off-by: Lucas De Marchi +Reviewed-by: Matt Roper +Link: https://patchwork.freedesktop.org/patch/msgid/20230206165410.3056073-1-lucas.demarchi@intel.com +(cherry picked from commit 869bace73ae2b4227e57ee3fd994bfa7d4808938) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_gt_regs.h | 5 +---- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 4 ++-- + drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c | 5 ++--- + drivers/gpu/drm/i915/intel_pm.c | 10 +++++----- + 4 files changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +index 0d47c930..3b6ef0eb 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h ++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +@@ -681,10 +681,7 @@ + #define GEN6_RSTCTL _MMIO(0x9420) + + #define GEN7_MISCCPCTL _MMIO(0x9424) +-#define GEN7_DOP_CLOCK_GATE_ENABLE (1 << 0) +- +-#define GEN8_MISCCPCTL MCR_REG(0x9424) +-#define GEN8_DOP_CLOCK_GATE_ENABLE REG_BIT(0) ++#define GEN7_DOP_CLOCK_GATE_ENABLE REG_BIT(0) + #define GEN12_DOP_CLOCK_GATE_RENDER_ENABLE REG_BIT(1) + #define GEN8_DOP_CLOCK_GATE_CFCLK_ENABLE (1 << 2) + #define GEN8_DOP_CLOCK_GATE_GUC_ENABLE (1 << 4) +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index 80b0e9a5..d92b006d 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -1673,7 +1673,7 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + wa_mcr_write_or(wal, XEHP_SQCM, EN_32B_ACCESS); + + /* Wa_14015795083 */ +- wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); ++ wa_write_clr(wal, GEN7_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); + + /* Wa_18018781329 */ + wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); +@@ -1692,7 +1692,7 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + pvc_init_mcr(gt, wal); + + /* Wa_14015795083 */ +- wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); ++ wa_write_clr(wal, GEN7_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); + + /* Wa_18018781329 */ + wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c +index 5b86b2e2..42c5d9d2 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c +@@ -38,9 +38,8 @@ static void guc_prepare_xfer(struct intel_gt *gt) + + if (GRAPHICS_VER(uncore->i915) == 9) { + /* DOP Clock Gating Enable for GuC clocks */ +- intel_gt_mcr_multicast_write(gt, GEN8_MISCCPCTL, +- GEN8_DOP_CLOCK_GATE_GUC_ENABLE | +- intel_gt_mcr_read_any(gt, GEN8_MISCCPCTL)); ++ intel_uncore_rmw(uncore, GEN7_MISCCPCTL, 0, ++ GEN8_DOP_CLOCK_GATE_GUC_ENABLE); + + /* allows for 5us (in 10ns units) before GT can go to RC6 */ + intel_uncore_write(uncore, GUC_ARAT_C6DIS, 0x1FF); +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 73c88b1c..ac61df46 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -4299,8 +4299,8 @@ static void gen8_set_l3sqc_credits(struct drm_i915_private *dev_priv, + u32 val; + + /* WaTempDisableDOPClkGating:bdw */ +- misccpctl = intel_gt_mcr_multicast_rmw(to_gt(dev_priv), GEN8_MISCCPCTL, +- GEN8_DOP_CLOCK_GATE_ENABLE, 0); ++ misccpctl = intel_uncore_rmw(&dev_priv->uncore, GEN7_MISCCPCTL, ++ GEN7_DOP_CLOCK_GATE_ENABLE, 0); + + val = intel_gt_mcr_read_any(to_gt(dev_priv), GEN8_L3SQCREG1); + val &= ~L3_PRIO_CREDITS_MASK; +@@ -4314,7 +4314,7 @@ static void gen8_set_l3sqc_credits(struct drm_i915_private *dev_priv, + */ + intel_gt_mcr_read_any(to_gt(dev_priv), GEN8_L3SQCREG1); + udelay(1); +- intel_gt_mcr_multicast_write(to_gt(dev_priv), GEN8_MISCCPCTL, misccpctl); ++ intel_uncore_write(&dev_priv->uncore, GEN7_MISCCPCTL, misccpctl); + } + + static void icl_init_clock_gating(struct drm_i915_private *dev_priv) +@@ -4465,8 +4465,8 @@ static void skl_init_clock_gating(struct drm_i915_private *dev_priv) + gen9_init_clock_gating(dev_priv); + + /* WaDisableDopClockGating:skl */ +- intel_gt_mcr_multicast_rmw(to_gt(dev_priv), GEN8_MISCCPCTL, +- GEN8_DOP_CLOCK_GATE_ENABLE, 0); ++ intel_uncore_rmw(&dev_priv->uncore, GEN7_MISCCPCTL, ++ GEN7_DOP_CLOCK_GATE_ENABLE, 0); + + /* WAC6entrylatency:skl */ + intel_uncore_rmw(&dev_priv->uncore, FBC_LLC_READ_CTRL, 0, FBC_LLC_FULLY_OPEN); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-438-spi-synquacer-Fix-timeout-handling-in-synquacer.patch b/patches.kernel.org/6.2.3-438-spi-synquacer-Fix-timeout-handling-in-synquacer.patch new file mode 100644 index 0000000..5a4306c --- /dev/null +++ b/patches.kernel.org/6.2.3-438-spi-synquacer-Fix-timeout-handling-in-synquacer.patch @@ -0,0 +1,49 @@ +From: Christophe JAILLET +Date: Wed, 15 Feb 2023 14:01:28 +0100 +Subject: [PATCH] spi: synquacer: Fix timeout handling in + synquacer_spi_transfer_one() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e6a0b671880207566e1ece983bf989dde60bc1d7 + +[ Upstream commit e6a0b671880207566e1ece983bf989dde60bc1d7 ] + +wait_for_completion_timeout() never returns a <0 value. It returns either +on timeout or a positive value (at least 1, or number of jiffies left +till timeout) + +So, fix the error handling path and return -ETIMEDOUT should a timeout +occur. + +Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform") +Signed-off-by: Christophe JAILLET +Acked-by: Jassi Brar +Link: https://lore.kernel.org/r/c2040bf3cfa201fd8890cfab14fa5a701ffeca14.1676466072.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/spi/spi-synquacer.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-synquacer.c b/drivers/spi/spi-synquacer.c +index 47cbe731..dc188f92 100644 +--- a/drivers/spi/spi-synquacer.c ++++ b/drivers/spi/spi-synquacer.c +@@ -472,10 +472,9 @@ static int synquacer_spi_transfer_one(struct spi_master *master, + read_fifo(sspi); + } + +- if (status < 0) { +- dev_err(sspi->dev, "failed to transfer. status: 0x%x\n", +- status); +- return status; ++ if (status == 0) { ++ dev_err(sspi->dev, "failed to transfer. Timeout.\n"); ++ return -ETIMEDOUT; + } + + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-439-ASoC-soc-dapm.h-fixup-warning-struct-snd_pcm_su.patch b/patches.kernel.org/6.2.3-439-ASoC-soc-dapm.h-fixup-warning-struct-snd_pcm_su.patch new file mode 100644 index 0000000..2373ca2 --- /dev/null +++ b/patches.kernel.org/6.2.3-439-ASoC-soc-dapm.h-fixup-warning-struct-snd_pcm_su.patch @@ -0,0 +1,39 @@ +From: Lucas Tanure +Date: Wed, 15 Feb 2023 13:28:51 +0000 +Subject: [PATCH] ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not + declared +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b + +[ Upstream commit fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b ] + +Add struct snd_pcm_substream forward declaration + +Fixes: 078a85f2806f ("ASoC: dapm: Only power up active channels from a DAI") +Signed-off-by: Lucas Tanure +Reviewed-by: Charles Keepax +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230215132851.1626881-1-lucas.tanure@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/sound/soc-dapm.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h +index 77495e59..64915ebd 100644 +--- a/include/sound/soc-dapm.h ++++ b/include/sound/soc-dapm.h +@@ -16,6 +16,7 @@ + #include + + struct device; ++struct snd_pcm_substream; + struct snd_soc_pcm_runtime; + struct soc_enum; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-440-HID-bigben-use-spinlock-to-protect-concurrent-a.patch b/patches.kernel.org/6.2.3-440-HID-bigben-use-spinlock-to-protect-concurrent-a.patch new file mode 100644 index 0000000..a94cb56 --- /dev/null +++ b/patches.kernel.org/6.2.3-440-HID-bigben-use-spinlock-to-protect-concurrent-a.patch @@ -0,0 +1,174 @@ +From: Pietro Borrello +Date: Sun, 12 Feb 2023 18:59:59 +0000 +Subject: [PATCH] HID: bigben: use spinlock to protect concurrent accesses +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 + +[ Upstream commit 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 ] + +bigben driver has a worker that may access data concurrently. +Proct the accesses using a spinlock. + +Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-1-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-bigbenff.c | 52 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 50 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index e8b16665..ed3d2d7b 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -174,6 +174,7 @@ static __u8 pid0902_rdesc_fixed[] = { + struct bigben_device { + struct hid_device *hid; + struct hid_report *report; ++ spinlock_t lock; + bool removed; + u8 led_state; /* LED1 = 1 .. LED4 = 8 */ + u8 right_motor_on; /* right motor off/on 0/1 */ +@@ -190,12 +191,27 @@ static void bigben_worker(struct work_struct *work) + struct bigben_device *bigben = container_of(work, + struct bigben_device, worker); + struct hid_field *report_field = bigben->report->field[0]; ++ bool do_work_led = false; ++ bool do_work_ff = false; ++ u8 *buf; ++ u32 len; ++ unsigned long flags; + + if (bigben->removed || !report_field) + return; + ++ buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); ++ if (!buf) ++ return; ++ ++ len = hid_report_len(bigben->report); ++ ++ /* LED work */ ++ spin_lock_irqsave(&bigben->lock, flags); ++ + if (bigben->work_led) { + bigben->work_led = false; ++ do_work_led = true; + report_field->value[0] = 0x01; /* 1 = led message */ + report_field->value[1] = 0x08; /* reserved value, always 8 */ + report_field->value[2] = bigben->led_state; +@@ -204,11 +220,22 @@ static void bigben_worker(struct work_struct *work) + report_field->value[5] = 0x00; /* padding */ + report_field->value[6] = 0x00; /* padding */ + report_field->value[7] = 0x00; /* padding */ +- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT); ++ hid_output_report(bigben->report, buf); ++ } ++ ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ ++ if (do_work_led) { ++ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len, ++ bigben->report->type, HID_REQ_SET_REPORT); + } + ++ /* FF work */ ++ spin_lock_irqsave(&bigben->lock, flags); ++ + if (bigben->work_ff) { + bigben->work_ff = false; ++ do_work_ff = true; + report_field->value[0] = 0x02; /* 2 = rumble effect message */ + report_field->value[1] = 0x08; /* reserved value, always 8 */ + report_field->value[2] = bigben->right_motor_on; +@@ -217,8 +244,17 @@ static void bigben_worker(struct work_struct *work) + report_field->value[5] = 0x00; /* padding */ + report_field->value[6] = 0x00; /* padding */ + report_field->value[7] = 0x00; /* padding */ +- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT); ++ hid_output_report(bigben->report, buf); ++ } ++ ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ ++ if (do_work_ff) { ++ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len, ++ bigben->report->type, HID_REQ_SET_REPORT); + } ++ ++ kfree(buf); + } + + static int hid_bigben_play_effect(struct input_dev *dev, void *data, +@@ -228,6 +264,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + struct bigben_device *bigben = hid_get_drvdata(hid); + u8 right_motor_on; + u8 left_motor_force; ++ unsigned long flags; + + if (!bigben) { + hid_err(hid, "no device data\n"); +@@ -242,9 +279,12 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + + if (right_motor_on != bigben->right_motor_on || + left_motor_force != bigben->left_motor_force) { ++ spin_lock_irqsave(&bigben->lock, flags); + bigben->right_motor_on = right_motor_on; + bigben->left_motor_force = left_motor_force; + bigben->work_ff = true; ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ + schedule_work(&bigben->worker); + } + +@@ -259,6 +299,7 @@ static void bigben_set_led(struct led_classdev *led, + struct bigben_device *bigben = hid_get_drvdata(hid); + int n; + bool work; ++ unsigned long flags; + + if (!bigben) { + hid_err(hid, "no device data\n"); +@@ -267,6 +308,7 @@ static void bigben_set_led(struct led_classdev *led, + + for (n = 0; n < NUM_LEDS; n++) { + if (led == bigben->leds[n]) { ++ spin_lock_irqsave(&bigben->lock, flags); + if (value == LED_OFF) { + work = (bigben->led_state & BIT(n)); + bigben->led_state &= ~BIT(n); +@@ -274,6 +316,7 @@ static void bigben_set_led(struct led_classdev *led, + work = !(bigben->led_state & BIT(n)); + bigben->led_state |= BIT(n); + } ++ spin_unlock_irqrestore(&bigben->lock, flags); + + if (work) { + bigben->work_led = true; +@@ -307,8 +350,12 @@ static enum led_brightness bigben_get_led(struct led_classdev *led) + static void bigben_remove(struct hid_device *hid) + { + struct bigben_device *bigben = hid_get_drvdata(hid); ++ unsigned long flags; + ++ spin_lock_irqsave(&bigben->lock, flags); + bigben->removed = true; ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ + cancel_work_sync(&bigben->worker); + hid_hw_stop(hid); + } +@@ -362,6 +409,7 @@ static int bigben_probe(struct hid_device *hid, + set_bit(FF_RUMBLE, hidinput->input->ffbit); + + INIT_WORK(&bigben->worker, bigben_worker); ++ spin_lock_init(&bigben->lock); + + error = input_ff_create_memless(hidinput->input, NULL, + hid_bigben_play_effect); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-441-HID-bigben_worker-remove-unneeded-check-on-repo.patch b/patches.kernel.org/6.2.3-441-HID-bigben_worker-remove-unneeded-check-on-repo.patch new file mode 100644 index 0000000..c35d013 --- /dev/null +++ b/patches.kernel.org/6.2.3-441-HID-bigben_worker-remove-unneeded-check-on-repo.patch @@ -0,0 +1,45 @@ +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:00 +0000 +Subject: [PATCH] HID: bigben_worker() remove unneeded check on report_field +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 27d2a2fd844ec7da70d19fabb482304fd1e0595b + +[ Upstream commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b ] + +bigben_worker() checks report_field to be non-NULL. +The check has been added in commit +918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") +to prevent a NULL pointer crash. +However, the true root cause was a missing check for output +reports, patched in commit +c7bf714f8755 ("HID: check empty report_list in bigben_probe()"), +where the type-confused report list_entry was overlapping with +a NULL pointer, which was then causing the crash. + +Fixes: 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-2-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-bigbenff.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index ed3d2d7b..b98c5f31 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -197,7 +197,7 @@ static void bigben_worker(struct work_struct *work) + u32 len; + unsigned long flags; + +- if (bigben->removed || !report_field) ++ if (bigben->removed) + return; + + buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-442-HID-bigben-use-spinlock-to-safely-schedule-work.patch b/patches.kernel.org/6.2.3-442-HID-bigben-use-spinlock-to-safely-schedule-work.patch new file mode 100644 index 0000000..811ee85 --- /dev/null +++ b/patches.kernel.org/6.2.3-442-HID-bigben-use-spinlock-to-safely-schedule-work.patch @@ -0,0 +1,84 @@ +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:01 +0000 +Subject: [PATCH] HID: bigben: use spinlock to safely schedule workers +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 76ca8da989c7d97a7f76c75d475fe95a584439d7 + +[ Upstream commit 76ca8da989c7d97a7f76c75d475fe95a584439d7 ] + +Use spinlocks to deal with workers introducing a wrapper +bigben_schedule_work(), and several spinlock checks. +Otherwise, bigben_set_led() may schedule bigben->worker after the +structure has been freed, causing a use-after-free. + +Fixes: 4eb1b01de5b9 ("HID: hid-bigbenff: fix race condition for scheduled work during removal") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-3-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-bigbenff.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index b98c5f31..9d6560db 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -185,6 +185,15 @@ struct bigben_device { + struct work_struct worker; + }; + ++static inline void bigben_schedule_work(struct bigben_device *bigben) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&bigben->lock, flags); ++ if (!bigben->removed) ++ schedule_work(&bigben->worker); ++ spin_unlock_irqrestore(&bigben->lock, flags); ++} + + static void bigben_worker(struct work_struct *work) + { +@@ -197,9 +206,6 @@ static void bigben_worker(struct work_struct *work) + u32 len; + unsigned long flags; + +- if (bigben->removed) +- return; +- + buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); + if (!buf) + return; +@@ -285,7 +291,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + bigben->work_ff = true; + spin_unlock_irqrestore(&bigben->lock, flags); + +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + } + + return 0; +@@ -320,7 +326,7 @@ static void bigben_set_led(struct led_classdev *led, + + if (work) { + bigben->work_led = true; +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + } + return; + } +@@ -450,7 +456,7 @@ static int bigben_probe(struct hid_device *hid, + bigben->left_motor_force = 0; + bigben->work_led = true; + bigben->work_ff = true; +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + + hid_info(hid, "LED and force feedback support for BigBen gamepad\n"); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-443-hid-bigben_probe-validate-report-count.patch b/patches.kernel.org/6.2.3-443-hid-bigben_probe-validate-report-count.patch new file mode 100644 index 0000000..41fe89b --- /dev/null +++ b/patches.kernel.org/6.2.3-443-hid-bigben_probe-validate-report-count.patch @@ -0,0 +1,58 @@ +From: Pietro Borrello +Date: Sun, 12 Feb 2023 00:01:44 +0000 +Subject: [PATCH] hid: bigben_probe(): validate report count +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b94335f899542a0da5fafc38af8edcaf90195843 + +[ Upstream commit b94335f899542a0da5fafc38af8edcaf90195843 ] + +bigben_probe() does not validate that the output report has the +needed report values in the first field. +A malicious device registering a report with one field and a single +value causes an head OOB write in bigben_worker() when +accessing report_field->value[1] to report_field->value[7]. +Use hid_validate_values() which takes care of all the needed checks. + +Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230211-bigben-oob-v1-1-d2849688594c@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-bigbenff.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index 9d6560db..a02cb517 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -371,7 +371,6 @@ static int bigben_probe(struct hid_device *hid, + { + struct bigben_device *bigben; + struct hid_input *hidinput; +- struct list_head *report_list; + struct led_classdev *led; + char *name; + size_t name_sz; +@@ -396,14 +395,12 @@ static int bigben_probe(struct hid_device *hid, + return error; + } + +- report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; +- if (list_empty(report_list)) { ++ bigben->report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 8); ++ if (!bigben->report) { + hid_err(hid, "no output report found\n"); + error = -ENODEV; + goto error_hw_stop; + } +- bigben->report = list_entry(report_list->next, +- struct hid_report, list); + + if (list_empty(&hid->inputs)) { + hid_err(hid, "no inputs found\n"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-444-ALSA-hda-hdmi-Register-with-vga_switcheroo-on-D.patch b/patches.kernel.org/6.2.3-444-ALSA-hda-hdmi-Register-with-vga_switcheroo-on-D.patch new file mode 100644 index 0000000..471550a --- /dev/null +++ b/patches.kernel.org/6.2.3-444-ALSA-hda-hdmi-Register-with-vga_switcheroo-on-D.patch @@ -0,0 +1,60 @@ +From: Orlando Chamberlain +Date: Thu, 16 Feb 2023 21:34:51 +1100 +Subject: [PATCH] ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU + Macbooks +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5beb5627a2481aade9aa630b7ebb7f99442321b6 + +[ Upstream commit 5beb5627a2481aade9aa630b7ebb7f99442321b6 ] + +Commit 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for +AMD") caused only AMD gpu's with PX to have their audio component register +with vga_switcheroo. This meant that Apple Macbooks with apple-gmux as the +gpu switcher no longer had the audio client registering, so when the gpu is +powered off by vga_switcheroo snd_hda_intel is unaware that it should have +suspended the device: + +amdgpu: switched off +snd_hda_intel 0000:03:00.1: + Unable to change power state from D3hot to D0, device inaccessible +snd_hda_intel 0000:03:00.1: CORB reset timeout#2, CORBRP = 65535 + +To resolve this, we use apple_gmux_detect() and register a +vga_switcheroo audio client when apple-gmux is detected. + +Fixes: 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD") +Link: https://lore.kernel.org/all/20230210044826.9834-9-orlandoch.dev@gmail.com/ +Signed-off-by: Orlando Chamberlain +Link: https://lore.kernel.org/r/20230216103450.12925-1-orlandoch.dev@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/hda_intel.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 2dbc0820..81c4a452 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -50,6 +50,7 @@ + #include + #include + #include ++#include + #include + #include + #include "hda_controller.h" +@@ -1466,7 +1467,7 @@ static struct pci_dev *get_bound_vga(struct pci_dev *pci) + * vgaswitcheroo. + */ + if (((p->class >> 16) == PCI_BASE_CLASS_DISPLAY) && +- atpx_present()) ++ (atpx_present() || apple_gmux_detect(NULL, NULL))) + return p; + pci_dev_put(p); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-445-drm-shmem-helper-Fix-locking-for-drm_gem_shmem_.patch b/patches.kernel.org/6.2.3-445-drm-shmem-helper-Fix-locking-for-drm_gem_shmem_.patch new file mode 100644 index 0000000..ea9966b --- /dev/null +++ b/patches.kernel.org/6.2.3-445-drm-shmem-helper-Fix-locking-for-drm_gem_shmem_.patch @@ -0,0 +1,114 @@ +From: Asahi Lina +Date: Sun, 5 Feb 2023 21:51:24 +0900 +Subject: [PATCH] drm/shmem-helper: Fix locking for + drm_gem_shmem_get_pages_sgt() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ddddedaa0db99481c5e5abe628ad54f65e8765bc + +[ Upstream commit ddddedaa0db99481c5e5abe628ad54f65e8765bc ] + +Other functions touching shmem->sgt take the pages lock, so do that here +too. drm_gem_shmem_get_pages() & co take the same lock, so move to the +_locked() variants to avoid recursive locking. + +Discovered while auditing locking to write the Rust abstractions. + +Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects") +Fixes: 4fa3d66f132b ("drm/shmem: Do dma_unmap_sg before purging pages") +Signed-off-by: Asahi Lina +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20230205125124.2260-1-lina@asahilina.net +(cherry picked from commit aa8c85affe3facd3842c8912186623415931cc72) +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_gem_shmem_helper.c | 54 ++++++++++++++++---------- + 1 file changed, 34 insertions(+), 20 deletions(-) + +diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c +index b602cd72..2c559b31 100644 +--- a/drivers/gpu/drm/drm_gem_shmem_helper.c ++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c +@@ -681,23 +681,7 @@ struct sg_table *drm_gem_shmem_get_sg_table(struct drm_gem_shmem_object *shmem) + } + EXPORT_SYMBOL_GPL(drm_gem_shmem_get_sg_table); + +-/** +- * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a +- * scatter/gather table for a shmem GEM object. +- * @shmem: shmem GEM object +- * +- * This function returns a scatter/gather table suitable for driver usage. If +- * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg +- * table created. +- * +- * This is the main function for drivers to get at backing storage, and it hides +- * and difference between dma-buf imported and natively allocated objects. +- * drm_gem_shmem_get_sg_table() should not be directly called by drivers. +- * +- * Returns: +- * A pointer to the scatter/gather table of pinned pages or errno on failure. +- */ +-struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) ++static struct sg_table *drm_gem_shmem_get_pages_sgt_locked(struct drm_gem_shmem_object *shmem) + { + struct drm_gem_object *obj = &shmem->base; + int ret; +@@ -708,7 +692,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) + + WARN_ON(obj->import_attach); + +- ret = drm_gem_shmem_get_pages(shmem); ++ ret = drm_gem_shmem_get_pages_locked(shmem); + if (ret) + return ERR_PTR(ret); + +@@ -730,10 +714,40 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) + sg_free_table(sgt); + kfree(sgt); + err_put_pages: +- drm_gem_shmem_put_pages(shmem); ++ drm_gem_shmem_put_pages_locked(shmem); + return ERR_PTR(ret); + } +-EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt); ++ ++/** ++ * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a ++ * scatter/gather table for a shmem GEM object. ++ * @shmem: shmem GEM object ++ * ++ * This function returns a scatter/gather table suitable for driver usage. If ++ * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg ++ * table created. ++ * ++ * This is the main function for drivers to get at backing storage, and it hides ++ * and difference between dma-buf imported and natively allocated objects. ++ * drm_gem_shmem_get_sg_table() should not be directly called by drivers. ++ * ++ * Returns: ++ * A pointer to the scatter/gather table of pinned pages or errno on failure. ++ */ ++struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) ++{ ++ int ret; ++ struct sg_table *sgt; ++ ++ ret = mutex_lock_interruptible(&shmem->pages_lock); ++ if (ret) ++ return ERR_PTR(ret); ++ sgt = drm_gem_shmem_get_pages_sgt_locked(shmem); ++ mutex_unlock(&shmem->pages_lock); ++ ++ return sgt; ++} ++EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt); + + /** + * drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-446-NFSD-enhance-inter-server-copy-cleanup.patch b/patches.kernel.org/6.2.3-446-NFSD-enhance-inter-server-copy-cleanup.patch new file mode 100644 index 0000000..0103429 --- /dev/null +++ b/patches.kernel.org/6.2.3-446-NFSD-enhance-inter-server-copy-cleanup.patch @@ -0,0 +1,346 @@ +From: Dai Ngo +Date: Sun, 18 Dec 2022 16:55:53 -0800 +Subject: [PATCH] NFSD: enhance inter-server copy cleanup +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: df24ac7a2e3a9d0bc68f1756a880e50bfe4b4522 + +[ Upstream commit df24ac7a2e3a9d0bc68f1756a880e50bfe4b4522 ] + +Currently nfsd4_setup_inter_ssc returns the vfsmount of the source +server's export when the mount completes. After the copy is done +nfsd4_cleanup_inter_ssc is called with the vfsmount of the source +server and it searches nfsd_ssc_mount_list for a matching entry +to do the clean up. + +The problems with this approach are (1) the need to search the +nfsd_ssc_mount_list and (2) the code has to handle the case where +the matching entry is not found which looks ugly. + +The enhancement is instead of nfsd4_setup_inter_ssc returning the +vfsmount, it returns the nfsd4_ssc_umount_item which has the +vfsmount embedded in it. When nfsd4_cleanup_inter_ssc is called +it's passed with the nfsd4_ssc_umount_item directly to do the +clean up so no searching is needed and there is no need to handle +the 'not found' case. + +Signed-off-by: Dai Ngo +Signed-off-by: Chuck Lever +[ cel: adjusted whitespace and variable/function names ] +Reviewed-by: Olga Kornievskaia +Stable-dep-of: 34e8f9ec4c9a ("NFSD: fix leaked reference count of nfsd4_ssc_umount_item") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4proc.c | 111 ++++++++++++++++------------------------ + fs/nfsd/xdr4.h | 2 +- + include/linux/nfs_ssc.h | 2 +- + 3 files changed, 46 insertions(+), 69 deletions(-) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index f189ba79..dbaf3339 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1293,15 +1293,15 @@ extern void nfs_sb_deactive(struct super_block *sb); + * setup a work entry in the ssc delayed unmount list. + */ + static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, +- struct nfsd4_ssc_umount_item **retwork, struct vfsmount **ss_mnt) ++ struct nfsd4_ssc_umount_item **nsui) + { + struct nfsd4_ssc_umount_item *ni = NULL; + struct nfsd4_ssc_umount_item *work = NULL; + struct nfsd4_ssc_umount_item *tmp; + DEFINE_WAIT(wait); ++ __be32 status = 0; + +- *ss_mnt = NULL; +- *retwork = NULL; ++ *nsui = NULL; + work = kzalloc(sizeof(*work), GFP_KERNEL); + try_again: + spin_lock(&nn->nfsd_ssc_lock); +@@ -1325,12 +1325,12 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, + finish_wait(&nn->nfsd_ssc_waitq, &wait); + goto try_again; + } +- *ss_mnt = ni->nsui_vfsmount; ++ *nsui = ni; + refcount_inc(&ni->nsui_refcnt); + spin_unlock(&nn->nfsd_ssc_lock); + kfree(work); + +- /* return vfsmount in ss_mnt */ ++ /* return vfsmount in (*nsui)->nsui_vfsmount */ + return 0; + } + if (work) { +@@ -1338,31 +1338,32 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, + refcount_set(&work->nsui_refcnt, 2); + work->nsui_busy = true; + list_add_tail(&work->nsui_list, &nn->nfsd_ssc_mount_list); +- *retwork = work; +- } ++ *nsui = work; ++ } else ++ status = nfserr_resource; + spin_unlock(&nn->nfsd_ssc_lock); +- return 0; ++ return status; + } + +-static void nfsd4_ssc_update_dul_work(struct nfsd_net *nn, +- struct nfsd4_ssc_umount_item *work, struct vfsmount *ss_mnt) ++static void nfsd4_ssc_update_dul(struct nfsd_net *nn, ++ struct nfsd4_ssc_umount_item *nsui, ++ struct vfsmount *ss_mnt) + { +- /* set nsui_vfsmount, clear busy flag and wakeup waiters */ + spin_lock(&nn->nfsd_ssc_lock); +- work->nsui_vfsmount = ss_mnt; +- work->nsui_busy = false; ++ nsui->nsui_vfsmount = ss_mnt; ++ nsui->nsui_busy = false; + wake_up_all(&nn->nfsd_ssc_waitq); + spin_unlock(&nn->nfsd_ssc_lock); + } + +-static void nfsd4_ssc_cancel_dul_work(struct nfsd_net *nn, +- struct nfsd4_ssc_umount_item *work) ++static void nfsd4_ssc_cancel_dul(struct nfsd_net *nn, ++ struct nfsd4_ssc_umount_item *nsui) + { + spin_lock(&nn->nfsd_ssc_lock); +- list_del(&work->nsui_list); ++ list_del(&nsui->nsui_list); + wake_up_all(&nn->nfsd_ssc_waitq); + spin_unlock(&nn->nfsd_ssc_lock); +- kfree(work); ++ kfree(nsui); + } + + /* +@@ -1370,7 +1371,7 @@ static void nfsd4_ssc_cancel_dul_work(struct nfsd_net *nn, + */ + static __be32 + nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, +- struct vfsmount **mount) ++ struct nfsd4_ssc_umount_item **nsui) + { + struct file_system_type *type; + struct vfsmount *ss_mnt; +@@ -1381,7 +1382,6 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, + char *ipaddr, *dev_name, *raw_data; + int len, raw_len; + __be32 status = nfserr_inval; +- struct nfsd4_ssc_umount_item *work = NULL; + struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); + + naddr = &nss->u.nl4_addr; +@@ -1389,6 +1389,7 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, + naddr->addr_len, + (struct sockaddr *)&tmp_addr, + sizeof(tmp_addr)); ++ *nsui = NULL; + if (tmp_addrlen == 0) + goto out_err; + +@@ -1431,10 +1432,10 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, + goto out_free_rawdata; + snprintf(dev_name, len + 5, "%s%s%s:/", startsep, ipaddr, endsep); + +- status = nfsd4_ssc_setup_dul(nn, ipaddr, &work, &ss_mnt); ++ status = nfsd4_ssc_setup_dul(nn, ipaddr, nsui); + if (status) + goto out_free_devname; +- if (ss_mnt) ++ if ((*nsui)->nsui_vfsmount) + goto out_done; + + /* Use an 'internal' mount: SB_KERNMOUNT -> MNT_INTERNAL */ +@@ -1442,15 +1443,12 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, + module_put(type->owner); + if (IS_ERR(ss_mnt)) { + status = nfserr_nodev; +- if (work) +- nfsd4_ssc_cancel_dul_work(nn, work); ++ nfsd4_ssc_cancel_dul(nn, *nsui); + goto out_free_devname; + } +- if (work) +- nfsd4_ssc_update_dul_work(nn, work, ss_mnt); ++ nfsd4_ssc_update_dul(nn, *nsui, ss_mnt); + out_done: + status = 0; +- *mount = ss_mnt; + + out_free_devname: + kfree(dev_name); +@@ -1474,7 +1472,7 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, + static __be32 + nfsd4_setup_inter_ssc(struct svc_rqst *rqstp, + struct nfsd4_compound_state *cstate, +- struct nfsd4_copy *copy, struct vfsmount **mount) ++ struct nfsd4_copy *copy) + { + struct svc_fh *s_fh = NULL; + stateid_t *s_stid = ©->cp_src_stateid; +@@ -1487,7 +1485,7 @@ nfsd4_setup_inter_ssc(struct svc_rqst *rqstp, + if (status) + goto out; + +- status = nfsd4_interssc_connect(copy->cp_src, rqstp, mount); ++ status = nfsd4_interssc_connect(copy->cp_src, rqstp, ©->ss_nsui); + if (status) + goto out; + +@@ -1505,45 +1503,27 @@ nfsd4_setup_inter_ssc(struct svc_rqst *rqstp, + } + + static void +-nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp, ++nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp, + struct nfsd_file *dst) + { +- bool found = false; +- long timeout; +- struct nfsd4_ssc_umount_item *tmp; +- struct nfsd4_ssc_umount_item *ni = NULL; + struct nfsd_net *nn = net_generic(dst->nf_net, nfsd_net_id); ++ long timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout); + + nfs42_ssc_close(filp); + nfsd_file_put(dst); + fput(filp); + +- if (!nn) { +- mntput(ss_mnt); +- return; +- } + spin_lock(&nn->nfsd_ssc_lock); +- timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout); +- list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) { +- if (ni->nsui_vfsmount->mnt_sb == ss_mnt->mnt_sb) { +- list_del(&ni->nsui_list); +- /* +- * vfsmount can be shared by multiple exports, +- * decrement refcnt. If the count drops to 1 it +- * will be unmounted when nsui_expire expires. +- */ +- refcount_dec(&ni->nsui_refcnt); +- ni->nsui_expire = jiffies + timeout; +- list_add_tail(&ni->nsui_list, &nn->nfsd_ssc_mount_list); +- found = true; +- break; +- } +- } ++ list_del(&nsui->nsui_list); ++ /* ++ * vfsmount can be shared by multiple exports, ++ * decrement refcnt. If the count drops to 1 it ++ * will be unmounted when nsui_expire expires. ++ */ ++ refcount_dec(&nsui->nsui_refcnt); ++ nsui->nsui_expire = jiffies + timeout; ++ list_add_tail(&nsui->nsui_list, &nn->nfsd_ssc_mount_list); + spin_unlock(&nn->nfsd_ssc_lock); +- if (!found) { +- mntput(ss_mnt); +- return; +- } + } + + #else /* CONFIG_NFSD_V4_2_INTER_SSC */ +@@ -1551,15 +1531,13 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp, + static __be32 + nfsd4_setup_inter_ssc(struct svc_rqst *rqstp, + struct nfsd4_compound_state *cstate, +- struct nfsd4_copy *copy, +- struct vfsmount **mount) ++ struct nfsd4_copy *copy) + { +- *mount = NULL; + return nfserr_inval; + } + + static void +-nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp, ++nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp, + struct nfsd_file *dst) + { + } +@@ -1700,7 +1678,7 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) + memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server)); + memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); + memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); +- dst->ss_mnt = src->ss_mnt; ++ dst->ss_nsui = src->ss_nsui; + } + + static void cleanup_async_copy(struct nfsd4_copy *copy) +@@ -1749,8 +1727,8 @@ static int nfsd4_do_async_copy(void *data) + if (nfsd4_ssc_is_inter(copy)) { + struct file *filp; + +- filp = nfs42_ssc_open(copy->ss_mnt, ©->c_fh, +- ©->stateid); ++ filp = nfs42_ssc_open(copy->ss_nsui->nsui_vfsmount, ++ ©->c_fh, ©->stateid); + if (IS_ERR(filp)) { + switch (PTR_ERR(filp)) { + case -EBADF: +@@ -1764,7 +1742,7 @@ static int nfsd4_do_async_copy(void *data) + } + nfserr = nfsd4_do_copy(copy, filp, copy->nf_dst->nf_file, + false); +- nfsd4_cleanup_inter_ssc(copy->ss_mnt, filp, copy->nf_dst); ++ nfsd4_cleanup_inter_ssc(copy->ss_nsui, filp, copy->nf_dst); + } else { + nfserr = nfsd4_do_copy(copy, copy->nf_src->nf_file, + copy->nf_dst->nf_file, false); +@@ -1790,8 +1768,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + status = nfserr_notsupp; + goto out; + } +- status = nfsd4_setup_inter_ssc(rqstp, cstate, copy, +- ©->ss_mnt); ++ status = nfsd4_setup_inter_ssc(rqstp, cstate, copy); + if (status) + return nfserr_offload_denied; + } else { +diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h +index 4fd2cf6d..510978e6 100644 +--- a/fs/nfsd/xdr4.h ++++ b/fs/nfsd/xdr4.h +@@ -571,7 +571,7 @@ struct nfsd4_copy { + struct task_struct *copy_task; + refcount_t refcount; + +- struct vfsmount *ss_mnt; ++ struct nfsd4_ssc_umount_item *ss_nsui; + struct nfs_fh c_fh; + nfs4_stateid stateid; + }; +diff --git a/include/linux/nfs_ssc.h b/include/linux/nfs_ssc.h +index 75843c00..22265b1f 100644 +--- a/include/linux/nfs_ssc.h ++++ b/include/linux/nfs_ssc.h +@@ -53,6 +53,7 @@ static inline void nfs42_ssc_close(struct file *filep) + if (nfs_ssc_client_tbl.ssc_nfs4_ops) + (*nfs_ssc_client_tbl.ssc_nfs4_ops->sco_close)(filep); + } ++#endif + + struct nfsd4_ssc_umount_item { + struct list_head nsui_list; +@@ -66,7 +67,6 @@ struct nfsd4_ssc_umount_item { + struct vfsmount *nsui_vfsmount; + char nsui_ipaddr[RPC_MAX_ADDRBUFLEN + 1]; + }; +-#endif + + /* + * NFS_FS +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-447-NFSD-fix-leaked-reference-count-of-nfsd4_ssc_um.patch b/patches.kernel.org/6.2.3-447-NFSD-fix-leaked-reference-count-of-nfsd4_ssc_um.patch new file mode 100644 index 0000000..b49947c --- /dev/null +++ b/patches.kernel.org/6.2.3-447-NFSD-fix-leaked-reference-count-of-nfsd4_ssc_um.patch @@ -0,0 +1,55 @@ +From: Dai Ngo +Date: Mon, 23 Jan 2023 21:34:13 -0800 +Subject: [PATCH] NFSD: fix leaked reference count of nfsd4_ssc_umount_item +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 34e8f9ec4c9ac235f917747b23a200a5e0ec857b + +[ Upstream commit 34e8f9ec4c9ac235f917747b23a200a5e0ec857b ] + +The reference count of nfsd4_ssc_umount_item is not decremented +on error conditions. This prevents the laundromat from unmounting +the vfsmount of the source file. + +This patch decrements the reference count of nfsd4_ssc_umount_item +on error. + +Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.") +Signed-off-by: Dai Ngo +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4proc.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index dbaf3339..e2dde8a1 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1814,13 +1814,17 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + out: + return status; + out_err: ++ if (nfsd4_ssc_is_inter(copy)) { ++ /* ++ * Source's vfsmount of inter-copy will be unmounted ++ * by the laundromat. Use copy instead of async_copy ++ * since async_copy->ss_nsui might not be set yet. ++ */ ++ refcount_dec(©->ss_nsui->nsui_refcnt); ++ } + if (async_copy) + cleanup_async_copy(async_copy); + status = nfserrno(-ENOMEM); +- /* +- * source's vfsmount of inter-copy will be unmounted +- * by the laundromat +- */ + goto out; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-448-nfsd-fix-race-to-check-ls_layouts.patch b/patches.kernel.org/6.2.3-448-nfsd-fix-race-to-check-ls_layouts.patch new file mode 100644 index 0000000..a83b43a --- /dev/null +++ b/patches.kernel.org/6.2.3-448-nfsd-fix-race-to-check-ls_layouts.patch @@ -0,0 +1,47 @@ +From: Benjamin Coddington +Date: Fri, 27 Jan 2023 11:18:56 -0500 +Subject: [PATCH] nfsd: fix race to check ls_layouts +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fb610c4dbc996415d57d7090957ecddd4fd64fb6 + +[ Upstream commit fb610c4dbc996415d57d7090957ecddd4fd64fb6 ] + +Its possible for __break_lease to find the layout's lease before we've +added the layout to the owner's ls_layouts list. In that case, setting +ls_recalled = true without actually recalling the layout will cause the +server to never send a recall callback. + +Move the check for ls_layouts before setting ls_recalled. + +Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") +Signed-off-by: Benjamin Coddington +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4layouts.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c +index 3564d1c6..e8a80052 100644 +--- a/fs/nfsd/nfs4layouts.c ++++ b/fs/nfsd/nfs4layouts.c +@@ -323,11 +323,11 @@ nfsd4_recall_file_layout(struct nfs4_layout_stateid *ls) + if (ls->ls_recalled) + goto out_unlock; + +- ls->ls_recalled = true; +- atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls); + if (list_empty(&ls->ls_layouts)) + goto out_unlock; + ++ ls->ls_recalled = true; ++ atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls); + trace_nfsd_layout_recall(&ls->ls_stid.sc_stateid); + + refcount_inc(&ls->ls_stid.sc_count); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-449-nfsd-clean-up-potential-nfsd_file-refcount-leak.patch b/patches.kernel.org/6.2.3-449-nfsd-clean-up-potential-nfsd_file-refcount-leak.patch new file mode 100644 index 0000000..00ad4ea --- /dev/null +++ b/patches.kernel.org/6.2.3-449-nfsd-clean-up-potential-nfsd_file-refcount-leak.patch @@ -0,0 +1,111 @@ +From: Jeff Layton +Date: Tue, 17 Jan 2023 14:38:31 -0500 +Subject: [PATCH] nfsd: clean up potential nfsd_file refcount leaks in COPY + codepath +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f + +[ Upstream commit 6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f ] + +There are two different flavors of the nfsd4_copy struct. One is +embedded in the compound and is used directly in synchronous copies. The +other is dynamically allocated, refcounted and tracked in the client +struture. For the embedded one, the cleanup just involves releasing any +nfsd_files held on its behalf. For the async one, the cleanup is a bit +more involved, and we need to dequeue it from lists, unhash it, etc. + +There is at least one potential refcount leak in this code now. If the +kthread_create call fails, then both the src and dst nfsd_files in the +original nfsd4_copy object are leaked. + +The cleanup in this codepath is also sort of weird. In the async copy +case, we'll have up to four nfsd_file references (src and dst for both +flavors of copy structure). They are both put at the end of +nfsd4_do_async_copy, even though the ones held on behalf of the embedded +one outlive that structure. + +Change it so that we always clean up the nfsd_file refs held by the +embedded copy structure before nfsd4_copy returns. Rework +cleanup_async_copy to handle both inter and intra copies. Eliminate +nfsd4_cleanup_intra_ssc since it now becomes a no-op. + +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Stable-dep-of: 81e722978ad2 ("NFSD: fix problems with cleanup on errors in nfsd4_copy") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4proc.c | 23 ++++++++++------------- + 1 file changed, 10 insertions(+), 13 deletions(-) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index e2dde8a1..b74cbc9a 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1510,7 +1510,6 @@ nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp, + long timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout); + + nfs42_ssc_close(filp); +- nfsd_file_put(dst); + fput(filp); + + spin_lock(&nn->nfsd_ssc_lock); +@@ -1560,13 +1559,6 @@ nfsd4_setup_intra_ssc(struct svc_rqst *rqstp, + ©->nf_dst); + } + +-static void +-nfsd4_cleanup_intra_ssc(struct nfsd_file *src, struct nfsd_file *dst) +-{ +- nfsd_file_put(src); +- nfsd_file_put(dst); +-} +- + static void nfsd4_cb_offload_release(struct nfsd4_callback *cb) + { + struct nfsd4_cb_offload *cbo = +@@ -1681,12 +1673,18 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) + dst->ss_nsui = src->ss_nsui; + } + ++static void release_copy_files(struct nfsd4_copy *copy) ++{ ++ if (copy->nf_src) ++ nfsd_file_put(copy->nf_src); ++ if (copy->nf_dst) ++ nfsd_file_put(copy->nf_dst); ++} ++ + static void cleanup_async_copy(struct nfsd4_copy *copy) + { + nfs4_free_copy_state(copy); +- nfsd_file_put(copy->nf_dst); +- if (!nfsd4_ssc_is_inter(copy)) +- nfsd_file_put(copy->nf_src); ++ release_copy_files(copy); + spin_lock(©->cp_clp->async_lock); + list_del(©->copies); + spin_unlock(©->cp_clp->async_lock); +@@ -1746,7 +1744,6 @@ static int nfsd4_do_async_copy(void *data) + } else { + nfserr = nfsd4_do_copy(copy, copy->nf_src->nf_file, + copy->nf_dst->nf_file, false); +- nfsd4_cleanup_intra_ssc(copy->nf_src, copy->nf_dst); + } + + do_callback: +@@ -1809,9 +1806,9 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + } else { + status = nfsd4_do_copy(copy, copy->nf_src->nf_file, + copy->nf_dst->nf_file, true); +- nfsd4_cleanup_intra_ssc(copy->nf_src, copy->nf_dst); + } + out: ++ release_copy_files(copy); + return status; + out_err: + if (nfsd4_ssc_is_inter(copy)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-450-NFSD-fix-problems-with-cleanup-on-errors-in-nfs.patch b/patches.kernel.org/6.2.3-450-NFSD-fix-problems-with-cleanup-on-errors-in-nfs.patch new file mode 100644 index 0000000..3a9bad2 --- /dev/null +++ b/patches.kernel.org/6.2.3-450-NFSD-fix-problems-with-cleanup-on-errors-in-nfs.patch @@ -0,0 +1,98 @@ +From: Dai Ngo +Date: Tue, 31 Jan 2023 11:12:29 -0800 +Subject: [PATCH] NFSD: fix problems with cleanup on errors in nfsd4_copy +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 81e722978ad21072470b73d8f6a50ad62c7d5b7d + +[ Upstream commit 81e722978ad21072470b73d8f6a50ad62c7d5b7d ] + +When nfsd4_copy fails to allocate memory for async_copy->cp_src, or +nfs4_init_copy_state fails, it calls cleanup_async_copy to do the +cleanup for the async_copy which causes page fault since async_copy +is not yet initialized. + +This patche rearranges the order of initializing the fields in +async_copy and adds checks in cleanup_async_copy to skip un-initialized +fields. + +Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy") +Fixes: 87689df69491 ("NFSD: Shrink size of struct nfsd4_copy") +Signed-off-by: Dai Ngo +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4proc.c | 12 ++++++++---- + fs/nfsd/nfs4state.c | 5 +++-- + 2 files changed, 11 insertions(+), 6 deletions(-) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index b74cbc9a..92674077 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1685,9 +1685,12 @@ static void cleanup_async_copy(struct nfsd4_copy *copy) + { + nfs4_free_copy_state(copy); + release_copy_files(copy); +- spin_lock(©->cp_clp->async_lock); +- list_del(©->copies); +- spin_unlock(©->cp_clp->async_lock); ++ if (copy->cp_clp) { ++ spin_lock(©->cp_clp->async_lock); ++ if (!list_empty(©->copies)) ++ list_del_init(©->copies); ++ spin_unlock(©->cp_clp->async_lock); ++ } + nfs4_put_copy(copy); + } + +@@ -1784,12 +1787,13 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + if (!async_copy) + goto out_err; ++ INIT_LIST_HEAD(&async_copy->copies); ++ refcount_set(&async_copy->refcount, 1); + async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); + if (!async_copy->cp_src) + goto out_err; + if (!nfs4_init_copy_state(nn, copy)) + goto out_err; +- refcount_set(&async_copy->refcount, 1); + memcpy(©->cp_res.cb_stateid, ©->cp_stateid.cs_stid, + sizeof(copy->cp_res.cb_stateid)); + dup_copy_fields(copy, async_copy); +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index c69f27d3..529de327 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -992,7 +992,6 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, + + stid->cs_stid.si_opaque.so_clid.cl_boot = (u32)nn->boot_time; + stid->cs_stid.si_opaque.so_clid.cl_id = nn->s2s_cp_cl_id; +- stid->cs_type = cs_type; + + idr_preload(GFP_KERNEL); + spin_lock(&nn->s2s_cp_lock); +@@ -1003,6 +1002,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, + idr_preload_end(); + if (new_id < 0) + return 0; ++ stid->cs_type = cs_type; + return 1; + } + +@@ -1036,7 +1036,8 @@ void nfs4_free_copy_state(struct nfsd4_copy *copy) + { + struct nfsd_net *nn; + +- WARN_ON_ONCE(copy->cp_stateid.cs_type != NFS4_COPY_STID); ++ if (copy->cp_stateid.cs_type != NFS4_COPY_STID) ++ return; + nn = net_generic(copy->cp_clp->net, nfsd_net_id); + spin_lock(&nn->s2s_cp_lock); + idr_remove(&nn->s2s_cp_stateids, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-451-nfsd-fix-courtesy-client-with-deny-mode-handlin.patch b/patches.kernel.org/6.2.3-451-nfsd-fix-courtesy-client-with-deny-mode-handlin.patch new file mode 100644 index 0000000..088e0e4 --- /dev/null +++ b/patches.kernel.org/6.2.3-451-nfsd-fix-courtesy-client-with-deny-mode-handlin.patch @@ -0,0 +1,63 @@ +From: Jeff Layton +Date: Fri, 3 Feb 2023 13:18:34 -0500 +Subject: [PATCH] nfsd: fix courtesy client with deny mode handling in + nfs4_upgrade_open +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dcd779dc46540e174a6ac8d52fbed23593407317 + +[ Upstream commit dcd779dc46540e174a6ac8d52fbed23593407317 ] + +The nested if statements here make no sense, as you can never reach +"else" branch in the nested statement. Fix the error handling for +when there is a courtesy client that holds a conflicting deny mode. + +Fixes: 3d6942715180 ("NFSD: add support for share reservation conflict to courteous server") +Reported-by: 張智諺 +Signed-off-by: Jeff Layton +Reviewed-by: Dai Ngo +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4state.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 529de327..104c2582 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -5299,16 +5299,17 @@ nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, + /* test and set deny mode */ + spin_lock(&fp->fi_lock); + status = nfs4_file_check_deny(fp, open->op_share_deny); +- if (status == nfs_ok) { +- if (status != nfserr_share_denied) { +- set_deny(open->op_share_deny, stp); +- fp->fi_share_deny |= +- (open->op_share_deny & NFS4_SHARE_DENY_BOTH); +- } else { +- if (nfs4_resolve_deny_conflicts_locked(fp, false, +- stp, open->op_share_deny, false)) +- status = nfserr_jukebox; +- } ++ switch (status) { ++ case nfs_ok: ++ set_deny(open->op_share_deny, stp); ++ fp->fi_share_deny |= ++ (open->op_share_deny & NFS4_SHARE_DENY_BOTH); ++ break; ++ case nfserr_share_denied: ++ if (nfs4_resolve_deny_conflicts_locked(fp, false, ++ stp, open->op_share_deny, false)) ++ status = nfserr_jukebox; ++ break; + } + spin_unlock(&fp->fi_lock); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-452-nfsd-don-t-fsync-nfsd_files-on-last-close.patch b/patches.kernel.org/6.2.3-452-nfsd-don-t-fsync-nfsd_files-on-last-close.patch new file mode 100644 index 0000000..fd25c61 --- /dev/null +++ b/patches.kernel.org/6.2.3-452-nfsd-don-t-fsync-nfsd_files-on-last-close.patch @@ -0,0 +1,177 @@ +From: Jeff Layton +Date: Tue, 7 Feb 2023 12:02:46 -0500 +Subject: [PATCH] nfsd: don't fsync nfsd_files on last close +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4c475eee02375ade6e864f1db16976ba0d96a0a2 + +[ Upstream commit 4c475eee02375ade6e864f1db16976ba0d96a0a2 ] + +Most of the time, NFSv4 clients issue a COMMIT before the final CLOSE of +an open stateid, so with NFSv4, the fsync in the nfsd_file_free path is +usually a no-op and doesn't block. + +We have a customer running knfsd over very slow storage (XFS over Ceph +RBD). They were using the "async" export option because performance was +more important than data integrity for this application. That export +option turns NFSv4 COMMIT calls into no-ops. Due to the fsync in this +codepath however, their final CLOSE calls would still stall (since a +CLOSE effectively became a COMMIT). + +I think this fsync is not strictly necessary. We only use that result to +reset the write verifier. Instead of fsync'ing all of the data when we +free an nfsd_file, we can just check for writeback errors when one is +acquired and when it is freed. + +If the client never comes back, then it'll never see the error anyway +and there is no point in resetting it. If an error occurs after the +nfsd_file is removed from the cache but before the inode is evicted, +then it will reset the write verifier on the next nfsd_file_acquire, +(since there will be an unseen error). + +The only exception here is if something else opens and fsyncs the file +during that window. Given that local applications work with this +limitation today, I don't see that as an issue. + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2166658 +Fixes: ac3a2585f018 ("nfsd: rework refcounting in filecache") +Reported-and-tested-by: Pierguido Lambri +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/filecache.c | 44 ++++++++++++-------------------------------- + fs/nfsd/trace.h | 31 ------------------------------- + 2 files changed, 12 insertions(+), 63 deletions(-) + +diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c +index c0950edb..697acf5c 100644 +--- a/fs/nfsd/filecache.c ++++ b/fs/nfsd/filecache.c +@@ -331,37 +331,27 @@ nfsd_file_alloc(struct nfsd_file_lookup_key *key, unsigned int may) + return nf; + } + ++/** ++ * nfsd_file_check_write_error - check for writeback errors on a file ++ * @nf: nfsd_file to check for writeback errors ++ * ++ * Check whether a nfsd_file has an unseen error. Reset the write ++ * verifier if so. ++ */ + static void +-nfsd_file_fsync(struct nfsd_file *nf) +-{ +- struct file *file = nf->nf_file; +- int ret; +- +- if (!file || !(file->f_mode & FMODE_WRITE)) +- return; +- ret = vfs_fsync(file, 1); +- trace_nfsd_file_fsync(nf, ret); +- if (ret) +- nfsd_reset_write_verifier(net_generic(nf->nf_net, nfsd_net_id)); +-} +- +-static int + nfsd_file_check_write_error(struct nfsd_file *nf) + { + struct file *file = nf->nf_file; + +- if (!file || !(file->f_mode & FMODE_WRITE)) +- return 0; +- return filemap_check_wb_err(file->f_mapping, READ_ONCE(file->f_wb_err)); ++ if ((file->f_mode & FMODE_WRITE) && ++ filemap_check_wb_err(file->f_mapping, READ_ONCE(file->f_wb_err))) ++ nfsd_reset_write_verifier(net_generic(nf->nf_net, nfsd_net_id)); + } + + static void + nfsd_file_hash_remove(struct nfsd_file *nf) + { + trace_nfsd_file_unhash(nf); +- +- if (nfsd_file_check_write_error(nf)) +- nfsd_reset_write_verifier(net_generic(nf->nf_net, nfsd_net_id)); + rhashtable_remove_fast(&nfsd_file_rhash_tbl, &nf->nf_rhash, + nfsd_file_rhash_params); + } +@@ -387,23 +377,12 @@ nfsd_file_free(struct nfsd_file *nf) + this_cpu_add(nfsd_file_total_age, age); + + nfsd_file_unhash(nf); +- +- /* +- * We call fsync here in order to catch writeback errors. It's not +- * strictly required by the protocol, but an nfsd_file could get +- * evicted from the cache before a COMMIT comes in. If another +- * task were to open that file in the interim and scrape the error, +- * then the client may never see it. By calling fsync here, we ensure +- * that writeback happens before the entry is freed, and that any +- * errors reported result in the write verifier changing. +- */ +- nfsd_file_fsync(nf); +- + if (nf->nf_mark) + nfsd_file_mark_put(nf->nf_mark); + if (nf->nf_file) { + get_file(nf->nf_file); + filp_close(nf->nf_file, NULL); ++ nfsd_file_check_write_error(nf); + fput(nf->nf_file); + } + +@@ -1159,6 +1138,7 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp, + out: + if (status == nfs_ok) { + this_cpu_inc(nfsd_file_acquisitions); ++ nfsd_file_check_write_error(nf); + *pnf = nf; + } else { + if (refcount_dec_and_test(&nf->nf_ref)) +diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h +index 8f9c82d9..4183819e 100644 +--- a/fs/nfsd/trace.h ++++ b/fs/nfsd/trace.h +@@ -1202,37 +1202,6 @@ TRACE_EVENT(nfsd_file_close, + ) + ); + +-TRACE_EVENT(nfsd_file_fsync, +- TP_PROTO( +- const struct nfsd_file *nf, +- int ret +- ), +- TP_ARGS(nf, ret), +- TP_STRUCT__entry( +- __field(void *, nf_inode) +- __field(int, nf_ref) +- __field(int, ret) +- __field(unsigned long, nf_flags) +- __field(unsigned char, nf_may) +- __field(struct file *, nf_file) +- ), +- TP_fast_assign( +- __entry->nf_inode = nf->nf_inode; +- __entry->nf_ref = refcount_read(&nf->nf_ref); +- __entry->ret = ret; +- __entry->nf_flags = nf->nf_flags; +- __entry->nf_may = nf->nf_may; +- __entry->nf_file = nf->nf_file; +- ), +- TP_printk("inode=%p ref=%d flags=%s may=%s nf_file=%p ret=%d", +- __entry->nf_inode, +- __entry->nf_ref, +- show_nf_flags(__entry->nf_flags), +- show_nfsd_may_flags(__entry->nf_may), +- __entry->nf_file, __entry->ret +- ) +-); +- + #include "cache.h" + + TRACE_DEFINE_ENUM(RC_DROPIT); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-453-NFSD-copy-the-whole-verifier-in-nfsd_copy_write.patch b/patches.kernel.org/6.2.3-453-NFSD-copy-the-whole-verifier-in-nfsd_copy_write.patch new file mode 100644 index 0000000..710d349 --- /dev/null +++ b/patches.kernel.org/6.2.3-453-NFSD-copy-the-whole-verifier-in-nfsd_copy_write.patch @@ -0,0 +1,37 @@ +From: Chuck Lever +Date: Tue, 14 Feb 2023 10:07:59 -0500 +Subject: [PATCH] NFSD: copy the whole verifier in nfsd_copy_write_verifier +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 90d2175572470ba7f55da8447c72ddd4942923c4 + +[ Upstream commit 90d2175572470ba7f55da8447c72ddd4942923c4 ] + +Currently, we're only memcpy'ing the first __be32. Ensure we copy into +both words. + +Fixes: 91d2e9b56cf5 ("NFSD: Clean up the nfsd_net::nfssvc_boot field") +Reported-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfssvc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index 325d3d3f..a0ecec54 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -363,7 +363,7 @@ void nfsd_copy_write_verifier(__be32 verf[2], struct nfsd_net *nn) + + do { + read_seqbegin_or_lock(&nn->writeverf_lock, &seq); +- memcpy(verf, nn->writeverf, sizeof(*verf)); ++ memcpy(verf, nn->writeverf, sizeof(nn->writeverf)); + } while (need_seqretry(&nn->writeverf_lock, seq)); + done_seqretry(&nn->writeverf_lock, seq); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-454-cifs-Fix-lost-destroy-smbd-connection-when-MR-a.patch b/patches.kernel.org/6.2.3-454-cifs-Fix-lost-destroy-smbd-connection-when-MR-a.patch new file mode 100644 index 0000000..c79ec28 --- /dev/null +++ b/patches.kernel.org/6.2.3-454-cifs-Fix-lost-destroy-smbd-connection-when-MR-a.patch @@ -0,0 +1,44 @@ +From: Zhang Xiaoxu +Date: Fri, 18 Nov 2022 16:42:07 +0800 +Subject: [PATCH] cifs: Fix lost destroy smbd connection when MR allocate + failed +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e9d3401d95d62a9531082cd2453ed42f2740e3fd + +[ Upstream commit e9d3401d95d62a9531082cd2453ed42f2740e3fd ] + +If the MR allocate failed, the smb direct connection info is NULL, +then smbd_destroy() will directly return, then the connection info +will be leaked. + +Let's set the smb direct connection info to the server before call +smbd_destroy(). + +Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") +Signed-off-by: Zhang Xiaoxu +Acked-by: Paulo Alcantara (SUSE) +Reviewed-by: David Howells +Reviewed-by: Tom Talpey +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/smbdirect.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c +index 8c816b25c..101dab87 100644 +--- a/fs/cifs/smbdirect.c ++++ b/fs/cifs/smbdirect.c +@@ -1700,6 +1700,7 @@ static struct smbd_connection *_smbd_get_connection( + + allocate_mr_failed: + /* At this point, need to a full transport shutdown */ ++ server->smbd_conn = info; + smbd_destroy(server); + return NULL; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-455-cifs-Fix-warning-and-UAF-when-destroy-the-MR-li.patch b/patches.kernel.org/6.2.3-455-cifs-Fix-warning-and-UAF-when-destroy-the-MR-li.patch new file mode 100644 index 0000000..2647945 --- /dev/null +++ b/patches.kernel.org/6.2.3-455-cifs-Fix-warning-and-UAF-when-destroy-the-MR-li.patch @@ -0,0 +1,134 @@ +From: Zhang Xiaoxu +Date: Fri, 18 Nov 2022 16:42:08 +0800 +Subject: [PATCH] cifs: Fix warning and UAF when destroy the MR list +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3e161c2791f8e661eed24a2c624087084d910215 + +[ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ] + +If the MR allocate failed, the MR recovery work not initialized +and list not cleared. Then will be warning and UAF when release +the MR: + + WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 + CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 + RIP: 0010:__flush_work.isra.0+0xf7/0x110 + Call Trace: + + __cancel_work_timer+0x2ba/0x2e0 + smbd_destroy+0x4e1/0x990 + _smbd_get_connection+0x1cbd/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 + Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 + CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 + Call Trace: + dump_stack_lvl+0x34/0x44 + print_report+0x171/0x472 + kasan_report+0xad/0x130 + smbd_destroy+0x4fc/0x990 + _smbd_get_connection+0x1cbd/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + Allocated by task 824: + kasan_save_stack+0x1e/0x40 + kasan_set_track+0x21/0x30 + __kasan_kmalloc+0x7a/0x90 + _smbd_get_connection+0x1b6f/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + Freed by task 824: + kasan_save_stack+0x1e/0x40 + kasan_set_track+0x21/0x30 + kasan_save_free_info+0x2a/0x40 + ____kasan_slab_free+0x143/0x1b0 + __kmem_cache_free+0xc8/0x330 + _smbd_get_connection+0x1c6a/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Let's initialize the MR recovery work before MR allocate to prevent +the warning, remove the MRs from the list to prevent the UAF. + +Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") +Acked-by: Paulo Alcantara (SUSE) +Reviewed-by: Tom Talpey +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/smbdirect.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c +index 101dab87..cf923f21 100644 +--- a/fs/cifs/smbdirect.c ++++ b/fs/cifs/smbdirect.c +@@ -2218,6 +2218,7 @@ static int allocate_mr_list(struct smbd_connection *info) + atomic_set(&info->mr_ready_count, 0); + atomic_set(&info->mr_used_count, 0); + init_waitqueue_head(&info->wait_for_mr_cleanup); ++ INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); + /* Allocate more MRs (2x) than hardware responder_resources */ + for (i = 0; i < info->responder_resources * 2; i++) { + smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL); +@@ -2245,13 +2246,13 @@ static int allocate_mr_list(struct smbd_connection *info) + list_add_tail(&smbdirect_mr->list, &info->mr_list); + atomic_inc(&info->mr_ready_count); + } +- INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); + return 0; + + out: + kfree(smbdirect_mr); + + list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) { ++ list_del(&smbdirect_mr->list); + ib_dereg_mr(smbdirect_mr->mr); + kfree(smbdirect_mr->sgl); + kfree(smbdirect_mr); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-456-cifs-use-tcon-allocation-functions-even-for-dum.patch b/patches.kernel.org/6.2.3-456-cifs-use-tcon-allocation-functions-even-for-dum.patch new file mode 100644 index 0000000..024405c --- /dev/null +++ b/patches.kernel.org/6.2.3-456-cifs-use-tcon-allocation-functions-even-for-dum.patch @@ -0,0 +1,48 @@ +From: Shyam Prasad N +Date: Fri, 10 Feb 2023 16:34:31 +0000 +Subject: [PATCH] cifs: use tcon allocation functions even for dummy tcon +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: df57109bd50b9ed6911f3c2aa914189fe4c1fe2c + +[ Upstream commit df57109bd50b9ed6911f3c2aa914189fe4c1fe2c ] + +In smb2_reconnect_server, we allocate a dummy tcon for +calling reconnect for just the session. This should be +allocated using tconInfoAlloc, and not kmalloc. + +Fixes: 3663c9045f51 ("cifs: check reconnects for channels of active tcons too") +Signed-off-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2pdu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 2c9ffa92..3b93680a 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -3898,7 +3898,7 @@ void smb2_reconnect_server(struct work_struct *work) + goto done; + + /* allocate a dummy tcon struct used for reconnect */ +- tcon = kzalloc(sizeof(struct cifs_tcon), GFP_KERNEL); ++ tcon = tconInfoAlloc(); + if (!tcon) { + resched = true; + list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { +@@ -3921,7 +3921,7 @@ void smb2_reconnect_server(struct work_struct *work) + list_del_init(&ses->rlist); + cifs_put_smb_ses(ses); + } +- kfree(tcon); ++ tconInfoFree(tcon); + + done: + cifs_dbg(FYI, "Reconnecting tcons and channels finished\n"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-457-gfs2-jdata-writepage-fix.patch b/patches.kernel.org/6.2.3-457-gfs2-jdata-writepage-fix.patch new file mode 100644 index 0000000..3e1b8ba --- /dev/null +++ b/patches.kernel.org/6.2.3-457-gfs2-jdata-writepage-fix.patch @@ -0,0 +1,46 @@ +From: Andreas Gruenbacher +Date: Wed, 1 Feb 2023 15:08:50 +0100 +Subject: [PATCH] gfs2: jdata writepage fix +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cbb60951ce18c9b6e91d2eb97deb41d8ff616622 + +[ Upstream commit cbb60951ce18c9b6e91d2eb97deb41d8ff616622 ] + +The ->writepage() and ->writepages() operations are supposed to write +entire pages. However, on filesystems with a block size smaller than +PAGE_SIZE, __gfs2_jdata_writepage() only adds the first block to the +current transaction instead of adding the entire page. Fix that. + +Fixes: 18ec7d5c3f43 ("[GFS2] Make journaled data files identical to normal files on disk") +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/gfs2/aops.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c +index e782b4f1..2f04c0ff 100644 +--- a/fs/gfs2/aops.c ++++ b/fs/gfs2/aops.c +@@ -127,7 +127,6 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w + { + struct inode *inode = page->mapping->host; + struct gfs2_inode *ip = GFS2_I(inode); +- struct gfs2_sbd *sdp = GFS2_SB(inode); + + if (PageChecked(page)) { + ClearPageChecked(page); +@@ -135,7 +134,7 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w + create_empty_buffers(page, inode->i_sb->s_blocksize, + BIT(BH_Dirty)|BIT(BH_Uptodate)); + } +- gfs2_page_add_databufs(ip, page, 0, sdp->sd_vfs->s_blocksize); ++ gfs2_page_add_databufs(ip, page, 0, PAGE_SIZE); + } + return gfs2_write_jdata_page(page, wbc); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-458-perf-llvm-Fix-inadvertent-file-creation.patch b/patches.kernel.org/6.2.3-458-perf-llvm-Fix-inadvertent-file-creation.patch new file mode 100644 index 0000000..4153aa8 --- /dev/null +++ b/patches.kernel.org/6.2.3-458-perf-llvm-Fix-inadvertent-file-creation.patch @@ -0,0 +1,92 @@ +From: Ian Rogers +Date: Thu, 5 Jan 2023 00:26:09 -0800 +Subject: [PATCH] perf llvm: Fix inadvertent file creation +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9f19aab47ced012eddef1e2bc96007efc7713b61 + +[ Upstream commit 9f19aab47ced012eddef1e2bc96007efc7713b61 ] + +The LLVM template is first echo-ed into command_out and then +command_out executed. The echo surrounds the template with double +quotes, however, the template itself may contain quotes. This is +generally innocuous but in tools/perf/tests/bpf-script-test-prologue.c +we see: +... +SEC("func=null_lseek file->f_mode offset orig") +... +where the first double quote ends the double quote of the echo, then +the > redirects output into a file called f_mode. + +To avoid this inadvertent behavior substitute redirects and similar +characters to be ASCII control codes, then substitute the output in +the echo back again. + +Fixes: 5eab5a7ee032acaa ("perf llvm: Display eBPF compiling command in debug output") +Signed-off-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Andrii Nakryiko +Cc: bpf@vger.kernel.org +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: llvm@lists.linux.dev +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Peter Zijlstra +Cc: Tom Rix +Link: https://lore.kernel.org/r/20230105082609.344538-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/util/llvm-utils.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c +index 650ffe33..4e8e243a 100644 +--- a/tools/perf/util/llvm-utils.c ++++ b/tools/perf/util/llvm-utils.c +@@ -531,14 +531,37 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf, + + pr_debug("llvm compiling command template: %s\n", template); + ++ /* ++ * Below, substitute control characters for values that can cause the ++ * echo to misbehave, then substitute the values back. ++ */ + err = -ENOMEM; +- if (asprintf(&command_echo, "echo -n \"%s\"", template) < 0) ++ if (asprintf(&command_echo, "echo -n \a%s\a", template) < 0) + goto errout; + ++#define SWAP_CHAR(a, b) do { if (*p == a) *p = b; } while (0) ++ for (char *p = command_echo; *p; p++) { ++ SWAP_CHAR('<', '\001'); ++ SWAP_CHAR('>', '\002'); ++ SWAP_CHAR('"', '\003'); ++ SWAP_CHAR('\'', '\004'); ++ SWAP_CHAR('|', '\005'); ++ SWAP_CHAR('&', '\006'); ++ SWAP_CHAR('\a', '"'); ++ } + err = read_from_pipe(command_echo, (void **) &command_out, NULL); + if (err) + goto errout; + ++ for (char *p = command_out; *p; p++) { ++ SWAP_CHAR('\001', '<'); ++ SWAP_CHAR('\002', '>'); ++ SWAP_CHAR('\003', '"'); ++ SWAP_CHAR('\004', '\''); ++ SWAP_CHAR('\005', '|'); ++ SWAP_CHAR('\006', '&'); ++ } ++#undef SWAP_CHAR + pr_debug("llvm compiling command : %s\n", command_out); + + err = read_from_pipe(template, &obj_buf, &obj_buf_sz); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-459-leds-led-core-Fix-refcount-leak-in-of_led_get.patch b/patches.kernel.org/6.2.3-459-leds-led-core-Fix-refcount-leak-in-of_led_get.patch new file mode 100644 index 0000000..9a1bf36 --- /dev/null +++ b/patches.kernel.org/6.2.3-459-leds-led-core-Fix-refcount-leak-in-of_led_get.patch @@ -0,0 +1,38 @@ +From: Miaoqian Lin +Date: Tue, 20 Dec 2022 16:18:07 +0400 +Subject: [PATCH] leds: led-core: Fix refcount leak in of_led_get() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: da1afe8e6099980fe1e2fd7436dca284af9d3f29 + +[ Upstream commit da1afe8e6099980fe1e2fd7436dca284af9d3f29 ] + +class_find_device_by_of_node() calls class_find_device(), it will take +the reference, use the put_device() to drop the reference when not need +anymore. + +Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()") +Signed-off-by: Miaoqian Lin +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221220121807.1543790-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/leds/led-class.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index 7391d2cf..aa39b2a4 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -235,6 +235,7 @@ struct led_classdev *of_led_get(struct device_node *np, int index) + + led_dev = class_find_device_by_of_node(leds_class, led_node); + of_node_put(led_node); ++ put_device(led_dev); + + if (!led_dev) + return ERR_PTR(-EPROBE_DEFER); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-460-leds-is31fl319x-Wrap-mutex_destroy-for-devm_add.patch b/patches.kernel.org/6.2.3-460-leds-is31fl319x-Wrap-mutex_destroy-for-devm_add.patch new file mode 100644 index 0000000..1597453 --- /dev/null +++ b/patches.kernel.org/6.2.3-460-leds-is31fl319x-Wrap-mutex_destroy-for-devm_add.patch @@ -0,0 +1,67 @@ +From: Andy Shevchenko +Date: Wed, 28 Dec 2022 11:32:38 +0200 +Subject: [PATCH] leds: is31fl319x: Wrap mutex_destroy() for + devm_add_action_or_rest() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a82c7cf803d98751cd3ddb35828faad925d71982 + +[ Upstream commit a82c7cf803d98751cd3ddb35828faad925d71982 ] + +Clang complains that devm_add_action() takes a parameter with a wrong type: + +warning: cast from 'void (*)(struct mutex *)' to 'void (*)(void *)' converts to incompatible function type [-Wcast-function-type-strict] + err = devm_add_action(dev, (void (*)(void *))mutex_destroy, &is31->lock); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 1 warning generated. + +It appears that the commit e1af5c815586 ("leds: is31fl319x: Fix devm vs. +non-devm ordering") missed two things: + +- whilst the commit mentions devm_add_action_or_reset() the actual change + utilised devm_add_action() call by mistake +- strictly speaking the parameter is not compatible by type + +Fix both issues by switching to devm_add_action_or_reset() and adding a +wrapper for mutex_destroy() call. + +Reported-by: kernel test robot +Fixes: e1af5c815586 ("leds: is31fl319x: Fix devm vs. non-devm ordering") +Signed-off-by: Andy Shevchenko +Tested-by: Vincent Knecht +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221228093238.82713-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/leds/leds-is31fl319x.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-is31fl319x.c b/drivers/leds/leds-is31fl319x.c +index b2f4c4ec..7c908414 100644 +--- a/drivers/leds/leds-is31fl319x.c ++++ b/drivers/leds/leds-is31fl319x.c +@@ -495,6 +495,11 @@ static inline int is31fl3196_db_to_gain(u32 dezibel) + return dezibel / IS31FL3196_AUDIO_GAIN_DB_STEP; + } + ++static void is31f1319x_mutex_destroy(void *lock) ++{ ++ mutex_destroy(lock); ++} ++ + static int is31fl319x_probe(struct i2c_client *client) + { + struct is31fl319x_chip *is31; +@@ -511,7 +516,7 @@ static int is31fl319x_probe(struct i2c_client *client) + return -ENOMEM; + + mutex_init(&is31->lock); +- err = devm_add_action(dev, (void (*)(void *))mutex_destroy, &is31->lock); ++ err = devm_add_action_or_reset(dev, is31f1319x_mutex_destroy, &is31->lock); + if (err) + return err; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-461-leds-simatic-ipc-leds-gpio-Make-sure-we-have-th.patch b/patches.kernel.org/6.2.3-461-leds-simatic-ipc-leds-gpio-Make-sure-we-have-th.patch new file mode 100644 index 0000000..e5f54a0 --- /dev/null +++ b/patches.kernel.org/6.2.3-461-leds-simatic-ipc-leds-gpio-Make-sure-we-have-th.patch @@ -0,0 +1,48 @@ +From: Henning Schild +Date: Fri, 7 Oct 2022 17:33:23 +0200 +Subject: [PATCH] leds: simatic-ipc-leds-gpio: Make sure we have the GPIO + providing driver +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c64964ebee2a415384385205950ee7a05f78451e + +[ Upstream commit c64964ebee2a415384385205950ee7a05f78451e ] + +If we register a "leds-gpio" platform device for GPIO pins that do not +exist we get a -EPROBE_DEFER and the probe will be tried again later. +If there is no driver to provide that pin we will poll forever and also +create a lot of log messages. + +So check if that GPIO driver is configured, if so it will come up +eventually. If not, we exit our probe function early and do not even +bother registering the "leds-gpio". This method was chosen over "Kconfig +depends" since this way we can add support for more devices and GPIO +backends more easily without "depends":ing on all GPIO backends. + +Fixes: a6c80bec3c93 ("leds: simatic-ipc-leds-gpio: Add GPIO version of Siemens driver") +Signed-off-by: Henning Schild +Reviewed-by: Andy Shevchenko +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221007153323.1326-1-henning.schild@siemens.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/leds/simple/simatic-ipc-leds-gpio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/leds/simple/simatic-ipc-leds-gpio.c b/drivers/leds/simple/simatic-ipc-leds-gpio.c +index 07f0d79d..e8d329b5 100644 +--- a/drivers/leds/simple/simatic-ipc-leds-gpio.c ++++ b/drivers/leds/simple/simatic-ipc-leds-gpio.c +@@ -77,6 +77,8 @@ static int simatic_ipc_leds_gpio_probe(struct platform_device *pdev) + + switch (plat->devmode) { + case SIMATIC_IPC_DEVICE_127E: ++ if (!IS_ENABLED(CONFIG_PINCTRL_BROXTON)) ++ return -ENODEV; + simatic_ipc_led_gpio_table = &simatic_ipc_led_gpio_table_127e; + break; + case SIMATIC_IPC_DEVICE_227G: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-462-tools-tracing-rtla-osnoise_hist-use-total-durat.patch b/patches.kernel.org/6.2.3-462-tools-tracing-rtla-osnoise_hist-use-total-durat.patch new file mode 100644 index 0000000..76d97bf --- /dev/null +++ b/patches.kernel.org/6.2.3-462-tools-tracing-rtla-osnoise_hist-use-total-durat.patch @@ -0,0 +1,57 @@ +From: Andreas Ziegler +Date: Tue, 3 Jan 2023 11:33:59 +0100 +Subject: [PATCH] tools/tracing/rtla: osnoise_hist: use total duration for + average calculation +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fe137a4fe0e77eb95396cfc5c3dd7df404421aa4 + +[ Upstream commit fe137a4fe0e77eb95396cfc5c3dd7df404421aa4 ] + +Sampled durations must be weighted by observed quantity, to arrive at a correct +average duration value. + +Perform calculation of total duration by summing (duration * count). + +Link: https://lkml.kernel.org/r/20230103103400.275566-2-br015@umbiko.net + +Fixes: 829a6c0b5698 ("rtla/osnoise: Add the hist mode") + +Signed-off-by: Andreas Ziegler +Acked-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/tracing/rtla/src/osnoise_hist.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/tracing/rtla/src/osnoise_hist.c b/tools/tracing/rtla/src/osnoise_hist.c +index 5d7ea479..fe34452f 100644 +--- a/tools/tracing/rtla/src/osnoise_hist.c ++++ b/tools/tracing/rtla/src/osnoise_hist.c +@@ -121,6 +121,7 @@ static void osnoise_hist_update_multiple(struct osnoise_tool *tool, int cpu, + { + struct osnoise_hist_params *params = tool->params; + struct osnoise_hist_data *data = tool->data; ++ unsigned long long total_duration; + int entries = data->entries; + int bucket; + int *hist; +@@ -131,10 +132,12 @@ static void osnoise_hist_update_multiple(struct osnoise_tool *tool, int cpu, + if (data->bucket_size) + bucket = duration / data->bucket_size; + ++ total_duration = duration * count; ++ + hist = data->hist[cpu].samples; + data->hist[cpu].count += count; + update_min(&data->hist[cpu].min_sample, &duration); +- update_sum(&data->hist[cpu].sum_sample, &duration); ++ update_sum(&data->hist[cpu].sum_sample, &total_duration); + update_max(&data->hist[cpu].max_sample, &duration); + + if (bucket < entries) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-463-perf-inject-Use-perf_data__read-for-auxtrace.patch b/patches.kernel.org/6.2.3-463-perf-inject-Use-perf_data__read-for-auxtrace.patch new file mode 100644 index 0000000..6982408 --- /dev/null +++ b/patches.kernel.org/6.2.3-463-perf-inject-Use-perf_data__read-for-auxtrace.patch @@ -0,0 +1,74 @@ +From: Namhyung Kim +Date: Mon, 30 Jan 2023 18:33:47 -0800 +Subject: [PATCH] perf inject: Use perf_data__read() for auxtrace +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1746212daeba95e9ae1639227dc0c3591d41deeb + +[ Upstream commit 1746212daeba95e9ae1639227dc0c3591d41deeb ] + +In copy_bytes(), it reads the data from the (input) fd and writes it to +the output file. But it does with the read(2) unconditionally which +caused a problem of mixing buffered vs unbuffered I/O together. + +You can see the problem when using pipes. + + $ perf record -e intel_pt// -o- true | perf inject -b > /dev/null + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.000 MB - ] + 0x45c0 [0x30]: failed to process type: 71 + +It should use perf_data__read() to honor the 'use_stdio' setting. + +Fixes: 601366678c93618f ("perf data: Allow to use stdio functions for pipe mode") +Reviewed-by: Adrian Hunter +Reviewed-by: James Clark +Signed-off-by: Namhyung Kim +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Leo Yan +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: https://lore.kernel.org/r/20230131023350.1903992-2-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/builtin-inject.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c +index 3f4e4dd5..f8182417 100644 +--- a/tools/perf/builtin-inject.c ++++ b/tools/perf/builtin-inject.c +@@ -215,14 +215,14 @@ static int perf_event__repipe_event_update(struct perf_tool *tool, + + #ifdef HAVE_AUXTRACE_SUPPORT + +-static int copy_bytes(struct perf_inject *inject, int fd, off_t size) ++static int copy_bytes(struct perf_inject *inject, struct perf_data *data, off_t size) + { + char buf[4096]; + ssize_t ssz; + int ret; + + while (size > 0) { +- ssz = read(fd, buf, min(size, (off_t)sizeof(buf))); ++ ssz = perf_data__read(data, buf, min(size, (off_t)sizeof(buf))); + if (ssz < 0) + return -errno; + ret = output_bytes(inject, buf, ssz); +@@ -260,7 +260,7 @@ static s64 perf_event__repipe_auxtrace(struct perf_session *session, + ret = output_bytes(inject, event, event->header.size); + if (ret < 0) + return ret; +- ret = copy_bytes(inject, perf_data__fd(session->data), ++ ret = copy_bytes(inject, session->data, + event->auxtrace.size); + } else { + ret = output_bytes(inject, event, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-464-perf-intel-pt-Do-not-try-to-queue-auxtrace-data.patch b/patches.kernel.org/6.2.3-464-perf-intel-pt-Do-not-try-to-queue-auxtrace-data.patch new file mode 100644 index 0000000..60b6aca --- /dev/null +++ b/patches.kernel.org/6.2.3-464-perf-intel-pt-Do-not-try-to-queue-auxtrace-data.patch @@ -0,0 +1,124 @@ +From: Namhyung Kim +Date: Mon, 30 Jan 2023 18:33:48 -0800 +Subject: [PATCH] perf intel-pt: Do not try to queue auxtrace data on pipe +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aeb802f872a7c42e4381f36041e77d1745908255 + +[ Upstream commit aeb802f872a7c42e4381f36041e77d1745908255 ] + +When it processes AUXTRACE_INFO, it calls to auxtrace_queue_data() to +collect AUXTRACE data first. That won't work with pipe since it needs +lseek() to read the scattered aux data. + + $ perf record -o- -e intel_pt// true | perf report -i- --itrace=i100 + # To display the perf.data header info, please use --header/--header-only options. + # + 0x4118 [0xa0]: failed to process type: 70 + Error: + failed to process sample + +For the pipe mode, it can handle the aux data as it gets. But there's +no guarantee it can get the aux data in time. So the following warning +will be shown at the beginning: + + WARNING: Intel PT with pipe mode is not recommended. + The output cannot relied upon. In particular, + time stamps and the order of events may be incorrect. + +Fixes: dbd134322e74f19d ("perf intel-pt: Add support for decoding AUX area samples") +Reviewed-by: Adrian Hunter +Reviewed-by: James Clark +Signed-off-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Leo Yan +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: https://lore.kernel.org/r/20230131023350.1903992-3-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/Documentation/perf-intel-pt.txt | 30 ++++++++++++++++++++++ + tools/perf/util/auxtrace.c | 3 +++ + tools/perf/util/intel-pt.c | 6 +++++ + 3 files changed, 39 insertions(+) + +diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt +index 7b6ccd2f..9d485a9c 100644 +--- a/tools/perf/Documentation/perf-intel-pt.txt ++++ b/tools/perf/Documentation/perf-intel-pt.txt +@@ -1821,6 +1821,36 @@ Can be compiled and traced: + $ + + ++Pipe mode ++--------- ++Pipe mode is a problem for Intel PT and possibly other auxtrace users. ++It's not recommended to use a pipe as data output with Intel PT because ++of the following reason. ++ ++Essentially the auxtrace buffers do not behave like the regular perf ++event buffers. That is because the head and tail are updated by ++software, but in the auxtrace case the data is written by hardware. ++So the head and tail do not get updated as data is written. ++ ++In the Intel PT case, the head and tail are updated only when the trace ++is disabled by software, for example: ++ - full-trace, system wide : when buffer passes watermark ++ - full-trace, not system-wide : when buffer passes watermark or ++ context switches ++ - snapshot mode : as above but also when a snapshot is made ++ - sample mode : as above but also when a sample is made ++ ++That means finished-round ordering doesn't work. An auxtrace buffer ++can turn up that has data that extends back in time, possibly to the ++very beginning of tracing. ++ ++For a perf.data file, that problem is solved by going through the trace ++and queuing up the auxtrace buffers in advance. ++ ++For pipe mode, the order of events and timestamps can presumably ++be messed up. ++ ++ + EXAMPLE + ------- + +diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c +index c2e323cd..d4b04fa0 100644 +--- a/tools/perf/util/auxtrace.c ++++ b/tools/perf/util/auxtrace.c +@@ -1133,6 +1133,9 @@ int auxtrace_queue_data(struct perf_session *session, bool samples, bool events) + if (auxtrace__dont_decode(session)) + return 0; + ++ if (perf_data__is_pipe(session->data)) ++ return 0; ++ + if (!session->auxtrace || !session->auxtrace->queue_data) + return -EINVAL; + +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index 6d392162..b8b29756 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -4379,6 +4379,12 @@ int intel_pt_process_auxtrace_info(union perf_event *event, + + intel_pt_setup_pebs_events(pt); + ++ if (perf_data__is_pipe(session->data)) { ++ pr_warning("WARNING: Intel PT with pipe mode is not recommended.\n" ++ " The output cannot relied upon. In particular,\n" ++ " timestamps and the order of events may be incorrect.\n"); ++ } ++ + if (pt->sampling_mode || list_empty(&session->auxtrace_index)) + err = auxtrace_queue_data(session, true, true); + else +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-465-perf-stat-Hide-invalid-uncore-event-output-for-.patch b/patches.kernel.org/6.2.3-465-perf-stat-Hide-invalid-uncore-event-output-for-.patch new file mode 100644 index 0000000..4d4a453 --- /dev/null +++ b/patches.kernel.org/6.2.3-465-perf-stat-Hide-invalid-uncore-event-output-for-.patch @@ -0,0 +1,139 @@ +From: Namhyung Kim +Date: Wed, 25 Jan 2023 11:24:31 -0800 +Subject: [PATCH] perf stat: Hide invalid uncore event output for aggr mode +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dd15480a3d67b9cf04a1f6f5d60f1c0dc018e22f + +[ Upstream commit dd15480a3d67b9cf04a1f6f5d60f1c0dc018e22f ] + +The current display code for perf stat iterates given cpus and build the +aggr map to collect the event data for the aggregation mode. + +But uncore events have their own cpu maps and it won't guarantee that +it'd match to the aggr map. For example, per-package uncore events +would generate a single value for each socket. When user asks per-core +aggregation mode, the output would contain 0 values for other cores. + +Thus it needs to check the uncore PMU's cpumask and if it matches to the +current aggregation id. + +Before: + $ sudo ./perf stat -a --per-core -e power/energy-pkg/ sleep 1 + + Performance counter stats for 'system wide': + + S0-D0-C0 1 3.73 Joules power/energy-pkg/ + S0-D0-C1 0 Joules power/energy-pkg/ + S0-D0-C2 0 Joules power/energy-pkg/ + S0-D0-C3 0 Joules power/energy-pkg/ + + 1.001404046 seconds time elapsed + + Some events weren't counted. Try disabling the NMI watchdog: + echo 0 > /proc/sys/kernel/nmi_watchdog + perf stat ... + echo 1 > /proc/sys/kernel/nmi_watchdog + +The core 1, 2 and 3 should not be printed because the event is handled +in a cpu in the core 0 only. With this change, the output becomes like +below. + +After: + $ sudo ./perf stat -a --per-core -e power/energy-pkg/ sleep 1 + + Performance counter stats for 'system wide': + + S0-D0-C0 1 2.09 Joules power/energy-pkg/ + +Fixes: b897613510890d6e ("perf stat: Update event skip condition for system-wide per-thread mode and merged uncore and hybrid events") +Signed-off-by: Namhyung Kim +Tested-by: Ian Rogers +Acked-by: Ian Rogers +Cc: Adrian Hunter +Cc: Athira Rajeev +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Michael Petlan +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20230125192431.2929677-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/util/stat-display.c | 51 ++++++++++++++++++++++++++++++---- + 1 file changed, 46 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c +index 8bd8b014..1b5cb20e 100644 +--- a/tools/perf/util/stat-display.c ++++ b/tools/perf/util/stat-display.c +@@ -787,6 +787,51 @@ static void uniquify_counter(struct perf_stat_config *config, struct evsel *coun + uniquify_event_name(counter); + } + ++/** ++ * should_skip_zero_count() - Check if the event should print 0 values. ++ * @config: The perf stat configuration (including aggregation mode). ++ * @counter: The evsel with its associated cpumap. ++ * @id: The aggregation id that is being queried. ++ * ++ * Due to mismatch between the event cpumap or thread-map and the ++ * aggregation mode, sometimes it'd iterate the counter with the map ++ * which does not contain any values. ++ * ++ * For example, uncore events have dedicated CPUs to manage them, ++ * result for other CPUs should be zero and skipped. ++ * ++ * Return: %true if the value should NOT be printed, %false if the value ++ * needs to be printed like "" or "". ++ */ ++static bool should_skip_zero_counter(struct perf_stat_config *config, ++ struct evsel *counter, ++ const struct aggr_cpu_id *id) ++{ ++ struct perf_cpu cpu; ++ int idx; ++ ++ /* ++ * Skip value 0 when enabling --per-thread globally, ++ * otherwise it will have too many 0 output. ++ */ ++ if (config->aggr_mode == AGGR_THREAD && config->system_wide) ++ return true; ++ /* ++ * Skip value 0 when it's an uncore event and the given aggr id ++ * does not belong to the PMU cpumask. ++ */ ++ if (!counter->pmu || !counter->pmu->is_uncore) ++ return false; ++ ++ perf_cpu_map__for_each_cpu(cpu, idx, counter->pmu->cpus) { ++ struct aggr_cpu_id own_id = config->aggr_get_id(config, cpu); ++ ++ if (aggr_cpu_id__equal(id, &own_id)) ++ return false; ++ } ++ return true; ++} ++ + static void print_counter_aggrdata(struct perf_stat_config *config, + struct evsel *counter, int s, + struct outstate *os) +@@ -814,11 +859,7 @@ static void print_counter_aggrdata(struct perf_stat_config *config, + ena = aggr->counts.ena; + run = aggr->counts.run; + +- /* +- * Skip value 0 when enabling --per-thread globally, otherwise it will +- * have too many 0 output. +- */ +- if (val == 0 && config->aggr_mode == AGGR_THREAD && config->system_wide) ++ if (val == 0 && should_skip_zero_counter(config, counter, &id)) + return; + + if (!metric_only) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-466-perf-jevents-Correct-bad-character-encoding.patch b/patches.kernel.org/6.2.3-466-perf-jevents-Correct-bad-character-encoding.patch new file mode 100644 index 0000000..ba6964e --- /dev/null +++ b/patches.kernel.org/6.2.3-466-perf-jevents-Correct-bad-character-encoding.patch @@ -0,0 +1,68 @@ +From: Ian Rogers +Date: Thu, 26 Jan 2023 15:36:43 -0800 +Subject: [PATCH] perf jevents: Correct bad character encoding +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d2e3dc829e389d686194d06f0a64adda4158faae + +[ Upstream commit d2e3dc829e389d686194d06f0a64adda4158faae ] + +A character encoding issue added a "3D" character that breaks the +metrics test. + +Fixes: 40769665b63d8c84 ("perf jevents: Parse metrics during conversion") +Reviewed-by: Kajol Jain +Signed-off-by: Ian Rogers +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Caleb Biggers +Cc: Florian Fischer +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jing Zhang +Cc: Jiri Olsa +Cc: John Garry +Cc: Kan Liang +Cc: Kang Minchul +Cc: Kim Phillips +Cc: Leo Yan +Cc: Mark Rutland +Cc: Mike Leach +Cc: Namhyung Kim +Cc: Perry Taylor +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Cc: Rob Herring +Cc: Sandipan Das +Cc: Stephane Eranian +Cc: Will Deacon +Cc: Xing Zhengjun +Cc: linux-arm-kernel@lists.infradead.org +Cc: linuxppc-dev@lists.ozlabs.org +Link: https://lore.kernel.org/r/20230126233645.200509-14-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/pmu-events/metric_test.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/pmu-events/metric_test.py b/tools/perf/pmu-events/metric_test.py +index 15315d0f..6980f452 100644 +--- a/tools/perf/pmu-events/metric_test.py ++++ b/tools/perf/pmu-events/metric_test.py +@@ -87,8 +87,8 @@ class TestMetricExpressions(unittest.TestCase): + after = r'min((a + b if c > 1 else c + d), e + f)' + self.assertEqual(ParsePerfJson(before).ToPerfJson(), after) + +- before =3D r'a if b else c if d else e' +- after =3D r'(a if b else (c if d else e))' ++ before = r'a if b else c if d else e' ++ after = r'(a if b else (c if d else e))' + self.assertEqual(ParsePerfJson(before).ToPerfJson(), after) + + def test_ToPython(self): +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-467-perf-test-bpf-Skip-test-if-kernel-debuginfo-is-.patch b/patches.kernel.org/6.2.3-467-perf-test-bpf-Skip-test-if-kernel-debuginfo-is-.patch new file mode 100644 index 0000000..8f9c4da --- /dev/null +++ b/patches.kernel.org/6.2.3-467-perf-test-bpf-Skip-test-if-kernel-debuginfo-is-.patch @@ -0,0 +1,110 @@ +From: Athira Rajeev +Date: Thu, 5 Jan 2023 17:47:42 +0530 +Subject: [PATCH] perf test bpf: Skip test if kernel-debuginfo is not present +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 34266f904abd45731bdade2e92d0536c092ee9bc + +[ Upstream commit 34266f904abd45731bdade2e92d0536c092ee9bc ] + +Perf BPF filter test fails in environment where "kernel-debuginfo" +is not installed. + +Test failure logs: + + <<>> + 42: BPF filter : + 42.1: Basic BPF filtering : Ok + 42.2: BPF pinning : Ok + 42.3: BPF prologue generation : FAILED! + <<>> + +Enabling verbose option provided debug logs, which says debuginfo +needs to be installed. Snippet of verbose logs: + + <<>> + 42.3: BPF prologue generation : + --- start --- + test child forked, pid 28218 + <<>> + Rebuild with CONFIG_DEBUG_INFO=y, or install an appropriate debuginfo + package. + bpf_probe: failed to convert perf probe events + Failed to add events selected by BPF + test child finished with -1 + ---- end ---- + BPF filter subtest 3: FAILED! + <<>> + +Here the subtest "BPF prologue generation" failed and logs shows +debuginfo is needed. After installing kernel-debuginfo package, testcase +passes. + +The "BPF prologue generation" subtest failed because, the do_test() +returns TEST_FAIL without checking the error type returned by +parse_events_load_bpf_obj(). + +parse_events_load_bpf_obj() can also return error of type -ENODATA +incase kernel-debuginfo package is not installed. Fix this by adding +check for -ENODATA error. + +Test result after the patch changes: + +Test failure logs: + + <<>> + 42: BPF filter : + 42.1: Basic BPF filtering : Ok + 42.2: BPF pinning : Ok + 42.3: BPF prologue generation : Skip (clang/debuginfo isn't installed or environment missing BPF support) + <<>> + +Fixes: ba1fae431e74bb42 ("perf test: Add 'perf test BPF'") +Signed-off-by: Athira Rajeev +Cc: Andi Kleen +Cc: Disha Goel +Cc: Ian Rogers +Cc: James Clark +Cc: Jiri Olsa +Cc: Kajol Jain +Cc: Madhavan Srinivasan +Cc: Michael Ellerman +Cc: Nageswara R Sastry +Cc: Namhyung Kim +Cc: Wang Nan +Cc: linuxppc-dev@lists.ozlabs.org +Link: http://lore.kernel.org/linux-perf-users/Y7bIk77mdE4j8Jyi@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/tests/bpf.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/tests/bpf.c b/tools/perf/tests/bpf.c +index 17c02382..6a4235a9 100644 +--- a/tools/perf/tests/bpf.c ++++ b/tools/perf/tests/bpf.c +@@ -126,6 +126,10 @@ static int do_test(struct bpf_object *obj, int (*func)(void), + + err = parse_events_load_bpf_obj(&parse_state, &parse_state.list, obj, NULL); + parse_events_error__exit(&parse_error); ++ if (err == -ENODATA) { ++ pr_debug("Failed to add events selected by BPF, debuginfo package not installed\n"); ++ return TEST_SKIP; ++ } + if (err || list_empty(&parse_state.list)) { + pr_debug("Failed to add events selected by BPF\n"); + return TEST_FAIL; +@@ -368,7 +372,7 @@ static struct test_case bpf_tests[] = { + "clang isn't installed or environment missing BPF support"), + #ifdef HAVE_BPF_PROLOGUE + TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test, +- "clang isn't installed or environment missing BPF support"), ++ "clang/debuginfo isn't installed or environment missing BPF support"), + #else + TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test, "not compiled in"), + #endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-468-perf-tools-Fix-auto-complete-on-aarch64.patch b/patches.kernel.org/6.2.3-468-perf-tools-Fix-auto-complete-on-aarch64.patch new file mode 100644 index 0000000..d7c5445 --- /dev/null +++ b/patches.kernel.org/6.2.3-468-perf-tools-Fix-auto-complete-on-aarch64.patch @@ -0,0 +1,73 @@ +From: Yicong Yang +Date: Tue, 7 Feb 2023 11:50:57 +0800 +Subject: [PATCH] perf tools: Fix auto-complete on aarch64 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ffd1240e8f0814262ceb957dbe961f6e0aef1e7a + +[ Upstream commit ffd1240e8f0814262ceb957dbe961f6e0aef1e7a ] + +On aarch64 CPU related events are not under event_source/devices/cpu/events, +they're under event_source/devices/armv8_pmuv3_0/events on my machine. +Using current auto-complete script will generate below error: + + [root@localhost bin]# perf stat -e + ls: cannot access '/sys/bus/event_source/devices/cpu/events': No such file or directory + +Fix this by not testing /sys/bus/event_source/devices/cpu/events on +aarch64 machine. + +Fixes: 74cd5815d9af6e6c ("perf tool: Improve bash command line auto-complete for multiple events with comma") +Reviewed-by: James Clark +Signed-off-by: Yicong Yang +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: linux-arm-kernel@lists.infradead.org +Cc: linuxarm@huawei.com +Cc: prime.zeng@hisilicon.com +Link: https://lore.kernel.org/r/20230207035057.43394-1-yangyicong@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/perf-completion.sh | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/perf-completion.sh b/tools/perf/perf-completion.sh +index fdf75d45..978249d7 100644 +--- a/tools/perf/perf-completion.sh ++++ b/tools/perf/perf-completion.sh +@@ -165,7 +165,12 @@ __perf_main () + + local cur1=${COMP_WORDS[COMP_CWORD]} + local raw_evts=$($cmd list --raw-dump) +- local arr s tmp result ++ local arr s tmp result cpu_evts ++ ++ # aarch64 doesn't have /sys/bus/event_source/devices/cpu/events ++ if [[ `uname -m` != aarch64 ]]; then ++ cpu_evts=$(ls /sys/bus/event_source/devices/cpu/events) ++ fi + + if [[ "$cur1" == */* && ${cur1#*/} =~ ^[A-Z] ]]; then + OLD_IFS="$IFS" +@@ -183,9 +188,9 @@ __perf_main () + fi + done + +- evts=${result}" "$(ls /sys/bus/event_source/devices/cpu/events) ++ evts=${result}" "${cpu_evts} + else +- evts=${raw_evts}" "$(ls /sys/bus/event_source/devices/cpu/events) ++ evts=${raw_evts}" "${cpu_evts} + fi + + if [[ "$cur1" == , ]]; then +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-469-perf-stat-Avoid-merging-aggregating-metric-coun.patch b/patches.kernel.org/6.2.3-469-perf-stat-Avoid-merging-aggregating-metric-coun.patch new file mode 100644 index 0000000..065d24a --- /dev/null +++ b/patches.kernel.org/6.2.3-469-perf-stat-Avoid-merging-aggregating-metric-coun.patch @@ -0,0 +1,58 @@ +From: Ian Rogers +Date: Wed, 8 Feb 2023 22:44:47 -0800 +Subject: [PATCH] perf stat: Avoid merging/aggregating metric counts twice +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 37f322cd58d81a9d46456531281c908de9ef6e42 + +[ Upstream commit 37f322cd58d81a9d46456531281c908de9ef6e42 ] + +The added perf_stat_merge_counters combines uncore counters. When +metrics are enabled, the counts are merged into a metric_leader via the +stat-shadow saved_value logic. As the leader now is passed an aggregated +count, it leads to all counters being added together twice and counts +appearing approximately doubled in metrics. + +This change disables the saved_value merging of counts for evsels that +are merged. It is recommended that later changes remove the saved_value +entirely as the two layers of aggregation in the code is confusing. + +Fixes: 942c5593393d9418 ("perf stat: Add perf_stat_merge_counters()") +Reported-by: Perry Taylor +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Alexander Shishkin +Cc: Eduard Zingerman +Cc: Florian Fischer +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Xing Zhengjun +Link: https://lore.kernel.org/r/20230209064447.83733-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/util/stat-shadow.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c +index cadb2df2..4cd05d92 100644 +--- a/tools/perf/util/stat-shadow.c ++++ b/tools/perf/util/stat-shadow.c +@@ -311,7 +311,7 @@ void perf_stat__update_shadow_stats(struct evsel *counter, u64 count, + update_stats(&v->stats, count); + if (counter->metric_leader) + v->metric_total += count; +- } else if (counter->metric_leader) { ++ } else if (counter->metric_leader && !counter->merged_stat) { + v = saved_value_lookup(counter->metric_leader, + map_idx, true, STAT_NONE, 0, st, rsd.cgrp); + v->metric_total += count; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-470-sparc-allow-PM-configs-for-sparc32-COMPILE_TEST.patch b/patches.kernel.org/6.2.3-470-sparc-allow-PM-configs-for-sparc32-COMPILE_TEST.patch new file mode 100644 index 0000000..e591026 --- /dev/null +++ b/patches.kernel.org/6.2.3-470-sparc-allow-PM-configs-for-sparc32-COMPILE_TEST.patch @@ -0,0 +1,87 @@ +From: Randy Dunlap +Date: Sat, 4 Feb 2023 16:43:57 -0800 +Subject: [PATCH] sparc: allow PM configs for sparc32 COMPILE_TEST +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7be6a87c2473957090995b7eb541e31d57a2c801 + +[ Upstream commit 7be6a87c2473957090995b7eb541e31d57a2c801 ] + +When doing randconfig builds for sparc32 with COMPILE_TEST, some +(non-Sparc) drivers cause kconfig warnings with the Kconfig symbols PM, +PM_GENERIC_DOMAINS, or PM_GENERIC_DOMAINS_OF. + +This is due to arch/sparc/Kconfig not using the PM Kconfig for +Sparc32: + + if SPARC64 + source "kernel/power/Kconfig" + endif + +Arnd suggested adding "|| COMPILE_TEST" to the conditional, +instead of trying to track down every driver that selects +any of these PM symbols. + +Fixes the following kconfig warnings: + +WARNING: unmet direct dependencies detected for PM + Depends on [n]: SPARC64 [=n] + Selected by [y]: + - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y]) + +WARNING: unmet direct dependencies detected for PM + Depends on [n]: SPARC64 [=n] + Selected by [y]: + - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y]) + +WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS + Depends on [n]: SPARC64 [=n] && PM [=y] + Selected by [y]: + - QCOM_GDSC [=y] && COMMON_CLK [=y] && PM [=y] + - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y]) + - MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] + - BCM2835_POWER [=y] && (ARCH_BCM2835 || COMPILE_TEST [=y] && OF [=y]) && PM [=y] + - BCM_PMB [=y] && (ARCH_BCMBCA || COMPILE_TEST [=y] && OF [=y]) && PM [=y] + - ROCKCHIP_PM_DOMAINS [=y] && (ARCH_ROCKCHIP || COMPILE_TEST [=y]) && PM [=y] + Selected by [m]: + - ARM_SCPI_POWER_DOMAIN [=m] && (ARM_SCPI_PROTOCOL [=m] || COMPILE_TEST [=y] && OF [=y]) && PM [=y] + - MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] + - QCOM_AOSS_QMP [=m] && (ARCH_QCOM || COMPILE_TEST [=y]) && MAILBOX [=y] && COMMON_CLK [=y] && PM [=y] + +WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS_OF + Depends on [n]: SPARC64 [=n] && PM_GENERIC_DOMAINS [=y] && OF [=y] + Selected by [y]: + - MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] + Selected by [m]: + - MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] + +Link: https://lkml.kernel.org/r/20230205004357.29459-1-rdunlap@infradead.org +Fixes: bdde6b3c8ba4 ("sparc64: Hibernation support") +Signed-off-by: Randy Dunlap +Suggested-by: Arnd Bergmann +Acked-by: Sam Ravnborg +Cc: "David S. Miller" +Cc: Kirill Tkhai +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/sparc/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig +index 4d3d1af9..84437a4c 100644 +--- a/arch/sparc/Kconfig ++++ b/arch/sparc/Kconfig +@@ -283,7 +283,7 @@ config ARCH_FORCE_MAX_ORDER + This config option is actually maximum order plus one. For example, + a value of 13 means that the largest free memory block is 2^12 pages. + +-if SPARC64 ++if SPARC64 || COMPILE_TEST + source "kernel/power/Kconfig" + endif + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-471-selftests-find-echo-binary-to-use-ne-options.patch b/patches.kernel.org/6.2.3-471-selftests-find-echo-binary-to-use-ne-options.patch new file mode 100644 index 0000000..eb90898 --- /dev/null +++ b/patches.kernel.org/6.2.3-471-selftests-find-echo-binary-to-use-ne-options.patch @@ -0,0 +1,63 @@ +From: Guillaume Tucker +Date: Fri, 3 Feb 2023 16:26:03 +0100 +Subject: [PATCH] selftests: find echo binary to use -ne options +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4ebe33398c40c1118b4d8546978036c0e0032d1b + +[ Upstream commit 4ebe33398c40c1118b4d8546978036c0e0032d1b ] + +Find the actual echo binary using $(which echo) and use it for +formatted output with -ne. On some systems, the default echo command +doesn't handle the -e option and the output looks like this (arm64 +build): + +-ne Emit Tests for alsa + +-ne Emit Tests for amd-pstate + +-ne Emit Tests for arm64 + +This is for example the case with the KernelCI Docker images +e.g. kernelci/gcc-10:x86-kselftest-kernelci. With the actual echo +binary (e.g. in /bin/echo), the output is formatted as expected (x86 +build this time): + +Emit Tests for alsa +Emit Tests for amd-pstate +Skipping non-existent dir: arm64 + +Only the install target is using "echo -ne" so keep the $ECHO variable +local to it. + +Reported-by: "kernelci.org bot" +Fixes: 3297a4df805d ("kselftests: Enable the echo command to print newlines in Makefile") +Signed-off-by: Guillaume Tucker +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/Makefile | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile +index 41b64945..9619d0f3 100644 +--- a/tools/testing/selftests/Makefile ++++ b/tools/testing/selftests/Makefile +@@ -234,10 +234,11 @@ ifdef INSTALL_PATH + @# While building kselftest-list.text skip also non-existent TARGET dirs: + @# they could be the result of a build failure and should NOT be + @# included in the generated runlist. ++ ECHO=`which echo`; \ + for TARGET in $(TARGETS); do \ + BUILD_TARGET=$$BUILD/$$TARGET; \ +- [ ! -d $(INSTALL_PATH)/$$TARGET ] && echo "Skipping non-existent dir: $$TARGET" && continue; \ +- echo -ne "Emit Tests for $$TARGET\n"; \ ++ [ ! -d $(INSTALL_PATH)/$$TARGET ] && $$ECHO "Skipping non-existent dir: $$TARGET" && continue; \ ++ $$ECHO -ne "Emit Tests for $$TARGET\n"; \ + $(MAKE) -s --no-print-directory OUTPUT=$$BUILD_TARGET COLLECTION=$$TARGET \ + -C $$TARGET emit_tests >> $(TEST_LIST); \ + done; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-472-selftests-ftrace-Fix-bash-specific-operator.patch b/patches.kernel.org/6.2.3-472-selftests-ftrace-Fix-bash-specific-operator.patch new file mode 100644 index 0000000..f8fe4b5 --- /dev/null +++ b/patches.kernel.org/6.2.3-472-selftests-ftrace-Fix-bash-specific-operator.patch @@ -0,0 +1,45 @@ +From: "Masami Hiramatsu (Google)" +Date: Sun, 22 Jan 2023 08:32:50 +0900 +Subject: [PATCH] selftests/ftrace: Fix bash specific "==" operator +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1e6b485c922fbedf41d5a9f4e6449c5aeb923a32 + +[ Upstream commit 1e6b485c922fbedf41d5a9f4e6449c5aeb923a32 ] + +Since commit a1d6cd88c897 ("selftests/ftrace: event_triggers: wait +longer for test_event_enable") introduced bash specific "==" +comparation operator, that test will fail when we run it on a +posix-shell. `checkbashisms` warned it as below. + +possible bashism in ftrace/func_event_triggers.tc line 45 (should be 'b = a'): + if [ "$e" == $val ]; then + +This replaces it with "=". + +Fixes: a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable") +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../selftests/ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc +index 3eea2abf..2ad7d4b5 100644 +--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc ++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc +@@ -42,7 +42,7 @@ test_event_enabled() { + + while [ $check_times -ne 0 ]; do + e=`cat $EVENT_ENABLE` +- if [ "$e" == $val ]; then ++ if [ "$e" = $val ]; then + return 0 + fi + sleep $SLEEP_TIME +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-473-selftests-use-printf-instead-of-echo-ne.patch b/patches.kernel.org/6.2.3-473-selftests-use-printf-instead-of-echo-ne.patch new file mode 100644 index 0000000..3f8ec0b --- /dev/null +++ b/patches.kernel.org/6.2.3-473-selftests-use-printf-instead-of-echo-ne.patch @@ -0,0 +1,48 @@ +From: Guillaume Tucker +Date: Thu, 9 Feb 2023 09:55:36 +0100 +Subject: [PATCH] selftests: use printf instead of echo -ne +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9e34fad00fc889abbb99d751a4c22cf2bded10df + +[ Upstream commit 9e34fad00fc889abbb99d751a4c22cf2bded10df ] + +Rather than trying to guess which implementation of "echo" to run with +support for "-ne" options, use "printf" instead of "echo -ne". It +handles escape characters as a standard feature and it is widespread +among modern shells. + +Reported-by: "kernelci.org bot" +Suggested-by: David Laight +Fixes: 3297a4df805d ("kselftests: Enable the echo command to print newlines in Makefile") +Fixes: 79c16b1120fe ("selftests: find echo binary to use -ne options") +Signed-off-by: Guillaume Tucker +Reviewed-by: Guenter Roeck +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/Makefile | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile +index 9619d0f3..06578963 100644 +--- a/tools/testing/selftests/Makefile ++++ b/tools/testing/selftests/Makefile +@@ -234,11 +234,10 @@ ifdef INSTALL_PATH + @# While building kselftest-list.text skip also non-existent TARGET dirs: + @# they could be the result of a build failure and should NOT be + @# included in the generated runlist. +- ECHO=`which echo`; \ + for TARGET in $(TARGETS); do \ + BUILD_TARGET=$$BUILD/$$TARGET; \ +- [ ! -d $(INSTALL_PATH)/$$TARGET ] && $$ECHO "Skipping non-existent dir: $$TARGET" && continue; \ +- $$ECHO -ne "Emit Tests for $$TARGET\n"; \ ++ [ ! -d $(INSTALL_PATH)/$$TARGET ] && printf "Skipping non-existent dir: $$TARGET\n" && continue; \ ++ printf "Emit Tests for $$TARGET\n"; \ + $(MAKE) -s --no-print-directory OUTPUT=$$BUILD_TARGET COLLECTION=$$TARGET \ + -C $$TARGET emit_tests >> $(TEST_LIST); \ + done; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-474-perf-record-Fix-segfault-with-overwrite-and-max.patch b/patches.kernel.org/6.2.3-474-perf-record-Fix-segfault-with-overwrite-and-max.patch new file mode 100644 index 0000000..d774384 --- /dev/null +++ b/patches.kernel.org/6.2.3-474-perf-record-Fix-segfault-with-overwrite-and-max.patch @@ -0,0 +1,126 @@ +From: Yang Jihong +Date: Wed, 15 Feb 2023 12:23:24 +0000 +Subject: [PATCH] perf record: Fix segfault with --overwrite and --max-size +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 91621be65d6812cd74b2ea09573ff9ee0cbf5666 + +[ Upstream commit 91621be65d6812cd74b2ea09573ff9ee0cbf5666 ] + +When --overwrite and --max-size options of perf record are used +together, a segmentation fault occurs. The following is an example: + + # perf record -e sched:sched* --overwrite --max-size 1K -a -- sleep 1 + [ perf record: Woken up 1 times to write data ] + perf: Segmentation fault + Obtained 12 stack frames. + ./perf/perf(+0x197673) [0x55f99710b673] + /lib/x86_64-linux-gnu/libc.so.6(+0x3ef0f) [0x7fa45f3cff0f] + ./perf/perf(+0x8eb40) [0x55f997002b40] + ./perf/perf(+0x1f6882) [0x55f99716a882] + ./perf/perf(+0x794c2) [0x55f996fed4c2] + ./perf/perf(+0x7b7c7) [0x55f996fef7c7] + ./perf/perf(+0x9074b) [0x55f99700474b] + ./perf/perf(+0x12e23c) [0x55f9970a223c] + ./perf/perf(+0x12e54a) [0x55f9970a254a] + ./perf/perf(+0x7db60) [0x55f996ff1b60] + /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe6) [0x7fa45f3b2c86] + ./perf/perf(+0x7dfe9) [0x55f996ff1fe9] + Segmentation fault (core dumped) + +backtrace of the core file is as follows: + + (gdb) bt + #0 record__bytes_written (rec=0x55f99755a200 ) at builtin-record.c:234 + #1 record__output_max_size_exceeded (rec=0x55f99755a200 ) at builtin-record.c:242 + #2 record__write (map=0x0, size=12816, bf=0x55f9978da2e0, rec=0x55f99755a200 ) at builtin-record.c:263 + #3 process_synthesized_event (tool=tool@entry=0x55f99755a200 , event=event@entry=0x55f9978da2e0, sample=sample@entry=0x0, machine=machine@entry=0x55f997893658) at builtin-record.c:618 + #4 0x000055f99716a883 in __perf_event__synthesize_id_index (tool=tool@entry=0x55f99755a200 , process=process@entry=0x55f997002aa0 , evlist=0x55f9978928b0, machine=machine@entry=0x55f997893658, + from=from@entry=0) at util/synthetic-events.c:1895 + #5 0x000055f99716a91f in perf_event__synthesize_id_index (tool=tool@entry=0x55f99755a200 , process=process@entry=0x55f997002aa0 , evlist=, machine=machine@entry=0x55f997893658) + at util/synthetic-events.c:1905 + #6 0x000055f996fed4c3 in record__synthesize (tail=tail@entry=true, rec=0x55f99755a200 ) at builtin-record.c:1997 + #7 0x000055f996fef7c8 in __cmd_record (argc=argc@entry=2, argv=argv@entry=0x7ffc67551260, rec=0x55f99755a200 ) at builtin-record.c:2802 + #8 0x000055f99700474c in cmd_record (argc=, argv=0x7ffc67551260) at builtin-record.c:4258 + #9 0x000055f9970a223d in run_builtin (p=0x55f997564d88 , argc=10, argv=0x7ffc67551260) at perf.c:330 + #10 0x000055f9970a254b in handle_internal_command (argc=10, argv=0x7ffc67551260) at perf.c:384 + #11 0x000055f996ff1b61 in run_argv (argcp=, argv=) at perf.c:428 + #12 main (argc=, argv=0x7ffc67551260) at perf.c:562 + +The reason is that record__bytes_written accesses the freed memory rec->thread_data, +The process is as follows: + __cmd_record + -> record__free_thread_data + -> zfree(&rec->thread_data) // free rec->thread_data + -> record__synthesize + -> perf_event__synthesize_id_index + -> process_synthesized_event + -> record__write + -> record__bytes_written // access rec->thread_data + +We add a member variable "thread_bytes_written" in the struct "record" +to save the data size written by the threads. + +Fixes: 6d57581659f72299 ("perf record: Add support for limit perf output file size") +Signed-off-by: Yang Jihong +Acked-by: Namhyung Kim +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Jiwei Sun +Cc: Mark Rutland +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/CAM9d7ci_TRrqBQVQNW8=GwakUr7SsZpYxaaty-S4bxF8zJWyqw@mail.gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/builtin-record.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c +index 29dcd454..8374117e 100644 +--- a/tools/perf/builtin-record.c ++++ b/tools/perf/builtin-record.c +@@ -154,6 +154,7 @@ struct record { + struct perf_tool tool; + struct record_opts opts; + u64 bytes_written; ++ u64 thread_bytes_written; + struct perf_data data; + struct auxtrace_record *itr; + struct evlist *evlist; +@@ -226,14 +227,7 @@ static bool switch_output_time(struct record *rec) + + static u64 record__bytes_written(struct record *rec) + { +- int t; +- u64 bytes_written = rec->bytes_written; +- struct record_thread *thread_data = rec->thread_data; +- +- for (t = 0; t < rec->nr_threads; t++) +- bytes_written += thread_data[t].bytes_written; +- +- return bytes_written; ++ return rec->bytes_written + rec->thread_bytes_written; + } + + static bool record__output_max_size_exceeded(struct record *rec) +@@ -255,10 +249,12 @@ static int record__write(struct record *rec, struct mmap *map __maybe_unused, + return -1; + } + +- if (map && map->file) ++ if (map && map->file) { + thread->bytes_written += size; +- else ++ rec->thread_bytes_written += size; ++ } else { + rec->bytes_written += size; ++ } + + if (record__output_max_size_exceeded(rec) && !done) { + fprintf(stderr, "[ perf record: perf size limit reached (%" PRIu64 " KB)," +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-475-printf-fix-errname.c-list.patch b/patches.kernel.org/6.2.3-475-printf-fix-errname.c-list.patch new file mode 100644 index 0000000..216104f --- /dev/null +++ b/patches.kernel.org/6.2.3-475-printf-fix-errname.c-list.patch @@ -0,0 +1,111 @@ +From: Arnd Bergmann +Date: Mon, 6 Feb 2023 20:40:57 +0100 +Subject: [PATCH] printf: fix errname.c list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 + +[ Upstream commit 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 ] + +On most architectures, gcc -Wextra warns about the list of error +numbers containing both EDEADLK and EDEADLOCK: + +lib/errname.c:15:67: warning: initialized field overwritten [-Woverride-init] + 15 | #define E(err) [err + BUILD_BUG_ON_ZERO(err <= 0 || err > 300)] = "-" #err + | ^~~ +lib/errname.c:172:2: note: in expansion of macro 'E' + 172 | E(EDEADLK), /* EDEADLOCK */ + | ^ + +On parisc, a similar error happens with -ECANCELLED, which is an +alias for ECANCELED. + +Make the EDEADLK printing conditional on the number being distinct +from EDEADLOCK, and remove the -ECANCELLED bit completely as it +can never be hit. + +To ensure these are correct, add static_assert lines that verify +all the remaining aliases are in fact identical to the canonical +name. + +Fixes: 57f5677e535b ("printf: add support for printing symbolic error names") +Cc: Petr Mladek +Suggested-by: Rasmus Villemoes +Acked-by: Uwe Kleine-König +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/all/20210514213456.745039-1-arnd@kernel.org/ +Link: https://lore.kernel.org/all/20210927123409.1109737-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Reviewed-by: Sergey Senozhatsky +Acked-by: Rasmus Villemoes +Reviewed-by: Petr Mladek +Signed-off-by: Petr Mladek +Link: https://lore.kernel.org/r/20230206194126.380350-1-arnd@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + lib/errname.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/lib/errname.c b/lib/errname.c +index 05cbf731..67739b17 100644 +--- a/lib/errname.c ++++ b/lib/errname.c +@@ -21,6 +21,7 @@ static const char *names_0[] = { + E(EADDRNOTAVAIL), + E(EADV), + E(EAFNOSUPPORT), ++ E(EAGAIN), /* EWOULDBLOCK */ + E(EALREADY), + E(EBADE), + E(EBADF), +@@ -31,15 +32,17 @@ static const char *names_0[] = { + E(EBADSLT), + E(EBFONT), + E(EBUSY), +-#ifdef ECANCELLED +- E(ECANCELLED), +-#endif ++ E(ECANCELED), /* ECANCELLED */ + E(ECHILD), + E(ECHRNG), + E(ECOMM), + E(ECONNABORTED), ++ E(ECONNREFUSED), /* EREFUSED */ + E(ECONNRESET), ++ E(EDEADLK), /* EDEADLOCK */ ++#if EDEADLK != EDEADLOCK /* mips, sparc, powerpc */ + E(EDEADLOCK), ++#endif + E(EDESTADDRREQ), + E(EDOM), + E(EDOTDOT), +@@ -166,14 +169,17 @@ static const char *names_0[] = { + E(EUSERS), + E(EXDEV), + E(EXFULL), +- +- E(ECANCELED), /* ECANCELLED */ +- E(EAGAIN), /* EWOULDBLOCK */ +- E(ECONNREFUSED), /* EREFUSED */ +- E(EDEADLK), /* EDEADLOCK */ + }; + #undef E + ++#ifdef EREFUSED /* parisc */ ++static_assert(EREFUSED == ECONNREFUSED); ++#endif ++#ifdef ECANCELLED /* parisc */ ++static_assert(ECANCELLED == ECANCELED); ++#endif ++static_assert(EAGAIN == EWOULDBLOCK); /* everywhere */ ++ + #define E(err) [err - 512 + BUILD_BUG_ON_ZERO(err < 512 || err > 550)] = "-" #err + static const char *names_512[] = { + E(ERESTARTSYS), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-476-perf-tests-stat_all_metrics-Change-true-workloa.patch b/patches.kernel.org/6.2.3-476-perf-tests-stat_all_metrics-Change-true-workloa.patch new file mode 100644 index 0000000..5686d81 --- /dev/null +++ b/patches.kernel.org/6.2.3-476-perf-tests-stat_all_metrics-Change-true-workloa.patch @@ -0,0 +1,83 @@ +From: Kajol Jain +Date: Wed, 15 Feb 2023 15:08:27 +0530 +Subject: [PATCH] perf tests stat_all_metrics: Change true workload to sleep + workload for system wide check +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f9fa0778ee7349a9aa3d2ea10e9f2ab843a0b44e + +[ Upstream commit f9fa0778ee7349a9aa3d2ea10e9f2ab843a0b44e ] + +Testcase stat_all_metrics.sh fails in powerpc: + +98: perf all metrics test : FAILED! + +Logs with verbose: + + [command]# ./perf test 98 -vv + 98: perf all metrics test : + --- start --- + test child forked, pid 13262 + Testing BRU_STALL_CPI + Testing COMPLETION_STALL_CPI + ---- + Testing TOTAL_LOCAL_NODE_PUMPS_P23 + Metric 'TOTAL_LOCAL_NODE_PUMPS_P23' not printed in: + Error: + Invalid event (hv_24x7/PM_PB_LNS_PUMP23,chip=3/) in per-thread mode, enable system wide with '-a'. + Testing TOTAL_LOCAL_NODE_PUMPS_RETRIES_P01 + Metric 'TOTAL_LOCAL_NODE_PUMPS_RETRIES_P01' not printed in: + Error: + Invalid event (hv_24x7/PM_PB_RTY_LNS_PUMP01,chip=3/) in per-thread mode, enable system wide with '-a'. + ---- + +Based on above logs, we could see some of the hv-24x7 metric events +fails, and logs suggest to run the metric event with -a option. This +change happened after the commit a4b8cfcabb1d90ec ("perf stat: Delay +metric parsing"), which delayed the metric parsing phase and now before +metric parsing phase perf tool identifies, whether target is system-wide +or not. With this change, perf_event_open will fails with workload +monitoring for uncore events as expected. + +The perf all metric test case fails as some of the hv-24x7 metric events +may need bigger workload with system wide monitoring to get the data. +Fix this issue by changing current system wide check from true workload +to sleep 0.01 workload. + +Result with the patch changes in powerpc: + + 98: perf all metrics test : Ok + +Fixes: a4b8cfcabb1d90ec ("perf stat: Delay metric parsing") +Suggested-by: Ian Rogers +Reviewed-by: Athira Rajeev +Signed-off-by: Kajol Jain +Tested-by: Disha Goel +Tested-by: Ian Rogers +Cc: Madhavan Srinivasan +Cc: Nageswara R Sastry +Cc: linuxppc-dev@lists.ozlabs.org +Link: https://lore.kernel.org/r/20230215093827.124921-1-kjain@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/perf/tests/shell/stat_all_metrics.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh +index 6e79349e..22e9cb29 100755 +--- a/tools/perf/tests/shell/stat_all_metrics.sh ++++ b/tools/perf/tests/shell/stat_all_metrics.sh +@@ -11,7 +11,7 @@ for m in $(perf list --raw-dump metrics); do + continue + fi + # Failed so try system wide. +- result=$(perf stat -M "$m" -a true 2>&1) ++ result=$(perf stat -M "$m" -a sleep 0.01 2>&1) + if [[ "$result" =~ "${m:0:50}" ]] + then + continue +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-477-objtool-add-UACCESS-exceptions-for-__tsan_volat.patch b/patches.kernel.org/6.2.3-477-objtool-add-UACCESS-exceptions-for-__tsan_volat.patch new file mode 100644 index 0000000..b6db01e --- /dev/null +++ b/patches.kernel.org/6.2.3-477-objtool-add-UACCESS-exceptions-for-__tsan_volat.patch @@ -0,0 +1,58 @@ +From: Arnd Bergmann +Date: Wed, 15 Feb 2023 14:00:58 +0100 +Subject: [PATCH] objtool: add UACCESS exceptions for + __tsan_volatile_read/write +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d5d469247264e56960705dc5ae7e1d014861fe40 + +[ Upstream commit d5d469247264e56960705dc5ae7e1d014861fe40 ] + +A lot of the tsan helpers are already excempt from the UACCESS warnings, +but some more functions were added that need the same thing: + +kernel/kcsan/core.o: warning: objtool: __tsan_volatile_read16+0x0: call to __tsan_unaligned_read16() with UACCESS enabled +kernel/kcsan/core.o: warning: objtool: __tsan_volatile_write16+0x0: call to __tsan_unaligned_write16() with UACCESS enabled +vmlinux.o: warning: objtool: __tsan_unaligned_volatile_read16+0x4: call to __tsan_unaligned_read16() with UACCESS enabled +vmlinux.o: warning: objtool: __tsan_unaligned_volatile_write16+0x4: call to __tsan_unaligned_write16() with UACCESS enabled + +As Marco points out, these functions don't even call each other +explicitly but instead gcc (but not clang) notices the functions +being identical and turns one symbol into a direct branch to the +other. + +Link: https://lkml.kernel.org/r/20230215130058.3836177-4-arnd@kernel.org +Fixes: 75d75b7a4d54 ("kcsan: Support distinguishing volatile accesses") +Signed-off-by: Arnd Bergmann +Acked-by: Marco Elver +Cc: Alexander Potapenko +Cc: Andrey Konovalov +Cc: Andrey Ryabinin +Cc: Dmitry Vyukov +Cc: Josh Poimboeuf +Cc: Kuan-Ying Lee +Cc: Peter Zijlstra (Intel) +Cc: Vincenzo Frascino +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/objtool/check.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 4b7c8b33..b1a5f658 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -1186,6 +1186,8 @@ static const char *uaccess_safe_builtin[] = { + "__tsan_atomic64_compare_exchange_val", + "__tsan_atomic_thread_fence", + "__tsan_atomic_signal_fence", ++ "__tsan_unaligned_read16", ++ "__tsan_unaligned_write16", + /* KCOV */ + "write_comp_data", + "check_kcov_mode", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-478-selftests-ftrace-Fix-probepoint-testcase-to-ign.patch b/patches.kernel.org/6.2.3-478-selftests-ftrace-Fix-probepoint-testcase-to-ign.patch new file mode 100644 index 0000000..501f686 --- /dev/null +++ b/patches.kernel.org/6.2.3-478-selftests-ftrace-Fix-probepoint-testcase-to-ign.patch @@ -0,0 +1,43 @@ +From: "Masami Hiramatsu (Google)" +Date: Tue, 21 Feb 2023 08:49:16 +0900 +Subject: [PATCH] selftests/ftrace: Fix probepoint testcase to ignore __pfx_* + symbols +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 96cd93af794cf3ef83ae1ad7291160029d7b525e + +[ Upstream commit 96cd93af794cf3ef83ae1ad7291160029d7b525e ] + +Fix kprobe probepoint testcase to ignore __pfx_* prefix symbols. Those are +introduced by commit b341b20d648b ("x86: Add prefix symbols for function +padding") for identifying PADDING_BYTES of NOPs. Since kprobe events can +not probe these prefix symbols, this testcase has to skip those symbols. + +Link: https://lore.kernel.org/all/167309835609.640500.9664678940260305746.stgit@devnote3/ + +Fixes: b341b20d648b ("x86: Add prefix symbols for function padding") +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Acked-by: Shuah Khan +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc +index 624269c8..68425987 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc +@@ -21,7 +21,7 @@ set_offs() { # prev target next + + # We have to decode symbol addresses to get correct offsets. + # If the offset is not an instruction boundary, it cause -EILSEQ. +-set_offs `grep -A1 -B1 ${TARGET_FUNC} /proc/kallsyms | cut -f 1 -d " " | xargs` ++set_offs `grep -v __pfx_ /proc/kallsyms | grep -A1 -B1 ${TARGET_FUNC} | cut -f 1 -d " " | xargs` + + UINT_TEST=no + # printf "%x" -1 returns (unsigned long)-1. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-479-sysctl-fix-proc_dobool-usability.patch b/patches.kernel.org/6.2.3-479-sysctl-fix-proc_dobool-usability.patch new file mode 100644 index 0000000..67f3737 --- /dev/null +++ b/patches.kernel.org/6.2.3-479-sysctl-fix-proc_dobool-usability.patch @@ -0,0 +1,170 @@ +From: Ondrej Mosnacek +Date: Fri, 10 Feb 2023 15:58:23 +0100 +Subject: [PATCH] sysctl: fix proc_dobool() usability +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f1aa2eb5ea05ccd1fd92d235346e60e90a1ed949 + +[ Upstream commit f1aa2eb5ea05ccd1fd92d235346e60e90a1ed949 ] + +Currently proc_dobool expects a (bool *) in table->data, but sizeof(int) +in table->maxsize, because it uses do_proc_dointvec() directly. + +This is unsafe for at least two reasons: +1. A sysctl table definition may use { .data = &variable, .maxsize = + sizeof(variable) }, not realizing that this makes the sysctl unusable + (see the Fixes: tag) and that they need to use the completely + counterintuitive sizeof(int) instead. +2. proc_dobool() will currently try to parse an array of values if given + .maxsize >= 2*sizeof(int), but will try to write values of type bool + by offsets of sizeof(int), so it will not work correctly with neither + an (int *) nor a (bool *). There is no .maxsize validation to prevent + this. + +Fix this by: +1. Constraining proc_dobool() to allow only one value and .maxsize == + sizeof(bool). +2. Wrapping the original struct ctl_table in a temporary one with .data + pointing to a local int variable and .maxsize set to sizeof(int) and + passing this one to proc_dointvec(), converting the value to/from + bool as needed (using proc_dou8vec_minmax() as an example). +3. Extending sysctl_check_table() to enforce proc_dobool() expectations. +4. Fixing the proc_dobool() docstring (it was just copy-pasted from + proc_douintvec, apparently...). +5. Converting all existing proc_dobool() users to set .maxsize to + sizeof(bool) instead of sizeof(int). + +Fixes: 83efeeeb3d04 ("tty: Allow TIOCSTI to be disabled") +Fixes: a2071573d634 ("sysctl: introduce new proc handler proc_dobool") +Signed-off-by: Ondrej Mosnacek +Acked-by: Kees Cook +Signed-off-by: Luis Chamberlain +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/lockd/svc.c | 2 +- + fs/proc/proc_sysctl.c | 6 ++++++ + kernel/sysctl.c | 43 ++++++++++++++++++++++++------------------- + mm/hugetlb_vmemmap.c | 2 +- + 4 files changed, 32 insertions(+), 21 deletions(-) + +diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c +index 59ef8a1f..914ea1c3 100644 +--- a/fs/lockd/svc.c ++++ b/fs/lockd/svc.c +@@ -496,7 +496,7 @@ static struct ctl_table nlm_sysctls[] = { + { + .procname = "nsm_use_hostnames", + .data = &nsm_use_hostnames, +- .maxlen = sizeof(int), ++ .maxlen = sizeof(bool), + .mode = 0644, + .proc_handler = proc_dobool, + }, +diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c +index 48f2d60b..436025e0 100644 +--- a/fs/proc/proc_sysctl.c ++++ b/fs/proc/proc_sysctl.c +@@ -1124,6 +1124,11 @@ static int sysctl_check_table_array(const char *path, struct ctl_table *table) + err |= sysctl_err(path, table, "array not allowed"); + } + ++ if (table->proc_handler == proc_dobool) { ++ if (table->maxlen != sizeof(bool)) ++ err |= sysctl_err(path, table, "array not allowed"); ++ } ++ + return err; + } + +@@ -1136,6 +1141,7 @@ static int sysctl_check_table(const char *path, struct ctl_table *table) + err |= sysctl_err(path, entry, "Not a file"); + + if ((entry->proc_handler == proc_dostring) || ++ (entry->proc_handler == proc_dobool) || + (entry->proc_handler == proc_dointvec) || + (entry->proc_handler == proc_douintvec) || + (entry->proc_handler == proc_douintvec_minmax) || +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 137d4abe..1c240d2c 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -425,21 +425,6 @@ static void proc_put_char(void **buf, size_t *size, char c) + } + } + +-static int do_proc_dobool_conv(bool *negp, unsigned long *lvalp, +- int *valp, +- int write, void *data) +-{ +- if (write) { +- *(bool *)valp = *lvalp; +- } else { +- int val = *(bool *)valp; +- +- *lvalp = (unsigned long)val; +- *negp = false; +- } +- return 0; +-} +- + static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp, + int *valp, + int write, void *data) +@@ -710,16 +695,36 @@ int do_proc_douintvec(struct ctl_table *table, int write, + * @lenp: the size of the user buffer + * @ppos: file position + * +- * Reads/writes up to table->maxlen/sizeof(unsigned int) integer +- * values from/to the user buffer, treated as an ASCII string. ++ * Reads/writes one integer value from/to the user buffer, ++ * treated as an ASCII string. ++ * ++ * table->data must point to a bool variable and table->maxlen must ++ * be sizeof(bool). + * + * Returns 0 on success. + */ + int proc_dobool(struct ctl_table *table, int write, void *buffer, + size_t *lenp, loff_t *ppos) + { +- return do_proc_dointvec(table, write, buffer, lenp, ppos, +- do_proc_dobool_conv, NULL); ++ struct ctl_table tmp; ++ bool *data = table->data; ++ int res, val; ++ ++ /* Do not support arrays yet. */ ++ if (table->maxlen != sizeof(bool)) ++ return -EINVAL; ++ ++ tmp = *table; ++ tmp.maxlen = sizeof(val); ++ tmp.data = &val; ++ ++ val = READ_ONCE(*data); ++ res = proc_dointvec(&tmp, write, buffer, lenp, ppos); ++ if (res) ++ return res; ++ if (write) ++ WRITE_ONCE(*data, val); ++ return 0; + } + + /** +diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c +index 45e93a54..a559037c 100644 +--- a/mm/hugetlb_vmemmap.c ++++ b/mm/hugetlb_vmemmap.c +@@ -581,7 +581,7 @@ static struct ctl_table hugetlb_vmemmap_sysctls[] = { + { + .procname = "hugetlb_optimize_vmemmap", + .data = &vmemmap_optimize_enabled, +- .maxlen = sizeof(int), ++ .maxlen = sizeof(vmemmap_optimize_enabled), + .mode = 0644, + .proc_handler = proc_dobool, + }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-480-mfd-rk808-Re-add-rk808-clkout-to-RK818.patch b/patches.kernel.org/6.2.3-480-mfd-rk808-Re-add-rk808-clkout-to-RK818.patch new file mode 100644 index 0000000..612b221 --- /dev/null +++ b/patches.kernel.org/6.2.3-480-mfd-rk808-Re-add-rk808-clkout-to-RK818.patch @@ -0,0 +1,42 @@ +From: Tom Fitzhenry +Date: Mon, 2 Jan 2023 22:11:47 +1100 +Subject: [PATCH] mfd: rk808: Re-add rk808-clkout to RK818 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5d69b181cd0db10dc8327d28ce837b3623cd531a + +[ Upstream commit 5d69b181cd0db10dc8327d28ce837b3623cd531a ] + +Fixes RK818 (e.g. on Pinephone Pro) to register its clock, without which +dependent devices (e.g. wifi/BT, via sdio-wifi-pwrseq) fail to probe. + +This line was removed in commit 3633daacea2e +("mfd: rk808: Permit having multiple PMIC instances"), but only from RK818. + +Fixes: 3633daacea2e ("mfd: rk808: Permit having multiple PMIC instances") +Signed-off-by: Tom Fitzhenry +Reviewed-by: Javier Martinez Canillas +Acked-by: Neil Armstrong +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230102111147.2580861-1-tom@tom-fitzhenry.me.uk +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/mfd/rk808.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/rk808.c b/drivers/mfd/rk808.c +index f44fc3f0..0f22ef61 100644 +--- a/drivers/mfd/rk808.c ++++ b/drivers/mfd/rk808.c +@@ -189,6 +189,7 @@ static const struct mfd_cell rk817s[] = { + }; + + static const struct mfd_cell rk818s[] = { ++ { .name = "rk808-clkout", .id = PLATFORM_DEVID_NONE, }, + { .name = "rk808-regulator", .id = PLATFORM_DEVID_NONE, }, + { + .name = "rk808-rtc", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-481-mfd-cs5535-Don-t-build-on-UML.patch b/patches.kernel.org/6.2.3-481-mfd-cs5535-Don-t-build-on-UML.patch new file mode 100644 index 0000000..d00a1e9 --- /dev/null +++ b/patches.kernel.org/6.2.3-481-mfd-cs5535-Don-t-build-on-UML.patch @@ -0,0 +1,63 @@ +From: Randy Dunlap +Date: Wed, 30 Nov 2022 17:25:41 -0800 +Subject: [PATCH] mfd: cs5535: Don't build on UML +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5ec32a3e4053c1a726b45381d56aa9e39eaf3911 + +[ Upstream commit 5ec32a3e4053c1a726b45381d56aa9e39eaf3911 ] + +The cs5535-mfd driver uses CPU-specific data that is not available +for ARCH=um builds, so don't allow it to be built for UML. + +Prevents these build errors: + +In file included from ../arch/x86/include/asm/olpc.h:7, + from ../drivers/mfd/cs5535-mfd.c:17: +../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’: +../arch/x86/include/asm/geode.h:16:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ + 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && +../arch/x86/include/asm/geode.h:16:46: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? + 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && +../arch/x86/include/asm/geode.h:17:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ + 17 | (boot_cpu_data.x86 == 5) && +../arch/x86/include/asm/geode.h:18:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ + 18 | (boot_cpu_data.x86_model == 5)); +../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’: +../arch/x86/include/asm/geode.h:23:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ + 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && +../arch/x86/include/asm/geode.h:23:46: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? + 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && +../arch/x86/include/asm/geode.h:24:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ + 24 | (boot_cpu_data.x86 == 5) && +../arch/x86/include/asm/geode.h:25:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ + 25 | (boot_cpu_data.x86_model == 10)); + +Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") +Signed-off-by: Randy Dunlap +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221201012541.11809-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/mfd/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig +index 30db49f3..7ed31fbd 100644 +--- a/drivers/mfd/Kconfig ++++ b/drivers/mfd/Kconfig +@@ -15,6 +15,7 @@ config MFD_CS5535 + tristate "AMD CS5535 and CS5536 southbridge core functions" + select MFD_CORE + depends on PCI && (X86_32 || (X86 && COMPILE_TEST)) ++ depends on !UML + help + This is the core driver for CS5535/CS5536 MFD functions. This is + necessary for using the board's GPIO and MFGPT functionality. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-482-mfd-pcf50633-adc-Fix-potential-memleak-in-pcf50.patch b/patches.kernel.org/6.2.3-482-mfd-pcf50633-adc-Fix-potential-memleak-in-pcf50.patch new file mode 100644 index 0000000..1472cb6 --- /dev/null +++ b/patches.kernel.org/6.2.3-482-mfd-pcf50633-adc-Fix-potential-memleak-in-pcf50.patch @@ -0,0 +1,52 @@ +From: Qiheng Lin +Date: Thu, 8 Dec 2022 14:15:55 +0800 +Subject: [PATCH] mfd: pcf50633-adc: Fix potential memleak in + pcf50633_adc_async_read() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8b450dcff23aa254844492831a8e2b508a9d522d + +[ Upstream commit 8b450dcff23aa254844492831a8e2b508a9d522d ] + +`req` is allocated in pcf50633_adc_async_read(), but +adc_enqueue_request() could fail to insert the `req` into queue. +We need to check the return value and free it in the case of failure. + +Fixes: 08c3e06a5eb2 ("mfd: PCF50633 adc driver") +Signed-off-by: Qiheng Lin +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221208061555.8776-1-linqiheng@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/mfd/pcf50633-adc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c +index 5cd653e6..191b1bc6 100644 +--- a/drivers/mfd/pcf50633-adc.c ++++ b/drivers/mfd/pcf50633-adc.c +@@ -136,6 +136,7 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, + void *callback_param) + { + struct pcf50633_adc_request *req; ++ int ret; + + /* req is freed when the result is ready, in interrupt handler */ + req = kmalloc(sizeof(*req), GFP_KERNEL); +@@ -147,7 +148,11 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, + req->callback = callback; + req->callback_param = callback_param; + +- return adc_enqueue_request(pcf, req); ++ ret = adc_enqueue_request(pcf, req); ++ if (ret) ++ kfree(req); ++ ++ return ret; + } + EXPORT_SYMBOL_GPL(pcf50633_adc_async_read); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-483-dmaengine-idxd-Set-traffic-class-values-in-GRPC.patch b/patches.kernel.org/6.2.3-483-dmaengine-idxd-Set-traffic-class-values-in-GRPC.patch new file mode 100644 index 0000000..ad6ae04 --- /dev/null +++ b/patches.kernel.org/6.2.3-483-dmaengine-idxd-Set-traffic-class-values-in-GRPC.patch @@ -0,0 +1,81 @@ +From: Fenghua Yu +Date: Fri, 9 Dec 2022 09:21:41 -0800 +Subject: [PATCH] dmaengine: idxd: Set traffic class values in GRPCFG on DSA + 2.0 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9735bde36487da43d3c3fc910df49639f72decbf + +[ Upstream commit 9735bde36487da43d3c3fc910df49639f72decbf ] + +On DSA/IAX 1.0, TC-A and TC-B in GRPCFG are set as 1 to have best +performance and cannot be changed through sysfs knobs unless override +option is given. + +The same values should be set on DSA 2.0 as well. + +Fixes: ea7c8f598c32 ("dmaengine: idxd: restore traffic class defaults after wq reset") +Fixes: ade8a86b512c ("dmaengine: idxd: Set defaults for GRPCFG traffic class") +Signed-off-by: Fenghua Yu +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20221209172141.562648-1-fenghua.yu@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/idxd/device.c | 2 +- + drivers/dma/idxd/init.c | 2 +- + drivers/dma/idxd/sysfs.c | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c +index 29dbb0f5..8b4573dc 100644 +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -701,7 +701,7 @@ static void idxd_groups_clear_state(struct idxd_device *idxd) + group->use_rdbuf_limit = false; + group->rdbufs_allowed = 0; + group->rdbufs_reserved = 0; +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) { ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) { + group->tc_a = 1; + group->tc_b = 1; + } else { +diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c +index 529ea09c..e63b0c67 100644 +--- a/drivers/dma/idxd/init.c ++++ b/drivers/dma/idxd/init.c +@@ -295,7 +295,7 @@ static int idxd_setup_groups(struct idxd_device *idxd) + } + + idxd->groups[i] = group; +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) { ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) { + group->tc_a = 1; + group->tc_b = 1; + } else { +diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c +index 3229dfc7..18cd8151 100644 +--- a/drivers/dma/idxd/sysfs.c ++++ b/drivers/dma/idxd/sysfs.c +@@ -387,7 +387,7 @@ static ssize_t group_traffic_class_a_store(struct device *dev, + if (idxd->state == IDXD_DEV_ENABLED) + return -EPERM; + +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) + return -EPERM; + + if (val < 0 || val > 7) +@@ -429,7 +429,7 @@ static ssize_t group_traffic_class_b_store(struct device *dev, + if (idxd->state == IDXD_DEV_ENABLED) + return -EPERM; + +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) + return -EPERM; + + if (val < 0 || val > 7) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-484-RDMA-erdma-Fix-refcount-leak-in-erdma_mmap.patch b/patches.kernel.org/6.2.3-484-RDMA-erdma-Fix-refcount-leak-in-erdma_mmap.patch new file mode 100644 index 0000000..901a041 --- /dev/null +++ b/patches.kernel.org/6.2.3-484-RDMA-erdma-Fix-refcount-leak-in-erdma_mmap.patch @@ -0,0 +1,47 @@ +From: Miaoqian Lin +Date: Tue, 20 Dec 2022 16:11:39 +0400 +Subject: [PATCH] RDMA/erdma: Fix refcount leak in erdma_mmap +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ee84146c05ad2316b9a7222d0ec4413e0bf30eeb + +[ Upstream commit ee84146c05ad2316b9a7222d0ec4413e0bf30eeb ] + +rdma_user_mmap_entry_get() take reference, we should release it when not +need anymore, add the missing rdma_user_mmap_entry_put() in the error +path to fix it. + +Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20221220121139.1540564-1-linmq006@gmail.com +Acked-by: Cheng Xu +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/erdma/erdma_verbs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c +index 5dab1e87..9c30d787 100644 +--- a/drivers/infiniband/hw/erdma/erdma_verbs.c ++++ b/drivers/infiniband/hw/erdma/erdma_verbs.c +@@ -1110,12 +1110,14 @@ int erdma_mmap(struct ib_ucontext *ctx, struct vm_area_struct *vma) + prot = pgprot_device(vma->vm_page_prot); + break; + default: +- return -EINVAL; ++ err = -EINVAL; ++ goto put_entry; + } + + err = rdma_user_mmap_io(ctx, vma, PFN_DOWN(entry->address), PAGE_SIZE, + prot, rdma_entry); + ++put_entry: + rdma_user_mmap_entry_put(rdma_entry); + return err; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-485-dmaengine-HISI_DMA-should-depend-on-ARCH_HISI.patch b/patches.kernel.org/6.2.3-485-dmaengine-HISI_DMA-should-depend-on-ARCH_HISI.patch new file mode 100644 index 0000000..01f641c --- /dev/null +++ b/patches.kernel.org/6.2.3-485-dmaengine-HISI_DMA-should-depend-on-ARCH_HISI.patch @@ -0,0 +1,39 @@ +From: Geert Uytterhoeven +Date: Mon, 21 Nov 2022 16:23:53 +0100 +Subject: [PATCH] dmaengine: HISI_DMA should depend on ARCH_HISI +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dcca9d045c0852584ad092123c7f6e6526a633b1 + +[ Upstream commit dcca9d045c0852584ad092123c7f6e6526a633b1 ] + +The HiSilicon DMA Engine is only present on HiSilicon SoCs. Hence add a +dependency on ARCH_HISI, to prevent asking the user about this driver +when configuring a kernel without HiSilicon SoC support. + +Fixes: e9f08b65250d73ab ("dmaengine: hisilicon: Add Kunpeng DMA engine support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/363a1816d36cd3cf604d88ec90f97c75f604de64.1669044190.git.geert+renesas@glider.be +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig +index b6d48d54..7b95f07c 100644 +--- a/drivers/dma/Kconfig ++++ b/drivers/dma/Kconfig +@@ -245,7 +245,7 @@ config FSL_RAID + + config HISI_DMA + tristate "HiSilicon DMA Engine support" +- depends on ARM64 || COMPILE_TEST ++ depends on ARCH_HISI || COMPILE_TEST + depends on PCI_MSI + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-486-RDMA-hns-Fix-refcount-leak-in-hns_roce_mmap.patch b/patches.kernel.org/6.2.3-486-RDMA-hns-Fix-refcount-leak-in-hns_roce_mmap.patch new file mode 100644 index 0000000..5ac1344 --- /dev/null +++ b/patches.kernel.org/6.2.3-486-RDMA-hns-Fix-refcount-leak-in-hns_roce_mmap.patch @@ -0,0 +1,48 @@ +From: Miaoqian Lin +Date: Fri, 23 Dec 2022 11:29:00 +0400 +Subject: [PATCH] RDMA/hns: Fix refcount leak in hns_roce_mmap +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cf6a05c8494a8ae7fec8e5f1229b45ca5b4bcd30 + +[ Upstream commit cf6a05c8494a8ae7fec8e5f1229b45ca5b4bcd30 ] + +rdma_user_mmap_entry_get_pgoff() takes the reference. +Add missing rdma_user_mmap_entry_put() to release the reference. + +Fixes: 0045e0d3f42e ("RDMA/hns: Support direct wqe of userspace") +Signed-off-by: Miaoqian Lin +Acked-by Haoyue Xu +Link: https://lore.kernel.org/r/20221223072900.802728-1-linmq006@gmail.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/hns/hns_roce_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index 8ba68ac1..946ba110 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -443,14 +443,15 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) + prot = pgprot_device(vma->vm_page_prot); + break; + default: +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + + ret = rdma_user_mmap_io(uctx, vma, pfn, rdma_entry->npages * PAGE_SIZE, + prot, rdma_entry); + ++out: + rdma_user_mmap_entry_put(rdma_entry); +- + return ret; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-487-iio-light-tsl2563-Do-not-hardcode-interrupt-tri.patch b/patches.kernel.org/6.2.3-487-iio-light-tsl2563-Do-not-hardcode-interrupt-tri.patch new file mode 100644 index 0000000..6a85560 --- /dev/null +++ b/patches.kernel.org/6.2.3-487-iio-light-tsl2563-Do-not-hardcode-interrupt-tri.patch @@ -0,0 +1,58 @@ +From: Ferry Toth +Date: Wed, 7 Dec 2022 21:03:38 +0200 +Subject: [PATCH] iio: light: tsl2563: Do not hardcode interrupt trigger type +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 027641b52fe37b64af61025298ce160c8b9b7a73 + +[ Upstream commit 027641b52fe37b64af61025298ce160c8b9b7a73 ] + +Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_RAISING, +let's respect the settings specified in the firmware description. +To be compatible with the older firmware descriptions, if trigger +type is not set up there, we'll set it to default (raising edge). + +Fixes: 388be4883952 ("staging:iio: tsl2563 abi fixes and interrupt handling") +Fixes: bdab1001738f ("staging:iio:light:tsl2563 remove old style event registration.") +Signed-off-by: Ferry Toth +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20221207190348.9347-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iio/light/tsl2563.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c +index d0e42b73..71302ae8 100644 +--- a/drivers/iio/light/tsl2563.c ++++ b/drivers/iio/light/tsl2563.c +@@ -704,6 +704,7 @@ static int tsl2563_probe(struct i2c_client *client) + struct iio_dev *indio_dev; + struct tsl2563_chip *chip; + struct tsl2563_platform_data *pdata = client->dev.platform_data; ++ unsigned long irq_flags; + int err = 0; + u8 id = 0; + +@@ -759,10 +760,15 @@ static int tsl2563_probe(struct i2c_client *client) + indio_dev->info = &tsl2563_info_no_irq; + + if (client->irq) { ++ irq_flags = irq_get_trigger_type(client->irq); ++ if (irq_flags == IRQF_TRIGGER_NONE) ++ irq_flags = IRQF_TRIGGER_RISING; ++ irq_flags |= IRQF_ONESHOT; ++ + err = devm_request_threaded_irq(&client->dev, client->irq, + NULL, + &tsl2563_event_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ irq_flags, + "tsl2563_event", + indio_dev); + if (err) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-488-usb-gadget-fusb300_udc-free-irq-on-the-error-pa.patch b/patches.kernel.org/6.2.3-488-usb-gadget-fusb300_udc-free-irq-on-the-error-pa.patch new file mode 100644 index 0000000..928a324 --- /dev/null +++ b/patches.kernel.org/6.2.3-488-usb-gadget-fusb300_udc-free-irq-on-the-error-pa.patch @@ -0,0 +1,74 @@ +From: Gaosheng Cui +Date: Wed, 23 Nov 2022 09:41:21 +0800 +Subject: [PATCH] usb: gadget: fusb300_udc: free irq on the error path in + fusb300_probe() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a8d3392e0e5cfeb03f0cea1f2bc3f5f183c1deb4 + +[ Upstream commit a8d3392e0e5cfeb03f0cea1f2bc3f5f183c1deb4 ] + +When request_irq(ires1->start) failed in w5300_hw_probe(), irq +ires->start has not been freed, and on the clean_up3 error path, +we also need to free ires1->start irq, fix it. + +In addition, We should add free_irq in fusb300_remove(), and give +the lables a proper name so that they can be understood easily, +so add free_irq in fusb300_remove(), and update clean_up3 to +err_alloc_request. + +Fixes: 0fe6f1d1f612 ("usb: udc: add Faraday fusb300 driver") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221123014121.1989721-1-cuigaosheng1@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/usb/gadget/udc/fusb300_udc.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c +index 5954800d..08ba9c8c 100644 +--- a/drivers/usb/gadget/udc/fusb300_udc.c ++++ b/drivers/usb/gadget/udc/fusb300_udc.c +@@ -1346,6 +1346,7 @@ static int fusb300_remove(struct platform_device *pdev) + usb_del_gadget_udc(&fusb300->gadget); + iounmap(fusb300->reg); + free_irq(platform_get_irq(pdev, 0), fusb300); ++ free_irq(platform_get_irq(pdev, 1), fusb300); + + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); + for (i = 0; i < FUSB300_MAX_NUM_EP; i++) +@@ -1431,7 +1432,7 @@ static int fusb300_probe(struct platform_device *pdev) + IRQF_SHARED, udc_name, fusb300); + if (ret < 0) { + pr_err("request_irq1 error (%d)\n", ret); +- goto clean_up; ++ goto err_request_irq1; + } + + INIT_LIST_HEAD(&fusb300->gadget.ep_list); +@@ -1470,7 +1471,7 @@ static int fusb300_probe(struct platform_device *pdev) + GFP_KERNEL); + if (fusb300->ep0_req == NULL) { + ret = -ENOMEM; +- goto clean_up3; ++ goto err_alloc_request; + } + + init_controller(fusb300); +@@ -1485,7 +1486,10 @@ static int fusb300_probe(struct platform_device *pdev) + err_add_udc: + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); + +-clean_up3: ++err_alloc_request: ++ free_irq(ires1->start, fusb300); ++ ++err_request_irq1: + free_irq(ires->start, fusb300); + + clean_up: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-489-i2c-designware-fix-i2c_dw_clk_rate-return-size-.patch b/patches.kernel.org/6.2.3-489-i2c-designware-fix-i2c_dw_clk_rate-return-size-.patch new file mode 100644 index 0000000..ad85b91 --- /dev/null +++ b/patches.kernel.org/6.2.3-489-i2c-designware-fix-i2c_dw_clk_rate-return-size-.patch @@ -0,0 +1,53 @@ +From: Hanna Hawa +Date: Mon, 19 Dec 2022 17:23:45 +0000 +Subject: [PATCH] i2c: designware: fix i2c_dw_clk_rate() return size to be u32 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f2e1fa99550dd7a882229e2c2cd9ecab4ce773d0 + +[ Upstream commit f2e1fa99550dd7a882229e2c2cd9ecab4ce773d0 ] + +Make i2c_dw_clk_rate() to return u32 instead of unsigned long, as the +function return the value of get_clk_rate_khz() which returns u32. + +Fixes: b33af11de236 ("i2c: designware: Do not require clock when SSCN and FFCN are provided") +Signed-off-by: Hanna Hawa +Reviewed-by: Andy Shevchenko +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-designware-common.c | 2 +- + drivers/i2c/busses/i2c-designware-core.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c +index 581e02cc..2f2e9988 100644 +--- a/drivers/i2c/busses/i2c-designware-common.c ++++ b/drivers/i2c/busses/i2c-designware-common.c +@@ -465,7 +465,7 @@ void __i2c_dw_disable(struct dw_i2c_dev *dev) + dev_warn(dev->dev, "timeout in disabling adapter\n"); + } + +-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev) ++u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev) + { + /* + * Clock is not necessary if we got LCNT/HCNT values directly from +diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h +index 95ebc5ea..6bc2edec 100644 +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -320,7 +320,7 @@ int i2c_dw_init_regmap(struct dw_i2c_dev *dev); + u32 i2c_dw_scl_hcnt(u32 ic_clk, u32 tSYMBOL, u32 tf, int cond, int offset); + u32 i2c_dw_scl_lcnt(u32 ic_clk, u32 tLOW, u32 tf, int offset); + int i2c_dw_set_sda_hold(struct dw_i2c_dev *dev); +-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev); ++u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev); + int i2c_dw_prepare_clk(struct dw_i2c_dev *dev, bool prepare); + int i2c_dw_acquire_lock(struct dw_i2c_dev *dev); + void i2c_dw_release_lock(struct dw_i2c_dev *dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-490-i2c-qcom-geni-change-i2c_master_hub-to-static.patch b/patches.kernel.org/6.2.3-490-i2c-qcom-geni-change-i2c_master_hub-to-static.patch new file mode 100644 index 0000000..5a03495 --- /dev/null +++ b/patches.kernel.org/6.2.3-490-i2c-qcom-geni-change-i2c_master_hub-to-static.patch @@ -0,0 +1,38 @@ +From: Yang Yingliang +Date: Wed, 28 Dec 2022 17:34:02 +0800 +Subject: [PATCH] i2c: qcom-geni: change i2c_master_hub to static +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 597688792c4d9939e1900f5840ca18804e9d4290 + +[ Upstream commit 597688792c4d9939e1900f5840ca18804e9d4290 ] + +i2c_master_hub is only used in i2c-qcom-geni.c now, +change it to static. + +Fixes: cacd9643eca7 ("i2c: qcom-geni: add support for I2C Master Hub variant") +Signed-off-by: Yang Yingliang +Reviewed-by: Bjorn Andersson +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/i2c/busses/i2c-qcom-geni.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c +index fd70794b..a378f679 100644 +--- a/drivers/i2c/busses/i2c-qcom-geni.c ++++ b/drivers/i2c/busses/i2c-qcom-geni.c +@@ -1025,7 +1025,7 @@ static const struct dev_pm_ops geni_i2c_pm_ops = { + NULL) + }; + +-const struct geni_i2c_desc i2c_master_hub = { ++static const struct geni_i2c_desc i2c_master_hub = { + .has_core_clk = true, + .icc_ddr = NULL, + .no_dma_support = true, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-491-soundwire-cadence-Don-t-overflow-the-command-FI.patch b/patches.kernel.org/6.2.3-491-soundwire-cadence-Don-t-overflow-the-command-FI.patch new file mode 100644 index 0000000..6b30573 --- /dev/null +++ b/patches.kernel.org/6.2.3-491-soundwire-cadence-Don-t-overflow-the-command-FI.patch @@ -0,0 +1,49 @@ +From: Richard Fitzgerald +Date: Fri, 2 Dec 2022 16:18:10 +0000 +Subject: [PATCH] soundwire: cadence: Don't overflow the command FIFOs +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7cbfee2e2e40d2be54196362a845a3ea0a3f877d + +[ Upstream commit 7cbfee2e2e40d2be54196362a845a3ea0a3f877d ] + +The command FIFOs in the Cadence IP can be configured during design +up to 32 entries, and the code in cadence_master.c was assuming the +full 32-entry FIFO. But all current Intel implementations use an 8-entry +FIFO. + +Up to now the longest message used was 6 entries so this wasn't +causing any problem. But future Cirrus Logic codecs have downloadable +firmware or tuning blobs. It is more efficient for the codec driver to +issue long transfers that can take advantage of any queuing in the +Soundwire controller and avoid the overhead of repeatedly writing the +page registers. + +Signed-off-by: Richard Fitzgerald +Reviewed-by: Pierre-Louis Bossart +Fixes: 2f52a5177caa ("soundwire: cdns: Add cadence library") +Link: https://lore.kernel.org/r/20221202161812.4186897-2-rf@opensource.cirrus.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/soundwire/cadence_master.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index a1de363e..27699f34 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -127,7 +127,8 @@ MODULE_PARM_DESC(cdns_mcp_int_mask, "Cadence MCP IntMask"); + + #define CDNS_MCP_CMD_BASE 0x80 + #define CDNS_MCP_RESP_BASE 0x80 +-#define CDNS_MCP_CMD_LEN 0x20 ++/* FIFO can hold 8 commands */ ++#define CDNS_MCP_CMD_LEN 8 + #define CDNS_MCP_CMD_WORD_LEN 0x4 + + #define CDNS_MCP_CMD_SSP_TAG BIT(31) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-492-driver-core-fix-potential-null-ptr-deref-in-dev.patch b/patches.kernel.org/6.2.3-492-driver-core-fix-potential-null-ptr-deref-in-dev.patch new file mode 100644 index 0000000..5ce8aa7 --- /dev/null +++ b/patches.kernel.org/6.2.3-492-driver-core-fix-potential-null-ptr-deref-in-dev.patch @@ -0,0 +1,73 @@ +From: Yang Yingliang +Date: Mon, 5 Dec 2022 11:49:04 +0800 +Subject: [PATCH] driver core: fix potential null-ptr-deref in device_add() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f6837f34a34973ef6600c08195ed300e24e97317 + +[ Upstream commit f6837f34a34973ef6600c08195ed300e24e97317 ] + +I got the following null-ptr-deref report while doing fault injection test: + +BUG: kernel NULL pointer dereference, address: 0000000000000058 +CPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+ +RIP: 0010:klist_put+0x2d/0xd0 +Call Trace: + + klist_remove+0xf1/0x1c0 + device_release_driver_internal+0x196/0x210 + bus_remove_device+0x1bd/0x240 + device_add+0xd3d/0x1100 + w1_add_master_device+0x476/0x490 [wire] + ds2482_probe+0x303/0x3e0 [ds2482] + +This is how it happened: + +w1_alloc_dev() + // The dev->driver is set to w1_master_driver. + memcpy(&dev->dev, device, sizeof(struct device)); + device_add() + bus_add_device() + dpm_sysfs_add() // It fails, calls bus_remove_device. + + // error path + bus_remove_device() + // The dev->driver is not null, but driver is not bound. + __device_release_driver() + klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref. + + // normal path + bus_probe_device() // It's not called yet. + device_bind_driver() + +If dev->driver is set, in the error path after calling bus_add_device() +in device_add(), bus_remove_device() is called, then the device will be +detached from driver. But device_bind_driver() is not called yet, so it +causes null-ptr-deref while access the 'knode_driver'. To fix this, set +dev->driver to null in the error path before calling bus_remove_device(). + +Fixes: 57eee3d23e88 ("Driver core: Call device_pm_add() after bus_add_device() in device_add()") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221205034904.2077765-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index a3e14143..506289e6 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3513,6 +3513,7 @@ int device_add(struct device *dev) + device_pm_remove(dev); + dpm_sysfs_remove(dev); + DPMError: ++ dev->driver = NULL; + bus_remove_device(dev); + BusError: + device_remove_attrs(dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-493-kobject-Fix-slab-out-of-bounds-in-fill_kobj_pat.patch b/patches.kernel.org/6.2.3-493-kobject-Fix-slab-out-of-bounds-in-fill_kobj_pat.patch new file mode 100644 index 0000000..754a4ed --- /dev/null +++ b/patches.kernel.org/6.2.3-493-kobject-Fix-slab-out-of-bounds-in-fill_kobj_pat.patch @@ -0,0 +1,149 @@ +From: Wang Hai +Date: Tue, 20 Dec 2022 09:21:43 +0800 +Subject: [PATCH] kobject: Fix slab-out-of-bounds in fill_kobj_path() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3bb2a01caa813d3a1845d378bbe4169ef280d394 + +[ Upstream commit 3bb2a01caa813d3a1845d378bbe4169ef280d394 ] + +In kobject_get_path(), if kobj->name is changed between calls +get_kobj_path_length() and fill_kobj_path() and the length becomes +longer, then fill_kobj_path() will have an out-of-bounds bug. + +The actual current problem occurs when the ixgbe probe. + +In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name +length becomes longer, out-of-bounds will occur. + +cpu0 cpu1 +ixgbe_probe + register_netdev(netdev) + netdev_register_kobject + device_add + kobject_uevent // Sending ADD events + systemd-udevd // rename netdev + dev_change_name + device_rename + kobject_rename + ixgbe_mii_bus_init | + mdiobus_register | + __mdiobus_register | + device_register | + device_add | + kobject_uevent | + kobject_get_path | + len = get_kobj_path_length // old name | + path = kzalloc(len, gfp_mask); | + kobj->name = name; + /* name length becomes + * longer + */ + fill_kobj_path /* kobj path length is + * longer than path, + * resulting in out of + * bounds when filling path + */ + +This is the kasan report: + +================================================================== +BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0 +Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673 + + Workqueue: events work_for_cpu_fn + Call Trace: + + dump_stack_lvl+0x34/0x48 + print_address_description.constprop.0+0x86/0x1e7 + print_report+0x36/0x4f + kasan_report+0xad/0x130 + kasan_check_range+0x35/0x1c0 + memcpy+0x39/0x60 + fill_kobj_path+0x50/0xc0 + kobject_get_path+0x5a/0xc0 + kobject_uevent_env+0x140/0x460 + device_add+0x5c7/0x910 + __mdiobus_register+0x14e/0x490 + ixgbe_probe.cold+0x441/0x574 [ixgbe] + local_pci_probe+0x78/0xc0 + work_for_cpu_fn+0x26/0x40 + process_one_work+0x3b6/0x6a0 + worker_thread+0x368/0x520 + kthread+0x165/0x1a0 + ret_from_fork+0x1f/0x30 + +This reproducer triggers that bug: + +while: +do + rmmod ixgbe + sleep 0.5 + modprobe ixgbe + sleep 0.5 + +When calling fill_kobj_path() to fill path, if the name length of +kobj becomes longer, return failure and retry. This fixes the problem. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Wang Hai +Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + lib/kobject.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/lib/kobject.c b/lib/kobject.c +index 985ee1c4..d20ce15e 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -112,7 +112,7 @@ static int get_kobj_path_length(const struct kobject *kobj) + return length; + } + +-static void fill_kobj_path(const struct kobject *kobj, char *path, int length) ++static int fill_kobj_path(const struct kobject *kobj, char *path, int length) + { + const struct kobject *parent; + +@@ -121,12 +121,16 @@ static void fill_kobj_path(const struct kobject *kobj, char *path, int length) + int cur = strlen(kobject_name(parent)); + /* back up enough to print this name with '/' */ + length -= cur; ++ if (length <= 0) ++ return -EINVAL; + memcpy(path + length, kobject_name(parent), cur); + *(path + --length) = '/'; + } + + pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj), + kobj, __func__, path); ++ ++ return 0; + } + + /** +@@ -141,13 +145,17 @@ char *kobject_get_path(const struct kobject *kobj, gfp_t gfp_mask) + char *path; + int len; + ++retry: + len = get_kobj_path_length(kobj); + if (len == 0) + return NULL; + path = kzalloc(len, gfp_mask); + if (!path) + return NULL; +- fill_kobj_path(kobj, path, len); ++ if (fill_kobj_path(kobj, path, len)) { ++ kfree(path); ++ goto retry; ++ } + + return path; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-494-alpha-boot-tools-objstrip-fix-the-check-for-ELF.patch b/patches.kernel.org/6.2.3-494-alpha-boot-tools-objstrip-fix-the-check-for-ELF.patch new file mode 100644 index 0000000..689afb2 --- /dev/null +++ b/patches.kernel.org/6.2.3-494-alpha-boot-tools-objstrip-fix-the-check-for-ELF.patch @@ -0,0 +1,37 @@ +From: Al Viro +Date: Mon, 9 Jan 2023 00:14:02 -0500 +Subject: [PATCH] alpha/boot/tools/objstrip: fix the check for ELF header +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1878787797cbb019eeefe6f905514dcd557302b6 + +[ Upstream commit 1878787797cbb019eeefe6f905514dcd557302b6 ] + +Just memcmp() with ELFMAG - that's the normal way to do it in userland +code, which that thing is. Besides, that has the benefit of actually +building - str_has_prefix() is *NOT* present in . + +Fixes: 5f14596e55de "alpha: Replace strncmp with str_has_prefix" +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/alpha/boot/tools/objstrip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/alpha/boot/tools/objstrip.c b/arch/alpha/boot/tools/objstrip.c +index 08b430d2..7cf92d17 100644 +--- a/arch/alpha/boot/tools/objstrip.c ++++ b/arch/alpha/boot/tools/objstrip.c +@@ -148,7 +148,7 @@ main (int argc, char *argv[]) + #ifdef __ELF__ + elf = (struct elfhdr *) buf; + +- if (elf->e_ident[0] == 0x7f && str_has_prefix((char *)elf->e_ident + 1, "ELF")) { ++ if (memcmp(&elf->e_ident[EI_MAG0], ELFMAG, SELFMAG) == 0) { + if (elf->e_type != ET_EXEC) { + fprintf(stderr, "%s: %s is not an ELF executable\n", + prog_name, inname); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-495-media-uvcvideo-Check-for-INACTIVE-in-uvc_ctrl_i.patch b/patches.kernel.org/6.2.3-495-media-uvcvideo-Check-for-INACTIVE-in-uvc_ctrl_i.patch new file mode 100644 index 0000000..1481f60 --- /dev/null +++ b/patches.kernel.org/6.2.3-495-media-uvcvideo-Check-for-INACTIVE-in-uvc_ctrl_i.patch @@ -0,0 +1,153 @@ +From: Hans Verkuil +Date: Tue, 3 Jan 2023 15:36:19 +0100 +Subject: [PATCH] media: uvcvideo: Check for INACTIVE in + uvc_ctrl_is_accessible() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9f582f0418ed1c18f92c9e4628075d6ec9a7d9fb + +[ Upstream commit 9f582f0418ed1c18f92c9e4628075d6ec9a7d9fb ] + +Check for inactive controls in uvc_ctrl_is_accessible(). + +Use the new value for the master_id controls if present, otherwise +use the existing value to determine if it is OK to set the control. +Doing this here avoids attempting to set an inactive control, which +will return an error from the USB device, which returns an invalid +errorcode. + +This fixes: + warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO +  warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO +test VIDIOC_G/S_CTRL: OK +  warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO +  warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO +  warn: v4l2-test-controls.cpp(816): s_ext_ctrls returned EIO +test VIDIOC_G/S/TRY_EXT_CTRLS: OK + +Tested with: +v4l2-ctl -c auto_exposure=1 +OK +v4l2-ctl -c exposure_time_absolute=251 +OK +v4l2-ctl -c auto_exposure=3 +OK +v4l2-ctl -c exposure_time_absolute=251 +VIDIOC_S_EXT_CTRLS: failed: Input/output error +exposure_time_absolute: Input/output error +ERROR +v4l2-ctl -c auto_exposure=3,exposure_time_absolute=251,auto_exposure=1 +v4l2-ctl -C auto_exposure,exposure_time_absolute   +auto_exposure: 1 +exposure_time_absolute: 251 + +Reviewed-by: Laurent Pinchart +Reviewed-by: Ricardo Ribalda +Signed-off-by: Hans Verkuil +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/usb/uvc/uvc_ctrl.c | 42 +++++++++++++++++++++++++++++++- + drivers/media/usb/uvc/uvc_v4l2.c | 3 +-- + drivers/media/usb/uvc/uvcvideo.h | 3 ++- + 3 files changed, 44 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index c95a2229..6f5aaaf0 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1085,11 +1085,28 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id, + return 0; + } + ++/* ++ * Check if control @v4l2_id can be accessed by the given control @ioctl ++ * (VIDIOC_G_EXT_CTRLS, VIDIOC_TRY_EXT_CTRLS or VIDIOC_S_EXT_CTRLS). ++ * ++ * For set operations on slave controls, check if the master's value is set to ++ * manual, either in the others controls set in the same ioctl call, or from ++ * the master's current value. This catches VIDIOC_S_EXT_CTRLS calls that set ++ * both the master and slave control, such as for instance setting ++ * auto_exposure=1, exposure_time_absolute=251. ++ */ + int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, +- bool read) ++ const struct v4l2_ext_controls *ctrls, ++ unsigned long ioctl) + { ++ struct uvc_control_mapping *master_map = NULL; ++ struct uvc_control *master_ctrl = NULL; + struct uvc_control_mapping *mapping; + struct uvc_control *ctrl; ++ bool read = ioctl == VIDIOC_G_EXT_CTRLS; ++ s32 val; ++ int ret; ++ int i; + + if (__uvc_query_v4l2_class(chain, v4l2_id, 0) >= 0) + return -EACCES; +@@ -1104,6 +1121,29 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, + if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR) && !read) + return -EACCES; + ++ if (ioctl != VIDIOC_S_EXT_CTRLS || !mapping->master_id) ++ return 0; ++ ++ /* ++ * Iterate backwards in cases where the master control is accessed ++ * multiple times in the same ioctl. We want the last value. ++ */ ++ for (i = ctrls->count - 1; i >= 0; i--) { ++ if (ctrls->controls[i].id == mapping->master_id) ++ return ctrls->controls[i].value == ++ mapping->master_manual ? 0 : -EACCES; ++ } ++ ++ __uvc_find_control(ctrl->entity, mapping->master_id, &master_map, ++ &master_ctrl, 0); ++ ++ if (!master_ctrl || !(master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR)) ++ return 0; ++ ++ ret = __uvc_ctrl_get(chain, master_ctrl, master_map, &val); ++ if (ret >= 0 && val != mapping->master_manual) ++ return -EACCES; ++ + return 0; + } + +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index f4d4c33b..3edb54c0 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -1020,8 +1020,7 @@ static int uvc_ctrl_check_access(struct uvc_video_chain *chain, + int ret = 0; + + for (i = 0; i < ctrls->count; ++ctrl, ++i) { +- ret = uvc_ctrl_is_accessible(chain, ctrl->id, +- ioctl == VIDIOC_G_EXT_CTRLS); ++ ret = uvc_ctrl_is_accessible(chain, ctrl->id, ctrls, ioctl); + if (ret) + break; + } +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index df93db25..a151f583 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -761,7 +761,8 @@ static inline int uvc_ctrl_rollback(struct uvc_fh *handle) + int uvc_ctrl_get(struct uvc_video_chain *chain, struct v4l2_ext_control *xctrl); + int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl); + int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, +- bool read); ++ const struct v4l2_ext_controls *ctrls, ++ unsigned long ioctl); + + int uvc_xu_ctrl_query(struct uvc_video_chain *chain, + struct uvc_xu_control_query *xqry); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-496-media-uvcvideo-Implement-mask-for-V4L2_CTRL_TYP.patch b/patches.kernel.org/6.2.3-496-media-uvcvideo-Implement-mask-for-V4L2_CTRL_TYP.patch new file mode 100644 index 0000000..c853759 --- /dev/null +++ b/patches.kernel.org/6.2.3-496-media-uvcvideo-Implement-mask-for-V4L2_CTRL_TYP.patch @@ -0,0 +1,189 @@ +From: Ricardo Ribalda +Date: Thu, 5 Jan 2023 14:52:54 +0100 +Subject: [PATCH] media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 40140eda661ea4be219ef194a4f43b7b5e3bbd27 + +[ Upstream commit 40140eda661ea4be219ef194a4f43b7b5e3bbd27 ] + +Replace the count with a mask field that lets us choose not only the max +value, but also the minimum value and what values are valid in between. + +Suggested-by: Laurent Pinchart +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Stable-dep-of: 3aa8628eb78a ("media: uvcvideo: Refactor power_line_frequency_controls_limited") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/usb/uvc/uvc_ctrl.c | 33 +++++++++++++++++++++--------- + drivers/media/usb/uvc/uvc_driver.c | 4 +++- + drivers/media/usb/uvc/uvc_v4l2.c | 3 ++- + drivers/media/usb/uvc/uvcvideo.h | 2 +- + 4 files changed, 29 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 6f5aaaf0..32c18298 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -6,6 +6,7 @@ + * Laurent Pinchart (laurent.pinchart@ideasonboard.com) + */ + ++#include + #include + #include + #include +@@ -525,7 +526,8 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + .v4l2_type = V4L2_CTRL_TYPE_MENU, + .data_type = UVC_CTRL_DATA_TYPE_BITMASK, + .menu_info = exposure_auto_controls, +- .menu_count = ARRAY_SIZE(exposure_auto_controls), ++ .menu_mask = GENMASK(V4L2_EXPOSURE_APERTURE_PRIORITY, ++ V4L2_EXPOSURE_AUTO), + .slave_ids = { V4L2_CID_EXPOSURE_ABSOLUTE, }, + }, + { +@@ -731,7 +733,8 @@ static const struct uvc_control_mapping uvc_ctrl_mappings_uvc11[] = { + .v4l2_type = V4L2_CTRL_TYPE_MENU, + .data_type = UVC_CTRL_DATA_TYPE_ENUM, + .menu_info = power_line_frequency_controls, +- .menu_count = ARRAY_SIZE(power_line_frequency_controls) - 1, ++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ, ++ V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), + }, + }; + +@@ -745,7 +748,8 @@ static const struct uvc_control_mapping uvc_ctrl_mappings_uvc15[] = { + .v4l2_type = V4L2_CTRL_TYPE_MENU, + .data_type = UVC_CTRL_DATA_TYPE_ENUM, + .menu_info = power_line_frequency_controls, +- .menu_count = ARRAY_SIZE(power_line_frequency_controls), ++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO, ++ V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), + }, + }; + +@@ -975,7 +979,9 @@ static s32 __uvc_ctrl_get_value(struct uvc_control_mapping *mapping, + const struct uvc_menu_info *menu = mapping->menu_info; + unsigned int i; + +- for (i = 0; i < mapping->menu_count; ++i, ++menu) { ++ for (i = 0; BIT(i) <= mapping->menu_mask; ++i, ++menu) { ++ if (!test_bit(i, &mapping->menu_mask)) ++ continue; + if (menu->value == value) { + value = i; + break; +@@ -1209,12 +1215,14 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain, + + switch (mapping->v4l2_type) { + case V4L2_CTRL_TYPE_MENU: +- v4l2_ctrl->minimum = 0; +- v4l2_ctrl->maximum = mapping->menu_count - 1; ++ v4l2_ctrl->minimum = ffs(mapping->menu_mask) - 1; ++ v4l2_ctrl->maximum = fls(mapping->menu_mask) - 1; + v4l2_ctrl->step = 1; + + menu = mapping->menu_info; +- for (i = 0; i < mapping->menu_count; ++i, ++menu) { ++ for (i = 0; BIT(i) <= mapping->menu_mask; ++i, ++menu) { ++ if (!test_bit(i, &mapping->menu_mask)) ++ continue; + if (menu->value == v4l2_ctrl->default_value) { + v4l2_ctrl->default_value = i; + break; +@@ -1329,7 +1337,7 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain, + goto done; + } + +- if (query_menu->index >= mapping->menu_count) { ++ if (!test_bit(query_menu->index, &mapping->menu_mask)) { + ret = -EINVAL; + goto done; + } +@@ -1837,8 +1845,13 @@ int uvc_ctrl_set(struct uvc_fh *handle, + break; + + case V4L2_CTRL_TYPE_MENU: +- if (xctrl->value < 0 || xctrl->value >= mapping->menu_count) ++ if (xctrl->value < (ffs(mapping->menu_mask) - 1) || ++ xctrl->value > (fls(mapping->menu_mask) - 1)) + return -ERANGE; ++ ++ if (!test_bit(xctrl->value, &mapping->menu_mask)) ++ return -EINVAL; ++ + value = mapping->menu_info[xctrl->value].value; + + /* +@@ -2277,7 +2290,7 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain, + + INIT_LIST_HEAD(&map->ev_subs); + +- size = sizeof(*mapping->menu_info) * mapping->menu_count; ++ size = sizeof(*mapping->menu_info) * fls(mapping->menu_mask); + map->menu_info = kmemdup(mapping->menu_info, size, GFP_KERNEL); + if (map->menu_info == NULL) { + kfree(map->name); +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index e4bcb501..1c8d936e 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -7,6 +7,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -2384,7 +2385,8 @@ static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = { + .v4l2_type = V4L2_CTRL_TYPE_MENU, + .data_type = UVC_CTRL_DATA_TYPE_ENUM, + .menu_info = power_line_frequency_controls_limited, +- .menu_count = ARRAY_SIZE(power_line_frequency_controls_limited), ++ .menu_mask = ++ GENMASK(ARRAY_SIZE(power_line_frequency_controls_limited) - 1, 0), + }; + + static const struct uvc_device_info uvc_ctrl_power_line_limited = { +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index 3edb54c0..0774a113 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -6,6 +6,7 @@ + * Laurent Pinchart (laurent.pinchart@ideasonboard.com) + */ + ++#include + #include + #include + #include +@@ -80,7 +81,7 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, + goto free_map; + } + +- map->menu_count = xmap->menu_count; ++ map->menu_mask = GENMASK(xmap->menu_count - 1, 0); + break; + + default: +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index a151f583..f75e5864 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -117,7 +117,7 @@ struct uvc_control_mapping { + u32 data_type; + + const struct uvc_menu_info *menu_info; +- u32 menu_count; ++ unsigned long menu_mask; + + u32 master_id; + s32 master_manual; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-497-media-uvcvideo-Refactor-uvc_ctrl_mappings_uvcXX.patch b/patches.kernel.org/6.2.3-497-media-uvcvideo-Refactor-uvc_ctrl_mappings_uvcXX.patch new file mode 100644 index 0000000..d1af9dd --- /dev/null +++ b/patches.kernel.org/6.2.3-497-media-uvcvideo-Refactor-uvc_ctrl_mappings_uvcXX.patch @@ -0,0 +1,127 @@ +From: Ricardo Ribalda +Date: Thu, 5 Jan 2023 14:52:55 +0100 +Subject: [PATCH] media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 96a160b068e09b4ed5a32e2179e5219fc3545eca + +[ Upstream commit 96a160b068e09b4ed5a32e2179e5219fc3545eca ] + +Convert the array of structs into an array of pointers, that way the +mappings can be reused. + +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Stable-dep-of: 3aa8628eb78a ("media: uvcvideo: Refactor power_line_frequency_controls_limited") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/usb/uvc/uvc_ctrl.c | 74 ++++++++++++++++---------------- + 1 file changed, 37 insertions(+), 37 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 32c18298..3c46c33b 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -723,34 +723,40 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + }; + +-static const struct uvc_control_mapping uvc_ctrl_mappings_uvc11[] = { +- { +- .id = V4L2_CID_POWER_LINE_FREQUENCY, +- .entity = UVC_GUID_UVC_PROCESSING, +- .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, +- .size = 2, +- .offset = 0, +- .v4l2_type = V4L2_CTRL_TYPE_MENU, +- .data_type = UVC_CTRL_DATA_TYPE_ENUM, +- .menu_info = power_line_frequency_controls, +- .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ, +- V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), +- }, ++static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc11 = { ++ .id = V4L2_CID_POWER_LINE_FREQUENCY, ++ .entity = UVC_GUID_UVC_PROCESSING, ++ .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, ++ .size = 2, ++ .offset = 0, ++ .v4l2_type = V4L2_CTRL_TYPE_MENU, ++ .data_type = UVC_CTRL_DATA_TYPE_ENUM, ++ .menu_info = power_line_frequency_controls, ++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ, ++ V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), + }; + +-static const struct uvc_control_mapping uvc_ctrl_mappings_uvc15[] = { +- { +- .id = V4L2_CID_POWER_LINE_FREQUENCY, +- .entity = UVC_GUID_UVC_PROCESSING, +- .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, +- .size = 2, +- .offset = 0, +- .v4l2_type = V4L2_CTRL_TYPE_MENU, +- .data_type = UVC_CTRL_DATA_TYPE_ENUM, +- .menu_info = power_line_frequency_controls, +- .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO, +- V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), +- }, ++static const struct uvc_control_mapping *uvc_ctrl_mappings_uvc11[] = { ++ &uvc_ctrl_power_line_mapping_uvc11, ++ NULL, /* Sentinel */ ++}; ++ ++static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc15 = { ++ .id = V4L2_CID_POWER_LINE_FREQUENCY, ++ .entity = UVC_GUID_UVC_PROCESSING, ++ .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, ++ .size = 2, ++ .offset = 0, ++ .v4l2_type = V4L2_CTRL_TYPE_MENU, ++ .data_type = UVC_CTRL_DATA_TYPE_ENUM, ++ .menu_info = power_line_frequency_controls, ++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO, ++ V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), ++}; ++ ++static const struct uvc_control_mapping *uvc_ctrl_mappings_uvc15[] = { ++ &uvc_ctrl_power_line_mapping_uvc15, ++ NULL, /* Sentinel */ + }; + + /* ------------------------------------------------------------------------ +@@ -2474,8 +2480,7 @@ static void uvc_ctrl_prune_entity(struct uvc_device *dev, + static void uvc_ctrl_init_ctrl(struct uvc_video_chain *chain, + struct uvc_control *ctrl) + { +- const struct uvc_control_mapping *mappings; +- unsigned int num_mappings; ++ const struct uvc_control_mapping **mappings; + unsigned int i; + + /* +@@ -2542,16 +2547,11 @@ static void uvc_ctrl_init_ctrl(struct uvc_video_chain *chain, + } + + /* Finally process version-specific mappings. */ +- if (chain->dev->uvc_version < 0x0150) { +- mappings = uvc_ctrl_mappings_uvc11; +- num_mappings = ARRAY_SIZE(uvc_ctrl_mappings_uvc11); +- } else { +- mappings = uvc_ctrl_mappings_uvc15; +- num_mappings = ARRAY_SIZE(uvc_ctrl_mappings_uvc15); +- } ++ mappings = chain->dev->uvc_version < 0x0150 ++ ? uvc_ctrl_mappings_uvc11 : uvc_ctrl_mappings_uvc15; + +- for (i = 0; i < num_mappings; ++i) { +- const struct uvc_control_mapping *mapping = &mappings[i]; ++ for (i = 0; mappings[i]; ++i) { ++ const struct uvc_control_mapping *mapping = mappings[i]; + + if (uvc_entity_match_guid(ctrl->entity, mapping->entity) && + ctrl->info.selector == mapping->selector) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-498-media-uvcvideo-Refactor-power_line_frequency_co.patch b/patches.kernel.org/6.2.3-498-media-uvcvideo-Refactor-power_line_frequency_co.patch new file mode 100644 index 0000000..41f383a --- /dev/null +++ b/patches.kernel.org/6.2.3-498-media-uvcvideo-Refactor-power_line_frequency_co.patch @@ -0,0 +1,100 @@ +From: Ricardo Ribalda +Date: Thu, 5 Jan 2023 14:52:56 +0100 +Subject: [PATCH] media: uvcvideo: Refactor + power_line_frequency_controls_limited +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3aa8628eb78a63d0bf93e159846e9c92bccc8f69 + +[ Upstream commit 3aa8628eb78a63d0bf93e159846e9c92bccc8f69 ] + +Move the control mapping to uvc_ctrl.c. This way we do not have +references to UVC controls or V4L2 controls in uvc_driver.c. + +This also fixes a bug introduced in commit 382075604a68 ("media: +uvcvideo: Limit power line control for Quanta UVC Webcam"). The +offending commit caused the power line control menu entries to have +incorrect indices compared to the V4L2_CID_POWER_LINE_FREQUENCY_* +enumeration. Now that the limited mapping reuses the correct menu_info +array, the indices correctly map to the V4L2 control specification. + +Fixes: 382075604a68 ("media: uvcvideo: Limit power line control for Quanta UVC Webcam") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/usb/uvc/uvc_ctrl.c | 13 +++++++++++++ + drivers/media/usb/uvc/uvc_driver.c | 18 ------------------ + drivers/media/usb/uvc/uvcvideo.h | 1 + + 3 files changed, 14 insertions(+), 18 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 3c46c33b..44b0cfb8 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -723,6 +723,19 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + }; + ++const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = { ++ .id = V4L2_CID_POWER_LINE_FREQUENCY, ++ .entity = UVC_GUID_UVC_PROCESSING, ++ .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, ++ .size = 2, ++ .offset = 0, ++ .v4l2_type = V4L2_CTRL_TYPE_MENU, ++ .data_type = UVC_CTRL_DATA_TYPE_ENUM, ++ .menu_info = power_line_frequency_controls, ++ .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ, ++ V4L2_CID_POWER_LINE_FREQUENCY_50HZ), ++}; ++ + static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc11 = { + .id = V4L2_CID_POWER_LINE_FREQUENCY, + .entity = UVC_GUID_UVC_PROCESSING, +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 1c8d936e..d5ff8df2 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -2371,24 +2371,6 @@ MODULE_PARM_DESC(timeout, "Streaming control requests timeout"); + * Driver initialization and cleanup + */ + +-static const struct uvc_menu_info power_line_frequency_controls_limited[] = { +- { 1, "50 Hz" }, +- { 2, "60 Hz" }, +-}; +- +-static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = { +- .id = V4L2_CID_POWER_LINE_FREQUENCY, +- .entity = UVC_GUID_UVC_PROCESSING, +- .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, +- .size = 2, +- .offset = 0, +- .v4l2_type = V4L2_CTRL_TYPE_MENU, +- .data_type = UVC_CTRL_DATA_TYPE_ENUM, +- .menu_info = power_line_frequency_controls_limited, +- .menu_mask = +- GENMASK(ARRAY_SIZE(power_line_frequency_controls_limited) - 1, 0), +-}; +- + static const struct uvc_device_info uvc_ctrl_power_line_limited = { + .mappings = (const struct uvc_control_mapping *[]) { + &uvc_ctrl_power_line_mapping_limited, +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index f75e5864..1227ae63 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -728,6 +728,7 @@ int uvc_status_start(struct uvc_device *dev, gfp_t flags); + void uvc_status_stop(struct uvc_device *dev); + + /* Controls */ ++extern const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited; + extern const struct v4l2_subscribed_event_ops uvc_ctrl_sub_ev_ops; + + int uvc_query_v4l2_ctrl(struct uvc_video_chain *chain, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-499-coresight-etm4x-Fix-accesses-to-TRCSEQRSTEVR-an.patch b/patches.kernel.org/6.2.3-499-coresight-etm4x-Fix-accesses-to-TRCSEQRSTEVR-an.patch new file mode 100644 index 0000000..da585ab --- /dev/null +++ b/patches.kernel.org/6.2.3-499-coresight-etm4x-Fix-accesses-to-TRCSEQRSTEVR-an.patch @@ -0,0 +1,70 @@ +From: Junhao He +Date: Sat, 14 Jan 2023 17:16:32 +0800 +Subject: [PATCH] coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 589d928248b72f8377d45904a14bcf686aa8bbeb + +[ Upstream commit 589d928248b72f8377d45904a14bcf686aa8bbeb ] + +The TRCSEQRSTEVR and TRCSEQSTR registers are not implemented if the +TRCIDR5.NUMSEQSTATE == 0. Skip accessing the registers in such cases. + +Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") +Signed-off-by: Junhao He +Reviewed-by: Mike Leach +Reviewed-by: Anshuman Khandual +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230114091632.60095-1-hejunhao3@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../hwtracing/coresight/coresight-etm4x-core.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 1cc05297..77bca693 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -427,8 +427,10 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, config->vipcssctlr, TRCVIPCSSCTLR); + for (i = 0; i < drvdata->nrseqstate - 1; i++) + etm4x_relaxed_write32(csa, config->seq_ctrl[i], TRCSEQEVRn(i)); +- etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); +- etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); ++ if (drvdata->nrseqstate) { ++ etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); ++ etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); ++ } + etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); +@@ -1634,8 +1636,10 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) + for (i = 0; i < drvdata->nrseqstate - 1; i++) + state->trcseqevr[i] = etm4x_read32(csa, TRCSEQEVRn(i)); + +- state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); +- state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); ++ if (drvdata->nrseqstate) { ++ state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); ++ state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); ++ } + state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { +@@ -1763,8 +1767,10 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) + for (i = 0; i < drvdata->nrseqstate - 1; i++) + etm4x_relaxed_write32(csa, state->trcseqevr[i], TRCSEQEVRn(i)); + +- etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); +- etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); ++ if (drvdata->nrseqstate) { ++ etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); ++ etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); ++ } + etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-500-coresight-cti-Prevent-negative-values-of-enable.patch b/patches.kernel.org/6.2.3-500-coresight-cti-Prevent-negative-values-of-enable.patch new file mode 100644 index 0000000..8a86c74 --- /dev/null +++ b/patches.kernel.org/6.2.3-500-coresight-cti-Prevent-negative-values-of-enable.patch @@ -0,0 +1,67 @@ +From: James Clark +Date: Tue, 10 Jan 2023 11:07:34 +0000 +Subject: [PATCH] coresight: cti: Prevent negative values of enable count +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3244fb6dbbf1ffc114cdf382cc167bdd8c18088a + +[ Upstream commit 3244fb6dbbf1ffc114cdf382cc167bdd8c18088a ] + +Writing 0 to the enable control repeatedly results in a negative value +for enable_req_count. After this, writing 1 to the enable control +appears to not work until the count returns to positive. + +Change it so that it's impossible for enable_req_count to be < 0. +Return an error to indicate that the disable request was invalid. + +Fixes: 835d722ba10a ("coresight: cti: Initial CoreSight CTI Driver") +Tested-by: Jinlong Mao +Signed-off-by: James Clark +Reviewed-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230110110736.2709917-2-james.clark@arm.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwtracing/coresight/coresight-cti-core.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c +index d2cf4f48..838872f2 100644 +--- a/drivers/hwtracing/coresight/coresight-cti-core.c ++++ b/drivers/hwtracing/coresight/coresight-cti-core.c +@@ -151,9 +151,16 @@ static int cti_disable_hw(struct cti_drvdata *drvdata) + { + struct cti_config *config = &drvdata->config; + struct coresight_device *csdev = drvdata->csdev; ++ int ret = 0; + + spin_lock(&drvdata->spinlock); + ++ /* don't allow negative refcounts, return an error */ ++ if (!atomic_read(&drvdata->config.enable_req_count)) { ++ ret = -EINVAL; ++ goto cti_not_disabled; ++ } ++ + /* check refcount - disable on 0 */ + if (atomic_dec_return(&drvdata->config.enable_req_count) > 0) + goto cti_not_disabled; +@@ -171,12 +178,12 @@ static int cti_disable_hw(struct cti_drvdata *drvdata) + coresight_disclaim_device_unlocked(csdev); + CS_LOCK(drvdata->base); + spin_unlock(&drvdata->spinlock); +- return 0; ++ return ret; + + /* not disabled this call */ + cti_not_disabled: + spin_unlock(&drvdata->spinlock); +- return 0; ++ return ret; + } + + void cti_write_single_reg(struct cti_drvdata *drvdata, int offset, u32 value) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-501-coresight-cti-Add-PM-runtime-call-in-enable_sto.patch b/patches.kernel.org/6.2.3-501-coresight-cti-Add-PM-runtime-call-in-enable_sto.patch new file mode 100644 index 0000000..a266581 --- /dev/null +++ b/patches.kernel.org/6.2.3-501-coresight-cti-Add-PM-runtime-call-in-enable_sto.patch @@ -0,0 +1,57 @@ +From: Mao Jinlong +Date: Tue, 10 Jan 2023 11:07:35 +0000 +Subject: [PATCH] coresight: cti: Add PM runtime call in enable_store +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: eff674a9b86a6ffdd10c3af3863545acf7f1ce4f + +[ Upstream commit eff674a9b86a6ffdd10c3af3863545acf7f1ce4f ] + +In commit 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()") +PM runtime calls are removed from cti_enable_hw/cti_disable_hw. When +enabling CTI by writing enable sysfs node, clock for accessing CTI +register won't be enabled. Device will crash due to register access +issue. Add PM runtime call in enable_store to fix this issue. + +Fixes: 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()") +Signed-off-by: Mao Jinlong +[Change to only call pm_runtime_put if a disable happened] +Tested-by: Jinlong Mao +Signed-off-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230110110736.2709917-3-james.clark@arm.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwtracing/coresight/coresight-cti-sysfs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cti-sysfs.c b/drivers/hwtracing/coresight/coresight-cti-sysfs.c +index 6d59c815..71e7a826 100644 +--- a/drivers/hwtracing/coresight/coresight-cti-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-cti-sysfs.c +@@ -108,10 +108,19 @@ static ssize_t enable_store(struct device *dev, + if (ret) + return ret; + +- if (val) ++ if (val) { ++ ret = pm_runtime_resume_and_get(dev->parent); ++ if (ret) ++ return ret; + ret = cti_enable(drvdata->csdev); +- else ++ if (ret) ++ pm_runtime_put(dev->parent); ++ } else { + ret = cti_disable(drvdata->csdev); ++ if (!ret) ++ pm_runtime_put(dev->parent); ++ } ++ + if (ret) + return ret; + return size; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-502-usb-typec-intel_pmc_mux-Don-t-leak-the-ACPI-dev.patch b/patches.kernel.org/6.2.3-502-usb-typec-intel_pmc_mux-Don-t-leak-the-ACPI-dev.patch new file mode 100644 index 0000000..ec53806 --- /dev/null +++ b/patches.kernel.org/6.2.3-502-usb-typec-intel_pmc_mux-Don-t-leak-the-ACPI-dev.patch @@ -0,0 +1,43 @@ +From: Andy Shevchenko +Date: Mon, 2 Jan 2023 22:29:32 +0200 +Subject: [PATCH] usb: typec: intel_pmc_mux: Don't leak the ACPI device + reference count +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c3194949ae8fcbe2b7e38670e7c6a5cfd2605edc + +[ Upstream commit c3194949ae8fcbe2b7e38670e7c6a5cfd2605edc ] + +When acpi_dev_get_memory_resources() fails, the reference count is +left bumped. Drop it as it's done in the other error paths. + +Fixes: 43d596e32276 ("usb: typec: intel_pmc_mux: Check the port status before connect") +Signed-off-by: Andy Shevchenko +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20230102202933.15968-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/usb/typec/mux/intel_pmc_mux.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c +index fdbf3694..87e2c913 100644 +--- a/drivers/usb/typec/mux/intel_pmc_mux.c ++++ b/drivers/usb/typec/mux/intel_pmc_mux.c +@@ -614,8 +614,10 @@ static int pmc_usb_probe_iom(struct pmc_usb *pmc) + + INIT_LIST_HEAD(&resource_list); + ret = acpi_dev_get_memory_resources(adev, &resource_list); +- if (ret < 0) ++ if (ret < 0) { ++ acpi_dev_put(adev); + return ret; ++ } + + rentry = list_first_entry_or_null(&resource_list, struct resource_entry, node); + if (rentry) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-503-PCI-IOV-Enlarge-virtfn-sysfs-name-buffer.patch b/patches.kernel.org/6.2.3-503-PCI-IOV-Enlarge-virtfn-sysfs-name-buffer.patch new file mode 100644 index 0000000..f967396 --- /dev/null +++ b/patches.kernel.org/6.2.3-503-PCI-IOV-Enlarge-virtfn-sysfs-name-buffer.patch @@ -0,0 +1,42 @@ +From: "Alexey V. Vissarionov" +Date: Sun, 18 Dec 2022 06:33:47 +0300 +Subject: [PATCH] PCI/IOV: Enlarge virtfn sysfs name buffer +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ea0b5aa5f184cf8293c93163f0fb00505190d431 + +[ Upstream commit ea0b5aa5f184cf8293c93163f0fb00505190d431 ] + +The sysfs link name "virtfn%u" constructed by pci_iov_sysfs_link() requires +17 bytes to contain the longest possible string. Increase VIRTFN_ID_LEN to +accommodate that. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +[bhelgaas: commit log, comment at #define] +Fixes: dd7cc44d0bce ("PCI: add SR-IOV API for Physical Function driver") +Link: https://lore.kernel.org/r/20221218033347.23743-1-gremlin@altlinux.org +Signed-off-by: Alexey V. Vissarionov +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pci/iov.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c +index 95221757..b2e83227 100644 +--- a/drivers/pci/iov.c ++++ b/drivers/pci/iov.c +@@ -14,7 +14,7 @@ + #include + #include "pci.h" + +-#define VIRTFN_ID_LEN 16 ++#define VIRTFN_ID_LEN 17 /* "virtfn%u\0" for 2^32 - 1 */ + + int pci_iov_virtfn_bus(struct pci_dev *dev, int vf_id) + { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-504-PCI-switchtec-Return-EFAULT-for-copy_to_user-er.patch b/patches.kernel.org/6.2.3-504-PCI-switchtec-Return-EFAULT-for-copy_to_user-er.patch new file mode 100644 index 0000000..93b8473 --- /dev/null +++ b/patches.kernel.org/6.2.3-504-PCI-switchtec-Return-EFAULT-for-copy_to_user-er.patch @@ -0,0 +1,58 @@ +From: Bjorn Helgaas +Date: Fri, 16 Dec 2022 10:21:26 -0600 +Subject: [PATCH] PCI: switchtec: Return -EFAULT for copy_to_user() errors +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ddc10938e08cd7aac63d8385f7305f7889df5179 + +[ Upstream commit ddc10938e08cd7aac63d8385f7305f7889df5179 ] + +switchtec_dev_read() didn't handle copy_to_user() errors correctly: it +assigned "rc = -EFAULT", but actually returned either "size", -ENXIO, or +-EBADMSG instead. + +Update the failure cases to unlock mrpc_mutex and return -EFAULT directly. + +Link: https://lore.kernel.org/r/20221216162126.207863-3-helgaas@kernel.org +Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver") +Signed-off-by: Bjorn Helgaas +Reviewed-by: Logan Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pci/switch/switchtec.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c +index 75be4fe2..0c1faa6c 100644 +--- a/drivers/pci/switch/switchtec.c ++++ b/drivers/pci/switch/switchtec.c +@@ -606,21 +606,20 @@ static ssize_t switchtec_dev_read(struct file *filp, char __user *data, + rc = copy_to_user(data, &stuser->return_code, + sizeof(stuser->return_code)); + if (rc) { +- rc = -EFAULT; +- goto out; ++ mutex_unlock(&stdev->mrpc_mutex); ++ return -EFAULT; + } + + data += sizeof(stuser->return_code); + rc = copy_to_user(data, &stuser->data, + size - sizeof(stuser->return_code)); + if (rc) { +- rc = -EFAULT; +- goto out; ++ mutex_unlock(&stdev->mrpc_mutex); ++ return -EFAULT; + } + + stuser_set_state(stuser, MRPC_IDLE); + +-out: + mutex_unlock(&stdev->mrpc_mutex); + + if (stuser->status == SWITCHTEC_MRPC_STATUS_DONE || +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-505-PCI-endpoint-pci-epf-vntb-Add-epf_ntb_mw_bar_cl.patch b/patches.kernel.org/6.2.3-505-PCI-endpoint-pci-epf-vntb-Add-epf_ntb_mw_bar_cl.patch new file mode 100644 index 0000000..6dd793c --- /dev/null +++ b/patches.kernel.org/6.2.3-505-PCI-endpoint-pci-epf-vntb-Add-epf_ntb_mw_bar_cl.patch @@ -0,0 +1,41 @@ +From: Yang Yingliang +Date: Tue, 3 Jan 2023 10:49:07 +0800 +Subject: [PATCH] PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() + num_mws kernel-doc +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fd858402c6d0a80e0b543886b9f7865c6d76d5d6 + +[ Upstream commit fd858402c6d0a80e0b543886b9f7865c6d76d5d6 ] + +8e4bfbe644a6 ("PCI: endpoint: pci-epf-vntb: fix error handle in +epf_ntb_mw_bar_init()") added a "num_mws" parameter to +epf_ntb_mw_bar_clear() but failed to add kernel-doc for num_mws. + +Add kernel-doc for num_mws on epf_ntb_mw_bar_clear(). + +Fixes: 8e4bfbe644a6 ("PCI: endpoint: pci-epf-vntb: fix error handle in epf_ntb_mw_bar_init()") +Link: https://lore.kernel.org/r/20230103024907.293853-1-yangyingliang@huawei.com +Signed-off-by: Yang Yingliang +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pci/endpoint/functions/pci-epf-vntb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c +index 04698e79..b7c7a8af 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c ++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c +@@ -652,6 +652,7 @@ static int epf_ntb_mw_bar_init(struct epf_ntb *ntb) + /** + * epf_ntb_mw_bar_clear() - Clear Memory window BARs + * @ntb: NTB device that facilitates communication between HOST and VHOST ++ * @num_mws: the number of Memory window BARs that to be cleared + */ + static void epf_ntb_mw_bar_clear(struct epf_ntb *ntb, int num_mws) + { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-506-hwtracing-hisi_ptt-Only-add-the-supported-devic.patch b/patches.kernel.org/6.2.3-506-hwtracing-hisi_ptt-Only-add-the-supported-devic.patch new file mode 100644 index 0000000..0bb0f7f --- /dev/null +++ b/patches.kernel.org/6.2.3-506-hwtracing-hisi_ptt-Only-add-the-supported-devic.patch @@ -0,0 +1,53 @@ +From: Yicong Yang +Date: Thu, 12 Jan 2023 19:22:00 +0800 +Subject: [PATCH] hwtracing: hisi_ptt: Only add the supported devices to the + filters list +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b8d976c7d41a28c0fccf22c7113be9a29dc07e5c + +[ Upstream commit b8d976c7d41a28c0fccf22c7113be9a29dc07e5c ] + +The PTT device can only support the devices on the same PCIe core, +within BDF range [lower_bdf, upper_bdf]. It's not correct to assume +the devices on the root bus are from the same PCIe core, there are +cases that root ports from different PCIe core are sharing the same +bus. So check when initializing the filters list. + +Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device") +Signed-off-by: Yicong Yang +Reviewed-by: Jonathan Cameron +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230112112201.16283-1-yangyicong@huawei.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwtracing/ptt/hisi_ptt.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c +index 5d5526aa..30f15256 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.c ++++ b/drivers/hwtracing/ptt/hisi_ptt.c +@@ -356,8 +356,18 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt) + + static int hisi_ptt_init_filters(struct pci_dev *pdev, void *data) + { ++ struct pci_dev *root_port = pcie_find_root_port(pdev); + struct hisi_ptt_filter_desc *filter; + struct hisi_ptt *hisi_ptt = data; ++ u32 port_devid; ++ ++ if (!root_port) ++ return 0; ++ ++ port_devid = PCI_DEVID(root_port->bus->number, root_port->devfn); ++ if (port_devid < hisi_ptt->lower_bdf || ++ port_devid > hisi_ptt->upper_bdf) ++ return 0; + + /* + * We won't fail the probe if filter allocation failed here. The filters +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-507-tty-serial-fsl_lpuart-disable-Rx-Tx-DMA-in-lpua.patch b/patches.kernel.org/6.2.3-507-tty-serial-fsl_lpuart-disable-Rx-Tx-DMA-in-lpua.patch new file mode 100644 index 0000000..72feec9 --- /dev/null +++ b/patches.kernel.org/6.2.3-507-tty-serial-fsl_lpuart-disable-Rx-Tx-DMA-in-lpua.patch @@ -0,0 +1,44 @@ +From: Sherry Sun +Date: Fri, 25 Nov 2022 18:19:52 +0800 +Subject: [PATCH] tty: serial: fsl_lpuart: disable Rx/Tx DMA in + lpuart32_shutdown() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1d4bd0e4ae4ba95892bef919a8d4d3f08f122d7e + +[ Upstream commit 1d4bd0e4ae4ba95892bef919a8d4d3f08f122d7e ] + +UARTBAUD_RDMAE and UARTBAUD_TDMAE are enabled in lpuart32_startup(), but +lpuart32_shutdown() not disable them, only free the dma ring buffer and +release the dma channels, so here disable the Rx/Tx DMA first in +lpuart32_shutdown(). + +Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20221125101953.18753-3-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/fsl_lpuart.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 5e69fb73..5d1c28e0 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1796,6 +1796,11 @@ static void lpuart32_shutdown(struct uart_port *port) + + spin_lock_irqsave(&port->lock, flags); + ++ /* disable Rx/Tx DMA */ ++ temp = lpuart32_read(port, UARTBAUD); ++ temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE); ++ lpuart32_write(port, temp, UARTBAUD); ++ + /* disable Rx/Tx and interrupts */ + temp = lpuart32_read(port, UARTCTRL); + temp &= ~(UARTCTRL_TE | UARTCTRL_RE | +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-508-tty-serial-fsl_lpuart-clear-LPUART-Status-Regis.patch b/patches.kernel.org/6.2.3-508-tty-serial-fsl_lpuart-clear-LPUART-Status-Regis.patch new file mode 100644 index 0000000..27771b2 --- /dev/null +++ b/patches.kernel.org/6.2.3-508-tty-serial-fsl_lpuart-clear-LPUART-Status-Regis.patch @@ -0,0 +1,41 @@ +From: Sherry Sun +Date: Fri, 25 Nov 2022 18:19:53 +0800 +Subject: [PATCH] tty: serial: fsl_lpuart: clear LPUART Status Register in + lpuart32_shutdown() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4029dfc034febb54f6dd8ea83568accc943bc088 + +[ Upstream commit 4029dfc034febb54f6dd8ea83568accc943bc088 ] + +The LPUART Status Register needs to be cleared when closing the uart +port to get a clean environment when reopening the uart. + +Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20221125101953.18753-4-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/fsl_lpuart.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 5d1c28e0..986ec832 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1796,6 +1796,10 @@ static void lpuart32_shutdown(struct uart_port *port) + + spin_lock_irqsave(&port->lock, flags); + ++ /* clear status */ ++ temp = lpuart32_read(&sport->port, UARTSTAT); ++ lpuart32_write(&sport->port, temp, UARTSTAT); ++ + /* disable Rx/Tx DMA */ + temp = lpuart32_read(port, UARTBAUD); + temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-509-serial-tegra-Add-missing-clk_disable_unprepare-.patch b/patches.kernel.org/6.2.3-509-serial-tegra-Add-missing-clk_disable_unprepare-.patch new file mode 100644 index 0000000..4443f32 --- /dev/null +++ b/patches.kernel.org/6.2.3-509-serial-tegra-Add-missing-clk_disable_unprepare-.patch @@ -0,0 +1,64 @@ +From: Yi Yang +Date: Sat, 26 Nov 2022 10:08:52 +0800 +Subject: [PATCH] serial: tegra: Add missing clk_disable_unprepare() in + tegra_uart_hw_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 38f28cfe9d08e3a47ef008798b275fef8118fc20 + +[ Upstream commit 38f28cfe9d08e3a47ef008798b275fef8118fc20 ] + +Add the missing clk_disable_unprepare() before return from +tegra_uart_hw_init() in the error handling path. +When request_irq() fails in tegra_uart_startup(), 'tup->uart_clk' +has been enabled, fix it by adding clk_disable_unprepare(). + +Fixes: cc9ca4d95846 ("serial: tegra: Only print FIFO error message when an error occurs") +Fixes: d781ec21bae6 ("serial: tegra: report clk rate errors") +Signed-off-by: Yi Yang +Link: https://lore.kernel.org/r/20221126020852.113378-1-yiyang13@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/serial-tegra.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index e5b9773d..1cf08b33 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -1046,6 +1046,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + if (tup->cdata->fifo_mode_enable_status) { + ret = tegra_uart_wait_fifo_mode_enabled(tup); + if (ret < 0) { ++ clk_disable_unprepare(tup->uart_clk); + dev_err(tup->uport.dev, + "Failed to enable FIFO mode: %d\n", ret); + return ret; +@@ -1067,6 +1068,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + */ + ret = tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD); + if (ret < 0) { ++ clk_disable_unprepare(tup->uart_clk); + dev_err(tup->uport.dev, "Failed to set baud rate\n"); + return ret; + } +@@ -1226,10 +1228,13 @@ static int tegra_uart_startup(struct uart_port *u) + dev_name(u->dev), tup); + if (ret < 0) { + dev_err(u->dev, "Failed to register ISR for IRQ %d\n", u->irq); +- goto fail_hw_init; ++ goto fail_request_irq; + } + return 0; + ++fail_request_irq: ++ /* tup->uart_clk is already enabled in tegra_uart_hw_init */ ++ clk_disable_unprepare(tup->uart_clk); + fail_hw_init: + if (!tup->use_rx_pio) + tegra_uart_dma_channel_free(tup, true); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-510-Revert-char-pcmcia-cm4000_cs-Replace-mdelay-wit.patch b/patches.kernel.org/6.2.3-510-Revert-char-pcmcia-cm4000_cs-Replace-mdelay-wit.patch new file mode 100644 index 0000000..6f6c41e --- /dev/null +++ b/patches.kernel.org/6.2.3-510-Revert-char-pcmcia-cm4000_cs-Replace-mdelay-wit.patch @@ -0,0 +1,62 @@ +From: Duoming Zhou +Date: Wed, 18 Jan 2023 22:10:00 +0800 +Subject: [PATCH] Revert "char: pcmcia: cm4000_cs: Replace mdelay with + usleep_range in set_protocol" +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 70fae37a09268455b8ab4f64647086b61da6f39c + +[ Upstream commit 70fae37a09268455b8ab4f64647086b61da6f39c ] + +This reverts commit be826ada52f1fcabed5b5217c94609ebf5967211. + +The function monitor_card() is a timer handler that runs in an +atomic context, but it calls usleep_range() that can sleep. +As a result, the sleep-in-atomic-context bugs will happen. +The process is shown below: + + (atomic context) +monitor_card() + set_protocol() + usleep_range() //sleep + +The origin commit c1986ee9bea3 ("[PATCH] New Omnikey Cardman +4000 driver") works fine. + +Fixes: be826ada52f1 ("char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol") +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20230118141000.5580-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/char/pcmcia/cm4000_cs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c +index adaec8fd..e656f42a 100644 +--- a/drivers/char/pcmcia/cm4000_cs.c ++++ b/drivers/char/pcmcia/cm4000_cs.c +@@ -529,7 +529,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) + DEBUGP(5, dev, "NumRecBytes is valid\n"); + break; + } +- usleep_range(10000, 11000); ++ /* can not sleep as this is in atomic context */ ++ mdelay(10); + } + if (i == 100) { + DEBUGP(5, dev, "Timeout waiting for NumRecBytes getting " +@@ -549,7 +550,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) + } + break; + } +- usleep_range(10000, 11000); ++ /* can not sleep as this is in atomic context */ ++ mdelay(10); + } + + /* check whether it is a short PTS reply? */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-511-eeprom-idt_89hpesx-Fix-error-handling-in-idt_in.patch b/patches.kernel.org/6.2.3-511-eeprom-idt_89hpesx-Fix-error-handling-in-idt_in.patch new file mode 100644 index 0000000..8f7fd43 --- /dev/null +++ b/patches.kernel.org/6.2.3-511-eeprom-idt_89hpesx-Fix-error-handling-in-idt_in.patch @@ -0,0 +1,69 @@ +From: Yuan Can +Date: Thu, 10 Nov 2022 02:00:30 +0000 +Subject: [PATCH] eeprom: idt_89hpesx: Fix error handling in idt_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d717a3ab282f51ec45142f911f7ef8a55c057de5 + +[ Upstream commit d717a3ab282f51ec45142f911f7ef8a55c057de5 ] + +A problem about idt_89hpesx create debugfs failed is triggered with the +following log given: + + [ 4973.269647] debugfs: Directory 'idt_csr' with parent '/' already present! + +The reason is that idt_init() returns i2c_add_driver() directly without +checking its return value, if i2c_add_driver() failed, it returns without +destroy the newly created debugfs, resulting the debugfs of idt_csr can +never be created later. + + idt_init() + debugfs_create_dir() # create debugfs directory + i2c_add_driver() + driver_register() + bus_add_driver() + priv = kzalloc(...) # OOM happened + # return without destroy debugfs directory + +Fix by removing debugfs when i2c_add_driver() returns error. + +Fixes: cfad6425382e ("eeprom: Add IDT 89HPESx EEPROM/CSR driver") +Signed-off-by: Yuan Can +Acked-by: Serge Semin +Link: https://lore.kernel.org/r/20221110020030.47711-1-yuancan@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/misc/eeprom/idt_89hpesx.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c +index 4e07ee9c..7075d0b3 100644 +--- a/drivers/misc/eeprom/idt_89hpesx.c ++++ b/drivers/misc/eeprom/idt_89hpesx.c +@@ -1566,12 +1566,20 @@ static struct i2c_driver idt_driver = { + */ + static int __init idt_init(void) + { ++ int ret; ++ + /* Create Debugfs directory first */ + if (debugfs_initialized()) + csr_dbgdir = debugfs_create_dir("idt_csr", NULL); + + /* Add new i2c-device driver */ +- return i2c_add_driver(&idt_driver); ++ ret = i2c_add_driver(&idt_driver); ++ if (ret) { ++ debugfs_remove_recursive(csr_dbgdir); ++ return ret; ++ } ++ ++ return 0; + } + module_init(idt_init); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-512-applicom-Fix-PCI-device-refcount-leak-in-applic.patch b/patches.kernel.org/6.2.3-512-applicom-Fix-PCI-device-refcount-leak-in-applic.patch new file mode 100644 index 0000000..5ea09d8 --- /dev/null +++ b/patches.kernel.org/6.2.3-512-applicom-Fix-PCI-device-refcount-leak-in-applic.patch @@ -0,0 +1,54 @@ +From: Xiongfeng Wang +Date: Tue, 22 Nov 2022 19:40:35 +0800 +Subject: [PATCH] applicom: Fix PCI device refcount leak in applicom_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ce4273d89c52167d6fe20572136c58117eae0657 + +[ Upstream commit ce4273d89c52167d6fe20572136c58117eae0657 ] + +As comment of pci_get_class() says, it returns a pci_device with its +refcount increased and decreased the refcount for the input parameter +@from if it is not NULL. + +If we break the loop in applicom_init() with 'dev' not NULL, we need to +call pci_dev_put() to decrease the refcount. Add the missing +pci_dev_put() to avoid refcount leak. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xiongfeng Wang +Link: https://lore.kernel.org/r/20221122114035.24194-1-wangxiongfeng2@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/char/applicom.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c +index 36203d3f..69314532 100644 +--- a/drivers/char/applicom.c ++++ b/drivers/char/applicom.c +@@ -197,8 +197,10 @@ static int __init applicom_init(void) + if (!pci_match_id(applicom_pci_tbl, dev)) + continue; + +- if (pci_enable_device(dev)) ++ if (pci_enable_device(dev)) { ++ pci_dev_put(dev); + return -EIO; ++ } + + RamIO = ioremap(pci_resource_start(dev, 0), LEN_RAM_IO); + +@@ -207,6 +209,7 @@ static int __init applicom_init(void) + "space at 0x%llx\n", + (unsigned long long)pci_resource_start(dev, 0)); + pci_disable_device(dev); ++ pci_dev_put(dev); + return -EIO; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-513-firmware-stratix10-svc-add-missing-gen_pool_des.patch b/patches.kernel.org/6.2.3-513-firmware-stratix10-svc-add-missing-gen_pool_des.patch new file mode 100644 index 0000000..092fa00 --- /dev/null +++ b/patches.kernel.org/6.2.3-513-firmware-stratix10-svc-add-missing-gen_pool_des.patch @@ -0,0 +1,71 @@ +From: Yang Yingliang +Date: Tue, 29 Nov 2022 10:36:01 -0600 +Subject: [PATCH] firmware: stratix10-svc: add missing gen_pool_destroy() in + stratix10_svc_drv_probe() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9175ee1a99d57ec07d66ff572e1d5a724477ab37 + +[ Upstream commit 9175ee1a99d57ec07d66ff572e1d5a724477ab37 ] + +In error path in stratix10_svc_drv_probe(), gen_pool_destroy() should be called +to destroy the memory pool that created by svc_create_memory_pool(). + +Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") +Signed-off-by: Yang Yingliang +Signed-off-by: Dinh Nguyen +Link: https://lore.kernel.org/r/20221129163602.462369-1-dinguyen@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/firmware/stratix10-svc.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c +index b4081f4d..1a5640b3 100644 +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -1138,13 +1138,17 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + + /* allocate service controller and supporting channel */ + controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL); +- if (!controller) +- return -ENOMEM; ++ if (!controller) { ++ ret = -ENOMEM; ++ goto err_destroy_pool; ++ } + + chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL, + sizeof(*chans), GFP_KERNEL | __GFP_ZERO); +- if (!chans) +- return -ENOMEM; ++ if (!chans) { ++ ret = -ENOMEM; ++ goto err_destroy_pool; ++ } + + controller->dev = dev; + controller->num_chans = SVC_NUM_CHANNEL; +@@ -1159,7 +1163,7 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL); + if (ret) { + dev_err(dev, "failed to allocate FIFO\n"); +- return ret; ++ goto err_destroy_pool; + } + spin_lock_init(&controller->svc_fifo_lock); + +@@ -1221,6 +1225,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + + err_free_kfifo: + kfifo_free(&controller->svc_fifo); ++err_destroy_pool: ++ gen_pool_destroy(genpool); + return ret; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-514-firmware-stratix10-svc-fix-error-handle-while-a.patch b/patches.kernel.org/6.2.3-514-firmware-stratix10-svc-fix-error-handle-while-a.patch new file mode 100644 index 0000000..543c15d --- /dev/null +++ b/patches.kernel.org/6.2.3-514-firmware-stratix10-svc-fix-error-handle-while-a.patch @@ -0,0 +1,67 @@ +From: Yang Yingliang +Date: Tue, 29 Nov 2022 10:36:02 -0600 +Subject: [PATCH] firmware: stratix10-svc: fix error handle while alloc/add + device failed +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d66a4c20ae55ac88136b4a3befd944c093ffa677 + +[ Upstream commit d66a4c20ae55ac88136b4a3befd944c093ffa677 ] + +If add device "stratix10-rsu" failed in stratix10_svc_drv_probe(), +the 'svc_fifo' and 'genpool' need be freed in the error path. + +If allocate or add device "intel-fcs" failed in stratix10_svc_drv_probe(), +the device "stratix10-rsu" need be unregistered in the error path. + +Fixes: e6281c26674e ("firmware: stratix10-svc: Add support for FCS") +Signed-off-by: Yang Yingliang +Signed-off-by: Dinh Nguyen +Link: https://lore.kernel.org/r/20221129163602.462369-2-dinguyen@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/firmware/stratix10-svc.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c +index 1a5640b3..bde1f543 100644 +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -1202,19 +1202,20 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + ret = platform_device_add(svc->stratix10_svc_rsu); + if (ret) { + platform_device_put(svc->stratix10_svc_rsu); +- return ret; ++ goto err_free_kfifo; + } + + svc->intel_svc_fcs = platform_device_alloc(INTEL_FCS, 1); + if (!svc->intel_svc_fcs) { + dev_err(dev, "failed to allocate %s device\n", INTEL_FCS); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_unregister_dev; + } + + ret = platform_device_add(svc->intel_svc_fcs); + if (ret) { + platform_device_put(svc->intel_svc_fcs); +- return ret; ++ goto err_unregister_dev; + } + + dev_set_drvdata(dev, svc); +@@ -1223,6 +1224,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + + return 0; + ++err_unregister_dev: ++ platform_device_unregister(svc->stratix10_svc_rsu); + err_free_kfifo: + kfifo_free(&controller->svc_fifo); + err_destroy_pool: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-515-VMCI-check-context-notify_page-after-call-to-ge.patch b/patches.kernel.org/6.2.3-515-VMCI-check-context-notify_page-after-call-to-ge.patch new file mode 100644 index 0000000..aeba733 --- /dev/null +++ b/patches.kernel.org/6.2.3-515-VMCI-check-context-notify_page-after-call-to-ge.patch @@ -0,0 +1,56 @@ +From: George Kennedy +Date: Mon, 28 Nov 2022 15:18:25 -0500 +Subject: [PATCH] VMCI: check context->notify_page after call to + get_user_pages_fast() to avoid GPF +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1a726cb47fd204109c767409fa9ca15a96328f14 + +[ Upstream commit 1a726cb47fd204109c767409fa9ca15a96328f14 ] + +The call to get_user_pages_fast() in vmci_host_setup_notify() can return +NULL context->notify_page causing a GPF. To avoid GPF check if +context->notify_page == NULL and return error if so. + +general protection fault, probably for non-canonical address + 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI +KASAN: maybe wild-memory-access in range [0x0005088000000300- + 0x0005088000000307] +CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 +Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 +RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 +Call Trace: + + vmci_host_unlocked_ioctl+0x362/0x1f40 + __x64_sys_ioctl+0x1a1/0x230 + do_syscall_64+0x3a/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: a1d88436d53a ("VMCI: Fix two UVA mapping bugs") +Reported-by: syzkaller +Signed-off-by: George Kennedy +Reviewed-by: Vishnu Dasa +Link: https://lore.kernel.org/r/1669666705-24012-1-git-send-email-george.kennedy@oracle.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/misc/vmw_vmci/vmci_host.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c +index da1e2a77..857b98514 100644 +--- a/drivers/misc/vmw_vmci/vmci_host.c ++++ b/drivers/misc/vmw_vmci/vmci_host.c +@@ -242,6 +242,8 @@ static int vmci_host_setup_notify(struct vmci_ctx *context, + context->notify_page = NULL; + return VMCI_ERROR_GENERIC; + } ++ if (context->notify_page == NULL) ++ return VMCI_ERROR_UNAVAILABLE; + + /* + * Map the locked page and set up notify pointer. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-516-mei-pxp-Use-correct-macros-to-initialize-uuid_l.patch b/patches.kernel.org/6.2.3-516-mei-pxp-Use-correct-macros-to-initialize-uuid_l.patch new file mode 100644 index 0000000..8e2cac1 --- /dev/null +++ b/patches.kernel.org/6.2.3-516-mei-pxp-Use-correct-macros-to-initialize-uuid_l.patch @@ -0,0 +1,42 @@ +From: Andy Shevchenko +Date: Wed, 28 Dec 2022 18:05:58 +0200 +Subject: [PATCH] mei: pxp: Use correct macros to initialize uuid_le +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 503b676dde2780330c90a10b37a844686601a784 + +[ Upstream commit 503b676dde2780330c90a10b37a844686601a784 ] + +GUID_INIT() is for internal guid_t type and shouldn't be used +for the uuid_le. I.o.w. relying on the implementation details +is layering violation. Use correct macros to initialize uuid_le. + +Fixes: c2004ce99ed7 ("mei: pxp: export pavp client to me client bus") +Signed-off-by: Andy Shevchenko +Acked-by: Tomas Winkler +Link: https://lore.kernel.org/r/20221228160558.21311-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/misc/mei/pxp/mei_pxp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/mei/pxp/mei_pxp.c b/drivers/misc/mei/pxp/mei_pxp.c +index 8dd09b17..7ee1fa7b 100644 +--- a/drivers/misc/mei/pxp/mei_pxp.c ++++ b/drivers/misc/mei/pxp/mei_pxp.c +@@ -238,8 +238,8 @@ static void mei_pxp_remove(struct mei_cl_device *cldev) + } + + /* fbf6fcf1-96cf-4e2e-a6a6-1bab8cbe36b1 : PAVP GUID*/ +-#define MEI_GUID_PXP GUID_INIT(0xfbf6fcf1, 0x96cf, 0x4e2e, 0xA6, \ +- 0xa6, 0x1b, 0xab, 0x8c, 0xbe, 0x36, 0xb1) ++#define MEI_GUID_PXP UUID_LE(0xfbf6fcf1, 0x96cf, 0x4e2e, 0xA6, \ ++ 0xa6, 0x1b, 0xab, 0x8c, 0xbe, 0x36, 0xb1) + + static struct mei_cl_device_id mei_pxp_tbl[] = { + { .uuid = MEI_GUID_PXP, .version = MEI_CL_VERSION_ANY }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-517-misc-mei-hdcp-Use-correct-macros-to-initialize-.patch b/patches.kernel.org/6.2.3-517-misc-mei-hdcp-Use-correct-macros-to-initialize-.patch new file mode 100644 index 0000000..dc12f6c --- /dev/null +++ b/patches.kernel.org/6.2.3-517-misc-mei-hdcp-Use-correct-macros-to-initialize-.patch @@ -0,0 +1,42 @@ +From: Andy Shevchenko +Date: Wed, 28 Dec 2022 18:05:00 +0200 +Subject: [PATCH] misc/mei/hdcp: Use correct macros to initialize uuid_le +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 512ba04d8211dd1a54dd36adc3ecc527a28069c5 + +[ Upstream commit 512ba04d8211dd1a54dd36adc3ecc527a28069c5 ] + +GUID_INIT() is for internal guid_t type and shouldn't be used +for the uuid_le. I.o.w. relying on the implementation details +is layering violation. Use correct macros to initialize uuid_le. + +Fixes: 64e9bbdd9588 ("misc/mei/hdcp: Client driver for HDCP application") +Signed-off-by: Andy Shevchenko +Acked-by: Tomas Winkler +Link: https://lore.kernel.org/r/20221228160500.21220-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/misc/mei/hdcp/mei_hdcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c +index e889a8bd..e0dcd5c1 100644 +--- a/drivers/misc/mei/hdcp/mei_hdcp.c ++++ b/drivers/misc/mei/hdcp/mei_hdcp.c +@@ -859,8 +859,8 @@ static void mei_hdcp_remove(struct mei_cl_device *cldev) + dev_warn(&cldev->dev, "mei_cldev_disable() failed\n"); + } + +-#define MEI_UUID_HDCP GUID_INIT(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \ +- 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04) ++#define MEI_UUID_HDCP UUID_LE(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \ ++ 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04) + + static const struct mei_cl_device_id mei_hdcp_tbl[] = { + { .uuid = MEI_UUID_HDCP, .version = MEI_CL_VERSION_ANY }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-518-misc-fastrpc-Fix-an-error-handling-path-in-fast.patch b/patches.kernel.org/6.2.3-518-misc-fastrpc-Fix-an-error-handling-path-in-fast.patch new file mode 100644 index 0000000..1634dcc --- /dev/null +++ b/patches.kernel.org/6.2.3-518-misc-fastrpc-Fix-an-error-handling-path-in-fast.patch @@ -0,0 +1,51 @@ +From: Christophe JAILLET +Date: Fri, 25 Nov 2022 18:45:02 +0100 +Subject: [PATCH] misc: fastrpc: Fix an error handling path in + fastrpc_rpmsg_probe() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 11819ed2b70da94acc41fec34178a011c4d3d25d + +[ Upstream commit 11819ed2b70da94acc41fec34178a011c4d3d25d ] + +If of_platform_populate() fails, some resources need to be freed as already +done in the other error handling paths. + +Fixes: 278d56f970ae ("misc: fastrpc: Reference count channel context") +Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/b909d2f3273b794ea0f1f78d14bc24affb08ea5f.1669398274.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/misc/fastrpc.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 53106061..7ccaca1b 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -2315,7 +2315,18 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) + data->domain_id = domain_id; + data->rpdev = rpdev; + +- return of_platform_populate(rdev->of_node, NULL, NULL, rdev); ++ err = of_platform_populate(rdev->of_node, NULL, NULL, rdev); ++ if (err) ++ goto populate_error; ++ ++ return 0; ++ ++populate_error: ++ if (data->fdevice) ++ misc_deregister(&data->fdevice->miscdev); ++ if (data->secure_fdevice) ++ misc_deregister(&data->secure_fdevice->miscdev); ++ + fdev_error: + kfree(data); + return err; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-519-iommu-exynos-Fix-error-handling-in-exynos_iommu.patch b/patches.kernel.org/6.2.3-519-iommu-exynos-Fix-error-handling-in-exynos_iommu.patch new file mode 100644 index 0000000..94a71f9 --- /dev/null +++ b/patches.kernel.org/6.2.3-519-iommu-exynos-Fix-error-handling-in-exynos_iommu.patch @@ -0,0 +1,39 @@ +From: Yang Yingliang +Date: Wed, 4 Jan 2023 17:57:02 +0800 +Subject: [PATCH] iommu/exynos: Fix error handling in exynos_iommu_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 53719876e064643a6e58b5e6067a149a0fd191ec + +[ Upstream commit 53719876e064643a6e58b5e6067a149a0fd191ec ] + +If platform_driver_register() fails, it don't need unregister and call +kmem_cache_free() to free the memory allocated before calling register. + +Fixes: bbc4d205d93f ("iommu/exynos: Fix driver initialization sequence") +Signed-off-by: Yang Yingliang +Reviewed-by: Sam Protsenko +Link: https://lore.kernel.org/r/20230104095702.2591122-1-yangyingliang@huawei.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iommu/exynos-iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c +index b0cde221..c1d579c2 100644 +--- a/drivers/iommu/exynos-iommu.c ++++ b/drivers/iommu/exynos-iommu.c +@@ -1446,7 +1446,7 @@ static int __init exynos_iommu_init(void) + + return 0; + err_reg_driver: +- platform_driver_unregister(&exynos_sysmmu_driver); ++ kmem_cache_free(lv2table_kmem_cache, zero_lv2_table); + err_zero_lv2: + kmem_cache_destroy(lv2table_kmem_cache); + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-520-driver-core-fix-resource-leak-in-device_add.patch b/patches.kernel.org/6.2.3-520-driver-core-fix-resource-leak-in-device_add.patch new file mode 100644 index 0000000..405412f --- /dev/null +++ b/patches.kernel.org/6.2.3-520-driver-core-fix-resource-leak-in-device_add.patch @@ -0,0 +1,80 @@ +From: Zhengchao Shao +Date: Wed, 23 Nov 2022 09:20:42 +0800 +Subject: [PATCH] driver core: fix resource leak in device_add() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6977b1a5d67097eaa4d02b0c126c04cc6e8917c0 + +[ Upstream commit 6977b1a5d67097eaa4d02b0c126c04cc6e8917c0 ] + +When calling kobject_add() failed in device_add(), it will call +cleanup_glue_dir() to free resource. But in kobject_add(), +dev->kobj.parent has been set to NULL. This will cause resource leak. + +The process is as follows: +device_add() + get_device_parent() + class_dir_create_and_add() + kobject_add() //kobject_get() + ... + dev->kobj.parent = kobj; + ... + kobject_add() //failed, but set dev->kobj.parent = NULL + ... + glue_dir = get_glue_dir(dev) //glue_dir = NULL, and goto + //"Error" label + ... + cleanup_glue_dir() //becaues glue_dir is NULL, not call + //kobject_put() + +The preceding problem may cause insmod mac80211_hwsim.ko to failed. +sysfs: cannot create duplicate filename '/devices/virtual/mac80211_hwsim' +Call Trace: + +dump_stack_lvl+0x8e/0xd1 +sysfs_warn_dup.cold+0x1c/0x29 +sysfs_create_dir_ns+0x224/0x280 +kobject_add_internal+0x2aa/0x880 +kobject_add+0x135/0x1a0 +get_device_parent+0x3d7/0x590 +device_add+0x2aa/0x1cb0 +device_create_groups_vargs+0x1eb/0x260 +device_create+0xdc/0x110 +mac80211_hwsim_new_radio+0x31e/0x4790 [mac80211_hwsim] +init_mac80211_hwsim+0x48d/0x1000 [mac80211_hwsim] +do_one_initcall+0x10f/0x630 +do_init_module+0x19f/0x5e0 +load_module+0x64b7/0x6eb0 +__do_sys_finit_module+0x140/0x200 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +kobject_add_internal failed for mac80211_hwsim with -EEXIST, don't try to +register things with the same name in the same directory. + +Fixes: cebf8fd16900 ("driver core: fix race between creating/querying glue dir and its cleanup") +Signed-off-by: Zhengchao Shao +Link: https://lore.kernel.org/r/20221123012042.335252-1-shaozhengchao@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 506289e6..9fccf7b4 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3413,7 +3413,7 @@ int device_add(struct device *dev) + /* we require the name to be set before, and pass NULL */ + error = kobject_add(&dev->kobj, dev->kobj.parent, NULL); + if (error) { +- glue_dir = get_glue_dir(dev); ++ glue_dir = kobj; + goto Error; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-521-driver-core-location-Free-struct-acpi_pld_info-.patch b/patches.kernel.org/6.2.3-521-driver-core-location-Free-struct-acpi_pld_info-.patch new file mode 100644 index 0000000..886b9a5 --- /dev/null +++ b/patches.kernel.org/6.2.3-521-driver-core-location-Free-struct-acpi_pld_info-.patch @@ -0,0 +1,43 @@ +From: Hanjun Guo +Date: Tue, 22 Nov 2022 15:37:28 +0800 +Subject: [PATCH] driver core: location: Free struct acpi_pld_info *pld before + return false +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0d150f967e8410e1e6712484543eec709356a65d + +[ Upstream commit 0d150f967e8410e1e6712484543eec709356a65d ] + +struct acpi_pld_info *pld should be freed before the return of allocation +failure, to prevent memory leak, add the ACPI_FREE() to fix it. + +Fixes: bc443c31def5 ("driver core: location: Check for allocations failure") +Signed-off-by: Hanjun Guo +Link: https://lore.kernel.org/r/1669102648-11517-1-git-send-email-guohanjun@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/physical_location.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/physical_location.c b/drivers/base/physical_location.c +index 87af641c..951819e7 100644 +--- a/drivers/base/physical_location.c ++++ b/drivers/base/physical_location.c +@@ -24,8 +24,11 @@ bool dev_add_physical_location(struct device *dev) + + dev->physical_location = + kzalloc(sizeof(*dev->physical_location), GFP_KERNEL); +- if (!dev->physical_location) ++ if (!dev->physical_location) { ++ ACPI_FREE(pld); + return false; ++ } ++ + dev->physical_location->panel = pld->panel; + dev->physical_location->vertical_position = pld->vertical_position; + dev->physical_location->horizontal_position = pld->horizontal_position; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-522-drivers-base-transport_class-fix-possible-memor.patch b/patches.kernel.org/6.2.3-522-drivers-base-transport_class-fix-possible-memor.patch new file mode 100644 index 0000000..f5b1943 --- /dev/null +++ b/patches.kernel.org/6.2.3-522-drivers-base-transport_class-fix-possible-memor.patch @@ -0,0 +1,49 @@ +From: Yang Yingliang +Date: Thu, 10 Nov 2022 18:23:07 +0800 +Subject: [PATCH] drivers: base: transport_class: fix possible memory leak +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a86367803838b369fe5486ac18771d14723c258c + +[ Upstream commit a86367803838b369fe5486ac18771d14723c258c ] + +Current some drivers(like iscsi) call transport_register_device() +failed, they don't call transport_destroy_device() to release the +memory allocated in transport_setup_device(), because they don't +know what was done, it should be internal thing to release the +resource in register function. So fix this leak by calling destroy +function inside register function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221110102307.3492557-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/transport_class.h | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/include/linux/transport_class.h b/include/linux/transport_class.h +index 63076fb8..2efc271a 100644 +--- a/include/linux/transport_class.h ++++ b/include/linux/transport_class.h +@@ -70,8 +70,14 @@ void transport_destroy_device(struct device *); + static inline int + transport_register_device(struct device *dev) + { ++ int ret; ++ + transport_setup_device(dev); +- return transport_add_device(dev); ++ ret = transport_add_device(dev); ++ if (ret) ++ transport_destroy_device(dev); ++ ++ return ret; + } + + static inline void +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-523-drivers-base-transport_class-fix-resource-leak-.patch b/patches.kernel.org/6.2.3-523-drivers-base-transport_class-fix-resource-leak-.patch new file mode 100644 index 0000000..df7da19 --- /dev/null +++ b/patches.kernel.org/6.2.3-523-drivers-base-transport_class-fix-resource-leak-.patch @@ -0,0 +1,74 @@ +From: Yang Yingliang +Date: Tue, 15 Nov 2022 11:16:38 +0800 +Subject: [PATCH] drivers: base: transport_class: fix resource leak when + transport_add_device() fails +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e5da06b27ff5a148e42265c8e306670a9d913969 + +[ Upstream commit e5da06b27ff5a148e42265c8e306670a9d913969 ] + +The normal call sequence of using transport class is: + +Add path: +transport_setup_device() + transport_setup_classdev() // call sas_host_setup() here +transport_add_device() // if fails, need call transport_destroy_device() +transport_configure_device() + +Remove path: +transport_remove_device() + transport_remove_classdev // call sas_host_remove() here +transport_destroy_device() + +If transport_add_device() fails, need call transport_destroy_device() +to free memory, but in this case, ->remove() is not called, and the +resources allocated in ->setup() are leaked. So fix these leaks by +calling ->remove() in transport_add_class_device() if it returns error. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221115031638.3816551-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/transport_class.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/transport_class.c b/drivers/base/transport_class.c +index ccc86206..09ee2a1e 100644 +--- a/drivers/base/transport_class.c ++++ b/drivers/base/transport_class.c +@@ -155,12 +155,27 @@ static int transport_add_class_device(struct attribute_container *cont, + struct device *dev, + struct device *classdev) + { ++ struct transport_class *tclass = class_to_transport_class(cont->class); + int error = attribute_container_add_class_device(classdev); + struct transport_container *tcont = + attribute_container_to_transport_container(cont); + +- if (!error && tcont->statistics) ++ if (error) ++ goto err_remove; ++ ++ if (tcont->statistics) { + error = sysfs_create_group(&classdev->kobj, tcont->statistics); ++ if (error) ++ goto err_del; ++ } ++ ++ return 0; ++ ++err_del: ++ attribute_container_class_device_del(classdev); ++err_remove: ++ if (tclass->remove) ++ tclass->remove(tcont, dev, classdev); + + return error; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-524-firmware-dmi-sysfs-Fix-null-ptr-deref-in-dmi_sy.patch b/patches.kernel.org/6.2.3-524-firmware-dmi-sysfs-Fix-null-ptr-deref-in-dmi_sy.patch new file mode 100644 index 0000000..fc16f2b --- /dev/null +++ b/patches.kernel.org/6.2.3-524-firmware-dmi-sysfs-Fix-null-ptr-deref-in-dmi_sy.patch @@ -0,0 +1,77 @@ +From: Chen Zhongjin +Date: Fri, 11 Nov 2022 09:53:26 +0800 +Subject: [PATCH] firmware: dmi-sysfs: Fix null-ptr-deref in + dmi_sysfs_register_handle +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 18e126e97c961f7a93823795c879d7c085fe5098 + +[ Upstream commit 18e126e97c961f7a93823795c879d7c085fe5098 ] + +KASAN reported a null-ptr-deref error: + +KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] +CPU: 0 PID: 1373 Comm: modprobe +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) +RIP: 0010:dmi_sysfs_entry_release +... +Call Trace: + + kobject_put + dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs + dmi_decode_table (drivers/firmware/dmi_scan.c:133) + dmi_walk (drivers/firmware/dmi_scan.c:1115) + dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs + do_one_initcall (init/main.c:1296) + ... +Kernel panic - not syncing: Fatal exception +Kernel Offset: 0x4000000 from 0xffffffff81000000 +---[ end Kernel panic - not syncing: Fatal exception ]--- + +It is because previous patch added kobject_put() to release the memory +which will call dmi_sysfs_entry_release() and list_del(). + +However, list_add_tail(entry->list) is called after the error block, +so the list_head is uninitialized and cannot be deleted. + +Move error handling to after list_add_tail to fix this. + +Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221111015326.251650-2-chenzhongjin@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/firmware/dmi-sysfs.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c +index 66727ad3..402217c5 100644 +--- a/drivers/firmware/dmi-sysfs.c ++++ b/drivers/firmware/dmi-sysfs.c +@@ -603,16 +603,16 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh, + *ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL, + "%d-%d", dh->type, entry->instance); + +- if (*ret) { +- kobject_put(&entry->kobj); +- return; +- } +- + /* Thread on the global list for cleanup */ + spin_lock(&entry_list_lock); + list_add_tail(&entry->list, &entry_list); + spin_unlock(&entry_list_lock); + ++ if (*ret) { ++ kobject_put(&entry->kobj); ++ return; ++ } ++ + /* Handle specializations by type */ + switch (dh->type) { + case DMI_ENTRY_SYSTEM_EVENT_LOG: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-525-selftests-iommu-Fix-test_cmd_destroy_access-cal.patch b/patches.kernel.org/6.2.3-525-selftests-iommu-Fix-test_cmd_destroy_access-cal.patch new file mode 100644 index 0000000..05ed644 --- /dev/null +++ b/patches.kernel.org/6.2.3-525-selftests-iommu-Fix-test_cmd_destroy_access-cal.patch @@ -0,0 +1,40 @@ +From: Nicolin Chen +Date: Thu, 19 Jan 2023 23:42:04 -0800 +Subject: [PATCH] selftests: iommu: Fix test_cmd_destroy_access() call in + user_copy +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9fabbdf338b701f2d763d9edbc3e82ce1e7fa1b4 + +[ Upstream commit 9fabbdf338b701f2d763d9edbc3e82ce1e7fa1b4 ] + +The test_cmd_destroy_access() should end with a semicolon, so add one. +There is a test_ioctl_destroy(ioas_id) following already, so drop one. + +Fixes: 57f0988706fe ("iommufd: Add a selftest") +Link: https://lore.kernel.org/r/20230120074204.1368-1-nicolinc@nvidia.com +Signed-off-by: Nicolin Chen +Reviewed-by: Kevin Tian +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/iommu/iommufd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c +index 8aa8a346..fa082092 100644 +--- a/tools/testing/selftests/iommu/iommufd.c ++++ b/tools/testing/selftests/iommu/iommufd.c +@@ -1259,7 +1259,7 @@ TEST_F(iommufd_mock_domain, user_copy) + + test_cmd_destroy_access_pages( + access_cmd.id, access_cmd.access_pages.out_access_pages_id); +- test_cmd_destroy_access(access_cmd.id) test_ioctl_destroy(ioas_id); ++ test_cmd_destroy_access(access_cmd.id); + + test_ioctl_destroy(ioas_id); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-526-iommufd-Add-three-missing-structures-in-ucmd_bu.patch b/patches.kernel.org/6.2.3-526-iommufd-Add-three-missing-structures-in-ucmd_bu.patch new file mode 100644 index 0000000..8cd143b --- /dev/null +++ b/patches.kernel.org/6.2.3-526-iommufd-Add-three-missing-structures-in-ucmd_bu.patch @@ -0,0 +1,44 @@ +From: Yi Liu +Date: Fri, 20 Jan 2023 04:20:40 -0800 +Subject: [PATCH] iommufd: Add three missing structures in ucmd_buffer +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 84798f2849942bb5e8817417adfdfa6241df2835 + +[ Upstream commit 84798f2849942bb5e8817417adfdfa6241df2835 ] + +struct iommu_ioas_copy, struct iommu_option and struct iommu_vfio_ioas are +missed in ucmd_buffer. Although they are smaller than the size of +ucmd_buffer, it is safer to list them in ucmd_buffer explicitly. + +Fixes: aad37e71d5c4 ("iommufd: IOCTLs for the io_pagetable") +Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") +Link: https://lore.kernel.org/r/20230120122040.280219-1-yi.l.liu@intel.com +Signed-off-by: Yi Liu +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iommu/iommufd/main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c +index 083e6fcb..3fbe636c 100644 +--- a/drivers/iommu/iommufd/main.c ++++ b/drivers/iommu/iommufd/main.c +@@ -252,9 +252,12 @@ union ucmd_buffer { + struct iommu_destroy destroy; + struct iommu_ioas_alloc alloc; + struct iommu_ioas_allow_iovas allow_iovas; ++ struct iommu_ioas_copy ioas_copy; + struct iommu_ioas_iova_ranges iova_ranges; + struct iommu_ioas_map map; + struct iommu_ioas_unmap unmap; ++ struct iommu_option option; ++ struct iommu_vfio_ioas vfio_ioas; + #ifdef CONFIG_IOMMUFD_TEST + struct iommu_test_cmd test; + #endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-527-fotg210-udc-Add-missing-completion-handler.patch b/patches.kernel.org/6.2.3-527-fotg210-udc-Add-missing-completion-handler.patch new file mode 100644 index 0000000..6d2ed39 --- /dev/null +++ b/patches.kernel.org/6.2.3-527-fotg210-udc-Add-missing-completion-handler.patch @@ -0,0 +1,60 @@ +From: Fabian Vogt +Date: Mon, 23 Jan 2023 08:35:06 +0100 +Subject: [PATCH] fotg210-udc: Add missing completion handler +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e55f67391fa986f7357edba0ca59e668d99c3a5f + +[ Upstream commit e55f67391fa986f7357edba0ca59e668d99c3a5f ] + +This is used when responding to GET_STATUS requests. Without this, it +crashes on completion. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20230123073508.2350402-2-linus.walleij@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/usb/fotg210/fotg210-udc.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/usb/fotg210/fotg210-udc.c b/drivers/usb/fotg210/fotg210-udc.c +index eb076746..7ba7fb52 100644 +--- a/drivers/usb/fotg210/fotg210-udc.c ++++ b/drivers/usb/fotg210/fotg210-udc.c +@@ -710,6 +710,20 @@ static int fotg210_is_epnstall(struct fotg210_ep *ep) + return value & INOUTEPMPSR_STL_EP ? 1 : 0; + } + ++/* For EP0 requests triggered by this driver (currently GET_STATUS response) */ ++static void fotg210_ep0_complete(struct usb_ep *_ep, struct usb_request *req) ++{ ++ struct fotg210_ep *ep; ++ struct fotg210_udc *fotg210; ++ ++ ep = container_of(_ep, struct fotg210_ep, ep); ++ fotg210 = ep->fotg210; ++ ++ if (req->status || req->actual != req->length) { ++ dev_warn(&fotg210->gadget.dev, "EP0 request failed: %d\n", req->status); ++ } ++} ++ + static void fotg210_get_status(struct fotg210_udc *fotg210, + struct usb_ctrlrequest *ctrl) + { +@@ -1261,6 +1275,8 @@ int fotg210_udc_probe(struct platform_device *pdev) + if (fotg210->ep0_req == NULL) + goto err_map; + ++ fotg210->ep0_req->complete = fotg210_ep0_complete; ++ + fotg210_init(fotg210); + + fotg210_disable_unplug(fotg210); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-528-dmaengine-dw-edma-Fix-missing-src-dst-address-o.patch b/patches.kernel.org/6.2.3-528-dmaengine-dw-edma-Fix-missing-src-dst-address-o.patch new file mode 100644 index 0000000..bd4be5b --- /dev/null +++ b/patches.kernel.org/6.2.3-528-dmaengine-dw-edma-Fix-missing-src-dst-address-o.patch @@ -0,0 +1,58 @@ +From: Serge Semin +Date: Fri, 13 Jan 2023 20:13:46 +0300 +Subject: [PATCH] dmaengine: dw-edma: Fix missing src/dst address of + interleaved xfers +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 13b6299cf66165a442089fa895a7f70250703584 + +[ Upstream commit 13b6299cf66165a442089fa895a7f70250703584 ] + +Interleaved DMA transfer support was added by 85e7518f42c8 ("dmaengine: +dw-edma: Add device_prep_interleave_dma() support"), but depending on the +selected channel, either source or destination address are left +uninitialized which was obviously wrong. + +Initialize the destination address of the eDMA burst descriptors for +DEV_TO_MEM interleaved operations and the source address for MEM_TO_DEV +operations. + +Link: https://lore.kernel.org/r/20230113171409.30470-5-Sergey.Semin@baikalelectronics.ru +Fixes: 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support") +Tested-by: Manivannan Sadhasivam +Signed-off-by: Serge Semin +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Acked-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/dw-edma/dw-edma-core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index c54b24ff..52bdf04a 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -455,6 +455,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + * and destination addresses are increased + * by the same portion (data length) + */ ++ } else if (xfer->type == EDMA_XFER_INTERLEAVED) { ++ burst->dar = dst_addr; + } + } else { + burst->dar = dst_addr; +@@ -470,6 +472,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + * and destination addresses are increased + * by the same portion (data length) + */ ++ } else if (xfer->type == EDMA_XFER_INTERLEAVED) { ++ burst->sar = src_addr; + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-529-fpga-microchip-spi-move-SPI-I-O-buffers-out-of-.patch b/patches.kernel.org/6.2.3-529-fpga-microchip-spi-move-SPI-I-O-buffers-out-of-.patch new file mode 100644 index 0000000..bd7f51a --- /dev/null +++ b/patches.kernel.org/6.2.3-529-fpga-microchip-spi-move-SPI-I-O-buffers-out-of-.patch @@ -0,0 +1,258 @@ +From: Ivan Bornyakov +Date: Fri, 30 Dec 2022 12:29:20 +0300 +Subject: [PATCH] fpga: microchip-spi: move SPI I/O buffers out of stack +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1da53d23a41c5f77963984d8da5623ed56918ada + +[ Upstream commit 1da53d23a41c5f77963984d8da5623ed56918ada ] + +As spi-summary doc says: + > I/O buffers use the usual Linux rules, and must be DMA-safe. + > You'd normally allocate them from the heap or free page pool. + > Don't use the stack, or anything that's declared "static". + +Replace spi_write() with spi_write_then_read(), which is dma-safe for +on-stack buffers. Use cacheline aligned buffers for transfers used in +spi_sync_transfer(). + +Although everything works OK with stack-located I/O buffers, better +follow the doc to be safe. + +Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager") +Signed-off-by: Ivan Bornyakov +Acked-by: Conor Dooley +Acked-by: Xu Yilun +Link: https://lore.kernel.org/r/20221230092922.18822-2-i.bornyakov@metrotek.ru +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/fpga/microchip-spi.c | 93 ++++++++++++++++++------------------ + 1 file changed, 47 insertions(+), 46 deletions(-) + +diff --git a/drivers/fpga/microchip-spi.c b/drivers/fpga/microchip-spi.c +index 7436976e..bb69f5be 100644 +--- a/drivers/fpga/microchip-spi.c ++++ b/drivers/fpga/microchip-spi.c +@@ -42,46 +42,55 @@ + struct mpf_priv { + struct spi_device *spi; + bool program_mode; ++ u8 tx __aligned(ARCH_KMALLOC_MINALIGN); ++ u8 rx; + }; + +-static int mpf_read_status(struct spi_device *spi) ++static int mpf_read_status(struct mpf_priv *priv) + { +- u8 status = 0, status_command = MPF_SPI_READ_STATUS; +- struct spi_transfer xfers[2] = { 0 }; +- int ret; +- + /* + * HW status is returned on MISO in the first byte after CS went + * active. However, first reading can be inadequate, so we submit + * two identical SPI transfers and use result of the later one. + */ +- xfers[0].tx_buf = &status_command; +- xfers[1].tx_buf = &status_command; +- xfers[0].rx_buf = &status; +- xfers[1].rx_buf = &status; +- xfers[0].len = 1; +- xfers[1].len = 1; +- xfers[0].cs_change = 1; ++ struct spi_transfer xfers[2] = { ++ { ++ .tx_buf = &priv->tx, ++ .rx_buf = &priv->rx, ++ .len = 1, ++ .cs_change = 1, ++ }, { ++ .tx_buf = &priv->tx, ++ .rx_buf = &priv->rx, ++ .len = 1, ++ }, ++ }; ++ u8 status; ++ int ret; ++ ++ priv->tx = MPF_SPI_READ_STATUS; ++ ++ ret = spi_sync_transfer(priv->spi, xfers, 2); ++ if (ret) ++ return ret; + +- ret = spi_sync_transfer(spi, xfers, 2); ++ status = priv->rx; + + if ((status & MPF_STATUS_SPI_VIOLATION) || + (status & MPF_STATUS_SPI_ERROR)) +- ret = -EIO; ++ return -EIO; + +- return ret ? : status; ++ return status; + } + + static enum fpga_mgr_states mpf_ops_state(struct fpga_manager *mgr) + { + struct mpf_priv *priv = mgr->priv; +- struct spi_device *spi; + bool program_mode; + int status; + +- spi = priv->spi; + program_mode = priv->program_mode; +- status = mpf_read_status(spi); ++ status = mpf_read_status(priv); + + if (!program_mode && !status) + return FPGA_MGR_STATE_OPERATING; +@@ -186,12 +195,12 @@ static int mpf_ops_parse_header(struct fpga_manager *mgr, + } + + /* Poll HW status until busy bit is cleared and mask bits are set. */ +-static int mpf_poll_status(struct spi_device *spi, u8 mask) ++static int mpf_poll_status(struct mpf_priv *priv, u8 mask) + { + int status, retries = MPF_STATUS_POLL_RETRIES; + + while (retries--) { +- status = mpf_read_status(spi); ++ status = mpf_read_status(priv); + if (status < 0) + return status; + +@@ -205,32 +214,32 @@ static int mpf_poll_status(struct spi_device *spi, u8 mask) + return -EBUSY; + } + +-static int mpf_spi_write(struct spi_device *spi, const void *buf, size_t buf_size) ++static int mpf_spi_write(struct mpf_priv *priv, const void *buf, size_t buf_size) + { +- int status = mpf_poll_status(spi, 0); ++ int status = mpf_poll_status(priv, 0); + + if (status < 0) + return status; + +- return spi_write(spi, buf, buf_size); ++ return spi_write_then_read(priv->spi, buf, buf_size, NULL, 0); + } + +-static int mpf_spi_write_then_read(struct spi_device *spi, ++static int mpf_spi_write_then_read(struct mpf_priv *priv, + const void *txbuf, size_t txbuf_size, + void *rxbuf, size_t rxbuf_size) + { + const u8 read_command[] = { MPF_SPI_READ_DATA }; + int ret; + +- ret = mpf_spi_write(spi, txbuf, txbuf_size); ++ ret = mpf_spi_write(priv, txbuf, txbuf_size); + if (ret) + return ret; + +- ret = mpf_poll_status(spi, MPF_STATUS_READY); ++ ret = mpf_poll_status(priv, MPF_STATUS_READY); + if (ret < 0) + return ret; + +- return spi_write_then_read(spi, read_command, sizeof(read_command), ++ return spi_write_then_read(priv->spi, read_command, sizeof(read_command), + rxbuf, rxbuf_size); + } + +@@ -242,7 +251,6 @@ static int mpf_ops_write_init(struct fpga_manager *mgr, + const u8 isc_en_command[] = { MPF_SPI_ISC_ENABLE }; + struct mpf_priv *priv = mgr->priv; + struct device *dev = &mgr->dev; +- struct spi_device *spi; + u32 isc_ret = 0; + int ret; + +@@ -251,9 +259,7 @@ static int mpf_ops_write_init(struct fpga_manager *mgr, + return -EOPNOTSUPP; + } + +- spi = priv->spi; +- +- ret = mpf_spi_write_then_read(spi, isc_en_command, sizeof(isc_en_command), ++ ret = mpf_spi_write_then_read(priv, isc_en_command, sizeof(isc_en_command), + &isc_ret, sizeof(isc_ret)); + if (ret || isc_ret) { + dev_err(dev, "Failed to enable ISC: spi_ret %d, isc_ret %u\n", +@@ -261,7 +267,7 @@ static int mpf_ops_write_init(struct fpga_manager *mgr, + return -EFAULT; + } + +- ret = mpf_spi_write(spi, program_mode, sizeof(program_mode)); ++ ret = mpf_spi_write(priv, program_mode, sizeof(program_mode)); + if (ret) { + dev_err(dev, "Failed to enter program mode: %d\n", ret); + return ret; +@@ -274,11 +280,9 @@ static int mpf_ops_write_init(struct fpga_manager *mgr, + + static int mpf_ops_write(struct fpga_manager *mgr, const char *buf, size_t count) + { +- u8 spi_frame_command[] = { MPF_SPI_FRAME }; + struct spi_transfer xfers[2] = { 0 }; + struct mpf_priv *priv = mgr->priv; + struct device *dev = &mgr->dev; +- struct spi_device *spi; + int ret, i; + + if (count % MPF_SPI_FRAME_SIZE) { +@@ -287,18 +291,18 @@ static int mpf_ops_write(struct fpga_manager *mgr, const char *buf, size_t count + return -EINVAL; + } + +- spi = priv->spi; +- +- xfers[0].tx_buf = spi_frame_command; +- xfers[0].len = sizeof(spi_frame_command); ++ xfers[0].tx_buf = &priv->tx; ++ xfers[0].len = 1; + + for (i = 0; i < count / MPF_SPI_FRAME_SIZE; i++) { + xfers[1].tx_buf = buf + i * MPF_SPI_FRAME_SIZE; + xfers[1].len = MPF_SPI_FRAME_SIZE; + +- ret = mpf_poll_status(spi, 0); +- if (ret >= 0) +- ret = spi_sync_transfer(spi, xfers, ARRAY_SIZE(xfers)); ++ ret = mpf_poll_status(priv, 0); ++ if (ret >= 0) { ++ priv->tx = MPF_SPI_FRAME; ++ ret = spi_sync_transfer(priv->spi, xfers, ARRAY_SIZE(xfers)); ++ } + + if (ret) { + dev_err(dev, "Failed to write bitstream frame %d/%zu\n", +@@ -317,12 +321,9 @@ static int mpf_ops_write_complete(struct fpga_manager *mgr, + const u8 release_command[] = { MPF_SPI_RELEASE }; + struct mpf_priv *priv = mgr->priv; + struct device *dev = &mgr->dev; +- struct spi_device *spi; + int ret; + +- spi = priv->spi; +- +- ret = mpf_spi_write(spi, isc_dis_command, sizeof(isc_dis_command)); ++ ret = mpf_spi_write(priv, isc_dis_command, sizeof(isc_dis_command)); + if (ret) { + dev_err(dev, "Failed to disable ISC: %d\n", ret); + return ret; +@@ -330,7 +331,7 @@ static int mpf_ops_write_complete(struct fpga_manager *mgr, + + usleep_range(1000, 2000); + +- ret = mpf_spi_write(spi, release_command, sizeof(release_command)); ++ ret = mpf_spi_write(priv, release_command, sizeof(release_command)); + if (ret) { + dev_err(dev, "Failed to exit program mode: %d\n", ret); + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-530-fpga-microchip-spi-rewrite-status-polling-in-a-.patch b/patches.kernel.org/6.2.3-530-fpga-microchip-spi-rewrite-status-polling-in-a-.patch new file mode 100644 index 0000000..60daac1 --- /dev/null +++ b/patches.kernel.org/6.2.3-530-fpga-microchip-spi-rewrite-status-polling-in-a-.patch @@ -0,0 +1,100 @@ +From: Ivan Bornyakov +Date: Fri, 30 Dec 2022 12:29:21 +0300 +Subject: [PATCH] fpga: microchip-spi: rewrite status polling in a time + measurable way +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 88e705697e801299a13ecaf2ba54599964fe711c + +[ Upstream commit 88e705697e801299a13ecaf2ba54599964fe711c ] + +Original busy loop with retries count in mpf_poll_status() is not too +reliable, as it takes different times on different systems. Replace it +with read_poll_timeout() macro. + +While at it, fix polling stop condition to met function's original +intention declared in the comment. The issue with original polling stop +condition is that it stops if any of mask bits is set, while intention +was to stop if all mask bits is set. This was not noticible because only +MPF_STATUS_READY is passed as mask argument and it is BIT(1). + +Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager") +Signed-off-by: Ivan Bornyakov +Reviewed-by: Ilpo Järvinen +Acked-by: Conor Dooley +Acked-by: Xu Yilun +Link: https://lore.kernel.org/r/20221230092922.18822-3-i.bornyakov@metrotek.ru +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/fpga/microchip-spi.c | 32 +++++++++++++++++--------------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +diff --git a/drivers/fpga/microchip-spi.c b/drivers/fpga/microchip-spi.c +index bb69f5be..137fafdf 100644 +--- a/drivers/fpga/microchip-spi.c ++++ b/drivers/fpga/microchip-spi.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -33,7 +34,7 @@ + + #define MPF_BITS_PER_COMPONENT_SIZE 22 + +-#define MPF_STATUS_POLL_RETRIES 10000 ++#define MPF_STATUS_POLL_TIMEOUT (2 * USEC_PER_SEC) + #define MPF_STATUS_BUSY BIT(0) + #define MPF_STATUS_READY BIT(1) + #define MPF_STATUS_SPI_VIOLATION BIT(2) +@@ -194,24 +195,25 @@ static int mpf_ops_parse_header(struct fpga_manager *mgr, + return 0; + } + +-/* Poll HW status until busy bit is cleared and mask bits are set. */ + static int mpf_poll_status(struct mpf_priv *priv, u8 mask) + { +- int status, retries = MPF_STATUS_POLL_RETRIES; ++ int ret, status; + +- while (retries--) { +- status = mpf_read_status(priv); +- if (status < 0) +- return status; +- +- if (status & MPF_STATUS_BUSY) +- continue; +- +- if (!mask || (status & mask)) +- return status; +- } ++ /* ++ * Busy poll HW status. Polling stops if any of the following ++ * conditions are met: ++ * - timeout is reached ++ * - mpf_read_status() returns an error ++ * - busy bit is cleared AND mask bits are set ++ */ ++ ret = read_poll_timeout(mpf_read_status, status, ++ (status < 0) || ++ ((status & (MPF_STATUS_BUSY | mask)) == mask), ++ 0, MPF_STATUS_POLL_TIMEOUT, false, priv); ++ if (ret < 0) ++ return ret; + +- return -EBUSY; ++ return status; + } + + static int mpf_spi_write(struct mpf_priv *priv, const void *buf, size_t buf_size) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-531-usb-early-xhci-dbc-Fix-a-potential-out-of-bound.patch b/patches.kernel.org/6.2.3-531-usb-early-xhci-dbc-Fix-a-potential-out-of-bound.patch new file mode 100644 index 0000000..0b64781 --- /dev/null +++ b/patches.kernel.org/6.2.3-531-usb-early-xhci-dbc-Fix-a-potential-out-of-bound.patch @@ -0,0 +1,43 @@ +From: Christophe JAILLET +Date: Sun, 29 Jan 2023 19:23:08 +0100 +Subject: [PATCH] usb: early: xhci-dbc: Fix a potential out-of-bound memory + access +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a4a97ab3db5c081eb6e7dba91306adefb461e0bd + +[ Upstream commit a4a97ab3db5c081eb6e7dba91306adefb461e0bd ] + +If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the +string is not guaranteed to be NULL terminated when xdbc_trace() is called. + +Reserve an extra byte, which will be zeroed automatically because 'buf' is +a static variable, in order to avoid troubles, should it happen. + +Fixes: aeb9dd1de98c ("usb/early: Add driver for xhci debug capability") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/d6a7562c5e839a195cee85db6dc81817f9372cb1.1675016180.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/usb/early/xhci-dbc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c +index 79704715..f3e23be2 100644 +--- a/drivers/usb/early/xhci-dbc.c ++++ b/drivers/usb/early/xhci-dbc.c +@@ -874,7 +874,8 @@ static int xdbc_bulk_write(const char *bytes, int size) + + static void early_xdbc_write(struct console *con, const char *str, u32 n) + { +- static char buf[XDBC_MAX_PACKET]; ++ /* static variables are zeroed, so buf is always NULL terminated */ ++ static char buf[XDBC_MAX_PACKET + 1]; + int chunk, ret; + int use_cr = 0; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-532-tty-serial-fsl_lpuart-Fix-the-wrong-RXWATER-set.patch b/patches.kernel.org/6.2.3-532-tty-serial-fsl_lpuart-Fix-the-wrong-RXWATER-set.patch new file mode 100644 index 0000000..bc4ff3b --- /dev/null +++ b/patches.kernel.org/6.2.3-532-tty-serial-fsl_lpuart-Fix-the-wrong-RXWATER-set.patch @@ -0,0 +1,47 @@ +From: Sherry Sun +Date: Mon, 30 Jan 2023 14:44:46 +0800 +Subject: [PATCH] tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx + dma case +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9ad9df8447547febe9dd09b040f4528a09e495f0 + +[ Upstream commit 9ad9df8447547febe9dd09b040f4528a09e495f0 ] + +The RXWATER value must be greater than 0 according to the LPUART +reference manual. And when the number of datawords in the receive +FIFO is greater than RXWATER, an interrupt or a DMA request is +generated, so no need to set the different value for lpuart interrupt +case and dma case. Here delete the wrong RXWATER setting for dma case +directly. + +Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20230130064449.9564-4-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/fsl_lpuart.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 986ec832..f34fabdc 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1683,12 +1683,6 @@ static void lpuart32_configure(struct lpuart_port *sport) + { + unsigned long temp; + +- if (sport->lpuart_dma_rx_use) { +- /* RXWATER must be 0 */ +- temp = lpuart32_read(&sport->port, UARTWATER); +- temp &= ~(UARTWATER_WATER_MASK << UARTWATER_RXWATER_OFF); +- lpuart32_write(&sport->port, temp, UARTWATER); +- } + temp = lpuart32_read(&sport->port, UARTCTRL); + if (!sport->lpuart_dma_rx_use) + temp |= UARTCTRL_RIE; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-533-RDMA-cxgb4-add-null-ptr-check-after-ip_dev_find.patch b/patches.kernel.org/6.2.3-533-RDMA-cxgb4-add-null-ptr-check-after-ip_dev_find.patch new file mode 100644 index 0000000..dab11c2 --- /dev/null +++ b/patches.kernel.org/6.2.3-533-RDMA-cxgb4-add-null-ptr-check-after-ip_dev_find.patch @@ -0,0 +1,44 @@ +From: Nikita Zhandarovich +Date: Wed, 1 Feb 2023 09:21:03 -0800 +Subject: [PATCH] RDMA/cxgb4: add null-ptr-check after ip_dev_find() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ef42520240aacfc0d46c8d780c051d135a8dc9b7 + +[ Upstream commit ef42520240aacfc0d46c8d780c051d135a8dc9b7 ] + +ip_dev_find() may return NULL and assign it to pdev which is +dereferenced later. +Fix this by checking the return value of ip_dev_find() for NULL +similar to the way it is done with other instances of said function. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection") +Signed-off-by: Nikita Zhandarovich +Link: https://lore.kernel.org/r/20230201172103.17261-1-n.zhandarovich@fintech.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/cxgb4/cm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 499a425a..ea3ddf0d 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -4144,6 +4144,10 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb) + + if (neigh->dev->flags & IFF_LOOPBACK) { + pdev = ip_dev_find(&init_net, iph->daddr); ++ if (!pdev) { ++ pr_err("%s - failed to find device!\n", __func__); ++ goto free_dst; ++ } + e = cxgb4_l2t_get(dev->rdev.lldi.l2t, neigh, + pdev, 0); + pi = (struct port_info *)netdev_priv(pdev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-534-usb-musb-mediatek-don-t-unregister-something-th.patch b/patches.kernel.org/6.2.3-534-usb-musb-mediatek-don-t-unregister-something-th.patch new file mode 100644 index 0000000..c2dee8d --- /dev/null +++ b/patches.kernel.org/6.2.3-534-usb-musb-mediatek-don-t-unregister-something-th.patch @@ -0,0 +1,41 @@ +From: Dan Carpenter +Date: Tue, 24 Jan 2023 18:20:46 +0300 +Subject: [PATCH] usb: musb: mediatek: don't unregister something that wasn't + registered +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ba883de971d1ad018f3083d9195b8abe54d87407 + +[ Upstream commit ba883de971d1ad018f3083d9195b8abe54d87407 ] + +This function only calls mtk_otg_switch_init() when the ->port_mode +is MUSB_OTG so the clean up code should only call mtk_otg_switch_exit() +for that mode. + +Fixes: 0990366bab3c ("usb: musb: Add support for MediaTek musb controller") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/Y8/3TqpqiSr0RxFH@kili +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/usb/musb/mediatek.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/musb/mediatek.c b/drivers/usb/musb/mediatek.c +index cad99138..27b9bd25 100644 +--- a/drivers/usb/musb/mediatek.c ++++ b/drivers/usb/musb/mediatek.c +@@ -294,7 +294,8 @@ static int mtk_musb_init(struct musb *musb) + err_phy_power_on: + phy_exit(glue->phy); + err_phy_init: +- mtk_otg_switch_exit(glue); ++ if (musb->port_mode == MUSB_OTG) ++ mtk_otg_switch_exit(glue); + return ret; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-535-usb-gadget-configfs-Restrict-symlink-creation-i.patch b/patches.kernel.org/6.2.3-535-usb-gadget-configfs-Restrict-symlink-creation-i.patch new file mode 100644 index 0000000..e0160d5 --- /dev/null +++ b/patches.kernel.org/6.2.3-535-usb-gadget-configfs-Restrict-symlink-creation-i.patch @@ -0,0 +1,104 @@ +From: Udipto Goswami +Date: Wed, 1 Feb 2023 18:53:08 +0530 +Subject: [PATCH] usb: gadget: configfs: Restrict symlink creation is UDC + already binded +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 89e7252d6c7e7eeb31971cd7df987316ecc64ff5 + +[ Upstream commit 89e7252d6c7e7eeb31971cd7df987316ecc64ff5 ] + +During enumeration or composition switch,a userspace process +agnostic of the conventions of configs can try to create function +symlinks even after the UDC is bound to current config which is +not correct. Potentially it can create duplicates within the +current config. + +Prevent this by adding a check if udc_name already exists, then bail +out of cfg_link. + +Following is an example: + +Step1: +ln -s X1 ffs.a +-->cfg_link +--> usb_get_function(ffs.a) + ->ffs_alloc + + CFG->FUNC_LIST: + C->FUNCTION: + +Step2: +echo udc.name > /config/usb_gadget/g1/UDC +--> UDC_store + ->composite_bind + ->usb_add_function + + CFG->FUNC_LIST: + C->FUNCTION: + +Step3: +ln -s Y1 ffs.a +-->cfg_link +-->usb_get_function(ffs.a) + ->ffs_alloc + + CFG->FUNC_LIST: + C->FUNCTION: + +both the lists corresponds to the same function instance ffs.a +but the usb_function* pointer is different because in step 3 +ffs_alloc has created a new reference to usb_function* for +ffs.a and added it to cfg_list. + +Step4: +Now a composition switch involving is executed. + +the composition switch will involve 3 things: + 1. unlinking the previous functions existing + 2. creating new symlinks + 3. writing UDC + +However, the composition switch is generally taken care by +userspace process which creates the symlinks in its own +nomenclature(X*) and removes only those. +So it won't be able to remove Y1 which user had created +by own. + +Due to this the new symlinks cannot be created for ffs.a +since the entry already exists in CFG->FUNC_LIST. + +The state of the CFG->FUNC_LIST is as follows: + CFG->FUNC_LIST: + +Fixes: 88af8bbe4ef7 ("usb: gadget: the start of the configfs interface") +Signed-off-by: Krishna Kurapati PSSNV +Signed-off-by: Udipto Goswami +Link: https://lore.kernel.org/r/20230201132308.31523-1-quic_ugoswami@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/usb/gadget/configfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 0853536c..2ff34dc1 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -430,6 +430,12 @@ static int config_usb_cfg_link( + * from another gadget or a random directory. + * Also a function instance can only be linked once. + */ ++ ++ if (gi->composite.gadget_driver.udc_name) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + list_for_each_entry(iter, &gi->available_func, cfs_list) { + if (iter != fi) + continue; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-536-phy-mediatek-remove-temporary-variable-mask_.patch b/patches.kernel.org/6.2.3-536-phy-mediatek-remove-temporary-variable-mask_.patch new file mode 100644 index 0000000..1a4343c --- /dev/null +++ b/patches.kernel.org/6.2.3-536-phy-mediatek-remove-temporary-variable-mask_.patch @@ -0,0 +1,53 @@ +From: Chunfeng Yun +Date: Wed, 18 Jan 2023 16:43:41 +0800 +Subject: [PATCH] phy: mediatek: remove temporary variable @mask_ +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 49094d928618309877c50e589f23e639a3b0c453 + +[ Upstream commit 49094d928618309877c50e589f23e639a3b0c453 ] + +Remove the temporary @mask_, this may cause build warning when use clang +compiler for powerpc, but can't reproduce it when compile for arm64. +the build warning is caused by: + +"warning: result of comparison of constant 18446744073709551615 with +expression of type (aka 'unsigned long') is always false +[-Wtautological-constant-out-of-range-compare]" + +More information provided in below lore link. + +After removing @mask_, there is a "CHECK:MACRO_ARG_REUSE" when run +checkpatch.pl, but due to @mask is constant, no reuse problem will happen. + +Link: https://lore.kernel.org/lkml/202212160357.jJuesD8n-lkp@intel.com/t/ +Fixes: 84513eccd678 ("phy: mediatek: fix build warning of FIELD_PREP()") +Reported-by: kernel test robot +Signed-off-by: Chunfeng Yun +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230118084343.26913-1-chunfeng.yun@mediatek.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/phy/mediatek/phy-mtk-io.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/mediatek/phy-mtk-io.h b/drivers/phy/mediatek/phy-mtk-io.h +index d20ad5e5..58f06db8 100644 +--- a/drivers/phy/mediatek/phy-mtk-io.h ++++ b/drivers/phy/mediatek/phy-mtk-io.h +@@ -39,8 +39,8 @@ static inline void mtk_phy_update_bits(void __iomem *reg, u32 mask, u32 val) + /* field @mask shall be constant and continuous */ + #define mtk_phy_update_field(reg, mask, val) \ + ({ \ +- typeof(mask) mask_ = (mask); \ +- mtk_phy_update_bits(reg, mask_, FIELD_PREP(mask_, val)); \ ++ BUILD_BUG_ON_MSG(!__builtin_constant_p(mask), "mask is not constant"); \ ++ mtk_phy_update_bits(reg, mask, FIELD_PREP(mask, val)); \ + }) + + #endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-537-PCI-mt7621-Delay-phy-ports-initialization.patch b/patches.kernel.org/6.2.3-537-PCI-mt7621-Delay-phy-ports-initialization.patch new file mode 100644 index 0000000..25c63d6 --- /dev/null +++ b/patches.kernel.org/6.2.3-537-PCI-mt7621-Delay-phy-ports-initialization.patch @@ -0,0 +1,63 @@ +From: Sergio Paracuellos +Date: Sat, 31 Dec 2022 08:40:41 +0100 +Subject: [PATCH] PCI: mt7621: Delay phy ports initialization +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0cb2a8f3456ff1cc51d571e287a48e8fddc98ec2 + +[ Upstream commit 0cb2a8f3456ff1cc51d571e287a48e8fddc98ec2 ] + +Some devices like ZBT WE1326 and ZBT WF3526-P and some Netgear models need +to delay phy port initialization after calling the mt7621_pcie_init_port() +driver function to get into reliable boots for both warm and hard resets. + +The delay required to detect the ports seems to be in the range [75-100] +milliseconds. + +If the ports are not detected the controller is not functional. + +There is no datasheet or something similar to really understand why this +extra delay is needed only for these devices and it is not for most of +the boards that are built on mt7621 SoC. + +This issue has been reported by openWRT community and the complete +discussion is in [0]. The 100 milliseconds delay has been tested in all +devices to validate it. + +Add the extra 100 milliseconds delay to fix the issue. + +[0]: https://github.com/openwrt/openwrt/pull/11220 + +Link: https://lore.kernel.org/r/20221231074041.264738-1-sergio.paracuellos@gmail.com +Fixes: 2bdd5238e756 ("PCI: mt7621: Add MediaTek MT7621 PCIe host controller driver") +Signed-off-by: Sergio Paracuellos +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pci/controller/pcie-mt7621.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pci/controller/pcie-mt7621.c b/drivers/pci/controller/pcie-mt7621.c +index ee7aad09..63a5f446 100644 +--- a/drivers/pci/controller/pcie-mt7621.c ++++ b/drivers/pci/controller/pcie-mt7621.c +@@ -60,6 +60,7 @@ + #define PCIE_PORT_LINKUP BIT(0) + #define PCIE_PORT_CNT 3 + ++#define INIT_PORTS_DELAY_MS 100 + #define PERST_DELAY_MS 100 + + /** +@@ -369,6 +370,7 @@ static int mt7621_pcie_init_ports(struct mt7621_pcie *pcie) + } + } + ++ msleep(INIT_PORTS_DELAY_MS); + mt7621_pcie_reset_ep_deassert(pcie); + + tmp = NULL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-538-iommu-vt-d-Set-No-Execute-Enable-bit-in-PASID-t.patch b/patches.kernel.org/6.2.3-538-iommu-vt-d-Set-No-Execute-Enable-bit-in-PASID-t.patch new file mode 100644 index 0000000..2ec450b --- /dev/null +++ b/patches.kernel.org/6.2.3-538-iommu-vt-d-Set-No-Execute-Enable-bit-in-PASID-t.patch @@ -0,0 +1,56 @@ +From: Lu Baolu +Date: Tue, 31 Jan 2023 15:37:33 +0800 +Subject: [PATCH] iommu/vt-d: Set No Execute Enable bit in PASID table entry +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e06d24435596c8afcaa81c0c498f5b0ec4ee2b7c + +[ Upstream commit e06d24435596c8afcaa81c0c498f5b0ec4ee2b7c ] + +Setup No Execute Enable bit (Bit 133) of a scalable mode PASID entry. +This is to allow the use of XD bit of the first level page table. + +Fixes: ddf09b6d43ec ("iommu/vt-d: Setup pasid entries for iova over first level") +Signed-off-by: Ashok Raj +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20230126095438.354205-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iommu/intel/pasid.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c +index fb3c7020..ec964ac7 100644 +--- a/drivers/iommu/intel/pasid.c ++++ b/drivers/iommu/intel/pasid.c +@@ -364,6 +364,16 @@ static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value) + pasid_set_bits(&pe->val[1], 1 << 23, value << 23); + } + ++/* ++ * Setup No Execute Enable bit (Bit 133) of a scalable mode PASID ++ * entry. It is required when XD bit of the first level page table ++ * entry is about to be set. ++ */ ++static inline void pasid_set_nxe(struct pasid_entry *pe) ++{ ++ pasid_set_bits(&pe->val[2], 1 << 5, 1 << 5); ++} ++ + /* + * Setup the Page Snoop (PGSNP) field (Bit 88) of a scalable mode + * PASID entry. +@@ -557,6 +567,7 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu, + pasid_set_domain_id(pte, did); + pasid_set_address_width(pte, iommu->agaw); + pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap)); ++ pasid_set_nxe(pte); + + /* Setup Present and PASID Granular Transfer Type: */ + pasid_set_translation_type(pte, PASID_ENTRY_PGTT_FL_ONLY); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-539-power-supply-remove-faulty-cooling-logic.patch b/patches.kernel.org/6.2.3-539-power-supply-remove-faulty-cooling-logic.patch new file mode 100644 index 0000000..dcb01de --- /dev/null +++ b/patches.kernel.org/6.2.3-539-power-supply-remove-faulty-cooling-logic.patch @@ -0,0 +1,180 @@ +From: Andreas Kemnade +Date: Sat, 21 Jan 2023 12:16:21 +0100 +Subject: [PATCH] power: supply: remove faulty cooling logic +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c85c191694cb1cf290b11059b3d2de8a2732ffd0 + +[ Upstream commit c85c191694cb1cf290b11059b3d2de8a2732ffd0 ] + +The rn5t618 power driver fails to register +a cooling device because POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX +is missing but availability is not checked before registering +cooling device. After improved error checking in the thermal +code, the registration of the power supply fails entirely. + +Checking for availability of _MAX before registering cooling device +fixes the rn5t618 problem. But the whole logic feels questionable. + +First, the logic is inverted here: +the code tells: max_current = max_cooling but +0 = max_cooling, so there needs to be some inversion +in the code which cannot be found. Comparing with other +cooling devices, it can be found that value for fan speed is not +inverted, value for cpufreq cooling is inverted (similar situation +as here lowest frequency = max cooling) + +Second, analyzing usage of _MAX: it is seems that maximum capabilities +of charging controller are specified and not of the battery. Probably +there is not too much mismatch in the drivers actually implementing +that. So nothing has exploded yet. So there is no easy and safe way +to specifify a max cooling value now. + +Conclusion for now (as a regression fix) just remove the cooling device +registration and do it properly later on. + +Fixes: e49a1e1ee078 ("thermal/core: fix error code in __thermal_cooling_device_register()") +Fixes: 952aeeb3ee28 ("power_supply: Register power supply for thermal cooling device") +Signed-off-by: Andreas Kemnade +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/power/supply/power_supply_core.c | 93 ------------------------ + 1 file changed, 93 deletions(-) + +diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c +index 7c790c41..cc5b2e22 100644 +--- a/drivers/power/supply/power_supply_core.c ++++ b/drivers/power/supply/power_supply_core.c +@@ -1186,83 +1186,6 @@ static void psy_unregister_thermal(struct power_supply *psy) + thermal_zone_device_unregister(psy->tzd); + } + +-/* thermal cooling device callbacks */ +-static int ps_get_max_charge_cntl_limit(struct thermal_cooling_device *tcd, +- unsigned long *state) +-{ +- struct power_supply *psy; +- union power_supply_propval val; +- int ret; +- +- psy = tcd->devdata; +- ret = power_supply_get_property(psy, +- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val); +- if (ret) +- return ret; +- +- *state = val.intval; +- +- return ret; +-} +- +-static int ps_get_cur_charge_cntl_limit(struct thermal_cooling_device *tcd, +- unsigned long *state) +-{ +- struct power_supply *psy; +- union power_supply_propval val; +- int ret; +- +- psy = tcd->devdata; +- ret = power_supply_get_property(psy, +- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val); +- if (ret) +- return ret; +- +- *state = val.intval; +- +- return ret; +-} +- +-static int ps_set_cur_charge_cntl_limit(struct thermal_cooling_device *tcd, +- unsigned long state) +-{ +- struct power_supply *psy; +- union power_supply_propval val; +- int ret; +- +- psy = tcd->devdata; +- val.intval = state; +- ret = psy->desc->set_property(psy, +- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val); +- +- return ret; +-} +- +-static const struct thermal_cooling_device_ops psy_tcd_ops = { +- .get_max_state = ps_get_max_charge_cntl_limit, +- .get_cur_state = ps_get_cur_charge_cntl_limit, +- .set_cur_state = ps_set_cur_charge_cntl_limit, +-}; +- +-static int psy_register_cooler(struct power_supply *psy) +-{ +- /* Register for cooling device if psy can control charging */ +- if (psy_has_property(psy->desc, POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT)) { +- psy->tcd = thermal_cooling_device_register( +- (char *)psy->desc->name, +- psy, &psy_tcd_ops); +- return PTR_ERR_OR_ZERO(psy->tcd); +- } +- +- return 0; +-} +- +-static void psy_unregister_cooler(struct power_supply *psy) +-{ +- if (IS_ERR_OR_NULL(psy->tcd)) +- return; +- thermal_cooling_device_unregister(psy->tcd); +-} + #else + static int psy_register_thermal(struct power_supply *psy) + { +@@ -1272,15 +1195,6 @@ static int psy_register_thermal(struct power_supply *psy) + static void psy_unregister_thermal(struct power_supply *psy) + { + } +- +-static int psy_register_cooler(struct power_supply *psy) +-{ +- return 0; +-} +- +-static void psy_unregister_cooler(struct power_supply *psy) +-{ +-} + #endif + + static struct power_supply *__must_check +@@ -1354,10 +1268,6 @@ __power_supply_register(struct device *parent, + if (rc) + goto register_thermal_failed; + +- rc = psy_register_cooler(psy); +- if (rc) +- goto register_cooler_failed; +- + rc = power_supply_create_triggers(psy); + if (rc) + goto create_triggers_failed; +@@ -1387,8 +1297,6 @@ __power_supply_register(struct device *parent, + add_hwmon_sysfs_failed: + power_supply_remove_triggers(psy); + create_triggers_failed: +- psy_unregister_cooler(psy); +-register_cooler_failed: + psy_unregister_thermal(psy); + register_thermal_failed: + wakeup_init_failed: +@@ -1540,7 +1448,6 @@ void power_supply_unregister(struct power_supply *psy) + sysfs_remove_link(&psy->dev.kobj, "powers"); + power_supply_remove_hwmon_sysfs(psy); + power_supply_remove_triggers(psy); +- psy_unregister_cooler(psy); + psy_unregister_thermal(psy); + device_init_wakeup(&psy->dev, false); + device_unregister(&psy->dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-540-RDMA-siw-Fix-user-page-pinning-accounting.patch b/patches.kernel.org/6.2.3-540-RDMA-siw-Fix-user-page-pinning-accounting.patch new file mode 100644 index 0000000..5239349 --- /dev/null +++ b/patches.kernel.org/6.2.3-540-RDMA-siw-Fix-user-page-pinning-accounting.patch @@ -0,0 +1,90 @@ +From: Bernard Metzler +Date: Thu, 2 Feb 2023 11:10:00 +0100 +Subject: [PATCH] RDMA/siw: Fix user page pinning accounting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 65a8fc30fb6722fc25adec6d7dd5b53b0bb85820 + +[ Upstream commit 65a8fc30fb6722fc25adec6d7dd5b53b0bb85820 ] + +To avoid racing with other user memory reservations, immediately +account full amount of pages to be pinned. + +Fixes: 2251334dcac9 ("rdma/siw: application buffer management") +Reported-by: Jason Gunthorpe +Suggested-by: Alistair Popple +Reviewed-by: Alistair Popple +Signed-off-by: Bernard Metzler +Link: https://lore.kernel.org/r/20230202101000.402990-1-bmt@zurich.ibm.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/sw/siw/siw_mem.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c +index b2b33dd3..f51ab2cc 100644 +--- a/drivers/infiniband/sw/siw/siw_mem.c ++++ b/drivers/infiniband/sw/siw/siw_mem.c +@@ -398,7 +398,7 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) + + mlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; + +- if (num_pages + atomic64_read(&mm_s->pinned_vm) > mlock_limit) { ++ if (atomic64_add_return(num_pages, &mm_s->pinned_vm) > mlock_limit) { + rv = -ENOMEM; + goto out_sem_up; + } +@@ -411,30 +411,27 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) + goto out_sem_up; + } + for (i = 0; num_pages; i++) { +- int got, nents = min_t(int, num_pages, PAGES_PER_CHUNK); +- +- umem->page_chunk[i].plist = ++ int nents = min_t(int, num_pages, PAGES_PER_CHUNK); ++ struct page **plist = + kcalloc(nents, sizeof(struct page *), GFP_KERNEL); +- if (!umem->page_chunk[i].plist) { ++ ++ if (!plist) { + rv = -ENOMEM; + goto out_sem_up; + } +- got = 0; ++ umem->page_chunk[i].plist = plist; + while (nents) { +- struct page **plist = &umem->page_chunk[i].plist[got]; +- + rv = pin_user_pages(first_page_va, nents, foll_flags, + plist, NULL); + if (rv < 0) + goto out_sem_up; + + umem->num_pages += rv; +- atomic64_add(rv, &mm_s->pinned_vm); + first_page_va += rv * PAGE_SIZE; ++ plist += rv; + nents -= rv; +- got += rv; ++ num_pages -= rv; + } +- num_pages -= got; + } + out_sem_up: + mmap_read_unlock(mm_s); +@@ -442,6 +439,10 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) + if (rv > 0) + return umem; + ++ /* Adjust accounting for pages not pinned */ ++ if (num_pages) ++ atomic64_sub(num_pages, &mm_s->pinned_vm); ++ + siw_umem_release(umem, false); + + return ERR_PTR(rv); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-541-RDMA-cxgb4-Fix-potential-null-ptr-deref-in-pass.patch b/patches.kernel.org/6.2.3-541-RDMA-cxgb4-Fix-potential-null-ptr-deref-in-pass.patch new file mode 100644 index 0000000..3d3d4f0 --- /dev/null +++ b/patches.kernel.org/6.2.3-541-RDMA-cxgb4-Fix-potential-null-ptr-deref-in-pass.patch @@ -0,0 +1,42 @@ +From: Nikita Zhandarovich +Date: Thu, 2 Feb 2023 10:48:50 -0800 +Subject: [PATCH] RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 283861a4c52c1ea4df3dd1b6fc75a50796ce3524 + +[ Upstream commit 283861a4c52c1ea4df3dd1b6fc75a50796ce3524 ] + +If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is +dereferenced later regardless of whether it is empty. +This patch adds a simple sanity check to fix the issue. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference") +Signed-off-by: Nikita Zhandarovich +Link: https://lore.kernel.org/r/20230202184850.29882-1-n.zhandarovich@fintech.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/cxgb4/cm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index ea3ddf0d..ced615b5 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2676,6 +2676,9 @@ static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb) + u16 tcp_opt = ntohs(req->tcp_opt); + + ep = get_ep_from_tid(dev, tid); ++ if (!ep) ++ return 0; ++ + pr_debug("ep %p tid %u\n", ep, ep->hwtid); + ep->snd_seq = be32_to_cpu(req->snd_isn); + ep->rcv_seq = be32_to_cpu(req->rcv_isn); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-542-usb-max-3421-Fix-setting-of-I-O-pins.patch b/patches.kernel.org/6.2.3-542-usb-max-3421-Fix-setting-of-I-O-pins.patch new file mode 100644 index 0000000..2b122de --- /dev/null +++ b/patches.kernel.org/6.2.3-542-usb-max-3421-Fix-setting-of-I-O-pins.patch @@ -0,0 +1,40 @@ +From: Mark Tomlinson +Date: Tue, 7 Feb 2023 16:33:37 +1300 +Subject: [PATCH] usb: max-3421: Fix setting of I/O pins +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a7efe3fc7cbe27c6eb2c2a3ab612194f8f800f4c + +[ Upstream commit a7efe3fc7cbe27c6eb2c2a3ab612194f8f800f4c ] + +To update the I/O pins, the registers are read/modified/written. The +read operation incorrectly always read the first register. Although +wrong, there wasn't any impact as all the output pins are always +written, and the inputs are read only anyway. + +Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.") +Signed-off-by: Mark Tomlinson +Link: https://lore.kernel.org/r/20230207033337.18112-1-mark.tomlinson@alliedtelesis.co.nz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index 352e3ac2..19111e83 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1436,7 +1436,7 @@ max3421_spi_thread(void *dev_id) + * use spi_wr_buf(). + */ + for (i = 0; i < ARRAY_SIZE(max3421_hcd->iopins); ++i) { +- u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1); ++ u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1 + i); + + val = ((val & 0xf0) | + (max3421_hcd->iopins[i] & 0x0f)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-543-RDMA-irdma-Cap-MSIX-used-to-online-CPUs-1.patch b/patches.kernel.org/6.2.3-543-RDMA-irdma-Cap-MSIX-used-to-online-CPUs-1.patch new file mode 100644 index 0000000..01020e7 --- /dev/null +++ b/patches.kernel.org/6.2.3-543-RDMA-irdma-Cap-MSIX-used-to-online-CPUs-1.patch @@ -0,0 +1,97 @@ +From: Mustafa Ismail +Date: Tue, 7 Feb 2023 14:19:38 -0600 +Subject: [PATCH] RDMA/irdma: Cap MSIX used to online CPUs + 1 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9cd9842c46996ef62173c36619c746f57416bcb0 + +[ Upstream commit 9cd9842c46996ef62173c36619c746f57416bcb0 ] + +The irdma driver can use a maximum number of msix vectors equal +to num_online_cpus() + 1 and the kernel warning stack below is shown +if that number is exceeded. + +The kernel throws a warning as the driver tries to update the affinity +hint with a CPU mask greater than the max CPU IDs. Fix this by capping +the MSIX vectors to num_online_cpus() + 1. + + WARNING: CPU: 7 PID: 23655 at include/linux/cpumask.h:106 irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] + RIP: 0010:irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] + Call Trace: + irdma_rt_init_hw+0xa62/0x1290 [irdma] + ? irdma_alloc_local_mac_entry+0x1a0/0x1a0 [irdma] + ? __is_kernel_percpu_address+0x63/0x310 + ? rcu_read_lock_held_common+0xe/0xb0 + ? irdma_lan_unregister_qset+0x280/0x280 [irdma] + ? irdma_request_reset+0x80/0x80 [irdma] + ? ice_get_qos_params+0x84/0x390 [ice] + irdma_probe+0xa40/0xfc0 [irdma] + ? rcu_read_lock_bh_held+0xd0/0xd0 + ? irdma_remove+0x140/0x140 [irdma] + ? rcu_read_lock_sched_held+0x62/0xe0 + ? down_write+0x187/0x3d0 + ? auxiliary_match_id+0xf0/0x1a0 + ? irdma_remove+0x140/0x140 [irdma] + auxiliary_bus_probe+0xa6/0x100 + __driver_probe_device+0x4a4/0xd50 + ? __device_attach_driver+0x2c0/0x2c0 + driver_probe_device+0x4a/0x110 + __driver_attach+0x1aa/0x350 + bus_for_each_dev+0x11d/0x1b0 + ? subsys_dev_iter_init+0xe0/0xe0 + bus_add_driver+0x3b1/0x610 + driver_register+0x18e/0x410 + ? 0xffffffffc0b88000 + irdma_init_module+0x50/0xaa [irdma] + do_one_initcall+0x103/0x5f0 + ? perf_trace_initcall_level+0x420/0x420 + ? do_init_module+0x4e/0x700 + ? __kasan_kmalloc+0x7d/0xa0 + ? kmem_cache_alloc_trace+0x188/0x2b0 + ? kasan_unpoison+0x21/0x50 + do_init_module+0x1d1/0x700 + load_module+0x3867/0x5260 + ? layout_and_allocate+0x3990/0x3990 + ? rcu_read_lock_held_common+0xe/0xb0 + ? rcu_read_lock_sched_held+0x62/0xe0 + ? rcu_read_lock_bh_held+0xd0/0xd0 + ? __vmalloc_node_range+0x46b/0x890 + ? lock_release+0x5c8/0xba0 + ? alloc_vm_area+0x120/0x120 + ? selinux_kernel_module_from_file+0x2a5/0x300 + ? __inode_security_revalidate+0xf0/0xf0 + ? __do_sys_init_module+0x1db/0x260 + __do_sys_init_module+0x1db/0x260 + ? load_module+0x5260/0x5260 + ? do_syscall_64+0x22/0x450 + do_syscall_64+0xa5/0x450 + entry_SYSCALL_64_after_hwframe+0x66/0xdb + +Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Signed-off-by: Sindhu Devale +Link: https://lore.kernel.org/r/20230207201938.1329-1-sindhu.devale@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/irdma/hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index ab246447..2e1e2bad 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -483,6 +483,8 @@ static int irdma_save_msix_info(struct irdma_pci_f *rf) + iw_qvlist->num_vectors = rf->msix_count; + if (rf->msix_count <= num_online_cpus()) + rf->msix_shared = true; ++ else if (rf->msix_count > num_online_cpus() + 1) ++ rf->msix_count = num_online_cpus() + 1; + + pmsix = rf->msix_entries; + for (i = 0, ceq_idx = 0; i < rf->msix_count; i++, iw_qvinfo++) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-544-serial-fsl_lpuart-fix-RS485-RTS-polariy-inverse.patch b/patches.kernel.org/6.2.3-544-serial-fsl_lpuart-fix-RS485-RTS-polariy-inverse.patch new file mode 100644 index 0000000..6f70195 --- /dev/null +++ b/patches.kernel.org/6.2.3-544-serial-fsl_lpuart-fix-RS485-RTS-polariy-inverse.patch @@ -0,0 +1,46 @@ +From: Shenwei Wang +Date: Tue, 7 Feb 2023 10:24:20 -0600 +Subject: [PATCH] serial: fsl_lpuart: fix RS485 RTS polariy inverse issue +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3957b9501a5a8fa709ae4a47483714491471f6db + +[ Upstream commit 3957b9501a5a8fa709ae4a47483714491471f6db ] + +The previous 'commit 846651eca073 ("serial: fsl_lpuart: RS485 RTS +polariy is inverse")' only fixed the inverse issue on lpuart 8bit +platforms. + +This is a follow-up patch to fix the RS485 polarity inverse +issue on lpuart 32bit platforms. + +Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") +Reported-by: Sherry Sun +Signed-off-by: Shenwei Wang +Link: https://lore.kernel.org/r/20230207162420.3647904-1-shenwei.wang@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/fsl_lpuart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index f34fabdc..23910ac7 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1387,9 +1387,9 @@ static int lpuart32_config_rs485(struct uart_port *port, struct ktermios *termio + * Note: UART is assumed to be active high. + */ + if (rs485->flags & SER_RS485_RTS_ON_SEND) +- modem &= ~UARTMODEM_TXRTSPOL; +- else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) + modem |= UARTMODEM_TXRTSPOL; ++ else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) ++ modem &= ~UARTMODEM_TXRTSPOL; + } + + lpuart32_write(&sport->port, modem, UARTMODIR); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-545-tty-serial-imx-disable-Ageing-Timer-interrupt-r.patch b/patches.kernel.org/6.2.3-545-tty-serial-imx-disable-Ageing-Timer-interrupt-r.patch new file mode 100644 index 0000000..7bbe881 --- /dev/null +++ b/patches.kernel.org/6.2.3-545-tty-serial-imx-disable-Ageing-Timer-interrupt-r.patch @@ -0,0 +1,84 @@ +From: Peng Fan +Date: Mon, 6 Feb 2023 09:30:16 +0800 +Subject: [PATCH] tty: serial: imx: disable Ageing Timer interrupt request irq +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ef25e16ea9674b713a68c3bda821556ce9901254 + +[ Upstream commit ef25e16ea9674b713a68c3bda821556ce9901254 ] + +There maybe pending USR interrupt before requesting irq, however +uart_add_one_port has not executed, so there will be kernel panic: +[ 0.795668] Unable to handle kernel NULL pointer dereference at virtual addre +ss 0000000000000080 +[ 0.802701] Mem abort info: +[ 0.805367] ESR = 0x0000000096000004 +[ 0.808950] EC = 0x25: DABT (current EL), IL = 32 bits +[ 0.814033] SET = 0, FnV = 0 +[ 0.816950] EA = 0, S1PTW = 0 +[ 0.819950] FSC = 0x04: level 0 translation fault +[ 0.824617] Data abort info: +[ 0.827367] ISV = 0, ISS = 0x00000004 +[ 0.831033] CM = 0, WnR = 0 +[ 0.833866] [0000000000000080] user address but active_mm is swapper +[ 0.839951] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP +[ 0.845953] Modules linked in: +[ 0.848869] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.1+g56321e101aca #1 +[ 0.855617] Hardware name: Freescale i.MX8MP EVK (DT) +[ 0.860452] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 0.867117] pc : __imx_uart_rxint.constprop.0+0x11c/0x2c0 +[ 0.872283] lr : imx_uart_int+0xf8/0x1ec + +The issue only happends in the inmate linux when Jailhouse hypervisor +enabled. The test procedure is: +while true; do + jailhouse enable imx8mp.cell + jailhouse cell linux xxxx + sleep 10 + jailhouse cell destroy 1 + jailhouse disable + sleep 5 +done + +And during the upper test, press keys to the 2nd linux console. +When `jailhouse cell destroy 1`, the 2nd linux has no chance to put +the uart to a quiese state, so USR1/2 may has pending interrupts. Then +when `jailhosue cell linux xx` to start 2nd linux again, the issue +trigger. + +In order to disable irqs before requesting them, both UCR1 and UCR2 irqs +should be disabled, so here fix that, disable the Ageing Timer interrupt +in UCR2 as UCR1 does. + +Fixes: 8a61f0c70ae6 ("serial: imx: Disable irqs before requesting them") +Suggested-by: Sherry Sun +Reviewed-by: Sherry Sun +Signed-off-by: Peng Fan +Acked-by: Jason Liu +Link: https://lore.kernel.org/r/20230206013016.29352-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/tty/serial/imx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 757825ed..5f35343f 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -2374,6 +2374,11 @@ static int imx_uart_probe(struct platform_device *pdev) + ucr1 &= ~(UCR1_ADEN | UCR1_TRDYEN | UCR1_IDEN | UCR1_RRDYEN | UCR1_RTSDEN); + imx_uart_writel(sport, ucr1, UCR1); + ++ /* Disable Ageing Timer interrupt */ ++ ucr2 = imx_uart_readl(sport, UCR2); ++ ucr2 &= ~UCR2_ATEN; ++ imx_uart_writel(sport, ucr2, UCR2); ++ + /* + * In case RS485 is enabled without GPIO RTS control, the UART IP + * is used to control CTS signal. Keep both the UART and Receiver +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-546-driver-core-fw_devlink-Add-DL_FLAG_CYCLE-suppor.patch b/patches.kernel.org/6.2.3-546-driver-core-fw_devlink-Add-DL_FLAG_CYCLE-suppor.patch new file mode 100644 index 0000000..2bb5dfc --- /dev/null +++ b/patches.kernel.org/6.2.3-546-driver-core-fw_devlink-Add-DL_FLAG_CYCLE-suppor.patch @@ -0,0 +1,164 @@ +From: Saravana Kannan +Date: Mon, 6 Feb 2023 17:41:57 -0800 +Subject: [PATCH] driver core: fw_devlink: Add DL_FLAG_CYCLE support to device + links +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 67cad5c67019c38126b749621665b6723d3ae7e6 + +[ Upstream commit 67cad5c67019c38126b749621665b6723d3ae7e6 ] + +fw_devlink uses DL_FLAG_SYNC_STATE_ONLY device link flag for two +purposes: + +1. To allow a parent device to proxy its child device's dependency on a + supplier so that the supplier doesn't get its sync_state() callback + before the child device/consumer can be added and probed. In this + usage scenario, we need to ignore cycles for ensure correctness of + sync_state() callbacks. + +2. When there are dependency cycles in firmware, we don't know which of + those dependencies are valid. So, we have to ignore them all wrt + probe ordering while still making sure the sync_state() callbacks + come correctly. + +However, when detecting dependency cycles, there can be multiple +dependency cycles between two devices that we need to detect. For +example: + +A -> B -> A and A -> C -> B -> A. + +To detect multiple cycles correct, we need to be able to differentiate +DL_FLAG_SYNC_STATE_ONLY device links used for (1) vs (2) above. + +To allow this differentiation, add a DL_FLAG_CYCLE that can be use to +mark use case (2). We can then use the DL_FLAG_CYCLE to decide which +DL_FLAG_SYNC_STATE_ONLY device links to follow when looking for +dependency cycles. + +Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") +Signed-off-by: Saravana Kannan +Tested-by: Colin Foster +Tested-by: Sudeep Holla +Tested-by: Douglas Anderson +Tested-by: Geert Uytterhoeven +Tested-by: Luca Weiss # qcom/sm7225-fairphone-fp4 +Link: https://lore.kernel.org/r/20230207014207.1678715-6-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/core.c | 28 ++++++++++++++++++---------- + include/linux/device.h | 1 + + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 9fccf7b4..609d1b04 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -272,6 +272,12 @@ static bool device_is_ancestor(struct device *dev, struct device *target) + return false; + } + ++static inline bool device_link_flag_is_sync_state_only(u32 flags) ++{ ++ return (flags & ~(DL_FLAG_INFERRED | DL_FLAG_CYCLE)) == ++ (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED); ++} ++ + /** + * device_is_dependent - Check if one device depends on another one + * @dev: Device to check dependencies for. +@@ -298,8 +304,7 @@ int device_is_dependent(struct device *dev, void *target) + return ret; + + list_for_each_entry(link, &dev->links.consumers, s_node) { +- if ((link->flags & ~DL_FLAG_INFERRED) == +- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) ++ if (device_link_flag_is_sync_state_only(link->flags)) + continue; + + if (link->consumer == target) +@@ -372,8 +377,7 @@ static int device_reorder_to_tail(struct device *dev, void *not_used) + + device_for_each_child(dev, NULL, device_reorder_to_tail); + list_for_each_entry(link, &dev->links.consumers, s_node) { +- if ((link->flags & ~DL_FLAG_INFERRED) == +- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) ++ if (device_link_flag_is_sync_state_only(link->flags)) + continue; + device_reorder_to_tail(link->consumer, NULL); + } +@@ -634,7 +638,8 @@ postcore_initcall(devlink_class_init); + DL_FLAG_AUTOREMOVE_SUPPLIER | \ + DL_FLAG_AUTOPROBE_CONSUMER | \ + DL_FLAG_SYNC_STATE_ONLY | \ +- DL_FLAG_INFERRED) ++ DL_FLAG_INFERRED | \ ++ DL_FLAG_CYCLE) + + #define DL_ADD_VALID_FLAGS (DL_MANAGED_LINK_FLAGS | DL_FLAG_STATELESS | \ + DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE) +@@ -703,8 +708,6 @@ struct device_link *device_link_add(struct device *consumer, + if (!consumer || !supplier || consumer == supplier || + flags & ~DL_ADD_VALID_FLAGS || + (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) || +- (flags & DL_FLAG_SYNC_STATE_ONLY && +- (flags & ~DL_FLAG_INFERRED) != DL_FLAG_SYNC_STATE_ONLY) || + (flags & DL_FLAG_AUTOPROBE_CONSUMER && + flags & (DL_FLAG_AUTOREMOVE_CONSUMER | + DL_FLAG_AUTOREMOVE_SUPPLIER))) +@@ -720,6 +723,10 @@ struct device_link *device_link_add(struct device *consumer, + if (!(flags & DL_FLAG_STATELESS)) + flags |= DL_FLAG_MANAGED; + ++ if (flags & DL_FLAG_SYNC_STATE_ONLY && ++ !device_link_flag_is_sync_state_only(flags)) ++ return NULL; ++ + device_links_write_lock(); + device_pm_lock(); + +@@ -1672,7 +1679,7 @@ static void fw_devlink_relax_link(struct device_link *link) + if (!(link->flags & DL_FLAG_INFERRED)) + return; + +- if (link->flags == (DL_FLAG_MANAGED | FW_DEVLINK_FLAGS_PERMISSIVE)) ++ if (device_link_flag_is_sync_state_only(link->flags)) + return; + + pm_runtime_drop_link(link); +@@ -1796,8 +1803,8 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) + return ret; + + list_for_each_entry(link, &con->links.consumers, s_node) { +- if ((link->flags & ~DL_FLAG_INFERRED) == +- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) ++ if (!(link->flags & DL_FLAG_CYCLE) && ++ device_link_flag_is_sync_state_only(link->flags)) + continue; + + if (!fw_devlink_relax_cycle(link->consumer, sup)) +@@ -1806,6 +1813,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) + ret = 1; + + fw_devlink_relax_link(link); ++ link->flags |= DL_FLAG_CYCLE; + } + return ret; + } +diff --git a/include/linux/device.h b/include/linux/device.h +index 44e3acae..f4d20655 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -328,6 +328,7 @@ enum device_link_state { + #define DL_FLAG_MANAGED BIT(6) + #define DL_FLAG_SYNC_STATE_ONLY BIT(7) + #define DL_FLAG_INFERRED BIT(8) ++#define DL_FLAG_CYCLE BIT(9) + + /** + * enum dl_dev_state - Device driver presence tracking information. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-547-driver-core-fw_devlink-Don-t-purge-child-fwnode.patch b/patches.kernel.org/6.2.3-547-driver-core-fw_devlink-Don-t-purge-child-fwnode.patch new file mode 100644 index 0000000..8fa4ac8 --- /dev/null +++ b/patches.kernel.org/6.2.3-547-driver-core-fw_devlink-Don-t-purge-child-fwnode.patch @@ -0,0 +1,201 @@ +From: Saravana Kannan +Date: Mon, 6 Feb 2023 17:41:53 -0800 +Subject: [PATCH] driver core: fw_devlink: Don't purge child fwnode's consumer + links +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3a2dbc510c437ca392516b0105bad8e7970e6614 + +[ Upstream commit 3a2dbc510c437ca392516b0105bad8e7970e6614 ] + +When a device X is bound successfully to a driver, if it has a child +firmware node Y that doesn't have a struct device created by then, we +delete fwnode links where the child firmware node Y is the supplier. We +did this to avoid blocking the consumers of the child firmware node Y +from deferring probe indefinitely. + +While that a step in the right direction, it's better to make the +consumers of the child firmware node Y to be consumers of the device X +because device X is probably implementing whatever functionality is +represented by child firmware node Y. By doing this, we capture the +device dependencies more accurately and ensure better +probe/suspend/resume ordering. + +Signed-off-by: Saravana Kannan +Tested-by: Colin Foster +Tested-by: Sudeep Holla +Tested-by: Douglas Anderson +Tested-by: Geert Uytterhoeven +Tested-by: Luca Weiss # qcom/sm7225-fairphone-fp4 +Link: https://lore.kernel.org/r/20230207014207.1678715-2-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 6a6dfdf8b3ff ("driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/core.c | 97 ++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 79 insertions(+), 18 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 609d1b04..b29c483e 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -54,11 +54,12 @@ static LIST_HEAD(deferred_sync); + static unsigned int defer_sync_state_count = 1; + static DEFINE_MUTEX(fwnode_link_lock); + static bool fw_devlink_is_permissive(void); ++static void __fw_devlink_link_to_consumers(struct device *dev); + static bool fw_devlink_drv_reg_done; + static bool fw_devlink_best_effort; + + /** +- * fwnode_link_add - Create a link between two fwnode_handles. ++ * __fwnode_link_add - Create a link between two fwnode_handles. + * @con: Consumer end of the link. + * @sup: Supplier end of the link. + * +@@ -74,22 +75,18 @@ static bool fw_devlink_best_effort; + * Attempts to create duplicate links between the same pair of fwnode handles + * are ignored and there is no reference counting. + */ +-int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup) ++static int __fwnode_link_add(struct fwnode_handle *con, ++ struct fwnode_handle *sup) + { + struct fwnode_link *link; +- int ret = 0; +- +- mutex_lock(&fwnode_link_lock); + + list_for_each_entry(link, &sup->consumers, s_hook) + if (link->consumer == con) +- goto out; ++ return 0; + + link = kzalloc(sizeof(*link), GFP_KERNEL); +- if (!link) { +- ret = -ENOMEM; +- goto out; +- } ++ if (!link) ++ return -ENOMEM; + + link->supplier = sup; + INIT_LIST_HEAD(&link->s_hook); +@@ -100,9 +97,17 @@ int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup) + list_add(&link->c_hook, &con->suppliers); + pr_debug("%pfwP Linked as a fwnode consumer to %pfwP\n", + con, sup); +-out: +- mutex_unlock(&fwnode_link_lock); + ++ return 0; ++} ++ ++int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup) ++{ ++ int ret; ++ ++ mutex_lock(&fwnode_link_lock); ++ ret = __fwnode_link_add(con, sup); ++ mutex_unlock(&fwnode_link_lock); + return ret; + } + +@@ -181,6 +186,51 @@ void fw_devlink_purge_absent_suppliers(struct fwnode_handle *fwnode) + } + EXPORT_SYMBOL_GPL(fw_devlink_purge_absent_suppliers); + ++/** ++ * __fwnode_links_move_consumers - Move consumer from @from to @to fwnode_handle ++ * @from: move consumers away from this fwnode ++ * @to: move consumers to this fwnode ++ * ++ * Move all consumer links from @from fwnode to @to fwnode. ++ */ ++static void __fwnode_links_move_consumers(struct fwnode_handle *from, ++ struct fwnode_handle *to) ++{ ++ struct fwnode_link *link, *tmp; ++ ++ list_for_each_entry_safe(link, tmp, &from->consumers, s_hook) { ++ __fwnode_link_add(link->consumer, to); ++ __fwnode_link_del(link); ++ } ++} ++ ++/** ++ * __fw_devlink_pickup_dangling_consumers - Pick up dangling consumers ++ * @fwnode: fwnode from which to pick up dangling consumers ++ * @new_sup: fwnode of new supplier ++ * ++ * If the @fwnode has a corresponding struct device and the device supports ++ * probing (that is, added to a bus), then we want to let fw_devlink create ++ * MANAGED device links to this device, so leave @fwnode and its descendant's ++ * fwnode links alone. ++ * ++ * Otherwise, move its consumers to the new supplier @new_sup. ++ */ ++static void __fw_devlink_pickup_dangling_consumers(struct fwnode_handle *fwnode, ++ struct fwnode_handle *new_sup) ++{ ++ struct fwnode_handle *child; ++ ++ if (fwnode->dev && fwnode->dev->bus) ++ return; ++ ++ fwnode->flags |= FWNODE_FLAG_NOT_DEVICE; ++ __fwnode_links_move_consumers(fwnode, new_sup); ++ ++ fwnode_for_each_available_child_node(fwnode, child) ++ __fw_devlink_pickup_dangling_consumers(child, new_sup); ++} ++ + #ifdef CONFIG_SRCU + static DEFINE_MUTEX(device_links_lock); + DEFINE_STATIC_SRCU(device_links_srcu); +@@ -1274,16 +1324,23 @@ void device_links_driver_bound(struct device *dev) + * them. So, fw_devlink no longer needs to create device links to any + * of the device's suppliers. + * +- * Also, if a child firmware node of this bound device is not added as +- * a device by now, assume it is never going to be added and make sure +- * other devices don't defer probe indefinitely by waiting for such a +- * child device. ++ * Also, if a child firmware node of this bound device is not added as a ++ * device by now, assume it is never going to be added. Make this bound ++ * device the fallback supplier to the dangling consumers of the child ++ * firmware node because this bound device is probably implementing the ++ * child firmware node functionality and we don't want the dangling ++ * consumers to defer probe indefinitely waiting for a device for the ++ * child firmware node. + */ + if (dev->fwnode && dev->fwnode->dev == dev) { + struct fwnode_handle *child; + fwnode_links_purge_suppliers(dev->fwnode); ++ mutex_lock(&fwnode_link_lock); + fwnode_for_each_available_child_node(dev->fwnode, child) +- fw_devlink_purge_absent_suppliers(child); ++ __fw_devlink_pickup_dangling_consumers(child, ++ dev->fwnode); ++ __fw_devlink_link_to_consumers(dev); ++ mutex_unlock(&fwnode_link_lock); + } + device_remove_file(dev, &dev_attr_waiting_for_supplier); + +@@ -1863,7 +1920,11 @@ static int fw_devlink_create_devlink(struct device *con, + fwnode_is_ancestor_of(sup_handle, con->fwnode)) + return -EINVAL; + +- sup_dev = get_dev_from_fwnode(sup_handle); ++ if (sup_handle->flags & FWNODE_FLAG_NOT_DEVICE) ++ sup_dev = fwnode_get_next_parent_dev(sup_handle); ++ else ++ sup_dev = get_dev_from_fwnode(sup_handle); ++ + if (sup_dev) { + /* + * If it's one of those drivers that don't actually bind to +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-548-driver-core-fw_devlink-Allow-marking-a-fwnode-l.patch b/patches.kernel.org/6.2.3-548-driver-core-fw_devlink-Allow-marking-a-fwnode-l.patch new file mode 100644 index 0000000..bbd0b4d --- /dev/null +++ b/patches.kernel.org/6.2.3-548-driver-core-fw_devlink-Allow-marking-a-fwnode-l.patch @@ -0,0 +1,189 @@ +From: Saravana Kannan +Date: Mon, 6 Feb 2023 17:41:58 -0800 +Subject: [PATCH] driver core: fw_devlink: Allow marking a fwnode link as being + part of a cycle +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6a6dfdf8b3ff337be5a447e9f4e71969f18370ad + +[ Upstream commit 6a6dfdf8b3ff337be5a447e9f4e71969f18370ad ] + +To improve detection and handling of dependency cycles, we need to be +able to mark fwnode links as being part of cycles. fwnode links marked +as being part of a cycle should not block their consumers from probing. + +Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") +Signed-off-by: Saravana Kannan +Tested-by: Colin Foster +Tested-by: Sudeep Holla +Tested-by: Douglas Anderson +Tested-by: Geert Uytterhoeven +Tested-by: Luca Weiss # qcom/sm7225-fairphone-fp4 +Link: https://lore.kernel.org/r/20230207014207.1678715-7-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/core.c | 50 +++++++++++++++++++++++++++++++++--------- + include/linux/fwnode.h | 11 +++++++++- + 2 files changed, 50 insertions(+), 11 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index b29c483e..bd8ae74e 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -76,13 +76,15 @@ static bool fw_devlink_best_effort; + * are ignored and there is no reference counting. + */ + static int __fwnode_link_add(struct fwnode_handle *con, +- struct fwnode_handle *sup) ++ struct fwnode_handle *sup, u8 flags) + { + struct fwnode_link *link; + + list_for_each_entry(link, &sup->consumers, s_hook) +- if (link->consumer == con) ++ if (link->consumer == con) { ++ link->flags |= flags; + return 0; ++ } + + link = kzalloc(sizeof(*link), GFP_KERNEL); + if (!link) +@@ -92,6 +94,7 @@ static int __fwnode_link_add(struct fwnode_handle *con, + INIT_LIST_HEAD(&link->s_hook); + link->consumer = con; + INIT_LIST_HEAD(&link->c_hook); ++ link->flags = flags; + + list_add(&link->s_hook, &sup->consumers); + list_add(&link->c_hook, &con->suppliers); +@@ -106,7 +109,7 @@ int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup) + int ret; + + mutex_lock(&fwnode_link_lock); +- ret = __fwnode_link_add(con, sup); ++ ret = __fwnode_link_add(con, sup, 0); + mutex_unlock(&fwnode_link_lock); + return ret; + } +@@ -126,6 +129,19 @@ static void __fwnode_link_del(struct fwnode_link *link) + kfree(link); + } + ++/** ++ * __fwnode_link_cycle - Mark a fwnode link as being part of a cycle. ++ * @link: the fwnode_link to be marked ++ * ++ * The fwnode_link_lock needs to be held when this function is called. ++ */ ++static void __fwnode_link_cycle(struct fwnode_link *link) ++{ ++ pr_debug("%pfwf: Relaxing link with %pfwf\n", ++ link->consumer, link->supplier); ++ link->flags |= FWLINK_FLAG_CYCLE; ++} ++ + /** + * fwnode_links_purge_suppliers - Delete all supplier links of fwnode_handle. + * @fwnode: fwnode whose supplier links need to be deleted +@@ -199,7 +215,7 @@ static void __fwnode_links_move_consumers(struct fwnode_handle *from, + struct fwnode_link *link, *tmp; + + list_for_each_entry_safe(link, tmp, &from->consumers, s_hook) { +- __fwnode_link_add(link->consumer, to); ++ __fwnode_link_add(link->consumer, to, link->flags); + __fwnode_link_del(link); + } + } +@@ -1041,6 +1057,21 @@ static bool dev_is_best_effort(struct device *dev) + (dev->fwnode && (dev->fwnode->flags & FWNODE_FLAG_BEST_EFFORT)); + } + ++static struct fwnode_handle *fwnode_links_check_suppliers( ++ struct fwnode_handle *fwnode) ++{ ++ struct fwnode_link *link; ++ ++ if (!fwnode || fw_devlink_is_permissive()) ++ return NULL; ++ ++ list_for_each_entry(link, &fwnode->suppliers, c_hook) ++ if (!(link->flags & FWLINK_FLAG_CYCLE)) ++ return link->supplier; ++ ++ return NULL; ++} ++ + /** + * device_links_check_suppliers - Check presence of supplier drivers. + * @dev: Consumer device. +@@ -1068,11 +1099,8 @@ int device_links_check_suppliers(struct device *dev) + * probe. + */ + mutex_lock(&fwnode_link_lock); +- if (dev->fwnode && !list_empty(&dev->fwnode->suppliers) && +- !fw_devlink_is_permissive()) { +- sup_fw = list_first_entry(&dev->fwnode->suppliers, +- struct fwnode_link, +- c_hook)->supplier; ++ sup_fw = fwnode_links_check_suppliers(dev->fwnode); ++ if (sup_fw) { + if (!dev_is_best_effort(dev)) { + fwnode_ret = -EPROBE_DEFER; + dev_err_probe(dev, -EPROBE_DEFER, +@@ -1261,7 +1289,9 @@ static ssize_t waiting_for_supplier_show(struct device *dev, + bool val; + + device_lock(dev); +- val = !list_empty(&dev->fwnode->suppliers); ++ mutex_lock(&fwnode_link_lock); ++ val = !!fwnode_links_check_suppliers(dev->fwnode); ++ mutex_unlock(&fwnode_link_lock); + device_unlock(dev); + return sysfs_emit(buf, "%u\n", val); + } +diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h +index 89b9bdfc..fdf2ee02 100644 +--- a/include/linux/fwnode.h ++++ b/include/linux/fwnode.h +@@ -18,7 +18,7 @@ struct fwnode_operations; + struct device; + + /* +- * fwnode link flags ++ * fwnode flags + * + * LINKS_ADDED: The fwnode has already be parsed to add fwnode links. + * NOT_DEVICE: The fwnode will never be populated as a struct device. +@@ -36,6 +36,7 @@ struct device; + #define FWNODE_FLAG_INITIALIZED BIT(2) + #define FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD BIT(3) + #define FWNODE_FLAG_BEST_EFFORT BIT(4) ++#define FWNODE_FLAG_VISITED BIT(5) + + struct fwnode_handle { + struct fwnode_handle *secondary; +@@ -46,11 +47,19 @@ struct fwnode_handle { + u8 flags; + }; + ++/* ++ * fwnode link flags ++ * ++ * CYCLE: The fwnode link is part of a cycle. Don't defer probe. ++ */ ++#define FWLINK_FLAG_CYCLE BIT(0) ++ + struct fwnode_link { + struct fwnode_handle *supplier; + struct list_head s_hook; + struct fwnode_handle *consumer; + struct list_head c_hook; ++ u8 flags; + }; + + /** +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-549-driver-core-fw_devlink-Consolidate-device-link-.patch b/patches.kernel.org/6.2.3-549-driver-core-fw_devlink-Consolidate-device-link-.patch new file mode 100644 index 0000000..9ff1356 --- /dev/null +++ b/patches.kernel.org/6.2.3-549-driver-core-fw_devlink-Consolidate-device-link-.patch @@ -0,0 +1,134 @@ +From: Saravana Kannan +Date: Mon, 6 Feb 2023 17:41:59 -0800 +Subject: [PATCH] driver core: fw_devlink: Consolidate device link flag + computation +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cd115c0409f283edde94bd5a9a42dc42bee0aba8 + +[ Upstream commit cd115c0409f283edde94bd5a9a42dc42bee0aba8 ] + +Consolidate the code that computes the flags to be used when creating a +device link from a fwnode link. + +Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") +Signed-off-by: Saravana Kannan +Tested-by: Colin Foster +Tested-by: Sudeep Holla +Tested-by: Douglas Anderson +Tested-by: Geert Uytterhoeven +Tested-by: Luca Weiss # qcom/sm7225-fairphone-fp4 +Link: https://lore.kernel.org/r/20230207014207.1678715-8-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/core.c | 28 +++++++++++++++------------- + include/linux/fwnode.h | 1 - + 2 files changed, 15 insertions(+), 14 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index bd8ae74e..05c3e9a0 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -1727,8 +1727,11 @@ static int __init fw_devlink_strict_setup(char *arg) + } + early_param("fw_devlink.strict", fw_devlink_strict_setup); + +-u32 fw_devlink_get_flags(void) ++static inline u32 fw_devlink_get_flags(u8 fwlink_flags) + { ++ if (fwlink_flags & FWLINK_FLAG_CYCLE) ++ return FW_DEVLINK_FLAGS_PERMISSIVE | DL_FLAG_CYCLE; ++ + return fw_devlink_flags; + } + +@@ -1909,7 +1912,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) + * fw_devlink_create_devlink - Create a device link from a consumer to fwnode + * @con: consumer device for the device link + * @sup_handle: fwnode handle of supplier +- * @flags: devlink flags ++ * @link: fwnode link that's being converted to a device link + * + * This function will try to create a device link between the consumer device + * @con and the supplier device represented by @sup_handle. +@@ -1926,10 +1929,17 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) + * possible to do that in the future + */ + static int fw_devlink_create_devlink(struct device *con, +- struct fwnode_handle *sup_handle, u32 flags) ++ struct fwnode_handle *sup_handle, ++ struct fwnode_link *link) + { + struct device *sup_dev; + int ret = 0; ++ u32 flags; ++ ++ if (con->fwnode == link->consumer) ++ flags = fw_devlink_get_flags(link->flags); ++ else ++ flags = FW_DEVLINK_FLAGS_PERMISSIVE; + + /* + * In some cases, a device P might also be a supplier to its child node +@@ -2055,7 +2065,6 @@ static void __fw_devlink_link_to_consumers(struct device *dev) + struct fwnode_link *link, *tmp; + + list_for_each_entry_safe(link, tmp, &fwnode->consumers, s_hook) { +- u32 dl_flags = fw_devlink_get_flags(); + struct device *con_dev; + bool own_link = true; + int ret; +@@ -2085,14 +2094,13 @@ static void __fw_devlink_link_to_consumers(struct device *dev) + con_dev = NULL; + } else { + own_link = false; +- dl_flags = FW_DEVLINK_FLAGS_PERMISSIVE; + } + } + + if (!con_dev) + continue; + +- ret = fw_devlink_create_devlink(con_dev, fwnode, dl_flags); ++ ret = fw_devlink_create_devlink(con_dev, fwnode, link); + put_device(con_dev); + if (!own_link || ret == -EAGAIN) + continue; +@@ -2133,19 +2141,13 @@ static void __fw_devlink_link_to_suppliers(struct device *dev, + bool own_link = (dev->fwnode == fwnode); + struct fwnode_link *link, *tmp; + struct fwnode_handle *child = NULL; +- u32 dl_flags; +- +- if (own_link) +- dl_flags = fw_devlink_get_flags(); +- else +- dl_flags = FW_DEVLINK_FLAGS_PERMISSIVE; + + list_for_each_entry_safe(link, tmp, &fwnode->suppliers, c_hook) { + int ret; + struct device *sup_dev; + struct fwnode_handle *sup = link->supplier; + +- ret = fw_devlink_create_devlink(dev, sup, dl_flags); ++ ret = fw_devlink_create_devlink(dev, sup, link); + if (!own_link || ret == -EAGAIN) + continue; + +diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h +index fdf2ee02..5700451b 100644 +--- a/include/linux/fwnode.h ++++ b/include/linux/fwnode.h +@@ -207,7 +207,6 @@ static inline void fwnode_dev_initialized(struct fwnode_handle *fwnode, + fwnode->flags &= ~FWNODE_FLAG_INITIALIZED; + } + +-extern u32 fw_devlink_get_flags(void); + extern bool fw_devlink_is_strict(void); + int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup); + void fwnode_links_purge(struct fwnode_handle *fwnode); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-550-driver-core-fw_devlink-Improve-check-for-fwnode.patch b/patches.kernel.org/6.2.3-550-driver-core-fw_devlink-Improve-check-for-fwnode.patch new file mode 100644 index 0000000..6191a2f --- /dev/null +++ b/patches.kernel.org/6.2.3-550-driver-core-fw_devlink-Improve-check-for-fwnode.patch @@ -0,0 +1,93 @@ +From: Saravana Kannan +Date: Mon, 6 Feb 2023 17:41:54 -0800 +Subject: [PATCH] driver core: fw_devlink: Improve check for fwnode with no + device/driver +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 411c0d58ca6faa9bc4b9f5382118a31c7bb92a6f + +[ Upstream commit 411c0d58ca6faa9bc4b9f5382118a31c7bb92a6f ] + +fw_devlink shouldn't defer the probe of a device to wait on a supplier +that'll never have a struct device or will never be probed by a driver. +We currently check if a supplier falls into this category, but don't +check its ancestors. We need to check the ancestors too because if the +ancestor will never probe, then the supplier will never probe either. + +Signed-off-by: Saravana Kannan +Tested-by: Colin Foster +Tested-by: Sudeep Holla +Tested-by: Douglas Anderson +Tested-by: Geert Uytterhoeven +Tested-by: Luca Weiss # qcom/sm7225-fairphone-fp4 +Link: https://lore.kernel.org/r/20230207014207.1678715-3-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/core.c | 40 ++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 38 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 05c3e9a0..8f32e2cb 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -1908,6 +1908,35 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) + return ret; + } + ++static bool fwnode_init_without_drv(struct fwnode_handle *fwnode) ++{ ++ struct device *dev; ++ bool ret; ++ ++ if (!(fwnode->flags & FWNODE_FLAG_INITIALIZED)) ++ return false; ++ ++ dev = get_dev_from_fwnode(fwnode); ++ ret = !dev || dev->links.status == DL_DEV_NO_DRIVER; ++ put_device(dev); ++ ++ return ret; ++} ++ ++static bool fwnode_ancestor_init_without_drv(struct fwnode_handle *fwnode) ++{ ++ struct fwnode_handle *parent; ++ ++ fwnode_for_each_parent_node(fwnode, parent) { ++ if (fwnode_init_without_drv(parent)) { ++ fwnode_handle_put(parent); ++ return true; ++ } ++ } ++ ++ return false; ++} ++ + /** + * fw_devlink_create_devlink - Create a device link from a consumer to fwnode + * @con: consumer device for the device link +@@ -1996,9 +2025,16 @@ static int fw_devlink_create_devlink(struct device *con, + goto out; + } + +- /* Supplier that's already initialized without a struct device. */ +- if (sup_handle->flags & FWNODE_FLAG_INITIALIZED) ++ /* ++ * Supplier or supplier's ancestor already initialized without a struct ++ * device or being probed by a driver. ++ */ ++ if (fwnode_init_without_drv(sup_handle) || ++ fwnode_ancestor_init_without_drv(sup_handle)) { ++ dev_dbg(con, "Not linking %pfwP - Might never probe\n", ++ sup_handle); + return -EINVAL; ++ } + + /* + * DL_FLAG_SYNC_STATE_ONLY doesn't block probing and supports +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-551-driver-core-fw_devlink-Make-cycle-detection-mor.patch b/patches.kernel.org/6.2.3-551-driver-core-fw_devlink-Make-cycle-detection-mor.patch new file mode 100644 index 0000000..503f38f --- /dev/null +++ b/patches.kernel.org/6.2.3-551-driver-core-fw_devlink-Make-cycle-detection-mor.patch @@ -0,0 +1,404 @@ +From: Saravana Kannan +Date: Mon, 6 Feb 2023 17:42:00 -0800 +Subject: [PATCH] driver core: fw_devlink: Make cycle detection more robust +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3fb16866b51ded6c016b664caad53f8d4fd9dc56 + +[ Upstream commit 3fb16866b51ded6c016b664caad53f8d4fd9dc56 ] + +fw_devlink could only detect a single and simple cycle because it relied +mainly on device link cycle detection code that only checked for cycles +between devices. The expectation was that the firmware wouldn't have +complicated cycles and multiple cycles between devices. That expectation +has been proven to be wrong. + +For example, fw_devlink could handle: + ++-+ +-+ +|A+------> |B+ ++-+ +++ + ^ | + | | + +----------+ + +But it couldn't handle even something as "simple" as: + + +---------------------+ + | | + v | ++-+ +-+ +++ +|A+------> |B+------> |C| ++-+ +++ +-+ + ^ | + | | + +----------+ + +But firmware has even more complicated cycles like: + + +---------------------+ + | | + v | + +-+ +---+ +++ ++--+A+------>| B +-----> |C|<--+ +| +-+ ++--+ +++ | +| ^ | ^ | | +| | | | | | +| +---------+ +---------+ | +| | ++------------------------------+ + +And this is without including parent child dependencies or nodes in the +cycle that are just firmware nodes that'll never have a struct device +created for them. + +The proper way to treat these devices it to not force any probe ordering +between them, while still enforce dependencies between node in the +cycles (A, B and C) and their consumers. + +So this patch goes all out and just deals with all types of cycles. It +does this by: + +1. Following dependencies across device links, parent-child and fwnode + links. +2. When it find cycles, it mark the device links and fwnode links as + such instead of just deleting them or making the indistinguishable + from proxy SYNC_STATE_ONLY device links. + +This way, when new nodes get added, we can immediately find and mark any +new cycles whether the new node is a device or firmware node. + +Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") +Signed-off-by: Saravana Kannan +Tested-by: Colin Foster +Tested-by: Sudeep Holla +Tested-by: Douglas Anderson +Tested-by: Geert Uytterhoeven +Tested-by: Luca Weiss # qcom/sm7225-fairphone-fp4 +Link: https://lore.kernel.org/r/20230207014207.1678715-9-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/core.c | 248 +++++++++++++++++++++++--------------------- + 1 file changed, 129 insertions(+), 119 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 8f32e2cb..126b10c8 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -1866,47 +1866,6 @@ static void fw_devlink_unblock_consumers(struct device *dev) + device_links_write_unlock(); + } + +-/** +- * fw_devlink_relax_cycle - Convert cyclic links to SYNC_STATE_ONLY links +- * @con: Device to check dependencies for. +- * @sup: Device to check against. +- * +- * Check if @sup depends on @con or any device dependent on it (its child or +- * its consumer etc). When such a cyclic dependency is found, convert all +- * device links created solely by fw_devlink into SYNC_STATE_ONLY device links. +- * This is the equivalent of doing fw_devlink=permissive just between the +- * devices in the cycle. We need to do this because, at this point, fw_devlink +- * can't tell which of these dependencies is not a real dependency. +- * +- * Return 1 if a cycle is found. Otherwise, return 0. +- */ +-static int fw_devlink_relax_cycle(struct device *con, void *sup) +-{ +- struct device_link *link; +- int ret; +- +- if (con == sup) +- return 1; +- +- ret = device_for_each_child(con, sup, fw_devlink_relax_cycle); +- if (ret) +- return ret; +- +- list_for_each_entry(link, &con->links.consumers, s_node) { +- if (!(link->flags & DL_FLAG_CYCLE) && +- device_link_flag_is_sync_state_only(link->flags)) +- continue; +- +- if (!fw_devlink_relax_cycle(link->consumer, sup)) +- continue; +- +- ret = 1; +- +- fw_devlink_relax_link(link); +- link->flags |= DL_FLAG_CYCLE; +- } +- return ret; +-} + + static bool fwnode_init_without_drv(struct fwnode_handle *fwnode) + { +@@ -1937,6 +1896,111 @@ static bool fwnode_ancestor_init_without_drv(struct fwnode_handle *fwnode) + return false; + } + ++/** ++ * __fw_devlink_relax_cycles - Relax and mark dependency cycles. ++ * @con: Potential consumer device. ++ * @sup_handle: Potential supplier's fwnode. ++ * ++ * Needs to be called with fwnode_lock and device link lock held. ++ * ++ * Check if @sup_handle or any of its ancestors or suppliers direct/indirectly ++ * depend on @con. This function can detect multiple cyles between @sup_handle ++ * and @con. When such dependency cycles are found, convert all device links ++ * created solely by fw_devlink into SYNC_STATE_ONLY device links. Also, mark ++ * all fwnode links in the cycle with FWLINK_FLAG_CYCLE so that when they are ++ * converted into a device link in the future, they are created as ++ * SYNC_STATE_ONLY device links. This is the equivalent of doing ++ * fw_devlink=permissive just between the devices in the cycle. We need to do ++ * this because, at this point, fw_devlink can't tell which of these ++ * dependencies is not a real dependency. ++ * ++ * Return true if one or more cycles were found. Otherwise, return false. ++ */ ++static bool __fw_devlink_relax_cycles(struct device *con, ++ struct fwnode_handle *sup_handle) ++{ ++ struct device *sup_dev = NULL, *par_dev = NULL; ++ struct fwnode_link *link; ++ struct device_link *dev_link; ++ bool ret = false; ++ ++ if (!sup_handle) ++ return false; ++ ++ /* ++ * We aren't trying to find all cycles. Just a cycle between con and ++ * sup_handle. ++ */ ++ if (sup_handle->flags & FWNODE_FLAG_VISITED) ++ return false; ++ ++ sup_handle->flags |= FWNODE_FLAG_VISITED; ++ ++ sup_dev = get_dev_from_fwnode(sup_handle); ++ ++ /* Termination condition. */ ++ if (sup_dev == con) { ++ ret = true; ++ goto out; ++ } ++ ++ /* ++ * If sup_dev is bound to a driver and @con hasn't started binding to a ++ * driver, sup_dev can't be a consumer of @con. So, no need to check ++ * further. ++ */ ++ if (sup_dev && sup_dev->links.status == DL_DEV_DRIVER_BOUND && ++ con->links.status == DL_DEV_NO_DRIVER) { ++ ret = false; ++ goto out; ++ } ++ ++ list_for_each_entry(link, &sup_handle->suppliers, c_hook) { ++ if (__fw_devlink_relax_cycles(con, link->supplier)) { ++ __fwnode_link_cycle(link); ++ ret = true; ++ } ++ } ++ ++ /* ++ * Give priority to device parent over fwnode parent to account for any ++ * quirks in how fwnodes are converted to devices. ++ */ ++ if (sup_dev) ++ par_dev = get_device(sup_dev->parent); ++ else ++ par_dev = fwnode_get_next_parent_dev(sup_handle); ++ ++ if (par_dev && __fw_devlink_relax_cycles(con, par_dev->fwnode)) ++ ret = true; ++ ++ if (!sup_dev) ++ goto out; ++ ++ list_for_each_entry(dev_link, &sup_dev->links.suppliers, c_node) { ++ /* ++ * Ignore a SYNC_STATE_ONLY flag only if it wasn't marked as ++ * such due to a cycle. ++ */ ++ if (device_link_flag_is_sync_state_only(dev_link->flags) && ++ !(dev_link->flags & DL_FLAG_CYCLE)) ++ continue; ++ ++ if (__fw_devlink_relax_cycles(con, ++ dev_link->supplier->fwnode)) { ++ fw_devlink_relax_link(dev_link); ++ dev_link->flags |= DL_FLAG_CYCLE; ++ ret = true; ++ } ++ } ++ ++out: ++ sup_handle->flags &= ~FWNODE_FLAG_VISITED; ++ put_device(sup_dev); ++ put_device(par_dev); ++ return ret; ++} ++ + /** + * fw_devlink_create_devlink - Create a device link from a consumer to fwnode + * @con: consumer device for the device link +@@ -1989,6 +2053,21 @@ static int fw_devlink_create_devlink(struct device *con, + fwnode_is_ancestor_of(sup_handle, con->fwnode)) + return -EINVAL; + ++ /* ++ * SYNC_STATE_ONLY device links don't block probing and supports cycles. ++ * So cycle detection isn't necessary and shouldn't be done. ++ */ ++ if (!(flags & DL_FLAG_SYNC_STATE_ONLY)) { ++ device_links_write_lock(); ++ if (__fw_devlink_relax_cycles(con, sup_handle)) { ++ __fwnode_link_cycle(link); ++ flags = fw_devlink_get_flags(link->flags); ++ dev_info(con, "Fixed dependency cycle(s) with %pfwf\n", ++ sup_handle); ++ } ++ device_links_write_unlock(); ++ } ++ + if (sup_handle->flags & FWNODE_FLAG_NOT_DEVICE) + sup_dev = fwnode_get_next_parent_dev(sup_handle); + else +@@ -2002,23 +2081,16 @@ static int fw_devlink_create_devlink(struct device *con, + */ + if (sup_dev->links.status == DL_DEV_NO_DRIVER && + sup_handle->flags & FWNODE_FLAG_INITIALIZED) { ++ dev_dbg(con, ++ "Not linking %pfwf - dev might never probe\n", ++ sup_handle); + ret = -EINVAL; + goto out; + } + +- /* +- * If this fails, it is due to cycles in device links. Just +- * give up on this link and treat it as invalid. +- */ +- if (!device_link_add(con, sup_dev, flags) && +- !(flags & DL_FLAG_SYNC_STATE_ONLY)) { +- dev_info(con, "Fixing up cyclic dependency with %s\n", +- dev_name(sup_dev)); +- device_links_write_lock(); +- fw_devlink_relax_cycle(con, sup_dev); +- device_links_write_unlock(); +- device_link_add(con, sup_dev, +- FW_DEVLINK_FLAGS_PERMISSIVE); ++ if (!device_link_add(con, sup_dev, flags)) { ++ dev_err(con, "Failed to create device link with %s\n", ++ dev_name(sup_dev)); + ret = -EINVAL; + } + +@@ -2031,49 +2103,12 @@ static int fw_devlink_create_devlink(struct device *con, + */ + if (fwnode_init_without_drv(sup_handle) || + fwnode_ancestor_init_without_drv(sup_handle)) { +- dev_dbg(con, "Not linking %pfwP - Might never probe\n", ++ dev_dbg(con, "Not linking %pfwf - might never become dev\n", + sup_handle); + return -EINVAL; + } + +- /* +- * DL_FLAG_SYNC_STATE_ONLY doesn't block probing and supports +- * cycles. So cycle detection isn't necessary and shouldn't be +- * done. +- */ +- if (flags & DL_FLAG_SYNC_STATE_ONLY) +- return -EAGAIN; +- +- /* +- * If we can't find the supplier device from its fwnode, it might be +- * due to a cyclic dependency between fwnodes. Some of these cycles can +- * be broken by applying logic. Check for these types of cycles and +- * break them so that devices in the cycle probe properly. +- * +- * If the supplier's parent is dependent on the consumer, then the +- * consumer and supplier have a cyclic dependency. Since fw_devlink +- * can't tell which of the inferred dependencies are incorrect, don't +- * enforce probe ordering between any of the devices in this cyclic +- * dependency. Do this by relaxing all the fw_devlink device links in +- * this cycle and by treating the fwnode link between the consumer and +- * the supplier as an invalid dependency. +- */ +- sup_dev = fwnode_get_next_parent_dev(sup_handle); +- if (sup_dev && device_is_dependent(con, sup_dev)) { +- dev_info(con, "Fixing up cyclic dependency with %pfwP (%s)\n", +- sup_handle, dev_name(sup_dev)); +- device_links_write_lock(); +- fw_devlink_relax_cycle(con, sup_dev); +- device_links_write_unlock(); +- ret = -EINVAL; +- } else { +- /* +- * Can't check for cycles or no cycles. So let's try +- * again later. +- */ +- ret = -EAGAIN; +- } +- ++ ret = -EAGAIN; + out: + put_device(sup_dev); + return ret; +@@ -2156,10 +2191,7 @@ static void __fw_devlink_link_to_consumers(struct device *dev) + * + * The function creates normal (non-SYNC_STATE_ONLY) device links between @dev + * and the real suppliers of @dev. Once these device links are created, the +- * fwnode links are deleted. When such device links are successfully created, +- * this function is called recursively on those supplier devices. This is +- * needed to detect and break some invalid cycles in fwnode links. See +- * fw_devlink_create_devlink() for more details. ++ * fwnode links are deleted. + * + * In addition, it also looks at all the suppliers of the entire fwnode tree + * because some of the child devices of @dev that have not been added yet +@@ -2180,7 +2212,6 @@ static void __fw_devlink_link_to_suppliers(struct device *dev, + + list_for_each_entry_safe(link, tmp, &fwnode->suppliers, c_hook) { + int ret; +- struct device *sup_dev; + struct fwnode_handle *sup = link->supplier; + + ret = fw_devlink_create_devlink(dev, sup, link); +@@ -2188,27 +2219,6 @@ static void __fw_devlink_link_to_suppliers(struct device *dev, + continue; + + __fwnode_link_del(link); +- +- /* If no device link was created, nothing more to do. */ +- if (ret) +- continue; +- +- /* +- * If a device link was successfully created to a supplier, we +- * now need to try and link the supplier to all its suppliers. +- * +- * This is needed to detect and delete false dependencies in +- * fwnode links that haven't been converted to a device link +- * yet. See comments in fw_devlink_create_devlink() for more +- * details on the false dependency. +- * +- * Without deleting these false dependencies, some devices will +- * never probe because they'll keep waiting for their false +- * dependency fwnode links to be converted to device links. +- */ +- sup_dev = get_dev_from_fwnode(sup); +- __fw_devlink_link_to_suppliers(sup_dev, sup_dev->fwnode); +- put_device(sup_dev); + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-552-mtd-mtdpart-Don-t-create-platform-device-that-l.patch b/patches.kernel.org/6.2.3-552-mtd-mtdpart-Don-t-create-platform-device-that-l.patch new file mode 100644 index 0000000..c622510 --- /dev/null +++ b/patches.kernel.org/6.2.3-552-mtd-mtdpart-Don-t-create-platform-device-that-l.patch @@ -0,0 +1,65 @@ +From: Saravana Kannan +Date: Mon, 6 Feb 2023 17:42:04 -0800 +Subject: [PATCH] mtd: mtdpart: Don't create platform device that'll never + probe +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fb42378dcc7f247df56f0ecddfdae85487495fbc + +[ Upstream commit fb42378dcc7f247df56f0ecddfdae85487495fbc ] + +These "nvmem-cells" platform devices never get probed because there's no +platform driver for it and it's never used anywhere else. So it's a +waste of memory. These devices also cause fw_devlink to block nvmem +consumers of "nvmem-cells" partition from probing because the supplier +device never probes. + +So stop creating platform devices for nvmem-cells partitions to avoid +wasting memory and to avoid blocking probing of consumers. + +Reported-by: Maxim Kiselev +Fixes: bcdf0315a61a ("mtd: call of_platform_populate() for MTD partitions") +Signed-off-by: Saravana Kannan +Tested-by: Maksim Kiselev +Tested-by: Douglas Anderson +Tested-by: Geert Uytterhoeven +Tested-by: Luca Weiss # qcom/sm7225-fairphone-fp4 +Link: https://lore.kernel.org/r/20230207014207.1678715-13-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/mtd/mtdpart.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c +index d442fa94..85f5ee6f 100644 +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -577,6 +577,7 @@ static int mtd_part_of_parse(struct mtd_info *master, + { + struct mtd_part_parser *parser; + struct device_node *np; ++ struct device_node *child; + struct property *prop; + struct device *dev; + const char *compat; +@@ -594,6 +595,15 @@ static int mtd_part_of_parse(struct mtd_info *master, + else + np = of_get_child_by_name(np, "partitions"); + ++ /* ++ * Don't create devices that are added to a bus but will never get ++ * probed. That'll cause fw_devlink to block probing of consumers of ++ * this partition until the partition device is probed. ++ */ ++ for_each_child_of_node(np, child) ++ if (of_device_is_compatible(child, "nvmem-cells")) ++ of_node_set_flag(child, OF_POPULATED); ++ + of_property_for_each_string(np, "compatible", prop, compat) { + parser = mtd_part_get_compatible_parser(compat); + if (!parser) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-553-usb-host-fsl-mph-dr-of-reuse-device_set_of_node.patch b/patches.kernel.org/6.2.3-553-usb-host-fsl-mph-dr-of-reuse-device_set_of_node.patch new file mode 100644 index 0000000..092dbeb --- /dev/null +++ b/patches.kernel.org/6.2.3-553-usb-host-fsl-mph-dr-of-reuse-device_set_of_node.patch @@ -0,0 +1,39 @@ +From: Alexander Stein +Date: Tue, 7 Feb 2023 12:05:31 +0100 +Subject: [PATCH] usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e2ffae3ed92a9f768902c1cf82642c3a09cd0345 + +[ Upstream commit e2ffae3ed92a9f768902c1cf82642c3a09cd0345 ] + +This sets both of_node fields and takes a of_node reference as well. + +Fixes: bb160ee61c04 ("drivers/usb/host/ehci-fsl: Fix interrupt setup in host mode.") +Signed-off-by: Alexander Stein +Reviewed-by: Rob Herring +Link: https://lore.kernel.org/r/20230207110531.1060252-4-alexander.stein@ew.tq-group.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/usb/host/fsl-mph-dr-of.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c +index e5df1752..46c6a152 100644 +--- a/drivers/usb/host/fsl-mph-dr-of.c ++++ b/drivers/usb/host/fsl-mph-dr-of.c +@@ -112,8 +112,7 @@ static struct platform_device *fsl_usb2_device_register( + goto error; + } + +- pdev->dev.of_node = ofdev->dev.of_node; +- pdev->dev.of_node_reused = true; ++ device_set_of_node_from_dev(&pdev->dev, &ofdev->dev); + + retval = platform_device_add(pdev); + if (retval) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-554-dmaengine-dw-edma-Fix-readq_ch-return-value-tru.patch b/patches.kernel.org/6.2.3-554-dmaengine-dw-edma-Fix-readq_ch-return-value-tru.patch new file mode 100644 index 0000000..b9ff3ee --- /dev/null +++ b/patches.kernel.org/6.2.3-554-dmaengine-dw-edma-Fix-readq_ch-return-value-tru.patch @@ -0,0 +1,41 @@ +From: Serge Semin +Date: Wed, 25 Jan 2023 18:19:00 +0300 +Subject: [PATCH] dmaengine: dw-edma: Fix readq_ch() return value truncation +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5fdca4a995bcd4cf61bda40af154a730589dc524 + +[ Upstream commit 5fdca4a995bcd4cf61bda40af154a730589dc524 ] + +Previously, readq_ch() did a 64-bit readq(), but truncated the result by +storing it in the u32 "value". Change "value" to u64 to avoid the +truncation. + +Note: the method is currently unused, so the bug hasn't caused any problem +so far. + +Fixes: 04e0a39fc10f ("dmaengine: dw-edma: Add writeq() and readq() for 64 bits architectures") +Signed-off-by: Serge Semin +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/dw-edma/dw-edma-v0-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c +index 77e6cfe5..a3816ba6 100644 +--- a/drivers/dma/dw-edma/dw-edma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-edma-v0-core.c +@@ -192,7 +192,7 @@ static inline void writeq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch, + static inline u64 readq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch, + const void __iomem *addr) + { +- u32 value; ++ u64 value; + + if (dw->chip->mf == EDMA_MF_EDMA_LEGACY) { + u32 viewport_sel; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-555-PCI-Fix-dropping-valid-root-bus-resources-with-.patch b/patches.kernel.org/6.2.3-555-PCI-Fix-dropping-valid-root-bus-resources-with-.patch new file mode 100644 index 0000000..dc7038d --- /dev/null +++ b/patches.kernel.org/6.2.3-555-PCI-Fix-dropping-valid-root-bus-resources-with-.patch @@ -0,0 +1,75 @@ +From: Geert Uytterhoeven +Date: Fri, 10 Feb 2023 14:46:39 +0100 +Subject: [PATCH] PCI: Fix dropping valid root bus resources with .end = zero +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9d8ba74a181b1c81def21168795ed96cbe6f05ed + +[ Upstream commit 9d8ba74a181b1c81def21168795ed96cbe6f05ed ] + +On r8a7791/koelsch: + + kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) + # cat /sys/kernel/debug/kmemleak + unreferenced object 0xc3a34e00 (size 64): + comm "swapper/0", pid 1, jiffies 4294937460 (age 199.080s) + hex dump (first 32 bytes): + b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00 .]...].......... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] __kmalloc+0xf0/0x140 + [<34bd6bc0>] resource_list_create_entry+0x18/0x38 + [<767046bc>] pci_add_resource_offset+0x20/0x68 + [] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390 + +When coalescing two resources for a contiguous aperture, the second +resource is enlarged to cover the full contiguous range, while the first +resource is marked invalid. This invalidation is done by clearing the +flags, start, and end members. + +When adding the initial resources to the bus later, invalid resources are +skipped. Unfortunately, the check for an invalid resource considers only +the end member, causing false positives. + +E.g. on r8a7791/koelsch, root bus resource 0 ("bus 00") is skipped, and no +longer registered with pci_bus_insert_busn_res() (causing the memory leak), +nor printed: + + pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges: + pci-rcar-gen2 ee090000.pci: MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000 + pci-rcar-gen2 ee090000.pci: PCI: revision 11 + pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00 + -pci_bus 0000:00: root bus resource [bus 00] + pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff] + +Fix this by only skipping resources where all of the flags, start, and end +members are zero. + +Fixes: 7c3855c423b17f6c ("PCI: Coalesce host bridge contiguous apertures") +Link: https://lore.kernel.org/r/da0fcd5e86c74239be79c7cb03651c0fce31b515.1676036673.git.geert+renesas@glider.be +Tested-by: Niklas Schnelle +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Bjorn Helgaas +Acked-by: Kai-Heng Feng +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pci/probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 1779582f..59885848 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -996,7 +996,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge) + resource_list_for_each_entry_safe(window, n, &resources) { + offset = window->offset; + res = window->res; +- if (!res->end) ++ if (!res->flags && !res->start && !res->end) + continue; + + list_move_tail(&window->node, &bridge->windows); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-556-phy-rockchip-typec-fix-tcphy_get_mode-error-cas.patch b/patches.kernel.org/6.2.3-556-phy-rockchip-typec-fix-tcphy_get_mode-error-cas.patch new file mode 100644 index 0000000..7cd0193 --- /dev/null +++ b/patches.kernel.org/6.2.3-556-phy-rockchip-typec-fix-tcphy_get_mode-error-cas.patch @@ -0,0 +1,55 @@ +From: Neill Kapron +Date: Thu, 26 Jan 2023 00:10:12 +0000 +Subject: [PATCH] phy: rockchip-typec: fix tcphy_get_mode error case +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4ca651df07183e29cdad7272255e23aec0169a1b + +[ Upstream commit 4ca651df07183e29cdad7272255e23aec0169a1b ] + +The existing logic in tcphy_get_mode() can cause the phy to be +incorrectly configured to USB UFP or DisplayPort mode when +extcon_get_state returns an error code. + +extcon_get_state() can return 0, 1, or a negative error code. + +It is possible to get into the failing state with an extcon driver +which does not support the extcon connector id specified as the +second argument to extcon_get_state(). + +tcphy_get_mode() +->extcon_get_state() +-->find_cable_index_by_id() +--->return -EINVAL; + +Fixes: e96be45cb84e ("phy: Add USB Type-C PHY driver for rk3399") +Signed-off-by: Neill Kapron +Reviewed-by: Lee Jones +Link: https://lore.kernel.org/r/20230126001013.3707873-1-nkapron@google.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/phy/rockchip/phy-rockchip-typec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c +index d76440ae..6aea512e 100644 +--- a/drivers/phy/rockchip/phy-rockchip-typec.c ++++ b/drivers/phy/rockchip/phy-rockchip-typec.c +@@ -821,10 +821,10 @@ static int tcphy_get_mode(struct rockchip_typec_phy *tcphy) + mode = MODE_DFP_USB; + id = EXTCON_USB_HOST; + +- if (ufp) { ++ if (ufp > 0) { + mode = MODE_UFP_USB; + id = EXTCON_USB; +- } else if (dp) { ++ } else if (dp > 0) { + mode = MODE_DFP_DP; + id = EXTCON_DISP_DP; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-557-PCI-qcom-Fix-host-init-error-handling.patch b/patches.kernel.org/6.2.3-557-PCI-qcom-Fix-host-init-error-handling.patch new file mode 100644 index 0000000..40885cc --- /dev/null +++ b/patches.kernel.org/6.2.3-557-PCI-qcom-Fix-host-init-error-handling.patch @@ -0,0 +1,52 @@ +From: Johan Hovold +Date: Mon, 17 Oct 2022 13:47:04 +0200 +Subject: [PATCH] PCI: qcom: Fix host-init error handling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 997e010de9134474dbfde52be03efd7d1bce902d + +[ Upstream commit 997e010de9134474dbfde52be03efd7d1bce902d ] + +Implement the new host_deinit() callback so that the PHY is powered off +and regulators and clocks are disabled also on late host-init errors. + +Link: https://lore.kernel.org/r/20221017114705.8277-2-johan+linaro@kernel.org +Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver") +Signed-off-by: Johan Hovold +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pci/controller/dwc/pcie-qcom.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index 77e5dc7b..7e23c74f 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -1534,8 +1534,19 @@ static int qcom_pcie_host_init(struct dw_pcie_rp *pp) + return ret; + } + ++static void qcom_pcie_host_deinit(struct dw_pcie_rp *pp) ++{ ++ struct dw_pcie *pci = to_dw_pcie_from_pp(pp); ++ struct qcom_pcie *pcie = to_qcom_pcie(pci); ++ ++ qcom_ep_reset_assert(pcie); ++ phy_power_off(pcie->phy); ++ pcie->cfg->ops->deinit(pcie); ++} ++ + static const struct dw_pcie_host_ops qcom_pcie_dw_ops = { +- .host_init = qcom_pcie_host_init, ++ .host_init = qcom_pcie_host_init, ++ .host_deinit = qcom_pcie_host_deinit, + }; + + /* Qcom IP rev.: 2.1.0 Synopsys IP rev.: 4.01a */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-558-iw_cxgb4-Fix-potential-NULL-dereference-in-c4iw.patch b/patches.kernel.org/6.2.3-558-iw_cxgb4-Fix-potential-NULL-dereference-in-c4iw.patch new file mode 100644 index 0000000..7b05ba0 --- /dev/null +++ b/patches.kernel.org/6.2.3-558-iw_cxgb4-Fix-potential-NULL-dereference-in-c4iw.patch @@ -0,0 +1,41 @@ +From: Dan Carpenter +Date: Tue, 14 Feb 2023 18:43:38 +0300 +Subject: [PATCH] iw_cxgb4: Fix potential NULL dereference in + c4iw_fill_res_cm_id_entry() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4ca446b127c568b59cb8d9748b6f70499624bb18 + +[ Upstream commit 4ca446b127c568b59cb8d9748b6f70499624bb18 ] + +This condition needs to match the previous "if (epcp->state == LISTEN) {" +exactly to avoid a NULL dereference of either "listen_ep" or "ep". The +problem is that "epcp" has been re-assigned so just testing +"if (epcp->state == LISTEN) {" a second time is not sufficient. + +Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/Y+usKuWIKr4dimZh@kili +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/cxgb4/restrack.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/cxgb4/restrack.c b/drivers/infiniband/hw/cxgb4/restrack.c +index ff645b95..fd22c85d 100644 +--- a/drivers/infiniband/hw/cxgb4/restrack.c ++++ b/drivers/infiniband/hw/cxgb4/restrack.c +@@ -238,7 +238,7 @@ int c4iw_fill_res_cm_id_entry(struct sk_buff *msg, + if (rdma_nl_put_driver_u64_hex(msg, "history", epcp->history)) + goto err_cancel_table; + +- if (epcp->state == LISTEN) { ++ if (listen_ep) { + if (rdma_nl_put_driver_u32(msg, "stid", listen_ep->stid)) + goto err_cancel_table; + if (rdma_nl_put_driver_u32(msg, "backlog", listen_ep->backlog)) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-559-iommu-Fix-error-unwind-in-iommu_group_alloc.patch b/patches.kernel.org/6.2.3-559-iommu-Fix-error-unwind-in-iommu_group_alloc.patch new file mode 100644 index 0000000..9bb25d2 --- /dev/null +++ b/patches.kernel.org/6.2.3-559-iommu-Fix-error-unwind-in-iommu_group_alloc.patch @@ -0,0 +1,54 @@ +From: Jason Gunthorpe +Date: Wed, 15 Feb 2023 21:21:16 -0400 +Subject: [PATCH] iommu: Fix error unwind in iommu_group_alloc() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4daa861174d56023c2068ddb03de0752f07fa199 + +[ Upstream commit 4daa861174d56023c2068ddb03de0752f07fa199 ] + +If either iommu_group_grate_file() fails then the +iommu_group is leaked. + +Destroy it on these error paths. + +Found by kselftest/iommu/iommufd_fail_nth + +Fixes: bc7d12b91bd3 ("iommu: Implement reserved_regions iommu-group sysfs file") +Fixes: c52c72d3dee8 ("iommu: Add sysfs attribyte for domain type") +Signed-off-by: Jason Gunthorpe +Reviewed-by: Lu Baolu +Link: https://lore.kernel.org/r/0-v1-8f616bee028d+8b-iommu_group_alloc_leak_jgg@nvidia.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iommu/iommu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 9ff8cda2..50d858f3 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -774,12 +774,16 @@ struct iommu_group *iommu_group_alloc(void) + + ret = iommu_group_create_file(group, + &iommu_group_attr_reserved_regions); +- if (ret) ++ if (ret) { ++ kobject_put(group->devices_kobj); + return ERR_PTR(ret); ++ } + + ret = iommu_group_create_file(group, &iommu_group_attr_type); +- if (ret) ++ if (ret) { ++ kobject_put(group->devices_kobj); + return ERR_PTR(ret); ++ } + + pr_debug("Allocated group %d\n", group->id); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-560-iommu-amd-Do-not-identity-map-v2-capable-device.patch b/patches.kernel.org/6.2.3-560-iommu-amd-Do-not-identity-map-v2-capable-device.patch new file mode 100644 index 0000000..e59f75d --- /dev/null +++ b/patches.kernel.org/6.2.3-560-iommu-amd-Do-not-identity-map-v2-capable-device.patch @@ -0,0 +1,62 @@ +From: Vasant Hegde +Date: Tue, 7 Feb 2023 09:17:52 +0000 +Subject: [PATCH] iommu/amd: Do not identity map v2 capable device when snp is + enabled +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 18792e99ea2fea27c72eb1ecca1879e5e6be304d + +[ Upstream commit 18792e99ea2fea27c72eb1ecca1879e5e6be304d ] + +Flow: + - Booted system with SNP enabled, memory encryption off and + IOMMU DMA translation mode + - AMD driver detects v2 capable device and amd_iommu_def_domain_type() + returns identity mode + - amd_iommu_domain_alloc() returns NULL an SNP is enabled + - System will fail to register device + +On SNP enabled system, passthrough mode is not supported. IOMMU default +domain is set to translation mode. We need to return zero from +amd_iommu_def_domain_type() so that it allocates translation domain. + +Fixes: fb2accadaa94 ("iommu/amd: Introduce function to check and enable SNP") +CC: Suravee Suthikulpanit +Signed-off-by: Vasant Hegde +Link: https://lore.kernel.org/r/20230207091752.7656-1-vasant.hegde@amd.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iommu/amd/iommu.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 9dc41c48..ff4f3d4d 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -2405,12 +2405,17 @@ static int amd_iommu_def_domain_type(struct device *dev) + return 0; + + /* +- * Do not identity map IOMMUv2 capable devices when memory encryption is +- * active, because some of those devices (AMD GPUs) don't have the +- * encryption bit in their DMA-mask and require remapping. ++ * Do not identity map IOMMUv2 capable devices when: ++ * - memory encryption is active, because some of those devices ++ * (AMD GPUs) don't have the encryption bit in their DMA-mask ++ * and require remapping. ++ * - SNP is enabled, because it prohibits DTE[Mode]=0. + */ +- if (!cc_platform_has(CC_ATTR_MEM_ENCRYPT) && dev_data->iommu_v2) ++ if (dev_data->iommu_v2 && ++ !cc_platform_has(CC_ATTR_MEM_ENCRYPT) && ++ !amd_iommu_snp_en) { + return IOMMU_DOMAIN_IDENTITY; ++ } + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-561-dmaengine-sf-pdma-pdma_desc-memory-leak-fix.patch b/patches.kernel.org/6.2.3-561-dmaengine-sf-pdma-pdma_desc-memory-leak-fix.patch new file mode 100644 index 0000000..055f7bd --- /dev/null +++ b/patches.kernel.org/6.2.3-561-dmaengine-sf-pdma-pdma_desc-memory-leak-fix.patch @@ -0,0 +1,83 @@ +From: Shravan Chippa +Date: Fri, 20 Jan 2023 15:36:23 +0530 +Subject: [PATCH] dmaengine: sf-pdma: pdma_desc memory leak fix +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b02e07015a5ac7bbc029da931ae17914b8ae0339 + +[ Upstream commit b02e07015a5ac7bbc029da931ae17914b8ae0339 ] + +Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a +DMA channel") changed sf_pdma_prep_dma_memcpy() to unconditionally +allocate a new sf_pdma_desc each time it is called. + +The driver previously recycled descs, by checking the in_use flag, only +allocating additional descs if the existing one was in use. This logic +was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread +support for a DMA channel"), but sf_pdma_free_desc() was not changed to +handle the new behaviour. + +As a result, each time sf_pdma_prep_dma_memcpy() is called, the previous +descriptor is leaked, over time leading to memory starvation: + + unreferenced object 0xffffffe008447300 (size 192): + comm "irq/39-mchp_dsc", pid 343, jiffies 4294906910 (age 981.200s) + hex dump (first 32 bytes): + 00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................ + 00 00 70 08 10 00 00 00 00 00 00 c0 00 00 00 00 ..p............. + backtrace: + [<00000000064a04f4>] kmemleak_alloc+0x1e/0x28 + [<00000000018927a7>] kmem_cache_alloc+0x11e/0x178 + [<000000002aea8d16>] sf_pdma_prep_dma_memcpy+0x40/0x112 + +Add the missing kfree() to sf_pdma_free_desc(), and remove the redundant +in_use flag. + +Fixes: b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel") +Signed-off-by: Shravan Chippa +Reviewed-by: Conor Dooley +Link: https://lore.kernel.org/r/20230120100623.3530634-1-shravan.chippa@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/sf-pdma/sf-pdma.c | 3 +-- + drivers/dma/sf-pdma/sf-pdma.h | 1 - + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/dma/sf-pdma/sf-pdma.c b/drivers/dma/sf-pdma/sf-pdma.c +index 6b524eb6..e578ad55 100644 +--- a/drivers/dma/sf-pdma/sf-pdma.c ++++ b/drivers/dma/sf-pdma/sf-pdma.c +@@ -96,7 +96,6 @@ sf_pdma_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dest, dma_addr_t src, + if (!desc) + return NULL; + +- desc->in_use = true; + desc->dirn = DMA_MEM_TO_MEM; + desc->async_tx = vchan_tx_prep(&chan->vchan, &desc->vdesc, flags); + +@@ -290,7 +289,7 @@ static void sf_pdma_free_desc(struct virt_dma_desc *vdesc) + struct sf_pdma_desc *desc; + + desc = to_sf_pdma_desc(vdesc); +- desc->in_use = false; ++ kfree(desc); + } + + static void sf_pdma_donebh_tasklet(struct tasklet_struct *t) +diff --git a/drivers/dma/sf-pdma/sf-pdma.h b/drivers/dma/sf-pdma/sf-pdma.h +index dcb3687b..5c398a83 100644 +--- a/drivers/dma/sf-pdma/sf-pdma.h ++++ b/drivers/dma/sf-pdma/sf-pdma.h +@@ -78,7 +78,6 @@ struct sf_pdma_desc { + u64 src_addr; + struct virt_dma_desc vdesc; + struct sf_pdma_chan *chan; +- bool in_use; + enum dma_transfer_direction dirn; + struct dma_async_tx_descriptor *async_tx; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-562-dmaengine-dw-axi-dmac-Do-not-dereference-NULL-s.patch b/patches.kernel.org/6.2.3-562-dmaengine-dw-axi-dmac-Do-not-dereference-NULL-s.patch new file mode 100644 index 0000000..09bcef3 --- /dev/null +++ b/patches.kernel.org/6.2.3-562-dmaengine-dw-axi-dmac-Do-not-dereference-NULL-s.patch @@ -0,0 +1,48 @@ +From: Kees Cook +Date: Fri, 27 Jan 2023 14:36:27 -0800 +Subject: [PATCH] dmaengine: dw-axi-dmac: Do not dereference NULL structure +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: be4d46edeee4b2459d2f53f37ada88bbfb634b6c + +[ Upstream commit be4d46edeee4b2459d2f53f37ada88bbfb634b6c ] + +If "vdesc" is NULL, it cannot be used with vd_to_axi_desc(). Leave +"bytes" unchanged at 0. Seen under GCC 13 with -Warray-bounds: + +../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c: In function 'dma_chan_tx_status': +../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c:329:46: warning: array subscript 0 is outside array bounds of 'struct +virt_dma_desc[46116860184273879]' [-Warray-bounds=] + 329 | bytes = vd_to_axi_desc(vdesc)->length; + | ^~ + +Fixes: 8e55444da65c ("dmaengine: dw-axi-dmac: Support burst residue granularity") +Cc: Eugeniy Paltsev +Cc: Vinod Koul +Cc: dmaengine@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230127223623.never.507-kees@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +index bf85aa09..152c5d98 100644 +--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c ++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +@@ -325,8 +325,6 @@ dma_chan_tx_status(struct dma_chan *dchan, dma_cookie_t cookie, + len = vd_to_axi_desc(vdesc)->hw_desc[0].len; + completed_length = completed_blocks * len; + bytes = length - completed_length; +- } else { +- bytes = vd_to_axi_desc(vdesc)->length; + } + + spin_unlock_irqrestore(&chan->vc.lock, flags); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-563-dmaengine-ptdma-check-for-null-desc-before-call.patch b/patches.kernel.org/6.2.3-563-dmaengine-ptdma-check-for-null-desc-before-call.patch new file mode 100644 index 0000000..2e76526 --- /dev/null +++ b/patches.kernel.org/6.2.3-563-dmaengine-ptdma-check-for-null-desc-before-call.patch @@ -0,0 +1,45 @@ +From: Eric Pilmore +Date: Thu, 9 Feb 2023 23:51:43 -0800 +Subject: [PATCH] dmaengine: ptdma: check for null desc before calling + pt_cmd_callback +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 928469986171a6f763b34b039427f5667ba3fd50 + +[ Upstream commit 928469986171a6f763b34b039427f5667ba3fd50 ] + +Resolves a panic that can occur on AMD systems, typically during host +shutdown, after the PTDMA driver had been exercised. The issue was +the pt_issue_pending() function is mistakenly assuming that there will +be at least one descriptor in the Submitted queue when the function +is called. However, it is possible that both the Submitted and Issued +queues could be empty, which could result in pt_cmd_callback() being +mistakenly called with a NULL pointer. +Ref: Bugzilla Bug 216856. + +Fixes: 6fa7e0e836e2 ("dmaengine: ptdma: fix concurrency issue with multiple dma transfer") +Signed-off-by: Eric Pilmore +Link: https://lore.kernel.org/r/20230210075142.58253-1-epilmore@gigaio.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/dma/ptdma/ptdma-dmaengine.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/ptdma/ptdma-dmaengine.c b/drivers/dma/ptdma/ptdma-dmaengine.c +index cc22d162..1aa65e5d 100644 +--- a/drivers/dma/ptdma/ptdma-dmaengine.c ++++ b/drivers/dma/ptdma/ptdma-dmaengine.c +@@ -254,7 +254,7 @@ static void pt_issue_pending(struct dma_chan *dma_chan) + spin_unlock_irqrestore(&chan->vc.lock, flags); + + /* If there was nothing active, start processing */ +- if (engine_is_idle) ++ if (engine_is_idle && desc) + pt_cmd_callback(desc, 0); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-564-iommu-vt-d-Fix-error-handling-in-sva-enable-dis.patch b/patches.kernel.org/6.2.3-564-iommu-vt-d-Fix-error-handling-in-sva-enable-dis.patch new file mode 100644 index 0000000..7c1bc5d --- /dev/null +++ b/patches.kernel.org/6.2.3-564-iommu-vt-d-Fix-error-handling-in-sva-enable-dis.patch @@ -0,0 +1,60 @@ +From: Lu Baolu +Date: Thu, 16 Feb 2023 21:08:13 +0800 +Subject: [PATCH] iommu/vt-d: Fix error handling in sva enable/disable paths +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 60b1daa3b168fbc648ae2ad28a84759223e49e18 + +[ Upstream commit 60b1daa3b168fbc648ae2ad28a84759223e49e18 ] + +Roll back all previous actions in error paths of intel_iommu_enable_sva() +and intel_iommu_disable_sva(). + +Fixes: d5b9e4bfe0d8 ("iommu/vt-d: Report prq to io-pgfault framework") +Reviewed-by: Kevin Tian +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20230208051559.700109-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iommu/intel/iommu.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 59df7e42..994dffa1 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -4642,8 +4642,12 @@ static int intel_iommu_enable_sva(struct device *dev) + return -EINVAL; + + ret = iopf_queue_add_device(iommu->iopf_queue, dev); +- if (!ret) +- ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev); ++ if (ret) ++ return ret; ++ ++ ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev); ++ if (ret) ++ iopf_queue_remove_device(iommu->iopf_queue, dev); + + return ret; + } +@@ -4655,8 +4659,12 @@ static int intel_iommu_disable_sva(struct device *dev) + int ret; + + ret = iommu_unregister_device_fault_handler(dev); +- if (!ret) +- ret = iopf_queue_remove_device(iommu->iopf_queue, dev); ++ if (ret) ++ return ret; ++ ++ ret = iopf_queue_remove_device(iommu->iopf_queue, dev); ++ if (ret) ++ iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev); + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-565-iommu-vt-d-Allow-to-use-flush-queue-when-first-.patch b/patches.kernel.org/6.2.3-565-iommu-vt-d-Allow-to-use-flush-queue-when-first-.patch new file mode 100644 index 0000000..fbe9edb --- /dev/null +++ b/patches.kernel.org/6.2.3-565-iommu-vt-d-Allow-to-use-flush-queue-when-first-.patch @@ -0,0 +1,75 @@ +From: Tina Zhang +Date: Thu, 16 Feb 2023 21:08:16 +0800 +Subject: [PATCH] iommu/vt-d: Allow to use flush-queue when first level is + default +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 257ec290741924f8df678927d0dfecb1deebb9c5 + +[ Upstream commit 257ec290741924f8df678927d0dfecb1deebb9c5 ] + +Commit 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode +is on") forced default domains to be strict mode as long as IOMMU +caching-mode is flagged. The reason for doing this is that when vIOMMU +uses VT-d caching mode to synchronize shadowing page tables, the strict +mode shows better performance. + +However, this optimization is orthogonal to the first-level page table +because the Intel VT-d architecture does not define the caching mode of +the first-level page table. Refer to VT-d spec, section 6.1, "When the +CM field is reported as Set, any software updates to remapping +structures other than first-stage mapping (including updates to not- +present entries or present entries whose programming resulted in +translation faults) requires explicit invalidation of the caches." +Exclude the first-level page table from this optimization. + +Generally using first-stage translation in vIOMMU implies nested +translation enabled in the physical IOMMU. In this case the first-stage +page table is wholly captured by the guest. The vIOMMU only needs to +transfer the cache invalidations on vIOMMU to the physical IOMMU. +Forcing the default domain to strict mode will cause more frequent +cache invalidations, resulting in performance degradation. In a real +performance benchmark test measured by iperf receive, the performance +result on Sapphire Rapids 100Gb NIC shows: +w/ this fix ~51 Gbits/s, w/o this fix ~39.3 Gbits/s. + +Theoretically a first-stage IOMMU page table can still be shadowed +in absence of the caching mode, e.g. with host write-protecting guest +IOMMU page table to synchronize changed PTEs with the physical +IOMMU page table. In this case the shadowing overhead is decoupled +from emulating IOTLB invalidation then the overhead of the latter part +is solely decided by the frequency of IOTLB invalidations. Hence +allowing guest default dma domain to be lazy can also benefit the +overall performance by reducing the total VM-exit numbers. + +Fixes: 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode is on") +Reported-by: Sanjay Kumar +Suggested-by: Sanjay Kumar +Signed-off-by: Tina Zhang +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20230214025618.2292889-1-tina.zhang@intel.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/iommu/intel/iommu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 994dffa1..b40ef352 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -4005,7 +4005,8 @@ int __init intel_iommu_init(void) + * is likely to be much lower than the overhead of synchronizing + * the virtual and physical IOMMU page-tables. + */ +- if (cap_caching_mode(iommu->cap)) { ++ if (cap_caching_mode(iommu->cap) && ++ !first_level_by_default(IOMMU_DOMAIN_DMA)) { + pr_info_once("IOMMU batching disallowed due to virtualization\n"); + iommu_set_dma_strict(); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-566-RDMA-rxe-Cleanup-mr_check_range.patch b/patches.kernel.org/6.2.3-566-RDMA-rxe-Cleanup-mr_check_range.patch new file mode 100644 index 0000000..47a1bd1 --- /dev/null +++ b/patches.kernel.org/6.2.3-566-RDMA-rxe-Cleanup-mr_check_range.patch @@ -0,0 +1,47 @@ +From: Bob Pearson +Date: Thu, 19 Jan 2023 17:59:32 -0600 +Subject: [PATCH] RDMA/rxe: Cleanup mr_check_range +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ade58da2a73de1b65616e4b1080dc078d1ce0b5d + +[ Upstream commit ade58da2a73de1b65616e4b1080dc078d1ce0b5d ] + +Remove blank lines and replace EFAULT by EINVAL when an invalid +mr type is used. + +Link: https://lore.kernel.org/r/20230119235936.19728-2-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/sw/rxe/rxe_mr.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index 072eac4b..632ee1e5 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -26,8 +26,6 @@ u8 rxe_get_next_key(u32 last_key) + + int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length) + { +- +- + switch (mr->ibmr.type) { + case IB_MR_TYPE_DMA: + return 0; +@@ -41,7 +39,7 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length) + + default: + rxe_dbg_mr(mr, "type (%d) not supported\n", mr->ibmr.type); +- return -EFAULT; ++ return -EINVAL; + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-567-RDMA-rxe-Move-rxe_map_mr_sg-to-rxe_mr.c.patch b/patches.kernel.org/6.2.3-567-RDMA-rxe-Move-rxe_map_mr_sg-to-rxe_mr.c.patch new file mode 100644 index 0000000..e68e975 --- /dev/null +++ b/patches.kernel.org/6.2.3-567-RDMA-rxe-Move-rxe_map_mr_sg-to-rxe_mr.c.patch @@ -0,0 +1,133 @@ +From: Bob Pearson +Date: Thu, 19 Jan 2023 17:59:33 -0600 +Subject: [PATCH] RDMA/rxe: Move rxe_map_mr_sg to rxe_mr.c +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: db4729a5251992ed535da09c0fcf9b590ac7fe6c + +[ Upstream commit db4729a5251992ed535da09c0fcf9b590ac7fe6c ] + +Move rxe_map_mr_sg() to rxe_mr.c where it makes a little more sense. + +Link: https://lore.kernel.org/r/20230119235936.19728-3-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/sw/rxe/rxe_loc.h | 2 ++ + drivers/infiniband/sw/rxe/rxe_mr.c | 36 +++++++++++++++++++++++++++ + drivers/infiniband/sw/rxe/rxe_verbs.c | 36 --------------------------- + 3 files changed, 38 insertions(+), 36 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h +index 948ce490..29b6c214 100644 +--- a/drivers/infiniband/sw/rxe/rxe_loc.h ++++ b/drivers/infiniband/sw/rxe/rxe_loc.h +@@ -69,6 +69,8 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length, + enum rxe_mr_copy_dir dir); + int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma, + void *addr, int length, enum rxe_mr_copy_dir dir); ++int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, ++ int sg_nents, unsigned int *sg_offset); + void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length); + struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key, + enum rxe_mr_lookup_type type); +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index 632ee1e5..229c7259 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -223,6 +223,42 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) + return err; + } + ++static int rxe_set_page(struct ib_mr *ibmr, u64 addr) ++{ ++ struct rxe_mr *mr = to_rmr(ibmr); ++ struct rxe_map *map; ++ struct rxe_phys_buf *buf; ++ ++ if (unlikely(mr->nbuf == mr->num_buf)) ++ return -ENOMEM; ++ ++ map = mr->map[mr->nbuf / RXE_BUF_PER_MAP]; ++ buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP]; ++ ++ buf->addr = addr; ++ buf->size = ibmr->page_size; ++ mr->nbuf++; ++ ++ return 0; ++} ++ ++int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, ++ int sg_nents, unsigned int *sg_offset) ++{ ++ struct rxe_mr *mr = to_rmr(ibmr); ++ int n; ++ ++ mr->nbuf = 0; ++ ++ n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); ++ ++ mr->page_shift = ilog2(ibmr->page_size); ++ mr->page_mask = ibmr->page_size - 1; ++ mr->offset = ibmr->iova & mr->page_mask; ++ ++ return n; ++} ++ + static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, + size_t *offset_out) + { +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 025b35bf..7a902e0a 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -948,42 +948,6 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, + return ERR_PTR(err); + } + +-static int rxe_set_page(struct ib_mr *ibmr, u64 addr) +-{ +- struct rxe_mr *mr = to_rmr(ibmr); +- struct rxe_map *map; +- struct rxe_phys_buf *buf; +- +- if (unlikely(mr->nbuf == mr->num_buf)) +- return -ENOMEM; +- +- map = mr->map[mr->nbuf / RXE_BUF_PER_MAP]; +- buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP]; +- +- buf->addr = addr; +- buf->size = ibmr->page_size; +- mr->nbuf++; +- +- return 0; +-} +- +-static int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, +- int sg_nents, unsigned int *sg_offset) +-{ +- struct rxe_mr *mr = to_rmr(ibmr); +- int n; +- +- mr->nbuf = 0; +- +- n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); +- +- mr->page_shift = ilog2(ibmr->page_size); +- mr->page_mask = ibmr->page_size - 1; +- mr->offset = ibmr->iova & mr->page_mask; +- +- return n; +-} +- + static ssize_t parent_show(struct device *device, + struct device_attribute *attr, char *buf) + { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-568-RDMA-rxe-Isolate-mr-code-from-atomic_reply.patch b/patches.kernel.org/6.2.3-568-RDMA-rxe-Isolate-mr-code-from-atomic_reply.patch new file mode 100644 index 0000000..af0508c --- /dev/null +++ b/patches.kernel.org/6.2.3-568-RDMA-rxe-Isolate-mr-code-from-atomic_reply.patch @@ -0,0 +1,329 @@ +From: Bob Pearson +Date: Thu, 19 Jan 2023 17:59:34 -0600 +Subject: [PATCH] RDMA-rxe: Isolate mr code from atomic_reply() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f04d5b3d916c61752ac2c2adea5dfe78f8e12f78 + +[ Upstream commit f04d5b3d916c61752ac2c2adea5dfe78f8e12f78 ] + +Isolate mr specific code from atomic_reply() in rxe_resp.c into +a subroutine rxe_mr_do_atomic_op() in rxe_mr.c. +Minor cleanups to rxe_check_range() and iova_to_vaddr(). +Move enum resp_state to rxe.h + +Link: https://lore.kernel.org/r/20230119235936.19728-4-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/sw/rxe/rxe.h | 38 +++++++++++++ + drivers/infiniband/sw/rxe/rxe_loc.h | 2 + + drivers/infiniband/sw/rxe/rxe_mr.c | 83 ++++++++++++++++++---------- + drivers/infiniband/sw/rxe/rxe_resp.c | 82 ++++----------------------- + 4 files changed, 105 insertions(+), 100 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h +index ab334900..2415f370 100644 +--- a/drivers/infiniband/sw/rxe/rxe.h ++++ b/drivers/infiniband/sw/rxe/rxe.h +@@ -57,6 +57,44 @@ + #define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \ + "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__) + ++/* responder states */ ++enum resp_states { ++ RESPST_NONE, ++ RESPST_GET_REQ, ++ RESPST_CHK_PSN, ++ RESPST_CHK_OP_SEQ, ++ RESPST_CHK_OP_VALID, ++ RESPST_CHK_RESOURCE, ++ RESPST_CHK_LENGTH, ++ RESPST_CHK_RKEY, ++ RESPST_EXECUTE, ++ RESPST_READ_REPLY, ++ RESPST_ATOMIC_REPLY, ++ RESPST_ATOMIC_WRITE_REPLY, ++ RESPST_PROCESS_FLUSH, ++ RESPST_COMPLETE, ++ RESPST_ACKNOWLEDGE, ++ RESPST_CLEANUP, ++ RESPST_DUPLICATE_REQUEST, ++ RESPST_ERR_MALFORMED_WQE, ++ RESPST_ERR_UNSUPPORTED_OPCODE, ++ RESPST_ERR_MISALIGNED_ATOMIC, ++ RESPST_ERR_PSN_OUT_OF_SEQ, ++ RESPST_ERR_MISSING_OPCODE_FIRST, ++ RESPST_ERR_MISSING_OPCODE_LAST_C, ++ RESPST_ERR_MISSING_OPCODE_LAST_D1E, ++ RESPST_ERR_TOO_MANY_RDMA_ATM_REQ, ++ RESPST_ERR_RNR, ++ RESPST_ERR_RKEY_VIOLATION, ++ RESPST_ERR_INVALIDATE_RKEY, ++ RESPST_ERR_LENGTH, ++ RESPST_ERR_CQ_OVERFLOW, ++ RESPST_ERROR, ++ RESPST_RESET, ++ RESPST_DONE, ++ RESPST_EXIT, ++}; ++ + void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu); + + int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name); +diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h +index 29b6c214..bcb1bbcf 100644 +--- a/drivers/infiniband/sw/rxe/rxe_loc.h ++++ b/drivers/infiniband/sw/rxe/rxe_loc.h +@@ -72,6 +72,8 @@ int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma, + int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, + int sg_nents, unsigned int *sg_offset); + void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length); ++int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, ++ u64 compare, u64 swap_add, u64 *orig_val); + struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key, + enum rxe_mr_lookup_type type); + int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length); +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index 229c7259..df974147 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -32,13 +32,15 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length) + + case IB_MR_TYPE_USER: + case IB_MR_TYPE_MEM_REG: +- if (iova < mr->ibmr.iova || length > mr->ibmr.length || +- iova > mr->ibmr.iova + mr->ibmr.length - length) +- return -EFAULT; ++ if (iova < mr->ibmr.iova || ++ iova + length > mr->ibmr.iova + mr->ibmr.length) { ++ rxe_dbg_mr(mr, "iova/length out of range"); ++ return -EINVAL; ++ } + return 0; + + default: +- rxe_dbg_mr(mr, "type (%d) not supported\n", mr->ibmr.type); ++ rxe_dbg_mr(mr, "mr type not supported\n"); + return -EINVAL; + } + } +@@ -299,37 +301,22 @@ void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) + { + size_t offset; + int m, n; +- void *addr; + +- if (mr->state != RXE_MR_STATE_VALID) { +- rxe_dbg_mr(mr, "Not in valid state\n"); +- addr = NULL; +- goto out; +- } ++ if (mr->state != RXE_MR_STATE_VALID) ++ return NULL; + +- if (!mr->map) { +- addr = (void *)(uintptr_t)iova; +- goto out; +- } ++ if (mr->ibmr.type == IB_MR_TYPE_DMA) ++ return (void *)(uintptr_t)iova; + +- if (mr_check_range(mr, iova, length)) { +- rxe_dbg_mr(mr, "Range violation\n"); +- addr = NULL; +- goto out; +- } ++ if (mr_check_range(mr, iova, length)) ++ return NULL; + + lookup_iova(mr, iova, &m, &n, &offset); + +- if (offset + length > mr->map[m]->buf[n].size) { +- rxe_dbg_mr(mr, "Crosses page boundary\n"); +- addr = NULL; +- goto out; +- } +- +- addr = (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset; ++ if (offset + length > mr->map[m]->buf[n].size) ++ return NULL; + +-out: +- return addr; ++ return (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset; + } + + int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length) +@@ -538,6 +525,46 @@ int copy_data( + return err; + } + ++/* Guarantee atomicity of atomic operations at the machine level. */ ++static DEFINE_SPINLOCK(atomic_ops_lock); ++ ++int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, ++ u64 compare, u64 swap_add, u64 *orig_val) ++{ ++ u64 *va; ++ u64 value; ++ ++ if (mr->state != RXE_MR_STATE_VALID) { ++ rxe_dbg_mr(mr, "mr not in valid state"); ++ return RESPST_ERR_RKEY_VIOLATION; ++ } ++ ++ va = iova_to_vaddr(mr, iova, sizeof(u64)); ++ if (!va) { ++ rxe_dbg_mr(mr, "iova out of range"); ++ return RESPST_ERR_RKEY_VIOLATION; ++ } ++ ++ if ((uintptr_t)va & 0x7) { ++ rxe_dbg_mr(mr, "iova not aligned"); ++ return RESPST_ERR_MISALIGNED_ATOMIC; ++ } ++ ++ spin_lock_bh(&atomic_ops_lock); ++ value = *orig_val = *va; ++ ++ if (opcode == IB_OPCODE_RC_COMPARE_SWAP) { ++ if (value == compare) ++ *va = swap_add; ++ } else { ++ value += swap_add; ++ *va = value; ++ } ++ spin_unlock_bh(&atomic_ops_lock); ++ ++ return 0; ++} ++ + int advance_dma_data(struct rxe_dma_info *dma, unsigned int length) + { + struct rxe_sge *sge = &dma->sge[dma->cur_sge]; +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index c7497224..9d4b4e9b 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -10,43 +10,6 @@ + #include "rxe_loc.h" + #include "rxe_queue.h" + +-enum resp_states { +- RESPST_NONE, +- RESPST_GET_REQ, +- RESPST_CHK_PSN, +- RESPST_CHK_OP_SEQ, +- RESPST_CHK_OP_VALID, +- RESPST_CHK_RESOURCE, +- RESPST_CHK_LENGTH, +- RESPST_CHK_RKEY, +- RESPST_EXECUTE, +- RESPST_READ_REPLY, +- RESPST_ATOMIC_REPLY, +- RESPST_ATOMIC_WRITE_REPLY, +- RESPST_PROCESS_FLUSH, +- RESPST_COMPLETE, +- RESPST_ACKNOWLEDGE, +- RESPST_CLEANUP, +- RESPST_DUPLICATE_REQUEST, +- RESPST_ERR_MALFORMED_WQE, +- RESPST_ERR_UNSUPPORTED_OPCODE, +- RESPST_ERR_MISALIGNED_ATOMIC, +- RESPST_ERR_PSN_OUT_OF_SEQ, +- RESPST_ERR_MISSING_OPCODE_FIRST, +- RESPST_ERR_MISSING_OPCODE_LAST_C, +- RESPST_ERR_MISSING_OPCODE_LAST_D1E, +- RESPST_ERR_TOO_MANY_RDMA_ATM_REQ, +- RESPST_ERR_RNR, +- RESPST_ERR_RKEY_VIOLATION, +- RESPST_ERR_INVALIDATE_RKEY, +- RESPST_ERR_LENGTH, +- RESPST_ERR_CQ_OVERFLOW, +- RESPST_ERROR, +- RESPST_RESET, +- RESPST_DONE, +- RESPST_EXIT, +-}; +- + static char *resp_state_name[] = { + [RESPST_NONE] = "NONE", + [RESPST_GET_REQ] = "GET_REQ", +@@ -725,17 +688,12 @@ static enum resp_states process_flush(struct rxe_qp *qp, + return RESPST_ACKNOWLEDGE; + } + +-/* Guarantee atomicity of atomic operations at the machine level. */ +-static DEFINE_SPINLOCK(atomic_ops_lock); +- + static enum resp_states atomic_reply(struct rxe_qp *qp, +- struct rxe_pkt_info *pkt) ++ struct rxe_pkt_info *pkt) + { +- u64 *vaddr; +- enum resp_states ret; + struct rxe_mr *mr = qp->resp.mr; + struct resp_res *res = qp->resp.res; +- u64 value; ++ int err; + + if (!res) { + res = rxe_prepare_res(qp, pkt, RXE_ATOMIC_MASK); +@@ -743,32 +701,14 @@ static enum resp_states atomic_reply(struct rxe_qp *qp, + } + + if (!res->replay) { +- if (mr->state != RXE_MR_STATE_VALID) { +- ret = RESPST_ERR_RKEY_VIOLATION; +- goto out; +- } +- +- vaddr = iova_to_vaddr(mr, qp->resp.va + qp->resp.offset, +- sizeof(u64)); +- +- /* check vaddr is 8 bytes aligned. */ +- if (!vaddr || (uintptr_t)vaddr & 7) { +- ret = RESPST_ERR_MISALIGNED_ATOMIC; +- goto out; +- } +- +- spin_lock_bh(&atomic_ops_lock); +- res->atomic.orig_val = value = *vaddr; +- +- if (pkt->opcode == IB_OPCODE_RC_COMPARE_SWAP) { +- if (value == atmeth_comp(pkt)) +- value = atmeth_swap_add(pkt); +- } else { +- value += atmeth_swap_add(pkt); +- } ++ u64 iova = qp->resp.va + qp->resp.offset; + +- *vaddr = value; +- spin_unlock_bh(&atomic_ops_lock); ++ err = rxe_mr_do_atomic_op(mr, iova, pkt->opcode, ++ atmeth_comp(pkt), ++ atmeth_swap_add(pkt), ++ &res->atomic.orig_val); ++ if (err) ++ return err; + + qp->resp.msn++; + +@@ -780,9 +720,7 @@ static enum resp_states atomic_reply(struct rxe_qp *qp, + qp->resp.status = IB_WC_SUCCESS; + } + +- ret = RESPST_ACKNOWLEDGE; +-out: +- return ret; ++ return RESPST_ACKNOWLEDGE; + } + + #ifdef CONFIG_64BIT +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-569-RDMA-rxe-Isolate-mr-code-from-atomic_write_repl.patch b/patches.kernel.org/6.2.3-569-RDMA-rxe-Isolate-mr-code-from-atomic_write_repl.patch new file mode 100644 index 0000000..6b5cf9f --- /dev/null +++ b/patches.kernel.org/6.2.3-569-RDMA-rxe-Isolate-mr-code-from-atomic_write_repl.patch @@ -0,0 +1,186 @@ +From: Bob Pearson +Date: Thu, 19 Jan 2023 17:59:35 -0600 +Subject: [PATCH] RDMA-rxe: Isolate mr code from atomic_write_reply() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d8bdb0ebca086b5845d782e800ad2bf2a7eb4877 + +[ Upstream commit d8bdb0ebca086b5845d782e800ad2bf2a7eb4877 ] + +Isolate mr specific code from atomic_write_reply() in rxe_resp.c into +a subroutine rxe_mr_do_atomic_write() in rxe_mr.c. +Check length for atomic write operation. +Make iova_to_vaddr() static. + +Link: https://lore.kernel.org/r/20230119235936.19728-5-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/sw/rxe/rxe_loc.h | 2 +- + drivers/infiniband/sw/rxe/rxe_mr.c | 38 ++++++++++++++++- + drivers/infiniband/sw/rxe/rxe_resp.c | 61 ++++++++++------------------ + 3 files changed, 59 insertions(+), 42 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h +index bcb1bbcf..ad8bd6bd 100644 +--- a/drivers/infiniband/sw/rxe/rxe_loc.h ++++ b/drivers/infiniband/sw/rxe/rxe_loc.h +@@ -71,9 +71,9 @@ int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma, + void *addr, int length, enum rxe_mr_copy_dir dir); + int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, + int sg_nents, unsigned int *sg_offset); +-void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length); + int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, + u64 compare, u64 swap_add, u64 *orig_val); ++int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value); + struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key, + enum rxe_mr_lookup_type type); + int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length); +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index df974147..5c4ce439 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -297,7 +297,7 @@ static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, + } + } + +-void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) ++static void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) + { + size_t offset; + int m, n; +@@ -565,6 +565,42 @@ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, + return 0; + } + ++/* only implemented for 64 bit architectures */ ++#if defined CONFIG_64BIT ++int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) ++{ ++ u64 *va; ++ ++ /* See IBA oA19-28 */ ++ if (unlikely(mr->state != RXE_MR_STATE_VALID)) { ++ rxe_dbg_mr(mr, "mr not in valid state"); ++ return RESPST_ERR_RKEY_VIOLATION; ++ } ++ ++ va = iova_to_vaddr(mr, iova, sizeof(value)); ++ if (unlikely(!va)) { ++ rxe_dbg_mr(mr, "iova out of range"); ++ return RESPST_ERR_RKEY_VIOLATION; ++ } ++ ++ /* See IBA A19.4.2 */ ++ if (unlikely((uintptr_t)va & 0x7 || iova & 0x7)) { ++ rxe_dbg_mr(mr, "misaligned address"); ++ return RESPST_ERR_MISALIGNED_ATOMIC; ++ } ++ ++ /* Do atomic write after all prior operations have completed */ ++ smp_store_release(va, value); ++ ++ return 0; ++} ++#else ++int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) ++{ ++ return RESPST_ERR_UNSUPPORTED_OPCODE; ++} ++#endif ++ + int advance_dma_data(struct rxe_dma_info *dma, unsigned int length) + { + struct rxe_sge *sge = &dma->sge[dma->cur_sge]; +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index 9d4b4e9b..cd2d88de 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -723,30 +723,32 @@ static enum resp_states atomic_reply(struct rxe_qp *qp, + return RESPST_ACKNOWLEDGE; + } + +-#ifdef CONFIG_64BIT +-static enum resp_states do_atomic_write(struct rxe_qp *qp, +- struct rxe_pkt_info *pkt) ++static enum resp_states atomic_write_reply(struct rxe_qp *qp, ++ struct rxe_pkt_info *pkt) + { +- struct rxe_mr *mr = qp->resp.mr; +- int payload = payload_size(pkt); +- u64 src, *dst; +- +- if (mr->state != RXE_MR_STATE_VALID) +- return RESPST_ERR_RKEY_VIOLATION; ++ struct resp_res *res = qp->resp.res; ++ struct rxe_mr *mr; ++ u64 value; ++ u64 iova; ++ int err; + +- memcpy(&src, payload_addr(pkt), payload); ++ if (!res) { ++ res = rxe_prepare_res(qp, pkt, RXE_ATOMIC_WRITE_MASK); ++ qp->resp.res = res; ++ } + +- dst = iova_to_vaddr(mr, qp->resp.va + qp->resp.offset, payload); +- /* check vaddr is 8 bytes aligned. */ +- if (!dst || (uintptr_t)dst & 7) +- return RESPST_ERR_MISALIGNED_ATOMIC; ++ if (res->replay) ++ return RESPST_ACKNOWLEDGE; + +- /* Do atomic write after all prior operations have completed */ +- smp_store_release(dst, src); ++ mr = qp->resp.mr; ++ value = *(u64 *)payload_addr(pkt); ++ iova = qp->resp.va + qp->resp.offset; + +- /* decrease resp.resid to zero */ +- qp->resp.resid -= sizeof(payload); ++ err = rxe_mr_do_atomic_write(mr, iova, value); ++ if (err) ++ return err; + ++ qp->resp.resid = 0; + qp->resp.msn++; + + /* next expected psn, read handles this separately */ +@@ -755,29 +757,8 @@ static enum resp_states do_atomic_write(struct rxe_qp *qp, + + qp->resp.opcode = pkt->opcode; + qp->resp.status = IB_WC_SUCCESS; +- return RESPST_ACKNOWLEDGE; +-} +-#else +-static enum resp_states do_atomic_write(struct rxe_qp *qp, +- struct rxe_pkt_info *pkt) +-{ +- return RESPST_ERR_UNSUPPORTED_OPCODE; +-} +-#endif /* CONFIG_64BIT */ +- +-static enum resp_states atomic_write_reply(struct rxe_qp *qp, +- struct rxe_pkt_info *pkt) +-{ +- struct resp_res *res = qp->resp.res; + +- if (!res) { +- res = rxe_prepare_res(qp, pkt, RXE_ATOMIC_WRITE_MASK); +- qp->resp.res = res; +- } +- +- if (res->replay) +- return RESPST_ACKNOWLEDGE; +- return do_atomic_write(qp, pkt); ++ return RESPST_ACKNOWLEDGE; + } + + static struct sk_buff *prepare_ack_packet(struct rxe_qp *qp, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-570-RDMA-rxe-Cleanup-page-variables-in-rxe_mr.c.patch b/patches.kernel.org/6.2.3-570-RDMA-rxe-Cleanup-page-variables-in-rxe_mr.c.patch new file mode 100644 index 0000000..d702a04 --- /dev/null +++ b/patches.kernel.org/6.2.3-570-RDMA-rxe-Cleanup-page-variables-in-rxe_mr.c.patch @@ -0,0 +1,153 @@ +From: Bob Pearson +Date: Thu, 19 Jan 2023 17:59:36 -0600 +Subject: [PATCH] RDMA/rxe: Cleanup page variables in rxe_mr.c +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 325a7eb85199ec9c5b5a7af812f43ea16b735569 + +[ Upstream commit 325a7eb85199ec9c5b5a7af812f43ea16b735569 ] + +Cleanup usage of mr->page_shift and mr->page_mask and introduce +an extractor for mr->ibmr.page_size. Normal usage in the kernel +has page_mask masking out offset in page rather than masking out +the page number. The rxe driver had reversed that which was confusing. +Implicitly there can be a per mr page_size which was not uniformly +supported. + +Link: https://lore.kernel.org/r/20230119235936.19728-6-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/sw/rxe/rxe_mr.c | 31 ++++++++++++--------------- + drivers/infiniband/sw/rxe/rxe_verbs.h | 11 +++++++--- + 2 files changed, 22 insertions(+), 20 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index 5c4ce439..2181165e 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -62,6 +62,9 @@ static void rxe_mr_init(int access, struct rxe_mr *mr) + mr->lkey = mr->ibmr.lkey = lkey; + mr->rkey = mr->ibmr.rkey = rkey; + ++ mr->ibmr.page_size = PAGE_SIZE; ++ mr->page_mask = PAGE_MASK; ++ mr->page_shift = PAGE_SHIFT; + mr->state = RXE_MR_STATE_INVALID; + } + +@@ -151,9 +154,6 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, + goto err_release_umem; + } + +- mr->page_shift = PAGE_SHIFT; +- mr->page_mask = PAGE_SIZE - 1; +- + num_buf = 0; + map = mr->map; + if (length > 0) { +@@ -182,7 +182,7 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, + goto err_release_umem; + } + buf->addr = (uintptr_t)vaddr; +- buf->size = PAGE_SIZE; ++ buf->size = mr_page_size(mr); + num_buf++; + buf++; + +@@ -191,10 +191,9 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, + + mr->umem = umem; + mr->access = access; +- mr->offset = ib_umem_offset(umem); ++ mr->page_offset = ib_umem_offset(umem); + mr->state = RXE_MR_STATE_VALID; + mr->ibmr.type = IB_MR_TYPE_USER; +- mr->ibmr.page_size = PAGE_SIZE; + + return 0; + +@@ -248,29 +247,27 @@ int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, + int sg_nents, unsigned int *sg_offset) + { + struct rxe_mr *mr = to_rmr(ibmr); +- int n; +- +- mr->nbuf = 0; ++ unsigned int page_size = mr_page_size(mr); + +- n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); ++ mr->page_shift = ilog2(page_size); ++ mr->page_mask = ~((u64)page_size - 1); ++ mr->page_offset = ibmr->iova & (page_size - 1); + +- mr->page_shift = ilog2(ibmr->page_size); +- mr->page_mask = ibmr->page_size - 1; +- mr->offset = ibmr->iova & mr->page_mask; ++ mr->nbuf = 0; + +- return n; ++ return ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); + } + + static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, + size_t *offset_out) + { +- size_t offset = iova - mr->ibmr.iova + mr->offset; ++ size_t offset = iova - mr->ibmr.iova + mr->page_offset; + int map_index; + int buf_index; + u64 length; + + if (likely(mr->page_shift)) { +- *offset_out = offset & mr->page_mask; ++ *offset_out = offset & (mr_page_size(mr) - 1); + offset >>= mr->page_shift; + *n_out = offset & mr->map_mask; + *m_out = offset >> mr->map_shift; +@@ -329,7 +326,7 @@ int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length) + if (mr->ibmr.type == IB_MR_TYPE_DMA) + return -EFAULT; + +- offset = (iova - mr->ibmr.iova + mr->offset) & mr->page_mask; ++ offset = (iova - mr->ibmr.iova + mr->page_offset) & mr->page_mask; + while (length > 0) { + u8 *va; + int bytes; +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h +index 19ddfa89..bfc94caa 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.h ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h +@@ -310,11 +310,11 @@ struct rxe_mr { + u32 lkey; + u32 rkey; + enum rxe_mr_state state; +- u32 offset; + int access; + +- int page_shift; +- int page_mask; ++ unsigned int page_offset; ++ unsigned int page_shift; ++ u64 page_mask; + int map_shift; + int map_mask; + +@@ -329,6 +329,11 @@ struct rxe_mr { + struct rxe_map **map; + }; + ++static inline unsigned int mr_page_size(struct rxe_mr *mr) ++{ ++ return mr ? mr->ibmr.page_size : PAGE_SIZE; ++} ++ + enum rxe_mw_state { + RXE_MW_STATE_INVALID = RXE_MR_STATE_INVALID, + RXE_MW_STATE_FREE = RXE_MR_STATE_FREE, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-571-RDMA-rxe-Replace-rxe_map-and-rxe_phys_buf-by-xa.patch b/patches.kernel.org/6.2.3-571-RDMA-rxe-Replace-rxe_map-and-rxe_phys_buf-by-xa.patch new file mode 100644 index 0000000..649d237 --- /dev/null +++ b/patches.kernel.org/6.2.3-571-RDMA-rxe-Replace-rxe_map-and-rxe_phys_buf-by-xa.patch @@ -0,0 +1,820 @@ +From: Bob Pearson +Date: Thu, 19 Jan 2023 17:59:37 -0600 +Subject: [PATCH] RDMA/rxe: Replace rxe_map and rxe_phys_buf by xarray +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 592627ccbdff0ec6fff00fc761142a76db750dd4 + +[ Upstream commit 592627ccbdff0ec6fff00fc761142a76db750dd4 ] + +Replace struct rxe-phys_buf and struct rxe_map by struct xarray +in rxe_verbs.h. This allows using rcu locking on reads for +the memory maps stored in each mr. + +This is based off of a sketch of a patch from Jason Gunthorpe in the +link below. Some changes were needed to make this work. It applies +cleanly to the current for-next and passes the pyverbs, perftest +and the same blktests test cases which run today. + +Link: https://lore.kernel.org/r/20230119235936.19728-7-rpearsonhpe@gmail.com +Link: https://lore.kernel.org/linux-rdma/Y3gvZr6%2FNCii9Avy@nvidia.com/ +Co-developed-by: Jason Gunthorpe +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/sw/rxe/rxe_loc.h | 6 +- + drivers/infiniband/sw/rxe/rxe_mr.c | 529 ++++++++++++-------------- + drivers/infiniband/sw/rxe/rxe_verbs.h | 21 +- + 3 files changed, 254 insertions(+), 302 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h +index ad8bd6bd..1bb0cb47 100644 +--- a/drivers/infiniband/sw/rxe/rxe_loc.h ++++ b/drivers/infiniband/sw/rxe/rxe_loc.h +@@ -64,9 +64,9 @@ void rxe_mr_init_dma(int access, struct rxe_mr *mr); + int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, + int access, struct rxe_mr *mr); + int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr); +-int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length); +-int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length, +- enum rxe_mr_copy_dir dir); ++int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length); ++int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, ++ unsigned int length, enum rxe_mr_copy_dir dir); + int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma, + void *addr, int length, enum rxe_mr_copy_dir dir); + int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index 2181165e..c8045863 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -62,60 +62,31 @@ static void rxe_mr_init(int access, struct rxe_mr *mr) + mr->lkey = mr->ibmr.lkey = lkey; + mr->rkey = mr->ibmr.rkey = rkey; + ++ mr->access = access; + mr->ibmr.page_size = PAGE_SIZE; + mr->page_mask = PAGE_MASK; + mr->page_shift = PAGE_SHIFT; + mr->state = RXE_MR_STATE_INVALID; + } + +-static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf) +-{ +- int i; +- int num_map; +- struct rxe_map **map = mr->map; +- +- num_map = (num_buf + RXE_BUF_PER_MAP - 1) / RXE_BUF_PER_MAP; +- +- mr->map = kmalloc_array(num_map, sizeof(*map), GFP_KERNEL); +- if (!mr->map) +- goto err1; +- +- for (i = 0; i < num_map; i++) { +- mr->map[i] = kmalloc(sizeof(**map), GFP_KERNEL); +- if (!mr->map[i]) +- goto err2; +- } +- +- BUILD_BUG_ON(!is_power_of_2(RXE_BUF_PER_MAP)); +- +- mr->map_shift = ilog2(RXE_BUF_PER_MAP); +- mr->map_mask = RXE_BUF_PER_MAP - 1; +- +- mr->num_buf = num_buf; +- mr->num_map = num_map; +- mr->max_buf = num_map * RXE_BUF_PER_MAP; +- +- return 0; +- +-err2: +- for (i--; i >= 0; i--) +- kfree(mr->map[i]); +- +- kfree(mr->map); +- mr->map = NULL; +-err1: +- return -ENOMEM; +-} +- + void rxe_mr_init_dma(int access, struct rxe_mr *mr) + { + rxe_mr_init(access, mr); + +- mr->access = access; + mr->state = RXE_MR_STATE_VALID; + mr->ibmr.type = IB_MR_TYPE_DMA; + } + ++static unsigned long rxe_mr_iova_to_index(struct rxe_mr *mr, u64 iova) ++{ ++ return (iova >> mr->page_shift) - (mr->ibmr.iova >> mr->page_shift); ++} ++ ++static unsigned long rxe_mr_iova_to_page_offset(struct rxe_mr *mr, u64 iova) ++{ ++ return iova & (mr_page_size(mr) - 1); ++} ++ + static bool is_pmem_page(struct page *pg) + { + unsigned long paddr = page_to_phys(pg); +@@ -125,82 +96,98 @@ static bool is_pmem_page(struct page *pg) + IORES_DESC_PERSISTENT_MEMORY); + } + ++static int rxe_mr_fill_pages_from_sgt(struct rxe_mr *mr, struct sg_table *sgt) ++{ ++ XA_STATE(xas, &mr->page_list, 0); ++ struct sg_page_iter sg_iter; ++ struct page *page; ++ bool persistent = !!(mr->access & IB_ACCESS_FLUSH_PERSISTENT); ++ ++ __sg_page_iter_start(&sg_iter, sgt->sgl, sgt->orig_nents, 0); ++ if (!__sg_page_iter_next(&sg_iter)) ++ return 0; ++ ++ do { ++ xas_lock(&xas); ++ while (true) { ++ page = sg_page_iter_page(&sg_iter); ++ ++ if (persistent && !is_pmem_page(page)) { ++ rxe_dbg_mr(mr, "Page can't be persistent\n"); ++ xas_set_err(&xas, -EINVAL); ++ break; ++ } ++ ++ xas_store(&xas, page); ++ if (xas_error(&xas)) ++ break; ++ xas_next(&xas); ++ if (!__sg_page_iter_next(&sg_iter)) ++ break; ++ } ++ xas_unlock(&xas); ++ } while (xas_nomem(&xas, GFP_KERNEL)); ++ ++ return xas_error(&xas); ++} ++ + int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, + int access, struct rxe_mr *mr) + { +- struct rxe_map **map; +- struct rxe_phys_buf *buf = NULL; +- struct ib_umem *umem; +- struct sg_page_iter sg_iter; +- int num_buf; +- void *vaddr; ++ struct ib_umem *umem; + int err; + ++ rxe_mr_init(access, mr); ++ ++ xa_init(&mr->page_list); ++ + umem = ib_umem_get(&rxe->ib_dev, start, length, access); + if (IS_ERR(umem)) { + rxe_dbg_mr(mr, "Unable to pin memory region err = %d\n", + (int)PTR_ERR(umem)); +- err = PTR_ERR(umem); +- goto err_out; ++ return PTR_ERR(umem); + } + +- num_buf = ib_umem_num_pages(umem); +- +- rxe_mr_init(access, mr); +- +- err = rxe_mr_alloc(mr, num_buf); ++ err = rxe_mr_fill_pages_from_sgt(mr, &umem->sgt_append.sgt); + if (err) { +- rxe_dbg_mr(mr, "Unable to allocate memory for map\n"); +- goto err_release_umem; ++ ib_umem_release(umem); ++ return err; + } + +- num_buf = 0; +- map = mr->map; +- if (length > 0) { +- bool persistent_access = access & IB_ACCESS_FLUSH_PERSISTENT; +- +- buf = map[0]->buf; +- for_each_sgtable_page (&umem->sgt_append.sgt, &sg_iter, 0) { +- struct page *pg = sg_page_iter_page(&sg_iter); ++ mr->umem = umem; ++ mr->ibmr.type = IB_MR_TYPE_USER; ++ mr->state = RXE_MR_STATE_VALID; + +- if (persistent_access && !is_pmem_page(pg)) { +- rxe_dbg_mr(mr, "Unable to register persistent access to non-pmem device\n"); +- err = -EINVAL; +- goto err_release_umem; +- } ++ return 0; ++} + +- if (num_buf >= RXE_BUF_PER_MAP) { +- map++; +- buf = map[0]->buf; +- num_buf = 0; +- } ++static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf) ++{ ++ XA_STATE(xas, &mr->page_list, 0); ++ int i = 0; ++ int err; + +- vaddr = page_address(pg); +- if (!vaddr) { +- rxe_dbg_mr(mr, "Unable to get virtual address\n"); +- err = -ENOMEM; +- goto err_release_umem; +- } +- buf->addr = (uintptr_t)vaddr; +- buf->size = mr_page_size(mr); +- num_buf++; +- buf++; ++ xa_init(&mr->page_list); + ++ do { ++ xas_lock(&xas); ++ while (i != num_buf) { ++ xas_store(&xas, XA_ZERO_ENTRY); ++ if (xas_error(&xas)) ++ break; ++ xas_next(&xas); ++ i++; + } +- } ++ xas_unlock(&xas); ++ } while (xas_nomem(&xas, GFP_KERNEL)); + +- mr->umem = umem; +- mr->access = access; +- mr->page_offset = ib_umem_offset(umem); +- mr->state = RXE_MR_STATE_VALID; +- mr->ibmr.type = IB_MR_TYPE_USER; ++ err = xas_error(&xas); ++ if (err) ++ return err; + +- return 0; ++ mr->num_buf = num_buf; + +-err_release_umem: +- ib_umem_release(umem); +-err_out: +- return err; ++ return 0; + } + + int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) +@@ -214,7 +201,6 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) + if (err) + goto err1; + +- mr->max_buf = max_pages; + mr->state = RXE_MR_STATE_FREE; + mr->ibmr.type = IB_MR_TYPE_MEM_REG; + +@@ -224,206 +210,122 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) + return err; + } + +-static int rxe_set_page(struct ib_mr *ibmr, u64 addr) ++static int rxe_set_page(struct ib_mr *ibmr, u64 iova) + { + struct rxe_mr *mr = to_rmr(ibmr); +- struct rxe_map *map; +- struct rxe_phys_buf *buf; ++ struct page *page = virt_to_page(iova & mr->page_mask); ++ bool persistent = !!(mr->access & IB_ACCESS_FLUSH_PERSISTENT); ++ int err; ++ ++ if (persistent && !is_pmem_page(page)) { ++ rxe_dbg_mr(mr, "Page cannot be persistent\n"); ++ return -EINVAL; ++ } + + if (unlikely(mr->nbuf == mr->num_buf)) + return -ENOMEM; + +- map = mr->map[mr->nbuf / RXE_BUF_PER_MAP]; +- buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP]; ++ err = xa_err(xa_store(&mr->page_list, mr->nbuf, page, GFP_KERNEL)); ++ if (err) ++ return err; + +- buf->addr = addr; +- buf->size = ibmr->page_size; + mr->nbuf++; +- + return 0; + } + +-int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, ++int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sgl, + int sg_nents, unsigned int *sg_offset) + { + struct rxe_mr *mr = to_rmr(ibmr); + unsigned int page_size = mr_page_size(mr); + ++ mr->nbuf = 0; + mr->page_shift = ilog2(page_size); + mr->page_mask = ~((u64)page_size - 1); +- mr->page_offset = ibmr->iova & (page_size - 1); +- +- mr->nbuf = 0; ++ mr->page_offset = mr->ibmr.iova & (page_size - 1); + +- return ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); ++ return ib_sg_to_pages(ibmr, sgl, sg_nents, sg_offset, rxe_set_page); + } + +-static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, +- size_t *offset_out) ++static int rxe_mr_copy_xarray(struct rxe_mr *mr, u64 iova, void *addr, ++ unsigned int length, enum rxe_mr_copy_dir dir) + { +- size_t offset = iova - mr->ibmr.iova + mr->page_offset; +- int map_index; +- int buf_index; +- u64 length; +- +- if (likely(mr->page_shift)) { +- *offset_out = offset & (mr_page_size(mr) - 1); +- offset >>= mr->page_shift; +- *n_out = offset & mr->map_mask; +- *m_out = offset >> mr->map_shift; +- } else { +- map_index = 0; +- buf_index = 0; +- +- length = mr->map[map_index]->buf[buf_index].size; ++ unsigned int page_offset = rxe_mr_iova_to_page_offset(mr, iova); ++ unsigned long index = rxe_mr_iova_to_index(mr, iova); ++ unsigned int bytes; ++ struct page *page; ++ void *va; + +- while (offset >= length) { +- offset -= length; +- buf_index++; +- +- if (buf_index == RXE_BUF_PER_MAP) { +- map_index++; +- buf_index = 0; +- } +- length = mr->map[map_index]->buf[buf_index].size; +- } ++ while (length) { ++ page = xa_load(&mr->page_list, index); ++ if (!page) ++ return -EFAULT; + +- *m_out = map_index; +- *n_out = buf_index; +- *offset_out = offset; ++ bytes = min_t(unsigned int, length, ++ mr_page_size(mr) - page_offset); ++ va = kmap_local_page(page); ++ if (dir == RXE_FROM_MR_OBJ) ++ memcpy(addr, va + page_offset, bytes); ++ else ++ memcpy(va + page_offset, addr, bytes); ++ kunmap_local(va); ++ ++ page_offset = 0; ++ addr += bytes; ++ length -= bytes; ++ index++; + } +-} +- +-static void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) +-{ +- size_t offset; +- int m, n; + +- if (mr->state != RXE_MR_STATE_VALID) +- return NULL; +- +- if (mr->ibmr.type == IB_MR_TYPE_DMA) +- return (void *)(uintptr_t)iova; +- +- if (mr_check_range(mr, iova, length)) +- return NULL; +- +- lookup_iova(mr, iova, &m, &n, &offset); +- +- if (offset + length > mr->map[m]->buf[n].size) +- return NULL; +- +- return (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset; ++ return 0; + } + +-int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length) ++static void rxe_mr_copy_dma(struct rxe_mr *mr, u64 iova, void *addr, ++ unsigned int length, enum rxe_mr_copy_dir dir) + { +- size_t offset; +- +- if (length == 0) +- return 0; +- +- if (mr->ibmr.type == IB_MR_TYPE_DMA) +- return -EFAULT; +- +- offset = (iova - mr->ibmr.iova + mr->page_offset) & mr->page_mask; +- while (length > 0) { +- u8 *va; +- int bytes; +- +- bytes = mr->ibmr.page_size - offset; +- if (bytes > length) +- bytes = length; +- +- va = iova_to_vaddr(mr, iova, length); +- if (!va) +- return -EFAULT; +- +- arch_wb_cache_pmem(va, bytes); ++ unsigned int page_offset = iova & (PAGE_SIZE - 1); ++ unsigned int bytes; ++ struct page *page; ++ u8 *va; + +- length -= bytes; ++ while (length) { ++ page = virt_to_page(iova & mr->page_mask); ++ bytes = min_t(unsigned int, length, ++ PAGE_SIZE - page_offset); ++ va = kmap_local_page(page); ++ ++ if (dir == RXE_TO_MR_OBJ) ++ memcpy(va + page_offset, addr, bytes); ++ else ++ memcpy(addr, va + page_offset, bytes); ++ ++ kunmap_local(va); ++ page_offset = 0; + iova += bytes; +- offset = 0; ++ addr += bytes; ++ length -= bytes; + } +- +- return 0; + } + +-/* copy data from a range (vaddr, vaddr+length-1) to or from +- * a mr object starting at iova. +- */ +-int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length, +- enum rxe_mr_copy_dir dir) ++int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, ++ unsigned int length, enum rxe_mr_copy_dir dir) + { +- int err; +- int bytes; +- u8 *va; +- struct rxe_map **map; +- struct rxe_phys_buf *buf; +- int m; +- int i; +- size_t offset; ++ int err; + + if (length == 0) + return 0; + + if (mr->ibmr.type == IB_MR_TYPE_DMA) { +- u8 *src, *dest; +- +- src = (dir == RXE_TO_MR_OBJ) ? addr : ((void *)(uintptr_t)iova); +- +- dest = (dir == RXE_TO_MR_OBJ) ? ((void *)(uintptr_t)iova) : addr; +- +- memcpy(dest, src, length); +- ++ rxe_mr_copy_dma(mr, iova, addr, length, dir); + return 0; + } + +- WARN_ON_ONCE(!mr->map); +- + err = mr_check_range(mr, iova, length); +- if (err) { +- err = -EFAULT; +- goto err1; +- } +- +- lookup_iova(mr, iova, &m, &i, &offset); +- +- map = mr->map + m; +- buf = map[0]->buf + i; +- +- while (length > 0) { +- u8 *src, *dest; +- +- va = (u8 *)(uintptr_t)buf->addr + offset; +- src = (dir == RXE_TO_MR_OBJ) ? addr : va; +- dest = (dir == RXE_TO_MR_OBJ) ? va : addr; +- +- bytes = buf->size - offset; +- +- if (bytes > length) +- bytes = length; +- +- memcpy(dest, src, bytes); +- +- length -= bytes; +- addr += bytes; +- +- offset = 0; +- buf++; +- i++; +- +- if (i == RXE_BUF_PER_MAP) { +- i = 0; +- map++; +- buf = map[0]->buf; +- } ++ if (unlikely(err)) { ++ rxe_dbg_mr(mr, "iova out of range"); ++ return err; + } + +- return 0; +- +-err1: +- return err; ++ return rxe_mr_copy_xarray(mr, iova, addr, length, dir); + } + + /* copy data in or out of a wqe, i.e. sg list +@@ -495,7 +397,6 @@ int copy_data( + + if (bytes > 0) { + iova = sge->addr + offset; +- + err = rxe_mr_copy(mr, iova, addr, bytes, dir); + if (err) + goto err2; +@@ -522,50 +423,111 @@ int copy_data( + return err; + } + ++int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length) ++{ ++ unsigned int page_offset; ++ unsigned long index; ++ struct page *page; ++ unsigned int bytes; ++ int err; ++ u8 *va; ++ ++ if (length == 0) ++ return 0; ++ ++ if (mr->ibmr.type == IB_MR_TYPE_DMA) ++ return -EFAULT; ++ ++ err = mr_check_range(mr, iova, length); ++ if (err) ++ return err; ++ ++ while (length > 0) { ++ index = rxe_mr_iova_to_index(mr, iova); ++ page = xa_load(&mr->page_list, index); ++ page_offset = rxe_mr_iova_to_page_offset(mr, iova); ++ if (!page) ++ return -EFAULT; ++ bytes = min_t(unsigned int, length, ++ mr_page_size(mr) - page_offset); ++ ++ va = kmap_local_page(page); ++ arch_wb_cache_pmem(va + page_offset, bytes); ++ kunmap_local(va); ++ ++ length -= bytes; ++ iova += bytes; ++ page_offset = 0; ++ } ++ ++ return 0; ++} ++ + /* Guarantee atomicity of atomic operations at the machine level. */ + static DEFINE_SPINLOCK(atomic_ops_lock); + + int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, + u64 compare, u64 swap_add, u64 *orig_val) + { +- u64 *va; ++ unsigned int page_offset; ++ struct page *page; + u64 value; ++ u64 *va; + +- if (mr->state != RXE_MR_STATE_VALID) { ++ if (unlikely(mr->state != RXE_MR_STATE_VALID)) { + rxe_dbg_mr(mr, "mr not in valid state"); + return RESPST_ERR_RKEY_VIOLATION; + } + +- va = iova_to_vaddr(mr, iova, sizeof(u64)); +- if (!va) { +- rxe_dbg_mr(mr, "iova out of range"); +- return RESPST_ERR_RKEY_VIOLATION; ++ if (mr->ibmr.type == IB_MR_TYPE_DMA) { ++ page_offset = iova & (PAGE_SIZE - 1); ++ page = virt_to_page(iova & PAGE_MASK); ++ } else { ++ unsigned long index; ++ int err; ++ ++ err = mr_check_range(mr, iova, sizeof(value)); ++ if (err) { ++ rxe_dbg_mr(mr, "iova out of range"); ++ return RESPST_ERR_RKEY_VIOLATION; ++ } ++ page_offset = rxe_mr_iova_to_page_offset(mr, iova); ++ index = rxe_mr_iova_to_index(mr, iova); ++ page = xa_load(&mr->page_list, index); ++ if (!page) ++ return RESPST_ERR_RKEY_VIOLATION; + } + +- if ((uintptr_t)va & 0x7) { ++ if (unlikely(page_offset & 0x7)) { + rxe_dbg_mr(mr, "iova not aligned"); + return RESPST_ERR_MISALIGNED_ATOMIC; + } + ++ va = kmap_local_page(page); ++ + spin_lock_bh(&atomic_ops_lock); +- value = *orig_val = *va; ++ value = *orig_val = va[page_offset >> 3]; + + if (opcode == IB_OPCODE_RC_COMPARE_SWAP) { + if (value == compare) +- *va = swap_add; ++ va[page_offset >> 3] = swap_add; + } else { + value += swap_add; +- *va = value; ++ va[page_offset >> 3] = value; + } + spin_unlock_bh(&atomic_ops_lock); + ++ kunmap_local(va); ++ + return 0; + } + +-/* only implemented for 64 bit architectures */ + #if defined CONFIG_64BIT ++/* only implemented or called for 64 bit architectures */ + int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) + { ++ unsigned int page_offset; ++ struct page *page; + u64 *va; + + /* See IBA oA19-28 */ +@@ -574,20 +536,38 @@ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) + return RESPST_ERR_RKEY_VIOLATION; + } + +- va = iova_to_vaddr(mr, iova, sizeof(value)); +- if (unlikely(!va)) { +- rxe_dbg_mr(mr, "iova out of range"); +- return RESPST_ERR_RKEY_VIOLATION; ++ if (mr->ibmr.type == IB_MR_TYPE_DMA) { ++ page_offset = iova & (PAGE_SIZE - 1); ++ page = virt_to_page(iova & PAGE_MASK); ++ } else { ++ unsigned long index; ++ int err; ++ ++ /* See IBA oA19-28 */ ++ err = mr_check_range(mr, iova, sizeof(value)); ++ if (unlikely(err)) { ++ rxe_dbg_mr(mr, "iova out of range"); ++ return RESPST_ERR_RKEY_VIOLATION; ++ } ++ page_offset = rxe_mr_iova_to_page_offset(mr, iova); ++ index = rxe_mr_iova_to_index(mr, iova); ++ page = xa_load(&mr->page_list, index); ++ if (!page) ++ return RESPST_ERR_RKEY_VIOLATION; + } + + /* See IBA A19.4.2 */ +- if (unlikely((uintptr_t)va & 0x7 || iova & 0x7)) { ++ if (unlikely(page_offset & 0x7)) { + rxe_dbg_mr(mr, "misaligned address"); + return RESPST_ERR_MISALIGNED_ATOMIC; + } + ++ va = kmap_local_page(page); ++ + /* Do atomic write after all prior operations have completed */ +- smp_store_release(va, value); ++ smp_store_release(&va[page_offset >> 3], value); ++ ++ kunmap_local(va); + + return 0; + } +@@ -631,12 +611,6 @@ int advance_dma_data(struct rxe_dma_info *dma, unsigned int length) + return 0; + } + +-/* (1) find the mr corresponding to lkey/rkey +- * depending on lookup_type +- * (2) verify that the (qp) pd matches the mr pd +- * (3) verify that the mr can support the requested access +- * (4) verify that mr state is valid +- */ + struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key, + enum rxe_mr_lookup_type type) + { +@@ -757,15 +731,10 @@ int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata) + void rxe_mr_cleanup(struct rxe_pool_elem *elem) + { + struct rxe_mr *mr = container_of(elem, typeof(*mr), elem); +- int i; + + rxe_put(mr_pd(mr)); + ib_umem_release(mr->umem); + +- if (mr->map) { +- for (i = 0; i < mr->num_map; i++) +- kfree(mr->map[i]); +- +- kfree(mr->map); +- } ++ if (mr->ibmr.type != IB_MR_TYPE_DMA) ++ xa_destroy(&mr->page_list); + } +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h +index bfc94caa..c269ae2a 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.h ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h +@@ -283,17 +283,6 @@ enum rxe_mr_lookup_type { + RXE_LOOKUP_REMOTE, + }; + +-#define RXE_BUF_PER_MAP (PAGE_SIZE / sizeof(struct rxe_phys_buf)) +- +-struct rxe_phys_buf { +- u64 addr; +- u64 size; +-}; +- +-struct rxe_map { +- struct rxe_phys_buf buf[RXE_BUF_PER_MAP]; +-}; +- + static inline int rkey_is_mw(u32 rkey) + { + u32 index = rkey >> 8; +@@ -311,22 +300,16 @@ struct rxe_mr { + u32 rkey; + enum rxe_mr_state state; + int access; ++ atomic_t num_mw; + + unsigned int page_offset; + unsigned int page_shift; + u64 page_mask; +- int map_shift; +- int map_mask; + + u32 num_buf; + u32 nbuf; + +- u32 max_buf; +- u32 num_map; +- +- atomic_t num_mw; +- +- struct rxe_map **map; ++ struct xarray page_list; + }; + + static inline unsigned int mr_page_size(struct rxe_mr *mr) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-572-Subject-RDMA-rxe-Handle-zero-length-rdma.patch b/patches.kernel.org/6.2.3-572-Subject-RDMA-rxe-Handle-zero-length-rdma.patch new file mode 100644 index 0000000..2f569ed --- /dev/null +++ b/patches.kernel.org/6.2.3-572-Subject-RDMA-rxe-Handle-zero-length-rdma.patch @@ -0,0 +1,198 @@ +From: Bob Pearson +Date: Wed, 1 Feb 2023 22:42:41 -0600 +Subject: [PATCH] Subject: RDMA/rxe: Handle zero length rdma +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5ff31dfcd6d23f9c1bd5dd1a2c648ba499659357 + +[ Upstream commit 5ff31dfcd6d23f9c1bd5dd1a2c648ba499659357 ] + +Currently the rxe driver does not handle all cases of zero length rdma +operations correctly. The client does not have to provide an rkey for zero +length RDMA read or write operations so the rkey provided may be invalid +and should not be used to lookup an mr. + +This patch corrects the driver to ignore the provided rkey if the reth +length is zero for read or write operations and make sure to set the mr to +NULL. In read_reply() if length is zero rxe_recheck_mr() is not +called. Warnings are added in the routines in rxe_mr.c to catch NULL MRs +when the length is non-zero. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20230202044240.6304-1-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Reviewed-by: Daisuke Matsuda +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/sw/rxe/rxe_mr.c | 7 ++++ + drivers/infiniband/sw/rxe/rxe_resp.c | 59 +++++++++++++++++++++------- + 2 files changed, 51 insertions(+), 15 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index c8045863..5e9a0383 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -314,6 +314,9 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, + if (length == 0) + return 0; + ++ if (WARN_ON(!mr)) ++ return -EINVAL; ++ + if (mr->ibmr.type == IB_MR_TYPE_DMA) { + rxe_mr_copy_dma(mr, iova, addr, length, dir); + return 0; +@@ -432,6 +435,10 @@ int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length) + int err; + u8 *va; + ++ /* mr must be valid even if length is zero */ ++ if (WARN_ON(!mr)) ++ return -EINVAL; ++ + if (length == 0) + return 0; + +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index cd2d88de..0cc1ba91 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -420,13 +420,23 @@ static enum resp_states rxe_resp_check_length(struct rxe_qp *qp, + return RESPST_CHK_RKEY; + } + ++/* if the reth length field is zero we can assume nothing ++ * about the rkey value and should not validate or use it. ++ * Instead set qp->resp.rkey to 0 which is an invalid rkey ++ * value since the minimum index part is 1. ++ */ + static void qp_resp_from_reth(struct rxe_qp *qp, struct rxe_pkt_info *pkt) + { ++ unsigned int length = reth_len(pkt); ++ + qp->resp.va = reth_va(pkt); + qp->resp.offset = 0; +- qp->resp.rkey = reth_rkey(pkt); +- qp->resp.resid = reth_len(pkt); +- qp->resp.length = reth_len(pkt); ++ qp->resp.resid = length; ++ qp->resp.length = length; ++ if (pkt->mask & RXE_READ_OR_WRITE_MASK && length == 0) ++ qp->resp.rkey = 0; ++ else ++ qp->resp.rkey = reth_rkey(pkt); + } + + static void qp_resp_from_atmeth(struct rxe_qp *qp, struct rxe_pkt_info *pkt) +@@ -437,6 +447,10 @@ static void qp_resp_from_atmeth(struct rxe_qp *qp, struct rxe_pkt_info *pkt) + qp->resp.resid = sizeof(u64); + } + ++/* resolve the packet rkey to qp->resp.mr or set qp->resp.mr to NULL ++ * if an invalid rkey is received or the rdma length is zero. For middle ++ * or last packets use the stored value of mr. ++ */ + static enum resp_states check_rkey(struct rxe_qp *qp, + struct rxe_pkt_info *pkt) + { +@@ -473,10 +487,12 @@ static enum resp_states check_rkey(struct rxe_qp *qp, + return RESPST_EXECUTE; + } + +- /* A zero-byte op is not required to set an addr or rkey. See C9-88 */ ++ /* A zero-byte read or write op is not required to ++ * set an addr or rkey. See C9-88 ++ */ + if ((pkt->mask & RXE_READ_OR_WRITE_MASK) && +- (pkt->mask & RXE_RETH_MASK) && +- reth_len(pkt) == 0) { ++ (pkt->mask & RXE_RETH_MASK) && reth_len(pkt) == 0) { ++ qp->resp.mr = NULL; + return RESPST_EXECUTE; + } + +@@ -555,6 +571,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp, + return RESPST_EXECUTE; + + err: ++ qp->resp.mr = NULL; + if (mr) + rxe_put(mr); + if (mw) +@@ -885,7 +902,11 @@ static enum resp_states read_reply(struct rxe_qp *qp, + } + + if (res->state == rdatm_res_state_new) { +- if (!res->replay) { ++ if (!res->replay || qp->resp.length == 0) { ++ /* if length == 0 mr will be NULL (is ok) ++ * otherwise qp->resp.mr holds a ref on mr ++ * which we transfer to mr and drop below. ++ */ + mr = qp->resp.mr; + qp->resp.mr = NULL; + } else { +@@ -899,6 +920,10 @@ static enum resp_states read_reply(struct rxe_qp *qp, + else + opcode = IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST; + } else { ++ /* re-lookup mr from rkey on all later packets. ++ * length will be non-zero. This can fail if someone ++ * modifies or destroys the mr since the first packet. ++ */ + mr = rxe_recheck_mr(qp, res->read.rkey); + if (!mr) + return RESPST_ERR_RKEY_VIOLATION; +@@ -916,18 +941,16 @@ static enum resp_states read_reply(struct rxe_qp *qp, + skb = prepare_ack_packet(qp, &ack_pkt, opcode, payload, + res->cur_psn, AETH_ACK_UNLIMITED); + if (!skb) { +- if (mr) +- rxe_put(mr); +- return RESPST_ERR_RNR; ++ state = RESPST_ERR_RNR; ++ goto err_out; + } + + err = rxe_mr_copy(mr, res->read.va, payload_addr(&ack_pkt), + payload, RXE_FROM_MR_OBJ); +- if (mr) +- rxe_put(mr); + if (err) { + kfree_skb(skb); +- return RESPST_ERR_RKEY_VIOLATION; ++ state = RESPST_ERR_RKEY_VIOLATION; ++ goto err_out; + } + + if (bth_pad(&ack_pkt)) { +@@ -936,9 +959,12 @@ static enum resp_states read_reply(struct rxe_qp *qp, + memset(pad, 0, bth_pad(&ack_pkt)); + } + ++ /* rxe_xmit_packet always consumes the skb */ + err = rxe_xmit_packet(qp, &ack_pkt, skb); +- if (err) +- return RESPST_ERR_RNR; ++ if (err) { ++ state = RESPST_ERR_RNR; ++ goto err_out; ++ } + + res->read.va += payload; + res->read.resid -= payload; +@@ -955,6 +981,9 @@ static enum resp_states read_reply(struct rxe_qp *qp, + state = RESPST_CLEANUP; + } + ++err_out: ++ if (mr) ++ rxe_put(mr); + return state; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-573-RDMA-mana_ib-Fix-a-bug-when-the-PF-indicates-mo.patch b/patches.kernel.org/6.2.3-573-RDMA-mana_ib-Fix-a-bug-when-the-PF-indicates-mo.patch new file mode 100644 index 0000000..ce2241c --- /dev/null +++ b/patches.kernel.org/6.2.3-573-RDMA-mana_ib-Fix-a-bug-when-the-PF-indicates-mo.patch @@ -0,0 +1,91 @@ +From: Long Li +Date: Wed, 15 Feb 2023 16:32:02 -0800 +Subject: [PATCH] RDMA/mana_ib: Fix a bug when the PF indicates more entries + for registering memory on first packet +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 89d42b8c85b4c67d310c5ccaf491acbf71a260c3 + +[ Upstream commit 89d42b8c85b4c67d310c5ccaf491acbf71a260c3 ] + +When registering memory in a large chunk that doesn't fit into a single PF +message, the PF may return GDMA_STATUS_MORE_ENTRIES on the first message if +there are more messages needed for registering more chunks. + +Fix the VF to make it process the correct return code. + +Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") +Link: https://lore.kernel.org/r/1676507522-21018-1-git-send-email-longli@linuxonhyperv.com +Signed-off-by: Long Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/mana/main.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c +index 8b3bc302..7be4c3ad 100644 +--- a/drivers/infiniband/hw/mana/main.c ++++ b/drivers/infiniband/hw/mana/main.c +@@ -249,7 +249,8 @@ static int + mana_ib_gd_first_dma_region(struct mana_ib_dev *dev, + struct gdma_context *gc, + struct gdma_create_dma_region_req *create_req, +- size_t num_pages, mana_handle_t *gdma_region) ++ size_t num_pages, mana_handle_t *gdma_region, ++ u32 expected_status) + { + struct gdma_create_dma_region_resp create_resp = {}; + unsigned int create_req_msg_size; +@@ -261,7 +262,7 @@ mana_ib_gd_first_dma_region(struct mana_ib_dev *dev, + + err = mana_gd_send_request(gc, create_req_msg_size, create_req, + sizeof(create_resp), &create_resp); +- if (err || create_resp.hdr.status) { ++ if (err || create_resp.hdr.status != expected_status) { + ibdev_dbg(&dev->ib_dev, + "Failed to create DMA region: %d, 0x%x\n", + err, create_resp.hdr.status); +@@ -372,14 +373,21 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem, + + page_addr_list = create_req->page_addr_list; + rdma_umem_for_each_dma_block(umem, &biter, page_sz) { ++ u32 expected_status = 0; ++ + page_addr_list[tail++] = rdma_block_iter_dma_address(&biter); + if (tail < num_pages_to_handle) + continue; + ++ if (num_pages_processed + num_pages_to_handle < ++ num_pages_total) ++ expected_status = GDMA_STATUS_MORE_ENTRIES; ++ + if (!num_pages_processed) { + /* First create message */ + err = mana_ib_gd_first_dma_region(dev, gc, create_req, +- tail, gdma_region); ++ tail, gdma_region, ++ expected_status); + if (err) + goto out; + +@@ -392,14 +400,8 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem, + page_addr_list = add_req->page_addr_list; + } else { + /* Subsequent create messages */ +- u32 expected_s = 0; +- +- if (num_pages_processed + num_pages_to_handle < +- num_pages_total) +- expected_s = GDMA_STATUS_MORE_ENTRIES; +- + err = mana_ib_gd_add_dma_region(dev, gc, add_req, tail, +- expected_s); ++ expected_status); + if (err) + break; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-574-RDMA-rxe-Fix-missing-memory-barriers-in-rxe_que.patch b/patches.kernel.org/6.2.3-574-RDMA-rxe-Fix-missing-memory-barriers-in-rxe_que.patch new file mode 100644 index 0000000..717826c --- /dev/null +++ b/patches.kernel.org/6.2.3-574-RDMA-rxe-Fix-missing-memory-barriers-in-rxe_que.patch @@ -0,0 +1,329 @@ +From: Bob Pearson +Date: Tue, 14 Feb 2023 01:10:54 -0600 +Subject: [PATCH] RDMA/rxe: Fix missing memory barriers in rxe_queue.h +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a77a52385e9a761f896a88a4162e69fb7ccafe3f + +[ Upstream commit a77a52385e9a761f896a88a4162e69fb7ccafe3f ] + +An earlier patch which introduced smp_load_acquire/smp_store_release +into rxe_queue.h incorrectly assumed that surrounding spin-locks in +rxe_verbs.c around queue updates for kernel ulps was sufficient to +protect the passing of data through the queues between the ulp and +the rxe tasklets. But this was incorrect. The typical sequence was + + ulp rxe requester tasklet + ------------------------ --------------------- + spin_lock_irqsave() wqe = queue_head(queue) + if (!queue_full(q)) { if (!wqe) + spin_unlock_irqrestore return; + return -ENOMEM + } + wqe = queue_producer_addr(q) + queue_advance_consumer(queue) + queue_advance_producer(q) + spin_unlock_irqrestore() + +queue_head() calls queue_empty() which calls smp_load_acquire() +For user space apps queue_advance_producer() calls smp_store_release() +so that there is a memory barrier between the producer and the +consumer but for kernel ulps queue_advance_produce() just incremented +the producer index because the lock function is a release function. +But to work the barrier has to come between filling in the wqe and +updating the producer index. This patch adds the missing barriers. +It also changes the enum names for the ulp queue types to + QUEUE_TYPE_FROM/TO_ULP instead of QUEUE_TYPE_TO/FROM_DRIVER +which is very ambiguous. This bug is suspected as the cause of very +rare lockups in a very high scale storage application. It is a bug +in any case and should be corrected. + +Fixes: 0a67c46d2e99 ("RDMA/rxe: Protect user space index loads/stores") +Link: https://lore.kernel.org/r/20230214071053.5395-1-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/sw/rxe/rxe_queue.h | 108 ++++++++++++++++---------- + drivers/infiniband/sw/rxe/rxe_verbs.c | 20 ++--- + 2 files changed, 76 insertions(+), 52 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_queue.h b/drivers/infiniband/sw/rxe/rxe_queue.h +index ed440427..c711cb98 100644 +--- a/drivers/infiniband/sw/rxe/rxe_queue.h ++++ b/drivers/infiniband/sw/rxe/rxe_queue.h +@@ -35,19 +35,26 @@ + /** + * enum queue_type - type of queue + * @QUEUE_TYPE_TO_CLIENT: Queue is written by rxe driver and +- * read by client. Used by rxe driver only. ++ * read by client which may be a user space ++ * application or a kernel ulp. ++ * Used by rxe internals only. + * @QUEUE_TYPE_FROM_CLIENT: Queue is written by client and +- * read by rxe driver. Used by rxe driver only. +- * @QUEUE_TYPE_TO_DRIVER: Queue is written by client and +- * read by rxe driver. Used by kernel client only. +- * @QUEUE_TYPE_FROM_DRIVER: Queue is written by rxe driver and +- * read by client. Used by kernel client only. ++ * read by rxe driver. ++ * Used by rxe internals only. ++ * @QUEUE_TYPE_FROM_ULP: Queue is written by kernel ulp and ++ * read by rxe driver. ++ * Used by kernel verbs APIs only on ++ * behalf of ulps. ++ * @QUEUE_TYPE_TO_ULP: Queue is written by rxe driver and ++ * read by kernel ulp. ++ * Used by kernel verbs APIs only on ++ * behalf of ulps. + */ + enum queue_type { + QUEUE_TYPE_TO_CLIENT, + QUEUE_TYPE_FROM_CLIENT, +- QUEUE_TYPE_TO_DRIVER, +- QUEUE_TYPE_FROM_DRIVER, ++ QUEUE_TYPE_FROM_ULP, ++ QUEUE_TYPE_TO_ULP, + }; + + struct rxe_queue_buf; +@@ -62,9 +69,9 @@ struct rxe_queue { + u32 index_mask; + enum queue_type type; + /* private copy of index for shared queues between +- * kernel space and user space. Kernel reads and writes ++ * driver and clients. Driver reads and writes + * this copy and then replicates to rxe_queue_buf +- * for read access by user space. ++ * for read access by clients. + */ + u32 index; + }; +@@ -97,19 +104,21 @@ static inline u32 queue_get_producer(const struct rxe_queue *q, + + switch (type) { + case QUEUE_TYPE_FROM_CLIENT: +- /* protect user index */ ++ /* used by rxe, client owns the index */ + prod = smp_load_acquire(&q->buf->producer_index); + break; + case QUEUE_TYPE_TO_CLIENT: ++ /* used by rxe which owns the index */ + prod = q->index; + break; +- case QUEUE_TYPE_FROM_DRIVER: +- /* protect driver index */ +- prod = smp_load_acquire(&q->buf->producer_index); +- break; +- case QUEUE_TYPE_TO_DRIVER: ++ case QUEUE_TYPE_FROM_ULP: ++ /* used by ulp which owns the index */ + prod = q->buf->producer_index; + break; ++ case QUEUE_TYPE_TO_ULP: ++ /* used by ulp, rxe owns the index */ ++ prod = smp_load_acquire(&q->buf->producer_index); ++ break; + } + + return prod; +@@ -122,19 +131,21 @@ static inline u32 queue_get_consumer(const struct rxe_queue *q, + + switch (type) { + case QUEUE_TYPE_FROM_CLIENT: ++ /* used by rxe which owns the index */ + cons = q->index; + break; + case QUEUE_TYPE_TO_CLIENT: +- /* protect user index */ ++ /* used by rxe, client owns the index */ + cons = smp_load_acquire(&q->buf->consumer_index); + break; +- case QUEUE_TYPE_FROM_DRIVER: +- cons = q->buf->consumer_index; +- break; +- case QUEUE_TYPE_TO_DRIVER: +- /* protect driver index */ ++ case QUEUE_TYPE_FROM_ULP: ++ /* used by ulp, rxe owns the index */ + cons = smp_load_acquire(&q->buf->consumer_index); + break; ++ case QUEUE_TYPE_TO_ULP: ++ /* used by ulp which owns the index */ ++ cons = q->buf->consumer_index; ++ break; + } + + return cons; +@@ -172,24 +183,31 @@ static inline void queue_advance_producer(struct rxe_queue *q, + + switch (type) { + case QUEUE_TYPE_FROM_CLIENT: +- pr_warn("%s: attempt to advance client index\n", +- __func__); ++ /* used by rxe, client owns the index */ ++ if (WARN_ON(1)) ++ pr_warn("%s: attempt to advance client index\n", ++ __func__); + break; + case QUEUE_TYPE_TO_CLIENT: ++ /* used by rxe which owns the index */ + prod = q->index; + prod = (prod + 1) & q->index_mask; + q->index = prod; +- /* protect user index */ ++ /* release so client can read it safely */ + smp_store_release(&q->buf->producer_index, prod); + break; +- case QUEUE_TYPE_FROM_DRIVER: +- pr_warn("%s: attempt to advance driver index\n", +- __func__); +- break; +- case QUEUE_TYPE_TO_DRIVER: ++ case QUEUE_TYPE_FROM_ULP: ++ /* used by ulp which owns the index */ + prod = q->buf->producer_index; + prod = (prod + 1) & q->index_mask; +- q->buf->producer_index = prod; ++ /* release so rxe can read it safely */ ++ smp_store_release(&q->buf->producer_index, prod); ++ break; ++ case QUEUE_TYPE_TO_ULP: ++ /* used by ulp, rxe owns the index */ ++ if (WARN_ON(1)) ++ pr_warn("%s: attempt to advance driver index\n", ++ __func__); + break; + } + } +@@ -201,24 +219,30 @@ static inline void queue_advance_consumer(struct rxe_queue *q, + + switch (type) { + case QUEUE_TYPE_FROM_CLIENT: +- cons = q->index; +- cons = (cons + 1) & q->index_mask; ++ /* used by rxe which owns the index */ ++ cons = (q->index + 1) & q->index_mask; + q->index = cons; +- /* protect user index */ ++ /* release so client can read it safely */ + smp_store_release(&q->buf->consumer_index, cons); + break; + case QUEUE_TYPE_TO_CLIENT: +- pr_warn("%s: attempt to advance client index\n", +- __func__); ++ /* used by rxe, client owns the index */ ++ if (WARN_ON(1)) ++ pr_warn("%s: attempt to advance client index\n", ++ __func__); ++ break; ++ case QUEUE_TYPE_FROM_ULP: ++ /* used by ulp, rxe owns the index */ ++ if (WARN_ON(1)) ++ pr_warn("%s: attempt to advance driver index\n", ++ __func__); + break; +- case QUEUE_TYPE_FROM_DRIVER: ++ case QUEUE_TYPE_TO_ULP: ++ /* used by ulp which owns the index */ + cons = q->buf->consumer_index; + cons = (cons + 1) & q->index_mask; +- q->buf->consumer_index = cons; +- break; +- case QUEUE_TYPE_TO_DRIVER: +- pr_warn("%s: attempt to advance driver index\n", +- __func__); ++ /* release so rxe can read it safely */ ++ smp_store_release(&q->buf->consumer_index, cons); + break; + } + } +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 7a902e0a..a3aee247 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -245,7 +245,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) + int num_sge = ibwr->num_sge; + int full; + +- full = queue_full(rq->queue, QUEUE_TYPE_TO_DRIVER); ++ full = queue_full(rq->queue, QUEUE_TYPE_FROM_ULP); + if (unlikely(full)) + return -ENOMEM; + +@@ -256,7 +256,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) + for (i = 0; i < num_sge; i++) + length += ibwr->sg_list[i].length; + +- recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_TO_DRIVER); ++ recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_FROM_ULP); + recv_wqe->wr_id = ibwr->wr_id; + + memcpy(recv_wqe->dma.sge, ibwr->sg_list, +@@ -268,7 +268,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) + recv_wqe->dma.cur_sge = 0; + recv_wqe->dma.sge_offset = 0; + +- queue_advance_producer(rq->queue, QUEUE_TYPE_TO_DRIVER); ++ queue_advance_producer(rq->queue, QUEUE_TYPE_FROM_ULP); + + return 0; + } +@@ -623,17 +623,17 @@ static int post_one_send(struct rxe_qp *qp, const struct ib_send_wr *ibwr, + + spin_lock_irqsave(&qp->sq.sq_lock, flags); + +- full = queue_full(sq->queue, QUEUE_TYPE_TO_DRIVER); ++ full = queue_full(sq->queue, QUEUE_TYPE_FROM_ULP); + + if (unlikely(full)) { + spin_unlock_irqrestore(&qp->sq.sq_lock, flags); + return -ENOMEM; + } + +- send_wqe = queue_producer_addr(sq->queue, QUEUE_TYPE_TO_DRIVER); ++ send_wqe = queue_producer_addr(sq->queue, QUEUE_TYPE_FROM_ULP); + init_send_wqe(qp, ibwr, mask, length, send_wqe); + +- queue_advance_producer(sq->queue, QUEUE_TYPE_TO_DRIVER); ++ queue_advance_producer(sq->queue, QUEUE_TYPE_FROM_ULP); + + spin_unlock_irqrestore(&qp->sq.sq_lock, flags); + +@@ -821,12 +821,12 @@ static int rxe_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc) + + spin_lock_irqsave(&cq->cq_lock, flags); + for (i = 0; i < num_entries; i++) { +- cqe = queue_head(cq->queue, QUEUE_TYPE_FROM_DRIVER); ++ cqe = queue_head(cq->queue, QUEUE_TYPE_TO_ULP); + if (!cqe) + break; + + memcpy(wc++, &cqe->ibwc, sizeof(*wc)); +- queue_advance_consumer(cq->queue, QUEUE_TYPE_FROM_DRIVER); ++ queue_advance_consumer(cq->queue, QUEUE_TYPE_TO_ULP); + } + spin_unlock_irqrestore(&cq->cq_lock, flags); + +@@ -838,7 +838,7 @@ static int rxe_peek_cq(struct ib_cq *ibcq, int wc_cnt) + struct rxe_cq *cq = to_rcq(ibcq); + int count; + +- count = queue_count(cq->queue, QUEUE_TYPE_FROM_DRIVER); ++ count = queue_count(cq->queue, QUEUE_TYPE_TO_ULP); + + return (count > wc_cnt) ? wc_cnt : count; + } +@@ -854,7 +854,7 @@ static int rxe_req_notify_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags) + if (cq->notify != IB_CQ_NEXT_COMP) + cq->notify = flags & IB_CQ_SOLICITED_MASK; + +- empty = queue_empty(cq->queue, QUEUE_TYPE_FROM_DRIVER); ++ empty = queue_empty(cq->queue, QUEUE_TYPE_TO_ULP); + + if ((flags & IB_CQ_REPORT_MISSED_EVENTS) && !empty) + ret = 1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-575-IB-hfi1-Fix-math-bugs-in-hfi1_can_pin_pages.patch b/patches.kernel.org/6.2.3-575-IB-hfi1-Fix-math-bugs-in-hfi1_can_pin_pages.patch new file mode 100644 index 0000000..3e5ee35 --- /dev/null +++ b/patches.kernel.org/6.2.3-575-IB-hfi1-Fix-math-bugs-in-hfi1_can_pin_pages.patch @@ -0,0 +1,106 @@ +From: Patrick Kelsey +Date: Thu, 16 Feb 2023 11:56:23 -0500 +Subject: [PATCH] IB/hfi1: Fix math bugs in hfi1_can_pin_pages() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a0d198f79a8d033bd46605b779859193649f1f99 + +[ Upstream commit a0d198f79a8d033bd46605b779859193649f1f99 ] + +Fix arithmetic and logic errors in hfi1_can_pin_pages() that would allow +hfi1 to attempt pinning pages in cases where it should not because of +resource limits or lack of required capability. + +Fixes: 2c97ce4f3c29 ("IB/hfi1: Add pin query function") +Link: https://lore.kernel.org/r/167656658362.2223096.10954762619837718026.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/hfi1/user_pages.c | 61 ++++++++++++++++--------- + 1 file changed, 40 insertions(+), 21 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_pages.c b/drivers/infiniband/hw/hfi1/user_pages.c +index 7bce963e..36aaedc6 100644 +--- a/drivers/infiniband/hw/hfi1/user_pages.c ++++ b/drivers/infiniband/hw/hfi1/user_pages.c +@@ -29,33 +29,52 @@ MODULE_PARM_DESC(cache_size, "Send and receive side cache size limit (in MB)"); + bool hfi1_can_pin_pages(struct hfi1_devdata *dd, struct mm_struct *mm, + u32 nlocked, u32 npages) + { +- unsigned long ulimit = rlimit(RLIMIT_MEMLOCK), pinned, cache_limit, +- size = (cache_size * (1UL << 20)); /* convert to bytes */ +- unsigned int usr_ctxts = +- dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt; +- bool can_lock = capable(CAP_IPC_LOCK); ++ unsigned long ulimit_pages; ++ unsigned long cache_limit_pages; ++ unsigned int usr_ctxts; + + /* +- * Calculate per-cache size. The calculation below uses only a quarter +- * of the available per-context limit. This leaves space for other +- * pinning. Should we worry about shared ctxts? ++ * Perform RLIMIT_MEMLOCK based checks unless CAP_IPC_LOCK is present. + */ +- cache_limit = (ulimit / usr_ctxts) / 4; +- +- /* If ulimit isn't set to "unlimited" and is smaller than cache_size. */ +- if (ulimit != (-1UL) && size > cache_limit) +- size = cache_limit; +- +- /* Convert to number of pages */ +- size = DIV_ROUND_UP(size, PAGE_SIZE); +- +- pinned = atomic64_read(&mm->pinned_vm); ++ if (!capable(CAP_IPC_LOCK)) { ++ ulimit_pages = ++ DIV_ROUND_DOWN_ULL(rlimit(RLIMIT_MEMLOCK), PAGE_SIZE); ++ ++ /* ++ * Pinning these pages would exceed this process's locked memory ++ * limit. ++ */ ++ if (atomic64_read(&mm->pinned_vm) + npages > ulimit_pages) ++ return false; ++ ++ /* ++ * Only allow 1/4 of the user's RLIMIT_MEMLOCK to be used for HFI ++ * caches. This fraction is then equally distributed among all ++ * existing user contexts. Note that if RLIMIT_MEMLOCK is ++ * 'unlimited' (-1), the value of this limit will be > 2^42 pages ++ * (2^64 / 2^12 / 2^8 / 2^2). ++ * ++ * The effectiveness of this check may be reduced if I/O occurs on ++ * some user contexts before all user contexts are created. This ++ * check assumes that this process is the only one using this ++ * context (e.g., the corresponding fd was not passed to another ++ * process for concurrent access) as there is no per-context, ++ * per-process tracking of pinned pages. It also assumes that each ++ * user context has only one cache to limit. ++ */ ++ usr_ctxts = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt; ++ if (nlocked + npages > (ulimit_pages / usr_ctxts / 4)) ++ return false; ++ } + +- /* First, check the absolute limit against all pinned pages. */ +- if (pinned + npages >= ulimit && !can_lock) ++ /* ++ * Pinning these pages would exceed the size limit for this cache. ++ */ ++ cache_limit_pages = cache_size * (1024 * 1024) / PAGE_SIZE; ++ if (nlocked + npages > cache_limit_pages) + return false; + +- return ((nlocked + npages) <= size) || can_lock; ++ return true; + } + + int hfi1_acquire_user_pages(struct mm_struct *mm, unsigned long vaddr, size_t npages, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-576-IB-hfi1-Fix-sdma.h-tx-num_descs-off-by-one-erro.patch b/patches.kernel.org/6.2.3-576-IB-hfi1-Fix-sdma.h-tx-num_descs-off-by-one-erro.patch new file mode 100644 index 0000000..b7e86a3 --- /dev/null +++ b/patches.kernel.org/6.2.3-576-IB-hfi1-Fix-sdma.h-tx-num_descs-off-by-one-erro.patch @@ -0,0 +1,111 @@ +From: Patrick Kelsey +Date: Thu, 16 Feb 2023 11:56:28 -0500 +Subject: [PATCH] IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fd8958efe8779d3db19c9124fce593ce681ac709 + +[ Upstream commit fd8958efe8779d3db19c9124fce593ce681ac709 ] + +Fix three sources of error involving struct sdma_txreq.num_descs. + +When _extend_sdma_tx_descs() extends the descriptor array, it uses the +value of tx->num_descs to determine how many existing entries from the +tx's original, internal descriptor array to copy to the newly allocated +one. As this value was incremented before the call, the copy loop will +access one entry past the internal descriptor array, copying its contents +into the corresponding slot in the new array. + +If the call to _extend_sdma_tx_descs() fails, _pad_smda_tx_descs() then +invokes __sdma_tx_clean() which uses the value of tx->num_desc to drive a +loop that unmaps all descriptor entries in use. As this value was +incremented before the call, the unmap loop will invoke sdma_unmap_desc() +on a descriptor entry whose contents consist of whatever random data was +copied into it during (1), leading to cascading further calls into the +kernel and driver using arbitrary data. + +_sdma_close_tx() was using tx->num_descs instead of tx->num_descs - 1. + +Fix all of the above by: +- Only increment .num_descs after .descp is extended. +- Use .num_descs - 1 instead of .num_descs for last .descp entry. + +Fixes: f4d26d81ad7f ("staging/rdma/hfi1: Add coalescing support for SDMA TX descriptors") +Link: https://lore.kernel.org/r/167656658879.2223096.10026561343022570690.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/infiniband/hw/hfi1/sdma.c | 4 ++-- + drivers/infiniband/hw/hfi1/sdma.h | 15 +++++++-------- + 2 files changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index a95b654f..8ed20392 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -3160,8 +3160,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + { + int rval = 0; + +- tx->num_desc++; +- if ((unlikely(tx->num_desc == tx->desc_limit))) { ++ if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) { + rval = _extend_sdma_tx_descs(dd, tx); + if (rval) { + __sdma_txclean(dd, tx); +@@ -3174,6 +3173,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + SDMA_MAP_NONE, + dd->sdma_pad_phys, + sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1))); ++ tx->num_desc++; + _sdma_close_tx(dd, tx); + return rval; + } +diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h +index d8170fcb..b023fc46 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.h ++++ b/drivers/infiniband/hw/hfi1/sdma.h +@@ -631,14 +631,13 @@ static inline void sdma_txclean(struct hfi1_devdata *dd, struct sdma_txreq *tx) + static inline void _sdma_close_tx(struct hfi1_devdata *dd, + struct sdma_txreq *tx) + { +- tx->descp[tx->num_desc].qw[0] |= +- SDMA_DESC0_LAST_DESC_FLAG; +- tx->descp[tx->num_desc].qw[1] |= +- dd->default_desc1; ++ u16 last_desc = tx->num_desc - 1; ++ ++ tx->descp[last_desc].qw[0] |= SDMA_DESC0_LAST_DESC_FLAG; ++ tx->descp[last_desc].qw[1] |= dd->default_desc1; + if (tx->flags & SDMA_TXREQ_F_URGENT) +- tx->descp[tx->num_desc].qw[1] |= +- (SDMA_DESC1_HEAD_TO_HOST_FLAG | +- SDMA_DESC1_INT_REQ_FLAG); ++ tx->descp[last_desc].qw[1] |= (SDMA_DESC1_HEAD_TO_HOST_FLAG | ++ SDMA_DESC1_INT_REQ_FLAG); + } + + static inline int _sdma_txadd_daddr( +@@ -655,6 +654,7 @@ static inline int _sdma_txadd_daddr( + type, + addr, len); + WARN_ON(len > tx->tlen); ++ tx->num_desc++; + tx->tlen -= len; + /* special cases for last */ + if (!tx->tlen) { +@@ -666,7 +666,6 @@ static inline int _sdma_txadd_daddr( + _sdma_close_tx(dd, tx); + } + } +- tx->num_desc++; + return rval; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-577-Revert-remoteproc-qcom_q6v5_mss-map-unmap-metad.patch b/patches.kernel.org/6.2.3-577-Revert-remoteproc-qcom_q6v5_mss-map-unmap-metad.patch new file mode 100644 index 0000000..5d0b98f --- /dev/null +++ b/patches.kernel.org/6.2.3-577-Revert-remoteproc-qcom_q6v5_mss-map-unmap-metad.patch @@ -0,0 +1,120 @@ +From: Christoph Hellwig +Date: Tue, 17 Jan 2023 14:28:34 +0530 +Subject: [PATCH] Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region + before/after use" +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a899d542b687c9b04ccbd9eefabc829ba5fef791 + +[ Upstream commit a899d542b687c9b04ccbd9eefabc829ba5fef791 ] + +This reverts commit fc156629b23a21181e473e60341e3a78af25a1d4. + +This commit manages to do three API violations at once: + + - dereference the return value of dma_alloc_attrs with the + DMA_ATTR_NO_KERNEL_MAPPING mapping, which is clearly forbidden and + will do the wrong thing on various dma mapping implementations. The + fact that dma-direct uses a struct page as a cookie is an undocumented + implementation detail + - include dma-map-ops.h and use pgprot_dmacoherent despite a clear + comment documenting that this is not acceptable + - use of the VM_DMA_COHERENT for something that is not the dma-mapping + code + - use of VM_FLUSH_RESET_PERMS for vmap, while it is only supported for + vmalloc + +Acked-by: Manivannan Sadhasivam +Signed-off-by: Christoph Hellwig +Signed-off-by: Sibi Sankar +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230117085840.32356-6-quic_sibis@quicinc.com +Stable-dep-of: 57f72170a2b2 ("remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/remoteproc/qcom_q6v5_mss.c | 38 +++++------------------------- + 1 file changed, 6 insertions(+), 32 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c +index fddb63cf..a8b141db 100644 +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -10,7 +10,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -933,52 +932,27 @@ static void q6v5proc_halt_axi_port(struct q6v5 *qproc, + static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, + const char *fw_name) + { +- unsigned long dma_attrs = DMA_ATTR_FORCE_CONTIGUOUS | DMA_ATTR_NO_KERNEL_MAPPING; +- unsigned long flags = VM_DMA_COHERENT | VM_FLUSH_RESET_PERMS; +- struct page **pages; +- struct page *page; ++ unsigned long dma_attrs = DMA_ATTR_FORCE_CONTIGUOUS; + dma_addr_t phys; + void *metadata; + int mdata_perm; + int xferop_ret; + size_t size; +- void *vaddr; +- int count; ++ void *ptr; + int ret; +- int i; + + metadata = qcom_mdt_read_metadata(fw, &size, fw_name, qproc->dev); + if (IS_ERR(metadata)) + return PTR_ERR(metadata); + +- page = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); +- if (!page) { ++ ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); ++ if (!ptr) { + kfree(metadata); + dev_err(qproc->dev, "failed to allocate mdt buffer\n"); + return -ENOMEM; + } + +- count = PAGE_ALIGN(size) >> PAGE_SHIFT; +- pages = kmalloc_array(count, sizeof(struct page *), GFP_KERNEL); +- if (!pages) { +- ret = -ENOMEM; +- goto free_dma_attrs; +- } +- +- for (i = 0; i < count; i++) +- pages[i] = nth_page(page, i); +- +- vaddr = vmap(pages, count, flags, pgprot_dmacoherent(PAGE_KERNEL)); +- kfree(pages); +- if (!vaddr) { +- dev_err(qproc->dev, "unable to map memory region: %pa+%zx\n", &phys, size); +- ret = -EBUSY; +- goto free_dma_attrs; +- } +- +- memcpy(vaddr, metadata, size); +- +- vunmap(vaddr); ++ memcpy(ptr, metadata, size); + + /* Hypervisor mapping to access metadata by modem */ + mdata_perm = BIT(QCOM_SCM_VMID_HLOS); +@@ -1008,7 +982,7 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, + "mdt buffer not reclaimed system may become unstable\n"); + + free_dma_attrs: +- dma_free_attrs(qproc->dev, size, page, phys, dma_attrs); ++ dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); + kfree(metadata); + + return ret < 0 ? ret : 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-578-remoteproc-qcom_q6v5_mss-Use-a-carveout-to-auth.patch b/patches.kernel.org/6.2.3-578-remoteproc-qcom_q6v5_mss-Use-a-carveout-to-auth.patch new file mode 100644 index 0000000..97c890b --- /dev/null +++ b/patches.kernel.org/6.2.3-578-remoteproc-qcom_q6v5_mss-Use-a-carveout-to-auth.patch @@ -0,0 +1,140 @@ +From: Sibi Sankar +Date: Tue, 17 Jan 2023 14:28:35 +0530 +Subject: [PATCH] remoteproc: qcom_q6v5_mss: Use a carveout to authenticate + modem headers +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 57f72170a2b2a362c35bb9407fc844eac5afdec1 + +[ Upstream commit 57f72170a2b2a362c35bb9407fc844eac5afdec1 ] + +Any access to the dynamically allocated metadata region by the application +processor after assigning it to the remote Q6 will result in a XPU +violation. Fix this by replacing the dynamically allocated memory region +with a no-map carveout and unmap the modem metadata memory region before +passing control to the remote Q6. + +Reported-and-tested-by: Amit Pundir +Fixes: 6c5a9dc2481b ("remoteproc: qcom: Make secure world call for mem ownership switch") +Signed-off-by: Sibi Sankar +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230117085840.32356-7-quic_sibis@quicinc.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/remoteproc/qcom_q6v5_mss.c | 59 +++++++++++++++++++++++++++--- + 1 file changed, 53 insertions(+), 6 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c +index a8b141db..7dbab5fc 100644 +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -210,6 +211,9 @@ struct q6v5 { + size_t mba_size; + size_t dp_size; + ++ phys_addr_t mdata_phys; ++ size_t mdata_size; ++ + phys_addr_t mpss_phys; + phys_addr_t mpss_reloc; + size_t mpss_size; +@@ -945,15 +949,35 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, + if (IS_ERR(metadata)) + return PTR_ERR(metadata); + +- ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); +- if (!ptr) { +- kfree(metadata); +- dev_err(qproc->dev, "failed to allocate mdt buffer\n"); +- return -ENOMEM; ++ if (qproc->mdata_phys) { ++ if (size > qproc->mdata_size) { ++ ret = -EINVAL; ++ dev_err(qproc->dev, "metadata size outside memory range\n"); ++ goto free_metadata; ++ } ++ ++ phys = qproc->mdata_phys; ++ ptr = memremap(qproc->mdata_phys, size, MEMREMAP_WC); ++ if (!ptr) { ++ ret = -EBUSY; ++ dev_err(qproc->dev, "unable to map memory region: %pa+%zx\n", ++ &qproc->mdata_phys, size); ++ goto free_metadata; ++ } ++ } else { ++ ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); ++ if (!ptr) { ++ ret = -ENOMEM; ++ dev_err(qproc->dev, "failed to allocate mdt buffer\n"); ++ goto free_metadata; ++ } + } + + memcpy(ptr, metadata, size); + ++ if (qproc->mdata_phys) ++ memunmap(ptr); ++ + /* Hypervisor mapping to access metadata by modem */ + mdata_perm = BIT(QCOM_SCM_VMID_HLOS); + ret = q6v5_xfer_mem_ownership(qproc, &mdata_perm, false, true, +@@ -982,7 +1006,9 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, + "mdt buffer not reclaimed system may become unstable\n"); + + free_dma_attrs: +- dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); ++ if (!qproc->mdata_phys) ++ dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); ++free_metadata: + kfree(metadata); + + return ret < 0 ? ret : 0; +@@ -1810,6 +1836,7 @@ static int q6v5_init_reset(struct q6v5 *qproc) + static int q6v5_alloc_memory_region(struct q6v5 *qproc) + { + struct device_node *child; ++ struct reserved_mem *rmem; + struct device_node *node; + struct resource r; + int ret; +@@ -1856,6 +1883,26 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc) + qproc->mpss_phys = qproc->mpss_reloc = r.start; + qproc->mpss_size = resource_size(&r); + ++ if (!child) { ++ node = of_parse_phandle(qproc->dev->of_node, "memory-region", 2); ++ } else { ++ child = of_get_child_by_name(qproc->dev->of_node, "metadata"); ++ node = of_parse_phandle(child, "memory-region", 0); ++ of_node_put(child); ++ } ++ ++ if (!node) ++ return 0; ++ ++ rmem = of_reserved_mem_lookup(node); ++ if (!rmem) { ++ dev_err(qproc->dev, "unable to resolve metadata region\n"); ++ return -EINVAL; ++ } ++ ++ qproc->mdata_phys = rmem->base; ++ qproc->mdata_size = rmem->size; ++ + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-579-media-ti-cal-fix-possible-memory-leak-in-cal_ct.patch b/patches.kernel.org/6.2.3-579-media-ti-cal-fix-possible-memory-leak-in-cal_ct.patch new file mode 100644 index 0000000..f468310 --- /dev/null +++ b/patches.kernel.org/6.2.3-579-media-ti-cal-fix-possible-memory-leak-in-cal_ct.patch @@ -0,0 +1,42 @@ +From: Gaosheng Cui +Date: Tue, 29 Nov 2022 12:01:59 +0100 +Subject: [PATCH] media: ti: cal: fix possible memory leak in cal_ctx_create() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7acd650a0484d92985a0d6d867d980c6dd019885 + +[ Upstream commit 7acd650a0484d92985a0d6d867d980c6dd019885 ] + +The memory of ctx is allocated in cal_ctx_create(), but it will +not be freed when cal_ctx_v4l2_init() fails, so add kfree() when +cal_ctx_v4l2_init() fails to fix it. + +Fixes: d68a94e98a89 ("media: ti-vpe: cal: Split video device initialization and registration") +Signed-off-by: Gaosheng Cui +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/platform/ti/cal/cal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/ti/cal/cal.c b/drivers/media/platform/ti/cal/cal.c +index 56b61c05..1236215e 100644 +--- a/drivers/media/platform/ti/cal/cal.c ++++ b/drivers/media/platform/ti/cal/cal.c +@@ -1050,8 +1050,10 @@ static struct cal_ctx *cal_ctx_create(struct cal_dev *cal, int inst) + ctx->cport = inst; + + ret = cal_ctx_v4l2_init(ctx); +- if (ret) ++ if (ret) { ++ kfree(ctx); + return NULL; ++ } + + return ctx; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-580-media-platform-ti-Add-missing-check-for-devm_re.patch b/patches.kernel.org/6.2.3-580-media-platform-ti-Add-missing-check-for-devm_re.patch new file mode 100644 index 0000000..b93df10 --- /dev/null +++ b/patches.kernel.org/6.2.3-580-media-platform-ti-Add-missing-check-for-devm_re.patch @@ -0,0 +1,46 @@ +From: Jiasheng Jiang +Date: Wed, 4 Jan 2023 09:55:37 +0100 +Subject: [PATCH] media: platform: ti: Add missing check for devm_regulator_get +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: da8e05f84a11c3cc3b0ba0a3c62d20e358002d99 + +[ Upstream commit da8e05f84a11c3cc3b0ba0a3c62d20e358002d99 ] + +Add check for the return value of devm_regulator_get since it may return +error pointer. + +Fixes: 448de7e7850b ("[media] omap3isp: OMAP3 ISP core") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/platform/ti/omap3isp/isp.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/media/platform/ti/omap3isp/isp.c b/drivers/media/platform/ti/omap3isp/isp.c +index 1d40bb59..e7327e38 100644 +--- a/drivers/media/platform/ti/omap3isp/isp.c ++++ b/drivers/media/platform/ti/omap3isp/isp.c +@@ -2307,7 +2307,16 @@ static int isp_probe(struct platform_device *pdev) + + /* Regulators */ + isp->isp_csiphy1.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy1"); ++ if (IS_ERR(isp->isp_csiphy1.vdd)) { ++ ret = PTR_ERR(isp->isp_csiphy1.vdd); ++ goto error; ++ } ++ + isp->isp_csiphy2.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy2"); ++ if (IS_ERR(isp->isp_csiphy2.vdd)) { ++ ret = PTR_ERR(isp->isp_csiphy2.vdd); ++ goto error; ++ } + + /* Clocks + * +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-581-media-imx-imx7-media-csi-fix-missing-clk_disabl.patch b/patches.kernel.org/6.2.3-581-media-imx-imx7-media-csi-fix-missing-clk_disabl.patch new file mode 100644 index 0000000..7d834ef --- /dev/null +++ b/patches.kernel.org/6.2.3-581-media-imx-imx7-media-csi-fix-missing-clk_disabl.patch @@ -0,0 +1,43 @@ +From: Yang Yingliang +Date: Wed, 4 Jan 2023 10:39:21 +0100 +Subject: [PATCH] media: imx: imx7-media-csi: fix missing + clk_disable_unprepare() in imx7_csi_init() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cea606d9e996a77eed57fc60709e0728341450e3 + +[ Upstream commit cea606d9e996a77eed57fc60709e0728341450e3 ] + +Add missing clk_disable_unprepare(), if imx7_csi_dma_setup() fails +in imx7_csi_init(). + +Fixes: ff43ca911978 ("media: imx: imx7-media-csi: Move CSI configuration before source start") +Signed-off-by: Yang Yingliang +Reviewed-by: Rui Miguel Silva +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/platform/nxp/imx7-media-csi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c +index 886374d3..1ef92c8c 100644 +--- a/drivers/media/platform/nxp/imx7-media-csi.c ++++ b/drivers/media/platform/nxp/imx7-media-csi.c +@@ -638,8 +638,10 @@ static int imx7_csi_init(struct imx7_csi *csi) + imx7_csi_configure(csi); + + ret = imx7_csi_dma_setup(csi); +- if (ret < 0) ++ if (ret < 0) { ++ clk_disable_unprepare(csi->mclk); + return ret; ++ } + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-582-powerpc-Remove-linker-flag-from-KBUILD_AFLAGS.patch b/patches.kernel.org/6.2.3-582-powerpc-Remove-linker-flag-from-KBUILD_AFLAGS.patch new file mode 100644 index 0000000..c753ac5 --- /dev/null +++ b/patches.kernel.org/6.2.3-582-powerpc-Remove-linker-flag-from-KBUILD_AFLAGS.patch @@ -0,0 +1,73 @@ +From: Nathan Chancellor +Date: Wed, 11 Jan 2023 20:05:02 -0700 +Subject: [PATCH] powerpc: Remove linker flag from KBUILD_AFLAGS +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 31f48f16264bc70962fb3e7ec62da64d0a2ba04a + +[ Upstream commit 31f48f16264bc70962fb3e7ec62da64d0a2ba04a ] + +When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it +points out that KBUILD_AFLAGS contains a linker flag, which will be +unused: + + clang: error: -Wl,-a32: 'linker' input unused [-Werror,-Wunused-command-line-argument] + +This was likely supposed to be '-Wa,-a$(BITS)'. However, this change is +unnecessary, as all supported versions of clang and gcc will pass '-a64' +or '-a32' to GNU as based on the value of '-m'; the behavior of the +latest stable release of the oldest supported major version of each +compiler is shown below and each compiler's latest release exhibits the +same behavior (GCC 12.2.0 and Clang 15.0.6). + + $ powerpc64-linux-gcc --version | head -1 + powerpc64-linux-gcc (GCC) 5.5.0 + + $ powerpc64-linux-gcc -m64 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as ' + .../as -a64 -mppc64 -many -mbig -o /dev/null /tmp/cctwuBzZ.s + + $ powerpc64-linux-gcc -m32 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as ' + .../as -a32 -mppc -many -mbig -o /dev/null /tmp/ccaZP4mF.sg + + $ clang --version | head -1 + Ubuntu clang version 11.1.0-++20211011094159+1fdec59bffc1-1~exp1~20211011214622.5 + + $ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \ + -x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as + "/usr/bin/powerpc64-linux-gnu-as" "-a64" "-mppc64" "-many" "-o" "/dev/null" "/tmp/null-80267c.s" + + $ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \ + -x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as + "/usr/bin/powerpc64-linux-gnu-as" "-a32" "-mppc" "-many" "-o" "/dev/null" "/tmp/null-ab8f8d.s" + +Remove this flag altogether to avoid future issues. + +Fixes: 1421dc6d4829 ("powerpc/kbuild: Use flags variables rather than overriding LD/CC/AS") +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Tested-by: Linux Kernel Functional Testing +Tested-by: Anders Roxell +Acked-by: Michael Ellerman +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/powerpc/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index dc4cbf0a..4fd630ef 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -90,7 +90,7 @@ aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian + + ifeq ($(HAS_BIARCH),y) + KBUILD_CFLAGS += -m$(BITS) +-KBUILD_AFLAGS += -m$(BITS) -Wl,-a$(BITS) ++KBUILD_AFLAGS += -m$(BITS) + KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION) + endif + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-583-s390-vdso-Drop-shared-from-KBUILD_CFLAGS_64.patch b/patches.kernel.org/6.2.3-583-s390-vdso-Drop-shared-from-KBUILD_CFLAGS_64.patch new file mode 100644 index 0000000..fb2af32 --- /dev/null +++ b/patches.kernel.org/6.2.3-583-s390-vdso-Drop-shared-from-KBUILD_CFLAGS_64.patch @@ -0,0 +1,46 @@ +From: Nathan Chancellor +Date: Wed, 11 Jan 2023 20:05:07 -0700 +Subject: [PATCH] s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fd8589dce8107e2ce62e92f76089654462dd67b4 + +[ Upstream commit fd8589dce8107e2ce62e92f76089654462dd67b4 ] + +When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it +points out that there is a linking phase flag added to CFLAGS, which +will only be used for compiling + + clang-16: error: argument unused during compilation: '-shared' [-Werror,-Wunused-command-line-argument] + +'-shared' is already present in ldflags-y so it can just be dropped. + +Fixes: 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO") +Signed-off-by: Nathan Chancellor +Acked-by: Heiko Carstens +Reviewed-by: Sven Schnelle +Tested-by: Linux Kernel Functional Testing +Tested-by: Anders Roxell +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/kernel/vdso64/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile +index 9e2b95a2..1605ba45 100644 +--- a/arch/s390/kernel/vdso64/Makefile ++++ b/arch/s390/kernel/vdso64/Makefile +@@ -25,7 +25,7 @@ KBUILD_AFLAGS_64 := $(filter-out -m64,$(KBUILD_AFLAGS)) + KBUILD_AFLAGS_64 += -m64 -s + + KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS)) +-KBUILD_CFLAGS_64 += -m64 -fPIC -shared -fno-common -fno-builtin ++KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin + ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \ + --hash-style=both --build-id=sha1 -T + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-584-builddeb-clean-generated-package-content.patch b/patches.kernel.org/6.2.3-584-builddeb-clean-generated-package-content.patch new file mode 100644 index 0000000..d1da93b --- /dev/null +++ b/patches.kernel.org/6.2.3-584-builddeb-clean-generated-package-content.patch @@ -0,0 +1,38 @@ +From: Bastian Germann +Date: Wed, 26 May 2021 01:01:37 +0200 +Subject: [PATCH] builddeb: clean generated package content +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c9f9cf2560e40b62015c6c4a04be60f55ce5240e + +[ Upstream commit c9f9cf2560e40b62015c6c4a04be60f55ce5240e ] + +For each binary Debian package, a directory with the package name is +created in the debian directory. Correct the generated file matches in the +package's clean target, which were renamed without adjusting the target. + +Fixes: 1694e94e4f46 ("builddeb: match temporary directory name to the package name") +Signed-off-by: Bastian Germann +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + scripts/package/mkdebian | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian +index 6cf38322..c3bbef7a 100755 +--- a/scripts/package/mkdebian ++++ b/scripts/package/mkdebian +@@ -236,7 +236,7 @@ binary-arch: build-arch + KBUILD_BUILD_VERSION=${revision} -f \$(srctree)/Makefile intdeb-pkg + + clean: +- rm -rf debian/*tmp debian/files ++ rm -rf debian/files debian/linux-* + \$(MAKE) clean + + binary: binary-arch +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-585-media-max9286-Fix-memleak-in-max9286_v4l2_regis.patch b/patches.kernel.org/6.2.3-585-media-max9286-Fix-memleak-in-max9286_v4l2_regis.patch new file mode 100644 index 0000000..30940f4 --- /dev/null +++ b/patches.kernel.org/6.2.3-585-media-max9286-Fix-memleak-in-max9286_v4l2_regis.patch @@ -0,0 +1,67 @@ +From: Shang XiaoJing +Date: Tue, 6 Dec 2022 14:05:55 +0100 +Subject: [PATCH] media: max9286: Fix memleak in max9286_v4l2_register() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8636c5fc7658c7c6299fb8b352d24ea4b9ba99e2 + +[ Upstream commit 8636c5fc7658c7c6299fb8b352d24ea4b9ba99e2 ] + +There is a kmemleak when testing the media/i2c/max9286.c with bpf mock +device: + +kmemleak: 5 new suspected memory leaks (see /sys/kernel/debug/kmemleak) + +unreferenced object 0xffff88810defc400 (size 256): + comm "python3", pid 278, jiffies 4294737563 (age 31.978s) + hex dump (first 32 bytes): + 28 06 a7 0a 81 88 ff ff 00 fe 22 12 81 88 ff ff (........."..... + 10 c4 ef 0d 81 88 ff ff 10 c4 ef 0d 81 88 ff ff ................ + backtrace: + [<00000000191de6a7>] __kmalloc_node+0x44/0x1b0 + [<000000002f4912b7>] kvmalloc_node+0x34/0x180 + [<0000000057dc4cae>] v4l2_ctrl_new+0x325/0x10f0 [videodev] + [<0000000026030272>] v4l2_ctrl_new_std+0x16f/0x210 [videodev] + [<00000000f0d9ea2f>] max9286_probe+0x76e/0xbff [max9286] + [<00000000ea8f6455>] i2c_device_probe+0x28d/0x680 + [<0000000087529af3>] really_probe+0x17c/0x3f0 + [<00000000b08be526>] __driver_probe_device+0xe3/0x170 + [<000000004382edea>] driver_probe_device+0x49/0x120 + [<000000007bde528a>] __device_attach_driver+0xf7/0x150 + [<000000009f9c6ab4>] bus_for_each_drv+0x114/0x180 + [<00000000c8aaf588>] __device_attach+0x1e5/0x2d0 + [<0000000041cc06b9>] bus_probe_device+0x126/0x140 + [<000000002309860d>] device_add+0x810/0x1130 + [<000000002827bf98>] i2c_new_client_device+0x359/0x4f0 + [<00000000593bdc85>] of_i2c_register_device+0xf1/0x110 + +max9286_v4l2_register() calls v4l2_ctrl_new_std(), but won't free the +created v412_ctrl when fwnode_graph_get_endpoint_by_id() failed, which +causes the memleak. Call v4l2_ctrl_handler_free() to free the v412_ctrl. + +Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver") +Signed-off-by: Shang XiaoJing +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/max9286.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c +index 9c083cf1..d034a670 100644 +--- a/drivers/media/i2c/max9286.c ++++ b/drivers/media/i2c/max9286.c +@@ -932,6 +932,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv) + err_put_node: + fwnode_handle_put(ep); + err_async: ++ v4l2_ctrl_handler_free(&priv->ctrls); + max9286_v4l2_notifier_unregister(priv); + + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-586-media-ov2740-Fix-memleak-in-ov2740_init_control.patch b/patches.kernel.org/6.2.3-586-media-ov2740-Fix-memleak-in-ov2740_init_control.patch new file mode 100644 index 0000000..a9e3be7 --- /dev/null +++ b/patches.kernel.org/6.2.3-586-media-ov2740-Fix-memleak-in-ov2740_init_control.patch @@ -0,0 +1,68 @@ +From: Shang XiaoJing +Date: Thu, 8 Dec 2022 08:59:37 +0100 +Subject: [PATCH] media: ov2740: Fix memleak in ov2740_init_controls() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2d899592ed7829d0d5140853bac4d58742a6b8af + +[ Upstream commit 2d899592ed7829d0d5140853bac4d58742a6b8af ] + +There is a kmemleak when testing the media/i2c/ov2740.c with bpf mock +device: + +unreferenced object 0xffff8881090e19e0 (size 16): + comm "51-i2c-ov2740", pid 278, jiffies 4294781584 (age 23.613s) + hex dump (first 16 bytes): + 00 f3 7c 0b 81 88 ff ff 80 75 6a 09 81 88 ff ff ..|......uj..... + backtrace: + [<000000004e9fad8f>] __kmalloc_node+0x44/0x1b0 + [<0000000039c802f4>] kvmalloc_node+0x34/0x180 + [<000000009b8b5c63>] v4l2_ctrl_handler_init_class+0x11d/0x180 +[videodev] + [<0000000038644056>] ov2740_probe+0x37d/0x84f [ov2740] + [<0000000092489f59>] i2c_device_probe+0x28d/0x680 + [<000000001038babe>] really_probe+0x17c/0x3f0 + [<0000000098c7af1c>] __driver_probe_device+0xe3/0x170 + [<00000000e1b3dc24>] device_driver_attach+0x34/0x80 + [<000000005a04a34d>] bind_store+0x10b/0x1a0 + [<00000000ce25d4f2>] drv_attr_store+0x49/0x70 + [<000000007d9f4e9a>] sysfs_kf_write+0x8c/0xb0 + [<00000000be6cff0f>] kernfs_fop_write_iter+0x216/0x2e0 + [<0000000031ddb40a>] vfs_write+0x658/0x810 + [<0000000041beecdd>] ksys_write+0xd6/0x1b0 + [<0000000023755840>] do_syscall_64+0x38/0x90 + [<00000000b2cc2da2>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +ov2740_init_controls() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: 866edc895171 ("media: i2c: Add ov2740 image sensor driver") +Signed-off-by: Shang XiaoJing +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/ov2740.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov2740.c b/drivers/media/i2c/ov2740.c +index f3731f93..89d12624 100644 +--- a/drivers/media/i2c/ov2740.c ++++ b/drivers/media/i2c/ov2740.c +@@ -629,8 +629,10 @@ static int ov2740_init_controls(struct ov2740 *ov2740) + V4L2_CID_TEST_PATTERN, + ARRAY_SIZE(ov2740_test_pattern_menu) - 1, + 0, 0, ov2740_test_pattern_menu); +- if (ctrl_hdlr->error) ++ if (ctrl_hdlr->error) { ++ v4l2_ctrl_handler_free(ctrl_hdlr); + return ctrl_hdlr->error; ++ } + + ov2740->sd.ctrl_handler = ctrl_hdlr; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-587-media-ov5675-Fix-memleak-in-ov5675_init_control.patch b/patches.kernel.org/6.2.3-587-media-ov5675-Fix-memleak-in-ov5675_init_control.patch new file mode 100644 index 0000000..6e70355 --- /dev/null +++ b/patches.kernel.org/6.2.3-587-media-ov5675-Fix-memleak-in-ov5675_init_control.patch @@ -0,0 +1,68 @@ +From: Shang XiaoJing +Date: Thu, 8 Dec 2022 08:59:38 +0100 +Subject: [PATCH] media: ov5675: Fix memleak in ov5675_init_controls() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dd74ed6c213003533e3abf4c204374ef01d86978 + +[ Upstream commit dd74ed6c213003533e3abf4c204374ef01d86978 ] + +There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock +device: + +AssertionError: unreferenced object 0xffff888107362160 (size 16): + comm "python3", pid 277, jiffies 4294832798 (age 20.722s) + hex dump (first 16 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000abe7d67c>] __kmalloc_node+0x44/0x1b0 + [<000000008a725aac>] kvmalloc_node+0x34/0x180 + [<000000009a53cd11>] v4l2_ctrl_handler_init_class+0x11d/0x180 +[videodev] + [<0000000055b46db0>] ov5675_probe+0x38b/0x897 [ov5675] + [<00000000153d886c>] i2c_device_probe+0x28d/0x680 + [<000000004afb7e8f>] really_probe+0x17c/0x3f0 + [<00000000ff2f18e4>] __driver_probe_device+0xe3/0x170 + [<000000000a001029>] driver_probe_device+0x49/0x120 + [<00000000e39743c7>] __device_attach_driver+0xf7/0x150 + [<00000000d32fd070>] bus_for_each_drv+0x114/0x180 + [<000000009083ac41>] __device_attach+0x1e5/0x2d0 + [<0000000015b4a830>] bus_probe_device+0x126/0x140 + [<000000007813deaf>] device_add+0x810/0x1130 + [<000000007becb867>] i2c_new_client_device+0x386/0x540 + [<000000007f9cf4b4>] of_i2c_register_device+0xf1/0x110 + [<00000000ebfdd032>] of_i2c_notify+0xfc/0x1f0 + +ov5675_init_controls() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: bf27502b1f3b ("media: ov5675: Add support for OV5675 sensor") +Signed-off-by: Shang XiaoJing +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/ov5675.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov5675.c b/drivers/media/i2c/ov5675.c +index 94dc8cb7..a6e6b367 100644 +--- a/drivers/media/i2c/ov5675.c ++++ b/drivers/media/i2c/ov5675.c +@@ -820,8 +820,10 @@ static int ov5675_init_controls(struct ov5675 *ov5675) + v4l2_ctrl_new_std(ctrl_hdlr, &ov5675_ctrl_ops, + V4L2_CID_VFLIP, 0, 1, 1, 0); + +- if (ctrl_hdlr->error) ++ if (ctrl_hdlr->error) { ++ v4l2_ctrl_handler_free(ctrl_hdlr); + return ctrl_hdlr->error; ++ } + + ov5675->sd.ctrl_handler = ctrl_hdlr; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-588-media-i2c-tc358746-fix-missing-return-assignmen.patch b/patches.kernel.org/6.2.3-588-media-i2c-tc358746-fix-missing-return-assignmen.patch new file mode 100644 index 0000000..725993a --- /dev/null +++ b/patches.kernel.org/6.2.3-588-media-i2c-tc358746-fix-missing-return-assignmen.patch @@ -0,0 +1,41 @@ +From: Marco Felsch +Date: Fri, 16 Dec 2022 11:35:43 +0100 +Subject: [PATCH] media: i2c: tc358746: fix missing return assignment +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0605081142070a41de8f1deb8fdaeb8677e97741 + +[ Upstream commit 0605081142070a41de8f1deb8fdaeb8677e97741 ] + +It was intended to return an error if tc358746_update_bits() call fail. +Fix this by storing the return code. + +Addresses-Coverity-ID: 1527252 ("Control flow issues") + +Reported-by: coverity-bot +Fixes: 80a21da36051 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver") +Signed-off-by: Marco Felsch +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/tc358746.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c +index d1f552bd..e7f27cbb 100644 +--- a/drivers/media/i2c/tc358746.c ++++ b/drivers/media/i2c/tc358746.c +@@ -406,7 +406,7 @@ tc358746_apply_pll_config(struct tc358746 *tc358746) + + val = PLL_FRS(ilog2(post)) | RESETB | PLL_EN; + mask = PLL_FRS_MASK | RESETB | PLL_EN; +- tc358746_update_bits(tc358746, PLLCTL1_REG, mask, val); ++ err = tc358746_update_bits(tc358746, PLLCTL1_REG, mask, val); + if (err) + return err; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-589-media-i2c-tc358746-fix-ignoring-read-error-in-g.patch b/patches.kernel.org/6.2.3-589-media-i2c-tc358746-fix-ignoring-read-error-in-g.patch new file mode 100644 index 0000000..b6aaa91 --- /dev/null +++ b/patches.kernel.org/6.2.3-589-media-i2c-tc358746-fix-ignoring-read-error-in-g.patch @@ -0,0 +1,58 @@ +From: Marco Felsch +Date: Fri, 16 Dec 2022 11:35:44 +0100 +Subject: [PATCH] media: i2c: tc358746: fix ignoring read error in g_register + callback +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9d33802c8bcf96c4099ffea4f392afa52897e556 + +[ Upstream commit 9d33802c8bcf96c4099ffea4f392afa52897e556 ] + +Currently we ignore the return value of tc358746_read() and return +alawys return 0 which is wrong. Fix this by returning the actual return +value of the read operation which is either 0 on success or an error +value. + +Addresses-Coverity-ID: 1527254 ("Error handling issues") + +Reported-by: coverity-bot +Fixes: 80a21da36051 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver") +Signed-off-by: Marco Felsch +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/tc358746.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c +index e7f27cbb..c5a0df30 100644 +--- a/drivers/media/i2c/tc358746.c ++++ b/drivers/media/i2c/tc358746.c +@@ -988,6 +988,7 @@ static int __maybe_unused + tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) + { + struct tc358746 *tc358746 = to_tc358746(sd); ++ int err; + + /* 32-bit registers starting from CLW_DPHYCONTTX */ + reg->size = reg->reg < CLW_DPHYCONTTX_REG ? 2 : 4; +@@ -995,12 +996,12 @@ tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) + if (!pm_runtime_get_if_in_use(sd->dev)) + return 0; + +- tc358746_read(tc358746, reg->reg, (u32 *)®->val); ++ err = tc358746_read(tc358746, reg->reg, (u32 *)®->val); + + pm_runtime_mark_last_busy(sd->dev); + pm_runtime_put_sync_autosuspend(sd->dev); + +- return 0; ++ return err; + } + + static int __maybe_unused +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-590-media-i2c-tc358746-fix-possible-endianness-issu.patch b/patches.kernel.org/6.2.3-590-media-i2c-tc358746-fix-possible-endianness-issu.patch new file mode 100644 index 0000000..00d2c91 --- /dev/null +++ b/patches.kernel.org/6.2.3-590-media-i2c-tc358746-fix-possible-endianness-issu.patch @@ -0,0 +1,53 @@ +From: Marco Felsch +Date: Fri, 16 Dec 2022 11:35:45 +0100 +Subject: [PATCH] media: i2c: tc358746: fix possible endianness issue +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5ad2e46030ad97de7fdbdaf63bb1af45c7caf3dd + +[ Upstream commit 5ad2e46030ad97de7fdbdaf63bb1af45c7caf3dd ] + +Using the u64 v4l2_dbg_register.val directly can lead to unexpected +results depending on machine endianness. Fix this by using a local +variable which is assigned afterwards. Since tc358746_read() will init +the val variable to 0 we can assing it without checking the return value +first. + +Addresses-Coverity-ID: 1527256 ("Integer handling issues") + +Reported-by: coverity-bot +Fixes: 80a21da36051 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver") +Signed-off-by: Marco Felsch +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/tc358746.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c +index c5a0df30..4063754a 100644 +--- a/drivers/media/i2c/tc358746.c ++++ b/drivers/media/i2c/tc358746.c +@@ -988,6 +988,7 @@ static int __maybe_unused + tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) + { + struct tc358746 *tc358746 = to_tc358746(sd); ++ u32 val; + int err; + + /* 32-bit registers starting from CLW_DPHYCONTTX */ +@@ -996,7 +997,8 @@ tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) + if (!pm_runtime_get_if_in_use(sd->dev)) + return 0; + +- err = tc358746_read(tc358746, reg->reg, (u32 *)®->val); ++ err = tc358746_read(tc358746, reg->reg, &val); ++ reg->val = val; + + pm_runtime_mark_last_busy(sd->dev); + pm_runtime_put_sync_autosuspend(sd->dev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-591-media-ov5640-Fix-soft-reset-sequence-and-timing.patch b/patches.kernel.org/6.2.3-591-media-ov5640-Fix-soft-reset-sequence-and-timing.patch new file mode 100644 index 0000000..f12f121 --- /dev/null +++ b/patches.kernel.org/6.2.3-591-media-ov5640-Fix-soft-reset-sequence-and-timing.patch @@ -0,0 +1,97 @@ +From: Jai Luthra +Date: Tue, 3 Jan 2023 13:27:35 +0100 +Subject: [PATCH] media: ov5640: Fix soft reset sequence and timings +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: decea0a98b7ac04536c7d659f74783e8d67a06c0 + +[ Upstream commit decea0a98b7ac04536c7d659f74783e8d67a06c0 ] + +Move the register-based reset out of the init_setting[] and into the +powerup_sequence function. The sensor is power cycled and reset using +the gpio pins so the soft reset is not always necessary. + +This also ensures that soft reset honors the timing sequence +from the datasheet [1]. + +[1] https://cdn.sparkfun.com/datasheets/Sensors/LightImaging/OV5640_datasheet.pdf + +Fixes: 19a81c1426c1 ("[media] add Omnivision OV5640 sensor driver") +Reported-by: Nishanth Menon +Suggested-by: Jacopo Mondi +Signed-off-by: Jai Luthra +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/ov5640.c | 34 ++++++++++++++++++++++++---------- + 1 file changed, 24 insertions(+), 10 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index e0f908af..75dada60 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -50,6 +50,7 @@ + #define OV5640_REG_SYS_CTRL0 0x3008 + #define OV5640_REG_SYS_CTRL0_SW_PWDN 0x42 + #define OV5640_REG_SYS_CTRL0_SW_PWUP 0x02 ++#define OV5640_REG_SYS_CTRL0_SW_RST 0x82 + #define OV5640_REG_CHIP_ID 0x300a + #define OV5640_REG_IO_MIPI_CTRL00 0x300e + #define OV5640_REG_PAD_OUTPUT_ENABLE01 0x3017 +@@ -532,7 +533,7 @@ static const struct v4l2_mbus_framefmt ov5640_default_fmt = { + }; + + static const struct reg_value ov5640_init_setting[] = { +- {0x3103, 0x11, 0, 0}, {0x3008, 0x82, 0, 5}, {0x3008, 0x42, 0, 0}, ++ {0x3103, 0x11, 0, 0}, + {0x3103, 0x03, 0, 0}, {0x3630, 0x36, 0, 0}, + {0x3631, 0x0e, 0, 0}, {0x3632, 0xe2, 0, 0}, {0x3633, 0x12, 0, 0}, + {0x3621, 0xe0, 0, 0}, {0x3704, 0xa0, 0, 0}, {0x3703, 0x5a, 0, 0}, +@@ -2429,19 +2430,32 @@ static void ov5640_reset(struct ov5640_dev *sensor) + if (!sensor->reset_gpio) + return; + +- gpiod_set_value_cansleep(sensor->reset_gpio, 0); ++ if (sensor->pwdn_gpio) { ++ gpiod_set_value_cansleep(sensor->reset_gpio, 0); + +- /* camera power cycle */ +- ov5640_power(sensor, false); +- usleep_range(5000, 10000); +- ov5640_power(sensor, true); +- usleep_range(5000, 10000); ++ /* camera power cycle */ ++ ov5640_power(sensor, false); ++ usleep_range(5000, 10000); ++ ov5640_power(sensor, true); ++ usleep_range(5000, 10000); + +- gpiod_set_value_cansleep(sensor->reset_gpio, 1); +- usleep_range(1000, 2000); ++ gpiod_set_value_cansleep(sensor->reset_gpio, 1); ++ usleep_range(1000, 2000); + +- gpiod_set_value_cansleep(sensor->reset_gpio, 0); ++ gpiod_set_value_cansleep(sensor->reset_gpio, 0); ++ } else { ++ /* software reset */ ++ ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, ++ OV5640_REG_SYS_CTRL0_SW_RST); ++ } + usleep_range(20000, 25000); ++ ++ /* ++ * software standby: allows registers programming; ++ * exit at restore_mode() for CSI, s_stream(1) for DVP ++ */ ++ ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, ++ OV5640_REG_SYS_CTRL0_SW_PWDN); + } + + static int ov5640_set_power_on(struct ov5640_dev *sensor) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-592-media-ov5640-Handle-delays-when-no-reset_gpio-s.patch b/patches.kernel.org/6.2.3-592-media-ov5640-Handle-delays-when-no-reset_gpio-s.patch new file mode 100644 index 0000000..5b75fcc --- /dev/null +++ b/patches.kernel.org/6.2.3-592-media-ov5640-Handle-delays-when-no-reset_gpio-s.patch @@ -0,0 +1,81 @@ +From: Jai Luthra +Date: Tue, 3 Jan 2023 13:27:36 +0100 +Subject: [PATCH] media: ov5640: Handle delays when no reset_gpio set +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d7ff69139908842adf824be4f50c7e9ac5886c04 + +[ Upstream commit d7ff69139908842adf824be4f50c7e9ac5886c04 ] + +Some module manufacturers [1][2] don't expose the RESETB and PWDN pins +of the sensor directly through the 15-pin FFC connector. Instead wiring +~PWDN gpio to the sensor pins with appropriate delays. + +In such cases, reset_gpio will not be available to the driver, but it +will still be toggled when the sensor is powered on, and thus we should +still honor the wait time of >= 5ms + 1ms + 20ms (see figure 2-3 in [3]) +before attempting any i/o operations over SCCB. + +Also, rename the function to ov5640_powerup_sequence to better match the +datasheet (section 2.7). + +[1] https://digilent.com/reference/_media/reference/add-ons/pcam-5c/pcam_5c_sch.pdf +[2] https://www.alinx.com/public/upload/file/AN5641_User_Manual.pdf +[3] https://cdn.sparkfun.com/datasheets/Sensors/LightImaging/OV5640_datasheet.pdf + +Fixes: 19a81c1426c1 ("[media] add Omnivision OV5640 sensor driver") +Reported-by: Nishanth Menon +Signed-off-by: Jai Luthra +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/ov5640.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 75dada60..c159f297 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -2425,11 +2425,22 @@ static void ov5640_power(struct ov5640_dev *sensor, bool enable) + gpiod_set_value_cansleep(sensor->pwdn_gpio, enable ? 0 : 1); + } + +-static void ov5640_reset(struct ov5640_dev *sensor) ++/* ++ * From section 2.7 power up sequence: ++ * t0 + t1 + t2 >= 5ms Delay from DOVDD stable to PWDN pull down ++ * t3 >= 1ms Delay from PWDN pull down to RESETB pull up ++ * t4 >= 20ms Delay from RESETB pull up to SCCB (i2c) stable ++ * ++ * Some modules don't expose RESETB/PWDN pins directly, instead providing a ++ * "PWUP" GPIO which is wired through appropriate delays and inverters to the ++ * pins. ++ * ++ * In such cases, this gpio should be mapped to pwdn_gpio in the driver, and we ++ * should still toggle the pwdn_gpio below with the appropriate delays, while ++ * the calls to reset_gpio will be ignored. ++ */ ++static void ov5640_powerup_sequence(struct ov5640_dev *sensor) + { +- if (!sensor->reset_gpio) +- return; +- + if (sensor->pwdn_gpio) { + gpiod_set_value_cansleep(sensor->reset_gpio, 0); + +@@ -2478,8 +2489,7 @@ static int ov5640_set_power_on(struct ov5640_dev *sensor) + goto xclk_off; + } + +- ov5640_reset(sensor); +- ov5640_power(sensor, true); ++ ov5640_powerup_sequence(sensor); + + ret = ov5640_init_slave_id(sensor); + if (ret) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-593-media-mc-Get-media_device-directly-from-pad.patch b/patches.kernel.org/6.2.3-593-media-mc-Get-media_device-directly-from-pad.patch new file mode 100644 index 0000000..b41d890 --- /dev/null +++ b/patches.kernel.org/6.2.3-593-media-mc-Get-media_device-directly-from-pad.patch @@ -0,0 +1,67 @@ +From: Laurent Pinchart +Date: Mon, 12 Dec 2022 14:25:04 +0100 +Subject: [PATCH] media: mc: Get media_device directly from pad +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a967a3a788028f541e4db54beabcebc3648997db + +[ Upstream commit a967a3a788028f541e4db54beabcebc3648997db ] + +Various functions access the media_device from a pad by going through +the entity the pad belongs to. Remove the level of indirection and get +the media_device from the pad directly. + +Fixes: 9e3576a1ae2b ("media: mc: convert pipeline funcs to take media_pad") +Signed-off-by: Laurent Pinchart +Reviewed-by: Tomi Valkeinen +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/mc/mc-entity.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c +index b8bcbc73..f268cf66 100644 +--- a/drivers/media/mc/mc-entity.c ++++ b/drivers/media/mc/mc-entity.c +@@ -703,7 +703,7 @@ static int media_pipeline_populate(struct media_pipeline *pipe, + __must_check int __media_pipeline_start(struct media_pad *pad, + struct media_pipeline *pipe) + { +- struct media_device *mdev = pad->entity->graph_obj.mdev; ++ struct media_device *mdev = pad->graph_obj.mdev; + struct media_pipeline_pad *err_ppad; + struct media_pipeline_pad *ppad; + int ret; +@@ -851,7 +851,7 @@ EXPORT_SYMBOL_GPL(__media_pipeline_start); + __must_check int media_pipeline_start(struct media_pad *pad, + struct media_pipeline *pipe) + { +- struct media_device *mdev = pad->entity->graph_obj.mdev; ++ struct media_device *mdev = pad->graph_obj.mdev; + int ret; + + mutex_lock(&mdev->graph_mutex); +@@ -888,7 +888,7 @@ EXPORT_SYMBOL_GPL(__media_pipeline_stop); + + void media_pipeline_stop(struct media_pad *pad) + { +- struct media_device *mdev = pad->entity->graph_obj.mdev; ++ struct media_device *mdev = pad->graph_obj.mdev; + + mutex_lock(&mdev->graph_mutex); + __media_pipeline_stop(pad); +@@ -898,7 +898,7 @@ EXPORT_SYMBOL_GPL(media_pipeline_stop); + + __must_check int media_pipeline_alloc_start(struct media_pad *pad) + { +- struct media_device *mdev = pad->entity->graph_obj.mdev; ++ struct media_device *mdev = pad->graph_obj.mdev; + struct media_pipeline *new_pipe = NULL; + struct media_pipeline *pipe; + int ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-594-media-i2c-ov772x-Fix-memleak-in-ov772x_probe.patch b/patches.kernel.org/6.2.3-594-media-i2c-ov772x-Fix-memleak-in-ov772x_probe.patch new file mode 100644 index 0000000..5cd5f0a --- /dev/null +++ b/patches.kernel.org/6.2.3-594-media-i2c-ov772x-Fix-memleak-in-ov772x_probe.patch @@ -0,0 +1,95 @@ +From: Yuan Can +Date: Thu, 8 Dec 2022 09:06:25 +0100 +Subject: [PATCH] media: i2c: ov772x: Fix memleak in ov772x_probe() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7485edb2b6ca5960205c0a49bedfd09bba30e521 + +[ Upstream commit 7485edb2b6ca5960205c0a49bedfd09bba30e521 ] + +A memory leak was reported when testing ov772x with bpf mock device: + +AssertionError: unreferenced object 0xffff888109afa7a8 (size 8): + comm "python3", pid 279, jiffies 4294805921 (age 20.681s) + hex dump (first 8 bytes): + 80 22 88 15 81 88 ff ff ."...... + backtrace: + [<000000009990b438>] __kmalloc_node+0x44/0x1b0 + [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 + [<00000000faf48134>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] + [<00000000da376937>] ov772x_probe+0x1c3/0x68c [ov772x] + [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 + [<00000000e0b6db89>] really_probe+0x17c/0x3f0 + [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 + [<0000000048370519>] driver_probe_device+0x49/0x120 + [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 + [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 + [<00000000358e5596>] __device_attach+0x1e5/0x2d0 + [<0000000043f83c5d>] bus_probe_device+0x126/0x140 + [<00000000ee0f3046>] device_add+0x810/0x1130 + [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 + [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110 + [<00000000a9f2159d>] of_i2c_notify+0x100/0x160 +unreferenced object 0xffff888119825c00 (size 256): + comm "python3", pid 279, jiffies 4294805921 (age 20.681s) + hex dump (first 32 bytes): + 00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^...... + 10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .\.......\...... + backtrace: + [<000000009990b438>] __kmalloc_node+0x44/0x1b0 + [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 + [<0000000073d88e0b>] v4l2_ctrl_new.cold+0x19b/0x86f [videodev] + [<00000000b1f576fb>] v4l2_ctrl_new_std+0x16f/0x210 [videodev] + [<00000000caf7ac99>] ov772x_probe+0x1fa/0x68c [ov772x] + [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 + [<00000000e0b6db89>] really_probe+0x17c/0x3f0 + [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 + [<0000000048370519>] driver_probe_device+0x49/0x120 + [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 + [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 + [<00000000358e5596>] __device_attach+0x1e5/0x2d0 + [<0000000043f83c5d>] bus_probe_device+0x126/0x140 + [<00000000ee0f3046>] device_add+0x810/0x1130 + [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 + [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110 + +The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the +error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all +resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() +are leaked. + +Fixes: 1112babde214 ("media: i2c: Copy ov772x soc_camera sensor driver") +Signed-off-by: Yuan Can +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/ov772x.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c +index 4189e3fc..a238e634 100644 +--- a/drivers/media/i2c/ov772x.c ++++ b/drivers/media/i2c/ov772x.c +@@ -1462,7 +1462,7 @@ static int ov772x_probe(struct i2c_client *client) + priv->subdev.ctrl_handler = &priv->hdl; + if (priv->hdl.error) { + ret = priv->hdl.error; +- goto error_mutex_destroy; ++ goto error_ctrl_free; + } + + priv->clk = clk_get(&client->dev, NULL); +@@ -1515,7 +1515,6 @@ static int ov772x_probe(struct i2c_client *client) + clk_put(priv->clk); + error_ctrl_free: + v4l2_ctrl_handler_free(&priv->hdl); +-error_mutex_destroy: + mutex_destroy(&priv->lock); + + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-595-media-i2c-imx219-Split-common-registers-from-mo.patch b/patches.kernel.org/6.2.3-595-media-i2c-imx219-Split-common-registers-from-mo.patch new file mode 100644 index 0000000..d68ff01 --- /dev/null +++ b/patches.kernel.org/6.2.3-595-media-i2c-imx219-Split-common-registers-from-mo.patch @@ -0,0 +1,315 @@ +From: Adam Ford +Date: Tue, 20 Dec 2022 13:07:53 +0100 +Subject: [PATCH] media: i2c: imx219: Split common registers from mode tables +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8508455961d5a9e8907bcfd8dcd58f19d9b6ce47 + +[ Upstream commit 8508455961d5a9e8907bcfd8dcd58f19d9b6ce47 ] + +There are four modes, and each mode has a table of registers. +Some of the registers are common to all modes, so create new +tables for these common registers to reduce duplicate code. + +Signed-off-by: Adam Ford +Reviewed-by: Dave Stevenson +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: ef86447e775f ("media: i2c: imx219: Fix binning for RAW8 capture") +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/imx219.c | 206 +++++++++++-------------------------- + 1 file changed, 59 insertions(+), 147 deletions(-) + +diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c +index 77bd79a5..7f44d620 100644 +--- a/drivers/media/i2c/imx219.c ++++ b/drivers/media/i2c/imx219.c +@@ -145,23 +145,61 @@ struct imx219_mode { + struct imx219_reg_list reg_list; + }; + +-/* +- * Register sets lifted off the i2C interface from the Raspberry Pi firmware +- * driver. +- * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7. +- */ +-static const struct imx219_reg mode_3280x2464_regs[] = { +- {0x0100, 0x00}, ++static const struct imx219_reg imx219_common_regs[] = { ++ {0x0100, 0x00}, /* Mode Select */ ++ ++ /* To Access Addresses 3000-5fff, send the following commands */ + {0x30eb, 0x0c}, + {0x30eb, 0x05}, + {0x300a, 0xff}, + {0x300b, 0xff}, + {0x30eb, 0x05}, + {0x30eb, 0x09}, +- {0x0114, 0x01}, +- {0x0128, 0x00}, +- {0x012a, 0x18}, ++ ++ /* PLL Clock Table */ ++ {0x0301, 0x05}, /* VTPXCK_DIV */ ++ {0x0303, 0x01}, /* VTSYSCK_DIV */ ++ {0x0304, 0x03}, /* PREPLLCK_VT_DIV 0x03 = AUTO set */ ++ {0x0305, 0x03}, /* PREPLLCK_OP_DIV 0x03 = AUTO set */ ++ {0x0306, 0x00}, /* PLL_VT_MPY */ ++ {0x0307, 0x39}, ++ {0x030b, 0x01}, /* OP_SYS_CLK_DIV */ ++ {0x030c, 0x00}, /* PLL_OP_MPY */ ++ {0x030d, 0x72}, ++ ++ /* Undocumented registers */ ++ {0x455e, 0x00}, ++ {0x471e, 0x4b}, ++ {0x4767, 0x0f}, ++ {0x4750, 0x14}, ++ {0x4540, 0x00}, ++ {0x47b4, 0x14}, ++ {0x4713, 0x30}, ++ {0x478b, 0x10}, ++ {0x478f, 0x10}, ++ {0x4793, 0x10}, ++ {0x4797, 0x0e}, ++ {0x479b, 0x0e}, ++ ++ /* Frame Bank Register Group "A" */ ++ {0x0162, 0x0d}, /* Line_Length_A */ ++ {0x0163, 0x78}, ++ {0x0170, 0x01}, /* X_ODD_INC_A */ ++ {0x0171, 0x01}, /* Y_ODD_INC_A */ ++ ++ /* Output setup registers */ ++ {0x0114, 0x01}, /* CSI 2-Lane Mode */ ++ {0x0128, 0x00}, /* DPHY Auto Mode */ ++ {0x012a, 0x18}, /* EXCK_Freq */ + {0x012b, 0x00}, ++}; ++ ++/* ++ * Register sets lifted off the i2C interface from the Raspberry Pi firmware ++ * driver. ++ * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7. ++ */ ++static const struct imx219_reg mode_3280x2464_regs[] = { + {0x0164, 0x00}, + {0x0165, 0x00}, + {0x0166, 0x0c}, +@@ -174,53 +212,15 @@ static const struct imx219_reg mode_3280x2464_regs[] = { + {0x016d, 0xd0}, + {0x016e, 0x09}, + {0x016f, 0xa0}, +- {0x0170, 0x01}, +- {0x0171, 0x01}, +- {0x0174, 0x00}, ++ {0x0174, 0x00}, /* No-Binning */ + {0x0175, 0x00}, +- {0x0301, 0x05}, +- {0x0303, 0x01}, +- {0x0304, 0x03}, +- {0x0305, 0x03}, +- {0x0306, 0x00}, +- {0x0307, 0x39}, +- {0x030b, 0x01}, +- {0x030c, 0x00}, +- {0x030d, 0x72}, + {0x0624, 0x0c}, + {0x0625, 0xd0}, + {0x0626, 0x09}, + {0x0627, 0xa0}, +- {0x455e, 0x00}, +- {0x471e, 0x4b}, +- {0x4767, 0x0f}, +- {0x4750, 0x14}, +- {0x4540, 0x00}, +- {0x47b4, 0x14}, +- {0x4713, 0x30}, +- {0x478b, 0x10}, +- {0x478f, 0x10}, +- {0x4793, 0x10}, +- {0x4797, 0x0e}, +- {0x479b, 0x0e}, +- {0x0162, 0x0d}, +- {0x0163, 0x78}, + }; + + static const struct imx219_reg mode_1920_1080_regs[] = { +- {0x0100, 0x00}, +- {0x30eb, 0x05}, +- {0x30eb, 0x0c}, +- {0x300a, 0xff}, +- {0x300b, 0xff}, +- {0x30eb, 0x05}, +- {0x30eb, 0x09}, +- {0x0114, 0x01}, +- {0x0128, 0x00}, +- {0x012a, 0x18}, +- {0x012b, 0x00}, +- {0x0162, 0x0d}, +- {0x0163, 0x78}, + {0x0164, 0x02}, + {0x0165, 0xa8}, + {0x0166, 0x0a}, +@@ -233,49 +233,15 @@ static const struct imx219_reg mode_1920_1080_regs[] = { + {0x016d, 0x80}, + {0x016e, 0x04}, + {0x016f, 0x38}, +- {0x0170, 0x01}, +- {0x0171, 0x01}, +- {0x0174, 0x00}, ++ {0x0174, 0x00}, /* No-Binning */ + {0x0175, 0x00}, +- {0x0301, 0x05}, +- {0x0303, 0x01}, +- {0x0304, 0x03}, +- {0x0305, 0x03}, +- {0x0306, 0x00}, +- {0x0307, 0x39}, +- {0x030b, 0x01}, +- {0x030c, 0x00}, +- {0x030d, 0x72}, + {0x0624, 0x07}, + {0x0625, 0x80}, + {0x0626, 0x04}, + {0x0627, 0x38}, +- {0x455e, 0x00}, +- {0x471e, 0x4b}, +- {0x4767, 0x0f}, +- {0x4750, 0x14}, +- {0x4540, 0x00}, +- {0x47b4, 0x14}, +- {0x4713, 0x30}, +- {0x478b, 0x10}, +- {0x478f, 0x10}, +- {0x4793, 0x10}, +- {0x4797, 0x0e}, +- {0x479b, 0x0e}, + }; + + static const struct imx219_reg mode_1640_1232_regs[] = { +- {0x0100, 0x00}, +- {0x30eb, 0x0c}, +- {0x30eb, 0x05}, +- {0x300a, 0xff}, +- {0x300b, 0xff}, +- {0x30eb, 0x05}, +- {0x30eb, 0x09}, +- {0x0114, 0x01}, +- {0x0128, 0x00}, +- {0x012a, 0x18}, +- {0x012b, 0x00}, + {0x0164, 0x00}, + {0x0165, 0x00}, + {0x0166, 0x0c}, +@@ -288,53 +254,15 @@ static const struct imx219_reg mode_1640_1232_regs[] = { + {0x016d, 0x68}, + {0x016e, 0x04}, + {0x016f, 0xd0}, +- {0x0170, 0x01}, +- {0x0171, 0x01}, +- {0x0174, 0x01}, ++ {0x0174, 0x01}, /* x2-Binning */ + {0x0175, 0x01}, +- {0x0301, 0x05}, +- {0x0303, 0x01}, +- {0x0304, 0x03}, +- {0x0305, 0x03}, +- {0x0306, 0x00}, +- {0x0307, 0x39}, +- {0x030b, 0x01}, +- {0x030c, 0x00}, +- {0x030d, 0x72}, + {0x0624, 0x06}, + {0x0625, 0x68}, + {0x0626, 0x04}, + {0x0627, 0xd0}, +- {0x455e, 0x00}, +- {0x471e, 0x4b}, +- {0x4767, 0x0f}, +- {0x4750, 0x14}, +- {0x4540, 0x00}, +- {0x47b4, 0x14}, +- {0x4713, 0x30}, +- {0x478b, 0x10}, +- {0x478f, 0x10}, +- {0x4793, 0x10}, +- {0x4797, 0x0e}, +- {0x479b, 0x0e}, +- {0x0162, 0x0d}, +- {0x0163, 0x78}, + }; + + static const struct imx219_reg mode_640_480_regs[] = { +- {0x0100, 0x00}, +- {0x30eb, 0x05}, +- {0x30eb, 0x0c}, +- {0x300a, 0xff}, +- {0x300b, 0xff}, +- {0x30eb, 0x05}, +- {0x30eb, 0x09}, +- {0x0114, 0x01}, +- {0x0128, 0x00}, +- {0x012a, 0x18}, +- {0x012b, 0x00}, +- {0x0162, 0x0d}, +- {0x0163, 0x78}, + {0x0164, 0x03}, + {0x0165, 0xe8}, + {0x0166, 0x08}, +@@ -347,35 +275,12 @@ static const struct imx219_reg mode_640_480_regs[] = { + {0x016d, 0x80}, + {0x016e, 0x01}, + {0x016f, 0xe0}, +- {0x0170, 0x01}, +- {0x0171, 0x01}, +- {0x0174, 0x03}, ++ {0x0174, 0x03}, /* x2-analog binning */ + {0x0175, 0x03}, +- {0x0301, 0x05}, +- {0x0303, 0x01}, +- {0x0304, 0x03}, +- {0x0305, 0x03}, +- {0x0306, 0x00}, +- {0x0307, 0x39}, +- {0x030b, 0x01}, +- {0x030c, 0x00}, +- {0x030d, 0x72}, + {0x0624, 0x06}, + {0x0625, 0x68}, + {0x0626, 0x04}, + {0x0627, 0xd0}, +- {0x455e, 0x00}, +- {0x471e, 0x4b}, +- {0x4767, 0x0f}, +- {0x4750, 0x14}, +- {0x4540, 0x00}, +- {0x47b4, 0x14}, +- {0x4713, 0x30}, +- {0x478b, 0x10}, +- {0x478f, 0x10}, +- {0x4793, 0x10}, +- {0x4797, 0x0e}, +- {0x479b, 0x0e}, + }; + + static const struct imx219_reg raw8_framefmt_regs[] = { +@@ -1041,6 +946,13 @@ static int imx219_start_streaming(struct imx219 *imx219) + if (ret < 0) + return ret; + ++ /* Send all registers that are common to all modes */ ++ ret = imx219_write_regs(imx219, imx219_common_regs, ARRAY_SIZE(imx219_common_regs)); ++ if (ret) { ++ dev_err(&client->dev, "%s failed to send mfg header\n", __func__); ++ goto err_rpm_put; ++ } ++ + /* Apply default values of current mode */ + reg_list = &imx219->mode->reg_list; + ret = imx219_write_regs(imx219, reg_list->regs, reg_list->num_of_regs); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-596-media-i2c-imx219-Fix-binning-for-RAW8-capture.patch b/patches.kernel.org/6.2.3-596-media-i2c-imx219-Fix-binning-for-RAW8-capture.patch new file mode 100644 index 0000000..91a07e6 --- /dev/null +++ b/patches.kernel.org/6.2.3-596-media-i2c-imx219-Fix-binning-for-RAW8-capture.patch @@ -0,0 +1,181 @@ +From: Jai Luthra +Date: Tue, 17 Jan 2023 09:16:23 +0100 +Subject: [PATCH] media: i2c: imx219: Fix binning for RAW8 capture +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ef86447e775fb1f2ced00d4c7fff2c0a1c63f165 + +[ Upstream commit ef86447e775fb1f2ced00d4c7fff2c0a1c63f165 ] + +2x2 binning works fine for RAW10 capture, but for RAW8 1232p mode it +leads to corrupted frames [1][2]. + +Using the special 2x2 analog binning mode fixes the issue, but causes +artefacts for RAW10 1232p capture. So here we choose the binning mode +depending upon the frame format selected. + +As both binning modes work fine for 480p RAW8 and RAW10 capture, it can +share the same code path as 1232p for selecting binning mode. + +[1] https://forums.raspberrypi.com/viewtopic.php?t=332103 +[2] https://github.com/raspberrypi/libcamera-apps/issues/281 + +Fixes: 22da1d56e982 ("media: i2c: imx219: Add support for RAW8 bit bayer format") +Signed-off-by: Jai Luthra +Reviewed-by: Dave Stevenson +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/imx219.c | 57 ++++++++++++++++++++++++++++++++------ + 1 file changed, 49 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c +index 7f44d620..7a14688f 100644 +--- a/drivers/media/i2c/imx219.c ++++ b/drivers/media/i2c/imx219.c +@@ -89,6 +89,12 @@ + + #define IMX219_REG_ORIENTATION 0x0172 + ++/* Binning Mode */ ++#define IMX219_REG_BINNING_MODE 0x0174 ++#define IMX219_BINNING_NONE 0x0000 ++#define IMX219_BINNING_2X2 0x0101 ++#define IMX219_BINNING_2X2_ANALOG 0x0303 ++ + /* Test Pattern Control */ + #define IMX219_REG_TEST_PATTERN 0x0600 + #define IMX219_TEST_PATTERN_DISABLE 0 +@@ -143,6 +149,9 @@ struct imx219_mode { + + /* Default register values */ + struct imx219_reg_list reg_list; ++ ++ /* 2x2 binning is used */ ++ bool binning; + }; + + static const struct imx219_reg imx219_common_regs[] = { +@@ -212,8 +221,6 @@ static const struct imx219_reg mode_3280x2464_regs[] = { + {0x016d, 0xd0}, + {0x016e, 0x09}, + {0x016f, 0xa0}, +- {0x0174, 0x00}, /* No-Binning */ +- {0x0175, 0x00}, + {0x0624, 0x0c}, + {0x0625, 0xd0}, + {0x0626, 0x09}, +@@ -233,8 +240,6 @@ static const struct imx219_reg mode_1920_1080_regs[] = { + {0x016d, 0x80}, + {0x016e, 0x04}, + {0x016f, 0x38}, +- {0x0174, 0x00}, /* No-Binning */ +- {0x0175, 0x00}, + {0x0624, 0x07}, + {0x0625, 0x80}, + {0x0626, 0x04}, +@@ -254,8 +259,6 @@ static const struct imx219_reg mode_1640_1232_regs[] = { + {0x016d, 0x68}, + {0x016e, 0x04}, + {0x016f, 0xd0}, +- {0x0174, 0x01}, /* x2-Binning */ +- {0x0175, 0x01}, + {0x0624, 0x06}, + {0x0625, 0x68}, + {0x0626, 0x04}, +@@ -275,8 +278,6 @@ static const struct imx219_reg mode_640_480_regs[] = { + {0x016d, 0x80}, + {0x016e, 0x01}, + {0x016f, 0xe0}, +- {0x0174, 0x03}, /* x2-analog binning */ +- {0x0175, 0x03}, + {0x0624, 0x06}, + {0x0625, 0x68}, + {0x0626, 0x04}, +@@ -390,6 +391,7 @@ static const struct imx219_mode supported_modes[] = { + .num_of_regs = ARRAY_SIZE(mode_3280x2464_regs), + .regs = mode_3280x2464_regs, + }, ++ .binning = false, + }, + { + /* 1080P 30fps cropped */ +@@ -406,6 +408,7 @@ static const struct imx219_mode supported_modes[] = { + .num_of_regs = ARRAY_SIZE(mode_1920_1080_regs), + .regs = mode_1920_1080_regs, + }, ++ .binning = false, + }, + { + /* 2x2 binned 30fps mode */ +@@ -422,6 +425,7 @@ static const struct imx219_mode supported_modes[] = { + .num_of_regs = ARRAY_SIZE(mode_1640_1232_regs), + .regs = mode_1640_1232_regs, + }, ++ .binning = true, + }, + { + /* 640x480 30fps mode */ +@@ -438,6 +442,7 @@ static const struct imx219_mode supported_modes[] = { + .num_of_regs = ARRAY_SIZE(mode_640_480_regs), + .regs = mode_640_480_regs, + }, ++ .binning = true, + }, + }; + +@@ -884,6 +889,35 @@ static int imx219_set_framefmt(struct imx219 *imx219) + return -EINVAL; + } + ++static int imx219_set_binning(struct imx219 *imx219) ++{ ++ if (!imx219->mode->binning) { ++ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE, ++ IMX219_REG_VALUE_16BIT, ++ IMX219_BINNING_NONE); ++ } ++ ++ switch (imx219->fmt.code) { ++ case MEDIA_BUS_FMT_SRGGB8_1X8: ++ case MEDIA_BUS_FMT_SGRBG8_1X8: ++ case MEDIA_BUS_FMT_SGBRG8_1X8: ++ case MEDIA_BUS_FMT_SBGGR8_1X8: ++ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE, ++ IMX219_REG_VALUE_16BIT, ++ IMX219_BINNING_2X2_ANALOG); ++ ++ case MEDIA_BUS_FMT_SRGGB10_1X10: ++ case MEDIA_BUS_FMT_SGRBG10_1X10: ++ case MEDIA_BUS_FMT_SGBRG10_1X10: ++ case MEDIA_BUS_FMT_SBGGR10_1X10: ++ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE, ++ IMX219_REG_VALUE_16BIT, ++ IMX219_BINNING_2X2); ++ } ++ ++ return -EINVAL; ++} ++ + static const struct v4l2_rect * + __imx219_get_pad_crop(struct imx219 *imx219, + struct v4l2_subdev_state *sd_state, +@@ -968,6 +1002,13 @@ static int imx219_start_streaming(struct imx219 *imx219) + goto err_rpm_put; + } + ++ ret = imx219_set_binning(imx219); ++ if (ret) { ++ dev_err(&client->dev, "%s failed to set binning: %d\n", ++ __func__, ret); ++ goto err_rpm_put; ++ } ++ + /* Apply customized values from user */ + ret = __v4l2_ctrl_handler_setup(imx219->sd.ctrl_handler); + if (ret) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-597-media-platform-mtk-mdp3-Fix-return-value-check-.patch b/patches.kernel.org/6.2.3-597-media-platform-mtk-mdp3-Fix-return-value-check-.patch new file mode 100644 index 0000000..450ef9f --- /dev/null +++ b/patches.kernel.org/6.2.3-597-media-platform-mtk-mdp3-Fix-return-value-check-.patch @@ -0,0 +1,54 @@ +From: Qiheng Lin +Date: Fri, 2 Dec 2022 11:18:36 +0100 +Subject: [PATCH] media: platform: mtk-mdp3: Fix return value check in + mdp_probe() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1963689bed4d500236938d90c91cdd5e63c1eb28 + +[ Upstream commit 1963689bed4d500236938d90c91cdd5e63c1eb28 ] + +In case of error, the function mtk_mutex_get() +returns ERR_PTR() and never returns NULL. The NULL test in the +return value check should be replaced with IS_ERR(). +And also fix the err_free_mutex case. + +Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") +Signed-off-by: Qiheng Lin +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c +index 2d1f6ae9..97edcd9d 100644 +--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c ++++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c +@@ -207,8 +207,8 @@ static int mdp_probe(struct platform_device *pdev) + } + for (i = 0; i < MDP_PIPE_MAX; i++) { + mdp->mdp_mutex[i] = mtk_mutex_get(&mm_pdev->dev); +- if (!mdp->mdp_mutex[i]) { +- ret = -ENODEV; ++ if (IS_ERR(mdp->mdp_mutex[i])) { ++ ret = PTR_ERR(mdp->mdp_mutex[i]); + goto err_free_mutex; + } + } +@@ -289,7 +289,8 @@ static int mdp_probe(struct platform_device *pdev) + mdp_comp_destroy(mdp); + err_free_mutex: + for (i = 0; i < MDP_PIPE_MAX; i++) +- mtk_mutex_put(mdp->mdp_mutex[i]); ++ if (!IS_ERR_OR_NULL(mdp->mdp_mutex[i])) ++ mtk_mutex_put(mdp->mdp_mutex[i]); + err_destroy_device: + kfree(mdp); + err_return: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-598-media-camss-csiphy-3ph-avoid-undefined-behavior.patch b/patches.kernel.org/6.2.3-598-media-camss-csiphy-3ph-avoid-undefined-behavior.patch new file mode 100644 index 0000000..84a1529 --- /dev/null +++ b/patches.kernel.org/6.2.3-598-media-camss-csiphy-3ph-avoid-undefined-behavior.patch @@ -0,0 +1,48 @@ +From: Arnd Bergmann +Date: Thu, 15 Dec 2022 17:28:46 +0100 +Subject: [PATCH] media: camss: csiphy-3ph: avoid undefined behavior +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 05fb9ace34b8645cb76f7e3a21b5c7b754329cae + +[ Upstream commit 05fb9ace34b8645cb76f7e3a21b5c7b754329cae ] + +Marking a case of the switch statement as unreachable means the +compiler treats it as undefined behavior, which is then caught by +an objtool warning: + +drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.o: warning: objtool: csiphy_lanes_enable() falls through to next function csiphy_lanes_disable() + +Instead of simply continuing execution at a random place of the +driver, print a warning and return from to the caller, which +makes it possible to understand what happens and avoids the +warning. + +Fixes: 53655d2a0ff2 ("media: camss: csiphy-3ph: add support for SM8250 CSI DPHY") +Signed-off-by: Arnd Bergmann +Reviewed-by: Robert Foss +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c +index 451a4c9b..04baa804 100644 +--- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c ++++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c +@@ -429,7 +429,8 @@ static void csiphy_gen2_config_lanes(struct csiphy_device *csiphy, + array_size = ARRAY_SIZE(lane_regs_sm8250[0]); + break; + default: +- unreachable(); ++ WARN(1, "unknown cspi version\n"); ++ return; + } + + for (l = 0; l < 5; l++) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-599-media-platform-mtk-mdp3-fix-Kconfig-dependencie.patch b/patches.kernel.org/6.2.3-599-media-platform-mtk-mdp3-fix-Kconfig-dependencie.patch new file mode 100644 index 0000000..ee0003a --- /dev/null +++ b/patches.kernel.org/6.2.3-599-media-platform-mtk-mdp3-fix-Kconfig-dependencie.patch @@ -0,0 +1,60 @@ +From: Arnd Bergmann +Date: Thu, 15 Dec 2022 17:40:08 +0100 +Subject: [PATCH] media: platform: mtk-mdp3: fix Kconfig dependencies +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e3f7feb6d89311f369dd4ad903ea62e45328cdbe + +[ Upstream commit e3f7feb6d89311f369dd4ad903ea62e45328cdbe ] + +The new mdp3 driver uses 'select' to force-enable a couple of drivers +it depends on. This is error-prone and likely to cause dependency +loops as well as warnings like: + +WARNING: unmet direct dependencies detected for VIDEO_MEDIATEK_VPU + Depends on [n]: MEDIA_SUPPORT [=m] && MEDIA_PLATFORM_SUPPORT [=y] && MEDIA_PLATFORM_DRIVERS [=y] && V4L_MEM2MEM_DRIVERS [=n] && VIDEO_DEV [=m] && (ARCH_MEDIATEK [=y] || COMPILE_TEST [=y]) + Selected by [m]: + - VIDEO_MEDIATEK_MDP3 [=m] && MEDIA_SUPPORT [=m] && MEDIA_PLATFORM_SUPPORT [=y] && MEDIA_PLATFORM_DRIVERS [=y] && (MTK_IOMMU [=m] || COMPILE_TEST [=y]) && VIDEO_DEV [=m] && (ARCH_MEDIATEK [=y] || COMPILE_TEST [=y]) && HAS_DMA [=y] && REMOTEPROC [=y] + +This specific warning was already addressed in a previous patch, +but there are similar unnecessary 'select' statements, so turn those +into 'depends on'. This also means the dependency on ARCH_MEDIATEK +is redundant and can be dropped. + +Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") +Fixes: 9195a860ef0a ("media: platform: mtk-mdp3: remove unused VIDEO_MEDIATEK_VPU config") +Signed-off-by: Arnd Bergmann +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/platform/mediatek/mdp3/Kconfig | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/mediatek/mdp3/Kconfig b/drivers/media/platform/mediatek/mdp3/Kconfig +index 846e759a..602329c4 100644 +--- a/drivers/media/platform/mediatek/mdp3/Kconfig ++++ b/drivers/media/platform/mediatek/mdp3/Kconfig +@@ -3,14 +3,13 @@ config VIDEO_MEDIATEK_MDP3 + tristate "MediaTek MDP v3 driver" + depends on MTK_IOMMU || COMPILE_TEST + depends on VIDEO_DEV +- depends on ARCH_MEDIATEK || COMPILE_TEST + depends on HAS_DMA + depends on REMOTEPROC ++ depends on MTK_MMSYS ++ depends on MTK_CMDQ ++ depends on MTK_SCP + select VIDEOBUF2_DMA_CONTIG + select V4L2_MEM2MEM_DEV +- select MTK_MMSYS +- select MTK_CMDQ +- select MTK_SCP + default n + help + It is a v4l2 driver and present in MediaTek MT8183 SoC. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-600-media-v4l2-jpeg-correct-the-skip-count-in-jpeg_.patch b/patches.kernel.org/6.2.3-600-media-v4l2-jpeg-correct-the-skip-count-in-jpeg_.patch new file mode 100644 index 0000000..d5e73a5 --- /dev/null +++ b/patches.kernel.org/6.2.3-600-media-v4l2-jpeg-correct-the-skip-count-in-jpeg_.patch @@ -0,0 +1,46 @@ +From: Ming Qian +Date: Fri, 16 Dec 2022 09:30:33 +0100 +Subject: [PATCH] media: v4l2-jpeg: correct the skip count in + jpeg_parse_app14_data +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 41959c4f973b837a12061b84d3a436fc64c73a30 + +[ Upstream commit 41959c4f973b837a12061b84d3a436fc64c73a30 ] + +The curr pointer has advanced 14 bytes in jpeg_parse_app14_data. +1. jpeg_get_word_be(stream), it goes forward 2 bytes. +2. jpeg_skip(stream, 11), it goes forward 11 bytes. +3. jpeg_get_byte(stream), it goes forward 1 bytes. + +so the remain bytes of this segment should be (lp - 2 - 11 - 1), +but not (lp - 2 - 11). + +if driver skip 1 extra bytes, the following parsing may go wrong. + +Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c +index c2513b77..75c2af76 100644 +--- a/drivers/media/v4l2-core/v4l2-jpeg.c ++++ b/drivers/media/v4l2-core/v4l2-jpeg.c +@@ -474,7 +474,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, + *tf = ret; + + /* skip the rest of the segment, this ensures at least it is complete */ +- skip = lp - 2 - 11; ++ skip = lp - 2 - 11 - 1; + return jpeg_skip(stream, skip); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-601-media-v4l2-jpeg-ignore-the-unknown-APP14-marker.patch b/patches.kernel.org/6.2.3-601-media-v4l2-jpeg-ignore-the-unknown-APP14-marker.patch new file mode 100644 index 0000000..cdc865b --- /dev/null +++ b/patches.kernel.org/6.2.3-601-media-v4l2-jpeg-ignore-the-unknown-APP14-marker.patch @@ -0,0 +1,41 @@ +From: Ming Qian +Date: Fri, 16 Dec 2022 10:08:44 +0100 +Subject: [PATCH] media: v4l2-jpeg: ignore the unknown APP14 marker +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 251c0ea6efd3c3ea0f8a55fdd96c749a98639bd3 + +[ Upstream commit 251c0ea6efd3c3ea0f8a55fdd96c749a98639bd3 ] + +The legal identifier of APP14 is "Adobe\0", +but sometimes it may be +"This is an unknown APP marker . Compliant decoders must ignore it." +In this case, just ignore it. +It won't affect the decode result. + +Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c +index 75c2af76..94435a7b 100644 +--- a/drivers/media/v4l2-core/v4l2-jpeg.c ++++ b/drivers/media/v4l2-core/v4l2-jpeg.c +@@ -460,7 +460,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, + /* Check for "Adobe\0" in Ap1..6 */ + if (stream->curr + 6 > stream->end || + strncmp(stream->curr, "Adobe\0", 6)) +- return -EINVAL; ++ return jpeg_skip(stream, lp - 2); + + /* get to Ap12 */ + ret = jpeg_skip(stream, 11); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-602-media-hantro-Fix-JPEG-encoder-ENUM_FRMSIZE-on-R.patch b/patches.kernel.org/6.2.3-602-media-hantro-Fix-JPEG-encoder-ENUM_FRMSIZE-on-R.patch new file mode 100644 index 0000000..f39a9ac --- /dev/null +++ b/patches.kernel.org/6.2.3-602-media-hantro-Fix-JPEG-encoder-ENUM_FRMSIZE-on-R.patch @@ -0,0 +1,58 @@ +From: Nicolas Dufresne +Date: Fri, 23 Dec 2022 19:16:47 +0100 +Subject: [PATCH] media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 29bd426764dee14a09e37700406f4a5920825fcc + +[ Upstream commit 29bd426764dee14a09e37700406f4a5920825fcc ] + +Since 79c987de8b354, enumerating framesize on format set with "MODE_NONE" +(any raw formats) is reporting an invalid frmsize. + + Size: Stepwise 0x0 - 0x0 with step 0/0 + +Before this change, the driver would return EINVAL, which is also invalid +but worked in GStreamer. The original intent was not to implement it, hence +the -ENOTTY return in this change. While drivers should implement +ENUM_FRMSIZE for all formats and queues, this change is limited in scope to +fix the regression. + +This fixes taking picture in Gnome Cheese software, or any software using +GSteamer to encode JPEG with hardware acceleration. + +Fixes: 79c987de8b35 ("media: hantro: Use post processor scaling capacities") +Reported-by: Robert Mader +Signed-off-by: Nicolas Dufresne +Reviewed-by: Benjamin Gaignard +Reviewed-by: Ezequiel Garcia +Tested-by: Robert Mader +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/platform/verisilicon/hantro_v4l2.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c +index 2c7a8052..30e650ed 100644 +--- a/drivers/media/platform/verisilicon/hantro_v4l2.c ++++ b/drivers/media/platform/verisilicon/hantro_v4l2.c +@@ -161,8 +161,11 @@ static int vidioc_enum_framesizes(struct file *file, void *priv, + } + + /* For non-coded formats check if postprocessing scaling is possible */ +- if (fmt->codec_mode == HANTRO_MODE_NONE && hantro_needs_postproc(ctx, fmt)) { +- return hanto_postproc_enum_framesizes(ctx, fsize); ++ if (fmt->codec_mode == HANTRO_MODE_NONE) { ++ if (hantro_needs_postproc(ctx, fmt)) ++ return hanto_postproc_enum_framesizes(ctx, fsize); ++ else ++ return -ENOTTY; + } else if (fsize->index != 0) { + vpu_debug(0, "invalid frame size index (expected 0, got %d)\n", + fsize->index); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-603-media-imx-jpeg-Apply-clk_bulk-api-instead-of-op.patch b/patches.kernel.org/6.2.3-603-media-imx-jpeg-Apply-clk_bulk-api-instead-of-op.patch new file mode 100644 index 0000000..ddd060f --- /dev/null +++ b/patches.kernel.org/6.2.3-603-media-imx-jpeg-Apply-clk_bulk-api-instead-of-op.patch @@ -0,0 +1,108 @@ +From: Ming Qian +Date: Thu, 12 Jan 2023 10:47:02 +0100 +Subject: [PATCH] media: imx-jpeg: Apply clk_bulk api instead of operating + specific clk +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 61fe43dc9f454bc3caa99dbdd8f5fa3ba813981a + +[ Upstream commit 61fe43dc9f454bc3caa99dbdd8f5fa3ba813981a ] + +using the api of clk_bulk can simplify the code. +and the clock of the jpeg codec may be changed, +the clk_bulk api can be compatible with the future change. + +Fixes: 4c2e5156d9fa ("media: imx-jpeg: Add pm-runtime support for imx-jpeg") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../media/platform/nxp/imx-jpeg/mxc-jpeg.c | 35 +++++-------------- + .../media/platform/nxp/imx-jpeg/mxc-jpeg.h | 4 +-- + 2 files changed, 10 insertions(+), 29 deletions(-) + +diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +index 6cd015a3..f085f14d 100644 +--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c ++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +@@ -2472,19 +2472,12 @@ static int mxc_jpeg_probe(struct platform_device *pdev) + jpeg->mode = mode; + + /* Get clocks */ +- jpeg->clk_ipg = devm_clk_get(dev, "ipg"); +- if (IS_ERR(jpeg->clk_ipg)) { +- dev_err(dev, "failed to get clock: ipg\n"); +- ret = PTR_ERR(jpeg->clk_ipg); +- goto err_clk; +- } +- +- jpeg->clk_per = devm_clk_get(dev, "per"); +- if (IS_ERR(jpeg->clk_per)) { +- dev_err(dev, "failed to get clock: per\n"); +- ret = PTR_ERR(jpeg->clk_per); ++ ret = devm_clk_bulk_get_all(&pdev->dev, &jpeg->clks); ++ if (ret < 0) { ++ dev_err(dev, "failed to get clock\n"); + goto err_clk; + } ++ jpeg->num_clks = ret; + + ret = mxc_jpeg_attach_pm_domains(jpeg); + if (ret < 0) { +@@ -2581,32 +2574,20 @@ static int mxc_jpeg_runtime_resume(struct device *dev) + struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev); + int ret; + +- ret = clk_prepare_enable(jpeg->clk_ipg); +- if (ret < 0) { +- dev_err(dev, "failed to enable clock: ipg\n"); +- goto err_ipg; +- } +- +- ret = clk_prepare_enable(jpeg->clk_per); ++ ret = clk_bulk_prepare_enable(jpeg->num_clks, jpeg->clks); + if (ret < 0) { +- dev_err(dev, "failed to enable clock: per\n"); +- goto err_per; ++ dev_err(dev, "failed to enable clock\n"); ++ return ret; + } + + return 0; +- +-err_per: +- clk_disable_unprepare(jpeg->clk_ipg); +-err_ipg: +- return ret; + } + + static int mxc_jpeg_runtime_suspend(struct device *dev) + { + struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev); + +- clk_disable_unprepare(jpeg->clk_ipg); +- clk_disable_unprepare(jpeg->clk_per); ++ clk_bulk_disable_unprepare(jpeg->num_clks, jpeg->clks); + + return 0; + } +diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h +index 8fa8c0ae..87157db7 100644 +--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h ++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h +@@ -120,8 +120,8 @@ struct mxc_jpeg_dev { + spinlock_t hw_lock; /* hardware access lock */ + unsigned int mode; + struct mutex lock; /* v4l2 ioctls serialization */ +- struct clk *clk_ipg; +- struct clk *clk_per; ++ struct clk_bulk_data *clks; ++ int num_clks; + struct platform_device *pdev; + struct device *dev; + void __iomem *base_reg; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-604-media-amphion-correct-the-unspecified-color-spa.patch b/patches.kernel.org/6.2.3-604-media-amphion-correct-the-unspecified-color-spa.patch new file mode 100644 index 0000000..e02bd4c --- /dev/null +++ b/patches.kernel.org/6.2.3-604-media-amphion-correct-the-unspecified-color-spa.patch @@ -0,0 +1,60 @@ +From: Ming Qian +Date: Fri, 13 Jan 2023 06:25:51 +0100 +Subject: [PATCH] media: amphion: correct the unspecified color space +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 809060c8a357e020010dd8f797a5efd3c5432b13 + +[ Upstream commit 809060c8a357e020010dd8f797a5efd3c5432b13 ] + +in the E.2.1 of Rec. ITU-T H.264 (06/2019), +0 of colour primaries is reserved, and 2 is unspecified. +driver can map V4L2_COLORSPACE_LAST to 0, +and map V4L2_COLORSPACE_DEFAULT to 2. + +v4l2_xfer_func and v4l2_ycbcr_encoding are similar case. + +Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/platform/amphion/vpu_color.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/amphion/vpu_color.c b/drivers/media/platform/amphion/vpu_color.c +index 80b9a53f..4ae435cb 100644 +--- a/drivers/media/platform/amphion/vpu_color.c ++++ b/drivers/media/platform/amphion/vpu_color.c +@@ -17,7 +17,7 @@ + #include "vpu_helpers.h" + + static const u8 colorprimaries[] = { +- 0, ++ V4L2_COLORSPACE_LAST, + V4L2_COLORSPACE_REC709, /*Rec. ITU-R BT.709-6*/ + 0, + 0, +@@ -31,7 +31,7 @@ static const u8 colorprimaries[] = { + }; + + static const u8 colortransfers[] = { +- 0, ++ V4L2_XFER_FUNC_LAST, + V4L2_XFER_FUNC_709, /*Rec. ITU-R BT.709-6*/ + 0, + 0, +@@ -53,7 +53,7 @@ static const u8 colortransfers[] = { + }; + + static const u8 colormatrixcoefs[] = { +- 0, ++ V4L2_YCBCR_ENC_LAST, + V4L2_YCBCR_ENC_709, /*Rec. ITU-R BT.709-6*/ + 0, + 0, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-605-media-drivers-media-v4l2-core-v4l2-h264-add-det.patch b/patches.kernel.org/6.2.3-605-media-drivers-media-v4l2-core-v4l2-h264-add-det.patch new file mode 100644 index 0000000..b028299 --- /dev/null +++ b/patches.kernel.org/6.2.3-605-media-drivers-media-v4l2-core-v4l2-h264-add-det.patch @@ -0,0 +1,51 @@ +From: Dong Chuanjian +Date: Tue, 27 Dec 2022 03:36:25 +0100 +Subject: [PATCH] media: drivers/media/v4l2-core/v4l2-h264 : add detection of + null pointers +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: be3ae7cf4326e95bb1d5413b63baabc26f4a1324 + +[ Upstream commit be3ae7cf4326e95bb1d5413b63baabc26f4a1324 ] + +When the pointer variable is judged to be null, null is returned +directly. + +[hverkuil: fix two checkpatch warnings] + +Signed-off-by: Dong Chuanjian +Acked-by: Nicolas Dufresne +Fixes: d3f756ad629b ("media: v4l2: Trace calculated p/b0/b1 initial reflist") +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/v4l2-core/v4l2-h264.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/v4l2-core/v4l2-h264.c b/drivers/media/v4l2-core/v4l2-h264.c +index 72bd64f6..c00197d0 100644 +--- a/drivers/media/v4l2-core/v4l2-h264.c ++++ b/drivers/media/v4l2-core/v4l2-h264.c +@@ -305,6 +305,8 @@ static const char *format_ref_list_p(const struct v4l2_h264_reflist_builder *bui + int n = 0, i; + + *out_str = kmalloc(tmp_str_size, GFP_KERNEL); ++ if (!(*out_str)) ++ return NULL; + + n += snprintf(*out_str + n, tmp_str_size - n, "|"); + +@@ -343,6 +345,8 @@ static const char *format_ref_list_b(const struct v4l2_h264_reflist_builder *bui + int n = 0, i; + + *out_str = kmalloc(tmp_str_size, GFP_KERNEL); ++ if (!(*out_str)) ++ return NULL; + + n += snprintf(*out_str + n, tmp_str_size - n, "|"); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-606-media-rc-Fix-use-after-free-bugs-caused-by-ene_.patch b/patches.kernel.org/6.2.3-606-media-rc-Fix-use-after-free-bugs-caused-by-ene_.patch new file mode 100644 index 0000000..0fcabe4 --- /dev/null +++ b/patches.kernel.org/6.2.3-606-media-rc-Fix-use-after-free-bugs-caused-by-ene_.patch @@ -0,0 +1,84 @@ +From: Duoming Zhou +Date: Tue, 24 Jan 2023 08:55:33 +0100 +Subject: [PATCH] media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 29b0589a865b6f66d141d79b2dd1373e4e50fe17 + +[ Upstream commit 29b0589a865b6f66d141d79b2dd1373e4e50fe17 ] + +When the ene device is detaching, function ene_remove() will +be called. But there is no function to cancel tx_sim_timer +in ene_remove(), the timer handler ene_tx_irqsim() could race +with ene_remove(). As a result, the UAF bugs could happen, +the process is shown below. + + (cleanup routine) | (timer routine) + | mod_timer(&dev->tx_sim_timer, ..) +ene_remove() | (wait a time) + | ene_tx_irqsim() + | dev->hw_lock //USE + | ene_tx_sample(dev) //USE + +Fix by adding del_timer_sync(&dev->tx_sim_timer) in ene_remove(), +The tx_sim_timer could stop before ene device is deallocated. + +What's more, The rc_unregister_device() and del_timer_sync() +should be called first in ene_remove() and the deallocated +functions such as free_irq(), release_region() and so on +should be called behind them. Because the rc_unregister_device() +is well synchronized. Otherwise, race conditions may happen. The +situations that may lead to race conditions are shown below. + +Firstly, the rx receiver is disabled with ene_rx_disable() +before rc_unregister_device() in ene_remove(), which means it +can be enabled again if a process opens /dev/lirc0 between +ene_rx_disable() and rc_unregister_device(). + +Secondly, the irqaction descriptor is freed by free_irq() +before the rc device is unregistered, which means irqaction +descriptor may be accessed again after it is deallocated. + +Thirdly, the timer can call ene_tx_sample() that can write +to the io ports, which means the io ports could be accessed +again after they are deallocated by release_region(). + +Therefore, the rc_unregister_device() and del_timer_sync() +should be called first in ene_remove(). + +Suggested by: Sean Young + +Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver") +Signed-off-by: Duoming Zhou +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/rc/ene_ir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c +index e0927091..11ee21a7 100644 +--- a/drivers/media/rc/ene_ir.c ++++ b/drivers/media/rc/ene_ir.c +@@ -1106,6 +1106,8 @@ static void ene_remove(struct pnp_dev *pnp_dev) + struct ene_device *dev = pnp_get_drvdata(pnp_dev); + unsigned long flags; + ++ rc_unregister_device(dev->rdev); ++ del_timer_sync(&dev->tx_sim_timer); + spin_lock_irqsave(&dev->hw_lock, flags); + ene_rx_disable(dev); + ene_rx_restore_hw_buffer(dev); +@@ -1113,7 +1115,6 @@ static void ene_remove(struct pnp_dev *pnp_dev) + + free_irq(dev->irq, dev); + release_region(dev->hw_io, ENE_IO_SIZE); +- rc_unregister_device(dev->rdev); + kfree(dev); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-607-media-atomisp-fix-videobuf2-Kconfig-depenendenc.patch b/patches.kernel.org/6.2.3-607-media-atomisp-fix-videobuf2-Kconfig-depenendenc.patch new file mode 100644 index 0000000..0218daf --- /dev/null +++ b/patches.kernel.org/6.2.3-607-media-atomisp-fix-videobuf2-Kconfig-depenendenc.patch @@ -0,0 +1,45 @@ +From: Arnd Bergmann +Date: Wed, 4 Jan 2023 09:21:36 +0100 +Subject: [PATCH] media: atomisp: fix videobuf2 Kconfig depenendency +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: be94be1b7fc7e51f9ccef20a0ef76583587275f3 + +[ Upstream commit be94be1b7fc7e51f9ccef20a0ef76583587275f3 ] + +The recent conversion missed the Kconfig bit, so it can now +end up in a link error on randconfig builds: + +ld.lld: error: undefined symbol: vb2_vmalloc_memops +>>> referenced by atomisp_fops.c +>>> drivers/staging/media/atomisp/pci/atomisp_fops.o:(atomisp_open) in archive vmlinux.a + +Link: https://lore.kernel.org/r/20230104082212.3770415-1-arnd@kernel.org + +Fixes: cb48ae89be3b ("media: atomisp: Convert to videobuf2") +Signed-off-by: Arnd Bergmann +Tested-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/staging/media/atomisp/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/atomisp/Kconfig b/drivers/staging/media/atomisp/Kconfig +index 2c8d7fdc..c9bff98e 100644 +--- a/drivers/staging/media/atomisp/Kconfig ++++ b/drivers/staging/media/atomisp/Kconfig +@@ -14,7 +14,7 @@ config VIDEO_ATOMISP + depends on VIDEO_DEV && INTEL_ATOMISP + depends on PMIC_OPREGION + select IOSF_MBI +- select VIDEOBUF_VMALLOC ++ select VIDEOBUF2_VMALLOC + select VIDEO_V4L2_SUBDEV_API + help + Say Y here if your platform supports Intel Atom SoC +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-608-media-atomisp-Only-set-default_run_mode-on-firs.patch b/patches.kernel.org/6.2.3-608-media-atomisp-Only-set-default_run_mode-on-firs.patch new file mode 100644 index 0000000..be14975 --- /dev/null +++ b/patches.kernel.org/6.2.3-608-media-atomisp-Only-set-default_run_mode-on-firs.patch @@ -0,0 +1,51 @@ +From: Hans de Goede +Date: Wed, 28 Dec 2022 23:11:47 +0100 +Subject: [PATCH] media: atomisp: Only set default_run_mode on first open of a + stream/asd +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 60ec70a71a9f9975a5d2dd4a7d97c20da0e41976 + +[ Upstream commit 60ec70a71a9f9975a5d2dd4a7d97c20da0e41976 ] + +Calling v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode) when +the stream is already active (through another /dev/video# node) causes +the stream to stop. + +Move the call to set the default run-mode so that it is only done +on the first open of one of the 4 /dev/video# nodes of one of +the 2 streams (atomisp-sub-devices / asd-s). + +Fixes: 2c45e343c581 ("media: atomisp: set per-device's default mode") +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/staging/media/atomisp/pci/atomisp_fops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c +index acea7492..9b9d50d7 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c +@@ -821,13 +821,13 @@ static int atomisp_open(struct file *file) + goto done; + + atomisp_subdev_init_struct(asd); ++ /* Ensure that a mode is set */ ++ v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode); + + done: + pipe->users++; + mutex_unlock(&isp->mutex); + +- /* Ensure that a mode is set */ +- v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode); + + return 0; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-609-media-i2c-ov7670-0-instead-of-EINVAL-was-return.patch b/patches.kernel.org/6.2.3-609-media-i2c-ov7670-0-instead-of-EINVAL-was-return.patch new file mode 100644 index 0000000..645eab7 --- /dev/null +++ b/patches.kernel.org/6.2.3-609-media-i2c-ov7670-0-instead-of-EINVAL-was-return.patch @@ -0,0 +1,42 @@ +From: Hans Verkuil +Date: Thu, 26 Jan 2023 14:03:51 +0100 +Subject: [PATCH] media: i2c: ov7670: 0 instead of -EINVAL was returned +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6a4c664539e6de9b32b65ddcf767ec1bcc1d7f8a + +[ Upstream commit 6a4c664539e6de9b32b65ddcf767ec1bcc1d7f8a ] + +If the media bus is unsupported, then return -EINVAL. Instead it +returned 'ret' which happened to be 0. + +This fixes a smatch warning: + +ov7670.c:1843 ov7670_parse_dt() warn: missing error code? 'ret' + +Signed-off-by: Hans Verkuil +Fixes: 01b8444828fc ("media: v4l2: i2c: ov7670: Implement OF mbus configuration") +Acked-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/i2c/ov7670.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c +index 11d3bef6..6e423cbc 100644 +--- a/drivers/media/i2c/ov7670.c ++++ b/drivers/media/i2c/ov7670.c +@@ -1840,7 +1840,7 @@ static int ov7670_parse_dt(struct device *dev, + + if (bus_cfg.bus_type != V4L2_MBUS_PARALLEL) { + dev_err(dev, "Unsupported media bus type\n"); +- return ret; ++ return -EINVAL; + } + info->mbus_config = bus_cfg.bus.parallel.flags; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-610-media-usb-siano-Fix-use-after-free-bugs-caused-.patch b/patches.kernel.org/6.2.3-610-media-usb-siano-Fix-use-after-free-bugs-caused-.patch new file mode 100644 index 0000000..86fba7d --- /dev/null +++ b/patches.kernel.org/6.2.3-610-media-usb-siano-Fix-use-after-free-bugs-caused-.patch @@ -0,0 +1,235 @@ +From: Duoming Zhou +Date: Mon, 23 Jan 2023 03:04:38 +0100 +Subject: [PATCH] media: usb: siano: Fix use after free bugs caused by + do_submit_urb +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ebad8e731c1c06adf04621d6fd327b860c0861b5 + +[ Upstream commit ebad8e731c1c06adf04621d6fd327b860c0861b5 ] + +There are UAF bugs caused by do_submit_urb(). One of the KASan reports +is shown below: + +[ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890 +[ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49 +[ 36.408316] +[ 36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8 +[ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 +[ 36.416157] Workqueue: 0x0 (events) +[ 36.417654] Call Trace: +[ 36.418546] +[ 36.419320] dump_stack_lvl+0x96/0xd0 +[ 36.420522] print_address_description+0x75/0x350 +[ 36.421992] print_report+0x11b/0x250 +[ 36.423174] ? _raw_spin_lock_irqsave+0x87/0xd0 +[ 36.424806] ? __virt_addr_valid+0xcf/0x170 +[ 36.426069] ? worker_thread+0x4a2/0x890 +[ 36.427355] kasan_report+0x131/0x160 +[ 36.428556] ? worker_thread+0x4a2/0x890 +[ 36.430053] worker_thread+0x4a2/0x890 +[ 36.431297] ? worker_clr_flags+0x90/0x90 +[ 36.432479] kthread+0x166/0x190 +[ 36.433493] ? kthread_blkcg+0x50/0x50 +[ 36.434669] ret_from_fork+0x22/0x30 +[ 36.435923] +[ 36.436684] +[ 36.437215] Allocated by task 24: +[ 36.438289] kasan_set_track+0x50/0x80 +[ 36.439436] __kasan_kmalloc+0x89/0xa0 +[ 36.440566] smsusb_probe+0x374/0xc90 +[ 36.441920] usb_probe_interface+0x2d1/0x4c0 +[ 36.443253] really_probe+0x1d5/0x580 +[ 36.444539] __driver_probe_device+0xe3/0x130 +[ 36.446085] driver_probe_device+0x49/0x220 +[ 36.447423] __device_attach_driver+0x19e/0x1b0 +[ 36.448931] bus_for_each_drv+0xcb/0x110 +[ 36.450217] __device_attach+0x132/0x1f0 +[ 36.451470] bus_probe_device+0x59/0xf0 +[ 36.452563] device_add+0x4ec/0x7b0 +[ 36.453830] usb_set_configuration+0xc63/0xe10 +[ 36.455230] usb_generic_driver_probe+0x3b/0x80 +[ 36.456166] printk: console [ttyGS0] disabled +[ 36.456569] usb_probe_device+0x90/0x110 +[ 36.459523] really_probe+0x1d5/0x580 +[ 36.461027] __driver_probe_device+0xe3/0x130 +[ 36.462465] driver_probe_device+0x49/0x220 +[ 36.463847] __device_attach_driver+0x19e/0x1b0 +[ 36.465229] bus_for_each_drv+0xcb/0x110 +[ 36.466466] __device_attach+0x132/0x1f0 +[ 36.467799] bus_probe_device+0x59/0xf0 +[ 36.469010] device_add+0x4ec/0x7b0 +[ 36.470125] usb_new_device+0x863/0xa00 +[ 36.471374] hub_event+0x18c7/0x2220 +[ 36.472746] process_one_work+0x34c/0x5b0 +[ 36.474041] worker_thread+0x4b7/0x890 +[ 36.475216] kthread+0x166/0x190 +[ 36.476267] ret_from_fork+0x22/0x30 +[ 36.477447] +[ 36.478160] Freed by task 24: +[ 36.479239] kasan_set_track+0x50/0x80 +[ 36.480512] kasan_save_free_info+0x2b/0x40 +[ 36.481808] ____kasan_slab_free+0x122/0x1a0 +[ 36.483173] __kmem_cache_free+0xc4/0x200 +[ 36.484563] smsusb_term_device+0xcd/0xf0 +[ 36.485896] smsusb_probe+0xc85/0xc90 +[ 36.486976] usb_probe_interface+0x2d1/0x4c0 +[ 36.488303] really_probe+0x1d5/0x580 +[ 36.489498] __driver_probe_device+0xe3/0x130 +[ 36.491140] driver_probe_device+0x49/0x220 +[ 36.492475] __device_attach_driver+0x19e/0x1b0 +[ 36.493988] bus_for_each_drv+0xcb/0x110 +[ 36.495171] __device_attach+0x132/0x1f0 +[ 36.496617] bus_probe_device+0x59/0xf0 +[ 36.497875] device_add+0x4ec/0x7b0 +[ 36.498972] usb_set_configuration+0xc63/0xe10 +[ 36.500264] usb_generic_driver_probe+0x3b/0x80 +[ 36.501740] usb_probe_device+0x90/0x110 +[ 36.503084] really_probe+0x1d5/0x580 +[ 36.504241] __driver_probe_device+0xe3/0x130 +[ 36.505548] driver_probe_device+0x49/0x220 +[ 36.506766] __device_attach_driver+0x19e/0x1b0 +[ 36.508368] bus_for_each_drv+0xcb/0x110 +[ 36.509646] __device_attach+0x132/0x1f0 +[ 36.510911] bus_probe_device+0x59/0xf0 +[ 36.512103] device_add+0x4ec/0x7b0 +[ 36.513215] usb_new_device+0x863/0xa00 +[ 36.514736] hub_event+0x18c7/0x2220 +[ 36.516130] process_one_work+0x34c/0x5b0 +[ 36.517396] worker_thread+0x4b7/0x890 +[ 36.518591] kthread+0x166/0x190 +[ 36.519599] ret_from_fork+0x22/0x30 +[ 36.520851] +[ 36.521405] Last potentially related work creation: +[ 36.523143] kasan_save_stack+0x3f/0x60 +[ 36.524275] kasan_record_aux_stack_noalloc+0x9d/0xb0 +[ 36.525831] insert_work+0x25/0x130 +[ 36.527039] __queue_work+0x4d4/0x620 +[ 36.528236] queue_work_on+0x72/0xb0 +[ 36.529344] __usb_hcd_giveback_urb+0x13f/0x1b0 +[ 36.530819] dummy_timer+0x350/0x1a40 +[ 36.532149] call_timer_fn+0x2c/0x190 +[ 36.533567] expire_timers+0x69/0x1f0 +[ 36.534736] __run_timers+0x289/0x2d0 +[ 36.535841] run_timer_softirq+0x2d/0x60 +[ 36.537110] __do_softirq+0x116/0x380 +[ 36.538377] +[ 36.538950] Second to last potentially related work creation: +[ 36.540855] kasan_save_stack+0x3f/0x60 +[ 36.542084] kasan_record_aux_stack_noalloc+0x9d/0xb0 +[ 36.543592] insert_work+0x25/0x130 +[ 36.544891] __queue_work+0x4d4/0x620 +[ 36.546168] queue_work_on+0x72/0xb0 +[ 36.547328] __usb_hcd_giveback_urb+0x13f/0x1b0 +[ 36.548805] dummy_timer+0x350/0x1a40 +[ 36.550116] call_timer_fn+0x2c/0x190 +[ 36.551570] expire_timers+0x69/0x1f0 +[ 36.552762] __run_timers+0x289/0x2d0 +[ 36.553916] run_timer_softirq+0x2d/0x60 +[ 36.555118] __do_softirq+0x116/0x380 +[ 36.556239] +[ 36.556807] The buggy address belongs to the object at ffff888005960000 +[ 36.556807] which belongs to the cache kmalloc-4k of size 4096 +[ 36.560652] The buggy address is located 232 bytes inside of +[ 36.560652] 4096-byte region [ffff888005960000, ffff888005961000) +[ 36.564791] +[ 36.565355] The buggy address belongs to the physical page: +[ 36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00 +[ 36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0 +[ 36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1) +[ 36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000 +[ 36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 +[ 36.580175] page dumped because: kasan: bad access detected +[ 36.581994] +[ 36.582548] Memory state around the buggy address: +[ 36.583983] ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 36.586240] ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.591071] ^ +[ 36.593295] ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.595705] ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.598026] ================================================================== +[ 36.600224] Disabling lock debugging due to kernel taint +[ 36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I +[ 36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G B 6.2.0-rc3-15798-8 +[ 36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 +[ 36.615026] Workqueue: events do_submit_urb +[ 36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 +[ 36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 +[ 36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 +[ 36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 +[ 36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 +[ 36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f +[ 36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 +[ 36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 +[ 36.636438] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 +[ 36.639092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 +[ 36.643411] Call Trace: +[ 36.644215] +[ 36.644902] smscore_getbuffer+0x3e/0x1e0 +[ 36.646147] do_submit_urb+0x4f/0x190 +[ 36.647449] process_one_work+0x34c/0x5b0 +[ 36.648777] worker_thread+0x4b7/0x890 +[ 36.649984] ? worker_clr_flags+0x90/0x90 +[ 36.651166] kthread+0x166/0x190 +[ 36.652151] ? kthread_blkcg+0x50/0x50 +[ 36.653547] ret_from_fork+0x22/0x30 +[ 36.655051] +[ 36.655733] Modules linked in: +[ 36.656787] ---[ end trace 0000000000000000 ]--- +[ 36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 +[ 36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 +[ 36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 +[ 36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 +[ 36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 +[ 36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f +[ 36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 +[ 36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 +[ 36.679184] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 +[ 36.681655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 +[ 36.685733] Kernel panic - not syncing: Fatal exception +[ 36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff) +[ 36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]--- + +When the siano device is plugged in, it may call the following functions +to initialize the device. + +smsusb_probe()-->smsusb_init_device()-->smscore_start_device(). + +When smscore_start_device() gets failed, the function smsusb_term_device() +will be called and smsusb_device_t will be deallocated. Although we use +usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests +and wait for them to finish, the worker threads that are scheduled by +smsusb_onresponse() may be still running. As a result, the UAF bugs +could happen. + +We add cancel_work_sync() in smsusb_stop_streaming() in order that the +worker threads could finish before the smsusb_device_t is deallocated. + +Fixes: dd47fbd40e6e ("[media] smsusb: don't sleep while atomic") +Signed-off-by: Duoming Zhou +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/usb/siano/smsusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index fe9c7b3a..6f443c54 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -179,6 +179,7 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) + + for (i = 0; i < MAX_URBS; i++) { + usb_kill_urb(&dev->surbs[i].urb); ++ cancel_work_sync(&dev->surbs[i].wq); + + if (dev->surbs[i].cb) { + smscore_putbuffer(dev->coredev, dev->surbs[i].cb); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-611-media-saa7134-Use-video_unregister_device-for-r.patch b/patches.kernel.org/6.2.3-611-media-saa7134-Use-video_unregister_device-for-r.patch new file mode 100644 index 0000000..750211a --- /dev/null +++ b/patches.kernel.org/6.2.3-611-media-saa7134-Use-video_unregister_device-for-r.patch @@ -0,0 +1,40 @@ +From: Tasos Sahanidis +Date: Thu, 26 Jan 2023 12:00:59 +0100 +Subject: [PATCH] media: saa7134: Use video_unregister_device for radio_dev +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: bc7635c6435c77a0c168e2cc6535740adfaff4e4 + +[ Upstream commit bc7635c6435c77a0c168e2cc6535740adfaff4e4 ] + +The radio device doesn't use vb2, thus calling vb2_video_unregister_device() +which results in the following warning being printed on module unload. + +WARNING: CPU: 1 PID: 215963 at drivers/media/common/videobuf2/videobuf2-v4l2.c:1236 vb2_video_unregister_device+0xc6/0xe0 [videobuf2_v4l2] + +Fixes: 11788d9b7e91 ("media: media/pci: use vb2_video_unregister_device()") +Signed-off-by: Tasos Sahanidis +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/media/pci/saa7134/saa7134-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c +index 96328b0a..cf287130 100644 +--- a/drivers/media/pci/saa7134/saa7134-core.c ++++ b/drivers/media/pci/saa7134/saa7134-core.c +@@ -978,7 +978,7 @@ static void saa7134_unregister_video(struct saa7134_dev *dev) + } + if (dev->radio_dev) { + if (video_is_registered(dev->radio_dev)) +- vb2_video_unregister_device(dev->radio_dev); ++ video_unregister_device(dev->radio_dev); + else + video_device_release(dev->radio_dev); + dev->radio_dev = NULL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-612-rpmsg-glink-Avoid-infinite-loop-on-intent-for-m.patch b/patches.kernel.org/6.2.3-612-rpmsg-glink-Avoid-infinite-loop-on-intent-for-m.patch new file mode 100644 index 0000000..7f86eb9 --- /dev/null +++ b/patches.kernel.org/6.2.3-612-rpmsg-glink-Avoid-infinite-loop-on-intent-for-m.patch @@ -0,0 +1,40 @@ +From: Bjorn Andersson +Date: Tue, 14 Feb 2023 15:42:31 -0800 +Subject: [PATCH] rpmsg: glink: Avoid infinite loop on intent for missing + channel +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3e74ec2f39362bffbd42854acbb67c7f4cb808f9 + +[ Upstream commit 3e74ec2f39362bffbd42854acbb67c7f4cb808f9 ] + +In the event that an intent advertisement arrives on an unknown channel +the fifo is not advanced, resulting in the same message being handled +over and over. + +Fixes: dacbb35e930f ("rpmsg: glink: Receive and store the remote intent buffers") +Signed-off-by: Bjorn Andersson +Reviewed-by: Chris Lew +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230214234231.2069751-1-quic_bjorande@quicinc.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/rpmsg/qcom_glink_native.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 115c0a1e..bb917746 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -954,6 +954,7 @@ static void qcom_glink_handle_intent(struct qcom_glink *glink, + spin_unlock_irqrestore(&glink->idr_lock, flags); + if (!channel) { + dev_err(glink->dev, "intents for non-existing channel\n"); ++ qcom_glink_rx_advance(glink, ALIGN(msglen, 8)); + return; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-613-rpmsg-glink-Release-driver_override.patch b/patches.kernel.org/6.2.3-613-rpmsg-glink-Release-driver_override.patch new file mode 100644 index 0000000..9c04470 --- /dev/null +++ b/patches.kernel.org/6.2.3-613-rpmsg-glink-Release-driver_override.patch @@ -0,0 +1,47 @@ +From: Bjorn Andersson +Date: Mon, 9 Jan 2023 14:39:31 -0800 +Subject: [PATCH] rpmsg: glink: Release driver_override +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fb80ef67e8ff6a00d3faad4cb348dafdb8eccfd8 + +[ Upstream commit fb80ef67e8ff6a00d3faad4cb348dafdb8eccfd8 ] + +Upon termination of the rpmsg_device, driver_override needs to be freed +to avoid leaking the potentially assigned string. + +Fixes: 42cd402b8fd4 ("rpmsg: Fix kfree() of static memory on setting driver_override") +Fixes: 39e47767ec9b ("rpmsg: Add driver_override device attribute for rpmsg_device") +Reviewed-by: Chris Lew +Signed-off-by: Bjorn Andersson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230109223931.1706429-1-quic_bjorande@quicinc.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/rpmsg/qcom_glink_native.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index bb917746..35df1b0a 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -1447,6 +1447,7 @@ static void qcom_glink_rpdev_release(struct device *dev) + { + struct rpmsg_device *rpdev = to_rpmsg_device(dev); + ++ kfree(rpdev->driver_override); + kfree(rpdev); + } + +@@ -1690,6 +1691,7 @@ static void qcom_glink_device_release(struct device *dev) + + /* Release qcom_glink_alloc_channel() reference */ + kref_put(&channel->refcount, qcom_glink_channel_release); ++ kfree(rpdev->driver_override); + kfree(rpdev); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-614-ARM-OMAP2-omap4-common-Fix-refcount-leak-bug.patch b/patches.kernel.org/6.2.3-614-ARM-OMAP2-omap4-common-Fix-refcount-leak-bug.patch new file mode 100644 index 0000000..91f278c --- /dev/null +++ b/patches.kernel.org/6.2.3-614-ARM-OMAP2-omap4-common-Fix-refcount-leak-bug.patch @@ -0,0 +1,37 @@ +From: Liang He +Date: Tue, 28 Jun 2022 19:29:39 +0800 +Subject: [PATCH] ARM: OMAP2+: omap4-common: Fix refcount leak bug +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7c32919a378782c95c72bc028b5c30dfe8c11f82 + +[ Upstream commit 7c32919a378782c95c72bc028b5c30dfe8c11f82 ] + +In omap4_sram_init(), of_find_compatible_node() will return a node +pointer with refcount incremented. We should use of_node_put() when +it is not used anymore. + +Signed-off-by: Liang He +Message-Id: <20220628112939.160737-1-windhl@126.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/mach-omap2/omap4-common.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c +index 6d1eb4ee..d9ed2a5d 100644 +--- a/arch/arm/mach-omap2/omap4-common.c ++++ b/arch/arm/mach-omap2/omap4-common.c +@@ -140,6 +140,7 @@ static int __init omap4_sram_init(void) + __func__); + else + sram_sync = (void __iomem *)gen_pool_alloc(sram_pool, PAGE_SIZE); ++ of_node_put(np); + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-615-arm64-dts-qcom-msm8996-Add-additional-A2NoC-clo.patch b/patches.kernel.org/6.2.3-615-arm64-dts-qcom-msm8996-Add-additional-A2NoC-clo.patch new file mode 100644 index 0000000..e00fabc --- /dev/null +++ b/patches.kernel.org/6.2.3-615-arm64-dts-qcom-msm8996-Add-additional-A2NoC-clo.patch @@ -0,0 +1,47 @@ +From: Konrad Dybcio +Date: Sat, 10 Dec 2022 21:03:53 +0100 +Subject: [PATCH] arm64: dts: qcom: msm8996: Add additional A2NoC clocks +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 67fb53745e0b38275fa0b422b6a3c6c1c028c9a2 + +[ Upstream commit 67fb53745e0b38275fa0b422b6a3c6c1c028c9a2 ] + +On eMMC devices, the UFS clocks aren't started in the bootloader (or well, +at least it should not be, as that would just leak power..), which results +in platform reboots when trying to access the unclocked UFS hardware, +which unfortunately happens on each and every boot, as interconnect calls +sync_state and goes over each and every path. + +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Tested-by: Dmitry Baryshkov #db820c +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221210200353.418391-6-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index a444d9b5..71678749 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -830,9 +830,11 @@ a2noc: interconnect@583000 { + compatible = "qcom,msm8996-a2noc"; + reg = <0x00583000 0x7000>; + #interconnect-cells = <1>; +- clock-names = "bus", "bus_a"; ++ clock-names = "bus", "bus_a", "aggre2_ufs_axi", "ufs_axi"; + clocks = <&rpmcc RPM_SMD_AGGR2_NOC_CLK>, +- <&rpmcc RPM_SMD_AGGR2_NOC_A_CLK>; ++ <&rpmcc RPM_SMD_AGGR2_NOC_A_CLK>, ++ <&gcc GCC_AGGRE2_UFS_AXI_CLK>, ++ <&gcc GCC_UFS_AXI_CLK>; + }; + + mnoc: interconnect@5a4000 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-616-udf-Define-EFSCORRUPTED-error-code.patch b/patches.kernel.org/6.2.3-616-udf-Define-EFSCORRUPTED-error-code.patch new file mode 100644 index 0000000..50ff64b --- /dev/null +++ b/patches.kernel.org/6.2.3-616-udf-Define-EFSCORRUPTED-error-code.patch @@ -0,0 +1,35 @@ +From: Jan Kara +Date: Thu, 29 Sep 2022 16:34:45 +0200 +Subject: [PATCH] udf: Define EFSCORRUPTED error code +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3d2d7e61553dbcc8ba45201d8ae4f383742c8202 + +[ Upstream commit 3d2d7e61553dbcc8ba45201d8ae4f383742c8202 ] + +Similarly to other filesystems define EFSCORRUPTED error code for +reporting internal filesystem corruption. + +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/udf/udf_sb.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h +index 291b56dd..6bccff3c 100644 +--- a/fs/udf/udf_sb.h ++++ b/fs/udf/udf_sb.h +@@ -55,6 +55,8 @@ + #define MF_DUPLICATE_MD 0x01 + #define MF_MIRROR_FE_LOADED 0x02 + ++#define EFSCORRUPTED EUCLEAN ++ + struct udf_meta_data { + __u32 s_meta_file_loc; + __u32 s_mirror_file_loc; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-617-context_tracking-Fix-noinstr-vs-KASAN.patch b/patches.kernel.org/6.2.3-617-context_tracking-Fix-noinstr-vs-KASAN.patch new file mode 100644 index 0000000..36c88a6 --- /dev/null +++ b/patches.kernel.org/6.2.3-617-context_tracking-Fix-noinstr-vs-KASAN.patch @@ -0,0 +1,84 @@ +From: Peter Zijlstra +Date: Thu, 12 Jan 2023 20:44:05 +0100 +Subject: [PATCH] context_tracking: Fix noinstr vs KASAN +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0e26e1de0032779e43929174339429c16307a299 + +[ Upstream commit 0e26e1de0032779e43929174339429c16307a299 ] + +Low level noinstr context-tracking code is calling out to instrumented +code on KASAN: + + vmlinux.o: warning: objtool: __ct_user_enter+0x72: call to __kasan_check_write() leaves .noinstr.text section + vmlinux.o: warning: objtool: __ct_user_exit+0x47: call to __kasan_check_write() leaves .noinstr.text section + +Use even lower level atomic methods to avoid the instrumentation. + +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230112195542.458034262@infradead.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/context_tracking.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/kernel/context_tracking.c b/kernel/context_tracking.c +index 77978e37..a09f1c19 100644 +--- a/kernel/context_tracking.c ++++ b/kernel/context_tracking.c +@@ -510,7 +510,7 @@ void noinstr __ct_user_enter(enum ctx_state state) + * In this we case we don't care about any concurrency/ordering. + */ + if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) +- atomic_set(&ct->state, state); ++ arch_atomic_set(&ct->state, state); + } else { + /* + * Even if context tracking is disabled on this CPU, because it's outside +@@ -527,7 +527,7 @@ void noinstr __ct_user_enter(enum ctx_state state) + */ + if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) { + /* Tracking for vtime only, no concurrent RCU EQS accounting */ +- atomic_set(&ct->state, state); ++ arch_atomic_set(&ct->state, state); + } else { + /* + * Tracking for vtime and RCU EQS. Make sure we don't race +@@ -535,7 +535,7 @@ void noinstr __ct_user_enter(enum ctx_state state) + * RCU only requires RCU_DYNTICKS_IDX increments to be fully + * ordered. + */ +- atomic_add(state, &ct->state); ++ arch_atomic_add(state, &ct->state); + } + } + } +@@ -630,12 +630,12 @@ void noinstr __ct_user_exit(enum ctx_state state) + * In this we case we don't care about any concurrency/ordering. + */ + if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) +- atomic_set(&ct->state, CONTEXT_KERNEL); ++ arch_atomic_set(&ct->state, CONTEXT_KERNEL); + + } else { + if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) { + /* Tracking for vtime only, no concurrent RCU EQS accounting */ +- atomic_set(&ct->state, CONTEXT_KERNEL); ++ arch_atomic_set(&ct->state, CONTEXT_KERNEL); + } else { + /* + * Tracking for vtime and RCU EQS. Make sure we don't race +@@ -643,7 +643,7 @@ void noinstr __ct_user_exit(enum ctx_state state) + * RCU only requires RCU_DYNTICKS_IDX increments to be fully + * ordered. + */ +- atomic_sub(state, &ct->state); ++ arch_atomic_sub(state, &ct->state); + } + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-618-exit-Detect-and-fix-irq-disabled-state-in-oops.patch b/patches.kernel.org/6.2.3-618-exit-Detect-and-fix-irq-disabled-state-in-oops.patch new file mode 100644 index 0000000..4ea5d7a --- /dev/null +++ b/patches.kernel.org/6.2.3-618-exit-Detect-and-fix-irq-disabled-state-in-oops.patch @@ -0,0 +1,60 @@ +From: Nicholas Piggin +Date: Fri, 20 Jan 2023 11:18:20 +1000 +Subject: [PATCH] exit: Detect and fix irq disabled state in oops +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 001c28e57187570e4b5aa4492c7a957fb6d65d7b + +[ Upstream commit 001c28e57187570e4b5aa4492c7a957fb6d65d7b ] + +If a task oopses with irqs disabled, this can cause various cascading +problems in the oops path such as sleep-from-invalid warnings, and +potentially worse. + +Since commit 0258b5fd7c712 ("coredump: Limit coredumps to a single +thread group"), the unconditional irq enable in coredump_task_exit() +will "fix" the irq state to be enabled early in do_exit(), so currently +this may not be triggerable, but that is coincidental and fragile. + +Detect and fix the irqs_disabled() condition in the oops path before +calling do_exit(), similarly to the way in_atomic() is handled. + +Reported-by: Michael Ellerman +Signed-off-by: Nicholas Piggin +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: "Eric W. Biederman" +Link: https://lore.kernel.org/lkml/20221004094401.708299-1-npiggin@gmail.com/ +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/exit.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/kernel/exit.c b/kernel/exit.c +index 15dc2ec8..bccfa421 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -807,6 +807,8 @@ void __noreturn do_exit(long code) + struct task_struct *tsk = current; + int group_dead; + ++ WARN_ON(irqs_disabled()); ++ + synchronize_group_exit(tsk, code); + + WARN_ON(tsk->plug); +@@ -938,6 +940,11 @@ void __noreturn make_task_dead(int signr) + if (unlikely(!tsk->pid)) + panic("Attempted to kill the idle task!"); + ++ if (unlikely(irqs_disabled())) { ++ pr_info("note: %s[%d] exited with irqs disabled\n", ++ current->comm, task_pid_nr(current)); ++ local_irq_enable(); ++ } + if (unlikely(in_atomic())) { + pr_info("note: %s[%d] exited with preempt_count %d\n", + current->comm, task_pid_nr(current), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-619-ARM-dts-exynos-Use-Exynos5420-compatible-for-th.patch b/patches.kernel.org/6.2.3-619-ARM-dts-exynos-Use-Exynos5420-compatible-for-th.patch new file mode 100644 index 0000000..8d0b89b --- /dev/null +++ b/patches.kernel.org/6.2.3-619-ARM-dts-exynos-Use-Exynos5420-compatible-for-th.patch @@ -0,0 +1,39 @@ +From: Markuss Broks +Date: Sat, 21 Jan 2023 22:18:42 +0200 +Subject: [PATCH] ARM: dts: exynos: Use Exynos5420 compatible for the MIPI + video phy +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5d5aa219a790d61cad2c38e1aa32058f16ad2f0b + +[ Upstream commit 5d5aa219a790d61cad2c38e1aa32058f16ad2f0b ] + +For some reason, the driver adding support for Exynos5420 MIPI phy +back in 2016 wasn't used on Exynos5420, which caused a kernel panic. +Add the proper compatible for it. + +Signed-off-by: Markuss Broks +Link: https://lore.kernel.org/r/20230121201844.46872-2-markuss.broks@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/exynos5420.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi +index 9f2523a8..62263eb9 100644 +--- a/arch/arm/boot/dts/exynos5420.dtsi ++++ b/arch/arm/boot/dts/exynos5420.dtsi +@@ -592,7 +592,7 @@ dp_phy: dp-video-phy { + }; + + mipi_phy: mipi-video-phy { +- compatible = "samsung,s5pv210-mipi-video-phy"; ++ compatible = "samsung,exynos5420-mipi-video-phy"; + syscon = <&pmu_system_controller>; + #phy-cells = <1>; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-620-fs-Use-CHECK_DATA_CORRUPTION-when-kernel-bugs-a.patch b/patches.kernel.org/6.2.3-620-fs-Use-CHECK_DATA_CORRUPTION-when-kernel-bugs-a.patch new file mode 100644 index 0000000..1078ac2 --- /dev/null +++ b/patches.kernel.org/6.2.3-620-fs-Use-CHECK_DATA_CORRUPTION-when-kernel-bugs-a.patch @@ -0,0 +1,97 @@ +From: Jann Horn +Date: Mon, 16 Jan 2023 20:14:25 +0100 +Subject: [PATCH] fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 47d586913f2abec4d240bae33417f537fda987ec + +[ Upstream commit 47d586913f2abec4d240bae33417f537fda987ec ] + +Currently, filp_close() and generic_shutdown_super() use printk() to log +messages when bugs are detected. This is problematic because infrastructure +like syzkaller has no idea that this message indicates a bug. +In addition, some people explicitly want their kernels to BUG() when kernel +data corruption has been detected (CONFIG_BUG_ON_DATA_CORRUPTION). +And finally, when generic_shutdown_super() detects remaining inodes on a +system without CONFIG_BUG_ON_DATA_CORRUPTION, it would be nice if later +accesses to a busy inode would at least crash somewhat cleanly rather than +walking through freed memory. + +To address all three, use CHECK_DATA_CORRUPTION() when kernel bugs are +detected. + +Signed-off-by: Jann Horn +Reviewed-by: Christian Brauner (Microsoft) +Reviewed-by: Kees Cook +Signed-off-by: Christian Brauner (Microsoft) +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/open.c | 5 +++-- + fs/super.c | 21 +++++++++++++++++---- + include/linux/poison.h | 3 +++ + 3 files changed, 23 insertions(+), 6 deletions(-) + +diff --git a/fs/open.c b/fs/open.c +index 82c1a28b..ceb88ac0 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -1411,8 +1411,9 @@ int filp_close(struct file *filp, fl_owner_t id) + { + int retval = 0; + +- if (!file_count(filp)) { +- printk(KERN_ERR "VFS: Close: file count is 0\n"); ++ if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, ++ "VFS: Close: file count is 0 (f_op=%ps)", ++ filp->f_op)) { + return 0; + } + +diff --git a/fs/super.c b/fs/super.c +index 12c08cb2..cf737ec2 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -491,10 +491,23 @@ void generic_shutdown_super(struct super_block *sb) + if (sop->put_super) + sop->put_super(sb); + +- if (!list_empty(&sb->s_inodes)) { +- printk("VFS: Busy inodes after unmount of %s. " +- "Self-destruct in 5 seconds. Have a nice day...\n", +- sb->s_id); ++ if (CHECK_DATA_CORRUPTION(!list_empty(&sb->s_inodes), ++ "VFS: Busy inodes after unmount of %s (%s)", ++ sb->s_id, sb->s_type->name)) { ++ /* ++ * Adding a proper bailout path here would be hard, but ++ * we can at least make it more likely that a later ++ * iput_final() or such crashes cleanly. ++ */ ++ struct inode *inode; ++ ++ spin_lock(&sb->s_inode_list_lock); ++ list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { ++ inode->i_op = VFS_PTR_POISON; ++ inode->i_sb = VFS_PTR_POISON; ++ inode->i_mapping = VFS_PTR_POISON; ++ } ++ spin_unlock(&sb->s_inode_list_lock); + } + } + spin_lock(&sb_lock); +diff --git a/include/linux/poison.h b/include/linux/poison.h +index 2d3249eb..0e8a1f2c 100644 +--- a/include/linux/poison.h ++++ b/include/linux/poison.h +@@ -84,4 +84,7 @@ + /********** kernel/bpf/ **********/ + #define BPF_PTR_POISON ((void *)(0xeB9FUL + POISON_POINTER_DELTA)) + ++/********** VFS **********/ ++#define VFS_PTR_POISON ((void *)(0xF5 + POISON_POINTER_DELTA)) ++ + #endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-621-blk-iocost-fix-divide-by-0-error-in-calc_lcoefs.patch b/patches.kernel.org/6.2.3-621-blk-iocost-fix-divide-by-0-error-in-calc_lcoefs.patch new file mode 100644 index 0000000..bcb82d5 --- /dev/null +++ b/patches.kernel.org/6.2.3-621-blk-iocost-fix-divide-by-0-error-in-calc_lcoefs.patch @@ -0,0 +1,71 @@ +From: Li Nan +Date: Tue, 17 Jan 2023 15:08:05 +0800 +Subject: [PATCH] blk-iocost: fix divide by 0 error in calc_lcoefs() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 984af1e66b4126cf145153661cc24c213e2ec231 + +[ Upstream commit 984af1e66b4126cf145153661cc24c213e2ec231 ] + +echo max of u64 to cost.model can cause divide by 0 error. + + # echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model + + divide error: 0000 [#1] PREEMPT SMP + RIP: 0010:calc_lcoefs+0x4c/0xc0 + Call Trace: + + ioc_refresh_params+0x2b3/0x4f0 + ioc_cost_model_write+0x3cb/0x4c0 + ? _copy_from_iter+0x6d/0x6c0 + ? kernfs_fop_write_iter+0xfc/0x270 + cgroup_file_write+0xa0/0x200 + kernfs_fop_write_iter+0x17d/0x270 + vfs_write+0x414/0x620 + ksys_write+0x73/0x160 + __x64_sys_write+0x1e/0x30 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +calc_lcoefs() uses the input value of cost.model in DIV_ROUND_UP_ULL, +overflow would happen if bps plus IOC_PAGE_SIZE is greater than +ULLONG_MAX, it can cause divide by 0 error. + +Fix the problem by setting basecost + +Signed-off-by: Li Nan +Signed-off-by: Yu Kuai +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20230117070806.3857142-5-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-iocost.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/block/blk-iocost.c b/block/blk-iocost.c +index 69556056..ec7219ca 100644 +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -866,9 +866,14 @@ static void calc_lcoefs(u64 bps, u64 seqiops, u64 randiops, + + *page = *seqio = *randio = 0; + +- if (bps) +- *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC, +- DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE)); ++ if (bps) { ++ u64 bps_pages = DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE); ++ ++ if (bps_pages) ++ *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC, bps_pages); ++ else ++ *page = 1; ++ } + + if (seqiops) { + v = DIV64_U64_ROUND_UP(VTIME_PER_SEC, seqiops); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-622-blk-cgroup-dropping-parent-refcount-after-pd_fr.patch b/patches.kernel.org/6.2.3-622-blk-cgroup-dropping-parent-refcount-after-pd_fr.patch new file mode 100644 index 0000000..a001170 --- /dev/null +++ b/patches.kernel.org/6.2.3-622-blk-cgroup-dropping-parent-refcount-after-pd_fr.patch @@ -0,0 +1,62 @@ +From: Yu Kuai +Date: Thu, 19 Jan 2023 19:03:48 +0800 +Subject: [PATCH] blk-cgroup: dropping parent refcount after pd_free_fn() is + done +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c7241babf0855d8a6180cd1743ff0ec34de40b4e + +[ Upstream commit c7241babf0855d8a6180cd1743ff0ec34de40b4e ] + +Some cgroup policies will access parent pd through child pd even +after pd_offline_fn() is done. If pd_free_fn() for parent is called +before child, then UAF can be triggered. Hence it's better to guarantee +the order of pd_free_fn(). + +Currently refcount of parent blkg is dropped in __blkg_release(), which +is before pd_free_fn() is called in blkg_free_work_fn() while +blkg_free_work_fn() is called asynchronously. + +This patch make sure pd_free_fn() called from removing cgroup is ordered +by delaying dropping parent refcount after calling pd_free_fn() for +child. + +BTW, pd_free_fn() will also be called from blkcg_deactivate_policy() +from deleting device, and following patches will guarantee the order. + +Signed-off-by: Yu Kuai +Acked-by: Tejun Heo +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20230119110350.2287325-2-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-cgroup.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 9ac1efb0..aa890e3e 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -124,6 +124,8 @@ static void blkg_free_workfn(struct work_struct *work) + if (blkg->pd[i]) + blkcg_policy[i]->pd_free_fn(blkg->pd[i]); + ++ if (blkg->parent) ++ blkg_put(blkg->parent); + if (blkg->q) + blk_put_queue(blkg->q); + free_percpu(blkg->iostat_cpu); +@@ -158,8 +160,6 @@ static void __blkg_release(struct rcu_head *rcu) + + /* release the blkcg and parent blkg refs this blkg has been holding */ + css_put(&blkg->blkcg->css); +- if (blkg->parent) +- blkg_put(blkg->parent); + blkg_free(blkg); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-623-blk-cgroup-synchronize-pd_free_fn-from-blkg_fre.patch b/patches.kernel.org/6.2.3-623-blk-cgroup-synchronize-pd_free_fn-from-blkg_fre.patch new file mode 100644 index 0000000..3575bc8 --- /dev/null +++ b/patches.kernel.org/6.2.3-623-blk-cgroup-synchronize-pd_free_fn-from-blkg_fre.patch @@ -0,0 +1,156 @@ +From: Yu Kuai +Date: Thu, 19 Jan 2023 19:03:50 +0800 +Subject: [PATCH] blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() + and blkcg_deactivate_policy() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f1c006f1c6850c14040f8337753a63119bba39b9 + +[ Upstream commit f1c006f1c6850c14040f8337753a63119bba39b9 ] + +Currently parent pd can be freed before child pd: + +t1: remove cgroup C1 +blkcg_destroy_blkgs + blkg_destroy + list_del_init(&blkg->q_node) + // remove blkg from queue list + percpu_ref_kill(&blkg->refcnt) + blkg_release + call_rcu + +t2: from t1 +__blkg_release + blkg_free + schedule_work + t4: deactivate policy + blkcg_deactivate_policy + pd_free_fn + // parent of C1 is freed first +t3: from t2 + blkg_free_workfn + pd_free_fn + +If policy(for example, ioc_timer_fn() from iocost) access parent pd from +child pd after pd_offline_fn(), then UAF can be triggered. + +Fix the problem by delaying 'list_del_init(&blkg->q_node)' from +blkg_destroy() to blkg_free_workfn(), and using a new disk level mutex to +synchronize blkg_free_workfn() and blkcg_deactivate_policy(). + +Signed-off-by: Yu Kuai +Acked-by: Tejun Heo +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20230119110350.2287325-4-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + block/blk-cgroup.c | 35 +++++++++++++++++++++++++++++------ + include/linux/blkdev.h | 1 + + 2 files changed, 30 insertions(+), 6 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index aa890e3e..45881f8c 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -118,16 +118,32 @@ static void blkg_free_workfn(struct work_struct *work) + { + struct blkcg_gq *blkg = container_of(work, struct blkcg_gq, + free_work); ++ struct request_queue *q = blkg->q; + int i; + ++ /* ++ * pd_free_fn() can also be called from blkcg_deactivate_policy(), ++ * in order to make sure pd_free_fn() is called in order, the deletion ++ * of the list blkg->q_node is delayed to here from blkg_destroy(), and ++ * blkcg_mutex is used to synchronize blkg_free_workfn() and ++ * blkcg_deactivate_policy(). ++ */ ++ if (q) ++ mutex_lock(&q->blkcg_mutex); ++ + for (i = 0; i < BLKCG_MAX_POLS; i++) + if (blkg->pd[i]) + blkcg_policy[i]->pd_free_fn(blkg->pd[i]); + + if (blkg->parent) + blkg_put(blkg->parent); +- if (blkg->q) +- blk_put_queue(blkg->q); ++ ++ if (q) { ++ list_del_init(&blkg->q_node); ++ mutex_unlock(&q->blkcg_mutex); ++ blk_put_queue(q); ++ } ++ + free_percpu(blkg->iostat_cpu); + percpu_ref_exit(&blkg->refcnt); + kfree(blkg); +@@ -458,9 +474,14 @@ static void blkg_destroy(struct blkcg_gq *blkg) + lockdep_assert_held(&blkg->q->queue_lock); + lockdep_assert_held(&blkcg->lock); + +- /* Something wrong if we are trying to remove same group twice */ +- WARN_ON_ONCE(list_empty(&blkg->q_node)); +- WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node)); ++ /* ++ * blkg stays on the queue list until blkg_free_workfn(), see details in ++ * blkg_free_workfn(), hence this function can be called from ++ * blkcg_destroy_blkgs() first and again from blkg_destroy_all() before ++ * blkg_free_workfn(). ++ */ ++ if (hlist_unhashed(&blkg->blkcg_node)) ++ return; + + for (i = 0; i < BLKCG_MAX_POLS; i++) { + struct blkcg_policy *pol = blkcg_policy[i]; +@@ -472,7 +493,6 @@ static void blkg_destroy(struct blkcg_gq *blkg) + blkg->online = false; + + radix_tree_delete(&blkcg->blkg_tree, blkg->q->id); +- list_del_init(&blkg->q_node); + hlist_del_init_rcu(&blkg->blkcg_node); + + /* +@@ -1273,6 +1293,7 @@ int blkcg_init_disk(struct gendisk *disk) + int ret; + + INIT_LIST_HEAD(&q->blkg_list); ++ mutex_init(&q->blkcg_mutex); + + new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL); + if (!new_blkg) +@@ -1510,6 +1531,7 @@ void blkcg_deactivate_policy(struct request_queue *q, + if (queue_is_mq(q)) + blk_mq_freeze_queue(q); + ++ mutex_lock(&q->blkcg_mutex); + spin_lock_irq(&q->queue_lock); + + __clear_bit(pol->plid, q->blkcg_pols); +@@ -1528,6 +1550,7 @@ void blkcg_deactivate_policy(struct request_queue *q, + } + + spin_unlock_irq(&q->queue_lock); ++ mutex_unlock(&q->blkcg_mutex); + + if (queue_is_mq(q)) + blk_mq_unfreeze_queue(q); +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 43d4e073..10ee92db 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -484,6 +484,7 @@ struct request_queue { + DECLARE_BITMAP (blkcg_pols, BLKCG_MAX_POLS); + struct blkcg_gq *root_blkg; + struct list_head blkg_list; ++ struct mutex blkcg_mutex; + #endif + + struct queue_limits limits; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-624-trace-blktrace-fix-memory-leak-with-using-debug.patch b/patches.kernel.org/6.2.3-624-trace-blktrace-fix-memory-leak-with-using-debug.patch new file mode 100644 index 0000000..a7b5eaf --- /dev/null +++ b/patches.kernel.org/6.2.3-624-trace-blktrace-fix-memory-leak-with-using-debug.patch @@ -0,0 +1,48 @@ +From: Greg Kroah-Hartman +Date: Thu, 2 Feb 2023 15:19:56 +0100 +Subject: [PATCH] trace/blktrace: fix memory leak with using debugfs_lookup() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 83e8864fee26f63a7435e941b7c36a20fd6fe93e + +[ Upstream commit 83e8864fee26f63a7435e941b7c36a20fd6fe93e ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic +at once. + +Cc: Jens Axboe +Cc: Steven Rostedt +Cc: Masami Hiramatsu +Cc: linux-block@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Cc: linux-trace-kernel@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20230202141956.2299521-1-gregkh@linuxfoundation.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/trace/blktrace.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index 918a7d12..5743be55 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -320,8 +320,8 @@ static void blk_trace_free(struct request_queue *q, struct blk_trace *bt) + * under 'q->debugfs_dir', thus lookup and remove them. + */ + if (!bt->dir) { +- debugfs_remove(debugfs_lookup("dropped", q->debugfs_dir)); +- debugfs_remove(debugfs_lookup("msg", q->debugfs_dir)); ++ debugfs_lookup_and_remove("dropped", q->debugfs_dir); ++ debugfs_lookup_and_remove("msg", q->debugfs_dir); + } else { + debugfs_remove(bt->dir); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-625-btrfs-scrub-improve-tree-block-error-reporting.patch b/patches.kernel.org/6.2.3-625-btrfs-scrub-improve-tree-block-error-reporting.patch new file mode 100644 index 0000000..7ef6036 --- /dev/null +++ b/patches.kernel.org/6.2.3-625-btrfs-scrub-improve-tree-block-error-reporting.patch @@ -0,0 +1,151 @@ +From: Qu Wenruo +Date: Sat, 17 Dec 2022 10:34:29 +0800 +Subject: [PATCH] btrfs: scrub: improve tree block error reporting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 28232909ba43561887508a6ef46d7f33a648f375 + +[ Upstream commit 28232909ba43561887508a6ef46d7f33a648f375 ] + +[BUG] +When debugging a scrub related metadata error, it turns out that our +metadata error reporting is not ideal. + +The only 3 error messages are: + +- BTRFS error (device dm-2): bdev /dev/mapper/test-scratch1 errs: wr 0, rd 0, flush 0, corrupt 0, gen 1 + Showing we have metadata generation mismatch errors. + +- BTRFS error (device dm-2): unable to fixup (regular) error at logical 7110656 on dev /dev/mapper/test-scratch1 + Showing which tree blocks are corrupted. + +- BTRFS warning (device dm-2): checksum/header error at logical 24772608 on dev /dev/mapper/test-scratch2, physical 3801088: metadata node (level 1) in tree 5 + Showing which physical range the corrupted metadata is at. + +We have to combine the above 3 to know we have a corrupted metadata with +generation mismatch. + +And this is already the better case, if we have other problems, like +fsid mismatch, we can not even know the cause. + +[CAUSE] +The problem is caused by the fact that, scrub_checksum_tree_block() +never outputs any error message. + +It just return two bits for scrub: sblock->header_error, and +sblock->generation_error. + +And later we report error in scrub_print_warning(), but unfortunately we +only have two bits, there is not really much thing we can done to print +any detailed errors. + +[FIX] +This patch will do the following to enhance the error reporting of +metadata scrub: + +- Add extra warning (ratelimited) for every error we hit + This can help us to distinguish the different types of errors. + Some errors can help us to know what's going wrong immediately, + like bytenr mismatch. + +- Re-order the checks + Currently we check bytenr first, then immediately generation. + This can lead to false generation mismatch reports, while the fsid + mismatches. + +Here is the new output for the bug I'm debugging (we forgot to +writeback tree blocks for commit roots): + + BTRFS warning (device dm-2): tree block 24117248 mirror 1 has bad fsid, has b77cd862-f150-4c71-90ec-7baf0544d83f want 17df6abf-23cd-445f-b350-5b3e40bfd2fc + BTRFS warning (device dm-2): tree block 24117248 mirror 0 has bad fsid, has b77cd862-f150-4c71-90ec-7baf0544d83f want 17df6abf-23cd-445f-b350-5b3e40bfd2fc + +Now we can immediately know it's some tree blocks didn't even get written +back, other than the original confusing generation mismatch. + +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/btrfs/scrub.c | 49 +++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 40 insertions(+), 9 deletions(-) + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index 52b34679..a5d02604 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -2053,20 +2053,33 @@ static int scrub_checksum_tree_block(struct scrub_block *sblock) + * a) don't have an extent buffer and + * b) the page is already kmapped + */ +- if (sblock->logical != btrfs_stack_header_bytenr(h)) ++ if (sblock->logical != btrfs_stack_header_bytenr(h)) { + sblock->header_error = 1; +- +- if (sector->generation != btrfs_stack_header_generation(h)) { +- sblock->header_error = 1; +- sblock->generation_error = 1; ++ btrfs_warn_rl(fs_info, ++ "tree block %llu mirror %u has bad bytenr, has %llu want %llu", ++ sblock->logical, sblock->mirror_num, ++ btrfs_stack_header_bytenr(h), ++ sblock->logical); ++ goto out; + } + +- if (!scrub_check_fsid(h->fsid, sector)) ++ if (!scrub_check_fsid(h->fsid, sector)) { + sblock->header_error = 1; ++ btrfs_warn_rl(fs_info, ++ "tree block %llu mirror %u has bad fsid, has %pU want %pU", ++ sblock->logical, sblock->mirror_num, ++ h->fsid, sblock->dev->fs_devices->fsid); ++ goto out; ++ } + +- if (memcmp(h->chunk_tree_uuid, fs_info->chunk_tree_uuid, +- BTRFS_UUID_SIZE)) ++ if (memcmp(h->chunk_tree_uuid, fs_info->chunk_tree_uuid, BTRFS_UUID_SIZE)) { + sblock->header_error = 1; ++ btrfs_warn_rl(fs_info, ++ "tree block %llu mirror %u has bad chunk tree uuid, has %pU want %pU", ++ sblock->logical, sblock->mirror_num, ++ h->chunk_tree_uuid, fs_info->chunk_tree_uuid); ++ goto out; ++ } + + shash->tfm = fs_info->csum_shash; + crypto_shash_init(shash); +@@ -2079,9 +2092,27 @@ static int scrub_checksum_tree_block(struct scrub_block *sblock) + } + + crypto_shash_final(shash, calculated_csum); +- if (memcmp(calculated_csum, on_disk_csum, sctx->fs_info->csum_size)) ++ if (memcmp(calculated_csum, on_disk_csum, sctx->fs_info->csum_size)) { + sblock->checksum_error = 1; ++ btrfs_warn_rl(fs_info, ++ "tree block %llu mirror %u has bad csum, has " CSUM_FMT " want " CSUM_FMT, ++ sblock->logical, sblock->mirror_num, ++ CSUM_FMT_VALUE(fs_info->csum_size, on_disk_csum), ++ CSUM_FMT_VALUE(fs_info->csum_size, calculated_csum)); ++ goto out; ++ } ++ ++ if (sector->generation != btrfs_stack_header_generation(h)) { ++ sblock->header_error = 1; ++ sblock->generation_error = 1; ++ btrfs_warn_rl(fs_info, ++ "tree block %llu mirror %u has bad generation, has %llu want %llu", ++ sblock->logical, sblock->mirror_num, ++ btrfs_stack_header_generation(h), ++ sector->generation); ++ } + ++out: + return sblock->header_error || sblock->checksum_error; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-626-arm64-zynqmp-Enable-hs-termination-flag-for-USB.patch b/patches.kernel.org/6.2.3-626-arm64-zynqmp-Enable-hs-termination-flag-for-USB.patch new file mode 100644 index 0000000..a603353 --- /dev/null +++ b/patches.kernel.org/6.2.3-626-arm64-zynqmp-Enable-hs-termination-flag-for-USB.patch @@ -0,0 +1,45 @@ +From: Michael Grzeschik +Date: Sun, 23 Oct 2022 23:56:49 +0200 +Subject: [PATCH] arm64: zynqmp: Enable hs termination flag for USB dwc3 + controller +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 32405e532d358a2f9d4befae928b9883c8597616 + +[ Upstream commit 32405e532d358a2f9d4befae928b9883c8597616 ] + +Since we need to support legacy phys with the dwc3 controller, +we enable this quirk on the zynqmp platforms. + +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20221023215649.221726-1-m.grzeschik@pengutronix.de +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index 4325cb85..f92df478 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -858,6 +858,7 @@ dwc3_0: usb@fe200000 { + clock-names = "bus_early", "ref"; + iommus = <&smmu 0x860>; + snps,quirk-frame-length-adjustment = <0x20>; ++ snps,resume-hs-terminations; + /* dma-coherent; */ + }; + }; +@@ -884,6 +885,7 @@ dwc3_1: usb@fe300000 { + clock-names = "bus_early", "ref"; + iommus = <&smmu 0x861>; + snps,quirk-frame-length-adjustment = <0x20>; ++ snps,resume-hs-terminations; + /* dma-coherent; */ + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-627-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_INIT_XSTATE.patch b/patches.kernel.org/6.2.3-627-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_INIT_XSTATE.patch new file mode 100644 index 0000000..eb8bbc0 --- /dev/null +++ b/patches.kernel.org/6.2.3-627-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_INIT_XSTATE.patch @@ -0,0 +1,87 @@ +From: Peter Zijlstra +Date: Thu, 12 Jan 2023 20:43:33 +0100 +Subject: [PATCH] cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 821ad23d0eaff73ef599ece39ecc77482df20a8c + +[ Upstream commit 821ad23d0eaff73ef599ece39ecc77482df20a8c ] + +Fix instrumentation bugs objtool found: + + vmlinux.o: warning: objtool: intel_idle_s2idle+0xd5: call to fpu_idle_fpregs() leaves .noinstr.text section + vmlinux.o: warning: objtool: intel_idle_xstate+0x11: call to fpu_idle_fpregs() leaves .noinstr.text section + vmlinux.o: warning: objtool: fpu_idle_fpregs+0x9: call to xfeatures_in_use() leaves .noinstr.text section + +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Tested-by: Tony Lindgren +Tested-by: Ulf Hansson +Acked-by: Rafael J. Wysocki +Acked-by: Frederic Weisbecker +Link: https://lore.kernel.org/r/20230112195540.494977795@infradead.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/include/asm/fpu/xcr.h | 4 ++-- + arch/x86/include/asm/special_insns.h | 2 +- + arch/x86/kernel/fpu/core.c | 4 ++-- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/include/asm/fpu/xcr.h b/arch/x86/include/asm/fpu/xcr.h +index 9656a5bc..9a710c06 100644 +--- a/arch/x86/include/asm/fpu/xcr.h ++++ b/arch/x86/include/asm/fpu/xcr.h +@@ -5,7 +5,7 @@ + #define XCR_XFEATURE_ENABLED_MASK 0x00000000 + #define XCR_XFEATURE_IN_USE_MASK 0x00000001 + +-static inline u64 xgetbv(u32 index) ++static __always_inline u64 xgetbv(u32 index) + { + u32 eax, edx; + +@@ -27,7 +27,7 @@ static inline void xsetbv(u32 index, u64 value) + * + * Callers should check X86_FEATURE_XGETBV1. + */ +-static inline u64 xfeatures_in_use(void) ++static __always_inline u64 xfeatures_in_use(void) + { + return xgetbv(XCR_XFEATURE_IN_USE_MASK); + } +diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h +index 35f709f6..c2e32218 100644 +--- a/arch/x86/include/asm/special_insns.h ++++ b/arch/x86/include/asm/special_insns.h +@@ -295,7 +295,7 @@ static inline int enqcmds(void __iomem *dst, const void *src) + return 0; + } + +-static inline void tile_release(void) ++static __always_inline void tile_release(void) + { + /* + * Instruction opcode for TILERELEASE; supported in binutils +diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c +index 9baa89a8..dccce582 100644 +--- a/arch/x86/kernel/fpu/core.c ++++ b/arch/x86/kernel/fpu/core.c +@@ -853,12 +853,12 @@ int fpu__exception_code(struct fpu *fpu, int trap_nr) + * Initialize register state that may prevent from entering low-power idle. + * This function will be invoked from the cpuidle driver only when needed. + */ +-void fpu_idle_fpregs(void) ++noinstr void fpu_idle_fpregs(void) + { + /* Note: AMX_TILE being enabled implies XGETBV1 support */ + if (cpu_feature_enabled(X86_FEATURE_AMX_TILE) && + (xfeatures_in_use() & XFEATURE_MASK_XTILE)) { + tile_release(); +- fpregs_deactivate(¤t->thread.fpu); ++ __this_cpu_write(fpu_fpregs_owner_ctx, NULL); + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-628-x86-fpu-Don-t-set-TIF_NEED_FPU_LOAD-for-PF_IO_W.patch b/patches.kernel.org/6.2.3-628-x86-fpu-Don-t-set-TIF_NEED_FPU_LOAD-for-PF_IO_W.patch new file mode 100644 index 0000000..e976c8a --- /dev/null +++ b/patches.kernel.org/6.2.3-628-x86-fpu-Don-t-set-TIF_NEED_FPU_LOAD-for-PF_IO_W.patch @@ -0,0 +1,70 @@ +From: Jens Axboe +Date: Tue, 24 Jan 2023 08:23:20 -0700 +Subject: [PATCH] x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cb3ea4b7671b7cfbac3ee609976b790aebd0bbda + +[ Upstream commit cb3ea4b7671b7cfbac3ee609976b790aebd0bbda ] + +We don't set it on PF_KTHREAD threads as they never return to userspace, +and PF_IO_WORKER threads are identical in that regard. As they keep +running in the kernel until they die, skip setting the FPU flag on them. + +More of a cosmetic thing that was found while debugging and +issue and pondering why the FPU flag is set on these threads. + +Signed-off-by: Jens Axboe +Signed-off-by: Ingo Molnar +Acked-by: Peter Zijlstra +Link: https://lore.kernel.org/r/560c844c-f128-555b-40c6-31baff27537f@kernel.dk +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/include/asm/fpu/sched.h | 2 +- + arch/x86/kernel/fpu/context.h | 2 +- + arch/x86/kernel/fpu/core.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h +index b2486b2c..c2d6cd78 100644 +--- a/arch/x86/include/asm/fpu/sched.h ++++ b/arch/x86/include/asm/fpu/sched.h +@@ -39,7 +39,7 @@ extern void fpu_flush_thread(void); + static inline void switch_fpu_prepare(struct fpu *old_fpu, int cpu) + { + if (cpu_feature_enabled(X86_FEATURE_FPU) && +- !(current->flags & PF_KTHREAD)) { ++ !(current->flags & (PF_KTHREAD | PF_IO_WORKER))) { + save_fpregs_to_fpstate(old_fpu); + /* + * The save operation preserved register state, so the +diff --git a/arch/x86/kernel/fpu/context.h b/arch/x86/kernel/fpu/context.h +index 958accf2..9fcfa5c4 100644 +--- a/arch/x86/kernel/fpu/context.h ++++ b/arch/x86/kernel/fpu/context.h +@@ -57,7 +57,7 @@ static inline void fpregs_restore_userregs(void) + struct fpu *fpu = ¤t->thread.fpu; + int cpu = smp_processor_id(); + +- if (WARN_ON_ONCE(current->flags & PF_KTHREAD)) ++ if (WARN_ON_ONCE(current->flags & (PF_KTHREAD | PF_IO_WORKER))) + return; + + if (!fpregs_state_valid(fpu, cpu)) { +diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c +index dccce582..caf33486 100644 +--- a/arch/x86/kernel/fpu/core.c ++++ b/arch/x86/kernel/fpu/core.c +@@ -426,7 +426,7 @@ void kernel_fpu_begin_mask(unsigned int kfpu_mask) + + this_cpu_write(in_kernel_fpu, true); + +- if (!(current->flags & PF_KTHREAD) && ++ if (!(current->flags & (PF_KTHREAD | PF_IO_WORKER)) && + !test_thread_flag(TIF_NEED_FPU_LOAD)) { + set_thread_flag(TIF_NEED_FPU_LOAD); + save_fpregs_to_fpstate(¤t->thread.fpu); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-629-cpuidle-drivers-firmware-psci-Dont-instrument-s.patch b/patches.kernel.org/6.2.3-629-cpuidle-drivers-firmware-psci-Dont-instrument-s.patch new file mode 100644 index 0000000..c94db1b --- /dev/null +++ b/patches.kernel.org/6.2.3-629-cpuidle-drivers-firmware-psci-Dont-instrument-s.patch @@ -0,0 +1,123 @@ +From: Mark Rutland +Date: Thu, 26 Jan 2023 16:08:30 +0100 +Subject: [PATCH] cpuidle: drivers: firmware: psci: Dont instrument suspend + code +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 393e2ea30aec634b37004d401863428e120d5e1b + +[ Upstream commit 393e2ea30aec634b37004d401863428e120d5e1b ] + +The PSCI suspend code is currently instrumentable, which is not safe as +instrumentation (e.g. ftrace) may try to make use of RCU during idle +periods when RCU is not watching. + +To fix this we need to ensure that psci_suspend_finisher() and anything +it calls are not instrumented. We can do this fairly simply by marking +psci_suspend_finisher() and the psci*_cpu_suspend() functions as +noinstr, and the underlying helper functions as __always_inline. + +When CONFIG_DEBUG_VIRTUAL=y, __pa_symbol() can expand to an out-of-line +instrumented function, so we must use __pa_symbol_nodebug() within +psci_suspend_finisher(). + +The raw SMCCC invocation functions are written in assembly, and are not +subject to compiler instrumentation. + +Signed-off-by: Mark Rutland +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230126151323.349423061@infradead.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/firmware/psci/psci.c | 31 +++++++++++++++++++------------ + 1 file changed, 19 insertions(+), 12 deletions(-) + +diff --git a/drivers/firmware/psci/psci.c b/drivers/firmware/psci/psci.c +index 447ee4ea..f78249fe 100644 +--- a/drivers/firmware/psci/psci.c ++++ b/drivers/firmware/psci/psci.c +@@ -108,9 +108,10 @@ bool psci_power_state_is_valid(u32 state) + return !(state & ~valid_mask); + } + +-static unsigned long __invoke_psci_fn_hvc(unsigned long function_id, +- unsigned long arg0, unsigned long arg1, +- unsigned long arg2) ++static __always_inline unsigned long ++__invoke_psci_fn_hvc(unsigned long function_id, ++ unsigned long arg0, unsigned long arg1, ++ unsigned long arg2) + { + struct arm_smccc_res res; + +@@ -118,9 +119,10 @@ static unsigned long __invoke_psci_fn_hvc(unsigned long function_id, + return res.a0; + } + +-static unsigned long __invoke_psci_fn_smc(unsigned long function_id, +- unsigned long arg0, unsigned long arg1, +- unsigned long arg2) ++static __always_inline unsigned long ++__invoke_psci_fn_smc(unsigned long function_id, ++ unsigned long arg0, unsigned long arg1, ++ unsigned long arg2) + { + struct arm_smccc_res res; + +@@ -128,7 +130,7 @@ static unsigned long __invoke_psci_fn_smc(unsigned long function_id, + return res.a0; + } + +-static int psci_to_linux_errno(int errno) ++static __always_inline int psci_to_linux_errno(int errno) + { + switch (errno) { + case PSCI_RET_SUCCESS: +@@ -169,7 +171,8 @@ int psci_set_osi_mode(bool enable) + return psci_to_linux_errno(err); + } + +-static int __psci_cpu_suspend(u32 fn, u32 state, unsigned long entry_point) ++static __always_inline int ++__psci_cpu_suspend(u32 fn, u32 state, unsigned long entry_point) + { + int err; + +@@ -177,13 +180,15 @@ static int __psci_cpu_suspend(u32 fn, u32 state, unsigned long entry_point) + return psci_to_linux_errno(err); + } + +-static int psci_0_1_cpu_suspend(u32 state, unsigned long entry_point) ++static __always_inline int ++psci_0_1_cpu_suspend(u32 state, unsigned long entry_point) + { + return __psci_cpu_suspend(psci_0_1_function_ids.cpu_suspend, + state, entry_point); + } + +-static int psci_0_2_cpu_suspend(u32 state, unsigned long entry_point) ++static __always_inline int ++psci_0_2_cpu_suspend(u32 state, unsigned long entry_point) + { + return __psci_cpu_suspend(PSCI_FN_NATIVE(0_2, CPU_SUSPEND), + state, entry_point); +@@ -450,10 +455,12 @@ late_initcall(psci_debugfs_init) + #endif + + #ifdef CONFIG_CPU_IDLE +-static int psci_suspend_finisher(unsigned long state) ++static noinstr int psci_suspend_finisher(unsigned long state) + { + u32 power_state = state; +- phys_addr_t pa_cpu_resume = __pa_symbol(cpu_resume); ++ phys_addr_t pa_cpu_resume; ++ ++ pa_cpu_resume = __pa_symbol_nodebug((unsigned long)cpu_resume); + + return psci_ops.cpu_suspend(power_state, pa_cpu_resume); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-630-cpuidle-lib-bug-Disable-rcu_is_watching-during-.patch b/patches.kernel.org/6.2.3-630-cpuidle-lib-bug-Disable-rcu_is_watching-during-.patch new file mode 100644 index 0000000..afe4f2f --- /dev/null +++ b/patches.kernel.org/6.2.3-630-cpuidle-lib-bug-Disable-rcu_is_watching-during-.patch @@ -0,0 +1,182 @@ +From: Peter Zijlstra +Date: Thu, 26 Jan 2023 16:08:31 +0100 +Subject: [PATCH] cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5a5d7e9badd2cb8065db171961bd30bd3595e4b6 + +[ Upstream commit 5a5d7e9badd2cb8065db171961bd30bd3595e4b6 ] + +In order to avoid WARN/BUG from generating nested or even recursive +warnings, force rcu_is_watching() true during +WARN/lockdep_rcu_suspicious(). + +Notably things like unwinding the stack can trigger rcu_dereference() +warnings, which then triggers more unwinding which then triggers more +warnings etc.. + +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230126151323.408156109@infradead.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/context_tracking.h | 27 +++++++++++++++++++++++++++ + kernel/locking/lockdep.c | 3 +++ + kernel/panic.c | 5 +++++ + lib/bug.c | 15 ++++++++++++++- + 4 files changed, 49 insertions(+), 1 deletion(-) + +diff --git a/include/linux/context_tracking.h b/include/linux/context_tracking.h +index dcef4a9e..d4afa850 100644 +--- a/include/linux/context_tracking.h ++++ b/include/linux/context_tracking.h +@@ -130,9 +130,36 @@ static __always_inline unsigned long ct_state_inc(int incby) + return arch_atomic_add_return(incby, this_cpu_ptr(&context_tracking.state)); + } + ++static __always_inline bool warn_rcu_enter(void) ++{ ++ bool ret = false; ++ ++ /* ++ * Horrible hack to shut up recursive RCU isn't watching fail since ++ * lots of the actual reporting also relies on RCU. ++ */ ++ preempt_disable_notrace(); ++ if (rcu_dynticks_curr_cpu_in_eqs()) { ++ ret = true; ++ ct_state_inc(RCU_DYNTICKS_IDX); ++ } ++ ++ return ret; ++} ++ ++static __always_inline void warn_rcu_exit(bool rcu) ++{ ++ if (rcu) ++ ct_state_inc(RCU_DYNTICKS_IDX); ++ preempt_enable_notrace(); ++} ++ + #else + static inline void ct_idle_enter(void) { } + static inline void ct_idle_exit(void) { } ++ ++static __always_inline bool warn_rcu_enter(void) { return false; } ++static __always_inline void warn_rcu_exit(bool rcu) { } + #endif /* !CONFIG_CONTEXT_TRACKING_IDLE */ + + #endif +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index e3375bc4..50d48639 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -55,6 +55,7 @@ + #include + #include + #include ++#include + + #include + +@@ -6555,6 +6556,7 @@ void lockdep_rcu_suspicious(const char *file, const int line, const char *s) + { + struct task_struct *curr = current; + int dl = READ_ONCE(debug_locks); ++ bool rcu = warn_rcu_enter(); + + /* Note: the following can be executed concurrently, so be careful. */ + pr_warn("\n"); +@@ -6595,5 +6597,6 @@ void lockdep_rcu_suspicious(const char *file, const int line, const char *s) + lockdep_print_held_locks(curr); + pr_warn("\nstack backtrace:\n"); + dump_stack(); ++ warn_rcu_exit(rcu); + } + EXPORT_SYMBOL_GPL(lockdep_rcu_suspicious); +diff --git a/kernel/panic.c b/kernel/panic.c +index 463c9295..487f5b03 100644 +--- a/kernel/panic.c ++++ b/kernel/panic.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -679,6 +680,7 @@ void __warn(const char *file, int line, void *caller, unsigned taint, + void warn_slowpath_fmt(const char *file, int line, unsigned taint, + const char *fmt, ...) + { ++ bool rcu = warn_rcu_enter(); + struct warn_args args; + + pr_warn(CUT_HERE); +@@ -693,11 +695,13 @@ void warn_slowpath_fmt(const char *file, int line, unsigned taint, + va_start(args.args, fmt); + __warn(file, line, __builtin_return_address(0), taint, NULL, &args); + va_end(args.args); ++ warn_rcu_exit(rcu); + } + EXPORT_SYMBOL(warn_slowpath_fmt); + #else + void __warn_printk(const char *fmt, ...) + { ++ bool rcu = warn_rcu_enter(); + va_list args; + + pr_warn(CUT_HERE); +@@ -705,6 +709,7 @@ void __warn_printk(const char *fmt, ...) + va_start(args, fmt); + vprintk(fmt, args); + va_end(args); ++ warn_rcu_exit(rcu); + } + EXPORT_SYMBOL(__warn_printk); + #endif +diff --git a/lib/bug.c b/lib/bug.c +index c223a257..e0ff2198 100644 +--- a/lib/bug.c ++++ b/lib/bug.c +@@ -47,6 +47,7 @@ + #include + #include + #include ++#include + + extern struct bug_entry __start___bug_table[], __stop___bug_table[]; + +@@ -153,7 +154,7 @@ struct bug_entry *find_bug(unsigned long bugaddr) + return module_find_bug(bugaddr); + } + +-enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) ++static enum bug_trap_type __report_bug(unsigned long bugaddr, struct pt_regs *regs) + { + struct bug_entry *bug; + const char *file; +@@ -209,6 +210,18 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) + return BUG_TRAP_TYPE_BUG; + } + ++enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) ++{ ++ enum bug_trap_type ret; ++ bool rcu = false; ++ ++ rcu = warn_rcu_enter(); ++ ret = __report_bug(bugaddr, regs); ++ warn_rcu_exit(rcu); ++ ++ return ret; ++} ++ + static void clear_once_table(struct bug_entry *start, struct bug_entry *end) + { + struct bug_entry *bug; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-631-perf-x86-intel-uncore-Add-Meteor-Lake-support.patch b/patches.kernel.org/6.2.3-631-perf-x86-intel-uncore-Add-Meteor-Lake-support.patch new file mode 100644 index 0000000..1efb744 --- /dev/null +++ b/patches.kernel.org/6.2.3-631-perf-x86-intel-uncore-Add-Meteor-Lake-support.patch @@ -0,0 +1,264 @@ +From: Kan Liang +Date: Fri, 10 Feb 2023 11:02:38 -0800 +Subject: [PATCH] perf/x86/intel/uncore: Add Meteor Lake support +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c828441f21ddc819a28b5723a72e3c840e9de1c6 + +[ Upstream commit c828441f21ddc819a28b5723a72e3c840e9de1c6 ] + +The uncore subsystem for Meteor Lake is similar to the previous Alder +Lake. The main difference is that MTL provides PMU support for different +tiles, while ADL only provides PMU support for the whole package. On +ADL, there are CBOX, ARB, and clockbox uncore PMON units. On MTL, they +are split into CBOX/HAC_CBOX, ARB/HAC_ARB, and cncu/sncu which provides +a fixed counter for clockticks. Also, new MSR addresses are introduced +on MTL. + +The IMC uncore PMON is the same as Alder Lake. Add new PCIIDs of IMC for +Meteor Lake. + +Signed-off-by: Kan Liang +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230210190238.1726237-1-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/events/intel/uncore.c | 7 ++ + arch/x86/events/intel/uncore.h | 1 + + arch/x86/events/intel/uncore_snb.c | 161 +++++++++++++++++++++++++++++ + 3 files changed, 169 insertions(+) + +diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c +index 459b1aaf..27b34f5b 100644 +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -1765,6 +1765,11 @@ static const struct intel_uncore_init_fun adl_uncore_init __initconst = { + .mmio_init = adl_uncore_mmio_init, + }; + ++static const struct intel_uncore_init_fun mtl_uncore_init __initconst = { ++ .cpu_init = mtl_uncore_cpu_init, ++ .mmio_init = adl_uncore_mmio_init, ++}; ++ + static const struct intel_uncore_init_fun icx_uncore_init __initconst = { + .cpu_init = icx_uncore_cpu_init, + .pci_init = icx_uncore_pci_init, +@@ -1832,6 +1837,8 @@ static const struct x86_cpu_id intel_uncore_match[] __initconst = { + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &adl_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &adl_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &adl_uncore_init), ++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE, &mtl_uncore_init), ++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L, &mtl_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &spr_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, &spr_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT_D, &snr_uncore_init), +diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h +index e278e2e7..305a54d8 100644 +--- a/arch/x86/events/intel/uncore.h ++++ b/arch/x86/events/intel/uncore.h +@@ -602,6 +602,7 @@ void skl_uncore_cpu_init(void); + void icl_uncore_cpu_init(void); + void tgl_uncore_cpu_init(void); + void adl_uncore_cpu_init(void); ++void mtl_uncore_cpu_init(void); + void tgl_uncore_mmio_init(void); + void tgl_l_uncore_mmio_init(void); + void adl_uncore_mmio_init(void); +diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c +index 1f486922..7fd4334e 100644 +--- a/arch/x86/events/intel/uncore_snb.c ++++ b/arch/x86/events/intel/uncore_snb.c +@@ -109,6 +109,19 @@ + #define PCI_DEVICE_ID_INTEL_RPL_23_IMC 0xA728 + #define PCI_DEVICE_ID_INTEL_RPL_24_IMC 0xA729 + #define PCI_DEVICE_ID_INTEL_RPL_25_IMC 0xA72A ++#define PCI_DEVICE_ID_INTEL_MTL_1_IMC 0x7d00 ++#define PCI_DEVICE_ID_INTEL_MTL_2_IMC 0x7d01 ++#define PCI_DEVICE_ID_INTEL_MTL_3_IMC 0x7d02 ++#define PCI_DEVICE_ID_INTEL_MTL_4_IMC 0x7d05 ++#define PCI_DEVICE_ID_INTEL_MTL_5_IMC 0x7d10 ++#define PCI_DEVICE_ID_INTEL_MTL_6_IMC 0x7d14 ++#define PCI_DEVICE_ID_INTEL_MTL_7_IMC 0x7d15 ++#define PCI_DEVICE_ID_INTEL_MTL_8_IMC 0x7d16 ++#define PCI_DEVICE_ID_INTEL_MTL_9_IMC 0x7d21 ++#define PCI_DEVICE_ID_INTEL_MTL_10_IMC 0x7d22 ++#define PCI_DEVICE_ID_INTEL_MTL_11_IMC 0x7d23 ++#define PCI_DEVICE_ID_INTEL_MTL_12_IMC 0x7d24 ++#define PCI_DEVICE_ID_INTEL_MTL_13_IMC 0x7d28 + + + #define IMC_UNCORE_DEV(a) \ +@@ -205,6 +218,32 @@ + #define ADL_UNC_ARB_PERFEVTSEL0 0x2FD0 + #define ADL_UNC_ARB_MSR_OFFSET 0x8 + ++/* MTL Cbo register */ ++#define MTL_UNC_CBO_0_PER_CTR0 0x2448 ++#define MTL_UNC_CBO_0_PERFEVTSEL0 0x2442 ++ ++/* MTL HAC_ARB register */ ++#define MTL_UNC_HAC_ARB_CTR 0x2018 ++#define MTL_UNC_HAC_ARB_CTRL 0x2012 ++ ++/* MTL ARB register */ ++#define MTL_UNC_ARB_CTR 0x2418 ++#define MTL_UNC_ARB_CTRL 0x2412 ++ ++/* MTL cNCU register */ ++#define MTL_UNC_CNCU_FIXED_CTR 0x2408 ++#define MTL_UNC_CNCU_FIXED_CTRL 0x2402 ++#define MTL_UNC_CNCU_BOX_CTL 0x240e ++ ++/* MTL sNCU register */ ++#define MTL_UNC_SNCU_FIXED_CTR 0x2008 ++#define MTL_UNC_SNCU_FIXED_CTRL 0x2002 ++#define MTL_UNC_SNCU_BOX_CTL 0x200e ++ ++/* MTL HAC_CBO register */ ++#define MTL_UNC_HBO_CTR 0x2048 ++#define MTL_UNC_HBO_CTRL 0x2042 ++ + DEFINE_UNCORE_FORMAT_ATTR(event, event, "config:0-7"); + DEFINE_UNCORE_FORMAT_ATTR(umask, umask, "config:8-15"); + DEFINE_UNCORE_FORMAT_ATTR(chmask, chmask, "config:8-11"); +@@ -598,6 +637,115 @@ void adl_uncore_cpu_init(void) + uncore_msr_uncores = adl_msr_uncores; + } + ++static struct intel_uncore_type mtl_uncore_cbox = { ++ .name = "cbox", ++ .num_counters = 2, ++ .perf_ctr_bits = 48, ++ .perf_ctr = MTL_UNC_CBO_0_PER_CTR0, ++ .event_ctl = MTL_UNC_CBO_0_PERFEVTSEL0, ++ .event_mask = ADL_UNC_RAW_EVENT_MASK, ++ .msr_offset = SNB_UNC_CBO_MSR_OFFSET, ++ .ops = &icl_uncore_msr_ops, ++ .format_group = &adl_uncore_format_group, ++}; ++ ++static struct intel_uncore_type mtl_uncore_hac_arb = { ++ .name = "hac_arb", ++ .num_counters = 2, ++ .num_boxes = 2, ++ .perf_ctr_bits = 48, ++ .perf_ctr = MTL_UNC_HAC_ARB_CTR, ++ .event_ctl = MTL_UNC_HAC_ARB_CTRL, ++ .event_mask = ADL_UNC_RAW_EVENT_MASK, ++ .msr_offset = SNB_UNC_CBO_MSR_OFFSET, ++ .ops = &icl_uncore_msr_ops, ++ .format_group = &adl_uncore_format_group, ++}; ++ ++static struct intel_uncore_type mtl_uncore_arb = { ++ .name = "arb", ++ .num_counters = 2, ++ .num_boxes = 2, ++ .perf_ctr_bits = 48, ++ .perf_ctr = MTL_UNC_ARB_CTR, ++ .event_ctl = MTL_UNC_ARB_CTRL, ++ .event_mask = ADL_UNC_RAW_EVENT_MASK, ++ .msr_offset = SNB_UNC_CBO_MSR_OFFSET, ++ .ops = &icl_uncore_msr_ops, ++ .format_group = &adl_uncore_format_group, ++}; ++ ++static struct intel_uncore_type mtl_uncore_hac_cbox = { ++ .name = "hac_cbox", ++ .num_counters = 2, ++ .num_boxes = 2, ++ .perf_ctr_bits = 48, ++ .perf_ctr = MTL_UNC_HBO_CTR, ++ .event_ctl = MTL_UNC_HBO_CTRL, ++ .event_mask = ADL_UNC_RAW_EVENT_MASK, ++ .msr_offset = SNB_UNC_CBO_MSR_OFFSET, ++ .ops = &icl_uncore_msr_ops, ++ .format_group = &adl_uncore_format_group, ++}; ++ ++static void mtl_uncore_msr_init_box(struct intel_uncore_box *box) ++{ ++ wrmsrl(uncore_msr_box_ctl(box), SNB_UNC_GLOBAL_CTL_EN); ++} ++ ++static struct intel_uncore_ops mtl_uncore_msr_ops = { ++ .init_box = mtl_uncore_msr_init_box, ++ .disable_event = snb_uncore_msr_disable_event, ++ .enable_event = snb_uncore_msr_enable_event, ++ .read_counter = uncore_msr_read_counter, ++}; ++ ++static struct intel_uncore_type mtl_uncore_cncu = { ++ .name = "cncu", ++ .num_counters = 1, ++ .num_boxes = 1, ++ .box_ctl = MTL_UNC_CNCU_BOX_CTL, ++ .fixed_ctr_bits = 48, ++ .fixed_ctr = MTL_UNC_CNCU_FIXED_CTR, ++ .fixed_ctl = MTL_UNC_CNCU_FIXED_CTRL, ++ .single_fixed = 1, ++ .event_mask = SNB_UNC_CTL_EV_SEL_MASK, ++ .format_group = &icl_uncore_clock_format_group, ++ .ops = &mtl_uncore_msr_ops, ++ .event_descs = icl_uncore_events, ++}; ++ ++static struct intel_uncore_type mtl_uncore_sncu = { ++ .name = "sncu", ++ .num_counters = 1, ++ .num_boxes = 1, ++ .box_ctl = MTL_UNC_SNCU_BOX_CTL, ++ .fixed_ctr_bits = 48, ++ .fixed_ctr = MTL_UNC_SNCU_FIXED_CTR, ++ .fixed_ctl = MTL_UNC_SNCU_FIXED_CTRL, ++ .single_fixed = 1, ++ .event_mask = SNB_UNC_CTL_EV_SEL_MASK, ++ .format_group = &icl_uncore_clock_format_group, ++ .ops = &mtl_uncore_msr_ops, ++ .event_descs = icl_uncore_events, ++}; ++ ++static struct intel_uncore_type *mtl_msr_uncores[] = { ++ &mtl_uncore_cbox, ++ &mtl_uncore_hac_arb, ++ &mtl_uncore_arb, ++ &mtl_uncore_hac_cbox, ++ &mtl_uncore_cncu, ++ &mtl_uncore_sncu, ++ NULL ++}; ++ ++void mtl_uncore_cpu_init(void) ++{ ++ mtl_uncore_cbox.num_boxes = icl_get_cbox_num(); ++ uncore_msr_uncores = mtl_msr_uncores; ++} ++ + enum { + SNB_PCI_UNCORE_IMC, + }; +@@ -1264,6 +1412,19 @@ static const struct pci_device_id tgl_uncore_pci_ids[] = { + IMC_UNCORE_DEV(RPL_23), + IMC_UNCORE_DEV(RPL_24), + IMC_UNCORE_DEV(RPL_25), ++ IMC_UNCORE_DEV(MTL_1), ++ IMC_UNCORE_DEV(MTL_2), ++ IMC_UNCORE_DEV(MTL_3), ++ IMC_UNCORE_DEV(MTL_4), ++ IMC_UNCORE_DEV(MTL_5), ++ IMC_UNCORE_DEV(MTL_6), ++ IMC_UNCORE_DEV(MTL_7), ++ IMC_UNCORE_DEV(MTL_8), ++ IMC_UNCORE_DEV(MTL_9), ++ IMC_UNCORE_DEV(MTL_10), ++ IMC_UNCORE_DEV(MTL_11), ++ IMC_UNCORE_DEV(MTL_12), ++ IMC_UNCORE_DEV(MTL_13), + { /* end: all zeroes */ } + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-632-wifi-ath9k-Fix-use-after-free-in-ath9k_hif_usb_.patch b/patches.kernel.org/6.2.3-632-wifi-ath9k-Fix-use-after-free-in-ath9k_hif_usb_.patch new file mode 100644 index 0000000..ef6a58d --- /dev/null +++ b/patches.kernel.org/6.2.3-632-wifi-ath9k-Fix-use-after-free-in-ath9k_hif_usb_.patch @@ -0,0 +1,163 @@ +From: Minsuk Kang +Date: Mon, 5 Dec 2022 10:43:08 +0900 +Subject: [PATCH] wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f099c5c9e2ba08a379bd354a82e05ef839ae29ac + +[ Upstream commit f099c5c9e2ba08a379bd354a82e05ef839ae29ac ] + +This patch fixes a use-after-free in ath9k that occurs in +ath9k_hif_usb_disconnect() when ath9k_destroy_wmi() is trying to access +'drv_priv' that has already been freed by ieee80211_free_hw(), called by +ath9k_htc_hw_deinit(). The patch moves ath9k_destroy_wmi() before +ieee80211_free_hw(). Note that urbs from the driver should be killed +before freeing 'wmi' with ath9k_destroy_wmi() as their callbacks will +access 'wmi'. + +Found by a modified version of syzkaller. + +================================================================== +BUG: KASAN: use-after-free in ath9k_destroy_wmi+0x38/0x40 +Read of size 8 at addr ffff8881069132a0 by task kworker/0:1/7 + +CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #131 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +Workqueue: usb_hub_wq hub_event +Call Trace: + dump_stack_lvl+0x8e/0xd1 + print_address_description.constprop.0.cold+0x93/0x334 + ? ath9k_destroy_wmi+0x38/0x40 + ? ath9k_destroy_wmi+0x38/0x40 + kasan_report.cold+0x83/0xdf + ? ath9k_destroy_wmi+0x38/0x40 + ath9k_destroy_wmi+0x38/0x40 + ath9k_hif_usb_disconnect+0x329/0x3f0 + ? ath9k_hif_usb_suspend+0x120/0x120 + ? usb_disable_interface+0xfc/0x180 + usb_unbind_interface+0x19b/0x7e0 + ? usb_autoresume_device+0x50/0x50 + device_release_driver_internal+0x44d/0x520 + bus_remove_device+0x2e5/0x5a0 + device_del+0x5b2/0xe30 + ? __device_link_del+0x370/0x370 + ? usb_remove_ep_devs+0x43/0x80 + ? remove_intf_ep_devs+0x112/0x1a0 + usb_disable_device+0x1e3/0x5a0 + usb_disconnect+0x267/0x870 + hub_event+0x168d/0x3950 + ? rcu_read_lock_sched_held+0xa1/0xd0 + ? hub_port_debounce+0x2e0/0x2e0 + ? check_irq_usage+0x860/0xf20 + ? drain_workqueue+0x281/0x360 + ? lock_release+0x640/0x640 + ? rcu_read_lock_sched_held+0xa1/0xd0 + ? rcu_read_lock_bh_held+0xb0/0xb0 + ? lockdep_hardirqs_on_prepare+0x273/0x3e0 + process_one_work+0x92b/0x1460 + ? pwq_dec_nr_in_flight+0x330/0x330 + ? rwlock_bug.part.0+0x90/0x90 + worker_thread+0x95/0xe00 + ? __kthread_parkme+0x115/0x1e0 + ? process_one_work+0x1460/0x1460 + kthread+0x3a1/0x480 + ? set_kthread_struct+0x120/0x120 + ret_from_fork+0x1f/0x30 + +The buggy address belongs to the page: +page:ffffea00041a44c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106913 +flags: 0x200000000000000(node=0|zone=2) +raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 +raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 +page dumped because: kasan: bad access detected +page_owner tracks the page as freed +page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 7, ts 38347963444, free_ts 41399957635 + prep_new_page+0x1aa/0x240 + get_page_from_freelist+0x159a/0x27c0 + __alloc_pages+0x2da/0x6a0 + alloc_pages+0xec/0x1e0 + kmalloc_order+0x39/0xf0 + kmalloc_order_trace+0x19/0x120 + __kmalloc+0x308/0x390 + wiphy_new_nm+0x6f5/0x1dd0 + ieee80211_alloc_hw_nm+0x36d/0x2230 + ath9k_htc_probe_device+0x9d/0x1e10 + ath9k_htc_hw_init+0x34/0x50 + ath9k_hif_usb_firmware_cb+0x25f/0x4e0 + request_firmware_work_func+0x131/0x240 + process_one_work+0x92b/0x1460 + worker_thread+0x95/0xe00 + kthread+0x3a1/0x480 +page last free stack trace: + free_pcp_prepare+0x3d3/0x7f0 + free_unref_page+0x1e/0x3d0 + device_release+0xa4/0x240 + kobject_put+0x186/0x4c0 + put_device+0x20/0x30 + ath9k_htc_disconnect_device+0x1cf/0x2c0 + ath9k_htc_hw_deinit+0x26/0x30 + ath9k_hif_usb_disconnect+0x2d9/0x3f0 + usb_unbind_interface+0x19b/0x7e0 + device_release_driver_internal+0x44d/0x520 + bus_remove_device+0x2e5/0x5a0 + device_del+0x5b2/0xe30 + usb_disable_device+0x1e3/0x5a0 + usb_disconnect+0x267/0x870 + hub_event+0x168d/0x3950 + process_one_work+0x92b/0x1460 + +Memory state around the buggy address: + ffff888106913180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ffff888106913200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff +>ffff888106913280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ^ + ffff888106913300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ffff888106913380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff +================================================================== + +Reported-by: Dokyung Song +Reported-by: Jisoo Jang +Reported-by: Minsuk Kang +Signed-off-by: Minsuk Kang +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221205014308.1617597-1-linuxlovemin@yonsei.ac.kr +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 2 -- + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 ++ + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index de6c0824..f521dfa2 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -1424,8 +1424,6 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface) + + if (hif_dev->flags & HIF_USB_READY) { + ath9k_htc_hw_deinit(hif_dev->htc_handle, unplugged); +- ath9k_hif_usb_dev_deinit(hif_dev); +- ath9k_destroy_wmi(hif_dev->htc_handle->drv_priv); + ath9k_htc_hw_free(hif_dev->htc_handle); + } + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index 07ac88fb..96a3185a 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -988,6 +988,8 @@ void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug) + + ath9k_deinit_device(htc_handle->drv_priv); + ath9k_stop_wmi(htc_handle->drv_priv); ++ ath9k_hif_usb_dealloc_urbs((struct hif_device_usb *)htc_handle->hif_dev); ++ ath9k_destroy_wmi(htc_handle->drv_priv); + ieee80211_free_hw(htc_handle->drv_priv->hw); + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-633-wifi-ath11k-fix-monitor-mode-bringup-crash.patch b/patches.kernel.org/6.2.3-633-wifi-ath11k-fix-monitor-mode-bringup-crash.patch new file mode 100644 index 0000000..9c63a77 --- /dev/null +++ b/patches.kernel.org/6.2.3-633-wifi-ath11k-fix-monitor-mode-bringup-crash.patch @@ -0,0 +1,90 @@ +From: Nagarajan Maran +Date: Tue, 29 Nov 2022 19:55:32 +0530 +Subject: [PATCH] wifi: ath11k: fix monitor mode bringup crash +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7 + +[ Upstream commit 950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7 ] + +When the interface is brought up in monitor mode, it leads +to NULL pointer dereference crash. This crash happens when +the packet type is extracted for a SKB. This extraction +which is present in the received msdu delivery path,is +not needed for the monitor ring packets since they are +all RAW packets. Hence appending the flags with +"RX_FLAG_ONLY_MONITOR" to skip that extraction. + +Observed calltrace: + +Unable to handle kernel NULL pointer dereference at virtual address +0000000000000064 +Mem abort info: + ESR = 0x0000000096000004 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x04: level 0 translation fault +Data abort info: + ISV = 0, ISS = 0x00000004 + CM = 0, WnR = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048517000 +[0000000000000064] pgd=0000000000000000, p4d=0000000000000000 +Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP +Modules linked in: ath11k_pci ath11k qmi_helpers +CPU: 2 PID: 1781 Comm: napi/-271 Not tainted +6.1.0-rc5-wt-ath-656295-gef907406320c-dirty #6 +Hardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK10-C2 (DT) +pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k] +lr : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x5c/0x60 [ath11k] +sp : ffff80000ef5bb10 +x29: ffff80000ef5bb10 x28: 0000000000000000 x27: ffff000007baafa0 +x26: ffff000014a91ed0 x25: 0000000000000000 x24: 0000000000000000 +x23: ffff800002b77378 x22: ffff000014a91ec0 x21: ffff000006c8d600 +x20: 0000000000000000 x19: ffff800002b77740 x18: 0000000000000006 +x17: 736564203634343a x16: 656e694c20657079 x15: 0000000000000143 +x14: 00000000ffffffea x13: ffff80000ef5b8b8 x12: ffff80000ef5b8c8 +x11: ffff80000a591d30 x10: ffff80000a579d40 x9 : c0000000ffffefff +x8 : 0000000000000003 x7 : 0000000000017fe8 x6 : ffff80000a579ce8 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : 3a35ec12ed7f8900 x1 : 0000000000000000 x0 : 0000000000000052 +Call trace: + ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k] + ath11k_dp_rx_deliver_msdu.isra.42+0xa4/0x3d0 [ath11k] + ath11k_dp_rx_mon_deliver.isra.43+0x2f8/0x458 [ath11k] + ath11k_dp_rx_process_mon_rings+0x310/0x4c0 [ath11k] + ath11k_dp_service_srng+0x234/0x338 [ath11k] + ath11k_pcic_ext_grp_napi_poll+0x30/0xb8 [ath11k] + __napi_poll+0x5c/0x190 + napi_threaded_poll+0xf0/0x118 + kthread+0xf4/0x110 + ret_from_fork+0x10/0x20 + +Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 +Reported-by: Florian Schmidt +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216573 +Signed-off-by: Nagarajan Maran +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221129142532.23421-1-quic_nmaran@quicinc.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/ath/ath11k/dp_rx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index 0c53d882..e964e1b7 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -5023,6 +5023,7 @@ static int ath11k_dp_rx_mon_deliver(struct ath11k *ar, u32 mac_id, + } else { + rxs->flag |= RX_FLAG_ALLOW_SAME_PN; + } ++ rxs->flag |= RX_FLAG_ONLY_MONITOR; + ath11k_update_radiotap(ar, ppduinfo, mon_skb, rxs); + + ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb, rxs); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-634-wifi-brcmfmac-Fix-potential-stack-out-of-bounds.patch b/patches.kernel.org/6.2.3-634-wifi-brcmfmac-Fix-potential-stack-out-of-bounds.patch new file mode 100644 index 0000000..2b670d7 --- /dev/null +++ b/patches.kernel.org/6.2.3-634-wifi-brcmfmac-Fix-potential-stack-out-of-bounds.patch @@ -0,0 +1,161 @@ +From: Jisoo Jang +Date: Tue, 15 Nov 2022 13:34:58 +0900 +Subject: [PATCH] wifi: brcmfmac: Fix potential stack-out-of-bounds in + brcmf_c_preinit_dcmds() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0a06cadcc2a0044e4a117cc0e61436fc3a0dad69 + +[ Upstream commit 0a06cadcc2a0044e4a117cc0e61436fc3a0dad69 ] + +This patch fixes a stack-out-of-bounds read in brcmfmac that occurs +when 'buf' that is not null-terminated is passed as an argument of +strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware +version string by memcpy() in brcmf_fil_iovar_data_get(). +The patch ensures buf is null-terminated. + +Found by a modified version of syzkaller. + +[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3 +[ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available +[ 47.601565][ T1897] ================================================================== +[ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0 +[ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897 +[ 47.604336][ T1897] +[ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131 +[ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +[ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event +[ 47.607453][ T1897] Call Trace: +[ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1 +[ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334 +[ 47.609009][ T1897] ? strsep+0x1b2/0x1f0 +[ 47.609434][ T1897] ? strsep+0x1b2/0x1f0 +[ 47.609863][ T1897] kasan_report.cold+0x83/0xdf +[ 47.610366][ T1897] ? strsep+0x1b2/0x1f0 +[ 47.610882][ T1897] strsep+0x1b2/0x1f0 +[ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0 +[ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40 +[ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100 +[ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0 +[ 47.614704][ T1897] ? find_held_lock+0x2d/0x110 +[ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260 +[ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0 +[ 47.616288][ T1897] brcmf_attach+0x246/0xd40 +[ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0 +[ 47.617280][ T1897] ? kmemdup+0x43/0x50 +[ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690 +[ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 +[ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760 +[ 47.619429][ T1897] ? usb_probe_device+0x250/0x250 +[ 47.619950][ T1897] really_probe+0x205/0xb70 +[ 47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130 +[ 47.621048][ T1897] __driver_probe_device+0x311/0x4b0 +[ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130 +[ 47.622209][ T1897] driver_probe_device+0x4e/0x150 +[ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0 +[ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0 +[ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30 +[ 47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 47.624907][ T1897] ? trace_hardirqs_on+0x46/0x160 +[ 47.625437][ T1897] __device_attach+0x23f/0x3a0 +[ 47.625924][ T1897] ? device_bind_driver+0xd0/0xd0 +[ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0 +[ 47.627057][ T1897] bus_probe_device+0x1da/0x290 +[ 47.627557][ T1897] device_add+0xb7b/0x1eb0 +[ 47.628027][ T1897] ? wait_for_completion+0x290/0x290 +[ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 +[ 47.629249][ T1897] usb_set_configuration+0xf59/0x16f0 +[ 47.629829][ T1897] usb_generic_driver_probe+0x82/0xa0 +[ 47.630385][ T1897] usb_probe_device+0xbb/0x250 +[ 47.630927][ T1897] ? usb_suspend+0x590/0x590 +[ 47.631397][ T1897] really_probe+0x205/0xb70 +[ 47.631855][ T1897] ? driver_allows_async_probing+0x130/0x130 +[ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0 +[ 47.633002][ T1897] ? usb_generic_driver_match+0x75/0x90 +[ 47.633573][ T1897] ? driver_allows_async_probing+0x130/0x130 +[ 47.634170][ T1897] driver_probe_device+0x4e/0x150 +[ 47.634703][ T1897] __device_attach_driver+0x1cc/0x2a0 +[ 47.635248][ T1897] bus_for_each_drv+0x156/0x1d0 +[ 47.635748][ T1897] ? bus_rescan_devices+0x30/0x30 +[ 47.636271][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 47.636881][ T1897] ? trace_hardirqs_on+0x46/0x160 +[ 47.637396][ T1897] __device_attach+0x23f/0x3a0 +[ 47.637904][ T1897] ? device_bind_driver+0xd0/0xd0 +[ 47.638426][ T1897] ? kobject_uevent_env+0x287/0x14b0 +[ 47.638985][ T1897] bus_probe_device+0x1da/0x290 +[ 47.639512][ T1897] device_add+0xb7b/0x1eb0 +[ 47.639977][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 +[ 47.640612][ T1897] ? kfree+0x14a/0x6b0 +[ 47.641055][ T1897] ? __usb_get_extra_descriptor+0x116/0x160 +[ 47.641679][ T1897] usb_new_device.cold+0x49c/0x1029 +[ 47.642245][ T1897] ? hub_disconnect+0x450/0x450 +[ 47.642756][ T1897] ? rwlock_bug.part.0+0x90/0x90 +[ 47.643273][ T1897] ? _raw_spin_unlock_irq+0x24/0x30 +[ 47.643822][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 47.644445][ T1897] hub_event+0x1c98/0x3950 +[ 47.644939][ T1897] ? hub_port_debounce+0x2e0/0x2e0 +[ 47.645467][ T1897] ? check_irq_usage+0x861/0xf20 +[ 47.645975][ T1897] ? drain_workqueue+0x280/0x360 +[ 47.646506][ T1897] ? lock_release+0x640/0x640 +[ 47.646994][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 47.647572][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 47.648111][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 47.648735][ T1897] process_one_work+0x92b/0x1460 +[ 47.649262][ T1897] ? pwq_dec_nr_in_flight+0x330/0x330 +[ 47.649816][ T1897] ? rwlock_bug.part.0+0x90/0x90 +[ 47.650336][ T1897] worker_thread+0x95/0xe00 +[ 47.650830][ T1897] ? __kthread_parkme+0x115/0x1e0 +[ 47.651361][ T1897] ? process_one_work+0x1460/0x1460 +[ 47.651904][ T1897] kthread+0x3a1/0x480 +[ 47.652329][ T1897] ? set_kthread_struct+0x120/0x120 +[ 47.652878][ T1897] ret_from_fork+0x1f/0x30 +[ 47.653370][ T1897] +[ 47.653608][ T1897] +[ 47.653848][ T1897] addr ffffc90001f6f000 is located in stack of task kworker/0:2/1897 at offset 512 in frame: +[ 47.654891][ T1897] brcmf_c_preinit_dcmds+0x0/0xc40 +[ 47.655442][ T1897] +[ 47.655690][ T1897] this frame has 4 objects: +[ 47.656151][ T1897] [48, 56) 'ptr' +[ 47.656159][ T1897] [80, 148) 'revinfo' +[ 47.656534][ T1897] [192, 210) 'eventmask' +[ 47.656953][ T1897] [256, 512) 'buf' +[ 47.657410][ T1897] +[ 47.658035][ T1897] Memory state around the buggy address: +[ 47.658743][ T1897] ffffc90001f6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 47.659577][ T1897] ffffc90001f6ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 47.660394][ T1897] >ffffc90001f6f000: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 +[ 47.661199][ T1897] ^ +[ 47.661625][ T1897] ffffc90001f6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 47.662455][ T1897] ffffc90001f6f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 +[ 47.663318][ T1897] ================================================================== +[ 47.664147][ T1897] Disabling lock debugging due to kernel taint + +Reported-by: Dokyung Song +Reported-by: Jisoo Jang +Reported-by: Minsuk Kang +Signed-off-by: Jisoo Jang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221115043458.37562-1-jisoo.jang@yonsei.ac.kr +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +index 4a309e5a..5b484bba 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +@@ -299,6 +299,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) + err); + goto done; + } ++ buf[sizeof(buf) - 1] = '\0'; + ptr = (char *)buf; + strsep(&ptr, "\n"); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-635-rcu-Make-RCU_LOCKDEP_WARN-avoid-early-lockdep-c.patch b/patches.kernel.org/6.2.3-635-rcu-Make-RCU_LOCKDEP_WARN-avoid-early-lockdep-c.patch new file mode 100644 index 0000000..e3861a4 --- /dev/null +++ b/patches.kernel.org/6.2.3-635-rcu-Make-RCU_LOCKDEP_WARN-avoid-early-lockdep-c.patch @@ -0,0 +1,59 @@ +From: "Paul E. McKenney" +Date: Wed, 14 Dec 2022 11:41:44 -0800 +Subject: [PATCH] rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0cae5ded535c3a80aed94f119bbd4ee3ae284a65 + +[ Upstream commit 0cae5ded535c3a80aed94f119bbd4ee3ae284a65 ] + +Currently, RCU_LOCKDEP_WARN() checks the condition before checking +to see if lockdep is still enabled. This is necessary to avoid the +false-positive splats fixed by commit 3066820034b5dd ("rcu: Reject +RCU_LOCKDEP_WARN() false positives"). However, the current state can +result in false-positive splats during early boot before lockdep is fully +initialized. This commit therefore checks debug_lockdep_rcu_enabled() +both before and after checking the condition, thus avoiding both sets +of false-positive error reports. + +Reported-by: Steven Rostedt +Reported-by: Masami Hiramatsu (Google) +Reported-by: Mathieu Desnoyers +Signed-off-by: Paul E. McKenney +Reviewed-by: Mathieu Desnoyers +Cc: Boqun Feng +Cc: Matthew Wilcox +Cc: Thomas Gleixner +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/rcupdate.h | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h +index c0c79bea..8d4bf695 100644 +--- a/include/linux/rcupdate.h ++++ b/include/linux/rcupdate.h +@@ -376,11 +376,18 @@ static inline int debug_lockdep_rcu_enabled(void) + * RCU_LOCKDEP_WARN - emit lockdep splat if specified condition is met + * @c: condition to check + * @s: informative message ++ * ++ * This checks debug_lockdep_rcu_enabled() before checking (c) to ++ * prevent early boot splats due to lockdep not yet being initialized, ++ * and rechecks it after checking (c) to prevent false-positive splats ++ * due to races with lockdep being disabled. See commit 3066820034b5dd ++ * ("rcu: Reject RCU_LOCKDEP_WARN() false positives") for more detail. + */ + #define RCU_LOCKDEP_WARN(c, s) \ + do { \ + static bool __section(".data.unlikely") __warned; \ +- if ((c) && debug_lockdep_rcu_enabled() && !__warned) { \ ++ if (debug_lockdep_rcu_enabled() && (c) && \ ++ debug_lockdep_rcu_enabled() && !__warned) { \ + __warned = true; \ + lockdep_rcu_suspicious(__FILE__, __LINE__, s); \ + } \ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-636-rcu-Suppress-smp_processor_id-complaint-in-sync.patch b/patches.kernel.org/6.2.3-636-rcu-Suppress-smp_processor_id-complaint-in-sync.patch new file mode 100644 index 0000000..a8202eb --- /dev/null +++ b/patches.kernel.org/6.2.3-636-rcu-Suppress-smp_processor_id-complaint-in-sync.patch @@ -0,0 +1,44 @@ +From: "Paul E. McKenney" +Date: Fri, 16 Dec 2022 15:55:48 -0800 +Subject: [PATCH] rcu: Suppress smp_processor_id() complaint in + synchronize_rcu_expedited_wait() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2d7f00b2f01301d6e41fd4a28030dab0442265be + +[ Upstream commit 2d7f00b2f01301d6e41fd4a28030dab0442265be ] + +The normal grace period's RCU CPU stall warnings are invoked from the +scheduling-clock interrupt handler, and can thus invoke smp_processor_id() +with impunity, which allows them to directly invoke dump_cpu_task(). +In contrast, the expedited grace period's RCU CPU stall warnings are +invoked from process context, which causes the dump_cpu_task() function's +calls to smp_processor_id() to complain bitterly in debug kernels. + +This commit therefore causes synchronize_rcu_expedited_wait() to disable +preemption around its call to dump_cpu_task(). + +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/rcu/tree_exp.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h +index ed6c3cce..927abaf6 100644 +--- a/kernel/rcu/tree_exp.h ++++ b/kernel/rcu/tree_exp.h +@@ -667,7 +667,9 @@ static void synchronize_rcu_expedited_wait(void) + mask = leaf_node_cpu_bit(rnp, cpu); + if (!(READ_ONCE(rnp->expmask) & mask)) + continue; ++ preempt_disable(); // For smp_processor_id() in dump_cpu_task(). + dump_cpu_task(cpu); ++ preempt_enable(); + } + } + jiffies_stall = 3 * rcu_exp_jiffies_till_stall_check() + 3; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-637-srcu-Delegate-work-to-the-boot-cpu-if-using-SRC.patch b/patches.kernel.org/6.2.3-637-srcu-Delegate-work-to-the-boot-cpu-if-using-SRC.patch new file mode 100644 index 0000000..c43026b --- /dev/null +++ b/patches.kernel.org/6.2.3-637-srcu-Delegate-work-to-the-boot-cpu-if-using-SRC.patch @@ -0,0 +1,148 @@ +From: Pingfan Liu +Date: Mon, 31 Oct 2022 09:52:37 +0800 +Subject: [PATCH] srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7f24626d6dd844bfc6d1f492d214d29c86d02550 + +[ Upstream commit 7f24626d6dd844bfc6d1f492d214d29c86d02550 ] + +Commit 994f706872e6 ("srcu: Make Tree SRCU able to operate without +snp_node array") assumes that cpu 0 is always online. However, there +really are situations when some other CPU is the boot CPU, for example, +when booting a kdump kernel with the maxcpus=1 boot parameter. + +On PowerPC, the kdump kernel can hang as follows: +... +[ 1.740036] systemd[1]: Hostname set to +[ 243.686240] INFO: task systemd:1 blocked for more than 122 seconds. +[ 243.686264] Not tainted 6.1.0-rc1 #1 +[ 243.686272] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 243.686281] task:systemd state:D stack:0 pid:1 ppid:0 flags:0x00042000 +[ 243.686296] Call Trace: +[ 243.686301] [c000000016657640] [c000000016657670] 0xc000000016657670 (unreliable) +[ 243.686317] [c000000016657830] [c00000001001dec0] __switch_to+0x130/0x220 +[ 243.686333] [c000000016657890] [c000000010f607b8] __schedule+0x1f8/0x580 +[ 243.686347] [c000000016657940] [c000000010f60bb4] schedule+0x74/0x140 +[ 243.686361] [c0000000166579b0] [c000000010f699b8] schedule_timeout+0x168/0x1c0 +[ 243.686374] [c000000016657a80] [c000000010f61de8] __wait_for_common+0x148/0x360 +[ 243.686387] [c000000016657b20] [c000000010176bb0] __flush_work.isra.0+0x1c0/0x3d0 +[ 243.686401] [c000000016657bb0] [c0000000105f2768] fsnotify_wait_marks_destroyed+0x28/0x40 +[ 243.686415] [c000000016657bd0] [c0000000105f21b8] fsnotify_destroy_group+0x68/0x160 +[ 243.686428] [c000000016657c40] [c0000000105f6500] inotify_release+0x30/0xa0 +[ 243.686440] [c000000016657cb0] [c0000000105751a8] __fput+0xc8/0x350 +[ 243.686452] [c000000016657d00] [c00000001017d524] task_work_run+0xe4/0x170 +[ 243.686464] [c000000016657d50] [c000000010020e94] do_notify_resume+0x134/0x140 +[ 243.686478] [c000000016657d80] [c00000001002eb18] interrupt_exit_user_prepare_main+0x198/0x270 +[ 243.686493] [c000000016657de0] [c00000001002ec60] syscall_exit_prepare+0x70/0x180 +[ 243.686505] [c000000016657e10] [c00000001000bf7c] system_call_vectored_common+0xfc/0x280 +[ 243.686520] --- interrupt: 3000 at 0x7fffa47d5ba4 +[ 243.686528] NIP: 00007fffa47d5ba4 LR: 0000000000000000 CTR: 0000000000000000 +[ 243.686538] REGS: c000000016657e80 TRAP: 3000 Not tainted (6.1.0-rc1) +[ 243.686548] MSR: 800000000000d033 CR: 42044440 XER: 00000000 +[ 243.686572] IRQMASK: 0 +[ 243.686572] GPR00: 0000000000000006 00007ffffa606710 00007fffa48e7200 0000000000000000 +[ 243.686572] GPR04: 0000000000000002 000000000000000a 0000000000000000 0000000000000001 +[ 243.686572] GPR08: 000001000c172dd0 0000000000000000 0000000000000000 0000000000000000 +[ 243.686572] GPR12: 0000000000000000 00007fffa4ff4bc0 0000000000000000 0000000000000000 +[ 243.686572] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +[ 243.686572] GPR20: 0000000132dfdc50 000000000000000e 0000000000189375 0000000000000000 +[ 243.686572] GPR24: 00007ffffa606ae0 0000000000000005 000001000c185490 000001000c172570 +[ 243.686572] GPR28: 000001000c172990 000001000c184850 000001000c172e00 00007fffa4fedd98 +[ 243.686683] NIP [00007fffa47d5ba4] 0x7fffa47d5ba4 +[ 243.686691] LR [0000000000000000] 0x0 +[ 243.686698] --- interrupt: 3000 +[ 243.686708] INFO: task kworker/u16:1:24 blocked for more than 122 seconds. +[ 243.686717] Not tainted 6.1.0-rc1 #1 +[ 243.686724] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 243.686733] task:kworker/u16:1 state:D stack:0 pid:24 ppid:2 flags:0x00000800 +[ 243.686747] Workqueue: events_unbound fsnotify_mark_destroy_workfn +[ 243.686758] Call Trace: +[ 243.686762] [c0000000166736e0] [c00000004fd91000] 0xc00000004fd91000 (unreliable) +[ 243.686775] [c0000000166738d0] [c00000001001dec0] __switch_to+0x130/0x220 +[ 243.686788] [c000000016673930] [c000000010f607b8] __schedule+0x1f8/0x580 +[ 243.686801] [c0000000166739e0] [c000000010f60bb4] schedule+0x74/0x140 +[ 243.686814] [c000000016673a50] [c000000010f699b8] schedule_timeout+0x168/0x1c0 +[ 243.686827] [c000000016673b20] [c000000010f61de8] __wait_for_common+0x148/0x360 +[ 243.686840] [c000000016673bc0] [c000000010210840] __synchronize_srcu.part.0+0xa0/0xe0 +[ 243.686855] [c000000016673c30] [c0000000105f2c64] fsnotify_mark_destroy_workfn+0xc4/0x1a0 +[ 243.686868] [c000000016673ca0] [c000000010174ea8] process_one_work+0x2a8/0x570 +[ 243.686882] [c000000016673d40] [c000000010175208] worker_thread+0x98/0x5e0 +[ 243.686895] [c000000016673dc0] [c0000000101828d4] kthread+0x124/0x130 +[ 243.686908] [c000000016673e10] [c00000001000cd40] ret_from_kernel_thread+0x5c/0x64 +[ 366.566274] INFO: task systemd:1 blocked for more than 245 seconds. +[ 366.566298] Not tainted 6.1.0-rc1 #1 +[ 366.566305] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 366.566314] task:systemd state:D stack:0 pid:1 ppid:0 flags:0x00042000 +[ 366.566329] Call Trace: +... + +The above splat occurs because PowerPC really does use maxcpus=1 +instead of nr_cpus=1 in the kernel command line. Consequently, the +(quite possibly non-zero) kdump CPU is the only online CPU in the kdump +kernel. SRCU unconditionally queues a sdp->work on cpu 0, for which no +worker thread has been created, so sdp->work will be never executed and +__synchronize_srcu() will never be completed. + +This commit therefore replaces CPU ID 0 with get_boot_cpu_id() in key +places in Tree SRCU. Since the CPU indicated by get_boot_cpu_id() +is guaranteed to be online, this avoids the above splat. + +Signed-off-by: Pingfan Liu +Cc: "Paul E. McKenney" +Cc: Lai Jiangshan +Cc: Josh Triplett +Cc: Steven Rostedt +Cc: Mathieu Desnoyers +To: rcu@vger.kernel.org +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/rcu/srcutree.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c +index ca4b5dce..16953784 100644 +--- a/kernel/rcu/srcutree.c ++++ b/kernel/rcu/srcutree.c +@@ -726,7 +726,7 @@ static void srcu_gp_start(struct srcu_struct *ssp) + int state; + + if (smp_load_acquire(&ssp->srcu_size_state) < SRCU_SIZE_WAIT_BARRIER) +- sdp = per_cpu_ptr(ssp->sda, 0); ++ sdp = per_cpu_ptr(ssp->sda, get_boot_cpu_id()); + else + sdp = this_cpu_ptr(ssp->sda); + lockdep_assert_held(&ACCESS_PRIVATE(ssp, lock)); +@@ -837,7 +837,8 @@ static void srcu_gp_end(struct srcu_struct *ssp) + /* Initiate callback invocation as needed. */ + ss_state = smp_load_acquire(&ssp->srcu_size_state); + if (ss_state < SRCU_SIZE_WAIT_BARRIER) { +- srcu_schedule_cbs_sdp(per_cpu_ptr(ssp->sda, 0), cbdelay); ++ srcu_schedule_cbs_sdp(per_cpu_ptr(ssp->sda, get_boot_cpu_id()), ++ cbdelay); + } else { + idx = rcu_seq_ctr(gpseq) % ARRAY_SIZE(snp->srcu_have_cbs); + srcu_for_each_node_breadth_first(ssp, snp) { +@@ -1161,7 +1162,7 @@ static unsigned long srcu_gp_start_if_needed(struct srcu_struct *ssp, + idx = __srcu_read_lock_nmisafe(ssp); + ss_state = smp_load_acquire(&ssp->srcu_size_state); + if (ss_state < SRCU_SIZE_WAIT_CALL) +- sdp = per_cpu_ptr(ssp->sda, 0); ++ sdp = per_cpu_ptr(ssp->sda, get_boot_cpu_id()); + else + sdp = raw_cpu_ptr(ssp->sda); + spin_lock_irqsave_sdp_contention(sdp, &flags); +@@ -1497,7 +1498,7 @@ void srcu_barrier(struct srcu_struct *ssp) + + idx = __srcu_read_lock_nmisafe(ssp); + if (smp_load_acquire(&ssp->srcu_size_state) < SRCU_SIZE_WAIT_BARRIER) +- srcu_barrier_one_cpu(ssp, per_cpu_ptr(ssp->sda, 0)); ++ srcu_barrier_one_cpu(ssp, per_cpu_ptr(ssp->sda, get_boot_cpu_id())); + else + for_each_possible_cpu(cpu) + srcu_barrier_one_cpu(ssp, per_cpu_ptr(ssp->sda, cpu)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-638-rcu-tasks-Make-rude-RCU-Tasks-work-well-with-CP.patch b/patches.kernel.org/6.2.3-638-rcu-tasks-Make-rude-RCU-Tasks-work-well-with-CP.patch new file mode 100644 index 0000000..7f16ad1 --- /dev/null +++ b/patches.kernel.org/6.2.3-638-rcu-tasks-Make-rude-RCU-Tasks-work-well-with-CP.patch @@ -0,0 +1,109 @@ +From: Zqiang +Date: Thu, 1 Dec 2022 07:45:33 +0800 +Subject: [PATCH] rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ea5c8987fef20a8cca07e428aa28bc64649c5104 + +[ Upstream commit ea5c8987fef20a8cca07e428aa28bc64649c5104 ] + +The synchronize_rcu_tasks_rude() function invokes rcu_tasks_rude_wait_gp() +to wait one rude RCU-tasks grace period. The rcu_tasks_rude_wait_gp() +function in turn checks if there is only a single online CPU. If so, it +will immediately return, because a call to synchronize_rcu_tasks_rude() +is by definition a grace period on a single-CPU system. (We could +have blocked!) + +Unfortunately, this check uses num_online_cpus() without synchronization, +which can result in too-short grace periods. To see this, consider the +following scenario: + + CPU0 CPU1 (going offline) + migration/1 task: + cpu_stopper_thread + -> take_cpu_down + -> _cpu_disable + (dec __num_online_cpus) + ->cpuhp_invoke_callback + preempt_disable + access old_data0 + task1 + del old_data0 ..... + synchronize_rcu_tasks_rude() + task1 schedule out + .... + task2 schedule in + rcu_tasks_rude_wait_gp() + ->__num_online_cpus == 1 + ->return + .... + task1 schedule in + ->free old_data0 + preempt_enable + +When CPU1 decrements __num_online_cpus, its value becomes 1. However, +CPU1 has not finished going offline, and will take one last trip through +the scheduler and the idle loop before it actually stops executing +instructions. Because synchronize_rcu_tasks_rude() is mostly used for +tracing, and because both the scheduler and the idle loop can be traced, +this means that CPU0's prematurely ended grace period might disrupt the +tracing on CPU1. Given that this disruption might include CPU1 executing +instructions in memory that was just now freed (and maybe reallocated), +this is a matter of some concern. + +This commit therefore removes that problematic single-CPU check from the +rcu_tasks_rude_wait_gp() function. This dispenses with the single-CPU +optimization, but there is no evidence indicating that this optimization +is important. In addition, synchronize_rcu_tasks_generic() contains a +similar optimization (albeit only for early boot), which also splats. +(As in exactly why are you invoking synchronize_rcu_tasks_rude() so +early in boot, anyway???) + +It is OK for the synchronize_rcu_tasks_rude() function's check to be +unsynchronized because the only times that this check can evaluate to +true is when there is only a single CPU running with preemption +disabled. + +While in the area, this commit also fixes a minor bug in which a +call to synchronize_rcu_tasks_rude() would instead be attributed to +synchronize_rcu_tasks(). + +[ paulmck: Add "synchronize_" prefix and "()" suffix. ] + +Signed-off-by: Zqiang +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/rcu/tasks.h | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index 03388e2e..947d0318 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -560,8 +560,9 @@ static int __noreturn rcu_tasks_kthread(void *arg) + static void synchronize_rcu_tasks_generic(struct rcu_tasks *rtp) + { + /* Complain if the scheduler has not started. */ +- WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE, +- "synchronize_rcu_tasks called too soon"); ++ if (WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE, ++ "synchronize_%s() called too soon", rtp->name)) ++ return; + + // If the grace-period kthread is running, use it. + if (READ_ONCE(rtp->kthread_ptr)) { +@@ -1064,9 +1065,6 @@ static void rcu_tasks_be_rude(struct work_struct *work) + // Wait for one rude RCU-tasks grace period. + static void rcu_tasks_rude_wait_gp(struct rcu_tasks *rtp) + { +- if (num_online_cpus() <= 1) +- return; // Fastpath for only one CPU. +- + rtp->n_ipis += cpumask_weight(cpu_online_mask); + schedule_on_each_cpu(rcu_tasks_be_rude); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-639-rcu-tasks-Handle-queue-shrink-callback-enqueue-.patch b/patches.kernel.org/6.2.3-639-rcu-tasks-Handle-queue-shrink-callback-enqueue-.patch new file mode 100644 index 0000000..7e81864 --- /dev/null +++ b/patches.kernel.org/6.2.3-639-rcu-tasks-Handle-queue-shrink-callback-enqueue-.patch @@ -0,0 +1,142 @@ +From: Zqiang +Date: Sat, 3 Dec 2022 10:25:03 +0800 +Subject: [PATCH] rcu-tasks: Handle queue-shrink/callback-enqueue race + condition +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a4fcfbee8f6274f9b3f9a71dd5b03e6772ce33f3 + +[ Upstream commit a4fcfbee8f6274f9b3f9a71dd5b03e6772ce33f3 ] + +The rcu_tasks_need_gpcb() determines whether or not: (1) There are +callbacks needing another grace period, (2) There are callbacks ready +to be invoked, and (3) It would be a good time to shrink back down to a +single-CPU callback list. This third case is interesting because some +other CPU might be adding new callbacks, which might suddenly make this +a very bad time to be shrinking. + +This is currently handled by requiring call_rcu_tasks_generic() to +enqueue callbacks under the protection of rcu_read_lock() and requiring +rcu_tasks_need_gpcb() to wait for an RCU grace period to elapse before +finalizing the transition. This works well in practice. + +Unfortunately, the current code assumes that a grace period whose end is +detected by the poll_state_synchronize_rcu() in the second "if" condition +actually ended before the earlier code counted the callbacks queued on +CPUs other than CPU 0 (local variable "ncbsnz"). Given the current code, +it is possible that a long-delayed call_rcu_tasks_generic() invocation +will queue a callback on a non-zero CPU after these CPUs have had their +callbacks counted and zero has been stored to ncbsnz. Such a callback +would trigger the WARN_ON_ONCE() in the second "if" statement. + +To see this, consider the following sequence of events: + +o CPU 0 invokes rcu_tasks_one_gp(), and counts fewer than + rcu_task_collapse_lim callbacks. It sees at least one + callback queued on some other CPU, thus setting ncbsnz + to a non-zero value. + +o CPU 1 invokes call_rcu_tasks_generic() and loads 42 from + ->percpu_enqueue_lim. It therefore decides to enqueue its + callback onto CPU 1's callback list, but is delayed. + +o CPU 0 sees the rcu_task_cb_adjust is non-zero and that the number + of callbacks does not exceed rcu_task_collapse_lim. It therefore + checks percpu_enqueue_lim, and sees that its value is greater + than the value one. CPU 0 therefore starts the shift back + to a single callback list. It sets ->percpu_enqueue_lim to 1, + but CPU 1 has already read the old value of 42. It also gets + a grace-period state value from get_state_synchronize_rcu(). + +o CPU 0 sees that ncbsnz is non-zero in its second "if" statement, + so it declines to finalize the shrink operation. + +o CPU 0 again invokes rcu_tasks_one_gp(), and counts fewer than + rcu_task_collapse_lim callbacks. It also sees that there are + no callback queued on any other CPU, and thus sets ncbsnz to zero. + +o CPU 1 resumes execution and enqueues its callback onto its own + list. This invalidates the value of ncbsnz. + +o CPU 0 sees the rcu_task_cb_adjust is non-zero and that the number + of callbacks does not exceed rcu_task_collapse_lim. It therefore + checks percpu_enqueue_lim, but sees that its value is already + unity. It therefore does not get a new grace-period state value. + +o CPU 0 sees that rcu_task_cb_adjust is non-zero, ncbsnz is zero, + and that poll_state_synchronize_rcu() says that the grace period + has completed. it therefore finalizes the shrink operation, + setting ->percpu_dequeue_lim to the value one. + +o CPU 0 does a debug check, scanning the other CPUs' callback lists. + It sees that CPU 1's list has a callback, so it (rightly) + triggers the WARN_ON_ONCE(). After all, the new value of + ->percpu_dequeue_lim says to not bother looking at CPU 1's + callback list, which means that this callback will never be + invoked. This can result in hangs and maybe even OOMs. + +Based on long experience with rcutorture, this is an extremely +low-probability race condition, but it really can happen, especially in +preemptible kernels or within guest OSes. + +This commit therefore checks for completion of the grace period +before counting callbacks. With this change, in the above failure +scenario CPU 0 would know not to prematurely end the shrink operation +because the grace period would not have completed before the count +operation started. + +[ paulmck: Adjust grace-period end rather than adding RCU reader. ] +[ paulmck: Avoid spurious WARN_ON_ONCE() with ->percpu_dequeue_lim check. ] + +Signed-off-by: Zqiang +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/rcu/tasks.h | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index 947d0318..d5a4a129 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -384,6 +384,7 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp) + { + int cpu; + unsigned long flags; ++ bool gpdone = poll_state_synchronize_rcu(rtp->percpu_dequeue_gpseq); + long n; + long ncbs = 0; + long ncbsnz = 0; +@@ -425,21 +426,23 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp) + WRITE_ONCE(rtp->percpu_enqueue_shift, order_base_2(nr_cpu_ids)); + smp_store_release(&rtp->percpu_enqueue_lim, 1); + rtp->percpu_dequeue_gpseq = get_state_synchronize_rcu(); ++ gpdone = false; + pr_info("Starting switch %s to CPU-0 callback queuing.\n", rtp->name); + } + raw_spin_unlock_irqrestore(&rtp->cbs_gbl_lock, flags); + } +- if (rcu_task_cb_adjust && !ncbsnz && +- poll_state_synchronize_rcu(rtp->percpu_dequeue_gpseq)) { ++ if (rcu_task_cb_adjust && !ncbsnz && gpdone) { + raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags); + if (rtp->percpu_enqueue_lim < rtp->percpu_dequeue_lim) { + WRITE_ONCE(rtp->percpu_dequeue_lim, 1); + pr_info("Completing switch %s to CPU-0 callback queuing.\n", rtp->name); + } +- for (cpu = rtp->percpu_dequeue_lim; cpu < nr_cpu_ids; cpu++) { +- struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu); ++ if (rtp->percpu_dequeue_lim == 1) { ++ for (cpu = rtp->percpu_dequeue_lim; cpu < nr_cpu_ids; cpu++) { ++ struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu); + +- WARN_ON_ONCE(rcu_segcblist_n_cbs(&rtpcp->cblist)); ++ WARN_ON_ONCE(rcu_segcblist_n_cbs(&rtpcp->cblist)); ++ } + } + raw_spin_unlock_irqrestore(&rtp->cbs_gbl_lock, flags); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-640-wifi-ath11k-debugfs-fix-to-work-with-multiple-P.patch b/patches.kernel.org/6.2.3-640-wifi-ath11k-debugfs-fix-to-work-with-multiple-P.patch new file mode 100644 index 0000000..3f5706a --- /dev/null +++ b/patches.kernel.org/6.2.3-640-wifi-ath11k-debugfs-fix-to-work-with-multiple-P.patch @@ -0,0 +1,152 @@ +From: Kalle Valo +Date: Thu, 22 Dec 2022 19:15:59 +0200 +Subject: [PATCH] wifi: ath11k: debugfs: fix to work with multiple PCI devices +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 323d91d4684d238f6bc3693fed93caf795378fe0 + +[ Upstream commit 323d91d4684d238f6bc3693fed93caf795378fe0 ] + +ath11k fails to load if there are multiple ath11k PCI devices with same name: + + ath11k_pci 0000:01:00.0: Hardware name qcn9074 hw1.0 + debugfs: Directory 'ath11k' with parent '/' already present! + ath11k_pci 0000:01:00.0: failed to create ath11k debugfs + ath11k_pci 0000:01:00.0: failed to create soc core: -17 + ath11k_pci 0000:01:00.0: failed to init core: -17 + ath11k_pci: probe of 0000:01:00.0 failed with error -17 + +Fix this by creating a directory for each ath11k device using schema +-, for example "pci-0000:06:00.0". This directory created under +the top-level ath11k directory, for example /sys/kernel/debug/ath11k. + +The reference to the toplevel ath11k directory is not stored anymore within ath11k, instead +it's retrieved using debugfs_lookup(). If the directory does not exist it will +be created. After the last directory from the ath11k directory is removed, for +example when doing rmmod ath11k, the empty ath11k directory is left in place, +it's a minor cosmetic issue anyway. + +Here's an example hierarchy with one WCN6855: + +ath11k +`-- pci-0000:06:00.0 + |-- mac0 + | |-- dfs_block_radar_events + | |-- dfs_simulate_radar + | |-- ext_rx_stats + | |-- ext_tx_stats + | |-- fw_dbglog_config + | |-- fw_stats + | | |-- beacon_stats + | | |-- pdev_stats + | | `-- vdev_stats + | |-- htt_stats + | |-- htt_stats_reset + | |-- htt_stats_type + | `-- pktlog_filter + |-- simulate_fw_crash + `-- soc_dp_stats + +I didn't have a test setup where I could connect multiple ath11k devices to the +same the host, so I have only tested this with one device. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1 +Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1 + +Tested-by: Robert Marko +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221220121231.20120-1-kvalo@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/ath/ath11k/core.h | 1 - + drivers/net/wireless/ath/ath11k/debugfs.c | 48 +++++++++++++++++++---- + 2 files changed, 40 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h +index 22460b0a..ac34c57e 100644 +--- a/drivers/net/wireless/ath/ath11k/core.h ++++ b/drivers/net/wireless/ath/ath11k/core.h +@@ -912,7 +912,6 @@ struct ath11k_base { + enum ath11k_dfs_region dfs_region; + #ifdef CONFIG_ATH11K_DEBUGFS + struct dentry *debugfs_soc; +- struct dentry *debugfs_ath11k; + #endif + struct ath11k_soc_dp_stats soc_stats; + +diff --git a/drivers/net/wireless/ath/ath11k/debugfs.c b/drivers/net/wireless/ath/ath11k/debugfs.c +index ccdf3d5b..5bb6fd17 100644 +--- a/drivers/net/wireless/ath/ath11k/debugfs.c ++++ b/drivers/net/wireless/ath/ath11k/debugfs.c +@@ -976,10 +976,6 @@ int ath11k_debugfs_pdev_create(struct ath11k_base *ab) + if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags)) + return 0; + +- ab->debugfs_soc = debugfs_create_dir(ab->hw_params.name, ab->debugfs_ath11k); +- if (IS_ERR(ab->debugfs_soc)) +- return PTR_ERR(ab->debugfs_soc); +- + debugfs_create_file("simulate_fw_crash", 0600, ab->debugfs_soc, ab, + &fops_simulate_fw_crash); + +@@ -1001,15 +997,51 @@ void ath11k_debugfs_pdev_destroy(struct ath11k_base *ab) + + int ath11k_debugfs_soc_create(struct ath11k_base *ab) + { +- ab->debugfs_ath11k = debugfs_create_dir("ath11k", NULL); ++ struct dentry *root; ++ bool dput_needed; ++ char name[64]; ++ int ret; ++ ++ root = debugfs_lookup("ath11k", NULL); ++ if (!root) { ++ root = debugfs_create_dir("ath11k", NULL); ++ if (IS_ERR_OR_NULL(root)) ++ return PTR_ERR(root); ++ ++ dput_needed = false; ++ } else { ++ /* a dentry from lookup() needs dput() after we don't use it */ ++ dput_needed = true; ++ } ++ ++ scnprintf(name, sizeof(name), "%s-%s", ath11k_bus_str(ab->hif.bus), ++ dev_name(ab->dev)); ++ ++ ab->debugfs_soc = debugfs_create_dir(name, root); ++ if (IS_ERR_OR_NULL(ab->debugfs_soc)) { ++ ret = PTR_ERR(ab->debugfs_soc); ++ goto out; ++ } ++ ++ ret = 0; + +- return PTR_ERR_OR_ZERO(ab->debugfs_ath11k); ++out: ++ if (dput_needed) ++ dput(root); ++ ++ return ret; + } + + void ath11k_debugfs_soc_destroy(struct ath11k_base *ab) + { +- debugfs_remove_recursive(ab->debugfs_ath11k); +- ab->debugfs_ath11k = NULL; ++ debugfs_remove_recursive(ab->debugfs_soc); ++ ab->debugfs_soc = NULL; ++ ++ /* We are not removing ath11k directory on purpose, even if it ++ * would be empty. This simplifies the directory handling and it's ++ * a minor cosmetic issue to leave an empty ath11k directory to ++ * debugfs. ++ */ + } + EXPORT_SYMBOL(ath11k_debugfs_soc_destroy); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-641-thermal-intel-Fix-unsigned-comparison-with-less.patch b/patches.kernel.org/6.2.3-641-thermal-intel-Fix-unsigned-comparison-with-less.patch new file mode 100644 index 0000000..b9eefad --- /dev/null +++ b/patches.kernel.org/6.2.3-641-thermal-intel-Fix-unsigned-comparison-with-less.patch @@ -0,0 +1,43 @@ +From: Yang Li +Date: Fri, 6 Jan 2023 08:59:51 +0800 +Subject: [PATCH] thermal: intel: Fix unsigned comparison with less than zero +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e7fcfe67f9f410736b758969477b17ea285e8e6c + +[ Upstream commit e7fcfe67f9f410736b758969477b17ea285e8e6c ] + +The return value from the call to intel_tcc_get_tjmax() is int, which can +be a negative error code. However, the return value is being assigned to +an u32 variable 'tj_max', so making 'tj_max' an int. + +Eliminate the following warning: +./drivers/thermal/intel/intel_soc_dts_iosf.c:394:5-11: WARNING: Unsigned expression compared with zero: tj_max < 0 + +Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3637 +Reported-by: Abaci Robot +Signed-off-by: Yang Li +Acked-by: Zhang Rui +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thermal/intel/intel_soc_dts_iosf.c b/drivers/thermal/intel/intel_soc_dts_iosf.c +index 342b0bb5..8651ff1a 100644 +--- a/drivers/thermal/intel/intel_soc_dts_iosf.c ++++ b/drivers/thermal/intel/intel_soc_dts_iosf.c +@@ -405,7 +405,7 @@ struct intel_soc_dts_sensors *intel_soc_dts_iosf_init( + { + struct intel_soc_dts_sensors *sensors; + bool notification; +- u32 tj_max; ++ int tj_max; + int ret; + int i; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-642-timers-Prevent-union-confusion-from-unexpected-.patch b/patches.kernel.org/6.2.3-642-timers-Prevent-union-confusion-from-unexpected-.patch new file mode 100644 index 0000000..646e98b --- /dev/null +++ b/patches.kernel.org/6.2.3-642-timers-Prevent-union-confusion-from-unexpected-.patch @@ -0,0 +1,110 @@ +From: Jann Horn +Date: Thu, 5 Jan 2023 14:44:03 +0100 +Subject: [PATCH] timers: Prevent union confusion from unexpected + restart_syscall() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9f76d59173d9d146e96c66886b671c1915a5c5e5 + +[ Upstream commit 9f76d59173d9d146e96c66886b671c1915a5c5e5 ] + +The nanosleep syscalls use the restart_block mechanism, with a quirk: +The `type` and `rmtp`/`compat_rmtp` fields are set up unconditionally on +syscall entry, while the rest of the restart_block is only set up in the +unlikely case that the syscall is actually interrupted by a signal (or +pseudo-signal) that doesn't have a signal handler. + +If the restart_block was set up by a previous syscall (futex(..., +FUTEX_WAIT, ...) or poll()) and hasn't been invalidated somehow since then, +this will clobber some of the union fields used by futex_wait_restart() and +do_restart_poll(). + +If userspace afterwards wrongly calls the restart_syscall syscall, +futex_wait_restart()/do_restart_poll() will read struct fields that have +been clobbered. + +This doesn't actually lead to anything particularly interesting because +none of the union fields contain trusted kernel data, and +futex(..., FUTEX_WAIT, ...) and poll() aren't syscalls where it makes much +sense to apply seccomp filters to their arguments. + +So the current consequences are just of the "if userspace does bad stuff, +it can damage itself, and that's not a problem" flavor. + +But still, it seems like a hazard for future developers, so invalidate the +restart_block when partly setting it up in the nanosleep syscalls. + +Signed-off-by: Jann Horn +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20230105134403.754986-1-jannh@google.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/time/hrtimer.c | 2 ++ + kernel/time/posix-stubs.c | 2 ++ + kernel/time/posix-timers.c | 2 ++ + 3 files changed, 6 insertions(+) + +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 3ae661ab..e4f0e3b0 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -2126,6 +2126,7 @@ SYSCALL_DEFINE2(nanosleep, struct __kernel_timespec __user *, rqtp, + if (!timespec64_valid(&tu)) + return -EINVAL; + ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE; + current->restart_block.nanosleep.rmtp = rmtp; + return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL, +@@ -2147,6 +2148,7 @@ SYSCALL_DEFINE2(nanosleep_time32, struct old_timespec32 __user *, rqtp, + if (!timespec64_valid(&tu)) + return -EINVAL; + ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE; + current->restart_block.nanosleep.compat_rmtp = rmtp; + return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL, +diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c +index 90ea5f37..828aeecb 100644 +--- a/kernel/time/posix-stubs.c ++++ b/kernel/time/posix-stubs.c +@@ -147,6 +147,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags, + return -EINVAL; + if (flags & TIMER_ABSTIME) + rmtp = NULL; ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE; + current->restart_block.nanosleep.rmtp = rmtp; + texp = timespec64_to_ktime(t); +@@ -240,6 +241,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags, + return -EINVAL; + if (flags & TIMER_ABSTIME) + rmtp = NULL; ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE; + current->restart_block.nanosleep.compat_rmtp = rmtp; + texp = timespec64_to_ktime(t); +diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c +index 5dead893..0c8a87a1 100644 +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -1270,6 +1270,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags, + return -EINVAL; + if (flags & TIMER_ABSTIME) + rmtp = NULL; ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE; + current->restart_block.nanosleep.rmtp = rmtp; + +@@ -1297,6 +1298,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags, + return -EINVAL; + if (flags & TIMER_ABSTIME) + rmtp = NULL; ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE; + current->restart_block.nanosleep.compat_rmtp = rmtp; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-643-x86-bugs-Reset-speculation-control-settings-on-.patch b/patches.kernel.org/6.2.3-643-x86-bugs-Reset-speculation-control-settings-on-.patch new file mode 100644 index 0000000..f467651 --- /dev/null +++ b/patches.kernel.org/6.2.3-643-x86-bugs-Reset-speculation-control-settings-on-.patch @@ -0,0 +1,76 @@ +From: Breno Leitao +Date: Mon, 28 Nov 2022 07:31:48 -0800 +Subject: [PATCH] x86/bugs: Reset speculation control settings on init +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0125acda7d76b943ca55811df40ed6ec0ecf670f + +[ Upstream commit 0125acda7d76b943ca55811df40ed6ec0ecf670f ] + +Currently, x86_spec_ctrl_base is read at boot time and speculative bits +are set if Kconfig items are enabled. For example, IBRS is enabled if +CONFIG_CPU_IBRS_ENTRY is configured, etc. These MSR bits are not cleared +if the mitigations are disabled. + +This is a problem when kexec-ing a kernel that has the mitigation +disabled from a kernel that has the mitigation enabled. In this case, +the MSR bits are not cleared during the new kernel boot. As a result, +this might have some performance degradation that is hard to pinpoint. + +This problem does not happen if the machine is (hard) rebooted because +the bit will be cleared by default. + + [ bp: Massage. ] + +Suggested-by: Pawan Gupta +Signed-off-by: Breno Leitao +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20221128153148.1129350-1-leitao@debian.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/x86/include/asm/msr-index.h | 4 ++++ + arch/x86/kernel/cpu/bugs.c | 10 +++++++++- + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h +index d3fe82c5..978a3e20 100644 +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -49,6 +49,10 @@ + #define SPEC_CTRL_RRSBA_DIS_S_SHIFT 6 /* Disable RRSBA behavior */ + #define SPEC_CTRL_RRSBA_DIS_S BIT(SPEC_CTRL_RRSBA_DIS_S_SHIFT) + ++/* A mask for bits which the kernel toggles when controlling mitigations */ ++#define SPEC_CTRL_MITIGATIONS_MASK (SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD \ ++ | SPEC_CTRL_RRSBA_DIS_S) ++ + #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */ + #define PRED_CMD_IBPB BIT(0) /* Indirect Branch Prediction Barrier */ + +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index bca0bd8f..374bc620 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -144,9 +144,17 @@ void __init check_bugs(void) + * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD + * init code as it is not enumerated and depends on the family. + */ +- if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) ++ if (cpu_feature_enabled(X86_FEATURE_MSR_SPEC_CTRL)) { + rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); + ++ /* ++ * Previously running kernel (kexec), may have some controls ++ * turned ON. Clear them and let the mitigations setup below ++ * rediscover them based on configuration. ++ */ ++ x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK; ++ } ++ + /* Select the proper CPU mitigations before patching alternatives: */ + spectre_v1_select_mitigation(); + spectre_v2_select_mitigation(); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-644-bpftool-Always-disable-stack-protection-for-BPF.patch b/patches.kernel.org/6.2.3-644-bpftool-Always-disable-stack-protection-for-BPF.patch new file mode 100644 index 0000000..a91e918 --- /dev/null +++ b/patches.kernel.org/6.2.3-644-bpftool-Always-disable-stack-protection-for-BPF.patch @@ -0,0 +1,67 @@ +From: =?UTF-8?q?Holger=20Hoffst=C3=A4tte?= +Date: Fri, 13 Jan 2023 16:40:23 +0100 +Subject: [PATCH] bpftool: Always disable stack protection for BPF objects +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 878625e1c7a10dfbb1fdaaaae2c4d2a58fbce627 + +[ Upstream commit 878625e1c7a10dfbb1fdaaaae2c4d2a58fbce627 ] + +When the clang toolchain has stack protection enabled in order to be +consistent with gcc - which just happens to be the case on Gentoo - +the bpftool build fails: + + [...] + clang \ + -I. \ + -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/include/uapi/ \ + -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/bpf/bpftool/bootstrap/libbpf/include \ + -g -O2 -Wall -target bpf -c skeleton/pid_iter.bpf.c -o pid_iter.bpf.o + clang \ + -I. \ + -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/include/uapi/ \ + -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/bpf/bpftool/bootstrap/libbpf/include \ + -g -O2 -Wall -target bpf -c skeleton/profiler.bpf.c -o profiler.bpf.o + skeleton/profiler.bpf.c:40:14: error: A call to built-in function '__stack_chk_fail' is not supported. + int BPF_PROG(fentry_XXX) + ^ + skeleton/profiler.bpf.c:94:14: error: A call to built-in function '__stack_chk_fail' is not supported. + int BPF_PROG(fexit_XXX) + ^ + 2 errors generated. + [...] + +Since stack-protector makes no sense for the BPF bits just unconditionally +disable it. + +Bug: https://bugs.gentoo.org/890638 +Signed-off-by: Holger Hoffstätte +Signed-off-by: Daniel Borkmann +Acked-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/74cd9d2e-6052-312a-241e-2b514a75c92c@applied-asynchrony.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/bpf/bpftool/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile +index f610e184..270066af 100644 +--- a/tools/bpf/bpftool/Makefile ++++ b/tools/bpf/bpftool/Makefile +@@ -215,7 +215,8 @@ $(OUTPUT)%.bpf.o: skeleton/%.bpf.c $(OUTPUT)vmlinux.h $(LIBBPF_BOOTSTRAP) + -I$(or $(OUTPUT),.) \ + -I$(srctree)/tools/include/uapi/ \ + -I$(LIBBPF_BOOTSTRAP_INCLUDE) \ +- -g -O2 -Wall -target bpf -c $< -o $@ ++ -g -O2 -Wall -fno-stack-protector \ ++ -target bpf -c $< -o $@ + $(Q)$(LLVM_STRIP) -g $@ + + $(OUTPUT)%.skel.h: $(OUTPUT)%.bpf.o $(BPFTOOL_BOOTSTRAP) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-645-wifi-brcmfmac-ensure-CLM-version-is-null-termin.patch b/patches.kernel.org/6.2.3-645-wifi-brcmfmac-ensure-CLM-version-is-null-termin.patch new file mode 100644 index 0000000..798d6df --- /dev/null +++ b/patches.kernel.org/6.2.3-645-wifi-brcmfmac-ensure-CLM-version-is-null-termin.patch @@ -0,0 +1,166 @@ +From: Jisoo Jang +Date: Fri, 30 Dec 2022 16:51:39 +0900 +Subject: [PATCH] wifi: brcmfmac: ensure CLM version is null-terminated to + prevent stack-out-of-bounds +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 660145d708be52f946a82e5b633c020f58f996de + +[ Upstream commit 660145d708be52f946a82e5b633c020f58f996de ] + +Fix a stack-out-of-bounds read in brcmfmac that occurs +when 'buf' that is not null-terminated is passed as an argument of +strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with +a CLM version string by memcpy() in brcmf_fil_iovar_data_get(). +Ensure buf is null-terminated. + +Found by a modified version of syzkaller. + +[ 33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available +[ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22 +[ 33.021554][ T1896] ================================================================== +[ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110 +[ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896 +[ 33.023852][ T1896] +[ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132 +[ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +[ 33.026065][ T1896] Workqueue: usb_hub_wq hub_event +[ 33.026581][ T1896] Call Trace: +[ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d +[ 33.027372][ T1896] print_address_description.constprop.0.cold+0xf/0x334 +[ 33.028037][ T1896] ? strreplace+0xf2/0x110 +[ 33.028403][ T1896] ? strreplace+0xf2/0x110 +[ 33.028807][ T1896] kasan_report.cold+0x83/0xdf +[ 33.029283][ T1896] ? strreplace+0xf2/0x110 +[ 33.029666][ T1896] strreplace+0xf2/0x110 +[ 33.029966][ T1896] brcmf_c_preinit_dcmds+0xab1/0xc40 +[ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100 +[ 33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 33.031223][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0 +[ 33.032091][ T1896] ? find_held_lock+0x2d/0x110 +[ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260 +[ 33.033087][ T1896] ? brcmf_usb_rx_fill_all+0x5a/0xf0 +[ 33.033582][ T1896] brcmf_attach+0x246/0xd40 +[ 33.034022][ T1896] ? wiphy_new_nm+0x1476/0x1d50 +[ 33.034383][ T1896] ? kmemdup+0x30/0x40 +[ 33.034722][ T1896] brcmf_usb_probe+0x12de/0x1690 +[ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 +[ 33.035833][ T1896] usb_probe_interface+0x25f/0x710 +[ 33.036315][ T1896] really_probe+0x1be/0xa90 +[ 33.036656][ T1896] __driver_probe_device+0x2ab/0x460 +[ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0 +[ 33.037383][ T1896] driver_probe_device+0x49/0x120 +[ 33.037790][ T1896] __device_attach_driver+0x18a/0x250 +[ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120 +[ 33.038986][ T1896] bus_for_each_drv+0x123/0x1a0 +[ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20 +[ 33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 33.041861][ T1896] ? trace_hardirqs_on+0x1c/0x120 +[ 33.042330][ T1896] __device_attach+0x207/0x330 +[ 33.042664][ T1896] ? device_bind_driver+0xb0/0xb0 +[ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0 +[ 33.043515][ T1896] bus_probe_device+0x1a2/0x260 +[ 33.043914][ T1896] device_add+0xa61/0x1ce0 +[ 33.044227][ T1896] ? __mutex_unlock_slowpath+0xe7/0x660 +[ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 +[ 33.045531][ T1896] usb_set_configuration+0x984/0x1770 +[ 33.046051][ T1896] ? kernfs_create_link+0x175/0x230 +[ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90 +[ 33.046931][ T1896] usb_probe_device+0x9c/0x220 +[ 33.047434][ T1896] really_probe+0x1be/0xa90 +[ 33.047760][ T1896] __driver_probe_device+0x2ab/0x460 +[ 33.048134][ T1896] driver_probe_device+0x49/0x120 +[ 33.048516][ T1896] __device_attach_driver+0x18a/0x250 +[ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120 +[ 33.049437][ T1896] bus_for_each_drv+0x123/0x1a0 +[ 33.049814][ T1896] ? bus_rescan_devices+0x20/0x20 +[ 33.050164][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 33.050579][ T1896] ? trace_hardirqs_on+0x1c/0x120 +[ 33.050936][ T1896] __device_attach+0x207/0x330 +[ 33.051399][ T1896] ? device_bind_driver+0xb0/0xb0 +[ 33.051888][ T1896] ? kobject_uevent_env+0x230/0x12c0 +[ 33.052314][ T1896] bus_probe_device+0x1a2/0x260 +[ 33.052688][ T1896] device_add+0xa61/0x1ce0 +[ 33.053121][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 +[ 33.053568][ T1896] usb_new_device.cold+0x463/0xf66 +[ 33.053953][ T1896] ? hub_disconnect+0x400/0x400 +[ 33.054313][ T1896] ? rwlock_bug.part.0+0x90/0x90 +[ 33.054661][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 33.055094][ T1896] hub_event+0x10d5/0x3330 +[ 33.055530][ T1896] ? hub_port_debounce+0x280/0x280 +[ 33.055934][ T1896] ? __lock_acquire+0x1671/0x5790 +[ 33.056387][ T1896] ? wq_calc_node_cpumask+0x170/0x2a0 +[ 33.056924][ T1896] ? lock_release+0x640/0x640 +[ 33.057383][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 33.057916][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 33.058402][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 33.059019][ T1896] process_one_work+0x873/0x13e0 +[ 33.059488][ T1896] ? lock_release+0x640/0x640 +[ 33.059932][ T1896] ? pwq_dec_nr_in_flight+0x320/0x320 +[ 33.060446][ T1896] ? rwlock_bug.part.0+0x90/0x90 +[ 33.060898][ T1896] worker_thread+0x8b/0xd10 +[ 33.061348][ T1896] ? __kthread_parkme+0xd9/0x1d0 +[ 33.061810][ T1896] ? process_one_work+0x13e0/0x13e0 +[ 33.062288][ T1896] kthread+0x379/0x450 +[ 33.062660][ T1896] ? _raw_spin_unlock_irq+0x24/0x30 +[ 33.063148][ T1896] ? set_kthread_struct+0x100/0x100 +[ 33.063606][ T1896] ret_from_fork+0x1f/0x30 +[ 33.064070][ T1896] +[ 33.064313][ T1896] +[ 33.064545][ T1896] addr ffffc90001d6efc8 is located in stack of task kworker/0:2/1896 at offset 512 in frame: +[ 33.065478][ T1896] brcmf_c_preinit_dcmds+0x0/0xc40 +[ 33.065973][ T1896] +[ 33.066191][ T1896] this frame has 4 objects: +[ 33.066614][ T1896] [48, 56) 'ptr' +[ 33.066618][ T1896] [80, 148) 'revinfo' +[ 33.066957][ T1896] [192, 210) 'eventmask' +[ 33.067338][ T1896] [256, 512) 'buf' +[ 33.067742][ T1896] +[ 33.068304][ T1896] Memory state around the buggy address: +[ 33.068838][ T1896] ffffc90001d6ee80: f2 00 00 02 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 +[ 33.069545][ T1896] ffffc90001d6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 33.070626][ T1896] >ffffc90001d6ef80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 +[ 33.072052][ T1896] ^ +[ 33.073043][ T1896] ffffc90001d6f000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 33.074230][ T1896] ffffc90001d6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 33.074914][ T1896] ================================================================== +[ 33.075713][ T1896] Disabling lock debugging due to kernel taint + +Reviewed-by: Arend van Spriel +Signed-off-by: Jisoo Jang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221230075139.56591-1-jisoo.jang@yonsei.ac.kr +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +index 5b484bba..f235bead 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +@@ -320,15 +320,17 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) + if (err) { + brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err); + } else { ++ buf[sizeof(buf) - 1] = '\0'; + clmver = (char *)buf; +- /* store CLM version for adding it to revinfo debugfs file */ +- memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver)); + + /* Replace all newline/linefeed characters with space + * character + */ + strreplace(clmver, '\n', ' '); + ++ /* store CLM version for adding it to revinfo debugfs file */ ++ memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver)); ++ + brcmf_dbg(INFO, "CLM version = %s\n", clmver); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-646-wifi-rtw89-fix-assignation-of-TX-BD-RAM-table.patch b/patches.kernel.org/6.2.3-646-wifi-rtw89-fix-assignation-of-TX-BD-RAM-table.patch new file mode 100644 index 0000000..5c8868f --- /dev/null +++ b/patches.kernel.org/6.2.3-646-wifi-rtw89-fix-assignation-of-TX-BD-RAM-table.patch @@ -0,0 +1,158 @@ +From: Zong-Zhe Yang +Date: Fri, 13 Jan 2023 17:06:31 +0800 +Subject: [PATCH] wifi: rtw89: fix assignation of TX BD RAM table +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7f495de6ae7d31f098970fb45a038c9f69b1bf75 + +[ Upstream commit 7f495de6ae7d31f098970fb45a038c9f69b1bf75 ] + +TX BD's RAM table describes how HW allocates usable buffer section +for each TX channel at fetch time. The total RAM size for TX BD is +chip-dependent. For 8852BE, it has only half size (32) for TX channels +of single band. Original table arrange total size (64) for dual band. +It will overflow on 8852BE circuit and cause section conflicts between +different TX channels. + +So, we do the changes below. +* add another table for single band chip and export both kind of tables +* point to the expected one in rtw89_pci_info by chip + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230113090632.60957-4-pkshih@realtek.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw89/pci.c | 15 ++++++++++++++- + drivers/net/wireless/realtek/rtw89/pci.h | 15 +++++++++------ + drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 + + drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 + + drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 + + 5 files changed, 26 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index 1c4500ba..0ea734c8 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -1384,7 +1384,7 @@ static int rtw89_pci_ops_tx_write(struct rtw89_dev *rtwdev, struct rtw89_core_tx + return 0; + } + +-static const struct rtw89_pci_bd_ram bd_ram_table[RTW89_TXCH_NUM] = { ++const struct rtw89_pci_bd_ram rtw89_bd_ram_table_dual[RTW89_TXCH_NUM] = { + [RTW89_TXCH_ACH0] = {.start_idx = 0, .max_num = 5, .min_num = 2}, + [RTW89_TXCH_ACH1] = {.start_idx = 5, .max_num = 5, .min_num = 2}, + [RTW89_TXCH_ACH2] = {.start_idx = 10, .max_num = 5, .min_num = 2}, +@@ -1399,11 +1399,24 @@ static const struct rtw89_pci_bd_ram bd_ram_table[RTW89_TXCH_NUM] = { + [RTW89_TXCH_CH11] = {.start_idx = 55, .max_num = 5, .min_num = 1}, + [RTW89_TXCH_CH12] = {.start_idx = 60, .max_num = 4, .min_num = 1}, + }; ++EXPORT_SYMBOL(rtw89_bd_ram_table_dual); ++ ++const struct rtw89_pci_bd_ram rtw89_bd_ram_table_single[RTW89_TXCH_NUM] = { ++ [RTW89_TXCH_ACH0] = {.start_idx = 0, .max_num = 5, .min_num = 2}, ++ [RTW89_TXCH_ACH1] = {.start_idx = 5, .max_num = 5, .min_num = 2}, ++ [RTW89_TXCH_ACH2] = {.start_idx = 10, .max_num = 5, .min_num = 2}, ++ [RTW89_TXCH_ACH3] = {.start_idx = 15, .max_num = 5, .min_num = 2}, ++ [RTW89_TXCH_CH8] = {.start_idx = 20, .max_num = 4, .min_num = 1}, ++ [RTW89_TXCH_CH9] = {.start_idx = 24, .max_num = 4, .min_num = 1}, ++ [RTW89_TXCH_CH12] = {.start_idx = 28, .max_num = 4, .min_num = 1}, ++}; ++EXPORT_SYMBOL(rtw89_bd_ram_table_single); + + static void rtw89_pci_reset_trx_rings(struct rtw89_dev *rtwdev) + { + struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv; + const struct rtw89_pci_info *info = rtwdev->pci_info; ++ const struct rtw89_pci_bd_ram *bd_ram_table = *info->bd_ram_table; + struct rtw89_pci_tx_ring *tx_ring; + struct rtw89_pci_rx_ring *rx_ring; + struct rtw89_pci_dma_ring *bd_ring; +diff --git a/drivers/net/wireless/realtek/rtw89/pci.h b/drivers/net/wireless/realtek/rtw89/pci.h +index 7d033501..1e19740d 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.h ++++ b/drivers/net/wireless/realtek/rtw89/pci.h +@@ -750,6 +750,12 @@ struct rtw89_pci_ch_dma_addr_set { + struct rtw89_pci_ch_dma_addr rx[RTW89_RXCH_NUM]; + }; + ++struct rtw89_pci_bd_ram { ++ u8 start_idx; ++ u8 max_num; ++ u8 min_num; ++}; ++ + struct rtw89_pci_info { + enum mac_ax_bd_trunc_mode txbd_trunc_mode; + enum mac_ax_bd_trunc_mode rxbd_trunc_mode; +@@ -785,6 +791,7 @@ struct rtw89_pci_info { + u32 tx_dma_ch_mask; + const struct rtw89_pci_bd_idx_addr *bd_idx_addr_low_power; + const struct rtw89_pci_ch_dma_addr_set *dma_addr_set; ++ const struct rtw89_pci_bd_ram (*bd_ram_table)[RTW89_TXCH_NUM]; + + int (*ltr_set)(struct rtw89_dev *rtwdev, bool en); + u32 (*fill_txaddr_info)(struct rtw89_dev *rtwdev, +@@ -798,12 +805,6 @@ struct rtw89_pci_info { + struct rtw89_pci_isrs *isrs); + }; + +-struct rtw89_pci_bd_ram { +- u8 start_idx; +- u8 max_num; +- u8 min_num; +-}; +- + struct rtw89_pci_tx_data { + dma_addr_t dma; + }; +@@ -1057,6 +1058,8 @@ static inline bool rtw89_pci_ltr_is_err_reg_val(u32 val) + extern const struct dev_pm_ops rtw89_pm_ops; + extern const struct rtw89_pci_ch_dma_addr_set rtw89_pci_ch_dma_addr_set; + extern const struct rtw89_pci_ch_dma_addr_set rtw89_pci_ch_dma_addr_set_v1; ++extern const struct rtw89_pci_bd_ram rtw89_bd_ram_table_dual[RTW89_TXCH_NUM]; ++extern const struct rtw89_pci_bd_ram rtw89_bd_ram_table_single[RTW89_TXCH_NUM]; + + struct pci_device_id; + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852ae.c b/drivers/net/wireless/realtek/rtw89/rtw8852ae.c +index 0cd8c0c4..d835a44a 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852ae.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852ae.c +@@ -44,6 +44,7 @@ static const struct rtw89_pci_info rtw8852a_pci_info = { + .tx_dma_ch_mask = 0, + .bd_idx_addr_low_power = NULL, + .dma_addr_set = &rtw89_pci_ch_dma_addr_set, ++ .bd_ram_table = &rtw89_bd_ram_table_dual, + + .ltr_set = rtw89_pci_ltr_set, + .fill_txaddr_info = rtw89_pci_fill_txaddr_info, +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852be.c b/drivers/net/wireless/realtek/rtw89/rtw8852be.c +index 0ef2ca8e..ecf39d2d 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852be.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852be.c +@@ -46,6 +46,7 @@ static const struct rtw89_pci_info rtw8852b_pci_info = { + BIT(RTW89_TXCH_CH10) | BIT(RTW89_TXCH_CH11), + .bd_idx_addr_low_power = NULL, + .dma_addr_set = &rtw89_pci_ch_dma_addr_set, ++ .bd_ram_table = &rtw89_bd_ram_table_single, + + .ltr_set = rtw89_pci_ltr_set, + .fill_txaddr_info = rtw89_pci_fill_txaddr_info, +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852ce.c b/drivers/net/wireless/realtek/rtw89/rtw8852ce.c +index 35901f64..80490a54 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852ce.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852ce.c +@@ -53,6 +53,7 @@ static const struct rtw89_pci_info rtw8852c_pci_info = { + .tx_dma_ch_mask = 0, + .bd_idx_addr_low_power = &rtw8852c_bd_idx_addr_low_power, + .dma_addr_set = &rtw89_pci_ch_dma_addr_set_v1, ++ .bd_ram_table = &rtw89_bd_ram_table_dual, + + .ltr_set = rtw89_pci_ltr_set_v1, + .fill_txaddr_info = rtw89_pci_fill_txaddr_info_v1, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-647-wifi-mt7601u-fix-an-integer-underflow.patch b/patches.kernel.org/6.2.3-647-wifi-mt7601u-fix-an-integer-underflow.patch new file mode 100644 index 0000000..b0491d3 --- /dev/null +++ b/patches.kernel.org/6.2.3-647-wifi-mt7601u-fix-an-integer-underflow.patch @@ -0,0 +1,103 @@ +From: Jisoo Jang +Date: Thu, 29 Dec 2022 18:29:06 +0900 +Subject: [PATCH] wifi: mt7601u: fix an integer underflow +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 803f3176c5df3b5582c27ea690f204abb60b19b9 + +[ Upstream commit 803f3176c5df3b5582c27ea690f204abb60b19b9 ] + +Fix an integer underflow that leads to a null pointer dereference in +'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet +could be manipulated, which could trigger an integer underflow of +'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently +causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be +bypassed, eventually leading to a dereference of the pointer 'p', which +is a null pointer. + +Ensure that 'dma_len' is greater than 'min_seg_len'. + +Found by a modified version of syzkaller. + +KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] +CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G W O 5.14.0+ +#139 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +RIP: 0010:skb_add_rx_frag+0x143/0x370 +Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 +89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 +00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 +RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 +RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 +RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 +RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 +R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 +R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 +FS: 0000000000000000(0000) GS:ffff88811a800000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + mt7601u_rx_tasklet+0xc73/0x1270 + ? mt7601u_submit_rx_buf.isra.0+0x510/0x510 + ? tasklet_action_common.isra.0+0x79/0x2f0 + tasklet_action_common.isra.0+0x206/0x2f0 + __do_softirq+0x1b5/0x880 + ? tasklet_unlock+0x30/0x30 + run_ksoftirqd+0x26/0x50 + smpboot_thread_fn+0x34f/0x7d0 + ? smpboot_register_percpu_thread+0x370/0x370 + kthread+0x3a1/0x480 + ? set_kthread_struct+0x120/0x120 + ret_from_fork+0x1f/0x30 +Modules linked in: 88XXau(O) 88x2bu(O) +---[ end trace 57f34f93b4da0f9b ]--- +RIP: 0010:skb_add_rx_frag+0x143/0x370 +Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 +89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 +00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 +RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 +RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 +RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 +RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 +R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 +R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 +FS: 0000000000000000(0000) GS:ffff88811a800000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 + +Signed-off-by: Jisoo Jang +Acked-by: Jakub Kicinski +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221229092906.2328282-1-jisoo.jang@yonsei.ac.kr +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt7601u/dma.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c +index 45714739..773a1cc2 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/dma.c ++++ b/drivers/net/wireless/mediatek/mt7601u/dma.c +@@ -123,7 +123,8 @@ static u16 mt7601u_rx_next_seg_len(u8 *data, u32 data_len) + if (data_len < min_seg_len || + WARN_ON_ONCE(!dma_len) || + WARN_ON_ONCE(dma_len + MT_DMA_HDRS > data_len) || +- WARN_ON_ONCE(dma_len & 0x3)) ++ WARN_ON_ONCE(dma_len & 0x3) || ++ WARN_ON_ONCE(dma_len < min_seg_len)) + return 0; + + return MT_DMA_HDRS + dma_len; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-648-inet-fix-fast-path-in-__inet_hash_connect.patch b/patches.kernel.org/6.2.3-648-inet-fix-fast-path-in-__inet_hash_connect.patch new file mode 100644 index 0000000..1203798 --- /dev/null +++ b/patches.kernel.org/6.2.3-648-inet-fix-fast-path-in-__inet_hash_connect.patch @@ -0,0 +1,57 @@ +From: Pietro Borrello +Date: Sat, 14 Jan 2023 13:11:41 +0000 +Subject: [PATCH] inet: fix fast path in __inet_hash_connect() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 21cbd90a6fab7123905386985e3e4a80236b8714 + +[ Upstream commit 21cbd90a6fab7123905386985e3e4a80236b8714 ] + +__inet_hash_connect() has a fast path taken if sk_head(&tb->owners) is +equal to the sk parameter. +sk_head() returns the hlist_entry() with respect to the sk_node field. +However entries in the tb->owners list are inserted with respect to the +sk_bind_node field with sk_add_bind_node(). +Thus the check would never pass and the fast path never execute. + +This fast path has never been executed or tested as this bug seems +to be present since commit 1da177e4c3f4 ("Linux-2.6.12-rc2"), thus +remove it to reduce code complexity. + +Signed-off-by: Pietro Borrello +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230112-inet_hash_connect_bind_head-v3-1-b591fd212b93@diag.uniroma1.it +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/ipv4/inet_hashtables.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index f58d7388..7a13dd7f 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -1008,17 +1008,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, + u32 index; + + if (port) { +- head = &hinfo->bhash[inet_bhashfn(net, port, +- hinfo->bhash_size)]; +- tb = inet_csk(sk)->icsk_bind_hash; +- spin_lock_bh(&head->lock); +- if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) { +- inet_ehash_nolisten(sk, NULL, NULL); +- spin_unlock_bh(&head->lock); +- return 0; +- } +- spin_unlock(&head->lock); +- /* No definite answer... Walk to established hash table */ ++ local_bh_disable(); + ret = check_established(death_row, sk, port, NULL); + local_bh_enable(); + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-649-ice-restrict-PTP-HW-clock-freq-adjustments-to-1.patch b/patches.kernel.org/6.2.3-649-ice-restrict-PTP-HW-clock-freq-adjustments-to-1.patch new file mode 100644 index 0000000..ec7a8a6 --- /dev/null +++ b/patches.kernel.org/6.2.3-649-ice-restrict-PTP-HW-clock-freq-adjustments-to-1.patch @@ -0,0 +1,59 @@ +From: Siddaraju DH +Date: Tue, 15 Nov 2022 15:11:35 +0530 +Subject: [PATCH] ice: restrict PTP HW clock freq adjustments to 100, 000, 000 + PPB +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8aa4318c3a122b8670bc09af142de3872ca63b88 + +[ Upstream commit 8aa4318c3a122b8670bc09af142de3872ca63b88 ] + +The PHY provides only 39b timestamp. With current timing +implementation, we discard lower 7b, leaving 32b timestamp. +The driver reconstructs the full 64b timestamp by correlating the +32b timestamp with cached_time for performance. The reconstruction +algorithm does both forward & backward interpolation. + +The 32b timeval has overflow duration of 2^32 counts ~= 4.23 second. +Due to interpolation in both direction, its now ~= 2.125 second +IIRC, going with at least half a duration, the cached_time is updated +with periodic thread of 1 second (worst-case) periodicity. + +But the 1 second periodicity is based on System-timer. +With PPB adjustments, if the 1588 timers increments at say +double the rate, (2s in-place of 1s), the Nyquist rate/half duration +sampling/update of cached_time with 1 second periodic thread will +lead to incorrect interpolations. + +Hence we should restrict the PPB adjustments to at least half duration +of cached_time update which translates to 500,000,000 PPB. + +Since the periodicity of the cached-time system thread can vary, +it is good to have some buffer time and considering practicality of +PPB adjustments, limiting the max_adj to 100,000,000. + +Signed-off-by: Siddaraju DH +Tested-by: Gurucharan G (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c +index d63161d7..3abc8db1 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c +@@ -2269,7 +2269,7 @@ static void ice_ptp_set_caps(struct ice_pf *pf) + snprintf(info->name, sizeof(info->name) - 1, "%s-%s-clk", + dev_driver_string(dev), dev_name(dev)); + info->owner = THIS_MODULE; +- info->max_adj = 999999999; ++ info->max_adj = 100000000; + info->adjtime = ice_ptp_adjtime; + info->adjfine = ice_ptp_adjfine; + info->gettimex64 = ice_ptp_gettimex64; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-650-ice-add-missing-checks-for-PF-vsi-type.patch b/patches.kernel.org/6.2.3-650-ice-add-missing-checks-for-PF-vsi-type.patch new file mode 100644 index 0000000..dec1539 --- /dev/null +++ b/patches.kernel.org/6.2.3-650-ice-add-missing-checks-for-PF-vsi-type.patch @@ -0,0 +1,73 @@ +From: Jesse Brandeburg +Date: Tue, 13 Dec 2022 16:01:31 -0800 +Subject: [PATCH] ice: add missing checks for PF vsi type +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6a8d013e904ad9a66706fcc926ec9993bed7d190 + +[ Upstream commit 6a8d013e904ad9a66706fcc926ec9993bed7d190 ] + +There were a few places we had missed checking the VSI type to make sure +it was definitely a PF VSI, before calling setup functions intended only +for the PF VSI. + +This doesn't fix any explicit bugs but cleans up the code in a few +places and removes one explicit != vsi->type check that can be +superseded by this code (it's a super set) + +Signed-off-by: Jesse Brandeburg +Tested-by: Gurucharan G (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/intel/ice/ice_main.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 8ec24f6c..38114628 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -6182,15 +6182,12 @@ int ice_vsi_cfg(struct ice_vsi *vsi) + { + int err; + +- if (vsi->netdev) { ++ if (vsi->netdev && vsi->type == ICE_VSI_PF) { + ice_set_rx_mode(vsi->netdev); + +- if (vsi->type != ICE_VSI_LB) { +- err = ice_vsi_vlan_setup(vsi); +- +- if (err) +- return err; +- } ++ err = ice_vsi_vlan_setup(vsi); ++ if (err) ++ return err; + } + ice_vsi_cfg_dcb_rings(vsi); + +@@ -6371,7 +6368,7 @@ static int ice_up_complete(struct ice_vsi *vsi) + + if (vsi->port_info && + (vsi->port_info->phy.link_info.link_info & ICE_AQ_LINK_UP) && +- vsi->netdev) { ++ vsi->netdev && vsi->type == ICE_VSI_PF) { + ice_print_link_msg(vsi, true); + netif_tx_start_all_queues(vsi->netdev); + netif_carrier_on(vsi->netdev); +@@ -6382,7 +6379,9 @@ static int ice_up_complete(struct ice_vsi *vsi) + * set the baseline so counters are ready when interface is up + */ + ice_update_eth_stats(vsi); +- ice_service_task_schedule(pf); ++ ++ if (vsi->type == ICE_VSI_PF) ++ ice_service_task_schedule(pf); + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-651-Compiler-attributes-GCC-cold-function-alignment.patch b/patches.kernel.org/6.2.3-651-Compiler-attributes-GCC-cold-function-alignment.patch new file mode 100644 index 0000000..2f56ef3 --- /dev/null +++ b/patches.kernel.org/6.2.3-651-Compiler-attributes-GCC-cold-function-alignment.patch @@ -0,0 +1,173 @@ +From: Mark Rutland +Date: Mon, 23 Jan 2023 13:45:57 +0000 +Subject: [PATCH] Compiler attributes: GCC cold function alignment workarounds +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c27cd083cfb9d392f304657ed00fcde1136704e7 + +[ Upstream commit c27cd083cfb9d392f304657ed00fcde1136704e7 ] + +Contemporary versions of GCC (e.g. GCC 12.2.0) drop the alignment +specified by '-falign-functions=N' for functions marked with the +__cold__ attribute, and potentially for callees of __cold__ functions as +these may be implicitly marked as __cold__ by the compiler. LLVM appears +to respect '-falign-functions=N' in such cases. + +This has been reported to GCC in bug 88345: + + https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345 + +... which also covers alignment being dropped when '-Os' is used, which +will be addressed in a separate patch. + +Currently, use of '-falign-functions=N' is limited to +CONFIG_FUNCTION_ALIGNMENT, which is largely used for performance and/or +analysis reasons (e.g. with CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B), but +isn't necessary for correct functionality. However, this dropped +alignment isn't great for the performance and/or analysis cases. + +Subsequent patches will use CONFIG_FUNCTION_ALIGNMENT as part of arm64's +ftrace implementation, which will require all instrumented functions to +be aligned to at least 8-bytes. + +This patch works around the dropped alignment by avoiding the use of the +__cold__ attribute when CONFIG_FUNCTION_ALIGNMENT is non-zero, and by +specifically aligning abort(), which GCC implicitly marks as __cold__. +As the __cold macro is now dependent upon config options (which is +against the policy described at the top of compiler_attributes.h), it is +moved into compiler_types.h. + +I've tested this by building and booting a kernel configured with +defconfig + CONFIG_EXPERT=y + CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y, +and looking for misaligned text symbols in /proc/kallsyms: + +* arm64: + + Before: + # uname -rm + 6.2.0-rc3 aarch64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 5009 + + After: + # uname -rm + 6.2.0-rc3-00001-g2a2bedf8bfa9 aarch64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 919 + +* x86_64: + + Before: + # uname -rm + 6.2.0-rc3 x86_64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 11537 + + After: + # uname -rm + 6.2.0-rc3-00001-g2a2bedf8bfa9 x86_64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 2805 + +There's clearly a substantial reduction in the number of misaligned +symbols. From manual inspection, the remaining unaligned text labels are +a combination of ACPICA functions (due to the use of '-Os'), static call +trampolines, and non-function labels in assembly, which will be dealt +with in subsequent patches. + +Signed-off-by: Mark Rutland +Cc: Florent Revest +Cc: Masami Hiramatsu +Cc: Peter Zijlstra +Cc: Steven Rostedt +Cc: Will Deacon +Cc: Miguel Ojeda +Cc: Nick Desaulniers +Link: https://lore.kernel.org/r/20230123134603.1064407-3-mark.rutland@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/compiler_attributes.h | 6 ------ + include/linux/compiler_types.h | 27 +++++++++++++++++++++++++++ + kernel/exit.c | 9 ++++++++- + 3 files changed, 35 insertions(+), 7 deletions(-) + +diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h +index 898b3458..b8312645 100644 +--- a/include/linux/compiler_attributes.h ++++ b/include/linux/compiler_attributes.h +@@ -75,12 +75,6 @@ + # define __assume_aligned(a, ...) + #endif + +-/* +- * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-cold-function-attribute +- * gcc: https://gcc.gnu.org/onlinedocs/gcc/Label-Attributes.html#index-cold-label-attribute +- */ +-#define __cold __attribute__((__cold__)) +- + /* + * Note the long name. + * +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index 7c1afe0f..aab34e30 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -79,6 +79,33 @@ static inline void __chk_io_ptr(const volatile void __iomem *ptr) { } + /* Attributes */ + #include + ++#if CONFIG_FUNCTION_ALIGNMENT > 0 ++#define __function_aligned __aligned(CONFIG_FUNCTION_ALIGNMENT) ++#else ++#define __function_aligned ++#endif ++ ++/* ++ * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-cold-function-attribute ++ * gcc: https://gcc.gnu.org/onlinedocs/gcc/Label-Attributes.html#index-cold-label-attribute ++ * ++ * When -falign-functions=N is in use, we must avoid the cold attribute as ++ * contemporary versions of GCC drop the alignment for cold functions. Worse, ++ * GCC can implicitly mark callees of cold functions as cold themselves, so ++ * it's not sufficient to add __function_aligned here as that will not ensure ++ * that callees are correctly aligned. ++ * ++ * See: ++ * ++ * https://lore.kernel.org/lkml/Y77%2FqVgvaJidFpYt@FVFF77S0Q05N ++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345#c9 ++ */ ++#if !defined(CONFIG_CC_IS_GCC) || (CONFIG_FUNCTION_ALIGNMENT == 0) ++#define __cold __attribute__((__cold__)) ++#else ++#define __cold ++#endif ++ + /* Builtins */ + + /* +diff --git a/kernel/exit.c b/kernel/exit.c +index bccfa421..f2afdb0a 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -1905,7 +1905,14 @@ bool thread_group_exited(struct pid *pid) + } + EXPORT_SYMBOL(thread_group_exited); + +-__weak void abort(void) ++/* ++ * This needs to be __function_aligned as GCC implicitly makes any ++ * implementation of abort() cold and drops alignment specified by ++ * -falign-functions=N. ++ * ++ * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345#c11 ++ */ ++__weak __function_aligned void abort(void) + { + BUG(); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-652-ACPI-Don-t-build-ACPICA-with-Os.patch b/patches.kernel.org/6.2.3-652-ACPI-Don-t-build-ACPICA-with-Os.patch new file mode 100644 index 0000000..8c481e9 --- /dev/null +++ b/patches.kernel.org/6.2.3-652-ACPI-Don-t-build-ACPICA-with-Os.patch @@ -0,0 +1,112 @@ +From: Mark Rutland +Date: Mon, 23 Jan 2023 13:45:58 +0000 +Subject: [PATCH] ACPI: Don't build ACPICA with '-Os' +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8f9e0a52810dd83406c768972d022c37e7a18f1f + +[ Upstream commit 8f9e0a52810dd83406c768972d022c37e7a18f1f ] + +The ACPICA code has been built with '-Os' since the beginning of git +history, though there's no explanatory comment as to why. + +This is unfortunate as GCC drops the alignment specificed by +'-falign-functions=N' when '-Os' is used, as reported in GCC bug 88345: + + https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345 + +This prevents CONFIG_FUNCTION_ALIGNMENT and +CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B from having their expected effect +on the ACPICA code. This is doubly unfortunate as in subsequent patches +arm64 will depend upon CONFIG_FUNCTION_ALIGNMENT for its ftrace +implementation. + +Drop the '-Os' flag when building the ACPICA code. With this removed, +the code builds cleanly and works correctly in testing so far. + +I've tested this by selecting CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y, +building and booting a kernel using ACPI, and looking for misaligned +text symbols: + +* arm64: + + Before, v6.2-rc3: + # uname -rm + 6.2.0-rc3 aarch64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 5009 + + Before, v6.2-rc3 + fixed __cold: + # uname -rm + 6.2.0-rc3-00001-g2a2bedf8bfa9 aarch64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 919 + + After: + # uname -rm + 6.2.0-rc3-00002-g267bddc38572 aarch64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 323 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l + 0 + +* x86_64: + + Before, v6.2-rc3: + # uname -rm + 6.2.0-rc3 x86_64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 11537 + + Before, v6.2-rc3 + fixed __cold: + # uname -rm + 6.2.0-rc3-00001-g2a2bedf8bfa9 x86_64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 2805 + + After: + # uname -rm + 6.2.0-rc3-00002-g267bddc38572 x86_64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 1357 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l + 0 + +With the patch applied, the remaining unaligned text labels are a +combination of static call trampolines and labels in assembly, which can +be dealt with in subsequent patches. + +Signed-off-by: Mark Rutland +Acked-by: Rafael J. Wysocki +Cc: Florent Revest +Cc: Len Brown +Cc: Masami Hiramatsu +Cc: Peter Zijlstra +Cc: Robert Moore +Cc: Steven Rostedt +Cc: Will Deacon +Cc: linux-acpi@vger.kernel.org +Link: https://lore.kernel.org/r/20230123134603.1064407-4-mark.rutland@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/acpica/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile +index 9e0d95d7..30f3fc13 100644 +--- a/drivers/acpi/acpica/Makefile ++++ b/drivers/acpi/acpica/Makefile +@@ -3,7 +3,7 @@ + # Makefile for ACPICA Core interpreter + # + +-ccflags-y := -Os -D_LINUX -DBUILDING_ACPICA ++ccflags-y := -D_LINUX -DBUILDING_ACPICA + ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT + + # use acpi.o to put all files here into acpi.o modparam namespace +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-653-bpf-docs-Fix-modulo-zero-division-by-zero-overf.patch b/patches.kernel.org/6.2.3-653-bpf-docs-Fix-modulo-zero-division-by-zero-overf.patch new file mode 100644 index 0000000..2e83efa --- /dev/null +++ b/patches.kernel.org/6.2.3-653-bpf-docs-Fix-modulo-zero-division-by-zero-overf.patch @@ -0,0 +1,70 @@ +From: Dave Thaler +Date: Tue, 24 Jan 2023 00:12:18 +0000 +Subject: [PATCH] bpf, docs: Fix modulo zero, division by zero, overflow, and + underflow +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0eb9d19e2201068260e439a5c96dc85f9f3722a2 + +[ Upstream commit 0eb9d19e2201068260e439a5c96dc85f9f3722a2 ] + +Fix modulo zero, division by zero, overflow, and underflow. Also clarify how +a negative immediate value is used in unsigned division. + +Signed-off-by: Dave Thaler +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230124001218.827-1-dthaler1968@googlemail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + Documentation/bpf/instruction-set.rst | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/Documentation/bpf/instruction-set.rst b/Documentation/bpf/instruction-set.rst +index e672d5ec..2d3fe59b 100644 +--- a/Documentation/bpf/instruction-set.rst ++++ b/Documentation/bpf/instruction-set.rst +@@ -99,19 +99,26 @@ code value description + BPF_ADD 0x00 dst += src + BPF_SUB 0x10 dst -= src + BPF_MUL 0x20 dst \*= src +-BPF_DIV 0x30 dst /= src ++BPF_DIV 0x30 dst = (src != 0) ? (dst / src) : 0 + BPF_OR 0x40 dst \|= src + BPF_AND 0x50 dst &= src + BPF_LSH 0x60 dst <<= src + BPF_RSH 0x70 dst >>= src + BPF_NEG 0x80 dst = ~src +-BPF_MOD 0x90 dst %= src ++BPF_MOD 0x90 dst = (src != 0) ? (dst % src) : dst + BPF_XOR 0xa0 dst ^= src + BPF_MOV 0xb0 dst = src + BPF_ARSH 0xc0 sign extending shift right + BPF_END 0xd0 byte swap operations (see `Byte swap instructions`_ below) + ======== ===== ========================================================== + ++Underflow and overflow are allowed during arithmetic operations, meaning ++the 64-bit or 32-bit value will wrap. If eBPF program execution would ++result in division by zero, the destination register is instead set to zero. ++If execution would result in modulo by zero, for ``BPF_ALU64`` the value of ++the destination register is unchanged whereas for ``BPF_ALU`` the upper ++32 bits of the destination register are zeroed. ++ + ``BPF_ADD | BPF_X | BPF_ALU`` means:: + + dst_reg = (u32) dst_reg + (u32) src_reg; +@@ -128,6 +135,11 @@ BPF_END 0xd0 byte swap operations (see `Byte swap instructions`_ below) + + dst_reg = dst_reg ^ imm32 + ++Also note that the division and modulo operations are unsigned. Thus, for ++``BPF_ALU``, 'imm' is first interpreted as an unsigned 32-bit value, whereas ++for ``BPF_ALU64``, 'imm' is first sign extended to 64 bits and the result ++interpreted as an unsigned 64-bit value. There are no instructions for ++signed division or modulo. + + Byte swap instructions + ~~~~~~~~~~~~~~~~~~~~~~ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-654-thermal-intel-intel_pch-Add-support-for-Wellsbu.patch b/patches.kernel.org/6.2.3-654-thermal-intel-intel_pch-Add-support-for-Wellsbu.patch new file mode 100644 index 0000000..0acbcce --- /dev/null +++ b/patches.kernel.org/6.2.3-654-thermal-intel-intel_pch-Add-support-for-Wellsbu.patch @@ -0,0 +1,65 @@ +From: Tim Zimmermann +Date: Sat, 7 Jan 2023 20:25:13 +0100 +Subject: [PATCH] thermal: intel: intel_pch: Add support for Wellsburg PCH +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 40dc1929089fc844ea06d9f8bdb6211ed4517c2e + +[ Upstream commit 40dc1929089fc844ea06d9f8bdb6211ed4517c2e ] + +Add the PCI ID for the Wellsburg C610 series chipset PCH. + +The driver can read the temperature from the Wellsburg PCH with only +the PCI ID added and no other modifications. + +Signed-off-by: Tim Zimmermann +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/thermal/intel/intel_pch_thermal.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/thermal/intel/intel_pch_thermal.c b/drivers/thermal/intel/intel_pch_thermal.c +index dabf11a6..9e27f430 100644 +--- a/drivers/thermal/intel/intel_pch_thermal.c ++++ b/drivers/thermal/intel/intel_pch_thermal.c +@@ -29,6 +29,7 @@ + #define PCH_THERMAL_DID_CNL_LP 0x02F9 /* CNL-LP PCH */ + #define PCH_THERMAL_DID_CML_H 0X06F9 /* CML-H PCH */ + #define PCH_THERMAL_DID_LWB 0xA1B1 /* Lewisburg PCH */ ++#define PCH_THERMAL_DID_WBG 0x8D24 /* Wellsburg PCH */ + + /* Wildcat Point-LP PCH Thermal registers */ + #define WPT_TEMP 0x0000 /* Temperature */ +@@ -350,6 +351,7 @@ enum board_ids { + board_cnl, + board_cml, + board_lwb, ++ board_wbg, + }; + + static const struct board_info { +@@ -380,6 +382,10 @@ static const struct board_info { + .name = "pch_lewisburg", + .ops = &pch_dev_ops_wpt, + }, ++ [board_wbg] = { ++ .name = "pch_wellsburg", ++ .ops = &pch_dev_ops_wpt, ++ }, + }; + + static int intel_pch_thermal_probe(struct pci_dev *pdev, +@@ -495,6 +501,8 @@ static const struct pci_device_id intel_pch_thermal_id[] = { + .driver_data = board_cml, }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_LWB), + .driver_data = board_lwb, }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_WBG), ++ .driver_data = board_wbg, }, + { 0, }, + }; + MODULE_DEVICE_TABLE(pci, intel_pch_thermal_id); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-655-clocksource-Suspend-the-watchdog-temporarily-wh.patch b/patches.kernel.org/6.2.3-655-clocksource-Suspend-the-watchdog-temporarily-wh.patch new file mode 100644 index 0000000..4fcad4b --- /dev/null +++ b/patches.kernel.org/6.2.3-655-clocksource-Suspend-the-watchdog-temporarily-wh.patch @@ -0,0 +1,147 @@ +From: Feng Tang +Date: Tue, 20 Dec 2022 16:25:12 +0800 +Subject: [PATCH] clocksource: Suspend the watchdog temporarily when high read + latency detected +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b7082cdfc464bf9231300605d03eebf943dda307 + +[ Upstream commit b7082cdfc464bf9231300605d03eebf943dda307 ] + +Bugs have been reported on 8 sockets x86 machines in which the TSC was +wrongly disabled when the system is under heavy workload. + + [ 818.380354] clocksource: timekeeping watchdog on CPU336: hpet wd-wd read-back delay of 1203520ns + [ 818.436160] clocksource: wd-tsc-wd read-back delay of 181880ns, clock-skew test skipped! + [ 819.402962] clocksource: timekeeping watchdog on CPU338: hpet wd-wd read-back delay of 324000ns + [ 819.448036] clocksource: wd-tsc-wd read-back delay of 337240ns, clock-skew test skipped! + [ 819.880863] clocksource: timekeeping watchdog on CPU339: hpet read-back delay of 150280ns, attempt 3, marking unstable + [ 819.936243] tsc: Marking TSC unstable due to clocksource watchdog + [ 820.068173] TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'. + [ 820.092382] sched_clock: Marking unstable (818769414384, 1195404998) + [ 820.643627] clocksource: Checking clocksource tsc synchronization from CPU 267 to CPUs 0,4,25,70,126,430,557,564. + [ 821.067990] clocksource: Switched to clocksource hpet + +This can be reproduced by running memory intensive 'stream' tests, +or some of the stress-ng subcases such as 'ioport'. + +The reason for these issues is the when system is under heavy load, the +read latency of the clocksources can be very high. Even lightweight TSC +reads can show high latencies, and latencies are much worse for external +clocksources such as HPET or the APIC PM timer. These latencies can +result in false-positive clocksource-unstable determinations. + +These issues were initially reported by a customer running on a production +system, and this problem was reproduced on several generations of Xeon +servers, especially when running the stress-ng test. These Xeon servers +were not production systems, but they did have the latest steppings +and firmware. + +Given that the clocksource watchdog is a continual diagnostic check with +frequency of twice a second, there is no need to rush it when the system +is under heavy load. Therefore, when high clocksource read latencies +are detected, suspend the watchdog timer for 5 minutes. + +Signed-off-by: Feng Tang +Acked-by: Waiman Long +Cc: John Stultz +Cc: Thomas Gleixner +Cc: Stephen Boyd +Cc: Feng Tang +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/time/clocksource.c | 45 ++++++++++++++++++++++++++++----------- + 1 file changed, 32 insertions(+), 13 deletions(-) + +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index 9cf32ccd..8cd74b89 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -384,6 +384,15 @@ void clocksource_verify_percpu(struct clocksource *cs) + } + EXPORT_SYMBOL_GPL(clocksource_verify_percpu); + ++static inline void clocksource_reset_watchdog(void) ++{ ++ struct clocksource *cs; ++ ++ list_for_each_entry(cs, &watchdog_list, wd_list) ++ cs->flags &= ~CLOCK_SOURCE_WATCHDOG; ++} ++ ++ + static void clocksource_watchdog(struct timer_list *unused) + { + u64 csnow, wdnow, cslast, wdlast, delta; +@@ -391,6 +400,7 @@ static void clocksource_watchdog(struct timer_list *unused) + int64_t wd_nsec, cs_nsec; + struct clocksource *cs; + enum wd_read_status read_ret; ++ unsigned long extra_wait = 0; + u32 md; + + spin_lock(&watchdog_lock); +@@ -410,13 +420,30 @@ static void clocksource_watchdog(struct timer_list *unused) + + read_ret = cs_watchdog_read(cs, &csnow, &wdnow); + +- if (read_ret != WD_READ_SUCCESS) { +- if (read_ret == WD_READ_UNSTABLE) +- /* Clock readout unreliable, so give it up. */ +- __clocksource_unstable(cs); ++ if (read_ret == WD_READ_UNSTABLE) { ++ /* Clock readout unreliable, so give it up. */ ++ __clocksource_unstable(cs); + continue; + } + ++ /* ++ * When WD_READ_SKIP is returned, it means the system is likely ++ * under very heavy load, where the latency of reading ++ * watchdog/clocksource is very big, and affect the accuracy of ++ * watchdog check. So give system some space and suspend the ++ * watchdog check for 5 minutes. ++ */ ++ if (read_ret == WD_READ_SKIP) { ++ /* ++ * As the watchdog timer will be suspended, and ++ * cs->last could keep unchanged for 5 minutes, reset ++ * the counters. ++ */ ++ clocksource_reset_watchdog(); ++ extra_wait = HZ * 300; ++ break; ++ } ++ + /* Clocksource initialized ? */ + if (!(cs->flags & CLOCK_SOURCE_WATCHDOG) || + atomic_read(&watchdog_reset_pending)) { +@@ -512,7 +539,7 @@ static void clocksource_watchdog(struct timer_list *unused) + * pair clocksource_stop_watchdog() clocksource_start_watchdog(). + */ + if (!timer_pending(&watchdog_timer)) { +- watchdog_timer.expires += WATCHDOG_INTERVAL; ++ watchdog_timer.expires += WATCHDOG_INTERVAL + extra_wait; + add_timer_on(&watchdog_timer, next_cpu); + } + out: +@@ -537,14 +564,6 @@ static inline void clocksource_stop_watchdog(void) + watchdog_running = 0; + } + +-static inline void clocksource_reset_watchdog(void) +-{ +- struct clocksource *cs; +- +- list_for_each_entry(cs, &watchdog_list, wd_list) +- cs->flags &= ~CLOCK_SOURCE_WATCHDOG; +-} +- + static void clocksource_resume_watchdog(void) + { + atomic_inc(&watchdog_reset_pending); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-656-crypto-hisilicon-Wipe-entire-pool-on-error.patch b/patches.kernel.org/6.2.3-656-crypto-hisilicon-Wipe-entire-pool-on-error.patch new file mode 100644 index 0000000..d445e74 --- /dev/null +++ b/patches.kernel.org/6.2.3-656-crypto-hisilicon-Wipe-entire-pool-on-error.patch @@ -0,0 +1,48 @@ +From: Kees Cook +Date: Thu, 5 Jan 2023 20:19:48 -0800 +Subject: [PATCH] crypto: hisilicon: Wipe entire pool on error +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aa85923a954e7704bc9d3847dabeb8540aa98d13 + +[ Upstream commit aa85923a954e7704bc9d3847dabeb8540aa98d13 ] + +To work around a Clang __builtin_object_size bug that shows up under +CONFIG_FORTIFY_SOURCE and UBSAN_BOUNDS, move the per-loop-iteration +mem_block wipe into a single wipe of the entire pool structure after +the loop. + +Reported-by: Nathan Chancellor +Link: https://github.com/ClangBuiltLinux/linux/issues/1780 +Cc: Weili Qian +Cc: Zhou Wang +Cc: Herbert Xu +Cc: "David S. Miller" +Cc: linux-crypto@vger.kernel.org +Signed-off-by: Kees Cook +Tested-by: Nathan Chancellor # build +Link: https://lore.kernel.org/r/20230106041945.never.831-kees@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/crypto/hisilicon/sgl.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sgl.c b/drivers/crypto/hisilicon/sgl.c +index 2b6f2281..0974b004 100644 +--- a/drivers/crypto/hisilicon/sgl.c ++++ b/drivers/crypto/hisilicon/sgl.c +@@ -124,9 +124,8 @@ struct hisi_acc_sgl_pool *hisi_acc_create_sgl_pool(struct device *dev, + for (j = 0; j < i; j++) { + dma_free_coherent(dev, block_size, block[j].sgl, + block[j].sgl_dma); +- memset(block + j, 0, sizeof(*block)); + } +- kfree(pool); ++ kfree_sensitive(pool); + return ERR_PTR(-ENOMEM); + } + EXPORT_SYMBOL_GPL(hisi_acc_create_sgl_pool); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-657-net-bcmgenet-Add-a-check-for-oversized-packets.patch b/patches.kernel.org/6.2.3-657-net-bcmgenet-Add-a-check-for-oversized-packets.patch new file mode 100644 index 0000000..3256e33 --- /dev/null +++ b/patches.kernel.org/6.2.3-657-net-bcmgenet-Add-a-check-for-oversized-packets.patch @@ -0,0 +1,44 @@ +From: Florian Fainelli +Date: Thu, 26 Jan 2023 16:08:19 -0800 +Subject: [PATCH] net: bcmgenet: Add a check for oversized packets +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5c0862c2c962052ed5055220a00ac1cefb92fbcd + +[ Upstream commit 5c0862c2c962052ed5055220a00ac1cefb92fbcd ] + +Occasionnaly we may get oversized packets from the hardware which +exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early +check which drops the packet to avoid invoking skb_over_panic() and move +on to processing the next packet. + +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 21973046..d937daa8 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2316,6 +2316,14 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring, + __func__, p_index, ring->c_index, + ring->read_ptr, dma_length_status); + ++ if (unlikely(len > RX_BUF_LENGTH)) { ++ netif_err(priv, rx_status, dev, "oversized packet\n"); ++ dev->stats.rx_length_errors++; ++ dev->stats.rx_errors++; ++ dev_kfree_skb_any(skb); ++ goto next; ++ } ++ + if (unlikely(!(dma_flag & DMA_EOP) || !(dma_flag & DMA_SOP))) { + netif_err(priv, rx_status, dev, + "dropping fragmented packet!\n"); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-658-m68k-Check-syscall_trace_enter-return-code.patch b/patches.kernel.org/6.2.3-658-m68k-Check-syscall_trace_enter-return-code.patch new file mode 100644 index 0000000..a63bb86 --- /dev/null +++ b/patches.kernel.org/6.2.3-658-m68k-Check-syscall_trace_enter-return-code.patch @@ -0,0 +1,73 @@ +From: Michael Schmitz +Date: Thu, 12 Jan 2023 16:55:27 +1300 +Subject: [PATCH] m68k: Check syscall_trace_enter() return code +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2ca8a1de4437f21562e57f9ac123914747a8e7a1 + +[ Upstream commit 2ca8a1de4437f21562e57f9ac123914747a8e7a1 ] + +Check return code of syscall_trace_enter(), and skip syscall +if -1. Return code will be left at what had been set by +ptrace or seccomp (in regs->d0). + +No regression seen in testing with strace on ARAnyM. + +Signed-off-by: Michael Schmitz +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230112035529.13521-2-schmitzmic@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/m68k/68000/entry.S | 2 ++ + arch/m68k/coldfire/entry.S | 2 ++ + arch/m68k/kernel/entry.S | 3 +++ + 3 files changed, 7 insertions(+) + +diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S +index 997b5493..7d63e2f1 100644 +--- a/arch/m68k/68000/entry.S ++++ b/arch/m68k/68000/entry.S +@@ -45,6 +45,8 @@ do_trace: + jbsr syscall_trace_enter + RESTORE_SWITCH_STACK + addql #4,%sp ++ addql #1,%d0 ++ jeq ret_from_exception + movel %sp@(PT_OFF_ORIG_D0),%d1 + movel #-ENOSYS,%d0 + cmpl #NR_syscalls,%d1 +diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S +index 9f337c70..35104c54 100644 +--- a/arch/m68k/coldfire/entry.S ++++ b/arch/m68k/coldfire/entry.S +@@ -90,6 +90,8 @@ ENTRY(system_call) + jbsr syscall_trace_enter + RESTORE_SWITCH_STACK + addql #4,%sp ++ addql #1,%d0 ++ jeq ret_from_exception + movel %d3,%a0 + jbsr %a0@ + movel %d0,%sp@(PT_OFF_D0) /* save the return value */ +diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S +index 18f278bd..42879e6e 100644 +--- a/arch/m68k/kernel/entry.S ++++ b/arch/m68k/kernel/entry.S +@@ -184,9 +184,12 @@ do_trace_entry: + jbsr syscall_trace_enter + RESTORE_SWITCH_STACK + addql #4,%sp ++ addql #1,%d0 | optimization for cmpil #-1,%d0 ++ jeq ret_from_syscall + movel %sp@(PT_OFF_ORIG_D0),%d0 + cmpl #NR_syscalls,%d0 + jcs syscall ++ jra ret_from_syscall + badsys: + movel #-ENOSYS,%sp@(PT_OFF_D0) + jra ret_from_syscall +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-659-s390-mm-ptdump-avoid-Kasan-vs-Memcpy-Real-marke.patch b/patches.kernel.org/6.2.3-659-s390-mm-ptdump-avoid-Kasan-vs-Memcpy-Real-marke.patch new file mode 100644 index 0000000..d1fa956 --- /dev/null +++ b/patches.kernel.org/6.2.3-659-s390-mm-ptdump-avoid-Kasan-vs-Memcpy-Real-marke.patch @@ -0,0 +1,80 @@ +From: Vasily Gorbik +Date: Tue, 24 Jan 2023 18:08:38 +0100 +Subject: [PATCH] s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 05178996e1a77e2a4664536e6d101a086a905034 + +[ Upstream commit 05178996e1a77e2a4664536e6d101a086a905034 ] + +---[ Real Memory Copy Area Start ]--- +0x001bfffffffff000-0x001c000000000000 4K PTE I +---[ Kasan Shadow Start ]--- +---[ Real Memory Copy Area End ]--- +0x001c000000000000-0x001c000200000000 8G PMD RW NX +... +---[ Kasan Shadow End ]--- + +ptdump does a stable sort of markers. Move kasan markers after +memcpy real to avoid swapping. + +Reviewed-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/mm/dump_pagetables.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c +index 9953819d..ba5f8026 100644 +--- a/arch/s390/mm/dump_pagetables.c ++++ b/arch/s390/mm/dump_pagetables.c +@@ -33,10 +33,6 @@ enum address_markers_idx { + #endif + IDENTITY_AFTER_NR, + IDENTITY_AFTER_END_NR, +-#ifdef CONFIG_KASAN +- KASAN_SHADOW_START_NR, +- KASAN_SHADOW_END_NR, +-#endif + VMEMMAP_NR, + VMEMMAP_END_NR, + VMALLOC_NR, +@@ -47,6 +43,10 @@ enum address_markers_idx { + ABS_LOWCORE_END_NR, + MEMCPY_REAL_NR, + MEMCPY_REAL_END_NR, ++#ifdef CONFIG_KASAN ++ KASAN_SHADOW_START_NR, ++ KASAN_SHADOW_END_NR, ++#endif + }; + + static struct addr_marker address_markers[] = { +@@ -62,10 +62,6 @@ static struct addr_marker address_markers[] = { + #endif + [IDENTITY_AFTER_NR] = {(unsigned long)_end, "Identity Mapping Start"}, + [IDENTITY_AFTER_END_NR] = {0, "Identity Mapping End"}, +-#ifdef CONFIG_KASAN +- [KASAN_SHADOW_START_NR] = {KASAN_SHADOW_START, "Kasan Shadow Start"}, +- [KASAN_SHADOW_END_NR] = {KASAN_SHADOW_END, "Kasan Shadow End"}, +-#endif + [VMEMMAP_NR] = {0, "vmemmap Area Start"}, + [VMEMMAP_END_NR] = {0, "vmemmap Area End"}, + [VMALLOC_NR] = {0, "vmalloc Area Start"}, +@@ -76,6 +72,10 @@ static struct addr_marker address_markers[] = { + [ABS_LOWCORE_END_NR] = {0, "Lowcore Area End"}, + [MEMCPY_REAL_NR] = {0, "Real Memory Copy Area Start"}, + [MEMCPY_REAL_END_NR] = {0, "Real Memory Copy Area End"}, ++#ifdef CONFIG_KASAN ++ [KASAN_SHADOW_START_NR] = {KASAN_SHADOW_START, "Kasan Shadow Start"}, ++ [KASAN_SHADOW_END_NR] = {KASAN_SHADOW_END, "Kasan Shadow End"}, ++#endif + { -1, NULL } + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-660-netfilter-nf_tables-NULL-pointer-dereference-in.patch b/patches.kernel.org/6.2.3-660-netfilter-nf_tables-NULL-pointer-dereference-in.patch new file mode 100644 index 0000000..16a369c --- /dev/null +++ b/patches.kernel.org/6.2.3-660-netfilter-nf_tables-NULL-pointer-dereference-in.patch @@ -0,0 +1,42 @@ +From: Alok Tiwari +Date: Tue, 17 Jan 2023 07:45:49 -0800 +Subject: [PATCH] netfilter: nf_tables: NULL pointer dereference in + nf_tables_updobj() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dac7f50a45216d652887fb92d6cd3b7ca7f006ea + +[ Upstream commit dac7f50a45216d652887fb92d6cd3b7ca7f006ea ] + +static analyzer detect null pointer dereference case for 'type' +function __nft_obj_type_get() can return NULL value which require to handle +if type is NULL pointer return -ENOENT. + +This is a theoretical issue, since an existing object has a type, but +better add this failsafe check. + +Signed-off-by: Alok Tiwari +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/netfilter/nf_tables_api.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 8c09e4d1..fc8256b0 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6999,6 +6999,9 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, + return -EOPNOTSUPP; + + type = __nft_obj_type_get(objtype); ++ if (WARN_ON_ONCE(!type)) ++ return -ENOENT; ++ + nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); + + return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-661-can-isotp-check-CAN-address-family-in-isotp_bin.patch b/patches.kernel.org/6.2.3-661-can-isotp-check-CAN-address-family-in-isotp_bin.patch new file mode 100644 index 0000000..d25056f --- /dev/null +++ b/patches.kernel.org/6.2.3-661-can-isotp-check-CAN-address-family-in-isotp_bin.patch @@ -0,0 +1,48 @@ +From: Oliver Hartkopp +Date: Wed, 4 Jan 2023 21:18:44 +0100 +Subject: [PATCH] can: isotp: check CAN address family in isotp_bind() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c6adf659a8ba85913e16a571d5a9bcd17d3d1234 + +[ Upstream commit c6adf659a8ba85913e16a571d5a9bcd17d3d1234 ] + +Add missing check to block non-AF_CAN binds. + +Syzbot created some code which matched the right sockaddr struct size +but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family +field: + +bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10) + ^^^^ +This has no funtional impact but the userspace should be notified about +the wrong address family field content. + +Link: https://syzkaller.appspot.com/text?tag=CrashLog&x=11ff9d8c480000 +Reported-by: syzbot+5aed6c3aaba661f5b917@syzkaller.appspotmail.com +Signed-off-by: Oliver Hartkopp +Link: https://lore.kernel.org/all/20230104201844.13168-1-socketcan@hartkopp.net +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/can/isotp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index fc81d777..9bc34485 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -1220,6 +1220,9 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) + if (len < ISOTP_MIN_NAMELEN) + return -EINVAL; + ++ if (addr->can_family != AF_CAN) ++ return -EINVAL; ++ + /* sanitize tx CAN identifier */ + if (tx_id & CAN_EFF_FLAG) + tx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-662-gcc-plugins-drop-std-gnu-11-to-fix-GCC-13-build.patch b/patches.kernel.org/6.2.3-662-gcc-plugins-drop-std-gnu-11-to-fix-GCC-13-build.patch new file mode 100644 index 0000000..5e99dfc --- /dev/null +++ b/patches.kernel.org/6.2.3-662-gcc-plugins-drop-std-gnu-11-to-fix-GCC-13-build.patch @@ -0,0 +1,52 @@ +From: Sam James +Date: Wed, 1 Feb 2023 23:00:09 +0000 +Subject: [PATCH] gcc-plugins: drop -std=gnu++11 to fix GCC 13 build +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5a6b64adc18d9adfb497a529ff004d59b6df151f + +[ Upstream commit 5a6b64adc18d9adfb497a529ff004d59b6df151f ] + +The latest GCC 13 snapshot (13.0.1 20230129) gives the following: +``` +cc1: error: cannot load plugin ./scripts/gcc-plugins/randomize_layout_plugin.so + :./scripts/gcc-plugins/randomize_layout_plugin.so: undefined symbol: tree_code_type +``` + +This ends up being because of https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=b0241ce6e37031 +upstream in GCC which changes the visibility of some types used by the kernel's +plugin infrastructure like tree_code_type. + +After discussion with the GCC folks, we found that the kernel needs to be building +plugins with the same flags used to build GCC - and GCC defaults to gnu++17 +right now. The minimum GCC version needed to build the kernel is GCC 5.1 +and GCC 5.1 already defaults to gnu++14 anyway, so just drop the flag, as +all GCCs that could be used to build GCC already default to an acceptable +version which was >= the version we forced via flags until now. + +Bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108634 +Signed-off-by: Sam James +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230201230009.2252783-1-sam@gentoo.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + scripts/gcc-plugins/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile +index b34d11e2..320afd3c 100644 +--- a/scripts/gcc-plugins/Makefile ++++ b/scripts/gcc-plugins/Makefile +@@ -29,7 +29,7 @@ GCC_PLUGINS_DIR = $(shell $(CC) -print-file-name=plugin) + plugin_cxxflags = -Wp,-MMD,$(depfile) $(KBUILD_HOSTCXXFLAGS) -fPIC \ + -include $(srctree)/include/linux/compiler-version.h \ + -DPLUGIN_VERSION=$(call stringify,$(KERNELVERSION)) \ +- -I $(GCC_PLUGINS_DIR)/include -I $(obj) -std=gnu++11 \ ++ -I $(GCC_PLUGINS_DIR)/include -I $(obj) \ + -fno-rtti -fno-exceptions -fasynchronous-unwind-tables \ + -ggdb -Wno-narrowing -Wno-unused-variable \ + -Wno-format-diag +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-663-tools-power-x86-intel-speed-select-Add-Emerald-.patch b/patches.kernel.org/6.2.3-663-tools-power-x86-intel-speed-select-Add-Emerald-.patch new file mode 100644 index 0000000..0466586 --- /dev/null +++ b/patches.kernel.org/6.2.3-663-tools-power-x86-intel-speed-select-Add-Emerald-.patch @@ -0,0 +1,38 @@ +From: Zhang Rui +Date: Wed, 24 Aug 2022 15:44:42 +0800 +Subject: [PATCH] tools/power/x86/intel-speed-select: Add Emerald Rapid quirk +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 61f9fdcdcd01f9a996b6db4e7092fcdfe8414ad5 + +[ Upstream commit 61f9fdcdcd01f9a996b6db4e7092fcdfe8414ad5 ] + +Need memory frequency quirk as Sapphire Rapids in Emerald Rapids. +So add Emerald Rapids CPU model check in is_spr_platform(). + +Signed-off-by: Zhang Rui +[srinivas.pandruvada@linux.intel.com: Subject, changelog and code edits] +Signed-off-by: Srinivas Pandruvada +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + tools/power/x86/intel-speed-select/isst-config.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/x86/intel-speed-select/isst-config.c b/tools/power/x86/intel-speed-select/isst-config.c +index a160bad2..be3668d3 100644 +--- a/tools/power/x86/intel-speed-select/isst-config.c ++++ b/tools/power/x86/intel-speed-select/isst-config.c +@@ -110,7 +110,7 @@ int is_skx_based_platform(void) + + int is_spr_platform(void) + { +- if (cpu_model == 0x8F) ++ if (cpu_model == 0x8F || cpu_model == 0xCF) + return 1; + + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-664-platform-x86-dell-ddv-Add-support-for-interface.patch b/patches.kernel.org/6.2.3-664-platform-x86-dell-ddv-Add-support-for-interface.patch new file mode 100644 index 0000000..433a3fe --- /dev/null +++ b/patches.kernel.org/6.2.3-664-platform-x86-dell-ddv-Add-support-for-interface.patch @@ -0,0 +1,59 @@ +From: Armin Wolf +Date: Thu, 26 Jan 2023 20:40:17 +0100 +Subject: [PATCH] platform/x86: dell-ddv: Add support for interface version 3 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3e899fec5dfce37701d49d656954a825275bf867 + +[ Upstream commit 3e899fec5dfce37701d49d656954a825275bf867 ] + +While trying to solve a bugreport on bugzilla, i learned that +some devices (for example the Dell XPS 17 9710) provide a more +recent DDV WMI interface (version 3). +Since the new interface version just adds an additional method, +no code changes are necessary apart from whitelisting the version. + +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20230126194021.381092-2-W_Armin@gmx.de +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/platform/x86/dell/dell-wmi-ddv.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/dell/dell-wmi-ddv.c b/drivers/platform/x86/dell/dell-wmi-ddv.c +index 2bb44984..9cb6ae42 100644 +--- a/drivers/platform/x86/dell/dell-wmi-ddv.c ++++ b/drivers/platform/x86/dell/dell-wmi-ddv.c +@@ -26,7 +26,8 @@ + + #define DRIVER_NAME "dell-wmi-ddv" + +-#define DELL_DDV_SUPPORTED_INTERFACE 2 ++#define DELL_DDV_SUPPORTED_VERSION_MIN 2 ++#define DELL_DDV_SUPPORTED_VERSION_MAX 3 + #define DELL_DDV_GUID "8A42EA14-4F2A-FD45-6422-0087F7A7E608" + + #define DELL_EPPID_LENGTH 20 +@@ -49,6 +50,7 @@ enum dell_ddv_method { + DELL_DDV_BATTERY_RAW_ANALYTICS_START = 0x0E, + DELL_DDV_BATTERY_RAW_ANALYTICS = 0x0F, + DELL_DDV_BATTERY_DESIGN_VOLTAGE = 0x10, ++ DELL_DDV_BATTERY_RAW_ANALYTICS_A_BLOCK = 0x11, /* version 3 */ + + DELL_DDV_INTERFACE_VERSION = 0x12, + +@@ -340,7 +342,7 @@ static int dell_wmi_ddv_probe(struct wmi_device *wdev, const void *context) + return ret; + + dev_dbg(&wdev->dev, "WMI interface version: %d\n", version); +- if (version != DELL_DDV_SUPPORTED_INTERFACE) ++ if (version < DELL_DDV_SUPPORTED_VERSION_MIN || version > DELL_DDV_SUPPORTED_VERSION_MAX) + return -ENODEV; + + data = devm_kzalloc(&wdev->dev, sizeof(*data), GFP_KERNEL); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-665-wifi-mt76-dma-free-rx_head-in-mt76_dma_rx_clean.patch b/patches.kernel.org/6.2.3-665-wifi-mt76-dma-free-rx_head-in-mt76_dma_rx_clean.patch new file mode 100644 index 0000000..773440c --- /dev/null +++ b/patches.kernel.org/6.2.3-665-wifi-mt76-dma-free-rx_head-in-mt76_dma_rx_clean.patch @@ -0,0 +1,61 @@ +From: Lorenzo Bianconi +Date: Sun, 1 Jan 2023 12:47:57 +0100 +Subject: [PATCH] wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1b88b47e898edef0e56e3a2f4e49f052a136153d + +[ Upstream commit 1b88b47e898edef0e56e3a2f4e49f052a136153d ] + +Free rx_head skb in mt76_dma_rx_cleanup routine in order to avoid +possible memory leak at module unload. + +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/mediatek/mt76/dma.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index dee4449d..d147dc69 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -737,6 +737,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q) + return; + + spin_lock_bh(&q->lock); ++ + do { + buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL); + if (!buf) +@@ -744,6 +745,12 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q) + + skb_free_frag(buf); + } while (1); ++ ++ if (q->rx_head) { ++ dev_kfree_skb(q->rx_head); ++ q->rx_head = NULL; ++ } ++ + spin_unlock_bh(&q->lock); + + if (!q->rx_page.va) +@@ -769,12 +776,6 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid) + mt76_dma_rx_cleanup(dev, q); + mt76_dma_sync_idx(dev, q); + mt76_dma_rx_fill(dev, q); +- +- if (!q->rx_head) +- return; +- +- dev_kfree_skb(q->rx_head); +- q->rx_head = NULL; + } + + static void +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-666-ACPI-video-Fix-Lenovo-Ideapad-Z570-DMI-match.patch b/patches.kernel.org/6.2.3-666-ACPI-video-Fix-Lenovo-Ideapad-Z570-DMI-match.patch new file mode 100644 index 0000000..69ae812 --- /dev/null +++ b/patches.kernel.org/6.2.3-666-ACPI-video-Fix-Lenovo-Ideapad-Z570-DMI-match.patch @@ -0,0 +1,43 @@ +From: Hans de Goede +Date: Thu, 2 Feb 2023 13:44:49 +0100 +Subject: [PATCH] ACPI: video: Fix Lenovo Ideapad Z570 DMI match +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2d11eae42d52a131f06061015e49dc0f085c5bfc + +[ Upstream commit 2d11eae42d52a131f06061015e49dc0f085c5bfc ] + +Multiple Ideapad Z570 variants need acpi_backlight=native to force native +use on these pre Windows 8 machines since acpi_video backlight control +does not work here. + +The original DMI quirk matches on a product_name of "102434U" but other +variants may have different product_name-s such as e.g. "1024D9U". + +Move to checking product_version instead as is more or less standard for +Lenovo DMI quirks for similar reasons. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/acpi/video_detect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index a8c02608..710ac640 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -434,7 +434,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + /* Lenovo Ideapad Z570 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_NAME, "102434U"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"), + }, + }, + { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-667-net-mlx5-fw_tracer-Fix-debug-print.patch b/patches.kernel.org/6.2.3-667-net-mlx5-fw_tracer-Fix-debug-print.patch new file mode 100644 index 0000000..b7f47ae --- /dev/null +++ b/patches.kernel.org/6.2.3-667-net-mlx5-fw_tracer-Fix-debug-print.patch @@ -0,0 +1,37 @@ +From: Shay Drory +Date: Wed, 11 Jan 2023 13:34:02 +0200 +Subject: [PATCH] net/mlx5: fw_tracer: Fix debug print +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 988c2352273997a242f15c4fc3711773515006a2 + +[ Upstream commit 988c2352273997a242f15c4fc3711773515006a2 ] + +The debug message specify tdsn, but takes as an argument the +tmsn. The correct argument is tmsn, hence, fix the print. + +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +index 5b05b884..d7b2ee5d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +@@ -603,7 +603,7 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, + } else { + cur_string = mlx5_tracer_message_get(tracer, tracer_event); + if (!cur_string) { +- pr_debug("%s Got string event for unknown string tdsm: %d\n", ++ pr_debug("%s Got string event for unknown string tmsn: %d\n", + __func__, tracer_event->string_event.tmsn); + return -1; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-668-coda-Avoid-partial-allocation-of-sig_inputArgs.patch b/patches.kernel.org/6.2.3-668-coda-Avoid-partial-allocation-of-sig_inputArgs.patch new file mode 100644 index 0000000..89fa2be --- /dev/null +++ b/patches.kernel.org/6.2.3-668-coda-Avoid-partial-allocation-of-sig_inputArgs.patch @@ -0,0 +1,47 @@ +From: Kees Cook +Date: Fri, 27 Jan 2023 14:39:21 -0800 +Subject: [PATCH] coda: Avoid partial allocation of sig_inputArgs +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 48df133578c70185a95a49390d42df1996ddba2a + +[ Upstream commit 48df133578c70185a95a49390d42df1996ddba2a ] + +GCC does not like having a partially allocated object, since it cannot +reason about it for bounds checking when it is passed to other code. +Instead, fully allocate sig_inputArgs. (Alternatively, sig_inputArgs +should be defined as a struct coda_in_hdr, if it is actually not using +any other part of the union.) Seen under GCC 13: + +../fs/coda/upcall.c: In function 'coda_upcall': +../fs/coda/upcall.c:801:22: warning: array subscript 'union inputArgs[0]' is partly outside array bounds of 'unsigned char[20]' [-Warray-bounds=] + 801 | sig_inputArgs->ih.opcode = CODA_SIGNAL; + | ^~ + +Cc: Jan Harkes +Cc: coda@cs.cmu.edu +Cc: codalist@coda.cs.cmu.edu +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230127223921.never.882-kees@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/coda/upcall.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c +index 59f6cfd0..cd6a3721 100644 +--- a/fs/coda/upcall.c ++++ b/fs/coda/upcall.c +@@ -791,7 +791,7 @@ static int coda_upcall(struct venus_comm *vcp, + sig_req = kmalloc(sizeof(struct upc_req), GFP_KERNEL); + if (!sig_req) goto exit; + +- sig_inputArgs = kvzalloc(sizeof(struct coda_in_hdr), GFP_KERNEL); ++ sig_inputArgs = kvzalloc(sizeof(*sig_inputArgs), GFP_KERNEL); + if (!sig_inputArgs) { + kfree(sig_req); + goto exit; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-669-uaccess-Add-minimum-bounds-check-on-kernel-buff.patch b/patches.kernel.org/6.2.3-669-uaccess-Add-minimum-bounds-check-on-kernel-buff.patch new file mode 100644 index 0000000..6dad704 --- /dev/null +++ b/patches.kernel.org/6.2.3-669-uaccess-Add-minimum-bounds-check-on-kernel-buff.patch @@ -0,0 +1,71 @@ +From: Kees Cook +Date: Tue, 31 Jan 2023 17:37:59 -0800 +Subject: [PATCH] uaccess: Add minimum bounds check on kernel buffer size +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 04ffde1319a715bd0550ded3580d4ea3bc003776 + +[ Upstream commit 04ffde1319a715bd0550ded3580d4ea3bc003776 ] + +While there is logic about the difference between ksize and usize, +copy_struct_from_user() didn't check the size of the destination buffer +(when it was known) against ksize. Add this check so there is an upper +bounds check on the possible memset() call, otherwise lower bounds +checks made by callers will trigger bounds warnings under -Warray-bounds. +Seen under GCC 13: + +In function 'copy_struct_from_user', + inlined from 'iommufd_fops_ioctl' at +../drivers/iommu/iommufd/main.c:333:8: +../include/linux/fortify-string.h:59:33: warning: '__builtin_memset' offset [57, 4294967294] is out of the bounds [0, 56] of object 'buf' with type 'union ucmd_buffer' [-Warray-bounds=] + 59 | #define __underlying_memset __builtin_memset + | ^ +../include/linux/fortify-string.h:453:9: note: in expansion of macro '__underlying_memset' + 453 | __underlying_memset(p, c, __fortify_size); \ + | ^~~~~~~~~~~~~~~~~~~ +../include/linux/fortify-string.h:461:25: note: in expansion of macro '__fortify_memset_chk' + 461 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \ + | ^~~~~~~~~~~~~~~~~~~~ +../include/linux/uaccess.h:334:17: note: in expansion of macro 'memset' + 334 | memset(dst + size, 0, rest); + | ^~~~~~ +../drivers/iommu/iommufd/main.c: In function 'iommufd_fops_ioctl': +../drivers/iommu/iommufd/main.c:311:27: note: 'buf' declared here + 311 | union ucmd_buffer buf; + | ^~~ + +Cc: Christian Brauner +Cc: Rasmus Villemoes +Cc: Arnd Bergmann +Cc: Dinh Nguyen +Cc: Catalin Marinas +Cc: Andrew Morton +Cc: Geert Uytterhoeven +Cc: Alexander Potapenko +Acked-by: Aleksa Sarai +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/lkml/20230203193523.never.667-kees@kernel.org/ +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/linux/uaccess.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h +index afb18f19..ab972813 100644 +--- a/include/linux/uaccess.h ++++ b/include/linux/uaccess.h +@@ -329,6 +329,10 @@ copy_struct_from_user(void *dst, size_t ksize, const void __user *src, + size_t size = min(ksize, usize); + size_t rest = max(ksize, usize) - size; + ++ /* Double check if ksize is larger than a known object size. */ ++ if (WARN_ON_ONCE(ksize > __builtin_object_size(dst, 1))) ++ return -E2BIG; ++ + /* Deal with trailing bytes. */ + if (usize < ksize) { + memset(dst + size, 0, rest); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-670-s390-idle-mark-arch_cpu_idle-noinstr.patch b/patches.kernel.org/6.2.3-670-s390-idle-mark-arch_cpu_idle-noinstr.patch new file mode 100644 index 0000000..96ebfff --- /dev/null +++ b/patches.kernel.org/6.2.3-670-s390-idle-mark-arch_cpu_idle-noinstr.patch @@ -0,0 +1,69 @@ +From: Heiko Carstens +Date: Mon, 6 Feb 2023 14:49:40 +0100 +Subject: [PATCH] s390/idle: mark arch_cpu_idle() noinstr +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a9cbc1b471d291c865907542394f1c483b93a811 + +[ Upstream commit a9cbc1b471d291c865907542394f1c483b93a811 ] + +linux-next commit ("cpuidle: tracing: Warn about !rcu_is_watching()") +adds a new warning which hits on s390's arch_cpu_idle() function: + +RCU not on for: arch_cpu_idle+0x0/0x28 +WARNING: CPU: 2 PID: 0 at include/linux/trace_recursion.h:162 arch_ftrace_ops_list_func+0x24c/0x258 +Modules linked in: +CPU: 2 PID: 0 Comm: swapper/2 Not tainted 6.2.0-rc6-next-20230202 #4 +Hardware name: IBM 8561 T01 703 (z/VM 7.3.0) +Krnl PSW : 0404d00180000000 00000000002b55c0 (arch_ftrace_ops_list_func+0x250/0x258) + R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3 +Krnl GPRS: c0000000ffffbfff 0000000080000002 0000000000000026 0000000000000000 + 0000037ffffe3a28 0000037ffffe3a20 0000000000000000 0000000000000000 + 0000000000000000 0000000000f4acf6 00000000001044f0 0000037ffffe3cb0 + 0000000000000000 0000000000000000 00000000002b55bc 0000037ffffe3bb8 +Krnl Code: 00000000002b55b0: c02000840051 larl %r2,0000000001335652 + 00000000002b55b6: c0e5fff512d1 brasl %r14,0000000000157b58 + #00000000002b55bc: af000000 mc 0,0 + >00000000002b55c0: a7f4ffe7 brc 15,00000000002b558e + 00000000002b55c4: 0707 bcr 0,%r7 + 00000000002b55c6: 0707 bcr 0,%r7 + 00000000002b55c8: eb6ff0480024 stmg %r6,%r15,72(%r15) + 00000000002b55ce: b90400ef lgr %r14,%r15 +Call Trace: + [<00000000002b55c0>] arch_ftrace_ops_list_func+0x250/0x258 +([<00000000002b55bc>] arch_ftrace_ops_list_func+0x24c/0x258) + [<0000000000f5f0fc>] ftrace_common+0x1c/0x20 + [<00000000001044f6>] arch_cpu_idle+0x6/0x28 + [<0000000000f4acf6>] default_idle_call+0x76/0x128 + [<00000000001cc374>] do_idle+0xf4/0x1b0 + [<00000000001cc6ce>] cpu_startup_entry+0x36/0x40 + [<0000000000119d00>] smp_start_secondary+0x140/0x150 + [<0000000000f5d2ae>] restart_int_handler+0x6e/0x90 + +Mark arch_cpu_idle() noinstr like all other architectures with +CONFIG_ARCH_WANTS_NO_INSTR (should) have it to fix this. + +Reviewed-by: Sven Schnelle +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/kernel/idle.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c +index 4bf1ee29..a0da049e 100644 +--- a/arch/s390/kernel/idle.c ++++ b/arch/s390/kernel/idle.c +@@ -44,7 +44,7 @@ void account_idle_time_irq(void) + S390_lowcore.last_update_timer = idle->timer_idle_exit; + } + +-void arch_cpu_idle(void) ++void noinstr arch_cpu_idle(void) + { + struct s390_idle_data *idle = this_cpu_ptr(&s390_idle); + unsigned long idle_time; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-671-time-debug-Fix-memory-leak-with-using-debugfs_l.patch b/patches.kernel.org/6.2.3-671-time-debug-Fix-memory-leak-with-using-debugfs_l.patch new file mode 100644 index 0000000..f632812 --- /dev/null +++ b/patches.kernel.org/6.2.3-671-time-debug-Fix-memory-leak-with-using-debugfs_l.patch @@ -0,0 +1,39 @@ +From: Greg Kroah-Hartman +Date: Thu, 2 Feb 2023 16:12:14 +0100 +Subject: [PATCH] time/debug: Fix memory leak with using debugfs_lookup() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5b268d8abaec6cbd4bd70d062e769098d96670aa + +[ Upstream commit 5b268d8abaec6cbd4bd70d062e769098d96670aa ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic at +once. + +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20230202151214.2306822-1-gregkh@linuxfoundation.org +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/time/test_udelay.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/time/test_udelay.c b/kernel/time/test_udelay.c +index 13b11eb6..20d5df63 100644 +--- a/kernel/time/test_udelay.c ++++ b/kernel/time/test_udelay.c +@@ -149,7 +149,7 @@ module_init(udelay_test_init); + static void __exit udelay_test_exit(void) + { + mutex_lock(&udelay_test_lock); +- debugfs_remove(debugfs_lookup(DEBUGFS_FILENAME, NULL)); ++ debugfs_lookup_and_remove(DEBUGFS_FILENAME, NULL); + mutex_unlock(&udelay_test_lock); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-672-PM-domains-fix-memory-leak-with-using-debugfs_l.patch b/patches.kernel.org/6.2.3-672-PM-domains-fix-memory-leak-with-using-debugfs_l.patch new file mode 100644 index 0000000..495dea2 --- /dev/null +++ b/patches.kernel.org/6.2.3-672-PM-domains-fix-memory-leak-with-using-debugfs_l.patch @@ -0,0 +1,45 @@ +From: Greg Kroah-Hartman +Date: Thu, 2 Feb 2023 15:15:45 +0100 +Subject: [PATCH] PM: domains: fix memory leak with using debugfs_lookup() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0b6200e1e9f53dabdc30d0f6c51af9a5f664d32b + +[ Upstream commit 0b6200e1e9f53dabdc30d0f6c51af9a5f664d32b ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic +at once. + +Signed-off-by: Greg Kroah-Hartman +Reviewed-by: Ulf Hansson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/power/domain.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index 967bcf9d..6097644e 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -220,13 +220,10 @@ static void genpd_debug_add(struct generic_pm_domain *genpd); + + static void genpd_debug_remove(struct generic_pm_domain *genpd) + { +- struct dentry *d; +- + if (!genpd_debugfs_dir) + return; + +- d = debugfs_lookup(genpd->name, genpd_debugfs_dir); +- debugfs_remove(d); ++ debugfs_lookup_and_remove(genpd->name, genpd_debugfs_dir); + } + + static void genpd_update_accounting(struct generic_pm_domain *genpd) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-673-PM-EM-fix-memory-leak-with-using-debugfs_lookup.patch b/patches.kernel.org/6.2.3-673-PM-EM-fix-memory-leak-with-using-debugfs_lookup.patch new file mode 100644 index 0000000..0442d20 --- /dev/null +++ b/patches.kernel.org/6.2.3-673-PM-EM-fix-memory-leak-with-using-debugfs_lookup.patch @@ -0,0 +1,41 @@ +From: Greg Kroah-Hartman +Date: Thu, 2 Feb 2023 16:15:15 +0100 +Subject: [PATCH] PM: EM: fix memory leak with using debugfs_lookup() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a0e8c13ccd6a9a636d27353da62c2410c4eca337 + +[ Upstream commit a0e8c13ccd6a9a636d27353da62c2410c4eca337 ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic +at once. + +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + kernel/power/energy_model.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c +index f8211183..7b44f5b8 100644 +--- a/kernel/power/energy_model.c ++++ b/kernel/power/energy_model.c +@@ -87,10 +87,7 @@ static void em_debug_create_pd(struct device *dev) + + static void em_debug_remove_pd(struct device *dev) + { +- struct dentry *debug_dir; +- +- debug_dir = debugfs_lookup(dev_name(dev), rootdir); +- debugfs_remove_recursive(debug_dir); ++ debugfs_lookup_and_remove(dev_name(dev), rootdir); + } + + static int __init em_debug_init(void) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-674-Bluetooth-Fix-issue-with-Actions-Semi-ATS2851-b.patch b/patches.kernel.org/6.2.3-674-Bluetooth-Fix-issue-with-Actions-Semi-ATS2851-b.patch new file mode 100644 index 0000000..58c6f47 --- /dev/null +++ b/patches.kernel.org/6.2.3-674-Bluetooth-Fix-issue-with-Actions-Semi-ATS2851-b.patch @@ -0,0 +1,93 @@ +From: Marcel Holtmann +Date: Fri, 16 Dec 2022 21:12:47 +0100 +Subject: [PATCH] Bluetooth: Fix issue with Actions Semi ATS2851 based devices +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5d44f76fab0839799b19cbc88d13575da968dc08 + +[ Upstream commit 5d44f76fab0839799b19cbc88d13575da968dc08 ] + +Their devices claim to support the erroneous data reporting, but don't +actually support the required commands. So blacklist them and add a +quirk. + + < HCI Command: Read Default Erroneous Data Reporting (0x03|0x005a) plen 0 + > HCI Event: Command Status (0x0f) plen 4 + Read Default Erroneous Data Reporting (0x03|0x005a) ncmd 1 + Status: Unknown HCI Command (0x01) + +T: Bus=02 Lev=02 Prnt=08 Port=02 Cnt=01 Dev#= 10 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=10d7 ProdID=b012 Rev=88.91 +S: Manufacturer=Actions +S: Product=general adapter +S: SerialNumber=ACTIONS1234 +C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=01(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=01(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=01(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=01(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=01(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=01(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Marcel Holtmann +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/bluetooth/btusb.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 2ad4efdd..afd2f08f 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -64,6 +64,7 @@ static struct usb_driver btusb_driver; + #define BTUSB_INTEL_BROKEN_SHUTDOWN_LED BIT(24) + #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25) + #define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26) ++#define BTUSB_ACTIONS_SEMI BIT(27) + + static const struct usb_device_id btusb_table[] = { + /* Generic Bluetooth USB device */ +@@ -677,6 +678,9 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + ++ /* Actions Semiconductor ATS2851 based devices */ ++ { USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI }, ++ + /* Silicon Wave based devices */ + { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE }, + +@@ -4098,6 +4102,11 @@ static int btusb_probe(struct usb_interface *intf, + set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags); + } + ++ if (id->driver_info & BTUSB_ACTIONS_SEMI) { ++ /* Support is advertised, but not implemented */ ++ set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks); ++ } ++ + if (!reset) + set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-675-Bluetooth-btusb-Add-new-PID-VID-0489-e0f2-for-M.patch b/patches.kernel.org/6.2.3-675-Bluetooth-btusb-Add-new-PID-VID-0489-e0f2-for-M.patch new file mode 100644 index 0000000..7827ff0 --- /dev/null +++ b/patches.kernel.org/6.2.3-675-Bluetooth-btusb-Add-new-PID-VID-0489-e0f2-for-M.patch @@ -0,0 +1,81 @@ +From: Mario Limonciello +Date: Wed, 14 Dec 2022 20:18:54 -0600 +Subject: [PATCH] Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 83458a5f272b303479e7d2f451600817a7350b6b + +[ Upstream commit 83458a5f272b303479e7d2f451600817a7350b6b ] + +This bluetooth device is found in a combo WLAN/BT card +for a MediaTek 7921e. + +The device information: + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0489 ProdID=e0f2 Rev= 1.00 +S: Manufacturer=MediaTek Inc. +S: Product=Wireless_Device +S: SerialNumber=000000000 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA +A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us +I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us + +Cc: Sean Wang +Cc: Anson Tsao +Signed-off-by: Mario Limonciello +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index afd2f08f..acfd40f1 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -567,6 +567,9 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0489, 0xe0e0), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, ++ { USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH | ++ BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-676-Bluetooth-btusb-Add-VID-PID-13d3-3529-for-Realt.patch b/patches.kernel.org/6.2.3-676-Bluetooth-btusb-Add-VID-PID-13d3-3529-for-Realt.patch new file mode 100644 index 0000000..089cd1d --- /dev/null +++ b/patches.kernel.org/6.2.3-676-Bluetooth-btusb-Add-VID-PID-13d3-3529-for-Realt.patch @@ -0,0 +1,71 @@ +From: Moises Cardona +Date: Sun, 25 Dec 2022 14:07:13 -0500 +Subject: [PATCH] Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1eec3b95b5ce7fb2cdd273ac4f8b24b1ed6776a1 + +[ Upstream commit 1eec3b95b5ce7fb2cdd273ac4f8b24b1ed6776a1 ] + +This patch adds VID:PID 13d3:3529 to the btusb.c file. + +This VID:PID is found in the Realtek RTL8821CE module +(M.2 module AW-CB304NF on an ASUS E210MA laptop) + +Output of /sys/kernel/debug/usb/devices: + +T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3529 Rev= 1.10 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Moises Cardona +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/bluetooth/btusb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index acfd40f1..18bc9471 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -493,6 +493,10 @@ static const struct usb_device_id blacklist_table[] = { + { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01), + .driver_info = BTUSB_IGNORE }, + ++ /* Realtek 8821CE Bluetooth devices */ ++ { USB_DEVICE(0x13d3, 0x3529), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, ++ + /* Realtek 8822CE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-677-wifi-rtw89-debug-avoid-invalid-access-on-RTW89_.patch b/patches.kernel.org/6.2.3-677-wifi-rtw89-debug-avoid-invalid-access-on-RTW89_.patch new file mode 100644 index 0000000..7d8d4e7 --- /dev/null +++ b/patches.kernel.org/6.2.3-677-wifi-rtw89-debug-avoid-invalid-access-on-RTW89_.patch @@ -0,0 +1,52 @@ +From: Zong-Zhe Yang +Date: Thu, 19 Jan 2023 14:35:28 +0800 +Subject: [PATCH] wifi: rtw89: debug: avoid invalid access on + RTW89_DBG_SEL_MAC_30 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c074da21dd346e0cfef5d08b0715078d7aea7f8d + +[ Upstream commit c074da21dd346e0cfef5d08b0715078d7aea7f8d ] + +Only 8852C chip has valid pages on RTW89_DBG_SEL_MAC_30. To other chips, +this section is an address hole. It will lead to crash if trying to access +this section on chips except for 8852C. So, we avoid that. + +Signed-off-by: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230119063529.61563-2-pkshih@realtek.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw89/debug.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c +index 8297e35b..6730eea9 100644 +--- a/drivers/net/wireless/realtek/rtw89/debug.c ++++ b/drivers/net/wireless/realtek/rtw89/debug.c +@@ -615,6 +615,7 @@ rtw89_debug_priv_mac_reg_dump_select(struct file *filp, + struct seq_file *m = (struct seq_file *)filp->private_data; + struct rtw89_debugfs_priv *debugfs_priv = m->private; + struct rtw89_dev *rtwdev = debugfs_priv->rtwdev; ++ const struct rtw89_chip_info *chip = rtwdev->chip; + char buf[32]; + size_t buf_size; + int sel; +@@ -634,6 +635,12 @@ rtw89_debug_priv_mac_reg_dump_select(struct file *filp, + return -EINVAL; + } + ++ if (sel == RTW89_DBG_SEL_MAC_30 && chip->chip_id != RTL8852C) { ++ rtw89_info(rtwdev, "sel %d is address hole on chip %d\n", sel, ++ chip->chip_id); ++ return -EINVAL; ++ } ++ + debugfs_priv->cb_data = sel; + rtw89_info(rtwdev, "select mac page dump %d\n", debugfs_priv->cb_data); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-678-hv_netvsc-Check-status-in-SEND_RNDIS_PKT-comple.patch b/patches.kernel.org/6.2.3-678-hv_netvsc-Check-status-in-SEND_RNDIS_PKT-comple.patch new file mode 100644 index 0000000..a308eb2 --- /dev/null +++ b/patches.kernel.org/6.2.3-678-hv_netvsc-Check-status-in-SEND_RNDIS_PKT-comple.patch @@ -0,0 +1,65 @@ +From: Michael Kelley +Date: Sun, 12 Feb 2023 21:08:01 -0800 +Subject: [PATCH] hv_netvsc: Check status in SEND_RNDIS_PKT completion message +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dca5161f9bd052e9e73be90716ffd57e8762c697 + +[ Upstream commit dca5161f9bd052e9e73be90716ffd57e8762c697 ] + +Completion responses to SEND_RNDIS_PKT messages are currently processed +regardless of the status in the response, so that resources associated +with the request are freed. While this is appropriate, code bugs that +cause sending a malformed message, or errors on the Hyper-V host, go +undetected. Fix this by checking the status and outputting a rate-limited +message if there is an error. + +Signed-off-by: Michael Kelley +Reviewed-by: Haiyang Zhang +Link: https://lore.kernel.org/r/1676264881-48928-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/net/hyperv/netvsc.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 79f4e136..da737d95 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -851,6 +851,7 @@ static void netvsc_send_completion(struct net_device *ndev, + u32 msglen = hv_pkt_datalen(desc); + struct nvsp_message *pkt_rqst; + u64 cmd_rqst; ++ u32 status; + + /* First check if this is a VMBUS completion without data payload */ + if (!msglen) { +@@ -922,6 +923,23 @@ static void netvsc_send_completion(struct net_device *ndev, + break; + + case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE: ++ if (msglen < sizeof(struct nvsp_message_header) + ++ sizeof(struct nvsp_1_message_send_rndis_packet_complete)) { ++ if (net_ratelimit()) ++ netdev_err(ndev, "nvsp_rndis_pkt_complete length too small: %u\n", ++ msglen); ++ return; ++ } ++ ++ /* If status indicates an error, output a message so we know ++ * there's a problem. But process the completion anyway so the ++ * resources are released. ++ */ ++ status = nvsp_packet->msg.v1_msg.send_rndis_pkt_complete.status; ++ if (status != NVSP_STAT_SUCCESS && net_ratelimit()) ++ netdev_err(ndev, "nvsp_rndis_pkt_complete error status: %x\n", ++ status); ++ + netvsc_send_tx_complete(ndev, net_device, incoming_channel, + desc, budget); + break; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-679-s390-kfence-fix-page-fault-reporting.patch b/patches.kernel.org/6.2.3-679-s390-kfence-fix-page-fault-reporting.patch new file mode 100644 index 0000000..5f451c3 --- /dev/null +++ b/patches.kernel.org/6.2.3-679-s390-kfence-fix-page-fault-reporting.patch @@ -0,0 +1,175 @@ +From: Heiko Carstens +Date: Mon, 13 Feb 2023 19:38:58 +0100 +Subject: [PATCH] s390/kfence: fix page fault reporting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d9c2cf67b9cfd643ba85d51bc865a89a92e4f979 + +[ Upstream commit d9c2cf67b9cfd643ba85d51bc865a89a92e4f979 ] + +Baoquan He reported lots of KFENCE reports when /proc/kcore is read, +e.g. with crash or even simpler with dd: + + BUG: KFENCE: invalid read in copy_from_kernel_nofault+0x5e/0x120 + Invalid read at 0x00000000f4f5149f: + copy_from_kernel_nofault+0x5e/0x120 + read_kcore+0x6b2/0x870 + proc_reg_read+0x9a/0xf0 + vfs_read+0x94/0x270 + ksys_read+0x70/0x100 + __do_syscall+0x1d0/0x200 + system_call+0x82/0xb0 + +The reason for this is that read_kcore() simply reads memory that might +have been unmapped by KFENCE with copy_from_kernel_nofault(). Any fault due +to pages being unmapped by KFENCE would be handled gracefully by the fault +handler (exception table fixup). + +However the s390 fault handler first reports the fault, and only afterwards +would perform the exception table fixup. Most architectures have this in +reversed order, which also avoids the false positive KFENCE reports when an +unmapped page is accessed. + +Therefore change the s390 fault handler so it handles exception table +fixups before KFENCE page faults are reported. + +Reported-by: Baoquan He +Tested-by: Baoquan He +Acked-by: Alexander Potapenko +Link: https://lore.kernel.org/r/20230213183858.1473681-1-hca@linux.ibm.com +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + arch/s390/mm/fault.c | 49 +++++++++++++++++++++++++++++++------------- + 1 file changed, 35 insertions(+), 14 deletions(-) + +diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c +index 9649d938..8e84ed2b 100644 +--- a/arch/s390/mm/fault.c ++++ b/arch/s390/mm/fault.c +@@ -96,6 +96,20 @@ static enum fault_type get_fault_type(struct pt_regs *regs) + return KERNEL_FAULT; + } + ++static unsigned long get_fault_address(struct pt_regs *regs) ++{ ++ unsigned long trans_exc_code = regs->int_parm_long; ++ ++ return trans_exc_code & __FAIL_ADDR_MASK; ++} ++ ++static bool fault_is_write(struct pt_regs *regs) ++{ ++ unsigned long trans_exc_code = regs->int_parm_long; ++ ++ return (trans_exc_code & store_indication) == 0x400; ++} ++ + static int bad_address(void *p) + { + unsigned long dummy; +@@ -228,15 +242,26 @@ static noinline void do_sigsegv(struct pt_regs *regs, int si_code) + (void __user *)(regs->int_parm_long & __FAIL_ADDR_MASK)); + } + +-static noinline void do_no_context(struct pt_regs *regs) ++static noinline void do_no_context(struct pt_regs *regs, vm_fault_t fault) + { ++ enum fault_type fault_type; ++ unsigned long address; ++ bool is_write; ++ + if (fixup_exception(regs)) + return; ++ fault_type = get_fault_type(regs); ++ if ((fault_type == KERNEL_FAULT) && (fault == VM_FAULT_BADCONTEXT)) { ++ address = get_fault_address(regs); ++ is_write = fault_is_write(regs); ++ if (kfence_handle_page_fault(address, is_write, regs)) ++ return; ++ } + /* + * Oops. The kernel tried to access some bad page. We'll have to + * terminate things with extreme prejudice. + */ +- if (get_fault_type(regs) == KERNEL_FAULT) ++ if (fault_type == KERNEL_FAULT) + printk(KERN_ALERT "Unable to handle kernel pointer dereference" + " in virtual kernel address space\n"); + else +@@ -255,7 +280,7 @@ static noinline void do_low_address(struct pt_regs *regs) + die (regs, "Low-address protection"); + } + +- do_no_context(regs); ++ do_no_context(regs, VM_FAULT_BADACCESS); + } + + static noinline void do_sigbus(struct pt_regs *regs) +@@ -286,28 +311,28 @@ static noinline void do_fault_error(struct pt_regs *regs, vm_fault_t fault) + fallthrough; + case VM_FAULT_BADCONTEXT: + case VM_FAULT_PFAULT: +- do_no_context(regs); ++ do_no_context(regs, fault); + break; + case VM_FAULT_SIGNAL: + if (!user_mode(regs)) +- do_no_context(regs); ++ do_no_context(regs, fault); + break; + default: /* fault & VM_FAULT_ERROR */ + if (fault & VM_FAULT_OOM) { + if (!user_mode(regs)) +- do_no_context(regs); ++ do_no_context(regs, fault); + else + pagefault_out_of_memory(); + } else if (fault & VM_FAULT_SIGSEGV) { + /* Kernel mode? Handle exceptions or die */ + if (!user_mode(regs)) +- do_no_context(regs); ++ do_no_context(regs, fault); + else + do_sigsegv(regs, SEGV_MAPERR); + } else if (fault & VM_FAULT_SIGBUS) { + /* Kernel mode? Handle exceptions or die */ + if (!user_mode(regs)) +- do_no_context(regs); ++ do_no_context(regs, fault); + else + do_sigbus(regs); + } else +@@ -334,7 +359,6 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access) + struct mm_struct *mm; + struct vm_area_struct *vma; + enum fault_type type; +- unsigned long trans_exc_code; + unsigned long address; + unsigned int flags; + vm_fault_t fault; +@@ -351,9 +375,8 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access) + return 0; + + mm = tsk->mm; +- trans_exc_code = regs->int_parm_long; +- address = trans_exc_code & __FAIL_ADDR_MASK; +- is_write = (trans_exc_code & store_indication) == 0x400; ++ address = get_fault_address(regs); ++ is_write = fault_is_write(regs); + + /* + * Verify that the fault happened in user space, that +@@ -364,8 +387,6 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access) + type = get_fault_type(regs); + switch (type) { + case KERNEL_FAULT: +- if (kfence_handle_page_fault(address, is_write, regs)) +- return 0; + goto out; + case USER_FAULT: + case GMAP_FAULT: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-680-devlink-Fix-TP_STRUCT_entry-in-trace-of-devlink.patch b/patches.kernel.org/6.2.3-680-devlink-Fix-TP_STRUCT_entry-in-trace-of-devlink.patch new file mode 100644 index 0000000..874036b --- /dev/null +++ b/patches.kernel.org/6.2.3-680-devlink-Fix-TP_STRUCT_entry-in-trace-of-devlink.patch @@ -0,0 +1,41 @@ +From: Moshe Shemesh +Date: Tue, 14 Feb 2023 18:38:06 +0200 +Subject: [PATCH] devlink: Fix TP_STRUCT_entry in trace of devlink health + report +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d0ab772c1f1558af84f3293a52e9e886e08e0754 + +[ Upstream commit d0ab772c1f1558af84f3293a52e9e886e08e0754 ] + +Fix a bug in trace point definition for devlink health report, as +TP_STRUCT_entry of reporter_name should get reporter_name and not msg. + +Note no fixes tag as this is a harmless bug as both reporter_name and +msg are strings and TP_fast_assign for this entry is correct. + +Signed-off-by: Moshe Shemesh +Reviewed-by: Jiri Pirko +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/trace/events/devlink.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/trace/events/devlink.h b/include/trace/events/devlink.h +index 24969184..77ff7cfc 100644 +--- a/include/trace/events/devlink.h ++++ b/include/trace/events/devlink.h +@@ -88,7 +88,7 @@ TRACE_EVENT(devlink_health_report, + __string(bus_name, devlink_to_dev(devlink)->bus->name) + __string(dev_name, dev_name(devlink_to_dev(devlink))) + __string(driver_name, devlink_to_dev(devlink)->driver->name) +- __string(reporter_name, msg) ++ __string(reporter_name, reporter_name) + __string(msg, msg) + ), + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-681-scm-add-user-copy-checks-to-put_cmsg.patch b/patches.kernel.org/6.2.3-681-scm-add-user-copy-checks-to-put_cmsg.patch new file mode 100644 index 0000000..9cdbe0a --- /dev/null +++ b/patches.kernel.org/6.2.3-681-scm-add-user-copy-checks-to-put_cmsg.patch @@ -0,0 +1,51 @@ +From: Eric Dumazet +Date: Fri, 17 Feb 2023 18:24:54 +0000 +Subject: [PATCH] scm: add user copy checks to put_cmsg() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5f1eb1ff58ea122e24adf0bc940f268ed2227462 + +[ Upstream commit 5f1eb1ff58ea122e24adf0bc940f268ed2227462 ] + +This is a followup of commit 2558b8039d05 ("net: use a bounce +buffer for copying skb->mark") + +x86 and powerpc define user_access_begin, meaning +that they are not able to perform user copy checks +when using user_write_access_begin() / unsafe_copy_to_user() +and friends [1] + +Instead of waiting bugs to trigger on other arches, +add a check_object_size() in put_cmsg() to make sure +that new code tested on x86 with CONFIG_HARDENED_USERCOPY=y +will perform more security checks. + +[1] We can not generically call check_object_size() from +unsafe_copy_to_user() because UACCESS is enabled at this point. + +Signed-off-by: Eric Dumazet +Cc: Kees Cook +Acked-by: Kees Cook +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + net/core/scm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/scm.c b/net/core/scm.c +index 5c356f0d..acb7d776 100644 +--- a/net/core/scm.c ++++ b/net/core/scm.c +@@ -229,6 +229,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) + if (msg->msg_control_is_user) { + struct cmsghdr __user *cm = msg->msg_control_user; + ++ check_object_size(data, cmlen - sizeof(*cm), true); ++ + if (!user_write_access_begin(cm, cmlen)) + goto efault; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-682-drm-panel-orientation-quirks-Add-quirk-for-Leno.patch b/patches.kernel.org/6.2.3-682-drm-panel-orientation-quirks-Add-quirk-for-Leno.patch new file mode 100644 index 0000000..3bb0a79 --- /dev/null +++ b/patches.kernel.org/6.2.3-682-drm-panel-orientation-quirks-Add-quirk-for-Leno.patch @@ -0,0 +1,56 @@ +From: Hans de Goede +Date: Sun, 27 Nov 2022 19:15:39 +0100 +Subject: [PATCH] drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab + 3 X90F +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8a238d7f7eea7592e0764bc3b9e79e7c6354b04c + +[ Upstream commit 8a238d7f7eea7592e0764bc3b9e79e7c6354b04c ] + +The Lenovo Yoga Tab 3 X90F has a portrait 1600x2560 LCD used in +landscape mode, add a quirk for this. + +Signed-off-by: Hans de Goede +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20221127181539.104223-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 3659f046..23d63a4d 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -127,6 +127,12 @@ static const struct drm_dmi_panel_orientation_data lcd1600x2560_leftside_up = { + .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data lcd1600x2560_rightside_up = { ++ .width = 1600, ++ .height = 2560, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct dmi_system_id orientation_data[] = { + { /* Acer One 10 (S1003) */ + .matches = { +@@ -331,6 +337,13 @@ static const struct dmi_system_id orientation_data[] = { + DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, ++ }, { /* Lenovo Yoga Tab 3 X90F */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"), ++ }, ++ .driver_data = (void *)&lcd1600x2560_rightside_up, + }, { /* Nanote UMPC-01 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "RWC CO.,LTD"), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-683-drm-panel-orientation-quirks-Add-quirk-for-Dyna.patch b/patches.kernel.org/6.2.3-683-drm-panel-orientation-quirks-Add-quirk-for-Dyna.patch new file mode 100644 index 0000000..3b7d13e --- /dev/null +++ b/patches.kernel.org/6.2.3-683-drm-panel-orientation-quirks-Add-quirk-for-Dyna.patch @@ -0,0 +1,79 @@ +From: Allen Ballway +Date: Wed, 30 Nov 2022 17:08:22 +0000 +Subject: [PATCH] drm: panel-orientation-quirks: Add quirk for DynaBook K50 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a3caf7ea0c3d5872ed0f2c51f5476aee0c47a73a + +[ Upstream commit a3caf7ea0c3d5872ed0f2c51f5476aee0c47a73a ] + +Like the ASUS T100HAN for which there is already a quirk, +the DynaBook K50 has a 800x1280 portrait screen mounted +in the tablet part of a landscape oriented 2-in-1. +Update the quirk to be more generic and apply to this device. + +Signed-off-by: Allen Ballway +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20221130170811.1.Iee9a494547541dade9eeee9521cc8b811e76a8a0@changeid +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../gpu/drm/drm_panel_orientation_quirks.c | 20 ++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 23d63a4d..b409fe25 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -30,12 +30,6 @@ struct drm_dmi_panel_orientation_data { + int orientation; + }; + +-static const struct drm_dmi_panel_orientation_data asus_t100ha = { +- .width = 800, +- .height = 1280, +- .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, +-}; +- + static const struct drm_dmi_panel_orientation_data gpd_micropc = { + .width = 720, + .height = 1280, +@@ -97,6 +91,12 @@ static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = { + .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data lcd800x1280_leftside_up = { ++ .width = 800, ++ .height = 1280, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = { + .width = 800, + .height = 1280, +@@ -157,7 +157,7 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"), + }, +- .driver_data = (void *)&asus_t100ha, ++ .driver_data = (void *)&lcd800x1280_leftside_up, + }, { /* Asus T101HA */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +@@ -202,6 +202,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Hi10 pro tablet"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, ++ }, { /* Dynabook K50 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dynabook Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "dynabook K50/FR"), ++ }, ++ .driver_data = (void *)&lcd800x1280_leftside_up, + }, { /* GPD MicroPC (generic strings, also match on bios date) */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-684-drm-amd-display-Reduce-expected-sdp-bandwidth-f.patch b/patches.kernel.org/6.2.3-684-drm-amd-display-Reduce-expected-sdp-bandwidth-f.patch new file mode 100644 index 0000000..868e9da --- /dev/null +++ b/patches.kernel.org/6.2.3-684-drm-amd-display-Reduce-expected-sdp-bandwidth-f.patch @@ -0,0 +1,39 @@ +From: Dillon Varone +Date: Fri, 2 Dec 2022 22:56:57 -0500 +Subject: [PATCH] drm/amd/display: Reduce expected sdp bandwidth for dcn321 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6b81090d6d4cc0fd818c9ec9dbb6906f921ad396 + +[ Upstream commit 6b81090d6d4cc0fd818c9ec9dbb6906f921ad396 ] + +[Description] +Modify soc BB to reduce expected sdp bandwidth and align with measurements to +fix underflow issues. + +Reviewed-by: Jun Lei +Acked-by: Jasdeep Dhillon +Signed-off-by: Dillon Varone +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +index f4b17659..0ea40614 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +@@ -136,7 +136,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn3_21_soc = { + .urgent_out_of_order_return_per_channel_pixel_only_bytes = 4096, + .urgent_out_of_order_return_per_channel_pixel_and_vm_bytes = 4096, + .urgent_out_of_order_return_per_channel_vm_only_bytes = 4096, +- .pct_ideal_sdp_bw_after_urgent = 100.0, ++ .pct_ideal_sdp_bw_after_urgent = 90.0, + .pct_ideal_fabric_bw_after_urgent = 67.0, + .pct_ideal_dram_sdp_bw_after_urgent_pixel_only = 20.0, + .pct_ideal_dram_sdp_bw_after_urgent_pixel_and_vm = 60.0, // N/A, for now keep as is until DML implemented +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-685-drm-amd-display-Revert-Reduce-delay-when-sink-d.patch b/patches.kernel.org/6.2.3-685-drm-amd-display-Revert-Reduce-delay-when-sink-d.patch new file mode 100644 index 0000000..ae02323 --- /dev/null +++ b/patches.kernel.org/6.2.3-685-drm-amd-display-Revert-Reduce-delay-when-sink-d.patch @@ -0,0 +1,83 @@ +From: Ian Chen +Date: Mon, 28 Nov 2022 16:17:34 +0800 +Subject: [PATCH] drm/amd/display: Revert Reduce delay when sink device not + able to ACK 00340h write +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 639f6ad6df7f47db48b59956b469a6917a136afb + +[ Upstream commit 639f6ad6df7f47db48b59956b469a6917a136afb ] + +[WHY] +It causes regression AMD source will not write DPCD 340. + +Reviewed-by: Wayne Lin +Acked-by: Jasdeep Dhillon +Signed-off-by: Ian Chen +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 6 ------ + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 14 +++----------- + drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 1 - + 3 files changed, 3 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index c88f0446..754fc863 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -1916,12 +1916,6 @@ struct dc_link *link_create(const struct link_init_data *init_params) + if (false == dc_link_construct(link, init_params)) + goto construct_fail; + +- /* +- * Must use preferred_link_setting, not reported_link_cap or verified_link_cap, +- * since struct preferred_link_setting won't be reset after S3. +- */ +- link->preferred_link_setting.dpcd_source_device_specific_field_support = true; +- + return link; + + construct_fail: +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index dedd1246..475ad3ee 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -6554,18 +6554,10 @@ void dpcd_set_source_specific_data(struct dc_link *link) + + uint8_t hblank_size = (uint8_t)link->dc->caps.min_horizontal_blanking_period; + +- if (link->preferred_link_setting.dpcd_source_device_specific_field_support) { +- result_write_min_hblank = core_link_write_dpcd(link, +- DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size), +- sizeof(hblank_size)); +- +- if (result_write_min_hblank == DC_ERROR_UNEXPECTED) +- link->preferred_link_setting.dpcd_source_device_specific_field_support = false; +- } else { +- DC_LOG_DC("Sink device does not support 00340h DPCD write. Skipping on purpose.\n"); +- } ++ result_write_min_hblank = core_link_write_dpcd(link, ++ DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size), ++ sizeof(hblank_size)); + } +- + DC_TRACE_LEVEL_MESSAGE(DAL_TRACE_LEVEL_INFORMATION, + WPP_BIT_FLAG_DC_DETECTION_DP_CAPS, + "result=%u link_index=%u enum dce_version=%d DPCD=0x%04X min_hblank=%u branch_dev_id=0x%x branch_dev_name='%c%c%c%c%c%c'", +diff --git a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h +index 2c54b6e0..296793d8 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h +@@ -149,7 +149,6 @@ struct dc_link_settings { + enum dc_link_spread link_spread; + bool use_link_rate_set; + uint8_t link_rate_set; +- bool dpcd_source_device_specific_field_support; + }; + + union dc_dp_ffe_preset { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-686-drm-amd-display-Fix-potential-null-deref-in-dm_.patch b/patches.kernel.org/6.2.3-686-drm-amd-display-Fix-potential-null-deref-in-dm_.patch new file mode 100644 index 0000000..6310df1 --- /dev/null +++ b/patches.kernel.org/6.2.3-686-drm-amd-display-Fix-potential-null-deref-in-dm_.patch @@ -0,0 +1,54 @@ +From: Roman Li +Date: Thu, 1 Dec 2022 09:06:42 -0500 +Subject: [PATCH] drm/amd/display: Fix potential null-deref in dm_resume +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7a7175a2cd84b7874bebbf8e59f134557a34161b + +[ Upstream commit 7a7175a2cd84b7874bebbf8e59f134557a34161b ] + +[Why] +Fixing smatch error: +dm_resume() error: we previously assumed 'aconnector->dc_link' could be null + +[How] +Check if dc_link null at the beginning of the loop, +so further checks can be dropped. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter + +Reviewed-by: Wayne Lin +Acked-by: Jasdeep Dhillon +Signed-off-by: Roman Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index af16d6bb..69f0ccc1 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2747,12 +2747,14 @@ static int dm_resume(void *handle) + drm_for_each_connector_iter(connector, &iter) { + aconnector = to_amdgpu_dm_connector(connector); + ++ if (!aconnector->dc_link) ++ continue; ++ + /* + * this is the case when traversing through already created + * MST connectors, should be skipped + */ +- if (aconnector->dc_link && +- aconnector->dc_link->type == dc_connection_mst_branch) ++ if (aconnector->dc_link->type == dc_connection_mst_branch) + continue; + + mutex_lock(&aconnector->hpd_lock); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-687-drm-omap-dsi-Fix-excessive-stack-usage.patch b/patches.kernel.org/6.2.3-687-drm-omap-dsi-Fix-excessive-stack-usage.patch new file mode 100644 index 0000000..fd4898e --- /dev/null +++ b/patches.kernel.org/6.2.3-687-drm-omap-dsi-Fix-excessive-stack-usage.patch @@ -0,0 +1,101 @@ +From: Tomi Valkeinen +Date: Fri, 16 Sep 2022 11:22:05 +0300 +Subject: [PATCH] drm/omap: dsi: Fix excessive stack usage +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cfca78971b9233aef0891507a98fba62046d4542 + +[ Upstream commit cfca78971b9233aef0891507a98fba62046d4542 ] + +dsi_dump_dsi_irqs(), a function used for debugfs prints, has a large +struct in its frame, which can result in: + +drivers/gpu/drm/omapdrm/dss/dsi.c:1126:1: warning: the frame size of 1060 bytes is larger than 1024 bytes [-Wframe-larger-than=] + +As the performance of the function is of no concern, let's allocate the +struct with kmalloc instead. + +Compile-tested only. + +Signed-off-by: Tomi Valkeinen +Reported-by: kernel test robot +Reviewed-by: Arnd Bergmann +Link: https://patchwork.freedesktop.org/patch/msgid/20220916082206.167427-1-tomi.valkeinen@ideasonboard.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/omapdrm/dss/dsi.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c +index a6845856..4c1084eb 100644 +--- a/drivers/gpu/drm/omapdrm/dss/dsi.c ++++ b/drivers/gpu/drm/omapdrm/dss/dsi.c +@@ -1039,22 +1039,26 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) + { + struct dsi_data *dsi = s->private; + unsigned long flags; +- struct dsi_irq_stats stats; ++ struct dsi_irq_stats *stats; ++ ++ stats = kmalloc(sizeof(*stats), GFP_KERNEL); ++ if (!stats) ++ return -ENOMEM; + + spin_lock_irqsave(&dsi->irq_stats_lock, flags); + +- stats = dsi->irq_stats; ++ *stats = dsi->irq_stats; + memset(&dsi->irq_stats, 0, sizeof(dsi->irq_stats)); + dsi->irq_stats.last_reset = jiffies; + + spin_unlock_irqrestore(&dsi->irq_stats_lock, flags); + + seq_printf(s, "period %u ms\n", +- jiffies_to_msecs(jiffies - stats.last_reset)); ++ jiffies_to_msecs(jiffies - stats->last_reset)); + +- seq_printf(s, "irqs %d\n", stats.irq_count); ++ seq_printf(s, "irqs %d\n", stats->irq_count); + #define PIS(x) \ +- seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1]); ++ seq_printf(s, "%-20s %10d\n", #x, stats->dsi_irqs[ffs(DSI_IRQ_##x)-1]); + + seq_printf(s, "-- DSI%d interrupts --\n", dsi->module_id + 1); + PIS(VC0); +@@ -1078,10 +1082,10 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) + + #define PIS(x) \ + seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \ +- stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ +- stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ +- stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ +- stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]); ++ stats->vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ ++ stats->vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ ++ stats->vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ ++ stats->vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]); + + seq_printf(s, "-- VC interrupts --\n"); + PIS(CS); +@@ -1097,7 +1101,7 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) + + #define PIS(x) \ + seq_printf(s, "%-20s %10d\n", #x, \ +- stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]); ++ stats->cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]); + + seq_printf(s, "-- CIO interrupts --\n"); + PIS(ERRSYNCESC1); +@@ -1122,6 +1126,8 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) + PIS(ULPSACTIVENOT_ALL1); + #undef PIS + ++ kfree(stats); ++ + return 0; + } + #endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-688-HID-Add-Mapping-for-System-Microphone-Mute.patch b/patches.kernel.org/6.2.3-688-HID-Add-Mapping-for-System-Microphone-Mute.patch new file mode 100644 index 0000000..a8d400b --- /dev/null +++ b/patches.kernel.org/6.2.3-688-HID-Add-Mapping-for-System-Microphone-Mute.patch @@ -0,0 +1,59 @@ +From: Jingyuan Liang +Date: Tue, 13 Dec 2022 22:53:30 +0000 +Subject: [PATCH] HID: Add Mapping for System Microphone Mute +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2d60f9f4f26785a00273cb81fe60eff129ebd449 + +[ Upstream commit 2d60f9f4f26785a00273cb81fe60eff129ebd449 ] + +HUTRR110 added a new usage code for a key that is supposed to +mute/unmute microphone system-wide. + +Map the new usage code(0x01 0xa9) to keycode KEY_MICMUTE. +Additionally hid-debug is adjusted to recognize this keycode as well. + +Signed-off-by: Jingyuan Liang +Reviewed-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-debug.c | 1 + + drivers/hid/hid-input.c | 8 ++++++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c +index e213bdde..e7ef1ea1 100644 +--- a/drivers/hid/hid-debug.c ++++ b/drivers/hid/hid-debug.c +@@ -975,6 +975,7 @@ static const char *keys[KEY_MAX + 1] = { + [KEY_CAMERA_ACCESS_DISABLE] = "CameraAccessDisable", + [KEY_CAMERA_ACCESS_TOGGLE] = "CameraAccessToggle", + [KEY_DICTATE] = "Dictate", ++ [KEY_MICMUTE] = "MicrophoneMute", + [KEY_BRIGHTNESS_MIN] = "BrightnessMin", + [KEY_BRIGHTNESS_MAX] = "BrightnessMax", + [KEY_BRIGHTNESS_AUTO] = "BrightnessAuto", +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 77c8c498..bd0cfccf 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -793,6 +793,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + break; + } + ++ if ((usage->hid & 0xf0) == 0xa0) { /* SystemControl */ ++ switch (usage->hid & 0xf) { ++ case 0x9: map_key_clear(KEY_MICMUTE); break; ++ default: goto ignore; ++ } ++ break; ++ } ++ + if ((usage->hid & 0xf0) == 0xb0) { /* SC - Display */ + switch (usage->hid & 0xf) { + case 0x05: map_key_clear(KEY_SWITCHVIDEOMODE); break; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-689-drm-tiny-ili9486-Do-not-assume-8-bit-only-SPI-c.patch b/patches.kernel.org/6.2.3-689-drm-tiny-ili9486-Do-not-assume-8-bit-only-SPI-c.patch new file mode 100644 index 0000000..6b8ef14 --- /dev/null +++ b/patches.kernel.org/6.2.3-689-drm-tiny-ili9486-Do-not-assume-8-bit-only-SPI-c.patch @@ -0,0 +1,86 @@ +From: Carlo Caione +Date: Mon, 19 Dec 2022 10:02:38 +0100 +Subject: [PATCH] drm/tiny: ili9486: Do not assume 8-bit only SPI controllers +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 77772e607522daa61f3af74df018559db75c43d6 + +[ Upstream commit 77772e607522daa61f3af74df018559db75c43d6 ] + +The pixel data for the ILI9486 is always 16-bits wide and it must be +sent over the SPI bus. When the controller is only able to deal with +8-bit transfers, this 16-bits data needs to be swapped before the +sending to account for the big endian bus, this is on the contrary not +needed when the SPI controller already supports 16-bits transfers. + +The decision about swapping the pixel data or not is taken in the MIPI +DBI code by probing the controller capabilities: if the controller only +suppors 8-bit transfers the data is swapped, otherwise it is not. + +This swapping/non-swapping is relying on the assumption that when the +controller does support 16-bit transactions then the data is sent +unswapped in 16-bits-per-word over SPI. + +The problem with the ILI9486 driver is that it is forcing 8-bit +transactions also for controllers supporting 16-bits, violating the +assumption and corrupting the pixel data. + +Align the driver to what is done in the MIPI DBI code by adjusting the +transfer size to the maximum allowed by the SPI controller. + +Reviewed-by: Neil Armstrong +Signed-off-by: Carlo Caione +Reviewed-by: Kamlesh Gurudasani +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20221116-s905x_spi_ili9486-v4-2-f86b4463b9e4@baylibre.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/tiny/ili9486.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/tiny/ili9486.c b/drivers/gpu/drm/tiny/ili9486.c +index 1bb84746..a63b1581 100644 +--- a/drivers/gpu/drm/tiny/ili9486.c ++++ b/drivers/gpu/drm/tiny/ili9486.c +@@ -43,6 +43,7 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par, + size_t num) + { + struct spi_device *spi = mipi->spi; ++ unsigned int bpw = 8; + void *data = par; + u32 speed_hz; + int i, ret; +@@ -56,8 +57,6 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par, + * The displays are Raspberry Pi HATs and connected to the 8-bit only + * SPI controller, so 16-bit command and parameters need byte swapping + * before being transferred as 8-bit on the big endian SPI bus. +- * Pixel data bytes have already been swapped before this function is +- * called. + */ + buf[0] = cpu_to_be16(*cmd); + gpiod_set_value_cansleep(mipi->dc, 0); +@@ -71,12 +70,18 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par, + for (i = 0; i < num; i++) + buf[i] = cpu_to_be16(par[i]); + num *= 2; +- speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num); + data = buf; + } + ++ /* ++ * Check whether pixel data bytes needs to be swapped or not ++ */ ++ if (*cmd == MIPI_DCS_WRITE_MEMORY_START && !mipi->swap_bytes) ++ bpw = 16; ++ + gpiod_set_value_cansleep(mipi->dc, 1); +- ret = mipi_dbi_spi_transfer(spi, speed_hz, 8, data, num); ++ speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num); ++ ret = mipi_dbi_spi_transfer(spi, speed_hz, bpw, data, num); + free: + kfree(buf); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-690-drm-amd-display-Defer-DIG-FIFO-disable-after-VI.patch b/patches.kernel.org/6.2.3-690-drm-amd-display-Defer-DIG-FIFO-disable-after-VI.patch new file mode 100644 index 0000000..a90b966 --- /dev/null +++ b/patches.kernel.org/6.2.3-690-drm-amd-display-Defer-DIG-FIFO-disable-after-VI.patch @@ -0,0 +1,53 @@ +From: Nicholas Kazlauskas +Date: Tue, 6 Dec 2022 16:10:22 -0500 +Subject: [PATCH] drm/amd/display: Defer DIG FIFO disable after VID stream + enable +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2d90a1c054831338d57b39aec4d273cf3e867590 + +[ Upstream commit 2d90a1c054831338d57b39aec4d273cf3e867590 ] + +[Why] +On some monitors we see a brief flash of corruption during the +monitor disable sequence caused by FIFO being disabled in the middle +of an active DP stream. + +[How] +Wait until DP vid stream is disabled before turning off the FIFO. + +The FIFO reset on DP unblank should take care of clearing any FIFO +error, if any. + +Acked-by: Aurabindo Pillai +Signed-off-by: Nicholas Kazlauskas +Reviewed-by: Syed Hassan +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c +index 38842f93..0926db01 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c +@@ -278,10 +278,10 @@ static void enc314_stream_encoder_dp_blank( + struct dc_link *link, + struct stream_encoder *enc) + { +- /* New to DCN314 - disable the FIFO before VID stream disable. */ +- enc314_disable_fifo(enc); +- + enc1_stream_encoder_dp_blank(link, enc); ++ ++ /* Disable FIFO after the DP vid stream is disabled to avoid corruption. */ ++ enc314_disable_fifo(enc); + } + + static void enc314_stream_encoder_dp_unblank( +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-691-drm-radeon-free-iio-for-atombios-when-driver-sh.patch b/patches.kernel.org/6.2.3-691-drm-radeon-free-iio-for-atombios-when-driver-sh.patch new file mode 100644 index 0000000..ec53257 --- /dev/null +++ b/patches.kernel.org/6.2.3-691-drm-radeon-free-iio-for-atombios-when-driver-sh.patch @@ -0,0 +1,61 @@ +From: Liwei Song +Date: Fri, 6 Jan 2023 17:47:29 +0800 +Subject: [PATCH] drm/radeon: free iio for atombios when driver shutdown +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4773fadedca918faec443daaca5e4ea1c0ced144 + +[ Upstream commit 4773fadedca918faec443daaca5e4ea1c0ced144 ] + +Fix below kmemleak when unload radeon driver: + +unreferenced object 0xffff9f8608ede200 (size 512): + comm "systemd-udevd", pid 326, jiffies 4294682822 (age 716.338s) + hex dump (first 32 bytes): + 00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<0000000062fadebe>] kmem_cache_alloc_trace+0x2f1/0x500 + [<00000000b6883cea>] atom_parse+0x117/0x230 [radeon] + [<00000000158c23fd>] radeon_atombios_init+0xab/0x170 [radeon] + [<00000000683f672e>] si_init+0x57/0x750 [radeon] + [<00000000566cc31f>] radeon_device_init+0x559/0x9c0 [radeon] + [<0000000046efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon] + [<00000000b5155064>] drm_dev_register+0xdd/0x1d0 + [<0000000045fec835>] radeon_pci_probe+0xbd/0x100 [radeon] + [<00000000e69ecca3>] pci_device_probe+0xe1/0x160 + [<0000000019484b76>] really_probe.part.0+0xc1/0x2c0 + [<000000003f2649da>] __driver_probe_device+0x96/0x130 + [<00000000231c5bb1>] driver_probe_device+0x24/0xf0 + [<0000000000a42377>] __driver_attach+0x77/0x190 + [<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0 + [<00000000633166d2>] driver_attach+0x1e/0x30 + [<00000000313b05b8>] bus_add_driver+0x12c/0x1e0 + +iio was allocated in atom_index_iio() called by atom_parse(), +but it doesn't got released when the dirver is shutdown. +Fix this kmemleak by free it in radeon_atombios_fini(). + +Signed-off-by: Liwei Song +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/radeon/radeon_device.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index 6344454a..4f9729b4 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -1023,6 +1023,7 @@ void radeon_atombios_fini(struct radeon_device *rdev) + { + if (rdev->mode_info.atom_context) { + kfree(rdev->mode_info.atom_context->scratch); ++ kfree(rdev->mode_info.atom_context->iio); + } + kfree(rdev->mode_info.atom_context); + rdev->mode_info.atom_context = NULL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-692-drm-amd-Avoid-BUG-for-case-of-SRIOV-missing-IP-.patch b/patches.kernel.org/6.2.3-692-drm-amd-Avoid-BUG-for-case-of-SRIOV-missing-IP-.patch new file mode 100644 index 0000000..d52b201 --- /dev/null +++ b/patches.kernel.org/6.2.3-692-drm-amd-Avoid-BUG-for-case-of-SRIOV-missing-IP-.patch @@ -0,0 +1,37 @@ +From: Mario Limonciello +Date: Tue, 3 Jan 2023 16:03:41 -0600 +Subject: [PATCH] drm/amd: Avoid BUG() for case of SRIOV missing IP version +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 93fec4f8c158584065134b4d45e875499bf517c8 + +[ Upstream commit 93fec4f8c158584065134b4d45e875499bf517c8 ] + +No need to crash the kernel. AMDGPU will now fail to probe. + +Reviewed-by: Alex Deucher +Reviewed-by: Lijo Lazar +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 7a2fc920..ba092072 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -380,7 +380,7 @@ static int psp_init_sriov_microcode(struct psp_context *psp) + adev->virt.autoload_ucode_id = AMDGPU_UCODE_ID_CP_MES1_DATA; + break; + default: +- BUG(); ++ ret = -EINVAL; + break; + } + return ret; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-693-drm-amdkfd-Page-aligned-memory-reserve-size.patch b/patches.kernel.org/6.2.3-693-drm-amdkfd-Page-aligned-memory-reserve-size.patch new file mode 100644 index 0000000..3f0585d --- /dev/null +++ b/patches.kernel.org/6.2.3-693-drm-amdkfd-Page-aligned-memory-reserve-size.patch @@ -0,0 +1,113 @@ +From: Philip Yang +Date: Mon, 9 Jan 2023 18:08:17 -0500 +Subject: [PATCH] drm/amdkfd: Page aligned memory reserve size +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0c2dece8fb541ab07b68c3312a1065fa9c927a81 + +[ Upstream commit 0c2dece8fb541ab07b68c3312a1065fa9c927a81 ] + +Use page aligned size to reserve memory usage because page aligned TTM +BO size is used to unreserve memory usage, otherwise no page aligned +size causes memory usage accounting unbalanced. + +Change vram_used definition type to int64_t to be able to trigger +WARN_ONCE(adev && adev->kfd.vram_used < 0, "..."), to help debug the +accounting issue with warning and backtrace. + +Signed-off-by: Philip Yang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 12 +++++++----- + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 9 +++++++-- + 3 files changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h +index 0040deaf..90a5254e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h +@@ -97,7 +97,7 @@ struct amdgpu_amdkfd_fence { + + struct amdgpu_kfd_dev { + struct kfd_dev *dev; +- uint64_t vram_used; ++ int64_t vram_used; + uint64_t vram_used_aligned; + bool init_complete; + struct work_struct reset_work; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index 3b5c5371..05b884fe 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -1612,6 +1612,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( + struct amdgpu_bo *bo; + struct drm_gem_object *gobj = NULL; + u32 domain, alloc_domain; ++ uint64_t aligned_size; + u64 alloc_flags; + int ret; + +@@ -1667,22 +1668,23 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( + * the memory. + */ + if ((*mem)->aql_queue) +- size = size >> 1; ++ size >>= 1; ++ aligned_size = PAGE_ALIGN(size); + + (*mem)->alloc_flags = flags; + + amdgpu_sync_create(&(*mem)->sync); + +- ret = amdgpu_amdkfd_reserve_mem_limit(adev, size, flags); ++ ret = amdgpu_amdkfd_reserve_mem_limit(adev, aligned_size, flags); + if (ret) { + pr_debug("Insufficient memory\n"); + goto err_reserve_limit; + } + + pr_debug("\tcreate BO VA 0x%llx size 0x%llx domain %s\n", +- va, size, domain_string(alloc_domain)); ++ va, (*mem)->aql_queue ? size << 1 : size, domain_string(alloc_domain)); + +- ret = amdgpu_gem_object_create(adev, size, 1, alloc_domain, alloc_flags, ++ ret = amdgpu_gem_object_create(adev, aligned_size, 1, alloc_domain, alloc_flags, + bo_type, NULL, &gobj); + if (ret) { + pr_debug("Failed to create BO on domain %s. ret %d\n", +@@ -1739,7 +1741,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( + /* Don't unreserve system mem limit twice */ + goto err_reserve_limit; + err_bo_create: +- amdgpu_amdkfd_unreserve_mem_limit(adev, size, flags); ++ amdgpu_amdkfd_unreserve_mem_limit(adev, aligned_size, flags); + err_reserve_limit: + mutex_destroy(&(*mem)->lock); + if (gobj) +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +index 6d291aa6..f79b8e96 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +@@ -1127,8 +1127,13 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, + } + + /* Update the VRAM usage count */ +- if (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) +- WRITE_ONCE(pdd->vram_usage, pdd->vram_usage + args->size); ++ if (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) { ++ uint64_t size = args->size; ++ ++ if (flags & KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM) ++ size >>= 1; ++ WRITE_ONCE(pdd->vram_usage, pdd->vram_usage + PAGE_ALIGN(size)); ++ } + + mutex_unlock(&p->mutex); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-694-scsi-lpfc-Fix-use-after-free-KFENCE-violation-d.patch b/patches.kernel.org/6.2.3-694-scsi-lpfc-Fix-use-after-free-KFENCE-violation-d.patch new file mode 100644 index 0000000..a2fdf11 --- /dev/null +++ b/patches.kernel.org/6.2.3-694-scsi-lpfc-Fix-use-after-free-KFENCE-violation-d.patch @@ -0,0 +1,98 @@ +From: Justin Tee +Date: Mon, 9 Jan 2023 15:33:13 -0800 +Subject: [PATCH] scsi: lpfc: Fix use-after-free KFENCE violation during sysfs + firmware write +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 21681b81b9ae548c5dae7ae00d931197a27f480c + +[ Upstream commit 21681b81b9ae548c5dae7ae00d931197a27f480c ] + +During the sysfs firmware write process, a use-after-free read warning is +logged from the lpfc_wr_object() routine: + + BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc] + Use-after-free read at 0x0000000000cf164d (in kfence-#111): + lpfc_wr_object+0x235/0x310 [lpfc] + lpfc_write_firmware.cold+0x206/0x30d [lpfc] + lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc] + lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc] + kernfs_fop_write_iter+0x121/0x1b0 + new_sync_write+0x11c/0x1b0 + vfs_write+0x1ef/0x280 + ksys_write+0x5f/0xe0 + do_syscall_64+0x59/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The driver accessed wr_object pointer data, which was initialized into +mailbox payload memory, after the mailbox object was released back to the +mailbox pool. + +Fix by moving the mailbox free calls to the end of the routine ensuring +that we don't reference internal mailbox memory after release. + +Signed-off-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/lpfc/lpfc_sli.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 182aaae6..55a0d401 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -20819,6 +20819,7 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, + struct lpfc_mbx_wr_object *wr_object; + LPFC_MBOXQ_t *mbox; + int rc = 0, i = 0; ++ int mbox_status = 0; + uint32_t shdr_status, shdr_add_status, shdr_add_status_2; + uint32_t shdr_change_status = 0, shdr_csf = 0; + uint32_t mbox_tmo; +@@ -20864,11 +20865,15 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, + wr_object->u.request.bde_count = i; + bf_set(lpfc_wr_object_write_length, &wr_object->u.request, written); + if (!phba->sli4_hba.intr_enable) +- rc = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL); ++ mbox_status = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL); + else { + mbox_tmo = lpfc_mbox_tmo_val(phba, mbox); +- rc = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo); ++ mbox_status = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo); + } ++ ++ /* The mbox status needs to be maintained to detect MBOX_TIMEOUT. */ ++ rc = mbox_status; ++ + /* The IOCTL status is embedded in the mailbox subheader. */ + shdr_status = bf_get(lpfc_mbox_hdr_status, + &wr_object->header.cfg_shdr.response); +@@ -20883,10 +20888,6 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, + &wr_object->u.response); + } + +- if (!phba->sli4_hba.intr_enable) +- mempool_free(mbox, phba->mbox_mem_pool); +- else if (rc != MBX_TIMEOUT) +- mempool_free(mbox, phba->mbox_mem_pool); + if (shdr_status || shdr_add_status || shdr_add_status_2 || rc) { + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, + "3025 Write Object mailbox failed with " +@@ -20904,6 +20905,12 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, + lpfc_log_fw_write_cmpl(phba, shdr_status, shdr_add_status, + shdr_add_status_2, shdr_change_status, + shdr_csf); ++ ++ if (!phba->sli4_hba.intr_enable) ++ mempool_free(mbox, phba->mbox_mem_pool); ++ else if (mbox_status != MBX_TIMEOUT) ++ mempool_free(mbox, phba->mbox_mem_pool); ++ + return rc; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-695-Revert-fbcon-don-t-lose-the-console-font-across.patch b/patches.kernel.org/6.2.3-695-Revert-fbcon-don-t-lose-the-console-font-across.patch new file mode 100644 index 0000000..bcb23eb --- /dev/null +++ b/patches.kernel.org/6.2.3-695-Revert-fbcon-don-t-lose-the-console-font-across.patch @@ -0,0 +1,114 @@ +From: Thomas Zimmermann +Date: Mon, 19 Dec 2022 17:05:00 +0100 +Subject: [PATCH] Revert "fbcon: don't lose the console font across + generic->chip driver switch" +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 12d5796d55f9fd9e4b621003127c99e176665064 + +[ Upstream commit 12d5796d55f9fd9e4b621003127c99e176665064 ] + +This reverts commit ae1287865f5361fa138d4d3b1b6277908b54eac9. + +Always free the console font when deinitializing the framebuffer +console. Subsequent framebuffer consoles will then use the default +font. Rely on userspace to load any user-configured font for these +consoles. + +Commit ae1287865f53 ("fbcon: don't lose the console font across +generic->chip driver switch") was introduced to work around losing +the font during graphics-device handover. [1][2] It kept a dangling +pointer with the font data between loading the two consoles, which is +fairly adventurous hack. It also never covered cases when the other +consoles, such as VGA text mode, where involved. + +The problem has meanwhile been solved in userspace. Systemd comes +with a udev rule that re-installs the configured font when a console +comes up. [3] So the kernel workaround can be removed. + +This also removes one of the two special cases triggered by setting +FBINFO_MISC_FIRMWARE in an fbdev driver. + +Tested during device handover from efifb and simpledrm to radeon. Udev +reloads the configured console font for the new driver's terminal. + +Signed-off-by: Thomas Zimmermann +Link: https://bugzilla.redhat.com/show_bug.cgi?id=892340 # 1 +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1074624 # 2 +Link: https://cgit.freedesktop.org/systemd/systemd/tree/src/vconsole/90-vconsole.rules.in?h=v222 # 3 +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-3-tzimmermann@suse.de +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/video/fbdev/core/fbcon.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 1b14c21a..2bc8baa9 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -958,7 +958,7 @@ static const char *fbcon_startup(void) + set_blitting_type(vc, info); + + /* Setup default font */ +- if (!p->fontdata && !vc->vc_font.data) { ++ if (!p->fontdata) { + if (!fontname[0] || !(font = find_font(fontname))) + font = get_default_font(info->var.xres, + info->var.yres, +@@ -968,8 +968,6 @@ static const char *fbcon_startup(void) + vc->vc_font.height = font->height; + vc->vc_font.data = (void *)(p->fontdata = font->data); + vc->vc_font.charcount = font->charcount; +- } else { +- p->fontdata = vc->vc_font.data; + } + + cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); +@@ -1135,9 +1133,9 @@ static void fbcon_init(struct vc_data *vc, int init) + ops->p = &fb_display[fg_console]; + } + +-static void fbcon_free_font(struct fbcon_display *p, bool freefont) ++static void fbcon_free_font(struct fbcon_display *p) + { +- if (freefont && p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0)) ++ if (p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0)) + kfree(p->fontdata - FONT_EXTRA_WORDS * sizeof(int)); + p->fontdata = NULL; + p->userfont = 0; +@@ -1172,8 +1170,8 @@ static void fbcon_deinit(struct vc_data *vc) + struct fb_info *info; + struct fbcon_ops *ops; + int idx; +- bool free_font = true; + ++ fbcon_free_font(p); + idx = con2fb_map[vc->vc_num]; + + if (idx == -1) +@@ -1184,8 +1182,6 @@ static void fbcon_deinit(struct vc_data *vc) + if (!info) + goto finished; + +- if (info->flags & FBINFO_MISC_FIRMWARE) +- free_font = false; + ops = info->fbcon_par; + + if (!ops) +@@ -1197,9 +1193,8 @@ static void fbcon_deinit(struct vc_data *vc) + ops->initialized = false; + finished: + +- fbcon_free_font(p, free_font); +- if (free_font) +- vc->vc_font.data = NULL; ++ fbcon_free_font(p); ++ vc->vc_font.data = NULL; + + if (vc->vc_hi_font_mask && vc->vc_screenbuf) + set_vc_hi_font(vc, false); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-696-drm-amd-Avoid-ASSERT-for-some-message-failures.patch b/patches.kernel.org/6.2.3-696-drm-amd-Avoid-ASSERT-for-some-message-failures.patch new file mode 100644 index 0000000..3474c01 --- /dev/null +++ b/patches.kernel.org/6.2.3-696-drm-amd-Avoid-ASSERT-for-some-message-failures.patch @@ -0,0 +1,44 @@ +From: Mario Limonciello +Date: Wed, 11 Jan 2023 15:52:31 -0600 +Subject: [PATCH] drm/amd: Avoid ASSERT for some message failures +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3e5019ee67760cd61b2a5fd605e1289c2f92d983 + +[ Upstream commit 3e5019ee67760cd61b2a5fd605e1289c2f92d983 ] + +On DCN314 when resuming from s0i3 an ASSERT is shown indicating that +`VBIOSSMC_MSG_SetHardMinDcfclkByFreq` returned `VBIOSSMC_Result_Failed`. + +This isn't a driver bug; it's a BIOS/configuration bug. To make this +easier to triage, add an explicit warning when this issue happens. + +This matches the behavior utilized for failures with +`VBIOSSMC_MSG_TransferTableDram2Smu` configuration. + +Signed-off-by: Mario Limonciello +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c +index f47cfe6b..0765334f 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c +@@ -146,6 +146,9 @@ static int dcn314_smu_send_msg_with_param(struct clk_mgr_internal *clk_mgr, + if (msg_id == VBIOSSMC_MSG_TransferTableDram2Smu && + param == TABLE_WATERMARKS) + DC_LOG_WARNING("Watermarks table not configured properly by SMU"); ++ else if (msg_id == VBIOSSMC_MSG_SetHardMinDcfclkByFreq || ++ msg_id == VBIOSSMC_MSG_SetMinDeepSleepDcfclk) ++ DC_LOG_WARNING("DCFCLK_DPM is not enabled by BIOS"); + else + ASSERT(0); + REG_WRITE(MP1_SMN_C2PMSG_91, VBIOSSMC_Result_OK); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-697-drm-amd-display-Fix-memory-leakage.patch b/patches.kernel.org/6.2.3-697-drm-amd-display-Fix-memory-leakage.patch new file mode 100644 index 0000000..11eecc7 --- /dev/null +++ b/patches.kernel.org/6.2.3-697-drm-amd-display-Fix-memory-leakage.patch @@ -0,0 +1,34 @@ +From: Konstantin Meskhidze +Date: Wed, 30 Nov 2022 10:50:46 +0800 +Subject: [PATCH] drm: amd: display: Fix memory leakage +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6b8701be1f66064ca72733c5f6e13748cdbf8397 + +[ Upstream commit 6b8701be1f66064ca72733c5f6e13748cdbf8397 ] + +This commit fixes memory leakage in dc_construct_ctx() function. + +Signed-off-by: Konstantin Meskhidze +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 0cb8d1f9..c03e86e4 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -862,6 +862,7 @@ static bool dc_construct_ctx(struct dc *dc, + + dc_ctx->perf_trace = dc_perf_trace_create(); + if (!dc_ctx->perf_trace) { ++ kfree(dc_ctx); + ASSERT_CRITICAL(false); + return false; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-698-drm-amd-display-fix-mapping-to-non-allocated-ad.patch b/patches.kernel.org/6.2.3-698-drm-amd-display-fix-mapping-to-non-allocated-ad.patch new file mode 100644 index 0000000..488e3a5 --- /dev/null +++ b/patches.kernel.org/6.2.3-698-drm-amd-display-fix-mapping-to-non-allocated-ad.patch @@ -0,0 +1,123 @@ +From: Brandon Syu +Date: Thu, 22 Dec 2022 16:43:37 +0800 +Subject: [PATCH] drm/amd/display: fix mapping to non-allocated address +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9190d4a263264eabf715f5fc1827da45e3fdc247 + +[ Upstream commit 9190d4a263264eabf715f5fc1827da45e3fdc247 ] + +[Why] +There is an issue mapping non-allocated location of memory. +It would allocate gpio registers from an array out of bounds. + +[How] +Patch correct numbers of bounds for using. + +Tested-by: Daniel Wheeler +Reviewed-by: Martin Leung +Acked-by: Rodrigo Siqueira +Signed-off-by: Brandon Syu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c | 6 ++++-- + .../gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c | 6 ++++-- + .../gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c | 6 ++++-- + drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h | 7 +++++++ + 4 files changed, 19 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c +index 9b63c6c0..e0bd0c72 100644 +--- a/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c ++++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c +@@ -138,7 +138,8 @@ static const struct ddc_sh_mask ddc_shift[] = { + DDC_MASK_SH_LIST_DCN2(__SHIFT, 3), + DDC_MASK_SH_LIST_DCN2(__SHIFT, 4), + DDC_MASK_SH_LIST_DCN2(__SHIFT, 5), +- DDC_MASK_SH_LIST_DCN2(__SHIFT, 6) ++ DDC_MASK_SH_LIST_DCN2(__SHIFT, 6), ++ DDC_MASK_SH_LIST_DCN2_VGA(__SHIFT) + }; + + static const struct ddc_sh_mask ddc_mask[] = { +@@ -147,7 +148,8 @@ static const struct ddc_sh_mask ddc_mask[] = { + DDC_MASK_SH_LIST_DCN2(_MASK, 3), + DDC_MASK_SH_LIST_DCN2(_MASK, 4), + DDC_MASK_SH_LIST_DCN2(_MASK, 5), +- DDC_MASK_SH_LIST_DCN2(_MASK, 6) ++ DDC_MASK_SH_LIST_DCN2(_MASK, 6), ++ DDC_MASK_SH_LIST_DCN2_VGA(_MASK) + }; + + #include "../generic_regs.h" +diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c +index 687d4f12..36a5736c 100644 +--- a/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c ++++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c +@@ -145,7 +145,8 @@ static const struct ddc_sh_mask ddc_shift[] = { + DDC_MASK_SH_LIST_DCN2(__SHIFT, 3), + DDC_MASK_SH_LIST_DCN2(__SHIFT, 4), + DDC_MASK_SH_LIST_DCN2(__SHIFT, 5), +- DDC_MASK_SH_LIST_DCN2(__SHIFT, 6) ++ DDC_MASK_SH_LIST_DCN2(__SHIFT, 6), ++ DDC_MASK_SH_LIST_DCN2_VGA(__SHIFT) + }; + + static const struct ddc_sh_mask ddc_mask[] = { +@@ -154,7 +155,8 @@ static const struct ddc_sh_mask ddc_mask[] = { + DDC_MASK_SH_LIST_DCN2(_MASK, 3), + DDC_MASK_SH_LIST_DCN2(_MASK, 4), + DDC_MASK_SH_LIST_DCN2(_MASK, 5), +- DDC_MASK_SH_LIST_DCN2(_MASK, 6) ++ DDC_MASK_SH_LIST_DCN2(_MASK, 6), ++ DDC_MASK_SH_LIST_DCN2_VGA(_MASK) + }; + + #include "../generic_regs.h" +diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c +index 9fd8b269..985f10b3 100644 +--- a/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c ++++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c +@@ -149,7 +149,8 @@ static const struct ddc_sh_mask ddc_shift[] = { + DDC_MASK_SH_LIST_DCN2(__SHIFT, 3), + DDC_MASK_SH_LIST_DCN2(__SHIFT, 4), + DDC_MASK_SH_LIST_DCN2(__SHIFT, 5), +- DDC_MASK_SH_LIST_DCN2(__SHIFT, 6) ++ DDC_MASK_SH_LIST_DCN2(__SHIFT, 6), ++ DDC_MASK_SH_LIST_DCN2_VGA(__SHIFT) + }; + + static const struct ddc_sh_mask ddc_mask[] = { +@@ -158,7 +159,8 @@ static const struct ddc_sh_mask ddc_mask[] = { + DDC_MASK_SH_LIST_DCN2(_MASK, 3), + DDC_MASK_SH_LIST_DCN2(_MASK, 4), + DDC_MASK_SH_LIST_DCN2(_MASK, 5), +- DDC_MASK_SH_LIST_DCN2(_MASK, 6) ++ DDC_MASK_SH_LIST_DCN2(_MASK, 6), ++ DDC_MASK_SH_LIST_DCN2_VGA(_MASK) + }; + + #include "../generic_regs.h" +diff --git a/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h b/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h +index 308a5431..59884ef6 100644 +--- a/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h ++++ b/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h +@@ -113,6 +113,13 @@ + (PHY_AUX_CNTL__AUX## cd ##_PAD_RXSEL## mask_sh),\ + (DC_GPIO_AUX_CTRL_5__DDC_PAD## cd ##_I2CMODE## mask_sh)} + ++#define DDC_MASK_SH_LIST_DCN2_VGA(mask_sh) \ ++ {DDC_MASK_SH_LIST_COMMON(mask_sh),\ ++ 0,\ ++ 0,\ ++ 0,\ ++ 0} ++ + struct ddc_registers { + struct gpio_registers gpio; + uint32_t ddc_setup; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-699-HID-uclogic-Add-frame-type-quirk.patch b/patches.kernel.org/6.2.3-699-HID-uclogic-Add-frame-type-quirk.patch new file mode 100644 index 0000000..683cd40 --- /dev/null +++ b/patches.kernel.org/6.2.3-699-HID-uclogic-Add-frame-type-quirk.patch @@ -0,0 +1,148 @@ +From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= +Date: Mon, 26 Dec 2022 13:54:49 +0100 +Subject: [PATCH] HID: uclogic: Add frame type quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 14b71e6ad8ca59dd734c7fa9676f3d60bddee2a9 + +[ Upstream commit 14b71e6ad8ca59dd734c7fa9676f3d60bddee2a9 ] + +The report descriptor used to get information about UGEE v2 devices is +incorrect in the XP-PEN Deco Pro SW. It indicates that the device frame +is of type UCLOGIC_PARAMS_FRAME_BUTTONS but the device has a frame of +type UCLOGIC_PARAMS_FRAME_MOUSE. + +Here is the original report descriptor: + + 0x0e 0x03 0xc8 0xb3 0x34 0x65 0x08 0x00 0xff 0x1f 0xd8 0x13 0x00 0x00 + ^ This byte should be 2 + +Add a quirk to be able to fix the reported frame type. + +Tested-by: Mia Kanashi +Tested-by: Andreas Grosse +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-uclogic-core.c | 20 +------------------- + drivers/hid/hid-uclogic-params.c | 5 +++++ + drivers/hid/hid-uclogic-params.h | 23 +++++++++++++++++++++++ + 3 files changed, 29 insertions(+), 19 deletions(-) + +diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c +index cfbbc398..739984b8 100644 +--- a/drivers/hid/hid-uclogic-core.c ++++ b/drivers/hid/hid-uclogic-core.c +@@ -22,25 +22,6 @@ + + #include "hid-ids.h" + +-/* Driver data */ +-struct uclogic_drvdata { +- /* Interface parameters */ +- struct uclogic_params params; +- /* Pointer to the replacement report descriptor. NULL if none. */ +- __u8 *desc_ptr; +- /* +- * Size of the replacement report descriptor. +- * Only valid if desc_ptr is not NULL +- */ +- unsigned int desc_size; +- /* Pen input device */ +- struct input_dev *pen_input; +- /* In-range timer */ +- struct timer_list inrange_timer; +- /* Last rotary encoder state, or U8_MAX for none */ +- u8 re_state; +-}; +- + /** + * uclogic_inrange_timeout - handle pen in-range state timeout. + * Emulate input events normally generated when pen goes out of range for +@@ -202,6 +183,7 @@ static int uclogic_probe(struct hid_device *hdev, + } + timer_setup(&drvdata->inrange_timer, uclogic_inrange_timeout, 0); + drvdata->re_state = U8_MAX; ++ drvdata->quirks = id->driver_data; + hid_set_drvdata(hdev, drvdata); + + /* Initialize the device and retrieve interface parameters */ +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 3c5eea3d..e052538a 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -1298,6 +1298,7 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params, + struct hid_device *hdev) + { + int rc = 0; ++ struct uclogic_drvdata *drvdata; + struct usb_interface *iface; + __u8 bInterfaceNumber; + const int str_desc_len = 12; +@@ -1316,6 +1317,7 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params, + goto cleanup; + } + ++ drvdata = hid_get_drvdata(hdev); + iface = to_usb_interface(hdev->dev.parent); + bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; + +@@ -1382,6 +1384,9 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params, + p.pen.subreport_list[0].id = UCLOGIC_RDESC_V1_FRAME_ID; + + /* Initialize the frame interface */ ++ if (drvdata->quirks & UCLOGIC_MOUSE_FRAME_QUIRK) ++ frame_type = UCLOGIC_PARAMS_FRAME_MOUSE; ++ + switch (frame_type) { + case UCLOGIC_PARAMS_FRAME_DIAL: + case UCLOGIC_PARAMS_FRAME_MOUSE: +diff --git a/drivers/hid/hid-uclogic-params.h b/drivers/hid/hid-uclogic-params.h +index a97477c0..10a05c7f 100644 +--- a/drivers/hid/hid-uclogic-params.h ++++ b/drivers/hid/hid-uclogic-params.h +@@ -19,6 +19,8 @@ + #include + #include + ++#define UCLOGIC_MOUSE_FRAME_QUIRK BIT(0) ++ + /* Types of pen in-range reporting */ + enum uclogic_params_pen_inrange { + /* Normal reports: zero - out of proximity, one - in proximity */ +@@ -215,6 +217,27 @@ struct uclogic_params { + struct uclogic_params_frame frame_list[3]; + }; + ++/* Driver data */ ++struct uclogic_drvdata { ++ /* Interface parameters */ ++ struct uclogic_params params; ++ /* Pointer to the replacement report descriptor. NULL if none. */ ++ __u8 *desc_ptr; ++ /* ++ * Size of the replacement report descriptor. ++ * Only valid if desc_ptr is not NULL ++ */ ++ unsigned int desc_size; ++ /* Pen input device */ ++ struct input_dev *pen_input; ++ /* In-range timer */ ++ struct timer_list inrange_timer; ++ /* Last rotary encoder state, or U8_MAX for none */ ++ u8 re_state; ++ /* Device quirks */ ++ unsigned long quirks; ++}; ++ + /* Initialize a tablet interface and discover its parameters */ + extern int uclogic_params_init(struct uclogic_params *params, + struct hid_device *hdev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-700-HID-uclogic-Add-battery-quirk.patch b/patches.kernel.org/6.2.3-700-HID-uclogic-Add-battery-quirk.patch new file mode 100644 index 0000000..12082fc --- /dev/null +++ b/patches.kernel.org/6.2.3-700-HID-uclogic-Add-battery-quirk.patch @@ -0,0 +1,61 @@ +From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= +Date: Mon, 26 Dec 2022 13:54:50 +0100 +Subject: [PATCH] HID: uclogic: Add battery quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f60c377f52de37f8705c5fc6d57737fdaf309ff9 + +[ Upstream commit f60c377f52de37f8705c5fc6d57737fdaf309ff9 ] + +Some UGEE v2 tablets have a wireless version with an internal battery +and their firmware is able to report their battery level. + +However, there was not found a field on their descriptor indicating +whether the tablet has battery or not, making it mandatory to classify +such devices through the UCLOGIC_BATTERY_QUIRK quirk. + +Tested-by: Mia Kanashi +Tested-by: Andreas Grosse +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-uclogic-params.c | 5 +++++ + drivers/hid/hid-uclogic-params.h | 1 + + 2 files changed, 6 insertions(+) + +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index e052538a..23624d5b 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -1222,6 +1222,11 @@ static int uclogic_params_ugee_v2_init_frame_mouse(struct uclogic_params *p) + */ + static bool uclogic_params_ugee_v2_has_battery(struct hid_device *hdev) + { ++ struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev); ++ ++ if (drvdata->quirks & UCLOGIC_BATTERY_QUIRK) ++ return true; ++ + /* The XP-PEN Deco LW vendor, product and version are identical to the + * Deco L. The only difference reported by their firmware is the product + * name. Add a quirk to support battery reporting on the wireless +diff --git a/drivers/hid/hid-uclogic-params.h b/drivers/hid/hid-uclogic-params.h +index 10a05c7f..b0e7f380 100644 +--- a/drivers/hid/hid-uclogic-params.h ++++ b/drivers/hid/hid-uclogic-params.h +@@ -20,6 +20,7 @@ + #include + + #define UCLOGIC_MOUSE_FRAME_QUIRK BIT(0) ++#define UCLOGIC_BATTERY_QUIRK BIT(1) + + /* Types of pen in-range reporting */ + enum uclogic_params_pen_inrange { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-701-HID-uclogic-Add-support-for-XP-PEN-Deco-Pro-SW.patch b/patches.kernel.org/6.2.3-701-HID-uclogic-Add-support-for-XP-PEN-Deco-Pro-SW.patch new file mode 100644 index 0000000..efbecce --- /dev/null +++ b/patches.kernel.org/6.2.3-701-HID-uclogic-Add-support-for-XP-PEN-Deco-Pro-SW.patch @@ -0,0 +1,90 @@ +From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= +Date: Mon, 26 Dec 2022 13:54:53 +0100 +Subject: [PATCH] HID: uclogic: Add support for XP-PEN Deco Pro SW +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7744ca571af55b794595cff2da9d51a26904998f + +[ Upstream commit 7744ca571af55b794595cff2da9d51a26904998f ] + +The XP-PEN Deco Pro SW is a UGEE v2 device with a frame with 8 buttons, +a bitmap dial and a mouse; however, the UCLOGIC_MOUSE_FRAME_QUIRK is +required because it reports an incorrect frame type. Its pen has 2 +buttons, supports tilt and pressure. + +It can be connected using a USB cable or, to use it in wireless mode, +using a USB Bluetooth dongle. When it is connected in wireless mode the +device battery is used to power it. + +All the pieces to support it are already in place. Add its ID and +quirks in order to support the device. + +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-input.c | 2 ++ + drivers/hid/hid-uclogic-core.c | 3 +++ + drivers/hid/hid-uclogic-params.c | 2 ++ + 4 files changed, 8 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 9e36b4cd..c662994d 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1300,6 +1300,7 @@ + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2 0x0905 + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L 0x0935 + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S 0x0909 ++#define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW 0x0933 + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06 0x0078 + #define USB_DEVICE_ID_UGEE_TABLET_G5 0x0074 + #define USB_DEVICE_ID_UGEE_TABLET_EX07S 0x0071 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index bd0cfccf..0f8a5152 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -378,6 +378,8 @@ static const struct hid_device_id hid_battery_quirks[] = { + HID_BATTERY_QUIRK_IGNORE }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L), + HID_BATTERY_QUIRK_AVOID_QUERY }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW), ++ HID_BATTERY_QUIRK_AVOID_QUERY }, + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15), + HID_BATTERY_QUIRK_IGNORE }, + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100), +diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c +index 739984b8..7c05d38d 100644 +--- a/drivers/hid/hid-uclogic-core.c ++++ b/drivers/hid/hid-uclogic-core.c +@@ -513,6 +513,9 @@ static const struct hid_device_id uclogic_devices[] = { + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, ++ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW), ++ .driver_data = UCLOGIC_MOUSE_FRAME_QUIRK | UCLOGIC_BATTERY_QUIRK }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06) }, + { } +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 23624d5b..492a30f8 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -1671,6 +1671,8 @@ int uclogic_params_init(struct uclogic_params *params, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L): + case VID_PID(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S): ++ case VID_PID(USB_VENDOR_ID_UGEE, ++ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW): + rc = uclogic_params_ugee_v2_init(&p, hdev); + if (rc != 0) + goto cleanup; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-702-HID-uclogic-Add-support-for-XP-PEN-Deco-Pro-MW.patch b/patches.kernel.org/6.2.3-702-HID-uclogic-Add-support-for-XP-PEN-Deco-Pro-MW.patch new file mode 100644 index 0000000..1210299 --- /dev/null +++ b/patches.kernel.org/6.2.3-702-HID-uclogic-Add-support-for-XP-PEN-Deco-Pro-MW.patch @@ -0,0 +1,91 @@ +From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= +Date: Mon, 26 Dec 2022 13:54:54 +0100 +Subject: [PATCH] HID: uclogic: Add support for XP-PEN Deco Pro MW +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9266a88156d1fbb8e50d6eeff7bac44ad4eaecc2 + +[ Upstream commit 9266a88156d1fbb8e50d6eeff7bac44ad4eaecc2 ] + +The XP-PEN Deco Pro MW is a UGEE v2 device with a frame with 8 buttons, +a bitmap dial and a mouse. Its pen has 2 buttons, supports tilt and +pressure. + +It can be connected using a USB cable or, to use it in wireless mode, +using a USB Bluetooth dongle. When it is connected in wireless mode the +device battery is used to power it. + +All the pieces to support it are already in place. Add its ID and +quirks in order to support the device. + +Link: https://github.com/DIGImend/digimend-kernel-drivers/issues/622 +Tested-by: Andreas Grosse +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-input.c | 2 ++ + drivers/hid/hid-uclogic-core.c | 3 +++ + drivers/hid/hid-uclogic-params.c | 2 ++ + 4 files changed, 8 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index c662994d..2235d787 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1299,6 +1299,7 @@ + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01 0x0042 + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2 0x0905 + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L 0x0935 ++#define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW 0x0934 + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S 0x0909 + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW 0x0933 + #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06 0x0078 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 0f8a5152..c3c7d0ab 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -378,6 +378,8 @@ static const struct hid_device_id hid_battery_quirks[] = { + HID_BATTERY_QUIRK_IGNORE }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L), + HID_BATTERY_QUIRK_AVOID_QUERY }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW), ++ HID_BATTERY_QUIRK_AVOID_QUERY }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW), + HID_BATTERY_QUIRK_AVOID_QUERY }, + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15), +diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c +index 7c05d38d..bfbb51f8 100644 +--- a/drivers/hid/hid-uclogic-core.c ++++ b/drivers/hid/hid-uclogic-core.c +@@ -511,6 +511,9 @@ static const struct hid_device_id uclogic_devices[] = { + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, ++ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW), ++ .driver_data = UCLOGIC_MOUSE_FRAME_QUIRK | UCLOGIC_BATTERY_QUIRK }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 492a30f8..0cc03c11 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -1669,6 +1669,8 @@ int uclogic_params_init(struct uclogic_params *params, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2): + case VID_PID(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L): ++ case VID_PID(USB_VENDOR_ID_UGEE, ++ USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW): + case VID_PID(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S): + case VID_PID(USB_VENDOR_ID_UGEE, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-703-drm-msm-dsi-Add-missing-check-for-alloc_ordered.patch b/patches.kernel.org/6.2.3-703-drm-msm-dsi-Add-missing-check-for-alloc_ordered.patch new file mode 100644 index 0000000..9da97d3 --- /dev/null +++ b/patches.kernel.org/6.2.3-703-drm-msm-dsi-Add-missing-check-for-alloc_ordered.patch @@ -0,0 +1,40 @@ +From: Jiasheng Jiang +Date: Tue, 10 Jan 2023 10:16:51 +0800 +Subject: [PATCH] drm/msm/dsi: Add missing check for alloc_ordered_workqueue +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 115906ca7b535afb1fe7b5406c566ccd3873f82b + +[ Upstream commit 115906ca7b535afb1fe7b5406c566ccd3873f82b ] + +Add check for the return value of alloc_ordered_workqueue as it may return +NULL pointer and cause NULL pointer dereference. + +Signed-off-by: Jiasheng Jiang +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/517646/ +Link: https://lore.kernel.org/r/20230110021651.12770-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index 89aadd3b..f167a45f 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -1977,6 +1977,9 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi) + + /* setup workqueue */ + msm_host->workqueue = alloc_ordered_workqueue("dsi_drm_work", 0); ++ if (!msm_host->workqueue) ++ return -ENOMEM; ++ + INIT_WORK(&msm_host->err_work, dsi_err_worker); + + msm_dsi->id = msm_host->id; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-704-drm-rcar-du-Add-quirk-for-H3-ES1.x-pclk-workaro.patch b/patches.kernel.org/6.2.3-704-drm-rcar-du-Add-quirk-for-H3-ES1.x-pclk-workaro.patch new file mode 100644 index 0000000..9423705 --- /dev/null +++ b/patches.kernel.org/6.2.3-704-drm-rcar-du-Add-quirk-for-H3-ES1.x-pclk-workaro.patch @@ -0,0 +1,166 @@ +From: Tomi Valkeinen +Date: Mon, 23 Jan 2023 12:47:40 +0200 +Subject: [PATCH] drm: rcar-du: Add quirk for H3 ES1.x pclk workaround +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4f548bc48a2b4c4e54eecfddb6f7d24aa1b98768 + +[ Upstream commit 4f548bc48a2b4c4e54eecfddb6f7d24aa1b98768 ] + +rcar_du_crtc.c does a soc_device_match() in +rcar_du_crtc_set_display_timing() to find out if the SoC is H3 ES1.x, and +if so, apply a workaround. + +We will need another H3 ES1.x check in the following patch, so rather than +adding more soc_device_match() calls, let's add a rcar_du_device_info +entry for the ES1, and a quirk flag, +RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY, for the workaround. + +Signed-off-by: Tomi Valkeinen +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 8 +---- + drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 ++++++++++++++++++++++++++ + drivers/gpu/drm/rcar-du/rcar_du_drv.h | 1 + + 3 files changed, 50 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +index 3619e1dd..f2d32665 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +@@ -10,7 +10,6 @@ + #include + #include + #include +-#include + + #include + #include +@@ -204,11 +203,6 @@ static void rcar_du_escr_divider(struct clk *clk, unsigned long target, + } + } + +-static const struct soc_device_attribute rcar_du_r8a7795_es1[] = { +- { .soc_id = "r8a7795", .revision = "ES1.*" }, +- { /* sentinel */ } +-}; +- + static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) + { + const struct drm_display_mode *mode = &rcrtc->crtc.state->adjusted_mode; +@@ -238,7 +232,7 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) + * no post-divider when a display PLL is present (as shown by + * the workaround breaking HDMI output on M3-W during testing). + */ +- if (soc_device_match(rcar_du_r8a7795_es1)) { ++ if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY) { + target *= 2; + div = 1; + } +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c +index d003e8d9..c479996f 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -386,6 +387,42 @@ static const struct rcar_du_device_info rcar_du_r8a7795_info = { + .dpll_mask = BIT(2) | BIT(1), + }; + ++static const struct rcar_du_device_info rcar_du_r8a7795_es1_info = { ++ .gen = 3, ++ .features = RCAR_DU_FEATURE_CRTC_IRQ ++ | RCAR_DU_FEATURE_CRTC_CLOCK ++ | RCAR_DU_FEATURE_VSP1_SOURCE ++ | RCAR_DU_FEATURE_INTERLACED ++ | RCAR_DU_FEATURE_TVM_SYNC, ++ .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY, ++ .channels_mask = BIT(3) | BIT(2) | BIT(1) | BIT(0), ++ .routes = { ++ /* ++ * R8A7795 has one RGB output, two HDMI outputs and one ++ * LVDS output. ++ */ ++ [RCAR_DU_OUTPUT_DPAD0] = { ++ .possible_crtcs = BIT(3), ++ .port = 0, ++ }, ++ [RCAR_DU_OUTPUT_HDMI0] = { ++ .possible_crtcs = BIT(1), ++ .port = 1, ++ }, ++ [RCAR_DU_OUTPUT_HDMI1] = { ++ .possible_crtcs = BIT(2), ++ .port = 2, ++ }, ++ [RCAR_DU_OUTPUT_LVDS0] = { ++ .possible_crtcs = BIT(0), ++ .port = 3, ++ }, ++ }, ++ .num_lvds = 1, ++ .num_rpf = 5, ++ .dpll_mask = BIT(2) | BIT(1), ++}; ++ + static const struct rcar_du_device_info rcar_du_r8a7796_info = { + .gen = 3, + .features = RCAR_DU_FEATURE_CRTC_IRQ +@@ -554,6 +591,11 @@ static const struct of_device_id rcar_du_of_table[] = { + + MODULE_DEVICE_TABLE(of, rcar_du_of_table); + ++static const struct soc_device_attribute rcar_du_soc_table[] = { ++ { .soc_id = "r8a7795", .revision = "ES1.*", .data = &rcar_du_r8a7795_es1_info }, ++ { /* sentinel */ } ++}; ++ + const char *rcar_du_output_name(enum rcar_du_output output) + { + static const char * const names[] = { +@@ -645,6 +687,7 @@ static void rcar_du_shutdown(struct platform_device *pdev) + + static int rcar_du_probe(struct platform_device *pdev) + { ++ const struct soc_device_attribute *soc_attr; + struct rcar_du_device *rcdu; + unsigned int mask; + int ret; +@@ -659,8 +702,13 @@ static int rcar_du_probe(struct platform_device *pdev) + return PTR_ERR(rcdu); + + rcdu->dev = &pdev->dev; ++ + rcdu->info = of_device_get_match_data(rcdu->dev); + ++ soc_attr = soc_device_match(rcar_du_soc_table); ++ if (soc_attr) ++ rcdu->info = soc_attr->data; ++ + platform_set_drvdata(pdev, rcdu); + + /* I/O resources */ +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h +index 5cfa2bb7..df87ccab 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h ++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h +@@ -34,6 +34,7 @@ struct rcar_du_device; + #define RCAR_DU_FEATURE_NO_BLENDING BIT(5) /* PnMR.SPIM does not have ALP nor EOR bits */ + + #define RCAR_DU_QUIRK_ALIGN_128B BIT(0) /* Align pitches to 128 bytes */ ++#define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1) /* H3 ES1 has pclk stability issue */ + + enum rcar_du_output { + RCAR_DU_OUTPUT_DPAD0, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-705-drm-rcar-du-Fix-setting-a-reserved-bit-in-DPLLC.patch b/patches.kernel.org/6.2.3-705-drm-rcar-du-Fix-setting-a-reserved-bit-in-DPLLC.patch new file mode 100644 index 0000000..3e901a3 --- /dev/null +++ b/patches.kernel.org/6.2.3-705-drm-rcar-du-Fix-setting-a-reserved-bit-in-DPLLC.patch @@ -0,0 +1,137 @@ +From: Tomi Valkeinen +Date: Mon, 23 Jan 2023 12:47:41 +0200 +Subject: [PATCH] drm: rcar-du: Fix setting a reserved bit in DPLLCR +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5fbc2f3b91d27e12b614947048764099570cbb55 + +[ Upstream commit 5fbc2f3b91d27e12b614947048764099570cbb55 ] + +On H3 ES1.x two bits in DPLLCR are used to select the DU input dot clock +source. These are bits 20 and 21 for DU2, and bits 22 and 23 for DU1. On +non-ES1.x, only the higher bits are used (bits 21 and 23), and the lower +bits are reserved and should be set to 0. + +The current code always sets the lower bits, even on non-ES1.x. + +For both DU1 and DU2, on all SoC versions, when writing zeroes to those +bits the input clock is DCLKIN, and thus there's no difference between +ES1.x and non-ES1.x. + +For DU1, writing 0b10 to the bits (or only writing the higher bit) +results in using PLL0 as the input clock, so in this case there's also +no difference between ES1.x and non-ES1.x. + +However, for DU2, writing 0b10 to the bits results in using PLL0 as the +input clock on ES1.x, whereas on non-ES1.x it results in using PLL1. On +ES1.x you need to write 0b11 to select PLL1. + +The current code always writes 0b11 to PLCS0 field to select PLL1 on all +SoC versions, which works but causes an illegal (in the sense of not +allowed by the documentation) write to a reserved bit field. + +To remove the illegal bit write on PLSC0 we need to handle the input dot +clock selection differently for ES1.x and non-ES1.x. + +Add a new quirk, RCAR_DU_QUIRK_H3_ES1_PLL, for this. This way we can +always set the bit 21 on PLSC0 when choosing the PLL as the source +clock, and additionally set the bit 20 when on ES1.x. + +Signed-off-by: Tomi Valkeinen +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 23 ++++++++++++++++++++--- + drivers/gpu/drm/rcar-du/rcar_du_drv.c | 3 ++- + drivers/gpu/drm/rcar-du/rcar_du_drv.h | 1 + + drivers/gpu/drm/rcar-du/rcar_du_regs.h | 8 ++------ + 4 files changed, 25 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +index f2d32665..b7dd59fe 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +@@ -245,13 +245,30 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) + | DPLLCR_N(dpll.n) | DPLLCR_M(dpll.m) + | DPLLCR_STBY; + +- if (rcrtc->index == 1) ++ if (rcrtc->index == 1) { + dpllcr |= DPLLCR_PLCS1 + | DPLLCR_INCS_DOTCLKIN1; +- else +- dpllcr |= DPLLCR_PLCS0 ++ } else { ++ dpllcr |= DPLLCR_PLCS0_PLL + | DPLLCR_INCS_DOTCLKIN0; + ++ /* ++ * On ES2.x we have a single mux controlled via bit 21, ++ * which selects between DCLKIN source (bit 21 = 0) and ++ * a PLL source (bit 21 = 1), where the PLL is always ++ * PLL1. ++ * ++ * On ES1.x we have an additional mux, controlled ++ * via bit 20, for choosing between PLL0 (bit 20 = 0) ++ * and PLL1 (bit 20 = 1). We always want to use PLL1, ++ * so on ES1.x, in addition to setting bit 21, we need ++ * to set the bit 20. ++ */ ++ ++ if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PLL) ++ dpllcr |= DPLLCR_PLCS0_H3ES1X_PLL1; ++ } ++ + rcar_du_group_write(rcrtc->group, DPLLCR, dpllcr); + + escr = ESCR_DCLKSEL_DCLKIN | div; +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c +index c479996f..53c9669a 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c +@@ -394,7 +394,8 @@ static const struct rcar_du_device_info rcar_du_r8a7795_es1_info = { + | RCAR_DU_FEATURE_VSP1_SOURCE + | RCAR_DU_FEATURE_INTERLACED + | RCAR_DU_FEATURE_TVM_SYNC, +- .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY, ++ .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY ++ | RCAR_DU_QUIRK_H3_ES1_PLL, + .channels_mask = BIT(3) | BIT(2) | BIT(1) | BIT(0), + .routes = { + /* +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h +index df87ccab..acc3673f 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h ++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h +@@ -35,6 +35,7 @@ struct rcar_du_device; + + #define RCAR_DU_QUIRK_ALIGN_128B BIT(0) /* Align pitches to 128 bytes */ + #define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1) /* H3 ES1 has pclk stability issue */ ++#define RCAR_DU_QUIRK_H3_ES1_PLL BIT(2) /* H3 ES1 PLL setup differs from non-ES1 */ + + enum rcar_du_output { + RCAR_DU_OUTPUT_DPAD0, +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_regs.h b/drivers/gpu/drm/rcar-du/rcar_du_regs.h +index c1bcb0e8..789ae928 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_regs.h ++++ b/drivers/gpu/drm/rcar-du/rcar_du_regs.h +@@ -283,12 +283,8 @@ + #define DPLLCR 0x20044 + #define DPLLCR_CODE (0x95 << 24) + #define DPLLCR_PLCS1 (1 << 23) +-/* +- * PLCS0 is bit 21, but H3 ES1.x requires bit 20 to be set as well. As bit 20 +- * isn't implemented by other SoC in the Gen3 family it can safely be set +- * unconditionally. +- */ +-#define DPLLCR_PLCS0 (3 << 20) ++#define DPLLCR_PLCS0_PLL (1 << 21) ++#define DPLLCR_PLCS0_H3ES1X_PLL1 (1 << 20) + #define DPLLCR_CLKE (1 << 18) + #define DPLLCR_FDPLL(n) ((n) << 12) + #define DPLLCR_N(n) ((n) << 5) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-706-drm-drm_print-correct-format-problem.patch b/patches.kernel.org/6.2.3-706-drm-drm_print-correct-format-problem.patch new file mode 100644 index 0000000..7ad93d7 --- /dev/null +++ b/patches.kernel.org/6.2.3-706-drm-drm_print-correct-format-problem.patch @@ -0,0 +1,40 @@ +From: Wayne Lin +Date: Fri, 23 Dec 2022 09:57:02 +0800 +Subject: [PATCH] drm/drm_print: correct format problem +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d987150b539271b0394f24c1c648d2846662adb4 + +[ Upstream commit d987150b539271b0394f24c1c648d2846662adb4 ] + +[why & how] +__drm_dbg() parameter set format is wrong and not aligned with the +format under CONFIG_DRM_USE_DYNAMIC_DEBUG is on. Fix it. + +Signed-off-by: Wayne Lin +Signed-off-by: Harry Wentland +Acked-by: Harry Wentland +Reviewed-by: Lyude Paul +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + include/drm/drm_print.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/drm/drm_print.h b/include/drm/drm_print.h +index a44fb7ef..094ded23 100644 +--- a/include/drm/drm_print.h ++++ b/include/drm/drm_print.h +@@ -521,7 +521,7 @@ __printf(1, 2) + void __drm_err(const char *format, ...); + + #if !defined(CONFIG_DRM_USE_DYNAMIC_DEBUG) +-#define __drm_dbg(fmt, ...) ___drm_dbg(NULL, fmt, ##__VA_ARGS__) ++#define __drm_dbg(cat, fmt, ...) ___drm_dbg(NULL, cat, fmt, ##__VA_ARGS__) + #else + #define __drm_dbg(cat, fmt, ...) \ + _dynamic_func_call_cls(cat, fmt, ___drm_dbg, \ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-707-drm-amd-display-Set-hvm_enabled-flag-for-S-G-mo.patch b/patches.kernel.org/6.2.3-707-drm-amd-display-Set-hvm_enabled-flag-for-S-G-mo.patch new file mode 100644 index 0000000..129d345 --- /dev/null +++ b/patches.kernel.org/6.2.3-707-drm-amd-display-Set-hvm_enabled-flag-for-S-G-mo.patch @@ -0,0 +1,44 @@ +From: Roman Li +Date: Thu, 5 Jan 2023 17:44:10 -0500 +Subject: [PATCH] drm/amd/display: Set hvm_enabled flag for S/G mode +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 40e9f3f067bc6fb47b878f8ba0a9cc7b93abbf49 + +[ Upstream commit 40e9f3f067bc6fb47b878f8ba0a9cc7b93abbf49 ] + +[Why] +After enabling S/G on dcn314 a screen corruption may be observed. +HostVM flag should be set in S/G mode to be included in DML calculations. + +[How] +In S/G mode gpu_vm_support flag is set. +Use its value to init is_hvm_enabled. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Alan Liu +Signed-off-by: Roman Li +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 69f0ccc1..027ffa5c 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1239,7 +1239,7 @@ static void mmhub_read_system_context(struct amdgpu_device *adev, struct dc_phy_ + pa_config->gart_config.page_table_end_addr = page_table_end.quad_part << 12; + pa_config->gart_config.page_table_base_addr = page_table_base.quad_part; + +- pa_config->is_hvm_enabled = 0; ++ pa_config->is_hvm_enabled = adev->mode_info.gpu_vm_support; + + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-708-drm-client-Test-for-connectors-before-sending-h.patch b/patches.kernel.org/6.2.3-708-drm-client-Test-for-connectors-before-sending-h.patch new file mode 100644 index 0000000..40801c7 --- /dev/null +++ b/patches.kernel.org/6.2.3-708-drm-client-Test-for-connectors-before-sending-h.patch @@ -0,0 +1,58 @@ +From: Thomas Zimmermann +Date: Wed, 25 Jan 2023 21:04:06 +0100 +Subject: [PATCH] drm/client: Test for connectors before sending hotplug event +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c2bb3be64eb7182285846123219230375af61abd + +[ Upstream commit c2bb3be64eb7182285846123219230375af61abd ] + +Test for connectors in the client code and remove a similar test +from the generic fbdev emulation. Do nothing if the test fails. +Not having connectors indicates a driver bug. + +Signed-off-by: Thomas Zimmermann +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20230125200415.14123-2-tzimmermann@suse.de +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_client.c | 5 +++++ + drivers/gpu/drm/drm_fbdev_generic.c | 5 ----- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c +index 056ab9d5..313cbabb 100644 +--- a/drivers/gpu/drm/drm_client.c ++++ b/drivers/gpu/drm/drm_client.c +@@ -198,6 +198,11 @@ void drm_client_dev_hotplug(struct drm_device *dev) + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return; + ++ if (!dev->mode_config.num_connector) { ++ drm_dbg_kms(dev, "No connectors found, will not send hotplug events!\n"); ++ return; ++ } ++ + mutex_lock(&dev->clientlist_mutex); + list_for_each_entry(client, &dev->clientlist, list) { + if (!client->funcs || !client->funcs->hotplug) +diff --git a/drivers/gpu/drm/drm_fbdev_generic.c b/drivers/gpu/drm/drm_fbdev_generic.c +index 593aa328..215fe16f 100644 +--- a/drivers/gpu/drm/drm_fbdev_generic.c ++++ b/drivers/gpu/drm/drm_fbdev_generic.c +@@ -390,11 +390,6 @@ static int drm_fbdev_client_hotplug(struct drm_client_dev *client) + if (dev->fb_helper) + return drm_fb_helper_hotplug_event(dev->fb_helper); + +- if (!dev->mode_config.num_connector) { +- drm_dbg_kms(dev, "No connectors found, will not create framebuffer!\n"); +- return 0; +- } +- + drm_fb_helper_prepare(dev, fb_helper, &drm_fb_helper_generic_funcs); + + ret = drm_fb_helper_init(dev, fb_helper); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-709-habanalabs-extend-fatal-messages-to-contain-PCI.patch b/patches.kernel.org/6.2.3-709-habanalabs-extend-fatal-messages-to-contain-PCI.patch new file mode 100644 index 0000000..aa209ed --- /dev/null +++ b/patches.kernel.org/6.2.3-709-habanalabs-extend-fatal-messages-to-contain-PCI.patch @@ -0,0 +1,130 @@ +From: Moti Haimovski +Date: Thu, 29 Dec 2022 12:44:09 +0200 +Subject: [PATCH] habanalabs: extend fatal messages to contain PCI info +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2a0a839b6a28f7c4c528bb75b740c7f38ef79a37 + +[ Upstream commit 2a0a839b6a28f7c4c528bb75b740c7f38ef79a37 ] + +This commit attaches the PCI device address to driver fatal messages +in order to ease debugging in multi-device setups. + +Signed-off-by: Moti Haimovski +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/misc/habanalabs/common/device.c | 38 ++++++++++++++++--------- + 1 file changed, 25 insertions(+), 13 deletions(-) + +diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c +index 87ab329e..f7b9c387 100644 +--- a/drivers/misc/habanalabs/common/device.c ++++ b/drivers/misc/habanalabs/common/device.c +@@ -1566,7 +1566,8 @@ int hl_device_reset(struct hl_device *hdev, u32 flags) + if (rc == -EBUSY) { + if (hdev->device_fini_pending) { + dev_crit(hdev->dev, +- "Failed to kill all open processes, stopping hard reset\n"); ++ "%s Failed to kill all open processes, stopping hard reset\n", ++ dev_name(&(hdev)->pdev->dev)); + goto out_err; + } + +@@ -1576,7 +1577,8 @@ int hl_device_reset(struct hl_device *hdev, u32 flags) + + if (rc) { + dev_crit(hdev->dev, +- "Failed to kill all open processes, stopping hard reset\n"); ++ "%s Failed to kill all open processes, stopping hard reset\n", ++ dev_name(&(hdev)->pdev->dev)); + goto out_err; + } + +@@ -1627,14 +1629,16 @@ int hl_device_reset(struct hl_device *hdev, u32 flags) + * ensure driver puts the driver in a unusable state + */ + dev_crit(hdev->dev, +- "Consecutive FW fatal errors received, stopping hard reset\n"); ++ "%s Consecutive FW fatal errors received, stopping hard reset\n", ++ dev_name(&(hdev)->pdev->dev)); + rc = -EIO; + goto out_err; + } + + if (hdev->kernel_ctx) { + dev_crit(hdev->dev, +- "kernel ctx was alive during hard reset, something is terribly wrong\n"); ++ "%s kernel ctx was alive during hard reset, something is terribly wrong\n", ++ dev_name(&(hdev)->pdev->dev)); + rc = -EBUSY; + goto out_err; + } +@@ -1752,9 +1756,13 @@ int hl_device_reset(struct hl_device *hdev, u32 flags) + hdev->reset_info.needs_reset = false; + + if (hard_reset) +- dev_info(hdev->dev, "Successfully finished resetting the device\n"); ++ dev_info(hdev->dev, ++ "Successfully finished resetting the %s device\n", ++ dev_name(&(hdev)->pdev->dev)); + else +- dev_dbg(hdev->dev, "Successfully finished resetting the device\n"); ++ dev_dbg(hdev->dev, ++ "Successfully finished resetting the %s device\n", ++ dev_name(&(hdev)->pdev->dev)); + + if (hard_reset) { + hdev->reset_info.hard_reset_cnt++; +@@ -1789,7 +1797,9 @@ int hl_device_reset(struct hl_device *hdev, u32 flags) + hdev->reset_info.in_compute_reset = 0; + + if (hard_reset) { +- dev_err(hdev->dev, "Failed to reset! Device is NOT usable\n"); ++ dev_err(hdev->dev, ++ "%s Failed to reset! Device is NOT usable\n", ++ dev_name(&(hdev)->pdev->dev)); + hdev->reset_info.hard_reset_cnt++; + } else if (reset_upon_device_release) { + spin_unlock(&hdev->reset_info.lock); +@@ -2186,7 +2196,8 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass) + } + + dev_notice(hdev->dev, +- "Successfully added device to habanalabs driver\n"); ++ "Successfully added device %s to habanalabs driver\n", ++ dev_name(&(hdev)->pdev->dev)); + + hdev->init_done = true; + +@@ -2235,11 +2246,11 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass) + device_cdev_sysfs_add(hdev); + if (hdev->pdev) + dev_err(&hdev->pdev->dev, +- "Failed to initialize hl%d. Device is NOT usable !\n", +- hdev->cdev_idx); ++ "Failed to initialize hl%d. Device %s is NOT usable !\n", ++ hdev->cdev_idx, dev_name(&(hdev)->pdev->dev)); + else +- pr_err("Failed to initialize hl%d. Device is NOT usable !\n", +- hdev->cdev_idx); ++ pr_err("Failed to initialize hl%d. Device %s is NOT usable !\n", ++ hdev->cdev_idx, dev_name(&(hdev)->pdev->dev)); + + return rc; + } +@@ -2295,7 +2306,8 @@ void hl_device_fini(struct hl_device *hdev) + + if (ktime_compare(ktime_get(), timeout) > 0) { + dev_crit(hdev->dev, +- "Failed to remove device because reset function did not finish\n"); ++ "%s Failed to remove device because reset function did not finish\n", ++ dev_name(&(hdev)->pdev->dev)); + return; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-710-habanalabs-fix-bug-in-timestamps-registration-c.patch b/patches.kernel.org/6.2.3-710-habanalabs-fix-bug-in-timestamps-registration-c.patch new file mode 100644 index 0000000..37b5157 --- /dev/null +++ b/patches.kernel.org/6.2.3-710-habanalabs-fix-bug-in-timestamps-registration-c.patch @@ -0,0 +1,95 @@ +From: farah kassabri +Date: Tue, 10 Jan 2023 12:29:55 +0200 +Subject: [PATCH] habanalabs: fix bug in timestamps registration code +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ac5af9900f82b7034de7c9eb1d70d030ba325607 + +[ Upstream commit ac5af9900f82b7034de7c9eb1d70d030ba325607 ] + +Protect re-using the same timestamp buffer record before actually +adding it to the to interrupt wait list. +Mark ts buff offset as in use in the spinlock protection area of the +interrupt wait list to avoid getting in the re-use section in +ts_buff_get_kernel_ts_record before adding the node to the list. +this scenario might happen when multiple threads are racing on +same offset and one thread could set data in the ts buff in +ts_buff_get_kernel_ts_record then the other thread takes over +and get to ts_buff_get_kernel_ts_record and we will try +to re-use the same ts buff offset then we will try to +delete a non existing node from the list. + +Signed-off-by: farah kassabri +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + .../habanalabs/common/command_submission.c | 33 ++++++++++++------- + 1 file changed, 22 insertions(+), 11 deletions(-) + +diff --git a/drivers/misc/habanalabs/common/command_submission.c b/drivers/misc/habanalabs/common/command_submission.c +index ea0e5101..6367cbea 100644 +--- a/drivers/misc/habanalabs/common/command_submission.c ++++ b/drivers/misc/habanalabs/common/command_submission.c +@@ -3119,19 +3119,18 @@ static int ts_buff_get_kernel_ts_record(struct hl_mmap_mem_buf *buf, + goto start_over; + } + } else { ++ /* Fill up the new registration node info */ ++ requested_offset_record->ts_reg_info.buf = buf; ++ requested_offset_record->ts_reg_info.cq_cb = cq_cb; ++ requested_offset_record->ts_reg_info.timestamp_kernel_addr = ++ (u64 *) ts_buff->user_buff_address + ts_offset; ++ requested_offset_record->cq_kernel_addr = ++ (u64 *) cq_cb->kernel_address + cq_offset; ++ requested_offset_record->cq_target_value = target_value; ++ + spin_unlock_irqrestore(wait_list_lock, flags); + } + +- /* Fill up the new registration node info */ +- requested_offset_record->ts_reg_info.in_use = 1; +- requested_offset_record->ts_reg_info.buf = buf; +- requested_offset_record->ts_reg_info.cq_cb = cq_cb; +- requested_offset_record->ts_reg_info.timestamp_kernel_addr = +- (u64 *) ts_buff->user_buff_address + ts_offset; +- requested_offset_record->cq_kernel_addr = +- (u64 *) cq_cb->kernel_address + cq_offset; +- requested_offset_record->cq_target_value = target_value; +- + *pend = requested_offset_record; + + dev_dbg(buf->mmg->dev, "Found available node in TS kernel CB %p\n", +@@ -3179,7 +3178,7 @@ static int _hl_interrupt_wait_ioctl(struct hl_device *hdev, struct hl_ctx *ctx, + goto put_cq_cb; + } + +- /* Find first available record */ ++ /* get ts buffer record */ + rc = ts_buff_get_kernel_ts_record(buf, cq_cb, ts_offset, + cq_counters_offset, target_value, + &interrupt->wait_list_lock, &pend); +@@ -3227,7 +3226,19 @@ static int _hl_interrupt_wait_ioctl(struct hl_device *hdev, struct hl_ctx *ctx, + * Note that we cannot have sorted list by target value, + * in order to shorten the list pass loop, since + * same list could have nodes for different cq counter handle. ++ * Note: ++ * Mark ts buff offset as in use here in the spinlock protection area ++ * to avoid getting in the re-use section in ts_buff_get_kernel_ts_record ++ * before adding the node to the list. this scenario might happen when ++ * multiple threads are racing on same offset and one thread could ++ * set the ts buff in ts_buff_get_kernel_ts_record then the other thread ++ * takes over and get to ts_buff_get_kernel_ts_record and then we will try ++ * to re-use the same ts buff offset, and will try to delete a non existing ++ * node from the list. + */ ++ if (register_ts_record) ++ pend->ts_reg_info.in_use = 1; ++ + list_add_tail(&pend->wait_list_node, &interrupt->wait_list_head); + spin_unlock_irqrestore(&interrupt->wait_list_lock, flags); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-711-docs-scripts-gdb-add-necessary-make-scripts_gdb.patch b/patches.kernel.org/6.2.3-711-docs-scripts-gdb-add-necessary-make-scripts_gdb.patch new file mode 100644 index 0000000..9022ee7 --- /dev/null +++ b/patches.kernel.org/6.2.3-711-docs-scripts-gdb-add-necessary-make-scripts_gdb.patch @@ -0,0 +1,47 @@ +From: Jakob Koschel +Date: Fri, 20 Jan 2023 00:23:20 +0100 +Subject: [PATCH] docs/scripts/gdb: add necessary make scripts_gdb step +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6b219431037bf98c9efd49716aea9b68440477a3 + +[ Upstream commit 6b219431037bf98c9efd49716aea9b68440477a3 ] + +In order to debug the kernel successfully with gdb you need to run +'make scripts_gdb' nowadays. + +This was changed with the following commit: + +Commit 67274c083438340ad16c ("scripts/gdb: delay generation of gdb +constants.py") + +In order to have a complete guide for beginners this remark +should be added to the offial documentation. + +Signed-off-by: Jakob Koschel +Link: https://lore.kernel.org/r/20230112-documentation-gdb-v2-1-292785c43dc9@gmail.com +Signed-off-by: Jonathan Corbet +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + Documentation/dev-tools/gdb-kernel-debugging.rst | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/Documentation/dev-tools/gdb-kernel-debugging.rst b/Documentation/dev-tools/gdb-kernel-debugging.rst +index 8e0f1fe8..895285c0 100644 +--- a/Documentation/dev-tools/gdb-kernel-debugging.rst ++++ b/Documentation/dev-tools/gdb-kernel-debugging.rst +@@ -39,6 +39,10 @@ Setup + this mode. In this case, you should build the kernel with + CONFIG_RANDOMIZE_BASE disabled if the architecture supports KASLR. + ++- Build the gdb scripts (required on kernels v5.1 and above):: ++ ++ make scripts_gdb ++ + - Enable the gdb stub of QEMU/KVM, either + + - at VM startup time by appending "-s" to the QEMU command line +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-712-drm-msm-dpu-Add-DSC-hardware-blocks-to-register.patch b/patches.kernel.org/6.2.3-712-drm-msm-dpu-Add-DSC-hardware-blocks-to-register.patch new file mode 100644 index 0000000..0410bef --- /dev/null +++ b/patches.kernel.org/6.2.3-712-drm-msm-dpu-Add-DSC-hardware-blocks-to-register.patch @@ -0,0 +1,44 @@ +From: Marijn Suijten +Date: Wed, 25 Jan 2023 11:14:11 +0100 +Subject: [PATCH] drm/msm/dpu: Add DSC hardware blocks to register snapshot +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a7efe60e36b9c0e966d7f82ac90a89b591d984e9 + +[ Upstream commit a7efe60e36b9c0e966d7f82ac90a89b591d984e9 ] + +Add missing DSC hardware block register ranges to the snapshot utility +to include them in dmesg (on MSM_DISP_SNAPSHOT_DUMP_IN_CONSOLE) and the +kms debugfs file. + +Signed-off-by: Marijn Suijten +Reviewed-by: Neil Armstrong +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/520175/ +Link: https://lore.kernel.org/r/20230125101412.216924-1-marijn.suijten@somainline.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +index b7119951..09757166 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +@@ -930,6 +930,11 @@ static void dpu_kms_mdp_snapshot(struct msm_disp_state *disp_state, struct msm_k + msm_disp_snapshot_add_block(disp_state, cat->mdp[0].len, + dpu_kms->mmio + cat->mdp[0].base, "top"); + ++ /* dump DSC sub-blocks HW regs info */ ++ for (i = 0; i < cat->dsc_count; i++) ++ msm_disp_snapshot_add_block(disp_state, cat->dsc[i].len, ++ dpu_kms->mmio + cat->dsc[i].base, "dsc_%d", i); ++ + pm_runtime_put_sync(&dpu_kms->pdev->dev); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-713-ASoC-soc-compress-Reposition-and-add-pcm_mutex.patch b/patches.kernel.org/6.2.3-713-ASoC-soc-compress-Reposition-and-add-pcm_mutex.patch new file mode 100644 index 0000000..191ef57 --- /dev/null +++ b/patches.kernel.org/6.2.3-713-ASoC-soc-compress-Reposition-and-add-pcm_mutex.patch @@ -0,0 +1,134 @@ +From: =?UTF-8?q?=EA=B0=95=EC=8B=A0=ED=98=95?= +Date: Thu, 8 Dec 2022 14:18:18 +0900 +Subject: [PATCH] ASoC: soc-compress: Reposition and add pcm_mutex +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aa9ff6a4955fdba02b54fbc4386db876603703b7 + +[ Upstream commit aa9ff6a4955fdba02b54fbc4386db876603703b7 ] + +If panic_on_warn is set and compress stream(DPCM) is started, +then kernel panic occurred because card->pcm_mutex isn't held appropriately. +In the following functions, warning were issued at this line +"snd_soc_dpcm_mutex_assert_held". + +static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe, + struct snd_soc_pcm_runtime *be, int stream) +{ + ... + snd_soc_dpcm_mutex_assert_held(fe); + ... +} + +void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream) +{ + ... + snd_soc_dpcm_mutex_assert_held(fe); + ... +} + +void snd_soc_runtime_action(struct snd_soc_pcm_runtime *rtd, + int stream, int action) +{ + ... + snd_soc_dpcm_mutex_assert_held(rtd); + ... +} + +int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir, + int event) +{ + ... + snd_soc_dpcm_mutex_assert_held(fe); + ... +} + +These functions are called by soc_compr_set_params_fe, soc_compr_open_fe +and soc_compr_free_fe +without pcm_mutex locking. And this is call stack. + +[ 414.527841][ T2179] pc : dpcm_process_paths+0x5a4/0x750 +[ 414.527848][ T2179] lr : dpcm_process_paths+0x37c/0x750 +[ 414.527945][ T2179] Call trace: +[ 414.527949][ T2179] dpcm_process_paths+0x5a4/0x750 +[ 414.527955][ T2179] soc_compr_open_fe+0xb0/0x2cc +[ 414.527972][ T2179] snd_compr_open+0x180/0x248 +[ 414.527981][ T2179] snd_open+0x15c/0x194 +[ 414.528003][ T2179] chrdev_open+0x1b0/0x220 +[ 414.528023][ T2179] do_dentry_open+0x30c/0x594 +[ 414.528045][ T2179] vfs_open+0x34/0x44 +[ 414.528053][ T2179] path_openat+0x914/0xb08 +[ 414.528062][ T2179] do_filp_open+0xc0/0x170 +[ 414.528068][ T2179] do_sys_openat2+0x94/0x18c +[ 414.528076][ T2179] __arm64_sys_openat+0x78/0xa4 +[ 414.528084][ T2179] invoke_syscall+0x48/0x10c +[ 414.528094][ T2179] el0_svc_common+0xbc/0x104 +[ 414.528099][ T2179] do_el0_svc+0x34/0xd8 +[ 414.528103][ T2179] el0_svc+0x34/0xc4 +[ 414.528125][ T2179] el0t_64_sync_handler+0x8c/0xfc +[ 414.528133][ T2179] el0t_64_sync+0x1a0/0x1a4 +[ 414.528142][ T2179] Kernel panic - not syncing: panic_on_warn set ... + +So, I reposition and add pcm_mutex to resolve lockdep error. + +Signed-off-by: Shinhyung Kang +Link: https://lore.kernel.org/r/016401d90ac4$7b6848c0$7238da40$@samsung.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/soc-compress.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c +index cb0ed2fe..e7aa6f36 100644 +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -149,6 +149,8 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream) + if (ret < 0) + goto be_err; + ++ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); ++ + /* calculate valid and active FE <-> BE dpcms */ + dpcm_process_paths(fe, stream, &list, 1); + fe->dpcm[stream].runtime = fe_substream->runtime; +@@ -184,7 +186,6 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream) + fe->dpcm[stream].state = SND_SOC_DPCM_STATE_OPEN; + fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO; + +- mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); + snd_soc_runtime_activate(fe, stream); + mutex_unlock(&fe->card->pcm_mutex); + +@@ -215,7 +216,6 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream) + + mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); + snd_soc_runtime_deactivate(fe, stream); +- mutex_unlock(&fe->card->pcm_mutex); + + fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE; + +@@ -234,6 +234,8 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream) + + dpcm_be_disconnect(fe, stream); + ++ mutex_unlock(&fe->card->pcm_mutex); ++ + fe->dpcm[stream].runtime = NULL; + + snd_soc_link_compr_shutdown(cstream, 0); +@@ -409,8 +411,9 @@ static int soc_compr_set_params_fe(struct snd_compr_stream *cstream, + ret = snd_soc_link_compr_set_params(cstream); + if (ret < 0) + goto out; +- ++ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); + dpcm_dapm_stream_event(fe, stream, SND_SOC_DAPM_STREAM_START); ++ mutex_unlock(&fe->card->pcm_mutex); + fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; + + out: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-714-ASoC-kirkwood-Iterate-over-array-indexes-instea.patch b/patches.kernel.org/6.2.3-714-ASoC-kirkwood-Iterate-over-array-indexes-instea.patch new file mode 100644 index 0000000..975f122 --- /dev/null +++ b/patches.kernel.org/6.2.3-714-ASoC-kirkwood-Iterate-over-array-indexes-instea.patch @@ -0,0 +1,51 @@ +From: Kees Cook +Date: Fri, 27 Jan 2023 14:41:29 -0800 +Subject: [PATCH] ASoC: kirkwood: Iterate over array indexes instead of using + pointer math +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b3bcedc0402fcdc5c8624c433562d9d1882749d8 + +[ Upstream commit b3bcedc0402fcdc5c8624c433562d9d1882749d8 ] + +Walking the dram->cs array was seen as accesses beyond the first array +item by the compiler. Instead, use the array index directly. This allows +for run-time bounds checking under CONFIG_UBSAN_BOUNDS as well. Seen +with GCC 13 with -fstrict-flex-arrays: + +../sound/soc/kirkwood/kirkwood-dma.c: In function +'kirkwood_dma_conf_mbus_windows.constprop': +../sound/soc/kirkwood/kirkwood-dma.c:90:24: warning: array subscript 0 is outside array bounds of 'const struct mbus_dram_window[0]' [-Warray-bounds=] + 90 | if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) { + | ~~^~~~~~ + +Cc: Liam Girdwood +Cc: Mark Brown +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: alsa-devel@alsa-project.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230127224128.never.410-kees@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + sound/soc/kirkwood/kirkwood-dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c +index 700a1856..640cebd2 100644 +--- a/sound/soc/kirkwood/kirkwood-dma.c ++++ b/sound/soc/kirkwood/kirkwood-dma.c +@@ -86,7 +86,7 @@ kirkwood_dma_conf_mbus_windows(void __iomem *base, int win, + + /* try to find matching cs for current dma address */ + for (i = 0; i < dram->num_cs; i++) { +- const struct mbus_dram_window *cs = dram->cs + i; ++ const struct mbus_dram_window *cs = &dram->cs[i]; + if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) { + writel(cs->base & 0xffff0000, + base + KIRKWOOD_AUDIO_WIN_BASE_REG(win)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-715-regulator-max77802-Bounds-check-regulator-id-ag.patch b/patches.kernel.org/6.2.3-715-regulator-max77802-Bounds-check-regulator-id-ag.patch new file mode 100644 index 0000000..df2d45d --- /dev/null +++ b/patches.kernel.org/6.2.3-715-regulator-max77802-Bounds-check-regulator-id-ag.patch @@ -0,0 +1,138 @@ +From: Kees Cook +Date: Fri, 27 Jan 2023 14:52:07 -0800 +Subject: [PATCH] regulator: max77802: Bounds check regulator id against opmode +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4fd8bcec5fd7c0d586206fa2f42bd67b06cdaa7e + +[ Upstream commit 4fd8bcec5fd7c0d586206fa2f42bd67b06cdaa7e ] + +Explicitly bounds-check the id before accessing the opmode array. Seen +with GCC 13: + +../drivers/regulator/max77802-regulator.c: In function 'max77802_enable': +../drivers/regulator/max77802-regulator.c:217:29: warning: array subscript [0, 41] is outside array bounds of 'unsigned int[42]' [-Warray-bounds=] + 217 | if (max77802->opmode[id] == MAX77802_OFF_PWRREQ) + | ~~~~~~~~~~~~~~~~^~~~ +../drivers/regulator/max77802-regulator.c:62:22: note: while referencing 'opmode' + 62 | unsigned int opmode[MAX77802_REG_MAX]; + | ^~~~~~ + +Cc: Javier Martinez Canillas +Cc: Liam Girdwood +Cc: Mark Brown +Signed-off-by: Kees Cook +Acked-by: Javier Martinez Canillas +Link: https://lore.kernel.org/r/20230127225203.never.864-kees@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/regulator/max77802-regulator.c | 34 ++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 10 deletions(-) + +diff --git a/drivers/regulator/max77802-regulator.c b/drivers/regulator/max77802-regulator.c +index 21e0eb0f..befe5f31 100644 +--- a/drivers/regulator/max77802-regulator.c ++++ b/drivers/regulator/max77802-regulator.c +@@ -94,9 +94,11 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev) + { + unsigned int val = MAX77802_OFF_PWRREQ; + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + int shift = max77802_get_opmode_shift(id); + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; + max77802->opmode[id] = val; + return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg, + rdev->desc->enable_mask, val << shift); +@@ -110,7 +112,7 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev) + static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode) + { + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + unsigned int val; + int shift = max77802_get_opmode_shift(id); + +@@ -127,6 +129,9 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode) + return -EINVAL; + } + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; ++ + max77802->opmode[id] = val; + return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg, + rdev->desc->enable_mask, val << shift); +@@ -135,8 +140,10 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode) + static unsigned max77802_get_mode(struct regulator_dev *rdev) + { + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; + return max77802_map_mode(max77802->opmode[id]); + } + +@@ -160,10 +167,13 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev, + unsigned int mode) + { + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + unsigned int val; + int shift = max77802_get_opmode_shift(id); + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; ++ + /* + * If the regulator has been disabled for suspend + * then is invalid to try setting a suspend mode. +@@ -209,9 +219,11 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev, + static int max77802_enable(struct regulator_dev *rdev) + { + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + int shift = max77802_get_opmode_shift(id); + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; + if (max77802->opmode[id] == MAX77802_OFF_PWRREQ) + max77802->opmode[id] = MAX77802_OPMODE_NORMAL; + +@@ -495,7 +507,7 @@ static int max77802_pmic_probe(struct platform_device *pdev) + + for (i = 0; i < MAX77802_REG_MAX; i++) { + struct regulator_dev *rdev; +- int id = regulators[i].id; ++ unsigned int id = regulators[i].id; + int shift = max77802_get_opmode_shift(id); + int ret; + +@@ -513,10 +525,12 @@ static int max77802_pmic_probe(struct platform_device *pdev) + * the hardware reports OFF as the regulator operating mode. + * Default to operating mode NORMAL in that case. + */ +- if (val == MAX77802_STATUS_OFF) +- max77802->opmode[id] = MAX77802_OPMODE_NORMAL; +- else +- max77802->opmode[id] = val; ++ if (id < ARRAY_SIZE(max77802->opmode)) { ++ if (val == MAX77802_STATUS_OFF) ++ max77802->opmode[id] = MAX77802_OPMODE_NORMAL; ++ else ++ max77802->opmode[id] = val; ++ } + + rdev = devm_regulator_register(&pdev->dev, + ®ulators[i], &config); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-716-regulator-s5m8767-Bounds-check-id-indexing-into.patch b/patches.kernel.org/6.2.3-716-regulator-s5m8767-Bounds-check-id-indexing-into.patch new file mode 100644 index 0000000..4e42070 --- /dev/null +++ b/patches.kernel.org/6.2.3-716-regulator-s5m8767-Bounds-check-id-indexing-into.patch @@ -0,0 +1,56 @@ +From: Kees Cook +Date: Fri, 27 Jan 2023 16:53:58 -0800 +Subject: [PATCH] regulator: s5m8767: Bounds check id indexing into arrays +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e314e15a0b58f9d051c00b25951073bcdae61953 + +[ Upstream commit e314e15a0b58f9d051c00b25951073bcdae61953 ] + +The compiler has no way to know if "id" is within the array bounds of +the regulators array. Add a check for this and a build-time check that +the regulators and reg_voltage_map arrays are sized the same. Seen with +GCC 13: + +../drivers/regulator/s5m8767.c: In function 's5m8767_pmic_probe': +../drivers/regulator/s5m8767.c:936:35: warning: array subscript [0, 36] is outside array bounds of 'struct regulator_desc[37]' [-Warray-bounds=] + 936 | regulators[id].vsel_reg = + | ~~~~~~~~~~^~~~ + +Cc: Krzysztof Kozlowski +Cc: Liam Girdwood +Cc: Mark Brown +Cc: linux-samsung-soc@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230128005358.never.313-kees@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/regulator/s5m8767.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c +index 35269f99..754c6fcc 100644 +--- a/drivers/regulator/s5m8767.c ++++ b/drivers/regulator/s5m8767.c +@@ -923,10 +923,14 @@ static int s5m8767_pmic_probe(struct platform_device *pdev) + + for (i = 0; i < pdata->num_regulators; i++) { + const struct sec_voltage_desc *desc; +- int id = pdata->regulators[i].id; ++ unsigned int id = pdata->regulators[i].id; + int enable_reg, enable_val; + struct regulator_dev *rdev; + ++ BUILD_BUG_ON(ARRAY_SIZE(regulators) != ARRAY_SIZE(reg_voltage_map)); ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(regulators))) ++ continue; ++ + desc = reg_voltage_map[id]; + if (desc) { + regulators[id].n_voltages = +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-717-Revert-drm-amdgpu-TA-unload-messages-are-not-ac.patch b/patches.kernel.org/6.2.3-717-Revert-drm-amdgpu-TA-unload-messages-are-not-ac.patch new file mode 100644 index 0000000..a79f125 --- /dev/null +++ b/patches.kernel.org/6.2.3-717-Revert-drm-amdgpu-TA-unload-messages-are-not-ac.patch @@ -0,0 +1,74 @@ +From: Vitaly Prosyak +Date: Fri, 20 Jan 2023 13:19:50 -0500 +Subject: [PATCH] Revert "drm/amdgpu: TA unload messages are not actually sent + to psp when amdgpu is uninstalled" +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 39934d3ed5725c5e3570ed1b67f612f1ea60ce03 + +[ Upstream commit 39934d3ed5725c5e3570ed1b67f612f1ea60ce03 ] + +This reverts commit fac53471d0ea9693d314aa2df08d62b2e7e3a0f8. +The following change: move the drm_dev_unplug call after +amdgpu_driver_unload_kms in amdgpu_pci_remove. The reason is +the following: amdgpu_pci_remove calls drm_dev_unregister +and it should be called first to ensure userspace can't access the +device instance anymore. If we call drm_dev_unplug after +amdgpu_driver_unload_kms then we observe IGT PCI software unplug +test failure (kernel hung) for all ASICs. This is how this +regression was found. + +After this revert, the following commands do work not, but it would +be fixed in the next commit: + - sudo modprobe -r amdgpu + - sudo modprobe amdgpu + +Signed-off-by: Vitaly Prosyak +Reviewed-by Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 ++-- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index fbf2f241..d8e79de8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4022,7 +4022,8 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev) + + amdgpu_gart_dummy_page_fini(adev); + +- amdgpu_device_unmap_mmio(adev); ++ if (drm_dev_is_unplugged(adev_to_drm(adev))) ++ amdgpu_device_unmap_mmio(adev); + + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 3fe277bc..7f598977 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -2236,6 +2236,8 @@ amdgpu_pci_remove(struct pci_dev *pdev) + struct drm_device *dev = pci_get_drvdata(pdev); + struct amdgpu_device *adev = drm_to_adev(dev); + ++ drm_dev_unplug(dev); ++ + if (adev->pm.rpm_mode != AMDGPU_RUNPM_NONE) { + pm_runtime_get_sync(dev->dev); + pm_runtime_forbid(dev->dev); +@@ -2275,8 +2277,6 @@ amdgpu_pci_remove(struct pci_dev *pdev) + + amdgpu_driver_unload_kms(dev); + +- drm_dev_unplug(dev); +- + /* + * Flush any in flight DMA operations from device. + * Clear the Bus Master Enable bit and then wait on the PCIe Device +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-718-drm-amd-display-fix-FCLK-pstate-change-underflo.patch b/patches.kernel.org/6.2.3-718-drm-amd-display-fix-FCLK-pstate-change-underflo.patch new file mode 100644 index 0000000..408d145 --- /dev/null +++ b/patches.kernel.org/6.2.3-718-drm-amd-display-fix-FCLK-pstate-change-underflo.patch @@ -0,0 +1,49 @@ +From: Vladimir Stempen +Date: Tue, 17 Jan 2023 14:14:42 -0500 +Subject: [PATCH] drm/amd/display: fix FCLK pstate change underflow +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 972243f973eb0821084e5833d5f7f4ed025f42da + +[ Upstream commit 972243f973eb0821084e5833d5f7f4ed025f42da ] + +[Why] +Currently we set FCLK p-state change +watermark calculated based on dummy +p-state latency when UCLK p-state is +not supported + +[How] +Calculate FCLK p-state change watermark +based on on FCLK pstate change latency +in case UCLK p-state is not supported + +Reviewed-by: Nevenko Stupar +Acked-by: Alex Hung +Signed-off-by: Vladimir Stempen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +index f94abd12..8450f59c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +@@ -2038,6 +2038,10 @@ void dcn32_calculate_wm_and_dlg_fpu(struct dc *dc, struct dc_state *context, + */ + context->bw_ctx.bw.dcn.watermarks.a = context->bw_ctx.bw.dcn.watermarks.c; + context->bw_ctx.bw.dcn.watermarks.a.cstate_pstate.pstate_change_ns = 0; ++ /* Calculate FCLK p-state change watermark based on FCLK pstate change latency in case ++ * UCLK p-state is not supported, to avoid underflow in case FCLK pstate is supported ++ */ ++ context->bw_ctx.bw.dcn.watermarks.a.cstate_pstate.fclk_pstate_change_ns = get_fclk_watermark(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000; + } else { + /* Set A: + * All clocks min. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-719-gfs2-Improve-gfs2_make_fs_rw-error-handling.patch b/patches.kernel.org/6.2.3-719-gfs2-Improve-gfs2_make_fs_rw-error-handling.patch new file mode 100644 index 0000000..762ce42 --- /dev/null +++ b/patches.kernel.org/6.2.3-719-gfs2-Improve-gfs2_make_fs_rw-error-handling.patch @@ -0,0 +1,56 @@ +From: Andreas Gruenbacher +Date: Tue, 31 Jan 2023 15:06:53 +0100 +Subject: [PATCH] gfs2: Improve gfs2_make_fs_rw error handling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b66f723bb552ad59c2acb5d45ea45c890f84498b + +[ Upstream commit b66f723bb552ad59c2acb5d45ea45c890f84498b ] + +In gfs2_make_fs_rw(), make sure to call gfs2_consist() to report an +inconsistency and mark the filesystem as withdrawn when +gfs2_find_jhead() fails. + +At the end of gfs2_make_fs_rw(), when we discover that the filesystem +has been withdrawn, make sure we report an error. This also replaces +the gfs2_withdrawn() check after gfs2_find_jhead(). + +Reported-by: Tetsuo Handa +Cc: syzbot+f51cb4b9afbd87ec06f2@syzkaller.appspotmail.com +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/gfs2/super.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 999cc146..a07cf31f 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -138,8 +138,10 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) + return -EIO; + + error = gfs2_find_jhead(sdp->sd_jdesc, &head, false); +- if (error || gfs2_withdrawn(sdp)) ++ if (error) { ++ gfs2_consist(sdp); + return error; ++ } + + if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT)) { + gfs2_consist(sdp); +@@ -151,7 +153,9 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) + gfs2_log_pointers_init(sdp, head.lh_blkno); + + error = gfs2_quota_init(sdp); +- if (!error && !gfs2_withdrawn(sdp)) ++ if (!error && gfs2_withdrawn(sdp)) ++ error = -EIO; ++ if (!error) + set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); + return error; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-720-hwmon-coretemp-Simplify-platform-device-handlin.patch b/patches.kernel.org/6.2.3-720-hwmon-coretemp-Simplify-platform-device-handlin.patch new file mode 100644 index 0000000..3aa6a95 --- /dev/null +++ b/patches.kernel.org/6.2.3-720-hwmon-coretemp-Simplify-platform-device-handlin.patch @@ -0,0 +1,281 @@ +From: Robin Murphy +Date: Tue, 3 Jan 2023 12:46:20 +0100 +Subject: [PATCH] hwmon: (coretemp) Simplify platform device handling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6d03bbff456befeccdd4d663177c4d6c75d0c4ff + +[ Upstream commit 6d03bbff456befeccdd4d663177c4d6c75d0c4ff ] + +Coretemp's platform driver is unconventional. All the real work is done +globally by the initcall and CPU hotplug notifiers, while the "driver" +effectively just wraps an allocation and the registration of the hwmon +interface in a long-winded round-trip through the driver core. The whole +logic of dynamically creating and destroying platform devices to bring +the interfaces up and down is error prone, since it assumes +platform_device_add() will synchronously bind the driver and set drvdata +before it returns, thus results in a NULL dereference if drivers_autoprobe +is turned off for the platform bus. Furthermore, the unusual approach of +doing that from within a CPU hotplug notifier, already commented in the +code that it deadlocks suspend, also causes lockdep issues for other +drivers or subsystems which may want to legitimately register a CPU +hotplug notifier from a platform bus notifier. + +All of these issues can be solved by ripping this unusual behaviour out +completely, simply tying the platform devices to the lifetime of the +module itself, and directly managing the hwmon interfaces from the +hotplug notifiers. There is a slight user-visible change in that +/sys/bus/platform/drivers/coretemp will no longer appear, and +/sys/devices/platform/coretemp.n will remain present if package n is +hotplugged off, but hwmon users should really only be looking for the +presence of the hwmon interfaces, whose behaviour remains unchanged. + +Link: https://lore.kernel.org/lkml/20220922101036.87457-1-janusz.krzysztofik@linux.intel.com/ +Link: https://gitlab.freedesktop.org/drm/intel/issues/6641 +Signed-off-by: Robin Murphy +Signed-off-by: Janusz Krzysztofik +Link: https://lore.kernel.org/r/20230103114620.15319-1-janusz.krzysztofik@linux.intel.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/coretemp.c | 128 ++++++++++++++++++--------------------- + 1 file changed, 58 insertions(+), 70 deletions(-) + +diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c +index ca7a9b37..3e440ebe 100644 +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -588,66 +588,49 @@ static void coretemp_remove_core(struct platform_data *pdata, int indx) + ida_free(&pdata->ida, indx - BASE_SYSFS_ATTR_NO); + } + +-static int coretemp_probe(struct platform_device *pdev) ++static int coretemp_device_add(int zoneid) + { +- struct device *dev = &pdev->dev; ++ struct platform_device *pdev; + struct platform_data *pdata; ++ int err; + + /* Initialize the per-zone data structures */ +- pdata = devm_kzalloc(dev, sizeof(struct platform_data), GFP_KERNEL); ++ pdata = kzalloc(sizeof(*pdata), GFP_KERNEL); + if (!pdata) + return -ENOMEM; + +- pdata->pkg_id = pdev->id; ++ pdata->pkg_id = zoneid; + ida_init(&pdata->ida); +- platform_set_drvdata(pdev, pdata); + +- pdata->hwmon_dev = devm_hwmon_device_register_with_groups(dev, DRVNAME, +- pdata, NULL); +- return PTR_ERR_OR_ZERO(pdata->hwmon_dev); +-} +- +-static int coretemp_remove(struct platform_device *pdev) +-{ +- struct platform_data *pdata = platform_get_drvdata(pdev); +- int i; ++ pdev = platform_device_alloc(DRVNAME, zoneid); ++ if (!pdev) { ++ err = -ENOMEM; ++ goto err_free_pdata; ++ } + +- for (i = MAX_CORE_DATA - 1; i >= 0; --i) +- if (pdata->core_data[i]) +- coretemp_remove_core(pdata, i); ++ err = platform_device_add(pdev); ++ if (err) ++ goto err_put_dev; + +- ida_destroy(&pdata->ida); ++ platform_set_drvdata(pdev, pdata); ++ zone_devices[zoneid] = pdev; + return 0; +-} + +-static struct platform_driver coretemp_driver = { +- .driver = { +- .name = DRVNAME, +- }, +- .probe = coretemp_probe, +- .remove = coretemp_remove, +-}; ++err_put_dev: ++ platform_device_put(pdev); ++err_free_pdata: ++ kfree(pdata); ++ return err; ++} + +-static struct platform_device *coretemp_device_add(unsigned int cpu) ++static void coretemp_device_remove(int zoneid) + { +- int err, zoneid = topology_logical_die_id(cpu); +- struct platform_device *pdev; +- +- if (zoneid < 0) +- return ERR_PTR(-ENOMEM); +- +- pdev = platform_device_alloc(DRVNAME, zoneid); +- if (!pdev) +- return ERR_PTR(-ENOMEM); +- +- err = platform_device_add(pdev); +- if (err) { +- platform_device_put(pdev); +- return ERR_PTR(err); +- } ++ struct platform_device *pdev = zone_devices[zoneid]; ++ struct platform_data *pdata = platform_get_drvdata(pdev); + +- zone_devices[zoneid] = pdev; +- return pdev; ++ ida_destroy(&pdata->ida); ++ kfree(pdata); ++ platform_device_unregister(pdev); + } + + static int coretemp_cpu_online(unsigned int cpu) +@@ -671,7 +654,10 @@ static int coretemp_cpu_online(unsigned int cpu) + if (!cpu_has(c, X86_FEATURE_DTHERM)) + return -ENODEV; + +- if (!pdev) { ++ pdata = platform_get_drvdata(pdev); ++ if (!pdata->hwmon_dev) { ++ struct device *hwmon; ++ + /* Check the microcode version of the CPU */ + if (chk_ucode_version(cpu)) + return -EINVAL; +@@ -682,9 +668,11 @@ static int coretemp_cpu_online(unsigned int cpu) + * online. So, initialize per-pkg data structures and + * then bring this core online. + */ +- pdev = coretemp_device_add(cpu); +- if (IS_ERR(pdev)) +- return PTR_ERR(pdev); ++ hwmon = hwmon_device_register_with_groups(&pdev->dev, DRVNAME, ++ pdata, NULL); ++ if (IS_ERR(hwmon)) ++ return PTR_ERR(hwmon); ++ pdata->hwmon_dev = hwmon; + + /* + * Check whether pkgtemp support is available. +@@ -694,7 +682,6 @@ static int coretemp_cpu_online(unsigned int cpu) + coretemp_add_core(pdev, cpu, 1); + } + +- pdata = platform_get_drvdata(pdev); + /* + * Check whether a thread sibling is already online. If not add the + * interface for this CPU core. +@@ -713,18 +700,14 @@ static int coretemp_cpu_offline(unsigned int cpu) + struct temp_data *tdata; + int i, indx = -1, target; + +- /* +- * Don't execute this on suspend as the device remove locks +- * up the machine. +- */ ++ /* No need to tear down any interfaces for suspend */ + if (cpuhp_tasks_frozen) + return 0; + + /* If the physical CPU device does not exist, just return */ +- if (!pdev) +- return 0; +- + pd = platform_get_drvdata(pdev); ++ if (!pd->hwmon_dev) ++ return 0; + + for (i = 0; i < NUM_REAL_CORES; i++) { + if (pd->cpu_map[i] == topology_core_id(cpu)) { +@@ -756,13 +739,14 @@ static int coretemp_cpu_offline(unsigned int cpu) + } + + /* +- * If all cores in this pkg are offline, remove the device. This +- * will invoke the platform driver remove function, which cleans up +- * the rest. ++ * If all cores in this pkg are offline, remove the interface. + */ ++ tdata = pd->core_data[PKG_SYSFS_ATTR_NO]; + if (cpumask_empty(&pd->cpumask)) { +- zone_devices[topology_logical_die_id(cpu)] = NULL; +- platform_device_unregister(pdev); ++ if (tdata) ++ coretemp_remove_core(pd, PKG_SYSFS_ATTR_NO); ++ hwmon_device_unregister(pd->hwmon_dev); ++ pd->hwmon_dev = NULL; + return 0; + } + +@@ -770,7 +754,6 @@ static int coretemp_cpu_offline(unsigned int cpu) + * Check whether this core is the target for the package + * interface. We need to assign it to some other cpu. + */ +- tdata = pd->core_data[PKG_SYSFS_ATTR_NO]; + if (tdata && tdata->cpu == cpu) { + target = cpumask_first(&pd->cpumask); + mutex_lock(&tdata->update_lock); +@@ -789,7 +772,7 @@ static enum cpuhp_state coretemp_hp_online; + + static int __init coretemp_init(void) + { +- int err; ++ int i, err; + + /* + * CPUID.06H.EAX[0] indicates whether the CPU has thermal +@@ -805,20 +788,22 @@ static int __init coretemp_init(void) + if (!zone_devices) + return -ENOMEM; + +- err = platform_driver_register(&coretemp_driver); +- if (err) +- goto outzone; ++ for (i = 0; i < max_zones; i++) { ++ err = coretemp_device_add(i); ++ if (err) ++ goto outzone; ++ } + + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/coretemp:online", + coretemp_cpu_online, coretemp_cpu_offline); + if (err < 0) +- goto outdrv; ++ goto outzone; + coretemp_hp_online = err; + return 0; + +-outdrv: +- platform_driver_unregister(&coretemp_driver); + outzone: ++ while (i--) ++ coretemp_device_remove(i); + kfree(zone_devices); + return err; + } +@@ -826,8 +811,11 @@ module_init(coretemp_init) + + static void __exit coretemp_exit(void) + { ++ int i; ++ + cpuhp_remove_state(coretemp_hp_online); +- platform_driver_unregister(&coretemp_driver); ++ for (i = 0; i < max_zones; i++) ++ coretemp_device_remove(i); + kfree(zone_devices); + } + module_exit(coretemp_exit) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-721-hwmon-nct6775-Directly-call-ASUS-ACPI-WMI-metho.patch b/patches.kernel.org/6.2.3-721-hwmon-nct6775-Directly-call-ASUS-ACPI-WMI-metho.patch new file mode 100644 index 0000000..9ebfc02 --- /dev/null +++ b/patches.kernel.org/6.2.3-721-hwmon-nct6775-Directly-call-ASUS-ACPI-WMI-metho.patch @@ -0,0 +1,199 @@ +From: Denis Pauk +Date: Wed, 11 Jan 2023 23:22:40 +0200 +Subject: [PATCH] hwmon: (nct6775) Directly call ASUS ACPI WMI method +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c3b3747d02f571da2543e719066a50dd966989d8 + +[ Upstream commit c3b3747d02f571da2543e719066a50dd966989d8 ] + +New ASUS B650/B660/X670 boards firmware have not exposed WMI monitoring +GUID and entrypoint method WMBD could be implemented for different device +UID. + +Implement the direct call to entrypoint method for monitoring the device +UID of B550/X570 boards. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204807 +Signed-off-by: Denis Pauk +Co-developed-by: Ahmad Khalifa +Signed-off-by: Ahmad Khalifa +Link: https://lore.kernel.org/r/20230111212241.7456-1-pauk.denis@gmail.com +[groeck: Fix multi-line formatting] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/Kconfig | 2 +- + drivers/hwmon/nct6775-platform.c | 98 ++++++++++++++++++++++---------- + 2 files changed, 70 insertions(+), 30 deletions(-) + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 3176c33a..300ce811 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1516,7 +1516,7 @@ config SENSORS_NCT6775_CORE + config SENSORS_NCT6775 + tristate "Platform driver for Nuvoton NCT6775F and compatibles" + depends on !PPC +- depends on ACPI_WMI || ACPI_WMI=n ++ depends on ACPI || ACPI=n + select HWMON_VID + select SENSORS_NCT6775_CORE + help +diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c +index bf43f73d..e5d4a79c 100644 +--- a/drivers/hwmon/nct6775-platform.c ++++ b/drivers/hwmon/nct6775-platform.c +@@ -17,7 +17,6 @@ + #include + #include + #include +-#include + + #include "nct6775.h" + +@@ -107,40 +106,50 @@ struct nct6775_sio_data { + void (*sio_exit)(struct nct6775_sio_data *sio_data); + }; + +-#define ASUSWMI_MONITORING_GUID "466747A0-70EC-11DE-8A39-0800200C9A66" ++#define ASUSWMI_METHOD "WMBD" + #define ASUSWMI_METHODID_RSIO 0x5253494F + #define ASUSWMI_METHODID_WSIO 0x5753494F + #define ASUSWMI_METHODID_RHWM 0x5248574D + #define ASUSWMI_METHODID_WHWM 0x5748574D + #define ASUSWMI_UNSUPPORTED_METHOD 0xFFFFFFFE ++#define ASUSWMI_DEVICE_HID "PNP0C14" ++#define ASUSWMI_DEVICE_UID "ASUSWMI" ++ ++#if IS_ENABLED(CONFIG_ACPI) ++/* ++ * ASUS boards have only one device with WMI "WMBD" method and have provided ++ * access to only one SuperIO chip at 0x0290. ++ */ ++static struct acpi_device *asus_acpi_dev; ++#endif + + static int nct6775_asuswmi_evaluate_method(u32 method_id, u8 bank, u8 reg, u8 val, u32 *retval) + { +-#if IS_ENABLED(CONFIG_ACPI_WMI) ++#if IS_ENABLED(CONFIG_ACPI) ++ acpi_handle handle = acpi_device_handle(asus_acpi_dev); + u32 args = bank | (reg << 8) | (val << 16); +- struct acpi_buffer input = { (acpi_size) sizeof(args), &args }; +- struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; ++ struct acpi_object_list input; ++ union acpi_object params[3]; ++ unsigned long long result; + acpi_status status; +- union acpi_object *obj; +- u32 tmp = ASUSWMI_UNSUPPORTED_METHOD; +- +- status = wmi_evaluate_method(ASUSWMI_MONITORING_GUID, 0, +- method_id, &input, &output); + ++ params[0].type = ACPI_TYPE_INTEGER; ++ params[0].integer.value = 0; ++ params[1].type = ACPI_TYPE_INTEGER; ++ params[1].integer.value = method_id; ++ params[2].type = ACPI_TYPE_BUFFER; ++ params[2].buffer.length = sizeof(args); ++ params[2].buffer.pointer = (void *)&args; ++ input.count = 3; ++ input.pointer = params; ++ ++ status = acpi_evaluate_integer(handle, ASUSWMI_METHOD, &input, &result); + if (ACPI_FAILURE(status)) + return -EIO; + +- obj = output.pointer; +- if (obj && obj->type == ACPI_TYPE_INTEGER) +- tmp = obj->integer.value; +- + if (retval) +- *retval = tmp; ++ *retval = (u32)result & 0xFFFFFFFF; + +- kfree(obj); +- +- if (tmp == ASUSWMI_UNSUPPORTED_METHOD) +- return -ENODEV; + return 0; + #else + return -EOPNOTSUPP; +@@ -1099,6 +1108,45 @@ static const char * const asus_wmi_boards[] = { + "TUF GAMING Z490-PLUS (WI-FI)", + }; + ++#if IS_ENABLED(CONFIG_ACPI) ++/* ++ * Callback for acpi_bus_for_each_dev() to find the right device ++ * by _UID and _HID and return 1 to stop iteration. ++ */ ++static int nct6775_asuswmi_device_match(struct device *dev, void *data) ++{ ++ struct acpi_device *adev = to_acpi_device(dev); ++ const char *uid = acpi_device_uid(adev); ++ const char *hid = acpi_device_hid(adev); ++ ++ if (hid && !strcmp(hid, ASUSWMI_DEVICE_HID) && uid && !strcmp(uid, data)) { ++ asus_acpi_dev = adev; ++ return 1; ++ } ++ ++ return 0; ++} ++#endif ++ ++static enum sensor_access nct6775_determine_access(const char *device_uid) ++{ ++#if IS_ENABLED(CONFIG_ACPI) ++ u8 tmp; ++ ++ acpi_bus_for_each_dev(nct6775_asuswmi_device_match, (void *)device_uid); ++ if (!asus_acpi_dev) ++ return access_direct; ++ ++ /* if reading chip id via ACPI succeeds, use WMI "WMBD" method for access */ ++ if (!nct6775_asuswmi_read(0, NCT6775_PORT_CHIPID, &tmp) && tmp) { ++ pr_debug("Using Asus WMBD method of %s to access %#x chip.\n", device_uid, tmp); ++ return access_asuswmi; ++ } ++#endif ++ ++ return access_direct; ++} ++ + static int __init sensors_nct6775_platform_init(void) + { + int i, err; +@@ -1109,7 +1157,6 @@ static int __init sensors_nct6775_platform_init(void) + int sioaddr[2] = { 0x2e, 0x4e }; + enum sensor_access access = access_direct; + const char *board_vendor, *board_name; +- u8 tmp; + + err = platform_driver_register(&nct6775_driver); + if (err) +@@ -1122,15 +1169,8 @@ static int __init sensors_nct6775_platform_init(void) + !strcmp(board_vendor, "ASUSTeK COMPUTER INC.")) { + err = match_string(asus_wmi_boards, ARRAY_SIZE(asus_wmi_boards), + board_name); +- if (err >= 0) { +- /* if reading chip id via WMI succeeds, use WMI */ +- if (!nct6775_asuswmi_read(0, NCT6775_PORT_CHIPID, &tmp) && tmp) { +- pr_info("Using Asus WMI to access %#x chip.\n", tmp); +- access = access_asuswmi; +- } else { +- pr_err("Can't read ChipID by Asus WMI.\n"); +- } +- } ++ if (err >= 0) ++ access = nct6775_determine_access(ASUSWMI_DEVICE_UID); + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-722-hwmon-nct6775-B650-B660-X670-ASUS-boards-suppor.patch b/patches.kernel.org/6.2.3-722-hwmon-nct6775-B650-B660-X670-ASUS-boards-suppor.patch new file mode 100644 index 0000000..bdc56c9 --- /dev/null +++ b/patches.kernel.org/6.2.3-722-hwmon-nct6775-B650-B660-X670-ASUS-boards-suppor.patch @@ -0,0 +1,153 @@ +From: Denis Pauk +Date: Wed, 11 Jan 2023 23:22:41 +0200 +Subject: [PATCH] hwmon: (nct6775) B650/B660/X670 ASUS boards support +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e2e09989ccc21ad428d6393450add78584b143bd + +[ Upstream commit e2e09989ccc21ad428d6393450add78584b143bd ] + +Boards such as: + "EX-B660M-V5 PRO D4", + "PRIME B650-PLUS", + "PRIME B650M-A", + "PRIME B650M-A AX", + "PRIME B650M-A II", + "PRIME B650M-A WIFI", + "PRIME B650M-A WIFI II", + "PRIME B660M-A D4", + "PRIME B660M-A WIFI D4", + "PRIME X670-P", + "PRIME X670-P WIFI", + "PRIME X670E-PRO WIFI", + "Pro B660M-C-D4", + "ProArt B660-CREATOR D4", + "ProArt X670E-CREATOR WIFI", + "ROG CROSSHAIR X670E EXTREME", + "ROG CROSSHAIR X670E GENE", + "ROG CROSSHAIR X670E HERO", + "ROG MAXIMUS XIII EXTREME GLACIAL", + "ROG MAXIMUS Z690 EXTREME", + "ROG MAXIMUS Z690 EXTREME GLACIAL", + "ROG STRIX B650-A GAMING WIFI", + "ROG STRIX B650E-E GAMING WIFI", + "ROG STRIX B650E-F GAMING WIFI", + "ROG STRIX B650E-I GAMING WIFI", + "ROG STRIX B660-A GAMING WIFI D4", + "ROG STRIX B660-F GAMING WIFI", + "ROG STRIX B660-G GAMING WIFI", + "ROG STRIX B660-I GAMING WIFI", + "ROG STRIX X670E-A GAMING WIFI", + "ROG STRIX X670E-E GAMING WIFI", + "ROG STRIX X670E-F GAMING WIFI", + "ROG STRIX X670E-I GAMING WIFI", + "ROG STRIX Z590-A GAMING WIFI II", + "ROG STRIX Z690-A GAMING WIFI D4", + "TUF GAMING B650-PLUS", + "TUF GAMING B650-PLUS WIFI", + "TUF GAMING B650M-PLUS", + "TUF GAMING B650M-PLUS WIFI", + "TUF GAMING B660M-PLUS WIFI", + "TUF GAMING X670E-PLUS", + "TUF GAMING X670E-PLUS WIFI", + "TUF GAMING Z590-PLUS WIFI", +have got a NCT6799D chip, but by default there's no use of it +because of resource conflict with WMI method. + +This commit adds such boards to the monitoring list with new ACPI device +UID. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204807 +Signed-off-by: Denis Pauk +Co-developed-by: Ahmad Khalifa +Signed-off-by: Ahmad Khalifa +Tested-by: Jeroen Beerstra +Tested-by: Slawomir Stepien +Link: https://lore.kernel.org/r/20230111212241.7456-2-pauk.denis@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/nct6775-platform.c | 52 ++++++++++++++++++++++++++++++++ + 1 file changed, 52 insertions(+) + +diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c +index e5d4a79c..76c6b564 100644 +--- a/drivers/hwmon/nct6775-platform.c ++++ b/drivers/hwmon/nct6775-platform.c +@@ -114,6 +114,7 @@ struct nct6775_sio_data { + #define ASUSWMI_UNSUPPORTED_METHOD 0xFFFFFFFE + #define ASUSWMI_DEVICE_HID "PNP0C14" + #define ASUSWMI_DEVICE_UID "ASUSWMI" ++#define ASUSMSI_DEVICE_UID "AsusMbSwInterface" + + #if IS_ENABLED(CONFIG_ACPI) + /* +@@ -1108,6 +1109,52 @@ static const char * const asus_wmi_boards[] = { + "TUF GAMING Z490-PLUS (WI-FI)", + }; + ++static const char * const asus_msi_boards[] = { ++ "EX-B660M-V5 PRO D4", ++ "PRIME B650-PLUS", ++ "PRIME B650M-A", ++ "PRIME B650M-A AX", ++ "PRIME B650M-A II", ++ "PRIME B650M-A WIFI", ++ "PRIME B650M-A WIFI II", ++ "PRIME B660M-A D4", ++ "PRIME B660M-A WIFI D4", ++ "PRIME X670-P", ++ "PRIME X670-P WIFI", ++ "PRIME X670E-PRO WIFI", ++ "Pro B660M-C-D4", ++ "ProArt B660-CREATOR D4", ++ "ProArt X670E-CREATOR WIFI", ++ "ROG CROSSHAIR X670E EXTREME", ++ "ROG CROSSHAIR X670E GENE", ++ "ROG CROSSHAIR X670E HERO", ++ "ROG MAXIMUS XIII EXTREME GLACIAL", ++ "ROG MAXIMUS Z690 EXTREME", ++ "ROG MAXIMUS Z690 EXTREME GLACIAL", ++ "ROG STRIX B650-A GAMING WIFI", ++ "ROG STRIX B650E-E GAMING WIFI", ++ "ROG STRIX B650E-F GAMING WIFI", ++ "ROG STRIX B650E-I GAMING WIFI", ++ "ROG STRIX B660-A GAMING WIFI D4", ++ "ROG STRIX B660-F GAMING WIFI", ++ "ROG STRIX B660-G GAMING WIFI", ++ "ROG STRIX B660-I GAMING WIFI", ++ "ROG STRIX X670E-A GAMING WIFI", ++ "ROG STRIX X670E-E GAMING WIFI", ++ "ROG STRIX X670E-F GAMING WIFI", ++ "ROG STRIX X670E-I GAMING WIFI", ++ "ROG STRIX Z590-A GAMING WIFI II", ++ "ROG STRIX Z690-A GAMING WIFI D4", ++ "TUF GAMING B650-PLUS", ++ "TUF GAMING B650-PLUS WIFI", ++ "TUF GAMING B650M-PLUS", ++ "TUF GAMING B650M-PLUS WIFI", ++ "TUF GAMING B660M-PLUS WIFI", ++ "TUF GAMING X670E-PLUS", ++ "TUF GAMING X670E-PLUS WIFI", ++ "TUF GAMING Z590-PLUS WIFI", ++}; ++ + #if IS_ENABLED(CONFIG_ACPI) + /* + * Callback for acpi_bus_for_each_dev() to find the right device +@@ -1171,6 +1218,11 @@ static int __init sensors_nct6775_platform_init(void) + board_name); + if (err >= 0) + access = nct6775_determine_access(ASUSWMI_DEVICE_UID); ++ ++ err = match_string(asus_msi_boards, ARRAY_SIZE(asus_msi_boards), ++ board_name); ++ if (err >= 0) ++ access = nct6775_determine_access(ASUSMSI_DEVICE_UID); + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-723-pinctrl-at91-use-devm_kasprintf-to-avoid-potent.patch b/patches.kernel.org/6.2.3-723-pinctrl-at91-use-devm_kasprintf-to-avoid-potent.patch new file mode 100644 index 0000000..bf8888c --- /dev/null +++ b/patches.kernel.org/6.2.3-723-pinctrl-at91-use-devm_kasprintf-to-avoid-potent.patch @@ -0,0 +1,54 @@ +From: Claudiu Beznea +Date: Fri, 3 Feb 2023 15:27:14 +0200 +Subject: [PATCH] pinctrl: at91: use devm_kasprintf() to avoid potential leaks +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1c4e5c470a56f7f7c649c0c70e603abc1eab15c4 + +[ Upstream commit 1c4e5c470a56f7f7c649c0c70e603abc1eab15c4 ] + +Use devm_kasprintf() instead of kasprintf() to avoid any potential +leaks. At the moment drivers have no remove functionality thus +there is no need for fixes tag. + +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230203132714.1931596-1-claudiu.beznea@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 4 ++-- + drivers/pinctrl/pinctrl-at91.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c +index 39b233f7..373eed8b 100644 +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -1149,8 +1149,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev) + + pin_desc[i].number = i; + /* Pin naming convention: P(bank_name)(bank_pin_number). */ +- pin_desc[i].name = kasprintf(GFP_KERNEL, "P%c%d", +- bank + 'A', line); ++ pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d", ++ bank + 'A', line); + + group->name = group_names[i] = pin_desc[i].name; + group->pin = pin_desc[i].number; +diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c +index 1e1813d7..c405296e 100644 +--- a/drivers/pinctrl/pinctrl-at91.c ++++ b/drivers/pinctrl/pinctrl-at91.c +@@ -1885,7 +1885,7 @@ static int at91_gpio_probe(struct platform_device *pdev) + } + + for (i = 0; i < chip->ngpio; i++) +- names[i] = kasprintf(GFP_KERNEL, "pio%c%d", alias_idx + 'A', i); ++ names[i] = devm_kasprintf(&pdev->dev, GFP_KERNEL, "pio%c%d", alias_idx + 'A', i); + + chip->names = (const char *const *)names; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-724-drm-amd-display-Do-not-commit-pipe-when-updatin.patch b/patches.kernel.org/6.2.3-724-drm-amd-display-Do-not-commit-pipe-when-updatin.patch new file mode 100644 index 0000000..3bda5fe --- /dev/null +++ b/patches.kernel.org/6.2.3-724-drm-amd-display-Do-not-commit-pipe-when-updatin.patch @@ -0,0 +1,130 @@ +From: Wesley Chalmers +Date: Fri, 4 Nov 2022 15:19:22 -0400 +Subject: [PATCH] drm/amd/display: Do not commit pipe when updating DRR +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8f0d304d21b351d65e8c434c5399a40231876ba1 + +[ Upstream commit 8f0d304d21b351d65e8c434c5399a40231876ba1 ] + +[WHY] +DRR and Pipe cannot be updated on +the same frame, or else underflow will +occur. + +Reviewed-by: Jun Lei +Acked-by: Qingqing Zhuo +Signed-off-by: Wesley Chalmers +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 15 +++++++++++++++ + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h | 3 ++- + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c | 9 +++++++++ + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h | 2 ++ + .../drm/amd/display/dc/inc/hw/timing_generator.h | 1 + + 5 files changed, 29 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index c03e86e4..698ef50e 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -3335,6 +3335,21 @@ static void commit_planes_for_stream(struct dc *dc, + + dc_z10_restore(dc); + ++ if (update_type == UPDATE_TYPE_FULL) { ++ /* wait for all double-buffer activity to clear on all pipes */ ++ int pipe_idx; ++ ++ for (pipe_idx = 0; pipe_idx < dc->res_pool->pipe_count; pipe_idx++) { ++ struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[pipe_idx]; ++ ++ if (!pipe_ctx->stream) ++ continue; ++ ++ if (pipe_ctx->stream_res.tg->funcs->wait_drr_doublebuffer_pending_clear) ++ pipe_ctx->stream_res.tg->funcs->wait_drr_doublebuffer_pending_clear(pipe_ctx->stream_res.tg); ++ } ++ } ++ + if (get_seamless_boot_stream_count(context) > 0 && surface_count > 0) { + /* Optimize seamless boot flag keeps clocks and watermarks high until + * first flip. After first flip, optimization is required to lower +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h +index 88ac5f6f..0b37bb0e 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h +@@ -519,7 +519,8 @@ struct dcn_optc_registers { + type OTG_CRC_DATA_STREAM_COMBINE_MODE;\ + type OTG_CRC_DATA_STREAM_SPLIT_MODE;\ + type OTG_CRC_DATA_FORMAT;\ +- type OTG_V_TOTAL_LAST_USED_BY_DRR; ++ type OTG_V_TOTAL_LAST_USED_BY_DRR;\ ++ type OTG_DRR_TIMING_DBUF_UPDATE_PENDING; + + #define TG_REG_FIELD_LIST_DCN3_2(type) \ + type OTG_H_TIMING_DIV_MODE_MANUAL; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c +index 867d6015..08b92715 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c +@@ -291,6 +291,14 @@ static void optc3_set_timing_double_buffer(struct timing_generator *optc, bool e + OTG_DRR_TIMING_DBUF_UPDATE_MODE, mode); + } + ++void optc3_wait_drr_doublebuffer_pending_clear(struct timing_generator *optc) ++{ ++ struct optc *optc1 = DCN10TG_FROM_TG(optc); ++ ++ REG_WAIT(OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_PENDING, 0, 2, 100000); /* 1 vupdate at 5hz */ ++ ++} ++ + void optc3_set_vtotal_min_max(struct timing_generator *optc, int vtotal_min, int vtotal_max) + { + optc1_set_vtotal_min_max(optc, vtotal_min, vtotal_max); +@@ -360,6 +368,7 @@ static struct timing_generator_funcs dcn30_tg_funcs = { + .program_manual_trigger = optc2_program_manual_trigger, + .setup_manual_trigger = optc2_setup_manual_trigger, + .get_hw_timing = optc1_get_hw_timing, ++ .wait_drr_doublebuffer_pending_clear = optc3_wait_drr_doublebuffer_pending_clear, + }; + + void dcn30_timing_generator_init(struct optc *optc1) +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h +index dd45a549..fb06dc9a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h +@@ -279,6 +279,7 @@ + SF(OTG0_OTG_DRR_TRIGGER_WINDOW, OTG_DRR_TRIGGER_WINDOW_END_X, mask_sh),\ + SF(OTG0_OTG_DRR_V_TOTAL_CHANGE, OTG_DRR_V_TOTAL_CHANGE_LIMIT, mask_sh),\ + SF(OTG0_OTG_H_TIMING_CNTL, OTG_H_TIMING_DIV_BY2, mask_sh),\ ++ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_PENDING, mask_sh),\ + SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_MODE, mask_sh),\ + SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_BLANK_DATA_DOUBLE_BUFFER_EN, mask_sh) + +@@ -317,6 +318,7 @@ + SF(OTG0_OTG_DRR_TRIGGER_WINDOW, OTG_DRR_TRIGGER_WINDOW_END_X, mask_sh),\ + SF(OTG0_OTG_DRR_V_TOTAL_CHANGE, OTG_DRR_V_TOTAL_CHANGE_LIMIT, mask_sh),\ + SF(OTG0_OTG_H_TIMING_CNTL, OTG_H_TIMING_DIV_MODE, mask_sh),\ ++ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_PENDING, mask_sh),\ + SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_MODE, mask_sh) + + void dcn30_timing_generator_init(struct optc *optc1); +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h +index 0e42e721..1d9f9c53 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h +@@ -331,6 +331,7 @@ struct timing_generator_funcs { + uint32_t vtotal_change_limit); + + void (*init_odm)(struct timing_generator *tg); ++ void (*wait_drr_doublebuffer_pending_clear)(struct timing_generator *tg); + }; + + #endif +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-725-scsi-snic-Fix-memory-leak-with-using-debugfs_lo.patch b/patches.kernel.org/6.2.3-725-scsi-snic-Fix-memory-leak-with-using-debugfs_lo.patch new file mode 100644 index 0000000..6b902a3 --- /dev/null +++ b/patches.kernel.org/6.2.3-725-scsi-snic-Fix-memory-leak-with-using-debugfs_lo.patch @@ -0,0 +1,45 @@ +From: Greg Kroah-Hartman +Date: Thu, 2 Feb 2023 15:10:09 +0100 +Subject: [PATCH] scsi: snic: Fix memory leak with using debugfs_lookup() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ad0e4e2fab928477f74d742e6e77d79245d3d3e7 + +[ Upstream commit ad0e4e2fab928477f74d742e6e77d79245d3d3e7 ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic at +once. + +Link: https://lore.kernel.org/r/20230202141009.2290380-1-gregkh@linuxfoundation.org +Cc: Karan Tilak Kumar +Cc: Sesidhar Baddela +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: linux-scsi@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/scsi/snic/snic_debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/snic/snic_debugfs.c b/drivers/scsi/snic/snic_debugfs.c +index 57bdc3ba..9dd975b3 100644 +--- a/drivers/scsi/snic/snic_debugfs.c ++++ b/drivers/scsi/snic/snic_debugfs.c +@@ -437,6 +437,6 @@ void snic_trc_debugfs_init(void) + void + snic_trc_debugfs_term(void) + { +- debugfs_remove(debugfs_lookup(TRC_FILE, snic_glob->trc_root)); +- debugfs_remove(debugfs_lookup(TRC_ENABLE_FILE, snic_glob->trc_root)); ++ debugfs_lookup_and_remove(TRC_FILE, snic_glob->trc_root); ++ debugfs_lookup_and_remove(TRC_ENABLE_FILE, snic_glob->trc_root); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-726-scsi-ufs-core-Fix-device-management-cmd-timeout.patch b/patches.kernel.org/6.2.3-726-scsi-ufs-core-Fix-device-management-cmd-timeout.patch new file mode 100644 index 0000000..91c1ef1 --- /dev/null +++ b/patches.kernel.org/6.2.3-726-scsi-ufs-core-Fix-device-management-cmd-timeout.patch @@ -0,0 +1,76 @@ +From: Mason Zhang +Date: Fri, 16 Dec 2022 11:25:33 +0800 +Subject: [PATCH] scsi: ufs: core: Fix device management cmd timeout flow +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 36822124f9de200cedc2f42516301b50d386a6cd + +[ Upstream commit 36822124f9de200cedc2f42516301b50d386a6cd ] + +In the UFS error handling flow, the host will send a device management cmd +(NOP OUT) to the device for link recovery. If this cmd times out and +clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and +return. hba->dev_cmd.complete struct is not set to NULL. + +When this happens, if cmd has been completed by device, then we will call +complete() in __ufshcd_transfer_req_compl(). Because the complete struct is +allocated on the stack, the following crash will occur: + + ipanic_die+0x24/0x38 [mrdump] + die+0x344/0x748 + arm64_notify_die+0x44/0x104 + do_debug_exception+0x104/0x1e0 + el1_dbg+0x38/0x54 + el1_sync_handler+0x40/0x88 + el1_sync+0x8c/0x140 + queued_spin_lock_slowpath+0x2e4/0x3c0 + __ufshcd_transfer_req_compl+0x3b0/0x1164 + ufshcd_trc_handler+0x15c/0x308 + ufshcd_host_reset_and_restore+0x54/0x260 + ufshcd_reset_and_restore+0x28c/0x57c + ufshcd_err_handler+0xeb8/0x1b6c + process_one_work+0x288/0x964 + worker_thread+0x4bc/0xc7c + kthread+0x15c/0x264 + ret_from_fork+0x10/0x30 + +Link: https://lore.kernel.org/r/20221216032532.1280-1-mason.zhang@mediatek.com +Signed-off-by: Mason Zhang +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/ufs/core/ufshcd.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index fd6f421f..2ddc1aba 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -3008,6 +3008,22 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, + } else { + dev_err(hba->dev, "%s: failed to clear tag %d\n", + __func__, lrbp->task_tag); ++ ++ spin_lock_irqsave(&hba->outstanding_lock, flags); ++ pending = test_bit(lrbp->task_tag, ++ &hba->outstanding_reqs); ++ if (pending) ++ hba->dev_cmd.complete = NULL; ++ spin_unlock_irqrestore(&hba->outstanding_lock, flags); ++ ++ if (!pending) { ++ /* ++ * The completion handler ran while we tried to ++ * clear the command. ++ */ ++ time_left = 1; ++ goto retry; ++ } + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-727-HID-logitech-hidpp-Don-t-restart-communication-.patch b/patches.kernel.org/6.2.3-727-HID-logitech-hidpp-Don-t-restart-communication-.patch new file mode 100644 index 0000000..2878e6f --- /dev/null +++ b/patches.kernel.org/6.2.3-727-HID-logitech-hidpp-Don-t-restart-communication-.patch @@ -0,0 +1,98 @@ +From: Bastien Nocera +Date: Wed, 25 Jan 2023 13:17:22 +0100 +Subject: [PATCH] HID: logitech-hidpp: Don't restart communication if not + necessary +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 498ba20690357691103de0f766960355247c78be + +[ Upstream commit 498ba20690357691103de0f766960355247c78be ] + +Don't stop and restart communication with the device unless we need to +modify the connect flags used because of a device quirk. + +Signed-off-by: Bastien Nocera +Link: https://lore.kernel.org/r/20230125121723.3122-1-hadess@hadess.net +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/hid/hid-logitech-hidpp.c | 32 ++++++++++++++++++++------------ + 1 file changed, 20 insertions(+), 12 deletions(-) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 0c024ec1..5efc591a 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -4102,6 +4102,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + bool connected; + unsigned int connect_mask = HID_CONNECT_DEFAULT; + struct hidpp_ff_private_data data; ++ bool will_restart = false; + + /* report_fixup needs drvdata to be set before we call hid_parse */ + hidpp = devm_kzalloc(&hdev->dev, sizeof(*hidpp), GFP_KERNEL); +@@ -4157,6 +4158,10 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + return ret; + } + ++ if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT || ++ hidpp->quirks & HIDPP_QUIRK_UNIFYING) ++ will_restart = true; ++ + INIT_WORK(&hidpp->work, delayed_work_cb); + mutex_init(&hidpp->send_mutex); + init_waitqueue_head(&hidpp->wait); +@@ -4171,7 +4176,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + * Plain USB connections need to actually call start and open + * on the transport driver to allow incoming data. + */ +- ret = hid_hw_start(hdev, 0); ++ ret = hid_hw_start(hdev, will_restart ? 0 : connect_mask); + if (ret) { + hid_err(hdev, "hw start failed\n"); + goto hid_hw_start_fail; +@@ -4208,6 +4213,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + hidpp->wireless_feature_index = 0; + else if (ret) + goto hid_hw_init_fail; ++ ret = 0; + } + + if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) { +@@ -4222,19 +4228,21 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + + hidpp_connect_event(hidpp); + +- /* Reset the HID node state */ +- hid_device_io_stop(hdev); +- hid_hw_close(hdev); +- hid_hw_stop(hdev); ++ if (will_restart) { ++ /* Reset the HID node state */ ++ hid_device_io_stop(hdev); ++ hid_hw_close(hdev); ++ hid_hw_stop(hdev); + +- if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) +- connect_mask &= ~HID_CONNECT_HIDINPUT; ++ if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) ++ connect_mask &= ~HID_CONNECT_HIDINPUT; + +- /* Now export the actual inputs and hidraw nodes to the world */ +- ret = hid_hw_start(hdev, connect_mask); +- if (ret) { +- hid_err(hdev, "%s:hid_hw_start returned error\n", __func__); +- goto hid_hw_start_fail; ++ /* Now export the actual inputs and hidraw nodes to the world */ ++ ret = hid_hw_start(hdev, connect_mask); ++ if (ret) { ++ hid_err(hdev, "%s:hid_hw_start returned error\n", __func__); ++ goto hid_hw_start_fail; ++ } + } + + if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-728-drm-amd-display-Enable-P-state-validation-check.patch b/patches.kernel.org/6.2.3-728-drm-amd-display-Enable-P-state-validation-check.patch new file mode 100644 index 0000000..bf1ee34 --- /dev/null +++ b/patches.kernel.org/6.2.3-728-drm-amd-display-Enable-P-state-validation-check.patch @@ -0,0 +1,43 @@ +From: Nicholas Kazlauskas +Date: Fri, 27 Jan 2023 10:03:45 -0500 +Subject: [PATCH] drm/amd/display: Enable P-state validation checks for DCN314 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 37d184b548db0f64d4a878960b2c6988b38a3e7e + +[ Upstream commit 37d184b548db0f64d4a878960b2c6988b38a3e7e ] + +[Why] +To align with DCN31 behavior. This helps avoid p-state hangs in +the case where underflow does occur. + +[How] +Flip the bit to true. + +Reviewed-by: Hansen Dsouza +Acked-by: Qingqing Zhuo +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +index 79850a68..bc7f2b73 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +@@ -901,7 +901,7 @@ static const struct dc_debug_options debug_defaults_drv = { + .max_downscale_src_width = 4096,/*upto true 4k*/ + .disable_pplib_wm_range = false, + .scl_reset_length10 = true, +- .sanity_checks = false, ++ .sanity_checks = true, + .underflow_assert_delay_us = 0xFFFFFFFF, + .dwb_fi_phase = -1, // -1 = disable, + .dmub_command_table = true, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-729-drm-panel-orientation-quirks-Add-quirk-for-Leno.patch b/patches.kernel.org/6.2.3-729-drm-panel-orientation-quirks-Add-quirk-for-Leno.patch new file mode 100644 index 0000000..a688642 --- /dev/null +++ b/patches.kernel.org/6.2.3-729-drm-panel-orientation-quirks-Add-quirk-for-Leno.patch @@ -0,0 +1,43 @@ +From: Darrell Kavanagh +Date: Tue, 14 Feb 2023 16:46:59 +0000 +Subject: [PATCH] drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad + Duet 3 10IGL5 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 38b2d8efd03d2e56431b611e3523f0158306451d + +[ Upstream commit 38b2d8efd03d2e56431b611e3523f0158306451d ] + +Another Lenovo convertable where the panel is installed landscape but is +reported to the kernel as portrait. + +Signed-off-by: Darrell Kavanagh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20230214164659.3583-1-darrell.kavanagh@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index b409fe25..5522d610 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -322,6 +322,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGL"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* Lenovo IdeaPad Duet 3 10IGL5 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Duet 3 10IGL5"), ++ }, ++ .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* Lenovo Yoga Book X90F / X91F / X91L */ + .matches = { + /* Non exact match to match all versions */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-730-drm-amd-display-Disable-HUBP-DPP-PG-on-DCN314-f.patch b/patches.kernel.org/6.2.3-730-drm-amd-display-Disable-HUBP-DPP-PG-on-DCN314-f.patch new file mode 100644 index 0000000..505bb5c --- /dev/null +++ b/patches.kernel.org/6.2.3-730-drm-amd-display-Disable-HUBP-DPP-PG-on-DCN314-f.patch @@ -0,0 +1,43 @@ +From: Nicholas Kazlauskas +Date: Thu, 2 Feb 2023 15:15:51 -0500 +Subject: [PATCH] drm/amd/display: Disable HUBP/DPP PG on DCN314 for now +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b7c67f72408b11b922f23f06c7df0f6743a2e89d + +[ Upstream commit b7c67f72408b11b922f23f06c7df0f6743a2e89d ] + +[Why] +The DMCUB implementation required to workaround corruption is +not currently stable and may cause intermittent corruption or hangs. + +[How] +Disable PG until the sequence is stable. + +Reviewed-by: Hansen Dsouza +Acked-by: Qingqing Zhuo +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +index bc7f2b73..73f519db 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +@@ -892,6 +892,8 @@ static const struct dc_debug_options debug_defaults_drv = { + .force_abm_enable = false, + .timing_trace = false, + .clock_trace = true, ++ .disable_dpp_power_gate = true, ++ .disable_hubp_power_gate = true, + .disable_pplib_clock_request = false, + .pipe_split_policy = MPC_SPLIT_DYNAMIC, + .force_single_disp_pipe_split = false, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-731-drm-amd-display-disable-SubVP-DRR-to-prevent-un.patch b/patches.kernel.org/6.2.3-731-drm-amd-display-disable-SubVP-DRR-to-prevent-un.patch new file mode 100644 index 0000000..e95bd06 --- /dev/null +++ b/patches.kernel.org/6.2.3-731-drm-amd-display-disable-SubVP-DRR-to-prevent-un.patch @@ -0,0 +1,96 @@ +From: Aurabindo Pillai +Date: Wed, 15 Feb 2023 12:51:20 -0500 +Subject: [PATCH] drm/amd/display: disable SubVP + DRR to prevent underflow +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 80c6d6804f31451848a3956a70c2bcb1f07cfcb0 + +[ Upstream commit 80c6d6804f31451848a3956a70c2bcb1f07cfcb0 ] + +[Why&How] +Temporarily disable SubVP+DRR since Xorg has an architectural limitation +where freesync will not work in a multi monitor configuration. SubVP+DRR +requires that freesync be working. + +Whether OS has variable refresh setting enabled or not, the state on +the crtc remains same unless an application requests VRR. Due to this, +there is no way to know whether freesync will actually work or not +while we are on the desktop from the kernel's perspective. + +If userspace does not have a limitation with multi-display freesync (for +example wayland), then this feature can be enabled by adding a +dcfeaturemask option to amdgpu on the kernel cmdline like: + +amdgpu.dcfeaturemask=0x200 + +Signed-off-by: Aurabindo Pillai +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +++++ + drivers/gpu/drm/amd/display/dc/dc.h | 2 +- + drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 ++++ + drivers/gpu/drm/amd/include/amd_shared.h | 1 + + 4 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 027ffa5c..1ba8a290 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1551,6 +1551,11 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + if (amdgpu_dc_feature_mask & DC_DISABLE_LTTPR_DP2_0) + init_data.flags.allow_lttpr_non_transparent_mode.bits.DP2_0 = true; + ++ /* Disable SubVP + DRR config by default */ ++ init_data.flags.disable_subvp_drr = true; ++ if (amdgpu_dc_feature_mask & DC_ENABLE_SUBVP_DRR) ++ init_data.flags.disable_subvp_drr = false; ++ + init_data.flags.seamless_boot_edp_requested = false; + + if (check_seamless_boot_capability(adev)) { +diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h +index 85ebeaa2..37998dc0 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc.h ++++ b/drivers/gpu/drm/amd/display/dc/dc.h +@@ -410,7 +410,7 @@ struct dc_config { + bool force_bios_enable_lttpr; + uint8_t force_bios_fixed_vs; + int sdpif_request_limit_words_per_umc; +- ++ bool disable_subvp_drr; + }; + + enum visual_confirm { +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +index 8450f59c..69e205ac 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +@@ -877,6 +877,10 @@ static bool subvp_drr_schedulable(struct dc *dc, struct dc_state *context, struc + int16_t stretched_drr_us = 0; + int16_t drr_stretched_vblank_us = 0; + int16_t max_vblank_mallregion = 0; ++ const struct dc_config *config = &dc->config; ++ ++ if (config->disable_subvp_drr) ++ return false; + + // Find SubVP pipe + for (i = 0; i < dc->res_pool->pipe_count; i++) { +diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h +index f175e65b..e4a22c68 100644 +--- a/drivers/gpu/drm/amd/include/amd_shared.h ++++ b/drivers/gpu/drm/amd/include/amd_shared.h +@@ -240,6 +240,7 @@ enum DC_FEATURE_MASK { + DC_DISABLE_LTTPR_DP2_0 = (1 << 6), //0x40, disabled by default + DC_PSR_ALLOW_SMU_OPT = (1 << 7), //0x80, disabled by default + DC_PSR_ALLOW_MULTI_DISP_OPT = (1 << 8), //0x100, disabled by default ++ DC_ENABLE_SUBVP_DRR = (1 << 9), // 0x200, disabled by default + }; + + enum DC_DEBUG_MASK { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-732-dm-thin-add-cond_resched-to-various-workqueue-l.patch b/patches.kernel.org/6.2.3-732-dm-thin-add-cond_resched-to-various-workqueue-l.patch new file mode 100644 index 0000000..e3bdacb --- /dev/null +++ b/patches.kernel.org/6.2.3-732-dm-thin-add-cond_resched-to-various-workqueue-l.patch @@ -0,0 +1,42 @@ +From: Mike Snitzer +Date: Thu, 16 Feb 2023 15:29:44 -0500 +Subject: [PATCH] dm thin: add cond_resched() to various workqueue loops +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e4f80303c2353952e6e980b23914e4214487f2a6 + +[ Upstream commit e4f80303c2353952e6e980b23914e4214487f2a6 ] + +Otherwise on resource constrained systems these workqueues may be too +greedy. + +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-thin.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 64cfcf46..e4c1a8a2 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2207,6 +2207,7 @@ static void process_thin_deferred_bios(struct thin_c *tc) + throttle_work_update(&pool->throttle); + dm_pool_issue_prefetches(pool->pmd); + } ++ cond_resched(); + } + blk_finish_plug(&plug); + } +@@ -2289,6 +2290,7 @@ static void process_thin_deferred_cells(struct thin_c *tc) + else + pool->process_cell(tc, cell); + } ++ cond_resched(); + } while (!list_empty(&cells)); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-733-dm-cache-add-cond_resched-to-various-workqueue-.patch b/patches.kernel.org/6.2.3-733-dm-cache-add-cond_resched-to-various-workqueue-.patch new file mode 100644 index 0000000..af74b52 --- /dev/null +++ b/patches.kernel.org/6.2.3-733-dm-cache-add-cond_resched-to-various-workqueue-.patch @@ -0,0 +1,51 @@ +From: Mike Snitzer +Date: Thu, 16 Feb 2023 15:31:08 -0500 +Subject: [PATCH] dm cache: add cond_resched() to various workqueue loops +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 76227f6dc805e9e960128bcc6276647361e0827c + +[ Upstream commit 76227f6dc805e9e960128bcc6276647361e0827c ] + +Otherwise on resource constrained systems these workqueues may be too +greedy. + +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-cache-target.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 5e92fac9..17fde3e5 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -1805,6 +1805,7 @@ static void process_deferred_bios(struct work_struct *ws) + + else + commit_needed = process_bio(cache, bio) || commit_needed; ++ cond_resched(); + } + + if (commit_needed) +@@ -1827,6 +1828,7 @@ static void requeue_deferred_bios(struct cache *cache) + while ((bio = bio_list_pop(&bios))) { + bio->bi_status = BLK_STS_DM_REQUEUE; + bio_endio(bio); ++ cond_resched(); + } + } + +@@ -1867,6 +1869,8 @@ static void check_migrations(struct work_struct *ws) + r = mg_start(cache, op, NULL); + if (r) + break; ++ ++ cond_resched(); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-734-nfsd-zero-out-pointers-after-putting-nfsd_files.patch b/patches.kernel.org/6.2.3-734-nfsd-zero-out-pointers-after-putting-nfsd_files.patch new file mode 100644 index 0000000..5b9eaad --- /dev/null +++ b/patches.kernel.org/6.2.3-734-nfsd-zero-out-pointers-after-putting-nfsd_files.patch @@ -0,0 +1,44 @@ +From: Jeff Layton +Date: Tue, 17 Jan 2023 14:38:30 -0500 +Subject: [PATCH] nfsd: zero out pointers after putting nfsd_files on COPY + setup error +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1f0001d43d0c0ac2a19a34a914f6595ad97cbc1d + +[ Upstream commit 1f0001d43d0c0ac2a19a34a914f6595ad97cbc1d ] + +At first, I thought this might be a source of nfsd_file overputs, but +the current callers seem to avoid an extra put when nfsd4_verify_copy +returns an error. + +Still, it's "bad form" to leave the pointers filled out when we don't +have a reference to them anymore, and that might lead to bugs later. +Zero them out as a defensive coding measure. + +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4proc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 92674077..e02ff76f 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1214,8 +1214,10 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + return status; + out_put_dst: + nfsd_file_put(*dst); ++ *dst = NULL; + out_put_src: + nfsd_file_put(*src); ++ *src = NULL; + goto out; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-735-nfsd-don-t-hand-out-delegation-on-setuid-files-.patch b/patches.kernel.org/6.2.3-735-nfsd-don-t-hand-out-delegation-on-setuid-files-.patch new file mode 100644 index 0000000..060eb2b --- /dev/null +++ b/patches.kernel.org/6.2.3-735-nfsd-don-t-hand-out-delegation-on-setuid-files-.patch @@ -0,0 +1,97 @@ +From: Jeff Layton +Date: Fri, 27 Jan 2023 07:09:33 -0500 +Subject: [PATCH] nfsd: don't hand out delegation on setuid files being opened + for write +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 826b67e6376c2a788e3a62c4860dcd79500a27d5 + +[ Upstream commit 826b67e6376c2a788e3a62c4860dcd79500a27d5 ] + +We had a bug report that xfstest generic/355 was failing on NFSv4.0. +This test sets various combinations of setuid/setgid modes and tests +whether DIO writes will cause them to be stripped. + +What I found was that the server did properly strip those bits, but +the client didn't notice because it held a delegation that was not +recalled. The recall didn't occur because the client itself was the +one generating the activity and we avoid recalls in that case. + +Clearing setuid bits is an "implicit" activity. The client didn't +specifically request that we do that, so we need the server to issue a +CB_RECALL, or avoid the situation entirely by not issuing a delegation. + +The easiest fix here is to simply not give out a delegation if the file +is being opened for write, and the mode has the setuid and/or setgid bit +set. Note that there is a potential race between the mode and lease +being set, so we test for this condition both before and after setting +the lease. + +This patch fixes generic/355, generic/683 and generic/684 for me. (Note +that 355 fails only on v4.0, and 683 and 684 require NFSv4.2 to run and +fail). + +Reported-by: Boyang Xue +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/nfsd/nfs4state.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 104c2582..8852a051 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -5440,6 +5440,23 @@ nfsd4_verify_deleg_dentry(struct nfsd4_open *open, struct nfs4_file *fp, + return 0; + } + ++/* ++ * We avoid breaking delegations held by a client due to its own activity, but ++ * clearing setuid/setgid bits on a write is an implicit activity and the client ++ * may not notice and continue using the old mode. Avoid giving out a delegation ++ * on setuid/setgid files when the client is requesting an open for write. ++ */ ++static int ++nfsd4_verify_setuid_write(struct nfsd4_open *open, struct nfsd_file *nf) ++{ ++ struct inode *inode = file_inode(nf->nf_file); ++ ++ if ((open->op_share_access & NFS4_SHARE_ACCESS_WRITE) && ++ (inode->i_mode & (S_ISUID|S_ISGID))) ++ return -EAGAIN; ++ return 0; ++} ++ + static struct nfs4_delegation * + nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, + struct svc_fh *parent) +@@ -5473,6 +5490,8 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, + spin_lock(&fp->fi_lock); + if (nfs4_delegation_exists(clp, fp)) + status = -EAGAIN; ++ else if (nfsd4_verify_setuid_write(open, nf)) ++ status = -EAGAIN; + else if (!fp->fi_deleg_file) { + fp->fi_deleg_file = nf; + /* increment early to prevent fi_deleg_file from being +@@ -5513,6 +5532,14 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, + if (status) + goto out_unlock; + ++ /* ++ * Now that the deleg is set, check again to ensure that nothing ++ * raced in and changed the mode while we weren't lookng. ++ */ ++ status = nfsd4_verify_setuid_write(open, fp->fi_deleg_file); ++ if (status) ++ goto out_unlock; ++ + spin_lock(&state_lock); + spin_lock(&fp->fi_lock); + if (fp->fi_had_conflict) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-736-cifs-prevent-data-race-in-smb2_reconnect.patch b/patches.kernel.org/6.2.3-736-cifs-prevent-data-race-in-smb2_reconnect.patch new file mode 100644 index 0000000..534952b --- /dev/null +++ b/patches.kernel.org/6.2.3-736-cifs-prevent-data-race-in-smb2_reconnect.patch @@ -0,0 +1,170 @@ +From: Paulo Alcantara +Date: Mon, 30 Jan 2023 20:33:29 -0300 +Subject: [PATCH] cifs: prevent data race in smb2_reconnect() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3c0070f54b3128de498c2dd9934a21f0dd867111 + +[ Upstream commit 3c0070f54b3128de498c2dd9934a21f0dd867111 ] + +Make sure to get an up-to-date TCP_Server_Info::nr_targets value prior +to waiting the server to be reconnected in smb2_reconnect(). It is +set in cifs_tcp_ses_needs_reconnect() and protected by +TCP_Server_Info::srv_lock. + +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2pdu.c | 119 +++++++++++++++++++++++++--------------------- + 1 file changed, 64 insertions(+), 55 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 3b93680a..5a063af8 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -139,6 +139,66 @@ smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, + return; + } + ++static int wait_for_server_reconnect(struct TCP_Server_Info *server, ++ __le16 smb2_command, bool retry) ++{ ++ int timeout = 10; ++ int rc; ++ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus != CifsNeedReconnect) { ++ spin_unlock(&server->srv_lock); ++ return 0; ++ } ++ timeout *= server->nr_targets; ++ spin_unlock(&server->srv_lock); ++ ++ /* ++ * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE ++ * here since they are implicitly done when session drops. ++ */ ++ switch (smb2_command) { ++ /* ++ * BB Should we keep oplock break and add flush to exceptions? ++ */ ++ case SMB2_TREE_DISCONNECT: ++ case SMB2_CANCEL: ++ case SMB2_CLOSE: ++ case SMB2_OPLOCK_BREAK: ++ return -EAGAIN; ++ } ++ ++ /* ++ * Give demultiplex thread up to 10 seconds to each target available for ++ * reconnect -- should be greater than cifs socket timeout which is 7 ++ * seconds. ++ * ++ * On "soft" mounts we wait once. Hard mounts keep retrying until ++ * process is killed or server comes back on-line. ++ */ ++ do { ++ rc = wait_event_interruptible_timeout(server->response_q, ++ (server->tcpStatus != CifsNeedReconnect), ++ timeout * HZ); ++ if (rc < 0) { ++ cifs_dbg(FYI, "%s: aborting reconnect due to received signal\n", ++ __func__); ++ return -ERESTARTSYS; ++ } ++ ++ /* are we still trying to reconnect? */ ++ spin_lock(&server->srv_lock); ++ if (server->tcpStatus != CifsNeedReconnect) { ++ spin_unlock(&server->srv_lock); ++ return 0; ++ } ++ spin_unlock(&server->srv_lock); ++ } while (retry); ++ ++ cifs_dbg(FYI, "%s: gave up waiting on reconnect\n", __func__); ++ return -EHOSTDOWN; ++} ++ + static int + smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + struct TCP_Server_Info *server) +@@ -146,7 +206,6 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + int rc = 0; + struct nls_table *nls_codepage; + struct cifs_ses *ses; +- int retries; + + /* + * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so +@@ -184,61 +243,11 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + (!tcon->ses->server) || !server) + return -EIO; + +- ses = tcon->ses; +- retries = server->nr_targets; +- +- /* +- * Give demultiplex thread up to 10 seconds to each target available for +- * reconnect -- should be greater than cifs socket timeout which is 7 +- * seconds. +- */ +- while (server->tcpStatus == CifsNeedReconnect) { +- /* +- * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE +- * here since they are implicitly done when session drops. +- */ +- switch (smb2_command) { +- /* +- * BB Should we keep oplock break and add flush to exceptions? +- */ +- case SMB2_TREE_DISCONNECT: +- case SMB2_CANCEL: +- case SMB2_CLOSE: +- case SMB2_OPLOCK_BREAK: +- return -EAGAIN; +- } +- +- rc = wait_event_interruptible_timeout(server->response_q, +- (server->tcpStatus != CifsNeedReconnect), +- 10 * HZ); +- if (rc < 0) { +- cifs_dbg(FYI, "%s: aborting reconnect due to a received signal by the process\n", +- __func__); +- return -ERESTARTSYS; +- } +- +- /* are we still trying to reconnect? */ +- spin_lock(&server->srv_lock); +- if (server->tcpStatus != CifsNeedReconnect) { +- spin_unlock(&server->srv_lock); +- break; +- } +- spin_unlock(&server->srv_lock); +- +- if (retries && --retries) +- continue; ++ rc = wait_for_server_reconnect(server, smb2_command, tcon->retry); ++ if (rc) ++ return rc; + +- /* +- * on "soft" mounts we wait once. Hard mounts keep +- * retrying until process is killed or server comes +- * back on-line +- */ +- if (!tcon->retry) { +- cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n"); +- return -EHOSTDOWN; +- } +- retries = server->nr_targets; +- } ++ ses = tcon->ses; + + spin_lock(&ses->chan_lock); + if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-737-drm-i915-mtl-Correct-implementation-of-Wa_18018.patch b/patches.kernel.org/6.2.3-737-drm-i915-mtl-Correct-implementation-of-Wa_18018.patch new file mode 100644 index 0000000..b943210 --- /dev/null +++ b/patches.kernel.org/6.2.3-737-drm-i915-mtl-Correct-implementation-of-Wa_18018.patch @@ -0,0 +1,148 @@ +From: Matt Roper +Date: Wed, 25 Jan 2023 15:41:58 -0800 +Subject: [PATCH] drm/i915/mtl: Correct implementation of Wa_18018781329 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: eda94a6e6a4f2d3d1574ff4f2bd4b9f844504f71 + +[ Upstream commit eda94a6e6a4f2d3d1574ff4f2bd4b9f844504f71 ] + +Workaround Wa_18018781329 has applied to several recent Xe_HP-based +platforms. However there are some extra gotchas to implementing this +properly for MTL that we need to take into account: + + * Due to the separation of media and render/compute into separate GTs, + this workaround needs to be implemented on each GT, not just the + primary GT. Since each class of register only exists on one of the + two GTs, we should program the appropriate registers on each GT. + + * As with past Xe_HP platforms, the registers on the primary GT (Xe_LPG + IP) are multicast/replicated registers and should be handled with the + MCR-aware functions. However the registers on the media GT (Xe_LPM+ + IP) are regular singleton registers and should _not_ use MCR + handling. We need to create separate register definitions for the + Xe_HP multicast form and the Xe_LPM+ singleton form and use each in + the appropriate place. + + * Starting with MTL, workarounds documented by the hardware teams are + technically associated with IP versions/steppings rather than + top-level platforms. That means we should take care to check the + media IP version rather than the graphics IP version when deciding + whether the workaround is needed on the Xe_LPM+ media GT (in this + case the workaround applies to both IPs and the stepping bounds are + identical, but we should still write the code appropriately to set a + proper precedent for future workaround implementations). + + * It's worth noting that the GSC register and the CCS register are + defined with the same MMIO offset (0xCF30). Since the CCS is only + relevant to the primary GT and the GSC is only relevant to the media + GT there isn't actually a clash here (the media GT automatically adds + the additional 0x380000 GSI offset). However there's currently a + glitch in the bspec where the CCS register doesn't show up at all and + the GSC register is listed as existing on both GTs. That's a known + documentation problem for several registers with shared GSC/CCS + offsets; rest assured that the CCS register really does still exist. + +Cc: Gustavo Sousa +Signed-off-by: Matt Roper +Fixes: 41bb543f5598 ("drm/i915/mtl: Add initial gt workarounds") +Reviewed-by: Gustavo Sousa +Link: https://patchwork.freedesktop.org/patch/msgid/20230125234159.3015385-2-matthew.d.roper@intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_gt_regs.h | 7 +++++-- + drivers/gpu/drm/i915/gt/intel_workarounds.c | 22 ++++++++++++++------- + drivers/gpu/drm/i915/i915_drv.h | 4 ++++ + 3 files changed, 24 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +index 3b6ef0eb..9758b0b6 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h ++++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h +@@ -1087,8 +1087,11 @@ + #define XEHP_MERT_MOD_CTRL MCR_REG(0xcf28) + #define RENDER_MOD_CTRL MCR_REG(0xcf2c) + #define COMP_MOD_CTRL MCR_REG(0xcf30) +-#define VDBX_MOD_CTRL MCR_REG(0xcf34) +-#define VEBX_MOD_CTRL MCR_REG(0xcf38) ++#define XELPMP_GSC_MOD_CTRL _MMIO(0xcf30) /* media GT only */ ++#define XEHP_VDBX_MOD_CTRL MCR_REG(0xcf34) ++#define XELPMP_VDBX_MOD_CTRL _MMIO(0xcf34) ++#define XEHP_VEBX_MOD_CTRL MCR_REG(0xcf38) ++#define XELPMP_VEBX_MOD_CTRL _MMIO(0xcf38) + #define FORCE_MISS_FTLB REG_BIT(3) + + #define XEHP_GAMSTLB_CTRL MCR_REG(0xcf4c) +diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c +index d92b006d..e13052c5 100644 +--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c +@@ -1678,8 +1678,8 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + /* Wa_18018781329 */ + wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, XEHP_VDBX_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, XEHP_VEBX_MOD_CTRL, FORCE_MISS_FTLB); + + /* Wa_1509235366:dg2 */ + wa_mcr_write_or(wal, XEHP_GAMCNTRL_CTRL, +@@ -1697,8 +1697,8 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + /* Wa_18018781329 */ + wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, XEHP_VDBX_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_mcr_write_or(wal, XEHP_VEBX_MOD_CTRL, FORCE_MISS_FTLB); + } + + static void +@@ -1712,8 +1712,6 @@ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + /* Wa_18018781329 */ + wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); +- wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); + } + + /* +@@ -1726,7 +1724,17 @@ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + static void + xelpmp_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) + { +- /* FIXME: Actual workarounds will be added in future patch(es) */ ++ if (IS_MTL_MEDIA_STEP(gt->i915, STEP_A0, STEP_B0)) { ++ /* ++ * Wa_18018781329 ++ * ++ * Note that although these registers are MCR on the primary ++ * GT, the media GT's versions are regular singleton registers. ++ */ ++ wa_write_or(wal, XELPMP_GSC_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_write_or(wal, XELPMP_VDBX_MOD_CTRL, FORCE_MISS_FTLB); ++ wa_write_or(wal, XELPMP_VEBX_MOD_CTRL, FORCE_MISS_FTLB); ++ } + + debug_dump_steering(gt); + } +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index a380db36..03c3a59d 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -726,6 +726,10 @@ IS_SUBPLATFORM(const struct drm_i915_private *i915, + (IS_SUBPLATFORM(__i915, INTEL_METEORLAKE, INTEL_SUBPLATFORM_##variant) && \ + IS_GRAPHICS_STEP(__i915, since, until)) + ++#define IS_MTL_MEDIA_STEP(__i915, since, until) \ ++ (IS_METEORLAKE(__i915) && \ ++ IS_MEDIA_STEP(__i915, since, until)) ++ + /* + * DG2 hardware steppings are a bit unusual. The hardware design was forked to + * create three variants (G10, G11, and G12) which each have distinct +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-738-drm-shmem-helper-Revert-accidental-non-GPL-expo.patch b/patches.kernel.org/6.2.3-738-drm-shmem-helper-Revert-accidental-non-GPL-expo.patch new file mode 100644 index 0000000..002d937 --- /dev/null +++ b/patches.kernel.org/6.2.3-738-drm-shmem-helper-Revert-accidental-non-GPL-expo.patch @@ -0,0 +1,40 @@ +From: Asahi Lina +Date: Mon, 27 Feb 2023 18:04:21 +0900 +Subject: [PATCH] drm/shmem-helper: Revert accidental non-GPL export +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 047a754558d640eaa080fce3b22ca9f3d4e04626 + +[ Upstream commit 047a754558d640eaa080fce3b22ca9f3d4e04626 ] + +The referenced commit added a wrapper for drm_gem_shmem_get_pages_sgt(), +but in the process it accidentally changed the export type from GPL to +non-GPL. Switch it back to GPL. + +Reported-by: Dmitry Osipenko +Fixes: ddddedaa0db9 ("drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()") +Signed-off-by: Asahi Lina +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20230227-shmem-export-fix-v1-1-8880b2c25e81@asahilina.net +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c +index 2c559b31..7af9da88 100644 +--- a/drivers/gpu/drm/drm_gem_shmem_helper.c ++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c +@@ -747,7 +747,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) + + return sgt; + } +-EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt); ++EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt); + + /** + * drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-739-driver-core-fw_devlink-Avoid-spurious-error-mes.patch b/patches.kernel.org/6.2.3-739-driver-core-fw_devlink-Avoid-spurious-error-mes.patch new file mode 100644 index 0000000..16d055d --- /dev/null +++ b/patches.kernel.org/6.2.3-739-driver-core-fw_devlink-Avoid-spurious-error-mes.patch @@ -0,0 +1,46 @@ +From: Saravana Kannan +Date: Fri, 24 Feb 2023 22:41:47 -0800 +Subject: [PATCH] driver core: fw_devlink: Avoid spurious error message +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6309872413f14f3d58c13ae4dc85b1a7004b4193 + +[ Upstream commit 6309872413f14f3d58c13ae4dc85b1a7004b4193 ] + +fw_devlink can sometimes try to create a device link with the consumer +and supplier as the same device. These attempts will fail (correctly), +but are harmless. So, avoid printing an error for these cases. Also, add +more detail to the error message. + +Fixes: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust") +Reported-by: Vladimir Oltean +Reported-by: Dmitry Baryshkov +Signed-off-by: Saravana Kannan +Link: https://lore.kernel.org/r/20230225064148.274376-1-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Jiri Slaby +--- + drivers/base/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 126b10c8..6ed21587 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -2088,9 +2088,9 @@ static int fw_devlink_create_devlink(struct device *con, + goto out; + } + +- if (!device_link_add(con, sup_dev, flags)) { +- dev_err(con, "Failed to create device link with %s\n", +- dev_name(sup_dev)); ++ if (con != sup_dev && !device_link_add(con, sup_dev, flags)) { ++ dev_err(con, "Failed to create device link (0x%x) with %s\n", ++ flags, dev_name(sup_dev)); + ret = -EINVAL; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-740-wifi-rtl8xxxu-fixing-transmisison-failure-for-r.patch b/patches.kernel.org/6.2.3-740-wifi-rtl8xxxu-fixing-transmisison-failure-for-r.patch new file mode 100644 index 0000000..c050f1f --- /dev/null +++ b/patches.kernel.org/6.2.3-740-wifi-rtl8xxxu-fixing-transmisison-failure-for-r.patch @@ -0,0 +1,42 @@ +From: Jun ASAKA +Date: Sat, 17 Dec 2022 11:06:59 +0800 +Subject: [PATCH] wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c6015bf3ff1ffb3caa27eb913797438a0fc634a0 + +commit c6015bf3ff1ffb3caa27eb913797438a0fc634a0 upstream. + +Fixing transmission failure which results in +"authentication with ... timed out". This can be +fixed by disable the REG_TXPAUSE. + +Signed-off-by: Jun ASAKA +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221217030659.12577-1-JunASAKA@zzy040330.moe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +index a7d76693..9d0ed676 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +@@ -1744,6 +1744,11 @@ static void rtl8192e_enable_rf(struct rtl8xxxu_priv *priv) + val8 = rtl8xxxu_read8(priv, REG_PAD_CTRL1); + val8 &= ~BIT(0); + rtl8xxxu_write8(priv, REG_PAD_CTRL1, val8); ++ ++ /* ++ * Fix transmission failure of rtl8192e. ++ */ ++ rtl8xxxu_write8(priv, REG_TXPAUSE, 0x00); + } + + static s8 rtl8192e_cck_rssi(struct rtl8xxxu_priv *priv, u8 cck_agc_rpt) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-741-firmware-coreboot-framebuffer-Ignore-reserved-p.patch b/patches.kernel.org/6.2.3-741-firmware-coreboot-framebuffer-Ignore-reserved-p.patch new file mode 100644 index 0000000..fb664a2 --- /dev/null +++ b/patches.kernel.org/6.2.3-741-firmware-coreboot-framebuffer-Ignore-reserved-p.patch @@ -0,0 +1,59 @@ +From: Alper Nebi Yasak +Date: Sun, 22 Jan 2023 22:04:31 +0300 +Subject: [PATCH] firmware: coreboot: framebuffer: Ignore reserved pixel color + bits +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e6acaf25cba14661211bb72181c35dd13b24f5b3 + +commit e6acaf25cba14661211bb72181c35dd13b24f5b3 upstream. + +The coreboot framebuffer doesn't support transparency, its 'reserved' +bit field is merely padding for byte/word alignment of pixel colors [1]. +When trying to match the framebuffer to a simplefb format, the kernel +driver unnecessarily requires the format's transparency bit field to +exactly match this padding, even if the former is zero-width. + +Due to a coreboot bug [2] (fixed upstream), some boards misreport the +reserved field's size as equal to its position (0x18 for both on a +'Lick' Chromebook), and the driver fails to probe where it would have +otherwise worked fine with e.g. the a8r8g8b8 or x8r8g8b8 formats. + +Remove the transparency comparison with reserved bits. When the +bits-per-pixel and other color components match, transparency will +already be in a subset of the reserved field. Not forcing it to match +reserved bits allows the driver to work on the boards which misreport +the reserved field. It also enables using simplefb formats that don't +have transparency bits, although this doesn't currently happen due to +format support and ordering in linux/platform_data/simplefb.h. + +[1] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.19/src/commonlib/include/commonlib/coreboot_tables.h#255 +[2] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.13/src/drivers/intel/fsp2_0/graphics.c#82 + +Signed-off-by: Alper Nebi Yasak +Link: https://lore.kernel.org/r/20230122190433.195941-1-alpernebiyasak@gmail.com +Cc: Salvatore Bonaccorso +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/firmware/google/framebuffer-coreboot.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/firmware/google/framebuffer-coreboot.c b/drivers/firmware/google/framebuffer-coreboot.c +index c6dcc1ef..c323a818 100644 +--- a/drivers/firmware/google/framebuffer-coreboot.c ++++ b/drivers/firmware/google/framebuffer-coreboot.c +@@ -43,9 +43,7 @@ static int framebuffer_probe(struct coreboot_device *dev) + fb->green_mask_pos == formats[i].green.offset && + fb->green_mask_size == formats[i].green.length && + fb->blue_mask_pos == formats[i].blue.offset && +- fb->blue_mask_size == formats[i].blue.length && +- fb->reserved_mask_pos == formats[i].transp.offset && +- fb->reserved_mask_size == formats[i].transp.length) ++ fb->blue_mask_size == formats[i].blue.length) + pdata.format = formats[i].name; + } + if (!pdata.format) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-742-block-don-t-allow-multiple-bios-for-IOCB_NOWAIT.patch b/patches.kernel.org/6.2.3-742-block-don-t-allow-multiple-bios-for-IOCB_NOWAIT.patch new file mode 100644 index 0000000..ee337d1 --- /dev/null +++ b/patches.kernel.org/6.2.3-742-block-don-t-allow-multiple-bios-for-IOCB_NOWAIT.patch @@ -0,0 +1,76 @@ +From: Jens Axboe +Date: Mon, 16 Jan 2023 08:55:53 -0700 +Subject: [PATCH] block: don't allow multiple bios for IOCB_NOWAIT issue +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 67d59247d4b52c917e373f05a807027756ab216f + +commit 67d59247d4b52c917e373f05a807027756ab216f upstream. + +If we're doing a large IO request which needs to be split into multiple +bios for issue, then we can run into the same situation as the below +marked commit fixes - parts will complete just fine, one or more parts +will fail to allocate a request. This will result in a partially +completed read or write request, where the caller gets EAGAIN even though +parts of the IO completed just fine. + +Do the same for large bios as we do for splits - fail a NOWAIT request +with EAGAIN. This isn't technically fixing an issue in the below marked +patch, but for stable purposes, we should have either none of them or +both. + +This depends on: 613b14884b85 ("block: handle bio_split_to_limits() NULL return") + +Cc: stable@vger.kernel.org # 5.15+ +Fixes: 9cea62b2cbab ("block: don't allow splitting of a REQ_NOWAIT bio") +Link: https://github.com/axboe/liburing/issues/766 +Reported-and-tested-by: Michael Kelley +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + block/fops.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/block/fops.c b/block/fops.c +index 50d245e8..d2e6be4e 100644 +--- a/block/fops.c ++++ b/block/fops.c +@@ -221,6 +221,24 @@ static ssize_t __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, + bio_endio(bio); + break; + } ++ if (iocb->ki_flags & IOCB_NOWAIT) { ++ /* ++ * This is nonblocking IO, and we need to allocate ++ * another bio if we have data left to map. As we ++ * cannot guarantee that one of the sub bios will not ++ * fail getting issued FOR NOWAIT and as error results ++ * are coalesced across all of them, be safe and ask for ++ * a retry of this from blocking context. ++ */ ++ if (unlikely(iov_iter_count(iter))) { ++ bio_release_pages(bio, false); ++ bio_clear_flag(bio, BIO_REFFED); ++ bio_put(bio); ++ blk_finish_plug(&plug); ++ return -EAGAIN; ++ } ++ bio->bi_opf |= REQ_NOWAIT; ++ } + + if (is_read) { + if (dio->flags & DIO_SHOULD_DIRTY) +@@ -228,9 +246,6 @@ static ssize_t __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, + } else { + task_io_account_write(bio->bi_iter.bi_size); + } +- if (iocb->ki_flags & IOCB_NOWAIT) +- bio->bi_opf |= REQ_NOWAIT; +- + dio->size += bio->bi_iter.bi_size; + pos += bio->bi_iter.bi_size; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-743-block-clear-bio-bi_bdev-when-putting-a-bio-back.patch b/patches.kernel.org/6.2.3-743-block-clear-bio-bi_bdev-when-putting-a-bio-back.patch new file mode 100644 index 0000000..5237934 --- /dev/null +++ b/patches.kernel.org/6.2.3-743-block-clear-bio-bi_bdev-when-putting-a-bio-back.patch @@ -0,0 +1,39 @@ +From: Jens Axboe +Date: Fri, 24 Feb 2023 09:59:44 -0700 +Subject: [PATCH] block: clear bio->bi_bdev when putting a bio back in the + cache +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 11eb695feb636fa5211067189cad25ac073e7fe5 + +commit 11eb695feb636fa5211067189cad25ac073e7fe5 upstream. + +This isn't strictly needed in terms of correctness, but it does allow +polling to know if the bio has been put already by a different task +and hence avoid polling something that we don't need to. + +Cc: stable@vger.kernel.org +Fixes: be4d234d7aeb ("bio: add allocation cache abstraction") +Reviewed-by: Keith Busch +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + block/bio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/block/bio.c b/block/bio.c +index ab59a491..4e7d1167 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -773,6 +773,7 @@ static inline void bio_put_percpu_cache(struct bio *bio) + + if ((bio->bi_opf & REQ_POLLED) && !WARN_ON_ONCE(in_interrupt())) { + bio->bi_next = cache->free_list; ++ bio->bi_bdev = NULL; + cache->free_list = bio; + cache->nr++; + } else { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-744-block-be-a-bit-more-careful-in-checking-for-NUL.patch b/patches.kernel.org/6.2.3-744-block-be-a-bit-more-careful-in-checking-for-NUL.patch new file mode 100644 index 0000000..a7a6bd9 --- /dev/null +++ b/patches.kernel.org/6.2.3-744-block-be-a-bit-more-careful-in-checking-for-NUL.patch @@ -0,0 +1,99 @@ +From: Jens Axboe +Date: Fri, 24 Feb 2023 10:01:19 -0700 +Subject: [PATCH] block: be a bit more careful in checking for NULL bdev while + polling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 310726c33ad76cebdee312dbfafc12c1b44bf977 + +commit 310726c33ad76cebdee312dbfafc12c1b44bf977 upstream. + +Wei reports a crash with an application using polled IO: + +PGD 14265e067 P4D 14265e067 PUD 47ec50067 PMD 0 +Oops: 0000 [#1] SMP +CPU: 0 PID: 21915 Comm: iocore_0 Kdump: loaded Tainted: G S 5.12.0-0_fbk12_clang_7346_g1bb6f2e7058f #1 +Hardware name: Wiwynn Delta Lake MP T8/Delta Lake-Class2, BIOS Y3DLM08 04/10/2022 +RIP: 0010:bio_poll+0x25/0x200 +Code: 0f 1f 44 00 00 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 28 65 48 8b 04 25 28 00 00 00 48 89 44 24 20 48 8b 47 08 <48> 8b 80 70 02 00 00 4c 8b 70 50 8b 6f 34 31 db 83 fd ff 75 25 65 +RSP: 0018:ffffc90005fafdf8 EFLAGS: 00010292 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 74b43cd65dd66600 +RDX: 0000000000000003 RSI: ffffc90005fafe78 RDI: ffff8884b614e140 +RBP: ffff88849964df78 R08: 0000000000000000 R09: 0000000000000008 +R10: 0000000000000000 R11: 0000000000000000 R12: ffff88849964df00 +R13: ffffc90005fafe78 R14: ffff888137d3c378 R15: 0000000000000001 +FS: 00007fd195000640(0000) GS:ffff88903f400000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000270 CR3: 0000000466121001 CR4: 00000000007706f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + iocb_bio_iopoll+0x1d/0x30 + io_do_iopoll+0xac/0x250 + __se_sys_io_uring_enter+0x3c5/0x5a0 + ? __x64_sys_write+0x89/0xd0 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x94f225d +Code: 24 cc 00 00 00 41 8b 84 24 d0 00 00 00 c1 e0 04 83 e0 10 41 09 c2 8b 33 8b 53 04 4c 8b 43 18 4c 63 4b 0c b8 aa 01 00 00 0f 05 <85> c0 0f 88 85 00 00 00 29 03 45 84 f6 0f 84 88 00 00 00 41 f6 c7 +RSP: 002b:00007fd194ffcd88 EFLAGS: 00000202 ORIG_RAX: 00000000000001aa +RAX: ffffffffffffffda RBX: 00007fd194ffcdc0 RCX: 00000000094f225d +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 +RBP: 00007fd194ffcdb0 R08: 0000000000000000 R09: 0000000000000008 +R10: 0000000000000001 R11: 0000000000000202 R12: 00007fd269d68030 +R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 + +which is due to bio->bi_bdev being NULL. This can happen if we have two +tasks doing polled IO, and task B ends up completing IO from task A if +they are sharing a poll queue. If task B completes the IO and puts the +bio into our cache, then it can allocate that bio again before task A +is done polling for it. As that would necessitate a preempt between the +two tasks, it's enough to just be a bit more careful in checking for +whether or not bio->bi_bdev is NULL. + +Reported-and-tested-by: Wei Zhang +Cc: stable@vger.kernel.org +Fixes: be4d234d7aeb ("bio: add allocation cache abstraction") +Reviewed-by: Keith Busch +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + block/blk-core.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 0a55844d..5a004921 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -854,10 +854,16 @@ EXPORT_SYMBOL(submit_bio); + */ + int bio_poll(struct bio *bio, struct io_comp_batch *iob, unsigned int flags) + { +- struct request_queue *q = bdev_get_queue(bio->bi_bdev); + blk_qc_t cookie = READ_ONCE(bio->bi_cookie); ++ struct block_device *bdev; ++ struct request_queue *q; + int ret = 0; + ++ bdev = READ_ONCE(bio->bi_bdev); ++ if (!bdev) ++ return 0; ++ ++ q = bdev_get_queue(bdev); + if (cookie == BLK_QC_T_NONE || + !test_bit(QUEUE_FLAG_POLL, &q->queue_flags)) + return 0; +@@ -917,7 +923,7 @@ int iocb_bio_iopoll(struct kiocb *kiocb, struct io_comp_batch *iob, + */ + rcu_read_lock(); + bio = READ_ONCE(kiocb->private); +- if (bio && bio->bi_bdev) ++ if (bio) + ret = bio_poll(bio, iob, flags); + rcu_read_unlock(); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-745-rtc-pm8xxx-fix-set-alarm-race.patch b/patches.kernel.org/6.2.3-745-rtc-pm8xxx-fix-set-alarm-race.patch new file mode 100644 index 0000000..a8d7bb7 --- /dev/null +++ b/patches.kernel.org/6.2.3-745-rtc-pm8xxx-fix-set-alarm-race.patch @@ -0,0 +1,80 @@ +From: Johan Hovold +Date: Thu, 2 Feb 2023 16:54:27 +0100 +Subject: [PATCH] rtc: pm8xxx: fix set-alarm race +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c88db0eff9722fc2b6c4d172a50471d20e08ecc6 + +commit c88db0eff9722fc2b6c4d172a50471d20e08ecc6 upstream. + +Make sure to disable the alarm before updating the four alarm time +registers to avoid spurious alarms during the update. + +Note that the disable needs to be done outside of the ctrl_reg_lock +section to prevent a racing alarm interrupt from disabling the newly set +alarm when the lock is released. + +Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC") +Cc: stable@vger.kernel.org # 3.1 +Signed-off-by: Johan Hovold +Reviewed-by: David Collins +Link: https://lore.kernel.org/r/20230202155448.6715-2-johan+linaro@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/rtc/rtc-pm8xxx.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c +index 716e5d9a..d114f0da 100644 +--- a/drivers/rtc/rtc-pm8xxx.c ++++ b/drivers/rtc/rtc-pm8xxx.c +@@ -221,7 +221,6 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm) + { + int rc, i; + u8 value[NUM_8_BIT_RTC_REGS]; +- unsigned int ctrl_reg; + unsigned long secs, irq_flags; + struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev); + const struct pm8xxx_rtc_regs *regs = rtc_dd->regs; +@@ -233,6 +232,11 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm) + secs >>= 8; + } + ++ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl, ++ regs->alarm_en, 0); ++ if (rc) ++ return rc; ++ + spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags); + + rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value, +@@ -242,19 +246,11 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm) + goto rtc_rw_fail; + } + +- rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg); +- if (rc) +- goto rtc_rw_fail; +- +- if (alarm->enabled) +- ctrl_reg |= regs->alarm_en; +- else +- ctrl_reg &= ~regs->alarm_en; +- +- rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg); +- if (rc) { +- dev_err(dev, "Write to RTC alarm control register failed\n"); +- goto rtc_rw_fail; ++ if (alarm->enabled) { ++ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl, ++ regs->alarm_en, regs->alarm_en); ++ if (rc) ++ goto rtc_rw_fail; + } + + dev_dbg(dev, "Alarm Set for h:m:s=%ptRt, y-m-d=%ptRdr\n", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-746-ipmi-ipmb-Fix-the-MODULE_PARM_DESC-associated-t.patch b/patches.kernel.org/6.2.3-746-ipmi-ipmb-Fix-the-MODULE_PARM_DESC-associated-t.patch new file mode 100644 index 0000000..4706224 --- /dev/null +++ b/patches.kernel.org/6.2.3-746-ipmi-ipmb-Fix-the-MODULE_PARM_DESC-associated-t.patch @@ -0,0 +1,39 @@ +From: Christophe JAILLET +Date: Sun, 5 Feb 2023 11:04:01 +0100 +Subject: [PATCH] ipmi: ipmb: Fix the MODULE_PARM_DESC associated to + 'retry_time_ms' +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: befb28f2676a65a5a4cc4626ae224461d8785af6 + +commit befb28f2676a65a5a4cc4626ae224461d8785af6 upstream. + +'This should be 'retry_time_ms' instead of 'max_retries'. + +Fixes: 63c4eb347164 ("ipmi:ipmb: Add initial support for IPMI over IPMB") +Signed-off-by: Christophe JAILLET +Message-Id: <0d8670cff2c656e99a832a249e77dc90578f67de.1675591429.git.christophe.jaillet@wanadoo.fr> +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/char/ipmi/ipmi_ipmb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/ipmi/ipmi_ipmb.c b/drivers/char/ipmi/ipmi_ipmb.c +index 7c1aee5e..3f1c9f15 100644 +--- a/drivers/char/ipmi/ipmi_ipmb.c ++++ b/drivers/char/ipmi/ipmi_ipmb.c +@@ -27,7 +27,7 @@ MODULE_PARM_DESC(bmcaddr, "Address to use for BMC."); + + static unsigned int retry_time_ms = 250; + module_param(retry_time_ms, uint, 0644); +-MODULE_PARM_DESC(max_retries, "Timeout time between retries, in milliseconds."); ++MODULE_PARM_DESC(retry_time_ms, "Timeout time between retries, in milliseconds."); + + static unsigned int max_retries = 1; + module_param(max_retries, uint, 0644); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-747-ipmi-ssif-resend_msg-cannot-fail.patch b/patches.kernel.org/6.2.3-747-ipmi-ssif-resend_msg-cannot-fail.patch new file mode 100644 index 0000000..c3c1416 --- /dev/null +++ b/patches.kernel.org/6.2.3-747-ipmi-ssif-resend_msg-cannot-fail.patch @@ -0,0 +1,99 @@ +From: Corey Minyard +Date: Wed, 25 Jan 2023 10:11:06 -0600 +Subject: [PATCH] ipmi:ssif: resend_msg() cannot fail +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 95767ed78a181d5404202627499f9cde56053b96 + +commit 95767ed78a181d5404202627499f9cde56053b96 upstream. + +The resend_msg() function cannot fail, but there was error handling +around using it. Rework the handling of the error, and fix the out of +retries debug reporting that was wrong around this, too. + +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/char/ipmi/ipmi_ssif.c | 28 +++++++--------------------- + 1 file changed, 7 insertions(+), 21 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 4bfd1e30..146409d2 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -602,7 +602,7 @@ static void ssif_alert(struct i2c_client *client, enum i2c_alert_protocol type, + start_get(ssif_info); + } + +-static int start_resend(struct ssif_info *ssif_info); ++static void start_resend(struct ssif_info *ssif_info); + + static void msg_done_handler(struct ssif_info *ssif_info, int result, + unsigned char *data, unsigned int len) +@@ -909,31 +909,17 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + if (result < 0) { + ssif_info->retries_left--; + if (ssif_info->retries_left > 0) { +- if (!start_resend(ssif_info)) { +- ssif_inc_stat(ssif_info, send_retries); +- return; +- } +- /* request failed, just return the error. */ +- ssif_inc_stat(ssif_info, send_errors); +- +- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) +- dev_dbg(&ssif_info->client->dev, +- "%s: Out of retries\n", __func__); +- msg_done_handler(ssif_info, -EIO, NULL, 0); ++ start_resend(ssif_info); + return; + } + + ssif_inc_stat(ssif_info, send_errors); + +- /* +- * Got an error on transmit, let the done routine +- * handle it. +- */ + if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) + dev_dbg(&ssif_info->client->dev, +- "%s: Error %d\n", __func__, result); ++ "%s: Out of retries\n", __func__); + +- msg_done_handler(ssif_info, result, NULL, 0); ++ msg_done_handler(ssif_info, -EIO, NULL, 0); + return; + } + +@@ -996,7 +982,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + } + } + +-static int start_resend(struct ssif_info *ssif_info) ++static void start_resend(struct ssif_info *ssif_info) + { + int command; + +@@ -1021,7 +1007,6 @@ static int start_resend(struct ssif_info *ssif_info) + + ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE, + command, ssif_info->data, I2C_SMBUS_BLOCK_DATA); +- return 0; + } + + static int start_send(struct ssif_info *ssif_info, +@@ -1036,7 +1021,8 @@ static int start_send(struct ssif_info *ssif_info, + ssif_info->retries_left = SSIF_SEND_RETRIES; + memcpy(ssif_info->data + 1, data, len); + ssif_info->data_len = len; +- return start_resend(ssif_info); ++ start_resend(ssif_info); ++ return 0; + } + + /* Must be called with the message lock held. */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-748-ipmi_ssif-Rename-idle-state-and-check.patch b/patches.kernel.org/6.2.3-748-ipmi_ssif-Rename-idle-state-and-check.patch new file mode 100644 index 0000000..d4bf023 --- /dev/null +++ b/patches.kernel.org/6.2.3-748-ipmi_ssif-Rename-idle-state-and-check.patch @@ -0,0 +1,199 @@ +From: Corey Minyard +Date: Wed, 25 Jan 2023 10:13:13 -0600 +Subject: [PATCH] ipmi_ssif: Rename idle state and check +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8230831c43a328c2be6d28c65d3f77e14c59986b + +commit 8230831c43a328c2be6d28c65d3f77e14c59986b upstream. + +Rename the SSIF_IDLE() to IS_SSIF_IDLE(), since that is more clear, and +rename SSIF_NORMAL to SSIF_IDLE, since that's more accurate. + +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/char/ipmi/ipmi_ssif.c | 46 +++++++++++++++++------------------ + 1 file changed, 23 insertions(+), 23 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 146409d2..5a377e86 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -92,7 +92,7 @@ + #define SSIF_WATCH_WATCHDOG_TIMEOUT msecs_to_jiffies(250) + + enum ssif_intf_state { +- SSIF_NORMAL, ++ SSIF_IDLE, + SSIF_GETTING_FLAGS, + SSIF_GETTING_EVENTS, + SSIF_CLEARING_FLAGS, +@@ -100,8 +100,8 @@ enum ssif_intf_state { + /* FIXME - add watchdog stuff. */ + }; + +-#define SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_NORMAL \ +- && (ssif)->curr_msg == NULL) ++#define IS_SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_IDLE \ ++ && (ssif)->curr_msg == NULL) + + /* + * Indexes into stats[] in ssif_info below. +@@ -348,9 +348,9 @@ static void return_hosed_msg(struct ssif_info *ssif_info, + + /* + * Must be called with the message lock held. This will release the +- * message lock. Note that the caller will check SSIF_IDLE and start a +- * new operation, so there is no need to check for new messages to +- * start in here. ++ * message lock. Note that the caller will check IS_SSIF_IDLE and ++ * start a new operation, so there is no need to check for new ++ * messages to start in here. + */ + static void start_clear_flags(struct ssif_info *ssif_info, unsigned long *flags) + { +@@ -367,7 +367,7 @@ static void start_clear_flags(struct ssif_info *ssif_info, unsigned long *flags) + + if (start_send(ssif_info, msg, 3) != 0) { + /* Error, just go to normal state. */ +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + } + } + +@@ -382,7 +382,7 @@ static void start_flag_fetch(struct ssif_info *ssif_info, unsigned long *flags) + mb[0] = (IPMI_NETFN_APP_REQUEST << 2); + mb[1] = IPMI_GET_MSG_FLAGS_CMD; + if (start_send(ssif_info, mb, 2) != 0) +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + } + + static void check_start_send(struct ssif_info *ssif_info, unsigned long *flags, +@@ -393,7 +393,7 @@ static void check_start_send(struct ssif_info *ssif_info, unsigned long *flags, + + flags = ipmi_ssif_lock_cond(ssif_info, &oflags); + ssif_info->curr_msg = NULL; +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + ipmi_free_smi_msg(msg); + } +@@ -407,7 +407,7 @@ static void start_event_fetch(struct ssif_info *ssif_info, unsigned long *flags) + + msg = ipmi_alloc_smi_msg(); + if (!msg) { +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } +@@ -430,7 +430,7 @@ static void start_recv_msg_fetch(struct ssif_info *ssif_info, + + msg = ipmi_alloc_smi_msg(); + if (!msg) { +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } +@@ -448,9 +448,9 @@ static void start_recv_msg_fetch(struct ssif_info *ssif_info, + + /* + * Must be called with the message lock held. This will release the +- * message lock. Note that the caller will check SSIF_IDLE and start a +- * new operation, so there is no need to check for new messages to +- * start in here. ++ * message lock. Note that the caller will check IS_SSIF_IDLE and ++ * start a new operation, so there is no need to check for new ++ * messages to start in here. + */ + static void handle_flags(struct ssif_info *ssif_info, unsigned long *flags) + { +@@ -466,7 +466,7 @@ static void handle_flags(struct ssif_info *ssif_info, unsigned long *flags) + /* Events available. */ + start_event_fetch(ssif_info, flags); + else { +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + } + } +@@ -568,7 +568,7 @@ static void watch_timeout(struct timer_list *t) + if (ssif_info->watch_timeout) { + mod_timer(&ssif_info->watch_timer, + jiffies + ssif_info->watch_timeout); +- if (SSIF_IDLE(ssif_info)) { ++ if (IS_SSIF_IDLE(ssif_info)) { + start_flag_fetch(ssif_info, flags); /* Releases lock */ + return; + } +@@ -756,7 +756,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + } + + switch (ssif_info->ssif_state) { +- case SSIF_NORMAL: ++ case SSIF_IDLE: + ipmi_ssif_unlock_cond(ssif_info, flags); + if (!msg) + break; +@@ -774,7 +774,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + * Error fetching flags, or invalid length, + * just give up for now. + */ +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + dev_warn(&ssif_info->client->dev, + "Error getting flags: %d %d, %x\n", +@@ -809,7 +809,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + "Invalid response clearing flags: %x %x\n", + data[0], data[1]); + } +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + ipmi_ssif_unlock_cond(ssif_info, flags); + break; + +@@ -887,7 +887,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + } + + flags = ipmi_ssif_lock_cond(ssif_info, &oflags); +- if (SSIF_IDLE(ssif_info) && !ssif_info->stopping) { ++ if (IS_SSIF_IDLE(ssif_info) && !ssif_info->stopping) { + if (ssif_info->req_events) + start_event_fetch(ssif_info, flags); + else if (ssif_info->req_flags) +@@ -1032,7 +1032,7 @@ static void start_next_msg(struct ssif_info *ssif_info, unsigned long *flags) + unsigned long oflags; + + restart: +- if (!SSIF_IDLE(ssif_info)) { ++ if (!IS_SSIF_IDLE(ssif_info)) { + ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } +@@ -1255,7 +1255,7 @@ static void shutdown_ssif(void *send_info) + dev_set_drvdata(&ssif_info->client->dev, NULL); + + /* make sure the driver is not looking for flags any more. */ +- while (ssif_info->ssif_state != SSIF_NORMAL) ++ while (ssif_info->ssif_state != SSIF_IDLE) + schedule_timeout(1); + + ssif_info->stopping = true; +@@ -1825,7 +1825,7 @@ static int ssif_probe(struct i2c_client *client) + } + + spin_lock_init(&ssif_info->lock); +- ssif_info->ssif_state = SSIF_NORMAL; ++ ssif_info->ssif_state = SSIF_IDLE; + timer_setup(&ssif_info->retry_timer, retry_timeout, 0); + timer_setup(&ssif_info->watch_timer, watch_timeout, 0); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-749-ipmi-ssif-Add-a-timer-between-request-retries.patch b/patches.kernel.org/6.2.3-749-ipmi-ssif-Add-a-timer-between-request-retries.patch new file mode 100644 index 0000000..388fcb0 --- /dev/null +++ b/patches.kernel.org/6.2.3-749-ipmi-ssif-Add-a-timer-between-request-retries.patch @@ -0,0 +1,136 @@ +From: Corey Minyard +Date: Wed, 25 Jan 2023 10:34:47 -0600 +Subject: [PATCH] ipmi:ssif: Add a timer between request retries +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 00bb7e763ec9f384cb382455cb6ba5588b5375cf + +commit 00bb7e763ec9f384cb382455cb6ba5588b5375cf upstream. + +The IPMI spec has a time (T6) specified between request retries. Add +the handling for that. + +Reported by: Tony Camuso +Cc: stable@vger.kernel.org +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/char/ipmi/ipmi_ssif.c | 34 +++++++++++++++++++++++++++------- + 1 file changed, 27 insertions(+), 7 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 5a377e86..f49d2c2e 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -74,7 +74,8 @@ + /* + * Timer values + */ +-#define SSIF_MSG_USEC 60000 /* 60ms between message tries. */ ++#define SSIF_MSG_USEC 60000 /* 60ms between message tries (T3). */ ++#define SSIF_REQ_RETRY_USEC 60000 /* 60ms between send retries (T6). */ + #define SSIF_MSG_PART_USEC 5000 /* 5ms for a message part */ + + /* How many times to we retry sending/receiving the message. */ +@@ -82,7 +83,9 @@ + #define SSIF_RECV_RETRIES 250 + + #define SSIF_MSG_MSEC (SSIF_MSG_USEC / 1000) ++#define SSIF_REQ_RETRY_MSEC (SSIF_REQ_RETRY_USEC / 1000) + #define SSIF_MSG_JIFFIES ((SSIF_MSG_USEC * 1000) / TICK_NSEC) ++#define SSIF_REQ_RETRY_JIFFIES ((SSIF_REQ_RETRY_USEC * 1000) / TICK_NSEC) + #define SSIF_MSG_PART_JIFFIES ((SSIF_MSG_PART_USEC * 1000) / TICK_NSEC) + + /* +@@ -229,6 +232,9 @@ struct ssif_info { + bool got_alert; + bool waiting_alert; + ++ /* Used to inform the timeout that it should do a resend. */ ++ bool do_resend; ++ + /* + * If set to true, this will request events the next time the + * state machine is idle. +@@ -538,22 +544,28 @@ static void start_get(struct ssif_info *ssif_info) + ssif_info->recv, I2C_SMBUS_BLOCK_DATA); + } + ++static void start_resend(struct ssif_info *ssif_info); ++ + static void retry_timeout(struct timer_list *t) + { + struct ssif_info *ssif_info = from_timer(ssif_info, t, retry_timer); + unsigned long oflags, *flags; +- bool waiting; ++ bool waiting, resend; + + if (ssif_info->stopping) + return; + + flags = ipmi_ssif_lock_cond(ssif_info, &oflags); ++ resend = ssif_info->do_resend; ++ ssif_info->do_resend = false; + waiting = ssif_info->waiting_alert; + ssif_info->waiting_alert = false; + ipmi_ssif_unlock_cond(ssif_info, flags); + + if (waiting) + start_get(ssif_info); ++ if (resend) ++ start_resend(ssif_info); + } + + static void watch_timeout(struct timer_list *t) +@@ -602,8 +614,6 @@ static void ssif_alert(struct i2c_client *client, enum i2c_alert_protocol type, + start_get(ssif_info); + } + +-static void start_resend(struct ssif_info *ssif_info); +- + static void msg_done_handler(struct ssif_info *ssif_info, int result, + unsigned char *data, unsigned int len) + { +@@ -909,7 +919,13 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, + if (result < 0) { + ssif_info->retries_left--; + if (ssif_info->retries_left > 0) { +- start_resend(ssif_info); ++ /* ++ * Wait the retry timeout time per the spec, ++ * then redo the send. ++ */ ++ ssif_info->do_resend = true; ++ mod_timer(&ssif_info->retry_timer, ++ jiffies + SSIF_REQ_RETRY_JIFFIES); + return; + } + +@@ -1320,8 +1336,10 @@ static int do_cmd(struct i2c_client *client, int len, unsigned char *msg, + ret = i2c_smbus_write_block_data(client, SSIF_IPMI_REQUEST, len, msg); + if (ret) { + retry_cnt--; +- if (retry_cnt > 0) ++ if (retry_cnt > 0) { ++ msleep(SSIF_REQ_RETRY_MSEC); + goto retry1; ++ } + return -ENODEV; + } + +@@ -1462,8 +1480,10 @@ static int start_multipart_test(struct i2c_client *client, + 32, msg); + if (ret) { + retry_cnt--; +- if (retry_cnt > 0) ++ if (retry_cnt > 0) { ++ msleep(SSIF_REQ_RETRY_MSEC); + goto retry_write; ++ } + dev_err(&client->dev, "Could not write multi-part start, though the BMC said it could handle it. Just limit sends to one part.\n"); + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-750-io_uring-Replace-0-length-array-with-flexible-a.patch b/patches.kernel.org/6.2.3-750-io_uring-Replace-0-length-array-with-flexible-a.patch new file mode 100644 index 0000000..7d01eb8 --- /dev/null +++ b/patches.kernel.org/6.2.3-750-io_uring-Replace-0-length-array-with-flexible-a.patch @@ -0,0 +1,58 @@ +From: Kees Cook +Date: Thu, 5 Jan 2023 11:05:11 -0800 +Subject: [PATCH] io_uring: Replace 0-length array with flexible array +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 36632d062975a9ff4410c90dd6d37922b68d0920 + +commit 36632d062975a9ff4410c90dd6d37922b68d0920 upstream. + +Zero-length arrays are deprecated[1]. Replace struct io_uring_buf_ring's +"bufs" with a flexible array member. (How is the size of this array +verified?) Detected with GCC 13, using -fstrict-flex-arrays=3: + +In function 'io_ring_buffer_select', + inlined from 'io_buffer_select' at io_uring/kbuf.c:183:10: +io_uring/kbuf.c:141:23: warning: array subscript 255 is outside the bounds of an interior zero-length array 'struct io_uring_buf[0]' [-Wzero-length-bounds] + 141 | buf = &br->bufs[head]; + | ^~~~~~~~~~~~~~~ +In file included from include/linux/io_uring.h:7, + from io_uring/kbuf.c:10: +include/uapi/linux/io_uring.h: In function 'io_buffer_select': +include/uapi/linux/io_uring.h:628:41: note: while referencing 'bufs' + 628 | struct io_uring_buf bufs[0]; + | ^~~~ + +[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays + +Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") +Cc: Jens Axboe +Cc: Pavel Begunkov +Cc: "Gustavo A. R. Silva" +Cc: stable@vger.kernel.org +Cc: io-uring@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Gustavo A. R. Silva +Link: https://lore.kernel.org/r/20230105190507.gonna.131-kees@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + include/uapi/linux/io_uring.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h +index 2780bce6..434f62e0 100644 +--- a/include/uapi/linux/io_uring.h ++++ b/include/uapi/linux/io_uring.h +@@ -625,7 +625,7 @@ struct io_uring_buf_ring { + __u16 resv3; + __u16 tail; + }; +- struct io_uring_buf bufs[0]; ++ __DECLARE_FLEX_ARRAY(struct io_uring_buf, bufs); + }; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-751-io_uring-use-user-visible-tail-in-io_uring_poll.patch b/patches.kernel.org/6.2.3-751-io_uring-use-user-visible-tail-in-io_uring_poll.patch new file mode 100644 index 0000000..ddbd1fa --- /dev/null +++ b/patches.kernel.org/6.2.3-751-io_uring-use-user-visible-tail-in-io_uring_poll.patch @@ -0,0 +1,39 @@ +From: Pavel Begunkov +Date: Mon, 23 Jan 2023 14:37:13 +0000 +Subject: [PATCH] io_uring: use user visible tail in io_uring_poll() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c10bb64684813a326174c3eebcafb3ee5af52ca3 + +commit c10bb64684813a326174c3eebcafb3ee5af52ca3 upstream. + +We return POLLIN from io_uring_poll() depending on whether there are +CQEs for the userspace, and so we should use the user visible tail +pointer instead of a transient cached value. + +Cc: stable@vger.kernel.org +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/228ffcbf30ba98856f66ffdb9a6a60ead1dd96c0.1674484266.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/io_uring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index db623b31..fbeb9d21 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2790,7 +2790,7 @@ static __poll_t io_uring_poll(struct file *file, poll_table *wait) + * pushes them to do the flush. + */ + +- if (io_cqring_events(ctx) || io_has_work(ctx)) ++ if (__io_cqring_events_user(ctx) || io_has_work(ctx)) + mask |= EPOLLIN | EPOLLRDNORM; + + return mask; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-752-io_uring-handle-TIF_NOTIFY_RESUME-when-checking.patch b/patches.kernel.org/6.2.3-752-io_uring-handle-TIF_NOTIFY_RESUME-when-checking.patch new file mode 100644 index 0000000..5a9f333 --- /dev/null +++ b/patches.kernel.org/6.2.3-752-io_uring-handle-TIF_NOTIFY_RESUME-when-checking.patch @@ -0,0 +1,53 @@ +From: Jens Axboe +Date: Tue, 24 Jan 2023 08:24:25 -0700 +Subject: [PATCH] io_uring: handle TIF_NOTIFY_RESUME when checking for + task_work +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b5d3ae202fbfe055aa2a8ae8524531ee1dcab717 + +commit b5d3ae202fbfe055aa2a8ae8524531ee1dcab717 upstream. + +If TIF_NOTIFY_RESUME is set, then we need to call resume_user_mode_work() +for PF_IO_WORKER threads. They never return to usermode, hence never get +a chance to process any items that are marked by this flag. Most notably +this includes the final put of files, but also any throttling markers set +by block cgroups. + +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/io_uring.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h +index ab4b2a1c..e532dea6 100644 +--- a/io_uring/io_uring.h ++++ b/io_uring/io_uring.h +@@ -3,6 +3,7 @@ + + #include + #include ++#include + #include + #include + #include "io-wq.h" +@@ -270,6 +271,13 @@ static inline int io_run_task_work(void) + */ + if (test_thread_flag(TIF_NOTIFY_SIGNAL)) + clear_notify_signal(); ++ /* ++ * PF_IO_WORKER never returns to userspace, so check here if we have ++ * notify work that needs processing. ++ */ ++ if (current->flags & PF_IO_WORKER && ++ test_thread_flag(TIF_NOTIFY_RESUME)) ++ resume_user_mode_work(NULL); + if (task_work_pending(current)) { + __set_current_state(TASK_RUNNING); + task_work_run(); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-753-io_uring-add-a-conditional-reschedule-to-the-IO.patch b/patches.kernel.org/6.2.3-753-io_uring-add-a-conditional-reschedule-to-the-IO.patch new file mode 100644 index 0000000..a1aa95e --- /dev/null +++ b/patches.kernel.org/6.2.3-753-io_uring-add-a-conditional-reschedule-to-the-IO.patch @@ -0,0 +1,88 @@ +From: Jens Axboe +Date: Fri, 27 Jan 2023 09:28:13 -0700 +Subject: [PATCH] io_uring: add a conditional reschedule to the IOPOLL + cancelation loop +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fcc926bb857949dbfa51a7d95f3f5ebc657f198c + +commit fcc926bb857949dbfa51a7d95f3f5ebc657f198c upstream. + +If the kernel is configured with CONFIG_PREEMPT_NONE, we could be +sitting in a tight loop reaping events but not giving them a chance to +finish. This results in a trace ala: + +rcu: INFO: rcu_sched self-detected stall on CPU +rcu: 2-...!: (5249 ticks this GP) idle=935c/1/0x4000000000000000 softirq=4265/4274 fqs=1 + (t=5251 jiffies g=465 q=4135 ncpus=4) +rcu: rcu_sched kthread starved for 5249 jiffies! g465 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 +rcu: Unless rcu_sched kthread gets sufficient CPU time, OOM is now expected behavior. +rcu: RCU grace-period kthread stack dump: +task:rcu_sched state:R running task stack:0 pid:12 ppid:2 flags:0x00000008 +Call trace: + __switch_to+0xb0/0xc8 + __schedule+0x43c/0x520 + schedule+0x4c/0x98 + schedule_timeout+0xbc/0xdc + rcu_gp_fqs_loop+0x308/0x344 + rcu_gp_kthread+0xd8/0xf0 + kthread+0xb8/0xc8 + ret_from_fork+0x10/0x20 +rcu: Stack dump where RCU GP kthread last ran: +Task dump for CPU 0: +task:kworker/u8:10 state:R running task stack:0 pid:89 ppid:2 flags:0x0000000a +Workqueue: events_unbound io_ring_exit_work +Call trace: + __switch_to+0xb0/0xc8 + 0xffff0000c8fefd28 +CPU: 2 PID: 95 Comm: kworker/u8:13 Not tainted 6.2.0-rc5-00042-g40316e337c80-dirty #2759 +Hardware name: linux,dummy-virt (DT) +Workqueue: events_unbound io_ring_exit_work +pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) +pc : io_do_iopoll+0x344/0x360 +lr : io_do_iopoll+0xb8/0x360 +sp : ffff800009bebc60 +x29: ffff800009bebc60 x28: 0000000000000000 x27: 0000000000000000 +x26: ffff0000c0f67d48 x25: ffff0000c0f67840 x24: ffff800008950024 +x23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c27d3200 +x20: ffff0000c0f67840 x19: ffff0000c0f67800 x18: 0000000000000000 +x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 +x14: 0000000000000001 x13: 0000000000000001 x12: 0000000000000000 +x11: 0000000000000179 x10: 0000000000000870 x9 : ffff800009bebd60 +x8 : ffff0000c27d3ad0 x7 : fefefefefefefeff x6 : 0000646e756f626e +x5 : ffff0000c0f67840 x4 : 0000000000000000 x3 : ffff0000c2398000 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 +Call trace: + io_do_iopoll+0x344/0x360 + io_uring_try_cancel_requests+0x21c/0x334 + io_ring_exit_work+0x90/0x40c + process_one_work+0x1a4/0x254 + worker_thread+0x1ec/0x258 + kthread+0xb8/0xc8 + ret_from_fork+0x10/0x20 + +Add a cond_resched() in the cancelation IOPOLL loop to fix this. + +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/io_uring.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index fbeb9d21..d7e2a743 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -3053,6 +3053,7 @@ static __cold bool io_uring_try_cancel_requests(struct io_ring_ctx *ctx, + while (!wq_list_empty(&ctx->iopoll_list)) { + io_iopoll_try_reap_events(ctx); + ret = true; ++ cond_resched(); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-754-io_uring-add-reschedule-point-to-handle_tw_list.patch b/patches.kernel.org/6.2.3-754-io_uring-add-reschedule-point-to-handle_tw_list.patch new file mode 100644 index 0000000..166c4dd --- /dev/null +++ b/patches.kernel.org/6.2.3-754-io_uring-add-reschedule-point-to-handle_tw_list.patch @@ -0,0 +1,47 @@ +From: Jens Axboe +Date: Fri, 27 Jan 2023 09:50:31 -0700 +Subject: [PATCH] io_uring: add reschedule point to handle_tw_list() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f58680085478dd292435727210122960d38e8014 + +commit f58680085478dd292435727210122960d38e8014 upstream. + +If CONFIG_PREEMPT_NONE is set and the task_work chains are long, we +could be running into issues blocking others for too long. Add a +reschedule check in handle_tw_list(), and flush the ctx if we need to +reschedule. + +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/io_uring.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index d7e2a743..80ba696e 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -1143,10 +1143,16 @@ static unsigned int handle_tw_list(struct llist_node *node, + /* if not contended, grab and improve batching */ + *locked = mutex_trylock(&(*ctx)->uring_lock); + percpu_ref_get(&(*ctx)->refs); +- } ++ } else if (!*locked) ++ *locked = mutex_trylock(&(*ctx)->uring_lock); + req->io_task_work.func(req, locked); + node = next; + count++; ++ if (unlikely(need_resched())) { ++ ctx_flush_and_put(*ctx, locked); ++ *ctx = NULL; ++ cond_resched(); ++ } + } + + return count; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-755-io_uring-rsrc-disallow-multi-source-reg-buffers.patch b/patches.kernel.org/6.2.3-755-io_uring-rsrc-disallow-multi-source-reg-buffers.patch new file mode 100644 index 0000000..a51b37e --- /dev/null +++ b/patches.kernel.org/6.2.3-755-io_uring-rsrc-disallow-multi-source-reg-buffers.patch @@ -0,0 +1,54 @@ +From: Pavel Begunkov +Date: Wed, 22 Feb 2023 14:36:48 +0000 +Subject: [PATCH] io_uring/rsrc: disallow multi-source reg buffers +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: edd478269640b360c6f301f2baa04abdda563ef3 + +commit edd478269640b360c6f301f2baa04abdda563ef3 upstream. + +If two or more mappings go back to back to each other they can be passed +into io_uring to be registered as a single registered buffer. That would +even work if mappings came from different sources, e.g. it's possible to +mix in this way anon pages and pages from shmem or hugetlb. That is not +a problem but it'd rather be less prone if we forbid such mixing. + +Cc: +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/rsrc.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c +index 18de10c6..4cbf3ad7 100644 +--- a/io_uring/rsrc.c ++++ b/io_uring/rsrc.c +@@ -1162,14 +1162,17 @@ struct page **io_pin_pages(unsigned long ubuf, unsigned long len, int *npages) + pret = pin_user_pages(ubuf, nr_pages, FOLL_WRITE | FOLL_LONGTERM, + pages, vmas); + if (pret == nr_pages) { ++ struct file *file = vmas[0]->vm_file; ++ + /* don't support file backed memory */ + for (i = 0; i < nr_pages; i++) { +- struct vm_area_struct *vma = vmas[i]; +- +- if (vma_is_shmem(vma)) ++ if (vmas[i]->vm_file != file) { ++ ret = -EINVAL; ++ break; ++ } ++ if (!file) + continue; +- if (vma->vm_file && +- !is_file_hugepages(vma->vm_file)) { ++ if (!vma_is_shmem(vmas[i]) && !is_file_hugepages(file)) { + ret = -EOPNOTSUPP; + break; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-756-io_uring-remove-MSG_NOSIGNAL-from-recvmsg.patch b/patches.kernel.org/6.2.3-756-io_uring-remove-MSG_NOSIGNAL-from-recvmsg.patch new file mode 100644 index 0000000..ccc969d --- /dev/null +++ b/patches.kernel.org/6.2.3-756-io_uring-remove-MSG_NOSIGNAL-from-recvmsg.patch @@ -0,0 +1,45 @@ +From: David Lamparter +Date: Fri, 24 Feb 2023 16:01:24 +0100 +Subject: [PATCH] io_uring: remove MSG_NOSIGNAL from recvmsg +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7605c43d67face310b4b87dee1a28bc0c8cd8c0f + +commit 7605c43d67face310b4b87dee1a28bc0c8cd8c0f upstream. + +MSG_NOSIGNAL is not applicable for the receiving side, SIGPIPE is +generated when trying to write to a "broken pipe". AF_PACKET's +packet_recvmsg() does enforce this, giving back EINVAL when MSG_NOSIGNAL +is set - making it unuseable in io_uring's recvmsg. + +Remove MSG_NOSIGNAL from io_recvmsg_prep(). + +Cc: stable@vger.kernel.org # v5.10+ +Signed-off-by: David Lamparter +Cc: Eric Dumazet +Cc: Jens Axboe +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230224150123.128346-1-equinox@diac24.net +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/net.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/net.c b/io_uring/net.c +index 90326b27..02587f7d 100644 +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -568,7 +568,7 @@ int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) + sr->flags = READ_ONCE(sqe->ioprio); + if (sr->flags & ~(RECVMSG_FLAGS)) + return -EINVAL; +- sr->msg_flags = READ_ONCE(sqe->msg_flags) | MSG_NOSIGNAL; ++ sr->msg_flags = READ_ONCE(sqe->msg_flags); + if (sr->msg_flags & MSG_DONTWAIT) + req->flags |= REQ_F_NOWAIT; + if (sr->msg_flags & MSG_ERRQUEUE) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-757-io_uring-poll-allow-some-retries-for-poll-trigg.patch b/patches.kernel.org/6.2.3-757-io_uring-poll-allow-some-retries-for-poll-trigg.patch new file mode 100644 index 0000000..6ac250b --- /dev/null +++ b/patches.kernel.org/6.2.3-757-io_uring-poll-allow-some-retries-for-poll-trigg.patch @@ -0,0 +1,102 @@ +From: Jens Axboe +Date: Sat, 25 Feb 2023 12:53:53 -0700 +Subject: [PATCH] io_uring/poll: allow some retries for poll triggering + spuriously +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c16bda37594f83147b167d381d54c010024efecf + +commit c16bda37594f83147b167d381d54c010024efecf upstream. + +If we get woken spuriously when polling and fail the operation with +-EAGAIN again, then we generally only allow polling again if data +had been transferred at some point. This is indicated with +REQ_F_PARTIAL_IO. However, if the spurious poll triggers when the socket +was originally empty, then we haven't transferred data yet and we will +fail the poll re-arm. This either punts the socket to io-wq if it's +blocking, or it fails the request with -EAGAIN if not. Neither condition +is desirable, as the former will slow things down, while the latter +will make the application confused. + +We want to ensure that a repeated poll trigger doesn't lead to infinite +work making no progress, that's what the REQ_F_PARTIAL_IO check was +for. But it doesn't protect against a loop post the first receive, and +it's unnecessarily strict if we started out with an empty socket. + +Add a somewhat random retry count, just to put an upper limit on the +potential number of retries that will be done. This should be high enough +that we won't really hit it in practice, unless something needs to be +aborted anyway. + +Cc: stable@vger.kernel.org # v5.10+ +Link: https://github.com/axboe/liburing/issues/364 +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/poll.c | 14 ++++++++++++-- + io_uring/poll.h | 1 + + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/io_uring/poll.c b/io_uring/poll.c +index 2ac1366a..fea739ee 100644 +--- a/io_uring/poll.c ++++ b/io_uring/poll.c +@@ -650,6 +650,14 @@ static void io_async_queue_proc(struct file *file, struct wait_queue_head *head, + __io_queue_proc(&apoll->poll, pt, head, &apoll->double_poll); + } + ++/* ++ * We can't reliably detect loops in repeated poll triggers and issue ++ * subsequently failing. But rather than fail these immediately, allow a ++ * certain amount of retries before we give up. Given that this condition ++ * should _rarely_ trigger even once, we should be fine with a larger value. ++ */ ++#define APOLL_MAX_RETRY 128 ++ + static struct async_poll *io_req_alloc_apoll(struct io_kiocb *req, + unsigned issue_flags) + { +@@ -665,14 +673,18 @@ static struct async_poll *io_req_alloc_apoll(struct io_kiocb *req, + if (entry == NULL) + goto alloc_apoll; + apoll = container_of(entry, struct async_poll, cache); ++ apoll->poll.retries = APOLL_MAX_RETRY; + } else { + alloc_apoll: + apoll = kmalloc(sizeof(*apoll), GFP_ATOMIC); + if (unlikely(!apoll)) + return NULL; ++ apoll->poll.retries = APOLL_MAX_RETRY; + } + apoll->double_poll = NULL; + req->apoll = apoll; ++ if (unlikely(!--apoll->poll.retries)) ++ return NULL; + return apoll; + } + +@@ -694,8 +706,6 @@ int io_arm_poll_handler(struct io_kiocb *req, unsigned issue_flags) + return IO_APOLL_ABORTED; + if (!file_can_poll(req->file)) + return IO_APOLL_ABORTED; +- if ((req->flags & (REQ_F_POLLED|REQ_F_PARTIAL_IO)) == REQ_F_POLLED) +- return IO_APOLL_ABORTED; + if (!(req->flags & REQ_F_APOLL_MULTISHOT)) + mask |= EPOLLONESHOT; + +diff --git a/io_uring/poll.h b/io_uring/poll.h +index 5f3bae50..b2393b40 100644 +--- a/io_uring/poll.h ++++ b/io_uring/poll.h +@@ -12,6 +12,7 @@ struct io_poll { + struct file *file; + struct wait_queue_head *head; + __poll_t events; ++ int retries; + struct wait_queue_entry wait; + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-758-io_uring-fix-fget-leak-when-fs-don-t-support-no.patch b/patches.kernel.org/6.2.3-758-io_uring-fix-fget-leak-when-fs-don-t-support-no.patch new file mode 100644 index 0000000..0b6e82d --- /dev/null +++ b/patches.kernel.org/6.2.3-758-io_uring-fix-fget-leak-when-fs-don-t-support-no.patch @@ -0,0 +1,71 @@ +From: Joseph Qi +Date: Tue, 28 Feb 2023 12:54:59 +0800 +Subject: [PATCH] io_uring: fix fget leak when fs don't support nowait buffered + read +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 54aa7f2330b82884f4a1afce0220add6e8312f8b + +commit 54aa7f2330b82884f4a1afce0220add6e8312f8b upstream. + +Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1] + +Do the following steps can reproduce this BUG: +mount -t ocfs2 /dev/vdc /mnt/ocfs2 +cp testfile /mnt/ocfs2/ +./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1 +umount /mnt/ocfs2 + +Then umount will fail, and it outputs: +umount: /mnt/ocfs2: target is busy. + +While tracing umount, it blames mnt_get_count() not return as expected. +Do a deep investigation for fget()/fput() on related code flow, I've +finally found that fget() leaks since ocfs2 doesn't support nowait +buffered read. + +io_issue_sqe +|-io_assign_file // do fget() first + |-io_read + |-io_iter_do_read + |-ocfs2_file_read_iter // return -EOPNOTSUPP + |-kiocb_done + |-io_rw_done + |-__io_complete_rw_common // set REQ_F_REISSUE + |-io_resubmit_prep + |-io_req_prep_async // override req->file, leak happens + +This was introduced by commit a196c78b5443 in v5.18. Fix it by don't +re-assign req->file if it has already been assigned. + +[1] https://lore.kernel.org/ocfs2-devel/ab580a75-91c8-d68a-3455-40361be1bfa8@linux.alibaba.com/T/#t + +Fixes: a196c78b5443 ("io_uring: assign non-fixed early for async work") +Cc: +Reported-by: Heming Zhao +Signed-off-by: Joseph Qi +Cc: Xiaoguang Wang +Link: https://lore.kernel.org/r/20230228045459.13524-1-joseph.qi@linux.alibaba.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/io_uring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index 80ba696e..a4e9dbc7 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -1728,7 +1728,7 @@ int io_req_prep_async(struct io_kiocb *req) + const struct io_op_def *def = &io_op_defs[req->opcode]; + + /* assign early for deferred execution for non-fixed file */ +- if (def->needs_file && !(req->flags & REQ_F_FIXED_FILE)) ++ if (def->needs_file && !(req->flags & REQ_F_FIXED_FILE) && !req->file) + req->file = io_file_get_normal(req, req->cqe.fd); + if (!def->prep_async) + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-759-s390-extmem-return-correct-segment-type-in-__se.patch b/patches.kernel.org/6.2.3-759-s390-extmem-return-correct-segment-type-in-__se.patch new file mode 100644 index 0000000..adcd0f8 --- /dev/null +++ b/patches.kernel.org/6.2.3-759-s390-extmem-return-correct-segment-type-in-__se.patch @@ -0,0 +1,82 @@ +From: Gerald Schaefer +Date: Mon, 27 Feb 2023 20:03:00 +0100 +Subject: [PATCH] s390/extmem: return correct segment type in __segment_load() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8c42dd78df148c90e48efff204cce38743906a79 + +commit 8c42dd78df148c90e48efff204cce38743906a79 upstream. + +Commit f05f62d04271f ("s390/vmem: get rid of memory segment list") +reshuffled the call to vmem_add_mapping() in __segment_load(), which now +overwrites rc after it was set to contain the segment type code. + +As result, __segment_load() will now always return 0 on success, which +corresponds to the segment type code SEG_TYPE_SW, i.e. a writeable +segment. This results in a kernel crash when loading a read-only segment +as dcssblk block device, and trying to write to it. + +Instead of reshuffling code again, make sure to return the segment type +on success, and also describe this rather delicate and unexpected logic +in the function comment. Also initialize new segtype variable with +invalid value, to prevent possible future confusion. + +Fixes: f05f62d04271 ("s390/vmem: get rid of memory segment list") +Cc: # 5.9+ +Signed-off-by: Gerald Schaefer +Reviewed-by: Heiko Carstens +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/s390/mm/extmem.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c +index 5060956b..1bc42ce2 100644 +--- a/arch/s390/mm/extmem.c ++++ b/arch/s390/mm/extmem.c +@@ -289,15 +289,17 @@ segment_overlaps_others (struct dcss_segment *seg) + + /* + * real segment loading function, called from segment_load ++ * Must return either an error code < 0, or the segment type code >= 0 + */ + static int + __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long *end) + { + unsigned long start_addr, end_addr, dummy; + struct dcss_segment *seg; +- int rc, diag_cc; ++ int rc, diag_cc, segtype; + + start_addr = end_addr = 0; ++ segtype = -1; + seg = kmalloc(sizeof(*seg), GFP_KERNEL | GFP_DMA); + if (seg == NULL) { + rc = -ENOMEM; +@@ -326,9 +328,9 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long + seg->res_name[8] = '\0'; + strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name)); + seg->res->name = seg->res_name; +- rc = seg->vm_segtype; +- if (rc == SEG_TYPE_SC || +- ((rc == SEG_TYPE_SR || rc == SEG_TYPE_ER) && !do_nonshared)) ++ segtype = seg->vm_segtype; ++ if (segtype == SEG_TYPE_SC || ++ ((segtype == SEG_TYPE_SR || segtype == SEG_TYPE_ER) && !do_nonshared)) + seg->res->flags |= IORESOURCE_READONLY; + + /* Check for overlapping resources before adding the mapping. */ +@@ -386,7 +388,7 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long + out_free: + kfree(seg); + out: +- return rc; ++ return rc < 0 ? rc : segtype; + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-760-s390-discard-.interp-section.patch b/patches.kernel.org/6.2.3-760-s390-discard-.interp-section.patch new file mode 100644 index 0000000..a3edea4 --- /dev/null +++ b/patches.kernel.org/6.2.3-760-s390-discard-.interp-section.patch @@ -0,0 +1,54 @@ +From: Ilya Leoshkevich +Date: Mon, 23 Jan 2023 22:50:32 +0100 +Subject: [PATCH] s390: discard .interp section +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e9c9cb90e76ffaabcc7ca8f275d9e82195fd6367 + +commit e9c9cb90e76ffaabcc7ca8f275d9e82195fd6367 upstream. + +When debugging vmlinux with QEMU + GDB, the following GDB error may +occur: + + (gdb) c + Continuing. + Warning: + Cannot insert breakpoint -1. + Cannot access memory at address 0xffffffffffff95c0 + + Command aborted. + (gdb) + +The reason is that, when .interp section is present, GDB tries to +locate the file specified in it in memory and put a number of +breakpoints there (see enable_break() function in gdb/solib-svr4.c). +Sometimes GDB finds a bogus location that matches its heuristics, +fails to set a breakpoint and stops. This makes further debugging +impossible. + +The .interp section contains misleading information anyway (vmlinux +does not need ld.so), so fix by discarding it. + +Signed-off-by: Ilya Leoshkevich +Cc: +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/s390/kernel/vmlinux.lds.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index cbf9c1b0..729d4f94 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -228,5 +228,6 @@ SECTIONS + DISCARDS + /DISCARD/ : { + *(.eh_frame) ++ *(.interp) + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-761-s390-ipl-add-DEFINE_GENERIC_LOADPARM.patch b/patches.kernel.org/6.2.3-761-s390-ipl-add-DEFINE_GENERIC_LOADPARM.patch new file mode 100644 index 0000000..efffbaa --- /dev/null +++ b/patches.kernel.org/6.2.3-761-s390-ipl-add-DEFINE_GENERIC_LOADPARM.patch @@ -0,0 +1,149 @@ +From: Sven Schnelle +Date: Sun, 29 Jan 2023 16:36:03 +0100 +Subject: [PATCH] s390/ipl: add DEFINE_GENERIC_LOADPARM() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c676aac66f5b2b03a1090bc6b1891486255f7159 + +commit c676aac66f5b2b03a1090bc6b1891486255f7159 upstream. + +In the current code each reipl type implements its own pair of loadparm +show/store functions. Add a macro to deduplicate the code a bit. + +Reviewed-by: Heiko Carstens +Signed-off-by: Sven Schnelle +Fixes: 87fd22e0ae92 ("s390/ipl: add eckd support") +Cc: +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/s390/kernel/ipl.c | 91 ++++++++++-------------------------------- + 1 file changed, 20 insertions(+), 71 deletions(-) + +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index fbd646db..3e593ca1 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -888,23 +888,26 @@ static ssize_t reipl_generic_loadparm_store(struct ipl_parameter_block *ipb, + return len; + } + +-/* FCP wrapper */ +-static ssize_t reipl_fcp_loadparm_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *page) +-{ +- return reipl_generic_loadparm_show(reipl_block_fcp, page); +-} +- +-static ssize_t reipl_fcp_loadparm_store(struct kobject *kobj, +- struct kobj_attribute *attr, +- const char *buf, size_t len) +-{ +- return reipl_generic_loadparm_store(reipl_block_fcp, buf, len); +-} +- +-static struct kobj_attribute sys_reipl_fcp_loadparm_attr = +- __ATTR(loadparm, 0644, reipl_fcp_loadparm_show, +- reipl_fcp_loadparm_store); ++#define DEFINE_GENERIC_LOADPARM(name) \ ++static ssize_t reipl_##name##_loadparm_show(struct kobject *kobj, \ ++ struct kobj_attribute *attr, char *page) \ ++{ \ ++ return reipl_generic_loadparm_show(reipl_block_##name, page); \ ++} \ ++static ssize_t reipl_##name##_loadparm_store(struct kobject *kobj, \ ++ struct kobj_attribute *attr, \ ++ const char *buf, size_t len) \ ++{ \ ++ return reipl_generic_loadparm_store(reipl_block_##name, buf, len); \ ++} \ ++static struct kobj_attribute sys_reipl_##name##_loadparm_attr = \ ++ __ATTR(loadparm, 0644, reipl_##name##_loadparm_show, \ ++ reipl_##name##_loadparm_store) ++ ++DEFINE_GENERIC_LOADPARM(fcp); ++DEFINE_GENERIC_LOADPARM(nvme); ++DEFINE_GENERIC_LOADPARM(ccw); ++DEFINE_GENERIC_LOADPARM(nss); + + static ssize_t reipl_fcp_clear_show(struct kobject *kobj, + struct kobj_attribute *attr, char *page) +@@ -994,24 +997,6 @@ DEFINE_IPL_ATTR_RW(reipl_nvme, bootprog, "%lld\n", "%lld\n", + DEFINE_IPL_ATTR_RW(reipl_nvme, br_lba, "%lld\n", "%lld\n", + reipl_block_nvme->nvme.br_lba); + +-/* nvme wrapper */ +-static ssize_t reipl_nvme_loadparm_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *page) +-{ +- return reipl_generic_loadparm_show(reipl_block_nvme, page); +-} +- +-static ssize_t reipl_nvme_loadparm_store(struct kobject *kobj, +- struct kobj_attribute *attr, +- const char *buf, size_t len) +-{ +- return reipl_generic_loadparm_store(reipl_block_nvme, buf, len); +-} +- +-static struct kobj_attribute sys_reipl_nvme_loadparm_attr = +- __ATTR(loadparm, 0644, reipl_nvme_loadparm_show, +- reipl_nvme_loadparm_store); +- + static struct attribute *reipl_nvme_attrs[] = { + &sys_reipl_nvme_fid_attr.attr, + &sys_reipl_nvme_nsid_attr.attr, +@@ -1047,38 +1032,6 @@ static struct kobj_attribute sys_reipl_nvme_clear_attr = + /* CCW reipl device attributes */ + DEFINE_IPL_CCW_ATTR_RW(reipl_ccw, device, reipl_block_ccw->ccw); + +-/* NSS wrapper */ +-static ssize_t reipl_nss_loadparm_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *page) +-{ +- return reipl_generic_loadparm_show(reipl_block_nss, page); +-} +- +-static ssize_t reipl_nss_loadparm_store(struct kobject *kobj, +- struct kobj_attribute *attr, +- const char *buf, size_t len) +-{ +- return reipl_generic_loadparm_store(reipl_block_nss, buf, len); +-} +- +-/* CCW wrapper */ +-static ssize_t reipl_ccw_loadparm_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *page) +-{ +- return reipl_generic_loadparm_show(reipl_block_ccw, page); +-} +- +-static ssize_t reipl_ccw_loadparm_store(struct kobject *kobj, +- struct kobj_attribute *attr, +- const char *buf, size_t len) +-{ +- return reipl_generic_loadparm_store(reipl_block_ccw, buf, len); +-} +- +-static struct kobj_attribute sys_reipl_ccw_loadparm_attr = +- __ATTR(loadparm, 0644, reipl_ccw_loadparm_show, +- reipl_ccw_loadparm_store); +- + static ssize_t reipl_ccw_clear_show(struct kobject *kobj, + struct kobj_attribute *attr, char *page) + { +@@ -1251,10 +1204,6 @@ static struct kobj_attribute sys_reipl_nss_name_attr = + __ATTR(name, 0644, reipl_nss_name_show, + reipl_nss_name_store); + +-static struct kobj_attribute sys_reipl_nss_loadparm_attr = +- __ATTR(loadparm, 0644, reipl_nss_loadparm_show, +- reipl_nss_loadparm_store); +- + static struct attribute *reipl_nss_attrs[] = { + &sys_reipl_nss_name_attr.attr, + &sys_reipl_nss_loadparm_attr.attr, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-762-s390-ipl-add-loadparm-parameter-to-eckd-ipl-rei.patch b/patches.kernel.org/6.2.3-762-s390-ipl-add-loadparm-parameter-to-eckd-ipl-rei.patch new file mode 100644 index 0000000..666cf54 --- /dev/null +++ b/patches.kernel.org/6.2.3-762-s390-ipl-add-loadparm-parameter-to-eckd-ipl-rei.patch @@ -0,0 +1,54 @@ +From: Sven Schnelle +Date: Sun, 29 Jan 2023 16:39:19 +0100 +Subject: [PATCH] s390/ipl: add loadparm parameter to eckd ipl/reipl data +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6bb361d5d8eb1dbc9e0b190eeee27a2ac4d1119f + +commit 6bb361d5d8eb1dbc9e0b190eeee27a2ac4d1119f upstream. + +commit 87fd22e0ae92 ("s390/ipl: add eckd support") missed to add the +loadparm attribute to the new eckd ipl/reipl data. + +Fixes: 87fd22e0ae92 ("s390/ipl: add eckd support") +Cc: +Signed-off-by: Sven Schnelle +Reviewed-by: Heiko Carstens +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/s390/kernel/ipl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index 3e593ca1..bcf03939 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -593,6 +593,7 @@ static struct attribute *ipl_eckd_attrs[] = { + &sys_ipl_type_attr.attr, + &sys_ipl_eckd_bootprog_attr.attr, + &sys_ipl_eckd_br_chr_attr.attr, ++ &sys_ipl_ccw_loadparm_attr.attr, + &sys_ipl_device_attr.attr, + &sys_ipl_secure_attr.attr, + &sys_ipl_has_secure_attr.attr, +@@ -908,6 +909,7 @@ DEFINE_GENERIC_LOADPARM(fcp); + DEFINE_GENERIC_LOADPARM(nvme); + DEFINE_GENERIC_LOADPARM(ccw); + DEFINE_GENERIC_LOADPARM(nss); ++DEFINE_GENERIC_LOADPARM(eckd); + + static ssize_t reipl_fcp_clear_show(struct kobject *kobj, + struct kobj_attribute *attr, char *page) +@@ -1129,6 +1131,7 @@ static struct attribute *reipl_eckd_attrs[] = { + &sys_reipl_eckd_device_attr.attr, + &sys_reipl_eckd_bootprog_attr.attr, + &sys_reipl_eckd_br_chr_attr.attr, ++ &sys_reipl_eckd_loadparm_attr.attr, + NULL, + }; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-763-s390-kprobes-fix-irq-mask-clobbering-on-kprobe-.patch b/patches.kernel.org/6.2.3-763-s390-kprobes-fix-irq-mask-clobbering-on-kprobe-.patch new file mode 100644 index 0000000..15dcbbe --- /dev/null +++ b/patches.kernel.org/6.2.3-763-s390-kprobes-fix-irq-mask-clobbering-on-kprobe-.patch @@ -0,0 +1,87 @@ +From: Vasily Gorbik +Date: Wed, 1 Mar 2023 02:23:08 +0100 +Subject: [PATCH] s390/kprobes: fix irq mask clobbering on kprobe reenter from + post_handler +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 42e19e6f04984088b6f9f0507c4c89a8152d9730 + +commit 42e19e6f04984088b6f9f0507c4c89a8152d9730 upstream. + +Recent test_kprobe_missed kprobes kunit test uncovers the following error +(reported when CONFIG_DEBUG_ATOMIC_SLEEP is enabled): + +BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 +in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 662, name: kunit_try_catch +preempt_count: 0, expected: 0 +RCU nest depth: 0, expected: 0 +no locks held by kunit_try_catch/662. +irq event stamp: 280 +hardirqs last enabled at (279): [<00000003e60a3d42>] __do_pgm_check+0x17a/0x1c0 +hardirqs last disabled at (280): [<00000003e3bd774a>] kprobe_exceptions_notify+0x27a/0x318 +softirqs last enabled at (0): [<00000003e3c5c890>] copy_process+0x14a8/0x4c80 +softirqs last disabled at (0): [<0000000000000000>] 0x0 +CPU: 46 PID: 662 Comm: kunit_try_catch Tainted: G N 6.2.0-173644-g44c18d77f0c0 #2 +Hardware name: IBM 3931 A01 704 (LPAR) +Call Trace: + [<00000003e60a3a00>] dump_stack_lvl+0x120/0x198 + [<00000003e3d02e82>] __might_resched+0x60a/0x668 + [<00000003e60b9908>] __mutex_lock+0xc0/0x14e0 + [<00000003e60bad5a>] mutex_lock_nested+0x32/0x40 + [<00000003e3f7b460>] unregister_kprobe+0x30/0xd8 + [<00000003e51b2602>] test_kprobe_missed+0xf2/0x268 + [<00000003e51b5406>] kunit_try_run_case+0x10e/0x290 + [<00000003e51b7dfa>] kunit_generic_run_threadfn_adapter+0x62/0xb8 + [<00000003e3ce30f8>] kthread+0x2d0/0x398 + [<00000003e3b96afa>] __ret_from_fork+0x8a/0xe8 + [<00000003e60ccada>] ret_from_fork+0xa/0x40 + +The reason for this error report is that kprobes handling code failed +to restore irqs. + +The problem is that when kprobe is triggered from another kprobe +post_handler current sequence of enable_singlestep / disable_singlestep +is the following: +enable_singlestep <- original kprobe (saves kprobe_saved_imask) +enable_singlestep <- kprobe triggered from post_handler (clobbers kprobe_saved_imask) +disable_singlestep <- kprobe triggered from post_handler (restores kprobe_saved_imask) +disable_singlestep <- original kprobe (restores wrong clobbered kprobe_saved_imask) + +There is just one kprobe_ctlblk per cpu and both calls saves and +loads irq mask to kprobe_saved_imask. To fix the problem simply move +resume_execution (which calls disable_singlestep) before calling +post_handler. This also fixes the problem that post_handler is called +with pt_regs which were not yet adjusted after single-stepping. + +Cc: stable@vger.kernel.org +Fixes: 4ba069b802c2 ("[S390] add kprobes support.") +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/s390/kernel/kprobes.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c +index 401f9c93..34482549 100644 +--- a/arch/s390/kernel/kprobes.c ++++ b/arch/s390/kernel/kprobes.c +@@ -432,12 +432,11 @@ static int post_kprobe_handler(struct pt_regs *regs) + if (!p) + return 0; + ++ resume_execution(p, regs); + if (kcb->kprobe_status != KPROBE_REENTER && p->post_handler) { + kcb->kprobe_status = KPROBE_HIT_SSDONE; + p->post_handler(p, regs, 0); + } +- +- resume_execution(p, regs); + pop_kprobe(kcb); + preempt_enable_no_resched(); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-764-s390-kprobes-fix-current_kprobe-never-cleared-a.patch b/patches.kernel.org/6.2.3-764-s390-kprobes-fix-current_kprobe-never-cleared-a.patch new file mode 100644 index 0000000..5f44aea --- /dev/null +++ b/patches.kernel.org/6.2.3-764-s390-kprobes-fix-current_kprobe-never-cleared-a.patch @@ -0,0 +1,61 @@ +From: Vasily Gorbik +Date: Wed, 1 Mar 2023 17:58:06 +0100 +Subject: [PATCH] s390/kprobes: fix current_kprobe never cleared after kprobes + reenter +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cd57953936f2213dfaccce10d20f396956222c7d + +commit cd57953936f2213dfaccce10d20f396956222c7d upstream. + +Recent test_kprobe_missed kprobes kunit test uncovers the following +problem. Once kprobe is triggered from another kprobe (kprobe reenter), +all future kprobes on this cpu are considered as kprobe reenter, thus +pre_handler and post_handler are not being called and kprobes are counted +as "missed". + +Commit b9599798f953 ("[S390] kprobes: activation and deactivation") +introduced a simpler scheme for kprobes (de)activation and status +tracking by using push_kprobe/pop_kprobe, which supposed to work for +both initial kprobe entry as well as kprobe reentry and helps to avoid +handling those two cases differently. The problem is that a sequence of +calls in case of kprobes reenter: +push_kprobe() <- NULL (current_kprobe) +push_kprobe() <- kprobe1 (current_kprobe) +pop_kprobe() -> kprobe1 (current_kprobe) +pop_kprobe() -> kprobe1 (current_kprobe) +leaves "kprobe1" as "current_kprobe" on this cpu, instead of setting it +to NULL. In fact push_kprobe/pop_kprobe can only store a single state +(there is just one prev_kprobe in kprobe_ctlblk). Which is a hack but +sufficient, there is no need to have another prev_kprobe just to store +NULL. To make a simple and backportable fix simply reset "prev_kprobe" +when kprobe is poped from this "stack". No need to worry about +"kprobe_status" in this case, because its value is only checked when +current_kprobe != NULL. + +Cc: stable@vger.kernel.org +Fixes: b9599798f953 ("[S390] kprobes: activation and deactivation") +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/s390/kernel/kprobes.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c +index 34482549..5ca02680 100644 +--- a/arch/s390/kernel/kprobes.c ++++ b/arch/s390/kernel/kprobes.c +@@ -278,6 +278,7 @@ static void pop_kprobe(struct kprobe_ctlblk *kcb) + { + __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp); + kcb->kprobe_status = kcb->prev_kprobe.status; ++ kcb->prev_kprobe.kp = NULL; + } + NOKPROBE_SYMBOL(pop_kprobe); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-765-KVM-s390-disable-migration-mode-when-dirty-trac.patch b/patches.kernel.org/6.2.3-765-KVM-s390-disable-migration-mode-when-dirty-trac.patch new file mode 100644 index 0000000..14ad977 --- /dev/null +++ b/patches.kernel.org/6.2.3-765-KVM-s390-disable-migration-mode-when-dirty-trac.patch @@ -0,0 +1,167 @@ +From: Nico Boehr +Date: Fri, 27 Jan 2023 15:05:32 +0100 +Subject: [PATCH] KVM: s390: disable migration mode when dirty tracking is + disabled +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f2d3155e2a6bac44d16f04415a321e8707d895c6 + +commit f2d3155e2a6bac44d16f04415a321e8707d895c6 upstream. + +Migration mode is a VM attribute which enables tracking of changes in +storage attributes (PGSTE). It assumes dirty tracking is enabled on all +memslots to keep a dirty bitmap of pages with changed storage attributes. + +When enabling migration mode, we currently check that dirty tracking is +enabled for all memslots. However, userspace can disable dirty tracking +without disabling migration mode. + +Since migration mode is pointless with dirty tracking disabled, disable +migration mode whenever userspace disables dirty tracking on any slot. + +Also update the documentation to clarify that dirty tracking must be +enabled when enabling migration mode, which is already enforced by the +code in kvm_s390_vm_start_migration(). + +Also highlight in the documentation for KVM_S390_GET_CMMA_BITS that it +can now fail with -EINVAL when dirty tracking is disabled while +migration mode is on. Move all the error codes to a table so this stays +readable. + +To disable migration mode, slots_lock should be held, which is taken +in kvm_set_memory_region() and thus held in +kvm_arch_prepare_memory_region(). + +Restructure the prepare code a bit so all the sanity checking is done +before disabling migration mode. This ensures migration mode isn't +disabled when some sanity check fails. + +Cc: stable@vger.kernel.org +Fixes: 190df4a212a7 ("KVM: s390: CMMA tracking, ESSA emulation, migration mode") +Signed-off-by: Nico Boehr +Reviewed-by: Janosch Frank +Reviewed-by: Claudio Imbrenda +Link: https://lore.kernel.org/r/20230127140532.230651-2-nrb@linux.ibm.com +Message-Id: <20230127140532.230651-2-nrb@linux.ibm.com> +[frankja@linux.ibm.com: fixed commit message typo, moved api.rst error table upwards] +Signed-off-by: Janosch Frank +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Documentation/virt/kvm/api.rst | 18 +++++++---- + Documentation/virt/kvm/devices/vm.rst | 4 +++ + arch/s390/kvm/kvm-s390.c | 43 +++++++++++++++++++-------- + 3 files changed, 46 insertions(+), 19 deletions(-) + +diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst +index 0a67cb73..dc89d4e9 100644 +--- a/Documentation/virt/kvm/api.rst ++++ b/Documentation/virt/kvm/api.rst +@@ -4457,6 +4457,18 @@ not holding a previously reported uncorrected error). + :Parameters: struct kvm_s390_cmma_log (in, out) + :Returns: 0 on success, a negative value on error + ++Errors: ++ ++ ====== ============================================================= ++ ENOMEM not enough memory can be allocated to complete the task ++ ENXIO if CMMA is not enabled ++ EINVAL if KVM_S390_CMMA_PEEK is not set but migration mode was not enabled ++ EINVAL if KVM_S390_CMMA_PEEK is not set but dirty tracking has been ++ disabled (and thus migration mode was automatically disabled) ++ EFAULT if the userspace address is invalid or if no page table is ++ present for the addresses (e.g. when using hugepages). ++ ====== ============================================================= ++ + This ioctl is used to get the values of the CMMA bits on the s390 + architecture. It is meant to be used in two scenarios: + +@@ -4537,12 +4549,6 @@ mask is unused. + + values points to the userspace buffer where the result will be stored. + +-This ioctl can fail with -ENOMEM if not enough memory can be allocated to +-complete the task, with -ENXIO if CMMA is not enabled, with -EINVAL if +-KVM_S390_CMMA_PEEK is not set but migration mode was not enabled, with +--EFAULT if the userspace address is invalid or if no page table is +-present for the addresses (e.g. when using hugepages). +- + 4.108 KVM_S390_SET_CMMA_BITS + ---------------------------- + +diff --git a/Documentation/virt/kvm/devices/vm.rst b/Documentation/virt/kvm/devices/vm.rst +index 60acc39e..147efec6 100644 +--- a/Documentation/virt/kvm/devices/vm.rst ++++ b/Documentation/virt/kvm/devices/vm.rst +@@ -302,6 +302,10 @@ Allows userspace to start migration mode, needed for PGSTE migration. + Setting this attribute when migration mode is already active will have + no effects. + ++Dirty tracking must be enabled on all memslots, else -EINVAL is returned. When ++dirty tracking is disabled on any memslot, migration mode is automatically ++stopped. ++ + :Parameters: none + :Returns: -ENOMEM if there is not enough free memory to start migration mode; + -EINVAL if the state of the VM is invalid (e.g. no memory defined); +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index e4890e04..cb72f9a0 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -5633,23 +5633,40 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, + if (kvm_s390_pv_get_handle(kvm)) + return -EINVAL; + +- if (change == KVM_MR_DELETE || change == KVM_MR_FLAGS_ONLY) +- return 0; ++ if (change != KVM_MR_DELETE && change != KVM_MR_FLAGS_ONLY) { ++ /* ++ * A few sanity checks. We can have memory slots which have to be ++ * located/ended at a segment boundary (1MB). The memory in userland is ++ * ok to be fragmented into various different vmas. It is okay to mmap() ++ * and munmap() stuff in this slot after doing this call at any time ++ */ + +- /* A few sanity checks. We can have memory slots which have to be +- located/ended at a segment boundary (1MB). The memory in userland is +- ok to be fragmented into various different vmas. It is okay to mmap() +- and munmap() stuff in this slot after doing this call at any time */ ++ if (new->userspace_addr & 0xffffful) ++ return -EINVAL; + +- if (new->userspace_addr & 0xffffful) +- return -EINVAL; ++ size = new->npages * PAGE_SIZE; ++ if (size & 0xffffful) ++ return -EINVAL; + +- size = new->npages * PAGE_SIZE; +- if (size & 0xffffful) +- return -EINVAL; ++ if ((new->base_gfn * PAGE_SIZE) + size > kvm->arch.mem_limit) ++ return -EINVAL; ++ } + +- if ((new->base_gfn * PAGE_SIZE) + size > kvm->arch.mem_limit) +- return -EINVAL; ++ if (!kvm->arch.migration_mode) ++ return 0; ++ ++ /* ++ * Turn off migration mode when: ++ * - userspace creates a new memslot with dirty logging off, ++ * - userspace modifies an existing memslot (MOVE or FLAGS_ONLY) and ++ * dirty logging is turned off. ++ * Migration mode expects dirty page logging being enabled to store ++ * its dirty bitmap. ++ */ ++ if (change != KVM_MR_DELETE && ++ !(new->flags & KVM_MEM_LOG_DIRTY_PAGES)) ++ WARN(kvm_s390_vm_stop_migration(kvm), ++ "Failed to stop migration mode"); + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-766-cifs-improve-checking-of-DFS-links-over-STATUS_.patch b/patches.kernel.org/6.2.3-766-cifs-improve-checking-of-DFS-links-over-STATUS_.patch new file mode 100644 index 0000000..6e5b2b6 --- /dev/null +++ b/patches.kernel.org/6.2.3-766-cifs-improve-checking-of-DFS-links-over-STATUS_.patch @@ -0,0 +1,245 @@ +From: Paulo Alcantara +Date: Tue, 28 Feb 2023 19:01:54 -0300 +Subject: [PATCH] cifs: improve checking of DFS links over + STATUS_OBJECT_NAME_INVALID +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b9ee2e307c6b06384b6f9e393a9b8e048e8fc277 + +commit b9ee2e307c6b06384b6f9e393a9b8e048e8fc277 upstream. + +Do not map STATUS_OBJECT_NAME_INVALID to -EREMOTE under non-DFS +shares, or 'nodfs' mounts or CONFIG_CIFS_DFS_UPCALL=n builds. +Otherwise, in the slow path, get a referral to figure out whether it +is an actual DFS link. + +This could be simply reproduced under a non-DFS share by running the +following + + $ mount.cifs //srv/share /mnt -o ... + $ cat /mnt/$(printf '\U110000') + cat: '/mnt/'$'\364\220\200\200': Object is remote + +Fixes: c877ce47e137 ("cifs: reduce roundtrips on create/qinfo requests") +CC: stable@vger.kernel.org # 6.2 +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cifsproto.h | 20 ++++++++++---- + fs/cifs/misc.c | 67 +++++++++++++++++++++++++++++++++++++++++++++ + fs/cifs/smb2inode.c | 21 +++++++------- + fs/cifs/smb2ops.c | 23 +++++++++------- + 4 files changed, 106 insertions(+), 25 deletions(-) + +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index 1207b396..e7518454 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -670,11 +670,21 @@ static inline int get_dfs_path(const unsigned int xid, struct cifs_ses *ses, + int match_target_ip(struct TCP_Server_Info *server, + const char *share, size_t share_len, + bool *result); +- +-int cifs_dfs_query_info_nonascii_quirk(const unsigned int xid, +- struct cifs_tcon *tcon, +- struct cifs_sb_info *cifs_sb, +- const char *dfs_link_path); ++int cifs_inval_name_dfs_link_error(const unsigned int xid, ++ struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, ++ const char *full_path, ++ bool *islink); ++#else ++static inline int cifs_inval_name_dfs_link_error(const unsigned int xid, ++ struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, ++ const char *full_path, ++ bool *islink) ++{ ++ *islink = false; ++ return 0; ++} + #endif + + static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options) +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 2a19c798..ae0679f0 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -21,6 +21,7 @@ + #include "cifsfs.h" + #ifdef CONFIG_CIFS_DFS_UPCALL + #include "dns_resolve.h" ++#include "dfs_cache.h" + #endif + #include "fs_context.h" + #include "cached_dir.h" +@@ -1300,4 +1301,70 @@ int cifs_update_super_prepath(struct cifs_sb_info *cifs_sb, char *prefix) + cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH; + return 0; + } ++ ++/* ++ * Handle weird Windows SMB server behaviour. It responds with ++ * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request for ++ * "\\\" DFS reference, where contains ++ * non-ASCII unicode symbols. ++ */ ++int cifs_inval_name_dfs_link_error(const unsigned int xid, ++ struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, ++ const char *full_path, ++ bool *islink) ++{ ++ struct cifs_ses *ses = tcon->ses; ++ size_t len; ++ char *path; ++ char *ref_path; ++ ++ *islink = false; ++ ++ /* ++ * Fast path - skip check when @full_path doesn't have a prefix path to ++ * look up or tcon is not DFS. ++ */ ++ if (strlen(full_path) < 2 || !cifs_sb || ++ (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS) || ++ !is_tcon_dfs(tcon) || !ses->server->origin_fullpath) ++ return 0; ++ ++ /* ++ * Slow path - tcon is DFS and @full_path has prefix path, so attempt ++ * to get a referral to figure out whether it is an DFS link. ++ */ ++ len = strnlen(tcon->tree_name, MAX_TREE_SIZE + 1) + strlen(full_path) + 1; ++ path = kmalloc(len, GFP_KERNEL); ++ if (!path) ++ return -ENOMEM; ++ ++ scnprintf(path, len, "%s%s", tcon->tree_name, full_path); ++ ref_path = dfs_cache_canonical_path(path + 1, cifs_sb->local_nls, ++ cifs_remap(cifs_sb)); ++ kfree(path); ++ ++ if (IS_ERR(ref_path)) { ++ if (PTR_ERR(ref_path) != -EINVAL) ++ return PTR_ERR(ref_path); ++ } else { ++ struct dfs_info3_param *refs = NULL; ++ int num_refs = 0; ++ ++ /* ++ * XXX: we are not using dfs_cache_find() here because we might ++ * end filling all the DFS cache and thus potentially ++ * removing cached DFS targets that the client would eventually ++ * need during failover. ++ */ ++ if (ses->server->ops->get_dfs_refer && ++ !ses->server->ops->get_dfs_refer(xid, ses, ref_path, &refs, ++ &num_refs, cifs_sb->local_nls, ++ cifs_remap(cifs_sb))) ++ *islink = refs[0].server_type == DFS_TYPE_LINK; ++ free_dfs_info_array(refs, num_refs); ++ kfree(ref_path); ++ } ++ return 0; ++} + #endif +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index 8521adf9..fff48e70 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -526,12 +526,13 @@ int smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_sb_info *cifs_sb, const char *full_path, + struct cifs_open_info_data *data, bool *adjust_tz, bool *reparse) + { +- int rc; + __u32 create_options = 0; + struct cifsFileInfo *cfile; + struct cached_fid *cfid = NULL; + struct kvec err_iov[3] = {}; + int err_buftype[3] = {}; ++ bool islink; ++ int rc, rc2; + + *adjust_tz = false; + *reparse = false; +@@ -579,15 +580,15 @@ int smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + SMB2_OP_QUERY_INFO, cfile, NULL, NULL, + NULL, NULL); + goto out; +- } else if (rc != -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && +- hdr->Status == STATUS_OBJECT_NAME_INVALID) { +- /* +- * Handle weird Windows SMB server behaviour. It responds with +- * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request +- * for "\\\" DFS reference, +- * where contains non-ASCII unicode symbols. +- */ +- rc = -EREMOTE; ++ } else if (rc != -EREMOTE && hdr->Status == STATUS_OBJECT_NAME_INVALID) { ++ rc2 = cifs_inval_name_dfs_link_error(xid, tcon, cifs_sb, ++ full_path, &islink); ++ if (rc2) { ++ rc = rc2; ++ goto out; ++ } ++ if (islink) ++ rc = -EREMOTE; + } + if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb && + (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)) +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index e6bcd2ba..a1fff47e 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -794,7 +794,6 @@ static int + smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_sb_info *cifs_sb, const char *full_path) + { +- int rc; + __le16 *utf16_path; + __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; + int err_buftype = CIFS_NO_BUFFER; +@@ -802,6 +801,8 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + struct kvec err_iov = {}; + struct cifs_fid fid; + struct cached_fid *cfid; ++ bool islink; ++ int rc, rc2; + + rc = open_cached_dir(xid, tcon, full_path, cifs_sb, true, &cfid); + if (!rc) { +@@ -830,15 +831,17 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + + if (unlikely(!hdr || err_buftype == CIFS_NO_BUFFER)) + goto out; +- /* +- * Handle weird Windows SMB server behaviour. It responds with +- * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request +- * for "\\\" DFS reference, +- * where contains non-ASCII unicode symbols. +- */ +- if (rc != -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && +- hdr->Status == STATUS_OBJECT_NAME_INVALID) +- rc = -EREMOTE; ++ ++ if (rc != -EREMOTE && hdr->Status == STATUS_OBJECT_NAME_INVALID) { ++ rc2 = cifs_inval_name_dfs_link_error(xid, tcon, cifs_sb, ++ full_path, &islink); ++ if (rc2) { ++ rc = rc2; ++ goto out; ++ } ++ if (islink) ++ rc = -EREMOTE; ++ } + if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb && + (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)) + rc = -EOPNOTSUPP; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-767-cifs-Fix-uninitialized-memory-read-in-smb3_qfs_.patch b/patches.kernel.org/6.2.3-767-cifs-Fix-uninitialized-memory-read-in-smb3_qfs_.patch new file mode 100644 index 0000000..ecaf43f --- /dev/null +++ b/patches.kernel.org/6.2.3-767-cifs-Fix-uninitialized-memory-read-in-smb3_qfs_.patch @@ -0,0 +1,48 @@ +From: Volker Lendecke +Date: Wed, 11 Jan 2023 12:37:58 +0100 +Subject: [PATCH] cifs: Fix uninitialized memory read in smb3_qfs_tcon() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d447e794a37288ec7a080aa1b044a8d9deebbab7 + +commit d447e794a37288ec7a080aa1b044a8d9deebbab7 upstream. + +oparms was not fully initialized + +Signed-off-by: Volker Lendecke +Reviewed-by: Paulo Alcantara (SUSE) +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2ops.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index a1fff47e..f95fa34b 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -729,12 +729,13 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid fid; + struct cached_fid *cfid = NULL; + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = open_cached_dir(xid, tcon, "", cifs_sb, false, &cfid); + if (rc == 0) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-768-cifs-Fix-uninitialized-memory-reads-for-oparms..patch b/patches.kernel.org/6.2.3-768-cifs-Fix-uninitialized-memory-reads-for-oparms..patch new file mode 100644 index 0000000..9a11169 --- /dev/null +++ b/patches.kernel.org/6.2.3-768-cifs-Fix-uninitialized-memory-reads-for-oparms..patch @@ -0,0 +1,813 @@ +From: Volker Lendecke +Date: Wed, 11 Jan 2023 12:37:58 +0100 +Subject: [PATCH] cifs: Fix uninitialized memory reads for oparms.mode +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: de036dcaca65cf94bf7ff09c571c077f02bc92b4 + +commit de036dcaca65cf94bf7ff09c571c077f02bc92b4 upstream. + +Use a struct assignment with implicit member initialization + +Signed-off-by: Volker Lendecke +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cached_dir.c | 13 +-- + fs/cifs/cifsacl.c | 34 ++++---- + fs/cifs/cifssmb.c | 17 ++-- + fs/cifs/dir.c | 19 +++-- + fs/cifs/file.c | 35 ++++---- + fs/cifs/inode.c | 53 ++++++------ + fs/cifs/link.c | 66 ++++++++------- + fs/cifs/smb1ops.c | 72 ++++++++-------- + fs/cifs/smb2inode.c | 17 ++-- + fs/cifs/smb2ops.c | 191 +++++++++++++++++++++++-------------------- + 10 files changed, 274 insertions(+), 243 deletions(-) + +diff --git a/fs/cifs/cached_dir.c b/fs/cifs/cached_dir.c +index 60399081..b36ae640 100644 +--- a/fs/cifs/cached_dir.c ++++ b/fs/cifs/cached_dir.c +@@ -181,12 +181,13 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- oparms.tcon = tcon; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE); +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.fid = pfid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE), ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .fid = pfid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c +index bbf58c24..3cc34711 100644 +--- a/fs/cifs/cifsacl.c ++++ b/fs/cifs/cifsacl.c +@@ -1428,14 +1428,15 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, + tcon = tlink_tcon(tlink); + xid = get_xid(); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = READ_CONTROL; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = READ_CONTROL, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (!rc) { +@@ -1494,14 +1495,15 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + else + access_flags = WRITE_DAC; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = access_flags; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = access_flags, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc) { +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 23f10e0d..8c014a3f 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -5372,14 +5372,15 @@ CIFSSMBSetPathInfoFB(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid fid; + int rc; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = fileName; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = fileName, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc) +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index ad4208bf..1bf61778 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -304,15 +304,16 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned + if (!tcon->unix_ext && (mode & S_IWUGO) == 0) + create_options |= CREATE_OPTION_READONLY; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = desired_access; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.disposition = disposition; +- oparms.path = full_path; +- oparms.fid = fid; +- oparms.reconnect = false; +- oparms.mode = mode; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = desired_access, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .disposition = disposition, ++ .path = full_path, ++ .fid = fid, ++ .mode = mode, ++ }; + rc = server->ops->open(xid, &oparms, oplock, buf); + if (rc) { + cifs_dbg(FYI, "cifs_create returned 0x%x\n", rc); +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index b8d1cbad..a53ddc81 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -260,14 +260,15 @@ static int cifs_nt_open(const char *full_path, struct inode *inode, struct cifs_ + if (f_flags & O_DIRECT) + create_options |= CREATE_NO_BUFFER; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = desired_access; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.disposition = disposition; +- oparms.path = full_path; +- oparms.fid = fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = desired_access, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .disposition = disposition, ++ .path = full_path, ++ .fid = fid, ++ }; + + rc = server->ops->open(xid, &oparms, oplock, buf); + if (rc) +@@ -848,14 +849,16 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + if (server->ops->get_lease_key) + server->ops->get_lease_key(inode, &cfile->fid); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = desired_access; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.disposition = disposition; +- oparms.path = full_path; +- oparms.fid = &cfile->fid; +- oparms.reconnect = true; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = desired_access, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .disposition = disposition, ++ .path = full_path, ++ .fid = &cfile->fid, ++ .reconnect = true, ++ }; + + /* + * Can not refresh inode by passing in file_info buf to be returned by +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index f145a59a..7d0cc39d 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -508,14 +508,15 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path, + return PTR_ERR(tlink); + tcon = tlink_tcon(tlink); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_READ; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_READ, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + if (tcon->ses->server->oplocks) + oplock = REQ_OPLOCK; +@@ -1518,14 +1519,15 @@ cifs_rename_pending_delete(const char *full_path, struct dentry *dentry, + goto out; + } + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = DELETE | FILE_WRITE_ATTRIBUTES; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = DELETE | FILE_WRITE_ATTRIBUTES, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = full_path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc != 0) +@@ -2112,15 +2114,16 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry, + if (to_dentry->d_parent != from_dentry->d_parent) + goto do_rename_exit; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- /* open the file to be renamed -- we need DELETE perms */ +- oparms.desired_access = DELETE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = from_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ /* open the file to be renamed -- we need DELETE perms */ ++ .desired_access = DELETE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = from_path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc == 0) { +diff --git a/fs/cifs/link.c b/fs/cifs/link.c +index a5a097a6..d937eedd 100644 +--- a/fs/cifs/link.c ++++ b/fs/cifs/link.c +@@ -271,14 +271,15 @@ cifs_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + int buf_type = CIFS_NO_BUFFER; + FILE_ALL_INFO file_info; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_READ; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_READ, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, &file_info); + if (rc) +@@ -313,14 +314,15 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + struct cifs_open_parms oparms; + struct cifs_io_parms io_parms = {0}; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_CREATE; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_CREATE, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc) +@@ -355,13 +357,14 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; + struct smb2_file_all_info *pfile_info = NULL; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_READ; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_READ, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .fid = &fid, ++ }; + + utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); + if (utf16_path == NULL) +@@ -421,14 +424,15 @@ smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + if (!utf16_path) + return -ENOMEM; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_CREATE; +- oparms.fid = &fid; +- oparms.reconnect = false; +- oparms.mode = 0644; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_CREATE, ++ .fid = &fid, ++ .mode = 0644, ++ }; + + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, + NULL, NULL); +diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c +index 4cb36445..abda6148 100644 +--- a/fs/cifs/smb1ops.c ++++ b/fs/cifs/smb1ops.c +@@ -576,14 +576,15 @@ static int cifs_query_path_info(const unsigned int xid, struct cifs_tcon *tcon, + if (!(le32_to_cpu(fi.Attributes) & ATTR_REPARSE)) + return 0; + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = full_path, ++ .fid = &fid, ++ }; + + /* Need to check if this is a symbolic link or not */ + tmprc = CIFS_open(xid, &oparms, &oplock, NULL); +@@ -823,14 +824,15 @@ smb_set_file_info(struct inode *inode, const char *full_path, + goto out; + } + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = SYNCHRONIZE | FILE_WRITE_ATTRIBUTES; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); +- oparms.disposition = FILE_OPEN; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = SYNCHRONIZE | FILE_WRITE_ATTRIBUTES, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), ++ .disposition = FILE_OPEN, ++ .path = full_path, ++ .fid = &fid, ++ }; + + cifs_dbg(FYI, "calling SetFileInfo since SetPathInfo for times not supported by this server\n"); + rc = CIFS_open(xid, &oparms, &oplock, NULL); +@@ -998,15 +1000,16 @@ cifs_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + goto out; + } + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.create_options = cifs_create_options(cifs_sb, +- OPEN_REPARSE_POINT); +- oparms.disposition = FILE_OPEN; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .create_options = cifs_create_options(cifs_sb, ++ OPEN_REPARSE_POINT), ++ .disposition = FILE_OPEN, ++ .path = full_path, ++ .fid = &fid, ++ }; + + rc = CIFS_open(xid, &oparms, &oplock, NULL); + if (rc) +@@ -1115,15 +1118,16 @@ cifs_make_node(unsigned int xid, struct inode *inode, + + cifs_dbg(FYI, "sfu compat create special file\n"); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | +- CREATE_OPTION_SPECIAL); +- oparms.disposition = FILE_CREATE; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | ++ CREATE_OPTION_SPECIAL), ++ .disposition = FILE_CREATE, ++ .path = full_path, ++ .fid = &fid, ++ }; + + if (tcon->ses->server->oplocks) + oplock = REQ_OPLOCK; +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index fff48e70..9b956294 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -105,14 +105,15 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + goto finished; + } + +- vars->oparms.tcon = tcon; +- vars->oparms.desired_access = desired_access; +- vars->oparms.disposition = create_disposition; +- vars->oparms.create_options = cifs_create_options(cifs_sb, create_options); +- vars->oparms.fid = &fid; +- vars->oparms.reconnect = false; +- vars->oparms.mode = mode; +- vars->oparms.cifs_sb = cifs_sb; ++ vars->oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = desired_access, ++ .disposition = create_disposition, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .fid = &fid, ++ .mode = mode, ++ .cifs_sb = cifs_sb, ++ }; + + rqst[num_rqst].rq_iov = &vars->open_iov[0]; + rqst[num_rqst].rq_nvec = SMB2_CREATE_IOV_SIZE; +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index f95fa34b..c7f8dba5 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -772,12 +772,13 @@ smb2_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_open_parms oparms; + struct cifs_fid fid; + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL, + NULL, NULL); +@@ -818,12 +819,13 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, + if (!utf16_path) + return -ENOMEM; + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, + &err_iov, &err_buftype); +@@ -1101,13 +1103,13 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- memset(&oparms, 0, sizeof(oparms)); +- oparms.tcon = tcon; +- oparms.desired_access = FILE_WRITE_EA; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_WRITE_EA, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -1457,12 +1459,12 @@ smb2_ioctl_query_info(const unsigned int xid, + rqst[0].rq_iov = &vars->open_iov[0]; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- memset(&oparms, 0, sizeof(oparms)); +- oparms.tcon = tcon; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .fid = &fid, ++ }; + + if (qi.flags & PASSTHRU_FSCTL) { + switch (qi.info_type & FSCTL_DEVICE_ACCESS_MASK) { +@@ -2092,12 +2094,13 @@ smb3_notify(const unsigned int xid, struct file *pfile, + } + + tcon = cifs_sb_master_tcon(cifs_sb); +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, NULL, + NULL); +@@ -2163,12 +2166,13 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -2494,12 +2498,13 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- oparms.tcon = tcon; +- oparms.desired_access = desired_access; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = desired_access, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -2627,12 +2632,13 @@ smb311_queryfs(const unsigned int xid, struct cifs_tcon *tcon, + if (!tcon->posix_extensions) + return smb2_queryfs(xid, tcon, cifs_sb, buf); + +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL, + NULL, NULL); +@@ -2920,13 +2926,13 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- memset(&oparms, 0, sizeof(oparms)); +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, create_options); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, create_options), ++ .fid = &fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -3060,13 +3066,13 @@ smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon, + rqst[0].rq_iov = open_iov; + rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE; + +- memset(&oparms, 0, sizeof(oparms)); +- oparms.tcon = tcon; +- oparms.desired_access = FILE_READ_ATTRIBUTES; +- oparms.disposition = FILE_OPEN; +- oparms.create_options = cifs_create_options(cifs_sb, OPEN_REPARSE_POINT); +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = FILE_READ_ATTRIBUTES, ++ .disposition = FILE_OPEN, ++ .create_options = cifs_create_options(cifs_sb, OPEN_REPARSE_POINT), ++ .fid = &fid, ++ }; + + rc = SMB2_open_init(tcon, server, + &rqst[0], &oplock, &oparms, utf16_path); +@@ -3200,17 +3206,20 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, + return ERR_PTR(rc); + } + +- oparms.tcon = tcon; +- oparms.desired_access = READ_CONTROL; +- oparms.disposition = FILE_OPEN; +- /* +- * When querying an ACL, even if the file is a symlink we want to open +- * the source not the target, and so the protocol requires that the +- * client specify this flag when opening a reparse point +- */ +- oparms.create_options = cifs_create_options(cifs_sb, 0) | OPEN_REPARSE_POINT; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = READ_CONTROL, ++ .disposition = FILE_OPEN, ++ /* ++ * When querying an ACL, even if the file is a symlink ++ * we want to open the source not the target, and so ++ * the protocol requires that the client specify this ++ * flag when opening a reparse point ++ */ ++ .create_options = cifs_create_options(cifs_sb, 0) | ++ OPEN_REPARSE_POINT, ++ .fid = &fid, ++ }; + + if (info & SACL_SECINFO) + oparms.desired_access |= SYSTEM_SECURITY; +@@ -3269,13 +3278,14 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + return rc; + } + +- oparms.tcon = tcon; +- oparms.desired_access = access_flags; +- oparms.create_options = cifs_create_options(cifs_sb, 0); +- oparms.disposition = FILE_OPEN; +- oparms.path = path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .desired_access = access_flags, ++ .create_options = cifs_create_options(cifs_sb, 0), ++ .disposition = FILE_OPEN, ++ .path = path, ++ .fid = &fid, ++ }; + + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, + NULL, NULL); +@@ -5138,15 +5148,16 @@ smb2_make_node(unsigned int xid, struct inode *inode, + + cifs_dbg(FYI, "sfu compat create special file\n"); + +- oparms.tcon = tcon; +- oparms.cifs_sb = cifs_sb; +- oparms.desired_access = GENERIC_WRITE; +- oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | +- CREATE_OPTION_SPECIAL); +- oparms.disposition = FILE_CREATE; +- oparms.path = full_path; +- oparms.fid = &fid; +- oparms.reconnect = false; ++ oparms = (struct cifs_open_parms) { ++ .tcon = tcon, ++ .cifs_sb = cifs_sb, ++ .desired_access = GENERIC_WRITE, ++ .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | ++ CREATE_OPTION_SPECIAL), ++ .disposition = FILE_CREATE, ++ .path = full_path, ++ .fid = &fid, ++ }; + + if (tcon->ses->server->oplocks) + oplock = REQ_OPLOCK; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-769-cifs-fix-mount-on-old-smb-servers.patch b/patches.kernel.org/6.2.3-769-cifs-fix-mount-on-old-smb-servers.patch new file mode 100644 index 0000000..b84260c --- /dev/null +++ b/patches.kernel.org/6.2.3-769-cifs-fix-mount-on-old-smb-servers.patch @@ -0,0 +1,141 @@ +From: Paulo Alcantara +Date: Thu, 16 Feb 2023 15:33:22 -0300 +Subject: [PATCH] cifs: fix mount on old smb servers +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d99e86ebde2d7b3a04190f8d14de5bf6814bf10f + +commit d99e86ebde2d7b3a04190f8d14de5bf6814bf10f upstream. + +The client was sending rfc1002 session request packet with a wrong +length field set, therefore failing to mount shares against old SMB +servers over port 139. + +Fix this by calculating the correct length as specified in rfc1002. + +Fixes: d7173623bf0b ("cifs: use ALIGN() and round_up() macros") +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/connect.c | 94 ++++++++++++++++++----------------------------- + 1 file changed, 35 insertions(+), 59 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index b2a04b4e..af49ae53 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2843,72 +2843,48 @@ ip_rfc1001_connect(struct TCP_Server_Info *server) + * negprot - BB check reconnection in case where second + * sessinit is sent but no second negprot + */ +- struct rfc1002_session_packet *ses_init_buf; +- unsigned int req_noscope_len; +- struct smb_hdr *smb_buf; ++ struct rfc1002_session_packet req = {}; ++ struct smb_hdr *smb_buf = (struct smb_hdr *)&req; ++ unsigned int len; + +- ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), +- GFP_KERNEL); ++ req.trailer.session_req.called_len = sizeof(req.trailer.session_req.called_name); + +- if (ses_init_buf) { +- ses_init_buf->trailer.session_req.called_len = 32; ++ if (server->server_RFC1001_name[0] != 0) ++ rfc1002mangle(req.trailer.session_req.called_name, ++ server->server_RFC1001_name, ++ RFC1001_NAME_LEN_WITH_NULL); ++ else ++ rfc1002mangle(req.trailer.session_req.called_name, ++ DEFAULT_CIFS_CALLED_NAME, ++ RFC1001_NAME_LEN_WITH_NULL); + +- if (server->server_RFC1001_name[0] != 0) +- rfc1002mangle(ses_init_buf->trailer. +- session_req.called_name, +- server->server_RFC1001_name, +- RFC1001_NAME_LEN_WITH_NULL); +- else +- rfc1002mangle(ses_init_buf->trailer. +- session_req.called_name, +- DEFAULT_CIFS_CALLED_NAME, +- RFC1001_NAME_LEN_WITH_NULL); ++ req.trailer.session_req.calling_len = sizeof(req.trailer.session_req.calling_name); + +- ses_init_buf->trailer.session_req.calling_len = 32; ++ /* calling name ends in null (byte 16) from old smb convention */ ++ if (server->workstation_RFC1001_name[0] != 0) ++ rfc1002mangle(req.trailer.session_req.calling_name, ++ server->workstation_RFC1001_name, ++ RFC1001_NAME_LEN_WITH_NULL); ++ else ++ rfc1002mangle(req.trailer.session_req.calling_name, ++ "LINUX_CIFS_CLNT", ++ RFC1001_NAME_LEN_WITH_NULL); + +- /* +- * calling name ends in null (byte 16) from old smb +- * convention. +- */ +- if (server->workstation_RFC1001_name[0] != 0) +- rfc1002mangle(ses_init_buf->trailer. +- session_req.calling_name, +- server->workstation_RFC1001_name, +- RFC1001_NAME_LEN_WITH_NULL); +- else +- rfc1002mangle(ses_init_buf->trailer. +- session_req.calling_name, +- "LINUX_CIFS_CLNT", +- RFC1001_NAME_LEN_WITH_NULL); +- +- ses_init_buf->trailer.session_req.scope1 = 0; +- ses_init_buf->trailer.session_req.scope2 = 0; +- smb_buf = (struct smb_hdr *)ses_init_buf; +- +- /* sizeof RFC1002_SESSION_REQUEST with no scopes */ +- req_noscope_len = sizeof(struct rfc1002_session_packet) - 2; +- +- /* == cpu_to_be32(0x81000044) */ +- smb_buf->smb_buf_length = +- cpu_to_be32((RFC1002_SESSION_REQUEST << 24) | req_noscope_len); +- rc = smb_send(server, smb_buf, 0x44); +- kfree(ses_init_buf); +- /* +- * RFC1001 layer in at least one server +- * requires very short break before negprot +- * presumably because not expecting negprot +- * to follow so fast. This is a simple +- * solution that works without +- * complicating the code and causes no +- * significant slowing down on mount +- * for everyone else +- */ +- usleep_range(1000, 2000); +- } + /* +- * else the negprot may still work without this +- * even though malloc failed ++ * As per rfc1002, @len must be the number of bytes that follows the ++ * length field of a rfc1002 session request payload. ++ */ ++ len = sizeof(req) - offsetof(struct rfc1002_session_packet, trailer.session_req); ++ ++ smb_buf->smb_buf_length = cpu_to_be32((RFC1002_SESSION_REQUEST << 24) | len); ++ rc = smb_send(server, smb_buf, len); ++ /* ++ * RFC1001 layer in at least one server requires very short break before ++ * negprot presumably because not expecting negprot to follow so fast. ++ * This is a simple solution that works without complicating the code ++ * and causes no significant slowing down on mount for everyone else + */ ++ usleep_range(1000, 2000); + + return rc; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-770-cifs-introduce-cifs_io_parms-in-smb2_async_writ.patch b/patches.kernel.org/6.2.3-770-cifs-introduce-cifs_io_parms-in-smb2_async_writ.patch new file mode 100644 index 0000000..7b086aa --- /dev/null +++ b/patches.kernel.org/6.2.3-770-cifs-introduce-cifs_io_parms-in-smb2_async_writ.patch @@ -0,0 +1,144 @@ +From: Stefan Metzmacher +Date: Wed, 1 Feb 2023 16:21:39 +0100 +Subject: [PATCH] cifs: introduce cifs_io_parms in smb2_async_writev() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d643a8a446fc46c06837d08a056f69da2ff16025 + +commit d643a8a446fc46c06837d08a056f69da2ff16025 upstream. + +This will simplify the following changes and makes it easy to get +in passed in from the caller in future. + +Signed-off-by: Stefan Metzmacher +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: David Howells +Cc: linux-cifs@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2pdu.c | 53 ++++++++++++++++++++++++++++++++++------------- + 1 file changed, 39 insertions(+), 14 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 5a063af8..5b3a821b 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -4504,10 +4504,27 @@ smb2_async_writev(struct cifs_writedata *wdata, + struct kvec iov[1]; + struct smb_rqst rqst = { }; + unsigned int total_len; ++ struct cifs_io_parms _io_parms; ++ struct cifs_io_parms *io_parms = NULL; + + if (!wdata->server) + server = wdata->server = cifs_pick_channel(tcon->ses); + ++ /* ++ * in future we may get cifs_io_parms passed in from the caller, ++ * but for now we construct it here... ++ */ ++ _io_parms = (struct cifs_io_parms) { ++ .tcon = tcon, ++ .server = server, ++ .offset = wdata->offset, ++ .length = wdata->bytes, ++ .persistent_fid = wdata->cfile->fid.persistent_fid, ++ .volatile_fid = wdata->cfile->fid.volatile_fid, ++ .pid = wdata->pid, ++ }; ++ io_parms = &_io_parms; ++ + rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, + (void **) &req, &total_len); + if (rc) +@@ -4517,26 +4534,31 @@ smb2_async_writev(struct cifs_writedata *wdata, + flags |= CIFS_TRANSFORM_REQ; + + shdr = (struct smb2_hdr *)req; +- shdr->Id.SyncId.ProcessId = cpu_to_le32(wdata->cfile->pid); ++ shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid); + +- req->PersistentFileId = wdata->cfile->fid.persistent_fid; +- req->VolatileFileId = wdata->cfile->fid.volatile_fid; ++ req->PersistentFileId = io_parms->persistent_fid; ++ req->VolatileFileId = io_parms->volatile_fid; + req->WriteChannelInfoOffset = 0; + req->WriteChannelInfoLength = 0; + req->Channel = 0; +- req->Offset = cpu_to_le64(wdata->offset); ++ req->Offset = cpu_to_le64(io_parms->offset); + req->DataOffset = cpu_to_le16( + offsetof(struct smb2_write_req, Buffer)); + req->RemainingBytes = 0; + +- trace_smb3_write_enter(0 /* xid */, wdata->cfile->fid.persistent_fid, +- tcon->tid, tcon->ses->Suid, wdata->offset, wdata->bytes); ++ trace_smb3_write_enter(0 /* xid */, ++ io_parms->persistent_fid, ++ io_parms->tcon->tid, ++ io_parms->tcon->ses->Suid, ++ io_parms->offset, ++ io_parms->length); ++ + #ifdef CONFIG_CIFS_SMB_DIRECT + /* + * If we want to do a server RDMA read, fill in and append + * smbd_buffer_descriptor_v1 to the end of write request + */ +- if (server->rdma && !server->sign && wdata->bytes >= ++ if (server->rdma && !server->sign && io_parms->length >= + server->smbd_conn->rdma_readwrite_threshold) { + + struct smbd_buffer_descriptor_v1 *v1; +@@ -4590,14 +4612,14 @@ smb2_async_writev(struct cifs_writedata *wdata, + } + #endif + cifs_dbg(FYI, "async write at %llu %u bytes\n", +- wdata->offset, wdata->bytes); ++ io_parms->offset, io_parms->length); + + #ifdef CONFIG_CIFS_SMB_DIRECT + /* For RDMA read, I/O size is in RemainingBytes not in Length */ + if (!wdata->mr) +- req->Length = cpu_to_le32(wdata->bytes); ++ req->Length = cpu_to_le32(io_parms->length); + #else +- req->Length = cpu_to_le32(wdata->bytes); ++ req->Length = cpu_to_le32(io_parms->length); + #endif + + if (wdata->credits.value > 0) { +@@ -4605,7 +4627,7 @@ smb2_async_writev(struct cifs_writedata *wdata, + SMB2_MAX_BUFFER_SIZE)); + shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); + +- rc = adjust_credits(server, &wdata->credits, wdata->bytes); ++ rc = adjust_credits(server, &wdata->credits, io_parms->length); + if (rc) + goto async_writev_out; + +@@ -4618,9 +4640,12 @@ smb2_async_writev(struct cifs_writedata *wdata, + + if (rc) { + trace_smb3_write_err(0 /* no xid */, +- req->PersistentFileId, +- tcon->tid, tcon->ses->Suid, wdata->offset, +- wdata->bytes, rc); ++ io_parms->persistent_fid, ++ io_parms->tcon->tid, ++ io_parms->tcon->ses->Suid, ++ io_parms->offset, ++ io_parms->length, ++ rc); + kref_put(&wdata->refcount, release); + cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-771-cifs-split-out-smb3_use_rdma_offload-helper.patch b/patches.kernel.org/6.2.3-771-cifs-split-out-smb3_use_rdma_offload-helper.patch new file mode 100644 index 0000000..6e1ed67 --- /dev/null +++ b/patches.kernel.org/6.2.3-771-cifs-split-out-smb3_use_rdma_offload-helper.patch @@ -0,0 +1,89 @@ +From: Stefan Metzmacher +Date: Wed, 1 Feb 2023 16:21:40 +0100 +Subject: [PATCH] cifs: split out smb3_use_rdma_offload() helper +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a6559cc1d35d3eeafb0296aca347b2f745a28a74 + +commit a6559cc1d35d3eeafb0296aca347b2f745a28a74 upstream. + +We should have the logic to decide if we want rdma offload +in a single spot in order to advance it in future. + +Signed-off-by: Stefan Metzmacher +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: David Howells +Cc: linux-cifs@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2pdu.c | 34 ++++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 5b3a821b..b68f43ed 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -4063,6 +4063,32 @@ SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, + return rc; + } + ++#ifdef CONFIG_CIFS_SMB_DIRECT ++static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) ++{ ++ struct TCP_Server_Info *server = io_parms->server; ++ struct cifs_tcon *tcon = io_parms->tcon; ++ ++ /* we can only offload if we're connected */ ++ if (!server || !tcon) ++ return false; ++ ++ /* we can only offload on an rdma connection */ ++ if (!server->rdma || !server->smbd_conn) ++ return false; ++ ++ /* we don't support signed offload yet */ ++ if (server->sign) ++ return false; ++ ++ /* offload also has its overhead, so only do it if desired */ ++ if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) ++ return false; ++ ++ return true; ++} ++#endif /* CONFIG_CIFS_SMB_DIRECT */ ++ + /* + * To form a chain of read requests, any read requests after the first should + * have the end_of_chain boolean set to true. +@@ -4106,9 +4132,7 @@ smb2_new_read_req(void **buf, unsigned int *total_len, + * If we want to do a RDMA write, fill in and append + * smbd_buffer_descriptor_v1 to the end of read request + */ +- if (server->rdma && rdata && !server->sign && +- rdata->bytes >= server->smbd_conn->rdma_readwrite_threshold) { +- ++ if (smb3_use_rdma_offload(io_parms)) { + struct smbd_buffer_descriptor_v1 *v1; + bool need_invalidate = server->dialect == SMB30_PROT_ID; + +@@ -4558,9 +4582,7 @@ smb2_async_writev(struct cifs_writedata *wdata, + * If we want to do a server RDMA read, fill in and append + * smbd_buffer_descriptor_v1 to the end of write request + */ +- if (server->rdma && !server->sign && io_parms->length >= +- server->smbd_conn->rdma_readwrite_threshold) { +- ++ if (smb3_use_rdma_offload(io_parms)) { + struct smbd_buffer_descriptor_v1 *v1; + bool need_invalidate = server->dialect == SMB30_PROT_ID; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-772-cifs-don-t-try-to-use-rdma-offload-on-encrypted.patch b/patches.kernel.org/6.2.3-772-cifs-don-t-try-to-use-rdma-offload-on-encrypted.patch new file mode 100644 index 0000000..4ed178b --- /dev/null +++ b/patches.kernel.org/6.2.3-772-cifs-don-t-try-to-use-rdma-offload-on-encrypted.patch @@ -0,0 +1,54 @@ +From: Stefan Metzmacher +Date: Wed, 1 Feb 2023 16:21:41 +0100 +Subject: [PATCH] cifs: don't try to use rdma offload on encrypted connections +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3891f6c7655a39065e44980f51ba46bb32be3133 + +commit 3891f6c7655a39065e44980f51ba46bb32be3133 upstream. + +The aim of using encryption on a connection is to keep +the data confidential, so we must not use plaintext rdma offload +for that data! + +It seems that current windows servers and ksmbd would allow +this, but that's no reason to expose the users data in plaintext! +And servers hopefully reject this in future. + +Note modern windows servers support signed or encrypted offload, +see MS-SMB2 2.2.3.1.6 SMB2_RDMA_TRANSFORM_CAPABILITIES, but we don't +support that yet. + +Signed-off-by: Stefan Metzmacher +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: David Howells +Cc: linux-cifs@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/smb2pdu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index b68f43ed..23926f75 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -4081,6 +4081,10 @@ static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) + if (server->sign) + return false; + ++ /* we don't support encrypted offload yet */ ++ if (smb3_encryption_required(tcon)) ++ return false; ++ + /* offload also has its overhead, so only do it if desired */ + if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) + return false; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-773-cifs-Check-the-lease-context-if-we-actually-got.patch b/patches.kernel.org/6.2.3-773-cifs-Check-the-lease-context-if-we-actually-got.patch new file mode 100644 index 0000000..a9ac399 --- /dev/null +++ b/patches.kernel.org/6.2.3-773-cifs-Check-the-lease-context-if-we-actually-got.patch @@ -0,0 +1,80 @@ +From: Ronnie Sahlberg +Date: Fri, 17 Feb 2023 13:35:00 +1000 +Subject: [PATCH] cifs: Check the lease context if we actually got a lease +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 66d45ca1350a3bb8d5f4db8879ccad3ed492337a + +commit 66d45ca1350a3bb8d5f4db8879ccad3ed492337a upstream. + +Some servers may return that we got a lease in rsp->OplockLevel +but then in the lease context contradict this and say we got no lease +at all. Thus we need to check the context if we have a lease. +Additionally, If we do not get a lease we need to make sure we close +the handle before we return an error to the caller. + +Signed-off-by: Ronnie Sahlberg +Cc: stable@vger.kernel.org +Reviewed-by: Bharath SM +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cached_dir.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/fs/cifs/cached_dir.c b/fs/cifs/cached_dir.c +index b36ae640..d5e5d757 100644 +--- a/fs/cifs/cached_dir.c ++++ b/fs/cifs/cached_dir.c +@@ -221,8 +221,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + } + goto oshr_free; + } +- +- atomic_inc(&tcon->num_remote_opens); ++ cfid->is_open = true; + + o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base; + oparms.fid->persistent_fid = o_rsp->PersistentFileId; +@@ -239,7 +238,8 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + &oparms.fid->epoch, + oparms.fid->lease_key, &oplock, + NULL, NULL); +- ++ if (!(oplock & SMB2_LEASE_READ_CACHING_HE)) ++ goto oshr_free; + qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base; + if (le32_to_cpu(qi_rsp->OutputBufferLength) < sizeof(struct smb2_file_all_info)) + goto oshr_free; +@@ -262,7 +262,6 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + cfid->dentry = dentry; + cfid->tcon = tcon; + cfid->time = jiffies; +- cfid->is_open = true; + cfid->has_lease = true; + + oshr_free: +@@ -282,12 +281,17 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + } + spin_unlock(&cfids->cfid_list_lock); + if (rc) { ++ if (cfid->is_open) ++ SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, ++ cfid->fid.volatile_fid); + free_cached_dir(cfid); + cfid = NULL; + } + +- if (rc == 0) ++ if (rc == 0) { + *ret_cfid = cfid; ++ atomic_inc(&tcon->num_remote_opens); ++ } + + return rc; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-774-cifs-return-a-single-use-cfid-if-we-did-not-get.patch b/patches.kernel.org/6.2.3-774-cifs-return-a-single-use-cfid-if-we-did-not-get.patch new file mode 100644 index 0000000..9b2cd40 --- /dev/null +++ b/patches.kernel.org/6.2.3-774-cifs-return-a-single-use-cfid-if-we-did-not-get.patch @@ -0,0 +1,101 @@ +From: Ronnie Sahlberg +Date: Fri, 17 Feb 2023 13:35:01 +1000 +Subject: [PATCH] cifs: return a single-use cfid if we did not get a lease +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8e843bf38f7be0766642a91523cfa65f2b021a8a + +commit 8e843bf38f7be0766642a91523cfa65f2b021a8a upstream. + +If we did not get a lease we can still return a single use cfid to the caller. +The cfid will not have has_lease set and will thus not be shared with any +other concurrent users and will be freed immediately when the caller +drops the handle. + +This avoids extra roundtrips for servers that do not support directory leases +where they would first fail to get a cfid with a lease and then fallback +to try a normal SMB2_open() + +Signed-off-by: Ronnie Sahlberg +Cc: stable@vger.kernel.org +Reviewed-by: Bharath SM +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cifs/cached_dir.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/fs/cifs/cached_dir.c b/fs/cifs/cached_dir.c +index d5e5d757..75d5e063 100644 +--- a/fs/cifs/cached_dir.c ++++ b/fs/cifs/cached_dir.c +@@ -14,6 +14,7 @@ + + static struct cached_fid *init_cached_dir(const char *path); + static void free_cached_dir(struct cached_fid *cfid); ++static void smb2_close_cached_fid(struct kref *ref); + + static struct cached_fid *find_or_create_cached_dir(struct cached_fids *cfids, + const char *path, +@@ -221,6 +222,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + } + goto oshr_free; + } ++ cfid->tcon = tcon; + cfid->is_open = true; + + o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base; +@@ -233,7 +235,6 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + if (o_rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) + goto oshr_free; + +- + smb2_parse_contexts(server, o_rsp, + &oparms.fid->epoch, + oparms.fid->lease_key, &oplock, +@@ -260,7 +261,6 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + } + } + cfid->dentry = dentry; +- cfid->tcon = tcon; + cfid->time = jiffies; + cfid->has_lease = true; + +@@ -271,7 +271,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base); + free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base); + spin_lock(&cfids->cfid_list_lock); +- if (!cfid->has_lease) { ++ if (rc && !cfid->has_lease) { + if (cfid->on_list) { + list_del(&cfid->entry); + cfid->on_list = false; +@@ -280,6 +280,15 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + rc = -ENOENT; + } + spin_unlock(&cfids->cfid_list_lock); ++ if (!rc && !cfid->has_lease) { ++ /* ++ * We are guaranteed to have two references at this point. ++ * One for the caller and one for a potential lease. ++ * Release the Lease-ref so that the directory will be closed ++ * when the caller closes the cached handle. ++ */ ++ kref_put(&cfid->refcount, smb2_close_cached_fid); ++ } + if (rc) { + if (cfid->is_open) + SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, +@@ -340,6 +349,7 @@ smb2_close_cached_fid(struct kref *ref) + if (cfid->is_open) { + SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, + cfid->fid.volatile_fid); ++ atomic_dec(&cfid->tcon->num_remote_opens); + } + + free_cached_dir(cfid); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-775-scsi-mpi3mr-Fix-missing-mrioc-evtack_cmds-initi.patch b/patches.kernel.org/6.2.3-775-scsi-mpi3mr-Fix-missing-mrioc-evtack_cmds-initi.patch new file mode 100644 index 0000000..4def3b5 --- /dev/null +++ b/patches.kernel.org/6.2.3-775-scsi-mpi3mr-Fix-missing-mrioc-evtack_cmds-initi.patch @@ -0,0 +1,50 @@ +From: Shin'ichiro Kawasaki +Date: Tue, 14 Feb 2023 09:50:19 +0900 +Subject: [PATCH] scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e39ea831ebad4ab15c4748cb62a397a8abcca36e + +commit e39ea831ebad4ab15c4748cb62a397a8abcca36e upstream. + +Commit c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") +introduced an array mrioc->evtack_cmds but initialization of the array +elements was missed. They are just zero cleared. The function +mpi3mr_complete_evt_ack() refers host_tag field of the elements. Due to the +zero value of the host_tag field, the function calls clear_bit() for +mrico->evtack_cmds_bitmap with wrong bit index. This results in memory +access to invalid address and "BUG: KASAN: use-after-free". This BUG was +observed at eHBA-9600 firmware update to version 8.3.1.0. To fix it, add +the missing initialization of mrioc->evtack_cmds. + +Link: https://lore.kernel.org/r/20230214005019.1897251-5-shinichiro.kawasaki@wdc.com +Cc: stable@vger.kernel.org +Fixes: c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") +Signed-off-by: Shin'ichiro Kawasaki +Reviewed-by: Damien Le Moal +Acked-by: Sathya Prakash Veerichetty +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/mpi3mr/mpi3mr_os.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c +index 3306de71..6eaeba41 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_os.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c +@@ -4952,6 +4952,10 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id) + mpi3mr_init_drv_cmd(&mrioc->dev_rmhs_cmds[i], + MPI3MR_HOSTTAG_DEVRMCMD_MIN + i); + ++ for (i = 0; i < MPI3MR_NUM_EVTACKCMD; i++) ++ mpi3mr_init_drv_cmd(&mrioc->evtack_cmds[i], ++ MPI3MR_HOSTTAG_EVTACKCMD_MIN + i); ++ + if (pdev->revision) + mrioc->enable_segqueue = true; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-776-scsi-mpi3mr-Fix-issues-in-mpi3mr_get_all_tgt_in.patch b/patches.kernel.org/6.2.3-776-scsi-mpi3mr-Fix-issues-in-mpi3mr_get_all_tgt_in.patch new file mode 100644 index 0000000..6f43808 --- /dev/null +++ b/patches.kernel.org/6.2.3-776-scsi-mpi3mr-Fix-issues-in-mpi3mr_get_all_tgt_in.patch @@ -0,0 +1,96 @@ +From: Shin'ichiro Kawasaki +Date: Tue, 14 Feb 2023 09:50:16 +0900 +Subject: [PATCH] scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fb428a2005fc1260d18b989cc5199f281617f44d + +commit fb428a2005fc1260d18b989cc5199f281617f44d upstream. + +The function mpi3mr_get_all_tgt_info() has four issues: + +1) It calculates valid entry length in alltgt_info assuming the header part + of the struct mpi3mr_device_map_info would equal to sizeof(u32). The + correct size is sizeof(u64). + +2) When it calculates the valid entry length kern_entrylen, it excludes one + entry by subtracting 1 from num_devices. + +3) It copies num_device by calling memcpy(). Substitution is enough. + +4) It does not specify the calculated length to sg_copy_from_buffer(). + Instead, it specifies the payload length which is larger than the + alltgt_info size. It causes "BUG: KASAN: slab-out-of-bounds". + +Fix the issues by using the correct header size, removing the subtraction +from num_devices, replacing the memcpy() with substitution and specifying +the correct length to sg_copy_from_buffer(). + +Link: https://lore.kernel.org/r/20230214005019.1897251-2-shinichiro.kawasaki@wdc.com +Cc: stable@vger.kernel.org +Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands") +Signed-off-by: Shin'ichiro Kawasaki +Acked-by: Sathya Prakash Veerichetty +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/mpi3mr/mpi3mr_app.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c +index 9baac224..72054e3a 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_app.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_app.c +@@ -312,7 +312,7 @@ static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, + num_devices++; + spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags); + +- if ((job->request_payload.payload_len == sizeof(u32)) || ++ if ((job->request_payload.payload_len <= sizeof(u64)) || + list_empty(&mrioc->tgtdev_list)) { + sg_copy_from_buffer(job->request_payload.sg_list, + job->request_payload.sg_cnt, +@@ -320,14 +320,14 @@ static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, + return 0; + } + +- kern_entrylen = (num_devices - 1) * sizeof(*devmap_info); +- size = sizeof(*alltgt_info) + kern_entrylen; ++ kern_entrylen = num_devices * sizeof(*devmap_info); ++ size = sizeof(u64) + kern_entrylen; + alltgt_info = kzalloc(size, GFP_KERNEL); + if (!alltgt_info) + return -ENOMEM; + + devmap_info = alltgt_info->dmi; +- memset((u8 *)devmap_info, 0xFF, (kern_entrylen + sizeof(*devmap_info))); ++ memset((u8 *)devmap_info, 0xFF, kern_entrylen); + spin_lock_irqsave(&mrioc->tgtdev_lock, flags); + list_for_each_entry(tgtdev, &mrioc->tgtdev_list, list) { + if (i < num_devices) { +@@ -344,9 +344,10 @@ static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, + num_devices = i; + spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags); + +- memcpy(&alltgt_info->num_devices, &num_devices, sizeof(num_devices)); ++ alltgt_info->num_devices = num_devices; + +- usr_entrylen = (job->request_payload.payload_len - sizeof(u32)) / sizeof(*devmap_info); ++ usr_entrylen = (job->request_payload.payload_len - sizeof(u64)) / ++ sizeof(*devmap_info); + usr_entrylen *= sizeof(*devmap_info); + min_entrylen = min(usr_entrylen, kern_entrylen); + if (min_entrylen && (!memcpy(&alltgt_info->dmi, devmap_info, min_entrylen))) { +@@ -358,7 +359,7 @@ static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, + + sg_copy_from_buffer(job->request_payload.sg_list, + job->request_payload.sg_cnt, +- alltgt_info, job->request_payload.payload_len); ++ alltgt_info, (min_entrylen + sizeof(u64))); + rval = 0; + out: + kfree(alltgt_info); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-777-scsi-mpi3mr-Remove-unnecessary-memcpy-to-alltgt.patch b/patches.kernel.org/6.2.3-777-scsi-mpi3mr-Remove-unnecessary-memcpy-to-alltgt.patch new file mode 100644 index 0000000..a2c8044 --- /dev/null +++ b/patches.kernel.org/6.2.3-777-scsi-mpi3mr-Remove-unnecessary-memcpy-to-alltgt.patch @@ -0,0 +1,72 @@ +From: Shin'ichiro Kawasaki +Date: Tue, 14 Feb 2023 09:50:17 +0900 +Subject: [PATCH] scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: eeb270aee3e085411399f129fc14fa04bd6d83cf + +commit eeb270aee3e085411399f129fc14fa04bd6d83cf upstream. + +In the function mpi3mr_get_all_tgt_info(), devmap_info points to +alltgt_info->dmi then there is no need to memcpy() data from devmap_info to +alltgt_info->dmi. Remove the unnecessary memcpy(). This also allows to +remove the local variable 'rval' and the goto label 'out'. + +Link: https://lore.kernel.org/r/20230214005019.1897251-3-shinichiro.kawasaki@wdc.com +Cc: stable@vger.kernel.org +Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands") +Signed-off-by: Shin'ichiro Kawasaki +Acked-by: Sathya Prakash Veerichetty +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/mpi3mr/mpi3mr_app.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c +index 72054e3a..bff63770 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_app.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_app.c +@@ -293,7 +293,6 @@ static long mpi3mr_bsg_pel_enable(struct mpi3mr_ioc *mrioc, + static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, + struct bsg_job *job) + { +- long rval = -EINVAL; + u16 num_devices = 0, i = 0, size; + unsigned long flags; + struct mpi3mr_tgt_dev *tgtdev; +@@ -304,7 +303,7 @@ static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, + if (job->request_payload.payload_len < sizeof(u32)) { + dprint_bsg_err(mrioc, "%s: invalid size argument\n", + __func__); +- return rval; ++ return -EINVAL; + } + + spin_lock_irqsave(&mrioc->tgtdev_lock, flags); +@@ -350,20 +349,12 @@ static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, + sizeof(*devmap_info); + usr_entrylen *= sizeof(*devmap_info); + min_entrylen = min(usr_entrylen, kern_entrylen); +- if (min_entrylen && (!memcpy(&alltgt_info->dmi, devmap_info, min_entrylen))) { +- dprint_bsg_err(mrioc, "%s:%d: device map info copy failed\n", +- __func__, __LINE__); +- rval = -EFAULT; +- goto out; +- } + + sg_copy_from_buffer(job->request_payload.sg_list, + job->request_payload.sg_cnt, + alltgt_info, (min_entrylen + sizeof(u64))); +- rval = 0; +-out: + kfree(alltgt_info); +- return rval; ++ return 0; + } + /** + * mpi3mr_get_change_count - Get topology change count +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-778-btrfs-hold-block-group-refcount-during-async-di.patch b/patches.kernel.org/6.2.3-778-btrfs-hold-block-group-refcount-during-async-di.patch new file mode 100644 index 0000000..86f180b --- /dev/null +++ b/patches.kernel.org/6.2.3-778-btrfs-hold-block-group-refcount-during-async-di.patch @@ -0,0 +1,159 @@ +From: Boris Burkov +Date: Thu, 12 Jan 2023 16:05:11 -0800 +Subject: [PATCH] btrfs: hold block group refcount during async discard +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2b5463fcbdfb24e898916bcae2b1359042d26963 + +commit 2b5463fcbdfb24e898916bcae2b1359042d26963 upstream. + +Async discard does not acquire the block group reference count while it +holds a reference on the discard list. This is generally OK, as the +paths which destroy block groups tend to try to synchronize on +cancelling async discard work. However, relying on cancelling work +requires careful analysis to be sure it is safe from races with +unpinning scheduling more work. + +While I am unable to find a race with unpinning in the current code for +either the unused bgs or relocation paths, I believe we have one in an +older version of auto relocation in a Meta internal build. This suggests +that this is in fact an error prone model, and could be fragile to +future changes to these bg deletion paths. + +To make this ownership more clear, add a refcount for async discard. If +work is queued for a block group, its refcount should be incremented, +and when work is completed or canceled, it should be decremented. + +CC: stable@vger.kernel.org # 5.15+ +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/btrfs/discard.c | 41 ++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 38 insertions(+), 3 deletions(-) + +diff --git a/fs/btrfs/discard.c b/fs/btrfs/discard.c +index ff2e524d..317aeff6 100644 +--- a/fs/btrfs/discard.c ++++ b/fs/btrfs/discard.c +@@ -78,6 +78,7 @@ static struct list_head *get_discard_list(struct btrfs_discard_ctl *discard_ctl, + static void __add_to_discard_list(struct btrfs_discard_ctl *discard_ctl, + struct btrfs_block_group *block_group) + { ++ lockdep_assert_held(&discard_ctl->lock); + if (!btrfs_run_discard_work(discard_ctl)) + return; + +@@ -89,6 +90,8 @@ static void __add_to_discard_list(struct btrfs_discard_ctl *discard_ctl, + BTRFS_DISCARD_DELAY); + block_group->discard_state = BTRFS_DISCARD_RESET_CURSOR; + } ++ if (list_empty(&block_group->discard_list)) ++ btrfs_get_block_group(block_group); + + list_move_tail(&block_group->discard_list, + get_discard_list(discard_ctl, block_group)); +@@ -108,8 +111,12 @@ static void add_to_discard_list(struct btrfs_discard_ctl *discard_ctl, + static void add_to_discard_unused_list(struct btrfs_discard_ctl *discard_ctl, + struct btrfs_block_group *block_group) + { ++ bool queued; ++ + spin_lock(&discard_ctl->lock); + ++ queued = !list_empty(&block_group->discard_list); ++ + if (!btrfs_run_discard_work(discard_ctl)) { + spin_unlock(&discard_ctl->lock); + return; +@@ -121,6 +128,8 @@ static void add_to_discard_unused_list(struct btrfs_discard_ctl *discard_ctl, + block_group->discard_eligible_time = (ktime_get_ns() + + BTRFS_DISCARD_UNUSED_DELAY); + block_group->discard_state = BTRFS_DISCARD_RESET_CURSOR; ++ if (!queued) ++ btrfs_get_block_group(block_group); + list_add_tail(&block_group->discard_list, + &discard_ctl->discard_list[BTRFS_DISCARD_INDEX_UNUSED]); + +@@ -131,6 +140,7 @@ static bool remove_from_discard_list(struct btrfs_discard_ctl *discard_ctl, + struct btrfs_block_group *block_group) + { + bool running = false; ++ bool queued = false; + + spin_lock(&discard_ctl->lock); + +@@ -140,7 +150,16 @@ static bool remove_from_discard_list(struct btrfs_discard_ctl *discard_ctl, + } + + block_group->discard_eligible_time = 0; ++ queued = !list_empty(&block_group->discard_list); + list_del_init(&block_group->discard_list); ++ /* ++ * If the block group is currently running in the discard workfn, we ++ * don't want to deref it, since it's still being used by the workfn. ++ * The workfn will notice this case and deref the block group when it is ++ * finished. ++ */ ++ if (queued && !running) ++ btrfs_put_block_group(block_group); + + spin_unlock(&discard_ctl->lock); + +@@ -214,10 +233,12 @@ static struct btrfs_block_group *peek_discard_list( + if (block_group && now >= block_group->discard_eligible_time) { + if (block_group->discard_index == BTRFS_DISCARD_INDEX_UNUSED && + block_group->used != 0) { +- if (btrfs_is_block_group_data_only(block_group)) ++ if (btrfs_is_block_group_data_only(block_group)) { + __add_to_discard_list(discard_ctl, block_group); +- else ++ } else { + list_del_init(&block_group->discard_list); ++ btrfs_put_block_group(block_group); ++ } + goto again; + } + if (block_group->discard_state == BTRFS_DISCARD_RESET_CURSOR) { +@@ -511,6 +532,15 @@ static void btrfs_discard_workfn(struct work_struct *work) + spin_lock(&discard_ctl->lock); + discard_ctl->prev_discard = trimmed; + discard_ctl->prev_discard_time = now; ++ /* ++ * If the block group was removed from the discard list while it was ++ * running in this workfn, then we didn't deref it, since this function ++ * still owned that reference. But we set the discard_ctl->block_group ++ * back to NULL, so we can use that condition to know that now we need ++ * to deref the block_group. ++ */ ++ if (discard_ctl->block_group == NULL) ++ btrfs_put_block_group(block_group); + discard_ctl->block_group = NULL; + __btrfs_discard_schedule_work(discard_ctl, now, false); + spin_unlock(&discard_ctl->lock); +@@ -651,8 +681,12 @@ void btrfs_discard_punt_unused_bgs_list(struct btrfs_fs_info *fs_info) + list_for_each_entry_safe(block_group, next, &fs_info->unused_bgs, + bg_list) { + list_del_init(&block_group->bg_list); +- btrfs_put_block_group(block_group); + btrfs_discard_queue_work(&fs_info->discard_ctl, block_group); ++ /* ++ * This put is for the get done by btrfs_mark_bg_unused. ++ * Queueing discard incremented it for discard's reference. ++ */ ++ btrfs_put_block_group(block_group); + } + spin_unlock(&fs_info->unused_bgs_lock); + } +@@ -683,6 +717,7 @@ static void btrfs_discard_purge_list(struct btrfs_discard_ctl *discard_ctl) + if (block_group->used == 0) + btrfs_mark_bg_unused(block_group); + spin_lock(&discard_ctl->lock); ++ btrfs_put_block_group(block_group); + } + } + spin_unlock(&discard_ctl->lock); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-779-btrfs-sysfs-update-fs-features-directory-asynch.patch b/patches.kernel.org/6.2.3-779-btrfs-sysfs-update-fs-features-directory-asynch.patch new file mode 100644 index 0000000..04362f4 --- /dev/null +++ b/patches.kernel.org/6.2.3-779-btrfs-sysfs-update-fs-features-directory-asynch.patch @@ -0,0 +1,238 @@ +From: Qu Wenruo +Date: Fri, 13 Jan 2023 19:11:39 +0800 +Subject: [PATCH] btrfs: sysfs: update fs features directory asynchronously +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b7625f461da6734a21c38ba6e7558538a116a2e3 + +commit b7625f461da6734a21c38ba6e7558538a116a2e3 upstream. + +[BUG] +Since the introduction of per-fs feature sysfs interface +(/sys/fs/btrfs//features/), the content of that directory is never +updated. + +Thus for the following case, that directory will not show the new +features like RAID56: + + # mkfs.btrfs -f $dev1 $dev2 $dev3 + # mount $dev1 $mnt + # btrfs balance start -f -mconvert=raid5 $mnt + # ls /sys/fs/btrfs/$uuid/features/ + extended_iref free_space_tree no_holes skinny_metadata + +While after unmount and mount, we got the correct features: + + # umount $mnt + # mount $dev1 $mnt + # ls /sys/fs/btrfs/$uuid/features/ + extended_iref free_space_tree no_holes raid56 skinny_metadata + +[CAUSE] +Because we never really try to update the content of per-fs features/ +directory. + +We had an attempt to update the features directory dynamically in commit +14e46e04958d ("btrfs: synchronize incompat feature bits with sysfs +files"), but unfortunately it get reverted in commit e410e34fad91 +("Revert "btrfs: synchronize incompat feature bits with sysfs files""). +The problem in the original patch is, in the context of +btrfs_create_chunk(), we can not afford to update the sysfs group. + +The exported but never utilized function, btrfs_sysfs_feature_update() +is the leftover of such attempt. As even if we go sysfs_update_group(), +new files will need extra memory allocation, and we have no way to +specify the sysfs update to go GFP_NOFS. + +[FIX] +This patch will address the old problem by doing asynchronous sysfs +update in the cleaner thread. + +This involves the following changes: + +- Make __btrfs_(set|clear)_fs_(incompat|compat_ro) helpers to set + BTRFS_FS_FEATURE_CHANGED flag when needed + +- Update btrfs_sysfs_feature_update() to use sysfs_update_group() + And drop unnecessary arguments. + +- Call btrfs_sysfs_feature_update() in cleaner_kthread + If we have the BTRFS_FS_FEATURE_CHANGED flag set. + +- Wake up cleaner_kthread in btrfs_commit_transaction if we have + BTRFS_FS_FEATURE_CHANGED flag + +By this, all the previously dangerous call sites like +btrfs_create_chunk() need no new changes, as above helpers would +have already set the BTRFS_FS_FEATURE_CHANGED flag. + +The real work happens at cleaner_kthread, thus we pay the cost of +delaying the update to sysfs directory, but the delayed time should be +small enough that end user can not distinguish though it might get +delayed if the cleaner thread is busy with removing subvolumes or +defrag. + +CC: stable@vger.kernel.org # 4.14+ +Reviewed-by: Anand Jain +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/btrfs/disk-io.c | 3 +++ + fs/btrfs/fs.c | 4 ++++ + fs/btrfs/fs.h | 6 ++++++ + fs/btrfs/sysfs.c | 29 ++++++++--------------------- + fs/btrfs/sysfs.h | 3 +-- + fs/btrfs/transaction.c | 5 +++++ + 6 files changed, 27 insertions(+), 23 deletions(-) + +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 3aa04224..fde40112 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1910,6 +1910,9 @@ static int cleaner_kthread(void *arg) + goto sleep; + } + ++ if (test_and_clear_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags)) ++ btrfs_sysfs_feature_update(fs_info); ++ + btrfs_run_delayed_iputs(fs_info); + + again = btrfs_clean_one_deleted_snapshot(fs_info); +diff --git a/fs/btrfs/fs.c b/fs/btrfs/fs.c +index 5553e1f8..31c1648b 100644 +--- a/fs/btrfs/fs.c ++++ b/fs/btrfs/fs.c +@@ -24,6 +24,7 @@ void __btrfs_set_fs_incompat(struct btrfs_fs_info *fs_info, u64 flag, + name, flag); + } + spin_unlock(&fs_info->super_lock); ++ set_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags); + } + } + +@@ -46,6 +47,7 @@ void __btrfs_clear_fs_incompat(struct btrfs_fs_info *fs_info, u64 flag, + name, flag); + } + spin_unlock(&fs_info->super_lock); ++ set_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags); + } + } + +@@ -68,6 +70,7 @@ void __btrfs_set_fs_compat_ro(struct btrfs_fs_info *fs_info, u64 flag, + name, flag); + } + spin_unlock(&fs_info->super_lock); ++ set_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags); + } + } + +@@ -90,5 +93,6 @@ void __btrfs_clear_fs_compat_ro(struct btrfs_fs_info *fs_info, u64 flag, + name, flag); + } + spin_unlock(&fs_info->super_lock); ++ set_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags); + } + } +diff --git a/fs/btrfs/fs.h b/fs/btrfs/fs.h +index 37b86acf..3d8156fc 100644 +--- a/fs/btrfs/fs.h ++++ b/fs/btrfs/fs.h +@@ -125,6 +125,12 @@ enum { + */ + BTRFS_FS_NO_OVERCOMMIT, + ++ /* ++ * Indicate if we have some features changed, this is mostly for ++ * cleaner thread to update the sysfs interface. ++ */ ++ BTRFS_FS_FEATURE_CHANGED, ++ + #if BITS_PER_LONG == 32 + /* Indicate if we have error/warn message printed on 32bit systems */ + BTRFS_FS_32BIT_ERROR, +diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c +index 45615ce3..108aa387 100644 +--- a/fs/btrfs/sysfs.c ++++ b/fs/btrfs/sysfs.c +@@ -2272,36 +2272,23 @@ void btrfs_sysfs_del_one_qgroup(struct btrfs_fs_info *fs_info, + * Change per-fs features in /sys/fs/btrfs/UUID/features to match current + * values in superblock. Call after any changes to incompat/compat_ro flags + */ +-void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info, +- u64 bit, enum btrfs_feature_set set) ++void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info) + { +- struct btrfs_fs_devices *fs_devs; + struct kobject *fsid_kobj; +- u64 __maybe_unused features; +- int __maybe_unused ret; ++ int ret; + + if (!fs_info) + return; + +- /* +- * See 14e46e04958df74 and e410e34fad913dd, feature bit updates are not +- * safe when called from some contexts (eg. balance) +- */ +- features = get_features(fs_info, set); +- ASSERT(bit & supported_feature_masks[set]); +- +- fs_devs = fs_info->fs_devices; +- fsid_kobj = &fs_devs->fsid_kobj; +- ++ fsid_kobj = &fs_info->fs_devices->fsid_kobj; + if (!fsid_kobj->state_initialized) + return; + +- /* +- * FIXME: this is too heavy to update just one value, ideally we'd like +- * to use sysfs_update_group but some refactoring is needed first. +- */ +- sysfs_remove_group(fsid_kobj, &btrfs_feature_attr_group); +- ret = sysfs_create_group(fsid_kobj, &btrfs_feature_attr_group); ++ ret = sysfs_update_group(fsid_kobj, &btrfs_feature_attr_group); ++ if (ret < 0) ++ btrfs_warn(fs_info, ++ "failed to update /sys/fs/btrfs/%pU/features: %d", ++ fs_info->fs_devices->fsid, ret); + } + + int __init btrfs_init_sysfs(void) +diff --git a/fs/btrfs/sysfs.h b/fs/btrfs/sysfs.h +index bacef43f..86c7eef1 100644 +--- a/fs/btrfs/sysfs.h ++++ b/fs/btrfs/sysfs.h +@@ -19,8 +19,7 @@ void btrfs_sysfs_remove_device(struct btrfs_device *device); + int btrfs_sysfs_add_fsid(struct btrfs_fs_devices *fs_devs); + void btrfs_sysfs_remove_fsid(struct btrfs_fs_devices *fs_devs); + void btrfs_sysfs_update_sprout_fsid(struct btrfs_fs_devices *fs_devices); +-void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info, +- u64 bit, enum btrfs_feature_set set); ++void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info); + void btrfs_kobject_uevent(struct block_device *bdev, enum kobject_action action); + + int __init btrfs_init_sysfs(void); +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index b8c52e89..8f8d0fce 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -2464,6 +2464,11 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) + wake_up(&fs_info->transaction_wait); + btrfs_trans_state_lockdep_release(fs_info, BTRFS_LOCKDEP_TRANS_UNBLOCKED); + ++ /* If we have features changed, wake up the cleaner to update sysfs. */ ++ if (test_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags) && ++ fs_info->cleaner_kthread) ++ wake_up_process(fs_info->cleaner_kthread); ++ + ret = btrfs_write_and_wait_transaction(trans); + if (ret) { + btrfs_handle_fs_error(fs_info, ret, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-780-locking-rwsem-Prevent-non-first-waiter-from-spi.patch b/patches.kernel.org/6.2.3-780-locking-rwsem-Prevent-non-first-waiter-from-spi.patch new file mode 100644 index 0000000..785ac8c --- /dev/null +++ b/patches.kernel.org/6.2.3-780-locking-rwsem-Prevent-non-first-waiter-from-spi.patch @@ -0,0 +1,106 @@ +From: Waiman Long +Date: Wed, 25 Jan 2023 19:36:25 -0500 +Subject: [PATCH] locking/rwsem: Prevent non-first waiter from spinning in + down_write() slowpath +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b613c7f31476c44316bfac1af7cac714b7d6bef9 + +commit b613c7f31476c44316bfac1af7cac714b7d6bef9 upstream. + +A non-first waiter can potentially spin in the for loop of +rwsem_down_write_slowpath() without sleeping but fail to acquire the +lock even if the rwsem is free if the following sequence happens: + + Non-first RT waiter First waiter Lock holder + ------------------- ------------ ----------- + Acquire wait_lock + rwsem_try_write_lock(): + Set handoff bit if RT or + wait too long + Set waiter->handoff_set + Release wait_lock + Acquire wait_lock + Inherit waiter->handoff_set + Release wait_lock + Clear owner + Release lock + if (waiter.handoff_set) { + rwsem_spin_on_owner((); + if (OWNER_NULL) + goto trylock_again; + } + trylock_again: + Acquire wait_lock + rwsem_try_write_lock(): + if (first->handoff_set && (waiter != first)) + return false; + Release wait_lock + +A non-first waiter cannot really acquire the rwsem even if it mistakenly +believes that it can spin on OWNER_NULL value. If that waiter happens +to be an RT task running on the same CPU as the first waiter, it can +block the first waiter from acquiring the rwsem leading to live lock. +Fix this problem by making sure that a non-first waiter cannot spin in +the slowpath loop without sleeping. + +Fixes: d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consistent") +Signed-off-by: Waiman Long +Signed-off-by: Ingo Molnar +Tested-by: Mukesh Ojha +Reviewed-by: Mukesh Ojha +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230126003628.365092-2-longman@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/locking/rwsem.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 324fc370..84d5b649 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -624,18 +624,16 @@ static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, + */ + if (first->handoff_set && (waiter != first)) + return false; +- +- /* +- * First waiter can inherit a previously set handoff +- * bit and spin on rwsem if lock acquisition fails. +- */ +- if (waiter == first) +- waiter->handoff_set = true; + } + + new = count; + + if (count & RWSEM_LOCK_MASK) { ++ /* ++ * A waiter (first or not) can set the handoff bit ++ * if it is an RT task or wait in the wait queue ++ * for too long. ++ */ + if (has_handoff || (!rt_task(waiter->task) && + !time_after(jiffies, waiter->timeout))) + return false; +@@ -651,11 +649,12 @@ static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, + } while (!atomic_long_try_cmpxchg_acquire(&sem->count, &count, new)); + + /* +- * We have either acquired the lock with handoff bit cleared or +- * set the handoff bit. ++ * We have either acquired the lock with handoff bit cleared or set ++ * the handoff bit. Only the first waiter can have its handoff_set ++ * set here to enable optimistic spinning in slowpath loop. + */ + if (new & RWSEM_FLAG_HANDOFF) { +- waiter->handoff_set = true; ++ first->handoff_set = true; + lockevent_inc(rwsem_wlock_handoff); + return false; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-781-ksmbd-fix-wrong-data-area-length-for-smb2-lock-.patch b/patches.kernel.org/6.2.3-781-ksmbd-fix-wrong-data-area-length-for-smb2-lock-.patch new file mode 100644 index 0000000..ffe72ec --- /dev/null +++ b/patches.kernel.org/6.2.3-781-ksmbd-fix-wrong-data-area-length-for-smb2-lock-.patch @@ -0,0 +1,53 @@ +From: Namjae Jeon +Date: Wed, 8 Feb 2023 09:50:46 +0900 +Subject: [PATCH] ksmbd: fix wrong data area length for smb2 lock request +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8f8c43b125882ac14372f8dca0c8e50a59e78d79 + +commit 8f8c43b125882ac14372f8dca0c8e50a59e78d79 upstream. + +When turning debug mode on, The following error message from +ksmbd_smb2_check_message() is coming. + +ksmbd: cli req padded more than expected. Length 112 not 88 for cmd:10 mid:14 + +data area length calculation for smb2 lock request in smb2_get_data_area_len() is +incorrect. + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Cc: stable@vger.kernel.org +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/smb2misc.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/fs/ksmbd/smb2misc.c b/fs/ksmbd/smb2misc.c +index 6e25ace3..a717aa9b 100644 +--- a/fs/ksmbd/smb2misc.c ++++ b/fs/ksmbd/smb2misc.c +@@ -149,15 +149,11 @@ static int smb2_get_data_area_len(unsigned int *off, unsigned int *len, + break; + case SMB2_LOCK: + { +- int lock_count; ++ unsigned short lock_count; + +- /* +- * smb2_lock request size is 48 included single +- * smb2_lock_element structure size. +- */ +- lock_count = le16_to_cpu(((struct smb2_lock_req *)hdr)->LockCount) - 1; ++ lock_count = le16_to_cpu(((struct smb2_lock_req *)hdr)->LockCount); + if (lock_count > 0) { +- *off = __SMB2_HEADER_STRUCTURE_SIZE + 48; ++ *off = offsetof(struct smb2_lock_req, locks); + *len = sizeof(struct smb2_lock_element) * lock_count; + } + break; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-782-ksmbd-do-not-allow-the-actual-frame-length-to-b.patch b/patches.kernel.org/6.2.3-782-ksmbd-do-not-allow-the-actual-frame-length-to-b.patch new file mode 100644 index 0000000..c768ea3 --- /dev/null +++ b/patches.kernel.org/6.2.3-782-ksmbd-do-not-allow-the-actual-frame-length-to-b.patch @@ -0,0 +1,65 @@ +From: Namjae Jeon +Date: Sat, 11 Feb 2023 00:27:34 +0900 +Subject: [PATCH] ksmbd: do not allow the actual frame length to be smaller + than the rfc1002 length +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fb533473d1595fe79ecb528fda1de33552b07178 + +commit fb533473d1595fe79ecb528fda1de33552b07178 upstream. + +ksmbd allowed the actual frame length to be smaller than the rfc1002 +length. If allowed, it is possible to allocates a large amount of memory +that can be limited by credit management and can eventually cause memory +exhaustion problem. This patch do not allow it except SMB2 Negotiate +request which will be validated when message handling proceeds. +Also, Allow a message that padded to 8byte boundary. + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Cc: stable@vger.kernel.org +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/smb2misc.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +diff --git a/fs/ksmbd/smb2misc.c b/fs/ksmbd/smb2misc.c +index a717aa9b..fbdde426 100644 +--- a/fs/ksmbd/smb2misc.c ++++ b/fs/ksmbd/smb2misc.c +@@ -408,20 +408,19 @@ int ksmbd_smb2_check_message(struct ksmbd_work *work) + goto validate_credit; + + /* +- * windows client also pad up to 8 bytes when compounding. +- * If pad is longer than eight bytes, log the server behavior +- * (once), since may indicate a problem but allow it and +- * continue since the frame is parseable. ++ * SMB2 NEGOTIATE request will be validated when message ++ * handling proceeds. + */ +- if (clc_len < len) { +- ksmbd_debug(SMB, +- "cli req padded more than expected. Length %d not %d for cmd:%d mid:%llu\n", +- len, clc_len, command, +- le64_to_cpu(hdr->MessageId)); ++ if (command == SMB2_NEGOTIATE_HE) ++ goto validate_credit; ++ ++ /* ++ * Allow a message that padded to 8byte boundary. ++ */ ++ if (clc_len < len && (len - clc_len) < 8) + goto validate_credit; +- } + +- ksmbd_debug(SMB, ++ pr_err_ratelimited( + "cli req too short, len %d not %d. cmd:%d mid:%llu\n", + len, clc_len, command, + le64_to_cpu(hdr->MessageId)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-783-ksmbd-fix-possible-memory-leak-in-smb2_lock.patch b/patches.kernel.org/6.2.3-783-ksmbd-fix-possible-memory-leak-in-smb2_lock.patch new file mode 100644 index 0000000..22e36e3 --- /dev/null +++ b/patches.kernel.org/6.2.3-783-ksmbd-fix-possible-memory-leak-in-smb2_lock.patch @@ -0,0 +1,125 @@ +From: Hangyu Hua +Date: Fri, 17 Feb 2023 22:29:34 +0900 +Subject: [PATCH] ksmbd: fix possible memory leak in smb2_lock() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d3ca9f7aeba793d74361d88a8800b2f205c9236b + +commit d3ca9f7aeba793d74361d88a8800b2f205c9236b upstream. + +argv needs to be free when setup_async_work fails or when the current +process is woken up. + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Cc: stable@vger.kernel.org +Signed-off-by: Hangyu Hua +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ksmbd/smb2pdu.c | 28 +++++++++++++--------------- + fs/ksmbd/vfs_cache.c | 5 ++--- + 2 files changed, 15 insertions(+), 18 deletions(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index d681f919..875eecc6 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -6644,7 +6644,7 @@ int smb2_cancel(struct ksmbd_work *work) + struct ksmbd_conn *conn = work->conn; + struct smb2_hdr *hdr = smb2_get_msg(work->request_buf); + struct smb2_hdr *chdr; +- struct ksmbd_work *cancel_work = NULL, *iter; ++ struct ksmbd_work *iter; + struct list_head *command_list; + + ksmbd_debug(SMB, "smb2 cancel called on mid %llu, async flags 0x%x\n", +@@ -6666,7 +6666,9 @@ int smb2_cancel(struct ksmbd_work *work) + "smb2 with AsyncId %llu cancelled command = 0x%x\n", + le64_to_cpu(hdr->Id.AsyncId), + le16_to_cpu(chdr->Command)); +- cancel_work = iter; ++ iter->state = KSMBD_WORK_CANCELLED; ++ if (iter->cancel_fn) ++ iter->cancel_fn(iter->cancel_argv); + break; + } + spin_unlock(&conn->request_lock); +@@ -6685,18 +6687,12 @@ int smb2_cancel(struct ksmbd_work *work) + "smb2 with mid %llu cancelled command = 0x%x\n", + le64_to_cpu(hdr->MessageId), + le16_to_cpu(chdr->Command)); +- cancel_work = iter; ++ iter->state = KSMBD_WORK_CANCELLED; + break; + } + spin_unlock(&conn->request_lock); + } + +- if (cancel_work) { +- cancel_work->state = KSMBD_WORK_CANCELLED; +- if (cancel_work->cancel_fn) +- cancel_work->cancel_fn(cancel_work->cancel_argv); +- } +- + /* For SMB2_CANCEL command itself send no response*/ + work->send_no_response = 1; + return 0; +@@ -7061,6 +7057,14 @@ int smb2_lock(struct ksmbd_work *work) + + ksmbd_vfs_posix_lock_wait(flock); + ++ spin_lock(&work->conn->request_lock); ++ spin_lock(&fp->f_lock); ++ list_del(&work->fp_entry); ++ work->cancel_fn = NULL; ++ kfree(argv); ++ spin_unlock(&fp->f_lock); ++ spin_unlock(&work->conn->request_lock); ++ + if (work->state != KSMBD_WORK_ACTIVE) { + list_del(&smb_lock->llist); + spin_lock(&work->conn->llist_lock); +@@ -7069,9 +7073,6 @@ int smb2_lock(struct ksmbd_work *work) + locks_free_lock(flock); + + if (work->state == KSMBD_WORK_CANCELLED) { +- spin_lock(&fp->f_lock); +- list_del(&work->fp_entry); +- spin_unlock(&fp->f_lock); + rsp->hdr.Status = + STATUS_CANCELLED; + kfree(smb_lock); +@@ -7093,9 +7094,6 @@ int smb2_lock(struct ksmbd_work *work) + list_del(&smb_lock->clist); + spin_unlock(&work->conn->llist_lock); + +- spin_lock(&fp->f_lock); +- list_del(&work->fp_entry); +- spin_unlock(&fp->f_lock); + goto retry; + } else if (!rc) { + spin_lock(&work->conn->llist_lock); +diff --git a/fs/ksmbd/vfs_cache.c b/fs/ksmbd/vfs_cache.c +index da9163b0..0ae5dd08 100644 +--- a/fs/ksmbd/vfs_cache.c ++++ b/fs/ksmbd/vfs_cache.c +@@ -364,12 +364,11 @@ static void __put_fd_final(struct ksmbd_work *work, struct ksmbd_file *fp) + + static void set_close_state_blocked_works(struct ksmbd_file *fp) + { +- struct ksmbd_work *cancel_work, *ctmp; ++ struct ksmbd_work *cancel_work; + + spin_lock(&fp->f_lock); +- list_for_each_entry_safe(cancel_work, ctmp, &fp->blocked_works, ++ list_for_each_entry(cancel_work, &fp->blocked_works, + fp_entry) { +- list_del(&cancel_work->fp_entry); + cancel_work->state = KSMBD_WORK_CLOSED; + cancel_work->cancel_fn(cancel_work->cancel_argv); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-784-torture-Fix-hang-during-kthread-shutdown-phase.patch b/patches.kernel.org/6.2.3-784-torture-Fix-hang-during-kthread-shutdown-phase.patch new file mode 100644 index 0000000..45de78b --- /dev/null +++ b/patches.kernel.org/6.2.3-784-torture-Fix-hang-during-kthread-shutdown-phase.patch @@ -0,0 +1,60 @@ +From: "Joel Fernandes (Google)" +Date: Sun, 1 Jan 2023 06:15:55 +0000 +Subject: [PATCH] torture: Fix hang during kthread shutdown phase +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d52d3a2bf408ff86f3a79560b5cce80efb340239 + +commit d52d3a2bf408ff86f3a79560b5cce80efb340239 upstream. + +During rcutorture shutdown, the rcu_torture_cleanup() function calls +torture_cleanup_begin(), which sets the fullstop global variable to +FULLSTOP_RMMOD. This causes the rcutorture threads for readers and +fakewriters to exit all of their "while" loops and start shutting down. + +They then call torture_kthread_stopping(), which in turn waits for +kthread_stop() to be called. However, rcu_torture_cleanup() has +not yet called kthread_stop() on those threads, and before it gets a +chance to do so, multiple instances of torture_kthread_stopping() invoke +schedule_timeout_interruptible(1) in a tight loop. Tracing confirms that +TIMER_SOFTIRQ can then continuously execute timer callbacks. If that +TIMER_SOFTIRQ preempts the task executing rcu_torture_cleanup(), that +task might never invoke kthread_stop(). + +This commit improves this situation by increasing the timeout passed to +schedule_timeout_interruptible() from one jiffy to 1/20th of a second. +This change prevents TIMER_SOFTIRQ from monopolizing its CPU, thus +allowing rcu_torture_cleanup() to carry out the needed kthread_stop() +invocations. Testing has shown 100 runs of TREE07 passing reliably, +as oppose to the tens-of-percent failure rates seen beforehand. + +Cc: Paul McKenney +Cc: Frederic Weisbecker +Cc: Zhouyi Zhou +Cc: # 6.0.x +Signed-off-by: Joel Fernandes (Google) +Tested-by: Zhouyi Zhou +Reviewed-by: Davidlohr Bueso +Signed-off-by: Paul E. McKenney +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/torture.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/torture.c b/kernel/torture.c +index 789aeb0e..9266ca16 100644 +--- a/kernel/torture.c ++++ b/kernel/torture.c +@@ -915,7 +915,7 @@ void torture_kthread_stopping(char *title) + VERBOSE_TOROUT_STRING(buf); + while (!kthread_should_stop()) { + torture_shutdown_absorb(title); +- schedule_timeout_uninterruptible(1); ++ schedule_timeout_uninterruptible(HZ / 20); + } + } + EXPORT_SYMBOL_GPL(torture_kthread_stopping); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-785-ARM-dts-exynos-correct-HDMI-phy-compatible-in-E.patch b/patches.kernel.org/6.2.3-785-ARM-dts-exynos-correct-HDMI-phy-compatible-in-E.patch new file mode 100644 index 0000000..0b13270 --- /dev/null +++ b/patches.kernel.org/6.2.3-785-ARM-dts-exynos-correct-HDMI-phy-compatible-in-E.patch @@ -0,0 +1,37 @@ +From: Krzysztof Kozlowski +Date: Wed, 25 Jan 2023 10:45:05 +0100 +Subject: [PATCH] ARM: dts: exynos: correct HDMI phy compatible in Exynos4 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: af1c89ddb74f170eccd5a57001d7317560b638ea + +commit af1c89ddb74f170eccd5a57001d7317560b638ea upstream. + +The HDMI phy compatible was missing vendor prefix. + +Fixes: ed80d4cab772 ("ARM: dts: add hdmi related nodes for exynos4 SoCs") +Cc: +Link: https://lore.kernel.org/r/20230125094513.155063-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/exynos4.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi +index 5c4ecda2..7ba7a18c 100644 +--- a/arch/arm/boot/dts/exynos4.dtsi ++++ b/arch/arm/boot/dts/exynos4.dtsi +@@ -605,7 +605,7 @@ i2c_8: i2c@138e0000 { + status = "disabled"; + + hdmi_i2c_phy: hdmiphy@38 { +- compatible = "exynos4210-hdmiphy"; ++ compatible = "samsung,exynos4210-hdmiphy"; + reg = <0x38>; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-786-io_uring-mark-task-TASK_RUNNING-before-handling.patch b/patches.kernel.org/6.2.3-786-io_uring-mark-task-TASK_RUNNING-before-handling.patch new file mode 100644 index 0000000..6f84ff3 --- /dev/null +++ b/patches.kernel.org/6.2.3-786-io_uring-mark-task-TASK_RUNNING-before-handling.patch @@ -0,0 +1,46 @@ +From: Jens Axboe +Date: Mon, 6 Feb 2023 08:20:46 -0700 +Subject: [PATCH] io_uring: mark task TASK_RUNNING before handling resume/task + work +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2f2bb1ffc9983e227424d0787289da5483b0c74f + +commit 2f2bb1ffc9983e227424d0787289da5483b0c74f upstream. + +Just like for task_work, set the task mode to TASK_RUNNING before doing +any potential resume work. We're not holding any locks at this point, +but we may have already set the task state to TASK_INTERRUPTIBLE in +preparation for going to sleep waiting for events. Ensure that we set it +back to TASK_RUNNING if we have work to process, to avoid warnings on +calling blocking operations with !TASK_RUNNING. + +Fixes: b5d3ae202fbf ("io_uring: handle TIF_NOTIFY_RESUME when checking for task_work") +Reported-by: kernel test robot +Link: https://lore.kernel.org/oe-lkp/202302062208.24d3e563-oliver.sang@intel.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + io_uring/io_uring.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h +index e532dea6..87426c0c 100644 +--- a/io_uring/io_uring.h ++++ b/io_uring/io_uring.h +@@ -276,8 +276,10 @@ static inline int io_run_task_work(void) + * notify work that needs processing. + */ + if (current->flags & PF_IO_WORKER && +- test_thread_flag(TIF_NOTIFY_RESUME)) ++ test_thread_flag(TIF_NOTIFY_RESUME)) { ++ __set_current_state(TASK_RUNNING); + resume_user_mode_work(NULL); ++ } + if (task_work_pending(current)) { + __set_current_state(TASK_RUNNING); + task_work_run(); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-787-hfs-fix-missing-hfs_bnode_get-in-__hfs_bnode_cr.patch b/patches.kernel.org/6.2.3-787-hfs-fix-missing-hfs_bnode_get-in-__hfs_bnode_cr.patch new file mode 100644 index 0000000..6d01726 --- /dev/null +++ b/patches.kernel.org/6.2.3-787-hfs-fix-missing-hfs_bnode_get-in-__hfs_bnode_cr.patch @@ -0,0 +1,104 @@ +From: Liu Shixin +Date: Mon, 12 Dec 2022 10:16:27 +0800 +Subject: [PATCH] hfs: fix missing hfs_bnode_get() in __hfs_bnode_create +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a9dc087fd3c484fd1ed18c5efb290efaaf44ce03 + +commit a9dc087fd3c484fd1ed18c5efb290efaaf44ce03 upstream. + +Syzbot found a kernel BUG in hfs_bnode_put(): + + kernel BUG at fs/hfs/bnode.c:466! + invalid opcode: 0000 [#1] PREEMPT SMP KASAN + CPU: 0 PID: 3634 Comm: kworker/u4:5 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 + Workqueue: writeback wb_workfn (flush-7:0) + RIP: 0010:hfs_bnode_put+0x46f/0x480 fs/hfs/bnode.c:466 + Code: 8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56 + RSP: 0018:ffffc90003b4f258 EFLAGS: 00010293 + RAX: ffffffff825e318f RBX: 0000000000000000 RCX: ffff8880739dd7c0 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1 + R10: ffffed10045157d1 R11: 1ffff110045157d0 R12: ffff8880228abe80 + R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00 + FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + hfs_write_inode+0x1bc/0xb40 + write_inode fs/fs-writeback.c:1440 [inline] + __writeback_single_inode+0x4d6/0x670 fs/fs-writeback.c:1652 + writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1878 + __writeback_inodes_wb+0x125/0x420 fs/fs-writeback.c:1949 + wb_writeback+0x440/0x7b0 fs/fs-writeback.c:2054 + wb_check_start_all fs/fs-writeback.c:2176 [inline] + wb_do_writeback fs/fs-writeback.c:2202 [inline] + wb_workfn+0x827/0xef0 fs/fs-writeback.c:2235 + process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 + worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 + kthread+0x266/0x300 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 + + +The BUG_ON() is triggered at here: + +/* Dispose of resources used by a node */ +void hfs_bnode_put(struct hfs_bnode *node) +{ + if (node) { + + BUG_ON(!atomic_read(&node->refcnt)); <- we have issue here!!!! + + } +} + +By tracing the refcnt, I found the node is created by hfs_bmap_alloc() +with refcnt 1. Then the node is used by hfs_btree_write(). There is a +missing of hfs_bnode_get() after find the node. The issue happened in +following path: + + + hfs_bmap_alloc + hfs_bnode_find + __hfs_bnode_create <- allocate a new node with refcnt 1. + hfs_bnode_put <- decrease the refcnt + + + hfs_btree_write + hfs_bnode_find + __hfs_bnode_create + hfs_bnode_findhash <- find the node without refcnt increased. + hfs_bnode_put <- trigger the BUG_ON() since refcnt is 0. + +Link: https://lkml.kernel.org/r/20221212021627.3766829-1-liushixin2@huawei.com +Reported-by: syzbot+5b04b49a7ec7226c7426@syzkaller.appspotmail.com +Signed-off-by: Liu Shixin +Cc: Fabio M. De Francesco +Cc: Viacheslav Dubeyko +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/hfs/bnode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c +index 2015e42e..6add6ebf 100644 +--- a/fs/hfs/bnode.c ++++ b/fs/hfs/bnode.c +@@ -274,6 +274,7 @@ static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid) + tree->node_hash[hash] = node; + tree->node_hash_cnt++; + } else { ++ hfs_bnode_get(node2); + spin_unlock(&tree->hash_lock); + kfree(node); + wait_event(node2->lock_wq, !test_bit(HFS_BNODE_NEW, &node2->flags)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-788-fs-hfsplus-fix-UAF-issue-in-hfsplus_put_super.patch b/patches.kernel.org/6.2.3-788-fs-hfsplus-fix-UAF-issue-in-hfsplus_put_super.patch new file mode 100644 index 0000000..623b2db --- /dev/null +++ b/patches.kernel.org/6.2.3-788-fs-hfsplus-fix-UAF-issue-in-hfsplus_put_super.patch @@ -0,0 +1,58 @@ +From: Dongliang Mu +Date: Sun, 26 Feb 2023 20:49:47 +0800 +Subject: [PATCH] fs: hfsplus: fix UAF issue in hfsplus_put_super +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 07db5e247ab5858439b14dd7cc1fe538b9efcf32 + +commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream. + +The current hfsplus_put_super first calls hfs_btree_close on +sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an +use-after-free issue in hfsplus_release_folio. + +As shown in hfsplus_fill_super, the error handling code also calls iput +before hfs_btree_close. + +To fix this error, we move all iput calls before hfsplus_btree_close. + +Note that this patch is tested on Syzbot. + +Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com +Reported-by: syzbot+57e3e98f7e3b80f64d56@syzkaller.appspotmail.com +Tested-by: Dongliang Mu +Signed-off-by: Dongliang Mu +Cc: Bart Van Assche +Cc: Jens Axboe +Cc: Muchun Song +Cc: Roman Gushchin +Cc: "Theodore Ts'o" +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/hfsplus/super.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index 122ed89e..1986b4f1 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -295,11 +295,11 @@ static void hfsplus_put_super(struct super_block *sb) + hfsplus_sync_fs(sb, 1); + } + ++ iput(sbi->alloc_file); ++ iput(sbi->hidden_dir); + hfs_btree_close(sbi->attr_tree); + hfs_btree_close(sbi->cat_tree); + hfs_btree_close(sbi->ext_tree); +- iput(sbi->alloc_file); +- iput(sbi->hidden_dir); + kfree(sbi->s_vhdr_buf); + kfree(sbi->s_backup_vhdr_buf); + unload_nls(sbi->nls); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-789-exfat-fix-reporting-fs-error-when-reading-dir-b.patch b/patches.kernel.org/6.2.3-789-exfat-fix-reporting-fs-error-when-reading-dir-b.patch new file mode 100644 index 0000000..0bd811a --- /dev/null +++ b/patches.kernel.org/6.2.3-789-exfat-fix-reporting-fs-error-when-reading-dir-b.patch @@ -0,0 +1,55 @@ +From: Yuezhang Mo +Date: Thu, 20 Oct 2022 14:27:37 +0800 +Subject: [PATCH] exfat: fix reporting fs error when reading dir beyond EOF +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 706fdcac002316893434d753be8cfb549fe1d40d + +commit 706fdcac002316893434d753be8cfb549fe1d40d upstream. + +Since seekdir() does not check whether the position is valid, the +position may exceed the size of the directory. We found that for +a directory with discontinuous clusters, if the position exceeds +the size of the directory and the excess size is greater than or +equal to the cluster size, exfat_readdir() will return -EIO, +causing a file system error and making the file system unavailable. + +Reproduce this bug by: + +seekdir(dir, dir_size + cluster_size); +dirent = readdir(dir); + +The following log will be printed if mount with 'errors=remount-ro'. + +[11166.712896] exFAT-fs (sdb1): error, invalid access to FAT (entry 0xffffffff) +[11166.712905] exFAT-fs (sdb1): Filesystem has been set read-only + +Fixes: 1e5654de0f51 ("exfat: handle wrong stream entry size in exfat_readdir()") +Cc: stable@vger.kernel.org # v5.7+ +Signed-off-by: Yuezhang Mo +Reviewed-by: Andy Wu +Reviewed-by: Aoyama Wataru +Reviewed-by: Sungjong Seo +Signed-off-by: Namjae Jeon +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/exfat/dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c +index 1dfa67f3..34e5ea5f 100644 +--- a/fs/exfat/dir.c ++++ b/fs/exfat/dir.c +@@ -100,7 +100,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent + clu.dir = ei->hint_bmap.clu; + } + +- while (clu_offset > 0) { ++ while (clu_offset > 0 && clu.dir != EXFAT_EOF_CLUSTER) { + if (exfat_get_next_cluster(sb, &(clu.dir))) + return -EIO; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-790-exfat-fix-unexpected-EOF-while-reading-dir.patch b/patches.kernel.org/6.2.3-790-exfat-fix-unexpected-EOF-while-reading-dir.patch new file mode 100644 index 0000000..9419c80 --- /dev/null +++ b/patches.kernel.org/6.2.3-790-exfat-fix-unexpected-EOF-while-reading-dir.patch @@ -0,0 +1,55 @@ +From: Yuezhang Mo +Date: Thu, 22 Sep 2022 14:43:47 +0800 +Subject: [PATCH] exfat: fix unexpected EOF while reading dir +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6cb5d1a16a51d080fbc1649a5144cbc5ca7d6f88 + +commit 6cb5d1a16a51d080fbc1649a5144cbc5ca7d6f88 upstream. + +If the position is not aligned with the dentry size, the return +value of readdir() will be NULL and errno is 0, which means the +end of the directory stream is reached. + +If the position is aligned with dentry size, but there is no file +or directory at the position, exfat_readdir() will continue to +get dentry from the next dentry. So the dentry gotten by readdir() +may not be at the position. + +After this commit, if the position is not aligned with the dentry +size, round the position up to the dentry size and continue to get +the dentry. + +Fixes: ca06197382bd ("exfat: add directory operations") +Cc: stable@vger.kernel.org # v5.7+ +Reported-by: Wang Yugui +Signed-off-by: Yuezhang Mo +Reviewed-by: Andy Wu +Reviewed-by: Aoyama Wataru +Reviewed-by: Sungjong Seo +Signed-off-by: Namjae Jeon +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/exfat/dir.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c +index 34e5ea5f..158427e8 100644 +--- a/fs/exfat/dir.c ++++ b/fs/exfat/dir.c +@@ -234,10 +234,7 @@ static int exfat_iterate(struct file *file, struct dir_context *ctx) + fake_offset = 1; + } + +- if (cpos & (DENTRY_SIZE - 1)) { +- err = -ENOENT; +- goto unlock; +- } ++ cpos = round_up(cpos, DENTRY_SIZE); + + /* name buffer should be allocated before use */ + err = exfat_alloc_namebuf(nb); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-791-exfat-redefine-DIR_DELETED-as-the-bad-cluster-n.patch b/patches.kernel.org/6.2.3-791-exfat-redefine-DIR_DELETED-as-the-bad-cluster-n.patch new file mode 100644 index 0000000..11578b9 --- /dev/null +++ b/patches.kernel.org/6.2.3-791-exfat-redefine-DIR_DELETED-as-the-bad-cluster-n.patch @@ -0,0 +1,44 @@ +From: Sungjong Seo +Date: Thu, 29 Dec 2022 20:52:38 +0900 +Subject: [PATCH] exfat: redefine DIR_DELETED as the bad cluster number +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: bdaadfd343e3cba49ad0b009ff4b148dad0fa404 + +commit bdaadfd343e3cba49ad0b009ff4b148dad0fa404 upstream. + +When a file or a directory is deleted, the hint for the cluster of +its parent directory in its in-memory inode is set as DIR_DELETED. +Therefore, DIR_DELETED must be one of invalid cluster numbers. According +to the exFAT specification, a volume can have at most 2^32-11 clusters. +However, DIR_DELETED is wrongly defined as 0xFFFF0321, which could be +a valid cluster number. To fix it, let's redefine DIR_DELETED as +0xFFFFFFF7, the bad cluster number. + +Fixes: 1acf1a564b60 ("exfat: add in-memory and on-disk structures and headers") +Cc: stable@vger.kernel.org # v5.7+ +Reported-by: Yuezhang Mo +Signed-off-by: Sungjong Seo +Signed-off-by: Namjae Jeon +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/exfat/exfat_fs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h +index bc6d21d7..25a5df0f 100644 +--- a/fs/exfat/exfat_fs.h ++++ b/fs/exfat/exfat_fs.h +@@ -50,7 +50,7 @@ enum { + #define ES_IDX_LAST_FILENAME(name_len) \ + (ES_IDX_FIRST_FILENAME + EXFAT_FILENAME_ENTRY_NUM(name_len) - 1) + +-#define DIR_DELETED 0xFFFF0321 ++#define DIR_DELETED 0xFFFFFFF7 + + /* type values */ + #define TYPE_UNUSED 0x0000 +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-792-exfat-fix-inode-i_blocks-for-non-512-byte-secto.patch b/patches.kernel.org/6.2.3-792-exfat-fix-inode-i_blocks-for-non-512-byte-secto.patch new file mode 100644 index 0000000..5206df7 --- /dev/null +++ b/patches.kernel.org/6.2.3-792-exfat-fix-inode-i_blocks-for-non-512-byte-secto.patch @@ -0,0 +1,96 @@ +From: Yuezhang Mo +Date: Wed, 4 Jan 2023 14:37:47 +0800 +Subject: [PATCH] exfat: fix inode->i_blocks for non-512 byte sector size + device +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 39c1ce8eafc0ff64fb9e28536ccc7df6a8e2999d + +commit 39c1ce8eafc0ff64fb9e28536ccc7df6a8e2999d upstream. + +inode->i_blocks is not real number of blocks, but 512 byte ones. + +Fixes: 98d917047e8b ("exfat: add file operations") +Cc: stable@vger.kernel.org # v5.7+ +Reported-by: Wang Yugui +Tested-by: Wang Yugui +Signed-off-by: Yuezhang Mo +Reviewed-by: Andy Wu +Signed-off-by: Namjae Jeon +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/exfat/file.c | 3 +-- + fs/exfat/inode.c | 6 ++---- + fs/exfat/namei.c | 2 +- + fs/exfat/super.c | 3 +-- + 4 files changed, 5 insertions(+), 9 deletions(-) + +diff --git a/fs/exfat/file.c b/fs/exfat/file.c +index f5b29072..b33431c7 100644 +--- a/fs/exfat/file.c ++++ b/fs/exfat/file.c +@@ -209,8 +209,7 @@ void exfat_truncate(struct inode *inode) + if (err) + goto write_size; + +- inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> +- inode->i_blkbits; ++ inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9; + write_size: + aligned_size = i_size_read(inode); + if (aligned_size & (blocksize - 1)) { +diff --git a/fs/exfat/inode.c b/fs/exfat/inode.c +index 5b644cb0..481dd338 100644 +--- a/fs/exfat/inode.c ++++ b/fs/exfat/inode.c +@@ -220,8 +220,7 @@ static int exfat_map_cluster(struct inode *inode, unsigned int clu_offset, + num_clusters += num_to_be_allocated; + *clu = new_clu.dir; + +- inode->i_blocks += +- num_to_be_allocated << sbi->sect_per_clus_bits; ++ inode->i_blocks += EXFAT_CLU_TO_B(num_to_be_allocated, sbi) >> 9; + + /* + * Move *clu pointer along FAT chains (hole care) because the +@@ -576,8 +575,7 @@ static int exfat_fill_inode(struct inode *inode, struct exfat_dir_entry *info) + + exfat_save_attr(inode, info->attr); + +- inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> +- inode->i_blkbits; ++ inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9; + inode->i_mtime = info->mtime; + inode->i_ctime = info->mtime; + ei->i_crtime = info->crtime; +diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c +index 5f995eba..7442fead 100644 +--- a/fs/exfat/namei.c ++++ b/fs/exfat/namei.c +@@ -396,7 +396,7 @@ static int exfat_find_empty_entry(struct inode *inode, + ei->i_size_ondisk += sbi->cluster_size; + ei->i_size_aligned += sbi->cluster_size; + ei->flags = p_dir->flags; +- inode->i_blocks += 1 << sbi->sect_per_clus_bits; ++ inode->i_blocks += sbi->cluster_size >> 9; + } + + return dentry; +diff --git a/fs/exfat/super.c b/fs/exfat/super.c +index 35f0305c..8c32460e 100644 +--- a/fs/exfat/super.c ++++ b/fs/exfat/super.c +@@ -373,8 +373,7 @@ static int exfat_read_root(struct inode *inode) + inode->i_op = &exfat_dir_inode_operations; + inode->i_fop = &exfat_dir_operations; + +- inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> +- inode->i_blkbits; ++ inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9; + ei->i_pos = ((loff_t)sbi->root_dir << 32) | 0xffffffff; + ei->i_size_aligned = i_size_read(inode); + ei->i_size_ondisk = i_size_read(inode); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-793-fs-dlm-start-midcomms-before-scand.patch b/patches.kernel.org/6.2.3-793-fs-dlm-start-midcomms-before-scand.patch new file mode 100644 index 0000000..8a6a1f9 --- /dev/null +++ b/patches.kernel.org/6.2.3-793-fs-dlm-start-midcomms-before-scand.patch @@ -0,0 +1,63 @@ +From: Alexander Aring +Date: Thu, 12 Jan 2023 17:10:31 -0500 +Subject: [PATCH] fs: dlm: start midcomms before scand +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aad633dc0cf90093998b1ae0ba9f19b5f1dab644 + +commit aad633dc0cf90093998b1ae0ba9f19b5f1dab644 upstream. + +The scand kthread can send dlm messages out, especially dlm remove +messages to free memory for unused rsb on other nodes. To send out dlm +messages, midcomms must be initialized. This patch moves the midcomms +start before scand is started. + +Cc: stable@vger.kernel.org +Fixes: e7fd41792fc0 ("[DLM] The core of the DLM for GFS2/CLVM") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dlm/lockspace.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c +index d0b4e218..99bc96f9 100644 +--- a/fs/dlm/lockspace.c ++++ b/fs/dlm/lockspace.c +@@ -381,23 +381,23 @@ static int threads_start(void) + { + int error; + +- error = dlm_scand_start(); ++ /* Thread for sending/receiving messages for all lockspace's */ ++ error = dlm_midcomms_start(); + if (error) { +- log_print("cannot start dlm_scand thread %d", error); ++ log_print("cannot start dlm midcomms %d", error); + goto fail; + } + +- /* Thread for sending/receiving messages for all lockspace's */ +- error = dlm_midcomms_start(); ++ error = dlm_scand_start(); + if (error) { +- log_print("cannot start dlm midcomms %d", error); +- goto scand_fail; ++ log_print("cannot start dlm_scand thread %d", error); ++ goto midcomms_fail; + } + + return 0; + +- scand_fail: +- dlm_scand_stop(); ++ midcomms_fail: ++ dlm_midcomms_stop(); + fail: + return error; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-794-fs-dlm-fix-use-after-free-in-midcomms-commit.patch b/patches.kernel.org/6.2.3-794-fs-dlm-fix-use-after-free-in-midcomms-commit.patch new file mode 100644 index 0000000..215aeec --- /dev/null +++ b/patches.kernel.org/6.2.3-794-fs-dlm-fix-use-after-free-in-midcomms-commit.patch @@ -0,0 +1,184 @@ +From: Alexander Aring +Date: Thu, 12 Jan 2023 17:10:32 -0500 +Subject: [PATCH] fs: dlm: fix use after free in midcomms commit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 724b6bab0d75f1dc01fdfbf7fe8d4217a5cb90ba + +commit 724b6bab0d75f1dc01fdfbf7fe8d4217a5cb90ba upstream. + +While working on processing dlm message in softirq context I experienced +the following KASAN use-after-free warning: + +[ 151.760477] ================================================================== +[ 151.761803] BUG: KASAN: use-after-free in dlm_midcomms_commit_mhandle+0x19d/0x4b0 +[ 151.763414] Read of size 4 at addr ffff88811a980c60 by task lock_torture/1347 + +[ 151.765284] CPU: 7 PID: 1347 Comm: lock_torture Not tainted 6.1.0-rc4+ #2828 +[ 151.766778] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+16134+e5908aa2 04/01/2014 +[ 151.768726] Call Trace: +[ 151.769277] +[ 151.769748] dump_stack_lvl+0x5b/0x86 +[ 151.770556] print_report+0x180/0x4c8 +[ 151.771378] ? kasan_complete_mode_report_info+0x7c/0x1e0 +[ 151.772241] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 +[ 151.773069] kasan_report+0x93/0x1a0 +[ 151.773668] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 +[ 151.774514] __asan_load4+0x7e/0xa0 +[ 151.775089] dlm_midcomms_commit_mhandle+0x19d/0x4b0 +[ 151.775890] ? create_message.isra.29.constprop.64+0x57/0xc0 +[ 151.776770] send_common+0x19f/0x1b0 +[ 151.777342] ? remove_from_waiters+0x60/0x60 +[ 151.778017] ? lock_downgrade+0x410/0x410 +[ 151.778648] ? __this_cpu_preempt_check+0x13/0x20 +[ 151.779421] ? rcu_lockdep_current_cpu_online+0x88/0xc0 +[ 151.780292] _convert_lock+0x46/0x150 +[ 151.780893] convert_lock+0x7b/0xc0 +[ 151.781459] dlm_lock+0x3ac/0x580 +[ 151.781993] ? 0xffffffffc0540000 +[ 151.782522] ? torture_stop+0x120/0x120 [dlm_locktorture] +[ 151.783379] ? dlm_scan_rsbs+0xa70/0xa70 +[ 151.784003] ? preempt_count_sub+0xd6/0x130 +[ 151.784661] ? is_module_address+0x47/0x70 +[ 151.785309] ? torture_stop+0x120/0x120 [dlm_locktorture] +[ 151.786166] ? 0xffffffffc0540000 +[ 151.786693] ? lockdep_init_map_type+0xc3/0x360 +[ 151.787414] ? 0xffffffffc0540000 +[ 151.787947] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] +[ 151.789004] ? torture_stop+0x120/0x120 [dlm_locktorture] +[ 151.789858] ? 0xffffffffc0540000 +[ 151.790392] ? lock_torture_cleanup+0x20/0x20 [dlm_locktorture] +[ 151.791347] ? delay_tsc+0x94/0xc0 +[ 151.791898] torture_ex_iter+0xc3/0xea [dlm_locktorture] +[ 151.792735] ? torture_start+0x30/0x30 [dlm_locktorture] +[ 151.793606] lock_torture+0x177/0x270 [dlm_locktorture] +[ 151.794448] ? torture_dlm_lock_sync.isra.3+0x150/0x150 [dlm_locktorture] +[ 151.795539] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] +[ 151.796476] ? do_raw_spin_lock+0x11e/0x1e0 +[ 151.797152] ? mark_held_locks+0x34/0xb0 +[ 151.797784] ? _raw_spin_unlock_irqrestore+0x30/0x70 +[ 151.798581] ? __kthread_parkme+0x79/0x110 +[ 151.799246] ? trace_preempt_on+0x2a/0xf0 +[ 151.799902] ? __kthread_parkme+0x79/0x110 +[ 151.800579] ? preempt_count_sub+0xd6/0x130 +[ 151.801271] ? __kasan_check_read+0x11/0x20 +[ 151.801963] ? __kthread_parkme+0xec/0x110 +[ 151.802630] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] +[ 151.803569] kthread+0x192/0x1d0 +[ 151.804104] ? kthread_complete_and_exit+0x30/0x30 +[ 151.804881] ret_from_fork+0x1f/0x30 +[ 151.805480] + +[ 151.806111] Allocated by task 1347: +[ 151.806681] kasan_save_stack+0x26/0x50 +[ 151.807308] kasan_set_track+0x25/0x30 +[ 151.807920] kasan_save_alloc_info+0x1e/0x30 +[ 151.808609] __kasan_slab_alloc+0x63/0x80 +[ 151.809263] kmem_cache_alloc+0x1ad/0x830 +[ 151.809916] dlm_allocate_mhandle+0x17/0x20 +[ 151.810590] dlm_midcomms_get_mhandle+0x96/0x260 +[ 151.811344] _create_message+0x95/0x180 +[ 151.811994] create_message.isra.29.constprop.64+0x57/0xc0 +[ 151.812880] send_common+0x129/0x1b0 +[ 151.813467] _convert_lock+0x46/0x150 +[ 151.814074] convert_lock+0x7b/0xc0 +[ 151.814648] dlm_lock+0x3ac/0x580 +[ 151.815199] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] +[ 151.816258] torture_ex_iter+0xc3/0xea [dlm_locktorture] +[ 151.817129] lock_torture+0x177/0x270 [dlm_locktorture] +[ 151.817986] kthread+0x192/0x1d0 +[ 151.818518] ret_from_fork+0x1f/0x30 + +[ 151.819369] Freed by task 1336: +[ 151.819890] kasan_save_stack+0x26/0x50 +[ 151.820514] kasan_set_track+0x25/0x30 +[ 151.821128] kasan_save_free_info+0x2e/0x50 +[ 151.821812] __kasan_slab_free+0x107/0x1a0 +[ 151.822483] kmem_cache_free+0x204/0x5e0 +[ 151.823152] dlm_free_mhandle+0x18/0x20 +[ 151.823781] dlm_mhandle_release+0x2e/0x40 +[ 151.824454] rcu_core+0x583/0x1330 +[ 151.825047] rcu_core_si+0xe/0x20 +[ 151.825594] __do_softirq+0xf4/0x5c2 + +[ 151.826450] Last potentially related work creation: +[ 151.827238] kasan_save_stack+0x26/0x50 +[ 151.827870] __kasan_record_aux_stack+0xa2/0xc0 +[ 151.828609] kasan_record_aux_stack_noalloc+0xb/0x20 +[ 151.829415] call_rcu+0x4c/0x760 +[ 151.829954] dlm_mhandle_delete+0x97/0xb0 +[ 151.830718] dlm_process_incoming_buffer+0x2fc/0xb30 +[ 151.831524] process_dlm_messages+0x16e/0x470 +[ 151.832245] process_one_work+0x505/0xa10 +[ 151.832905] worker_thread+0x67/0x650 +[ 151.833507] kthread+0x192/0x1d0 +[ 151.834046] ret_from_fork+0x1f/0x30 + +[ 151.834900] The buggy address belongs to the object at ffff88811a980c30 + which belongs to the cache dlm_mhandle of size 88 +[ 151.836894] The buggy address is located 48 bytes inside of + 88-byte region [ffff88811a980c30, ffff88811a980c88) + +[ 151.839007] The buggy address belongs to the physical page: +[ 151.839904] page:0000000076cf5d62 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a980 +[ 151.841378] flags: 0x8000000000000200(slab|zone=2) +[ 151.842141] raw: 8000000000000200 0000000000000000 dead000000000122 ffff8881089b43c0 +[ 151.843401] raw: 0000000000000000 0000000000220022 00000001ffffffff 0000000000000000 +[ 151.844640] page dumped because: kasan: bad access detected + +[ 151.845822] Memory state around the buggy address: +[ 151.846602] ffff88811a980b00: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb +[ 151.847761] ffff88811a980b80: fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb +[ 151.848921] >ffff88811a980c00: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb +[ 151.850076] ^ +[ 151.851085] ffff88811a980c80: fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb +[ 151.852269] ffff88811a980d00: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fc +[ 151.853428] ================================================================== +[ 151.855618] Disabling lock debugging due to kernel taint + +It is accessing a mhandle in dlm_midcomms_commit_mhandle() and the mhandle +was freed by a call_rcu() call in dlm_process_incoming_buffer(), +dlm_mhandle_delete(). It looks like it was freed because an ack of +this message was received. There is a short race between committing the +dlm message to be transmitted and getting an ack back. If the ack is +faster than returning from dlm_midcomms_commit_msg_3_2(), then we run +into a use-after free because we still need to reference the mhandle when +calling srcu_read_unlock(). + +To avoid that, we don't allow that mhandle to be freed between +dlm_midcomms_commit_msg_3_2() and srcu_read_unlock() by using rcu read +lock. We can do that because mhandle is protected by rcu handling. + +Cc: stable@vger.kernel.org +Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dlm/midcomms.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/dlm/midcomms.c b/fs/dlm/midcomms.c +index fc015a6a..2e60d9a2 100644 +--- a/fs/dlm/midcomms.c ++++ b/fs/dlm/midcomms.c +@@ -1214,8 +1214,15 @@ void dlm_midcomms_commit_mhandle(struct dlm_mhandle *mh, + dlm_free_mhandle(mh); + break; + case DLM_VERSION_3_2: ++ /* held rcu read lock here, because we sending the ++ * dlm message out, when we do that we could receive ++ * an ack back which releases the mhandle and we ++ * get a use after free. ++ */ ++ rcu_read_lock(); + dlm_midcomms_commit_msg_3_2(mh, name, namelen); + srcu_read_unlock(&nodes_srcu, mh->idx); ++ rcu_read_unlock(); + break; + default: + srcu_read_unlock(&nodes_srcu, mh->idx); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-795-fs-dlm-be-sure-to-call-dlm_send_queue_flush.patch b/patches.kernel.org/6.2.3-795-fs-dlm-be-sure-to-call-dlm_send_queue_flush.patch new file mode 100644 index 0000000..983857e --- /dev/null +++ b/patches.kernel.org/6.2.3-795-fs-dlm-be-sure-to-call-dlm_send_queue_flush.patch @@ -0,0 +1,40 @@ +From: Alexander Aring +Date: Thu, 12 Jan 2023 17:10:33 -0500 +Subject: [PATCH] fs: dlm: be sure to call dlm_send_queue_flush() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7354fa4ef697191effedc2ae9a8293427708bbf5 + +commit 7354fa4ef697191effedc2ae9a8293427708bbf5 upstream. + +If we release a midcomms node structure, there should be nothing left +inside the dlm midcomms send queue. However, sometimes this is not true +because I believe some DLM_FIN message was not acked... if we run +into a shutdown timeout, then we should be sure there is no pending send +dlm message inside this queue when releasing midcomms node structure. + +Cc: stable@vger.kernel.org +Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dlm/midcomms.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/dlm/midcomms.c b/fs/dlm/midcomms.c +index 2e60d9a2..a3eb19c8 100644 +--- a/fs/dlm/midcomms.c ++++ b/fs/dlm/midcomms.c +@@ -1402,6 +1402,7 @@ static void midcomms_node_release(struct rcu_head *rcu) + struct midcomms_node *node = container_of(rcu, struct midcomms_node, rcu); + + WARN_ON_ONCE(atomic_read(&node->send_queue_cnt)); ++ dlm_send_queue_flush(node); + kfree(node); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-796-fs-dlm-fix-race-setting-stop-tx-flag.patch b/patches.kernel.org/6.2.3-796-fs-dlm-fix-race-setting-stop-tx-flag.patch new file mode 100644 index 0000000..8ea9095 --- /dev/null +++ b/patches.kernel.org/6.2.3-796-fs-dlm-fix-race-setting-stop-tx-flag.patch @@ -0,0 +1,51 @@ +From: Alexander Aring +Date: Thu, 12 Jan 2023 17:10:34 -0500 +Subject: [PATCH] fs: dlm: fix race setting stop tx flag +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 164272113b685927126c938b4a9cbd2075eb15ee + +commit 164272113b685927126c938b4a9cbd2075eb15ee upstream. + +This patch sets the stop tx flag before we commit the dlm message. +This flag will report about unexpected transmissions after we +send the DLM_FIN message out, which should be the last message sent. +When we commit the dlm fin message, it could be that we already +got an ack back and the CLOSED state change already happened. +We should not set this flag when we are in CLOSED state. To avoid this +race we simply set the tx flag before the state change can be in +progress by moving it before dlm_midcomms_commit_mhandle(). + +Cc: stable@vger.kernel.org +Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dlm/midcomms.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dlm/midcomms.c b/fs/dlm/midcomms.c +index a3eb19c8..9d459d5b 100644 +--- a/fs/dlm/midcomms.c ++++ b/fs/dlm/midcomms.c +@@ -406,6 +406,7 @@ static int dlm_send_fin(struct midcomms_node *node, + if (!mh) + return -ENOMEM; + ++ set_bit(DLM_NODE_FLAG_STOP_TX, &node->flags); + mh->ack_rcv = ack_rcv; + + m_header = (struct dlm_header *)ppc; +@@ -417,7 +418,6 @@ static int dlm_send_fin(struct midcomms_node *node, + + pr_debug("sending fin msg to node %d\n", node->nodeid); + dlm_midcomms_commit_mhandle(mh, NULL, 0); +- set_bit(DLM_NODE_FLAG_STOP_TX, &node->flags); + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-797-fs-dlm-don-t-set-stop-rx-flag-after-node-reset.patch b/patches.kernel.org/6.2.3-797-fs-dlm-don-t-set-stop-rx-flag-after-node-reset.patch new file mode 100644 index 0000000..8d92cdf --- /dev/null +++ b/patches.kernel.org/6.2.3-797-fs-dlm-don-t-set-stop-rx-flag-after-node-reset.patch @@ -0,0 +1,53 @@ +From: Alexander Aring +Date: Thu, 12 Jan 2023 17:10:35 -0500 +Subject: [PATCH] fs: dlm: don't set stop rx flag after node reset +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 15c63db8e86a72e0d5cfb9bf0cd1870e39a3e5fe + +commit 15c63db8e86a72e0d5cfb9bf0cd1870e39a3e5fe upstream. + +Similar to the stop tx flag, the rx flag should warn about a dlm message +being received at DLM_FIN state change, when we are assuming no other +dlm application messages. If we receive a FIN message and we are in the +state DLM_FIN_WAIT2 we call midcomms_node_reset() which puts the +midcomms node into DLM_CLOSED state. Afterwards we should not set the +DLM_NODE_FLAG_STOP_RX flag any more. This patch changes the setting +DLM_NODE_FLAG_STOP_RX in those state changes when we receive a FIN +message and we assume there will be no other dlm application messages +received until we hit DLM_CLOSED state. + +Cc: stable@vger.kernel.org +Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dlm/midcomms.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/dlm/midcomms.c b/fs/dlm/midcomms.c +index 9d459d5b..1fef9921 100644 +--- a/fs/dlm/midcomms.c ++++ b/fs/dlm/midcomms.c +@@ -524,6 +524,7 @@ static void dlm_midcomms_receive_buffer(union dlm_packet *p, + break; + case DLM_FIN_WAIT1: + node->state = DLM_CLOSING; ++ set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); + pr_debug("switch node %d to state %s\n", + node->nodeid, dlm_state_str(node->state)); + break; +@@ -544,8 +545,6 @@ static void dlm_midcomms_receive_buffer(union dlm_packet *p, + return; + } + spin_unlock(&node->state_lock); +- +- set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); + break; + default: + WARN_ON_ONCE(test_bit(DLM_NODE_FLAG_STOP_RX, &node->flags)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-798-fs-dlm-move-sending-fin-message-into-state-chan.patch b/patches.kernel.org/6.2.3-798-fs-dlm-move-sending-fin-message-into-state-chan.patch new file mode 100644 index 0000000..d76f0d1 --- /dev/null +++ b/patches.kernel.org/6.2.3-798-fs-dlm-move-sending-fin-message-into-state-chan.patch @@ -0,0 +1,115 @@ +From: Alexander Aring +Date: Thu, 12 Jan 2023 17:10:36 -0500 +Subject: [PATCH] fs: dlm: move sending fin message into state change handling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a58496361802070996f9bd76e941d109c4a85ebd + +commit a58496361802070996f9bd76e941d109c4a85ebd upstream. + +This patch moves the send fin handling, which should appear in a specific +state change, into the state change handling while the per node +state_lock is held. I experienced issues with other messages because +we changed the state and a fin message was sent out in a different state. + +Cc: stable@vger.kernel.org +Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dlm/midcomms.c | 33 +++++++++------------------------ + 1 file changed, 9 insertions(+), 24 deletions(-) + +diff --git a/fs/dlm/midcomms.c b/fs/dlm/midcomms.c +index 1fef9921..fd9f413c 100644 +--- a/fs/dlm/midcomms.c ++++ b/fs/dlm/midcomms.c +@@ -402,7 +402,7 @@ static int dlm_send_fin(struct midcomms_node *node, + struct dlm_mhandle *mh; + char *ppc; + +- mh = dlm_midcomms_get_mhandle(node->nodeid, mb_len, GFP_NOFS, &ppc); ++ mh = dlm_midcomms_get_mhandle(node->nodeid, mb_len, GFP_ATOMIC, &ppc); + if (!mh) + return -ENOMEM; + +@@ -518,8 +518,8 @@ static void dlm_midcomms_receive_buffer(union dlm_packet *p, + node->state = DLM_LAST_ACK; + pr_debug("switch node %d to state %s case 1\n", + node->nodeid, dlm_state_str(node->state)); +- spin_unlock(&node->state_lock); +- goto send_fin; ++ set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); ++ dlm_send_fin(node, dlm_pas_fin_ack_rcv); + } + break; + case DLM_FIN_WAIT1: +@@ -563,12 +563,6 @@ static void dlm_midcomms_receive_buffer(union dlm_packet *p, + log_print_ratelimited("ignore dlm msg because seq mismatch, seq: %u, expected: %u, nodeid: %d", + seq, node->seq_next, node->nodeid); + } +- +- return; +- +-send_fin: +- set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); +- dlm_send_fin(node, dlm_pas_fin_ack_rcv); + } + + static struct midcomms_node * +@@ -1368,11 +1362,11 @@ void dlm_midcomms_remove_member(int nodeid) + case DLM_CLOSE_WAIT: + /* passive shutdown DLM_LAST_ACK case 2 */ + node->state = DLM_LAST_ACK; +- spin_unlock(&node->state_lock); +- + pr_debug("switch node %d to state %s case 2\n", + node->nodeid, dlm_state_str(node->state)); +- goto send_fin; ++ set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); ++ dlm_send_fin(node, dlm_pas_fin_ack_rcv); ++ break; + case DLM_LAST_ACK: + /* probably receive fin caught it, do nothing */ + break; +@@ -1388,12 +1382,6 @@ void dlm_midcomms_remove_member(int nodeid) + spin_unlock(&node->state_lock); + + srcu_read_unlock(&nodes_srcu, idx); +- return; +- +-send_fin: +- set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); +- dlm_send_fin(node, dlm_pas_fin_ack_rcv); +- srcu_read_unlock(&nodes_srcu, idx); + } + + static void midcomms_node_release(struct rcu_head *rcu) +@@ -1425,6 +1413,7 @@ static void midcomms_shutdown(struct midcomms_node *node) + node->state = DLM_FIN_WAIT1; + pr_debug("switch node %d to state %s case 2\n", + node->nodeid, dlm_state_str(node->state)); ++ dlm_send_fin(node, dlm_act_fin_ack_rcv); + break; + case DLM_CLOSED: + /* we have what we want */ +@@ -1438,12 +1427,8 @@ static void midcomms_shutdown(struct midcomms_node *node) + } + spin_unlock(&node->state_lock); + +- if (node->state == DLM_FIN_WAIT1) { +- dlm_send_fin(node, dlm_act_fin_ack_rcv); +- +- if (DLM_DEBUG_FENCE_TERMINATION) +- msleep(5000); +- } ++ if (DLM_DEBUG_FENCE_TERMINATION) ++ msleep(5000); + + /* wait for other side dlm + fin */ + ret = wait_event_timeout(node->shutdown_wait, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-799-fs-dlm-send-FIN-ack-back-in-right-cases.patch b/patches.kernel.org/6.2.3-799-fs-dlm-send-FIN-ack-back-in-right-cases.patch new file mode 100644 index 0000000..90e1635 --- /dev/null +++ b/patches.kernel.org/6.2.3-799-fs-dlm-send-FIN-ack-back-in-right-cases.patch @@ -0,0 +1,76 @@ +From: Alexander Aring +Date: Thu, 12 Jan 2023 17:10:37 -0500 +Subject: [PATCH] fs: dlm: send FIN ack back in right cases +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 00908b3388255fc1d3782b744d07f327712f401f + +commit 00908b3388255fc1d3782b744d07f327712f401f upstream. + +This patch moves to send a ack back for receiving a FIN message only +when we are in valid states. In other cases and there might be a sender +waiting for a ack we just let it timeout at the senders time and +hopefully all other cleanups will remove the FIN message on their +sending queue. As an example we should never send out an ACK being in +LAST_ACK state or we cannot assume a working socket communication when +we are in CLOSED state. + +Cc: stable@vger.kernel.org +Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/dlm/midcomms.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/fs/dlm/midcomms.c b/fs/dlm/midcomms.c +index fd9f413c..ecfb3beb 100644 +--- a/fs/dlm/midcomms.c ++++ b/fs/dlm/midcomms.c +@@ -375,7 +375,7 @@ static int dlm_send_ack(int nodeid, uint32_t seq) + struct dlm_msg *msg; + char *ppc; + +- msg = dlm_lowcomms_new_msg(nodeid, mb_len, GFP_NOFS, &ppc, ++ msg = dlm_lowcomms_new_msg(nodeid, mb_len, GFP_ATOMIC, &ppc, + NULL, NULL); + if (!msg) + return -ENOMEM; +@@ -498,15 +498,14 @@ static void dlm_midcomms_receive_buffer(union dlm_packet *p, + + switch (p->header.h_cmd) { + case DLM_FIN: +- /* send ack before fin */ +- dlm_send_ack(node->nodeid, node->seq_next); +- + spin_lock(&node->state_lock); + pr_debug("receive fin msg from node %d with state %s\n", + node->nodeid, dlm_state_str(node->state)); + + switch (node->state) { + case DLM_ESTABLISHED: ++ dlm_send_ack(node->nodeid, node->seq_next); ++ + node->state = DLM_CLOSE_WAIT; + pr_debug("switch node %d to state %s\n", + node->nodeid, dlm_state_str(node->state)); +@@ -523,12 +522,14 @@ static void dlm_midcomms_receive_buffer(union dlm_packet *p, + } + break; + case DLM_FIN_WAIT1: ++ dlm_send_ack(node->nodeid, node->seq_next); + node->state = DLM_CLOSING; + set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); + pr_debug("switch node %d to state %s\n", + node->nodeid, dlm_state_str(node->state)); + break; + case DLM_FIN_WAIT2: ++ dlm_send_ack(node->nodeid, node->seq_next); + midcomms_node_reset(node); + pr_debug("switch node %d to state %s\n", + node->nodeid, dlm_state_str(node->state)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-800-f2fs-fix-information-leak-in-f2fs_move_inline_d.patch b/patches.kernel.org/6.2.3-800-f2fs-fix-information-leak-in-f2fs_move_inline_d.patch new file mode 100644 index 0000000..244c4f9 --- /dev/null +++ b/patches.kernel.org/6.2.3-800-f2fs-fix-information-leak-in-f2fs_move_inline_d.patch @@ -0,0 +1,62 @@ +From: Eric Biggers +Date: Sun, 22 Jan 2023 23:04:14 -0800 +Subject: [PATCH] f2fs: fix information leak in f2fs_move_inline_dirents() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9a5571cff4ffcfc24847df9fd545cc5799ac0ee5 + +commit 9a5571cff4ffcfc24847df9fd545cc5799ac0ee5 upstream. + +When converting an inline directory to a regular one, f2fs is leaking +uninitialized memory to disk because it doesn't initialize the entire +directory block. Fix this by zero-initializing the block. + +This bug was introduced by commit 4ec17d688d74 ("f2fs: avoid unneeded +initializing when converting inline dentry"), which didn't consider the +security implications of leaking uninitialized memory to disk. + +This was found by running xfstest generic/435 on a KMSAN-enabled kernel. + +Fixes: 4ec17d688d74 ("f2fs: avoid unneeded initializing when converting inline dentry") +Cc: # v4.3+ +Signed-off-by: Eric Biggers +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/f2fs/inline.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c +index 21a49523..7e867dff 100644 +--- a/fs/f2fs/inline.c ++++ b/fs/f2fs/inline.c +@@ -422,18 +422,17 @@ static int f2fs_move_inline_dirents(struct inode *dir, struct page *ipage, + + dentry_blk = page_address(page); + ++ /* ++ * Start by zeroing the full block, to ensure that all unused space is ++ * zeroed and no uninitialized memory is leaked to disk. ++ */ ++ memset(dentry_blk, 0, F2FS_BLKSIZE); ++ + make_dentry_ptr_inline(dir, &src, inline_dentry); + make_dentry_ptr_block(dir, &dst, dentry_blk); + + /* copy data from inline dentry block to new dentry block */ + memcpy(dst.bitmap, src.bitmap, src.nr_bitmap); +- memset(dst.bitmap + src.nr_bitmap, 0, dst.nr_bitmap - src.nr_bitmap); +- /* +- * we do not need to zero out remainder part of dentry and filename +- * field, since we have used bitmap for marking the usage status of +- * them, besides, we can also ignore copying/zeroing reserved space +- * of dentry block, because them haven't been used so far. +- */ + memcpy(dst.dentry, src.dentry, SIZE_OF_DIR_ENTRY * src.max); + memcpy(dst.filename, src.filename, src.max * F2FS_SLOT_LEN); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-801-f2fs-retry-to-update-the-inode-page-given-data-.patch b/patches.kernel.org/6.2.3-801-f2fs-retry-to-update-the-inode-page-given-data-.patch new file mode 100644 index 0000000..2900b88 --- /dev/null +++ b/patches.kernel.org/6.2.3-801-f2fs-retry-to-update-the-inode-page-given-data-.patch @@ -0,0 +1,59 @@ +From: Jaegeuk Kim +Date: Mon, 30 Jan 2023 15:20:09 -0800 +Subject: [PATCH] f2fs: retry to update the inode page given data corruption +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3aa51c61cb4a4dcb40df51ac61171e9ac5a35321 + +commit 3aa51c61cb4a4dcb40df51ac61171e9ac5a35321 upstream. + +If the storage gives a corrupted node block due to short power failure and +reset, f2fs stops the entire operations by setting the checkpoint failure flag. + +Let's give more chances to live by re-issuing IOs for a while in such critical +path. + +Cc: stable@vger.kernel.org +Suggested-by: Randall Huang +Suggested-by: Chao Yu +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/f2fs/inode.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index ff6cf66e..fb489f55 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -714,18 +714,19 @@ void f2fs_update_inode_page(struct inode *inode) + { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct page *node_page; ++ int count = 0; + retry: + node_page = f2fs_get_node_page(sbi, inode->i_ino); + if (IS_ERR(node_page)) { + int err = PTR_ERR(node_page); + +- if (err == -ENOMEM) { +- cond_resched(); ++ /* The node block was truncated. */ ++ if (err == -ENOENT) ++ return; ++ ++ if (err == -ENOMEM || ++count <= DEFAULT_RETRY_IO_COUNT) + goto retry; +- } else if (err != -ENOENT) { +- f2fs_stop_checkpoint(sbi, false, +- STOP_CP_REASON_UPDATE_INODE); +- } ++ f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_UPDATE_INODE); + return; + } + f2fs_update_inode(inode, node_page); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-802-f2fs-fix-cgroup-writeback-accounting-with-fs-la.patch b/patches.kernel.org/6.2.3-802-f2fs-fix-cgroup-writeback-accounting-with-fs-la.patch new file mode 100644 index 0000000..3894f71 --- /dev/null +++ b/patches.kernel.org/6.2.3-802-f2fs-fix-cgroup-writeback-accounting-with-fs-la.patch @@ -0,0 +1,70 @@ +From: Eric Biggers +Date: Thu, 2 Feb 2023 17:02:39 -0800 +Subject: [PATCH] f2fs: fix cgroup writeback accounting with fs-layer + encryption +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 844545c51a5b2a524b22a2fe9d0b353b827d24b4 + +commit 844545c51a5b2a524b22a2fe9d0b353b827d24b4 upstream. + +When writing a page from an encrypted file that is using +filesystem-layer encryption (not inline encryption), f2fs encrypts the +pagecache page into a bounce page, then writes the bounce page. + +It also passes the bounce page to wbc_account_cgroup_owner(). That's +incorrect, because the bounce page is a newly allocated temporary page +that doesn't have the memory cgroup of the original pagecache page. +This makes wbc_account_cgroup_owner() not account the I/O to the owner +of the pagecache page as it should. + +Fix this by always passing the pagecache page to +wbc_account_cgroup_owner(). + +Fixes: 578c647879f7 ("f2fs: implement cgroup writeback support") +Cc: stable@vger.kernel.org +Reported-by: Matthew Wilcox (Oracle) +Signed-off-by: Eric Biggers +Acked-by: Tejun Heo +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/f2fs/data.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 97e81659..ce4d539b 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -741,7 +741,7 @@ int f2fs_submit_page_bio(struct f2fs_io_info *fio) + } + + if (fio->io_wbc && !is_read_io(fio->op)) +- wbc_account_cgroup_owner(fio->io_wbc, page, PAGE_SIZE); ++ wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE); + + inc_page_count(fio->sbi, is_read_io(fio->op) ? + __read_io_type(page) : WB_DATA_TYPE(fio->page)); +@@ -948,7 +948,7 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio) + } + + if (fio->io_wbc) +- wbc_account_cgroup_owner(fio->io_wbc, page, PAGE_SIZE); ++ wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE); + + inc_page_count(fio->sbi, WB_DATA_TYPE(page)); + +@@ -1022,7 +1022,7 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio) + } + + if (fio->io_wbc) +- wbc_account_cgroup_owner(fio->io_wbc, bio_page, PAGE_SIZE); ++ wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE); + + io->last_block_in_bio = fio->new_blkaddr; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-803-f2fs-fix-kernel-crash-due-to-null-io-bio.patch b/patches.kernel.org/6.2.3-803-f2fs-fix-kernel-crash-due-to-null-io-bio.patch new file mode 100644 index 0000000..562fb7d --- /dev/null +++ b/patches.kernel.org/6.2.3-803-f2fs-fix-kernel-crash-due-to-null-io-bio.patch @@ -0,0 +1,64 @@ +From: Jaegeuk Kim +Date: Sun, 5 Feb 2023 19:13:39 -0800 +Subject: [PATCH] f2fs: fix kernel crash due to null io->bio +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 267c159f9c7bcb7009dae16889b880c5ed8759a8 + +commit 267c159f9c7bcb7009dae16889b880c5ed8759a8 upstream. + +We should return when io->bio is null before doing anything. Otherwise, panic. + +BUG: kernel NULL pointer dereference, address: 0000000000000010 +RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs] +Call Trace: + + f2fs_submit_merged_write+0x1d/0x30 [f2fs] + commit_checkpoint+0x110/0x1e0 [f2fs] + f2fs_write_checkpoint+0x9f7/0xf00 [f2fs] + ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs] + __checkpoint_and_complete_reqs+0x84/0x190 [f2fs] + ? preempt_count_add+0x82/0xc0 + ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs] + issue_checkpoint_thread+0x4c/0xf0 [f2fs] + ? __pfx_autoremove_wake_function+0x10/0x10 + kthread+0xff/0x130 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x2c/0x50 + + +Cc: stable@vger.kernel.org # v5.18+ +Fixes: 64bf0eef0171 ("f2fs: pass the bio operation to bio_alloc_bioset") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/f2fs/data.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index ce4d539b..8cca566b 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -655,6 +655,9 @@ static void __f2fs_submit_merged_write(struct f2fs_sb_info *sbi, + + f2fs_down_write(&io->io_rwsem); + ++ if (!io->bio) ++ goto unlock_out; ++ + /* change META to META_FLUSH in the checkpoint procedure */ + if (type >= META_FLUSH) { + io->fio.type = META_FLUSH; +@@ -663,6 +666,7 @@ static void __f2fs_submit_merged_write(struct f2fs_sb_info *sbi, + io->bio->bi_opf |= REQ_PREFLUSH | REQ_FUA; + } + __submit_merged_bio(io); ++unlock_out: + f2fs_up_write(&io->io_rwsem); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-804-f2fs-Revert-f2fs-truncate-blocks-in-batch-in-__.patch b/patches.kernel.org/6.2.3-804-f2fs-Revert-f2fs-truncate-blocks-in-batch-in-__.patch new file mode 100644 index 0000000..8d78e51 --- /dev/null +++ b/patches.kernel.org/6.2.3-804-f2fs-Revert-f2fs-truncate-blocks-in-batch-in-__.patch @@ -0,0 +1,58 @@ +From: Jaegeuk Kim +Date: Tue, 14 Feb 2023 15:53:52 -0800 +Subject: [PATCH] f2fs: Revert "f2fs: truncate blocks in batch in + __complete_revoke_list()" +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c7dbc06688292db34c1bb9c715e29ac4935af994 + +commit c7dbc06688292db34c1bb9c715e29ac4935af994 upstream. + +We should not truncate replaced blocks, and were supposed to truncate the first +part as well. + +This reverts commit 78a99fe6254cad4be310cd84af39f6c46b668c72. + +Cc: stable@vger.kernel.org +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/f2fs/segment.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index ae3c4e54..b019f63f 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -262,19 +262,24 @@ static void __complete_revoke_list(struct inode *inode, struct list_head *head, + bool revoke) + { + struct revoke_entry *cur, *tmp; ++ pgoff_t start_index = 0; + bool truncate = is_inode_flag_set(inode, FI_ATOMIC_REPLACE); + + list_for_each_entry_safe(cur, tmp, head, list) { +- if (revoke) ++ if (revoke) { + __replace_atomic_write_block(inode, cur->index, + cur->old_addr, NULL, true); ++ } else if (truncate) { ++ f2fs_truncate_hole(inode, start_index, cur->index); ++ start_index = cur->index + 1; ++ } + + list_del(&cur->list); + kmem_cache_free(revoke_entry_slab, cur); + } + + if (!revoke && truncate) +- f2fs_do_truncate_blocks(inode, 0, false); ++ f2fs_do_truncate_blocks(inode, start_index * PAGE_SIZE, false); + } + + static int __f2fs_commit_atomic_write(struct inode *inode) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-805-ocfs2-fix-defrag-path-triggering-jbd2-ASSERT.patch b/patches.kernel.org/6.2.3-805-ocfs2-fix-defrag-path-triggering-jbd2-ASSERT.patch new file mode 100644 index 0000000..2646728 --- /dev/null +++ b/patches.kernel.org/6.2.3-805-ocfs2-fix-defrag-path-triggering-jbd2-ASSERT.patch @@ -0,0 +1,106 @@ +From: Heming Zhao via Ocfs2-devel +Date: Fri, 17 Feb 2023 08:37:17 +0800 +Subject: [PATCH] ocfs2: fix defrag path triggering jbd2 ASSERT +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 60eed1e3d45045623e46944ebc7c42c30a4350f0 + +commit 60eed1e3d45045623e46944ebc7c42c30a4350f0 upstream. + +code path: + +ocfs2_ioctl_move_extents + ocfs2_move_extents + ocfs2_defrag_extent + __ocfs2_move_extent + + ocfs2_journal_access_di + + ocfs2_split_extent //sub-paths call jbd2_journal_restart + + ocfs2_journal_dirty //crash by jbs2 ASSERT + +crash stacks: + +PID: 11297 TASK: ffff974a676dcd00 CPU: 67 COMMAND: "defragfs.ocfs2" + #0 [ffffb25d8dad3900] machine_kexec at ffffffff8386fe01 + #1 [ffffb25d8dad3958] __crash_kexec at ffffffff8395959d + #2 [ffffb25d8dad3a20] crash_kexec at ffffffff8395a45d + #3 [ffffb25d8dad3a38] oops_end at ffffffff83836d3f + #4 [ffffb25d8dad3a58] do_trap at ffffffff83833205 + #5 [ffffb25d8dad3aa0] do_invalid_op at ffffffff83833aa6 + #6 [ffffb25d8dad3ac0] invalid_op at ffffffff84200d18 + [exception RIP: jbd2_journal_dirty_metadata+0x2ba] + RIP: ffffffffc09ca54a RSP: ffffb25d8dad3b70 RFLAGS: 00010207 + RAX: 0000000000000000 RBX: ffff9706eedc5248 RCX: 0000000000000000 + RDX: 0000000000000001 RSI: ffff97337029ea28 RDI: ffff9706eedc5250 + RBP: ffff9703c3520200 R8: 000000000f46b0b2 R9: 0000000000000000 + R10: 0000000000000001 R11: 00000001000000fe R12: ffff97337029ea28 + R13: 0000000000000000 R14: ffff9703de59bf60 R15: ffff9706eedc5250 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + #7 [ffffb25d8dad3ba8] ocfs2_journal_dirty at ffffffffc137fb95 [ocfs2] + #8 [ffffb25d8dad3be8] __ocfs2_move_extent at ffffffffc139a950 [ocfs2] + #9 [ffffb25d8dad3c80] ocfs2_defrag_extent at ffffffffc139b2d2 [ocfs2] + +Analysis + +This bug has the same root cause of 'commit 7f27ec978b0e ("ocfs2: call +ocfs2_journal_access_di() before ocfs2_journal_dirty() in +ocfs2_write_end_nolock()")'. For this bug, jbd2_journal_restart() is +called by ocfs2_split_extent() during defragmenting. + +How to fix + +For ocfs2_split_extent() can handle journal operations totally by itself. +Caller doesn't need to call journal access/dirty pair, and caller only +needs to call journal start/stop pair. The fix method is to remove +journal access/dirty from __ocfs2_move_extent(). + +The discussion for this patch: +https://oss.oracle.com/pipermail/ocfs2-devel/2023-February/000647.html + +Link: https://lkml.kernel.org/r/20230217003717.32469-1-heming.zhao@suse.com +Signed-off-by: Heming Zhao +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ocfs2/move_extents.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c +index 192cad06..6251748c 100644 +--- a/fs/ocfs2/move_extents.c ++++ b/fs/ocfs2/move_extents.c +@@ -105,14 +105,6 @@ static int __ocfs2_move_extent(handle_t *handle, + */ + replace_rec.e_flags = ext_flags & ~OCFS2_EXT_REFCOUNTED; + +- ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), +- context->et.et_root_bh, +- OCFS2_JOURNAL_ACCESS_WRITE); +- if (ret) { +- mlog_errno(ret); +- goto out; +- } +- + ret = ocfs2_split_extent(handle, &context->et, path, index, + &replace_rec, context->meta_ac, + &context->dealloc); +@@ -121,8 +113,6 @@ static int __ocfs2_move_extent(handle_t *handle, + goto out; + } + +- ocfs2_journal_dirty(handle, context->et.et_root_bh); +- + context->new_phys_cpos = new_p_cpos; + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-806-ocfs2-fix-non-auto-defrag-path-not-working-issu.patch b/patches.kernel.org/6.2.3-806-ocfs2-fix-non-auto-defrag-path-not-working-issu.patch new file mode 100644 index 0000000..b33d6ec --- /dev/null +++ b/patches.kernel.org/6.2.3-806-ocfs2-fix-non-auto-defrag-path-not-working-issu.patch @@ -0,0 +1,97 @@ +From: Heming Zhao via Ocfs2-devel +Date: Mon, 20 Feb 2023 13:05:26 +0800 +Subject: [PATCH] ocfs2: fix non-auto defrag path not working issue +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 236b9254f8d1edc273ad88b420aa85fbd84f492d + +commit 236b9254f8d1edc273ad88b420aa85fbd84f492d upstream. + +This fixes three issues on move extents ioctl without auto defrag: + +a) In ocfs2_find_victim_alloc_group(), we have to convert bits to block + first in case of global bitmap. + +b) In ocfs2_probe_alloc_group(), when finding enough bits in block + group bitmap, we have to back off move_len to start pos as well, + otherwise it may corrupt filesystem. + +c) In ocfs2_ioctl_move_extents(), set me_threshold both for non-auto + and auto defrag paths. Otherwise it will set move_max_hop to 0 and + finally cause unexpectedly ENOSPC error. + +Currently there are no tools triggering the above issues since +defragfs.ocfs2 enables auto defrag by default. Tested with manually +changing defragfs.ocfs2 to run non auto defrag path. + +Link: https://lkml.kernel.org/r/20230220050526.22020-1-heming.zhao@suse.com +Signed-off-by: Heming Zhao +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ocfs2/move_extents.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c +index 6251748c..b1e32ec4 100644 +--- a/fs/ocfs2/move_extents.c ++++ b/fs/ocfs2/move_extents.c +@@ -434,7 +434,7 @@ static int ocfs2_find_victim_alloc_group(struct inode *inode, + bg = (struct ocfs2_group_desc *)gd_bh->b_data; + + if (vict_blkno < (le64_to_cpu(bg->bg_blkno) + +- le16_to_cpu(bg->bg_bits))) { ++ (le16_to_cpu(bg->bg_bits) << bits_per_unit))) { + + *ret_bh = gd_bh; + *vict_bit = (vict_blkno - blkno) >> +@@ -549,6 +549,7 @@ static void ocfs2_probe_alloc_group(struct inode *inode, struct buffer_head *bh, + last_free_bits++; + + if (last_free_bits == move_len) { ++ i -= move_len; + *goal_bit = i; + *phys_cpos = base_cpos + i; + break; +@@ -1020,18 +1021,19 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp) + + context->range = ⦥ + ++ /* ++ * ok, the default theshold for the defragmentation ++ * is 1M, since our maximum clustersize was 1M also. ++ * any thought? ++ */ ++ if (!range.me_threshold) ++ range.me_threshold = 1024 * 1024; ++ ++ if (range.me_threshold > i_size_read(inode)) ++ range.me_threshold = i_size_read(inode); ++ + if (range.me_flags & OCFS2_MOVE_EXT_FL_AUTO_DEFRAG) { + context->auto_defrag = 1; +- /* +- * ok, the default theshold for the defragmentation +- * is 1M, since our maximum clustersize was 1M also. +- * any thought? +- */ +- if (!range.me_threshold) +- range.me_threshold = 1024 * 1024; +- +- if (range.me_threshold > i_size_read(inode)) +- range.me_threshold = i_size_read(inode); + + if (range.me_flags & OCFS2_MOVE_EXT_FL_PART_DEFRAG) + context->partial = 1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-807-fs-cramfs-inode.c-initialize-file_ra_state.patch b/patches.kernel.org/6.2.3-807-fs-cramfs-inode.c-initialize-file_ra_state.patch new file mode 100644 index 0000000..b558348 --- /dev/null +++ b/patches.kernel.org/6.2.3-807-fs-cramfs-inode.c-initialize-file_ra_state.patch @@ -0,0 +1,41 @@ +From: Andrew Morton +Date: Sun, 26 Feb 2023 12:31:11 -0800 +Subject: [PATCH] fs/cramfs/inode.c: initialize file_ra_state +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3e35102666f873a135d31a726ac1ec8af4905206 + +commit 3e35102666f873a135d31a726ac1ec8af4905206 upstream. + +file_ra_state_init() assumes that the file_ra_state has been zeroed out. +Fixes a KMSAN used-unintialized issue (at least). + +Fixes: cf948cbc35e80 ("cramfs: read_mapping_page() is synchronous") +Reported-by: syzbot + Link: https://lkml.kernel.org/r/0000000000008f74e905f56df987@google.com +Cc: Matthew Wilcox +Cc: Nicolas Pitre +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/cramfs/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c +index 61ccf772..6dae27d6 100644 +--- a/fs/cramfs/inode.c ++++ b/fs/cramfs/inode.c +@@ -183,7 +183,7 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset, + unsigned int len) + { + struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping; +- struct file_ra_state ra; ++ struct file_ra_state ra = {}; + struct page *pages[BLKS_PER_BUF]; + unsigned i, blocknr, buffer; + unsigned long devsize; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-808-selftests-landlock-Skip-overlayfs-tests-when-no.patch b/patches.kernel.org/6.2.3-808-selftests-landlock-Skip-overlayfs-tests-when-no.patch new file mode 100644 index 0000000..1ab6990 --- /dev/null +++ b/patches.kernel.org/6.2.3-808-selftests-landlock-Skip-overlayfs-tests-when-no.patch @@ -0,0 +1,124 @@ +From: Jeff Xu +Date: Fri, 13 Jan 2023 05:32:29 +0000 +Subject: [PATCH] selftests/landlock: Skip overlayfs tests when not supported +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 366617a69e60610912836570546f118006ebc7cb + +commit 366617a69e60610912836570546f118006ebc7cb upstream. + +overlayfs may be disabled in the kernel configuration, causing related +tests to fail. Check that overlayfs is supported at runtime, so we can +skip layout2_overlay.* accordingly. + +Signed-off-by: Jeff Xu +Reviewed-by: Guenter Roeck +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230113053229.1281774-2-jeffxu@google.com +[mic: Reword comments and constify variables] +Signed-off-by: Mickaël Salaün +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/landlock/fs_test.c | 47 ++++++++++++++++++++++ + 1 file changed, 47 insertions(+) + +diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c +index d5dab986..b6c4be3f 100644 +--- a/tools/testing/selftests/landlock/fs_test.c ++++ b/tools/testing/selftests/landlock/fs_test.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -89,6 +90,40 @@ static const char dir_s3d3[] = TMP_DIR "/s3d1/s3d2/s3d3"; + * └── s3d3 + */ + ++static bool fgrep(FILE *const inf, const char *const str) ++{ ++ char line[32]; ++ const int slen = strlen(str); ++ ++ while (!feof(inf)) { ++ if (!fgets(line, sizeof(line), inf)) ++ break; ++ if (strncmp(line, str, slen)) ++ continue; ++ ++ return true; ++ } ++ ++ return false; ++} ++ ++static bool supports_overlayfs(void) ++{ ++ bool res; ++ FILE *const inf = fopen("/proc/filesystems", "r"); ++ ++ /* ++ * Consider that the filesystem is supported if we cannot get the ++ * supported ones. ++ */ ++ if (!inf) ++ return true; ++ ++ res = fgrep(inf, "nodev\toverlay\n"); ++ fclose(inf); ++ return res; ++} ++ + static void mkdir_parents(struct __test_metadata *const _metadata, + const char *const path) + { +@@ -4001,6 +4036,9 @@ FIXTURE(layout2_overlay) {}; + + FIXTURE_SETUP(layout2_overlay) + { ++ if (!supports_overlayfs()) ++ SKIP(return, "overlayfs is not supported"); ++ + prepare_layout(_metadata); + + create_directory(_metadata, LOWER_BASE); +@@ -4037,6 +4075,9 @@ FIXTURE_SETUP(layout2_overlay) + + FIXTURE_TEARDOWN(layout2_overlay) + { ++ if (!supports_overlayfs()) ++ SKIP(return, "overlayfs is not supported"); ++ + EXPECT_EQ(0, remove_path(lower_do1_fl3)); + EXPECT_EQ(0, remove_path(lower_dl1_fl2)); + EXPECT_EQ(0, remove_path(lower_fl1)); +@@ -4068,6 +4109,9 @@ FIXTURE_TEARDOWN(layout2_overlay) + + TEST_F_FORK(layout2_overlay, no_restriction) + { ++ if (!supports_overlayfs()) ++ SKIP(return, "overlayfs is not supported"); ++ + ASSERT_EQ(0, test_open(lower_fl1, O_RDONLY)); + ASSERT_EQ(0, test_open(lower_dl1, O_RDONLY)); + ASSERT_EQ(0, test_open(lower_dl1_fl2, O_RDONLY)); +@@ -4231,6 +4275,9 @@ TEST_F_FORK(layout2_overlay, same_content_different_file) + size_t i; + const char *path_entry; + ++ if (!supports_overlayfs()) ++ SKIP(return, "overlayfs is not supported"); ++ + /* Sets rules on base directories (i.e. outside overlay scope). */ + ruleset_fd = create_ruleset(_metadata, ACCESS_RW, layer1_base); + ASSERT_LE(0, ruleset_fd); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-809-selftests-landlock-Test-ptrace-as-much-as-possi.patch b/patches.kernel.org/6.2.3-809-selftests-landlock-Test-ptrace-as-much-as-possi.patch new file mode 100644 index 0000000..e4ba79d --- /dev/null +++ b/patches.kernel.org/6.2.3-809-selftests-landlock-Test-ptrace-as-much-as-possi.patch @@ -0,0 +1,221 @@ +From: Jeff Xu +Date: Sat, 14 Jan 2023 02:03:06 +0000 +Subject: [PATCH] selftests/landlock: Test ptrace as much as possible with Yama +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8677e555f17f51321d0730b945aeb7d4b95f998f + +commit 8677e555f17f51321d0730b945aeb7d4b95f998f upstream. + +Update ptrace tests according to all potential Yama security policies. +This is required to make such tests pass even if Yama is enabled. + +Tests are not skipped but they now check both Landlock and Yama boundary +restrictions at run time to keep a maximum test coverage (i.e. positive +and negative testing). + +Signed-off-by: Jeff Xu +Link: https://lore.kernel.org/r/20230114020306.1407195-2-jeffxu@google.com +Cc: stable@vger.kernel.org +[mic: Add curly braces around EXPECT_EQ() to make it build, and improve +commit message] +Co-developed-by: Mickaël Salaün +Signed-off-by: Mickaël Salaün +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../testing/selftests/landlock/ptrace_test.c | 113 +++++++++++++++--- + 1 file changed, 96 insertions(+), 17 deletions(-) + +diff --git a/tools/testing/selftests/landlock/ptrace_test.c b/tools/testing/selftests/landlock/ptrace_test.c +index c28ef98f..55e78716 100644 +--- a/tools/testing/selftests/landlock/ptrace_test.c ++++ b/tools/testing/selftests/landlock/ptrace_test.c +@@ -19,6 +19,12 @@ + + #include "common.h" + ++/* Copied from security/yama/yama_lsm.c */ ++#define YAMA_SCOPE_DISABLED 0 ++#define YAMA_SCOPE_RELATIONAL 1 ++#define YAMA_SCOPE_CAPABILITY 2 ++#define YAMA_SCOPE_NO_ATTACH 3 ++ + static void create_domain(struct __test_metadata *const _metadata) + { + int ruleset_fd; +@@ -60,6 +66,25 @@ static int test_ptrace_read(const pid_t pid) + return 0; + } + ++static int get_yama_ptrace_scope(void) ++{ ++ int ret; ++ char buf[2] = {}; ++ const int fd = open("/proc/sys/kernel/yama/ptrace_scope", O_RDONLY); ++ ++ if (fd < 0) ++ return 0; ++ ++ if (read(fd, buf, 1) < 0) { ++ close(fd); ++ return -1; ++ } ++ ++ ret = atoi(buf); ++ close(fd); ++ return ret; ++} ++ + /* clang-format off */ + FIXTURE(hierarchy) {}; + /* clang-format on */ +@@ -232,8 +257,51 @@ TEST_F(hierarchy, trace) + pid_t child, parent; + int status, err_proc_read; + int pipe_child[2], pipe_parent[2]; ++ int yama_ptrace_scope; + char buf_parent; + long ret; ++ bool can_read_child, can_trace_child, can_read_parent, can_trace_parent; ++ ++ yama_ptrace_scope = get_yama_ptrace_scope(); ++ ASSERT_LE(0, yama_ptrace_scope); ++ ++ if (yama_ptrace_scope > YAMA_SCOPE_DISABLED) ++ TH_LOG("Incomplete tests due to Yama restrictions (scope %d)", ++ yama_ptrace_scope); ++ ++ /* ++ * can_read_child is true if a parent process can read its child ++ * process, which is only the case when the parent process is not ++ * isolated from the child with a dedicated Landlock domain. ++ */ ++ can_read_child = !variant->domain_parent; ++ ++ /* ++ * can_trace_child is true if a parent process can trace its child ++ * process. This depends on two conditions: ++ * - The parent process is not isolated from the child with a dedicated ++ * Landlock domain. ++ * - Yama allows tracing children (up to YAMA_SCOPE_RELATIONAL). ++ */ ++ can_trace_child = can_read_child && ++ yama_ptrace_scope <= YAMA_SCOPE_RELATIONAL; ++ ++ /* ++ * can_read_parent is true if a child process can read its parent ++ * process, which is only the case when the child process is not ++ * isolated from the parent with a dedicated Landlock domain. ++ */ ++ can_read_parent = !variant->domain_child; ++ ++ /* ++ * can_trace_parent is true if a child process can trace its parent ++ * process. This depends on two conditions: ++ * - The child process is not isolated from the parent with a dedicated ++ * Landlock domain. ++ * - Yama is disabled (YAMA_SCOPE_DISABLED). ++ */ ++ can_trace_parent = can_read_parent && ++ yama_ptrace_scope <= YAMA_SCOPE_DISABLED; + + /* + * Removes all effective and permitted capabilities to not interfere +@@ -264,16 +332,21 @@ TEST_F(hierarchy, trace) + /* Waits for the parent to be in a domain, if any. */ + ASSERT_EQ(1, read(pipe_parent[0], &buf_child, 1)); + +- /* Tests PTRACE_ATTACH and PTRACE_MODE_READ on the parent. */ ++ /* Tests PTRACE_MODE_READ on the parent. */ + err_proc_read = test_ptrace_read(parent); ++ if (can_read_parent) { ++ EXPECT_EQ(0, err_proc_read); ++ } else { ++ EXPECT_EQ(EACCES, err_proc_read); ++ } ++ ++ /* Tests PTRACE_ATTACH on the parent. */ + ret = ptrace(PTRACE_ATTACH, parent, NULL, 0); +- if (variant->domain_child) { ++ if (can_trace_parent) { ++ EXPECT_EQ(0, ret); ++ } else { + EXPECT_EQ(-1, ret); + EXPECT_EQ(EPERM, errno); +- EXPECT_EQ(EACCES, err_proc_read); +- } else { +- EXPECT_EQ(0, ret); +- EXPECT_EQ(0, err_proc_read); + } + if (ret == 0) { + ASSERT_EQ(parent, waitpid(parent, &status, 0)); +@@ -283,11 +356,11 @@ TEST_F(hierarchy, trace) + + /* Tests child PTRACE_TRACEME. */ + ret = ptrace(PTRACE_TRACEME); +- if (variant->domain_parent) { ++ if (can_trace_child) { ++ EXPECT_EQ(0, ret); ++ } else { + EXPECT_EQ(-1, ret); + EXPECT_EQ(EPERM, errno); +- } else { +- EXPECT_EQ(0, ret); + } + + /* +@@ -296,7 +369,7 @@ TEST_F(hierarchy, trace) + */ + ASSERT_EQ(1, write(pipe_child[1], ".", 1)); + +- if (!variant->domain_parent) { ++ if (can_trace_child) { + ASSERT_EQ(0, raise(SIGSTOP)); + } + +@@ -321,7 +394,7 @@ TEST_F(hierarchy, trace) + ASSERT_EQ(1, read(pipe_child[0], &buf_parent, 1)); + + /* Tests child PTRACE_TRACEME. */ +- if (!variant->domain_parent) { ++ if (can_trace_child) { + ASSERT_EQ(child, waitpid(child, &status, 0)); + ASSERT_EQ(1, WIFSTOPPED(status)); + ASSERT_EQ(0, ptrace(PTRACE_DETACH, child, NULL, 0)); +@@ -331,17 +404,23 @@ TEST_F(hierarchy, trace) + EXPECT_EQ(ESRCH, errno); + } + +- /* Tests PTRACE_ATTACH and PTRACE_MODE_READ on the child. */ ++ /* Tests PTRACE_MODE_READ on the child. */ + err_proc_read = test_ptrace_read(child); ++ if (can_read_child) { ++ EXPECT_EQ(0, err_proc_read); ++ } else { ++ EXPECT_EQ(EACCES, err_proc_read); ++ } ++ ++ /* Tests PTRACE_ATTACH on the child. */ + ret = ptrace(PTRACE_ATTACH, child, NULL, 0); +- if (variant->domain_parent) { ++ if (can_trace_child) { ++ EXPECT_EQ(0, ret); ++ } else { + EXPECT_EQ(-1, ret); + EXPECT_EQ(EPERM, errno); +- EXPECT_EQ(EACCES, err_proc_read); +- } else { +- EXPECT_EQ(0, ret); +- EXPECT_EQ(0, err_proc_read); + } ++ + if (ret == 0) { + ASSERT_EQ(child, waitpid(child, &status, 0)); + ASSERT_EQ(1, WIFSTOPPED(status)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-810-udf-Truncate-added-extents-on-failed-expansion.patch b/patches.kernel.org/6.2.3-810-udf-Truncate-added-extents-on-failed-expansion.patch new file mode 100644 index 0000000..db41a82 --- /dev/null +++ b/patches.kernel.org/6.2.3-810-udf-Truncate-added-extents-on-failed-expansion.patch @@ -0,0 +1,71 @@ +From: Jan Kara +Date: Thu, 15 Dec 2022 14:24:03 +0100 +Subject: [PATCH] udf: Truncate added extents on failed expansion +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 70bfb3a8d661d4fdc742afc061b88a7f3fc9f500 + +commit 70bfb3a8d661d4fdc742afc061b88a7f3fc9f500 upstream. + +When a file expansion failed because we didn't have enough space for +indirect extents make sure we truncate extents created so far so that we +don't leave extents beyond EOF. + +CC: stable@vger.kernel.org +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/udf/inode.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 34e41632..8f5f9314 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -521,8 +521,10 @@ static int udf_do_extend_file(struct inode *inode, + } + + if (fake) { +- udf_add_aext(inode, last_pos, &last_ext->extLocation, +- last_ext->extLength, 1); ++ err = udf_add_aext(inode, last_pos, &last_ext->extLocation, ++ last_ext->extLength, 1); ++ if (err < 0) ++ goto out_err; + count++; + } else { + struct kernel_lb_addr tmploc; +@@ -556,7 +558,7 @@ static int udf_do_extend_file(struct inode *inode, + err = udf_add_aext(inode, last_pos, &last_ext->extLocation, + last_ext->extLength, 1); + if (err) +- return err; ++ goto out_err; + count++; + } + if (new_block_bytes) { +@@ -565,7 +567,7 @@ static int udf_do_extend_file(struct inode *inode, + err = udf_add_aext(inode, last_pos, &last_ext->extLocation, + last_ext->extLength, 1); + if (err) +- return err; ++ goto out_err; + count++; + } + +@@ -579,6 +581,11 @@ static int udf_do_extend_file(struct inode *inode, + return -EIO; + + return count; ++out_err: ++ /* Remove extents we've created so far */ ++ udf_clear_extent_cache(inode); ++ udf_truncate_extents(inode); ++ return err; + } + + /* Extend the final block of the file to final_block_len bytes */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-811-udf-Do-not-bother-merging-very-long-extents.patch b/patches.kernel.org/6.2.3-811-udf-Do-not-bother-merging-very-long-extents.patch new file mode 100644 index 0000000..12aa0a1 --- /dev/null +++ b/patches.kernel.org/6.2.3-811-udf-Do-not-bother-merging-very-long-extents.patch @@ -0,0 +1,58 @@ +From: Jan Kara +Date: Fri, 16 Dec 2022 12:37:51 +0100 +Subject: [PATCH] udf: Do not bother merging very long extents +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 53cafe1d6d8ef9f93318e5bfccc0d24f27d41ced + +commit 53cafe1d6d8ef9f93318e5bfccc0d24f27d41ced upstream. + +When merging very long extents we try to push as much length as possible +to the first extent. However this is unnecessarily complicated and not +really worth the trouble. Furthermore there was a bug in the logic +resulting in corrupting extents in the file as syzbot reproducer shows. +So just don't bother with the merging of extents that are too long +together. + +CC: stable@vger.kernel.org +Reported-by: syzbot+60f291a24acecb3c2bd5@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/udf/inode.c | 19 ++----------------- + 1 file changed, 2 insertions(+), 17 deletions(-) + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 8f5f9314..2517cdda 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1087,23 +1087,8 @@ static void udf_merge_extents(struct inode *inode, struct kernel_long_ad *laarr, + blocksize - 1) >> blocksize_bits)))) { + + if (((li->extLength & UDF_EXTENT_LENGTH_MASK) + +- (lip1->extLength & UDF_EXTENT_LENGTH_MASK) + +- blocksize - 1) & ~UDF_EXTENT_LENGTH_MASK) { +- lip1->extLength = (lip1->extLength - +- (li->extLength & +- UDF_EXTENT_LENGTH_MASK) + +- UDF_EXTENT_LENGTH_MASK) & +- ~(blocksize - 1); +- li->extLength = (li->extLength & +- UDF_EXTENT_FLAG_MASK) + +- (UDF_EXTENT_LENGTH_MASK + 1) - +- blocksize; +- lip1->extLocation.logicalBlockNum = +- li->extLocation.logicalBlockNum + +- ((li->extLength & +- UDF_EXTENT_LENGTH_MASK) >> +- blocksize_bits); +- } else { ++ (lip1->extLength & UDF_EXTENT_LENGTH_MASK) + ++ blocksize - 1) <= UDF_EXTENT_LENGTH_MASK) { + li->extLength = lip1->extLength + + (((li->extLength & + UDF_EXTENT_LENGTH_MASK) + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-812-udf-Do-not-update-file-length-for-failed-writes.patch b/patches.kernel.org/6.2.3-812-udf-Do-not-update-file-length-for-failed-writes.patch new file mode 100644 index 0000000..fea2696 --- /dev/null +++ b/patches.kernel.org/6.2.3-812-udf-Do-not-update-file-length-for-failed-writes.patch @@ -0,0 +1,69 @@ +From: Jan Kara +Date: Mon, 2 Jan 2023 20:14:47 +0100 +Subject: [PATCH] udf: Do not update file length for failed writes to inline + files +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 256fe4162f8b5a1625b8603ca5f7ff79725bfb47 + +commit 256fe4162f8b5a1625b8603ca5f7ff79725bfb47 upstream. + +When write to inline file fails (or happens only partly), we still +updated length of inline data as if the whole write succeeded. Fix the +update of length of inline data to happen only if the write succeeds. + +Reported-by: syzbot+0937935b993956ba28ab@syzkaller.appspotmail.com +CC: stable@vger.kernel.org +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/udf/file.c | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/fs/udf/file.c b/fs/udf/file.c +index 5c659e23..8be51161 100644 +--- a/fs/udf/file.c ++++ b/fs/udf/file.c +@@ -149,26 +149,24 @@ static ssize_t udf_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + goto out; + + down_write(&iinfo->i_data_sem); +- if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { +- loff_t end = iocb->ki_pos + iov_iter_count(from); +- +- if (inode->i_sb->s_blocksize < +- (udf_file_entry_alloc_offset(inode) + end)) { +- err = udf_expand_file_adinicb(inode); +- if (err) { +- inode_unlock(inode); +- udf_debug("udf_expand_adinicb: err=%d\n", err); +- return err; +- } +- } else { +- iinfo->i_lenAlloc = max(end, inode->i_size); +- up_write(&iinfo->i_data_sem); ++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB && ++ inode->i_sb->s_blocksize < (udf_file_entry_alloc_offset(inode) + ++ iocb->ki_pos + iov_iter_count(from))) { ++ err = udf_expand_file_adinicb(inode); ++ if (err) { ++ inode_unlock(inode); ++ udf_debug("udf_expand_adinicb: err=%d\n", err); ++ return err; + } + } else + up_write(&iinfo->i_data_sem); + + retval = __generic_file_write_iter(iocb, from); + out: ++ down_write(&iinfo->i_data_sem); ++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB && retval > 0) ++ iinfo->i_lenAlloc = inode->i_size; ++ up_write(&iinfo->i_data_sem); + inode_unlock(inode); + + if (retval > 0) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-813-udf-Preserve-link-count-of-system-files.patch b/patches.kernel.org/6.2.3-813-udf-Preserve-link-count-of-system-files.patch new file mode 100644 index 0000000..ecd3639 --- /dev/null +++ b/patches.kernel.org/6.2.3-813-udf-Preserve-link-count-of-system-files.patch @@ -0,0 +1,79 @@ +From: Jan Kara +Date: Tue, 3 Jan 2023 09:56:56 +0100 +Subject: [PATCH] udf: Preserve link count of system files +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: fc8033a34a3ca7d23353e645e6dde5d364ac5f12 + +commit fc8033a34a3ca7d23353e645e6dde5d364ac5f12 upstream. + +System files in UDF filesystem have link count 0. To not confuse VFS we +fudge the link count to be 1 when reading such inodes however we forget +to restore the link count of 0 when writing such inodes. Fix that. + +CC: stable@vger.kernel.org +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/udf/inode.c | 9 +++++++-- + fs/udf/super.c | 1 + + fs/udf/udf_i.h | 3 ++- + 3 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 2517cdda..2bc0f369 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1373,6 +1373,7 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode) + ret = -EIO; + goto out; + } ++ iinfo->i_hidden = hidden_inode; + iinfo->i_unique = 0; + iinfo->i_lenEAttr = 0; + iinfo->i_lenExtents = 0; +@@ -1708,8 +1709,12 @@ static int udf_update_inode(struct inode *inode, int do_sync) + + if (S_ISDIR(inode->i_mode) && inode->i_nlink > 0) + fe->fileLinkCount = cpu_to_le16(inode->i_nlink - 1); +- else +- fe->fileLinkCount = cpu_to_le16(inode->i_nlink); ++ else { ++ if (iinfo->i_hidden) ++ fe->fileLinkCount = cpu_to_le16(0); ++ else ++ fe->fileLinkCount = cpu_to_le16(inode->i_nlink); ++ } + + fe->informationLength = cpu_to_le64(inode->i_size); + +diff --git a/fs/udf/super.c b/fs/udf/super.c +index 06eda817..241b40e8 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -147,6 +147,7 @@ static struct inode *udf_alloc_inode(struct super_block *sb) + ei->i_next_alloc_goal = 0; + ei->i_strat4096 = 0; + ei->i_streamdir = 0; ++ ei->i_hidden = 0; + init_rwsem(&ei->i_data_sem); + ei->cached_extent.lstart = -1; + spin_lock_init(&ei->i_extent_cache_lock); +diff --git a/fs/udf/udf_i.h b/fs/udf/udf_i.h +index 06ff7006..312b7c9e 100644 +--- a/fs/udf/udf_i.h ++++ b/fs/udf/udf_i.h +@@ -44,7 +44,8 @@ struct udf_inode_info { + unsigned i_use : 1; /* unallocSpaceEntry */ + unsigned i_strat4096 : 1; + unsigned i_streamdir : 1; +- unsigned reserved : 25; ++ unsigned i_hidden : 1; /* hidden system inode */ ++ unsigned reserved : 24; + __u8 *i_data; + struct kernel_lb_addr i_locStreamdir; + __u64 i_lenStreams; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-814-udf-Detect-system-inodes-linked-into-directory-.patch b/patches.kernel.org/6.2.3-814-udf-Detect-system-inodes-linked-into-directory-.patch new file mode 100644 index 0000000..3f8e6b9 --- /dev/null +++ b/patches.kernel.org/6.2.3-814-udf-Detect-system-inodes-linked-into-directory-.patch @@ -0,0 +1,46 @@ +From: Jan Kara +Date: Tue, 3 Jan 2023 10:03:35 +0100 +Subject: [PATCH] udf: Detect system inodes linked into directory hierarchy +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 85a37983ec69cc9fcd188bc37c4de15ee326355a + +commit 85a37983ec69cc9fcd188bc37c4de15ee326355a upstream. + +When UDF filesystem is corrupted, hidden system inodes can be linked +into directory hierarchy which is an avenue for further serious +corruption of the filesystem and kernel confusion as noticed by syzbot +fuzzed images. Refuse to access system inodes linked into directory +hierarchy and vice versa. + +CC: stable@vger.kernel.org +Reported-by: syzbot+38695a20b8addcbc1084@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/udf/inode.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 2bc0f369..65831cd8 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1885,8 +1885,13 @@ struct inode *__udf_iget(struct super_block *sb, struct kernel_lb_addr *ino, + if (!inode) + return ERR_PTR(-ENOMEM); + +- if (!(inode->i_state & I_NEW)) ++ if (!(inode->i_state & I_NEW)) { ++ if (UDF_I(inode)->i_hidden != hidden_inode) { ++ iput(inode); ++ return ERR_PTR(-EFSCORRUPTED); ++ } + return inode; ++ } + + memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr)); + err = udf_read_inode(inode, hidden_inode); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-815-udf-Fix-file-corruption-when-appending-just-aft.patch b/patches.kernel.org/6.2.3-815-udf-Fix-file-corruption-when-appending-just-aft.patch new file mode 100644 index 0000000..0795ce1 --- /dev/null +++ b/patches.kernel.org/6.2.3-815-udf-Fix-file-corruption-when-appending-just-aft.patch @@ -0,0 +1,70 @@ +From: Jan Kara +Date: Mon, 23 Jan 2023 14:18:47 +0100 +Subject: [PATCH] udf: Fix file corruption when appending just after end of + preallocated extent +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 36ec52ea038b18a53e198116ef7d7e70c87db046 + +commit 36ec52ea038b18a53e198116ef7d7e70c87db046 upstream. + +When we append new block just after the end of preallocated extent, the +code in inode_getblk() wrongly determined we're going to use the +preallocated extent which resulted in adding block into a wrong logical +offset in the file. Sequence like this manifests it: + +xfs_io -f -c "pwrite 0x2cacf 0xd122" -c "truncate 0x2dd6f" \ + -c "pwrite 0x27fd9 0x69a9" -c "pwrite 0x32981 0x7244" + +The code that determined the use of preallocated extent is actually +stale because udf_do_extend_file() does not create preallocation anymore +so after calling that function we are sure there's no usable +preallocation. Just remove the faulty condition. + +CC: stable@vger.kernel.org +Fixes: 16d055656814 ("udf: Discard preallocation before extending file with a hole") +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/udf/inode.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 65831cd8..a1af2c2e 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -799,19 +799,17 @@ static sector_t inode_getblk(struct inode *inode, sector_t block, + c = 0; + offset = 0; + count += ret; +- /* We are not covered by a preallocated extent? */ +- if ((laarr[0].extLength & UDF_EXTENT_FLAG_MASK) != +- EXT_NOT_RECORDED_ALLOCATED) { +- /* Is there any real extent? - otherwise we overwrite +- * the fake one... */ +- if (count) +- c = !c; +- laarr[c].extLength = EXT_NOT_RECORDED_NOT_ALLOCATED | +- inode->i_sb->s_blocksize; +- memset(&laarr[c].extLocation, 0x00, +- sizeof(struct kernel_lb_addr)); +- count++; +- } ++ /* ++ * Is there any real extent? - otherwise we overwrite the fake ++ * one... ++ */ ++ if (count) ++ c = !c; ++ laarr[c].extLength = EXT_NOT_RECORDED_NOT_ALLOCATED | ++ inode->i_sb->s_blocksize; ++ memset(&laarr[c].extLocation, 0x00, ++ sizeof(struct kernel_lb_addr)); ++ count++; + endnum = c + 1; + lastblock = 1; + } else { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-816-md-don-t-update-recovery_cp-when-curr_resync-is.patch b/patches.kernel.org/6.2.3-816-md-don-t-update-recovery_cp-when-curr_resync-is.patch new file mode 100644 index 0000000..9381f73 --- /dev/null +++ b/patches.kernel.org/6.2.3-816-md-don-t-update-recovery_cp-when-curr_resync-is.patch @@ -0,0 +1,57 @@ +From: Hou Tao +Date: Tue, 31 Jan 2023 15:07:19 +0800 +Subject: [PATCH] md: don't update recovery_cp when curr_resync is ACTIVE +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1d1f25bfda432a6b61bd0205d426226bbbd73504 + +commit 1d1f25bfda432a6b61bd0205d426226bbbd73504 upstream. + +Don't update recovery_cp when curr_resync is MD_RESYNC_ACTIVE, otherwise +md may skip the resync of the first 3 sectors if the resync procedure is +interrupted before the first calling of ->sync_request() as shown below: + +md_do_sync thread control thread + // setup resync + mddev->recovery_cp = 0 + j = 0 + mddev->curr_resync = MD_RESYNC_ACTIVE + + // e.g., set array as idle + set_bit(MD_RECOVERY_INTR, &&mddev_recovery) + // resync loop + // check INTR before calling sync_request + !test_bit(MD_RECOVERY_INTR, &mddev->recovery + + // resync interrupted + // update recovery_cp from 0 to 3 + // the resync of three 3 sectors will be skipped + mddev->recovery_cp = 3 + +Fixes: eac58d08d493 ("md: Use enum for overloaded magic numbers used by mddev->curr_resync") +Cc: stable@vger.kernel.org # 6.0+ +Signed-off-by: Hou Tao +Reviewed-by: Logan Gunthorpe +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/md.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 02b0240e..272cc5d1 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -9030,7 +9030,7 @@ void md_do_sync(struct md_thread *thread) + mddev->pers->sync_request(mddev, max_sectors, &skipped); + + if (!test_bit(MD_RECOVERY_CHECK, &mddev->recovery) && +- mddev->curr_resync >= MD_RESYNC_ACTIVE) { ++ mddev->curr_resync > MD_RESYNC_ACTIVE) { + if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) { + if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) { + if (mddev->curr_resync >= mddev->recovery_cp) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-817-KVM-Destroy-target-device-if-coalesced-MMIO-unr.patch b/patches.kernel.org/6.2.3-817-KVM-Destroy-target-device-if-coalesced-MMIO-unr.patch new file mode 100644 index 0000000..51b0843 --- /dev/null +++ b/patches.kernel.org/6.2.3-817-KVM-Destroy-target-device-if-coalesced-MMIO-unr.patch @@ -0,0 +1,81 @@ +From: Sean Christopherson +Date: Mon, 19 Dec 2022 17:19:24 +0000 +Subject: [PATCH] KVM: Destroy target device if coalesced MMIO unregistration + fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b1cb1fac22abf102ffeb29dd3eeca208a3869d54 + +commit b1cb1fac22abf102ffeb29dd3eeca208a3869d54 upstream. + +Destroy and free the target coalesced MMIO device if unregistering said +device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() +does not destroy the target device. + + BUG: memory leak + unreferenced object 0xffff888112a54880 (size 64): + comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s) + hex dump (first 32 bytes): + 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... + e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... + backtrace: + [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline] + [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline] + [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 + [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 + [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline] + [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline] + [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 + [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 + [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline] + [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline] + [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 + [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 + [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe + + BUG: leak checking failed + +Fixes: 5d3c4c79384a ("KVM: Stop looking for coalesced MMIO zones if the bus is destroyed") +Cc: stable@vger.kernel.org +Reported-by: 柳菁峰 +Reported-by: Michal Luczaj +Link: https://lore.kernel.org/r/20221219171924.67989-1-seanjc@google.com +Link: https://lore.kernel.org/all/20230118220003.1239032-1-mhal@rbox.co +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + virt/kvm/coalesced_mmio.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c +index 0be80c21..5ef88f5a 100644 +--- a/virt/kvm/coalesced_mmio.c ++++ b/virt/kvm/coalesced_mmio.c +@@ -187,15 +187,17 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm, + r = kvm_io_bus_unregister_dev(kvm, + zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev); + ++ kvm_iodevice_destructor(&dev->dev); ++ + /* + * On failure, unregister destroys all devices on the + * bus _except_ the target device, i.e. coalesced_zones +- * has been modified. No need to restart the walk as +- * there aren't any zones left. ++ * has been modified. Bail after destroying the target ++ * device, there's no need to restart the walk as there ++ * aren't any zones left. + */ + if (r) + break; +- kvm_iodevice_destructor(&dev->dev); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-818-KVM-VMX-Fix-crash-due-to-uninitialized-current_.patch b/patches.kernel.org/6.2.3-818-KVM-VMX-Fix-crash-due-to-uninitialized-current_.patch new file mode 100644 index 0000000..7053e07 --- /dev/null +++ b/patches.kernel.org/6.2.3-818-KVM-VMX-Fix-crash-due-to-uninitialized-current_.patch @@ -0,0 +1,107 @@ +From: Alexandru Matei +Date: Tue, 24 Jan 2023 00:12:08 +0200 +Subject: [PATCH] KVM: VMX: Fix crash due to uninitialized current_vmcs +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 93827a0a36396f2fd6368a54a020f420c8916e9b + +commit 93827a0a36396f2fd6368a54a020f420c8916e9b upstream. + +KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as +a nested hypervisor on top of Hyper-V. When MSR bitmap is updated, +evmcs_touch_msr_bitmap function uses current_vmcs per-cpu variable to mark +that the msr bitmap was changed. + +vmx_vcpu_create() modifies the msr bitmap via vmx_disable_intercept_for_msr +-> vmx_msr_bitmap_l01_changed which in the end calls this function. The +function checks for current_vmcs if it is null but the check is +insufficient because current_vmcs is not initialized. Because of this, the +code might incorrectly write to the structure pointed by current_vmcs value +left by another task. Preemption is not disabled, the current task can be +preempted and moved to another CPU while current_vmcs is accessed multiple +times from evmcs_touch_msr_bitmap() which leads to crash. + +The manipulation of MSR bitmaps by callers happens only for vmcs01 so the +solution is to use vmx->vmcs01.vmcs instead of current_vmcs. + + BUG: kernel NULL pointer dereference, address: 0000000000000338 + PGD 4e1775067 P4D 0 + Oops: 0002 [#1] PREEMPT SMP NOPTI + ... + RIP: 0010:vmx_msr_bitmap_l01_changed+0x39/0x50 [kvm_intel] + ... + Call Trace: + vmx_disable_intercept_for_msr+0x36/0x260 [kvm_intel] + vmx_vcpu_create+0xe6/0x540 [kvm_intel] + kvm_arch_vcpu_create+0x1d1/0x2e0 [kvm] + kvm_vm_ioctl_create_vcpu+0x178/0x430 [kvm] + kvm_vm_ioctl+0x53f/0x790 [kvm] + __x64_sys_ioctl+0x8a/0xc0 + do_syscall_64+0x5c/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: ceef7d10dfb6 ("KVM: x86: VMX: hyper-v: Enlightened MSR-Bitmap support") +Cc: stable@vger.kernel.org +Suggested-by: Sean Christopherson +Signed-off-by: Alexandru Matei +Link: https://lore.kernel.org/r/20230123221208.4964-1-alexandru.matei@uipath.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/vmx/hyperv.h | 11 ----------- + arch/x86/kvm/vmx/vmx.c | 9 +++++++-- + 2 files changed, 7 insertions(+), 13 deletions(-) + +diff --git a/arch/x86/kvm/vmx/hyperv.h b/arch/x86/kvm/vmx/hyperv.h +index 571e7929..9dee7144 100644 +--- a/arch/x86/kvm/vmx/hyperv.h ++++ b/arch/x86/kvm/vmx/hyperv.h +@@ -190,16 +190,6 @@ static inline u16 evmcs_read16(unsigned long field) + return *(u16 *)((char *)current_evmcs + offset); + } + +-static inline void evmcs_touch_msr_bitmap(void) +-{ +- if (unlikely(!current_evmcs)) +- return; +- +- if (current_evmcs->hv_enlightenments_control.msr_bitmap) +- current_evmcs->hv_clean_fields &= +- ~HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP; +-} +- + static inline void evmcs_load(u64 phys_addr) + { + struct hv_vp_assist_page *vp_ap = +@@ -219,7 +209,6 @@ static inline u64 evmcs_read64(unsigned long field) { return 0; } + static inline u32 evmcs_read32(unsigned long field) { return 0; } + static inline u16 evmcs_read16(unsigned long field) { return 0; } + static inline void evmcs_load(u64 phys_addr) {} +-static inline void evmcs_touch_msr_bitmap(void) {} + #endif /* IS_ENABLED(CONFIG_HYPERV) */ + + #define EVMPTR_INVALID (-1ULL) +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index 7eec0226..939e395c 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -3865,8 +3865,13 @@ static void vmx_msr_bitmap_l01_changed(struct vcpu_vmx *vmx) + * 'Enlightened MSR Bitmap' feature L0 needs to know that MSR + * bitmap has changed. + */ +- if (static_branch_unlikely(&enable_evmcs)) +- evmcs_touch_msr_bitmap(); ++ if (IS_ENABLED(CONFIG_HYPERV) && static_branch_unlikely(&enable_evmcs)) { ++ struct hv_enlightened_vmcs *evmcs = (void *)vmx->vmcs01.vmcs; ++ ++ if (evmcs->hv_enlightenments_control.msr_bitmap) ++ evmcs->hv_clean_fields &= ++ ~HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP; ++ } + + vmx->nested.force_msr_bitmap_recalc = true; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-819-KVM-Register-dev-kvm-as-the-_very_-last-thing-d.patch b/patches.kernel.org/6.2.3-819-KVM-Register-dev-kvm-as-the-_very_-last-thing-d.patch new file mode 100644 index 0000000..dc33f14 --- /dev/null +++ b/patches.kernel.org/6.2.3-819-KVM-Register-dev-kvm-as-the-_very_-last-thing-d.patch @@ -0,0 +1,90 @@ +From: Sean Christopherson +Date: Wed, 30 Nov 2022 23:08:45 +0000 +Subject: [PATCH] KVM: Register /dev/kvm as the _very_ last thing during + initialization +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2b01281273738bf2d6551da48d65db2df3f28998 + +commit 2b01281273738bf2d6551da48d65db2df3f28998 upstream. + +Register /dev/kvm, i.e. expose KVM to userspace, only after all other +setup has completed. Once /dev/kvm is exposed, userspace can start +invoking KVM ioctls, creating VMs, etc... If userspace creates a VM +before KVM is done with its configuration, bad things may happen, e.g. +KVM will fail to properly migrate vCPU state if a VM is created before +KVM has registered preemption notifiers. + +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Message-Id: <20221130230934.1014142-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + virt/kvm/kvm_main.c | 31 ++++++++++++++++++++++--------- + 1 file changed, 22 insertions(+), 9 deletions(-) + +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 9c60384b..07aae602 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -5995,12 +5995,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, + + kvm_chardev_ops.owner = module; + +- r = misc_register(&kvm_dev); +- if (r) { +- pr_err("kvm: misc device register failed\n"); +- goto out_unreg; +- } +- + register_syscore_ops(&kvm_syscore_ops); + + kvm_preempt_ops.sched_in = kvm_sched_in; +@@ -6009,11 +6003,24 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, + kvm_init_debug(); + + r = kvm_vfio_ops_init(); +- WARN_ON(r); ++ if (WARN_ON_ONCE(r)) ++ goto err_vfio; ++ ++ /* ++ * Registration _must_ be the very last thing done, as this exposes ++ * /dev/kvm to userspace, i.e. all infrastructure must be setup! ++ */ ++ r = misc_register(&kvm_dev); ++ if (r) { ++ pr_err("kvm: misc device register failed\n"); ++ goto err_register; ++ } + + return 0; + +-out_unreg: ++err_register: ++ kvm_vfio_ops_exit(); ++err_vfio: + kvm_async_pf_deinit(); + out_free_4: + for_each_possible_cpu(cpu) +@@ -6039,8 +6046,14 @@ void kvm_exit(void) + { + int cpu; + +- debugfs_remove_recursive(kvm_debugfs_dir); ++ /* ++ * Note, unregistering /dev/kvm doesn't strictly need to come first, ++ * fops_get(), a.k.a. try_module_get(), prevents acquiring references ++ * to KVM while the module is being stopped. ++ */ + misc_deregister(&kvm_dev); ++ ++ debugfs_remove_recursive(kvm_debugfs_dir); + for_each_possible_cpu(cpu) + free_cpumask_var(per_cpu(cpu_kick_mask, cpu)); + kmem_cache_destroy(kvm_vcpu_cache); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-820-KVM-x86-Purge-highest-ISR-cache-when-updating-A.patch b/patches.kernel.org/6.2.3-820-KVM-x86-Purge-highest-ISR-cache-when-updating-A.patch new file mode 100644 index 0000000..95739ea --- /dev/null +++ b/patches.kernel.org/6.2.3-820-KVM-x86-Purge-highest-ISR-cache-when-updating-A.patch @@ -0,0 +1,64 @@ +From: Sean Christopherson +Date: Fri, 6 Jan 2023 01:12:35 +0000 +Subject: [PATCH] KVM: x86: Purge "highest ISR" cache when updating APICv state +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 97a71c444a147ae41c7d0ab5b3d855d7f762f3ed + +commit 97a71c444a147ae41c7d0ab5b3d855d7f762f3ed upstream. + +Purge the "highest ISR" cache when updating APICv state on a vCPU. The +cache must not be used when APICv is active as hardware may emulate EOIs +(and other operations) without exiting to KVM. + +This fixes a bug where KVM will effectively block IRQs in perpetuity due +to the "highest ISR" never getting reset if APICv is activated on a vCPU +while an IRQ is in-service. Hardware emulates the EOI and KVM never gets +a chance to update its cache. + +Fixes: b26a695a1d78 ("kvm: lapic: Introduce APICv update helper function") +Cc: stable@vger.kernel.org +Cc: Suravee Suthikulpanit +Cc: Maxim Levitsky +Reviewed-by: Paolo Bonzini +Reviewed-by: Maxim Levitsky +Signed-off-by: Sean Christopherson +Message-Id: <20230106011306.85230-3-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/lapic.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 4efdb4a4..9c1324e3 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2429,6 +2429,7 @@ void kvm_apic_update_apicv(struct kvm_vcpu *vcpu) + */ + apic->isr_count = count_vectors(apic->regs + APIC_ISR); + } ++ apic->highest_isr_cache = -1; + } + + void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event) +@@ -2484,7 +2485,6 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event) + kvm_lapic_set_reg(apic, APIC_TMR + 0x10 * i, 0); + } + kvm_apic_update_apicv(vcpu); +- apic->highest_isr_cache = -1; + update_divide_count(apic); + atomic_set(&apic->lapic_timer.pending, 0); + +@@ -2772,7 +2772,6 @@ int kvm_apic_set_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s) + __start_apic_timer(apic, APIC_TMCCT); + kvm_lapic_set_reg(apic, APIC_TMCCT, 0); + kvm_apic_update_apicv(vcpu); +- apic->highest_isr_cache = -1; + if (apic->apicv_active) { + static_call_cond(kvm_x86_apicv_post_state_restore)(vcpu); + static_call_cond(kvm_x86_hwapic_irr_update)(vcpu, apic_find_highest_irr(apic)); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-821-KVM-x86-Blindly-get-current-x2APIC-reg-value-on.patch b/patches.kernel.org/6.2.3-821-KVM-x86-Blindly-get-current-x2APIC-reg-value-on.patch new file mode 100644 index 0000000..3a7bcff --- /dev/null +++ b/patches.kernel.org/6.2.3-821-KVM-x86-Blindly-get-current-x2APIC-reg-value-on.patch @@ -0,0 +1,69 @@ +From: Sean Christopherson +Date: Fri, 6 Jan 2023 01:12:34 +0000 +Subject: [PATCH] KVM: x86: Blindly get current x2APIC reg value on "nodecode + write" traps +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0a19807b464fb10aa79b9dd7f494bc317438fada + +commit 0a19807b464fb10aa79b9dd7f494bc317438fada upstream. + +When emulating a x2APIC write in response to an APICv/AVIC trap, get the +the written value from the vAPIC page without checking that reads are +allowed for the target register. AVIC can generate trap-like VM-Exits on +writes to EOI, and so KVM needs to get the written value from the backing +page without running afoul of EOI's write-only behavior. + +Alternatively, EOI could be special cased to always write '0', e.g. so +that the sanity check could be preserved, but x2APIC on AMD is actually +supposed to disallow non-zero writes (not emulated by KVM), and the +sanity check was a byproduct of how the KVM code was written, i.e. wasn't +added to guard against anything in particular. + +Fixes: 70c8327c11c6 ("KVM: x86: Bug the VM if an accelerated x2APIC trap occurs on a "bad" reg") +Fixes: 1bd9dfec9fd4 ("KVM: x86: Do not block APIC write for non ICR registers") +Reported-by: Alejandro Jimenez +Cc: stable@vger.kernel.org +Reviewed-by: Maxim Levitsky +Signed-off-by: Sean Christopherson +Message-Id: <20230106011306.85230-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/lapic.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 9c1324e3..33a661d8 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2284,23 +2284,18 @@ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset) + struct kvm_lapic *apic = vcpu->arch.apic; + u64 val; + +- if (apic_x2apic_mode(apic)) { +- if (KVM_BUG_ON(kvm_lapic_msr_read(apic, offset, &val), vcpu->kvm)) +- return; +- } else { +- val = kvm_lapic_get_reg(apic, offset); +- } +- + /* + * ICR is a single 64-bit register when x2APIC is enabled. For legacy + * xAPIC, ICR writes need to go down the common (slightly slower) path + * to get the upper half from ICR2. + */ + if (apic_x2apic_mode(apic) && offset == APIC_ICR) { ++ val = kvm_lapic_get_reg64(apic, APIC_ICR); + kvm_apic_send_ipi(apic, (u32)val, (u32)(val >> 32)); + trace_kvm_apic_write(APIC_ICR, val); + } else { + /* TODO: optimize to just emulate side effect w/o one more write */ ++ val = kvm_lapic_get_reg(apic, offset); + kvm_lapic_reg_write(apic, offset, (u32)val); + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-822-KVM-x86-Don-t-inhibit-APICv-AVIC-on-xAPIC-ID-ch.patch b/patches.kernel.org/6.2.3-822-KVM-x86-Don-t-inhibit-APICv-AVIC-on-xAPIC-ID-ch.patch new file mode 100644 index 0000000..056e466 --- /dev/null +++ b/patches.kernel.org/6.2.3-822-KVM-x86-Don-t-inhibit-APICv-AVIC-on-xAPIC-ID-ch.patch @@ -0,0 +1,44 @@ +From: Sean Christopherson +Date: Fri, 6 Jan 2023 01:12:38 +0000 +Subject: [PATCH] KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if + APIC is disabled +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a58a66afc464d6d2ec294cd3102f36f3652e7ce4 + +commit a58a66afc464d6d2ec294cd3102f36f3652e7ce4 upstream. + +Don't inhibit APICv/AVIC due to an xAPIC ID mismatch if the APIC is +hardware disabled. The ID cannot be consumed while the APIC is disabled, +and the ID is guaranteed to be set back to the vcpu_id when the APIC is +hardware enabled (architectural behavior correctly emulated by KVM). + +Fixes: 3743c2f02517 ("KVM: x86: inhibit APICv/AVIC on changes to APIC ID or APIC base") +Cc: stable@vger.kernel.org +Reviewed-by: Maxim Levitsky +Signed-off-by: Sean Christopherson +Message-Id: <20230106011306.85230-6-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/lapic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 33a661d8..191b5a96 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2072,6 +2072,9 @@ static void kvm_lapic_xapic_id_updated(struct kvm_lapic *apic) + { + struct kvm *kvm = apic->vcpu->kvm; + ++ if (!kvm_apic_hw_enabled(apic)) ++ return; ++ + if (KVM_BUG_ON(apic_x2apic_mode(apic), kvm)) + return; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-823-KVM-x86-Don-t-inhibit-APICv-AVIC-if-xAPIC-ID-mi.patch b/patches.kernel.org/6.2.3-823-KVM-x86-Don-t-inhibit-APICv-AVIC-if-xAPIC-ID-mi.patch new file mode 100644 index 0000000..bfdbc0a --- /dev/null +++ b/patches.kernel.org/6.2.3-823-KVM-x86-Don-t-inhibit-APICv-AVIC-if-xAPIC-ID-mi.patch @@ -0,0 +1,67 @@ +From: Sean Christopherson +Date: Fri, 6 Jan 2023 01:12:39 +0000 +Subject: [PATCH] KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is + due to 32-bit ID +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f651a008954803d7bb2d85b7042d0fd46133d782 + +commit f651a008954803d7bb2d85b7042d0fd46133d782 upstream. + +Truncate the vcpu_id, a.k.a. x2APIC ID, to an 8-bit value when comparing +it against the xAPIC ID to avoid false positives (sort of) on systems +with >255 CPUs, i.e. with IDs that don't fit into a u8. The intent of +APIC_ID_MODIFIED is to inhibit APICv/AVIC when the xAPIC is changed from +it's original value, + +The mismatch isn't technically a false positive, as architecturally the +xAPIC IDs do end up being aliased in this scenario, and neither APICv +nor AVIC correctly handles IPI virtualization when there is aliasing. +However, KVM already deliberately does not honor the aliasing behavior +that results when an x2APIC ID gets truncated to an xAPIC ID. I.e. the +resulting APICv/AVIC behavior is aligned with KVM's existing behavior +when KVM's x2APIC hotplug hack is effectively enabled. + +If/when KVM provides a way to disable the hotplug hack, APICv/AVIC can +piggyback whatever logic disables the optimized APIC map (which is what +provides the hotplug hack), i.e. so that KVM's optimized map and APIC +virtualization yield the same behavior. + +For now, fix the immediate problem of APIC virtualization being disabled +for large VMs, which is a much more pressing issue than ensuring KVM +honors architectural behavior for APIC ID aliasing. + +Fixes: 3743c2f02517 ("KVM: x86: inhibit APICv/AVIC on changes to APIC ID or APIC base") +Reported-by: Suravee Suthikulpanit +Cc: stable@vger.kernel.org +Reviewed-by: Maxim Levitsky +Signed-off-by: Sean Christopherson +Message-Id: <20230106011306.85230-7-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/lapic.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 191b5a96..2183a9b8 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2078,7 +2078,12 @@ static void kvm_lapic_xapic_id_updated(struct kvm_lapic *apic) + if (KVM_BUG_ON(apic_x2apic_mode(apic), kvm)) + return; + +- if (kvm_xapic_id(apic) == apic->vcpu->vcpu_id) ++ /* ++ * Deliberately truncate the vCPU ID when detecting a modified APIC ID ++ * to avoid false positives if the vCPU ID, i.e. x2APIC ID, is a 32-bit ++ * value. ++ */ ++ if (kvm_xapic_id(apic) == (u8)apic->vcpu->vcpu_id) + return; + + kvm_set_apicv_inhibit(apic->vcpu->kvm, APICV_INHIBIT_REASON_APIC_ID_MODIFIED); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-824-KVM-SVM-Flush-the-current-TLB-when-activating-A.patch b/patches.kernel.org/6.2.3-824-KVM-SVM-Flush-the-current-TLB-when-activating-A.patch new file mode 100644 index 0000000..6f66ac3 --- /dev/null +++ b/patches.kernel.org/6.2.3-824-KVM-SVM-Flush-the-current-TLB-when-activating-A.patch @@ -0,0 +1,50 @@ +From: Sean Christopherson +Date: Fri, 6 Jan 2023 01:12:36 +0000 +Subject: [PATCH] KVM: SVM: Flush the "current" TLB when activating AVIC +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0ccf3e7cb95a2db8ddb2a44812037ffba8166dc9 + +commit 0ccf3e7cb95a2db8ddb2a44812037ffba8166dc9 upstream. + +Flush the TLB when activating AVIC as the CPU can insert into the TLB +while AVIC is "locally" disabled. KVM doesn't treat "APIC hardware +disabled" as VM-wide AVIC inhibition, and so when a vCPU has its APIC +hardware disabled, AVIC is not guaranteed to be inhibited. As a result, +KVM may create a valid NPT mapping for the APIC base, which the CPU can +cache as a non-AVIC translation. + +Note, Intel handles this in vmx_set_virtual_apic_mode(). + +Reviewed-by: Paolo Bonzini +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Reviewed-by: Maxim Levitsky +Message-Id: <20230106011306.85230-4-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/svm/avic.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c +index 6919dee6..712330b8 100644 +--- a/arch/x86/kvm/svm/avic.c ++++ b/arch/x86/kvm/svm/avic.c +@@ -86,6 +86,12 @@ static void avic_activate_vmcb(struct vcpu_svm *svm) + /* Disabling MSR intercept for x2APIC registers */ + svm_set_x2apic_msr_interception(svm, false); + } else { ++ /* ++ * Flush the TLB, the guest may have inserted a non-APIC ++ * mapping into the TLB while AVIC was disabled. ++ */ ++ kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, &svm->vcpu); ++ + /* For xAVIC and hybrid-xAVIC modes */ + vmcb->control.avic_physical_id |= AVIC_MAX_PHYSICAL_ID; + /* Enabling MSR intercept for x2APIC registers */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-825-KVM-SVM-Process-ICR-on-AVIC-IPI-delivery-failur.patch b/patches.kernel.org/6.2.3-825-KVM-SVM-Process-ICR-on-AVIC-IPI-delivery-failur.patch new file mode 100644 index 0000000..18bb211 --- /dev/null +++ b/patches.kernel.org/6.2.3-825-KVM-SVM-Process-ICR-on-AVIC-IPI-delivery-failur.patch @@ -0,0 +1,71 @@ +From: Sean Christopherson +Date: Fri, 6 Jan 2023 01:12:37 +0000 +Subject: [PATCH] KVM: SVM: Process ICR on AVIC IPI delivery failure due to + invalid target +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5aede752a839904059c2b5d68be0dc4501c6c15f + +commit 5aede752a839904059c2b5d68be0dc4501c6c15f upstream. + +Emulate ICR writes on AVIC IPI failures due to invalid targets using the +same logic as failures due to invalid types. AVIC acceleration fails if +_any_ of the targets are invalid, and crucially VM-Exits before sending +IPIs to targets that _are_ valid. In logical mode, the destination is a +bitmap, i.e. a single IPI can target multiple logical IDs. Doing nothing +causes KVM to drop IPIs if at least one target is valid and at least one +target is invalid. + +Fixes: 18f40c53e10f ("svm: Add VMEXIT handlers for AVIC") +Cc: stable@vger.kernel.org +Reviewed-by: Paolo Bonzini +Reviewed-by: Maxim Levitsky +Signed-off-by: Sean Christopherson +Message-Id: <20230106011306.85230-5-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/svm/avic.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c +index 712330b8..3b2c88b1 100644 +--- a/arch/x86/kvm/svm/avic.c ++++ b/arch/x86/kvm/svm/avic.c +@@ -502,14 +502,18 @@ int avic_incomplete_ipi_interception(struct kvm_vcpu *vcpu) + trace_kvm_avic_incomplete_ipi(vcpu->vcpu_id, icrh, icrl, id, index); + + switch (id) { ++ case AVIC_IPI_FAILURE_INVALID_TARGET: + case AVIC_IPI_FAILURE_INVALID_INT_TYPE: + /* + * Emulate IPIs that are not handled by AVIC hardware, which +- * only virtualizes Fixed, Edge-Triggered INTRs. The exit is +- * a trap, e.g. ICR holds the correct value and RIP has been +- * advanced, KVM is responsible only for emulating the IPI. +- * Sadly, hardware may sometimes leave the BUSY flag set, in +- * which case KVM needs to emulate the ICR write as well in ++ * only virtualizes Fixed, Edge-Triggered INTRs, and falls over ++ * if _any_ targets are invalid, e.g. if the logical mode mask ++ * is a superset of running vCPUs. ++ * ++ * The exit is a trap, e.g. ICR holds the correct value and RIP ++ * has been advanced, KVM is responsible only for emulating the ++ * IPI. Sadly, hardware may sometimes leave the BUSY flag set, ++ * in which case KVM needs to emulate the ICR write as well in + * order to clear the BUSY flag. + */ + if (icrl & APIC_ICR_BUSY) +@@ -525,8 +529,6 @@ int avic_incomplete_ipi_interception(struct kvm_vcpu *vcpu) + */ + avic_kick_target_vcpus(vcpu->kvm, apic, icrl, icrh, index); + break; +- case AVIC_IPI_FAILURE_INVALID_TARGET: +- break; + case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE: + WARN_ONCE(1, "Invalid backing page\n"); + break; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-826-KVM-SVM-Don-t-put-load-AVIC-when-setting-virtua.patch b/patches.kernel.org/6.2.3-826-KVM-SVM-Don-t-put-load-AVIC-when-setting-virtua.patch new file mode 100644 index 0000000..ecc4cef --- /dev/null +++ b/patches.kernel.org/6.2.3-826-KVM-SVM-Don-t-put-load-AVIC-when-setting-virtua.patch @@ -0,0 +1,166 @@ +From: Sean Christopherson +Date: Fri, 6 Jan 2023 01:12:40 +0000 +Subject: [PATCH] KVM: SVM: Don't put/load AVIC when setting virtual APIC mode +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e0bead97e7590da888148feb9e9133bc278c534b + +commit e0bead97e7590da888148feb9e9133bc278c534b upstream. + +Move the VMCB updates from avic_refresh_apicv_exec_ctrl() into +avic_set_virtual_apic_mode() and invert the dependency being said +functions to avoid calling avic_vcpu_{load,put}() and +avic_set_pi_irte_mode() when "only" setting the virtual APIC mode. + +avic_set_virtual_apic_mode() is invoked from common x86 with preemption +enabled, which makes avic_vcpu_{load,put}() unhappy. Luckily, calling +those and updating IRTE stuff is unnecessary as the only reason +avic_set_virtual_apic_mode() is called is to handle transitions between +xAPIC and x2APIC that don't also toggle APICv activation. And if +activation doesn't change, there's no need to fiddle with the physical +APIC ID table or update IRTE. + +The "full" refresh is guaranteed to be called if activation changes in +this case as the only call to the "set" path is: + + kvm_vcpu_update_apicv(vcpu); + static_call_cond(kvm_x86_set_virtual_apic_mode)(vcpu); + +and kvm_vcpu_update_apicv() invokes the refresh if activation changes: + + if (apic->apicv_active == activate) + goto out; + + apic->apicv_active = activate; + kvm_apic_update_apicv(vcpu); + static_call(kvm_x86_refresh_apicv_exec_ctrl)(vcpu); + +Rename the helper to reflect that it is also called during "refresh". + + WARNING: CPU: 183 PID: 49186 at arch/x86/kvm/svm/avic.c:1081 avic_vcpu_put+0xde/0xf0 [kvm_amd] + CPU: 183 PID: 49186 Comm: stable Tainted: G O 6.0.0-smp--fcddbca45f0a-sink #34 + Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022 + RIP: 0010:avic_vcpu_put+0xde/0xf0 [kvm_amd] + avic_refresh_apicv_exec_ctrl+0x142/0x1c0 [kvm_amd] + avic_set_virtual_apic_mode+0x5a/0x70 [kvm_amd] + kvm_lapic_set_base+0x149/0x1a0 [kvm] + kvm_set_apic_base+0x8f/0xd0 [kvm] + kvm_set_msr_common+0xa3a/0xdc0 [kvm] + svm_set_msr+0x364/0x6b0 [kvm_amd] + __kvm_set_msr+0xb8/0x1c0 [kvm] + kvm_emulate_wrmsr+0x58/0x1d0 [kvm] + msr_interception+0x1c/0x30 [kvm_amd] + svm_invoke_exit_handler+0x31/0x100 [kvm_amd] + svm_handle_exit+0xfc/0x160 [kvm_amd] + vcpu_enter_guest+0x21bb/0x23e0 [kvm] + vcpu_run+0x92/0x450 [kvm] + kvm_arch_vcpu_ioctl_run+0x43e/0x6e0 [kvm] + kvm_vcpu_ioctl+0x559/0x620 [kvm] + +Fixes: 05c4fe8c1bd9 ("KVM: SVM: Refresh AVIC configuration when changing APIC mode") +Cc: stable@vger.kernel.org +Cc: Suravee Suthikulpanit +Reviewed-by: Maxim Levitsky +Signed-off-by: Sean Christopherson +Message-Id: <20230106011306.85230-8-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/svm/avic.c | 31 +++++++++++++++---------------- + arch/x86/kvm/svm/svm.c | 2 +- + arch/x86/kvm/svm/svm.h | 2 +- + 3 files changed, 17 insertions(+), 18 deletions(-) + +diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c +index 3b2c88b1..97ad0661 100644 +--- a/arch/x86/kvm/svm/avic.c ++++ b/arch/x86/kvm/svm/avic.c +@@ -747,18 +747,6 @@ void avic_apicv_post_state_restore(struct kvm_vcpu *vcpu) + avic_handle_ldr_update(vcpu); + } + +-void avic_set_virtual_apic_mode(struct kvm_vcpu *vcpu) +-{ +- if (!lapic_in_kernel(vcpu) || avic_mode == AVIC_MODE_NONE) +- return; +- +- if (kvm_get_apic_mode(vcpu) == LAPIC_MODE_INVALID) { +- WARN_ONCE(true, "Invalid local APIC state (vcpu_id=%d)", vcpu->vcpu_id); +- return; +- } +- avic_refresh_apicv_exec_ctrl(vcpu); +-} +- + static int avic_set_pi_irte_mode(struct kvm_vcpu *vcpu, bool activate) + { + int ret = 0; +@@ -1100,17 +1088,18 @@ void avic_vcpu_put(struct kvm_vcpu *vcpu) + WRITE_ONCE(*(svm->avic_physical_id_cache), entry); + } + +- +-void avic_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu) ++void avic_refresh_virtual_apic_mode(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); + struct vmcb *vmcb = svm->vmcb01.ptr; +- bool activated = kvm_vcpu_apicv_active(vcpu); ++ ++ if (!lapic_in_kernel(vcpu) || avic_mode == AVIC_MODE_NONE) ++ return; + + if (!enable_apicv) + return; + +- if (activated) { ++ if (kvm_vcpu_apicv_active(vcpu)) { + /** + * During AVIC temporary deactivation, guest could update + * APIC ID, DFR and LDR registers, which would not be trapped +@@ -1124,6 +1113,16 @@ void avic_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu) + avic_deactivate_vmcb(svm); + } + vmcb_mark_dirty(vmcb, VMCB_AVIC); ++} ++ ++void avic_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu) ++{ ++ bool activated = kvm_vcpu_apicv_active(vcpu); ++ ++ if (!enable_apicv) ++ return; ++ ++ avic_refresh_virtual_apic_mode(vcpu); + + if (activated) + avic_vcpu_load(vcpu, vcpu->cpu); +diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c +index 9a194aa1..22d054ba 100644 +--- a/arch/x86/kvm/svm/svm.c ++++ b/arch/x86/kvm/svm/svm.c +@@ -4771,7 +4771,7 @@ static struct kvm_x86_ops svm_x86_ops __initdata = { + .enable_nmi_window = svm_enable_nmi_window, + .enable_irq_window = svm_enable_irq_window, + .update_cr8_intercept = svm_update_cr8_intercept, +- .set_virtual_apic_mode = avic_set_virtual_apic_mode, ++ .set_virtual_apic_mode = avic_refresh_virtual_apic_mode, + .refresh_apicv_exec_ctrl = avic_refresh_apicv_exec_ctrl, + .check_apicv_inhibit_reasons = avic_check_apicv_inhibit_reasons, + .apicv_post_state_restore = avic_apicv_post_state_restore, +diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h +index 4826e6cc..d0ed3f59 100644 +--- a/arch/x86/kvm/svm/svm.h ++++ b/arch/x86/kvm/svm/svm.h +@@ -648,7 +648,7 @@ void avic_vcpu_blocking(struct kvm_vcpu *vcpu); + void avic_vcpu_unblocking(struct kvm_vcpu *vcpu); + void avic_ring_doorbell(struct kvm_vcpu *vcpu); + unsigned long avic_vcpu_get_apicv_inhibit_reasons(struct kvm_vcpu *vcpu); +-void avic_set_virtual_apic_mode(struct kvm_vcpu *vcpu); ++void avic_refresh_virtual_apic_mode(struct kvm_vcpu *vcpu); + + + /* sev.c */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-827-KVM-x86-Inject-GP-if-WRMSR-sets-reserved-bits-i.patch b/patches.kernel.org/6.2.3-827-KVM-x86-Inject-GP-if-WRMSR-sets-reserved-bits-i.patch new file mode 100644 index 0000000..6b3414a --- /dev/null +++ b/patches.kernel.org/6.2.3-827-KVM-x86-Inject-GP-if-WRMSR-sets-reserved-bits-i.patch @@ -0,0 +1,51 @@ +From: Sean Christopherson +Date: Sat, 7 Jan 2023 01:10:20 +0000 +Subject: [PATCH] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC + Self-IPI +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ba5838abb05334e4abfdff1490585c7f365e0424 + +commit ba5838abb05334e4abfdff1490585c7f365e0424 upstream. + +Inject a #GP if the guest attempts to set reserved bits in the x2APIC-only +Self-IPI register. Bits 7:0 hold the vector, all other bits are reserved. + +Reported-by: Marc Orr +Cc: Ben Gardon +Cc: Venkatesh Srinivas +Cc: stable@vger.kernel.org +Reviewed-by: Maxim Levitsky +Link: https://lore.kernel.org/r/20230107011025.565472-2-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/lapic.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 2183a9b8..b2edbdeb 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2227,10 +2227,14 @@ static int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) + break; + + case APIC_SELF_IPI: +- if (apic_x2apic_mode(apic)) +- kvm_apic_send_ipi(apic, APIC_DEST_SELF | (val & APIC_VECTOR_MASK), 0); +- else ++ /* ++ * Self-IPI exists only when x2APIC is enabled. Bits 7:0 hold ++ * the vector, everything else is reserved. ++ */ ++ if (!apic_x2apic_mode(apic) || (val & ~APIC_VECTOR_MASK)) + ret = 1; ++ else ++ kvm_apic_send_ipi(apic, APIC_DEST_SELF | val, 0); + break; + default: + ret = 1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-828-KVM-x86-Inject-GP-on-x2APIC-WRMSR-that-sets-res.patch b/patches.kernel.org/6.2.3-828-KVM-x86-Inject-GP-on-x2APIC-WRMSR-that-sets-res.patch new file mode 100644 index 0000000..9b49cc3 --- /dev/null +++ b/patches.kernel.org/6.2.3-828-KVM-x86-Inject-GP-on-x2APIC-WRMSR-that-sets-res.patch @@ -0,0 +1,55 @@ +From: Sean Christopherson +Date: Sat, 7 Jan 2023 01:10:21 +0000 +Subject: [PATCH] KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits + 63:32 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ab52be1b310bcb39e6745d34a8f0e8475d67381a + +commit ab52be1b310bcb39e6745d34a8f0e8475d67381a upstream. + +Reject attempts to set bits 63:32 for 32-bit x2APIC registers, i.e. all +x2APIC registers except ICR. Per Intel's SDM: + + Non-zero writes (by WRMSR instruction) to reserved bits to these + registers will raise a general protection fault exception + +Opportunistically fix a typo in a nearby comment. + +Reported-by: Marc Orr +Cc: stable@vger.kernel.org +Reviewed-by: Maxim Levitsky +Link: https://lore.kernel.org/r/20230107011025.565472-3-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/lapic.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index b2edbdeb..7f0c02b5 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2949,13 +2949,17 @@ static int kvm_lapic_msr_read(struct kvm_lapic *apic, u32 reg, u64 *data) + static int kvm_lapic_msr_write(struct kvm_lapic *apic, u32 reg, u64 data) + { + /* +- * ICR is a 64-bit register in x2APIC mode (and Hyper'v PV vAPIC) and ++ * ICR is a 64-bit register in x2APIC mode (and Hyper-V PV vAPIC) and + * can be written as such, all other registers remain accessible only + * through 32-bit reads/writes. + */ + if (reg == APIC_ICR) + return kvm_x2apic_icr_write(apic, data); + ++ /* Bits 63:32 are reserved in all other registers. */ ++ if (data >> 32) ++ return 1; ++ + return kvm_lapic_reg_write(apic, reg, (u32)data); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-829-KVM-SVM-Fix-potential-overflow-in-SEV-s-send-re.patch b/patches.kernel.org/6.2.3-829-KVM-SVM-Fix-potential-overflow-in-SEV-s-send-re.patch new file mode 100644 index 0000000..4aab489 --- /dev/null +++ b/patches.kernel.org/6.2.3-829-KVM-SVM-Fix-potential-overflow-in-SEV-s-send-re.patch @@ -0,0 +1,72 @@ +From: Peter Gonda +Date: Tue, 7 Feb 2023 09:13:54 -0800 +Subject: [PATCH] KVM: SVM: Fix potential overflow in SEV's + send|receive_update_data() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f94f053aa3a5d6ff17951870483d9eb9e13de2e2 + +commit f94f053aa3a5d6ff17951870483d9eb9e13de2e2 upstream. + +KVM_SEV_SEND_UPDATE_DATA and KVM_SEV_RECEIVE_UPDATE_DATA have an integer +overflow issue. Params.guest_len and offset are both 32 bits wide, with a +large params.guest_len the check to confirm a page boundary is not +crossed can falsely pass: + + /* Check if we are crossing the page boundary * + offset = params.guest_uaddr & (PAGE_SIZE - 1); + if ((params.guest_len + offset > PAGE_SIZE)) + +Add an additional check to confirm that params.guest_len itself is not +greater than PAGE_SIZE. + +Note, this isn't a security concern as overflow can happen if and only if +params.guest_len is greater than 0xfffff000, and the FW spec says these +commands fail with lengths greater than 16KB, i.e. the PSP will detect +KVM's goof. + +Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command") +Fixes: d3d1af85e2c7 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command") +Reported-by: Andy Nguyen +Suggested-by: Thomas Lendacky +Signed-off-by: Peter Gonda +Cc: David Rientjes +Cc: Paolo Bonzini +Cc: Sean Christopherson +Cc: kvm@vger.kernel.org +Cc: stable@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Reviewed-by: Tom Lendacky +Link: https://lore.kernel.org/r/20230207171354.4012821-1-pgonda@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/svm/sev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c +index 86d6897f..579038ee 100644 +--- a/arch/x86/kvm/svm/sev.c ++++ b/arch/x86/kvm/svm/sev.c +@@ -1293,7 +1293,7 @@ static int sev_send_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) + + /* Check if we are crossing the page boundary */ + offset = params.guest_uaddr & (PAGE_SIZE - 1); +- if ((params.guest_len + offset > PAGE_SIZE)) ++ if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE) + return -EINVAL; + + /* Pin guest memory */ +@@ -1473,7 +1473,7 @@ static int sev_receive_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp) + + /* Check if we are crossing the page boundary */ + offset = params.guest_uaddr & (PAGE_SIZE - 1); +- if ((params.guest_len + offset > PAGE_SIZE)) ++ if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE) + return -EINVAL; + + hdr = psp_copy_user_blob(params.hdr_uaddr, params.hdr_len); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-830-KVM-SVM-hyper-v-placate-modpost-section-mismatc.patch b/patches.kernel.org/6.2.3-830-KVM-SVM-hyper-v-placate-modpost-section-mismatc.patch new file mode 100644 index 0000000..26d75e1 --- /dev/null +++ b/patches.kernel.org/6.2.3-830-KVM-SVM-hyper-v-placate-modpost-section-mismatc.patch @@ -0,0 +1,63 @@ +From: Randy Dunlap +Date: Tue, 21 Feb 2023 23:33:15 -0800 +Subject: [PATCH] KVM: SVM: hyper-v: placate modpost section mismatch error +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 45dd9bc75d9adc9483f0c7d662ba6e73ed698a0b + +commit 45dd9bc75d9adc9483f0c7d662ba6e73ed698a0b upstream. + +modpost reports section mismatch errors/warnings: +WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data) +WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data) +WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data) + +This "(unknown) (section: .init.data)" all refer to svm_x86_ops. + +Tag svm_hv_hardware_setup() with __init to fix a modpost warning as the +non-stub implementation accesses __initdata (svm_x86_ops), i.e. would +generate a use-after-free if svm_hv_hardware_setup() were actually invoked +post-init. The helper is only called from svm_hardware_setup(), which is +also __init, i.e. lack of __init is benign other than the modpost warning. + +Fixes: 1e0c7d40758b ("KVM: SVM: hyper-v: Remote TLB flush for SVM") +Signed-off-by: Randy Dunlap +Cc: Vineeth Pillai +Cc: Paolo Bonzini +Cc: kvm@vger.kernel.org +Cc: stable@vger.kernel.org +Reviewed-by: Sean Christopherson +Reviewed-by: Vitaly Kuznetsov +Message-Id: <20230222073315.9081-1-rdunlap@infradead.org> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kvm/svm/svm_onhyperv.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/svm/svm_onhyperv.h b/arch/x86/kvm/svm/svm_onhyperv.h +index 45faf844..65c355b4 100644 +--- a/arch/x86/kvm/svm/svm_onhyperv.h ++++ b/arch/x86/kvm/svm/svm_onhyperv.h +@@ -30,7 +30,7 @@ static inline void svm_hv_init_vmcb(struct vmcb *vmcb) + hve->hv_enlightenments_control.msr_bitmap = 1; + } + +-static inline void svm_hv_hardware_setup(void) ++static inline __init void svm_hv_hardware_setup(void) + { + if (npt_enabled && + ms_hyperv.nested_features & HV_X64_NESTED_ENLIGHTENED_TLB) { +@@ -84,7 +84,7 @@ static inline void svm_hv_init_vmcb(struct vmcb *vmcb) + { + } + +-static inline void svm_hv_hardware_setup(void) ++static inline __init void svm_hv_hardware_setup(void) + { + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-831-selftests-x86-Fix-incorrect-kernel-headers-sear.patch b/patches.kernel.org/6.2.3-831-selftests-x86-Fix-incorrect-kernel-headers-sear.patch new file mode 100644 index 0000000..207b54b --- /dev/null +++ b/patches.kernel.org/6.2.3-831-selftests-x86-Fix-incorrect-kernel-headers-sear.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:50 -0500 +Subject: [PATCH] selftests: x86: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ac5ec90e94fe8eddb4499e51398640fa6a89d657 + +commit ac5ec90e94fe8eddb4499e51398640fa6a89d657 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/x86/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile +index 0388c4d6..ca9374b5 100644 +--- a/tools/testing/selftests/x86/Makefile ++++ b/tools/testing/selftests/x86/Makefile +@@ -34,7 +34,7 @@ BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=%_64) + BINARIES_32 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_32)) + BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64)) + +-CFLAGS := -O2 -g -std=gnu99 -pthread -Wall ++CFLAGS := -O2 -g -std=gnu99 -pthread -Wall $(KHDR_INCLUDES) + + # call32_from_64 in thunks.S uses absolute addresses. + ifeq ($(CAN_BUILD_WITH_NOPIE),1) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-832-x86-virt-Force-GIF-1-prior-to-disabling-SVM-for.patch b/patches.kernel.org/6.2.3-832-x86-virt-Force-GIF-1-prior-to-disabling-SVM-for.patch new file mode 100644 index 0000000..c1459e7 --- /dev/null +++ b/patches.kernel.org/6.2.3-832-x86-virt-Force-GIF-1-prior-to-disabling-SVM-for.patch @@ -0,0 +1,61 @@ +From: Sean Christopherson +Date: Wed, 30 Nov 2022 23:36:48 +0000 +Subject: [PATCH] x86/virt: Force GIF=1 prior to disabling SVM (for reboot + flows) +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6a3236580b0b1accc3976345e723104f74f6f8e6 + +commit 6a3236580b0b1accc3976345e723104f74f6f8e6 upstream. + +Set GIF=1 prior to disabling SVM to ensure that INIT is recognized if the +kernel is disabling SVM in an emergency, e.g. if the kernel is about to +jump into a crash kernel or may reboot without doing a full CPU RESET. +If GIF is left cleared, the new kernel (or firmware) will be unabled to +awaken APs. Eat faults on STGI (due to EFER.SVME=0) as it's possible +that SVM could be disabled via NMI shootdown between reading EFER.SVME +and executing STGI. + +Link: https://lore.kernel.org/all/cbcb6f35-e5d7-c1c9-4db9-fe5cc4de579a@amd.com +Cc: stable@vger.kernel.org +Cc: Andrew Cooper +Cc: Tom Lendacky +Reviewed-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20221130233650.1404148-3-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/include/asm/virtext.h | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/virtext.h b/arch/x86/include/asm/virtext.h +index 8757078d..3b12e6b9 100644 +--- a/arch/x86/include/asm/virtext.h ++++ b/arch/x86/include/asm/virtext.h +@@ -126,7 +126,21 @@ static inline void cpu_svm_disable(void) + + wrmsrl(MSR_VM_HSAVE_PA, 0); + rdmsrl(MSR_EFER, efer); +- wrmsrl(MSR_EFER, efer & ~EFER_SVME); ++ if (efer & EFER_SVME) { ++ /* ++ * Force GIF=1 prior to disabling SVM to ensure INIT and NMI ++ * aren't blocked, e.g. if a fatal error occurred between CLGI ++ * and STGI. Note, STGI may #UD if SVM is disabled from NMI ++ * context between reading EFER and executing STGI. In that ++ * case, GIF must already be set, otherwise the NMI would have ++ * been blocked, so just eat the fault. ++ */ ++ asm_volatile_goto("1: stgi\n\t" ++ _ASM_EXTABLE(1b, %l[fault]) ++ ::: "memory" : fault); ++fault: ++ wrmsrl(MSR_EFER, efer & ~EFER_SVME); ++ } + } + + /** Makes sure SVM is disabled, if it is supported on the CPU +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-833-x86-crash-Disable-virt-in-core-NMI-crash-handle.patch b/patches.kernel.org/6.2.3-833-x86-crash-Disable-virt-in-core-NMI-crash-handle.patch new file mode 100644 index 0000000..1860fdf --- /dev/null +++ b/patches.kernel.org/6.2.3-833-x86-crash-Disable-virt-in-core-NMI-crash-handle.patch @@ -0,0 +1,254 @@ +From: Sean Christopherson +Date: Wed, 30 Nov 2022 23:36:47 +0000 +Subject: [PATCH] x86/crash: Disable virt in core NMI crash handler to avoid + double shootdown +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 26044aff37a5455b19a91785086914fd33053ef4 + +commit 26044aff37a5455b19a91785086914fd33053ef4 upstream. + +Disable virtualization in crash_nmi_callback() and rework the +emergency_vmx_disable_all() path to do an NMI shootdown if and only if a +shootdown has not already occurred. NMI crash shootdown fundamentally +can't support multiple invocations as responding CPUs are deliberately +put into halt state without unblocking NMIs. But, the emergency reboot +path doesn't have any work of its own, it simply cares about disabling +virtualization, i.e. so long as a shootdown occurred, emergency reboot +doesn't care who initiated the shootdown, or when. + +If "crash_kexec_post_notifiers" is specified on the kernel command line, +panic() will invoke crash_smp_send_stop() and result in a second call to +nmi_shootdown_cpus() during native_machine_emergency_restart(). + +Invoke the callback _before_ disabling virtualization, as the current +VMCS needs to be cleared before doing VMXOFF. Note, this results in a +subtle change in ordering between disabling virtualization and stopping +Intel PT on the responding CPUs. While VMX and Intel PT do interact, +VMXOFF and writes to MSR_IA32_RTIT_CTL do not induce faults between one +another, which is all that matters when panicking. + +Harden nmi_shootdown_cpus() against multiple invocations to try and +capture any such kernel bugs via a WARN instead of hanging the system +during a crash/dump, e.g. prior to the recent hardening of +register_nmi_handler(), re-registering the NMI handler would trigger a +double list_add() and hang the system if CONFIG_BUG_ON_DATA_CORRUPTION=y. + + list_add double add: new=ffffffff82220800, prev=ffffffff8221cfe8, next=ffffffff82220800. + WARNING: CPU: 2 PID: 1319 at lib/list_debug.c:29 __list_add_valid+0x67/0x70 + Call Trace: + __register_nmi_handler+0xcf/0x130 + nmi_shootdown_cpus+0x39/0x90 + native_machine_emergency_restart+0x1c9/0x1d0 + panic+0x237/0x29b + +Extract the disabling logic to a common helper to deduplicate code, and +to prepare for doing the shootdown in the emergency reboot path if SVM +is supported. + +Note, prior to commit ed72736183c4 ("x86/reboot: Force all cpus to exit +VMX root if VMX is supported"), nmi_shootdown_cpus() was subtly protected +against a second invocation by a cpu_vmx_enabled() check as the kdump +handler would disable VMX if it ran first. + +Fixes: ed72736183c4 ("x86/reboot: Force all cpus to exit VMX root if VMX is supported") +Cc: stable@vger.kernel.org +Reported-by: Guilherme G. Piccoli +Cc: Vitaly Kuznetsov +Cc: Paolo Bonzini +Link: https://lore.kernel.org/all/20220427224924.592546-2-gpiccoli@igalia.com +Tested-by: Guilherme G. Piccoli +Reviewed-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20221130233650.1404148-2-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/include/asm/reboot.h | 2 ++ + arch/x86/kernel/crash.c | 17 +-------- + arch/x86/kernel/reboot.c | 65 ++++++++++++++++++++++++++++------- + 3 files changed, 56 insertions(+), 28 deletions(-) + +diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h +index 04c17be9..bc5b4d78 100644 +--- a/arch/x86/include/asm/reboot.h ++++ b/arch/x86/include/asm/reboot.h +@@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type); + #define MRR_BIOS 0 + #define MRR_APM 1 + ++void cpu_emergency_disable_virtualization(void); ++ + typedef void (*nmi_shootdown_cb)(int, struct pt_regs*); + void nmi_panic_self_stop(struct pt_regs *regs); + void nmi_shootdown_cpus(nmi_shootdown_cb callback); +diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c +index 30551443..cdd92ab4 100644 +--- a/arch/x86/kernel/crash.c ++++ b/arch/x86/kernel/crash.c +@@ -37,7 +37,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -81,15 +80,6 @@ static void kdump_nmi_callback(int cpu, struct pt_regs *regs) + */ + cpu_crash_vmclear_loaded_vmcss(); + +- /* Disable VMX or SVM if needed. +- * +- * We need to disable virtualization on all CPUs. +- * Having VMX or SVM enabled on any CPU may break rebooting +- * after the kdump kernel has finished its task. +- */ +- cpu_emergency_vmxoff(); +- cpu_emergency_svm_disable(); +- + /* + * Disable Intel PT to stop its logging + */ +@@ -148,12 +138,7 @@ void native_machine_crash_shutdown(struct pt_regs *regs) + */ + cpu_crash_vmclear_loaded_vmcss(); + +- /* Booting kdump kernel with VMX or SVM enabled won't work, +- * because (among other limitations) we can't disable paging +- * with the virt flags. +- */ +- cpu_emergency_vmxoff(); +- cpu_emergency_svm_disable(); ++ cpu_emergency_disable_virtualization(); + + /* + * Disable Intel PT to stop its logging +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index c3636ea4..374c14b3 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -528,10 +528,7 @@ static inline void kb_wait(void) + } + } + +-static void vmxoff_nmi(int cpu, struct pt_regs *regs) +-{ +- cpu_emergency_vmxoff(); +-} ++static inline void nmi_shootdown_cpus_on_restart(void); + + /* Use NMIs as IPIs to tell all CPUs to disable virtualization */ + static void emergency_vmx_disable_all(void) +@@ -554,7 +551,7 @@ static void emergency_vmx_disable_all(void) + __cpu_emergency_vmxoff(); + + /* Halt and exit VMX root operation on the other CPUs. */ +- nmi_shootdown_cpus(vmxoff_nmi); ++ nmi_shootdown_cpus_on_restart(); + } + } + +@@ -795,6 +792,17 @@ void machine_crash_shutdown(struct pt_regs *regs) + /* This is the CPU performing the emergency shutdown work. */ + int crashing_cpu = -1; + ++/* ++ * Disable virtualization, i.e. VMX or SVM, to ensure INIT is recognized during ++ * reboot. VMX blocks INIT if the CPU is post-VMXON, and SVM blocks INIT if ++ * GIF=0, i.e. if the crash occurred between CLGI and STGI. ++ */ ++void cpu_emergency_disable_virtualization(void) ++{ ++ cpu_emergency_vmxoff(); ++ cpu_emergency_svm_disable(); ++} ++ + #if defined(CONFIG_SMP) + + static nmi_shootdown_cb shootdown_callback; +@@ -817,7 +825,14 @@ static int crash_nmi_callback(unsigned int val, struct pt_regs *regs) + return NMI_HANDLED; + local_irq_disable(); + +- shootdown_callback(cpu, regs); ++ if (shootdown_callback) ++ shootdown_callback(cpu, regs); ++ ++ /* ++ * Prepare the CPU for reboot _after_ invoking the callback so that the ++ * callback can safely use virtualization instructions, e.g. VMCLEAR. ++ */ ++ cpu_emergency_disable_virtualization(); + + atomic_dec(&waiting_for_crash_ipi); + /* Assume hlt works */ +@@ -828,18 +843,32 @@ static int crash_nmi_callback(unsigned int val, struct pt_regs *regs) + return NMI_HANDLED; + } + +-/* +- * Halt all other CPUs, calling the specified function on each of them ++/** ++ * nmi_shootdown_cpus - Stop other CPUs via NMI ++ * @callback: Optional callback to be invoked from the NMI handler ++ * ++ * The NMI handler on the remote CPUs invokes @callback, if not ++ * NULL, first and then disables virtualization to ensure that ++ * INIT is recognized during reboot. + * +- * This function can be used to halt all other CPUs on crash +- * or emergency reboot time. The function passed as parameter +- * will be called inside a NMI handler on all CPUs. ++ * nmi_shootdown_cpus() can only be invoked once. After the first ++ * invocation all other CPUs are stuck in crash_nmi_callback() and ++ * cannot respond to a second NMI. + */ + void nmi_shootdown_cpus(nmi_shootdown_cb callback) + { + unsigned long msecs; ++ + local_irq_disable(); + ++ /* ++ * Avoid certain doom if a shootdown already occurred; re-registering ++ * the NMI handler will cause list corruption, modifying the callback ++ * will do who knows what, etc... ++ */ ++ if (WARN_ON_ONCE(crash_ipi_issued)) ++ return; ++ + /* Make a note of crashing cpu. Will be used in NMI callback. */ + crashing_cpu = safe_smp_processor_id(); + +@@ -867,7 +896,17 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback) + msecs--; + } + +- /* Leave the nmi callback set */ ++ /* ++ * Leave the nmi callback set, shootdown is a one-time thing. Clearing ++ * the callback could result in a NULL pointer dereference if a CPU ++ * (finally) responds after the timeout expires. ++ */ ++} ++ ++static inline void nmi_shootdown_cpus_on_restart(void) ++{ ++ if (!crash_ipi_issued) ++ nmi_shootdown_cpus(NULL); + } + + /* +@@ -897,6 +936,8 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback) + /* No other CPUs to shoot down */ + } + ++static inline void nmi_shootdown_cpus_on_restart(void) { } ++ + void run_crash_ipi_callback(struct pt_regs *regs) + { + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-834-x86-reboot-Disable-virtualization-in-an-emergen.patch b/patches.kernel.org/6.2.3-834-x86-reboot-Disable-virtualization-in-an-emergen.patch new file mode 100644 index 0000000..e7e3bac --- /dev/null +++ b/patches.kernel.org/6.2.3-834-x86-reboot-Disable-virtualization-in-an-emergen.patch @@ -0,0 +1,79 @@ +From: Sean Christopherson +Date: Wed, 30 Nov 2022 23:36:49 +0000 +Subject: [PATCH] x86/reboot: Disable virtualization in an emergency if SVM is + supported +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d81f952aa657b76cea381384bef1fea35c5fd266 + +commit d81f952aa657b76cea381384bef1fea35c5fd266 upstream. + +Disable SVM on all CPUs via NMI shootdown during an emergency reboot. +Like VMX, SVM can block INIT, e.g. if the emergency reboot is triggered +between CLGI and STGI, and thus can prevent bringing up other CPUs via +INIT-SIPI-SIPI. + +Cc: stable@vger.kernel.org +Reviewed-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20221130233650.1404148-4-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/reboot.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index 374c14b3..d03c551d 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -530,27 +530,26 @@ static inline void kb_wait(void) + + static inline void nmi_shootdown_cpus_on_restart(void); + +-/* Use NMIs as IPIs to tell all CPUs to disable virtualization */ +-static void emergency_vmx_disable_all(void) ++static void emergency_reboot_disable_virtualization(void) + { + /* Just make sure we won't change CPUs while doing this */ + local_irq_disable(); + + /* +- * Disable VMX on all CPUs before rebooting, otherwise we risk hanging +- * the machine, because the CPU blocks INIT when it's in VMX root. ++ * Disable virtualization on all CPUs before rebooting to avoid hanging ++ * the system, as VMX and SVM block INIT when running in the host. + * + * We can't take any locks and we may be on an inconsistent state, so +- * use NMIs as IPIs to tell the other CPUs to exit VMX root and halt. ++ * use NMIs as IPIs to tell the other CPUs to disable VMX/SVM and halt. + * +- * Do the NMI shootdown even if VMX if off on _this_ CPU, as that +- * doesn't prevent a different CPU from being in VMX root operation. ++ * Do the NMI shootdown even if virtualization is off on _this_ CPU, as ++ * other CPUs may have virtualization enabled. + */ +- if (cpu_has_vmx()) { +- /* Safely force _this_ CPU out of VMX root operation. */ +- __cpu_emergency_vmxoff(); ++ if (cpu_has_vmx() || cpu_has_svm(NULL)) { ++ /* Safely force _this_ CPU out of VMX/SVM operation. */ ++ cpu_emergency_disable_virtualization(); + +- /* Halt and exit VMX root operation on the other CPUs. */ ++ /* Disable VMX/SVM and halt on other CPUs. */ + nmi_shootdown_cpus_on_restart(); + } + } +@@ -587,7 +586,7 @@ static void native_machine_emergency_restart(void) + unsigned short mode; + + if (reboot_emergency) +- emergency_vmx_disable_all(); ++ emergency_reboot_disable_virtualization(); + + tboot_shutdown(TB_SHUTDOWN_REBOOT); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-835-x86-reboot-Disable-SVM-not-just-VMX-when-stoppi.patch b/patches.kernel.org/6.2.3-835-x86-reboot-Disable-SVM-not-just-VMX-when-stoppi.patch new file mode 100644 index 0000000..407c72d --- /dev/null +++ b/patches.kernel.org/6.2.3-835-x86-reboot-Disable-SVM-not-just-VMX-when-stoppi.patch @@ -0,0 +1,60 @@ +From: Sean Christopherson +Date: Wed, 30 Nov 2022 23:36:50 +0000 +Subject: [PATCH] x86/reboot: Disable SVM, not just VMX, when stopping CPUs +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a2b07fa7b93321c059af0c6d492cc9a4f1e390aa + +commit a2b07fa7b93321c059af0c6d492cc9a4f1e390aa upstream. + +Disable SVM and more importantly force GIF=1 when halting a CPU or +rebooting the machine. Similar to VMX, SVM allows software to block +INITs via CLGI, and thus can be problematic for a crash/reboot. The +window for failure is smaller with SVM as INIT is only blocked while +GIF=0, i.e. between CLGI and STGI, but the window does exist. + +Fixes: fba4f472b33a ("x86/reboot: Turn off KVM when halting a CPU") +Cc: stable@vger.kernel.org +Reviewed-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20221130233650.1404148-5-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/smp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c +index 06db901f..375b33ec 100644 +--- a/arch/x86/kernel/smp.c ++++ b/arch/x86/kernel/smp.c +@@ -32,7 +32,7 @@ + #include + #include + #include +-#include ++#include + + /* + * Some notes on x86 processor bugs affecting SMP operation: +@@ -122,7 +122,7 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) + if (raw_smp_processor_id() == atomic_read(&stopping_cpu)) + return NMI_HANDLED; + +- cpu_emergency_vmxoff(); ++ cpu_emergency_disable_virtualization(); + stop_this_cpu(NULL); + + return NMI_HANDLED; +@@ -134,7 +134,7 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) + DEFINE_IDTENTRY_SYSVEC(sysvec_reboot) + { + ack_APIC_irq(); +- cpu_emergency_vmxoff(); ++ cpu_emergency_disable_virtualization(); + stop_this_cpu(NULL); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-836-x86-kprobes-Fix-__recover_optprobed_insn-check-.patch b/patches.kernel.org/6.2.3-836-x86-kprobes-Fix-__recover_optprobed_insn-check-.patch new file mode 100644 index 0000000..ad522ba --- /dev/null +++ b/patches.kernel.org/6.2.3-836-x86-kprobes-Fix-__recover_optprobed_insn-check-.patch @@ -0,0 +1,83 @@ +From: Yang Jihong +Date: Tue, 21 Feb 2023 08:49:16 +0900 +Subject: [PATCH] x86/kprobes: Fix __recover_optprobed_insn check optimizing + logic +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 868a6fc0ca2407622d2833adefe1c4d284766c4c + +commit 868a6fc0ca2407622d2833adefe1c4d284766c4c upstream. + +Since the following commit: + + commit f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") + +modified the update timing of the KPROBE_FLAG_OPTIMIZED, a optimized_kprobe +may be in the optimizing or unoptimizing state when op.kp->flags +has KPROBE_FLAG_OPTIMIZED and op->list is not empty. + +The __recover_optprobed_insn check logic is incorrect, a kprobe in the +unoptimizing state may be incorrectly determined as unoptimizing. +As a result, incorrect instructions are copied. + +The optprobe_queued_unopt function needs to be exported for invoking in +arch directory. + +Link: https://lore.kernel.org/all/20230216034247.32348-2-yangjihong1@huawei.com/ + +Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") +Cc: stable@vger.kernel.org +Signed-off-by: Yang Jihong +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/kprobes/opt.c | 4 ++-- + include/linux/kprobes.h | 1 + + kernel/kprobes.c | 2 +- + 3 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c +index e57e07b0..f406bfa9 100644 +--- a/arch/x86/kernel/kprobes/opt.c ++++ b/arch/x86/kernel/kprobes/opt.c +@@ -46,8 +46,8 @@ unsigned long __recover_optprobed_insn(kprobe_opcode_t *buf, unsigned long addr) + /* This function only handles jump-optimized kprobe */ + if (kp && kprobe_optimized(kp)) { + op = container_of(kp, struct optimized_kprobe, kp); +- /* If op->list is not empty, op is under optimizing */ +- if (list_empty(&op->list)) ++ /* If op is optimized or under unoptimizing */ ++ if (list_empty(&op->list) || optprobe_queued_unopt(op)) + goto found; + } + } +diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h +index a0b92be9..ab39285f 100644 +--- a/include/linux/kprobes.h ++++ b/include/linux/kprobes.h +@@ -378,6 +378,7 @@ extern void opt_pre_handler(struct kprobe *p, struct pt_regs *regs); + DEFINE_INSN_CACHE_OPS(optinsn); + + extern void wait_for_kprobe_optimizer(void); ++bool optprobe_queued_unopt(struct optimized_kprobe *op); + #else /* !CONFIG_OPTPROBES */ + static inline void wait_for_kprobe_optimizer(void) { } + #endif /* CONFIG_OPTPROBES */ +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 1c18ecf9..90b0fac6 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -662,7 +662,7 @@ void wait_for_kprobe_optimizer(void) + mutex_unlock(&kprobe_mutex); + } + +-static bool optprobe_queued_unopt(struct optimized_kprobe *op) ++bool optprobe_queued_unopt(struct optimized_kprobe *op) + { + struct optimized_kprobe *_op; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-837-x86-kprobes-Fix-arch_check_optimized_kprobe-che.patch b/patches.kernel.org/6.2.3-837-x86-kprobes-Fix-arch_check_optimized_kprobe-che.patch new file mode 100644 index 0000000..1e8b5b0 --- /dev/null +++ b/patches.kernel.org/6.2.3-837-x86-kprobes-Fix-arch_check_optimized_kprobe-che.patch @@ -0,0 +1,155 @@ +From: Yang Jihong +Date: Tue, 21 Feb 2023 08:49:16 +0900 +Subject: [PATCH] x86/kprobes: Fix arch_check_optimized_kprobe check within + optimized_kprobe range +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f1c97a1b4ef709e3f066f82e3ba3108c3b133ae6 + +commit f1c97a1b4ef709e3f066f82e3ba3108c3b133ae6 upstream. + +When arch_prepare_optimized_kprobe calculating jump destination address, +it copies original instructions from jmp-optimized kprobe (see +__recover_optprobed_insn), and calculated based on length of original +instruction. + +arch_check_optimized_kprobe does not check KPROBE_FLAG_OPTIMATED when +checking whether jmp-optimized kprobe exists. +As a result, setup_detour_execution may jump to a range that has been +overwritten by jump destination address, resulting in an inval opcode error. + +For example, assume that register two kprobes whose addresses are + and in "func" function. +The original code of "func" function is as follows: + + 0xffffffff816cb5e9 <+9>: push %r12 + 0xffffffff816cb5eb <+11>: xor %r12d,%r12d + 0xffffffff816cb5ee <+14>: test %rdi,%rdi + 0xffffffff816cb5f1 <+17>: setne %r12b + 0xffffffff816cb5f5 <+21>: push %rbp + +1.Register the kprobe for , assume that is kp1, corresponding optimized_kprobe is op1. + After the optimization, "func" code changes to: + + 0xffffffff816cc079 <+9>: push %r12 + 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 + 0xffffffff816cc080 <+16>: incl 0xf(%rcx) + 0xffffffff816cc083 <+19>: xchg %eax,%ebp + 0xffffffff816cc084 <+20>: (bad) + 0xffffffff816cc085 <+21>: push %rbp + +Now op1->flags == KPROBE_FLAG_OPTIMATED; + +2. Register the kprobe for , assume that is kp2, corresponding optimized_kprobe is op2. + +register_kprobe(kp2) + register_aggr_kprobe + alloc_aggr_kprobe + __prepare_optimized_kprobe + arch_prepare_optimized_kprobe + __recover_optprobed_insn // copy original bytes from kp1->optinsn.copied_insn, + // jump address = + +3. disable kp1: + +disable_kprobe(kp1) + __disable_kprobe + ... + if (p == orig_p || aggr_kprobe_disabled(orig_p)) { + ret = disarm_kprobe(orig_p, true) // add op1 in unoptimizing_list, not unoptimized + orig_p->flags |= KPROBE_FLAG_DISABLED; // op1->flags == KPROBE_FLAG_OPTIMATED | KPROBE_FLAG_DISABLED + ... + +4. unregister kp2 +__unregister_kprobe_top + ... + if (!kprobe_disabled(ap) && !kprobes_all_disarmed) { + optimize_kprobe(op) + ... + if (arch_check_optimized_kprobe(op) < 0) // because op1 has KPROBE_FLAG_DISABLED, here not return + return; + p->kp.flags |= KPROBE_FLAG_OPTIMIZED; // now op2 has KPROBE_FLAG_OPTIMIZED + } + +"func" code now is: + + 0xffffffff816cc079 <+9>: int3 + 0xffffffff816cc07a <+10>: push %rsp + 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 + 0xffffffff816cc080 <+16>: incl 0xf(%rcx) + 0xffffffff816cc083 <+19>: xchg %eax,%ebp + 0xffffffff816cc084 <+20>: (bad) + 0xffffffff816cc085 <+21>: push %rbp + +5. if call "func", int3 handler call setup_detour_execution: + + if (p->flags & KPROBE_FLAG_OPTIMIZED) { + ... + regs->ip = (unsigned long)op->optinsn.insn + TMPL_END_IDX; + ... + } + +The code for the destination address is + + 0xffffffffa021072c: push %r12 + 0xffffffffa021072e: xor %r12d,%r12d + 0xffffffffa0210731: jmp 0xffffffff816cb5ee + +However, is not a valid start instruction address. As a result, an error occurs. + +Link: https://lore.kernel.org/all/20230216034247.32348-3-yangjihong1@huawei.com/ + +Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") +Signed-off-by: Yang Jihong +Cc: stable@vger.kernel.org +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/kprobes/opt.c | 2 +- + include/linux/kprobes.h | 1 + + kernel/kprobes.c | 2 +- + 3 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c +index f406bfa9..57b0037d 100644 +--- a/arch/x86/kernel/kprobes/opt.c ++++ b/arch/x86/kernel/kprobes/opt.c +@@ -353,7 +353,7 @@ int arch_check_optimized_kprobe(struct optimized_kprobe *op) + + for (i = 1; i < op->optinsn.size; i++) { + p = get_kprobe(op->kp.addr + i); +- if (p && !kprobe_disabled(p)) ++ if (p && !kprobe_disarmed(p)) + return -EEXIST; + } + +diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h +index ab39285f..85a64cb9 100644 +--- a/include/linux/kprobes.h ++++ b/include/linux/kprobes.h +@@ -379,6 +379,7 @@ DEFINE_INSN_CACHE_OPS(optinsn); + + extern void wait_for_kprobe_optimizer(void); + bool optprobe_queued_unopt(struct optimized_kprobe *op); ++bool kprobe_disarmed(struct kprobe *p); + #else /* !CONFIG_OPTPROBES */ + static inline void wait_for_kprobe_optimizer(void) { } + #endif /* CONFIG_OPTPROBES */ +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 90b0fac6..99c3f4de 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -458,7 +458,7 @@ static inline int kprobe_optready(struct kprobe *p) + } + + /* Return true if the kprobe is disarmed. Note: p must be on hash list */ +-static inline bool kprobe_disarmed(struct kprobe *p) ++bool kprobe_disarmed(struct kprobe *p) + { + struct optimized_kprobe *op; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-838-x86-microcode-amd-Remove-load_microcode_amd-s-b.patch b/patches.kernel.org/6.2.3-838-x86-microcode-amd-Remove-load_microcode_amd-s-b.patch new file mode 100644 index 0000000..860be31 --- /dev/null +++ b/patches.kernel.org/6.2.3-838-x86-microcode-amd-Remove-load_microcode_amd-s-b.patch @@ -0,0 +1,93 @@ +From: "Borislav Petkov (AMD)" +Date: Tue, 17 Jan 2023 23:59:24 +0100 +Subject: [PATCH] x86/microcode/amd: Remove load_microcode_amd()'s bsp + parameter +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2355370cd941cbb20882cc3f34460f9f2b8f9a18 + +commit 2355370cd941cbb20882cc3f34460f9f2b8f9a18 upstream. + +It is always the BSP. + +No functional changes. + +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230130161709.11615-2-bp@alien8.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/cpu/microcode/amd.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c +index 56471f75..f41ea464 100644 +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -553,8 +553,7 @@ void load_ucode_amd_ap(unsigned int cpuid_1_eax) + apply_microcode_early_amd(cpuid_1_eax, cp.data, cp.size, false); + } + +-static enum ucode_state +-load_microcode_amd(bool save, u8 family, const u8 *data, size_t size); ++static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size); + + int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) + { +@@ -572,7 +571,7 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) + if (!desc.mc) + return -EINVAL; + +- ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size); ++ ret = load_microcode_amd(x86_family(cpuid_1_eax), desc.data, desc.size); + if (ret > UCODE_UPDATED) + return -EINVAL; + +@@ -850,8 +849,7 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data, + return UCODE_OK; + } + +-static enum ucode_state +-load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) ++static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size) + { + struct ucode_patch *p; + enum ucode_state ret; +@@ -875,10 +873,6 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) + ret = UCODE_NEW; + } + +- /* save BSP's matching patch for early load */ +- if (!save) +- return ret; +- + memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); + memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); + +@@ -905,14 +899,9 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device) + { + char fw_name[36] = "amd-ucode/microcode_amd.bin"; + struct cpuinfo_x86 *c = &cpu_data(cpu); +- bool bsp = c->cpu_index == boot_cpu_data.cpu_index; + enum ucode_state ret = UCODE_NFOUND; + const struct firmware *fw; + +- /* reload ucode container only on the boot cpu */ +- if (!bsp) +- return UCODE_OK; +- + if (c->x86 >= 0x15) + snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86); + +@@ -925,7 +914,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device) + if (!verify_container(fw->data, fw->size, false)) + goto fw_release; + +- ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size); ++ ret = load_microcode_amd(c->x86, fw->data, fw->size); + + fw_release: + release_firmware(fw); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-839-x86-microcode-AMD-Add-a-cpu-parameter-to-the-re.patch b/patches.kernel.org/6.2.3-839-x86-microcode-AMD-Add-a-cpu-parameter-to-the-re.patch new file mode 100644 index 0000000..e154b83 --- /dev/null +++ b/patches.kernel.org/6.2.3-839-x86-microcode-AMD-Add-a-cpu-parameter-to-the-re.patch @@ -0,0 +1,109 @@ +From: "Borislav Petkov (AMD)" +Date: Thu, 26 Jan 2023 00:08:03 +0100 +Subject: [PATCH] x86/microcode/AMD: Add a @cpu parameter to the reloading + functions +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a5ad92134bd153a9ccdcddf09a95b088f36c3cce + +commit a5ad92134bd153a9ccdcddf09a95b088f36c3cce upstream. + +Will be used in a subsequent change. + +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230130161709.11615-3-bp@alien8.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/include/asm/microcode.h | 4 ++-- + arch/x86/include/asm/microcode_amd.h | 4 ++-- + arch/x86/kernel/cpu/microcode/amd.c | 2 +- + arch/x86/kernel/cpu/microcode/core.c | 6 +++--- + 4 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h +index d5a58bde..320566a0 100644 +--- a/arch/x86/include/asm/microcode.h ++++ b/arch/x86/include/asm/microcode.h +@@ -125,13 +125,13 @@ static inline unsigned int x86_cpuid_family(void) + #ifdef CONFIG_MICROCODE + extern void __init load_ucode_bsp(void); + extern void load_ucode_ap(void); +-void reload_early_microcode(void); ++void reload_early_microcode(unsigned int cpu); + extern bool initrd_gone; + void microcode_bsp_resume(void); + #else + static inline void __init load_ucode_bsp(void) { } + static inline void load_ucode_ap(void) { } +-static inline void reload_early_microcode(void) { } ++static inline void reload_early_microcode(unsigned int cpu) { } + static inline void microcode_bsp_resume(void) { } + #endif + +diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h +index ac31f914..e6662adf 100644 +--- a/arch/x86/include/asm/microcode_amd.h ++++ b/arch/x86/include/asm/microcode_amd.h +@@ -47,12 +47,12 @@ struct microcode_amd { + extern void __init load_ucode_amd_bsp(unsigned int family); + extern void load_ucode_amd_ap(unsigned int family); + extern int __init save_microcode_in_initrd_amd(unsigned int family); +-void reload_ucode_amd(void); ++void reload_ucode_amd(unsigned int cpu); + #else + static inline void __init load_ucode_amd_bsp(unsigned int family) {} + static inline void load_ucode_amd_ap(unsigned int family) {} + static inline int __init + save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } +-static inline void reload_ucode_amd(void) {} ++static inline void reload_ucode_amd(unsigned int cpu) {} + #endif + #endif /* _ASM_X86_MICROCODE_AMD_H */ +diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c +index f41ea464..b8d73f13 100644 +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -578,7 +578,7 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) + return 0; + } + +-void reload_ucode_amd(void) ++void reload_ucode_amd(unsigned int cpu) + { + struct microcode_amd *mc; + u32 rev, dummy __always_unused; +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index 3c4e732a..7487518d 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -298,7 +298,7 @@ struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa) + #endif + } + +-void reload_early_microcode(void) ++void reload_early_microcode(unsigned int cpu) + { + int vendor, family; + +@@ -312,7 +312,7 @@ void reload_early_microcode(void) + break; + case X86_VENDOR_AMD: + if (family >= 0x10) +- reload_ucode_amd(); ++ reload_ucode_amd(cpu); + break; + default: + break; +@@ -567,7 +567,7 @@ void microcode_bsp_resume(void) + if (uci->mc) + microcode_ops->apply_microcode(cpu); + else +- reload_early_microcode(); ++ reload_early_microcode(cpu); + } + + static struct syscore_ops mc_syscore_ops = { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-840-x86-microcode-AMD-Fix-mixed-steppings-support.patch b/patches.kernel.org/6.2.3-840-x86-microcode-AMD-Fix-mixed-steppings-support.patch new file mode 100644 index 0000000..46de22e --- /dev/null +++ b/patches.kernel.org/6.2.3-840-x86-microcode-AMD-Fix-mixed-steppings-support.patch @@ -0,0 +1,112 @@ +From: "Borislav Petkov (AMD)" +Date: Thu, 26 Jan 2023 16:26:17 +0100 +Subject: [PATCH] x86/microcode/AMD: Fix mixed steppings support +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7ff6edf4fef38ab404ee7861f257e28eaaeed35f + +commit 7ff6edf4fef38ab404ee7861f257e28eaaeed35f upstream. + +The AMD side of the loader has always claimed to support mixed +steppings. But somewhere along the way, it broke that by assuming that +the cached patch blob is a single one instead of it being one per +*node*. + +So turn it into a per-node one so that each node can stash the blob +relevant for it. + + [ NB: Fixes tag is not really the exactly correct one but it is good + enough. ] + +Fixes: fe055896c040 ("x86/microcode: Merge the early microcode loader") +Signed-off-by: Borislav Petkov (AMD) +Cc: # 2355370cd941 ("x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter") +Cc: # a5ad92134bd1 ("x86/microcode/AMD: Add a @cpu parameter to the reloading functions") +Link: https://lore.kernel.org/r/20230130161709.11615-4-bp@alien8.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/cpu/microcode/amd.c | 34 ++++++++++++++++++----------- + 1 file changed, 21 insertions(+), 13 deletions(-) + +diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c +index b8d73f13..ac59783e 100644 +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -55,7 +55,9 @@ struct cont_desc { + }; + + static u32 ucode_new_rev; +-static u8 amd_ucode_patch[PATCH_MAX_SIZE]; ++ ++/* One blob per node. */ ++static u8 amd_ucode_patch[MAX_NUMNODES][PATCH_MAX_SIZE]; + + /* + * Microcode patch container file is prepended to the initrd in cpio +@@ -428,7 +430,7 @@ apply_microcode_early_amd(u32 cpuid_1_eax, void *ucode, size_t size, bool save_p + patch = (u8 (*)[PATCH_MAX_SIZE])__pa_nodebug(&amd_ucode_patch); + #else + new_rev = &ucode_new_rev; +- patch = &amd_ucode_patch; ++ patch = &amd_ucode_patch[0]; + #endif + + desc.cpuid_1_eax = cpuid_1_eax; +@@ -580,10 +582,10 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) + + void reload_ucode_amd(unsigned int cpu) + { +- struct microcode_amd *mc; + u32 rev, dummy __always_unused; ++ struct microcode_amd *mc; + +- mc = (struct microcode_amd *)amd_ucode_patch; ++ mc = (struct microcode_amd *)amd_ucode_patch[cpu_to_node(cpu)]; + + rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy); + +@@ -851,6 +853,8 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data, + + static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size) + { ++ struct cpuinfo_x86 *c; ++ unsigned int nid, cpu; + struct ucode_patch *p; + enum ucode_state ret; + +@@ -863,18 +867,22 @@ static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t siz + return ret; + } + +- p = find_patch(0); +- if (!p) { +- return ret; +- } else { +- if (boot_cpu_data.microcode >= p->patch_id) +- return ret; ++ for_each_node(nid) { ++ cpu = cpumask_first(cpumask_of_node(nid)); ++ c = &cpu_data(cpu); ++ ++ p = find_patch(cpu); ++ if (!p) ++ continue; ++ ++ if (c->microcode >= p->patch_id) ++ continue; + + ret = UCODE_NEW; +- } + +- memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); +- memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); ++ memset(&amd_ucode_patch[nid], 0, PATCH_MAX_SIZE); ++ memcpy(&amd_ucode_patch[nid], p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); ++ } + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-841-x86-speculation-Allow-enabling-STIBP-with-legac.patch b/patches.kernel.org/6.2.3-841-x86-speculation-Allow-enabling-STIBP-with-legac.patch new file mode 100644 index 0000000..dc5c15a --- /dev/null +++ b/patches.kernel.org/6.2.3-841-x86-speculation-Allow-enabling-STIBP-with-legac.patch @@ -0,0 +1,102 @@ +From: KP Singh +Date: Mon, 27 Feb 2023 07:05:40 +0100 +Subject: [PATCH] x86/speculation: Allow enabling STIBP with legacy IBRS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6921ed9049bc7457f66c1596c5b78aec0dae4a9d + +commit 6921ed9049bc7457f66c1596c5b78aec0dae4a9d upstream. + +When plain IBRS is enabled (not enhanced IBRS), the logic in +spectre_v2_user_select_mitigation() determines that STIBP is not needed. + +The IBRS bit implicitly protects against cross-thread branch target +injection. However, with legacy IBRS, the IBRS bit is cleared on +returning to userspace for performance reasons which leaves userspace +threads vulnerable to cross-thread branch target injection against which +STIBP protects. + +Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for +enabling STIBP (through seccomp/prctl() by default or always-on, if +selected by spectre_v2_user kernel cmdline parameter). + + [ bp: Massage. ] + +Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") +Reported-by: José Oliveira +Reported-by: Rodrigo Branco +Signed-off-by: KP Singh +Signed-off-by: Borislav Petkov (AMD) +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230220120127.1975241-1-kpsingh@kernel.org +Link: https://lore.kernel.org/r/20230221184908.2349578-1-kpsingh@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/x86/kernel/cpu/bugs.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 374bc620..daad10e7 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -1132,14 +1132,18 @@ spectre_v2_parse_user_cmdline(void) + return SPECTRE_V2_USER_CMD_AUTO; + } + +-static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) ++static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode) + { +- return mode == SPECTRE_V2_IBRS || +- mode == SPECTRE_V2_EIBRS || ++ return mode == SPECTRE_V2_EIBRS || + mode == SPECTRE_V2_EIBRS_RETPOLINE || + mode == SPECTRE_V2_EIBRS_LFENCE; + } + ++static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) ++{ ++ return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS; ++} ++ + static void __init + spectre_v2_user_select_mitigation(void) + { +@@ -1202,12 +1206,19 @@ spectre_v2_user_select_mitigation(void) + } + + /* +- * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible, +- * STIBP is not required. ++ * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP ++ * is not required. ++ * ++ * Enhanced IBRS also protects against cross-thread branch target ++ * injection in user-mode as the IBRS bit remains always set which ++ * implicitly enables cross-thread protections. However, in legacy IBRS ++ * mode, the IBRS bit is set only on kernel entry and cleared on return ++ * to userspace. This disables the implicit cross-thread protection, ++ * so allow for STIBP to be selected in that case. + */ + if (!boot_cpu_has(X86_FEATURE_STIBP) || + !smt_possible || +- spectre_v2_in_ibrs_mode(spectre_v2_enabled)) ++ spectre_v2_in_eibrs_mode(spectre_v2_enabled)) + return; + + /* +@@ -2335,7 +2346,7 @@ static ssize_t mmio_stale_data_show_state(char *buf) + + static char *stibp_state(void) + { +- if (spectre_v2_in_ibrs_mode(spectre_v2_enabled)) ++ if (spectre_v2_in_eibrs_mode(spectre_v2_enabled)) + return ""; + + switch (spectre_v2_user_stibp) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-842-Documentation-hw-vuln-Document-the-interaction-.patch b/patches.kernel.org/6.2.3-842-Documentation-hw-vuln-Document-the-interaction-.patch new file mode 100644 index 0000000..7b3a542 --- /dev/null +++ b/patches.kernel.org/6.2.3-842-Documentation-hw-vuln-Document-the-interaction-.patch @@ -0,0 +1,65 @@ +From: KP Singh +Date: Mon, 27 Feb 2023 07:05:41 +0100 +Subject: [PATCH] Documentation/hw-vuln: Document the interaction between IBRS + and STIBP +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e02b50ca442e88122e1302d4dbc1b71a4808c13f + +commit e02b50ca442e88122e1302d4dbc1b71a4808c13f upstream. + +Explain why STIBP is needed with legacy IBRS as currently implemented +(KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled. + +Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") +Signed-off-by: KP Singh +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230227060541.1939092-2-kpsingh@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Documentation/admin-guide/hw-vuln/spectre.rst | 21 ++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst +index c4dcdb3d..a39bbfe9 100644 +--- a/Documentation/admin-guide/hw-vuln/spectre.rst ++++ b/Documentation/admin-guide/hw-vuln/spectre.rst +@@ -479,8 +479,16 @@ Spectre variant 2 + On Intel Skylake-era systems the mitigation covers most, but not all, + cases. See :ref:`[3] ` for more details. + +- On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced +- IBRS on x86), retpoline is automatically disabled at run time. ++ On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS ++ or enhanced IBRS on x86), retpoline is automatically disabled at run time. ++ ++ Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at ++ boot, by setting the IBRS bit, and they're automatically protected against ++ Spectre v2 variant attacks, including cross-thread branch target injections ++ on SMT systems (STIBP). In other words, eIBRS enables STIBP too. ++ ++ Legacy IBRS systems clear the IBRS bit on exit to userspace and ++ therefore explicitly enable STIBP for that + + The retpoline mitigation is turned on by default on vulnerable + CPUs. It can be forced on or off by the administrator +@@ -504,9 +512,12 @@ Spectre variant 2 + For Spectre variant 2 mitigation, individual user programs + can be compiled with return trampolines for indirect branches. + This protects them from consuming poisoned entries in the branch +- target buffer left by malicious software. Alternatively, the +- programs can disable their indirect branch speculation via prctl() +- (See :ref:`Documentation/userspace-api/spec_ctrl.rst `). ++ target buffer left by malicious software. ++ ++ On legacy IBRS systems, at return to userspace, implicit STIBP is disabled ++ because the kernel clears the IBRS bit. In this case, the userspace programs ++ can disable indirect branch speculation via prctl() (See ++ :ref:`Documentation/userspace-api/spec_ctrl.rst `). + On x86, this will turn on STIBP to guard against attacks from the + sibling thread when the user program is running, and use IBPB to + flush the branch target buffer when switching to/from the program. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-843-virt-sev-guest-Return-EIO-if-certificate-buffer.patch b/patches.kernel.org/6.2.3-843-virt-sev-guest-Return-EIO-if-certificate-buffer.patch new file mode 100644 index 0000000..73fd561 --- /dev/null +++ b/patches.kernel.org/6.2.3-843-virt-sev-guest-Return-EIO-if-certificate-buffer.patch @@ -0,0 +1,78 @@ +From: Tom Lendacky +Date: Wed, 22 Feb 2023 10:39:39 -0600 +Subject: [PATCH] virt/sev-guest: Return -EIO if certificate buffer is not + large enough +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: dd093fb08e8f8a958fec4eef36f9f09eac047f60 + +commit dd093fb08e8f8a958fec4eef36f9f09eac047f60 upstream. + +Commit + + 47894e0fa6a5 ("virt/sev-guest: Prevent IV reuse in the SNP guest driver") + +changed the behavior associated with the return value when the caller +does not supply a large enough certificate buffer. Prior to the commit a +value of -EIO was returned. Now, 0 is returned. This breaks the +established ABI with the user. + +Change the code to detect the buffer size error and return -EIO. + +Fixes: 47894e0fa6a5 ("virt/sev-guest: Prevent IV reuse in the SNP guest driver") +Reported-by: Larry Dewey +Signed-off-by: Tom Lendacky +Signed-off-by: Borislav Petkov (AMD) +Tested-by: Larry Dewey +Cc: +Link: https://lore.kernel.org/r/2afbcae6daf13f7ad5a4296692e0a0fe1bc1e4ee.1677083979.git.thomas.lendacky@amd.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/virt/coco/sev-guest/sev-guest.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c +index 4ec4174e..7b4e9009 100644 +--- a/drivers/virt/coco/sev-guest/sev-guest.c ++++ b/drivers/virt/coco/sev-guest/sev-guest.c +@@ -377,9 +377,26 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in + snp_dev->input.data_npages = certs_npages; + } + ++ /* ++ * Increment the message sequence number. There is no harm in doing ++ * this now because decryption uses the value stored in the response ++ * structure and any failure will wipe the VMPCK, preventing further ++ * use anyway. ++ */ ++ snp_inc_msg_seqno(snp_dev); ++ + if (fw_err) + *fw_err = err; + ++ /* ++ * If an extended guest request was issued and the supplied certificate ++ * buffer was not large enough, a standard guest request was issued to ++ * prevent IV reuse. If the standard request was successful, return -EIO ++ * back to the caller as would have originally been returned. ++ */ ++ if (!rc && err == SNP_GUEST_REQ_INVALID_LEN) ++ return -EIO; ++ + if (rc) { + dev_alert(snp_dev->dev, + "Detected error from ASP request. rc: %d, fw_err: %llu\n", +@@ -395,9 +412,6 @@ static int handle_guest_request(struct snp_guest_dev *snp_dev, u64 exit_code, in + goto disable_vmpck; + } + +- /* Increment to new message sequence after payload decryption was successful. */ +- snp_inc_msg_seqno(snp_dev); +- + return 0; + + disable_vmpck: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-844-brd-mark-as-nowait-compatible.patch b/patches.kernel.org/6.2.3-844-brd-mark-as-nowait-compatible.patch new file mode 100644 index 0000000..51184a7 --- /dev/null +++ b/patches.kernel.org/6.2.3-844-brd-mark-as-nowait-compatible.patch @@ -0,0 +1,63 @@ +From: Jens Axboe +Date: Wed, 15 Feb 2023 16:43:47 -0700 +Subject: [PATCH] brd: mark as nowait compatible +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 67205f80be9910207481406c47f7d85e703fb2e9 + +commit 67205f80be9910207481406c47f7d85e703fb2e9 upstream. + +By default, non-mq drivers do not support nowait. This causes io_uring +to use a slower path as the driver cannot be trust not to block. brd +can safely set the nowait flag, as worst case all it does is a NOIO +allocation. + +For io_uring, this makes a substantial difference. Before: + +submitter=0, tid=453, file=/dev/ram0, node=-1 +polled=0, fixedbufs=1/0, register_files=1, buffered=0, QD=128 +Engine=io_uring, sq_ring=128, cq_ring=128 +IOPS=440.03K, BW=1718MiB/s, IOS/call=32/31 +IOPS=428.96K, BW=1675MiB/s, IOS/call=32/32 +IOPS=442.59K, BW=1728MiB/s, IOS/call=32/31 +IOPS=419.65K, BW=1639MiB/s, IOS/call=32/32 +IOPS=426.82K, BW=1667MiB/s, IOS/call=32/31 + +and after: + +submitter=0, tid=354, file=/dev/ram0, node=-1 +polled=0, fixedbufs=1/0, register_files=1, buffered=0, QD=128 +Engine=io_uring, sq_ring=128, cq_ring=128 +IOPS=3.37M, BW=13.15GiB/s, IOS/call=32/31 +IOPS=3.45M, BW=13.46GiB/s, IOS/call=32/31 +IOPS=3.43M, BW=13.42GiB/s, IOS/call=32/32 +IOPS=3.43M, BW=13.39GiB/s, IOS/call=32/31 +IOPS=3.43M, BW=13.38GiB/s, IOS/call=32/31 + +or about an 8x in difference. Now that brd is prepared to deal with +REQ_NOWAIT reads/writes, mark it as supporting that. + +Cc: stable@vger.kernel.org # 5.10+ +Link: https://lore.kernel.org/linux-block/20230203103005.31290-1-p.raghav@samsung.com/ +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/block/brd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index 20acc4a1..82419e34 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -412,6 +412,7 @@ static int brd_alloc(int i) + /* Tell the block layer that this is not a rotational device */ + blk_queue_flag_set(QUEUE_FLAG_NONROT, disk->queue); + blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, disk->queue); ++ blk_queue_flag_set(QUEUE_FLAG_NOWAIT, disk->queue); + err = add_disk(disk); + if (err) + goto out_cleanup_disk; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-845-brd-return-0-error-from-brd_insert_page.patch b/patches.kernel.org/6.2.3-845-brd-return-0-error-from-brd_insert_page.patch new file mode 100644 index 0000000..024b75a --- /dev/null +++ b/patches.kernel.org/6.2.3-845-brd-return-0-error-from-brd_insert_page.patch @@ -0,0 +1,99 @@ +From: Jens Axboe +Date: Thu, 16 Feb 2023 07:57:32 -0700 +Subject: [PATCH] brd: return 0/-error from brd_insert_page() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: db0ccc44a20b4bb3039c0f6885a1f9c3323c7673 + +commit db0ccc44a20b4bb3039c0f6885a1f9c3323c7673 upstream. + +It currently returns a page, but callers just check for NULL/page to +gauge success. Clean this up and return the appropriate error directly +instead. + +Cc: stable@vger.kernel.org # 5.10+ +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/block/brd.c | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index 82419e34..39cad8b2 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -78,11 +78,9 @@ static struct page *brd_lookup_page(struct brd_device *brd, sector_t sector) + } + + /* +- * Look up and return a brd's page for a given sector. +- * If one does not exist, allocate an empty page, and insert that. Then +- * return it. ++ * Insert a new page for a given sector, if one does not already exist. + */ +-static struct page *brd_insert_page(struct brd_device *brd, sector_t sector) ++static int brd_insert_page(struct brd_device *brd, sector_t sector) + { + pgoff_t idx; + struct page *page; +@@ -90,7 +88,7 @@ static struct page *brd_insert_page(struct brd_device *brd, sector_t sector) + + page = brd_lookup_page(brd, sector); + if (page) +- return page; ++ return 0; + + /* + * Must use NOIO because we don't want to recurse back into the +@@ -99,11 +97,11 @@ static struct page *brd_insert_page(struct brd_device *brd, sector_t sector) + gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM; + page = alloc_page(gfp_flags); + if (!page) +- return NULL; ++ return -ENOMEM; + + if (radix_tree_preload(GFP_NOIO)) { + __free_page(page); +- return NULL; ++ return -ENOMEM; + } + + spin_lock(&brd->brd_lock); +@@ -120,8 +118,7 @@ static struct page *brd_insert_page(struct brd_device *brd, sector_t sector) + spin_unlock(&brd->brd_lock); + + radix_tree_preload_end(); +- +- return page; ++ return 0; + } + + /* +@@ -174,16 +171,17 @@ static int copy_to_brd_setup(struct brd_device *brd, sector_t sector, size_t n) + { + unsigned int offset = (sector & (PAGE_SECTORS-1)) << SECTOR_SHIFT; + size_t copy; ++ int ret; + + copy = min_t(size_t, n, PAGE_SIZE - offset); +- if (!brd_insert_page(brd, sector)) +- return -ENOSPC; ++ ret = brd_insert_page(brd, sector); ++ if (ret) ++ return ret; + if (copy < n) { + sector += copy >> SECTOR_SHIFT; +- if (!brd_insert_page(brd, sector)) +- return -ENOSPC; ++ ret = brd_insert_page(brd, sector); + } +- return 0; ++ return ret; + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-846-brd-check-for-REQ_NOWAIT-and-set-correct-page-a.patch b/patches.kernel.org/6.2.3-846-brd-check-for-REQ_NOWAIT-and-set-correct-page-a.patch new file mode 100644 index 0000000..a5aa309 --- /dev/null +++ b/patches.kernel.org/6.2.3-846-brd-check-for-REQ_NOWAIT-and-set-correct-page-a.patch @@ -0,0 +1,161 @@ +From: Jens Axboe +Date: Thu, 16 Feb 2023 08:01:08 -0700 +Subject: [PATCH] brd: check for REQ_NOWAIT and set correct page allocation + mask +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6ded703c56c21bfb259725d4f1831a5feb563e9b + +commit 6ded703c56c21bfb259725d4f1831a5feb563e9b upstream. + +If REQ_NOWAIT is set, then do a non-blocking allocation if the operation +is a write and we need to insert a new page. Currently REQ_NOWAIT cannot +be set as the queue isn't marked as supporting nowait, this change is in +preparation for allowing that. + +radix_tree_preload() warns on attempting to call it with an allocation +mask that doesn't allow blocking. While that warning could arguably +be removed, we need to handle radix insertion failures anyway as they +are more likely if we cannot block to get memory. + +Remove legacy BUG_ON()'s and turn them into proper errors instead, one +for the allocation failure and one for finding a page that doesn't +match the correct index. + +Cc: stable@vger.kernel.org # 5.10+ +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/block/brd.c | 48 ++++++++++++++++++++++++++------------------- + 1 file changed, 28 insertions(+), 20 deletions(-) + +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index 39cad8b2..740631dc 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -80,26 +80,21 @@ static struct page *brd_lookup_page(struct brd_device *brd, sector_t sector) + /* + * Insert a new page for a given sector, if one does not already exist. + */ +-static int brd_insert_page(struct brd_device *brd, sector_t sector) ++static int brd_insert_page(struct brd_device *brd, sector_t sector, gfp_t gfp) + { + pgoff_t idx; + struct page *page; +- gfp_t gfp_flags; ++ int ret = 0; + + page = brd_lookup_page(brd, sector); + if (page) + return 0; + +- /* +- * Must use NOIO because we don't want to recurse back into the +- * block or filesystem layers from page reclaim. +- */ +- gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM; +- page = alloc_page(gfp_flags); ++ page = alloc_page(gfp | __GFP_ZERO | __GFP_HIGHMEM); + if (!page) + return -ENOMEM; + +- if (radix_tree_preload(GFP_NOIO)) { ++ if (gfpflags_allow_blocking(gfp) && radix_tree_preload(gfp)) { + __free_page(page); + return -ENOMEM; + } +@@ -110,15 +105,17 @@ static int brd_insert_page(struct brd_device *brd, sector_t sector) + if (radix_tree_insert(&brd->brd_pages, idx, page)) { + __free_page(page); + page = radix_tree_lookup(&brd->brd_pages, idx); +- BUG_ON(!page); +- BUG_ON(page->index != idx); ++ if (!page) ++ ret = -ENOMEM; ++ else if (page->index != idx) ++ ret = -EIO; + } else { + brd->brd_nr_pages++; + } + spin_unlock(&brd->brd_lock); + + radix_tree_preload_end(); +- return 0; ++ return ret; + } + + /* +@@ -167,19 +164,20 @@ static void brd_free_pages(struct brd_device *brd) + /* + * copy_to_brd_setup must be called before copy_to_brd. It may sleep. + */ +-static int copy_to_brd_setup(struct brd_device *brd, sector_t sector, size_t n) ++static int copy_to_brd_setup(struct brd_device *brd, sector_t sector, size_t n, ++ gfp_t gfp) + { + unsigned int offset = (sector & (PAGE_SECTORS-1)) << SECTOR_SHIFT; + size_t copy; + int ret; + + copy = min_t(size_t, n, PAGE_SIZE - offset); +- ret = brd_insert_page(brd, sector); ++ ret = brd_insert_page(brd, sector, gfp); + if (ret) + return ret; + if (copy < n) { + sector += copy >> SECTOR_SHIFT; +- ret = brd_insert_page(brd, sector); ++ ret = brd_insert_page(brd, sector, gfp); + } + return ret; + } +@@ -254,20 +252,26 @@ static void copy_from_brd(void *dst, struct brd_device *brd, + * Process a single bvec of a bio. + */ + static int brd_do_bvec(struct brd_device *brd, struct page *page, +- unsigned int len, unsigned int off, enum req_op op, ++ unsigned int len, unsigned int off, blk_opf_t opf, + sector_t sector) + { + void *mem; + int err = 0; + +- if (op_is_write(op)) { +- err = copy_to_brd_setup(brd, sector, len); ++ if (op_is_write(opf)) { ++ /* ++ * Must use NOIO because we don't want to recurse back into the ++ * block or filesystem layers from page reclaim. ++ */ ++ gfp_t gfp = opf & REQ_NOWAIT ? GFP_NOWAIT : GFP_NOIO; ++ ++ err = copy_to_brd_setup(brd, sector, len, gfp); + if (err) + goto out; + } + + mem = kmap_atomic(page); +- if (!op_is_write(op)) { ++ if (!op_is_write(opf)) { + copy_from_brd(mem + off, brd, sector, len); + flush_dcache_page(page); + } else { +@@ -296,8 +300,12 @@ static void brd_submit_bio(struct bio *bio) + (len & (SECTOR_SIZE - 1))); + + err = brd_do_bvec(brd, bvec.bv_page, len, bvec.bv_offset, +- bio_op(bio), sector); ++ bio->bi_opf, sector); + if (err) { ++ if (err == -ENOMEM && bio->bi_opf & REQ_NOWAIT) { ++ bio_wouldblock_error(bio); ++ return; ++ } + bio_io_error(bio); + return; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-847-ima-fix-error-handling-logic-when-file-measurem.patch b/patches.kernel.org/6.2.3-847-ima-fix-error-handling-logic-when-file-measurem.patch new file mode 100644 index 0000000..6fbfced --- /dev/null +++ b/patches.kernel.org/6.2.3-847-ima-fix-error-handling-logic-when-file-measurem.patch @@ -0,0 +1,53 @@ +From: Matt Bobrowski +Date: Wed, 4 Jan 2023 03:41:44 +0000 +Subject: [PATCH] ima: fix error handling logic when file measurement failed +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6dc387d52eb67f45d68caa263704fa4e39ef8e76 + +commit 6dc387d52eb67f45d68caa263704fa4e39ef8e76 upstream. + +Restore the error handling logic so that when file measurement fails, +the respective iint entry is not left with the digest data being +populated with zeroes. + +Fixes: 54f03916fb89 ("ima: permit fsverity's file digests in the IMA measurement list") +Cc: stable@vger.kernel.org # 5.19 +Signed-off-by: Matt Bobrowski +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + security/integrity/ima/ima_api.c | 2 +- + security/integrity/ima/ima_main.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c +index c1e76282..1e3a7a4f 100644 +--- a/security/integrity/ima/ima_api.c ++++ b/security/integrity/ima/ima_api.c +@@ -292,7 +292,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, + result = ima_calc_file_hash(file, &hash.hdr); + } + +- if (result == -ENOMEM) ++ if (result && result != -EBADF && result != -EINVAL) + goto out; + + length = sizeof(hash.hdr) + hash.hdr.length; +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index 37730097..b1ae0f27 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -337,7 +337,7 @@ static int process_measurement(struct file *file, const struct cred *cred, + hash_algo = ima_get_hash_algo(xattr_value, xattr_len); + + rc = ima_collect_measurement(iint, file, buf, size, hash_algo, modsig); +- if (rc == -ENOMEM) ++ if (rc != 0 && rc != -EBADF && rc != -EINVAL) + goto out_locked; + + if (!pathbuf) /* ima_rdwr_violation possibly pre-fetched */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-848-ima-Align-ima_file_mmap-parameters-with-mmap_fi.patch b/patches.kernel.org/6.2.3-848-ima-Align-ima_file_mmap-parameters-with-mmap_fi.patch new file mode 100644 index 0000000..af667e0 --- /dev/null +++ b/patches.kernel.org/6.2.3-848-ima-Align-ima_file_mmap-parameters-with-mmap_fi.patch @@ -0,0 +1,117 @@ +From: Roberto Sassu +Date: Tue, 31 Jan 2023 18:42:43 +0100 +Subject: [PATCH] ima: Align ima_file_mmap() parameters with mmap_file LSM hook +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4971c268b85e1c7a734a61622fc0813c86e2362e + +commit 4971c268b85e1c7a734a61622fc0813c86e2362e upstream. + +Commit 98de59bfe4b2f ("take calculation of final prot in +security_mmap_file() into a helper") moved the code to update prot, to be +the actual protections applied to the kernel, to a new helper called +mmap_prot(). + +However, while without the helper ima_file_mmap() was getting the updated +prot, with the helper ima_file_mmap() gets the original prot, which +contains the protections requested by the application. + +A possible consequence of this change is that, if an application calls +mmap() with only PROT_READ, and the kernel applies PROT_EXEC in addition, +that application would have access to executable memory without having this +event recorded in the IMA measurement list. This situation would occur for +example if the application, before mmap(), calls the personality() system +call with READ_IMPLIES_EXEC as the first argument. + +Align ima_file_mmap() parameters with those of the mmap_file LSM hook, so +that IMA can receive both the requested prot and the final prot. Since the +requested protections are stored in a new variable, and the final +protections are stored in the existing variable, this effectively restores +the original behavior of the MMAP_CHECK hook. + +Cc: stable@vger.kernel.org +Fixes: 98de59bfe4b2 ("take calculation of final prot in security_mmap_file() into a helper") +Signed-off-by: Roberto Sassu +Reviewed-by: Stefan Berger +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + include/linux/ima.h | 6 ++++-- + security/integrity/ima/ima_main.c | 7 +++++-- + security/security.c | 7 ++++--- + 3 files changed, 13 insertions(+), 7 deletions(-) + +diff --git a/include/linux/ima.h b/include/linux/ima.h +index 5a0b2a28..d79fee67 100644 +--- a/include/linux/ima.h ++++ b/include/linux/ima.h +@@ -21,7 +21,8 @@ extern int ima_file_check(struct file *file, int mask); + extern void ima_post_create_tmpfile(struct user_namespace *mnt_userns, + struct inode *inode); + extern void ima_file_free(struct file *file); +-extern int ima_file_mmap(struct file *file, unsigned long prot); ++extern int ima_file_mmap(struct file *file, unsigned long reqprot, ++ unsigned long prot, unsigned long flags); + extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); + extern int ima_load_data(enum kernel_load_data_id id, bool contents); + extern int ima_post_load_data(char *buf, loff_t size, +@@ -76,7 +77,8 @@ static inline void ima_file_free(struct file *file) + return; + } + +-static inline int ima_file_mmap(struct file *file, unsigned long prot) ++static inline int ima_file_mmap(struct file *file, unsigned long reqprot, ++ unsigned long prot, unsigned long flags) + { + return 0; + } +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index b1ae0f27..53dc4380 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -397,7 +397,9 @@ static int process_measurement(struct file *file, const struct cred *cred, + /** + * ima_file_mmap - based on policy, collect/store measurement. + * @file: pointer to the file to be measured (May be NULL) +- * @prot: contains the protection that will be applied by the kernel. ++ * @reqprot: protection requested by the application ++ * @prot: protection that will be applied by the kernel ++ * @flags: operational flags + * + * Measure files being mmapped executable based on the ima_must_measure() + * policy decision. +@@ -405,7 +407,8 @@ static int process_measurement(struct file *file, const struct cred *cred, + * On success return 0. On integrity appraisal error, assuming the file + * is in policy and IMA-appraisal is in enforcing mode, return -EACCES. + */ +-int ima_file_mmap(struct file *file, unsigned long prot) ++int ima_file_mmap(struct file *file, unsigned long reqprot, ++ unsigned long prot, unsigned long flags) + { + u32 secid; + +diff --git a/security/security.c b/security/security.c +index d1571900..174afa4f 100644 +--- a/security/security.c ++++ b/security/security.c +@@ -1661,12 +1661,13 @@ static inline unsigned long mmap_prot(struct file *file, unsigned long prot) + int security_mmap_file(struct file *file, unsigned long prot, + unsigned long flags) + { ++ unsigned long prot_adj = mmap_prot(file, prot); + int ret; +- ret = call_int_hook(mmap_file, 0, file, prot, +- mmap_prot(file, prot), flags); ++ ++ ret = call_int_hook(mmap_file, 0, file, prot, prot_adj, flags); + if (ret) + return ret; +- return ima_file_mmap(file, prot); ++ return ima_file_mmap(file, prot, prot_adj, flags); + } + + int security_mmap_addr(unsigned long addr) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-849-selftests-powerpc-Fix-incorrect-kernel-headers-.patch b/patches.kernel.org/6.2.3-849-selftests-powerpc-Fix-incorrect-kernel-headers-.patch new file mode 100644 index 0000000..b175f5b --- /dev/null +++ b/patches.kernel.org/6.2.3-849-selftests-powerpc-Fix-incorrect-kernel-headers-.patch @@ -0,0 +1,83 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:42 -0500 +Subject: [PATCH] selftests/powerpc: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4f11410bf6da87defe8fd59b0413f0d9f71744da + +commit 4f11410bf6da87defe8fd59b0413f0d9f71744da upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Cc: stable@vger.kernel.org # v5.18+ +Signed-off-by: Mathieu Desnoyers +Acked-by: Shuah Khan +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20230127135755.79929-22-mathieu.desnoyers@efficios.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/powerpc/ptrace/Makefile | 2 +- + tools/testing/selftests/powerpc/security/Makefile | 2 +- + tools/testing/selftests/powerpc/syscalls/Makefile | 2 +- + tools/testing/selftests/powerpc/tm/Makefile | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/ptrace/Makefile b/tools/testing/selftests/powerpc/ptrace/Makefile +index 2f02cb54..cbeeaeae 100644 +--- a/tools/testing/selftests/powerpc/ptrace/Makefile ++++ b/tools/testing/selftests/powerpc/ptrace/Makefile +@@ -33,7 +33,7 @@ TESTS_64 := $(patsubst %,$(OUTPUT)/%,$(TESTS_64)) + $(TESTS_64): CFLAGS += -m64 + $(TM_TESTS): CFLAGS += -I../tm -mhtm + +-CFLAGS += -I../../../../../usr/include -fno-pie ++CFLAGS += $(KHDR_INCLUDES) -fno-pie + + $(OUTPUT)/ptrace-gpr: ptrace-gpr.S + $(OUTPUT)/ptrace-pkey $(OUTPUT)/core-pkey: LDLIBS += -pthread +diff --git a/tools/testing/selftests/powerpc/security/Makefile b/tools/testing/selftests/powerpc/security/Makefile +index 7488315f..e0d979ab 100644 +--- a/tools/testing/selftests/powerpc/security/Makefile ++++ b/tools/testing/selftests/powerpc/security/Makefile +@@ -5,7 +5,7 @@ TEST_PROGS := mitigation-patching.sh + + top_srcdir = ../../../../.. + +-CFLAGS += -I../../../../../usr/include ++CFLAGS += $(KHDR_INCLUDES) + + include ../../lib.mk + +diff --git a/tools/testing/selftests/powerpc/syscalls/Makefile b/tools/testing/selftests/powerpc/syscalls/Makefile +index b63f8459..d1f2648b 100644 +--- a/tools/testing/selftests/powerpc/syscalls/Makefile ++++ b/tools/testing/selftests/powerpc/syscalls/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0-only + TEST_GEN_PROGS := ipc_unmuxed rtas_filter + +-CFLAGS += -I../../../../../usr/include ++CFLAGS += $(KHDR_INCLUDES) + + top_srcdir = ../../../../.. + include ../../lib.mk +diff --git a/tools/testing/selftests/powerpc/tm/Makefile b/tools/testing/selftests/powerpc/tm/Makefile +index 5881e97c..3876805c 100644 +--- a/tools/testing/selftests/powerpc/tm/Makefile ++++ b/tools/testing/selftests/powerpc/tm/Makefile +@@ -17,7 +17,7 @@ $(TEST_GEN_PROGS): ../harness.c ../utils.c + CFLAGS += -mhtm + + $(OUTPUT)/tm-syscall: tm-syscall-asm.S +-$(OUTPUT)/tm-syscall: CFLAGS += -I../../../../../usr/include ++$(OUTPUT)/tm-syscall: CFLAGS += $(KHDR_INCLUDES) + $(OUTPUT)/tm-tmspr: CFLAGS += -pthread + $(OUTPUT)/tm-vmx-unavail: CFLAGS += -pthread -m64 + $(OUTPUT)/tm-resched-dscr: ../pmu/lib.c +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-850-selftests-ftrace-Fix-eprobe-syntax-test-case-to.patch b/patches.kernel.org/6.2.3-850-selftests-ftrace-Fix-eprobe-syntax-test-case-to.patch new file mode 100644 index 0000000..54d84ac --- /dev/null +++ b/patches.kernel.org/6.2.3-850-selftests-ftrace-Fix-eprobe-syntax-test-case-to.patch @@ -0,0 +1,45 @@ +From: "Masami Hiramatsu (Google)" +Date: Tue, 21 Feb 2023 08:49:16 +0900 +Subject: [PATCH] selftests/ftrace: Fix eprobe syntax test case to check filter + support +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a457e944df92789ab31aaf35fae9db064e3c51c4 + +commit a457e944df92789ab31aaf35fae9db064e3c51c4 upstream. + +Fix eprobe syntax test case to check whether the kernel supports the filter +on eprobe for filter syntax test command. Without this fix, this test case +will fail if the kernel supports eprobe but doesn't support the filter on +eprobe. + +Link: https://lore.kernel.org/all/167309834742.640500.379128668288448035.stgit@devnote3/ + +Fixes: 9e14bae7d049 ("selftests/ftrace: Add eprobe syntax error testcase") +Cc: stable@vger.kernel.org +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Acked-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + .../selftests/ftrace/test.d/dynevent/eprobes_syntax_errors.tc | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/dynevent/eprobes_syntax_errors.tc b/tools/testing/selftests/ftrace/test.d/dynevent/eprobes_syntax_errors.tc +index fc1daac7..4f5e8c66 100644 +--- a/tools/testing/selftests/ftrace/test.d/dynevent/eprobes_syntax_errors.tc ++++ b/tools/testing/selftests/ftrace/test.d/dynevent/eprobes_syntax_errors.tc +@@ -22,6 +22,8 @@ check_error 'e:foo/^bar.1 syscalls/sys_enter_openat' # BAD_EVENT_NAME + check_error 'e:foo/bar syscalls/sys_enter_openat arg=^dfd' # BAD_FETCH_ARG + check_error 'e:foo/bar syscalls/sys_enter_openat ^arg=$foo' # BAD_ATTACH_ARG + +-check_error 'e:foo/bar syscalls/sys_enter_openat if ^' # NO_EP_FILTER ++if grep -q '\..*\[if \]' README; then ++ check_error 'e:foo/bar syscalls/sys_enter_openat if ^' # NO_EP_FILTER ++fi + + exit 0 +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-851-selftests-sched-Fix-incorrect-kernel-headers-se.patch b/patches.kernel.org/6.2.3-851-selftests-sched-Fix-incorrect-kernel-headers-se.patch new file mode 100644 index 0000000..6ea9f00 --- /dev/null +++ b/patches.kernel.org/6.2.3-851-selftests-sched-Fix-incorrect-kernel-headers-se.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:45 -0500 +Subject: [PATCH] selftests: sched: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0d2cace5af50806a6b32ab73d367b80e46acda0f + +commit 0d2cace5af50806a6b32ab73d367b80e46acda0f upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/sched/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/sched/Makefile b/tools/testing/selftests/sched/Makefile +index 10c72f14..099ee921 100644 +--- a/tools/testing/selftests/sched/Makefile ++++ b/tools/testing/selftests/sched/Makefile +@@ -4,7 +4,7 @@ ifneq ($(shell $(CC) --version 2>&1 | head -n 1 | grep clang),) + CLANG_FLAGS += -no-integrated-as + endif + +-CFLAGS += -O2 -Wall -g -I./ -I../../../../usr/include/ -Wl,-rpath=./ \ ++CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) -Wl,-rpath=./ \ + $(CLANG_FLAGS) + LDLIBS += -lpthread + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-852-selftests-core-Fix-incorrect-kernel-headers-sea.patch b/patches.kernel.org/6.2.3-852-selftests-core-Fix-incorrect-kernel-headers-sea.patch new file mode 100644 index 0000000..fab791d --- /dev/null +++ b/patches.kernel.org/6.2.3-852-selftests-core-Fix-incorrect-kernel-headers-sea.patch @@ -0,0 +1,40 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:25 -0500 +Subject: [PATCH] selftests: core: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 145df2fdc38f24b3e52e4c2a59b02d874a074fbd + +commit 145df2fdc38f24b3e52e4c2a59b02d874a074fbd upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/core/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/core/Makefile b/tools/testing/selftests/core/Makefile +index f6f2d6f4..ce262d09 100644 +--- a/tools/testing/selftests/core/Makefile ++++ b/tools/testing/selftests/core/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only +-CFLAGS += -g -I../../../../usr/include/ ++CFLAGS += -g $(KHDR_INCLUDES) + + TEST_GEN_PROGS := close_range_test + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-853-selftests-pid_namespace-Fix-incorrect-kernel-he.patch b/patches.kernel.org/6.2.3-853-selftests-pid_namespace-Fix-incorrect-kernel-he.patch new file mode 100644 index 0000000..8659b5b --- /dev/null +++ b/patches.kernel.org/6.2.3-853-selftests-pid_namespace-Fix-incorrect-kernel-he.patch @@ -0,0 +1,41 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:40 -0500 +Subject: [PATCH] selftests: pid_namespace: Fix incorrect kernel headers search + path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e81ff69f66969a16a98a2e0977c1860f1c182c74 + +commit e81ff69f66969a16a98a2e0977c1860f1c182c74 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/pid_namespace/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/pid_namespace/Makefile b/tools/testing/selftests/pid_namespace/Makefile +index edafaca1..9286a1d2 100644 +--- a/tools/testing/selftests/pid_namespace/Makefile ++++ b/tools/testing/selftests/pid_namespace/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-CFLAGS += -g -I../../../../usr/include/ ++CFLAGS += -g $(KHDR_INCLUDES) + + TEST_GEN_PROGS = regression_enomem + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-854-selftests-arm64-Fix-incorrect-kernel-headers-se.patch b/patches.kernel.org/6.2.3-854-selftests-arm64-Fix-incorrect-kernel-headers-se.patch new file mode 100644 index 0000000..fcdb9f8 --- /dev/null +++ b/patches.kernel.org/6.2.3-854-selftests-arm64-Fix-incorrect-kernel-headers-se.patch @@ -0,0 +1,57 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:22 -0500 +Subject: [PATCH] selftests: arm64: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7482c19173b7eb044d476b3444d7ee55bc669d03 + +commit 7482c19173b7eb044d476b3444d7ee55bc669d03 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Acked-by: Shuah Khan +Acked-by: Catalin Marinas +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/arm64/fp/Makefile | 2 +- + tools/testing/selftests/arm64/tags/Makefile | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/arm64/fp/Makefile b/tools/testing/selftests/arm64/fp/Makefile +index 36db6135..932ec879 100644 +--- a/tools/testing/selftests/arm64/fp/Makefile ++++ b/tools/testing/selftests/arm64/fp/Makefile +@@ -3,7 +3,7 @@ + # A proper top_srcdir is needed by KSFT(lib.mk) + top_srcdir = $(realpath ../../../../../) + +-CFLAGS += -I$(top_srcdir)/usr/include/ ++CFLAGS += $(KHDR_INCLUDES) + + TEST_GEN_PROGS := fp-stress \ + sve-ptrace sve-probe-vls \ +diff --git a/tools/testing/selftests/arm64/tags/Makefile b/tools/testing/selftests/arm64/tags/Makefile +index 41cb7507..6d29cfde 100644 +--- a/tools/testing/selftests/arm64/tags/Makefile ++++ b/tools/testing/selftests/arm64/tags/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + +-CFLAGS += -I../../../../../usr/include/ ++CFLAGS += $(KHDR_INCLUDES) + TEST_GEN_PROGS := tags_test + TEST_PROGS := run_tags_test.sh + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-855-selftests-clone3-Fix-incorrect-kernel-headers-s.patch b/patches.kernel.org/6.2.3-855-selftests-clone3-Fix-incorrect-kernel-headers-s.patch new file mode 100644 index 0000000..19d9f11 --- /dev/null +++ b/patches.kernel.org/6.2.3-855-selftests-clone3-Fix-incorrect-kernel-headers-s.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:24 -0500 +Subject: [PATCH] selftests: clone3: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 612cf4d283414a5ee2733db6608d917deb45fa46 + +commit 612cf4d283414a5ee2733db6608d917deb45fa46 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Acked-by: Shuah Khan +Acked-by: Christian Brauner +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/clone3/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/clone3/Makefile b/tools/testing/selftests/clone3/Makefile +index 79b19a28..84832c36 100644 +--- a/tools/testing/selftests/clone3/Makefile ++++ b/tools/testing/selftests/clone3/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-CFLAGS += -g -std=gnu99 -I../../../../usr/include/ ++CFLAGS += -g -std=gnu99 $(KHDR_INCLUDES) + LDLIBS += -lcap + + TEST_GEN_PROGS := clone3 clone3_clear_sighand clone3_set_tid \ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-856-selftests-pidfd-Fix-incorrect-kernel-headers-se.patch b/patches.kernel.org/6.2.3-856-selftests-pidfd-Fix-incorrect-kernel-headers-se.patch new file mode 100644 index 0000000..14b6f91 --- /dev/null +++ b/patches.kernel.org/6.2.3-856-selftests-pidfd-Fix-incorrect-kernel-headers-se.patch @@ -0,0 +1,40 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:41 -0500 +Subject: [PATCH] selftests: pidfd: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3f7d71768795c386019f2295c1986d00035c9f0f + +commit 3f7d71768795c386019f2295c1986d00035c9f0f upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/pidfd/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/pidfd/Makefile b/tools/testing/selftests/pidfd/Makefile +index 778b6cdc..d731e3e7 100644 +--- a/tools/testing/selftests/pidfd/Makefile ++++ b/tools/testing/selftests/pidfd/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only +-CFLAGS += -g -I../../../../usr/include/ -pthread -Wall ++CFLAGS += -g $(KHDR_INCLUDES) -pthread -Wall + + TEST_GEN_PROGS := pidfd_test pidfd_fdinfo_test pidfd_open_test \ + pidfd_poll_test pidfd_wait pidfd_getfd_test pidfd_setns_test +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-857-selftests-membarrier-Fix-incorrect-kernel-heade.patch b/patches.kernel.org/6.2.3-857-selftests-membarrier-Fix-incorrect-kernel-heade.patch new file mode 100644 index 0000000..eee7fa9 --- /dev/null +++ b/patches.kernel.org/6.2.3-857-selftests-membarrier-Fix-incorrect-kernel-heade.patch @@ -0,0 +1,41 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:35 -0500 +Subject: [PATCH] selftests: membarrier: Fix incorrect kernel headers search + path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 498bb027726371ba4a94686d251f9be1d437573e + +commit 498bb027726371ba4a94686d251f9be1d437573e upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/membarrier/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/membarrier/Makefile b/tools/testing/selftests/membarrier/Makefile +index 34d1c81a..fc840e06 100644 +--- a/tools/testing/selftests/membarrier/Makefile ++++ b/tools/testing/selftests/membarrier/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only +-CFLAGS += -g -I../../../../usr/include/ ++CFLAGS += -g $(KHDR_INCLUDES) + LDLIBS += -lpthread + + TEST_GEN_PROGS := membarrier_test_single_thread \ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-858-selftests-kcmp-Fix-incorrect-kernel-headers-sea.patch b/patches.kernel.org/6.2.3-858-selftests-kcmp-Fix-incorrect-kernel-headers-sea.patch new file mode 100644 index 0000000..3bfc058 --- /dev/null +++ b/patches.kernel.org/6.2.3-858-selftests-kcmp-Fix-incorrect-kernel-headers-sea.patch @@ -0,0 +1,40 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:33 -0500 +Subject: [PATCH] selftests: kcmp: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5d74231a2caad259f6669d8d6112814cef6bcd60 + +commit 5d74231a2caad259f6669d8d6112814cef6bcd60 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/kcmp/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/kcmp/Makefile b/tools/testing/selftests/kcmp/Makefile +index b4d39f6b..59a1e537 100644 +--- a/tools/testing/selftests/kcmp/Makefile ++++ b/tools/testing/selftests/kcmp/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only +-CFLAGS += -I../../../../usr/include/ ++CFLAGS += $(KHDR_INCLUDES) + + TEST_GEN_PROGS := kcmp_test + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-859-selftests-media_tests-Fix-incorrect-kernel-head.patch b/patches.kernel.org/6.2.3-859-selftests-media_tests-Fix-incorrect-kernel-head.patch new file mode 100644 index 0000000..44cdac5 --- /dev/null +++ b/patches.kernel.org/6.2.3-859-selftests-media_tests-Fix-incorrect-kernel-head.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:34 -0500 +Subject: [PATCH] selftests: media_tests: Fix incorrect kernel headers search + path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f2f9592b736087f695230410fb8dc1afd3cafbbb + +commit f2f9592b736087f695230410fb8dc1afd3cafbbb upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/media_tests/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/media_tests/Makefile b/tools/testing/selftests/media_tests/Makefile +index 60826d7d..471d83e6 100644 +--- a/tools/testing/selftests/media_tests/Makefile ++++ b/tools/testing/selftests/media_tests/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + # +-CFLAGS += -I../ -I../../../../usr/include/ ++CFLAGS += -I../ $(KHDR_INCLUDES) + TEST_GEN_PROGS := media_device_test media_device_open video_device_test + + include ../lib.mk +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-860-selftests-gpio-Fix-incorrect-kernel-headers-sea.patch b/patches.kernel.org/6.2.3-860-selftests-gpio-Fix-incorrect-kernel-headers-sea.patch new file mode 100644 index 0000000..279d8f1 --- /dev/null +++ b/patches.kernel.org/6.2.3-860-selftests-gpio-Fix-incorrect-kernel-headers-sea.patch @@ -0,0 +1,41 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:31 -0500 +Subject: [PATCH] selftests: gpio: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8bb9c1808628babcc7b99ec2439bf102379bd4ac + +commit 8bb9c1808628babcc7b99ec2439bf102379bd4ac upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/gpio/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/gpio/Makefile b/tools/testing/selftests/gpio/Makefile +index 616ed401..e0884390 100644 +--- a/tools/testing/selftests/gpio/Makefile ++++ b/tools/testing/selftests/gpio/Makefile +@@ -3,6 +3,6 @@ + TEST_PROGS := gpio-mockup.sh gpio-sim.sh + TEST_FILES := gpio-mockup-sysfs.sh + TEST_GEN_PROGS_EXTENDED := gpio-mockup-cdev gpio-chip-info gpio-line-name +-CFLAGS += -O2 -g -Wall -I../../../../usr/include/ $(KHDR_INCLUDES) ++CFLAGS += -O2 -g -Wall $(KHDR_INCLUDES) + + include ../lib.mk +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-861-selftests-filesystems-Fix-incorrect-kernel-head.patch b/patches.kernel.org/6.2.3-861-selftests-filesystems-Fix-incorrect-kernel-head.patch new file mode 100644 index 0000000..46bf4dc --- /dev/null +++ b/patches.kernel.org/6.2.3-861-selftests-filesystems-Fix-incorrect-kernel-head.patch @@ -0,0 +1,68 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:29 -0500 +Subject: [PATCH] selftests: filesystems: Fix incorrect kernel headers search + path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c2d3cf3653a8ff6e4b402d55e7f84790ac08a8ad + +commit c2d3cf3653a8ff6e4b402d55e7f84790ac08a8ad upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/filesystems/Makefile | 2 +- + tools/testing/selftests/filesystems/binderfs/Makefile | 2 +- + tools/testing/selftests/filesystems/epoll/Makefile | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/filesystems/Makefile b/tools/testing/selftests/filesystems/Makefile +index 129880fb..c647fd6a 100644 +--- a/tools/testing/selftests/filesystems/Makefile ++++ b/tools/testing/selftests/filesystems/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + +-CFLAGS += -I../../../../usr/include/ ++CFLAGS += $(KHDR_INCLUDES) + TEST_GEN_PROGS := devpts_pts + TEST_GEN_PROGS_EXTENDED := dnotify_test + +diff --git a/tools/testing/selftests/filesystems/binderfs/Makefile b/tools/testing/selftests/filesystems/binderfs/Makefile +index 8af25ae9..c2f7cef9 100644 +--- a/tools/testing/selftests/filesystems/binderfs/Makefile ++++ b/tools/testing/selftests/filesystems/binderfs/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + +-CFLAGS += -I../../../../../usr/include/ -pthread ++CFLAGS += $(KHDR_INCLUDES) -pthread + TEST_GEN_PROGS := binderfs_test + + binderfs_test: binderfs_test.c ../../kselftest.h ../../kselftest_harness.h +diff --git a/tools/testing/selftests/filesystems/epoll/Makefile b/tools/testing/selftests/filesystems/epoll/Makefile +index 78ae4aaf..0788a7dc 100644 +--- a/tools/testing/selftests/filesystems/epoll/Makefile ++++ b/tools/testing/selftests/filesystems/epoll/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + +-CFLAGS += -I../../../../../usr/include/ ++CFLAGS += $(KHDR_INCLUDES) + LDLIBS += -lpthread + TEST_GEN_PROGS := epoll_wakeup_test + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-862-selftests-user_events-Fix-incorrect-kernel-head.patch b/patches.kernel.org/6.2.3-862-selftests-user_events-Fix-incorrect-kernel-head.patch new file mode 100644 index 0000000..ca52ad2 --- /dev/null +++ b/patches.kernel.org/6.2.3-862-selftests-user_events-Fix-incorrect-kernel-head.patch @@ -0,0 +1,41 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:48 -0500 +Subject: [PATCH] selftests: user_events: Fix incorrect kernel headers search + path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f3886fd28987c119a98493f625cb9940b5f1c9a0 + +commit f3886fd28987c119a98493f625cb9940b5f1c9a0 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/user_events/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/user_events/Makefile b/tools/testing/selftests/user_events/Makefile +index c765d863..87d54c64 100644 +--- a/tools/testing/selftests/user_events/Makefile ++++ b/tools/testing/selftests/user_events/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-CFLAGS += -Wl,-no-as-needed -Wall -I../../../../usr/include ++CFLAGS += -Wl,-no-as-needed -Wall $(KHDR_INCLUDES) + LDLIBS += -lrt -lpthread -lm + + TEST_GEN_PROGS = ftrace_test dyn_test perf_test +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-863-selftests-ptp-Fix-incorrect-kernel-headers-sear.patch b/patches.kernel.org/6.2.3-863-selftests-ptp-Fix-incorrect-kernel-headers-sear.patch new file mode 100644 index 0000000..4aa3ee2 --- /dev/null +++ b/patches.kernel.org/6.2.3-863-selftests-ptp-Fix-incorrect-kernel-headers-sear.patch @@ -0,0 +1,40 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:43 -0500 +Subject: [PATCH] selftests: ptp: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 01ede99e9de16e7a1ed689c99f41022aa878f2f4 + +commit 01ede99e9de16e7a1ed689c99f41022aa878f2f4 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/ptp/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/ptp/Makefile b/tools/testing/selftests/ptp/Makefile +index ef06de08..eeab44cc 100644 +--- a/tools/testing/selftests/ptp/Makefile ++++ b/tools/testing/selftests/ptp/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-CFLAGS += -I../../../../usr/include/ ++CFLAGS += $(KHDR_INCLUDES) + TEST_PROGS := testptp + LDLIBS += -lrt + all: $(TEST_PROGS) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-864-selftests-sync-Fix-incorrect-kernel-headers-sea.patch b/patches.kernel.org/6.2.3-864-selftests-sync-Fix-incorrect-kernel-headers-sea.patch new file mode 100644 index 0000000..a7f0056 --- /dev/null +++ b/patches.kernel.org/6.2.3-864-selftests-sync-Fix-incorrect-kernel-headers-sea.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:47 -0500 +Subject: [PATCH] selftests: sync: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5ad0c8e42c13623bd996e19ce76f2596e16eb0db + +commit 5ad0c8e42c13623bd996e19ce76f2596e16eb0db upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Acked-by: Shuah Khan +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/sync/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/sync/Makefile b/tools/testing/selftests/sync/Makefile +index d0121a8a..df0f91bf 100644 +--- a/tools/testing/selftests/sync/Makefile ++++ b/tools/testing/selftests/sync/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + CFLAGS += -O2 -g -std=gnu89 -pthread -Wall -Wextra +-CFLAGS += -I../../../../usr/include/ ++CFLAGS += $(KHDR_INCLUDES) + LDFLAGS += -pthread + + .PHONY: all clean +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-865-selftests-rseq-Fix-incorrect-kernel-headers-sea.patch b/patches.kernel.org/6.2.3-865-selftests-rseq-Fix-incorrect-kernel-headers-sea.patch new file mode 100644 index 0000000..da25ab0 --- /dev/null +++ b/patches.kernel.org/6.2.3-865-selftests-rseq-Fix-incorrect-kernel-headers-sea.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:44 -0500 +Subject: [PATCH] selftests: rseq: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2279bfc03211045c8f43a76b01889a5ca86acd5a + +commit 2279bfc03211045c8f43a76b01889a5ca86acd5a upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/rseq/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/rseq/Makefile b/tools/testing/selftests/rseq/Makefile +index 215e1067..3a173e18 100644 +--- a/tools/testing/selftests/rseq/Makefile ++++ b/tools/testing/selftests/rseq/Makefile +@@ -4,7 +4,7 @@ ifneq ($(shell $(CC) --version 2>&1 | head -n 1 | grep clang),) + CLANG_FLAGS += -no-integrated-as + endif + +-CFLAGS += -O2 -Wall -g -I./ -I../../../../usr/include/ -L$(OUTPUT) -Wl,-rpath=./ \ ++CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) -L$(OUTPUT) -Wl,-rpath=./ \ + $(CLANG_FLAGS) + LDLIBS += -lpthread -ldl + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-866-selftests-move_mount_set_group-Fix-incorrect-ke.patch b/patches.kernel.org/6.2.3-866-selftests-move_mount_set_group-Fix-incorrect-ke.patch new file mode 100644 index 0000000..ad006bb --- /dev/null +++ b/patches.kernel.org/6.2.3-866-selftests-move_mount_set_group-Fix-incorrect-ke.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:37 -0500 +Subject: [PATCH] selftests: move_mount_set_group: Fix incorrect kernel headers + search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 65c68af0131bfef8e395c325735b6c40638cb931 + +commit 65c68af0131bfef8e395c325735b6c40638cb931 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/move_mount_set_group/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/move_mount_set_group/Makefile b/tools/testing/selftests/move_mount_set_group/Makefile +index 80c2d868..94235846 100644 +--- a/tools/testing/selftests/move_mount_set_group/Makefile ++++ b/tools/testing/selftests/move_mount_set_group/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + # Makefile for mount selftests. +-CFLAGS = -g -I../../../../usr/include/ -Wall -O2 ++CFLAGS = -g $(KHDR_INCLUDES) -Wall -O2 + + TEST_GEN_FILES += move_mount_set_group_test + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-867-selftests-mount_setattr-Fix-incorrect-kernel-he.patch b/patches.kernel.org/6.2.3-867-selftests-mount_setattr-Fix-incorrect-kernel-he.patch new file mode 100644 index 0000000..49feeb3 --- /dev/null +++ b/patches.kernel.org/6.2.3-867-selftests-mount_setattr-Fix-incorrect-kernel-he.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:36 -0500 +Subject: [PATCH] selftests: mount_setattr: Fix incorrect kernel headers search + path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5d11f2d0eb39d2b5c5e8f05e1f650c4a4de69918 + +commit 5d11f2d0eb39d2b5c5e8f05e1f650c4a4de69918 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/mount_setattr/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/mount_setattr/Makefile b/tools/testing/selftests/mount_setattr/Makefile +index 2250f7dc..fde72df0 100644 +--- a/tools/testing/selftests/mount_setattr/Makefile ++++ b/tools/testing/selftests/mount_setattr/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + # Makefile for mount selftests. +-CFLAGS = -g -I../../../../usr/include/ -Wall -O2 -pthread ++CFLAGS = -g $(KHDR_INCLUDES) -Wall -O2 -pthread + + TEST_GEN_FILES += mount_setattr_test + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-868-selftests-perf_events-Fix-incorrect-kernel-head.patch b/patches.kernel.org/6.2.3-868-selftests-perf_events-Fix-incorrect-kernel-head.patch new file mode 100644 index 0000000..56b5b47 --- /dev/null +++ b/patches.kernel.org/6.2.3-868-selftests-perf_events-Fix-incorrect-kernel-head.patch @@ -0,0 +1,41 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:39 -0500 +Subject: [PATCH] selftests: perf_events: Fix incorrect kernel headers search + path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 465cbb1b9a9fd5f6907adb2d761facaf1a46bfbe + +commit 465cbb1b9a9fd5f6907adb2d761facaf1a46bfbe upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/perf_events/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/perf_events/Makefile b/tools/testing/selftests/perf_events/Makefile +index fcafa5f0..db93c4ff 100644 +--- a/tools/testing/selftests/perf_events/Makefile ++++ b/tools/testing/selftests/perf_events/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-CFLAGS += -Wl,-no-as-needed -Wall -I../../../../usr/include ++CFLAGS += -Wl,-no-as-needed -Wall $(KHDR_INCLUDES) + LDFLAGS += -lpthread + + TEST_GEN_PROGS := sigtrap_threads remove_on_exec +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-869-selftests-ipc-Fix-incorrect-kernel-headers-sear.patch b/patches.kernel.org/6.2.3-869-selftests-ipc-Fix-incorrect-kernel-headers-sear.patch new file mode 100644 index 0000000..968d383 --- /dev/null +++ b/patches.kernel.org/6.2.3-869-selftests-ipc-Fix-incorrect-kernel-headers-sear.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:32 -0500 +Subject: [PATCH] selftests: ipc: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ecf9fdb5c2a9d63c732acccb6318feb73dd1589f + +commit ecf9fdb5c2a9d63c732acccb6318feb73dd1589f upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/ipc/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/ipc/Makefile b/tools/testing/selftests/ipc/Makefile +index 1c4448a8..50e9c299 100644 +--- a/tools/testing/selftests/ipc/Makefile ++++ b/tools/testing/selftests/ipc/Makefile +@@ -10,7 +10,7 @@ ifeq ($(ARCH),x86_64) + CFLAGS := -DCONFIG_X86_64 -D__x86_64__ + endif + +-CFLAGS += -I../../../../usr/include/ ++CFLAGS += $(KHDR_INCLUDES) + + TEST_GEN_PROGS := msgque + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-870-selftests-futex-Fix-incorrect-kernel-headers-se.patch b/patches.kernel.org/6.2.3-870-selftests-futex-Fix-incorrect-kernel-headers-se.patch new file mode 100644 index 0000000..3426466 --- /dev/null +++ b/patches.kernel.org/6.2.3-870-selftests-futex-Fix-incorrect-kernel-headers-se.patch @@ -0,0 +1,40 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:30 -0500 +Subject: [PATCH] selftests: futex: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 24c55275ba0d538def2b1220002d0e808a85d50f + +commit 24c55275ba0d538def2b1220002d0e808a85d50f upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/futex/functional/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile +index 5a0e0df8..a392d091 100644 +--- a/tools/testing/selftests/futex/functional/Makefile ++++ b/tools/testing/selftests/futex/functional/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-INCLUDES := -I../include -I../../ -I../../../../../usr/include/ ++INCLUDES := -I../include -I../../ $(KHDR_INCLUDES) + CFLAGS := $(CFLAGS) -g -O2 -Wall -D_GNU_SOURCE -pthread $(INCLUDES) $(KHDR_INCLUDES) + LDLIBS := -lpthread -lrt + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-871-selftests-drivers-Fix-incorrect-kernel-headers-.patch b/patches.kernel.org/6.2.3-871-selftests-drivers-Fix-incorrect-kernel-headers-.patch new file mode 100644 index 0000000..f644476 --- /dev/null +++ b/patches.kernel.org/6.2.3-871-selftests-drivers-Fix-incorrect-kernel-headers-.patch @@ -0,0 +1,57 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:28 -0500 +Subject: [PATCH] selftests: drivers: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 07f0148aafe8c95a3a76cd59e9e75b4d78d1d31d + +commit 07f0148aafe8c95a3a76cd59e9e75b4d78d1d31d upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/drivers/dma-buf/Makefile | 2 +- + tools/testing/selftests/drivers/s390x/uvdevice/Makefile | 3 +-- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/drivers/dma-buf/Makefile b/tools/testing/selftests/drivers/dma-buf/Makefile +index 79cb16b4..441407bb 100644 +--- a/tools/testing/selftests/drivers/dma-buf/Makefile ++++ b/tools/testing/selftests/drivers/dma-buf/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only +-CFLAGS += -I../../../../../usr/include/ ++CFLAGS += $(KHDR_INCLUDES) + + TEST_GEN_PROGS := udmabuf + +diff --git a/tools/testing/selftests/drivers/s390x/uvdevice/Makefile b/tools/testing/selftests/drivers/s390x/uvdevice/Makefile +index 891215a7..755d1643 100644 +--- a/tools/testing/selftests/drivers/s390x/uvdevice/Makefile ++++ b/tools/testing/selftests/drivers/s390x/uvdevice/Makefile +@@ -11,10 +11,9 @@ else + TEST_GEN_PROGS := test_uvdevice + + top_srcdir ?= ../../../../../.. +-khdr_dir = $(top_srcdir)/usr/include + LINUX_TOOL_ARCH_INCLUDE = $(top_srcdir)/tools/arch/$(ARCH)/include + +-CFLAGS += -Wall -Werror -static -I$(khdr_dir) -I$(LINUX_TOOL_ARCH_INCLUDE) ++CFLAGS += -Wall -Werror -static $(KHDR_INCLUDES) -I$(LINUX_TOOL_ARCH_INCLUDE) + + include ../../../lib.mk + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-872-selftests-dmabuf-heaps-Fix-incorrect-kernel-hea.patch b/patches.kernel.org/6.2.3-872-selftests-dmabuf-heaps-Fix-incorrect-kernel-hea.patch new file mode 100644 index 0000000..f277f11 --- /dev/null +++ b/patches.kernel.org/6.2.3-872-selftests-dmabuf-heaps-Fix-incorrect-kernel-hea.patch @@ -0,0 +1,58 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:27 -0500 +Subject: [PATCH] selftests: dmabuf-heaps: Fix incorrect kernel headers search + path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f80f09b59fdd45753dd80ac623981ad00ece4c2d + +commit f80f09b59fdd45753dd80ac623981ad00ece4c2d upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/dmabuf-heaps/Makefile | 2 +- + tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 3 +-- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/dmabuf-heaps/Makefile b/tools/testing/selftests/dmabuf-heaps/Makefile +index 604b43ec..9e7e158d 100644 +--- a/tools/testing/selftests/dmabuf-heaps/Makefile ++++ b/tools/testing/selftests/dmabuf-heaps/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-CFLAGS += -static -O3 -Wl,-no-as-needed -Wall ++CFLAGS += -static -O3 -Wl,-no-as-needed -Wall $(KHDR_INCLUDES) + + TEST_GEN_PROGS = dmabuf-heap + +diff --git a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c +index 29af27ac..890a8236 100644 +--- a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c ++++ b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c +@@ -13,10 +13,9 @@ + #include + + #include ++#include + #include + +-#include "../../../../include/uapi/linux/dma-heap.h" +- + #define DEVPATH "/dev/dma_heap" + + static int check_vgem(int fd) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-873-selftests-vm-Fix-incorrect-kernel-headers-searc.patch b/patches.kernel.org/6.2.3-873-selftests-vm-Fix-incorrect-kernel-headers-searc.patch new file mode 100644 index 0000000..ab548b3 --- /dev/null +++ b/patches.kernel.org/6.2.3-873-selftests-vm-Fix-incorrect-kernel-headers-searc.patch @@ -0,0 +1,42 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:49 -0500 +Subject: [PATCH] selftests: vm: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8eb3751c73bec746f61fb6bada60d1074d92b8c3 + +commit 8eb3751c73bec746f61fb6bada60d1074d92b8c3 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/vm/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile +index 89c14e41..ac936606 100644 +--- a/tools/testing/selftests/vm/Makefile ++++ b/tools/testing/selftests/vm/Makefile +@@ -25,7 +25,7 @@ MACHINE ?= $(shell echo $(uname_M) | sed -e 's/aarch64.*/arm64/' -e 's/ppc64.*/p + # LDLIBS. + MAKEFLAGS += --no-builtin-rules + +-CFLAGS = -Wall -I $(top_srcdir) -I $(top_srcdir)/usr/include $(EXTRA_CFLAGS) $(KHDR_INCLUDES) ++CFLAGS = -Wall -I $(top_srcdir) $(EXTRA_CFLAGS) $(KHDR_INCLUDES) + LDLIBS = -lrt -lpthread + TEST_GEN_FILES = cow + TEST_GEN_FILES += compaction_test +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-874-selftests-seccomp-Fix-incorrect-kernel-headers-.patch b/patches.kernel.org/6.2.3-874-selftests-seccomp-Fix-incorrect-kernel-headers-.patch new file mode 100644 index 0000000..bc772df --- /dev/null +++ b/patches.kernel.org/6.2.3-874-selftests-seccomp-Fix-incorrect-kernel-headers-.patch @@ -0,0 +1,40 @@ +From: Mathieu Desnoyers +Date: Fri, 27 Jan 2023 08:57:46 -0500 +Subject: [PATCH] selftests: seccomp: Fix incorrect kernel headers search path +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 07d42dd854446ba3177ad7a217870a5b4edee165 + +commit 07d42dd854446ba3177ad7a217870a5b4edee165 upstream. + +Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents +building against kernel headers from the build environment in scenarios +where kernel headers are installed into a specific output directory +(O=...). + +Signed-off-by: Mathieu Desnoyers +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Cc: Ingo Molnar +Cc: # 5.18+ +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/selftests/seccomp/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile +index f017c382..584fba48 100644 +--- a/tools/testing/selftests/seccomp/Makefile ++++ b/tools/testing/selftests/seccomp/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-CFLAGS += -Wl,-no-as-needed -Wall -isystem ../../../../usr/include/ ++CFLAGS += -Wl,-no-as-needed -Wall $(KHDR_INCLUDES) + LDFLAGS += -lpthread + LDLIBS += -lcap + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-875-irqdomain-Fix-association-race.patch b/patches.kernel.org/6.2.3-875-irqdomain-Fix-association-race.patch new file mode 100644 index 0000000..2bdbbf6 --- /dev/null +++ b/patches.kernel.org/6.2.3-875-irqdomain-Fix-association-race.patch @@ -0,0 +1,89 @@ +From: Johan Hovold +Date: Mon, 13 Feb 2023 11:42:43 +0100 +Subject: [PATCH] irqdomain: Fix association race +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b06730a571a9ff1ba5bd6b20bf9e50e5a12f1ec6 + +commit b06730a571a9ff1ba5bd6b20bf9e50e5a12f1ec6 upstream. + +The sanity check for an already mapped virq is done outside of the +irq_domain_mutex-protected section which means that an (unlikely) racing +association may not be detected. + +Fix this by factoring out the association implementation, which will +also be used in a follow-on change to fix a shared-interrupt mapping +race. + +Fixes: ddaf144c61da ("irqdomain: Refactor irq_domain_associate_many()") +Cc: stable@vger.kernel.org # 3.11 +Tested-by: Hsin-Yi Wang +Tested-by: Mark-PK Tsai +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-2-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/irq/irqdomain.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 798a9042..561689a3 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -559,8 +559,8 @@ static void irq_domain_disassociate(struct irq_domain *domain, unsigned int irq) + irq_domain_clear_mapping(domain, hwirq); + } + +-int irq_domain_associate(struct irq_domain *domain, unsigned int virq, +- irq_hw_number_t hwirq) ++static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq, ++ irq_hw_number_t hwirq) + { + struct irq_data *irq_data = irq_get_irq_data(virq); + int ret; +@@ -573,7 +573,6 @@ int irq_domain_associate(struct irq_domain *domain, unsigned int virq, + if (WARN(irq_data->domain, "error: virq%i is already associated", virq)) + return -EINVAL; + +- mutex_lock(&irq_domain_mutex); + irq_data->hwirq = hwirq; + irq_data->domain = domain; + if (domain->ops->map) { +@@ -590,7 +589,6 @@ int irq_domain_associate(struct irq_domain *domain, unsigned int virq, + } + irq_data->domain = NULL; + irq_data->hwirq = 0; +- mutex_unlock(&irq_domain_mutex); + return ret; + } + +@@ -601,12 +599,23 @@ int irq_domain_associate(struct irq_domain *domain, unsigned int virq, + + domain->mapcount++; + irq_domain_set_mapping(domain, hwirq, irq_data); +- mutex_unlock(&irq_domain_mutex); + + irq_clear_status_flags(virq, IRQ_NOREQUEST); + + return 0; + } ++ ++int irq_domain_associate(struct irq_domain *domain, unsigned int virq, ++ irq_hw_number_t hwirq) ++{ ++ int ret; ++ ++ mutex_lock(&irq_domain_mutex); ++ ret = irq_domain_associate_locked(domain, virq, hwirq); ++ mutex_unlock(&irq_domain_mutex); ++ ++ return ret; ++} + EXPORT_SYMBOL_GPL(irq_domain_associate); + + void irq_domain_associate_many(struct irq_domain *domain, unsigned int irq_base, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-876-irqdomain-Fix-disassociation-race.patch b/patches.kernel.org/6.2.3-876-irqdomain-Fix-disassociation-race.patch new file mode 100644 index 0000000..d7f3441 --- /dev/null +++ b/patches.kernel.org/6.2.3-876-irqdomain-Fix-disassociation-race.patch @@ -0,0 +1,57 @@ +From: Johan Hovold +Date: Mon, 13 Feb 2023 11:42:44 +0100 +Subject: [PATCH] irqdomain: Fix disassociation race +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3f883c38f5628f46b30bccf090faec054088e262 + +commit 3f883c38f5628f46b30bccf090faec054088e262 upstream. + +The global irq_domain_mutex is held when mapping interrupts from +non-hierarchical domains but currently not when disposing them. + +This specifically means that updates of the domain mapcount is racy +(currently only used for statistics in debugfs). + +Make sure to hold the global irq_domain_mutex also when disposing +mappings from non-hierarchical domains. + +Fixes: 9dc6be3d4193 ("genirq/irqdomain: Add map counter") +Cc: stable@vger.kernel.org # 4.13 +Tested-by: Hsin-Yi Wang +Tested-by: Mark-PK Tsai +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-3-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/irq/irqdomain.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 561689a3..981cd636 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -538,6 +538,9 @@ static void irq_domain_disassociate(struct irq_domain *domain, unsigned int irq) + return; + + hwirq = irq_data->hwirq; ++ ++ mutex_lock(&irq_domain_mutex); ++ + irq_set_status_flags(irq, IRQ_NOREQUEST); + + /* remove chip and handler */ +@@ -557,6 +560,8 @@ static void irq_domain_disassociate(struct irq_domain *domain, unsigned int irq) + + /* Clear reverse map for this hwirq */ + irq_domain_clear_mapping(domain, hwirq); ++ ++ mutex_unlock(&irq_domain_mutex); + } + + static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-877-irqdomain-Look-for-existing-mapping-only-once.patch b/patches.kernel.org/6.2.3-877-irqdomain-Look-for-existing-mapping-only-once.patch new file mode 100644 index 0000000..9dcb066 --- /dev/null +++ b/patches.kernel.org/6.2.3-877-irqdomain-Look-for-existing-mapping-only-once.patch @@ -0,0 +1,134 @@ +From: Johan Hovold +Date: Mon, 13 Feb 2023 11:42:46 +0100 +Subject: [PATCH] irqdomain: Look for existing mapping only once +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6e6f75c9c98d2d246d90411ff2b6f0cd271f4cba + +commit 6e6f75c9c98d2d246d90411ff2b6f0cd271f4cba upstream. + +Avoid looking for an existing mapping twice when creating a new mapping +using irq_create_fwspec_mapping() by factoring out the actual allocation +which is shared with irq_create_mapping_affinity(). + +The new helper function will also be used to fix a shared-interrupt +mapping race, hence the Fixes tag. + +Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings") +Cc: stable@vger.kernel.org # 4.8 +Tested-by: Hsin-Yi Wang +Tested-by: Mark-PK Tsai +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-5-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/irq/irqdomain.c | 60 +++++++++++++++++++++++------------------- + 1 file changed, 33 insertions(+), 27 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 981cd636..1b5e9dec 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -682,6 +682,34 @@ unsigned int irq_create_direct_mapping(struct irq_domain *domain) + EXPORT_SYMBOL_GPL(irq_create_direct_mapping); + #endif + ++static unsigned int __irq_create_mapping_affinity(struct irq_domain *domain, ++ irq_hw_number_t hwirq, ++ const struct irq_affinity_desc *affinity) ++{ ++ struct device_node *of_node = irq_domain_get_of_node(domain); ++ int virq; ++ ++ pr_debug("irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq); ++ ++ /* Allocate a virtual interrupt number */ ++ virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node), ++ affinity); ++ if (virq <= 0) { ++ pr_debug("-> virq allocation failed\n"); ++ return 0; ++ } ++ ++ if (irq_domain_associate(domain, virq, hwirq)) { ++ irq_free_desc(virq); ++ return 0; ++ } ++ ++ pr_debug("irq %lu on domain %s mapped to virtual irq %u\n", ++ hwirq, of_node_full_name(of_node), virq); ++ ++ return virq; ++} ++ + /** + * irq_create_mapping_affinity() - Map a hardware interrupt into linux irq space + * @domain: domain owning this hardware interrupt or NULL for default domain +@@ -694,14 +722,11 @@ EXPORT_SYMBOL_GPL(irq_create_direct_mapping); + * on the number returned from that call. + */ + unsigned int irq_create_mapping_affinity(struct irq_domain *domain, +- irq_hw_number_t hwirq, +- const struct irq_affinity_desc *affinity) ++ irq_hw_number_t hwirq, ++ const struct irq_affinity_desc *affinity) + { +- struct device_node *of_node; + int virq; + +- pr_debug("irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq); +- + /* Look for default domain if necessary */ + if (domain == NULL) + domain = irq_default_domain; +@@ -709,34 +734,15 @@ unsigned int irq_create_mapping_affinity(struct irq_domain *domain, + WARN(1, "%s(, %lx) called with NULL domain\n", __func__, hwirq); + return 0; + } +- pr_debug("-> using domain @%p\n", domain); +- +- of_node = irq_domain_get_of_node(domain); + + /* Check if mapping already exists */ + virq = irq_find_mapping(domain, hwirq); + if (virq) { +- pr_debug("-> existing mapping on virq %d\n", virq); ++ pr_debug("existing mapping on virq %d\n", virq); + return virq; + } + +- /* Allocate a virtual interrupt number */ +- virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node), +- affinity); +- if (virq <= 0) { +- pr_debug("-> virq allocation failed\n"); +- return 0; +- } +- +- if (irq_domain_associate(domain, virq, hwirq)) { +- irq_free_desc(virq); +- return 0; +- } +- +- pr_debug("irq %lu on domain %s mapped to virtual irq %u\n", +- hwirq, of_node_full_name(of_node), virq); +- +- return virq; ++ return __irq_create_mapping_affinity(domain, hwirq, affinity); + } + EXPORT_SYMBOL_GPL(irq_create_mapping_affinity); + +@@ -841,7 +847,7 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec) + return 0; + } else { + /* Create mapping */ +- virq = irq_create_mapping(domain, hwirq); ++ virq = __irq_create_mapping_affinity(domain, hwirq, NULL); + if (!virq) + return virq; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-878-irqdomain-Drop-bogus-fwspec-mapping-error-handl.patch b/patches.kernel.org/6.2.3-878-irqdomain-Drop-bogus-fwspec-mapping-error-handl.patch new file mode 100644 index 0000000..6b0f8b1 --- /dev/null +++ b/patches.kernel.org/6.2.3-878-irqdomain-Drop-bogus-fwspec-mapping-error-handl.patch @@ -0,0 +1,52 @@ +From: Johan Hovold +Date: Mon, 13 Feb 2023 11:42:45 +0100 +Subject: [PATCH] irqdomain: Drop bogus fwspec-mapping error handling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e3b7ab025e931accdc2c12acf9b75c6197f1c062 + +commit e3b7ab025e931accdc2c12acf9b75c6197f1c062 upstream. + +In case a newly allocated IRQ ever ends up not having any associated +struct irq_data it would not even be possible to dispose the mapping. + +Replace the bogus disposal with a WARN_ON(). + +This will also be used to fix a shared-interrupt mapping race, hence the +CC-stable tag. + +Fixes: 1e2a7d78499e ("irqdomain: Don't set type when mapping an IRQ") +Cc: stable@vger.kernel.org # 4.8 +Tested-by: Hsin-Yi Wang +Tested-by: Mark-PK Tsai +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-4-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/irq/irqdomain.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 1b5e9dec..3d6a14ef 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -853,13 +853,8 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec) + } + + irq_data = irq_get_irq_data(virq); +- if (!irq_data) { +- if (irq_domain_is_hierarchy(domain)) +- irq_domain_free_irqs(virq, 1); +- else +- irq_dispose_mapping(virq); ++ if (WARN_ON(!irq_data)) + return 0; +- } + + /* Store trigger type */ + irqd_set_trigger_type(irq_data, type); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-879-irqdomain-Refactor-__irq_domain_alloc_irqs.patch b/patches.kernel.org/6.2.3-879-irqdomain-Refactor-__irq_domain_alloc_irqs.patch new file mode 100644 index 0000000..006139a --- /dev/null +++ b/patches.kernel.org/6.2.3-879-irqdomain-Refactor-__irq_domain_alloc_irqs.patch @@ -0,0 +1,156 @@ +From: Johan Hovold +Date: Mon, 13 Feb 2023 11:42:47 +0100 +Subject: [PATCH] irqdomain: Refactor __irq_domain_alloc_irqs() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d55f7f4c58c07beb5050a834bf57ae2ede599c7e + +commit d55f7f4c58c07beb5050a834bf57ae2ede599c7e upstream. + +Refactor __irq_domain_alloc_irqs() so that it can be called internally +while holding the irq_domain_mutex. + +This will be used to fix a shared-interrupt mapping race, hence the +Fixes tag. + +Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings") +Cc: stable@vger.kernel.org # 4.8 +Tested-by: Hsin-Yi Wang +Tested-by: Mark-PK Tsai +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-6-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/irq/irqdomain.c | 88 +++++++++++++++++++++++------------------- + 1 file changed, 48 insertions(+), 40 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 3d6a14ef..7b57949b 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -1441,40 +1441,12 @@ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain, + return domain->ops->alloc(domain, irq_base, nr_irqs, arg); + } + +-/** +- * __irq_domain_alloc_irqs - Allocate IRQs from domain +- * @domain: domain to allocate from +- * @irq_base: allocate specified IRQ number if irq_base >= 0 +- * @nr_irqs: number of IRQs to allocate +- * @node: NUMA node id for memory allocation +- * @arg: domain specific argument +- * @realloc: IRQ descriptors have already been allocated if true +- * @affinity: Optional irq affinity mask for multiqueue devices +- * +- * Allocate IRQ numbers and initialized all data structures to support +- * hierarchy IRQ domains. +- * Parameter @realloc is mainly to support legacy IRQs. +- * Returns error code or allocated IRQ number +- * +- * The whole process to setup an IRQ has been split into two steps. +- * The first step, __irq_domain_alloc_irqs(), is to allocate IRQ +- * descriptor and required hardware resources. The second step, +- * irq_domain_activate_irq(), is to program the hardware with preallocated +- * resources. In this way, it's easier to rollback when failing to +- * allocate resources. +- */ +-int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base, +- unsigned int nr_irqs, int node, void *arg, +- bool realloc, const struct irq_affinity_desc *affinity) ++static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base, ++ unsigned int nr_irqs, int node, void *arg, ++ bool realloc, const struct irq_affinity_desc *affinity) + { + int i, ret, virq; + +- if (domain == NULL) { +- domain = irq_default_domain; +- if (WARN(!domain, "domain is NULL; cannot allocate IRQ\n")) +- return -EINVAL; +- } +- + if (realloc && irq_base >= 0) { + virq = irq_base; + } else { +@@ -1493,24 +1465,18 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base, + goto out_free_desc; + } + +- mutex_lock(&irq_domain_mutex); + ret = irq_domain_alloc_irqs_hierarchy(domain, virq, nr_irqs, arg); +- if (ret < 0) { +- mutex_unlock(&irq_domain_mutex); ++ if (ret < 0) + goto out_free_irq_data; +- } + + for (i = 0; i < nr_irqs; i++) { + ret = irq_domain_trim_hierarchy(virq + i); +- if (ret) { +- mutex_unlock(&irq_domain_mutex); ++ if (ret) + goto out_free_irq_data; +- } + } +- ++ + for (i = 0; i < nr_irqs; i++) + irq_domain_insert_irq(virq + i); +- mutex_unlock(&irq_domain_mutex); + + return virq; + +@@ -1520,6 +1486,48 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base, + irq_free_descs(virq, nr_irqs); + return ret; + } ++ ++/** ++ * __irq_domain_alloc_irqs - Allocate IRQs from domain ++ * @domain: domain to allocate from ++ * @irq_base: allocate specified IRQ number if irq_base >= 0 ++ * @nr_irqs: number of IRQs to allocate ++ * @node: NUMA node id for memory allocation ++ * @arg: domain specific argument ++ * @realloc: IRQ descriptors have already been allocated if true ++ * @affinity: Optional irq affinity mask for multiqueue devices ++ * ++ * Allocate IRQ numbers and initialized all data structures to support ++ * hierarchy IRQ domains. ++ * Parameter @realloc is mainly to support legacy IRQs. ++ * Returns error code or allocated IRQ number ++ * ++ * The whole process to setup an IRQ has been split into two steps. ++ * The first step, __irq_domain_alloc_irqs(), is to allocate IRQ ++ * descriptor and required hardware resources. The second step, ++ * irq_domain_activate_irq(), is to program the hardware with preallocated ++ * resources. In this way, it's easier to rollback when failing to ++ * allocate resources. ++ */ ++int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base, ++ unsigned int nr_irqs, int node, void *arg, ++ bool realloc, const struct irq_affinity_desc *affinity) ++{ ++ int ret; ++ ++ if (domain == NULL) { ++ domain = irq_default_domain; ++ if (WARN(!domain, "domain is NULL; cannot allocate IRQ\n")) ++ return -EINVAL; ++ } ++ ++ mutex_lock(&irq_domain_mutex); ++ ret = irq_domain_alloc_irqs_locked(domain, irq_base, nr_irqs, node, arg, ++ realloc, affinity); ++ mutex_unlock(&irq_domain_mutex); ++ ++ return ret; ++} + EXPORT_SYMBOL_GPL(__irq_domain_alloc_irqs); + + /* The irq_data was moved, fix the revmap to refer to the new location */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-880-irqdomain-Fix-mapping-creation-race.patch b/patches.kernel.org/6.2.3-880-irqdomain-Fix-mapping-creation-race.patch new file mode 100644 index 0000000..79ae136 --- /dev/null +++ b/patches.kernel.org/6.2.3-880-irqdomain-Fix-mapping-creation-race.patch @@ -0,0 +1,185 @@ +From: Johan Hovold +Date: Mon, 13 Feb 2023 11:42:48 +0100 +Subject: [PATCH] irqdomain: Fix mapping-creation race +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 601363cc08da25747feb87c55573dd54de91d66a + +commit 601363cc08da25747feb87c55573dd54de91d66a upstream. + +Parallel probing of devices that share interrupts (e.g. when a driver +uses asynchronous probing) can currently result in two mappings for the +same hardware interrupt to be created due to missing serialisation. + +Make sure to hold the irq_domain_mutex when creating mappings so that +looking for an existing mapping before creating a new one is done +atomically. + +Fixes: 765230b5f084 ("driver-core: add asynchronous probing support for drivers") +Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings") +Link: https://lore.kernel.org/r/YuJXMHoT4ijUxnRb@hovoldconsulting.com +Cc: stable@vger.kernel.org # 4.8 +Cc: Dmitry Torokhov +Cc: Jon Hunter +Tested-by: Hsin-Yi Wang +Tested-by: Mark-PK Tsai +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-7-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/irq/irqdomain.c | 64 ++++++++++++++++++++++++++++++------------ + 1 file changed, 46 insertions(+), 18 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 7b57949b..bfda4adc 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -25,6 +25,9 @@ static DEFINE_MUTEX(irq_domain_mutex); + + static struct irq_domain *irq_default_domain; + ++static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base, ++ unsigned int nr_irqs, int node, void *arg, ++ bool realloc, const struct irq_affinity_desc *affinity); + static void irq_domain_check_hierarchy(struct irq_domain *domain); + + struct irqchip_fwid { +@@ -682,9 +685,9 @@ unsigned int irq_create_direct_mapping(struct irq_domain *domain) + EXPORT_SYMBOL_GPL(irq_create_direct_mapping); + #endif + +-static unsigned int __irq_create_mapping_affinity(struct irq_domain *domain, +- irq_hw_number_t hwirq, +- const struct irq_affinity_desc *affinity) ++static unsigned int irq_create_mapping_affinity_locked(struct irq_domain *domain, ++ irq_hw_number_t hwirq, ++ const struct irq_affinity_desc *affinity) + { + struct device_node *of_node = irq_domain_get_of_node(domain); + int virq; +@@ -699,7 +702,7 @@ static unsigned int __irq_create_mapping_affinity(struct irq_domain *domain, + return 0; + } + +- if (irq_domain_associate(domain, virq, hwirq)) { ++ if (irq_domain_associate_locked(domain, virq, hwirq)) { + irq_free_desc(virq); + return 0; + } +@@ -735,14 +738,20 @@ unsigned int irq_create_mapping_affinity(struct irq_domain *domain, + return 0; + } + ++ mutex_lock(&irq_domain_mutex); ++ + /* Check if mapping already exists */ + virq = irq_find_mapping(domain, hwirq); + if (virq) { + pr_debug("existing mapping on virq %d\n", virq); +- return virq; ++ goto out; + } + +- return __irq_create_mapping_affinity(domain, hwirq, affinity); ++ virq = irq_create_mapping_affinity_locked(domain, hwirq, affinity); ++out: ++ mutex_unlock(&irq_domain_mutex); ++ ++ return virq; + } + EXPORT_SYMBOL_GPL(irq_create_mapping_affinity); + +@@ -809,6 +818,8 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec) + if (WARN_ON(type & ~IRQ_TYPE_SENSE_MASK)) + type &= IRQ_TYPE_SENSE_MASK; + ++ mutex_lock(&irq_domain_mutex); ++ + /* + * If we've already configured this interrupt, + * don't do it again, or hell will break loose. +@@ -821,7 +832,7 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec) + * interrupt number. + */ + if (type == IRQ_TYPE_NONE || type == irq_get_trigger_type(virq)) +- return virq; ++ goto out; + + /* + * If the trigger type has not been set yet, then set +@@ -829,35 +840,45 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec) + */ + if (irq_get_trigger_type(virq) == IRQ_TYPE_NONE) { + irq_data = irq_get_irq_data(virq); +- if (!irq_data) +- return 0; ++ if (!irq_data) { ++ virq = 0; ++ goto out; ++ } + + irqd_set_trigger_type(irq_data, type); +- return virq; ++ goto out; + } + + pr_warn("type mismatch, failed to map hwirq-%lu for %s!\n", + hwirq, of_node_full_name(to_of_node(fwspec->fwnode))); +- return 0; ++ virq = 0; ++ goto out; + } + + if (irq_domain_is_hierarchy(domain)) { +- virq = irq_domain_alloc_irqs(domain, 1, NUMA_NO_NODE, fwspec); +- if (virq <= 0) +- return 0; ++ virq = irq_domain_alloc_irqs_locked(domain, -1, 1, NUMA_NO_NODE, ++ fwspec, false, NULL); ++ if (virq <= 0) { ++ virq = 0; ++ goto out; ++ } + } else { + /* Create mapping */ +- virq = __irq_create_mapping_affinity(domain, hwirq, NULL); ++ virq = irq_create_mapping_affinity_locked(domain, hwirq, NULL); + if (!virq) +- return virq; ++ goto out; + } + + irq_data = irq_get_irq_data(virq); +- if (WARN_ON(!irq_data)) +- return 0; ++ if (WARN_ON(!irq_data)) { ++ virq = 0; ++ goto out; ++ } + + /* Store trigger type */ + irqd_set_trigger_type(irq_data, type); ++out: ++ mutex_unlock(&irq_domain_mutex); + + return virq; + } +@@ -1888,6 +1909,13 @@ void irq_domain_set_info(struct irq_domain *domain, unsigned int virq, + irq_set_handler_data(virq, handler_data); + } + ++static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base, ++ unsigned int nr_irqs, int node, void *arg, ++ bool realloc, const struct irq_affinity_desc *affinity) ++{ ++ return -EINVAL; ++} ++ + static void irq_domain_check_hierarchy(struct irq_domain *domain) + { + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-881-irqdomain-Fix-domain-registration-race.patch b/patches.kernel.org/6.2.3-881-irqdomain-Fix-domain-registration-race.patch new file mode 100644 index 0000000..04029aa --- /dev/null +++ b/patches.kernel.org/6.2.3-881-irqdomain-Fix-domain-registration-race.patch @@ -0,0 +1,135 @@ +From: Marc Zyngier +Date: Mon, 13 Feb 2023 11:42:49 +0100 +Subject: [PATCH] irqdomain: Fix domain registration race +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8932c32c3053accd50702b36e944ac2016cd103c + +commit 8932c32c3053accd50702b36e944ac2016cd103c upstream. + +Hierarchical domains created using irq_domain_create_hierarchy() are +currently added to the domain list before having been fully initialised. + +This specifically means that a racing allocation request might fail to +allocate irq data for the inner domains of a hierarchy in case the +parent domain pointer has not yet been set up. + +Note that this is not really any issue for irqchip drivers that are +registered early (e.g. via IRQCHIP_DECLARE() or IRQCHIP_ACPI_DECLARE()) +but could potentially cause trouble with drivers that are registered +later (e.g. modular drivers using IRQCHIP_PLATFORM_DRIVER_BEGIN(), +gpiochip drivers, etc.). + +Fixes: afb7da83b9f4 ("irqdomain: Introduce helper function irq_domain_add_hierarchy()") +Cc: stable@vger.kernel.org # 3.19 +Signed-off-by: Marc Zyngier +[ johan: add commit message ] +Signed-off-by: Johan Hovold +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230213104302.17307-8-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/irq/irqdomain.c | 62 +++++++++++++++++++++++++++++------------- + 1 file changed, 43 insertions(+), 19 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index bfda4adc..8e14805c 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -126,23 +126,12 @@ void irq_domain_free_fwnode(struct fwnode_handle *fwnode) + } + EXPORT_SYMBOL_GPL(irq_domain_free_fwnode); + +-/** +- * __irq_domain_add() - Allocate a new irq_domain data structure +- * @fwnode: firmware node for the interrupt controller +- * @size: Size of linear map; 0 for radix mapping only +- * @hwirq_max: Maximum number of interrupts supported by controller +- * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no +- * direct mapping +- * @ops: domain callbacks +- * @host_data: Controller private data pointer +- * +- * Allocates and initializes an irq_domain structure. +- * Returns pointer to IRQ domain, or NULL on failure. +- */ +-struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size, +- irq_hw_number_t hwirq_max, int direct_max, +- const struct irq_domain_ops *ops, +- void *host_data) ++static struct irq_domain *__irq_domain_create(struct fwnode_handle *fwnode, ++ unsigned int size, ++ irq_hw_number_t hwirq_max, ++ int direct_max, ++ const struct irq_domain_ops *ops, ++ void *host_data) + { + struct irqchip_fwid *fwid; + struct irq_domain *domain; +@@ -230,12 +219,44 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int s + + irq_domain_check_hierarchy(domain); + ++ return domain; ++} ++ ++static void __irq_domain_publish(struct irq_domain *domain) ++{ + mutex_lock(&irq_domain_mutex); + debugfs_add_domain_dir(domain); + list_add(&domain->link, &irq_domain_list); + mutex_unlock(&irq_domain_mutex); + + pr_debug("Added domain %s\n", domain->name); ++} ++ ++/** ++ * __irq_domain_add() - Allocate a new irq_domain data structure ++ * @fwnode: firmware node for the interrupt controller ++ * @size: Size of linear map; 0 for radix mapping only ++ * @hwirq_max: Maximum number of interrupts supported by controller ++ * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no ++ * direct mapping ++ * @ops: domain callbacks ++ * @host_data: Controller private data pointer ++ * ++ * Allocates and initializes an irq_domain structure. ++ * Returns pointer to IRQ domain, or NULL on failure. ++ */ ++struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size, ++ irq_hw_number_t hwirq_max, int direct_max, ++ const struct irq_domain_ops *ops, ++ void *host_data) ++{ ++ struct irq_domain *domain; ++ ++ domain = __irq_domain_create(fwnode, size, hwirq_max, direct_max, ++ ops, host_data); ++ if (domain) ++ __irq_domain_publish(domain); ++ + return domain; + } + EXPORT_SYMBOL_GPL(__irq_domain_add); +@@ -1138,12 +1159,15 @@ struct irq_domain *irq_domain_create_hierarchy(struct irq_domain *parent, + struct irq_domain *domain; + + if (size) +- domain = irq_domain_create_linear(fwnode, size, ops, host_data); ++ domain = __irq_domain_create(fwnode, size, size, 0, ops, host_data); + else +- domain = irq_domain_create_tree(fwnode, ops, host_data); ++ domain = __irq_domain_create(fwnode, 0, ~0, 0, ops, host_data); ++ + if (domain) { + domain->parent = parent; + domain->flags |= flags; ++ ++ __irq_domain_publish(domain); + } + + return domain; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-882-crypto-qat-fix-out-of-bounds-read.patch b/patches.kernel.org/6.2.3-882-crypto-qat-fix-out-of-bounds-read.patch new file mode 100644 index 0000000..2c6cbee --- /dev/null +++ b/patches.kernel.org/6.2.3-882-crypto-qat-fix-out-of-bounds-read.patch @@ -0,0 +1,67 @@ +From: Giovanni Cabiddu +Date: Wed, 1 Feb 2023 15:59:44 +0000 +Subject: [PATCH] crypto: qat - fix out-of-bounds read +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f6044cc3030e139f60c281386f28bda6e3049d66 + +commit f6044cc3030e139f60c281386f28bda6e3049d66 upstream. + +When preparing an AER-CTR request, the driver copies the key provided by +the user into a data structure that is accessible by the firmware. +If the target device is QAT GEN4, the key size is rounded up by 16 since +a rounded up size is expected by the device. +If the key size is rounded up before the copy, the size used for copying +the key might be bigger than the size of the region containing the key, +causing an out-of-bounds read. + +Fix by doing the copy first and then update the keylen. + +This is to fix the following warning reported by KASAN: + + [ 138.150574] BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] + [ 138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgr_test/2340 + + [ 138.150651] CPU: 15 PID: 2340 Comm: cryptomgr_test Not tainted 6.2.0-rc1+ #45 + [ 138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13.2208261706 08/26/2022 + [ 138.150663] Call Trace: + [ 138.150668] + [ 138.150922] kasan_check_range+0x13a/0x1c0 + [ 138.150931] memcpy+0x1f/0x60 + [ 138.150940] qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] + [ 138.151006] qat_alg_skcipher_init_sessions+0xc1/0x240 [intel_qat] + [ 138.151073] crypto_skcipher_setkey+0x82/0x160 + [ 138.151085] ? prepare_keybuf+0xa2/0xd0 + [ 138.151095] test_skcipher_vec_cfg+0x2b8/0x800 + +Fixes: 67916c951689 ("crypto: qat - add AES-CTR support for QAT GEN4 devices") +Cc: +Reported-by: Vladis Dronov +Signed-off-by: Giovanni Cabiddu +Reviewed-by: Fiona Trahe +Reviewed-by: Vladis Dronov +Tested-by: Vladis Dronov +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/crypto/qat/qat_common/qat_algs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c +index b4b9f0aa..b61ada55 100644 +--- a/drivers/crypto/qat/qat_common/qat_algs.c ++++ b/drivers/crypto/qat/qat_common/qat_algs.c +@@ -435,8 +435,8 @@ static void qat_alg_skcipher_init_com(struct qat_alg_skcipher_ctx *ctx, + } else if (aes_v2_capable && mode == ICP_QAT_HW_CIPHER_CTR_MODE) { + ICP_QAT_FW_LA_SLICE_TYPE_SET(header->serv_specif_flags, + ICP_QAT_FW_LA_USE_UCS_SLICE_TYPE); +- keylen = round_up(keylen, 16); + memcpy(cd->ucs_aes.key, key, keylen); ++ keylen = round_up(keylen, 16); + } else { + memcpy(cd->aes.key, key, keylen); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-883-mm-damon-paddr-fix-missing-folio_put.patch b/patches.kernel.org/6.2.3-883-mm-damon-paddr-fix-missing-folio_put.patch new file mode 100644 index 0000000..d407cf8 --- /dev/null +++ b/patches.kernel.org/6.2.3-883-mm-damon-paddr-fix-missing-folio_put.patch @@ -0,0 +1,57 @@ +From: "andrew.yang" +Date: Wed, 22 Feb 2023 14:42:20 +0800 +Subject: [PATCH] mm/damon/paddr: fix missing folio_put() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3f98c9a62c338bbe06a215c9491e6166ea39bf82 + +commit 3f98c9a62c338bbe06a215c9491e6166ea39bf82 upstream. + +damon_get_folio() would always increase folio _refcount and +folio_isolate_lru() would increase folio _refcount if the folio's lru flag +is set. + +If an unevictable folio isolated successfully, there will be two more +_refcount. The one from folio_isolate_lru() will be decreased in +folio_puback_lru(), but the other one from damon_get_folio() will be left +behind. This causes a pin page. + +Whatever the case, the _refcount from damon_get_folio() should be +decreased. + +Link: https://lkml.kernel.org/r/20230222064223.6735-1-andrew.yang@mediatek.com +Fixes: 57223ac29584 ("mm/damon/paddr: support the pageout scheme") +Signed-off-by: andrew.yang +Reviewed-by: SeongJae Park +Cc: [5.16.x] +Signed-off-by: Andrew Morton +Signed-off-by: SeongJae Park +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/damon/paddr.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/mm/damon/paddr.c b/mm/damon/paddr.c +index e1a4315c..402d30b3 100644 +--- a/mm/damon/paddr.c ++++ b/mm/damon/paddr.c +@@ -219,12 +219,11 @@ static unsigned long damon_pa_pageout(struct damon_region *r) + put_page(page); + continue; + } +- if (PageUnevictable(page)) { ++ if (PageUnevictable(page)) + putback_lru_page(page); +- } else { ++ else + list_add(&page->lru, &page_list); +- put_page(page); +- } ++ put_page(page); + } + applied = reclaim_pages(&page_list); + cond_resched(); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-884-ALSA-ice1712-Do-not-left-ice-gpio_mutex-locked-.patch b/patches.kernel.org/6.2.3-884-ALSA-ice1712-Do-not-left-ice-gpio_mutex-locked-.patch new file mode 100644 index 0000000..e2446c5 --- /dev/null +++ b/patches.kernel.org/6.2.3-884-ALSA-ice1712-Do-not-left-ice-gpio_mutex-locked-.patch @@ -0,0 +1,55 @@ +From: Dmitry Fomin +Date: Sat, 25 Feb 2023 21:43:21 +0300 +Subject: [PATCH] ALSA: ice1712: Do not left ice->gpio_mutex locked in + aureon_add_controls() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 951606a14a8901e3551fe4d8d3cedd73fe954ce1 + +commit 951606a14a8901e3551fe4d8d3cedd73fe954ce1 upstream. + +If snd_ctl_add() fails in aureon_add_controls(), it immediately returns +and leaves ice->gpio_mutex locked. ice->gpio_mutex locks in +snd_ice1712_save_gpio_status and unlocks in +snd_ice1712_restore_gpio_status(ice). + +It seems that the mutex is required only for aureon_cs8415_get(), +so snd_ice1712_restore_gpio_status(ice) can be placed +just after that. Compile tested only. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Dmitry Fomin +Cc: +Link: https://lore.kernel.org/r/20230225184322.6286-1-fomindmitriyfoma@mail.ru +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/ice1712/aureon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/ice1712/aureon.c b/sound/pci/ice1712/aureon.c +index 9a30f6d3..40a0e009 100644 +--- a/sound/pci/ice1712/aureon.c ++++ b/sound/pci/ice1712/aureon.c +@@ -1892,6 +1892,7 @@ static int aureon_add_controls(struct snd_ice1712 *ice) + unsigned char id; + snd_ice1712_save_gpio_status(ice); + id = aureon_cs8415_get(ice, CS8415_ID); ++ snd_ice1712_restore_gpio_status(ice); + if (id != 0x41) + dev_info(ice->card->dev, + "No CS8415 chip. Skipping CS8415 controls.\n"); +@@ -1909,7 +1910,6 @@ static int aureon_add_controls(struct snd_ice1712 *ice) + kctl->id.device = ice->pcm->device; + } + } +- snd_ice1712_restore_gpio_status(ice); + } + + return 0; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-885-ALSA-hda-realtek-Add-quirk-for-HP-EliteDesk-800.patch b/patches.kernel.org/6.2.3-885-ALSA-hda-realtek-Add-quirk-for-HP-EliteDesk-800.patch new file mode 100644 index 0000000..16d9b25 --- /dev/null +++ b/patches.kernel.org/6.2.3-885-ALSA-hda-realtek-Add-quirk-for-HP-EliteDesk-800.patch @@ -0,0 +1,41 @@ +From: =?UTF-8?q?=C5=81ukasz=20Stelmach?= +Date: Thu, 23 Feb 2023 08:47:48 +0100 +Subject: [PATCH] ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ea24b9953bcd3889f77a66e7f1d7e86e995dd9c3 + +commit ea24b9953bcd3889f77a66e7f1d7e86e995dd9c3 upstream. + +HP EliteDesk 800 G6 Tower PC (103c:870c) requires a quirk for enabling +headset-mic. + +Signed-off-by: Łukasz Stelmach +Cc: +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217008 +Link: https://lore.kernel.org/r/20230223074749.1026060-1-l.stelmach@samsung.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index e103bb36..d4819890 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11617,6 +11617,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), ++ SND_PCI_QUIRK(0x103c, 0x870c, "HP", ALC897_FIXUP_HP_HSMIC_VERB), + SND_PCI_QUIRK(0x103c, 0x8719, "HP", ALC897_FIXUP_HP_HSMIC_VERB), + SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2), + SND_PCI_QUIRK(0x103c, 0x877e, "HP 288 Pro G6", ALC671_FIXUP_HP_HEADSET_MIC2), +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-886-jbd2-fix-data-missing-when-reusing-bh-which-is-.patch b/patches.kernel.org/6.2.3-886-jbd2-fix-data-missing-when-reusing-bh-which-is-.patch new file mode 100644 index 0000000..184c2c9 --- /dev/null +++ b/patches.kernel.org/6.2.3-886-jbd2-fix-data-missing-when-reusing-bh-which-is-.patch @@ -0,0 +1,152 @@ +From: Zhihao Cheng +Date: Tue, 10 Jan 2023 09:53:27 +0800 +Subject: [PATCH] jbd2: fix data missing when reusing bh which is ready to be + checkpointed +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e6b9bd7290d334451ce054e98e752abc055e0034 + +commit e6b9bd7290d334451ce054e98e752abc055e0034 upstream. + +Following process will make data lost and could lead to a filesystem +corrupted problem: + +1. jh(bh) is inserted into T1->t_checkpoint_list, bh is dirty, and + jh->b_transaction = NULL +2. T1 is added into journal->j_checkpoint_transactions. +3. Get bh prepare to write while doing checkpoing: + PA PB + do_get_write_access jbd2_log_do_checkpoint + spin_lock(&jh->b_state_lock) + if (buffer_dirty(bh)) + clear_buffer_dirty(bh) // clear buffer dirty + set_buffer_jbddirty(bh) + transaction = + journal->j_checkpoint_transactions + jh = transaction->t_checkpoint_list + if (!buffer_dirty(bh)) + __jbd2_journal_remove_checkpoint(jh) + // bh won't be flushed + jbd2_cleanup_journal_tail + __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved) +4. Aborting journal/Power-cut before writing latest bh on journal area. + +In this way we get a corrupted filesystem with bh's data lost. + +Fix it by moving the clearing of buffer_dirty bit just before the call +to __jbd2_journal_file_buffer(), both bit clearing and jh->b_transaction +assignment are under journal->j_list_lock locked, so that +jbd2_log_do_checkpoint() will wait until jh's new transaction fininshed +even bh is currently not dirty. And journal_shrink_one_cp_list() won't +remove jh from checkpoint list if the buffer head is reused in +do_get_write_access(). + +Fetch a reproducer in [Link]. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216898 +Cc: +Signed-off-by: Zhihao Cheng +Signed-off-by: zhanchengbin +Suggested-by: Jan Kara +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230110015327.1181863-1-chengzhihao1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/jbd2/transaction.c | 50 +++++++++++++++++++++++++------------------ + 1 file changed, 29 insertions(+), 21 deletions(-) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index 6a404ac1..15de1385 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1010,36 +1010,28 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, + * ie. locked but not dirty) or tune2fs (which may actually have + * the buffer dirtied, ugh.) */ + +- if (buffer_dirty(bh)) { ++ if (buffer_dirty(bh) && jh->b_transaction) { ++ warn_dirty_buffer(bh); + /* +- * First question: is this buffer already part of the current +- * transaction or the existing committing transaction? +- */ +- if (jh->b_transaction) { +- J_ASSERT_JH(jh, +- jh->b_transaction == transaction || +- jh->b_transaction == +- journal->j_committing_transaction); +- if (jh->b_next_transaction) +- J_ASSERT_JH(jh, jh->b_next_transaction == +- transaction); +- warn_dirty_buffer(bh); +- } +- /* +- * In any case we need to clean the dirty flag and we must +- * do it under the buffer lock to be sure we don't race +- * with running write-out. ++ * We need to clean the dirty flag and we must do it under the ++ * buffer lock to be sure we don't race with running write-out. + */ + JBUFFER_TRACE(jh, "Journalling dirty buffer"); + clear_buffer_dirty(bh); ++ /* ++ * The buffer is going to be added to BJ_Reserved list now and ++ * nothing guarantees jbd2_journal_dirty_metadata() will be ++ * ever called for it. So we need to set jbddirty bit here to ++ * make sure the buffer is dirtied and written out when the ++ * journaling machinery is done with it. ++ */ + set_buffer_jbddirty(bh); + } + +- unlock_buffer(bh); +- + error = -EROFS; + if (is_handle_aborted(handle)) { + spin_unlock(&jh->b_state_lock); ++ unlock_buffer(bh); + goto out; + } + error = 0; +@@ -1049,8 +1041,10 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, + * b_next_transaction points to it + */ + if (jh->b_transaction == transaction || +- jh->b_next_transaction == transaction) ++ jh->b_next_transaction == transaction) { ++ unlock_buffer(bh); + goto done; ++ } + + /* + * this is the first time this transaction is touching this buffer, +@@ -1074,10 +1068,24 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, + */ + smp_wmb(); + spin_lock(&journal->j_list_lock); ++ if (test_clear_buffer_dirty(bh)) { ++ /* ++ * Execute buffer dirty clearing and jh->b_transaction ++ * assignment under journal->j_list_lock locked to ++ * prevent bh being removed from checkpoint list if ++ * the buffer is in an intermediate state (not dirty ++ * and jh->b_transaction is NULL). ++ */ ++ JBUFFER_TRACE(jh, "Journalling dirty buffer"); ++ set_buffer_jbddirty(bh); ++ } + __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved); + spin_unlock(&journal->j_list_lock); ++ unlock_buffer(bh); + goto done; + } ++ unlock_buffer(bh); ++ + /* + * If there is already a copy-out version of this buffer, then we don't + * need to make another one +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-887-ext4-optimize-ea_inode-block-expansion.patch b/patches.kernel.org/6.2.3-887-ext4-optimize-ea_inode-block-expansion.patch new file mode 100644 index 0000000..1216025 --- /dev/null +++ b/patches.kernel.org/6.2.3-887-ext4-optimize-ea_inode-block-expansion.patch @@ -0,0 +1,101 @@ +From: Jun Nie +Date: Tue, 3 Jan 2023 09:45:16 +0800 +Subject: [PATCH] ext4: optimize ea_inode block expansion +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1e9d62d252812575ded7c620d8fc67c32ff06c16 + +commit 1e9d62d252812575ded7c620d8fc67c32ff06c16 upstream. + +Copy ea data from inode entry when expanding ea block if possible. +Then remove the ea entry if expansion success. Thus memcpy to a +temporary buffer may be avoided. + +If the expansion fails, we do not need to recovery the removed ea +entry neither in this way. + +Reported-by: syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d08 +Link: https://lore.kernel.org/r/20230103014517.495275-2-jun.nie@linaro.org +Cc: stable@kernel.org +Signed-off-by: Jun Nie +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ext4/xattr.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index a2f04a38..2beace6a 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -2567,9 +2567,8 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode, + + is = kzalloc(sizeof(struct ext4_xattr_ibody_find), GFP_NOFS); + bs = kzalloc(sizeof(struct ext4_xattr_block_find), GFP_NOFS); +- buffer = kvmalloc(value_size, GFP_NOFS); + b_entry_name = kmalloc(entry->e_name_len + 1, GFP_NOFS); +- if (!is || !bs || !buffer || !b_entry_name) { ++ if (!is || !bs || !b_entry_name) { + error = -ENOMEM; + goto out; + } +@@ -2581,12 +2580,18 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode, + + /* Save the entry name and the entry value */ + if (entry->e_value_inum) { ++ buffer = kvmalloc(value_size, GFP_NOFS); ++ if (!buffer) { ++ error = -ENOMEM; ++ goto out; ++ } ++ + error = ext4_xattr_inode_get(inode, entry, buffer, value_size); + if (error) + goto out; + } else { + size_t value_offs = le16_to_cpu(entry->e_value_offs); +- memcpy(buffer, (void *)IFIRST(header) + value_offs, value_size); ++ buffer = (void *)IFIRST(header) + value_offs; + } + + memcpy(b_entry_name, entry->e_name, entry->e_name_len); +@@ -2601,25 +2606,26 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode, + if (error) + goto out; + +- /* Remove the chosen entry from the inode */ +- error = ext4_xattr_ibody_set(handle, inode, &i, is); +- if (error) +- goto out; +- + i.value = buffer; + i.value_len = value_size; + error = ext4_xattr_block_find(inode, &i, bs); + if (error) + goto out; + +- /* Add entry which was removed from the inode into the block */ ++ /* Move ea entry from the inode into the block */ + error = ext4_xattr_block_set(handle, inode, &i, bs); + if (error) + goto out; +- error = 0; ++ ++ /* Remove the chosen entry from the inode */ ++ i.value = NULL; ++ i.value_len = 0; ++ error = ext4_xattr_ibody_set(handle, inode, &i, is); ++ + out: + kfree(b_entry_name); +- kvfree(buffer); ++ if (entry->e_value_inum && buffer) ++ kvfree(buffer); + if (is) + brelse(is->iloc.bh); + if (bs) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-888-ext4-refuse-to-create-ea-block-when-umounted.patch b/patches.kernel.org/6.2.3-888-ext4-refuse-to-create-ea-block-when-umounted.patch new file mode 100644 index 0000000..e02c82d --- /dev/null +++ b/patches.kernel.org/6.2.3-888-ext4-refuse-to-create-ea-block-when-umounted.patch @@ -0,0 +1,46 @@ +From: Jun Nie +Date: Tue, 3 Jan 2023 09:45:17 +0800 +Subject: [PATCH] ext4: refuse to create ea block when umounted +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f31173c19901a96bb2ebf6bcfec8a08df7095c91 + +commit f31173c19901a96bb2ebf6bcfec8a08df7095c91 upstream. + +The ea block expansion need to access s_root while it is +already set as NULL when umount is triggered. Refuse this +request to avoid panic. + +Reported-by: syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d08 +Link: https://lore.kernel.org/r/20230103014517.495275-3-jun.nie@linaro.org +Cc: stable@kernel.org +Signed-off-by: Jun Nie +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ext4/xattr.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 2beace6a..0c6b011a 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1438,6 +1438,13 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle, + uid_t owner[2] = { i_uid_read(inode), i_gid_read(inode) }; + int err; + ++ if (inode->i_sb->s_root == NULL) { ++ ext4_warning(inode->i_sb, ++ "refuse to create EA inode when umounting"); ++ WARN_ON(1); ++ return ERR_PTR(-EINVAL); ++ } ++ + /* + * Let the next inode be the goal, so we try and allocate the EA inode + * in the same group, or nearby one. +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-889-cxl-pmem-Fix-nvdimm-registration-races.patch b/patches.kernel.org/6.2.3-889-cxl-pmem-Fix-nvdimm-registration-races.patch new file mode 100644 index 0000000..84256a3 --- /dev/null +++ b/patches.kernel.org/6.2.3-889-cxl-pmem-Fix-nvdimm-registration-races.patch @@ -0,0 +1,155 @@ +From: Dan Williams +Date: Mon, 13 Feb 2023 17:01:05 -0800 +Subject: [PATCH] cxl/pmem: Fix nvdimm registration races +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f57aec443c24d2e8e1f3b5b4856aea12ddda4254 + +commit f57aec443c24d2e8e1f3b5b4856aea12ddda4254 upstream. + +A loop of the form: + + while true; do modprobe cxl_pci; modprobe -r cxl_pci; done + +...fails with the following crash signature: + + BUG: kernel NULL pointer dereference, address: 0000000000000040 + [..] + RIP: 0010:cxl_internal_send_cmd+0x5/0xb0 [cxl_core] + [..] + Call Trace: + + cxl_pmem_ctl+0x121/0x240 [cxl_pmem] + nvdimm_get_config_data+0xd6/0x1a0 [libnvdimm] + nd_label_data_init+0x135/0x7e0 [libnvdimm] + nvdimm_probe+0xd6/0x1c0 [libnvdimm] + nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm] + really_probe+0xde/0x380 + __driver_probe_device+0x78/0x170 + driver_probe_device+0x1f/0x90 + __device_attach_driver+0x85/0x110 + bus_for_each_drv+0x7d/0xc0 + __device_attach+0xb4/0x1e0 + bus_probe_device+0x9f/0xc0 + device_add+0x445/0x9c0 + nd_async_device_register+0xe/0x40 [libnvdimm] + async_run_entry_fn+0x30/0x130 + +...namely that the bottom half of async nvdimm device registration runs +after the CXL has already torn down the context that cxl_pmem_ctl() +needs. Unlike the ACPI NFIT case that benefits from launching multiple +nvdimm device registrations in parallel from those listed in the table, +CXL is already marked PROBE_PREFER_ASYNCHRONOUS. So provide for a +synchronous registration path to preclude this scenario. + +Fixes: 21083f51521f ("cxl/pmem: Register 'pmem' / cxl_nvdimm devices") +Cc: +Reported-by: Dave Jiang +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/cxl/pmem.c | 1 + + drivers/nvdimm/bus.c | 19 ++++++++++++++++--- + drivers/nvdimm/dimm_devs.c | 5 ++++- + drivers/nvdimm/nd-core.h | 1 + + include/linux/libnvdimm.h | 3 +++ + 5 files changed, 25 insertions(+), 4 deletions(-) + +diff --git a/drivers/cxl/pmem.c b/drivers/cxl/pmem.c +index 08bbbac9..71cfa1fd 100644 +--- a/drivers/cxl/pmem.c ++++ b/drivers/cxl/pmem.c +@@ -76,6 +76,7 @@ static int cxl_nvdimm_probe(struct device *dev) + return rc; + + set_bit(NDD_LABELING, &flags); ++ set_bit(NDD_REGISTER_SYNC, &flags); + set_bit(ND_CMD_GET_CONFIG_SIZE, &cmd_mask); + set_bit(ND_CMD_GET_CONFIG_DATA, &cmd_mask); + set_bit(ND_CMD_SET_CONFIG_DATA, &cmd_mask); +diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c +index b38d0355..5ad49056 100644 +--- a/drivers/nvdimm/bus.c ++++ b/drivers/nvdimm/bus.c +@@ -508,7 +508,7 @@ static void nd_async_device_unregister(void *d, async_cookie_t cookie) + put_device(dev); + } + +-void nd_device_register(struct device *dev) ++static void __nd_device_register(struct device *dev, bool sync) + { + if (!dev) + return; +@@ -531,11 +531,24 @@ void nd_device_register(struct device *dev) + } + get_device(dev); + +- async_schedule_dev_domain(nd_async_device_register, dev, +- &nd_async_domain); ++ if (sync) ++ nd_async_device_register(dev, 0); ++ else ++ async_schedule_dev_domain(nd_async_device_register, dev, ++ &nd_async_domain); ++} ++ ++void nd_device_register(struct device *dev) ++{ ++ __nd_device_register(dev, false); + } + EXPORT_SYMBOL(nd_device_register); + ++void nd_device_register_sync(struct device *dev) ++{ ++ __nd_device_register(dev, true); ++} ++ + void nd_device_unregister(struct device *dev, enum nd_async_mode mode) + { + bool killed; +diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c +index 1fc081dc..6d3b03a9 100644 +--- a/drivers/nvdimm/dimm_devs.c ++++ b/drivers/nvdimm/dimm_devs.c +@@ -624,7 +624,10 @@ struct nvdimm *__nvdimm_create(struct nvdimm_bus *nvdimm_bus, + nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); + device_initialize(dev); + lockdep_set_class(&dev->mutex, &nvdimm_key); +- nd_device_register(dev); ++ if (test_bit(NDD_REGISTER_SYNC, &flags)) ++ nd_device_register_sync(dev); ++ else ++ nd_device_register(dev); + + return nvdimm; + } +diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h +index cc86ee09..845408f1 100644 +--- a/drivers/nvdimm/nd-core.h ++++ b/drivers/nvdimm/nd-core.h +@@ -107,6 +107,7 @@ int nvdimm_bus_create_ndctl(struct nvdimm_bus *nvdimm_bus); + void nvdimm_bus_destroy_ndctl(struct nvdimm_bus *nvdimm_bus); + void nd_synchronize(void); + void nd_device_register(struct device *dev); ++void nd_device_register_sync(struct device *dev); + struct nd_label_id; + char *nd_label_gen_id(struct nd_label_id *label_id, const uuid_t *uuid, + u32 flags); +diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h +index af38252a..e772aae7 100644 +--- a/include/linux/libnvdimm.h ++++ b/include/linux/libnvdimm.h +@@ -41,6 +41,9 @@ enum { + */ + NDD_INCOHERENT = 7, + ++ /* dimm provider wants synchronous registration by __nvdimm_create() */ ++ NDD_REGISTER_SYNC = 8, ++ + /* need to set a limit somewhere, but yes, this is likely overkill */ + ND_IOCTL_MAX_BUFLEN = SZ_4M, + ND_CMD_MAX_ELEM = 5, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-890-Input-exc3000-properly-stop-timer-on-shutdown.patch b/patches.kernel.org/6.2.3-890-Input-exc3000-properly-stop-timer-on-shutdown.patch new file mode 100644 index 0000000..5a9dc38 --- /dev/null +++ b/patches.kernel.org/6.2.3-890-Input-exc3000-properly-stop-timer-on-shutdown.patch @@ -0,0 +1,54 @@ +From: Dmitry Torokhov +Date: Fri, 3 Feb 2023 16:43:29 -0800 +Subject: [PATCH] Input: exc3000 - properly stop timer on shutdown +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 79c81d137d36f9635bbcbc3916c0cccb418a61dd + +commit 79c81d137d36f9635bbcbc3916c0cccb418a61dd upstream. + +We need to stop the timer on driver unbind or probe failures, otherwise +we get UAF/Oops. + +Fixes: 7e577a17f2ee ("Input: add I2C attached EETI EXC3000 multi touch driver") +Reported-by: "Stahl, Michael" +Link: https://lore.kernel.org/r/Y9dK57BFqtlf8NmN@google.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/input/touchscreen/exc3000.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/input/touchscreen/exc3000.c b/drivers/input/touchscreen/exc3000.c +index 4b7eee01..69eae79e 100644 +--- a/drivers/input/touchscreen/exc3000.c ++++ b/drivers/input/touchscreen/exc3000.c +@@ -109,6 +109,11 @@ static inline void exc3000_schedule_timer(struct exc3000_data *data) + mod_timer(&data->timer, jiffies + msecs_to_jiffies(EXC3000_TIMEOUT_MS)); + } + ++static void exc3000_shutdown_timer(void *timer) ++{ ++ timer_shutdown_sync(timer); ++} ++ + static int exc3000_read_frame(struct exc3000_data *data, u8 *buf) + { + struct i2c_client *client = data->client; +@@ -386,6 +391,11 @@ static int exc3000_probe(struct i2c_client *client) + if (error) + return error; + ++ error = devm_add_action_or_reset(&client->dev, exc3000_shutdown_timer, ++ &data->timer); ++ if (error) ++ return error; ++ + error = devm_request_threaded_irq(&client->dev, client->irq, + NULL, exc3000_interrupt, IRQF_ONESHOT, + client->name, data); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-891-mtd-spi-nor-sfdp-Fix-index-value-for-SCCR-dword.patch b/patches.kernel.org/6.2.3-891-mtd-spi-nor-sfdp-Fix-index-value-for-SCCR-dword.patch new file mode 100644 index 0000000..303cd8f --- /dev/null +++ b/patches.kernel.org/6.2.3-891-mtd-spi-nor-sfdp-Fix-index-value-for-SCCR-dword.patch @@ -0,0 +1,39 @@ +From: Takahiro Kuwano +Date: Mon, 26 Dec 2022 13:01:58 +0900 +Subject: [PATCH] mtd: spi-nor: sfdp: Fix index value for SCCR dwords +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ad9679f3811899fd1c21dc7bdd715e8e1cfb46b9 + +commit ad9679f3811899fd1c21dc7bdd715e8e1cfb46b9 upstream. + +Array index for SCCR 22th DOWRD should be 21. + +Fixes: 981a8d60e01f ("mtd: spi-nor: Parse SFDP SCCR Map") +Signed-off-by: Takahiro Kuwano +Signed-off-by: Tudor Ambarus +Reviewed-by: Michael Walle +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/d8a2a77c2c95cf776e7dcae6392d29fdcf5d6307.1672026365.git.Takahiro.Kuwano@infineon.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/mtd/spi-nor/sfdp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c +index 8434f654..5df2fcba 100644 +--- a/drivers/mtd/spi-nor/sfdp.c ++++ b/drivers/mtd/spi-nor/sfdp.c +@@ -1228,7 +1228,7 @@ static int spi_nor_parse_sccr(struct spi_nor *nor, + + le32_to_cpu_array(dwords, sccr_header->length); + +- if (FIELD_GET(SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE, dwords[22])) ++ if (FIELD_GET(SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE, dwords[21])) + nor->flags |= SNOR_F_IO_MODE_EN_VOLATILE; + + out: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-892-mtd-spi-nor-spansion-Consider-reserved-bits-in-.patch b/patches.kernel.org/6.2.3-892-mtd-spi-nor-spansion-Consider-reserved-bits-in-.patch new file mode 100644 index 0000000..838757c --- /dev/null +++ b/patches.kernel.org/6.2.3-892-mtd-spi-nor-spansion-Consider-reserved-bits-in-.patch @@ -0,0 +1,53 @@ +From: Tudor Ambarus +Date: Tue, 10 Jan 2023 18:47:02 +0200 +Subject: [PATCH] mtd: spi-nor: spansion: Consider reserved bits in CFR5 + register +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3f592a869f87723314f0cb1ac232bd3bf8245be8 + +commit 3f592a869f87723314f0cb1ac232bd3bf8245be8 upstream. + +CFR5[6] is reserved bit and must be always 1. Set it to comply with flash +requirements. While fixing SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_{EN, DS} +definition, stop using magic numbers and describe the missing bit fields +in CFR5 register. This is useful for both readability and future possible +addition of Octal STR mode support. + +Fixes: c3266af101f2 ("mtd: spi-nor: spansion: add support for Cypress Semper flash") +Cc: stable@vger.kernel.org +Reported-by: Takahiro Kuwano +Signed-off-by: Tudor Ambarus +Reviewed-by: Dhruva Gole +Reviewed-by: Pratyush Yadav +Tested-by: Dhruva Gole +Link: https://lore.kernel.org/linux-mtd/20230110164703.83413-1-tudor.ambarus@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/mtd/spi-nor/spansion.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/spi-nor/spansion.c b/drivers/mtd/spi-nor/spansion.c +index b621cdfd..07fe0f6f 100644 +--- a/drivers/mtd/spi-nor/spansion.c ++++ b/drivers/mtd/spi-nor/spansion.c +@@ -21,8 +21,13 @@ + #define SPINOR_REG_CYPRESS_CFR3V 0x00800004 + #define SPINOR_REG_CYPRESS_CFR3V_PGSZ BIT(4) /* Page size. */ + #define SPINOR_REG_CYPRESS_CFR5V 0x00800006 +-#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_EN 0x3 +-#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_DS 0 ++#define SPINOR_REG_CYPRESS_CFR5_BIT6 BIT(6) ++#define SPINOR_REG_CYPRESS_CFR5_DDR BIT(1) ++#define SPINOR_REG_CYPRESS_CFR5_OPI BIT(0) ++#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_EN \ ++ (SPINOR_REG_CYPRESS_CFR5_BIT6 | SPINOR_REG_CYPRESS_CFR5_DDR | \ ++ SPINOR_REG_CYPRESS_CFR5_OPI) ++#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_DS SPINOR_REG_CYPRESS_CFR5_BIT6 + #define SPINOR_OP_CYPRESS_RD_FAST 0xee + + /* Cypress SPI NOR flash operations. */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-893-mtd-spi-nor-Fix-shift-out-of-bounds-in-spi_nor_.patch b/patches.kernel.org/6.2.3-893-mtd-spi-nor-Fix-shift-out-of-bounds-in-spi_nor_.patch new file mode 100644 index 0000000..1d7aff4 --- /dev/null +++ b/patches.kernel.org/6.2.3-893-mtd-spi-nor-Fix-shift-out-of-bounds-in-spi_nor_.patch @@ -0,0 +1,96 @@ +From: Louis Rannou +Date: Fri, 3 Feb 2023 09:07:54 +0200 +Subject: [PATCH] mtd: spi-nor: Fix shift-out-of-bounds in + spi_nor_set_erase_type +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f0f0cfdc3a024e21161714f2e05f0df3b84d42ad + +commit f0f0cfdc3a024e21161714f2e05f0df3b84d42ad upstream. + +spi_nor_set_erase_type() was used either to set or to mask out an erase +type. When we used it to mask out an erase type a shift-out-of-bounds +was hit: +UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 +shift exponent 4294967295 is too large for 32-bit type 'int' + +The setting of the size_{shift, mask} and of the opcode are unnecessary +when the erase size is zero, as throughout the code just the erase size +is considered to determine whether an erase type is supported or not. +Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF +is an unused opcode. Thus when masking out an erase type, just set the +erase size to zero. This will fix the shift-out-of-bounds. + +Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") +Cc: stable@vger.kernel.org +Reported-by: Alexander Stein +Signed-off-by: Louis Rannou +Tested-by: Alexander Stein +Link: https://lore.kernel.org/r/20230203070754.50677-1-tudor.ambarus@linaro.org +[ta: refine changes, new commit message, fix compilation error] +Signed-off-by: Tudor Ambarus +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/mtd/spi-nor/core.c | 9 +++++++++ + drivers/mtd/spi-nor/core.h | 1 + + drivers/mtd/spi-nor/sfdp.c | 4 ++-- + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c +index d67c926b..2ef2660f 100644 +--- a/drivers/mtd/spi-nor/core.c ++++ b/drivers/mtd/spi-nor/core.c +@@ -2026,6 +2026,15 @@ void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, + erase->size_mask = (1 << erase->size_shift) - 1; + } + ++/** ++ * spi_nor_mask_erase_type() - mask out a SPI NOR erase type ++ * @erase: pointer to a structure that describes a SPI NOR erase type ++ */ ++void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase) ++{ ++ erase->size = 0; ++} ++ + /** + * spi_nor_init_uniform_erase_map() - Initialize uniform erase map + * @map: the erase map of the SPI NOR +diff --git a/drivers/mtd/spi-nor/core.h b/drivers/mtd/spi-nor/core.h +index f03b55cf..958cd143 100644 +--- a/drivers/mtd/spi-nor/core.h ++++ b/drivers/mtd/spi-nor/core.h +@@ -684,6 +684,7 @@ void spi_nor_set_pp_settings(struct spi_nor_pp_command *pp, u8 opcode, + + void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, + u8 opcode); ++void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase); + struct spi_nor_erase_region * + spi_nor_region_next(struct spi_nor_erase_region *region); + void spi_nor_init_uniform_erase_map(struct spi_nor_erase_map *map, +diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c +index 5df2fcba..22390660 100644 +--- a/drivers/mtd/spi-nor/sfdp.c ++++ b/drivers/mtd/spi-nor/sfdp.c +@@ -875,7 +875,7 @@ static int spi_nor_init_non_uniform_erase_map(struct spi_nor *nor, + */ + for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++) + if (!(regions_erase_type & BIT(erase[i].idx))) +- spi_nor_set_erase_type(&erase[i], 0, 0xFF); ++ spi_nor_mask_erase_type(&erase[i]); + + return 0; + } +@@ -1089,7 +1089,7 @@ static int spi_nor_parse_4bait(struct spi_nor *nor, + erase_type[i].opcode = (dwords[1] >> + erase_type[i].idx * 8) & 0xFF; + else +- spi_nor_set_erase_type(&erase_type[i], 0u, 0xFF); ++ spi_nor_mask_erase_type(&erase_type[i]); + } + + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-894-dm-send-just-one-event-on-resize-not-two.patch b/patches.kernel.org/6.2.3-894-dm-send-just-one-event-on-resize-not-two.patch new file mode 100644 index 0000000..c9290bd --- /dev/null +++ b/patches.kernel.org/6.2.3-894-dm-send-just-one-event-on-resize-not-two.patch @@ -0,0 +1,178 @@ +From: Mikulas Patocka +Date: Tue, 7 Feb 2023 08:33:06 -0500 +Subject: [PATCH] dm: send just one event on resize, not two +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7533afa1d27ba1234146d31d2402c195cf195962 + +commit 7533afa1d27ba1234146d31d2402c195cf195962 upstream. + +Device mapper sends an uevent when the device is suspended, using the +function set_capacity_and_notify. However, this causes a race condition +with udev. + +Udev skips scanning dm devices that are suspended. If we send an uevent +while we are suspended, udev will be racing with device mapper resume +code. If the device mapper resume code wins the race, udev will process +the uevent after the device is resumed and it will properly scan the +device. + +However, if udev wins the race, it will receive the uevent, find out that +the dm device is suspended and skip scanning the device. This causes bugs +such as systemd unmounting the device - see +https://bugzilla.redhat.com/show_bug.cgi?id=2158628 + +This commit fixes this race. + +We replace the function set_capacity_and_notify with set_capacity, so that +the uevent is not sent at this point. In do_resume, we detect if the +capacity has changed and we pass a boolean variable need_resize_uevent to +dm_kobject_uevent. dm_kobject_uevent adds "RESIZE=1" to the uevent if +need_resize_uevent is set. + +Signed-off-by: Mikulas Patocka +Tested-by: Peter Rajnoha +Cc: stable@vger.kernel.org +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-ioctl.c | 13 ++++++++++--- + drivers/md/dm.c | 27 +++++++++++++-------------- + drivers/md/dm.h | 2 +- + 3 files changed, 24 insertions(+), 18 deletions(-) + +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index 36fc6ae4..e031088f 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -482,7 +482,7 @@ static struct mapped_device *dm_hash_rename(struct dm_ioctl *param, + dm_table_event(table); + dm_put_live_table(hc->md, srcu_idx); + +- if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, param->event_nr)) ++ if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, param->event_nr, false)) + param->flags |= DM_UEVENT_GENERATED_FLAG; + + md = hc->md; +@@ -995,7 +995,7 @@ static int dev_remove(struct file *filp, struct dm_ioctl *param, size_t param_si + + dm_ima_measure_on_device_remove(md, false); + +- if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr)) ++ if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr, false)) + param->flags |= DM_UEVENT_GENERATED_FLAG; + + dm_put(md); +@@ -1129,6 +1129,7 @@ static int do_resume(struct dm_ioctl *param) + struct hash_cell *hc; + struct mapped_device *md; + struct dm_table *new_map, *old_map = NULL; ++ bool need_resize_uevent = false; + + down_write(&_hash_lock); + +@@ -1149,6 +1150,8 @@ static int do_resume(struct dm_ioctl *param) + + /* Do we need to load a new map ? */ + if (new_map) { ++ sector_t old_size, new_size; ++ + /* Suspend if it isn't already suspended */ + if (param->flags & DM_SKIP_LOCKFS_FLAG) + suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG; +@@ -1157,6 +1160,7 @@ static int do_resume(struct dm_ioctl *param) + if (!dm_suspended_md(md)) + dm_suspend(md, suspend_flags); + ++ old_size = dm_get_size(md); + old_map = dm_swap_table(md, new_map); + if (IS_ERR(old_map)) { + dm_sync_table(md); +@@ -1164,6 +1168,9 @@ static int do_resume(struct dm_ioctl *param) + dm_put(md); + return PTR_ERR(old_map); + } ++ new_size = dm_get_size(md); ++ if (old_size && new_size && old_size != new_size) ++ need_resize_uevent = true; + + if (dm_table_get_mode(new_map) & FMODE_WRITE) + set_disk_ro(dm_disk(md), 0); +@@ -1176,7 +1183,7 @@ static int do_resume(struct dm_ioctl *param) + if (!r) { + dm_ima_measure_on_device_resume(md, new_map ? true : false); + +- if (!dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr)) ++ if (!dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr, need_resize_uevent)) + param->flags |= DM_UEVENT_GENERATED_FLAG; + } + } +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index eba9bc06..edf7af98 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2171,10 +2171,7 @@ static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t, + if (size != dm_get_size(md)) + memset(&md->geometry, 0, sizeof(md->geometry)); + +- if (!get_capacity(md->disk)) +- set_capacity(md->disk, size); +- else +- set_capacity_and_notify(md->disk, size); ++ set_capacity(md->disk, size); + + dm_table_event_callback(t, event_callback, md); + +@@ -2967,23 +2964,25 @@ EXPORT_SYMBOL_GPL(dm_internal_resume_fast); + * Event notification. + *---------------------------------------------------------------*/ + int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action, +- unsigned cookie) ++ unsigned cookie, bool need_resize_uevent) + { + int r; + unsigned noio_flag; + char udev_cookie[DM_COOKIE_LENGTH]; +- char *envp[] = { udev_cookie, NULL }; +- +- noio_flag = memalloc_noio_save(); +- +- if (!cookie) +- r = kobject_uevent(&disk_to_dev(md->disk)->kobj, action); +- else { ++ char *envp[3] = { NULL, NULL, NULL }; ++ char **envpp = envp; ++ if (cookie) { + snprintf(udev_cookie, DM_COOKIE_LENGTH, "%s=%u", + DM_COOKIE_ENV_VAR_NAME, cookie); +- r = kobject_uevent_env(&disk_to_dev(md->disk)->kobj, +- action, envp); ++ *envpp++ = udev_cookie; + } ++ if (need_resize_uevent) { ++ *envpp++ = "RESIZE=1"; ++ } ++ ++ noio_flag = memalloc_noio_save(); ++ ++ r = kobject_uevent_env(&disk_to_dev(md->disk)->kobj, action, envp); + + memalloc_noio_restore(noio_flag); + +diff --git a/drivers/md/dm.h b/drivers/md/dm.h +index 5201df03..a9a3ffca 100644 +--- a/drivers/md/dm.h ++++ b/drivers/md/dm.h +@@ -203,7 +203,7 @@ int dm_get_table_device(struct mapped_device *md, dev_t dev, fmode_t mode, + void dm_put_table_device(struct mapped_device *md, struct dm_dev *d); + + int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action, +- unsigned cookie); ++ unsigned cookie, bool need_resize_uevent); + + void dm_internal_suspend(struct mapped_device *md); + void dm_internal_resume(struct mapped_device *md); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-895-dm-add-cond_resched-to-dm_wq_work.patch b/patches.kernel.org/6.2.3-895-dm-add-cond_resched-to-dm_wq_work.patch new file mode 100644 index 0000000..7d0bba3 --- /dev/null +++ b/patches.kernel.org/6.2.3-895-dm-add-cond_resched-to-dm_wq_work.patch @@ -0,0 +1,38 @@ +From: Pingfan Liu +Date: Wed, 15 Feb 2023 19:23:40 +0800 +Subject: [PATCH] dm: add cond_resched() to dm_wq_work() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0ca44fcef241768fd25ee763b3d203b9852f269b + +commit 0ca44fcef241768fd25ee763b3d203b9852f269b upstream. + +Otherwise the while() loop in dm_wq_work() can result in a "dead +loop" on systems that have preemption disabled. This is particularly +problematic on single cpu systems. + +Cc: stable@vger.kernel.org +Signed-off-by: Pingfan Liu +Acked-by: Ming Lei +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index edf7af98..3aea215a 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2565,6 +2565,7 @@ static void dm_wq_work(struct work_struct *work) + break; + + submit_bio_noacct(bio); ++ cond_resched(); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-896-dm-add-cond_resched-to-dm_wq_requeue_work.patch b/patches.kernel.org/6.2.3-896-dm-add-cond_resched-to-dm_wq_requeue_work.patch new file mode 100644 index 0000000..07ab505 --- /dev/null +++ b/patches.kernel.org/6.2.3-896-dm-add-cond_resched-to-dm_wq_requeue_work.patch @@ -0,0 +1,37 @@ +From: Mike Snitzer +Date: Thu, 16 Feb 2023 12:10:05 -0500 +Subject: [PATCH] dm: add cond_resched() to dm_wq_requeue_work() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f77692d65d54665d81815349cc727baa85e8b71d + +commit f77692d65d54665d81815349cc727baa85e8b71d upstream. + +Otherwise the while() loop in dm_wq_requeue_work() can result in a +"dead loop" on systems that have preemption disabled. This is +particularly problematic on single cpu systems. + +Fixes: 8b211aaccb915 ("dm: add two stage requeue mechanism") +Cc: stable@vger.kernel.org +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 3aea215a..60566293 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1007,6 +1007,7 @@ static void dm_wq_requeue_work(struct work_struct *work) + io->next = NULL; + __dm_io_complete(io, false); + io = next; ++ cond_resched(); + } + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-897-wifi-rtw88-use-RTW_FLAG_POWERON-flag-to-prevent.patch b/patches.kernel.org/6.2.3-897-wifi-rtw88-use-RTW_FLAG_POWERON-flag-to-prevent.patch new file mode 100644 index 0000000..b9f81d4 --- /dev/null +++ b/patches.kernel.org/6.2.3-897-wifi-rtw88-use-RTW_FLAG_POWERON-flag-to-prevent.patch @@ -0,0 +1,140 @@ +From: Ping-Ke Shih +Date: Thu, 16 Feb 2023 13:36:33 +0800 +Subject: [PATCH] wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power + on/off twice +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4a267bc5ea8f159b614d0549030216d0434eccca + +commit 4a267bc5ea8f159b614d0549030216d0434eccca upstream. + +Use power state to decide whether we can enter or leave IPS accurately, +and then prevent to power on/off twice. + +The commit 6bf3a083407b ("wifi: rtw88: add flag check before enter or leave IPS") +would like to prevent this as well, but it still can't entirely handle all +cases. The exception is that WiFi gets connected and does suspend/resume, +it will power on twice and cause it failed to power on after resuming, +like: + + rtw_8723de 0000:03:00.0: failed to poll offset=0x6 mask=0x2 value=0x2 + rtw_8723de 0000:03:00.0: mac power on failed + rtw_8723de 0000:03:00.0: failed to power on mac + rtw_8723de 0000:03:00.0: leave idle state failed + rtw_8723de 0000:03:00.0: failed to leave ips state + rtw_8723de 0000:03:00.0: failed to leave idle state + rtw_8723de 0000:03:00.0: failed to send h2c command + +To fix this, introduce new flag RTW_FLAG_POWERON to reflect power state, +and call rtw_mac_pre_system_cfg() to configure registers properly between +power-off/-on. + +Reported-by: Paul Gover +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217016 +Fixes: 6bf3a083407b ("wifi: rtw88: add flag check before enter or leave IPS") +Cc: +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230216053633.20366-1-pkshih@realtek.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtw88/coex.c | 2 +- + drivers/net/wireless/realtek/rtw88/mac.c | 10 ++++++++++ + drivers/net/wireless/realtek/rtw88/main.h | 2 +- + drivers/net/wireless/realtek/rtw88/ps.c | 4 ++-- + drivers/net/wireless/realtek/rtw88/wow.c | 2 +- + 5 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c +index 38697237..86467d2f 100644 +--- a/drivers/net/wireless/realtek/rtw88/coex.c ++++ b/drivers/net/wireless/realtek/rtw88/coex.c +@@ -4056,7 +4056,7 @@ void rtw_coex_display_coex_info(struct rtw_dev *rtwdev, struct seq_file *m) + rtwdev->stats.tx_throughput, rtwdev->stats.rx_throughput); + seq_printf(m, "%-40s = %u/ %u/ %u\n", + "IPS/ Low Power/ PS mode", +- test_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags), ++ !test_bit(RTW_FLAG_POWERON, rtwdev->flags), + test_bit(RTW_FLAG_LEISURE_PS_DEEP, rtwdev->flags), + rtwdev->lps_conf.mode); + +diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c +index 98777f29..aa7c5901 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac.c ++++ b/drivers/net/wireless/realtek/rtw88/mac.c +@@ -273,6 +273,11 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on) + if (rtw_pwr_seq_parser(rtwdev, pwr_seq)) + return -EINVAL; + ++ if (pwr_on) ++ set_bit(RTW_FLAG_POWERON, rtwdev->flags); ++ else ++ clear_bit(RTW_FLAG_POWERON, rtwdev->flags); ++ + return 0; + } + +@@ -335,6 +340,11 @@ int rtw_mac_power_on(struct rtw_dev *rtwdev) + ret = rtw_mac_power_switch(rtwdev, true); + if (ret == -EALREADY) { + rtw_mac_power_switch(rtwdev, false); ++ ++ ret = rtw_mac_pre_system_cfg(rtwdev); ++ if (ret) ++ goto err; ++ + ret = rtw_mac_power_switch(rtwdev, true); + if (ret) + goto err; +diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h +index 165f299e..d4a53d55 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.h ++++ b/drivers/net/wireless/realtek/rtw88/main.h +@@ -356,7 +356,7 @@ enum rtw_flags { + RTW_FLAG_RUNNING, + RTW_FLAG_FW_RUNNING, + RTW_FLAG_SCANNING, +- RTW_FLAG_INACTIVE_PS, ++ RTW_FLAG_POWERON, + RTW_FLAG_LEISURE_PS, + RTW_FLAG_LEISURE_PS_DEEP, + RTW_FLAG_DIG_DISABLE, +diff --git a/drivers/net/wireless/realtek/rtw88/ps.c b/drivers/net/wireless/realtek/rtw88/ps.c +index 11594940..99636557 100644 +--- a/drivers/net/wireless/realtek/rtw88/ps.c ++++ b/drivers/net/wireless/realtek/rtw88/ps.c +@@ -25,7 +25,7 @@ static int rtw_ips_pwr_up(struct rtw_dev *rtwdev) + + int rtw_enter_ips(struct rtw_dev *rtwdev) + { +- if (test_and_set_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags)) ++ if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags)) + return 0; + + rtw_coex_ips_notify(rtwdev, COEX_IPS_ENTER); +@@ -50,7 +50,7 @@ int rtw_leave_ips(struct rtw_dev *rtwdev) + { + int ret; + +- if (!test_and_clear_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags)) ++ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags)) + return 0; + + rtw_hci_link_ps(rtwdev, false); +diff --git a/drivers/net/wireless/realtek/rtw88/wow.c b/drivers/net/wireless/realtek/rtw88/wow.c +index 89dc5950..16ddee57 100644 +--- a/drivers/net/wireless/realtek/rtw88/wow.c ++++ b/drivers/net/wireless/realtek/rtw88/wow.c +@@ -592,7 +592,7 @@ static int rtw_wow_leave_no_link_ps(struct rtw_dev *rtwdev) + if (rtw_get_lps_deep_mode(rtwdev) != LPS_DEEP_MODE_NONE) + rtw_leave_lps_deep(rtwdev); + } else { +- if (test_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags)) { ++ if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags)) { + rtw_wow->ips_enabled = true; + ret = rtw_leave_ips(rtwdev); + if (ret) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-898-wifi-rtl8xxxu-Use-a-longer-retry-limit-of-48.patch b/patches.kernel.org/6.2.3-898-wifi-rtl8xxxu-Use-a-longer-retry-limit-of-48.patch new file mode 100644 index 0000000..82b3527 --- /dev/null +++ b/patches.kernel.org/6.2.3-898-wifi-rtl8xxxu-Use-a-longer-retry-limit-of-48.patch @@ -0,0 +1,65 @@ +From: Bitterblue Smith +Date: Sun, 8 Jan 2023 17:08:16 +0200 +Subject: [PATCH] wifi: rtl8xxxu: Use a longer retry limit of 48 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2a86aa9a1892d60ef2e3f310f5b42b8b05546d65 + +commit 2a86aa9a1892d60ef2e3f310f5b42b8b05546d65 upstream. + +The Realtek rate control algorithm goes back and forth a lot between +the highest and the lowest rate it's allowed to use. This is due to +a lot of frames being dropped because the retry limits set by +IEEE80211_CONF_CHANGE_RETRY_LIMITS are too low. (Experimentally, they +are 4 for long frames and 7 for short frames.) + +The vendor drivers hardcode the value 48 for both retry limits (for +station mode), which makes dropped frames very rare and thus the rate +control is more stable. + +Because most Realtek chips handle the rate control in the firmware, +which can't be modified, ignore the limits set by +IEEE80211_CONF_CHANGE_RETRY_LIMITS and use the value 48 (set during +chip initialisation), same as the vendor drivers. + +Cc: stable@vger.kernel.org +Signed-off-by: Bitterblue Smith +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/477d745b-6bac-111d-403c-487fc19aa30d@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 75d393b5..d2299046 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5954,7 +5954,6 @@ static int rtl8xxxu_config(struct ieee80211_hw *hw, u32 changed) + { + struct rtl8xxxu_priv *priv = hw->priv; + struct device *dev = &priv->udev->dev; +- u16 val16; + int ret = 0, channel; + bool ht40; + +@@ -5964,14 +5963,6 @@ static int rtl8xxxu_config(struct ieee80211_hw *hw, u32 changed) + __func__, hw->conf.chandef.chan->hw_value, + changed, hw->conf.chandef.width); + +- if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) { +- val16 = ((hw->conf.long_frame_max_tx_count << +- RETRY_LIMIT_LONG_SHIFT) & RETRY_LIMIT_LONG_MASK) | +- ((hw->conf.short_frame_max_tx_count << +- RETRY_LIMIT_SHORT_SHIFT) & RETRY_LIMIT_SHORT_MASK); +- rtl8xxxu_write16(priv, REG_RETRY_LIMIT, val16); +- } +- + if (changed & IEEE80211_CONF_CHANGE_CHANNEL) { + switch (hw->conf.chandef.width) { + case NL80211_CHAN_WIDTH_20_NOHT: +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-899-wifi-ath11k-allow-system-suspend-to-survive-ath.patch b/patches.kernel.org/6.2.3-899-wifi-ath11k-allow-system-suspend-to-survive-ath.patch new file mode 100644 index 0000000..e91f0af --- /dev/null +++ b/patches.kernel.org/6.2.3-899-wifi-ath11k-allow-system-suspend-to-survive-ath.patch @@ -0,0 +1,54 @@ +From: Len Brown +Date: Wed, 1 Feb 2023 12:32:01 -0600 +Subject: [PATCH] wifi: ath11k: allow system suspend to survive ath11k +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7c15430822e71e90203d87e6d0cfe83fa058b0dc + +commit 7c15430822e71e90203d87e6d0cfe83fa058b0dc upstream. + +When ath11k runs into internal errors upon suspend, +it returns an error code to pci_pm_suspend, which +aborts the entire system suspend. + +The driver should not abort system suspend, but should +keep its internal errors to itself, and allow the system +to suspend. Otherwise, a user can suspend a laptop +by closing the lid and sealing it into a case, assuming +that is will suspend, rather than heating up and draining +the battery when in transit. + +In practice, the ath11k device seems to have plenty of transient +errors, and subsequent suspend cycles after this failure +often succeed. + +https://bugzilla.kernel.org/show_bug.cgi?id=216968 + +Fixes: d1b0c33850d29 ("ath11k: implement suspend for QCA6390 PCI devices") + +Signed-off-by: Len Brown +Cc: stable@vger.kernel.org +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230201183201.14431-1-len.brown@intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/wireless/ath/ath11k/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath11k/pci.c b/drivers/net/wireless/ath/ath11k/pci.c +index 99cf3357..3c6005ab 100644 +--- a/drivers/net/wireless/ath/ath11k/pci.c ++++ b/drivers/net/wireless/ath/ath11k/pci.c +@@ -979,7 +979,7 @@ static __maybe_unused int ath11k_pci_pm_suspend(struct device *dev) + if (ret) + ath11k_warn(ab, "failed to suspend core: %d\n", ret); + +- return ret; ++ return 0; + } + + static __maybe_unused int ath11k_pci_pm_resume(struct device *dev) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-900-wifi-cfg80211-Fix-use-after-free-for-wext.patch b/patches.kernel.org/6.2.3-900-wifi-cfg80211-Fix-use-after-free-for-wext.patch new file mode 100644 index 0000000..d769190 --- /dev/null +++ b/patches.kernel.org/6.2.3-900-wifi-cfg80211-Fix-use-after-free-for-wext.patch @@ -0,0 +1,102 @@ +From: Alexander Wetzel +Date: Tue, 24 Jan 2023 15:18:56 +0100 +Subject: [PATCH] wifi: cfg80211: Fix use after free for wext +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 015b8cc5e7c4d7bb671f1984d7b7338c310b185b + +commit 015b8cc5e7c4d7bb671f1984d7b7338c310b185b upstream. + +Key information in wext.connect is not reset on (re)connect and can hold +data from a previous connection. + +Reset key data to avoid that drivers or mac80211 incorrectly detect a +WEP connection request and access the freed or already reused memory. + +Additionally optimize cfg80211_sme_connect() and avoid an useless +schedule of conn_work. + +Fixes: fffd0934b939 ("cfg80211: rework key operation") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230124141856.356646-1-alexander@wetzel-home.de +Signed-off-by: Alexander Wetzel +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/wireless/sme.c | 31 ++++++++++++++++++++++++++----- + 1 file changed, 26 insertions(+), 5 deletions(-) + +diff --git a/net/wireless/sme.c b/net/wireless/sme.c +index 4b5b6ee0..e2dcc28f 100644 +--- a/net/wireless/sme.c ++++ b/net/wireless/sme.c +@@ -285,6 +285,15 @@ void cfg80211_conn_work(struct work_struct *work) + wiphy_unlock(&rdev->wiphy); + } + ++static void cfg80211_step_auth_next(struct cfg80211_conn *conn, ++ struct cfg80211_bss *bss) ++{ ++ memcpy(conn->bssid, bss->bssid, ETH_ALEN); ++ conn->params.bssid = conn->bssid; ++ conn->params.channel = bss->channel; ++ conn->state = CFG80211_CONN_AUTHENTICATE_NEXT; ++} ++ + /* Returned bss is reference counted and must be cleaned up appropriately. */ + static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev) + { +@@ -302,10 +311,7 @@ static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev) + if (!bss) + return NULL; + +- memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN); +- wdev->conn->params.bssid = wdev->conn->bssid; +- wdev->conn->params.channel = bss->channel; +- wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT; ++ cfg80211_step_auth_next(wdev->conn, bss); + schedule_work(&rdev->conn_work); + + return bss; +@@ -597,7 +603,12 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev, + wdev->conn->params.ssid_len = wdev->u.client.ssid_len; + + /* see if we have the bss already */ +- bss = cfg80211_get_conn_bss(wdev); ++ bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel, ++ wdev->conn->params.bssid, ++ wdev->conn->params.ssid, ++ wdev->conn->params.ssid_len, ++ wdev->conn_bss_type, ++ IEEE80211_PRIVACY(wdev->conn->params.privacy)); + + if (prev_bssid) { + memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN); +@@ -608,6 +619,7 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev, + if (bss) { + enum nl80211_timeout_reason treason; + ++ cfg80211_step_auth_next(wdev->conn, bss); + err = cfg80211_conn_do_work(wdev, &treason); + cfg80211_put_bss(wdev->wiphy, bss); + } else { +@@ -1468,6 +1480,15 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev, + } else { + if (WARN_ON(connkeys)) + return -EINVAL; ++ ++ /* connect can point to wdev->wext.connect which ++ * can hold key data from a previous connection ++ */ ++ connect->key = NULL; ++ connect->key_len = 0; ++ connect->key_idx = 0; ++ connect->crypto.cipher_group = 0; ++ connect->crypto.n_ciphers_pairwise = 0; + } + + wdev->connect_keys = connkeys; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-901-wifi-cfg80211-Set-SSID-if-it-is-not-already-set.patch b/patches.kernel.org/6.2.3-901-wifi-cfg80211-Set-SSID-if-it-is-not-already-set.patch new file mode 100644 index 0000000..9f95f16 --- /dev/null +++ b/patches.kernel.org/6.2.3-901-wifi-cfg80211-Set-SSID-if-it-is-not-already-set.patch @@ -0,0 +1,68 @@ +From: Marc Bornand +Date: Wed, 15 Feb 2023 08:47:53 +0000 +Subject: [PATCH] wifi: cfg80211: Set SSID if it is not already set +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c38c701851011c94ce3be1ccb3593678d2933fd8 + +commit c38c701851011c94ce3be1ccb3593678d2933fd8 upstream. + +When a connection was established without going through +NL80211_CMD_CONNECT, the ssid was never set in the wireless_dev struct. +Now we set it in __cfg80211_connect_result() when it is not already set. + +When using a userspace configuration that does not call +cfg80211_connect() (can be checked with breakpoints in the kernel), +this patch should allow `networkctl status device_name` to output the +SSID instead of null. + +Cc: stable@vger.kernel.org +Reported-by: Yohan Prod'homme +Fixes: 7b0a0e3c3a88 (wifi: cfg80211: do some rework towards MLO link APIs) +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216711 +Signed-off-by: Marc Bornand +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/wireless/sme.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/net/wireless/sme.c b/net/wireless/sme.c +index e2dcc28f..4f813e34 100644 +--- a/net/wireless/sme.c ++++ b/net/wireless/sme.c +@@ -736,6 +736,7 @@ void __cfg80211_connect_result(struct net_device *dev, + { + struct wireless_dev *wdev = dev->ieee80211_ptr; + const struct element *country_elem = NULL; ++ const struct element *ssid; + const u8 *country_data; + u8 country_datalen; + #ifdef CONFIG_CFG80211_WEXT +@@ -895,6 +896,22 @@ void __cfg80211_connect_result(struct net_device *dev, + country_data, country_datalen); + kfree(country_data); + ++ if (!wdev->u.client.ssid_len) { ++ rcu_read_lock(); ++ for_each_valid_link(cr, link) { ++ ssid = ieee80211_bss_get_elem(cr->links[link].bss, ++ WLAN_EID_SSID); ++ ++ if (!ssid || !ssid->datalen) ++ continue; ++ ++ memcpy(wdev->u.client.ssid, ssid->data, ssid->datalen); ++ wdev->u.client.ssid_len = ssid->datalen; ++ break; ++ } ++ rcu_read_unlock(); ++ } ++ + return; + out: + for_each_valid_link(cr, link) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-902-cpuidle-add-ARCH_SUSPEND_POSSIBLE-dependencies.patch b/patches.kernel.org/6.2.3-902-cpuidle-add-ARCH_SUSPEND_POSSIBLE-dependencies.patch new file mode 100644 index 0000000..3c81575 --- /dev/null +++ b/patches.kernel.org/6.2.3-902-cpuidle-add-ARCH_SUSPEND_POSSIBLE-dependencies.patch @@ -0,0 +1,61 @@ +From: Arnd Bergmann +Date: Mon, 6 Feb 2023 20:33:06 +0100 +Subject: [PATCH] cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7787943a3a8ade6594a68db28c166adbb1d3708c + +commit 7787943a3a8ade6594a68db28c166adbb1d3708c upstream. + +Some ARMv4 processors don't support suspend, which leads +to a build failure with the tegra and qualcomm cpuidle driver: + +WARNING: unmet direct dependencies detected for ARM_CPU_SUSPEND + Depends on [n]: ARCH_SUSPEND_POSSIBLE [=n] + Selected by [y]: + - ARM_TEGRA_CPUIDLE [=y] && CPU_IDLE [=y] && (ARM [=y] || ARM64) && (ARCH_TEGRA [=n] || COMPILE_TEST [=y]) && !ARM64 && MMU [=y] + +arch/arm/kernel/sleep.o: in function `__cpu_suspend': +(.text+0x68): undefined reference to `cpu_sa110_suspend_size' +(.text+0x68): undefined reference to `cpu_fa526_suspend_size' + +Add an explicit dependency to make randconfig builds avoid +this combination. + +Fixes: faae6c9f2e68 ("cpuidle: tegra: Enable compile testing") +Fixes: a871be6b8eee ("cpuidle: Convert Qualcomm SPM driver to a generic CPUidle driver") +Link: https://lore.kernel.org/all/20211013160125.772873-1-arnd@kernel.org/ +Cc: All applicable +Reviewed-by: Dmitry Osipenko +Signed-off-by: Arnd Bergmann +Acked-by: Thierry Reding +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/cpuidle/Kconfig.arm | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/cpuidle/Kconfig.arm b/drivers/cpuidle/Kconfig.arm +index 747aa537..f0714a32 100644 +--- a/drivers/cpuidle/Kconfig.arm ++++ b/drivers/cpuidle/Kconfig.arm +@@ -102,6 +102,7 @@ config ARM_MVEBU_V7_CPUIDLE + config ARM_TEGRA_CPUIDLE + bool "CPU Idle Driver for NVIDIA Tegra SoCs" + depends on (ARCH_TEGRA || COMPILE_TEST) && !ARM64 && MMU ++ depends on ARCH_SUSPEND_POSSIBLE + select ARCH_NEEDS_CPU_IDLE_COUPLED if SMP + select ARM_CPU_SUSPEND + help +@@ -110,6 +111,7 @@ config ARM_TEGRA_CPUIDLE + config ARM_QCOM_SPM_CPUIDLE + bool "CPU Idle Driver for Qualcomm Subsystem Power Manager (SPM)" + depends on (ARCH_QCOM || COMPILE_TEST) && !ARM64 && MMU ++ depends on ARCH_SUSPEND_POSSIBLE + select ARM_CPU_SUSPEND + select CPU_IDLE_MULTIPLE_DRIVERS + select DT_IDLE_STATES +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-903-qede-fix-interrupt-coalescing-configuration.patch b/patches.kernel.org/6.2.3-903-qede-fix-interrupt-coalescing-configuration.patch new file mode 100644 index 0000000..8da6db0 --- /dev/null +++ b/patches.kernel.org/6.2.3-903-qede-fix-interrupt-coalescing-configuration.patch @@ -0,0 +1,58 @@ +From: Manish Chopra +Date: Thu, 16 Feb 2023 03:54:47 -0800 +Subject: [PATCH] qede: fix interrupt coalescing configuration +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 908d4bb7c54caa58253a363d63e797a468eaf321 + +commit 908d4bb7c54caa58253a363d63e797a468eaf321 upstream. + +On default driver load device gets configured with unexpected +higher interrupt coalescing values instead of default expected +values as memory allocated from krealloc() is not supposed to +be zeroed out and may contain garbage values. + +Fix this by allocating the memory of required size first with +kcalloc() and then use krealloc() to resize and preserve the +contents across down/up of the interface. + +Signed-off-by: Manish Chopra +Fixes: b0ec5489c480 ("qede: preserve per queue stats across up/down of interface") +Cc: stable@vger.kernel.org +Cc: Bhaskar Upadhaya +Cc: David S. Miller +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2160054 +Signed-off-by: Alok Prasad +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/qlogic/qede/qede_main.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index 953f304b..af39513d 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -970,8 +970,15 @@ static int qede_alloc_fp_array(struct qede_dev *edev) + goto err; + } + +- mem = krealloc(edev->coal_entry, QEDE_QUEUE_CNT(edev) * +- sizeof(*edev->coal_entry), GFP_KERNEL); ++ if (!edev->coal_entry) { ++ mem = kcalloc(QEDE_MAX_RSS_CNT(edev), ++ sizeof(*edev->coal_entry), GFP_KERNEL); ++ } else { ++ mem = krealloc(edev->coal_entry, ++ QEDE_QUEUE_CNT(edev) * sizeof(*edev->coal_entry), ++ GFP_KERNEL); ++ } ++ + if (!mem) { + DP_ERR(edev, "coalesce entry allocation failed\n"); + kfree(edev->coal_entry); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-904-thermal-intel-powerclamp-Fix-cur_state-for-mult.patch b/patches.kernel.org/6.2.3-904-thermal-intel-powerclamp-Fix-cur_state-for-mult.patch new file mode 100644 index 0000000..0771e22 --- /dev/null +++ b/patches.kernel.org/6.2.3-904-thermal-intel-powerclamp-Fix-cur_state-for-mult.patch @@ -0,0 +1,104 @@ +From: Srinivas Pandruvada +Date: Wed, 1 Feb 2023 12:39:41 -0800 +Subject: [PATCH] thermal: intel: powerclamp: Fix cur_state for multi package + system +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8e47363588377e1bdb65e2b020b409cfb44dd260 + +commit 8e47363588377e1bdb65e2b020b409cfb44dd260 upstream. + +The powerclamp cooling device cur_state shows actual idle observed by +package C-state idle counters. But the implementation is not sufficient +for multi package or multi die system. The cur_state value is incorrect. +On these systems, these counters must be read from each package/die and +somehow aggregate them. But there is no good method for aggregation. + +It was not a problem when explicit CPU model addition was required to +enable intel powerclamp. In this way certain CPU models could have +been avoided. But with the removal of CPU model check with the +availability of Package C-state counters, the driver is loaded on most +of the recent systems. + +For multi package/die systems, just show the actual target idle state, +the system is trying to achieve. In powerclamp this is the user set +state minus one. + +Also there is no use of starting a worker thread for polling package +C-state counters and applying any compensation for multiple package +or multiple die systems. + +Fixes: b721ca0d1927 ("thermal/powerclamp: remove cpu whitelist") +Signed-off-by: Srinivas Pandruvada +Cc: 4.14+ # 4.14+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/thermal/intel/intel_powerclamp.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/intel/intel_powerclamp.c b/drivers/thermal/intel/intel_powerclamp.c +index b80e25ec..2f4cbfdf 100644 +--- a/drivers/thermal/intel/intel_powerclamp.c ++++ b/drivers/thermal/intel/intel_powerclamp.c +@@ -57,6 +57,7 @@ + + static unsigned int target_mwait; + static struct dentry *debug_dir; ++static bool poll_pkg_cstate_enable; + + /* user selected target */ + static unsigned int set_target_ratio; +@@ -261,6 +262,9 @@ static unsigned int get_compensation(int ratio) + { + unsigned int comp = 0; + ++ if (!poll_pkg_cstate_enable) ++ return 0; ++ + /* we only use compensation if all adjacent ones are good */ + if (ratio == 1 && + cal_data[ratio].confidence >= CONFIDENCE_OK && +@@ -519,7 +523,8 @@ static int start_power_clamp(void) + control_cpu = cpumask_first(cpu_online_mask); + + clamping = true; +- schedule_delayed_work(&poll_pkg_cstate_work, 0); ++ if (poll_pkg_cstate_enable) ++ schedule_delayed_work(&poll_pkg_cstate_work, 0); + + /* start one kthread worker per online cpu */ + for_each_online_cpu(cpu) { +@@ -585,11 +590,15 @@ static int powerclamp_get_max_state(struct thermal_cooling_device *cdev, + static int powerclamp_get_cur_state(struct thermal_cooling_device *cdev, + unsigned long *state) + { +- if (true == clamping) +- *state = pkg_cstate_ratio_cur; +- else ++ if (clamping) { ++ if (poll_pkg_cstate_enable) ++ *state = pkg_cstate_ratio_cur; ++ else ++ *state = set_target_ratio; ++ } else { + /* to save power, do not poll idle ratio while not clamping */ + *state = -1; /* indicates invalid state */ ++ } + + return 0; + } +@@ -712,6 +721,9 @@ static int __init powerclamp_init(void) + goto exit_unregister; + } + ++ if (topology_max_packages() == 1 && topology_max_die_per_package() == 1) ++ poll_pkg_cstate_enable = true; ++ + cooling_dev = thermal_cooling_device_register("intel_powerclamp", NULL, + &powerclamp_cooling_ops); + if (IS_ERR(cooling_dev)) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-905-dm-flakey-fix-logic-when-corrupting-a-bio.patch b/patches.kernel.org/6.2.3-905-dm-flakey-fix-logic-when-corrupting-a-bio.patch new file mode 100644 index 0000000..30e2ffe --- /dev/null +++ b/patches.kernel.org/6.2.3-905-dm-flakey-fix-logic-when-corrupting-a-bio.patch @@ -0,0 +1,71 @@ +From: Mikulas Patocka +Date: Sun, 22 Jan 2023 14:03:56 -0500 +Subject: [PATCH] dm flakey: fix logic when corrupting a bio +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aa56b9b75996ff4c76a0a4181c2fa0206c3d91cc + +commit aa56b9b75996ff4c76a0a4181c2fa0206c3d91cc upstream. + +If "corrupt_bio_byte" is set to corrupt reads and corrupt_bio_flags is +used, dm-flakey would erroneously return all writes as errors. Likewise, +if "corrupt_bio_byte" is set to corrupt writes, dm-flakey would return +errors for all reads. + +Fix the logic so that if fc->corrupt_bio_byte is non-zero, dm-flakey +will not abort reads on writes with an error. + +Cc: stable@vger.kernel.org +Signed-off-by: Mikulas Patocka +Reviewed-by: Sweet Tea Dorminy +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-flakey.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 89fa7a68..220bbf35 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -361,9 +361,11 @@ static int flakey_map(struct dm_target *ti, struct bio *bio) + /* + * Corrupt matching writes. + */ +- if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == WRITE)) { +- if (all_corrupt_bio_flags_match(bio, fc)) +- corrupt_bio_data(bio, fc); ++ if (fc->corrupt_bio_byte) { ++ if (fc->corrupt_bio_rw == WRITE) { ++ if (all_corrupt_bio_flags_match(bio, fc)) ++ corrupt_bio_data(bio, fc); ++ } + goto map_bio; + } + +@@ -389,13 +391,14 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, + return DM_ENDIO_DONE; + + if (!*error && pb->bio_submitted && (bio_data_dir(bio) == READ)) { +- if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) && +- all_corrupt_bio_flags_match(bio, fc)) { +- /* +- * Corrupt successful matching READs while in down state. +- */ +- corrupt_bio_data(bio, fc); +- ++ if (fc->corrupt_bio_byte) { ++ if ((fc->corrupt_bio_rw == READ) && ++ all_corrupt_bio_flags_match(bio, fc)) { ++ /* ++ * Corrupt successful matching READs while in down state. ++ */ ++ corrupt_bio_data(bio, fc); ++ } + } else if (!test_bit(DROP_WRITES, &fc->flags) && + !test_bit(ERROR_WRITES, &fc->flags)) { + /* +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-906-dm-cache-free-background-tracker-s-queued-work-.patch b/patches.kernel.org/6.2.3-906-dm-cache-free-background-tracker-s-queued-work-.patch new file mode 100644 index 0000000..1033c12 --- /dev/null +++ b/patches.kernel.org/6.2.3-906-dm-cache-free-background-tracker-s-queued-work-.patch @@ -0,0 +1,86 @@ +From: Joe Thornber +Date: Thu, 26 Jan 2023 09:59:10 +0000 +Subject: [PATCH] dm cache: free background tracker's queued work in + btracker_destroy +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 95ab80a8a0fef2ce0cc494a306dd283948066ce7 + +commit 95ab80a8a0fef2ce0cc494a306dd283948066ce7 upstream. + +Otherwise the kernel can BUG with: + +[ 2245.426978] ============================================================================= +[ 2245.435155] BUG bt_work (Tainted: G B W ): Objects remaining in bt_work on __kmem_cache_shutdown() +[ 2245.445233] ----------------------------------------------------------------------------- +[ 2245.445233] +[ 2245.454879] Slab 0x00000000b0ce2b30 objects=64 used=2 fp=0x000000000a3c6a4e flags=0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) +[ 2245.467300] CPU: 7 PID: 10805 Comm: lvm Kdump: loaded Tainted: G B W 6.0.0-rc2 #19 +[ 2245.476078] Hardware name: Dell Inc. PowerEdge R7525/0590KW, BIOS 2.5.6 10/06/2021 +[ 2245.483646] Call Trace: +[ 2245.486100] +[ 2245.488206] dump_stack_lvl+0x34/0x48 +[ 2245.491878] slab_err+0x95/0xcd +[ 2245.495028] __kmem_cache_shutdown.cold+0x31/0x136 +[ 2245.499821] kmem_cache_destroy+0x49/0x130 +[ 2245.503928] btracker_destroy+0x12/0x20 [dm_cache] +[ 2245.508728] smq_destroy+0x15/0x60 [dm_cache_smq] +[ 2245.513435] dm_cache_policy_destroy+0x12/0x20 [dm_cache] +[ 2245.518834] destroy+0xc0/0x110 [dm_cache] +[ 2245.522933] dm_table_destroy+0x5c/0x120 [dm_mod] +[ 2245.527649] __dm_destroy+0x10e/0x1c0 [dm_mod] +[ 2245.532102] dev_remove+0x117/0x190 [dm_mod] +[ 2245.536384] ctl_ioctl+0x1a2/0x290 [dm_mod] +[ 2245.540579] dm_ctl_ioctl+0xa/0x20 [dm_mod] +[ 2245.544773] __x64_sys_ioctl+0x8a/0xc0 +[ 2245.548524] do_syscall_64+0x5c/0x90 +[ 2245.552104] ? syscall_exit_to_user_mode+0x12/0x30 +[ 2245.556897] ? do_syscall_64+0x69/0x90 +[ 2245.560648] ? do_syscall_64+0x69/0x90 +[ 2245.564394] entry_SYSCALL_64_after_hwframe+0x63/0xcd +[ 2245.569447] RIP: 0033:0x7fe52583ec6b +... +[ 2245.646771] ------------[ cut here ]------------ +[ 2245.651395] kmem_cache_destroy bt_work: Slab cache still has objects when called from btracker_destroy+0x12/0x20 [dm_cache] +[ 2245.651408] WARNING: CPU: 7 PID: 10805 at mm/slab_common.c:478 kmem_cache_destroy+0x128/0x130 + +Found using: lvm2-testsuite --only "cache-single-split.sh" + +Ben bisected and found that commit 0495e337b703 ("mm/slab_common: +Deleting kobject in kmem_cache_destroy() without holding +slab_mutex/cpu_hotplug_lock") first exposed dm-cache's incomplete +cleanup of its background tracker work objects. + +Reported-by: Benjamin Marzinski +Tested-by: Benjamin Marzinski +Cc: stable@vger.kernel.org # 6.0+ +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-cache-background-tracker.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/md/dm-cache-background-tracker.c b/drivers/md/dm-cache-background-tracker.c +index 84814e81..7887f99b 100644 +--- a/drivers/md/dm-cache-background-tracker.c ++++ b/drivers/md/dm-cache-background-tracker.c +@@ -60,6 +60,14 @@ EXPORT_SYMBOL_GPL(btracker_create); + + void btracker_destroy(struct background_tracker *b) + { ++ struct bt_work *w, *tmp; ++ ++ BUG_ON(!list_empty(&b->issued)); ++ list_for_each_entry_safe (w, tmp, &b->queued, list) { ++ list_del(&w->list); ++ kmem_cache_free(b->work_cache, w); ++ } ++ + kmem_cache_destroy(b->work_cache); + kfree(b); + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-907-dm-flakey-don-t-corrupt-the-zero-page.patch b/patches.kernel.org/6.2.3-907-dm-flakey-don-t-corrupt-the-zero-page.patch new file mode 100644 index 0000000..1755fa7 --- /dev/null +++ b/patches.kernel.org/6.2.3-907-dm-flakey-don-t-corrupt-the-zero-page.patch @@ -0,0 +1,52 @@ +From: Mikulas Patocka +Date: Sun, 22 Jan 2023 14:02:57 -0500 +Subject: [PATCH] dm flakey: don't corrupt the zero page +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f50714b57aecb6b3dc81d578e295f86d9c73f078 + +commit f50714b57aecb6b3dc81d578e295f86d9c73f078 upstream. + +When we need to zero some range on a block device, the function +__blkdev_issue_zero_pages submits a write bio with the bio vector pointing +to the zero page. If we use dm-flakey with corrupt bio writes option, it +will corrupt the content of the zero page which results in crashes of +various userspace programs. Glibc assumes that memory returned by mmap is +zeroed and it uses it for calloc implementation; if the newly mapped +memory is not zeroed, calloc will return non-zeroed memory. + +Fix this bug by testing if the page is equal to ZERO_PAGE(0) and +avoiding the corruption in this case. + +Cc: stable@vger.kernel.org +Fixes: a00f5276e266 ("dm flakey: Properly corrupt multi-page bios.") +Signed-off-by: Mikulas Patocka +Reviewed-by: Sweet Tea Dorminy +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-flakey.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 220bbf35..805a70ab 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -303,8 +303,11 @@ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc) + */ + bio_for_each_segment(bvec, bio, iter) { + if (bio_iter_len(bio, iter) > corrupt_bio_byte) { +- char *segment = (page_address(bio_iter_page(bio, iter)) +- + bio_iter_offset(bio, iter)); ++ char *segment; ++ struct page *page = bio_iter_page(bio, iter); ++ if (unlikely(page == ZERO_PAGE(0))) ++ break; ++ segment = (page_address(page) + bio_iter_offset(bio, iter)); + segment[corrupt_bio_byte] = fc->corrupt_bio_value; + DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " + "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-908-dm-flakey-fix-a-bug-with-32-bit-highmem-systems.patch b/patches.kernel.org/6.2.3-908-dm-flakey-fix-a-bug-with-32-bit-highmem-systems.patch new file mode 100644 index 0000000..4ce41d8 --- /dev/null +++ b/patches.kernel.org/6.2.3-908-dm-flakey-fix-a-bug-with-32-bit-highmem-systems.patch @@ -0,0 +1,40 @@ +From: Mikulas Patocka +Date: Sun, 22 Jan 2023 14:03:31 -0500 +Subject: [PATCH] dm flakey: fix a bug with 32-bit highmem systems +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8eb29c4fbf9661e6bd4dd86197a37ffe0ecc9d50 + +commit 8eb29c4fbf9661e6bd4dd86197a37ffe0ecc9d50 upstream. + +The function page_address does not work with 32-bit systems with high +memory. Use bvec_kmap_local/kunmap_local instead. + +Cc: stable@vger.kernel.org +Signed-off-by: Mikulas Patocka +Reviewed-by: Sweet Tea Dorminy +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/md/dm-flakey.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index 805a70ab..335684a1 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -307,8 +307,9 @@ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc) + struct page *page = bio_iter_page(bio, iter); + if (unlikely(page == ZERO_PAGE(0))) + break; +- segment = (page_address(page) + bio_iter_offset(bio, iter)); ++ segment = bvec_kmap_local(&bvec); + segment[corrupt_bio_byte] = fc->corrupt_bio_value; ++ kunmap_local(segment); + DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " + "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n", + bio, fc->corrupt_bio_value, fc->corrupt_bio_byte, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-909-hwmon-peci-cputemp-Fix-off-by-one-in-coretemp_l.patch b/patches.kernel.org/6.2.3-909-hwmon-peci-cputemp-Fix-off-by-one-in-coretemp_l.patch new file mode 100644 index 0000000..291d00c --- /dev/null +++ b/patches.kernel.org/6.2.3-909-hwmon-peci-cputemp-Fix-off-by-one-in-coretemp_l.patch @@ -0,0 +1,42 @@ +From: Zev Weiss +Date: Wed, 1 Feb 2023 18:18:25 -0800 +Subject: [PATCH] hwmon: (peci/cputemp) Fix off-by-one in coretemp_label + allocation +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f00093608fa790580da309bb9feb5108fbe7c331 + +commit f00093608fa790580da309bb9feb5108fbe7c331 upstream. + +The find_last_bit() call produces the index of the highest-numbered +core in core_mask; because cores are numbered from zero, the number of +elements we need to allocate is one more than that. + +Signed-off-by: Zev Weiss +Cc: stable@kernel.org # v5.18 +Fixes: bf3608f338e9 ("hwmon: peci: Add cputemp driver") +Reviewed-by: Iwona Winiarska +Link: https://lore.kernel.org/r/20230202021825.21486-1-zev@bewilderbeest.net +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/peci/cputemp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/peci/cputemp.c b/drivers/hwmon/peci/cputemp.c +index 57470fda..30850a47 100644 +--- a/drivers/hwmon/peci/cputemp.c ++++ b/drivers/hwmon/peci/cputemp.c +@@ -402,7 +402,7 @@ static int create_temp_label(struct peci_cputemp *priv) + unsigned long core_max = find_last_bit(priv->core_mask, CORE_NUMS_MAX); + int i; + +- priv->coretemp_label = devm_kzalloc(priv->dev, core_max * sizeof(char *), GFP_KERNEL); ++ priv->coretemp_label = devm_kzalloc(priv->dev, (core_max + 1) * sizeof(char *), GFP_KERNEL); + if (!priv->coretemp_label) + return -ENOMEM; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-910-hwmon-nct6775-Fix-incorrect-parenthesization-in.patch b/patches.kernel.org/6.2.3-910-hwmon-nct6775-Fix-incorrect-parenthesization-in.patch new file mode 100644 index 0000000..3f194cb --- /dev/null +++ b/patches.kernel.org/6.2.3-910-hwmon-nct6775-Fix-incorrect-parenthesization-in.patch @@ -0,0 +1,42 @@ +From: Zev Weiss +Date: Mon, 2 Jan 2023 13:28:57 -0800 +Subject: [PATCH] hwmon: (nct6775) Fix incorrect parenthesization in + nct6775_write_fan_div() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2fbb848b65cde5b876cce52ebcb34de4aaa5a94a + +commit 2fbb848b65cde5b876cce52ebcb34de4aaa5a94a upstream. + +Commit 4ef2774511dc ("hwmon: (nct6775) Convert register access to +regmap API") fumbled the shifting & masking of the fan_div values such +that odd-numbered fan divisors would always be set to zero. Fix it so +that we actually OR in the bits we meant to. + +Signed-off-by: Zev Weiss +Fixes: 4ef2774511dc ("hwmon: (nct6775) Convert register access to regmap API") +Cc: stable@kernel.org # v5.19+ +Link: https://lore.kernel.org/r/20230102212857.5670-1-zev@bewilderbeest.net +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/hwmon/nct6775-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c +index da9ec698..c54233f0 100644 +--- a/drivers/hwmon/nct6775-core.c ++++ b/drivers/hwmon/nct6775-core.c +@@ -1150,7 +1150,7 @@ static int nct6775_write_fan_div(struct nct6775_data *data, int nr) + if (err) + return err; + reg &= 0x70 >> oddshift; +- reg |= data->fan_div[nr] & (0x7 << oddshift); ++ reg |= (data->fan_div[nr] & 0x7) << oddshift; + return nct6775_write_value(data, fandiv_reg, reg); + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-911-spi-intel-Check-number-of-chip-selects-after-re.patch b/patches.kernel.org/6.2.3-911-spi-intel-Check-number-of-chip-selects-after-re.patch new file mode 100644 index 0000000..1b1ce5d --- /dev/null +++ b/patches.kernel.org/6.2.3-911-spi-intel-Check-number-of-chip-selects-after-re.patch @@ -0,0 +1,53 @@ +From: Mika Westerberg +Date: Wed, 15 Feb 2023 13:00:40 +0200 +Subject: [PATCH] spi: intel: Check number of chip selects after reading the + descriptor +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 574fbb95cd9d88bdc9c9c4c64223a38a61d7de9a + +commit 574fbb95cd9d88bdc9c9c4c64223a38a61d7de9a upstream. + +The flash decriptor contains the number of flash components that we use +to figure out how many flash chips there are connected. Therefore we +need to read it first before deciding how many chip selects the +controller has. + +Reported-by: Marcin Witkowski +Fixes: 3f03c618bebb ("spi: intel: Add support for second flash chip") +Cc: stable@vger.kernel.org +Signed-off-by: Mika Westerberg +Link: https://lore.kernel.org/r/20230215110040.42186-1-mika.westerberg@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/spi/spi-intel.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-intel.c b/drivers/spi/spi-intel.c +index f619212b..62728792 100644 +--- a/drivers/spi/spi-intel.c ++++ b/drivers/spi/spi-intel.c +@@ -1368,14 +1368,14 @@ static int intel_spi_populate_chip(struct intel_spi *ispi) + if (!spi_new_device(ispi->master, &chip)) + return -ENODEV; + +- /* Add the second chip if present */ +- if (ispi->master->num_chipselect < 2) +- return 0; +- + ret = intel_spi_read_desc(ispi); + if (ret) + return ret; + ++ /* Add the second chip if present */ ++ if (ispi->master->num_chipselect < 2) ++ return 0; ++ + chip.platform_data = NULL; + chip.chip_select = 1; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-912-ARM-dts-qcom-sdx65-Add-Qcom-SMMU-500-as-the-fal.patch b/patches.kernel.org/6.2.3-912-ARM-dts-qcom-sdx65-Add-Qcom-SMMU-500-as-the-fal.patch new file mode 100644 index 0000000..d652214 --- /dev/null +++ b/patches.kernel.org/6.2.3-912-ARM-dts-qcom-sdx65-Add-Qcom-SMMU-500-as-the-fal.patch @@ -0,0 +1,41 @@ +From: Manivannan Sadhasivam +Date: Mon, 23 Jan 2023 18:49:31 +0530 +Subject: [PATCH] ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for + IOMMU node +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 157178a7912e00a0aa0371dc9041952c1a21d112 + +commit 157178a7912e00a0aa0371dc9041952c1a21d112 upstream. + +SDX65 uses the Qcom version of the SMMU-500 IP. So use "qcom,smmu-500" +compatible as the fallback to the SoC specific compatible. + +Cc: # 5.19 +Fixes: 98187f7b74bf ("ARM: dts: qcom: sdx65: Enable ARM SMMU") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230123131931.263024-4-manivannan.sadhasivam@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/qcom-sdx65.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-sdx65.dtsi b/arch/arm/boot/dts/qcom-sdx65.dtsi +index b073e0c6..408c4b87 100644 +--- a/arch/arm/boot/dts/qcom-sdx65.dtsi ++++ b/arch/arm/boot/dts/qcom-sdx65.dtsi +@@ -455,7 +455,7 @@ pil-reloc@94c { + }; + + apps_smmu: iommu@15000000 { +- compatible = "qcom,sdx65-smmu-500", "arm,mmu-500"; ++ compatible = "qcom,sdx65-smmu-500", "qcom,smmu-500", "arm,mmu-500"; + reg = <0x15000000 0x40000>; + #iommu-cells = <2>; + #global-interrupts = <1>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-913-ARM-dts-qcom-sdx55-Add-Qcom-SMMU-500-as-the-fal.patch b/patches.kernel.org/6.2.3-913-ARM-dts-qcom-sdx55-Add-Qcom-SMMU-500-as-the-fal.patch new file mode 100644 index 0000000..9b15dc3 --- /dev/null +++ b/patches.kernel.org/6.2.3-913-ARM-dts-qcom-sdx55-Add-Qcom-SMMU-500-as-the-fal.patch @@ -0,0 +1,41 @@ +From: Manivannan Sadhasivam +Date: Mon, 23 Jan 2023 18:49:30 +0530 +Subject: [PATCH] ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for + IOMMU node +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: af4ab377543853b690cc85b4c46cf976ab560dc2 + +commit af4ab377543853b690cc85b4c46cf976ab560dc2 upstream. + +SDX55 uses the Qcom version of the SMMU-500 IP. So use "qcom,smmu-500" +compatible as the fallback to the SoC specific compatible. + +Cc: # 5.12 +Fixes: a2bdfdfba2af ("ARM: dts: qcom: sdx55: Enable ARM SMMU") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230123131931.263024-3-manivannan.sadhasivam@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-sdx55.dtsi b/arch/arm/boot/dts/qcom-sdx55.dtsi +index f1c0dab4..93d71aff 100644 +--- a/arch/arm/boot/dts/qcom-sdx55.dtsi ++++ b/arch/arm/boot/dts/qcom-sdx55.dtsi +@@ -578,7 +578,7 @@ pil-reloc@94c { + }; + + apps_smmu: iommu@15000000 { +- compatible = "qcom,sdx55-smmu-500", "arm,mmu-500"; ++ compatible = "qcom,sdx55-smmu-500", "qcom,smmu-500", "arm,mmu-500"; + reg = <0x15000000 0x20000>; + #iommu-cells = <2>; + #global-interrupts = <1>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-914-ARM-dts-exynos-correct-TMU-phandle-in-Exynos421.patch b/patches.kernel.org/6.2.3-914-ARM-dts-exynos-correct-TMU-phandle-in-Exynos421.patch new file mode 100644 index 0000000..e2ad47b --- /dev/null +++ b/patches.kernel.org/6.2.3-914-ARM-dts-exynos-correct-TMU-phandle-in-Exynos421.patch @@ -0,0 +1,39 @@ +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:37 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Exynos4210 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 408ab6786dbf6dd696488054c9559681112ef994 + +commit 408ab6786dbf6dd696488054c9559681112ef994 upstream. + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. Since thermal-sensors property is +already defined in included exynos4-cpu-thermal.dtsi, drop it from +exynos4210.dtsi to fix the error and remoev redundancy. + +Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/exynos4210.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi +index 2c25cc37..f8c6c5d1 100644 +--- a/arch/arm/boot/dts/exynos4210.dtsi ++++ b/arch/arm/boot/dts/exynos4210.dtsi +@@ -393,7 +393,6 @@ &cpu_alert2 { + &cpu_thermal { + polling-delay-passive = <0>; + polling-delay = <0>; +- thermal-sensors = <&tmu 0>; + }; + + &gic { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-915-ARM-dts-exynos-correct-TMU-phandle-in-Exynos4.patch b/patches.kernel.org/6.2.3-915-ARM-dts-exynos-correct-TMU-phandle-in-Exynos4.patch new file mode 100644 index 0000000..94697f3 --- /dev/null +++ b/patches.kernel.org/6.2.3-915-ARM-dts-exynos-correct-TMU-phandle-in-Exynos4.patch @@ -0,0 +1,38 @@ +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:36 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Exynos4 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8e4505e617a80f601e2f53a917611777f128f925 + +commit 8e4505e617a80f601e2f53a917611777f128f925 upstream. + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. + +Fixes: 328829a6ad70 ("ARM: dts: define default thermal-zones for exynos4") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi +index 021d9fc1..27a1a895 100644 +--- a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi ++++ b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi +@@ -10,7 +10,7 @@ + / { + thermal-zones { + cpu_thermal: cpu-thermal { +- thermal-sensors = <&tmu 0>; ++ thermal-sensors = <&tmu>; + polling-delay-passive = <0>; + polling-delay = <0>; + trips { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-916-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch b/patches.kernel.org/6.2.3-916-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch new file mode 100644 index 0000000..581783a --- /dev/null +++ b/patches.kernel.org/6.2.3-916-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch @@ -0,0 +1,83 @@ +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:41 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Odroid XU3 family +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: a3583e92d188ec6c58c7f603ac5e72dd8a11c21a + +commit a3583e92d188ec6c58c7f603ac5e72dd8a11c21a upstream. + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. This was not critical before, +but since rework of thermal Devicetree initialization in the +commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree +initialization"), this leads to errors registering thermal zones other +than first one: + + thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 + thermal_sys: Failed to find thermal zone for tmu id=0 + exynos-tmu 10064000.tmu: Failed to register sensor: -2 + exynos-tmu: probe of 10064000.tmu failed with error -2 + +Fixes: f1722d7dd8b8 ("ARM: dts: Define default thermal-zones for exynos5422") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-6-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +index a6961ff2..e6e7e2ff 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi ++++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +@@ -50,7 +50,7 @@ fan0: pwm-fan { + + thermal-zones { + cpu0_thermal: cpu0-thermal { +- thermal-sensors = <&tmu_cpu0 0>; ++ thermal-sensors = <&tmu_cpu0>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -139,7 +139,7 @@ cpu0_cooling_map4: map4 { + }; + }; + cpu1_thermal: cpu1-thermal { +- thermal-sensors = <&tmu_cpu1 0>; ++ thermal-sensors = <&tmu_cpu1>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -212,7 +212,7 @@ cpu1_cooling_map4: map4 { + }; + }; + cpu2_thermal: cpu2-thermal { +- thermal-sensors = <&tmu_cpu2 0>; ++ thermal-sensors = <&tmu_cpu2>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -285,7 +285,7 @@ cpu2_cooling_map4: map4 { + }; + }; + cpu3_thermal: cpu3-thermal { +- thermal-sensors = <&tmu_cpu3 0>; ++ thermal-sensors = <&tmu_cpu3>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +@@ -358,7 +358,7 @@ cpu3_cooling_map4: map4 { + }; + }; + gpu_thermal: gpu-thermal { +- thermal-sensors = <&tmu_gpu 0>; ++ thermal-sensors = <&tmu_gpu>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-917-ARM-dts-exynos-correct-TMU-phandle-in-Exynos525.patch b/patches.kernel.org/6.2.3-917-ARM-dts-exynos-correct-TMU-phandle-in-Exynos525.patch new file mode 100644 index 0000000..e692b38 --- /dev/null +++ b/patches.kernel.org/6.2.3-917-ARM-dts-exynos-correct-TMU-phandle-in-Exynos525.patch @@ -0,0 +1,38 @@ +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:38 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Exynos5250 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 33e2c595e2e4016991ead44933a29d1ef93d5f26 + +commit 33e2c595e2e4016991ead44933a29d1ef93d5f26 upstream. + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. + +Cc: +Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") +Link: https://lore.kernel.org/r/20230209105841.779596-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/exynos5250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi +index 4708dcd5..01751706 100644 +--- a/arch/arm/boot/dts/exynos5250.dtsi ++++ b/arch/arm/boot/dts/exynos5250.dtsi +@@ -1107,7 +1107,7 @@ timer { + &cpu_thermal { + polling-delay-passive = <0>; + polling-delay = <0>; +- thermal-sensors = <&tmu 0>; ++ thermal-sensors = <&tmu>; + + cooling-maps { + map0 { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-918-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch b/patches.kernel.org/6.2.3-918-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch new file mode 100644 index 0000000..276fbc3 --- /dev/null +++ b/patches.kernel.org/6.2.3-918-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch @@ -0,0 +1,39 @@ +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:39 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Odroid XU +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9372eca505e7a19934d750b4b4c89a3652738e66 + +commit 9372eca505e7a19934d750b4b4c89a3652738e66 upstream. + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. Since thermal-sensors property +is already defined in included exynosi5410.dtsi, drop it from +exynos5410-odroidxu.dts to fix the error and remoev redundancy. + +Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-4-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5410-odroidxu.dts b/arch/arm/boot/dts/exynos5410-odroidxu.dts +index d1cbc6b8..e18110b9 100644 +--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts ++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts +@@ -120,7 +120,6 @@ &clock_audss { + }; + + &cpu0_thermal { +- thermal-sensors = <&tmu_cpu0 0>; + polling-delay-passive = <0>; + polling-delay = <0>; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-919-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-HC.patch b/patches.kernel.org/6.2.3-919-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-HC.patch new file mode 100644 index 0000000..2515f1e --- /dev/null +++ b/patches.kernel.org/6.2.3-919-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-HC.patch @@ -0,0 +1,83 @@ +From: Krzysztof Kozlowski +Date: Thu, 9 Feb 2023 11:58:40 +0100 +Subject: [PATCH] ARM: dts: exynos: correct TMU phandle in Odroid HC1 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 2e3d0e20d8456f876607a8af61fdb83dfbf98cb6 + +commit 2e3d0e20d8456f876607a8af61fdb83dfbf98cb6 upstream. + +TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing +it must not have an argument to phandle. This was not critical before, +but since rework of thermal Devicetree initialization in the +commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree +initialization"), this leads to errors registering thermal zones other +than first one: + + thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 + thermal_sys: Failed to find thermal zone for tmu id=0 + exynos-tmu 10064000.tmu: Failed to register sensor: -2 + exynos-tmu: probe of 10064000.tmu failed with error -2 + +Fixes: 1ac49427b566 ("ARM: dts: exynos: Add support for Hardkernel's Odroid HC1 board") +Cc: +Link: https://lore.kernel.org/r/20230209105841.779596-5-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm/boot/dts/exynos5422-odroidhc1.dts | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +index 3de70195..5e428039 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +@@ -31,7 +31,7 @@ led-1 { + + thermal-zones { + cpu0_thermal: cpu0-thermal { +- thermal-sensors = <&tmu_cpu0 0>; ++ thermal-sensors = <&tmu_cpu0>; + trips { + cpu0_alert0: cpu-alert-0 { + temperature = <70000>; /* millicelsius */ +@@ -86,7 +86,7 @@ map1 { + }; + }; + cpu1_thermal: cpu1-thermal { +- thermal-sensors = <&tmu_cpu1 0>; ++ thermal-sensors = <&tmu_cpu1>; + trips { + cpu1_alert0: cpu-alert-0 { + temperature = <70000>; +@@ -130,7 +130,7 @@ map1 { + }; + }; + cpu2_thermal: cpu2-thermal { +- thermal-sensors = <&tmu_cpu2 0>; ++ thermal-sensors = <&tmu_cpu2>; + trips { + cpu2_alert0: cpu-alert-0 { + temperature = <70000>; +@@ -174,7 +174,7 @@ map1 { + }; + }; + cpu3_thermal: cpu3-thermal { +- thermal-sensors = <&tmu_cpu3 0>; ++ thermal-sensors = <&tmu_cpu3>; + trips { + cpu3_alert0: cpu-alert-0 { + temperature = <70000>; +@@ -218,7 +218,7 @@ map1 { + }; + }; + gpu_thermal: gpu-thermal { +- thermal-sensors = <&tmu_gpu 0>; ++ thermal-sensors = <&tmu_gpu>; + trips { + gpu_alert0: gpu-alert-0 { + temperature = <70000>; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-920-arm64-acpi-Fix-possible-memory-leak-of-ffh_ctxt.patch b/patches.kernel.org/6.2.3-920-arm64-acpi-Fix-possible-memory-leak-of-ffh_ctxt.patch new file mode 100644 index 0000000..a9fea04 --- /dev/null +++ b/patches.kernel.org/6.2.3-920-arm64-acpi-Fix-possible-memory-leak-of-ffh_ctxt.patch @@ -0,0 +1,61 @@ +From: Sudeep Holla +Date: Thu, 23 Feb 2023 13:57:42 +0000 +Subject: [PATCH] arm64: acpi: Fix possible memory leak of ffh_ctxt +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1b561d3949f8478c5403c9752b5533211a757226 + +commit 1b561d3949f8478c5403c9752b5533211a757226 upstream. + +Allocated 'ffh_ctxt' memory leak is possible if the SMCCC version +and conduit checks fail and -EOPNOTSUPP is returned without freeing the +allocated memory. + +Fix the same by moving the allocation after the SMCCC version and +conduit checks. + +Fixes: 1d280ce099db ("arm64: Add architecture specific ACPI FFH Opregion callbacks") +Cc: # 6.2.x +Cc: Will Deacon +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Suggested-by: Dan Carpenter +Link: https://lore.kernel.org/r/202302191417.dAl9NuE8-lkp@intel.com/ +Signed-off-by: Sudeep Holla +Link: https://lore.kernel.org/r/20230223135742.2952091-1-sudeep.holla@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/kernel/acpi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c +index 378453fa..dba8fcec 100644 +--- a/arch/arm64/kernel/acpi.c ++++ b/arch/arm64/kernel/acpi.c +@@ -435,10 +435,6 @@ int acpi_ffh_address_space_arch_setup(void *handler_ctxt, void **region_ctxt) + enum arm_smccc_conduit conduit; + struct acpi_ffh_data *ffh_ctxt; + +- ffh_ctxt = kzalloc(sizeof(*ffh_ctxt), GFP_KERNEL); +- if (!ffh_ctxt) +- return -ENOMEM; +- + if (arm_smccc_get_version() < ARM_SMCCC_VERSION_1_2) + return -EOPNOTSUPP; + +@@ -448,6 +444,10 @@ int acpi_ffh_address_space_arch_setup(void *handler_ctxt, void **region_ctxt) + return -EOPNOTSUPP; + } + ++ ffh_ctxt = kzalloc(sizeof(*ffh_ctxt), GFP_KERNEL); ++ if (!ffh_ctxt) ++ return -ENOMEM; ++ + if (conduit == SMCCC_CONDUIT_SMC) { + ffh_ctxt->invoke_ffh_fn = __arm_smccc_smc; + ffh_ctxt->invoke_ffh64_fn = arm_smccc_1_2_smc; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-921-arm64-mm-hugetlb-Disable-HUGETLB_PAGE_OPTIMIZE_.patch b/patches.kernel.org/6.2.3-921-arm64-mm-hugetlb-Disable-HUGETLB_PAGE_OPTIMIZE_.patch new file mode 100644 index 0000000..8147618 --- /dev/null +++ b/patches.kernel.org/6.2.3-921-arm64-mm-hugetlb-Disable-HUGETLB_PAGE_OPTIMIZE_.patch @@ -0,0 +1,58 @@ +From: Catalin Marinas +Date: Wed, 22 Feb 2023 17:52:32 +0000 +Subject: [PATCH] arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 060a2c92d1b627c86c5c42ca69baf00457c00c5a + +commit 060a2c92d1b627c86c5c42ca69baf00457c00c5a upstream. + +Revert the HUGETLB_PAGE_FREE_VMEMMAP selection from commit 1e63ac088f20 +("arm64: mm: hugetlb: enable HUGETLB_PAGE_FREE_VMEMMAP for arm64") but +keep the flush_dcache_page() compound_head() change as it aligns with +the corresponding check in the __sync_icache_dcache() function. + +The original config option was renamed in commit 47010c040dec ("mm: +hugetlb_vmemmap: cleanup CONFIG_HUGETLB_PAGE_FREE_VMEMMAP*") to +HUGETLB_PAGE_OPTIMIZE_VMEMMAP and the flush_dcache_page() check was +further simplified by commit 2da1c30929a2 ("mm: hugetlb_vmemmap: delete +hugetlb_optimize_vmemmap_enabled()"). + +The reason for the revert is that the generic vmemmap_remap_pte() +function changes both the permissions (writeable to read-only) and the +output address (pfn) of the vmemmap ptes. This is deemed UNPREDICTABLE +by the Arm architecture without a break-before-make sequence (make the +PTE invalid, TLBI, write the new valid PTE). However, such sequence is +not possible since the vmemmap may be concurrently accessed by the +kernel. Disable the optimisation until a better solution is found. + +Fixes: 1e63ac088f20 ("arm64: mm: hugetlb: enable HUGETLB_PAGE_FREE_VMEMMAP for arm64") +Cc: # 5.19.x +Cc: Muchun Song +Cc: Will Deacon +Cc: Anshuman Khandual +Link: https://lore.kernel.org/r/Y9pZALdn3pKiJUeQ@arm.com +Reviewed-by: Anshuman Khandual +Link: https://lore.kernel.org/r/20230222175232.540851-1-catalin.marinas@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index c5ccca26..ddfd35c8 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -100,7 +100,6 @@ config ARM64 + select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT + select ARCH_WANT_FRAME_POINTERS + select ARCH_WANT_HUGE_PMD_SHARE if ARM64_4K_PAGES || (ARM64_16K_PAGES && !ARM64_VA_BITS_36) +- select ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP + select ARCH_WANT_LD_ORPHAN_WARN + select ARCH_WANTS_NO_INSTR + select ARCH_WANTS_THP_SWAP if ARM64_4K_PAGES +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-922-arm64-Reset-KASAN-tag-in-copy_highpage-with-HW-.patch b/patches.kernel.org/6.2.3-922-arm64-Reset-KASAN-tag-in-copy_highpage-with-HW-.patch new file mode 100644 index 0000000..0e69497 --- /dev/null +++ b/patches.kernel.org/6.2.3-922-arm64-Reset-KASAN-tag-in-copy_highpage-with-HW-.patch @@ -0,0 +1,60 @@ +From: Peter Collingbourne +Date: Tue, 14 Feb 2023 21:09:11 -0800 +Subject: [PATCH] arm64: Reset KASAN tag in copy_highpage with HW tags only +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e74a68468062d7ebd8ce17069e12ccc64cc6a58c + +commit e74a68468062d7ebd8ce17069e12ccc64cc6a58c upstream. + +During page migration, the copy_highpage function is used to copy the +page data to the target page. If the source page is a userspace page +with MTE tags, the KASAN tag of the target page must have the match-all +tag in order to avoid tag check faults during subsequent accesses to the +page by the kernel. However, the target page may have been allocated in +a number of ways, some of which will use the KASAN allocator and will +therefore end up setting the KASAN tag to a non-match-all tag. Therefore, +update the target page's KASAN tag to match the source page. + +We ended up unintentionally fixing this issue as a result of a bad +merge conflict resolution between commit e059853d14ca ("arm64: mte: +Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64: +kasan: Revert "arm64: mte: reset the page tag in page->flags""), which +preserved a tag reset for PG_mte_tagged pages which was considered to be +unnecessary at the time. Because SW tags KASAN uses separate tag storage, +update the code to only reset the tags when HW tags KASAN is enabled. + +Signed-off-by: Peter Collingbourne +Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830f52e0c +Reported-by: "Kuan-Ying Lee (李冠穎)" +Cc: # 6.1 +Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"") +Reviewed-by: Andrey Konovalov +Link: https://lore.kernel.org/r/20230215050911.1433132-1-pcc@google.com +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/arm64/mm/copypage.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c +index 8dd5a8fe..4aadcfb0 100644 +--- a/arch/arm64/mm/copypage.c ++++ b/arch/arm64/mm/copypage.c +@@ -22,7 +22,8 @@ void copy_highpage(struct page *to, struct page *from) + copy_page(kto, kfrom); + + if (system_supports_mte() && page_mte_tagged(from)) { +- page_kasan_tag_reset(to); ++ if (kasan_hw_tags_enabled()) ++ page_kasan_tag_reset(to); + /* It's a new page, shouldn't have been tagged yet */ + WARN_ON_ONCE(!try_page_mte_tagging(to)); + mte_copy_page_tags(kto, kfrom); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-923-fuse-add-inode-permission-checks-to-fileattr_ge.patch b/patches.kernel.org/6.2.3-923-fuse-add-inode-permission-checks-to-fileattr_ge.patch new file mode 100644 index 0000000..7c878df --- /dev/null +++ b/patches.kernel.org/6.2.3-923-fuse-add-inode-permission-checks-to-fileattr_ge.patch @@ -0,0 +1,43 @@ +From: Alexander Mikhalitsyn +Date: Thu, 26 Jan 2023 11:23:18 +0100 +Subject: [PATCH] fuse: add inode/permission checks to + fileattr_get/fileattr_set +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1cc4606d19e3710bfab3f6704b87ff9580493c69 + +commit 1cc4606d19e3710bfab3f6704b87ff9580493c69 upstream. + +It looks like these checks were accidentally lost during the conversion to +fileattr API. + +Fixes: 72227eac177d ("fuse: convert to fileattr") +Cc: # v5.13 +Signed-off-by: Alexander Mikhalitsyn +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/fuse/ioctl.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/fuse/ioctl.c b/fs/fuse/ioctl.c +index fcce94ac..8ba1545e 100644 +--- a/fs/fuse/ioctl.c ++++ b/fs/fuse/ioctl.c +@@ -419,6 +419,12 @@ static struct fuse_file *fuse_priv_ioctl_prepare(struct inode *inode) + struct fuse_mount *fm = get_fuse_mount(inode); + bool isdir = S_ISDIR(inode->i_mode); + ++ if (!fuse_allow_current_process(fm->fc)) ++ return ERR_PTR(-EACCES); ++ ++ if (fuse_is_bad(inode)) ++ return ERR_PTR(-EIO); ++ + if (!S_ISREG(inode->i_mode) && !isdir) + return ERR_PTR(-ENOTTY); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-924-rbd-avoid-use-after-free-in-do_rbd_add-when-rbd.patch b/patches.kernel.org/6.2.3-924-rbd-avoid-use-after-free-in-do_rbd_add-when-rbd.patch new file mode 100644 index 0000000..42d1f07 --- /dev/null +++ b/patches.kernel.org/6.2.3-924-rbd-avoid-use-after-free-in-do_rbd_add-when-rbd.patch @@ -0,0 +1,101 @@ +From: Ilya Dryomov +Date: Fri, 24 Feb 2023 18:48:54 +0100 +Subject: [PATCH] rbd: avoid use-after-free in do_rbd_add() when + rbd_dev_create() fails +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f7c4d9b133c7a04ca619355574e96b6abf209fba + +commit f7c4d9b133c7a04ca619355574e96b6abf209fba upstream. + +If getting an ID or setting up a work queue in rbd_dev_create() fails, +use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts +is triggered in do_rbd_add(). The root cause is that the ownership of +these structures is transfered to rbd_dev prematurely and they all end +up getting freed when rbd_dev_create() calls rbd_dev_free() prior to +returning to do_rbd_add(). + +Found by Linux Verification Center (linuxtesting.org) with SVACE, an +incomplete patch submitted by Natalia Petrova . + +Cc: stable@vger.kernel.org +Fixes: 1643dfa4c2c8 ("rbd: introduce a per-device ordered workqueue") +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/block/rbd.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 04453f4a..60aed196 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -5292,8 +5292,7 @@ static void rbd_dev_release(struct device *dev) + module_put(THIS_MODULE); + } + +-static struct rbd_device *__rbd_dev_create(struct rbd_client *rbdc, +- struct rbd_spec *spec) ++static struct rbd_device *__rbd_dev_create(struct rbd_spec *spec) + { + struct rbd_device *rbd_dev; + +@@ -5338,9 +5337,6 @@ static struct rbd_device *__rbd_dev_create(struct rbd_client *rbdc, + rbd_dev->dev.parent = &rbd_root_dev; + device_initialize(&rbd_dev->dev); + +- rbd_dev->rbd_client = rbdc; +- rbd_dev->spec = spec; +- + return rbd_dev; + } + +@@ -5353,12 +5349,10 @@ static struct rbd_device *rbd_dev_create(struct rbd_client *rbdc, + { + struct rbd_device *rbd_dev; + +- rbd_dev = __rbd_dev_create(rbdc, spec); ++ rbd_dev = __rbd_dev_create(spec); + if (!rbd_dev) + return NULL; + +- rbd_dev->opts = opts; +- + /* get an id and fill in device name */ + rbd_dev->dev_id = ida_simple_get(&rbd_dev_id_ida, 0, + minor_to_rbd_dev_id(1 << MINORBITS), +@@ -5375,6 +5369,10 @@ static struct rbd_device *rbd_dev_create(struct rbd_client *rbdc, + /* we have a ref from do_rbd_add() */ + __module_get(THIS_MODULE); + ++ rbd_dev->rbd_client = rbdc; ++ rbd_dev->spec = spec; ++ rbd_dev->opts = opts; ++ + dout("%s rbd_dev %p dev_id %d\n", __func__, rbd_dev, rbd_dev->dev_id); + return rbd_dev; + +@@ -6736,7 +6734,7 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth) + goto out_err; + } + +- parent = __rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec); ++ parent = __rbd_dev_create(rbd_dev->parent_spec); + if (!parent) { + ret = -ENOMEM; + goto out_err; +@@ -6746,8 +6744,8 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth) + * Images related by parent/child relationships always share + * rbd_client and spec/parent_spec, so bump their refcounts. + */ +- __rbd_get_client(rbd_dev->rbd_client); +- rbd_spec_get(rbd_dev->parent_spec); ++ parent->rbd_client = __rbd_get_client(rbd_dev->rbd_client); ++ parent->spec = rbd_spec_get(rbd_dev->parent_spec); + + __set_bit(RBD_DEV_FLAG_READONLY, &parent->flags); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-925-ceph-update-the-time-stamps-and-try-to-drop-the.patch b/patches.kernel.org/6.2.3-925-ceph-update-the-time-stamps-and-try-to-drop-the.patch new file mode 100644 index 0000000..65c7d70 --- /dev/null +++ b/patches.kernel.org/6.2.3-925-ceph-update-the-time-stamps-and-try-to-drop-the.patch @@ -0,0 +1,67 @@ +From: Xiubo Li +Date: Mon, 13 Feb 2023 13:56:20 +0800 +Subject: [PATCH] ceph: update the time stamps and try to drop the suid/sgid +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e027253c4b77d395798600a90b6a96fe4adf4d5e + +commit e027253c4b77d395798600a90b6a96fe4adf4d5e upstream. + +The fallocate will try to clear the suid/sgid if a unprevileged user +changed the file. + +There is no POSIX item requires that we should clear the suid/sgid +in fallocate code path but this is the default behaviour for most of +the filesystems and the VFS layer. And also the same for the write +code path, which have already support it. + +And also we need to update the time stamps since the fallocate will +change the file contents. + +Cc: stable@vger.kernel.org +Link: https://tracker.ceph.com/issues/58054 +Signed-off-by: Xiubo Li +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + fs/ceph/file.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index b5cff859..dc39a4b0 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -2102,6 +2102,9 @@ static long ceph_fallocate(struct file *file, int mode, + loff_t endoff = 0; + loff_t size; + ++ dout("%s %p %llx.%llx mode %x, offset %llu length %llu\n", __func__, ++ inode, ceph_vinop(inode), mode, offset, length); ++ + if (mode != (FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE)) + return -EOPNOTSUPP; + +@@ -2136,6 +2139,10 @@ static long ceph_fallocate(struct file *file, int mode, + if (ret < 0) + goto unlock; + ++ ret = file_modified(file); ++ if (ret) ++ goto put_caps; ++ + filemap_invalidate_lock(inode->i_mapping); + ceph_fscache_invalidate(inode, false); + ceph_zero_pagecache_range(inode, offset, length); +@@ -2151,6 +2158,7 @@ static long ceph_fallocate(struct file *file, int mode, + } + filemap_invalidate_unlock(inode->i_mapping); + ++put_caps: + ceph_put_cap_refs(ci, got); + unlock: + inode_unlock(inode); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-926-regulator-core-Use-ktime_get_boottime-to-determ.patch b/patches.kernel.org/6.2.3-926-regulator-core-Use-ktime_get_boottime-to-determ.patch new file mode 100644 index 0000000..9cb54ca --- /dev/null +++ b/patches.kernel.org/6.2.3-926-regulator-core-Use-ktime_get_boottime-to-determ.patch @@ -0,0 +1,66 @@ +From: Matthias Kaehlcke +Date: Thu, 23 Feb 2023 00:33:30 +0000 +Subject: [PATCH] regulator: core: Use ktime_get_boottime() to determine how + long a regulator was off +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 80d2c29e09e663761c2778167a625b25ffe01b6f + +commit 80d2c29e09e663761c2778167a625b25ffe01b6f upstream. + +For regulators with 'off-on-delay-us' the regulator framework currently +uses ktime_get() to determine how long the regulator has been off +before re-enabling it (after a delay if needed). A problem with using +ktime_get() is that it doesn't account for the time the system is +suspended. As a result a regulator with a longer 'off-on-delay' (e.g. +500ms) that was switched off during suspend might still incurr in a +delay on resume before it is re-enabled, even though the regulator +might have been off for hours. ktime_get_boottime() accounts for +suspend time, use it instead of ktime_get(). + +Fixes: a8ce7bd89689 ("regulator: core: Fix off_on_delay handling") +Cc: stable@vger.kernel.org # 5.13+ +Signed-off-by: Matthias Kaehlcke +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/20230223003301.v2.1.I9719661b8eb0a73b8c416f9c26cf5bd8c0563f99@changeid +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/regulator/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index ae69e493..4fcd3605 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1584,7 +1584,7 @@ static int set_machine_constraints(struct regulator_dev *rdev) + } + + if (rdev->desc->off_on_delay) +- rdev->last_off = ktime_get(); ++ rdev->last_off = ktime_get_boottime(); + + /* If the constraints say the regulator should be on at this point + * and we have control then make sure it is enabled. +@@ -2673,7 +2673,7 @@ static int _regulator_do_enable(struct regulator_dev *rdev) + * this regulator was disabled. + */ + ktime_t end = ktime_add_us(rdev->last_off, rdev->desc->off_on_delay); +- s64 remaining = ktime_us_delta(end, ktime_get()); ++ s64 remaining = ktime_us_delta(end, ktime_get_boottime()); + + if (remaining > 0) + _regulator_delay_helper(remaining); +@@ -2912,7 +2912,7 @@ static int _regulator_do_disable(struct regulator_dev *rdev) + } + + if (rdev->desc->off_on_delay) +- rdev->last_off = ktime_get(); ++ rdev->last_off = ktime_get_boottime(); + + trace_regulator_disable_complete(rdev_get_name(rdev)); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-927-panic-fix-the-panic_print-NMI-backtrace-setting.patch b/patches.kernel.org/6.2.3-927-panic-fix-the-panic_print-NMI-backtrace-setting.patch new file mode 100644 index 0000000..b7caea9 --- /dev/null +++ b/patches.kernel.org/6.2.3-927-panic-fix-the-panic_print-NMI-backtrace-setting.patch @@ -0,0 +1,113 @@ +From: "Guilherme G. Piccoli" +Date: Sun, 26 Feb 2023 13:08:38 -0300 +Subject: [PATCH] panic: fix the panic_print NMI backtrace setting +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b905039e428d639adeebb719b76f98865ea38d4d + +commit b905039e428d639adeebb719b76f98865ea38d4d upstream. + +Commit 8d470a45d1a6 ("panic: add option to dump all CPUs backtraces in +panic_print") introduced a setting for the "panic_print" kernel parameter +to allow users to request a NMI backtrace on panic. Problem is that the +panic_print handling happens after the secondary CPUs are already +disabled, hence this option ended-up being kind of a no-op - kernel skips +the NMI trace in idling CPUs, which is the case of offline CPUs. + +Fix it by checking the NMI backtrace bit in the panic_print prior to the +CPU disabling function. + +Link: https://lkml.kernel.org/r/20230226160838.414257-1-gpiccoli@igalia.com +Fixes: 8d470a45d1a6 ("panic: add option to dump all CPUs backtraces in panic_print") +Signed-off-by: Guilherme G. Piccoli +Cc: +Cc: Baoquan He +Cc: Dave Young +Cc: Feng Tang +Cc: HATAYAMA Daisuke +Cc: Hidehiro Kawai +Cc: Kees Cook +Cc: Michael Kelley +Cc: Petr Mladek +Cc: Vivek Goyal +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/panic.c | 44 ++++++++++++++++++++++++++------------------ + 1 file changed, 26 insertions(+), 18 deletions(-) + +diff --git a/kernel/panic.c b/kernel/panic.c +index 487f5b03..5cfea830 100644 +--- a/kernel/panic.c ++++ b/kernel/panic.c +@@ -212,9 +212,6 @@ static void panic_print_sys_info(bool console_flush) + return; + } + +- if (panic_print & PANIC_PRINT_ALL_CPU_BT) +- trigger_all_cpu_backtrace(); +- + if (panic_print & PANIC_PRINT_TASK_INFO) + show_state(); + +@@ -244,6 +241,30 @@ void check_panic_on_warn(const char *origin) + origin, limit); + } + ++/* ++ * Helper that triggers the NMI backtrace (if set in panic_print) ++ * and then performs the secondary CPUs shutdown - we cannot have ++ * the NMI backtrace after the CPUs are off! ++ */ ++static void panic_other_cpus_shutdown(bool crash_kexec) ++{ ++ if (panic_print & PANIC_PRINT_ALL_CPU_BT) ++ trigger_all_cpu_backtrace(); ++ ++ /* ++ * Note that smp_send_stop() is the usual SMP shutdown function, ++ * which unfortunately may not be hardened to work in a panic ++ * situation. If we want to do crash dump after notifier calls ++ * and kmsg_dump, we will need architecture dependent extra ++ * bits in addition to stopping other CPUs, hence we rely on ++ * crash_smp_send_stop() for that. ++ */ ++ if (!crash_kexec) ++ smp_send_stop(); ++ else ++ crash_smp_send_stop(); ++} ++ + /** + * panic - halt the system + * @fmt: The text string to print +@@ -334,23 +355,10 @@ void panic(const char *fmt, ...) + * + * Bypass the panic_cpu check and call __crash_kexec directly. + */ +- if (!_crash_kexec_post_notifiers) { ++ if (!_crash_kexec_post_notifiers) + __crash_kexec(NULL); + +- /* +- * Note smp_send_stop is the usual smp shutdown function, which +- * unfortunately means it may not be hardened to work in a +- * panic situation. +- */ +- smp_send_stop(); +- } else { +- /* +- * If we want to do crash dump after notifier calls and +- * kmsg_dump, we will need architecture dependent extra +- * works in addition to stopping other CPUs. +- */ +- crash_smp_send_stop(); +- } ++ panic_other_cpus_shutdown(_crash_kexec_post_notifiers); + + /* + * Run any panic handlers, including those that might need to +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-928-mm-hwpoison-convert-TTU_IGNORE_HWPOISON-to-TTU_.patch b/patches.kernel.org/6.2.3-928-mm-hwpoison-convert-TTU_IGNORE_HWPOISON-to-TTU_.patch new file mode 100644 index 0000000..4730e8b --- /dev/null +++ b/patches.kernel.org/6.2.3-928-mm-hwpoison-convert-TTU_IGNORE_HWPOISON-to-TTU_.patch @@ -0,0 +1,116 @@ +From: Naoya Horiguchi +Date: Tue, 21 Feb 2023 17:59:05 +0900 +Subject: [PATCH] mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6da6b1d4a7df8c35770186b53ef65d388398e139 + +commit 6da6b1d4a7df8c35770186b53ef65d388398e139 upstream. + +After a memory error happens on a clean folio, a process unexpectedly +receives SIGBUS when it accesses the error page. This SIGBUS killing is +pointless and simply degrades the level of RAS of the system, because the +clean folio can be dropped without any data lost on memory error handling +as we do for a clean pagecache. + +When memory_failure() is called on a clean folio, try_to_unmap() is called +twice (one from split_huge_page() and one from hwpoison_user_mappings()). +The root cause of the issue is that pte conversion to hwpoisoned entry is +now done in the first call of try_to_unmap() because PageHWPoison is +already set at this point, while it's actually expected to be done in the +second call. This behavior disturbs the error handling operation like +removing pagecache, which results in the malfunction described above. + +So convert TTU_IGNORE_HWPOISON into TTU_HWPOISON and set TTU_HWPOISON only +when we really intend to convert pte to hwpoison entry. This can prevent +other callers of try_to_unmap() from accidentally converting to hwpoison +entries. + +Link: https://lkml.kernel.org/r/20230221085905.1465385-1-naoya.horiguchi@linux.dev +Fixes: a42634a6c07d ("readahead: Use a folio in read_pages()") +Signed-off-by: Naoya Horiguchi +Cc: David Hildenbrand +Cc: Hugh Dickins +Cc: Matthew Wilcox +Cc: Miaohe Lin +Cc: Minchan Kim +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + include/linux/rmap.h | 2 +- + mm/memory-failure.c | 8 ++++---- + mm/rmap.c | 2 +- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/include/linux/rmap.h b/include/linux/rmap.h +index bd3504d1..2bdba700 100644 +--- a/include/linux/rmap.h ++++ b/include/linux/rmap.h +@@ -94,7 +94,7 @@ enum ttu_flags { + TTU_SPLIT_HUGE_PMD = 0x4, /* split huge PMD if any */ + TTU_IGNORE_MLOCK = 0x8, /* ignore mlock */ + TTU_SYNC = 0x10, /* avoid racy checks with PVMW_SYNC */ +- TTU_IGNORE_HWPOISON = 0x20, /* corrupted page is recoverable */ ++ TTU_HWPOISON = 0x20, /* do convert pte to hwpoison entry */ + TTU_BATCH_FLUSH = 0x40, /* Batch TLB flushes where possible + * and caller guarantees they will + * do a final flush if necessary */ +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index c77a9e37..89361306 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1034,7 +1034,7 @@ static int me_pagecache_dirty(struct page_state *ps, struct page *p) + * cache and swap cache(ie. page is freshly swapped in). So it could be + * referenced concurrently by 2 types of PTEs: + * normal PTEs and swap PTEs. We try to handle them consistently by calling +- * try_to_unmap(TTU_IGNORE_HWPOISON) to convert the normal PTEs to swap PTEs, ++ * try_to_unmap(!TTU_HWPOISON) to convert the normal PTEs to swap PTEs, + * and then + * - clear dirty bit to prevent IO + * - remove from LRU +@@ -1415,7 +1415,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, + int flags, struct page *hpage) + { + struct folio *folio = page_folio(hpage); +- enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_SYNC; ++ enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_SYNC | TTU_HWPOISON; + struct address_space *mapping; + LIST_HEAD(tokill); + bool unmap_success; +@@ -1445,7 +1445,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, + + if (PageSwapCache(p)) { + pr_err("%#lx: keeping poisoned page in swap cache\n", pfn); +- ttu |= TTU_IGNORE_HWPOISON; ++ ttu &= ~TTU_HWPOISON; + } + + /* +@@ -1460,7 +1460,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, + if (page_mkclean(hpage)) { + SetPageDirty(hpage); + } else { +- ttu |= TTU_IGNORE_HWPOISON; ++ ttu &= ~TTU_HWPOISON; + pr_info("%#lx: corrupted page was clean: dropped without side effects\n", + pfn); + } +diff --git a/mm/rmap.c b/mm/rmap.c +index b616870a..3b45d049 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -1615,7 +1615,7 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma, + /* Update high watermark before we lower rss */ + update_hiwater_rss(mm); + +- if (PageHWPoison(subpage) && !(flags & TTU_IGNORE_HWPOISON)) { ++ if (PageHWPoison(subpage) && (flags & TTU_HWPOISON)) { + pteval = swp_entry_to_pte(make_hwpoison_entry(subpage)); + if (folio_test_hugetlb(folio)) { + hugetlb_count_sub(folio_nr_pages(folio), mm); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-929-genirq-msi-platform-msi-Ensure-that-MSI-descrip.patch b/patches.kernel.org/6.2.3-929-genirq-msi-platform-msi-Ensure-that-MSI-descrip.patch new file mode 100644 index 0000000..aa7bcc7 --- /dev/null +++ b/patches.kernel.org/6.2.3-929-genirq-msi-platform-msi-Ensure-that-MSI-descrip.patch @@ -0,0 +1,109 @@ +From: Thomas Gleixner +Date: Wed, 1 Mar 2023 22:07:48 +0100 +Subject: [PATCH] genirq/msi, platform-msi: Ensure that MSI descriptors are + unreferenced +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0fb7fb713461e44b12e72c292bf90ee300f40710 + +commit 0fb7fb713461e44b12e72c292bf90ee300f40710 upstream. + +Miquel reported a warning in the MSI core which is triggered when +interrupts are freed via platform_msi_device_domain_free(). + +This code got reworked to use core functions for freeing the MSI +descriptors, but nothing took care to clear the msi_desc->irq entry, which +then triggers the warning in msi_free_msi_desc() which uses desc->irq to +validate that the descriptor has been torn down. The same issue exists in +msi_domain_populate_irqs(). + +Up to the point that msi_free_msi_descs() grew a warning for this case, +this went un-noticed. + +Provide the counterpart of msi_domain_populate_irqs() and invoke it in +platform_msi_device_domain_free() before freeing the interrupts and MSI +descriptors and also in the error path of msi_domain_populate_irqs(). + +Fixes: 2f2940d16823 ("genirq/msi: Remove filter from msi_free_descs_free_range()") +Reported-by: Miquel Raynal +Signed-off-by: Thomas Gleixner +Tested-by: Miquel Raynal +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/87mt4wkwnv.ffs@tglx +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/base/platform-msi.c | 1 + + include/linux/msi.h | 2 ++ + kernel/irq/msi.c | 23 ++++++++++++++++++++++- + 3 files changed, 25 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/platform-msi.c b/drivers/base/platform-msi.c +index 5883e763..f37ad34c 100644 +--- a/drivers/base/platform-msi.c ++++ b/drivers/base/platform-msi.c +@@ -324,6 +324,7 @@ void platform_msi_device_domain_free(struct irq_domain *domain, unsigned int vir + struct platform_msi_priv_data *data = domain->host_data; + + msi_lock_descs(data->dev); ++ msi_domain_depopulate_descs(data->dev, virq, nr_irqs); + irq_domain_free_irqs_common(domain, virq, nr_irqs); + msi_free_msi_descs_range(data->dev, virq, virq + nr_irqs - 1); + msi_unlock_descs(data->dev); +diff --git a/include/linux/msi.h b/include/linux/msi.h +index a112b913..15dd7181 100644 +--- a/include/linux/msi.h ++++ b/include/linux/msi.h +@@ -631,6 +631,8 @@ int msi_domain_prepare_irqs(struct irq_domain *domain, struct device *dev, + int nvec, msi_alloc_info_t *args); + int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev, + int virq, int nvec, msi_alloc_info_t *args); ++void msi_domain_depopulate_descs(struct device *dev, int virq, int nvec); ++ + struct irq_domain * + __platform_msi_create_device_domain(struct device *dev, + unsigned int nvec, +diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c +index 783a3e6a..1f25d459 100644 +--- a/kernel/irq/msi.c ++++ b/kernel/irq/msi.c +@@ -1109,14 +1109,35 @@ int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev, + return 0; + + fail: +- for (--virq; virq >= virq_base; virq--) ++ for (--virq; virq >= virq_base; virq--) { ++ msi_domain_depopulate_descs(dev, virq, 1); + irq_domain_free_irqs_common(domain, virq, 1); ++ } + msi_domain_free_descs(dev, &ctrl); + unlock: + msi_unlock_descs(dev); + return ret; + } + ++void msi_domain_depopulate_descs(struct device *dev, int virq_base, int nvec) ++{ ++ struct msi_ctrl ctrl = { ++ .domid = MSI_DEFAULT_DOMAIN, ++ .first = virq_base, ++ .last = virq_base + nvec - 1, ++ }; ++ struct msi_desc *desc; ++ struct xarray *xa; ++ unsigned long idx; ++ ++ if (!msi_ctrl_valid(dev, &ctrl)) ++ return; ++ ++ xa = &dev->msi.data->__domains[ctrl.domid].store; ++ xa_for_each_range(xa, idx, desc, ctrl.first, ctrl.last) ++ desc->irq = 0; ++} ++ + /* + * Carefully check whether the device can use reservation mode. If + * reservation mode is enabled then the early activation will assign a +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-930-genirq-msi-Take-the-per-device-MSI-lock-before-.patch b/patches.kernel.org/6.2.3-930-genirq-msi-Take-the-per-device-MSI-lock-before-.patch new file mode 100644 index 0000000..401c78e --- /dev/null +++ b/patches.kernel.org/6.2.3-930-genirq-msi-Take-the-per-device-MSI-lock-before-.patch @@ -0,0 +1,56 @@ +From: Marc Zyngier +Date: Mon, 20 Feb 2023 19:01:01 +0000 +Subject: [PATCH] genirq/msi: Take the per-device MSI lock before validating + the control structure +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0af2795f936f1ea1f9f1497447145dfcc7ed2823 + +commit 0af2795f936f1ea1f9f1497447145dfcc7ed2823 upstream. + +Calling msi_ctrl_valid() ultimately results in calling +msi_get_device_domain(), which requires holding the device MSI lock. + +However, in msi_domain_populate_irqs() the lock is taken right after having +called msi_ctrl_valid(), which is just a tad too late. + +Take the lock before invoking msi_ctrl_valid(). + +Fixes: 40742716f294 ("genirq/msi: Make msi_add_simple_msi_descs() device domain aware") +Reported-by: "Russell King (Oracle)" +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Tested-by: Russell King (Oracle) +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/Y/Opu6ETe3ZzZ/8E@shell.armlinux.org.uk +Link: https://lore.kernel.org/r/20230220190101.314446-1-maz@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/irq/msi.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c +index 1f25d459..a020bc97 100644 +--- a/kernel/irq/msi.c ++++ b/kernel/irq/msi.c +@@ -1084,10 +1084,13 @@ int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev, + struct xarray *xa; + int ret, virq; + +- if (!msi_ctrl_valid(dev, &ctrl)) +- return -EINVAL; +- + msi_lock_descs(dev); ++ ++ if (!msi_ctrl_valid(dev, &ctrl)) { ++ ret = -EINVAL; ++ goto unlock; ++ } ++ + ret = msi_domain_add_simple_msi_descs(dev, &ctrl); + if (ret) + goto unlock; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-931-spi-spi-sn-f-ospi-fix-duplicate-flag-while-assi.patch b/patches.kernel.org/6.2.3-931-spi-spi-sn-f-ospi-fix-duplicate-flag-while-assi.patch new file mode 100644 index 0000000..59c0dc3 --- /dev/null +++ b/patches.kernel.org/6.2.3-931-spi-spi-sn-f-ospi-fix-duplicate-flag-while-assi.patch @@ -0,0 +1,44 @@ +From: Dhruva Gole +Date: Thu, 23 Feb 2023 15:22:02 +0530 +Subject: [PATCH] spi: spi-sn-f-ospi: fix duplicate flag while assigning to + mode_bits +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 078a5517d22342eb0474046d3e891427a2552e3c + +commit 078a5517d22342eb0474046d3e891427a2552e3c upstream. + +Replace the SPI_TX_OCTAL flag that appeared two time with SPI_RX_OCTAL +in the chain of '|' operators while assigning to mode_bits + +Fixes: 1b74dd64c861 ("spi: Add Socionext F_OSPI SPI flash controller driver") + +Reported-by: David Binderman +Link: https://lore.kernel.org/all/DB6P189MB0568F3BE9384315F5C8C1A3E9CA49@DB6P189MB0568.EURP189.PROD.OUTLOOK.COM/ + +Cc: stable@vger.kernel.org +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230223095202.924626-1-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/spi/spi-sn-f-ospi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-sn-f-ospi.c b/drivers/spi/spi-sn-f-ospi.c +index 348c6e1e..333b22df 100644 +--- a/drivers/spi/spi-sn-f-ospi.c ++++ b/drivers/spi/spi-sn-f-ospi.c +@@ -611,7 +611,7 @@ static int f_ospi_probe(struct platform_device *pdev) + return -ENOMEM; + + ctlr->mode_bits = SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL +- | SPI_RX_DUAL | SPI_RX_QUAD | SPI_TX_OCTAL ++ | SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL + | SPI_MODE_0 | SPI_MODE_1 | SPI_LSB_FIRST; + ctlr->mem_ops = &f_ospi_mem_ops; + ctlr->bus_num = -1; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-932-alpha-fix-FEN-fault-handling.patch b/patches.kernel.org/6.2.3-932-alpha-fix-FEN-fault-handling.patch new file mode 100644 index 0000000..f0a2219 --- /dev/null +++ b/patches.kernel.org/6.2.3-932-alpha-fix-FEN-fault-handling.patch @@ -0,0 +1,94 @@ +From: Al Viro +Date: Fri, 6 Jan 2023 19:25:59 -0500 +Subject: [PATCH] alpha: fix FEN fault handling +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 977a3009547dad4a5bc95d91be4a58c9f7eedac0 + +commit 977a3009547dad4a5bc95d91be4a58c9f7eedac0 upstream. + +Type 3 instruction fault (FPU insn with FPU disabled) is handled +by quietly enabling FPU and returning. Which is fine, except that +we need to do that both for fault in userland and in the kernel; +the latter *can* legitimately happen - all it takes is this: + +.global _start +_start: + call_pal 0xae + lda $0, 0 + ldq $0, 0($0) + +- call_pal CLRFEN to clear "FPU enabled" flag and arrange for +a signal delivery (SIGSEGV in this case). + +Fixed by moving the handling of type 3 into the common part of +do_entIF(), before we check for kernel vs. user mode. + +Incidentally, the check for kernel mode is unidiomatic; the normal +way to do that is !user_mode(regs). The difference is that +the open-coded variant treats any of bits 63..3 of regs->ps being +set as "it's user mode" while the normal approach is to check just +the bit 3. PS is a 4-bit register and regs->ps always will have +bits 63..4 clear, so the open-coded variant here is actually equivalent +to !user_mode(regs). Harder to follow, though... + +Cc: stable@vger.kernel.org +Reviewed-by: Richard Henderson +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/alpha/kernel/traps.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c +index 8a66fe54..d9a67b37 100644 +--- a/arch/alpha/kernel/traps.c ++++ b/arch/alpha/kernel/traps.c +@@ -233,7 +233,21 @@ do_entIF(unsigned long type, struct pt_regs *regs) + { + int signo, code; + +- if ((regs->ps & ~IPL_MAX) == 0) { ++ if (type == 3) { /* FEN fault */ ++ /* Irritating users can call PAL_clrfen to disable the ++ FPU for the process. The kernel will then trap in ++ do_switch_stack and undo_switch_stack when we try ++ to save and restore the FP registers. ++ ++ Given that GCC by default generates code that uses the ++ FP registers, PAL_clrfen is not useful except for DoS ++ attacks. So turn the bleeding FPU back on and be done ++ with it. */ ++ current_thread_info()->pcb.flags |= 1; ++ __reload_thread(¤t_thread_info()->pcb); ++ return; ++ } ++ if (!user_mode(regs)) { + if (type == 1) { + const unsigned int *data + = (const unsigned int *) regs->pc; +@@ -366,20 +380,6 @@ do_entIF(unsigned long type, struct pt_regs *regs) + } + break; + +- case 3: /* FEN fault */ +- /* Irritating users can call PAL_clrfen to disable the +- FPU for the process. The kernel will then trap in +- do_switch_stack and undo_switch_stack when we try +- to save and restore the FP registers. +- +- Given that GCC by default generates code that uses the +- FP registers, PAL_clrfen is not useful except for DoS +- attacks. So turn the bleeding FPU back on and be done +- with it. */ +- current_thread_info()->pcb.flags |= 1; +- __reload_thread(¤t_thread_info()->pcb); +- return; +- + case 5: /* illoc */ + default: /* unexpected instruction-fault type */ + ; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-933-dax-kmem-Fix-leak-of-memory-hotplug-resources.patch b/patches.kernel.org/6.2.3-933-dax-kmem-Fix-leak-of-memory-hotplug-resources.patch new file mode 100644 index 0000000..6753aa4 --- /dev/null +++ b/patches.kernel.org/6.2.3-933-dax-kmem-Fix-leak-of-memory-hotplug-resources.patch @@ -0,0 +1,146 @@ +From: Dan Williams +Date: Thu, 16 Feb 2023 00:36:02 -0800 +Subject: [PATCH] dax/kmem: Fix leak of memory-hotplug resources +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e686c32590f40bffc45f105c04c836ffad3e531a + +commit e686c32590f40bffc45f105c04c836ffad3e531a upstream. + +While experimenting with CXL region removal the following corruption of +/proc/iomem appeared. + +Before: +f010000000-f04fffffff : CXL Window 0 + f010000000-f02fffffff : region4 + f010000000-f02fffffff : dax4.0 + f010000000-f02fffffff : System RAM (kmem) + +After (modprobe -r cxl_test): +f010000000-f02fffffff : **redacted binary garbage** + f010000000-f02fffffff : System RAM (kmem) + +...and testing further the same is visible with persistent memory +assigned to kmem: + +Before: +480000000-243fffffff : Persistent Memory + 480000000-57e1fffff : namespace3.0 + 580000000-243fffffff : dax3.0 + 580000000-243fffffff : System RAM (kmem) + +After (ndctl disable-region all): +480000000-243fffffff : Persistent Memory + 580000000-243fffffff : ***redacted binary garbage*** + 580000000-243fffffff : System RAM (kmem) + +The corrupted data is from a use-after-free of the "dax4.0" and "dax3.0" +resources, and it also shows that the "System RAM (kmem)" resource is +not being removed. The bug does not appear after "modprobe -r kmem", it +requires the parent of "dax4.0" and "dax3.0" to be removed which +re-parents the leaked "System RAM (kmem)" instances. Those in turn +reference the freed resource as a parent. + +First up for the fix is release_mem_region_adjustable() needs to +reliably delete the resource inserted by add_memory_driver_managed(). +That is thwarted by a check for IORESOURCE_SYSRAM that predates the +dax/kmem driver, from commit: + +65c78784135f ("kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable") + +That appears to be working around the behavior of HMM's +"MEMORY_DEVICE_PUBLIC" facility that has since been deleted. With that +check removed the "System RAM (kmem)" resource gets removed, but +corruption still occurs occasionally because the "dax" resource is not +reliably removed. + +The dax range information is freed before the device is unregistered, so +the driver can not reliably recall (another use after free) what it is +meant to release. Lastly if that use after free got lucky, the driver +was covering up the leak of "System RAM (kmem)" due to its use of +release_resource() which detaches, but does not free, child resources. +The switch to remove_resource() forces remove_memory() to be responsible +for the deletion of the resource added by add_memory_driver_managed(). + +Fixes: c2f3011ee697 ("device-dax: add an allocation interface for device-dax instances") +Cc: +Cc: Oscar Salvador +Cc: David Hildenbrand +Cc: Pavel Tatashin +Reviewed-by: Vishal Verma +Reviewed-by: Pasha Tatashin +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/167653656244.3147810.5705900882794040229.stgit@dwillia2-xfh.jf.intel.com +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/dax/bus.c | 2 +- + drivers/dax/kmem.c | 4 ++-- + kernel/resource.c | 14 -------------- + 3 files changed, 3 insertions(+), 17 deletions(-) + +diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c +index 1dad813e..c64e7076 100644 +--- a/drivers/dax/bus.c ++++ b/drivers/dax/bus.c +@@ -427,8 +427,8 @@ static void unregister_dev_dax(void *dev) + dev_dbg(dev, "%s\n", __func__); + + kill_dev_dax(dev_dax); +- free_dev_dax_ranges(dev_dax); + device_del(dev); ++ free_dev_dax_ranges(dev_dax); + put_device(dev); + } + +diff --git a/drivers/dax/kmem.c b/drivers/dax/kmem.c +index 4852a2db..4aa758a2 100644 +--- a/drivers/dax/kmem.c ++++ b/drivers/dax/kmem.c +@@ -146,7 +146,7 @@ static int dev_dax_kmem_probe(struct dev_dax *dev_dax) + if (rc) { + dev_warn(dev, "mapping%d: %#llx-%#llx memory add failed\n", + i, range.start, range.end); +- release_resource(res); ++ remove_resource(res); + kfree(res); + data->res[i] = NULL; + if (mapped) +@@ -195,7 +195,7 @@ static void dev_dax_kmem_remove(struct dev_dax *dev_dax) + + rc = remove_memory(range.start, range_len(&range)); + if (rc == 0) { +- release_resource(data->res[i]); ++ remove_resource(data->res[i]); + kfree(data->res[i]); + data->res[i] = NULL; + success++; +diff --git a/kernel/resource.c b/kernel/resource.c +index ddbbacb9..b1763b2f 100644 +--- a/kernel/resource.c ++++ b/kernel/resource.c +@@ -1343,20 +1343,6 @@ void release_mem_region_adjustable(resource_size_t start, resource_size_t size) + continue; + } + +- /* +- * All memory regions added from memory-hotplug path have the +- * flag IORESOURCE_SYSTEM_RAM. If the resource does not have +- * this flag, we know that we are dealing with a resource coming +- * from HMM/devm. HMM/devm use another mechanism to add/release +- * a resource. This goes via devm_request_mem_region and +- * devm_release_mem_region. +- * HMM/devm take care to release their resources when they want, +- * so if we are dealing with them, let us just back off here. +- */ +- if (!(res->flags & IORESOURCE_SYSRAM)) { +- break; +- } +- + if (!(res->flags & IORESOURCE_MEM)) + break; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-934-mips-fix-syscall_get_nr.patch b/patches.kernel.org/6.2.3-934-mips-fix-syscall_get_nr.patch new file mode 100644 index 0000000..0878560 --- /dev/null +++ b/patches.kernel.org/6.2.3-934-mips-fix-syscall_get_nr.patch @@ -0,0 +1,45 @@ +From: Elvira Khabirova +Date: Sat, 18 Feb 2023 23:43:59 +0100 +Subject: [PATCH] mips: fix syscall_get_nr +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 85cc91e2ba4262a602ec65e2b76c4391a9e60d3d + +commit 85cc91e2ba4262a602ec65e2b76c4391a9e60d3d upstream. + +The implementation of syscall_get_nr on mips used to ignore the task +argument and return the syscall number of the calling thread instead of +the target thread. + +The bug was exposed to user space by commit 201766a20e30f ("ptrace: add +PTRACE_GET_SYSCALL_INFO request") and detected by strace test suite. + +Link: https://github.com/strace/strace/issues/235 +Fixes: c2d9f1775731 ("MIPS: Fix syscall_get_nr for the syscall exit tracing.") +Cc: # v3.19+ +Co-developed-by: Dmitry V. Levin +Signed-off-by: Dmitry V. Levin +Signed-off-by: Elvira Khabirova +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/mips/include/asm/syscall.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h +index 25fa651c..ebdf4d91 100644 +--- a/arch/mips/include/asm/syscall.h ++++ b/arch/mips/include/asm/syscall.h +@@ -38,7 +38,7 @@ static inline bool mips_syscall_is_indirect(struct task_struct *task, + static inline long syscall_get_nr(struct task_struct *task, + struct pt_regs *regs) + { +- return current_thread_info()->syscall; ++ return task_thread_info(task)->syscall; + } + + static inline void mips_syscall_update_nr(struct task_struct *task, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-935-media-ipu3-cio2-Fix-PM-runtime-usage_count-in-d.patch b/patches.kernel.org/6.2.3-935-media-ipu3-cio2-Fix-PM-runtime-usage_count-in-d.patch new file mode 100644 index 0000000..2c2aa40 --- /dev/null +++ b/patches.kernel.org/6.2.3-935-media-ipu3-cio2-Fix-PM-runtime-usage_count-in-d.patch @@ -0,0 +1,40 @@ +From: Sakari Ailus +Date: Wed, 21 Dec 2022 09:30:11 +0100 +Subject: [PATCH] media: ipu3-cio2: Fix PM runtime usage_count in driver unbind +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 909d3096ac99fa2289f9b8945a3eab2269947a0a + +commit 909d3096ac99fa2289f9b8945a3eab2269947a0a upstream. + +Get the PM runtime usage_count and forbid PM runtime at driver unbind. The +opposite is being done in probe() already. + +Fixes: commit c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") +Cc: stable@vger.kernel.org # for >= 4.16 +Signed-off-by: Sakari Ailus +Reviewed-by: Bingbu Cao +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +index 390bd5ea..3b76a9d0 100644 +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +@@ -1843,6 +1843,9 @@ static void cio2_pci_remove(struct pci_dev *pci_dev) + v4l2_device_unregister(&cio2->v4l2_dev); + media_device_cleanup(&cio2->media_dev); + mutex_destroy(&cio2->lock); ++ ++ pm_runtime_forbid(&pci_dev->dev); ++ pm_runtime_get_noresume(&pci_dev->dev); + } + + static int __maybe_unused cio2_runtime_suspend(struct device *dev) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-936-remoteproc-mtk_scp-Move-clk-ops-outside-send_lo.patch b/patches.kernel.org/6.2.3-936-remoteproc-mtk_scp-Move-clk-ops-outside-send_lo.patch new file mode 100644 index 0000000..defb981 --- /dev/null +++ b/patches.kernel.org/6.2.3-936-remoteproc-mtk_scp-Move-clk-ops-outside-send_lo.patch @@ -0,0 +1,81 @@ +From: Chen-Yu Tsai +Date: Wed, 4 Jan 2023 16:31:10 +0800 +Subject: [PATCH] remoteproc/mtk_scp: Move clk ops outside send_lock +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e46ceea3148163166ef9b7bcac578e72dd30c064 + +commit e46ceea3148163166ef9b7bcac578e72dd30c064 upstream. + +Clocks are properly reference counted and do not need to be inside the +lock range. + +Right now this triggers a false-positive lockdep warning on MT8192 based +Chromebooks, through a combination of mtk-scp that has a cros-ec-rpmsg +sub-device, the (actual) cros-ec I2C adapter registration, I2C client +(not on cros-ec) probe doing i2c transfers and enabling clocks. + +This is a false positive because the cros-ec-rpmsg under mtk-scp does +not have an I2C adapter, and also each I2C adapter and cros-ec instance +have their own mutex. + +Move the clk operations outside of the send_lock range. + +Fixes: 63c13d61eafe ("remoteproc/mediatek: add SCP support for mt8183") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230104083110.736377-1-wenst@chromium.org +[Fixed "Fixes:" tag line] +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/remoteproc/mtk_scp_ipi.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c +index 00f041eb..4c0d121c 100644 +--- a/drivers/remoteproc/mtk_scp_ipi.c ++++ b/drivers/remoteproc/mtk_scp_ipi.c +@@ -164,21 +164,21 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf)) + return -EINVAL; + +- mutex_lock(&scp->send_lock); +- + ret = clk_prepare_enable(scp->clk); + if (ret) { + dev_err(scp->dev, "failed to enable clock\n"); +- goto unlock_mutex; ++ return ret; + } + ++ mutex_lock(&scp->send_lock); ++ + /* Wait until SCP receives the last command */ + timeout = jiffies + msecs_to_jiffies(2000); + do { + if (time_after(jiffies, timeout)) { + dev_err(scp->dev, "%s: IPI timeout!\n", __func__); + ret = -ETIMEDOUT; +- goto clock_disable; ++ goto unlock_mutex; + } + } while (readl(scp->reg_base + scp->data->host_to_scp_reg)); + +@@ -205,10 +205,9 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len, + ret = 0; + } + +-clock_disable: +- clk_disable_unprepare(scp->clk); + unlock_mutex: + mutex_unlock(&scp->send_lock); ++ clk_disable_unprepare(scp->clk); + + return ret; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-937-vfio-Fix-NULL-pointer-dereference-caused-by-uni.patch b/patches.kernel.org/6.2.3-937-vfio-Fix-NULL-pointer-dereference-caused-by-uni.patch new file mode 100644 index 0000000..f2b0494 --- /dev/null +++ b/patches.kernel.org/6.2.3-937-vfio-Fix-NULL-pointer-dereference-caused-by-uni.patch @@ -0,0 +1,52 @@ +From: Yan Zhao +Date: Wed, 22 Feb 2023 15:49:38 +0800 +Subject: [PATCH] vfio: Fix NULL pointer dereference caused by uninitialized + group->iommufd +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d649c34cb916b015fdcb487e51409fcc5caeca8d + +commit d649c34cb916b015fdcb487e51409fcc5caeca8d upstream. + +group->iommufd is not initialized for the iommufd_ctx_put() + +[20018.331541] BUG: kernel NULL pointer dereference, address: 0000000000000000 +[20018.377508] RIP: 0010:iommufd_ctx_put+0x5/0x10 [iommufd] +... +[20018.476483] Call Trace: +[20018.479214] +[20018.481555] vfio_group_fops_unl_ioctl+0x506/0x690 [vfio] +[20018.487586] __x64_sys_ioctl+0x6a/0xb0 +[20018.491773] ? trace_hardirqs_on+0xc5/0xe0 +[20018.496347] do_syscall_64+0x67/0x90 +[20018.500340] entry_SYSCALL_64_after_hwframe+0x4b/0xb5 + +Fixes: 9eefba8002c2 ("vfio: Move vfio group specific code into group.c") +Cc: stable@vger.kernel.org +Signed-off-by: Yan Zhao +Reviewed-by: Jason Gunthorpe +Reviewed-by: Yi Liu +Link: https://lore.kernel.org/r/20230222074938.13681-1-yan.y.zhao@intel.com +Signed-off-by: Alex Williamson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/vfio/group.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/group.c b/drivers/vfio/group.c +index bb24b2f0..855db154 100644 +--- a/drivers/vfio/group.c ++++ b/drivers/vfio/group.c +@@ -137,7 +137,7 @@ static int vfio_group_ioctl_set_container(struct vfio_group *group, + + ret = iommufd_vfio_compat_ioas_id(iommufd, &ioas_id); + if (ret) { +- iommufd_ctx_put(group->iommufd); ++ iommufd_ctx_put(iommufd); + goto out_unlock; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-938-docs-gdbmacros-print-newest-record.patch b/patches.kernel.org/6.2.3-938-docs-gdbmacros-print-newest-record.patch new file mode 100644 index 0000000..3c39d7f --- /dev/null +++ b/patches.kernel.org/6.2.3-938-docs-gdbmacros-print-newest-record.patch @@ -0,0 +1,48 @@ +From: John Ogness +Date: Thu, 29 Dec 2022 14:49:39 +0106 +Subject: [PATCH] docs: gdbmacros: print newest record +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: f2e4cca2f670c8e52fbb551a295f2afc9aa2bd72 + +commit f2e4cca2f670c8e52fbb551a295f2afc9aa2bd72 upstream. + +@head_id points to the newest record, but the printing loop +exits when it increments to this value (before printing). + +Exit the printing loop after the newest record has been printed. + +The python-based function in scripts/gdb/linux/dmesg.py already +does this correctly. + +Fixes: e60768311af8 ("scripts/gdb: update for lockless printk ringbuffer") +Cc: stable@vger.kernel.org +Signed-off-by: John Ogness +Reviewed-by: Petr Mladek +Signed-off-by: Petr Mladek +Link: https://lore.kernel.org/r/20221229134339.197627-1-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Documentation/admin-guide/kdump/gdbmacros.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/admin-guide/kdump/gdbmacros.txt b/Documentation/admin-guide/kdump/gdbmacros.txt +index 82aecdca..030de95e 100644 +--- a/Documentation/admin-guide/kdump/gdbmacros.txt ++++ b/Documentation/admin-guide/kdump/gdbmacros.txt +@@ -312,10 +312,10 @@ define dmesg + set var $prev_flags = $info->flags + end + +- set var $id = ($id + 1) & $id_mask + if ($id == $end_id) + loop_break + end ++ set var $id = ($id + 1) & $id_mask + end + end + document dmesg +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-939-mm-memcontrol-deprecate-charge-moving.patch b/patches.kernel.org/6.2.3-939-mm-memcontrol-deprecate-charge-moving.patch new file mode 100644 index 0000000..69a530a --- /dev/null +++ b/patches.kernel.org/6.2.3-939-mm-memcontrol-deprecate-charge-moving.patch @@ -0,0 +1,108 @@ +From: Johannes Weiner +Date: Wed, 7 Dec 2022 14:00:39 +0100 +Subject: [PATCH] mm: memcontrol: deprecate charge moving +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: da34a8484d162585e22ed8c1e4114aa2f60e3567 + +commit da34a8484d162585e22ed8c1e4114aa2f60e3567 upstream. + +Charge moving mode in cgroup1 allows memory to follow tasks as they +migrate between cgroups. This is, and always has been, a questionable +thing to do - for several reasons. + +First, it's expensive. Pages need to be identified, locked and isolated +from various MM operations, and reassigned, one by one. + +Second, it's unreliable. Once pages are charged to a cgroup, there isn't +always a clear owner task anymore. Cache isn't moved at all, for example. +Mapped memory is moved - but if trylocking or isolating a page fails, +it's arbitrarily left behind. Frequent moving between domains may leave a +task's memory scattered all over the place. + +Third, it isn't really needed. Launcher tasks can kick off workload tasks +directly in their target cgroup. Using dedicated per-workload groups +allows fine-grained policy adjustments - no need to move tasks and their +physical pages between control domains. The feature was never +forward-ported to cgroup2, and it hasn't been missed. + +Despite it being a niche usecase, the maintenance overhead of supporting +it is enormous. Because pages are moved while they are live and subject +to various MM operations, the synchronization rules are complicated. +There are lock_page_memcg() in MM and FS code, which non-cgroup people +don't understand. In some cases we've been able to shift code and cgroup +API calls around such that we can rely on native locking as much as +possible. But that's fragile, and sometimes we need to hold MM locks for +longer than we otherwise would (pte lock e.g.). + +Mark the feature deprecated. Hopefully we can remove it soon. + +And backport into -stable kernels so that people who develop against +earlier kernels are warned about this deprecation as early as possible. + +[akpm@linux-foundation.org: fix memory.rst underlining] +Link: https://lkml.kernel.org/r/Y5COd+qXwk/S+n8N@cmpxchg.org +Signed-off-by: Johannes Weiner +Acked-by: Shakeel Butt +Acked-by: Hugh Dickins +Acked-by: Michal Hocko +Cc: Muchun Song +Cc: Roman Gushchin +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Documentation/admin-guide/cgroup-v1/memory.rst | 13 +++++++++++-- + mm/memcontrol.c | 4 ++++ + 2 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/Documentation/admin-guide/cgroup-v1/memory.rst b/Documentation/admin-guide/cgroup-v1/memory.rst +index 60370f2c..258e45cc 100644 +--- a/Documentation/admin-guide/cgroup-v1/memory.rst ++++ b/Documentation/admin-guide/cgroup-v1/memory.rst +@@ -86,6 +86,8 @@ Brief summary of control files. + memory.swappiness set/show swappiness parameter of vmscan + (See sysctl's vm.swappiness) + memory.move_charge_at_immigrate set/show controls of moving charges ++ This knob is deprecated and shouldn't be ++ used. + memory.oom_control set/show oom controls. + memory.numa_stat show the number of memory usage per numa + node +@@ -717,8 +719,15 @@ NOTE2: + It is recommended to set the soft limit always below the hard limit, + otherwise the hard limit will take precedence. + +-8. Move charges at task migration +-================================= ++8. Move charges at task migration (DEPRECATED!) ++=============================================== ++ ++THIS IS DEPRECATED! ++ ++It's expensive and unreliable! It's better practice to launch workload ++tasks directly from inside their target cgroup. Use dedicated workload ++cgroups to allow fine-grained policy adjustments without having to ++move physical pages between control domains. + + Users can move charges associated with a task along with task migration, that + is, uncharge task's pages from the old cgroup and charge them to the new cgroup. +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 73afff80..2eee092f 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -3914,6 +3914,10 @@ static int mem_cgroup_move_charge_write(struct cgroup_subsys_state *css, + { + struct mem_cgroup *memcg = mem_cgroup_from_css(css); + ++ pr_warn_once("Cgroup memory moving (move_charge_at_immigrate) is deprecated. " ++ "Please report your usecase to linux-mm@kvack.org if you " ++ "depend on this functionality.\n"); ++ + if (val & ~MOVE_MASK) + return -EINVAL; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-940-mm-thp-check-and-bail-out-if-page-in-deferred-q.patch b/patches.kernel.org/6.2.3-940-mm-thp-check-and-bail-out-if-page-in-deferred-q.patch new file mode 100644 index 0000000..5b13474 --- /dev/null +++ b/patches.kernel.org/6.2.3-940-mm-thp-check-and-bail-out-if-page-in-deferred-q.patch @@ -0,0 +1,97 @@ +From: Yin Fengwei +Date: Fri, 23 Dec 2022 21:52:07 +0800 +Subject: [PATCH] mm/thp: check and bail out if page in deferred queue already +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 81e506bec9be1eceaf5a2c654e28ba5176ef48d8 + +commit 81e506bec9be1eceaf5a2c654e28ba5176ef48d8 upstream. + +Kernel build regression with LLVM was reported here: +https://lore.kernel.org/all/Y1GCYXGtEVZbcv%2F5@dev-arch.thelio-3990X/ with +commit f35b5d7d676e ("mm: align larger anonymous mappings on THP +boundaries"). And the commit f35b5d7d676e was reverted. + +It turned out the regression is related with madvise(MADV_DONTNEED) +was used by ld.lld. But with none PMD_SIZE aligned parameter len. +trace-bpfcc captured: +531607 531732 ld.lld do_madvise.part.0 start: 0x7feca9000000, len: 0x7fb000, behavior: 0x4 +531607 531793 ld.lld do_madvise.part.0 start: 0x7fec86a00000, len: 0x7fb000, behavior: 0x4 + +If the underneath physical page is THP, the madvise(MADV_DONTNEED) can +trigger split_queue_lock contention raised significantly. perf showed +following data: + 14.85% 0.00% ld.lld [kernel.kallsyms] [k] + entry_SYSCALL_64_after_hwframe + 11.52% + entry_SYSCALL_64_after_hwframe + do_syscall_64 + __x64_sys_madvise + do_madvise.part.0 + zap_page_range + unmap_single_vma + unmap_page_range + page_remove_rmap + deferred_split_huge_page + __lock_text_start + native_queued_spin_lock_slowpath + +If THP can't be removed from rmap as whole THP, partial THP will be +removed from rmap by removing sub-pages from rmap. Even the THP head page +is added to deferred queue already, the split_queue_lock will be acquired +and check whether the THP head page is in the queue already. Thus, the +contention of split_queue_lock is raised. + +Before acquire split_queue_lock, check and bail out early if the THP +head page is in the queue already. The checking without holding +split_queue_lock could race with deferred_split_scan, but it doesn't +impact the correctness here. + +Test result of building kernel with ld.lld: +commit 7b5a0b664ebe (parent commit of f35b5d7d676e): +time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all + 6:07.99 real, 26367.77 user, 5063.35 sys + +commit f35b5d7d676e: +time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all + 7:22.15 real, 26235.03 user, 12504.55 sys + +commit f35b5d7d676e with the fixing patch: +time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all + 6:08.49 real, 26520.15 user, 5047.91 sys + +Link: https://lkml.kernel.org/r/20221223135207.2275317-1-fengwei.yin@intel.com +Signed-off-by: Yin Fengwei +Tested-by: Nathan Chancellor +Acked-by: David Rientjes +Reviewed-by: "Huang, Ying" +Cc: Feng Tang +Cc: Matthew Wilcox +Cc: Rik van Riel +Cc: Xing Zhengjun +Cc: Yang Shi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/huge_memory.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 1b791b26..d6651be1 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2837,6 +2837,9 @@ void deferred_split_huge_page(struct page *page) + if (PageSwapCache(page)) + return; + ++ if (!list_empty(page_deferred_list(page))) ++ return; ++ + spin_lock_irqsave(&ds_queue->split_queue_lock, flags); + if (list_empty(page_deferred_list(page))) { + count_vm_event(THP_DEFERRED_SPLIT_PAGE); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-941-ktest.pl-Give-back-console-on-Ctrt-C-on-monitor.patch b/patches.kernel.org/6.2.3-941-ktest.pl-Give-back-console-on-Ctrt-C-on-monitor.patch new file mode 100644 index 0000000..68200a2 --- /dev/null +++ b/patches.kernel.org/6.2.3-941-ktest.pl-Give-back-console-on-Ctrt-C-on-monitor.patch @@ -0,0 +1,42 @@ +From: Steven Rostedt +Date: Wed, 18 Jan 2023 16:32:13 -0500 +Subject: [PATCH] ktest.pl: Give back console on Ctrt^C on monitor +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 83d29d439cd3ef23041570d55841f814af2ecac0 + +commit 83d29d439cd3ef23041570d55841f814af2ecac0 upstream. + +When monitoring the console output, the stdout is being redirected to do +so. If Ctrl^C is hit during this mode, the stdout is not back to the +console, the user does not see anything they type (no echo). + +Add "end_monitor" to the SIGINT interrupt handler to give back the console +on Ctrl^C. + +Cc: stable@vger.kernel.org +Fixes: 9f2cdcbbb90e7 ("ktest: Give console process a dedicated tty") +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/ktest/ktest.pl | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index ac59999e..da071b13 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -4200,6 +4200,9 @@ sub send_email { + } + + sub cancel_test { ++ if ($monitor_cnt) { ++ end_monitor; ++ } + if ($email_when_canceled) { + my $name = get_test_name; + send_email("KTEST: Your [$name] test was cancelled", +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-942-kprobes-Fix-to-handle-forcibly-unoptimized-kpro.patch b/patches.kernel.org/6.2.3-942-kprobes-Fix-to-handle-forcibly-unoptimized-kpro.patch new file mode 100644 index 0000000..e3a9a00 --- /dev/null +++ b/patches.kernel.org/6.2.3-942-kprobes-Fix-to-handle-forcibly-unoptimized-kpro.patch @@ -0,0 +1,99 @@ +From: "Masami Hiramatsu (Google)" +Date: Tue, 21 Feb 2023 08:49:16 +0900 +Subject: [PATCH] kprobes: Fix to handle forcibly unoptimized kprobes on + freeing_list +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4fbd2f83fda0ca44a2ec6421ca3508b355b31858 + +commit 4fbd2f83fda0ca44a2ec6421ca3508b355b31858 upstream. + +Since forcibly unoptimized kprobes will be put on the freeing_list directly +in the unoptimize_kprobe(), do_unoptimize_kprobes() must continue to check +the freeing_list even if unoptimizing_list is empty. + +This bug can happen if a kprobe is put in an instruction which is in the +middle of the jump-replaced instruction sequence of an optprobe, *and* the +optprobe is recently unregistered and queued on unoptimizing_list. +In this case, the optprobe will be unoptimized forcibly (means immediately) +and put it into the freeing_list, expecting the optprobe will be handled in +do_unoptimize_kprobe(). +But if there is no other optprobes on the unoptimizing_list, current code +returns from the do_unoptimize_kprobe() soon and does not handle the +optprobe which is on the freeing_list. Then the optprobe will hit the +WARN_ON_ONCE() in the do_free_cleaned_kprobes(), because it is not handled +in the latter loop of the do_unoptimize_kprobe(). + +To solve this issue, do not return from do_unoptimize_kprobes() immediately +even if unoptimizing_list is empty. + +Moreover, this change affects another case. kill_optimized_kprobes() expects +kprobe_optimizer() will just free the optprobe on freeing_list. +So I changed it to just do list_move() to freeing_list if optprobes are on +unoptimizing list. And the do_unoptimize_kprobe() will skip +arch_disarm_kprobe() if the probe on freeing_list has gone flag. + +Link: https://lore.kernel.org/all/Y8URdIfVr3pq2X8w@xpf.sh.intel.com/ +Link: https://lore.kernel.org/all/167448024501.3253718.13037333683110512967.stgit@devnote3/ + +Fixes: e4add247789e ("kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic") +Reported-by: Pengfei Xu +Signed-off-by: Masami Hiramatsu (Google) +Cc: stable@vger.kernel.org +Acked-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/kprobes.c | 23 ++++++++++------------- + 1 file changed, 10 insertions(+), 13 deletions(-) + +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 99c3f4de..00e177de 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -555,17 +555,15 @@ static void do_unoptimize_kprobes(void) + /* See comment in do_optimize_kprobes() */ + lockdep_assert_cpus_held(); + +- /* Unoptimization must be done anytime */ +- if (list_empty(&unoptimizing_list)) +- return; ++ if (!list_empty(&unoptimizing_list)) ++ arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list); + +- arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list); +- /* Loop on 'freeing_list' for disarming */ ++ /* Loop on 'freeing_list' for disarming and removing from kprobe hash list */ + list_for_each_entry_safe(op, tmp, &freeing_list, list) { + /* Switching from detour code to origin */ + op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED; +- /* Disarm probes if marked disabled */ +- if (kprobe_disabled(&op->kp)) ++ /* Disarm probes if marked disabled and not gone */ ++ if (kprobe_disabled(&op->kp) && !kprobe_gone(&op->kp)) + arch_disarm_kprobe(&op->kp); + if (kprobe_unused(&op->kp)) { + /* +@@ -797,14 +795,13 @@ static void kill_optimized_kprobe(struct kprobe *p) + op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED; + + if (kprobe_unused(p)) { +- /* Enqueue if it is unused */ +- list_add(&op->list, &freeing_list); + /* +- * Remove unused probes from the hash list. After waiting +- * for synchronization, this probe is reclaimed. +- * (reclaiming is done by do_free_cleaned_kprobes().) ++ * Unused kprobe is on unoptimizing or freeing list. We move it ++ * to freeing_list and let the kprobe_optimizer() remove it from ++ * the kprobe hash list and free it. + */ +- hlist_del_rcu(&op->kp.hlist); ++ if (optprobe_queued_unopt(op)) ++ list_move(&op->list, &freeing_list); + } + + /* Don't touch the code, because it is already freed. */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-943-ktest.pl-Fix-missing-end_monitor-when-machine-c.patch b/patches.kernel.org/6.2.3-943-ktest.pl-Fix-missing-end_monitor-when-machine-c.patch new file mode 100644 index 0000000..425f039 --- /dev/null +++ b/patches.kernel.org/6.2.3-943-ktest.pl-Fix-missing-end_monitor-when-machine-c.patch @@ -0,0 +1,44 @@ +From: Steven Rostedt +Date: Wed, 18 Jan 2023 11:31:25 -0500 +Subject: [PATCH] ktest.pl: Fix missing "end_monitor" when machine check fails +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e8bf9b98d40dbdf4e39362e3b85a70c61da68cb7 + +commit e8bf9b98d40dbdf4e39362e3b85a70c61da68cb7 upstream. + +In the "reboot" command, it does a check of the machine to see if it is +still alive with a simple "ssh echo" command. If it fails, it will assume +that a normal "ssh reboot" is not possible and force a power cycle. + +In this case, the "start_monitor" is executed, but the "end_monitor" is +not, and this causes the screen will not be given back to the console. That +is, after the test, a "reset" command needs to be performed, as "echo" is +turned off. + +Cc: stable@vger.kernel.org +Fixes: 6474ace999edd ("ktest.pl: Powercycle the box on reboot if no connection can be made") +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/ktest/ktest.pl | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index da071b13..74801811 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -1495,7 +1495,8 @@ sub reboot { + + # Still need to wait for the reboot to finish + wait_for_monitor($time, $reboot_success_line); +- ++ } ++ if ($powercycle || $time) { + end_monitor; + } + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-944-ktest.pl-Add-RUN_TIMEOUT-option-with-default-un.patch b/patches.kernel.org/6.2.3-944-ktest.pl-Add-RUN_TIMEOUT-option-with-default-un.patch new file mode 100644 index 0000000..b8286dc --- /dev/null +++ b/patches.kernel.org/6.2.3-944-ktest.pl-Add-RUN_TIMEOUT-option-with-default-un.patch @@ -0,0 +1,116 @@ +From: Steven Rostedt +Date: Wed, 18 Jan 2023 16:37:25 -0500 +Subject: [PATCH] ktest.pl: Add RUN_TIMEOUT option with default unlimited +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 4e7d2a8f0b52abf23b1dc13b3d88bc0923383cd5 + +commit 4e7d2a8f0b52abf23b1dc13b3d88bc0923383cd5 upstream. + +There is a disconnect between the run_command function and the +wait_for_input. The wait_for_input has a default timeout of 2 minutes. But +if that happens, the run_command loop will exit out to the waitpid() of +the executing command. This fails in that it no longer monitors the +command, and also, the ssh to the test box can hang when its finished, as +it's waiting for the pipe it's writing to to flush, but the loop that +reads that pipe has already exited, leaving the command stuck, and the +test hangs. + +Instead, make the default "wait_for_input" of the run_command infinite, +and allow the user to override it if they want with a default timeout +option "RUN_TIMEOUT". + +But this fixes the hang that happens when the pipe is full and the ssh +session never exits. + +Cc: stable@vger.kernel.org +Fixes: 6e98d1b4415fe ("ktest: Add timeout to ssh command") +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/testing/ktest/ktest.pl | 20 ++++++++++++++++---- + tools/testing/ktest/sample.conf | 5 +++++ + 2 files changed, 21 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index 74801811..822794ca 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -178,6 +178,7 @@ my $store_failures; + my $store_successes; + my $test_name; + my $timeout; ++my $run_timeout; + my $connect_timeout; + my $config_bisect_exec; + my $booted_timeout; +@@ -340,6 +341,7 @@ my %option_map = ( + "STORE_SUCCESSES" => \$store_successes, + "TEST_NAME" => \$test_name, + "TIMEOUT" => \$timeout, ++ "RUN_TIMEOUT" => \$run_timeout, + "CONNECT_TIMEOUT" => \$connect_timeout, + "CONFIG_BISECT_EXEC" => \$config_bisect_exec, + "BOOTED_TIMEOUT" => \$booted_timeout, +@@ -1858,6 +1860,14 @@ sub run_command { + $command =~ s/\$SSH_USER/$ssh_user/g; + $command =~ s/\$MACHINE/$machine/g; + ++ if (!defined($timeout)) { ++ $timeout = $run_timeout; ++ } ++ ++ if (!defined($timeout)) { ++ $timeout = -1; # tell wait_for_input to wait indefinitely ++ } ++ + doprint("$command ... "); + $start_time = time; + +@@ -1884,13 +1894,10 @@ sub run_command { + + while (1) { + my $fp = \*CMD; +- if (defined($timeout)) { +- doprint "timeout = $timeout\n"; +- } + my $line = wait_for_input($fp, $timeout); + if (!defined($line)) { + my $now = time; +- if (defined($timeout) && (($now - $start_time) >= $timeout)) { ++ if ($timeout >= 0 && (($now - $start_time) >= $timeout)) { + doprint "Hit timeout of $timeout, killing process\n"; + $hit_timeout = 1; + kill 9, $pid; +@@ -2062,6 +2069,11 @@ sub wait_for_input { + $time = $timeout; + } + ++ if ($time < 0) { ++ # Negative number means wait indefinitely ++ undef $time; ++ } ++ + $rin = ''; + vec($rin, fileno($fp), 1) = 1; + vec($rin, fileno(\*STDIN), 1) = 1; +diff --git a/tools/testing/ktest/sample.conf b/tools/testing/ktest/sample.conf +index 2d0fe15a..f43477a9 100644 +--- a/tools/testing/ktest/sample.conf ++++ b/tools/testing/ktest/sample.conf +@@ -817,6 +817,11 @@ + # is issued instead of a reboot. + # CONNECT_TIMEOUT = 25 + ++# The timeout in seconds for how long to wait for any running command ++# to timeout. If not defined, it will let it go indefinitely. ++# (default undefined) ++#RUN_TIMEOUT = 600 ++ + # In between tests, a reboot of the box may occur, and this + # is the time to wait for the console after it stops producing + # output. Some machines may not produce a large lag on reboot +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-945-memory-tier-release-the-new_memtier-in-find_cre.patch b/patches.kernel.org/6.2.3-945-memory-tier-release-the-new_memtier-in-find_cre.patch new file mode 100644 index 0000000..042aaaa --- /dev/null +++ b/patches.kernel.org/6.2.3-945-memory-tier-release-the-new_memtier-in-find_cre.patch @@ -0,0 +1,46 @@ +From: Tong Tiangen +Date: Sun, 29 Jan 2023 04:06:51 +0000 +Subject: [PATCH] memory tier: release the new_memtier in + find_create_memory_tier() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 93419139fa14124c1c507d804f2b28866ebee28d + +commit 93419139fa14124c1c507d804f2b28866ebee28d upstream. + +In find_create_memory_tier(), if failed to register device, then we should +release new_memtier from the tier list and put device instead of memtier. + +Link: https://lkml.kernel.org/r/20230129040651.1329208-1-tongtiangen@huawei.com +Fixes: 9832fb87834e ("mm/demotion: expose memory tier details via sysfs") +Signed-off-by: Tong Tiangen +Cc: Aneesh Kumar K.V +Cc: Hanjun Guo +Cc: Kefeng Wang +Cc: Guohanjun +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + mm/memory-tiers.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/memory-tiers.c b/mm/memory-tiers.c +index c734658c..e593e56e 100644 +--- a/mm/memory-tiers.c ++++ b/mm/memory-tiers.c +@@ -211,8 +211,8 @@ static struct memory_tier *find_create_memory_tier(struct memory_dev_type *memty + + ret = device_register(&new_memtier->dev); + if (ret) { +- list_del(&memtier->list); +- put_device(&memtier->dev); ++ list_del(&new_memtier->list); ++ put_device(&new_memtier->dev); + return ERR_PTR(ret); + } + memtier = new_memtier; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-946-ring-buffer-Handle-race-between-rb_move_tail-an.patch b/patches.kernel.org/6.2.3-946-ring-buffer-Handle-race-between-rb_move_tail-an.patch new file mode 100644 index 0000000..7e1c431 --- /dev/null +++ b/patches.kernel.org/6.2.3-946-ring-buffer-Handle-race-between-rb_move_tail-an.patch @@ -0,0 +1,182 @@ +From: Mukesh Ojha +Date: Tue, 14 Feb 2023 17:36:43 +0530 +Subject: [PATCH] ring-buffer: Handle race between rb_move_tail and + rb_check_pages +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8843e06f67b14f71c044bf6267b2387784c7e198 + +commit 8843e06f67b14f71c044bf6267b2387784c7e198 upstream. + +It seems a data race between ring_buffer writing and integrity check. +That is, RB_FLAG of head_page is been updating, while at same time +RB_FLAG was cleared when doing integrity check rb_check_pages(): + + rb_check_pages() rb_handle_head_page(): + -------- -------- + rb_head_page_deactivate() + rb_head_page_set_normal() + rb_head_page_activate() + +We do intergrity test of the list to check if the list is corrupted and +it is still worth doing it. So, let's refactor rb_check_pages() such that +we no longer clear and set flag during the list sanity checking. + +[1] and [2] are the test to reproduce and the crash report respectively. + +1: +``` read_trace.sh + while true; + do + # the "trace" file is closed after read + head -1 /sys/kernel/tracing/trace > /dev/null + done +``` +``` repro.sh + sysctl -w kernel.panic_on_warn=1 + # function tracer will writing enough data into ring_buffer + echo function > /sys/kernel/tracing/current_tracer + ./read_trace.sh & + ./read_trace.sh & + ./read_trace.sh & + ./read_trace.sh & + ./read_trace.sh & + ./read_trace.sh & + ./read_trace.sh & + ./read_trace.sh & +``` + +2: +------------[ cut here ]------------ +WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653 +rb_move_tail+0x450/0x470 +Modules linked in: +CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+ +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 +RIP: 0010:rb_move_tail+0x450/0x470 +Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24 +83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83 +f8 02 0f 84 ce fb ff ff e9 db +RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203 +RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18 +RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400 +RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2 +R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000 +R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108 +FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0 +Call Trace: + + ring_buffer_lock_reserve+0x136/0x360 + ? __do_softirq+0x287/0x2df + ? __pfx_rcu_softirq_qs+0x10/0x10 + trace_function+0x21/0x110 + ? __pfx_rcu_softirq_qs+0x10/0x10 + ? __do_softirq+0x287/0x2df + function_trace_call+0xf6/0x120 + 0xffffffffc038f097 + ? rcu_softirq_qs+0x5/0x140 + rcu_softirq_qs+0x5/0x140 + __do_softirq+0x287/0x2df + run_ksoftirqd+0x2a/0x30 + smpboot_thread_fn+0x188/0x220 + ? __pfx_smpboot_thread_fn+0x10/0x10 + kthread+0xe7/0x110 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x2c/0x50 + +---[ end trace 0000000000000000 ]--- + +[ crash report and test reproducer credit goes to Zheng Yejian] + +Link: https://lore.kernel.org/linux-trace-kernel/1676376403-16462-1-git-send-email-quic_mojha@quicinc.com + +Cc: +Cc: stable@vger.kernel.org +Fixes: 1039221cc278 ("ring-buffer: Do not disable recording when there is an iterator") +Reported-by: Zheng Yejian +Signed-off-by: Mukesh Ojha +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/trace/ring_buffer.c | 42 +++++++++----------------------------- + 1 file changed, 10 insertions(+), 32 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index c366a0a9..b641cab2 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -1580,19 +1580,6 @@ static int rb_check_bpage(struct ring_buffer_per_cpu *cpu_buffer, + return 0; + } + +-/** +- * rb_check_list - make sure a pointer to a list has the last bits zero +- */ +-static int rb_check_list(struct ring_buffer_per_cpu *cpu_buffer, +- struct list_head *list) +-{ +- if (RB_WARN_ON(cpu_buffer, rb_list_head(list->prev) != list->prev)) +- return 1; +- if (RB_WARN_ON(cpu_buffer, rb_list_head(list->next) != list->next)) +- return 1; +- return 0; +-} +- + /** + * rb_check_pages - integrity check of buffer pages + * @cpu_buffer: CPU buffer with pages to test +@@ -1602,36 +1589,27 @@ static int rb_check_list(struct ring_buffer_per_cpu *cpu_buffer, + */ + static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer) + { +- struct list_head *head = cpu_buffer->pages; +- struct buffer_page *bpage, *tmp; ++ struct list_head *head = rb_list_head(cpu_buffer->pages); ++ struct list_head *tmp; + +- /* Reset the head page if it exists */ +- if (cpu_buffer->head_page) +- rb_set_head_page(cpu_buffer); +- +- rb_head_page_deactivate(cpu_buffer); +- +- if (RB_WARN_ON(cpu_buffer, head->next->prev != head)) +- return -1; +- if (RB_WARN_ON(cpu_buffer, head->prev->next != head)) ++ if (RB_WARN_ON(cpu_buffer, ++ rb_list_head(rb_list_head(head->next)->prev) != head)) + return -1; + +- if (rb_check_list(cpu_buffer, head)) ++ if (RB_WARN_ON(cpu_buffer, ++ rb_list_head(rb_list_head(head->prev)->next) != head)) + return -1; + +- list_for_each_entry_safe(bpage, tmp, head, list) { ++ for (tmp = rb_list_head(head->next); tmp != head; tmp = rb_list_head(tmp->next)) { + if (RB_WARN_ON(cpu_buffer, +- bpage->list.next->prev != &bpage->list)) ++ rb_list_head(rb_list_head(tmp->next)->prev) != tmp)) + return -1; ++ + if (RB_WARN_ON(cpu_buffer, +- bpage->list.prev->next != &bpage->list)) +- return -1; +- if (rb_check_list(cpu_buffer, &bpage->list)) ++ rb_list_head(rb_list_head(tmp->prev)->next) != tmp)) + return -1; + } + +- rb_head_page_activate(cpu_buffer); +- + return 0; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-947-tools-bootconfig-fix-single-used-for-logical-co.patch b/patches.kernel.org/6.2.3-947-tools-bootconfig-fix-single-used-for-logical-co.patch new file mode 100644 index 0000000..728b5c7 --- /dev/null +++ b/patches.kernel.org/6.2.3-947-tools-bootconfig-fix-single-used-for-logical-co.patch @@ -0,0 +1,42 @@ +From: Antonio Alvarez Feijoo +Date: Wed, 22 Feb 2023 08:27:35 +0900 +Subject: [PATCH] tools/bootconfig: fix single & used for logical condition +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cf8c59a3756b2735c409a9b3ac1e4ec556546a7a + +commit cf8c59a3756b2735c409a9b3ac1e4ec556546a7a upstream. + +A single & will create a background process and return true, so the grep +command will run even if the file checked in the first condition does not +exist. + +Link: https://lore.kernel.org/all/20230112114215.17103-1-antonio.feijoo@suse.com/ + +Fixes: 1eaad3ac3f39 ("tools/bootconfig: Use per-group/all enable option in ftrace2bconf script") +Signed-off-by: Antonio Alvarez Feijoo +Cc: stable@vger.kernel.org +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + tools/bootconfig/scripts/ftrace2bconf.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/bootconfig/scripts/ftrace2bconf.sh b/tools/bootconfig/scripts/ftrace2bconf.sh +index 6183b36c..1603801c 100755 +--- a/tools/bootconfig/scripts/ftrace2bconf.sh ++++ b/tools/bootconfig/scripts/ftrace2bconf.sh +@@ -93,7 +93,7 @@ referred_vars() { + } + + event_is_enabled() { # enable-file +- test -f $1 & grep -q "1" $1 ++ test -f $1 && grep -q "1" $1 + } + + per_event_options() { # event-dir +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-948-tracing-eprobe-Fix-to-add-filter-on-eprobe-desc.patch b/patches.kernel.org/6.2.3-948-tracing-eprobe-Fix-to-add-filter-on-eprobe-desc.patch new file mode 100644 index 0000000..b21e503 --- /dev/null +++ b/patches.kernel.org/6.2.3-948-tracing-eprobe-Fix-to-add-filter-on-eprobe-desc.patch @@ -0,0 +1,41 @@ +From: "Masami Hiramatsu (Google)" +Date: Tue, 21 Feb 2023 08:49:16 +0900 +Subject: [PATCH] tracing/eprobe: Fix to add filter on eprobe description in + README file +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 133921530c42960c07d25d12677f9e131a2b0cdf + +commit 133921530c42960c07d25d12677f9e131a2b0cdf upstream. + +Fix to add a description of the filter on eprobe in README file. This +is required to identify the kernel supports the filter on eprobe or not. + +Link: https://lore.kernel.org/all/167309833728.640500.12232259238201433587.stgit@devnote3/ + +Fixes: 752be5c5c910 ("tracing/eprobe: Add eprobe filter support") +Cc: stable@vger.kernel.org +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + kernel/trace/trace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index c9e40f69..b677f8d6 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -5598,7 +5598,7 @@ static const char readme_msg[] = + #ifdef CONFIG_HIST_TRIGGERS + "\t s:[synthetic/] []\n" + #endif +- "\t e[:[/][]] . []\n" ++ "\t e[:[/][]] . [] [if ]\n" + "\t -:[/][]\n" + #ifdef CONFIG_KPROBE_EVENTS + "\t place: [:][+]|\n" +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-949-iommu-amd-Add-a-length-limitation-for-the-ivrs_.patch b/patches.kernel.org/6.2.3-949-iommu-amd-Add-a-length-limitation-for-the-ivrs_.patch new file mode 100644 index 0000000..5058795 --- /dev/null +++ b/patches.kernel.org/6.2.3-949-iommu-amd-Add-a-length-limitation-for-the-ivrs_.patch @@ -0,0 +1,74 @@ +From: Gavrilov Ilia +Date: Thu, 2 Feb 2023 08:26:56 +0000 +Subject: [PATCH] iommu/amd: Add a length limitation for the ivrs_acpihid + command-line parameter +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b6b26d86c61c441144c72f842f7469bb686e1211 + +commit b6b26d86c61c441144c72f842f7469bb686e1211 upstream. + +The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, +because the string specifier in the format string sscanf() +has no width limitation. + +Found by InfoTeCS on behalf of Linux Verification Center +(linuxtesting.org) with SVACE. + +Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") +Cc: stable@vger.kernel.org +Signed-off-by: Ilia.Gavrilov +Reviewed-by: Kim Phillips +Link: https://lore.kernel.org/r/20230202082719.1513849-1-Ilia.Gavrilov@infotecs.ru +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/amd/init.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index 467b1949..19a46b9f 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -3475,15 +3475,26 @@ static int __init parse_ivrs_hpet(char *str) + return 1; + } + ++#define ACPIID_LEN (ACPIHID_UID_LEN + ACPIHID_HID_LEN) ++ + static int __init parse_ivrs_acpihid(char *str) + { + u32 seg = 0, bus, dev, fn; + char *hid, *uid, *p, *addr; +- char acpiid[ACPIHID_UID_LEN + ACPIHID_HID_LEN] = {0}; ++ char acpiid[ACPIID_LEN] = {0}; + int i; + + addr = strchr(str, '@'); + if (!addr) { ++ addr = strchr(str, '='); ++ if (!addr) ++ goto not_found; ++ ++ ++addr; ++ ++ if (strlen(addr) > ACPIID_LEN) ++ goto not_found; ++ + if (sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid) == 4 || + sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid) == 5) { + pr_warn("ivrs_acpihid%s option format deprecated; use ivrs_acpihid=%s@%04x:%02x:%02x.%d instead\n", +@@ -3496,6 +3507,9 @@ static int __init parse_ivrs_acpihid(char *str) + /* We have the '@', make it the terminator to get just the acpiid */ + *addr++ = 0; + ++ if (strlen(str) > ACPIID_LEN + 1) ++ goto not_found; ++ + if (sscanf(str, "=%s", acpiid) != 1) + goto not_found; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-950-scsi-aacraid-Allocate-cmd_priv-with-scsicmd.patch b/patches.kernel.org/6.2.3-950-scsi-aacraid-Allocate-cmd_priv-with-scsicmd.patch new file mode 100644 index 0000000..762c28e --- /dev/null +++ b/patches.kernel.org/6.2.3-950-scsi-aacraid-Allocate-cmd_priv-with-scsicmd.patch @@ -0,0 +1,78 @@ +From: Kees Cook +Date: Fri, 27 Jan 2023 16:04:13 -0800 +Subject: [PATCH] scsi: aacraid: Allocate cmd_priv with scsicmd +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7ab734fc759828707dae22fe48b1eb4dcf70beea + +commit 7ab734fc759828707dae22fe48b1eb4dcf70beea upstream. + +The aac_priv() helper assumes that the private cmd area immediately follows +struct scsi_cmnd. Allocate this space as part of scsicmd, else there is a +risk of heap overflow. Seen with GCC 13: + +../drivers/scsi/aacraid/aachba.c: In function 'aac_probe_container': +../drivers/scsi/aacraid/aachba.c:841:26: warning: array subscript 16 is outside array bounds of 'void[392]' [-Warray-bounds=] + 841 | status = cmd_priv->status; + | ^~ +In file included from ../include/linux/resource_ext.h:11, + from ../include/linux/pci.h:40, + from ../drivers/scsi/aacraid/aachba.c:22: +In function 'kmalloc', + inlined from 'kzalloc' at ../include/linux/slab.h:720:9, + inlined from 'aac_probe_container' at ../drivers/scsi/aacraid/aachba.c:821:30: +../include/linux/slab.h:580:24: note: at offset 392 into object of size 392 allocated by 'kmalloc_trace' + 580 | return kmalloc_trace( + | ^~~~~~~~~~~~~~ + 581 | kmalloc_caches[kmalloc_type(flags)][index], + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 582 | flags, size); + | ~~~~~~~~~~~~ + +Fixes: 76a3451b64c6 ("scsi: aacraid: Move the SCSI pointer to private command data") +Link: https://lore.kernel.org/r/20230128000409.never.976-kees@kernel.org +Cc: Bart Van Assche +Cc: Hannes Reinecke +Cc: Himanshu Madhani +Cc: Adaptec OEM Raid Solutions +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: linux-scsi@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Vegard Nossum +Reviewed-by: Hannes Reinecke +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/aacraid/aachba.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c +index 4d4cb47b..24c049ef 100644 +--- a/drivers/scsi/aacraid/aachba.c ++++ b/drivers/scsi/aacraid/aachba.c +@@ -818,8 +818,8 @@ static void aac_probe_container_scsi_done(struct scsi_cmnd *scsi_cmnd) + + int aac_probe_container(struct aac_dev *dev, int cid) + { +- struct scsi_cmnd *scsicmd = kzalloc(sizeof(*scsicmd), GFP_KERNEL); +- struct aac_cmd_priv *cmd_priv = aac_priv(scsicmd); ++ struct aac_cmd_priv *cmd_priv; ++ struct scsi_cmnd *scsicmd = kzalloc(sizeof(*scsicmd) + sizeof(*cmd_priv), GFP_KERNEL); + struct scsi_device *scsidev = kzalloc(sizeof(*scsidev), GFP_KERNEL); + int status; + +@@ -838,6 +838,7 @@ int aac_probe_container(struct aac_dev *dev, int cid) + while (scsicmd->device == scsidev) + schedule(); + kfree(scsidev); ++ cmd_priv = aac_priv(scsicmd); + status = cmd_priv->status; + kfree(scsicmd); + return status; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-951-scsi-qla2xxx-Fix-link-failure-in-NPIV-environme.patch b/patches.kernel.org/6.2.3-951-scsi-qla2xxx-Fix-link-failure-in-NPIV-environme.patch new file mode 100644 index 0000000..fd586b4 --- /dev/null +++ b/patches.kernel.org/6.2.3-951-scsi-qla2xxx-Fix-link-failure-in-NPIV-environme.patch @@ -0,0 +1,49 @@ +From: Quinn Tran +Date: Mon, 19 Dec 2022 03:07:39 -0800 +Subject: [PATCH] scsi: qla2xxx: Fix link failure in NPIV environment +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b1ae65c082f74536ec292b15766f2846f0238373 + +commit b1ae65c082f74536ec292b15766f2846f0238373 upstream. + +User experienced symptoms of adapter failure in NPIV environment. NPIV +hosts were allowed to trigger chip reset back to back due to NPIV link +state being slow to come online. + +Fix link failure in NPIV environment by removing NPIV host from directly +being able to perform chip reset. + + kernel: qla2xxx [0000:04:00.1]-6009:261: Loop down - aborting ISP. + kernel: qla2xxx [0000:04:00.1]-6009:262: Loop down - aborting ISP. + kernel: qla2xxx [0000:04:00.1]-6009:281: Loop down - aborting ISP. + kernel: qla2xxx [0000:04:00.1]-6009:285: Loop down - aborting ISP + +Fixes: 0d6e61bc6a4f ("[SCSI] qla2xxx: Correct various NPIV issues.") +Cc: stable@vger.kernel.org +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_os.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 7fb28c20..36d3ceca 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -7447,7 +7447,7 @@ qla2x00_timer(struct timer_list *t) + + /* if the loop has been down for 4 minutes, reinit adapter */ + if (atomic_dec_and_test(&vha->loop_down_timer) != 0) { +- if (!(vha->device_flags & DFLG_NO_CABLE)) { ++ if (!(vha->device_flags & DFLG_NO_CABLE) && !vha->vp_idx) { + ql_log(ql_log_warn, vha, 0x6009, + "Loop down - aborting ISP.\n"); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-952-scsi-qla2xxx-Check-if-port-is-online-before-sen.patch b/patches.kernel.org/6.2.3-952-scsi-qla2xxx-Check-if-port-is-online-before-sen.patch new file mode 100644 index 0000000..2349ef9 --- /dev/null +++ b/patches.kernel.org/6.2.3-952-scsi-qla2xxx-Check-if-port-is-online-before-sen.patch @@ -0,0 +1,69 @@ +From: Shreyas Deodhar +Date: Mon, 19 Dec 2022 03:07:38 -0800 +Subject: [PATCH] scsi: qla2xxx: Check if port is online before sending ELS +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0c227dc22ca18856055983f27594feb2e0149965 + +commit 0c227dc22ca18856055983f27594feb2e0149965 upstream. + +CT Ping and ELS cmds fail for NVMe targets. Check if port is online before +sending ELS instead of sending login. + +Cc: stable@vger.kernel.org +Signed-off-by: Shreyas Deodhar +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_bsg.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c +index cd75b179..dba7bba7 100644 +--- a/drivers/scsi/qla2xxx/qla_bsg.c ++++ b/drivers/scsi/qla2xxx/qla_bsg.c +@@ -278,8 +278,8 @@ qla2x00_process_els(struct bsg_job *bsg_job) + const char *type; + int req_sg_cnt, rsp_sg_cnt; + int rval = (DID_ERROR << 16); +- uint16_t nextlid = 0; + uint32_t els_cmd = 0; ++ int qla_port_allocated = 0; + + if (bsg_request->msgcode == FC_BSG_RPT_ELS) { + rport = fc_bsg_to_rport(bsg_job); +@@ -329,9 +329,9 @@ qla2x00_process_els(struct bsg_job *bsg_job) + /* make sure the rport is logged in, + * if not perform fabric login + */ +- if (qla2x00_fabric_login(vha, fcport, &nextlid)) { ++ if (atomic_read(&fcport->state) != FCS_ONLINE) { + ql_dbg(ql_dbg_user, vha, 0x7003, +- "Failed to login port %06X for ELS passthru.\n", ++ "Port %06X is not online for ELS passthru.\n", + fcport->d_id.b24); + rval = -EIO; + goto done; +@@ -348,6 +348,7 @@ qla2x00_process_els(struct bsg_job *bsg_job) + goto done; + } + ++ qla_port_allocated = 1; + /* Initialize all required fields of fcport */ + fcport->vha = vha; + fcport->d_id.b.al_pa = +@@ -432,7 +433,7 @@ qla2x00_process_els(struct bsg_job *bsg_job) + goto done_free_fcport; + + done_free_fcport: +- if (bsg_request->msgcode != FC_BSG_RPT_ELS) ++ if (qla_port_allocated) + qla2x00_free_fcport(fcport); + done: + return rval; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-953-scsi-qla2xxx-Fix-DMA-API-call-trace-on-NVMe-LS-.patch b/patches.kernel.org/6.2.3-953-scsi-qla2xxx-Fix-DMA-API-call-trace-on-NVMe-LS-.patch new file mode 100644 index 0000000..3b43584 --- /dev/null +++ b/patches.kernel.org/6.2.3-953-scsi-qla2xxx-Fix-DMA-API-call-trace-on-NVMe-LS-.patch @@ -0,0 +1,93 @@ +From: Arun Easi +Date: Mon, 19 Dec 2022 03:07:40 -0800 +Subject: [PATCH] scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: c75e6aef5039830cce5d4cf764dd204522f89e6b + +commit c75e6aef5039830cce5d4cf764dd204522f89e6b upstream. + +The following message and call trace was seen with debug kernels: + +DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map +error [device address=0x00000002a3ff38d8] [size=1024 bytes] [mapped as +single] +WARNING: CPU: 0 PID: 2930 at kernel/dma/debug.c:1017 + check_unmap+0xf42/0x1990 + +Call Trace: + debug_dma_unmap_page+0xc9/0x100 + qla_nvme_ls_unmap+0x141/0x210 [qla2xxx] + +Remove DMA mapping from the driver altogether, as it is already done by FC +layer. This prevents the warning. + +Fixes: c85ab7d9e27a ("scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests") +Cc: stable@vger.kernel.org +Signed-off-by: Arun Easi +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_nvme.c | 19 +------------------ + 1 file changed, 1 insertion(+), 18 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 582d88dd..c57e02a3 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -170,18 +170,6 @@ static void qla_nvme_release_fcp_cmd_kref(struct kref *kref) + qla2xxx_rel_qpair_sp(sp->qpair, sp); + } + +-static void qla_nvme_ls_unmap(struct srb *sp, struct nvmefc_ls_req *fd) +-{ +- if (sp->flags & SRB_DMA_VALID) { +- struct srb_iocb *nvme = &sp->u.iocb_cmd; +- struct qla_hw_data *ha = sp->fcport->vha->hw; +- +- dma_unmap_single(&ha->pdev->dev, nvme->u.nvme.cmd_dma, +- fd->rqstlen, DMA_TO_DEVICE); +- sp->flags &= ~SRB_DMA_VALID; +- } +-} +- + static void qla_nvme_release_ls_cmd_kref(struct kref *kref) + { + struct srb *sp = container_of(kref, struct srb, cmd_kref); +@@ -199,7 +187,6 @@ static void qla_nvme_release_ls_cmd_kref(struct kref *kref) + + fd = priv->fd; + +- qla_nvme_ls_unmap(sp, fd); + fd->done(fd, priv->comp_status); + out: + qla2x00_rel_sp(sp); +@@ -365,13 +352,10 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, + nvme->u.nvme.rsp_len = fd->rsplen; + nvme->u.nvme.rsp_dma = fd->rspdma; + nvme->u.nvme.timeout_sec = fd->timeout; +- nvme->u.nvme.cmd_dma = dma_map_single(&ha->pdev->dev, fd->rqstaddr, +- fd->rqstlen, DMA_TO_DEVICE); ++ nvme->u.nvme.cmd_dma = fd->rqstdma; + dma_sync_single_for_device(&ha->pdev->dev, nvme->u.nvme.cmd_dma, + fd->rqstlen, DMA_TO_DEVICE); + +- sp->flags |= SRB_DMA_VALID; +- + rval = qla2x00_start_sp(sp); + if (rval != QLA_SUCCESS) { + ql_log(ql_log_warn, vha, 0x700e, +@@ -379,7 +363,6 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, + wake_up(&sp->nvme_ls_waitq); + sp->priv = NULL; + priv->sp = NULL; +- qla_nvme_ls_unmap(sp, fd); + qla2x00_rel_sp(sp); + return rval; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-954-scsi-qla2xxx-Remove-unintended-flag-clearing.patch b/patches.kernel.org/6.2.3-954-scsi-qla2xxx-Remove-unintended-flag-clearing.patch new file mode 100644 index 0000000..a88b4b4 --- /dev/null +++ b/patches.kernel.org/6.2.3-954-scsi-qla2xxx-Remove-unintended-flag-clearing.patch @@ -0,0 +1,39 @@ +From: Quinn Tran +Date: Mon, 19 Dec 2022 03:07:44 -0800 +Subject: [PATCH] scsi: qla2xxx: Remove unintended flag clearing +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 7e8a936a2d0f98dd6e5d05d4838affabe606cabc + +commit 7e8a936a2d0f98dd6e5d05d4838affabe606cabc upstream. + +FCF_ASYNC_SENT flag is used in session management. This flag is cleared in +task management path by accident. Remove unintended flag clearing. + +Fixes: 388a49959ee4 ("scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd") +Cc: stable@vger.kernel.org +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_init.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index fd27fb51..8f2a9687 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -2076,7 +2076,6 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun, + done_free_sp: + /* ref: INIT */ + kref_put(&sp->cmd_kref, qla2x00_sp_release); +- fcport->flags &= ~FCF_ASYNC_SENT; + done: + return rval; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-955-scsi-qla2xxx-Fix-erroneous-link-down.patch b/patches.kernel.org/6.2.3-955-scsi-qla2xxx-Fix-erroneous-link-down.patch new file mode 100644 index 0000000..ac62abd --- /dev/null +++ b/patches.kernel.org/6.2.3-955-scsi-qla2xxx-Fix-erroneous-link-down.patch @@ -0,0 +1,56 @@ +From: Quinn Tran +Date: Mon, 19 Dec 2022 03:07:45 -0800 +Subject: [PATCH] scsi: qla2xxx: Fix erroneous link down +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3fbc74feb642deb688cc97f76d40b7287ddd4cb1 + +commit 3fbc74feb642deb688cc97f76d40b7287ddd4cb1 upstream. + +If after an adapter reset the appearance of link is not recovered, the +devices are not rediscovered. This is result of a race condition between +adapter reset (abort_isp) and the topology scan. During adapter reset, the +ABORT_ISP_ACTIVE flag is set. Topology scan usually occurred after adapter +reset. In this case, the topology scan came earlier than usual where it +ran into problem due to ABORT_ISP_ACTIVE flag was still set. + +kernel: qla2xxx [0000:13:00.0]-1005:1: Cmd 0x6a aborted with timeout since ISP Abort is pending +kernel: qla2xxx [0000:13:00.0]-28a0:1: MBX_GET_PORT_NAME failed, No FL Port. +kernel: qla2xxx [0000:13:00.0]-286b:1: qla2x00_configure_loop: exiting normally. local port wwpn 51402ec0123d9a80 id 012300) +kernel: qla2xxx [0000:13:00.0]-8017:1: ADAPTER RESET SUCCEEDED nexus=1:0:15. + +Allow adapter reset to complete before any scan can start. + +Cc: stable@vger.kernel.org +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_os.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 36d3ceca..2d86f804 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -7094,9 +7094,12 @@ qla2x00_do_dpc(void *data) + } + } + loop_resync_check: +- if (test_and_clear_bit(LOOP_RESYNC_NEEDED, ++ if (!qla2x00_reset_active(base_vha) && ++ test_and_clear_bit(LOOP_RESYNC_NEEDED, + &base_vha->dpc_flags)) { +- ++ /* ++ * Allow abort_isp to complete before moving on to scanning. ++ */ + ql_dbg(ql_dbg_dpc, base_vha, 0x400f, + "Loop resync scheduled.\n"); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-956-scsi-qla2xxx-Remove-increment-of-interface-err-.patch b/patches.kernel.org/6.2.3-956-scsi-qla2xxx-Remove-increment-of-interface-err-.patch new file mode 100644 index 0000000..5ae902a --- /dev/null +++ b/patches.kernel.org/6.2.3-956-scsi-qla2xxx-Remove-increment-of-interface-err-.patch @@ -0,0 +1,40 @@ +From: Saurav Kashyap +Date: Mon, 19 Dec 2022 03:07:46 -0800 +Subject: [PATCH] scsi: qla2xxx: Remove increment of interface err cnt +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: d676a9e3d9efb7e93df460bcf4c445496c16314f + +commit d676a9e3d9efb7e93df460bcf4c445496c16314f upstream. + +Residual underrun is not an interface error, hence no need to increment +that count. + +Fixes: dbf1f53cfd23 ("scsi: qla2xxx: Implementation to get and manage host, target stats and initiator port") +Cc: stable@vger.kernel.org +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/qla2xxx/qla_isr.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 759bea69..cbbd7014 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3363,8 +3363,6 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) + "Dropped frame(s) detected (0x%x of 0x%x bytes).\n", + resid, scsi_bufflen(cp)); + +- vha->interface_err_cnt++; +- + res = DID_ERROR << 16 | lscsi_status; + goto check_scsi_status; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-957-scsi-ses-Don-t-attach-if-enclosure-has-no-compo.patch b/patches.kernel.org/6.2.3-957-scsi-ses-Don-t-attach-if-enclosure-has-no-compo.patch new file mode 100644 index 0000000..fd08a74 --- /dev/null +++ b/patches.kernel.org/6.2.3-957-scsi-ses-Don-t-attach-if-enclosure-has-no-compo.patch @@ -0,0 +1,47 @@ +From: James Bottomley +Date: Sat, 28 Nov 2020 15:27:21 -0800 +Subject: [PATCH] scsi: ses: Don't attach if enclosure has no components +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 3fe97ff3d94934649abb0652028dd7296170c8d0 + +commit 3fe97ff3d94934649abb0652028dd7296170c8d0 upstream. + +An enclosure with no components can't usefully be operated by the driver +(since effectively it has nothing to manage), so report the problem and +don't attach. Not attaching also fixes an oops which could occur if the +driver tries to manage a zero component enclosure. + +[mkp: Switched to KERN_WARNING since this scenario is common] + +Link: https://lore.kernel.org/r/c5deac044ac409e32d9ad9968ce0dcbc996bfc7a.camel@linux.ibm.com +Cc: stable@vger.kernel.org +Reported-by: Ding Hui +Signed-off-by: James Bottomley +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/ses.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 0a1734f3..b61d7e49 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -704,6 +704,12 @@ static int ses_intf_add(struct device *cdev, + type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE) + components += type_ptr[1]; + } ++ ++ if (components == 0) { ++ sdev_printk(KERN_WARNING, sdev, "enclosure has no enumerated components\n"); ++ goto err_free; ++ } ++ + ses_dev->page1 = buf; + ses_dev->page1_len = len; + buf = NULL; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-958-scsi-ses-Fix-slab-out-of-bounds-in-ses_enclosur.patch b/patches.kernel.org/6.2.3-958-scsi-ses-Fix-slab-out-of-bounds-in-ses_enclosur.patch new file mode 100644 index 0000000..aa97ed1 --- /dev/null +++ b/patches.kernel.org/6.2.3-958-scsi-ses-Fix-slab-out-of-bounds-in-ses_enclosur.patch @@ -0,0 +1,50 @@ +From: Tomas Henzl +Date: Thu, 2 Feb 2023 17:24:48 +0100 +Subject: [PATCH] scsi: ses: Fix slab-out-of-bounds in + ses_enclosure_data_process() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9b4f5028e493cb353a5c8f5c45073eeea0303abd + +commit 9b4f5028e493cb353a5c8f5c45073eeea0303abd upstream. + +A fix for: + +BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] +Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 + +Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we +expect the size to be sanitized before first access to addl_desc_ptr[1]. +Make sure we don't walk beyond end of page. + +Link: https://lore.kernel.org/r/20230202162451.15346-2-thenzl@redhat.com +Cc: stable@vger.kernel.org +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/ses.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index b61d7e49..4739c03b 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -603,9 +603,11 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, + /* these elements are optional */ + type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || + type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || +- type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) ++ type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) { + addl_desc_ptr += addl_desc_ptr[1] + 2; +- ++ if (addl_desc_ptr + 1 >= ses_dev->page10 + ses_dev->page10_len) ++ addl_desc_ptr = NULL; ++ } + } + } + kfree(buf); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-959-scsi-ses-Fix-possible-addl_desc_ptr-out-of-boun.patch b/patches.kernel.org/6.2.3-959-scsi-ses-Fix-possible-addl_desc_ptr-out-of-boun.patch new file mode 100644 index 0000000..c42dce1 --- /dev/null +++ b/patches.kernel.org/6.2.3-959-scsi-ses-Fix-possible-addl_desc_ptr-out-of-boun.patch @@ -0,0 +1,120 @@ +From: Tomas Henzl +Date: Thu, 2 Feb 2023 17:24:49 +0100 +Subject: [PATCH] scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: db95d4df71cb55506425b6e4a5f8d68e3a765b63 + +commit db95d4df71cb55506425b6e4a5f8d68e3a765b63 upstream. + +Sanitize possible addl_desc_ptr out-of-bounds accesses in +ses_enclosure_data_process(). + +Link: https://lore.kernel.org/r/20230202162451.15346-3-thenzl@redhat.com +Cc: stable@vger.kernel.org +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/ses.c | 35 ++++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 4739c03b..4b66f9ae 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -433,8 +433,8 @@ int ses_match_host(struct enclosure_device *edev, void *data) + } + #endif /* 0 */ + +-static void ses_process_descriptor(struct enclosure_component *ecomp, +- unsigned char *desc) ++static int ses_process_descriptor(struct enclosure_component *ecomp, ++ unsigned char *desc, int max_desc_len) + { + int eip = desc[0] & 0x10; + int invalid = desc[0] & 0x80; +@@ -445,22 +445,32 @@ static void ses_process_descriptor(struct enclosure_component *ecomp, + unsigned char *d; + + if (invalid) +- return; ++ return 0; + + switch (proto) { + case SCSI_PROTOCOL_FCP: + if (eip) { ++ if (max_desc_len <= 7) ++ return 1; + d = desc + 4; + slot = d[3]; + } + break; + case SCSI_PROTOCOL_SAS: ++ + if (eip) { ++ if (max_desc_len <= 27) ++ return 1; + d = desc + 4; + slot = d[3]; + d = desc + 8; +- } else ++ } else { ++ if (max_desc_len <= 23) ++ return 1; + d = desc + 4; ++ } ++ ++ + /* only take the phy0 addr */ + addr = (u64)d[12] << 56 | + (u64)d[13] << 48 | +@@ -477,6 +487,8 @@ static void ses_process_descriptor(struct enclosure_component *ecomp, + } + ecomp->slot = slot; + scomp->addr = addr; ++ ++ return 0; + } + + struct efd { +@@ -549,7 +561,7 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, + /* skip past overall descriptor */ + desc_ptr += len + 4; + } +- if (ses_dev->page10) ++ if (ses_dev->page10 && ses_dev->page10_len > 9) + addl_desc_ptr = ses_dev->page10 + 8; + type_ptr = ses_dev->page1_types; + components = 0; +@@ -557,6 +569,7 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, + for (j = 0; j < type_ptr[1]; j++) { + char *name = NULL; + struct enclosure_component *ecomp; ++ int max_desc_len; + + if (desc_ptr) { + if (desc_ptr >= buf + page7_len) { +@@ -583,10 +596,14 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, + ecomp = &edev->component[components++]; + + if (!IS_ERR(ecomp)) { +- if (addl_desc_ptr) +- ses_process_descriptor( +- ecomp, +- addl_desc_ptr); ++ if (addl_desc_ptr) { ++ max_desc_len = ses_dev->page10_len - ++ (addl_desc_ptr - ses_dev->page10); ++ if (ses_process_descriptor(ecomp, ++ addl_desc_ptr, ++ max_desc_len)) ++ addl_desc_ptr = NULL; ++ } + if (create) + enclosure_component_register( + ecomp); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-960-scsi-ses-Fix-possible-desc_ptr-out-of-bounds-ac.patch b/patches.kernel.org/6.2.3-960-scsi-ses-Fix-possible-desc_ptr-out-of-bounds-ac.patch new file mode 100644 index 0000000..be5ad6f --- /dev/null +++ b/patches.kernel.org/6.2.3-960-scsi-ses-Fix-possible-desc_ptr-out-of-bounds-ac.patch @@ -0,0 +1,54 @@ +From: Tomas Henzl +Date: Thu, 2 Feb 2023 17:24:50 +0100 +Subject: [PATCH] scsi: ses: Fix possible desc_ptr out-of-bounds accesses +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 801ab13d50cf3d26170ee073ea8bb4eececb76ab + +commit 801ab13d50cf3d26170ee073ea8bb4eececb76ab upstream. + +Sanitize possible desc_ptr out-of-bounds accesses in +ses_enclosure_data_process(). + +Link: https://lore.kernel.org/r/20230202162451.15346-4-thenzl@redhat.com +Cc: stable@vger.kernel.org +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/ses.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 4b66f9ae..77f4322e 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -572,15 +572,19 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, + int max_desc_len; + + if (desc_ptr) { +- if (desc_ptr >= buf + page7_len) { ++ if (desc_ptr + 3 >= buf + page7_len) { + desc_ptr = NULL; + } else { + len = (desc_ptr[2] << 8) + desc_ptr[3]; + desc_ptr += 4; +- /* Add trailing zero - pushes into +- * reserved space */ +- desc_ptr[len] = '\0'; +- name = desc_ptr; ++ if (desc_ptr + len > buf + page7_len) ++ desc_ptr = NULL; ++ else { ++ /* Add trailing zero - pushes into ++ * reserved space */ ++ desc_ptr[len] = '\0'; ++ name = desc_ptr; ++ } + } + } + if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE || +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-961-scsi-ses-Fix-slab-out-of-bounds-in-ses_intf_rem.patch b/patches.kernel.org/6.2.3-961-scsi-ses-Fix-slab-out-of-bounds-in-ses_intf_rem.patch new file mode 100644 index 0000000..18eba36 --- /dev/null +++ b/patches.kernel.org/6.2.3-961-scsi-ses-Fix-slab-out-of-bounds-in-ses_intf_rem.patch @@ -0,0 +1,44 @@ +From: Tomas Henzl +Date: Thu, 2 Feb 2023 17:24:51 +0100 +Subject: [PATCH] scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 578797f0c8cbc2e3ec5fc0dab87087b4c7073686 + +commit 578797f0c8cbc2e3ec5fc0dab87087b4c7073686 upstream. + +A fix for: + +BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] +Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013 + +When edev->components is zero, accessing edev->component[0] members is +wrong. + +Link: https://lore.kernel.org/r/20230202162451.15346-5-thenzl@redhat.com +Cc: stable@vger.kernel.org +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/scsi/ses.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 77f4322e..1707d6d1 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -856,7 +856,8 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev) + kfree(ses_dev->page2); + kfree(ses_dev); + +- kfree(edev->component[0].scratch); ++ if (edev->components) ++ kfree(edev->component[0].scratch); + + put_device(&edev->edev); + enclosure_unregister(edev); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-962-RISC-V-add-a-spin_shadow_stack-declaration.patch b/patches.kernel.org/6.2.3-962-RISC-V-add-a-spin_shadow_stack-declaration.patch new file mode 100644 index 0000000..b79c4fe --- /dev/null +++ b/patches.kernel.org/6.2.3-962-RISC-V-add-a-spin_shadow_stack-declaration.patch @@ -0,0 +1,45 @@ +From: Conor Dooley +Date: Fri, 10 Feb 2023 18:59:45 +0000 +Subject: [PATCH] RISC-V: add a spin_shadow_stack declaration +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: eb9be8310c58c166f9fae3b71c0ad9d6741b4897 + +commit eb9be8310c58c166f9fae3b71c0ad9d6741b4897 upstream. + +The patchwork automation reported a sparse complaint that +spin_shadow_stack was not declared and should be static: +../arch/riscv/kernel/traps.c:335:15: warning: symbol 'spin_shadow_stack' was not declared. Should it be static? + +However, this is used in entry.S and therefore shouldn't be static. +The same applies to the shadow_stack that this pseudo spinlock is +trying to protect, so do like its charge and add a declaration to +thread_info.h + +Signed-off-by: Conor Dooley +Fixes: 7e1864332fbc ("riscv: fix race when vmap stack overflow") +Reviewed-by: Guo Ren +Link: https://lore.kernel.org/r/20230210185945.915806-1-conor@kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/include/asm/thread_info.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/include/asm/thread_info.h b/arch/riscv/include/asm/thread_info.h +index 67322f87..f704c8dd 100644 +--- a/arch/riscv/include/asm/thread_info.h ++++ b/arch/riscv/include/asm/thread_info.h +@@ -43,6 +43,7 @@ + #ifndef __ASSEMBLY__ + + extern long shadow_stack[SHADOW_OVERFLOW_STACK_SIZE / sizeof(long)]; ++extern unsigned long spin_shadow_stack; + + #include + #include +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-963-riscv-Avoid-enabling-interrupts-in-die.patch b/patches.kernel.org/6.2.3-963-riscv-Avoid-enabling-interrupts-in-die.patch new file mode 100644 index 0000000..ad02751 --- /dev/null +++ b/patches.kernel.org/6.2.3-963-riscv-Avoid-enabling-interrupts-in-die.patch @@ -0,0 +1,61 @@ +From: Mattias Nissler +Date: Wed, 15 Feb 2023 14:48:28 +0000 +Subject: [PATCH] riscv: Avoid enabling interrupts in die() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 130aee3fd9981297ff9354e5d5609cd59aafbbea + +commit 130aee3fd9981297ff9354e5d5609cd59aafbbea upstream. + +While working on something else, I noticed that the kernel would start +accepting interrupts again after crashing in an interrupt handler. Since +the kernel is already in inconsistent state, enabling interrupts is +dangerous and opens up risk of kernel state deteriorating further. +Interrupts do get enabled via what looks like an unintended side effect of +spin_unlock_irq, so switch to the more cautious +spin_lock_irqsave/spin_unlock_irqrestore instead. + +Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code") +Signed-off-by: Mattias Nissler +Reviewed-by: Björn Töpel +Link: https://lore.kernel.org/r/20230215144828.3370316-1-mnissler@rivosinc.com +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/kernel/traps.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index 549bde5c..70c98ce2 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -34,10 +34,11 @@ void die(struct pt_regs *regs, const char *str) + static int die_counter; + int ret; + long cause; ++ unsigned long flags; + + oops_enter(); + +- spin_lock_irq(&die_lock); ++ spin_lock_irqsave(&die_lock, flags); + console_verbose(); + bust_spinlocks(1); + +@@ -54,7 +55,7 @@ void die(struct pt_regs *regs, const char *str) + + bust_spinlocks(0); + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); +- spin_unlock_irq(&die_lock); ++ spin_unlock_irqrestore(&die_lock, flags); + oops_exit(); + + if (in_interrupt()) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-964-riscv-mm-fix-regression-due-to-update_mmu_cache.patch b/patches.kernel.org/6.2.3-964-riscv-mm-fix-regression-due-to-update_mmu_cache.patch new file mode 100644 index 0000000..b83166c --- /dev/null +++ b/patches.kernel.org/6.2.3-964-riscv-mm-fix-regression-due-to-update_mmu_cache.patch @@ -0,0 +1,52 @@ +From: Sergey Matyukevich +Date: Mon, 30 Jan 2023 00:18:18 +0300 +Subject: [PATCH] riscv: mm: fix regression due to update_mmu_cache change +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b49f700668fff7565b945dce823def79bff59bb0 + +commit b49f700668fff7565b945dce823def79bff59bb0 upstream. + +This is a partial revert of the commit 4bd1d80efb5a ("riscv: mm: notify +remote harts about mmu cache updates"). Original commit included two +loosely related changes serving the same purpose of fixing stale TLB +entries causing user-space application crash: +- introduce deferred per-ASID TLB flush for CPUs not running the task +- switch to per-ASID TLB flush on all CPUs running the task in update_mmu_cache + +According to report and discussion in [1], the second part caused a +regression on Renesas RZ/Five SoC. For now restore the old behavior +of the update_mmu_cache. + +[1] https://lore.kernel.org/linux-riscv/20220829205219.283543-1-geomatsi@gmail.com/ + +Fixes: 4bd1d80efb5a ("riscv: mm: notify remote harts about mmu cache updates") +Reported-by: "Lad, Prabhakar" +Signed-off-by: Sergey Matyukevich +Link: trailer, so that it can be parsed with git's trailer functionality? +Reviewed-by: Conor Dooley +Link: https://lore.kernel.org/r/20230129211818.686557-1-geomatsi@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/include/asm/pgtable.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h +index 3e01f4f3..6da0f328 100644 +--- a/arch/riscv/include/asm/pgtable.h ++++ b/arch/riscv/include/asm/pgtable.h +@@ -415,7 +415,7 @@ static inline void update_mmu_cache(struct vm_area_struct *vma, + * Relying on flush_tlb_fix_spurious_fault would suffice, but + * the extra traps reduce performance. So, eagerly SFENCE.VMA. + */ +- flush_tlb_page(vma, address); ++ local_flush_tlb_page(address); + } + + #define __HAVE_ARCH_UPDATE_MMU_TLB +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-965-riscv-jump_label-Fixup-unaligned-arch_static_br.patch b/patches.kernel.org/6.2.3-965-riscv-jump_label-Fixup-unaligned-arch_static_br.patch new file mode 100644 index 0000000..eb78436 --- /dev/null +++ b/patches.kernel.org/6.2.3-965-riscv-jump_label-Fixup-unaligned-arch_static_br.patch @@ -0,0 +1,68 @@ +From: Andy Chiu +Date: Mon, 6 Feb 2023 04:04:40 -0500 +Subject: [PATCH] riscv: jump_label: Fixup unaligned arch_static_branch + function +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 9ddfc3cd806081ce1f6c9c2f988cbb031f35d28f + +commit 9ddfc3cd806081ce1f6c9c2f988cbb031f35d28f upstream. + +Runtime code patching must be done at a naturally aligned address, or we +may execute on a partial instruction. + +We have encountered problems traced back to static jump functions during +the test. We switched the tracer randomly for every 1~5 seconds on a +dual-core QEMU setup and found the kernel sucking at a static branch +where it jumps to itself. + +The reason is that the static branch was 2-byte but not 4-byte aligned. +Then, the kernel would patch the instruction, either J or NOP, with two +half-word stores if the machine does not have efficient unaligned +accesses. Thus, moments exist where half of the NOP mixes with the other +half of the J when transitioning the branch. In our particular case, on +a little-endian machine, the upper half of the NOP was mixed with the +lower part of the J when enabling the branch, resulting in a jump that +jumped to itself. Conversely, it would result in a HINT instruction when +disabling the branch, but it might not be observable. + +ARM64 does not have this problem since all instructions must be 4-byte +aligned. + +Fixes: ebc00dde8a97 ("riscv: Add jump-label implementation") +Link: https://lore.kernel.org/linux-riscv/20220913094252.3555240-6-andy.chiu@sifive.com/ +Reviewed-by: Greentime Hu +Signed-off-by: Andy Chiu +Signed-off-by: Guo Ren +Link: https://lore.kernel.org/r/20230206090440.1255001-1-guoren@kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/include/asm/jump_label.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/riscv/include/asm/jump_label.h b/arch/riscv/include/asm/jump_label.h +index 6d58bbb5..14a5ea8d 100644 +--- a/arch/riscv/include/asm/jump_label.h ++++ b/arch/riscv/include/asm/jump_label.h +@@ -18,6 +18,7 @@ static __always_inline bool arch_static_branch(struct static_key * const key, + const bool branch) + { + asm_volatile_goto( ++ " .align 2 \n\t" + " .option push \n\t" + " .option norelax \n\t" + " .option norvc \n\t" +@@ -39,6 +40,7 @@ static __always_inline bool arch_static_branch_jump(struct static_key * const ke + const bool branch) + { + asm_volatile_goto( ++ " .align 2 \n\t" + " .option push \n\t" + " .option norelax \n\t" + " .option norvc \n\t" +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-966-riscv-ftrace-Fixup-panic-by-disabling-preemptio.patch b/patches.kernel.org/6.2.3-966-riscv-ftrace-Fixup-panic-by-disabling-preemptio.patch new file mode 100644 index 0000000..90acf5c --- /dev/null +++ b/patches.kernel.org/6.2.3-966-riscv-ftrace-Fixup-panic-by-disabling-preemptio.patch @@ -0,0 +1,58 @@ +From: Andy Chiu +Date: Thu, 12 Jan 2023 04:05:57 -0500 +Subject: [PATCH] riscv: ftrace: Fixup panic by disabling preemption +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8547649981e6631328cd64f583667501ae385531 + +commit 8547649981e6631328cd64f583667501ae385531 upstream. + +In RISCV, we must use an AUIPC + JALR pair to encode an immediate, +forming a jump that jumps to an address over 4K. This may cause errors +if we want to enable kernel preemption and remove dependency from +patching code with stop_machine(). For example, if a task was switched +out on auipc. And, if we changed the ftrace function before it was +switched back, then it would jump to an address that has updated 11:0 +bits mixing with previous XLEN:12 part. + +p: patched area performed by dynamic ftrace +ftrace_prologue: +p| REG_S ra, -SZREG(sp) +p| auipc ra, 0x? ------------> preempted + ... + change ftrace function + ... +p| jalr -?(ra) <------------- switched back +p| REG_L ra, -SZREG(sp) +func: + xxx + ret + +Fixes: afc76b8b8011 ("riscv: Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT") +Signed-off-by: Andy Chiu +Signed-off-by: Guo Ren +Link: https://lore.kernel.org/r/20230112090603.1295340-2-guoren@kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index e2b65604..ee0d39b2 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -138,7 +138,7 @@ config RISCV + select HAVE_DYNAMIC_FTRACE_WITH_REGS if HAVE_DYNAMIC_FTRACE + select HAVE_FTRACE_MCOUNT_RECORD if !XIP_KERNEL + select HAVE_FUNCTION_GRAPH_TRACER +- select HAVE_FUNCTION_TRACER if !XIP_KERNEL ++ select HAVE_FUNCTION_TRACER if !XIP_KERNEL && !PREEMPTION + + config ARCH_MMAP_RND_BITS_MIN + default 18 if 64BIT +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-967-riscv-mm-Perform-BPF-exhandler-fixup-on-page-fa.patch b/patches.kernel.org/6.2.3-967-riscv-mm-Perform-BPF-exhandler-fixup-on-page-fa.patch new file mode 100644 index 0000000..f0c9bc0 --- /dev/null +++ b/patches.kernel.org/6.2.3-967-riscv-mm-Perform-BPF-exhandler-fixup-on-page-fa.patch @@ -0,0 +1,60 @@ +From: =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= +Date: Tue, 14 Feb 2023 17:25:15 +0100 +Subject: [PATCH] riscv, mm: Perform BPF exhandler fixup on page fault +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 416721ff05fddc58ca531b6f069de250301de6e5 + +commit 416721ff05fddc58ca531b6f069de250301de6e5 upstream. + +Commit 21855cac82d3 ("riscv/mm: Prevent kernel module to access user +memory without uaccess routines") added early exits/deaths for page +faults stemming from accesses to user-space without using proper +uaccess routines (where sstatus.SUM is set). + +Unfortunatly, this is too strict for some BPF programs, which relies +on BPF exhandler fixups. These BPF programs loads "BTF pointers". A +BTF pointers could either be a valid kernel pointer or NULL, but not a +userspace address. + +Resolve the problem by calling the fixup handler in the early exit +path. + +Fixes: 21855cac82d3 ("riscv/mm: Prevent kernel module to access user memory without uaccess routines") +Signed-off-by: Björn Töpel +Link: https://lore.kernel.org/r/20230214162515.184827-1-bjorn@kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/mm/fault.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c +index d86f7ceb..eb0774d9 100644 +--- a/arch/riscv/mm/fault.c ++++ b/arch/riscv/mm/fault.c +@@ -267,10 +267,12 @@ asmlinkage void do_page_fault(struct pt_regs *regs) + if (user_mode(regs)) + flags |= FAULT_FLAG_USER; + +- if (!user_mode(regs) && addr < TASK_SIZE && +- unlikely(!(regs->status & SR_SUM))) +- die_kernel_fault("access to user memory without uaccess routines", +- addr, regs); ++ if (!user_mode(regs) && addr < TASK_SIZE && unlikely(!(regs->status & SR_SUM))) { ++ if (fixup_exception(regs)) ++ return; ++ ++ die_kernel_fault("access to user memory without uaccess routines", addr, regs); ++ } + + perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-968-riscv-ftrace-Remove-wasted-nops-for-RISCV_ISA_C.patch b/patches.kernel.org/6.2.3-968-riscv-ftrace-Remove-wasted-nops-for-RISCV_ISA_C.patch new file mode 100644 index 0000000..d2bda5a --- /dev/null +++ b/patches.kernel.org/6.2.3-968-riscv-ftrace-Remove-wasted-nops-for-RISCV_ISA_C.patch @@ -0,0 +1,61 @@ +From: Guo Ren +Date: Thu, 12 Jan 2023 04:05:58 -0500 +Subject: [PATCH] riscv: ftrace: Remove wasted nops for !RISCV_ISA_C +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 409c8fb20c66df7150e592747412438c04aeb11f + +commit 409c8fb20c66df7150e592747412438c04aeb11f upstream. + +When CONFIG_RISCV_ISA_C=n, -fpatchable-function-entry=8 would generate +more nops than we expect. Because it treat nop opcode as 0x00000013 +instead of 0x0001. + +Dump of assembler code for function dw_pcie_free_msi: + 0xffffffff806fce94 <+0>: sd ra,-8(sp) + 0xffffffff806fce98 <+4>: auipc ra,0xff90f + 0xffffffff806fce9c <+8>: jalr -684(ra) # 0xffffffff8000bbec + + 0xffffffff806fcea0 <+12>: ld ra,-8(sp) + 0xffffffff806fcea4 <+16>: nop /* wasted */ + 0xffffffff806fcea8 <+20>: nop /* wasted */ + 0xffffffff806fceac <+24>: nop /* wasted */ + 0xffffffff806fceb0 <+28>: nop /* wasted */ + 0xffffffff806fceb4 <+0>: addi sp,sp,-48 + 0xffffffff806fceb8 <+4>: sd s0,32(sp) + 0xffffffff806fcebc <+8>: sd s1,24(sp) + 0xffffffff806fcec0 <+12>: sd s2,16(sp) + 0xffffffff806fcec4 <+16>: sd s3,8(sp) + 0xffffffff806fcec8 <+20>: sd ra,40(sp) + 0xffffffff806fcecc <+24>: addi s0,sp,48 + +Signed-off-by: Guo Ren +Signed-off-by: Guo Ren +Link: https://lore.kernel.org/r/20230112090603.1295340-3-guoren@kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/Makefile | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index 82153960..23149e98 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -11,7 +11,11 @@ LDFLAGS_vmlinux := + ifeq ($(CONFIG_DYNAMIC_FTRACE),y) + LDFLAGS_vmlinux := --no-relax + KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY ++ifeq ($(CONFIG_RISCV_ISA_C),y) + CC_FLAGS_FTRACE := -fpatchable-function-entry=8 ++else ++ CC_FLAGS_FTRACE := -fpatchable-function-entry=4 ++endif + endif + + ifeq ($(CONFIG_CMODEL_MEDLOW),y) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-969-riscv-ftrace-Reduce-the-detour-code-size-to-hal.patch b/patches.kernel.org/6.2.3-969-riscv-ftrace-Reduce-the-detour-code-size-to-hal.patch new file mode 100644 index 0000000..a945162 --- /dev/null +++ b/patches.kernel.org/6.2.3-969-riscv-ftrace-Reduce-the-detour-code-size-to-hal.patch @@ -0,0 +1,448 @@ +From: Guo Ren +Date: Thu, 12 Jan 2023 04:05:59 -0500 +Subject: [PATCH] riscv: ftrace: Reduce the detour code size to half +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 6724a76cff85ee271bbbff42ac527e4643b2ec52 + +commit 6724a76cff85ee271bbbff42ac527e4643b2ec52 upstream. + +Use a temporary register to reduce the size of detour code from 16 bytes to +8 bytes. The previous implementation is from 'commit afc76b8b8011 ("riscv: +Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT")'. + +Before the patch: +: + 0: REG_S ra, -SZREG(sp) + 4: auipc ra, ? + 8: jalr ?(ra) +12: REG_L ra, -SZREG(sp) + (func_boddy) + +After the patch: +: + 0: auipc t0, ? + 4: jalr t0, ?(t0) + (func_boddy) + +This patch not just reduces the size of detour code, but also fixes an +important issue: + +An Ftrace callback registered with FTRACE_OPS_FL_IPMODIFY flag can +actually change the instruction pointer, e.g. to "replace" the given +kernel function with a new one, which is needed for livepatching, etc. + +In this case, the trampoline (ftrace_regs_caller) would not return to + but would rather jump to the new function. So, "REG_L +ra, -SZREG(sp)" would not run and the original return address would not +be restored. The kernel is likely to hang or crash as a result. + +This can be easily demonstrated if one tries to "replace", say, +cmdline_proc_show() with a new function with the same signature using +instruction_pointer_set(&fregs->regs, new_func_addr) in the Ftrace +callback. + +Link: https://lore.kernel.org/linux-riscv/20221122075440.1165172-1-suagrfillet@gmail.com/ +Link: https://lore.kernel.org/linux-riscv/d7d5730b-ebef-68e5-5046-e763e1ee6164@yadro.com/ +Co-developed-by: Song Shuai +Signed-off-by: Song Shuai +Signed-off-by: Guo Ren +Signed-off-by: Guo Ren +Cc: Evgenii Shatokhin +Reviewed-by: Evgenii Shatokhin +Link: https://lore.kernel.org/r/20230112090603.1295340-4-guoren@kernel.org +Cc: stable@vger.kernel.org +Fixes: 10626c32e382 ("riscv/ftrace: Add basic support") +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/riscv/Makefile | 4 +- + arch/riscv/include/asm/ftrace.h | 50 +++++++++++++++++++------ + arch/riscv/kernel/ftrace.c | 65 ++++++++++----------------------- + arch/riscv/kernel/mcount-dyn.S | 42 ++++++++------------- + 4 files changed, 75 insertions(+), 86 deletions(-) + +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index 23149e98..56b92199 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -12,9 +12,9 @@ ifeq ($(CONFIG_DYNAMIC_FTRACE),y) + LDFLAGS_vmlinux := --no-relax + KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY + ifeq ($(CONFIG_RISCV_ISA_C),y) +- CC_FLAGS_FTRACE := -fpatchable-function-entry=8 +-else + CC_FLAGS_FTRACE := -fpatchable-function-entry=4 ++else ++ CC_FLAGS_FTRACE := -fpatchable-function-entry=2 + endif + endif + +diff --git a/arch/riscv/include/asm/ftrace.h b/arch/riscv/include/asm/ftrace.h +index 04dad338..9e73922e 100644 +--- a/arch/riscv/include/asm/ftrace.h ++++ b/arch/riscv/include/asm/ftrace.h +@@ -42,6 +42,14 @@ struct dyn_arch_ftrace { + * 2) jalr: setting low-12 offset to ra, jump to ra, and set ra to + * return address (original pc + 4) + * ++ *: ++ * 0: auipc t0/ra, 0x? ++ * 4: jalr t0/ra, ?(t0/ra) ++ * ++ *: ++ * 0: nop ++ * 4: nop ++ * + * Dynamic ftrace generates probes to call sites, so we must deal with + * both auipc and jalr at the same time. + */ +@@ -52,25 +60,43 @@ struct dyn_arch_ftrace { + #define AUIPC_OFFSET_MASK (0xfffff000) + #define AUIPC_PAD (0x00001000) + #define JALR_SHIFT 20 +-#define JALR_BASIC (0x000080e7) +-#define AUIPC_BASIC (0x00000097) ++#define JALR_RA (0x000080e7) ++#define AUIPC_RA (0x00000097) ++#define JALR_T0 (0x000282e7) ++#define AUIPC_T0 (0x00000297) + #define NOP4 (0x00000013) + +-#define make_call(caller, callee, call) \ ++#define to_jalr_t0(offset) \ ++ (((offset & JALR_OFFSET_MASK) << JALR_SHIFT) | JALR_T0) ++ ++#define to_auipc_t0(offset) \ ++ ((offset & JALR_SIGN_MASK) ? \ ++ (((offset & AUIPC_OFFSET_MASK) + AUIPC_PAD) | AUIPC_T0) : \ ++ ((offset & AUIPC_OFFSET_MASK) | AUIPC_T0)) ++ ++#define make_call_t0(caller, callee, call) \ + do { \ +- call[0] = to_auipc_insn((unsigned int)((unsigned long)callee - \ +- (unsigned long)caller)); \ +- call[1] = to_jalr_insn((unsigned int)((unsigned long)callee - \ +- (unsigned long)caller)); \ ++ unsigned int offset = \ ++ (unsigned long) callee - (unsigned long) caller; \ ++ call[0] = to_auipc_t0(offset); \ ++ call[1] = to_jalr_t0(offset); \ + } while (0) + +-#define to_jalr_insn(offset) \ +- (((offset & JALR_OFFSET_MASK) << JALR_SHIFT) | JALR_BASIC) ++#define to_jalr_ra(offset) \ ++ (((offset & JALR_OFFSET_MASK) << JALR_SHIFT) | JALR_RA) + +-#define to_auipc_insn(offset) \ ++#define to_auipc_ra(offset) \ + ((offset & JALR_SIGN_MASK) ? \ +- (((offset & AUIPC_OFFSET_MASK) + AUIPC_PAD) | AUIPC_BASIC) : \ +- ((offset & AUIPC_OFFSET_MASK) | AUIPC_BASIC)) ++ (((offset & AUIPC_OFFSET_MASK) + AUIPC_PAD) | AUIPC_RA) : \ ++ ((offset & AUIPC_OFFSET_MASK) | AUIPC_RA)) ++ ++#define make_call_ra(caller, callee, call) \ ++do { \ ++ unsigned int offset = \ ++ (unsigned long) callee - (unsigned long) caller; \ ++ call[0] = to_auipc_ra(offset); \ ++ call[1] = to_jalr_ra(offset); \ ++} while (0) + + /* + * Let auipc+jalr be the basic *mcount unit*, so we make it 8 bytes here. +diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c +index 2086f658..5bff37af 100644 +--- a/arch/riscv/kernel/ftrace.c ++++ b/arch/riscv/kernel/ftrace.c +@@ -55,12 +55,15 @@ static int ftrace_check_current_call(unsigned long hook_pos, + } + + static int __ftrace_modify_call(unsigned long hook_pos, unsigned long target, +- bool enable) ++ bool enable, bool ra) + { + unsigned int call[2]; + unsigned int nops[2] = {NOP4, NOP4}; + +- make_call(hook_pos, target, call); ++ if (ra) ++ make_call_ra(hook_pos, target, call); ++ else ++ make_call_t0(hook_pos, target, call); + + /* Replace the auipc-jalr pair at once. Return -EPERM on write error. */ + if (patch_text_nosync +@@ -70,42 +73,13 @@ static int __ftrace_modify_call(unsigned long hook_pos, unsigned long target, + return 0; + } + +-/* +- * Put 5 instructions with 16 bytes at the front of function within +- * patchable function entry nops' area. +- * +- * 0: REG_S ra, -SZREG(sp) +- * 1: auipc ra, 0x? +- * 2: jalr -?(ra) +- * 3: REG_L ra, -SZREG(sp) +- * +- * So the opcodes is: +- * 0: 0xfe113c23 (sd)/0xfe112e23 (sw) +- * 1: 0x???????? -> auipc +- * 2: 0x???????? -> jalr +- * 3: 0xff813083 (ld)/0xffc12083 (lw) +- */ +-#if __riscv_xlen == 64 +-#define INSN0 0xfe113c23 +-#define INSN3 0xff813083 +-#elif __riscv_xlen == 32 +-#define INSN0 0xfe112e23 +-#define INSN3 0xffc12083 +-#endif +- +-#define FUNC_ENTRY_SIZE 16 +-#define FUNC_ENTRY_JMP 4 +- + int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + { +- unsigned int call[4] = {INSN0, 0, 0, INSN3}; +- unsigned long target = addr; +- unsigned long caller = rec->ip + FUNC_ENTRY_JMP; ++ unsigned int call[2]; + +- call[1] = to_auipc_insn((unsigned int)(target - caller)); +- call[2] = to_jalr_insn((unsigned int)(target - caller)); ++ make_call_t0(rec->ip, addr, call); + +- if (patch_text_nosync((void *)rec->ip, call, FUNC_ENTRY_SIZE)) ++ if (patch_text_nosync((void *)rec->ip, call, MCOUNT_INSN_SIZE)) + return -EPERM; + + return 0; +@@ -114,15 +88,14 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec, + unsigned long addr) + { +- unsigned int nops[4] = {NOP4, NOP4, NOP4, NOP4}; ++ unsigned int nops[2] = {NOP4, NOP4}; + +- if (patch_text_nosync((void *)rec->ip, nops, FUNC_ENTRY_SIZE)) ++ if (patch_text_nosync((void *)rec->ip, nops, MCOUNT_INSN_SIZE)) + return -EPERM; + + return 0; + } + +- + /* + * This is called early on, and isn't wrapped by + * ftrace_arch_code_modify_{prepare,post_process}() and therefor doesn't hold +@@ -144,10 +117,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec) + int ftrace_update_ftrace_func(ftrace_func_t func) + { + int ret = __ftrace_modify_call((unsigned long)&ftrace_call, +- (unsigned long)func, true); ++ (unsigned long)func, true, true); + if (!ret) { + ret = __ftrace_modify_call((unsigned long)&ftrace_regs_call, +- (unsigned long)func, true); ++ (unsigned long)func, true, true); + } + + return ret; +@@ -159,16 +132,16 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, + unsigned long addr) + { + unsigned int call[2]; +- unsigned long caller = rec->ip + FUNC_ENTRY_JMP; ++ unsigned long caller = rec->ip; + int ret; + +- make_call(caller, old_addr, call); ++ make_call_t0(caller, old_addr, call); + ret = ftrace_check_current_call(caller, call); + + if (ret) + return ret; + +- return __ftrace_modify_call(caller, addr, true); ++ return __ftrace_modify_call(caller, addr, true, false); + } + #endif + +@@ -203,12 +176,12 @@ int ftrace_enable_ftrace_graph_caller(void) + int ret; + + ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call, +- (unsigned long)&prepare_ftrace_return, true); ++ (unsigned long)&prepare_ftrace_return, true, true); + if (ret) + return ret; + + return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call, +- (unsigned long)&prepare_ftrace_return, true); ++ (unsigned long)&prepare_ftrace_return, true, true); + } + + int ftrace_disable_ftrace_graph_caller(void) +@@ -216,12 +189,12 @@ int ftrace_disable_ftrace_graph_caller(void) + int ret; + + ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call, +- (unsigned long)&prepare_ftrace_return, false); ++ (unsigned long)&prepare_ftrace_return, false, true); + if (ret) + return ret; + + return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call, +- (unsigned long)&prepare_ftrace_return, false); ++ (unsigned long)&prepare_ftrace_return, false, true); + } + #endif /* CONFIG_DYNAMIC_FTRACE */ + #endif /* CONFIG_FUNCTION_GRAPH_TRACER */ +diff --git a/arch/riscv/kernel/mcount-dyn.S b/arch/riscv/kernel/mcount-dyn.S +index d171eca6..125de818 100644 +--- a/arch/riscv/kernel/mcount-dyn.S ++++ b/arch/riscv/kernel/mcount-dyn.S +@@ -13,8 +13,8 @@ + + .text + +-#define FENTRY_RA_OFFSET 12 +-#define ABI_SIZE_ON_STACK 72 ++#define FENTRY_RA_OFFSET 8 ++#define ABI_SIZE_ON_STACK 80 + #define ABI_A0 0 + #define ABI_A1 8 + #define ABI_A2 16 +@@ -23,10 +23,10 @@ + #define ABI_A5 40 + #define ABI_A6 48 + #define ABI_A7 56 +-#define ABI_RA 64 ++#define ABI_T0 64 ++#define ABI_RA 72 + + .macro SAVE_ABI +- addi sp, sp, -SZREG + addi sp, sp, -ABI_SIZE_ON_STACK + + REG_S a0, ABI_A0(sp) +@@ -37,6 +37,7 @@ + REG_S a5, ABI_A5(sp) + REG_S a6, ABI_A6(sp) + REG_S a7, ABI_A7(sp) ++ REG_S t0, ABI_T0(sp) + REG_S ra, ABI_RA(sp) + .endm + +@@ -49,24 +50,18 @@ + REG_L a5, ABI_A5(sp) + REG_L a6, ABI_A6(sp) + REG_L a7, ABI_A7(sp) ++ REG_L t0, ABI_T0(sp) + REG_L ra, ABI_RA(sp) + + addi sp, sp, ABI_SIZE_ON_STACK +- addi sp, sp, SZREG + .endm + + #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS + .macro SAVE_ALL +- addi sp, sp, -SZREG + addi sp, sp, -PT_SIZE_ON_STACK + +- REG_S x1, PT_EPC(sp) +- addi sp, sp, PT_SIZE_ON_STACK +- REG_L x1, (sp) +- addi sp, sp, -PT_SIZE_ON_STACK ++ REG_S t0, PT_EPC(sp) + REG_S x1, PT_RA(sp) +- REG_L x1, PT_EPC(sp) +- + REG_S x2, PT_SP(sp) + REG_S x3, PT_GP(sp) + REG_S x4, PT_TP(sp) +@@ -100,15 +95,11 @@ + .endm + + .macro RESTORE_ALL ++ REG_L t0, PT_EPC(sp) + REG_L x1, PT_RA(sp) +- addi sp, sp, PT_SIZE_ON_STACK +- REG_S x1, (sp) +- addi sp, sp, -PT_SIZE_ON_STACK +- REG_L x1, PT_EPC(sp) + REG_L x2, PT_SP(sp) + REG_L x3, PT_GP(sp) + REG_L x4, PT_TP(sp) +- REG_L x5, PT_T0(sp) + REG_L x6, PT_T1(sp) + REG_L x7, PT_T2(sp) + REG_L x8, PT_S0(sp) +@@ -137,17 +128,16 @@ + REG_L x31, PT_T6(sp) + + addi sp, sp, PT_SIZE_ON_STACK +- addi sp, sp, SZREG + .endm + #endif /* CONFIG_DYNAMIC_FTRACE_WITH_REGS */ + + ENTRY(ftrace_caller) + SAVE_ABI + +- addi a0, ra, -FENTRY_RA_OFFSET ++ addi a0, t0, -FENTRY_RA_OFFSET + la a1, function_trace_op + REG_L a2, 0(a1) +- REG_L a1, ABI_SIZE_ON_STACK(sp) ++ mv a1, ra + mv a3, sp + + ftrace_call: +@@ -155,8 +145,8 @@ ftrace_call: + call ftrace_stub + + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +- addi a0, sp, ABI_SIZE_ON_STACK +- REG_L a1, ABI_RA(sp) ++ addi a0, sp, ABI_RA ++ REG_L a1, ABI_T0(sp) + addi a1, a1, -FENTRY_RA_OFFSET + #ifdef HAVE_FUNCTION_GRAPH_FP_TEST + mv a2, s0 +@@ -166,17 +156,17 @@ ftrace_graph_call: + call ftrace_stub + #endif + RESTORE_ABI +- ret ++ jr t0 + ENDPROC(ftrace_caller) + + #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS + ENTRY(ftrace_regs_caller) + SAVE_ALL + +- addi a0, ra, -FENTRY_RA_OFFSET ++ addi a0, t0, -FENTRY_RA_OFFSET + la a1, function_trace_op + REG_L a2, 0(a1) +- REG_L a1, PT_SIZE_ON_STACK(sp) ++ mv a1, ra + mv a3, sp + + ftrace_regs_call: +@@ -196,6 +186,6 @@ ftrace_graph_regs_call: + #endif + + RESTORE_ALL +- ret ++ jr t0 + ENDPROC(ftrace_regs_caller) + #endif /* CONFIG_DYNAMIC_FTRACE_WITH_REGS */ +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-970-MIPS-DTS-CI20-fix-otg-power-gpio.patch b/patches.kernel.org/6.2.3-970-MIPS-DTS-CI20-fix-otg-power-gpio.patch new file mode 100644 index 0000000..3e16d94 --- /dev/null +++ b/patches.kernel.org/6.2.3-970-MIPS-DTS-CI20-fix-otg-power-gpio.patch @@ -0,0 +1,40 @@ +From: "H. Nikolaus Schaller" +Date: Sun, 29 Jan 2023 19:57:04 +0100 +Subject: [PATCH] MIPS: DTS: CI20: fix otg power gpio +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0cb4228f6cc9ed0ca2be0d9ddf29168a8e3a3905 + +commit 0cb4228f6cc9ed0ca2be0d9ddf29168a8e3a3905 upstream. + +According to schematics it is PF15 and not PF14 (MIC_SW_EN). +Seems as if it was hidden and not noticed during testing since +there is no sound DT node. + +Fixes: 158c774d3c64 ("MIPS: Ingenic: Add missing nodes for Ingenic SoCs and boards.") +Cc: stable@vger.kernel.org +Signed-off-by: H. Nikolaus Schaller +Acked-by: Paul Cercueil +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + arch/mips/boot/dts/ingenic/ci20.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts +index f38c3957..8f21d230 100644 +--- a/arch/mips/boot/dts/ingenic/ci20.dts ++++ b/arch/mips/boot/dts/ingenic/ci20.dts +@@ -113,7 +113,7 @@ otg_power: fixedregulator@2 { + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; + +- gpio = <&gpf 14 GPIO_ACTIVE_LOW>; ++ gpio = <&gpf 15 GPIO_ACTIVE_LOW>; + enable-active-high; + }; + }; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-971-PCI-PM-Observe-reset-delay-irrespective-of-brid.patch b/patches.kernel.org/6.2.3-971-PCI-PM-Observe-reset-delay-irrespective-of-brid.patch new file mode 100644 index 0000000..3058423 --- /dev/null +++ b/patches.kernel.org/6.2.3-971-PCI-PM-Observe-reset-delay-irrespective-of-brid.patch @@ -0,0 +1,63 @@ +From: Lukas Wunner +Date: Sun, 15 Jan 2023 09:20:31 +0100 +Subject: [PATCH] PCI/PM: Observe reset delay irrespective of bridge_d3 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8ef0217227b42e2c34a18de316cee3da16c9bf1e + +commit 8ef0217227b42e2c34a18de316cee3da16c9bf1e upstream. + +If a PCI bridge is suspended to D3cold upon entering system sleep, +resuming it entails a Fundamental Reset per PCIe r6.0 sec 5.8. + +The delay prescribed after a Fundamental Reset in PCIe r6.0 sec 6.6.1 +is sought to be observed by: + + pci_pm_resume_noirq() + pci_pm_bridge_power_up_actions() + pci_bridge_wait_for_secondary_bus() + +However, pci_bridge_wait_for_secondary_bus() bails out if the bridge_d3 +flag is not set. That flag indicates whether a bridge is allowed to +suspend to D3cold at *runtime*. + +Hence *no* delay is observed on resume from system sleep if runtime +D3cold is forbidden. That doesn't make any sense, so drop the bridge_d3 +check from pci_bridge_wait_for_secondary_bus(). + +The purpose of the bridge_d3 check was probably to avoid delays if a +bridge remained in D0 during suspend. However the sole caller of +pci_bridge_wait_for_secondary_bus(), pci_pm_bridge_power_up_actions(), +is only invoked if the previous power state was D3cold. Hence the +additional bridge_d3 check seems superfluous. + +Fixes: ad9001f2f411 ("PCI/PM: Add missing link delays required by the PCIe spec") +Link: https://lore.kernel.org/r/eb37fa345285ec8bacabbf06b020b803f77bdd3d.1673769517.git.lukas@wunner.de +Tested-by: Ravi Kishore Koppuravuri +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Reviewed-by: Mika Westerberg +Reviewed-by: Kuppuswamy Sathyanarayanan +Cc: stable@vger.kernel.org # v5.5+ +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pci/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 5641786b..de99cdcd 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -4957,7 +4957,7 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev) + if (pci_dev_is_disconnected(dev)) + return; + +- if (!pci_is_bridge(dev) || !dev->bridge_d3) ++ if (!pci_is_bridge(dev)) + return; + + down_read(&pci_bus_sem); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-972-PCI-Unify-delay-handling-for-reset-and-resume.patch b/patches.kernel.org/6.2.3-972-PCI-Unify-delay-handling-for-reset-and-resume.patch new file mode 100644 index 0000000..f01877c --- /dev/null +++ b/patches.kernel.org/6.2.3-972-PCI-Unify-delay-handling-for-reset-and-resume.patch @@ -0,0 +1,259 @@ +From: Lukas Wunner +Date: Sun, 15 Jan 2023 09:20:32 +0100 +Subject: [PATCH] PCI: Unify delay handling for reset and resume +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ac91e6980563ed53afadd925fa6585ffd2bc4a2c + +commit ac91e6980563ed53afadd925fa6585ffd2bc4a2c upstream. + +Sheng Bi reports that pci_bridge_secondary_bus_reset() may fail to wait +for devices on the secondary bus to become accessible after reset: + +Although it does call pci_dev_wait(), it erroneously passes the bridge's +pci_dev rather than that of a child. The bridge of course is always +accessible while its secondary bus is reset, so pci_dev_wait() returns +immediately. + +Sheng Bi proposes introducing a new pci_bridge_secondary_bus_wait() +function which is called from pci_bridge_secondary_bus_reset(): + +https://lore.kernel.org/linux-pci/20220523171517.32407-1-windy.bi.enflame@gmail.com/ + +However we already have pci_bridge_wait_for_secondary_bus() which does +almost exactly what we need. So far it's only called on resume from +D3cold (which implies a Fundamental Reset per PCIe r6.0 sec 5.8). +Re-using it for Secondary Bus Resets is a leaner and more rational +approach than introducing a new function. + +That only requires a few minor tweaks: + +- Amend pci_bridge_wait_for_secondary_bus() to await accessibility of + the first device on the secondary bus by calling pci_dev_wait() after + performing the prescribed delays. pci_dev_wait() needs two parameters, + a reset reason and a timeout, which callers must now pass to + pci_bridge_wait_for_secondary_bus(). The timeout is 1 sec for resume + (PCIe r6.0 sec 6.6.1) and 60 sec for reset (commit 821cdad5c46c ("PCI: + Wait up to 60 seconds for device to become ready after FLR")). + Introduce a PCI_RESET_WAIT macro for the 1 sec timeout. + +- Amend pci_bridge_wait_for_secondary_bus() to return 0 on success or + -ENOTTY on error for consumption by pci_bridge_secondary_bus_reset(). + +- Drop an unnecessary 1 sec delay from pci_reset_secondary_bus() which + is now performed by pci_bridge_wait_for_secondary_bus(). A static + delay this long is only necessary for Conventional PCI, so modern + PCIe systems benefit from shorter reset times as a side effect. + +Fixes: 6b2f1351af56 ("PCI: Wait for device to become ready after secondary bus reset") +Link: https://lore.kernel.org/r/da77c92796b99ec568bd070cbe4725074a117038.1673769517.git.lukas@wunner.de +Reported-by: Sheng Bi +Tested-by: Ravi Kishore Koppuravuri +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Reviewed-by: Mika Westerberg +Reviewed-by: Kuppuswamy Sathyanarayanan +Cc: stable@vger.kernel.org # v4.17+ +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pci/pci-driver.c | 2 +- + drivers/pci/pci.c | 54 ++++++++++++++++++---------------------- + drivers/pci/pci.h | 10 +++++++- + 3 files changed, 34 insertions(+), 32 deletions(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index a2ceeacc..7a19f11d 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -572,7 +572,7 @@ static void pci_pm_default_resume_early(struct pci_dev *pci_dev) + + static void pci_pm_bridge_power_up_actions(struct pci_dev *pci_dev) + { +- pci_bridge_wait_for_secondary_bus(pci_dev); ++ pci_bridge_wait_for_secondary_bus(pci_dev, "resume", PCI_RESET_WAIT); + /* + * When powering on a bridge from D3cold, the whole hierarchy may be + * powered on into D0uninitialized state, resume them to give them a +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index de99cdcd..108c6ce5 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1174,7 +1174,7 @@ static int pci_dev_wait(struct pci_dev *dev, char *reset_type, int timeout) + return -ENOTTY; + } + +- if (delay > 1000) ++ if (delay > PCI_RESET_WAIT) + pci_info(dev, "not ready %dms after %s; waiting\n", + delay - 1, reset_type); + +@@ -1183,7 +1183,7 @@ static int pci_dev_wait(struct pci_dev *dev, char *reset_type, int timeout) + pci_read_config_dword(dev, PCI_COMMAND, &id); + } + +- if (delay > 1000) ++ if (delay > PCI_RESET_WAIT) + pci_info(dev, "ready %dms after %s\n", delay - 1, + reset_type); + +@@ -4941,24 +4941,31 @@ static int pci_bus_max_d3cold_delay(const struct pci_bus *bus) + /** + * pci_bridge_wait_for_secondary_bus - Wait for secondary bus to be accessible + * @dev: PCI bridge ++ * @reset_type: reset type in human-readable form ++ * @timeout: maximum time to wait for devices on secondary bus (milliseconds) + * + * Handle necessary delays before access to the devices on the secondary +- * side of the bridge are permitted after D3cold to D0 transition. ++ * side of the bridge are permitted after D3cold to D0 transition ++ * or Conventional Reset. + * + * For PCIe this means the delays in PCIe 5.0 section 6.6.1. For + * conventional PCI it means Tpvrh + Trhfa specified in PCI 3.0 section + * 4.3.2. ++ * ++ * Return 0 on success or -ENOTTY if the first device on the secondary bus ++ * failed to become accessible. + */ +-void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev) ++int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type, ++ int timeout) + { + struct pci_dev *child; + int delay; + + if (pci_dev_is_disconnected(dev)) +- return; ++ return 0; + + if (!pci_is_bridge(dev)) +- return; ++ return 0; + + down_read(&pci_bus_sem); + +@@ -4970,14 +4977,14 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev) + */ + if (!dev->subordinate || list_empty(&dev->subordinate->devices)) { + up_read(&pci_bus_sem); +- return; ++ return 0; + } + + /* Take d3cold_delay requirements into account */ + delay = pci_bus_max_d3cold_delay(dev->subordinate); + if (!delay) { + up_read(&pci_bus_sem); +- return; ++ return 0; + } + + child = list_first_entry(&dev->subordinate->devices, struct pci_dev, +@@ -4986,14 +4993,12 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev) + + /* + * Conventional PCI and PCI-X we need to wait Tpvrh + Trhfa before +- * accessing the device after reset (that is 1000 ms + 100 ms). In +- * practice this should not be needed because we don't do power +- * management for them (see pci_bridge_d3_possible()). ++ * accessing the device after reset (that is 1000 ms + 100 ms). + */ + if (!pci_is_pcie(dev)) { + pci_dbg(dev, "waiting %d ms for secondary bus\n", 1000 + delay); + msleep(1000 + delay); +- return; ++ return 0; + } + + /* +@@ -5010,11 +5015,11 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev) + * configuration requests if we only wait for 100 ms (see + * https://bugzilla.kernel.org/show_bug.cgi?id=203885). + * +- * Therefore we wait for 100 ms and check for the device presence. +- * If it is still not present give it an additional 100 ms. ++ * Therefore we wait for 100 ms and check for the device presence ++ * until the timeout expires. + */ + if (!pcie_downstream_port(dev)) +- return; ++ return 0; + + if (pcie_get_speed_cap(dev) <= PCIE_SPEED_5_0GT) { + pci_dbg(dev, "waiting %d ms for downstream link\n", delay); +@@ -5025,14 +5030,11 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev) + if (!pcie_wait_for_link_delay(dev, true, delay)) { + /* Did not train, no need to wait any further */ + pci_info(dev, "Data Link Layer Link Active not set in 1000 msec\n"); +- return; ++ return -ENOTTY; + } + } + +- if (!pci_device_is_present(child)) { +- pci_dbg(child, "waiting additional %d ms to become accessible\n", delay); +- msleep(delay); +- } ++ return pci_dev_wait(child, reset_type, timeout - delay); + } + + void pci_reset_secondary_bus(struct pci_dev *dev) +@@ -5051,15 +5053,6 @@ void pci_reset_secondary_bus(struct pci_dev *dev) + + ctrl &= ~PCI_BRIDGE_CTL_BUS_RESET; + pci_write_config_word(dev, PCI_BRIDGE_CONTROL, ctrl); +- +- /* +- * Trhfa for conventional PCI is 2^25 clock cycles. +- * Assuming a minimum 33MHz clock this results in a 1s +- * delay before we can consider subordinate devices to +- * be re-initialized. PCIe has some ways to shorten this, +- * but we don't make use of them yet. +- */ +- ssleep(1); + } + + void __weak pcibios_reset_secondary_bus(struct pci_dev *dev) +@@ -5078,7 +5071,8 @@ int pci_bridge_secondary_bus_reset(struct pci_dev *dev) + { + pcibios_reset_secondary_bus(dev); + +- return pci_dev_wait(dev, "bus reset", PCIE_RESET_READY_POLL_MS); ++ return pci_bridge_wait_for_secondary_bus(dev, "bus reset", ++ PCIE_RESET_READY_POLL_MS); + } + EXPORT_SYMBOL_GPL(pci_bridge_secondary_bus_reset); + +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 9049d07d..7a403b8f 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -64,6 +64,13 @@ struct pci_cap_saved_state *pci_find_saved_ext_cap(struct pci_dev *dev, + #define PCI_PM_D3HOT_WAIT 10 /* msec */ + #define PCI_PM_D3COLD_WAIT 100 /* msec */ + ++/* ++ * Following exit from Conventional Reset, devices must be ready within 1 sec ++ * (PCIe r6.0 sec 6.6.1). A D3cold to D0 transition implies a Conventional ++ * Reset (PCIe r6.0 sec 5.8). ++ */ ++#define PCI_RESET_WAIT 1000 /* msec */ ++ + void pci_update_current_state(struct pci_dev *dev, pci_power_t state); + void pci_refresh_power_state(struct pci_dev *dev); + int pci_power_up(struct pci_dev *dev); +@@ -86,8 +93,9 @@ void pci_msi_init(struct pci_dev *dev); + void pci_msix_init(struct pci_dev *dev); + bool pci_bridge_d3_possible(struct pci_dev *dev); + void pci_bridge_d3_update(struct pci_dev *dev); +-void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev); + void pci_bridge_reconfigure_ltr(struct pci_dev *dev); ++int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type, ++ int timeout); + + static inline void pci_wakeup_event(struct pci_dev *dev) + { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-973-PCI-hotplug-Allow-marking-devices-as-disconnect.patch b/patches.kernel.org/6.2.3-973-PCI-hotplug-Allow-marking-devices-as-disconnect.patch new file mode 100644 index 0000000..4e600e4 --- /dev/null +++ b/patches.kernel.org/6.2.3-973-PCI-hotplug-Allow-marking-devices-as-disconnect.patch @@ -0,0 +1,143 @@ +From: Lukas Wunner +Date: Fri, 20 Jan 2023 10:19:02 +0100 +Subject: [PATCH] PCI: hotplug: Allow marking devices as disconnected during + bind/unbind +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 74ff8864cc842be994853095dba6db48e716400a + +commit 74ff8864cc842be994853095dba6db48e716400a upstream. + +On surprise removal, pciehp_unconfigure_device() and acpiphp's +trim_stale_devices() call pci_dev_set_disconnected() to mark removed +devices as permanently offline. Thereby, the PCI core and drivers know +to skip device accesses. + +However pci_dev_set_disconnected() takes the device_lock and thus waits for +a concurrent driver bind or unbind to complete. As a result, the driver's +->probe and ->remove hooks have no chance to learn that the device is gone. + +That doesn't make any sense, so drop the device_lock and instead use atomic +xchg() and cmpxchg() operations to update the device state. + +As a byproduct, an AB-BA deadlock reported by Anatoli is fixed which occurs +on surprise removal with AER concurrently performing a bus reset. + +AER bus reset: + + INFO: task irq/26-aerdrv:95 blocked for more than 120 seconds. + Tainted: G W 6.2.0-rc3-custom-norework-jan11+ + schedule + rwsem_down_write_slowpath + down_write_nested + pciehp_reset_slot # acquires reset_lock + pci_reset_hotplug_slot + pci_slot_reset # acquires device_lock + pci_bus_error_reset + aer_root_reset + pcie_do_recovery + aer_process_err_devices + aer_isr + +pciehp surprise removal: + + INFO: task irq/26-pciehp:96 blocked for more than 120 seconds. + Tainted: G W 6.2.0-rc3-custom-norework-jan11+ + schedule_preempt_disabled + __mutex_lock + mutex_lock_nested + pci_dev_set_disconnected # acquires device_lock + pci_walk_bus + pciehp_unconfigure_device + pciehp_disable_slot + pciehp_handle_presence_or_link_change + pciehp_ist # acquires reset_lock + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215590 +Fixes: a6bd101b8f84 ("PCI: Unify device inaccessible") +Link: https://lore.kernel.org/r/3dc88ea82bdc0e37d9000e413d5ebce481cbd629.1674205689.git.lukas@wunner.de +Reported-by: Anatoli Antonovitch +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org # v4.20+ +Cc: Keith Busch +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pci/pci.h | 43 +++++++++++++------------------------------ + 1 file changed, 13 insertions(+), 30 deletions(-) + +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 7a403b8f..44643ffb 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -318,53 +318,36 @@ struct pci_sriov { + * @dev: PCI device to set new error_state + * @new: the state we want dev to be in + * +- * Must be called with device_lock held. ++ * If the device is experiencing perm_failure, it has to remain in that state. ++ * Any other transition is allowed. + * + * Returns true if state has been changed to the requested state. + */ + static inline bool pci_dev_set_io_state(struct pci_dev *dev, + pci_channel_state_t new) + { +- bool changed = false; ++ pci_channel_state_t old; + +- device_lock_assert(&dev->dev); + switch (new) { + case pci_channel_io_perm_failure: +- switch (dev->error_state) { +- case pci_channel_io_frozen: +- case pci_channel_io_normal: +- case pci_channel_io_perm_failure: +- changed = true; +- break; +- } +- break; ++ xchg(&dev->error_state, pci_channel_io_perm_failure); ++ return true; + case pci_channel_io_frozen: +- switch (dev->error_state) { +- case pci_channel_io_frozen: +- case pci_channel_io_normal: +- changed = true; +- break; +- } +- break; ++ old = cmpxchg(&dev->error_state, pci_channel_io_normal, ++ pci_channel_io_frozen); ++ return old != pci_channel_io_perm_failure; + case pci_channel_io_normal: +- switch (dev->error_state) { +- case pci_channel_io_frozen: +- case pci_channel_io_normal: +- changed = true; +- break; +- } +- break; ++ old = cmpxchg(&dev->error_state, pci_channel_io_frozen, ++ pci_channel_io_normal); ++ return old != pci_channel_io_perm_failure; ++ default: ++ return false; + } +- if (changed) +- dev->error_state = new; +- return changed; + } + + static inline int pci_dev_set_disconnected(struct pci_dev *dev, void *unused) + { +- device_lock(&dev->dev); + pci_dev_set_io_state(dev, pci_channel_io_perm_failure); +- device_unlock(&dev->dev); + + return 0; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-974-PCI-Avoid-FLR-for-AMD-FCH-AHCI-adapters.patch b/patches.kernel.org/6.2.3-974-PCI-Avoid-FLR-for-AMD-FCH-AHCI-adapters.patch new file mode 100644 index 0000000..c9a5bdf --- /dev/null +++ b/patches.kernel.org/6.2.3-974-PCI-Avoid-FLR-for-AMD-FCH-AHCI-adapters.patch @@ -0,0 +1,54 @@ +From: Damien Le Moal +Date: Sat, 28 Jan 2023 10:39:51 +0900 +Subject: [PATCH] PCI: Avoid FLR for AMD FCH AHCI adapters +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 63ba51db24ed1b8f8088a897290eb6c036c5435d + +commit 63ba51db24ed1b8f8088a897290eb6c036c5435d upstream. + +PCI passthrough to VMs does not work with AMD FCH AHCI adapters: the guest +OS fails to correctly probe devices attached to the controller due to FIS +communication failures: + + ata4: softreset failed (1st FIS failed) + ... + ata4.00: qc timeout after 5000 msecs (cmd 0xec) + ata4.00: failed to IDENTIFY (I/O error, err_mask=0x4) + +Forcing the "bus" reset method before unbinding & binding the adapter to +the vfio-pci driver solves this issue, e.g.: + + echo "bus" > /sys/bus/pci/devices//reset_method + +gives a working guest OS, indicating that the default FLR reset method +doesn't work correctly. + +Apply quirk_no_flr() to AMD FCH AHCI devices to work around this issue. + +Link: https://lore.kernel.org/r/20230128013951.523247-1-damien.lemoal@opensource.wdc.com +Reported-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pci/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 285acc4a..20ac67d5 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5340,6 +5340,7 @@ static void quirk_no_flr(struct pci_dev *dev) + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1487, quirk_no_flr); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x148c, quirk_no_flr); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x149c, quirk_no_flr); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x7901, quirk_no_flr); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr); + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-975-PCI-DPC-Await-readiness-of-secondary-bus-after-.patch b/patches.kernel.org/6.2.3-975-PCI-DPC-Await-readiness-of-secondary-bus-after-.patch new file mode 100644 index 0000000..ea48eb7 --- /dev/null +++ b/patches.kernel.org/6.2.3-975-PCI-DPC-Await-readiness-of-secondary-bus-after-.patch @@ -0,0 +1,91 @@ +From: Lukas Wunner +Date: Sun, 15 Jan 2023 09:20:33 +0100 +Subject: [PATCH] PCI/DPC: Await readiness of secondary bus after reset +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 53b54ad074de1896f8b021615f65b27f557ce874 + +commit 53b54ad074de1896f8b021615f65b27f557ce874 upstream. + +pci_bridge_wait_for_secondary_bus() is called after a Secondary Bus +Reset, but not after a DPC-induced Hot Reset. + +As a result, the delays prescribed by PCIe r6.0 sec 6.6.1 are not +observed and devices on the secondary bus may be accessed before +they're ready. + +One affected device is Intel's Ponte Vecchio HPC GPU. It comprises a +PCIe switch whose upstream port is not immediately ready after reset. +Because its config space is restored too early, it remains in +D0uninitialized, its subordinate devices remain inaccessible and DPC +recovery fails with messages such as: + + i915 0000:8c:00.0: can't change power state from D3cold to D0 (config space inaccessible) + intel_vsec 0000:8e:00.1: can't change power state from D3cold to D0 (config space inaccessible) + pcieport 0000:89:02.0: AER: device recovery failed + +Fix it. + +Link: https://lore.kernel.org/r/9f5ff00e1593d8d9a4b452398b98aa14d23fca11.1673769517.git.lukas@wunner.de +Tested-by: Ravi Kishore Koppuravuri +Signed-off-by: Lukas Wunner +Signed-off-by: Bjorn Helgaas +Reviewed-by: Mika Westerberg +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/pci/pci.c | 3 --- + drivers/pci/pci.h | 6 ++++++ + drivers/pci/pcie/dpc.c | 4 ++-- + 3 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 108c6ce5..da748247 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -167,9 +167,6 @@ static int __init pcie_port_pm_setup(char *str) + } + __setup("pcie_port_pm=", pcie_port_pm_setup); + +-/* Time to wait after a reset for device to become responsive */ +-#define PCIE_RESET_READY_POLL_MS 60000 +- + /** + * pci_bus_max_busnr - returns maximum PCI bus number of given bus' children + * @bus: pointer to PCI bus structure to search +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 44643ffb..d2c08670 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -70,6 +70,12 @@ struct pci_cap_saved_state *pci_find_saved_ext_cap(struct pci_dev *dev, + * Reset (PCIe r6.0 sec 5.8). + */ + #define PCI_RESET_WAIT 1000 /* msec */ ++/* ++ * Devices may extend the 1 sec period through Request Retry Status completions ++ * (PCIe r6.0 sec 2.3.1). The spec does not provide an upper limit, but 60 sec ++ * ought to be enough for any device to become responsive. ++ */ ++#define PCIE_RESET_READY_POLL_MS 60000 /* msec */ + + void pci_update_current_state(struct pci_dev *dev, pci_power_t state); + void pci_refresh_power_state(struct pci_dev *dev); +diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c +index f5ffea17..a5d7c69b 100644 +--- a/drivers/pci/pcie/dpc.c ++++ b/drivers/pci/pcie/dpc.c +@@ -170,8 +170,8 @@ pci_ers_result_t dpc_reset_link(struct pci_dev *pdev) + pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS, + PCI_EXP_DPC_STATUS_TRIGGER); + +- if (!pcie_wait_for_link(pdev, true)) { +- pci_info(pdev, "Data Link Layer Link Active not set in 1000 msec\n"); ++ if (pci_bridge_wait_for_secondary_bus(pdev, "DPC", ++ PCIE_RESET_READY_POLL_MS)) { + clear_bit(PCI_DPC_RECOVERED, &pdev->priv_flags); + ret = PCI_ERS_RESULT_DISCONNECT; + } else { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-976-bus-mhi-ep-Only-send-ENOTCONN-status-if-client-.patch b/patches.kernel.org/6.2.3-976-bus-mhi-ep-Only-send-ENOTCONN-status-if-client-.patch new file mode 100644 index 0000000..df17eaf --- /dev/null +++ b/patches.kernel.org/6.2.3-976-bus-mhi-ep-Only-send-ENOTCONN-status-if-client-.patch @@ -0,0 +1,63 @@ +From: Manivannan Sadhasivam +Date: Wed, 28 Dec 2022 21:47:01 +0530 +Subject: [PATCH] bus: mhi: ep: Only send -ENOTCONN status if client driver is + available +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: e6cebcc27519dcf1652e604c73b9fd4f416987c0 + +commit e6cebcc27519dcf1652e604c73b9fd4f416987c0 upstream. + +For the STOP and RESET commands, only send the channel disconnect status +-ENOTCONN if client driver is available. Otherwise, it will result in +null pointer dereference. + +Cc: # 5.19 +Fixes: e827569062a8 ("bus: mhi: ep: Add support for processing command rings") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Jeffrey Hugo +Link: https://lore.kernel.org/r/20221228161704.255268-4-manivannan.sadhasivam@linaro.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/bus/mhi/ep/main.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c +index 1dc8a355..2b3a3b56 100644 +--- a/drivers/bus/mhi/ep/main.c ++++ b/drivers/bus/mhi/ep/main.c +@@ -196,9 +196,11 @@ static int mhi_ep_process_cmd_ring(struct mhi_ep_ring *ring, struct mhi_ring_ele + mhi_ep_mmio_disable_chdb(mhi_cntrl, ch_id); + + /* Send channel disconnect status to client drivers */ +- result.transaction_status = -ENOTCONN; +- result.bytes_xferd = 0; +- mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); ++ if (mhi_chan->xfer_cb) { ++ result.transaction_status = -ENOTCONN; ++ result.bytes_xferd = 0; ++ mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); ++ } + + /* Set channel state to STOP */ + mhi_chan->state = MHI_CH_STATE_STOP; +@@ -228,9 +230,11 @@ static int mhi_ep_process_cmd_ring(struct mhi_ep_ring *ring, struct mhi_ring_ele + mhi_ep_ring_reset(mhi_cntrl, ch_ring); + + /* Send channel disconnect status to client driver */ +- result.transaction_status = -ENOTCONN; +- result.bytes_xferd = 0; +- mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); ++ if (mhi_chan->xfer_cb) { ++ result.transaction_status = -ENOTCONN; ++ result.bytes_xferd = 0; ++ mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); ++ } + + /* Set channel state to DISABLED */ + mhi_chan->state = MHI_CH_STATE_DISABLED; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-977-bus-mhi-ep-Move-chan-lock-to-the-start-of-proce.patch b/patches.kernel.org/6.2.3-977-bus-mhi-ep-Move-chan-lock-to-the-start-of-proce.patch new file mode 100644 index 0000000..66d6fa9 --- /dev/null +++ b/patches.kernel.org/6.2.3-977-bus-mhi-ep-Move-chan-lock-to-the-start-of-proce.patch @@ -0,0 +1,80 @@ +From: Manivannan Sadhasivam +Date: Wed, 28 Dec 2022 21:47:03 +0530 +Subject: [PATCH] bus: mhi: ep: Move chan->lock to the start of processing + queued ch ring +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8d6a1fea53864cd9545741f48f4ae4df804db557 + +commit 8d6a1fea53864cd9545741f48f4ae4df804db557 upstream. + +There is a good chance that while the channel ring gets processed, the STOP +or RESET command for the channel might be received from the MHI host. In +those cases, the entire channel ring processing needs to be protected by +chan->lock to prevent the race where the corresponding channel ring might +be reset. + +While at it, let's also add a sanity check to make sure that the ring is +started before processing it. Because, if the STOP/RESET command gets +processed while mhi_ep_ch_ring_worker() waited for chan->lock, the ring +would've been reset. + +Cc: # 5.19 +Fixes: 03c0bb8ec983 ("bus: mhi: ep: Add support for processing channel rings") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Jeffrey Hugo +Link: https://lore.kernel.org/r/20221228161704.255268-6-manivannan.sadhasivam@linaro.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/bus/mhi/ep/main.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c +index 2b3a3b56..883bf79b 100644 +--- a/drivers/bus/mhi/ep/main.c ++++ b/drivers/bus/mhi/ep/main.c +@@ -723,24 +723,37 @@ static void mhi_ep_ch_ring_worker(struct work_struct *work) + list_del(&itr->node); + ring = itr->ring; + ++ chan = &mhi_cntrl->mhi_chan[ring->ch_id]; ++ mutex_lock(&chan->lock); ++ ++ /* ++ * The ring could've stopped while we waited to grab the (chan->lock), so do ++ * a sanity check before going further. ++ */ ++ if (!ring->started) { ++ mutex_unlock(&chan->lock); ++ kfree(itr); ++ continue; ++ } ++ + /* Update the write offset for the ring */ + ret = mhi_ep_update_wr_offset(ring); + if (ret) { + dev_err(dev, "Error updating write offset for ring\n"); ++ mutex_unlock(&chan->lock); + kfree(itr); + continue; + } + + /* Sanity check to make sure there are elements in the ring */ + if (ring->rd_offset == ring->wr_offset) { ++ mutex_unlock(&chan->lock); + kfree(itr); + continue; + } + + el = &ring->ring_cache[ring->rd_offset]; +- chan = &mhi_cntrl->mhi_chan[ring->ch_id]; + +- mutex_lock(&chan->lock); + dev_dbg(dev, "Processing the ring for channel (%u)\n", ring->ch_id); + ret = mhi_ep_process_ch_ring(ring, el); + if (ret) { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-978-bus-mhi-ep-Save-channel-state-locally-during-su.patch b/patches.kernel.org/6.2.3-978-bus-mhi-ep-Save-channel-state-locally-during-su.patch new file mode 100644 index 0000000..7c43777 --- /dev/null +++ b/patches.kernel.org/6.2.3-978-bus-mhi-ep-Save-channel-state-locally-during-su.patch @@ -0,0 +1,51 @@ +From: Manivannan Sadhasivam +Date: Wed, 28 Dec 2022 21:47:04 +0530 +Subject: [PATCH] bus: mhi: ep: Save channel state locally during suspend and + resume +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 8a1c24bb908f9ecbc4be0fea014df67d43161551 + +commit 8a1c24bb908f9ecbc4be0fea014df67d43161551 upstream. + +During suspend and resume, the channel state needs to be saved locally. +Otherwise, the endpoint may access the channels while they were being +suspended and causing access violations. + +Fix it by saving the channel state locally during suspend and resume. + +Cc: # 5.19 +Fixes: e4b7b5f0f30a ("bus: mhi: ep: Add support for suspending and resuming channels") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Jeffrey Hugo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/bus/mhi/ep/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c +index 883bf79b..9c428868 100644 +--- a/drivers/bus/mhi/ep/main.c ++++ b/drivers/bus/mhi/ep/main.c +@@ -1136,6 +1136,7 @@ void mhi_ep_suspend_channels(struct mhi_ep_cntrl *mhi_cntrl) + + dev_dbg(&mhi_chan->mhi_dev->dev, "Suspending channel\n"); + /* Set channel state to SUSPENDED */ ++ mhi_chan->state = MHI_CH_STATE_SUSPENDED; + tmp &= ~CHAN_CTX_CHSTATE_MASK; + tmp |= FIELD_PREP(CHAN_CTX_CHSTATE_MASK, MHI_CH_STATE_SUSPENDED); + mhi_cntrl->ch_ctx_cache[i].chcfg = cpu_to_le32(tmp); +@@ -1165,6 +1166,7 @@ void mhi_ep_resume_channels(struct mhi_ep_cntrl *mhi_cntrl) + + dev_dbg(&mhi_chan->mhi_dev->dev, "Resuming channel\n"); + /* Set channel state to RUNNING */ ++ mhi_chan->state = MHI_CH_STATE_RUNNING; + tmp &= ~CHAN_CTX_CHSTATE_MASK; + tmp |= FIELD_PREP(CHAN_CTX_CHSTATE_MASK, MHI_CH_STATE_RUNNING); + mhi_cntrl->ch_ctx_cache[i].chcfg = cpu_to_le32(tmp); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-979-iommufd-Make-sure-to-zero-vfio_iommu_type1_info.patch b/patches.kernel.org/6.2.3-979-iommufd-Make-sure-to-zero-vfio_iommu_type1_info.patch new file mode 100644 index 0000000..6b7d202 --- /dev/null +++ b/patches.kernel.org/6.2.3-979-iommufd-Make-sure-to-zero-vfio_iommu_type1_info.patch @@ -0,0 +1,42 @@ +From: Jason Gunthorpe +Date: Mon, 13 Feb 2023 10:32:21 -0400 +Subject: [PATCH] iommufd: Make sure to zero vfio_iommu_type1_info before + copying to user +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b3551ead616318ea155558cdbe7e91495b8d9b33 + +commit b3551ead616318ea155558cdbe7e91495b8d9b33 upstream. + +Missed a zero initialization here. Most of the struct is filled with +a copy_from_user(), however minsz for that copy is smaller than the +actual struct by 8 bytes, thus we don't fill the padding. + +Cc: stable@vger.kernel.org # 6.1+ +Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") +Link: https://lore.kernel.org/r/0-v1-a74499ece799+1a-iommufd_get_info_leak_jgg@nvidia.com +Reviewed-by: Kevin Tian +Reported-by: syzbot+cb1e0978f6bf46b83a58@syzkaller.appspotmail.com +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/iommufd/vfio_compat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommufd/vfio_compat.c b/drivers/iommu/iommufd/vfio_compat.c +index 3ceca0e8..dba88ee1 100644 +--- a/drivers/iommu/iommufd/vfio_compat.c ++++ b/drivers/iommu/iommufd/vfio_compat.c +@@ -381,7 +381,7 @@ static int iommufd_vfio_iommu_get_info(struct iommufd_ctx *ictx, + }; + size_t minsz = offsetofend(struct vfio_iommu_type1_info, iova_pgsizes); + struct vfio_info_cap_header __user *last_cap = NULL; +- struct vfio_iommu_type1_info info; ++ struct vfio_iommu_type1_info info = {}; + struct iommufd_ioas *ioas; + size_t total_cap_size; + int rc; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-980-iommufd-Do-not-add-the-same-hwpt-to-the-ioas-hw.patch b/patches.kernel.org/6.2.3-980-iommufd-Do-not-add-the-same-hwpt-to-the-ioas-hw.patch new file mode 100644 index 0000000..bffd663 --- /dev/null +++ b/patches.kernel.org/6.2.3-980-iommufd-Do-not-add-the-same-hwpt-to-the-ioas-hw.patch @@ -0,0 +1,48 @@ +From: Jason Gunthorpe +Date: Mon, 13 Feb 2023 14:02:42 -0400 +Subject: [PATCH] iommufd: Do not add the same hwpt to the ioas->hwpt_list + twice +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: b4ff830eca097df51af10a9be29e8cc817327919 + +commit b4ff830eca097df51af10a9be29e8cc817327919 upstream. + +The hwpt is added to the hwpt_list only during its creation, it is never +added again. This hunk is some missed leftover from rework. Adding it +twice will corrupt the linked list in some cases. + +It effects HWPT specific attachment, which is something the test suite +cannot cover until we can create a legitimate struct device with a +non-system iommu "driver" (ie we need the bus removed from the iommu code) + +Cc: stable@vger.kernel.org +Fixes: e8d57210035b ("iommufd: Add kAPI toward external drivers for physical devices") +Link: https://lore.kernel.org/r/1-v1-4336b5cb2fe4+1d7-iommufd_hwpt_jgg@nvidia.com +Reviewed-by: Kevin Tian +Reported-by: Kevin Tian +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/iommufd/device.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c +index d81f93a3..f6f42d8b 100644 +--- a/drivers/iommu/iommufd/device.c ++++ b/drivers/iommu/iommufd/device.c +@@ -346,10 +346,6 @@ int iommufd_device_attach(struct iommufd_device *idev, u32 *pt_id) + rc = iommufd_device_do_attach(idev, hwpt); + if (rc) + goto out_put_pt_obj; +- +- mutex_lock(&hwpt->ioas->mutex); +- list_add_tail(&hwpt->hwpt_item, &hwpt->ioas->hwpt_list); +- mutex_unlock(&hwpt->ioas->mutex); + break; + } + case IOMMUFD_OBJ_IOAS: { +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-981-iommu-vt-d-Avoid-superfluous-IOTLB-tracking-in-.patch b/patches.kernel.org/6.2.3-981-iommu-vt-d-Avoid-superfluous-IOTLB-tracking-in-.patch new file mode 100644 index 0000000..d060bfd --- /dev/null +++ b/patches.kernel.org/6.2.3-981-iommu-vt-d-Avoid-superfluous-IOTLB-tracking-in-.patch @@ -0,0 +1,59 @@ +From: Jacob Pan +Date: Thu, 16 Feb 2023 21:08:14 +0800 +Subject: [PATCH] iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 16a75bbe480c3598b3af57a2504ea89b1e32c3ac + +commit 16a75bbe480c3598b3af57a2504ea89b1e32c3ac upstream. + +Intel IOMMU driver implements IOTLB flush queue with domain selective +or PASID selective invalidations. In this case there's no need to track +IOVA page range and sync IOTLBs, which may cause significant performance +hit. + +This patch adds a check to avoid IOVA gather page and IOTLB sync for +the lazy path. + +The performance difference on Sapphire Rapids 100Gb NIC is improved by +the following (as measured by iperf send): + +w/o this fix~48 Gbits/s. with this fix ~54 Gbits/s + +Cc: +Fixes: 2a2b8eaa5b25 ("iommu: Handle freelists when using deferred flushing in iommu drivers") +Reviewed-by: Robin Murphy +Reviewed-by: Kevin Tian +Tested-by: Sanjay Kumar +Signed-off-by: Sanjay Kumar +Signed-off-by: Jacob Pan +Link: https://lore.kernel.org/r/20230209175330.1783556-1-jacob.jun.pan@linux.intel.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/intel/iommu.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index b40ef352..52afcdaf 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -4347,7 +4347,12 @@ static size_t intel_iommu_unmap(struct iommu_domain *domain, + if (dmar_domain->max_addr == iova + size) + dmar_domain->max_addr = iova; + +- iommu_iotlb_gather_add_page(domain, gather, iova, size); ++ /* ++ * We do not use page-selective IOTLB invalidation in flush queue, ++ * so there is no need to track page and sync iotlb. ++ */ ++ if (!iommu_iotlb_gather_queued(gather)) ++ iommu_iotlb_gather_add_page(domain, gather, iova, size); + + return size; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-982-iommu-vt-d-Fix-PASID-directory-pointer-coherenc.patch b/patches.kernel.org/6.2.3-982-iommu-vt-d-Fix-PASID-directory-pointer-coherenc.patch new file mode 100644 index 0000000..9ac79ca --- /dev/null +++ b/patches.kernel.org/6.2.3-982-iommu-vt-d-Fix-PASID-directory-pointer-coherenc.patch @@ -0,0 +1,83 @@ +From: Jacob Pan +Date: Thu, 16 Feb 2023 21:08:15 +0800 +Subject: [PATCH] iommu/vt-d: Fix PASID directory pointer coherency +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 194b3348bdbb7db65375c72f3f774aee4cc6614e + +commit 194b3348bdbb7db65375c72f3f774aee4cc6614e upstream. + +On platforms that do not support IOMMU Extended capability bit 0 +Page-walk Coherency, CPU caches are not snooped when IOMMU is accessing +any translation structures. IOMMU access goes only directly to +memory. Intel IOMMU code was missing a flush for the PASID table +directory that resulted in the unrecoverable fault as shown below. + +This patch adds clflush calls whenever allocating and updating +a PASID table directory to ensure cache coherency. + +On the reverse direction, there's no need to clflush the PASID directory +pointer when we deactivate a context entry in that IOMMU hardware will +not see the old PASID directory pointer after we clear the context entry. +PASID directory entries are also never freed once allocated. + + DMAR: DRHD: handling fault status reg 3 + DMAR: [DMA Read NO_PASID] Request device [00:0d.2] fault addr 0x1026a4000 + [fault reason 0x51] SM: Present bit in Directory Entry is clear + DMAR: Dump dmar1 table entries for IOVA 0x1026a4000 + DMAR: scalable mode root entry: hi 0x0000000102448001, low 0x0000000101b3e001 + DMAR: context entry: hi 0x0000000000000000, low 0x0000000101b4d401 + DMAR: pasid dir entry: 0x0000000101b4e001 + DMAR: pasid table entry[0]: 0x0000000000000109 + DMAR: pasid table entry[1]: 0x0000000000000001 + DMAR: pasid table entry[2]: 0x0000000000000000 + DMAR: pasid table entry[3]: 0x0000000000000000 + DMAR: pasid table entry[4]: 0x0000000000000000 + DMAR: pasid table entry[5]: 0x0000000000000000 + DMAR: pasid table entry[6]: 0x0000000000000000 + DMAR: pasid table entry[7]: 0x0000000000000000 + DMAR: PTE not present at level 4 + +Cc: +Fixes: 0bbeb01a4faf ("iommu/vt-d: Manage scalalble mode PASID tables") +Reviewed-by: Kevin Tian +Reported-by: Sukumar Ghorai +Signed-off-by: Ashok Raj +Signed-off-by: Jacob Pan +Link: https://lore.kernel.org/r/20230209212843.1788125-1-jacob.jun.pan@linux.intel.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/iommu/intel/pasid.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c +index ec964ac7..9d2f05cf 100644 +--- a/drivers/iommu/intel/pasid.c ++++ b/drivers/iommu/intel/pasid.c +@@ -128,6 +128,9 @@ int intel_pasid_alloc_table(struct device *dev) + pasid_table->max_pasid = 1 << (order + PAGE_SHIFT + 3); + info->pasid_table = pasid_table; + ++ if (!ecap_coherent(info->iommu->ecap)) ++ clflush_cache_range(pasid_table->table, size); ++ + return 0; + } + +@@ -215,6 +218,10 @@ static struct pasid_entry *intel_pasid_get_entry(struct device *dev, u32 pasid) + free_pgtable_page(entries); + goto retry; + } ++ if (!ecap_coherent(info->iommu->ecap)) { ++ clflush_cache_range(entries, VTD_PAGE_SIZE); ++ clflush_cache_range(&dir[dir_index].val, sizeof(*dir)); ++ } + } + + return &entries[index]; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-983-vfio-type1-exclude-mdevs-from-VFIO_UPDATE_VADDR.patch b/patches.kernel.org/6.2.3-983-vfio-type1-exclude-mdevs-from-VFIO_UPDATE_VADDR.patch new file mode 100644 index 0000000..9fe6091 --- /dev/null +++ b/patches.kernel.org/6.2.3-983-vfio-type1-exclude-mdevs-from-VFIO_UPDATE_VADDR.patch @@ -0,0 +1,176 @@ +From: Steve Sistare +Date: Tue, 31 Jan 2023 08:58:03 -0800 +Subject: [PATCH] vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: ef3a3f6a294ba65fd906a291553935881796f8a5 + +commit ef3a3f6a294ba65fd906a291553935881796f8a5 upstream. + +Disable the VFIO_UPDATE_VADDR capability if mediated devices are present. +Their kernel threads could be blocked indefinitely by a misbehaving +userland while trying to pin/unpin pages while vaddrs are being updated. + +Do not allow groups to be added to the container while vaddr's are invalid, +so we never need to block user threads from pinning, and can delete the +vaddr-waiting code in a subsequent patch. + +Fixes: c3cbab24db38 ("vfio/type1: implement interfaces to update vaddr") +Cc: stable@vger.kernel.org +Signed-off-by: Steve Sistare +Reviewed-by: Kevin Tian +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/1675184289-267876-2-git-send-email-steven.sistare@oracle.com +Signed-off-by: Alex Williamson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/vfio/vfio_iommu_type1.c | 44 +++++++++++++++++++++++++++++++-- + include/uapi/linux/vfio.h | 15 ++++++----- + 2 files changed, 51 insertions(+), 8 deletions(-) + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index 2209372f..e8902e75 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -861,6 +861,12 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data, + + mutex_lock(&iommu->lock); + ++ if (WARN_ONCE(iommu->vaddr_invalid_count, ++ "vfio_pin_pages not allowed with VFIO_UPDATE_VADDR\n")) { ++ ret = -EBUSY; ++ goto pin_done; ++ } ++ + /* + * Wait for all necessary vaddr's to be valid so they can be used in + * the main loop without dropping the lock, to avoid racing vs unmap. +@@ -1343,6 +1349,12 @@ static int vfio_dma_do_unmap(struct vfio_iommu *iommu, + + mutex_lock(&iommu->lock); + ++ /* Cannot update vaddr if mdev is present. */ ++ if (invalidate_vaddr && !list_empty(&iommu->emulated_iommu_groups)) { ++ ret = -EBUSY; ++ goto unlock; ++ } ++ + pgshift = __ffs(iommu->pgsize_bitmap); + pgsize = (size_t)1 << pgshift; + +@@ -2194,11 +2206,16 @@ static int vfio_iommu_type1_attach_group(void *iommu_data, + struct iommu_domain_geometry *geo; + LIST_HEAD(iova_copy); + LIST_HEAD(group_resv_regions); +- int ret = -EINVAL; ++ int ret = -EBUSY; + + mutex_lock(&iommu->lock); + ++ /* Attach could require pinning, so disallow while vaddr is invalid. */ ++ if (iommu->vaddr_invalid_count) ++ goto out_unlock; ++ + /* Check for duplicates */ ++ ret = -EINVAL; + if (vfio_iommu_find_iommu_group(iommu, iommu_group)) + goto out_unlock; + +@@ -2669,6 +2686,16 @@ static int vfio_domains_have_enforce_cache_coherency(struct vfio_iommu *iommu) + return ret; + } + ++static bool vfio_iommu_has_emulated(struct vfio_iommu *iommu) ++{ ++ bool ret; ++ ++ mutex_lock(&iommu->lock); ++ ret = !list_empty(&iommu->emulated_iommu_groups); ++ mutex_unlock(&iommu->lock); ++ return ret; ++} ++ + static int vfio_iommu_type1_check_extension(struct vfio_iommu *iommu, + unsigned long arg) + { +@@ -2677,8 +2704,13 @@ static int vfio_iommu_type1_check_extension(struct vfio_iommu *iommu, + case VFIO_TYPE1v2_IOMMU: + case VFIO_TYPE1_NESTING_IOMMU: + case VFIO_UNMAP_ALL: +- case VFIO_UPDATE_VADDR: + return 1; ++ case VFIO_UPDATE_VADDR: ++ /* ++ * Disable this feature if mdevs are present. They cannot ++ * safely pin/unpin/rw while vaddrs are being updated. ++ */ ++ return iommu && !vfio_iommu_has_emulated(iommu); + case VFIO_DMA_CC_IOMMU: + if (!iommu) + return 0; +@@ -3147,6 +3179,13 @@ static int vfio_iommu_type1_dma_rw(void *iommu_data, dma_addr_t user_iova, + size_t done; + + mutex_lock(&iommu->lock); ++ ++ if (WARN_ONCE(iommu->vaddr_invalid_count, ++ "vfio_dma_rw not allowed with VFIO_UPDATE_VADDR\n")) { ++ ret = -EBUSY; ++ goto out; ++ } ++ + while (count > 0) { + ret = vfio_iommu_type1_dma_rw_chunk(iommu, user_iova, data, + count, write, &done); +@@ -3158,6 +3197,7 @@ static int vfio_iommu_type1_dma_rw(void *iommu_data, dma_addr_t user_iova, + user_iova += done; + } + ++out: + mutex_unlock(&iommu->lock); + return ret; + } +diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h +index 23105eb0..0552e8dc 100644 +--- a/include/uapi/linux/vfio.h ++++ b/include/uapi/linux/vfio.h +@@ -49,7 +49,11 @@ + /* Supports VFIO_DMA_UNMAP_FLAG_ALL */ + #define VFIO_UNMAP_ALL 9 + +-/* Supports the vaddr flag for DMA map and unmap */ ++/* ++ * Supports the vaddr flag for DMA map and unmap. Not supported for mediated ++ * devices, so this capability is subject to change as groups are added or ++ * removed. ++ */ + #define VFIO_UPDATE_VADDR 10 + + /* +@@ -1343,8 +1347,7 @@ struct vfio_iommu_type1_info_dma_avail { + * Map process virtual addresses to IO virtual addresses using the + * provided struct vfio_dma_map. Caller sets argsz. READ &/ WRITE required. + * +- * If flags & VFIO_DMA_MAP_FLAG_VADDR, update the base vaddr for iova, and +- * unblock translation of host virtual addresses in the iova range. The vaddr ++ * If flags & VFIO_DMA_MAP_FLAG_VADDR, update the base vaddr for iova. The vaddr + * must have previously been invalidated with VFIO_DMA_UNMAP_FLAG_VADDR. To + * maintain memory consistency within the user application, the updated vaddr + * must address the same memory object as originally mapped. Failure to do so +@@ -1395,9 +1398,9 @@ struct vfio_bitmap { + * must be 0. This cannot be combined with the get-dirty-bitmap flag. + * + * If flags & VFIO_DMA_UNMAP_FLAG_VADDR, do not unmap, but invalidate host +- * virtual addresses in the iova range. Tasks that attempt to translate an +- * iova's vaddr will block. DMA to already-mapped pages continues. This +- * cannot be combined with the get-dirty-bitmap flag. ++ * virtual addresses in the iova range. DMA to already-mapped pages continues. ++ * Groups may not be added to the container while any addresses are invalid. ++ * This cannot be combined with the get-dirty-bitmap flag. + */ + struct vfio_iommu_type1_dma_unmap { + __u32 argsz; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-984-vfio-type1-prevent-underflow-of-locked_vm-via-e.patch b/patches.kernel.org/6.2.3-984-vfio-type1-prevent-underflow-of-locked_vm-via-e.patch new file mode 100644 index 0000000..1647a3a --- /dev/null +++ b/patches.kernel.org/6.2.3-984-vfio-type1-prevent-underflow-of-locked_vm-via-e.patch @@ -0,0 +1,135 @@ +From: Steve Sistare +Date: Tue, 31 Jan 2023 08:58:04 -0800 +Subject: [PATCH] vfio/type1: prevent underflow of locked_vm via exec() +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 046eca5018f8a5dd1dc2cedf87fb5843b9ea3026 + +commit 046eca5018f8a5dd1dc2cedf87fb5843b9ea3026 upstream. + +When a vfio container is preserved across exec, the task does not change, +but it gets a new mm with locked_vm=0, and loses the count from existing +dma mappings. If the user later unmaps a dma mapping, locked_vm underflows +to a large unsigned value, and a subsequent dma map request fails with +ENOMEM in __account_locked_vm. + +To avoid underflow, grab and save the mm at the time a dma is mapped. +Use that mm when adjusting locked_vm, rather than re-acquiring the saved +task's mm, which may have changed. If the saved mm is dead, do nothing. + +locked_vm is incremented for existing mappings in a subsequent patch. + +Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Steve Sistare +Reviewed-by: Kevin Tian +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/1675184289-267876-3-git-send-email-steven.sistare@oracle.com +Signed-off-by: Alex Williamson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/vfio/vfio_iommu_type1.c | 41 +++++++++++---------------------- + 1 file changed, 14 insertions(+), 27 deletions(-) + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index e8902e75..ee9e9888 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -100,6 +100,7 @@ struct vfio_dma { + struct task_struct *task; + struct rb_root pfn_list; /* Ex-user pinned pfn list */ + unsigned long *bitmap; ++ struct mm_struct *mm; + }; + + struct vfio_batch { +@@ -420,8 +421,8 @@ static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async) + if (!npage) + return 0; + +- mm = async ? get_task_mm(dma->task) : dma->task->mm; +- if (!mm) ++ mm = dma->mm; ++ if (async && !mmget_not_zero(mm)) + return -ESRCH; /* process exited */ + + ret = mmap_write_lock_killable(mm); +@@ -794,8 +795,8 @@ static int vfio_pin_page_external(struct vfio_dma *dma, unsigned long vaddr, + struct mm_struct *mm; + int ret; + +- mm = get_task_mm(dma->task); +- if (!mm) ++ mm = dma->mm; ++ if (!mmget_not_zero(mm)) + return -ENODEV; + + ret = vaddr_get_pfns(mm, vaddr, 1, dma->prot, pfn_base, pages); +@@ -805,7 +806,7 @@ static int vfio_pin_page_external(struct vfio_dma *dma, unsigned long vaddr, + ret = 0; + + if (do_accounting && !is_invalid_reserved_pfn(*pfn_base)) { +- ret = vfio_lock_acct(dma, 1, true); ++ ret = vfio_lock_acct(dma, 1, false); + if (ret) { + put_pfn(*pfn_base, dma->prot); + if (ret == -ENOMEM) +@@ -1180,6 +1181,7 @@ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma) + vfio_unmap_unpin(iommu, dma, true); + vfio_unlink_dma(iommu, dma); + put_task_struct(dma->task); ++ mmdrop(dma->mm); + vfio_dma_bitmap_free(dma); + if (dma->vaddr_invalid) { + iommu->vaddr_invalid_count--; +@@ -1664,29 +1666,15 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu, + * against the locked memory limit and we need to be able to do both + * outside of this call path as pinning can be asynchronous via the + * external interfaces for mdev devices. RLIMIT_MEMLOCK requires a +- * task_struct and VM locked pages requires an mm_struct, however +- * holding an indefinite mm reference is not recommended, therefore we +- * only hold a reference to a task. We could hold a reference to +- * current, however QEMU uses this call path through vCPU threads, +- * which can be killed resulting in a NULL mm and failure in the unmap +- * path when called via a different thread. Avoid this problem by +- * using the group_leader as threads within the same group require +- * both CLONE_THREAD and CLONE_VM and will therefore use the same +- * mm_struct. +- * +- * Previously we also used the task for testing CAP_IPC_LOCK at the +- * time of pinning and accounting, however has_capability() makes use +- * of real_cred, a copy-on-write field, so we can't guarantee that it +- * matches group_leader, or in fact that it might not change by the +- * time it's evaluated. If a process were to call MAP_DMA with +- * CAP_IPC_LOCK but later drop it, it doesn't make sense that they +- * possibly see different results for an iommu_mapped vfio_dma vs +- * externally mapped. Therefore track CAP_IPC_LOCK in vfio_dma at the +- * time of calling MAP_DMA. ++ * task_struct. Save the group_leader so that all DMA tracking uses ++ * the same task, to make debugging easier. VM locked pages requires ++ * an mm_struct, so grab the mm in case the task dies. + */ + get_task_struct(current->group_leader); + dma->task = current->group_leader; + dma->lock_cap = capable(CAP_IPC_LOCK); ++ dma->mm = current->mm; ++ mmgrab(dma->mm); + + dma->pfn_list = RB_ROOT; + +@@ -3131,9 +3119,8 @@ static int vfio_iommu_type1_dma_rw_chunk(struct vfio_iommu *iommu, + !(dma->prot & IOMMU_READ)) + return -EPERM; + +- mm = get_task_mm(dma->task); +- +- if (!mm) ++ mm = dma->mm; ++ if (!mmget_not_zero(mm)) + return -EPERM; + + if (kthread) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-985-vfio-type1-track-locked_vm-per-dma.patch b/patches.kernel.org/6.2.3-985-vfio-type1-track-locked_vm-per-dma.patch new file mode 100644 index 0000000..29013d7 --- /dev/null +++ b/patches.kernel.org/6.2.3-985-vfio-type1-track-locked_vm-per-dma.patch @@ -0,0 +1,76 @@ +From: Steve Sistare +Date: Tue, 31 Jan 2023 08:58:05 -0800 +Subject: [PATCH] vfio/type1: track locked_vm per dma +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 18e292705ba21cc9b3227b9ad5b1c28973605ee5 + +commit 18e292705ba21cc9b3227b9ad5b1c28973605ee5 upstream. + +Track locked_vm per dma struct, and create a new subroutine, both for use +in a subsequent patch. No functional change. + +Fixes: c3cbab24db38 ("vfio/type1: implement interfaces to update vaddr") +Cc: stable@vger.kernel.org +Signed-off-by: Steve Sistare +Reviewed-by: Kevin Tian +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/1675184289-267876-4-git-send-email-steven.sistare@oracle.com +Signed-off-by: Alex Williamson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/vfio/vfio_iommu_type1.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index ee9e9888..5a083462 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -101,6 +101,7 @@ struct vfio_dma { + struct rb_root pfn_list; /* Ex-user pinned pfn list */ + unsigned long *bitmap; + struct mm_struct *mm; ++ size_t locked_vm; + }; + + struct vfio_batch { +@@ -413,6 +414,19 @@ static int vfio_iova_put_vfio_pfn(struct vfio_dma *dma, struct vfio_pfn *vpfn) + return ret; + } + ++static int mm_lock_acct(struct task_struct *task, struct mm_struct *mm, ++ bool lock_cap, long npage) ++{ ++ int ret = mmap_write_lock_killable(mm); ++ ++ if (ret) ++ return ret; ++ ++ ret = __account_locked_vm(mm, abs(npage), npage > 0, task, lock_cap); ++ mmap_write_unlock(mm); ++ return ret; ++} ++ + static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async) + { + struct mm_struct *mm; +@@ -425,12 +439,9 @@ static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async) + if (async && !mmget_not_zero(mm)) + return -ESRCH; /* process exited */ + +- ret = mmap_write_lock_killable(mm); +- if (!ret) { +- ret = __account_locked_vm(mm, abs(npage), npage > 0, dma->task, +- dma->lock_cap); +- mmap_write_unlock(mm); +- } ++ ret = mm_lock_acct(dma->task, mm, dma->lock_cap, npage); ++ if (!ret) ++ dma->locked_vm += npage; + + if (async) + mmput(mm); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-986-vfio-type1-restore-locked_vm.patch b/patches.kernel.org/6.2.3-986-vfio-type1-restore-locked_vm.patch new file mode 100644 index 0000000..35a02b4 --- /dev/null +++ b/patches.kernel.org/6.2.3-986-vfio-type1-restore-locked_vm.patch @@ -0,0 +1,88 @@ +From: Steve Sistare +Date: Tue, 31 Jan 2023 08:58:06 -0800 +Subject: [PATCH] vfio/type1: restore locked_vm +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 90fdd158a695d70403163f9a0e4efc5b20f3fd3e + +commit 90fdd158a695d70403163f9a0e4efc5b20f3fd3e upstream. + +When a vfio container is preserved across exec or fork-exec, the new +task's mm has a locked_vm count of 0. After a dma vaddr is updated using +VFIO_DMA_MAP_FLAG_VADDR, locked_vm remains 0, and the pinned memory does +not count against the task's RLIMIT_MEMLOCK. + +To restore the correct locked_vm count, when VFIO_DMA_MAP_FLAG_VADDR is +used and the dma's mm has changed, add the dma's locked_vm count to +the new mm->locked_vm, subject to the rlimit, and subtract it from the +old mm->locked_vm. + +Fixes: c3cbab24db38 ("vfio/type1: implement interfaces to update vaddr") +Cc: stable@vger.kernel.org +Signed-off-by: Steve Sistare +Reviewed-by: Kevin Tian +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/1675184289-267876-5-git-send-email-steven.sistare@oracle.com +Signed-off-by: Alex Williamson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/vfio/vfio_iommu_type1.c | 35 +++++++++++++++++++++++++++++++++ + 1 file changed, 35 insertions(+) + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index 5a083462..7fa68dc4 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -1591,6 +1591,38 @@ static bool vfio_iommu_iova_dma_valid(struct vfio_iommu *iommu, + return list_empty(iova); + } + ++static int vfio_change_dma_owner(struct vfio_dma *dma) ++{ ++ struct task_struct *task = current->group_leader; ++ struct mm_struct *mm = current->mm; ++ long npage = dma->locked_vm; ++ bool lock_cap; ++ int ret; ++ ++ if (mm == dma->mm) ++ return 0; ++ ++ lock_cap = capable(CAP_IPC_LOCK); ++ ret = mm_lock_acct(task, mm, lock_cap, npage); ++ if (ret) ++ return ret; ++ ++ if (mmget_not_zero(dma->mm)) { ++ mm_lock_acct(dma->task, dma->mm, dma->lock_cap, -npage); ++ mmput(dma->mm); ++ } ++ ++ if (dma->task != task) { ++ put_task_struct(dma->task); ++ dma->task = get_task_struct(task); ++ } ++ mmdrop(dma->mm); ++ dma->mm = mm; ++ mmgrab(dma->mm); ++ dma->lock_cap = lock_cap; ++ return 0; ++} ++ + static int vfio_dma_do_map(struct vfio_iommu *iommu, + struct vfio_iommu_type1_dma_map *map) + { +@@ -1640,6 +1672,9 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu, + dma->size != size) { + ret = -EINVAL; + } else { ++ ret = vfio_change_dma_owner(dma); ++ if (ret) ++ goto out_unlock; + dma->vaddr = vaddr; + dma->vaddr_invalid = false; + iommu->vaddr_invalid_count--; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-987-drm-amd-Fix-initialization-for-nbio-7.5.1.patch b/patches.kernel.org/6.2.3-987-drm-amd-Fix-initialization-for-nbio-7.5.1.patch new file mode 100644 index 0000000..e4d45cc --- /dev/null +++ b/patches.kernel.org/6.2.3-987-drm-amd-Fix-initialization-for-nbio-7.5.1.patch @@ -0,0 +1,44 @@ +From: Mario Limonciello +Date: Sun, 19 Feb 2023 23:04:04 -0600 +Subject: [PATCH] drm/amd: Fix initialization for nbio 7.5.1 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 65a24000808f70ac69bd2a96381fa0c7341f20c0 + +commit 65a24000808f70ac69bd2a96381fa0c7341f20c0 upstream. + +A mistake has been made in the BIOS for some ASICs with NBIO 7.5.1 +where some NBIO registers aren't properly setup. + +Ensure that they're set during initialization. + +Tested-by: Richard Gong +Signed-off-by: Mario Limonciello +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c +index 31776b12..4b0d563c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c +@@ -382,6 +382,11 @@ static void nbio_v7_2_init_registers(struct amdgpu_device *adev) + if (def != data) + WREG32_PCIE_PORT(SOC15_REG_OFFSET(NBIO, 0, regBIF1_PCIE_MST_CTRL_3), data); + break; ++ case IP_VERSION(7, 5, 1): ++ data = RREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2); ++ data &= ~RCC_DEV2_EPF0_STRAP2__STRAP_NO_SOFT_RESET_DEV2_F0_MASK; ++ WREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2, data); ++ fallthrough; + default: + def = data = RREG32_PCIE_PORT(SOC15_REG_OFFSET(NBIO, 0, regPCIE_CONFIG_CNTL)); + data = REG_SET_FIELD(data, PCIE_CONFIG_CNTL, +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-988-drm-i915-quirks-Add-inverted-backlight-quirk-fo.patch b/patches.kernel.org/6.2.3-988-drm-i915-quirks-Add-inverted-backlight-quirk-fo.patch new file mode 100644 index 0000000..4e2df6d --- /dev/null +++ b/patches.kernel.org/6.2.3-988-drm-i915-quirks-Add-inverted-backlight-quirk-fo.patch @@ -0,0 +1,43 @@ +From: Mavroudis Chatzilaridis +Date: Wed, 1 Feb 2023 18:51:25 +0000 +Subject: [PATCH] drm/i915/quirks: Add inverted backlight quirk for HP + 14-r206nv +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 5e438bf7f9a1705ebcae5fa89cdbfbc6932a7871 + +commit 5e438bf7f9a1705ebcae5fa89cdbfbc6932a7871 upstream. + +This laptop uses inverted backlight PWM. Thus, without this quirk, +backlight brightness decreases as the brightness value increases and +vice versa. + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8013 +Cc: stable@vger.kernel.org +Signed-off-by: Mavroudis Chatzilaridis +Reviewed-by: Jani Nikula +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20230201184947.8835-1-mavchatz@protonmail.com +(cherry picked from commit 83e7d6fd330d413cb2064e680ffea91b0512a520) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/display/intel_quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/i915/display/intel_quirks.c b/drivers/gpu/drm/i915/display/intel_quirks.c +index 6e48d3bc..a280448d 100644 +--- a/drivers/gpu/drm/i915/display/intel_quirks.c ++++ b/drivers/gpu/drm/i915/display/intel_quirks.c +@@ -199,6 +199,8 @@ static struct intel_quirk intel_quirks[] = { + /* ECS Liva Q2 */ + { 0x3185, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time }, + { 0x3184, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time }, ++ /* HP Notebook - 14-r206nv */ ++ { 0x0f31, 0x103c, 0x220f, quirk_invert_brightness }, + }; + + void intel_init_quirks(struct drm_i915_private *i915) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-989-drm-radeon-Fix-eDP-for-single-display-iMac11-2.patch b/patches.kernel.org/6.2.3-989-drm-radeon-Fix-eDP-for-single-display-iMac11-2.patch new file mode 100644 index 0000000..f45fe0d --- /dev/null +++ b/patches.kernel.org/6.2.3-989-drm-radeon-Fix-eDP-for-single-display-iMac11-2.patch @@ -0,0 +1,52 @@ +From: Mark Hawrylak +Date: Sun, 19 Feb 2023 16:02:00 +1100 +Subject: [PATCH] drm/radeon: Fix eDP for single-display iMac11,2 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 05eacc198c68cbb35a7281ce4011f8899ee1cfb8 + +commit 05eacc198c68cbb35a7281ce4011f8899ee1cfb8 upstream. + +Apple iMac11,2 (mid 2010) also with Radeon HD-4670 that has the same +issue as iMac10,1 (late 2009) where the internal eDP panel stays dark on +driver load. This patch treats iMac11,2 the same as iMac10,1, +so the eDP panel stays active. + +Additional steps: +Kernel boot parameter radeon.nomodeset=0 required to keep the eDP +panel active. + +This patch is an extension of +commit 564d8a2cf3ab ("drm/radeon: Fix eDP for single-display iMac10,1 (v2)") +Link: https://lore.kernel.org/all/lsq.1507553064.833262317@decadent.org.uk/ +Signed-off-by: Mark Hawrylak +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/radeon/atombios_encoders.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index c841c273..3e24fa11 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -2122,11 +2122,12 @@ int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder, int fe_idx) + + /* + * On DCE32 any encoder can drive any block so usually just use crtc id, +- * but Apple thinks different at least on iMac10,1, so there use linkb, ++ * but Apple thinks different at least on iMac10,1 and iMac11,2, so there use linkb, + * otherwise the internal eDP panel will stay dark. + */ + if (ASIC_IS_DCE32(rdev)) { +- if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1")) ++ if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1") || ++ dmi_match(DMI_PRODUCT_NAME, "iMac11,2")) + enc_idx = (dig->linkb) ? 1 : 0; + else + enc_idx = radeon_crtc->crtc_id; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-990-drm-i915-Don-t-use-stolen-memory-for-ring-buffe.patch b/patches.kernel.org/6.2.3-990-drm-i915-Don-t-use-stolen-memory-for-ring-buffe.patch new file mode 100644 index 0000000..f8714e1 --- /dev/null +++ b/patches.kernel.org/6.2.3-990-drm-i915-Don-t-use-stolen-memory-for-ring-buffe.patch @@ -0,0 +1,53 @@ +From: John Harrison +Date: Wed, 15 Feb 2023 17:11:00 -0800 +Subject: [PATCH] drm/i915: Don't use stolen memory for ring buffers with LLC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 690e0ec8e63da9a29b39fedc6ed5da09c7c82651 + +commit 690e0ec8e63da9a29b39fedc6ed5da09c7c82651 upstream. + +Direction from hardware is that stolen memory should never be used for +ring buffer allocations on platforms with LLC. There are too many +caching pitfalls due to the way stolen memory accesses are routed. So +it is safest to just not use it. + +Signed-off-by: John Harrison +Fixes: c58b735fc762 ("drm/i915: Allocate rings from stolen") +Cc: Chris Wilson +Cc: Joonas Lahtinen +Cc: Jani Nikula +Cc: Rodrigo Vivi +Cc: Tvrtko Ursulin +Cc: intel-gfx@lists.freedesktop.org +Cc: # v4.9+ +Tested-by: Jouni Högander +Reviewed-by: Daniele Ceraolo Spurio +Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-2-John.C.Harrison@Intel.com +(cherry picked from commit f54c1f6c697c4297f7ed94283c184acc338a5cf8) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c b/drivers/gpu/drm/i915/gt/intel_ring.c +index 15ec64d8..fb1d2595 100644 +--- a/drivers/gpu/drm/i915/gt/intel_ring.c ++++ b/drivers/gpu/drm/i915/gt/intel_ring.c +@@ -116,7 +116,7 @@ static struct i915_vma *create_ring_vma(struct i915_ggtt *ggtt, int size) + + obj = i915_gem_object_create_lmem(i915, size, I915_BO_ALLOC_VOLATILE | + I915_BO_ALLOC_PM_VOLATILE); +- if (IS_ERR(obj) && i915_ggtt_has_aperture(ggtt)) ++ if (IS_ERR(obj) && i915_ggtt_has_aperture(ggtt) && !HAS_LLC(i915)) + obj = i915_gem_object_create_stolen(i915, size); + if (IS_ERR(obj)) + obj = i915_gem_object_create_internal(i915, size); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-991-drm-i915-Don-t-use-BAR-mappings-for-ring-buffer.patch b/patches.kernel.org/6.2.3-991-drm-i915-Don-t-use-BAR-mappings-for-ring-buffer.patch new file mode 100644 index 0000000..f2194de --- /dev/null +++ b/patches.kernel.org/6.2.3-991-drm-i915-Don-t-use-BAR-mappings-for-ring-buffer.patch @@ -0,0 +1,62 @@ +From: John Harrison +Date: Wed, 15 Feb 2023 17:11:01 -0800 +Subject: [PATCH] drm/i915: Don't use BAR mappings for ring buffers with LLC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 85636167e3206c3fbd52254fc432991cc4e90194 + +commit 85636167e3206c3fbd52254fc432991cc4e90194 upstream. + +Direction from hardware is that ring buffers should never be mapped +via the BAR on systems with LLC. There are too many caching pitfalls +due to the way BAR accesses are routed. So it is safest to just not +use it. + +Signed-off-by: John Harrison +Fixes: 9d80841ea4c9 ("drm/i915: Allow ringbuffers to be bound anywhere") +Cc: Chris Wilson +Cc: Joonas Lahtinen +Cc: Jani Nikula +Cc: Rodrigo Vivi +Cc: Tvrtko Ursulin +Cc: intel-gfx@lists.freedesktop.org +Cc: # v4.9+ +Tested-by: Jouni Högander +Reviewed-by: Daniele Ceraolo Spurio +Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-3-John.C.Harrison@Intel.com +(cherry picked from commit 65c08339db1ada87afd6cfe7db8e60bb4851d919) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/i915/gt/intel_ring.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_ring.c b/drivers/gpu/drm/i915/gt/intel_ring.c +index fb1d2595..fb99143b 100644 +--- a/drivers/gpu/drm/i915/gt/intel_ring.c ++++ b/drivers/gpu/drm/i915/gt/intel_ring.c +@@ -53,7 +53,7 @@ int intel_ring_pin(struct intel_ring *ring, struct i915_gem_ww_ctx *ww) + if (unlikely(ret)) + goto err_unpin; + +- if (i915_vma_is_map_and_fenceable(vma)) { ++ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915)) { + addr = (void __force *)i915_vma_pin_iomap(vma); + } else { + int type = i915_coherent_map_type(vma->vm->i915, vma->obj, false); +@@ -98,7 +98,7 @@ void intel_ring_unpin(struct intel_ring *ring) + return; + + i915_vma_unset_ggtt_write(vma); +- if (i915_vma_is_map_and_fenceable(vma)) ++ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915)) + i915_vma_unpin_iomap(vma); + else + i915_gem_object_unpin_map(vma->obj); +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-992-drm-gud-Fix-UBSAN-warning.patch b/patches.kernel.org/6.2.3-992-drm-gud-Fix-UBSAN-warning.patch new file mode 100644 index 0000000..a8d2ab7 --- /dev/null +++ b/patches.kernel.org/6.2.3-992-drm-gud-Fix-UBSAN-warning.patch @@ -0,0 +1,85 @@ +From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= +Date: Wed, 30 Nov 2022 20:26:49 +0100 +Subject: [PATCH] drm/gud: Fix UBSAN warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 951df98024f7272f85df5044eca7374f5b5b24ef + +commit 951df98024f7272f85df5044eca7374f5b5b24ef upstream. + +UBSAN complains about invalid value for bool: + +[ 101.165172] [drm] Initialized gud 1.0.0 20200422 for 2-3.2:1.0 on minor 1 +[ 101.213360] gud 2-3.2:1.0: [drm] fb1: guddrmfb frame buffer device +[ 101.213426] usbcore: registered new interface driver gud +[ 101.989431] ================================================================================ +[ 101.989441] UBSAN: invalid-load in linux/include/linux/iosys-map.h:253:9 +[ 101.989447] load of value 121 is not a valid value for type '_Bool' +[ 101.989451] CPU: 1 PID: 455 Comm: kworker/1:6 Not tainted 5.18.0-rc5-gud-5.18-rc5 #3 +[ 101.989456] Hardware name: Hewlett-Packard HP EliteBook 820 G1/1991, BIOS L71 Ver. 01.44 04/12/2018 +[ 101.989459] Workqueue: events_long gud_flush_work [gud] +[ 101.989471] Call Trace: +[ 101.989474] +[ 101.989479] dump_stack_lvl+0x49/0x5f +[ 101.989488] dump_stack+0x10/0x12 +[ 101.989493] ubsan_epilogue+0x9/0x3b +[ 101.989498] __ubsan_handle_load_invalid_value.cold+0x44/0x49 +[ 101.989504] dma_buf_vmap.cold+0x38/0x3d +[ 101.989511] ? find_busiest_group+0x48/0x300 +[ 101.989520] drm_gem_shmem_vmap+0x76/0x1b0 [drm_shmem_helper] +[ 101.989528] drm_gem_shmem_object_vmap+0x9/0xb [drm_shmem_helper] +[ 101.989535] drm_gem_vmap+0x26/0x60 [drm] +[ 101.989594] drm_gem_fb_vmap+0x47/0x150 [drm_kms_helper] +[ 101.989630] gud_prep_flush+0xc1/0x710 [gud] +[ 101.989639] ? _raw_spin_lock+0x17/0x40 +[ 101.989648] gud_flush_work+0x1e0/0x430 [gud] +[ 101.989653] ? __switch_to+0x11d/0x470 +[ 101.989664] process_one_work+0x21f/0x3f0 +[ 101.989673] worker_thread+0x200/0x3e0 +[ 101.989679] ? rescuer_thread+0x390/0x390 +[ 101.989684] kthread+0xfd/0x130 +[ 101.989690] ? kthread_complete_and_exit+0x20/0x20 +[ 101.989696] ret_from_fork+0x22/0x30 +[ 101.989706] +[ 101.989708] ================================================================================ + +The source of this warning is in iosys_map_clear() called from +dma_buf_vmap(). It conditionally sets values based on map->is_iomem. The +iosys_map variables are allocated uninitialized on the stack leading to +->is_iomem having all kinds of values and not only 0/1. + +Fix this by zeroing the iosys_map variables. + +Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver") +Cc: # v5.18+ +Reviewed-by: Javier Martinez Canillas +Reviewed-by: Thomas Zimmermann +Signed-off-by: Noralf Trønnes +Link: https://patchwork.freedesktop.org/patch/msgid/20221122-gud-shadow-plane-v2-1-435037990a83@tronnes.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/gud/gud_pipe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c +index 7c6dc2bc..61f4abaf 100644 +--- a/drivers/gpu/drm/gud/gud_pipe.c ++++ b/drivers/gpu/drm/gud/gud_pipe.c +@@ -157,8 +157,8 @@ static int gud_prep_flush(struct gud_device *gdrm, struct drm_framebuffer *fb, + { + struct dma_buf_attachment *import_attach = fb->obj[0]->import_attach; + u8 compression = gdrm->compression; +- struct iosys_map map[DRM_FORMAT_MAX_PLANES]; +- struct iosys_map map_data[DRM_FORMAT_MAX_PLANES]; ++ struct iosys_map map[DRM_FORMAT_MAX_PLANES] = { }; ++ struct iosys_map map_data[DRM_FORMAT_MAX_PLANES] = { }; + struct iosys_map dst; + void *vaddr, *buf; + size_t pitch, len; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-993-drm-edid-fix-AVI-infoframe-aspect-ratio-handlin.patch b/patches.kernel.org/6.2.3-993-drm-edid-fix-AVI-infoframe-aspect-ratio-handlin.patch new file mode 100644 index 0000000..6d0e2ae --- /dev/null +++ b/patches.kernel.org/6.2.3-993-drm-edid-fix-AVI-infoframe-aspect-ratio-handlin.patch @@ -0,0 +1,89 @@ +From: Jani Nikula +Date: Wed, 4 Jan 2023 12:05:16 +0200 +Subject: [PATCH] drm/edid: fix AVI infoframe aspect ratio handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 1cbc1f0d324ba6c4d1b10ac6362b5e0b029f63d5 + +commit 1cbc1f0d324ba6c4d1b10ac6362b5e0b029f63d5 upstream. + +We try to avoid sending VICs defined in the later specs in AVI +infoframes to sinks that conform to the earlier specs, to not upset +them, and use 0 for the VIC instead. However, we do this detection and +conversion to 0 too early, as we'll need the actual VIC to figure out +the aspect ratio. + +In particular, for a mode with 64:27 aspect ratio, 0 for VIC fails the +AVI infoframe generation altogether with -EINVAL. + +Separate the VIC lookup from the "filtering", and postpone the +filtering, to use the proper VIC for aspect ratio handling, and the 0 +VIC for the infoframe video code as needed. + +Reported-by: William Tseng +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6153 +References: https://lore.kernel.org/r/20220920062316.43162-1-william.tseng@intel.com +Cc: +Cc: Ville Syrjälä +Signed-off-by: Jani Nikula +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/c3e78cc6d01ed237f71ad0038826b08d83d75eef.1672826282.git.jani.nikula@intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_edid.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 3841aba1..23f7146e 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -6885,8 +6885,6 @@ static u8 drm_mode_hdmi_vic(const struct drm_connector *connector, + static u8 drm_mode_cea_vic(const struct drm_connector *connector, + const struct drm_display_mode *mode) + { +- u8 vic; +- + /* + * HDMI spec says if a mode is found in HDMI 1.4b 4K modes + * we should send its VIC in vendor infoframes, else send the +@@ -6896,13 +6894,18 @@ static u8 drm_mode_cea_vic(const struct drm_connector *connector, + if (drm_mode_hdmi_vic(connector, mode)) + return 0; + +- vic = drm_match_cea_mode(mode); ++ return drm_match_cea_mode(mode); ++} + +- /* +- * HDMI 1.4 VIC range: 1 <= VIC <= 64 (CEA-861-D) but +- * HDMI 2.0 VIC range: 1 <= VIC <= 107 (CEA-861-F). So we +- * have to make sure we dont break HDMI 1.4 sinks. +- */ ++/* ++ * Avoid sending VICs defined in HDMI 2.0 in AVI infoframes to sinks that ++ * conform to HDMI 1.4. ++ * ++ * HDMI 1.4 (CTA-861-D) VIC range: [1..64] ++ * HDMI 2.0 (CTA-861-F) VIC range: [1..107] ++ */ ++static u8 vic_for_avi_infoframe(const struct drm_connector *connector, u8 vic) ++{ + if (!is_hdmi2_sink(connector) && vic > 64) + return 0; + +@@ -6978,7 +6981,7 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame, + picture_aspect = HDMI_PICTURE_ASPECT_NONE; + } + +- frame->video_code = vic; ++ frame->video_code = vic_for_avi_infoframe(connector, vic); + frame->picture_aspect = picture_aspect; + frame->active_aspect = HDMI_ACTIVE_ASPECT_PICTURE; + frame->scan_mode = HDMI_SCAN_MODE_UNDERSCAN; +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-994-drm-edid-fix-parsing-of-3D-modes-from-HDMI-VSDB.patch b/patches.kernel.org/6.2.3-994-drm-edid-fix-parsing-of-3D-modes-from-HDMI-VSDB.patch new file mode 100644 index 0000000..ddc057a --- /dev/null +++ b/patches.kernel.org/6.2.3-994-drm-edid-fix-parsing-of-3D-modes-from-HDMI-VSDB.patch @@ -0,0 +1,85 @@ +From: Jani Nikula +Date: Wed, 4 Jan 2023 12:05:17 +0200 +Subject: [PATCH] drm/edid: fix parsing of 3D modes from HDMI VSDB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 72794d16bd535a984e6653a18f5862405b49b5f9 + +commit 72794d16bd535a984e6653a18f5862405b49b5f9 upstream. + +Commit 537d9ed2f6c1 ("drm/edid: convert add_cea_modes() to use cea db +iter") inadvertently moved the do_hdmi_vsdb_modes() call within the db +iteration loop, always passing NULL as the CTA VDB to +do_hdmi_vsdb_modes(), skipping a lot of stereo modes. + +Move the call back outside of the loop. + +This does mean only one CTA VDB and HDMI VSDB combination will be +handled, but it's an unlikely scenario to have more than one of either +block, and it was not accounted for before the regression either. + +Fixes: 537d9ed2f6c1 ("drm/edid: convert add_cea_modes() to use cea db iter") +Cc: # v6.0+ +Cc: Ville Syrjälä +Signed-off-by: Jani Nikula +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/cf159b8816191ed595a3cb954acaf189c4528cc7.1672826282.git.jani.nikula@intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/gpu/drm/drm_edid.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 23f7146e..b94adb9b 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -5249,13 +5249,12 @@ static int add_cea_modes(struct drm_connector *connector, + { + const struct cea_db *db; + struct cea_db_iter iter; ++ const u8 *hdmi = NULL, *video = NULL; ++ u8 hdmi_len = 0, video_len = 0; + int modes = 0; + + cea_db_iter_edid_begin(drm_edid, &iter); + cea_db_iter_for_each(db, &iter) { +- const u8 *hdmi = NULL, *video = NULL; +- u8 hdmi_len = 0, video_len = 0; +- + if (cea_db_tag(db) == CTA_DB_VIDEO) { + video = cea_db_data(db); + video_len = cea_db_payload_len(db); +@@ -5271,18 +5270,17 @@ static int add_cea_modes(struct drm_connector *connector, + modes += do_y420vdb_modes(connector, vdb420, + cea_db_payload_len(db) - 1); + } +- +- /* +- * We parse the HDMI VSDB after having added the cea modes as we +- * will be patching their flags when the sink supports stereo +- * 3D. +- */ +- if (hdmi) +- modes += do_hdmi_vsdb_modes(connector, hdmi, hdmi_len, +- video, video_len); + } + cea_db_iter_end(&iter); + ++ /* ++ * We parse the HDMI VSDB after having added the cea modes as we will be ++ * patching their flags when the sink supports stereo 3D. ++ */ ++ if (hdmi) ++ modes += do_hdmi_vsdb_modes(connector, hdmi, hdmi_len, ++ video, video_len); ++ + return modes; + } + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-995-qede-avoid-uninitialized-entries-in-coal_entry-.patch b/patches.kernel.org/6.2.3-995-qede-avoid-uninitialized-entries-in-coal_entry-.patch new file mode 100644 index 0000000..f8e334e --- /dev/null +++ b/patches.kernel.org/6.2.3-995-qede-avoid-uninitialized-entries-in-coal_entry-.patch @@ -0,0 +1,82 @@ +From: Michal Schmidt +Date: Fri, 24 Feb 2023 01:41:45 +0100 +Subject: [PATCH] qede: avoid uninitialized entries in coal_entry array +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: aaa3c08ee0653beaa649d4adfb27ad562641cfd8 + +commit aaa3c08ee0653beaa649d4adfb27ad562641cfd8 upstream. + +Even after commit 908d4bb7c54c ("qede: fix interrupt coalescing +configuration"), some entries of the coal_entry array may theoretically +be used uninitialized: + + 1. qede_alloc_fp_array() allocates QEDE_MAX_RSS_CNT entries for + coal_entry. The initial allocation uses kcalloc, so everything is + initialized. + 2. The user sets a small number of queues (ethtool -L). + coal_entry is reallocated for the actual small number of queues. + 3. The user sets a bigger number of queues. + coal_entry is reallocated bigger. The added entries are not + necessarily initialized. + +In practice, the reallocations will actually keep using the originally +allocated region of memory, but we should not rely on it. + +The reallocation is unnecessary. coal_entry can always have +QEDE_MAX_RSS_CNT entries. + +Fixes: 908d4bb7c54c ("qede: fix interrupt coalescing configuration") +Signed-off-by: Michal Schmidt +Nacked-by: Manish Chopra +Acked-by: Manish Chopra +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/qlogic/qede/qede_main.c | 21 +++++++------------- + 1 file changed, 7 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index af39513d..89d64a5a 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -960,7 +960,6 @@ static int qede_alloc_fp_array(struct qede_dev *edev) + { + u8 fp_combined, fp_rx = edev->fp_num_rx; + struct qede_fastpath *fp; +- void *mem; + int i; + + edev->fp_array = kcalloc(QEDE_QUEUE_CNT(edev), +@@ -971,20 +970,14 @@ static int qede_alloc_fp_array(struct qede_dev *edev) + } + + if (!edev->coal_entry) { +- mem = kcalloc(QEDE_MAX_RSS_CNT(edev), +- sizeof(*edev->coal_entry), GFP_KERNEL); +- } else { +- mem = krealloc(edev->coal_entry, +- QEDE_QUEUE_CNT(edev) * sizeof(*edev->coal_entry), +- GFP_KERNEL); +- } +- +- if (!mem) { +- DP_ERR(edev, "coalesce entry allocation failed\n"); +- kfree(edev->coal_entry); +- goto err; ++ edev->coal_entry = kcalloc(QEDE_MAX_RSS_CNT(edev), ++ sizeof(*edev->coal_entry), ++ GFP_KERNEL); ++ if (!edev->coal_entry) { ++ DP_ERR(edev, "coalesce entry allocation failed\n"); ++ goto err; ++ } + } +- edev->coal_entry = mem; + + fp_combined = QEDE_QUEUE_CNT(edev) - fp_rx - edev->fp_num_tx; + +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-996-brd-use-radix_tree_maybe_preload-instead-of-rad.patch b/patches.kernel.org/6.2.3-996-brd-use-radix_tree_maybe_preload-instead-of-rad.patch new file mode 100644 index 0000000..c223c6c --- /dev/null +++ b/patches.kernel.org/6.2.3-996-brd-use-radix_tree_maybe_preload-instead-of-rad.patch @@ -0,0 +1,54 @@ +From: Pankaj Raghav +Date: Fri, 17 Feb 2023 17:44:44 +0530 +Subject: [PATCH] brd: use radix_tree_maybe_preload instead of + radix_tree_preload +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 0aa2988e4fd23c0c8b33999d7b47dfbc5e6bf24b + +commit 0aa2988e4fd23c0c8b33999d7b47dfbc5e6bf24b upstream. + +Unconditionally calling radix_tree_preload_end() results in a OOPS +message as the preload is only conditionally called for +gfpflags_allow_blocking(). + +[ 20.267323] BUG: using smp_processor_id() in preemptible [00000000] code: fio/416 +[ 20.267837] caller is brd_insert_page.part.0+0xbe/0x190 [brd] +[ 20.269436] Call Trace: +[ 20.269598] +[ 20.269742] dump_stack_lvl+0x32/0x50 +[ 20.269982] check_preemption_disabled+0xd1/0xe0 +[ 20.270289] brd_insert_page.part.0+0xbe/0x190 [brd] +[ 20.270664] brd_submit_bio+0x33f/0xf40 [brd] + +Use radix_tree_maybe_preload() which does preload only if +gfpflags_allow_blocking() is true but also takes the lock. Therefore, +unconditionally calling radix_tree_preload_end() should not create any +issues and the message disappears. + +Fixes: 6ded703c56c2 ("brd: check for REQ_NOWAIT and set correct page allocation mask") +Signed-off-by: Pankaj Raghav +Link: https://lore.kernel.org/r/20230217121442.33914-1-p.raghav@samsung.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/block/brd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index 740631dc..a8a77a1e 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -94,7 +94,7 @@ static int brd_insert_page(struct brd_device *brd, sector_t sector, gfp_t gfp) + if (!page) + return -ENOMEM; + +- if (gfpflags_allow_blocking(gfp) && radix_tree_preload(gfp)) { ++ if (radix_tree_maybe_preload(gfp)) { + __free_page(page); + return -ENOMEM; + } +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-997-net-avoid-double-iput-when-sock_alloc_file-fail.patch b/patches.kernel.org/6.2.3-997-net-avoid-double-iput-when-sock_alloc_file-fail.patch new file mode 100644 index 0000000..d9ab33d --- /dev/null +++ b/patches.kernel.org/6.2.3-997-net-avoid-double-iput-when-sock_alloc_file-fail.patch @@ -0,0 +1,105 @@ +From: Thadeu Lima de Souza Cascardo +Date: Tue, 7 Mar 2023 14:37:07 -0300 +Subject: [PATCH] net: avoid double iput when sock_alloc_file fails +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: 649c15c7691e9b13cbe9bf6c65c365350e056067 + +commit 649c15c7691e9b13cbe9bf6c65c365350e056067 upstream. + +When sock_alloc_file fails to allocate a file, it will call sock_release. +__sys_socket_file should then not call sock_release again, otherwise there +will be a double free. + +[ 89.319884] ------------[ cut here ]------------ +[ 89.320286] kernel BUG at fs/inode.c:1764! +[ 89.320656] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI +[ 89.321051] CPU: 7 PID: 125 Comm: iou-sqp-124 Not tainted 6.2.0+ #361 +[ 89.321535] RIP: 0010:iput+0x1ff/0x240 +[ 89.321808] Code: d1 83 e1 03 48 83 f9 02 75 09 48 81 fa 00 10 00 00 77 05 83 e2 01 75 1f 4c 89 ef e8 fb d2 ba 00 e9 80 fe ff ff c3 cc cc cc cc <0f> 0b 0f 0b e9 d0 fe ff ff 0f 0b eb 8d 49 8d b4 24 08 01 00 00 48 +[ 89.322760] RSP: 0018:ffffbdd60068bd50 EFLAGS: 00010202 +[ 89.323036] RAX: 0000000000000000 RBX: ffff9d7ad3cacac0 RCX: 0000000000001107 +[ 89.323412] RDX: 000000000003af00 RSI: 0000000000000000 RDI: ffff9d7ad3cacb40 +[ 89.323785] RBP: ffffbdd60068bd68 R08: ffffffffffffffff R09: ffffffffab606438 +[ 89.324157] R10: ffffffffacb3dfa0 R11: 6465686361657256 R12: ffff9d7ad3cacb40 +[ 89.324529] R13: 0000000080000001 R14: 0000000080000001 R15: 0000000000000002 +[ 89.324904] FS: 00007f7b28516740(0000) GS:ffff9d7aeb1c0000(0000) knlGS:0000000000000000 +[ 89.325328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 89.325629] CR2: 00007f0af52e96c0 CR3: 0000000002a02006 CR4: 0000000000770ee0 +[ 89.326004] PKRU: 55555554 +[ 89.326161] Call Trace: +[ 89.326298] +[ 89.326419] __sock_release+0xb5/0xc0 +[ 89.326632] __sys_socket_file+0xb2/0xd0 +[ 89.326844] io_socket+0x88/0x100 +[ 89.327039] ? io_issue_sqe+0x6a/0x430 +[ 89.327258] io_issue_sqe+0x67/0x430 +[ 89.327450] io_submit_sqes+0x1fe/0x670 +[ 89.327661] io_sq_thread+0x2e6/0x530 +[ 89.327859] ? __pfx_autoremove_wake_function+0x10/0x10 +[ 89.328145] ? __pfx_io_sq_thread+0x10/0x10 +[ 89.328367] ret_from_fork+0x29/0x50 +[ 89.328576] RIP: 0033:0x0 +[ 89.328732] Code: Unable to access opcode bytes at 0xffffffffffffffd6. +[ 89.329073] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 +[ 89.329477] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f7b28637a3d +[ 89.329845] RDX: 00007fff4e4318a8 RSI: 00007fff4e4318b0 RDI: 0000000000000400 +[ 89.330216] RBP: 00007fff4e431830 R08: 00007fff4e431711 R09: 00007fff4e4318b0 +[ 89.330584] R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff4e441b38 +[ 89.330950] R13: 0000563835e3e725 R14: 0000563835e40d10 R15: 00007f7b28784040 +[ 89.331318] +[ 89.331441] Modules linked in: +[ 89.331617] ---[ end trace 0000000000000000 ]--- + +Fixes: da214a475f8b ("net: add __sys_socket_file()") +Signed-off-by: Thadeu Lima de Souza Cascardo +Reviewed-by: Jens Axboe +Reviewed-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20230307173707.468744-1-cascardo@canonical.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + net/socket.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/net/socket.c b/net/socket.c +index c12af3c8..b4cdc576 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -449,7 +449,9 @@ static struct file_system_type sock_fs_type = { + * + * Returns the &file bound with @sock, implicitly storing it + * in sock->file. If dname is %NULL, sets to "". +- * On failure the return is a ERR pointer (see linux/err.h). ++ * ++ * On failure @sock is released, and an ERR pointer is returned. ++ * + * This function uses GFP_KERNEL internally. + */ + +@@ -1613,7 +1615,6 @@ static struct socket *__sys_socket_create(int family, int type, int protocol) + struct file *__sys_socket_file(int family, int type, int protocol) + { + struct socket *sock; +- struct file *file; + int flags; + + sock = __sys_socket_create(family, type, protocol); +@@ -1624,11 +1625,7 @@ struct file *__sys_socket_file(int family, int type, int protocol) + if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK)) + flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK; + +- file = sock_alloc_file(sock, flags, NULL); +- if (IS_ERR(file)) +- sock_release(sock); +- +- return file; ++ return sock_alloc_file(sock, flags, NULL); + } + + int __sys_socket(int family, int type, int protocol) +-- +2.35.3 + diff --git a/patches.kernel.org/6.2.3-998-Linux-6.2.3.patch b/patches.kernel.org/6.2.3-998-Linux-6.2.3.patch new file mode 100644 index 0000000..9d56ed7 --- /dev/null +++ b/patches.kernel.org/6.2.3-998-Linux-6.2.3.patch @@ -0,0 +1,45 @@ +From: Greg Kroah-Hartman +Date: Fri, 10 Mar 2023 09:29:57 +0100 +Subject: [PATCH] Linux 6.2.3 +References: bsc#1012628 +Patch-mainline: 6.2.3 +Git-commit: cdc56cf3e0ca6bd3119fc841de1c37b0e6e5b802 + +Link: https://lore.kernel.org/r/20230307170022.094103862@linuxfoundation.org +Tested-by: Ronald Warsow +Tested-by: Luna Jernberg +Tested-by: Ron Economos +Tested-by: Conor Dooley +Tested-by: Bagas Sanjaya +Link: https://lore.kernel.org/r/20230308091912.362228731@linuxfoundation.org +Tested-by: Luna Jernberg +Tested-by: Ronald Warsow +Tested-by: Justin M. Forbes +Tested-by: Ron Economos +Tested-by: Florian Fainelli +Tested-by: Bagas Sanjaya +Tested-by: Linux Kernel Functional Testing +Tested-by: Jiri Slaby +Tested-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 1836ddaf..eef164b4 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 2 +-SUBLEVEL = 2 ++SUBLEVEL = 3 + EXTRAVERSION = + NAME = Hurr durr I'ma ninja sloth + +-- +2.35.3 + diff --git a/patches.rpmify/bpf_doc-Fix-build-error-with-older-python-versions.patch b/patches.rpmify/bpf_doc-Fix-build-error-with-older-python-versions.patch deleted file mode 100644 index eecfb83..0000000 --- a/patches.rpmify/bpf_doc-Fix-build-error-with-older-python-versions.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 5fbea42387eba1c7517fcad79099df706def7054 Mon Sep 17 00:00:00 2001 -From: Michal Suchanek -Date: Mon, 9 Jan 2023 12:34:42 +0100 -Subject: [PATCH] bpf_doc: Fix build error with older python versions - -References: TypeError: '_sre.SRE_Match' object is not subscriptable -Patch-mainline: queued -Git-commit: 5fbea42387eba1c7517fcad79099df706def7054 -Git-repo: https://git.kernel.org/bpf/bpf-next - -The ability to subscript match result as an array is only available -since python 3.6. Existing code in bpf_doc uses the older group() -interface but commit 8a76145a2ec2 adds code using the new interface. - -Use the old interface consistently to avoid build error on older -distributions like the below: - -+ make -j48 -s -C /dev/shm/kbuild/linux.33946/current ARCH=powerpc HOSTCC=gcc CROSS_COMPILE=powerpc64-suse-linux- clean -TypeError: '_sre.SRE_Match' object is not subscriptable - -Fixes: 8a76145a2ec2 ("bpf: explicitly define BPF_FUNC_xxx integer values") -Signed-off-by: Michal Suchanek -Signed-off-by: Andrii Nakryiko -Acked-by: Quentin Monnet -Link: https://lore.kernel.org/bpf/20230109113442.20946-1-msuchanek@suse.de -Acked-by: Michal Suchanek ---- - scripts/bpf_doc.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/scripts/bpf_doc.py b/scripts/bpf_doc.py -index e8d90829f23e..38d51e05c7a2 100755 ---- a/scripts/bpf_doc.py -+++ b/scripts/bpf_doc.py -@@ -271,7 +271,7 @@ class HeaderParser(object): - if capture: - fn_defines_str += self.line - helper_name = capture.expand(r'bpf_\1') -- self.helper_enum_vals[helper_name] = int(capture[2]) -+ self.helper_enum_vals[helper_name] = int(capture.group(2)) - self.helper_enum_pos[helper_name] = i - i += 1 - else: --- -2.35.3 - diff --git a/series.conf b/series.conf index d52326e..d29bedf 100644 --- a/series.conf +++ b/series.conf @@ -57,6 +57,1004 @@ patches.kernel.org/6.2.2-015-usb-typec-pd-Remove-usb_suspend_supported-sysfs.patch patches.kernel.org/6.2.2-016-USB-core-Don-t-hold-device-lock-while-reading-t.patch patches.kernel.org/6.2.2-017-Linux-6.2.2.patch + patches.kernel.org/6.2.3-001-HID-asus-use-spinlock-to-protect-concurrent-acc.patch + patches.kernel.org/6.2.3-002-HID-asus-use-spinlock-to-safely-schedule-worker.patch + patches.kernel.org/6.2.3-003-iommu-amd-Fix-error-handling-for-pdev_pri_ats_e.patch + patches.kernel.org/6.2.3-004-iommu-amd-Skip-attach-device-domain-is-same-as-.patch + patches.kernel.org/6.2.3-005-iommu-amd-Improve-page-fault-error-reporting.patch + patches.kernel.org/6.2.3-006-iommu-Attach-device-group-to-old-domain-in-erro.patch + patches.kernel.org/6.2.3-007-powerpc-mm-Rearrange-if-else-block-to-avoid-cla.patch + patches.kernel.org/6.2.3-008-ata-ahci-Revert-ata-ahci-Add-Tiger-Lake-UP-3-4-.patch + patches.kernel.org/6.2.3-009-ARM-OMAP2-Fix-memory-leak-in-realtime_counter_i.patch + patches.kernel.org/6.2.3-010-arm64-dts-qcom-qcs404-use-symbol-names-for-PCIe.patch + patches.kernel.org/6.2.3-011-arm64-dts-qcom-msm8996-tone-Fix-USB-taking-6-mi.patch + patches.kernel.org/6.2.3-012-arm64-dts-qcom-sm6115-Fix-UFS-node.patch + patches.kernel.org/6.2.3-013-arm64-dts-qcom-sm6115-Provide-xo-clk-to-rpmcc.patch + patches.kernel.org/6.2.3-014-arm64-dts-qcom-sm8150-kumano-Panel-framebuffer-.patch + patches.kernel.org/6.2.3-015-arm64-dts-qcom-pmi8950-Correct-rev_1250v-channe.patch + patches.kernel.org/6.2.3-016-arm64-dts-qcom-sm6350-Fix-up-the-ramoops-node.patch + patches.kernel.org/6.2.3-017-arm64-dts-qcom-sdm670-google-sargo-keep-pm660-l.patch + patches.kernel.org/6.2.3-018-arm64-dts-qcom-Re-enable-resin-on-MSM8998-and-S.patch + patches.kernel.org/6.2.3-019-arm64-dts-qcom-sm8350-sagami-Configure-SLG51000.patch + patches.kernel.org/6.2.3-020-arm64-dts-qcom-sm8350-sagami-Add-GPIO-line-name.patch + patches.kernel.org/6.2.3-021-arm64-dts-qcom-sm8350-sagami-Rectify-GPIO-keys.patch + patches.kernel.org/6.2.3-022-arm64-dts-qcom-sm6350-lena-Flatten-gpio-keys-pi.patch + patches.kernel.org/6.2.3-023-arm64-dts-qcom-sm6125-Reorder-HSUSB-PHY-clocks-.patch + patches.kernel.org/6.2.3-024-arm64-dts-qcom-sm6125-seine-Clean-up-gpio-keys-.patch + patches.kernel.org/6.2.3-025-arm64-dts-imx8m-Align-SoC-unique-ID-node-unit-a.patch + patches.kernel.org/6.2.3-026-ARM-zynq-Fix-refcount-leak-in-zynq_early_slcr_i.patch + patches.kernel.org/6.2.3-027-fs-dlm-fix-return-value-check-in-dlm_memory_ini.patch + patches.kernel.org/6.2.3-028-arm64-dts-mediatek-mt8195-Add-power-domain-to-U.patch + patches.kernel.org/6.2.3-029-arm64-dts-mediatek-mt8183-Fix-systimer-13-MHz-c.patch + patches.kernel.org/6.2.3-030-arm64-dts-mediatek-mt8192-Fix-systimer-13-MHz-c.patch + patches.kernel.org/6.2.3-031-arm64-dts-mediatek-mt8195-Fix-systimer-13-MHz-c.patch + patches.kernel.org/6.2.3-032-arm64-dts-mediatek-mt8186-Fix-systimer-13-MHz-c.patch + patches.kernel.org/6.2.3-033-arm64-dts-qcom-sdm845-db845c-fix-audio-codec-in.patch + patches.kernel.org/6.2.3-034-arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-audi.patch + patches.kernel.org/6.2.3-035-x86-acpi-boot-Do-not-register-processors-that-c.patch + patches.kernel.org/6.2.3-036-arm64-dts-qcom-sc7180-correct-SPMI-bus-address-.patch + patches.kernel.org/6.2.3-037-arm64-dts-qcom-sc7280-correct-SPMI-bus-address-.patch + patches.kernel.org/6.2.3-038-arm64-dts-qcom-sc8280xp-correct-SPMI-bus-addres.patch + patches.kernel.org/6.2.3-039-arm64-dts-qcom-sm8450-correct-Soundwire-wakeup-.patch + patches.kernel.org/6.2.3-040-arm64-dts-qcom-sdm845-make-DP-node-follow-the-s.patch + patches.kernel.org/6.2.3-041-arm64-dts-qcom-msm8996-oneplus-common-drop-vdda.patch + patches.kernel.org/6.2.3-042-arm64-dts-qcom-sc8280xp-Vote-for-CX-in-USB-cont.patch + patches.kernel.org/6.2.3-043-arm64-dts-meson-gxl-jethub-j80-Fix-WiFi-MAC-add.patch + patches.kernel.org/6.2.3-044-arm64-dts-meson-gxl-jethub-j80-Fix-Bluetooth-MA.patch + patches.kernel.org/6.2.3-045-arm64-dts-meson-axg-jethub-j1xx-Fix-MAC-address.patch + patches.kernel.org/6.2.3-046-arm64-dts-meson-gx-Fix-Ethernet-MAC-address-uni.patch + patches.kernel.org/6.2.3-047-arm64-dts-meson-g12a-Fix-internal-Ethernet-PHY-.patch + patches.kernel.org/6.2.3-048-arm64-dts-meson-gx-Fix-the-SCPI-DVFS-node-name-.patch + patches.kernel.org/6.2.3-049-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_IRQ_ENABLE-.patch + patches.kernel.org/6.2.3-050-arm64-dts-ti-k3-am62-main-Fix-clocks-for-McSPI.patch + patches.kernel.org/6.2.3-051-arm64-tegra-Fix-duplicate-regulator-on-Jetson-T.patch + patches.kernel.org/6.2.3-052-arm64-dts-qcom-msm8992-bullhead-Fix-cont_splash.patch + patches.kernel.org/6.2.3-053-arm64-dts-qcom-msm8992-bullhead-Disable-dfps_da.patch + patches.kernel.org/6.2.3-054-arm64-dts-qcom-msm8956-use-SoC-specific-compat-.patch + patches.kernel.org/6.2.3-055-arm64-dts-qcom-ipq8074-correct-USB3-QMP-PHY-s-c.patch + patches.kernel.org/6.2.3-056-arm64-dts-qcom-ipq8074-fix-Gen2-PCIe-QMP-PHY.patch + patches.kernel.org/6.2.3-057-arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-QMP-PHY.patch + patches.kernel.org/6.2.3-058-arm64-dts-qcom-ipq8074-correct-Gen2-PCIe-ranges.patch + patches.kernel.org/6.2.3-059-arm64-dts-qcom-ipq8074-fix-Gen3-PCIe-node.patch + patches.kernel.org/6.2.3-060-arm64-dts-qcom-ipq8074-correct-PCIe-QMP-PHY-out.patch + patches.kernel.org/6.2.3-061-arm64-dts-meson-remove-CPU-opps-below-1GHz-for-.patch + patches.kernel.org/6.2.3-062-ARM-OMAP1-call-platform_device_put-in-error-cas.patch + patches.kernel.org/6.2.3-063-arm64-dts-mediatek-mt8192-Mark-scp_adsp-clock-a.patch + patches.kernel.org/6.2.3-064-ARM-bcm2835_defconfig-Enable-the-framebuffer.patch + patches.kernel.org/6.2.3-065-ARM-s3c-fix-s3c64xx_set_timer_source-prototype.patch + patches.kernel.org/6.2.3-066-arm64-dts-ti-k3-j7200-Fix-wakeup-pinmux-range.patch + patches.kernel.org/6.2.3-067-ARM-dts-exynos-correct-wr-active-property-in-Ex.patch + patches.kernel.org/6.2.3-068-ARM-imx-Call-ida_simple_remove-for-ida_simple_g.patch + patches.kernel.org/6.2.3-069-arm64-dts-amlogic-meson-gx-fix-SCPI-clock-dvfs-.patch + patches.kernel.org/6.2.3-070-arm64-dts-amlogic-meson-axg-fix-SCPI-clock-dvfs.patch + patches.kernel.org/6.2.3-071-arm64-dts-amlogic-meson-gx-add-missing-SCPI-sen.patch + patches.kernel.org/6.2.3-072-arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx.patch + patches.kernel.org/6.2.3-073-arm64-dts-amlogic-meson-gxl-s905d-sml5442tw-dro.patch + patches.kernel.org/6.2.3-074-arm64-dts-amlogic-meson-gx-add-missing-unit-add.patch + patches.kernel.org/6.2.3-075-arm64-dts-amlogic-meson-gxl-s905w-jethome-jethu.patch + patches.kernel.org/6.2.3-076-arm64-dts-amlogic-meson-axg-jethome-jethub-j1xx.patch + patches.kernel.org/6.2.3-077-arm64-dts-amlogic-meson-gxl-add-missing-unit-ad.patch + patches.kernel.org/6.2.3-078-arm64-dts-amlogic-meson-gx-libretech-pc-fix-upd.patch + patches.kernel.org/6.2.3-079-arm64-dts-amlogic-meson-sm1-bananapi-m5-fix-adc.patch + patches.kernel.org/6.2.3-080-arm64-dts-amlogic-meson-gxl-s905d-phicomm-n1-fi.patch + patches.kernel.org/6.2.3-081-arm64-dts-amlogic-meson-gxbb-kii-pro-fix-led-no.patch + patches.kernel.org/6.2.3-082-arm64-dts-amlogic-meson-g12b-odroid-go-ultra-fi.patch + patches.kernel.org/6.2.3-083-arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-acti.patch + patches.kernel.org/6.2.3-084-locking-rwsem-Disable-preemption-in-all-down_re.patch + patches.kernel.org/6.2.3-085-arm64-tegra-Mark-host1x-as-dma-coherent-on-Tegr.patch + patches.kernel.org/6.2.3-086-arm64-dts-renesas-beacon-renesom-Fix-gpio-expan.patch + patches.kernel.org/6.2.3-087-arm64-dts-meson-radxa-zero-allow-usb-otg-mode.patch + patches.kernel.org/6.2.3-088-arm64-dts-meson-bananapi-m5-switch-VDDIO_C-pin-.patch + patches.kernel.org/6.2.3-089-ARM-dts-sun8i-nanopi-duo2-Fix-regulator-GPIO-re.patch + patches.kernel.org/6.2.3-090-ublk_drv-remove-nr_aborted_queues-from-ublk_dev.patch + patches.kernel.org/6.2.3-091-ublk_drv-don-t-probe-partitions-if-the-ubq-daem.patch + patches.kernel.org/6.2.3-092-ARM-dts-imx7s-correct-iomuxc-gpr-mux-controller.patch + patches.kernel.org/6.2.3-093-sbitmap-remove-redundant-check-in-__sbitmap_que.patch + patches.kernel.org/6.2.3-094-sbitmap-correct-wake_batch-recalculation-to-avo.patch + patches.kernel.org/6.2.3-095-arm64-dts-mt8195-Fix-CPU-map-for-single-cluster.patch + patches.kernel.org/6.2.3-096-arm64-dts-mt8192-Fix-CPU-map-for-single-cluster.patch + patches.kernel.org/6.2.3-097-arm64-dts-mt8186-Fix-CPU-map-for-single-cluster.patch + patches.kernel.org/6.2.3-098-arm64-dts-mediatek-mt7622-Add-missing-pwm-cells.patch + patches.kernel.org/6.2.3-099-arm64-dts-mediatek-mt8186-Fix-watchdog-compatib.patch + patches.kernel.org/6.2.3-100-arm64-dts-mediatek-mt8195-Fix-watchdog-compatib.patch + patches.kernel.org/6.2.3-101-arm64-dts-mediatek-mt7986-Fix-watchdog-compatib.patch + patches.kernel.org/6.2.3-102-ARM-dts-stm32-Update-part-number-NVMEM-descript.patch + patches.kernel.org/6.2.3-103-arm64-dts-qcom-sm8450-nagara-Correct-firmware-p.patch + patches.kernel.org/6.2.3-104-blk-mq-avoid-sleep-in-blk_mq_alloc_request_hctx.patch + patches.kernel.org/6.2.3-105-blk-mq-remove-stale-comment-for-blk_mq_sched_ma.patch + patches.kernel.org/6.2.3-106-blk-mq-wait-on-correct-sbitmap_queue-in-blk_mq_.patch + patches.kernel.org/6.2.3-107-blk-mq-Fix-potential-io-hung-for-shared-sbitmap.patch + patches.kernel.org/6.2.3-108-blk-mq-correct-stale-comment-of-.get_budget.patch + patches.kernel.org/6.2.3-109-arm64-dts-qcom-msm8996-support-using-GPLL0-as-k.patch + patches.kernel.org/6.2.3-110-arm64-dts-qcom-msm8996-switch-from-RPM_SMD_BB_C.patch + patches.kernel.org/6.2.3-111-arm64-dts-qcom-sm8350-drop-incorrect-cells-from.patch + patches.kernel.org/6.2.3-112-arm64-dts-qcom-sm8450-drop-incorrect-cells-from.patch + patches.kernel.org/6.2.3-113-arm64-dts-qcom-msm8992-lg-bullhead-Correct-memo.patch + patches.kernel.org/6.2.3-114-arm64-dts-qcom-msm8953-correct-TLMM-gpio-ranges.patch + patches.kernel.org/6.2.3-115-arm64-dts-qcom-sm6115-correct-TLMM-gpio-ranges.patch + patches.kernel.org/6.2.3-116-arm64-dts-qcom-msm8992-lg-bullhead-Enable-regul.patch + patches.kernel.org/6.2.3-117-s390-dasd-Fix-potential-memleak-in-dasd_eckd_in.patch + patches.kernel.org/6.2.3-118-io_uring-audit-don-t-log-IORING_OP_MADVISE.patch + patches.kernel.org/6.2.3-119-sched-rt-pick_next_rt_entity-check-list_entry.patch + patches.kernel.org/6.2.3-120-perf-x86-intel-ds-Fix-the-conversion-from-TSC-t.patch + patches.kernel.org/6.2.3-121-x86-perf-zhaoxin-Add-stepping-check-for-ZXC.patch + patches.kernel.org/6.2.3-122-KEYS-asymmetric-Fix-ECDSA-use-via-keyctl-uapi.patch + patches.kernel.org/6.2.3-123-block-ublk-check-IO-buffer-based-on-flag-need_g.patch + patches.kernel.org/6.2.3-124-arm64-dts-qcom-pmk8350-Use-the-correct-PON-comp.patch + patches.kernel.org/6.2.3-125-erofs-relinquish-volume-with-mutex-held.patch + patches.kernel.org/6.2.3-126-block-sync-mixed-merged-request-s-failfast-with.patch + patches.kernel.org/6.2.3-127-block-Fix-io-statistics-for-cgroup-in-throttle-.patch + patches.kernel.org/6.2.3-128-block-bio-integrity-Copy-flags-when-bio_integri.patch + patches.kernel.org/6.2.3-129-block-use-proper-return-value-from-bio_failfast.patch + patches.kernel.org/6.2.3-130-wifi-mt76-mt7915-add-missing-of_node_put.patch + patches.kernel.org/6.2.3-131-wifi-mt76-mt7921s-fix-slab-out-of-bounds-access.patch + patches.kernel.org/6.2.3-132-wifi-mt76-mt7915-fix-mt7915_rate_txpower_get-re.patch + patches.kernel.org/6.2.3-133-wifi-mt76-mt7996-fix-insecure-data-handling-of-.patch + patches.kernel.org/6.2.3-134-wifi-mt76-mt7996-fix-insecure-data-handling-of-.patch + patches.kernel.org/6.2.3-135-wifi-mt76-mt7996-fix-integer-handling-issue-of-.patch + patches.kernel.org/6.2.3-136-wifi-mt76-mt7915-check-return-value-before-acce.patch + patches.kernel.org/6.2.3-137-wifi-mt76-mt7996-check-return-value-before-acce.patch + patches.kernel.org/6.2.3-138-wifi-mt76-mt7915-drop-always-true-condition-of-.patch + patches.kernel.org/6.2.3-139-wifi-mt76-mt7996-drop-always-true-condition-of-.patch + patches.kernel.org/6.2.3-140-wifi-mt76-mt7996-fix-endianness-warning-in-mt79.patch + patches.kernel.org/6.2.3-141-wifi-mt76-mt76x0-fix-oob-access-in-mt76x0_phy_g.patch + patches.kernel.org/6.2.3-142-wifi-mt76-mt7996-fix-unintended-sign-extension-.patch + patches.kernel.org/6.2.3-143-wifi-mt76-mt7915-fix-unintended-sign-extension-.patch + patches.kernel.org/6.2.3-144-wifi-mt76-fix-coverity-uninit_use_in_call-in-mt.patch + patches.kernel.org/6.2.3-145-wifi-mt76-mt7921-resource-leaks-at-mt7921_check.patch + patches.kernel.org/6.2.3-146-wifi-rsi-Fix-memory-leak-in-rsi_coex_attach.patch + patches.kernel.org/6.2.3-147-wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-und.patch + patches.kernel.org/6.2.3-148-wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-und.patch + patches.kernel.org/6.2.3-149-wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-und.patch + patches.kernel.org/6.2.3-150-wifi-iwlegacy-common-don-t-call-dev_kfree_skb-u.patch + patches.kernel.org/6.2.3-151-wifi-libertas-fix-memory-leak-in-lbs_init_adapt.patch + patches.kernel.org/6.2.3-152-wifi-rtl8xxxu-Fix-assignment-to-bit-field-priv-.patch + patches.kernel.org/6.2.3-153-wifi-rtl8xxxu-Fix-assignment-to-bit-field-priv-.patch + patches.kernel.org/6.2.3-154-wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-sp.patch + patches.kernel.org/6.2.3-155-wifi-rtw89-8852c-rfk-correct-DACK-setting.patch + patches.kernel.org/6.2.3-156-wifi-rtw89-8852c-rfk-correct-DPK-settings.patch + patches.kernel.org/6.2.3-157-wifi-rtlwifi-Fix-global-out-of-bounds-bug-in-_r.patch + patches.kernel.org/6.2.3-158-libbpf-Fix-single-line-struct-definition-output.patch + patches.kernel.org/6.2.3-159-libbpf-Fix-btf__align_of-by-taking-into-account.patch + patches.kernel.org/6.2.3-160-wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spi.patch + patches.kernel.org/6.2.3-161-wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch + patches.kernel.org/6.2.3-162-wifi-wilc1000-fix-potential-memory-leak-in-wilc.patch + patches.kernel.org/6.2.3-163-wifi-wilc1000-add-missing-unregister_netdev-in-.patch + patches.kernel.org/6.2.3-164-wifi-brcmfmac-fix-potential-memory-leak-in-brcm.patch + patches.kernel.org/6.2.3-165-wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_.patch + patches.kernel.org/6.2.3-166-wifi-libertas_tf-don-t-call-kfree_skb-under-spi.patch + patches.kernel.org/6.2.3-167-wifi-libertas-if_usb-don-t-call-kfree_skb-under.patch + patches.kernel.org/6.2.3-168-wifi-libertas-main-don-t-call-kfree_skb-under-s.patch + patches.kernel.org/6.2.3-169-wifi-libertas-cmdresp-don-t-call-kfree_skb-unde.patch + patches.kernel.org/6.2.3-170-wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_.patch + patches.kernel.org/6.2.3-171-libbpf-Fix-invalid-return-address-register-in-s.patch + patches.kernel.org/6.2.3-172-crypto-x86-ghash-fix-unaligned-access-in-ghash_.patch + patches.kernel.org/6.2.3-173-crypto-ux500-update-debug-config-after-ux500-cr.patch + patches.kernel.org/6.2.3-174-ACPICA-Drop-port-I-O-validation-for-some-region.patch + patches.kernel.org/6.2.3-175-genirq-Fix-the-return-type-of-kstat_cpu_irqs_su.patch + patches.kernel.org/6.2.3-176-rcu-tasks-Improve-comments-explaining-tasks_rcu.patch + patches.kernel.org/6.2.3-177-rcu-tasks-Remove-preemption-disablement-around-.patch + patches.kernel.org/6.2.3-178-rcu-tasks-Fix-synchronize_rcu_tasks-VS-zap_pid_.patch + patches.kernel.org/6.2.3-179-lib-mpi-Fix-buffer-overrun-when-SG-is-too-long.patch + patches.kernel.org/6.2.3-180-crypto-ccp-Avoid-page-allocation-failure-warnin.patch + patches.kernel.org/6.2.3-181-platform-chrome-cros_ec_typec-Update-port-DP-VD.patch + patches.kernel.org/6.2.3-182-ACPICA-nsrepair-handle-cases-without-a-return-v.patch + patches.kernel.org/6.2.3-183-libbpf-Fix-map-creation-flags-sanitization.patch + patches.kernel.org/6.2.3-184-bpf_doc-Fix-build-error-with-older-python-versi.patch + patches.kernel.org/6.2.3-185-selftests-xsk-print-correct-payload-for-packet-.patch + patches.kernel.org/6.2.3-186-selftests-xsk-print-correct-error-codes-when-ex.patch + patches.kernel.org/6.2.3-187-arm64-cpufeature-Fix-field-sign-for-DIT-hwcap-d.patch + patches.kernel.org/6.2.3-188-arm64-sysreg-Fix-errors-in-32-bit-enumeration-v.patch + patches.kernel.org/6.2.3-189-kselftest-arm64-Fix-syscall-abi-for-systems-wit.patch + patches.kernel.org/6.2.3-190-workqueue-Protects-wq_unbound_cpumask-with-wq_p.patch + patches.kernel.org/6.2.3-191-s390-early-fix-sclp_early_sccb-variable-lifetim.patch + patches.kernel.org/6.2.3-192-s390-vfio-ap-fix-an-error-handling-path-in-vfio.patch + patches.kernel.org/6.2.3-193-x86-signal-Fix-the-value-returned-by-strict_sas.patch + patches.kernel.org/6.2.3-194-thermal-drivers-tsens-Drop-msm8976-specific-def.patch + patches.kernel.org/6.2.3-195-thermal-drivers-tsens-Sort-out-msm8976-vs-msm89.patch + patches.kernel.org/6.2.3-196-thermal-drivers-tsens-fix-slope-values-for-msm8.patch + patches.kernel.org/6.2.3-197-thermal-drivers-tsens-limit-num_sensors-to-9-fo.patch + patches.kernel.org/6.2.3-198-wifi-rtw89-fix-potential-leak-in-rtw89_append_p.patch + patches.kernel.org/6.2.3-199-wifi-rtw89-Add-missing-check-for-alloc_workqueu.patch + patches.kernel.org/6.2.3-200-wifi-rtl8xxxu-Fix-memory-leaks-with-RTL8723BU-R.patch + patches.kernel.org/6.2.3-201-wifi-orinoco-check-return-value-of-hermes_write.patch + patches.kernel.org/6.2.3-202-wifi-rtw88-Use-rtw_iterate_vifs-for-rtw_vif_wat.patch + patches.kernel.org/6.2.3-203-wifi-rtw88-Use-non-atomic-sta-iterator-in-rtw_r.patch + patches.kernel.org/6.2.3-204-thermal-drivers-imx_sc_thermal-Fix-the-loop-con.patch + patches.kernel.org/6.2.3-205-wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg.patch + patches.kernel.org/6.2.3-206-wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_u.patch + patches.kernel.org/6.2.3-207-wifi-ath9k-Fix-potential-stack-out-of-bounds-wr.patch + patches.kernel.org/6.2.3-208-wifi-ath11k-Fix-memory-leak-in-ath11k_peer_rx_f.patch + patches.kernel.org/6.2.3-209-wifi-cfg80211-Fix-extended-KCK-key-length-check.patch + patches.kernel.org/6.2.3-210-ACPI-battery-Fix-missing-NUL-termination-with-l.patch + patches.kernel.org/6.2.3-211-selftests-bpf-Fix-build-errors-if-CONFIG_NF_CON.patch + patches.kernel.org/6.2.3-212-crypto-ccp-Failure-on-re-initialization-due-to-.patch + patches.kernel.org/6.2.3-213-crypto-essiv-Handle-EBUSY-correctly.patch + patches.kernel.org/6.2.3-214-crypto-seqiv-Handle-EBUSY-correctly.patch + patches.kernel.org/6.2.3-215-powercap-fix-possible-name-leak-in-powercap_reg.patch + patches.kernel.org/6.2.3-216-bpf-Fix-state-pruning-for-STACK_DYNPTR-stack-sl.patch + patches.kernel.org/6.2.3-217-bpf-Fix-missing-var_off-check-for-ARG_PTR_TO_DY.patch + patches.kernel.org/6.2.3-218-bpf-Fix-partial-dynptr-stack-slot-reads-writes.patch + patches.kernel.org/6.2.3-219-x86-microcode-Add-a-parameter-to-microcode_chec.patch + patches.kernel.org/6.2.3-220-x86-microcode-Check-CPU-capabilities-after-late.patch + patches.kernel.org/6.2.3-221-x86-microcode-Adjust-late-loading-result-report.patch + patches.kernel.org/6.2.3-222-net-ethernet-ti-am65-cpsw-cpts-Fix-CPTS-release.patch + patches.kernel.org/6.2.3-223-selftests-bpf-Fix-vmtest-static-compilation-err.patch + patches.kernel.org/6.2.3-224-crypto-xts-Handle-EBUSY-correctly.patch + patches.kernel.org/6.2.3-225-leds-led-class-Add-missing-put_device-to-led_pu.patch + patches.kernel.org/6.2.3-226-drm-nouveau-disp-Fix-nvif_outp_acquire_dp-argum.patch + patches.kernel.org/6.2.3-227-s390-bpf-Add-expoline-to-tail-calls.patch + patches.kernel.org/6.2.3-228-wifi-iwlwifi-mei-fix-compilation-errors-in-rfki.patch + patches.kernel.org/6.2.3-229-kselftest-arm64-Fix-enumeration-of-systems-with.patch + patches.kernel.org/6.2.3-230-can-rcar_canfd-Fix-R-Car-V3U-CAN-mode-selection.patch + patches.kernel.org/6.2.3-231-can-rcar_canfd-Fix-R-Car-V3U-GAFLCFG-field-acce.patch + patches.kernel.org/6.2.3-232-selftests-bpf-Initialize-tc-in-xdp_synproxy.patch + patches.kernel.org/6.2.3-233-crypto-ccp-Flush-the-SEV-ES-TMR-memory-before-g.patch + patches.kernel.org/6.2.3-234-bpftool-profile-online-CPUs-instead-of-possible.patch + patches.kernel.org/6.2.3-235-wifi-mt76-mt7921-fix-deadlock-in-mt7921_abort_r.patch + patches.kernel.org/6.2.3-236-wifi-mt76-mt7915-call-mt7915_mcu_set_thermal_th.patch + patches.kernel.org/6.2.3-237-wifi-mt76-mt7915-rework-mt7915_mcu_set_thermal_.patch + patches.kernel.org/6.2.3-238-wifi-mt76-mt7915-rework-mt7915_thermal_temp_sto.patch + patches.kernel.org/6.2.3-239-wifi-mt76-mt7921-fix-channel-switch-fail-in-mon.patch + patches.kernel.org/6.2.3-240-wifi-mt76-mt7996-fix-chainmask-calculation-in-m.patch + patches.kernel.org/6.2.3-241-wifi-mt76-mt7996-update-register-for-CFEND_RATE.patch + patches.kernel.org/6.2.3-242-wifi-mt76-connac-fix-POWER_CTRL-command-name-ty.patch + patches.kernel.org/6.2.3-243-wifi-mt76-mt7921-fix-invalid-remain_on_channel-.patch + patches.kernel.org/6.2.3-244-wifi-mt76-mt7915-fix-memory-leak-in-mt7915_mcu_.patch + patches.kernel.org/6.2.3-245-wifi-mt76-mt7996-fix-memory-leak-in-mt7996_mcu_.patch + patches.kernel.org/6.2.3-246-wifi-mt76-dma-fix-memory-leak-running-mt76_dma_.patch + patches.kernel.org/6.2.3-247-wifi-mt76-fix-switch-default-case-in-mt7996_rev.patch + patches.kernel.org/6.2.3-248-wifi-mt76-mt7915-fix-WED-TxS-reporting.patch + patches.kernel.org/6.2.3-249-wifi-mt76-add-memory-barrier-to-SDIO-queue-kick.patch + patches.kernel.org/6.2.3-250-wifi-mt76-mt7921-fix-error-code-of-return-in-mt.patch + patches.kernel.org/6.2.3-251-wifi-mt76-mt7996-rely-on-mt76_connac2_mac_tx_ra.patch + patches.kernel.org/6.2.3-252-net-mlx5-Enhance-debug-print-in-page-allocation.patch + patches.kernel.org/6.2.3-253-irqchip-Fix-refcount-leak-in-platform_irqchip_p.patch + patches.kernel.org/6.2.3-254-irqchip-alpine-msi-Fix-refcount-leak-in-alpine_.patch + patches.kernel.org/6.2.3-255-irqchip-irq-mvebu-gicp-Fix-refcount-leak-in-mve.patch + patches.kernel.org/6.2.3-256-irqchip-ti-sci-Fix-refcount-leak-in-ti_sci_intr.patch + patches.kernel.org/6.2.3-257-s390-mem_detect-fix-detect_memory-error-handlin.patch + patches.kernel.org/6.2.3-258-s390-vmem-fix-empty-page-tables-cleanup-under-K.patch + patches.kernel.org/6.2.3-259-s390-boot-cleanup-decompressor-header-files.patch + patches.kernel.org/6.2.3-260-s390-mem_detect-rely-on-diag260-if-sclp_early_g.patch + patches.kernel.org/6.2.3-261-s390-boot-fix-mem_detect-extended-area-allocati.patch + patches.kernel.org/6.2.3-262-net-add-sock_init_data_uid.patch + patches.kernel.org/6.2.3-263-tun-tun_chr_open-correctly-initialize-socket-ui.patch + patches.kernel.org/6.2.3-264-tap-tap_open-correctly-initialize-socket-uid.patch + patches.kernel.org/6.2.3-265-rxrpc-Fix-overwaking-on-call-poking.patch + patches.kernel.org/6.2.3-266-OPP-fix-error-checking-in-opp_migrate_dentry.patch + patches.kernel.org/6.2.3-267-cpufreq-davinci-Fix-clk-use-after-free.patch + patches.kernel.org/6.2.3-268-Bluetooth-hci_conn-Refactor-hci_bind_bis-since-.patch + patches.kernel.org/6.2.3-269-Bluetooth-L2CAP-Fix-potential-user-after-free.patch + patches.kernel.org/6.2.3-270-Bluetooth-hci_qca-get-wakeup-status-from-serdev.patch + patches.kernel.org/6.2.3-271-net-ipa-generic-command-param-fix.patch + patches.kernel.org/6.2.3-272-s390-vfio-ap-tighten-the-NIB-validity-check.patch + patches.kernel.org/6.2.3-273-s390-ap-fix-status-returned-by-ap_aqic.patch + patches.kernel.org/6.2.3-274-s390-ap-fix-status-returned-by-ap_qact.patch + patches.kernel.org/6.2.3-275-libbpf-Fix-alen-calculation-in-libbpf_nla_dump_.patch + patches.kernel.org/6.2.3-276-xen-grant-dma-iommu-Implement-a-dummy-probe_dev.patch + patches.kernel.org/6.2.3-277-rds-rds_rm_zerocopy_callback-correct-order-for-.patch + patches.kernel.org/6.2.3-278-crypto-rsa-pkcs1pad-Use-akcipher_request_comple.patch + patches.kernel.org/6.2.3-279-m68k-proc-hardware-should-depend-on-PROC_FS.patch + patches.kernel.org/6.2.3-280-RISC-V-time-initialize-hrtimer-based-broadcast-.patch + patches.kernel.org/6.2.3-281-clocksource-drivers-riscv-Patch-riscv_clock_nex.patch + patches.kernel.org/6.2.3-282-wifi-iwl3945-Add-missing-check-for-create_singl.patch + patches.kernel.org/6.2.3-283-wifi-iwl4965-Add-missing-check-for-create_singl.patch + patches.kernel.org/6.2.3-284-wifi-brcmfmac-Rename-Cypress-89459-to-BCM4355.patch + patches.kernel.org/6.2.3-285-wifi-brcmfmac-pcie-Add-IDs-properties-for-BCM43.patch + patches.kernel.org/6.2.3-286-wifi-brcmfmac-pcie-Add-IDs-properties-for-BCM43.patch + patches.kernel.org/6.2.3-287-wifi-brcmfmac-pcie-Perform-correct-BCM4364-firm.patch + patches.kernel.org/6.2.3-288-wifi-mwifiex-fix-loop-iterator-in-mwifiex_updat.patch + patches.kernel.org/6.2.3-289-wifi-rtw89-fix-parsing-offset-for-MCC-C2H.patch + patches.kernel.org/6.2.3-290-selftests-bpf-Fix-out-of-srctree-build.patch + patches.kernel.org/6.2.3-291-ACPI-resource-Add-IRQ-overrides-for-MAINGEAR-Ve.patch + patches.kernel.org/6.2.3-292-ACPI-resource-Do-IRQ-override-on-all-TongFang-G.patch + patches.kernel.org/6.2.3-293-crypto-octeontx2-Fix-objects-shared-between-sev.patch + patches.kernel.org/6.2.3-294-crypto-crypto4xx-Call-dma_unmap_page-when-done.patch + patches.kernel.org/6.2.3-295-vfio-ccw-remove-WARN_ON-during-shutdown.patch + patches.kernel.org/6.2.3-296-wifi-mac80211-move-color-collision-detection-re.patch + patches.kernel.org/6.2.3-297-wifi-mac80211-make-rate-u32-in-sta_set_rate_inf.patch + patches.kernel.org/6.2.3-298-wifi-mac80211-fix-non-MLO-station-association.patch + patches.kernel.org/6.2.3-299-wifi-mac80211-Don-t-translate-MLD-addresses-for.patch + patches.kernel.org/6.2.3-300-wifi-mac80211-avoid-u32_encode_bits-warning.patch + patches.kernel.org/6.2.3-301-wifi-mac80211-fix-off-by-one-link-setting.patch + patches.kernel.org/6.2.3-302-tools-lib-thermal-Fix-thermal_sampling_exit.patch + patches.kernel.org/6.2.3-303-thermal-drivers-hisi-Drop-second-sensor-hi3660.patch + patches.kernel.org/6.2.3-304-selftests-bpf-Fix-map_kptr-test.patch + patches.kernel.org/6.2.3-305-wifi-mac80211-pass-sta-to-ieee80211_rx_data_set.patch + patches.kernel.org/6.2.3-306-bpf-Zeroing-allocated-object-from-slab-in-bpf-m.patch + patches.kernel.org/6.2.3-307-selftests-bpf-Fix-xdp_do_redirect-on-s390x.patch + patches.kernel.org/6.2.3-308-can-esd_usb-Move-mislocated-storage-of-SJA1000_.patch + patches.kernel.org/6.2.3-309-can-esd_usb-Make-use-of-can_change_state-and-re.patch + patches.kernel.org/6.2.3-310-xsk-check-IFF_UP-earlier-in-Tx-path.patch + patches.kernel.org/6.2.3-311-LoongArch-bpf-Use-4-instructions-for-function-a.patch + patches.kernel.org/6.2.3-312-bpf-Fix-global-subprog-context-argument-resolut.patch + patches.kernel.org/6.2.3-313-irqchip-irq-brcmstb-l2-Set-IRQ_LEVEL-for-level-.patch + patches.kernel.org/6.2.3-314-irqchip-irq-bcm7120-l2-Set-IRQ_LEVEL-for-level-.patch + patches.kernel.org/6.2.3-315-net-smc-fix-potential-panic-dues-to-unprotected.patch + patches.kernel.org/6.2.3-316-net-smc-fix-application-data-exception.patch + patches.kernel.org/6.2.3-317-selftests-net-Interpret-UDP_GRO-cmsg-data-as-an.patch + patches.kernel.org/6.2.3-318-l2tp-Avoid-possible-recursive-deadlock-in-l2tp_.patch + patches.kernel.org/6.2.3-319-net-bcmgenet-fix-MoCA-LED-control.patch + patches.kernel.org/6.2.3-320-net-lan966x-Fix-possible-deadlock-inside-PTP.patch + patches.kernel.org/6.2.3-321-net-mlx4_en-Introduce-flexible-array-to-silence.patch + patches.kernel.org/6.2.3-322-net-mlx5e-Align-IPsec-ASO-result-memory-to-be-a.patch + patches.kernel.org/6.2.3-323-selftest-fib_tests-Always-cleanup-before-exit.patch + patches.kernel.org/6.2.3-324-sefltests-netdevsim-wait-for-devlink-instance-a.patch + patches.kernel.org/6.2.3-325-drm-Fix-potential-null-ptr-deref-due-to-drmm_mo.patch + patches.kernel.org/6.2.3-326-drm-fourcc-Add-missing-big-endian-XRGB1555-and-.patch + patches.kernel.org/6.2.3-327-drm-bridge-ti-sn65dsi83-Fix-delay-after-reset-d.patch + patches.kernel.org/6.2.3-328-drm-mxsfb-DRM_IMX_LCDIF-should-depend-on-ARCH_M.patch + patches.kernel.org/6.2.3-329-drm-mxsfb-DRM_MXSFB-should-depend-on-ARCH_MXS-A.patch + patches.kernel.org/6.2.3-330-drm-bridge-megachips-Fix-error-handling-in-i2c_.patch + patches.kernel.org/6.2.3-331-drm-vkms-Fix-memory-leak-in-vkms_init.patch + patches.kernel.org/6.2.3-332-drm-vkms-Fix-null-ptr-deref-in-vkms_release.patch + patches.kernel.org/6.2.3-333-drm-modes-Use-strscpy-to-copy-command-line-mode.patch + patches.kernel.org/6.2.3-334-drm-vc4-dpi-Fix-format-mapping-for-RGB565.patch + patches.kernel.org/6.2.3-335-drm-bridge-it6505-Guard-bridge-power-in-IRQ-han.patch + patches.kernel.org/6.2.3-336-drm-tidss-Fix-pixel-format-definition.patch + patches.kernel.org/6.2.3-337-gpu-ipu-v3-common-Add-of_node_put-for-reference.patch + patches.kernel.org/6.2.3-338-drm-ast-Init-iosys_map-pointer-as-I-O-memory-fo.patch + patches.kernel.org/6.2.3-339-drm-vc4-drop-all-currently-held-locks-if-deadlo.patch + patches.kernel.org/6.2.3-340-hwmon-ftsteutates-Fix-scaling-of-measurements.patch + patches.kernel.org/6.2.3-341-drm-msm-dpu-check-for-null-return-of-devm_kzall.patch + patches.kernel.org/6.2.3-342-drm-msm-hdmi-Add-missing-check-for-alloc_ordere.patch + patches.kernel.org/6.2.3-343-pinctrl-qcom-pinctrl-msm8976-Correct-function-n.patch + patches.kernel.org/6.2.3-344-pinctrl-stm32-Fix-refcount-leak-in-stm32_pctrl_.patch + patches.kernel.org/6.2.3-345-pinctrl-rockchip-Fix-refcount-leak-in-rockchip_.patch + patches.kernel.org/6.2.3-346-drm-vc4-hvs-Configure-the-HVS-COB-allocations.patch + patches.kernel.org/6.2.3-347-drm-vc4-hvs-Set-AXI-panic-modes.patch + patches.kernel.org/6.2.3-348-drm-vc4-hvs-SCALER_DISPBKGND_AUTOHS-is-only-val.patch + patches.kernel.org/6.2.3-349-drm-vc4-hvs-Correct-interrupt-masking-bit-assig.patch + patches.kernel.org/6.2.3-350-drm-vc4-hvs-Fix-colour-order-for-xRGB1555-on-HV.patch + patches.kernel.org/6.2.3-351-drm-vc4-hdmi-Correct-interlaced-timings-again.patch + patches.kernel.org/6.2.3-352-drm-msm-clean-event_thread-worker-in-case-of-an.patch + patches.kernel.org/6.2.3-353-drm-panel-edp-fix-name-for-IVO-product-id-854b.patch + patches.kernel.org/6.2.3-354-scsi-qla2xxx-Fix-exchange-oversubscription.patch + patches.kernel.org/6.2.3-355-scsi-qla2xxx-Fix-exchange-oversubscription-for-.patch + patches.kernel.org/6.2.3-356-scsi-qla2xxx-edif-Fix-clang-warning.patch + patches.kernel.org/6.2.3-357-ASoC-fsl_sai-initialize-is_dsp_mode-flag.patch + patches.kernel.org/6.2.3-358-drm-bridge-tc358767-Set-default-CLRSIPO-count.patch + patches.kernel.org/6.2.3-359-drm-msm-adreno-Fix-null-ptr-access-in-adreno_gp.patch + patches.kernel.org/6.2.3-360-ALSA-hda-ca0132-minor-fix-for-allocation-size.patch + patches.kernel.org/6.2.3-361-drm-amdgpu-Use-the-sched-from-entity-for-amdgpu.patch + patches.kernel.org/6.2.3-362-drm-msm-gem-Add-check-for-kmalloc.patch + patches.kernel.org/6.2.3-363-drm-msm-dpu-Disallow-unallocated-resources-to-b.patch + patches.kernel.org/6.2.3-364-drm-bridge-lt9611-fix-sleep-mode-setup.patch + patches.kernel.org/6.2.3-365-drm-bridge-lt9611-fix-HPD-reenablement.patch + patches.kernel.org/6.2.3-366-drm-bridge-lt9611-fix-polarity-programming.patch + patches.kernel.org/6.2.3-367-drm-bridge-lt9611-fix-programming-of-video-mode.patch + patches.kernel.org/6.2.3-368-drm-bridge-lt9611-fix-clock-calculation.patch + patches.kernel.org/6.2.3-369-drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch + patches.kernel.org/6.2.3-370-regulator-tps65219-use-IS_ERR-to-detect-an-erro.patch + patches.kernel.org/6.2.3-371-drm-mipi-dsi-Fix-byte-order-of-16-bit-DCS-set-g.patch + patches.kernel.org/6.2.3-372-drm-exynos-dsi-Fix-MIPI_DSI-_NO_-mode-flags.patch + patches.kernel.org/6.2.3-373-drm-msm-dsi-Allow-2-CTRLs-on-v2.5.0.patch + patches.kernel.org/6.2.3-374-scsi-ufs-exynos-Fix-DMA-alignment-for-PAGE_SIZE.patch + patches.kernel.org/6.2.3-375-drm-msm-dpu-sc7180-add-missing-WB2-clock-contro.patch + patches.kernel.org/6.2.3-376-drm-msm-use-strscpy-instead-of-strncpy.patch + patches.kernel.org/6.2.3-377-drm-msm-dpu-Add-check-for-cstate.patch + patches.kernel.org/6.2.3-378-drm-msm-dpu-Add-check-for-pstates.patch + patches.kernel.org/6.2.3-379-drm-msm-mdp5-Add-check-for-kzalloc.patch + patches.kernel.org/6.2.3-380-habanalabs-bugs-fixes-in-timestamps-buff-alloc.patch + patches.kernel.org/6.2.3-381-pinctrl-bcm2835-Remove-of_node_put-in-bcm2835_o.patch + patches.kernel.org/6.2.3-382-pinctrl-mediatek-Initialize-variable-pullen-and.patch + patches.kernel.org/6.2.3-383-pinctrl-mediatek-Initialize-variable-buf-to-zer.patch + patches.kernel.org/6.2.3-384-gpu-host1x-Fix-mask-for-syncpoint-increment-reg.patch + patches.kernel.org/6.2.3-385-gpu-host1x-Don-t-skip-assigning-syncpoints-to-c.patch + patches.kernel.org/6.2.3-386-drm-tegra-firewall-Check-for-is_addr_reg-existe.patch + patches.kernel.org/6.2.3-387-drm-i915-mtl-Add-initial-gt-workarounds.patch + patches.kernel.org/6.2.3-388-drm-i915-xehp-GAM-registers-don-t-need-to-be-re.patch + patches.kernel.org/6.2.3-389-pinctrl-renesas-rzg2l-Fix-configuring-the-GPIO-.patch + patches.kernel.org/6.2.3-390-drm-i915-xehp-Annotate-a-couple-more-workaround.patch + patches.kernel.org/6.2.3-391-drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_pl.patch + patches.kernel.org/6.2.3-392-drm-mediatek-dsi-Reduce-the-time-of-dsi-from-LP.patch + patches.kernel.org/6.2.3-393-drm-mediatek-Use-NULL-instead-of-0-for-NULL-poi.patch + patches.kernel.org/6.2.3-394-drm-mediatek-Drop-unbalanced-obj-unref.patch + patches.kernel.org/6.2.3-395-drm-mediatek-mtk_drm_crtc-Add-checks-for-devm_k.patch + patches.kernel.org/6.2.3-396-drm-mediatek-Clean-dangling-pointer-on-bind-err.patch + patches.kernel.org/6.2.3-397-ASoC-soc-compress.c-fixup-private_data-on-snd_s.patch + patches.kernel.org/6.2.3-398-dt-bindings-display-mediatek-Fix-the-fallback-f.patch + patches.kernel.org/6.2.3-399-gpio-pca9570-rename-platform_data-to-chip_data.patch + patches.kernel.org/6.2.3-400-gpio-vf610-connect-GPIO-label-to-dev-name.patch + patches.kernel.org/6.2.3-401-ASoC-topology-Properly-access-value-coming-from.patch + patches.kernel.org/6.2.3-402-spi-dw_bt1-fix-MUX_MMIO-dependencies.patch + patches.kernel.org/6.2.3-403-ASoC-mchp-spdifrx-fix-controls-which-rely-on-rs.patch + patches.kernel.org/6.2.3-404-ASoC-mchp-spdifrx-fix-return-value-in-case-comp.patch + patches.kernel.org/6.2.3-405-ASoC-mchp-spdifrx-fix-controls-that-works-with-.patch + patches.kernel.org/6.2.3-406-ASoC-mchp-spdifrx-disable-all-interrupts-in-mch.patch + patches.kernel.org/6.2.3-407-dm-improve-shrinker-debug-names.patch + patches.kernel.org/6.2.3-408-regmap-apply-reg_base-and-reg_downshift-for-sin.patch + patches.kernel.org/6.2.3-409-accel-fix-CONFIG_DRM-dependencies.patch + patches.kernel.org/6.2.3-410-ASoC-rsnd-fixup-endif-position.patch + patches.kernel.org/6.2.3-411-ASoC-mchp-spdifrx-Fix-uninitialized-use-of-mr-i.patch + patches.kernel.org/6.2.3-412-ASoC-dt-bindings-meson-fix-gx-card-codec-node-r.patch + patches.kernel.org/6.2.3-413-regulator-tps65219-use-generic-set_bypass.patch + patches.kernel.org/6.2.3-414-hwmon-asus-ec-sensors-add-missing-mutex-path.patch + patches.kernel.org/6.2.3-415-hwmon-ltc2945-Handle-error-case-in-ltc2945_valu.patch + patches.kernel.org/6.2.3-416-ALSA-hda-Fix-the-control-element-identification.patch + patches.kernel.org/6.2.3-417-drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch + patches.kernel.org/6.2.3-418-scsi-mpt3sas-Fix-a-memory-leak.patch + patches.kernel.org/6.2.3-419-scsi-aic94xx-Add-missing-check-for-dma_map_sing.patch + patches.kernel.org/6.2.3-420-HID-multitouch-Add-quirks-for-flipped-axes.patch + patches.kernel.org/6.2.3-421-HID-retain-initial-quirks-set-up-when-creating-.patch + patches.kernel.org/6.2.3-422-ASoC-qcom-q6apm-lpass-dai-unprepare-stream-if-i.patch + patches.kernel.org/6.2.3-423-ASoC-qcom-q6apm-dai-fix-race-condition-while-up.patch + patches.kernel.org/6.2.3-424-ASoC-qcom-q6apm-dai-Add-SNDRV_PCM_INFO_BATCH-fl.patch + patches.kernel.org/6.2.3-425-ASoC-codecs-lpass-register-mclk-after-runtime-p.patch + patches.kernel.org/6.2.3-426-ASoC-codecs-lpass-fix-incorrect-mclk-rate.patch + patches.kernel.org/6.2.3-427-drm-amd-display-don-t-call-dc_interrupt_set-for.patch + patches.kernel.org/6.2.3-428-HID-logitech-hidpp-Hard-code-HID-1.0-fast-scrol.patch + patches.kernel.org/6.2.3-429-spi-bcm63xx-hsspi-Fix-multi-bit-mode-setting.patch + patches.kernel.org/6.2.3-430-hwmon-mlxreg-fan-Return-zero-speed-for-broken-f.patch + patches.kernel.org/6.2.3-431-ASoC-tlv320adcx140-fix-ti-gpio-config-DT-proper.patch + patches.kernel.org/6.2.3-432-dm-remove-flush_scheduled_work-during-local_exi.patch + patches.kernel.org/6.2.3-433-nfs4trace-fix-state-manager-flag-printing.patch + patches.kernel.org/6.2.3-434-NFS-fix-disabling-of-swap.patch + patches.kernel.org/6.2.3-435-drm-i915-pvc-Implement-recommended-caching-poli.patch + patches.kernel.org/6.2.3-436-drm-i915-pvc-Annotate-two-more-workaround-tunin.patch + patches.kernel.org/6.2.3-437-drm-i915-Fix-GEN8_MISCCPCTL.patch + patches.kernel.org/6.2.3-438-spi-synquacer-Fix-timeout-handling-in-synquacer.patch + patches.kernel.org/6.2.3-439-ASoC-soc-dapm.h-fixup-warning-struct-snd_pcm_su.patch + patches.kernel.org/6.2.3-440-HID-bigben-use-spinlock-to-protect-concurrent-a.patch + patches.kernel.org/6.2.3-441-HID-bigben_worker-remove-unneeded-check-on-repo.patch + patches.kernel.org/6.2.3-442-HID-bigben-use-spinlock-to-safely-schedule-work.patch + patches.kernel.org/6.2.3-443-hid-bigben_probe-validate-report-count.patch + patches.kernel.org/6.2.3-444-ALSA-hda-hdmi-Register-with-vga_switcheroo-on-D.patch + patches.kernel.org/6.2.3-445-drm-shmem-helper-Fix-locking-for-drm_gem_shmem_.patch + patches.kernel.org/6.2.3-446-NFSD-enhance-inter-server-copy-cleanup.patch + patches.kernel.org/6.2.3-447-NFSD-fix-leaked-reference-count-of-nfsd4_ssc_um.patch + patches.kernel.org/6.2.3-448-nfsd-fix-race-to-check-ls_layouts.patch + patches.kernel.org/6.2.3-449-nfsd-clean-up-potential-nfsd_file-refcount-leak.patch + patches.kernel.org/6.2.3-450-NFSD-fix-problems-with-cleanup-on-errors-in-nfs.patch + patches.kernel.org/6.2.3-451-nfsd-fix-courtesy-client-with-deny-mode-handlin.patch + patches.kernel.org/6.2.3-452-nfsd-don-t-fsync-nfsd_files-on-last-close.patch + patches.kernel.org/6.2.3-453-NFSD-copy-the-whole-verifier-in-nfsd_copy_write.patch + patches.kernel.org/6.2.3-454-cifs-Fix-lost-destroy-smbd-connection-when-MR-a.patch + patches.kernel.org/6.2.3-455-cifs-Fix-warning-and-UAF-when-destroy-the-MR-li.patch + patches.kernel.org/6.2.3-456-cifs-use-tcon-allocation-functions-even-for-dum.patch + patches.kernel.org/6.2.3-457-gfs2-jdata-writepage-fix.patch + patches.kernel.org/6.2.3-458-perf-llvm-Fix-inadvertent-file-creation.patch + patches.kernel.org/6.2.3-459-leds-led-core-Fix-refcount-leak-in-of_led_get.patch + patches.kernel.org/6.2.3-460-leds-is31fl319x-Wrap-mutex_destroy-for-devm_add.patch + patches.kernel.org/6.2.3-461-leds-simatic-ipc-leds-gpio-Make-sure-we-have-th.patch + patches.kernel.org/6.2.3-462-tools-tracing-rtla-osnoise_hist-use-total-durat.patch + patches.kernel.org/6.2.3-463-perf-inject-Use-perf_data__read-for-auxtrace.patch + patches.kernel.org/6.2.3-464-perf-intel-pt-Do-not-try-to-queue-auxtrace-data.patch + patches.kernel.org/6.2.3-465-perf-stat-Hide-invalid-uncore-event-output-for-.patch + patches.kernel.org/6.2.3-466-perf-jevents-Correct-bad-character-encoding.patch + patches.kernel.org/6.2.3-467-perf-test-bpf-Skip-test-if-kernel-debuginfo-is-.patch + patches.kernel.org/6.2.3-468-perf-tools-Fix-auto-complete-on-aarch64.patch + patches.kernel.org/6.2.3-469-perf-stat-Avoid-merging-aggregating-metric-coun.patch + patches.kernel.org/6.2.3-470-sparc-allow-PM-configs-for-sparc32-COMPILE_TEST.patch + patches.kernel.org/6.2.3-471-selftests-find-echo-binary-to-use-ne-options.patch + patches.kernel.org/6.2.3-472-selftests-ftrace-Fix-bash-specific-operator.patch + patches.kernel.org/6.2.3-473-selftests-use-printf-instead-of-echo-ne.patch + patches.kernel.org/6.2.3-474-perf-record-Fix-segfault-with-overwrite-and-max.patch + patches.kernel.org/6.2.3-475-printf-fix-errname.c-list.patch + patches.kernel.org/6.2.3-476-perf-tests-stat_all_metrics-Change-true-workloa.patch + patches.kernel.org/6.2.3-477-objtool-add-UACCESS-exceptions-for-__tsan_volat.patch + patches.kernel.org/6.2.3-478-selftests-ftrace-Fix-probepoint-testcase-to-ign.patch + patches.kernel.org/6.2.3-479-sysctl-fix-proc_dobool-usability.patch + patches.kernel.org/6.2.3-480-mfd-rk808-Re-add-rk808-clkout-to-RK818.patch + patches.kernel.org/6.2.3-481-mfd-cs5535-Don-t-build-on-UML.patch + patches.kernel.org/6.2.3-482-mfd-pcf50633-adc-Fix-potential-memleak-in-pcf50.patch + patches.kernel.org/6.2.3-483-dmaengine-idxd-Set-traffic-class-values-in-GRPC.patch + patches.kernel.org/6.2.3-484-RDMA-erdma-Fix-refcount-leak-in-erdma_mmap.patch + patches.kernel.org/6.2.3-485-dmaengine-HISI_DMA-should-depend-on-ARCH_HISI.patch + patches.kernel.org/6.2.3-486-RDMA-hns-Fix-refcount-leak-in-hns_roce_mmap.patch + patches.kernel.org/6.2.3-487-iio-light-tsl2563-Do-not-hardcode-interrupt-tri.patch + patches.kernel.org/6.2.3-488-usb-gadget-fusb300_udc-free-irq-on-the-error-pa.patch + patches.kernel.org/6.2.3-489-i2c-designware-fix-i2c_dw_clk_rate-return-size-.patch + patches.kernel.org/6.2.3-490-i2c-qcom-geni-change-i2c_master_hub-to-static.patch + patches.kernel.org/6.2.3-491-soundwire-cadence-Don-t-overflow-the-command-FI.patch + patches.kernel.org/6.2.3-492-driver-core-fix-potential-null-ptr-deref-in-dev.patch + patches.kernel.org/6.2.3-493-kobject-Fix-slab-out-of-bounds-in-fill_kobj_pat.patch + patches.kernel.org/6.2.3-494-alpha-boot-tools-objstrip-fix-the-check-for-ELF.patch + patches.kernel.org/6.2.3-495-media-uvcvideo-Check-for-INACTIVE-in-uvc_ctrl_i.patch + patches.kernel.org/6.2.3-496-media-uvcvideo-Implement-mask-for-V4L2_CTRL_TYP.patch + patches.kernel.org/6.2.3-497-media-uvcvideo-Refactor-uvc_ctrl_mappings_uvcXX.patch + patches.kernel.org/6.2.3-498-media-uvcvideo-Refactor-power_line_frequency_co.patch + patches.kernel.org/6.2.3-499-coresight-etm4x-Fix-accesses-to-TRCSEQRSTEVR-an.patch + patches.kernel.org/6.2.3-500-coresight-cti-Prevent-negative-values-of-enable.patch + patches.kernel.org/6.2.3-501-coresight-cti-Add-PM-runtime-call-in-enable_sto.patch + patches.kernel.org/6.2.3-502-usb-typec-intel_pmc_mux-Don-t-leak-the-ACPI-dev.patch + patches.kernel.org/6.2.3-503-PCI-IOV-Enlarge-virtfn-sysfs-name-buffer.patch + patches.kernel.org/6.2.3-504-PCI-switchtec-Return-EFAULT-for-copy_to_user-er.patch + patches.kernel.org/6.2.3-505-PCI-endpoint-pci-epf-vntb-Add-epf_ntb_mw_bar_cl.patch + patches.kernel.org/6.2.3-506-hwtracing-hisi_ptt-Only-add-the-supported-devic.patch + patches.kernel.org/6.2.3-507-tty-serial-fsl_lpuart-disable-Rx-Tx-DMA-in-lpua.patch + patches.kernel.org/6.2.3-508-tty-serial-fsl_lpuart-clear-LPUART-Status-Regis.patch + patches.kernel.org/6.2.3-509-serial-tegra-Add-missing-clk_disable_unprepare-.patch + patches.kernel.org/6.2.3-510-Revert-char-pcmcia-cm4000_cs-Replace-mdelay-wit.patch + patches.kernel.org/6.2.3-511-eeprom-idt_89hpesx-Fix-error-handling-in-idt_in.patch + patches.kernel.org/6.2.3-512-applicom-Fix-PCI-device-refcount-leak-in-applic.patch + patches.kernel.org/6.2.3-513-firmware-stratix10-svc-add-missing-gen_pool_des.patch + patches.kernel.org/6.2.3-514-firmware-stratix10-svc-fix-error-handle-while-a.patch + patches.kernel.org/6.2.3-515-VMCI-check-context-notify_page-after-call-to-ge.patch + patches.kernel.org/6.2.3-516-mei-pxp-Use-correct-macros-to-initialize-uuid_l.patch + patches.kernel.org/6.2.3-517-misc-mei-hdcp-Use-correct-macros-to-initialize-.patch + patches.kernel.org/6.2.3-518-misc-fastrpc-Fix-an-error-handling-path-in-fast.patch + patches.kernel.org/6.2.3-519-iommu-exynos-Fix-error-handling-in-exynos_iommu.patch + patches.kernel.org/6.2.3-520-driver-core-fix-resource-leak-in-device_add.patch + patches.kernel.org/6.2.3-521-driver-core-location-Free-struct-acpi_pld_info-.patch + patches.kernel.org/6.2.3-522-drivers-base-transport_class-fix-possible-memor.patch + patches.kernel.org/6.2.3-523-drivers-base-transport_class-fix-resource-leak-.patch + patches.kernel.org/6.2.3-524-firmware-dmi-sysfs-Fix-null-ptr-deref-in-dmi_sy.patch + patches.kernel.org/6.2.3-525-selftests-iommu-Fix-test_cmd_destroy_access-cal.patch + patches.kernel.org/6.2.3-526-iommufd-Add-three-missing-structures-in-ucmd_bu.patch + patches.kernel.org/6.2.3-527-fotg210-udc-Add-missing-completion-handler.patch + patches.kernel.org/6.2.3-528-dmaengine-dw-edma-Fix-missing-src-dst-address-o.patch + patches.kernel.org/6.2.3-529-fpga-microchip-spi-move-SPI-I-O-buffers-out-of-.patch + patches.kernel.org/6.2.3-530-fpga-microchip-spi-rewrite-status-polling-in-a-.patch + patches.kernel.org/6.2.3-531-usb-early-xhci-dbc-Fix-a-potential-out-of-bound.patch + patches.kernel.org/6.2.3-532-tty-serial-fsl_lpuart-Fix-the-wrong-RXWATER-set.patch + patches.kernel.org/6.2.3-533-RDMA-cxgb4-add-null-ptr-check-after-ip_dev_find.patch + patches.kernel.org/6.2.3-534-usb-musb-mediatek-don-t-unregister-something-th.patch + patches.kernel.org/6.2.3-535-usb-gadget-configfs-Restrict-symlink-creation-i.patch + patches.kernel.org/6.2.3-536-phy-mediatek-remove-temporary-variable-mask_.patch + patches.kernel.org/6.2.3-537-PCI-mt7621-Delay-phy-ports-initialization.patch + patches.kernel.org/6.2.3-538-iommu-vt-d-Set-No-Execute-Enable-bit-in-PASID-t.patch + patches.kernel.org/6.2.3-539-power-supply-remove-faulty-cooling-logic.patch + patches.kernel.org/6.2.3-540-RDMA-siw-Fix-user-page-pinning-accounting.patch + patches.kernel.org/6.2.3-541-RDMA-cxgb4-Fix-potential-null-ptr-deref-in-pass.patch + patches.kernel.org/6.2.3-542-usb-max-3421-Fix-setting-of-I-O-pins.patch + patches.kernel.org/6.2.3-543-RDMA-irdma-Cap-MSIX-used-to-online-CPUs-1.patch + patches.kernel.org/6.2.3-544-serial-fsl_lpuart-fix-RS485-RTS-polariy-inverse.patch + patches.kernel.org/6.2.3-545-tty-serial-imx-disable-Ageing-Timer-interrupt-r.patch + patches.kernel.org/6.2.3-546-driver-core-fw_devlink-Add-DL_FLAG_CYCLE-suppor.patch + patches.kernel.org/6.2.3-547-driver-core-fw_devlink-Don-t-purge-child-fwnode.patch + patches.kernel.org/6.2.3-548-driver-core-fw_devlink-Allow-marking-a-fwnode-l.patch + patches.kernel.org/6.2.3-549-driver-core-fw_devlink-Consolidate-device-link-.patch + patches.kernel.org/6.2.3-550-driver-core-fw_devlink-Improve-check-for-fwnode.patch + patches.kernel.org/6.2.3-551-driver-core-fw_devlink-Make-cycle-detection-mor.patch + patches.kernel.org/6.2.3-552-mtd-mtdpart-Don-t-create-platform-device-that-l.patch + patches.kernel.org/6.2.3-553-usb-host-fsl-mph-dr-of-reuse-device_set_of_node.patch + patches.kernel.org/6.2.3-554-dmaengine-dw-edma-Fix-readq_ch-return-value-tru.patch + patches.kernel.org/6.2.3-555-PCI-Fix-dropping-valid-root-bus-resources-with-.patch + patches.kernel.org/6.2.3-556-phy-rockchip-typec-fix-tcphy_get_mode-error-cas.patch + patches.kernel.org/6.2.3-557-PCI-qcom-Fix-host-init-error-handling.patch + patches.kernel.org/6.2.3-558-iw_cxgb4-Fix-potential-NULL-dereference-in-c4iw.patch + patches.kernel.org/6.2.3-559-iommu-Fix-error-unwind-in-iommu_group_alloc.patch + patches.kernel.org/6.2.3-560-iommu-amd-Do-not-identity-map-v2-capable-device.patch + patches.kernel.org/6.2.3-561-dmaengine-sf-pdma-pdma_desc-memory-leak-fix.patch + patches.kernel.org/6.2.3-562-dmaengine-dw-axi-dmac-Do-not-dereference-NULL-s.patch + patches.kernel.org/6.2.3-563-dmaengine-ptdma-check-for-null-desc-before-call.patch + patches.kernel.org/6.2.3-564-iommu-vt-d-Fix-error-handling-in-sva-enable-dis.patch + patches.kernel.org/6.2.3-565-iommu-vt-d-Allow-to-use-flush-queue-when-first-.patch + patches.kernel.org/6.2.3-566-RDMA-rxe-Cleanup-mr_check_range.patch + patches.kernel.org/6.2.3-567-RDMA-rxe-Move-rxe_map_mr_sg-to-rxe_mr.c.patch + patches.kernel.org/6.2.3-568-RDMA-rxe-Isolate-mr-code-from-atomic_reply.patch + patches.kernel.org/6.2.3-569-RDMA-rxe-Isolate-mr-code-from-atomic_write_repl.patch + patches.kernel.org/6.2.3-570-RDMA-rxe-Cleanup-page-variables-in-rxe_mr.c.patch + patches.kernel.org/6.2.3-571-RDMA-rxe-Replace-rxe_map-and-rxe_phys_buf-by-xa.patch + patches.kernel.org/6.2.3-572-Subject-RDMA-rxe-Handle-zero-length-rdma.patch + patches.kernel.org/6.2.3-573-RDMA-mana_ib-Fix-a-bug-when-the-PF-indicates-mo.patch + patches.kernel.org/6.2.3-574-RDMA-rxe-Fix-missing-memory-barriers-in-rxe_que.patch + patches.kernel.org/6.2.3-575-IB-hfi1-Fix-math-bugs-in-hfi1_can_pin_pages.patch + patches.kernel.org/6.2.3-576-IB-hfi1-Fix-sdma.h-tx-num_descs-off-by-one-erro.patch + patches.kernel.org/6.2.3-577-Revert-remoteproc-qcom_q6v5_mss-map-unmap-metad.patch + patches.kernel.org/6.2.3-578-remoteproc-qcom_q6v5_mss-Use-a-carveout-to-auth.patch + patches.kernel.org/6.2.3-579-media-ti-cal-fix-possible-memory-leak-in-cal_ct.patch + patches.kernel.org/6.2.3-580-media-platform-ti-Add-missing-check-for-devm_re.patch + patches.kernel.org/6.2.3-581-media-imx-imx7-media-csi-fix-missing-clk_disabl.patch + patches.kernel.org/6.2.3-582-powerpc-Remove-linker-flag-from-KBUILD_AFLAGS.patch + patches.kernel.org/6.2.3-583-s390-vdso-Drop-shared-from-KBUILD_CFLAGS_64.patch + patches.kernel.org/6.2.3-584-builddeb-clean-generated-package-content.patch + patches.kernel.org/6.2.3-585-media-max9286-Fix-memleak-in-max9286_v4l2_regis.patch + patches.kernel.org/6.2.3-586-media-ov2740-Fix-memleak-in-ov2740_init_control.patch + patches.kernel.org/6.2.3-587-media-ov5675-Fix-memleak-in-ov5675_init_control.patch + patches.kernel.org/6.2.3-588-media-i2c-tc358746-fix-missing-return-assignmen.patch + patches.kernel.org/6.2.3-589-media-i2c-tc358746-fix-ignoring-read-error-in-g.patch + patches.kernel.org/6.2.3-590-media-i2c-tc358746-fix-possible-endianness-issu.patch + patches.kernel.org/6.2.3-591-media-ov5640-Fix-soft-reset-sequence-and-timing.patch + patches.kernel.org/6.2.3-592-media-ov5640-Handle-delays-when-no-reset_gpio-s.patch + patches.kernel.org/6.2.3-593-media-mc-Get-media_device-directly-from-pad.patch + patches.kernel.org/6.2.3-594-media-i2c-ov772x-Fix-memleak-in-ov772x_probe.patch + patches.kernel.org/6.2.3-595-media-i2c-imx219-Split-common-registers-from-mo.patch + patches.kernel.org/6.2.3-596-media-i2c-imx219-Fix-binning-for-RAW8-capture.patch + patches.kernel.org/6.2.3-597-media-platform-mtk-mdp3-Fix-return-value-check-.patch + patches.kernel.org/6.2.3-598-media-camss-csiphy-3ph-avoid-undefined-behavior.patch + patches.kernel.org/6.2.3-599-media-platform-mtk-mdp3-fix-Kconfig-dependencie.patch + patches.kernel.org/6.2.3-600-media-v4l2-jpeg-correct-the-skip-count-in-jpeg_.patch + patches.kernel.org/6.2.3-601-media-v4l2-jpeg-ignore-the-unknown-APP14-marker.patch + patches.kernel.org/6.2.3-602-media-hantro-Fix-JPEG-encoder-ENUM_FRMSIZE-on-R.patch + patches.kernel.org/6.2.3-603-media-imx-jpeg-Apply-clk_bulk-api-instead-of-op.patch + patches.kernel.org/6.2.3-604-media-amphion-correct-the-unspecified-color-spa.patch + patches.kernel.org/6.2.3-605-media-drivers-media-v4l2-core-v4l2-h264-add-det.patch + patches.kernel.org/6.2.3-606-media-rc-Fix-use-after-free-bugs-caused-by-ene_.patch + patches.kernel.org/6.2.3-607-media-atomisp-fix-videobuf2-Kconfig-depenendenc.patch + patches.kernel.org/6.2.3-608-media-atomisp-Only-set-default_run_mode-on-firs.patch + patches.kernel.org/6.2.3-609-media-i2c-ov7670-0-instead-of-EINVAL-was-return.patch + patches.kernel.org/6.2.3-610-media-usb-siano-Fix-use-after-free-bugs-caused-.patch + patches.kernel.org/6.2.3-611-media-saa7134-Use-video_unregister_device-for-r.patch + patches.kernel.org/6.2.3-612-rpmsg-glink-Avoid-infinite-loop-on-intent-for-m.patch + patches.kernel.org/6.2.3-613-rpmsg-glink-Release-driver_override.patch + patches.kernel.org/6.2.3-614-ARM-OMAP2-omap4-common-Fix-refcount-leak-bug.patch + patches.kernel.org/6.2.3-615-arm64-dts-qcom-msm8996-Add-additional-A2NoC-clo.patch + patches.kernel.org/6.2.3-616-udf-Define-EFSCORRUPTED-error-code.patch + patches.kernel.org/6.2.3-617-context_tracking-Fix-noinstr-vs-KASAN.patch + patches.kernel.org/6.2.3-618-exit-Detect-and-fix-irq-disabled-state-in-oops.patch + patches.kernel.org/6.2.3-619-ARM-dts-exynos-Use-Exynos5420-compatible-for-th.patch + patches.kernel.org/6.2.3-620-fs-Use-CHECK_DATA_CORRUPTION-when-kernel-bugs-a.patch + patches.kernel.org/6.2.3-621-blk-iocost-fix-divide-by-0-error-in-calc_lcoefs.patch + patches.kernel.org/6.2.3-622-blk-cgroup-dropping-parent-refcount-after-pd_fr.patch + patches.kernel.org/6.2.3-623-blk-cgroup-synchronize-pd_free_fn-from-blkg_fre.patch + patches.kernel.org/6.2.3-624-trace-blktrace-fix-memory-leak-with-using-debug.patch + patches.kernel.org/6.2.3-625-btrfs-scrub-improve-tree-block-error-reporting.patch + patches.kernel.org/6.2.3-626-arm64-zynqmp-Enable-hs-termination-flag-for-USB.patch + patches.kernel.org/6.2.3-627-cpuidle-intel_idle-Fix-CPUIDLE_FLAG_INIT_XSTATE.patch + patches.kernel.org/6.2.3-628-x86-fpu-Don-t-set-TIF_NEED_FPU_LOAD-for-PF_IO_W.patch + patches.kernel.org/6.2.3-629-cpuidle-drivers-firmware-psci-Dont-instrument-s.patch + patches.kernel.org/6.2.3-630-cpuidle-lib-bug-Disable-rcu_is_watching-during-.patch + patches.kernel.org/6.2.3-631-perf-x86-intel-uncore-Add-Meteor-Lake-support.patch + patches.kernel.org/6.2.3-632-wifi-ath9k-Fix-use-after-free-in-ath9k_hif_usb_.patch + patches.kernel.org/6.2.3-633-wifi-ath11k-fix-monitor-mode-bringup-crash.patch + patches.kernel.org/6.2.3-634-wifi-brcmfmac-Fix-potential-stack-out-of-bounds.patch + patches.kernel.org/6.2.3-635-rcu-Make-RCU_LOCKDEP_WARN-avoid-early-lockdep-c.patch + patches.kernel.org/6.2.3-636-rcu-Suppress-smp_processor_id-complaint-in-sync.patch + patches.kernel.org/6.2.3-637-srcu-Delegate-work-to-the-boot-cpu-if-using-SRC.patch + patches.kernel.org/6.2.3-638-rcu-tasks-Make-rude-RCU-Tasks-work-well-with-CP.patch + patches.kernel.org/6.2.3-639-rcu-tasks-Handle-queue-shrink-callback-enqueue-.patch + patches.kernel.org/6.2.3-640-wifi-ath11k-debugfs-fix-to-work-with-multiple-P.patch + patches.kernel.org/6.2.3-641-thermal-intel-Fix-unsigned-comparison-with-less.patch + patches.kernel.org/6.2.3-642-timers-Prevent-union-confusion-from-unexpected-.patch + patches.kernel.org/6.2.3-643-x86-bugs-Reset-speculation-control-settings-on-.patch + patches.kernel.org/6.2.3-644-bpftool-Always-disable-stack-protection-for-BPF.patch + patches.kernel.org/6.2.3-645-wifi-brcmfmac-ensure-CLM-version-is-null-termin.patch + patches.kernel.org/6.2.3-646-wifi-rtw89-fix-assignation-of-TX-BD-RAM-table.patch + patches.kernel.org/6.2.3-647-wifi-mt7601u-fix-an-integer-underflow.patch + patches.kernel.org/6.2.3-648-inet-fix-fast-path-in-__inet_hash_connect.patch + patches.kernel.org/6.2.3-649-ice-restrict-PTP-HW-clock-freq-adjustments-to-1.patch + patches.kernel.org/6.2.3-650-ice-add-missing-checks-for-PF-vsi-type.patch + patches.kernel.org/6.2.3-651-Compiler-attributes-GCC-cold-function-alignment.patch + patches.kernel.org/6.2.3-652-ACPI-Don-t-build-ACPICA-with-Os.patch + patches.kernel.org/6.2.3-653-bpf-docs-Fix-modulo-zero-division-by-zero-overf.patch + patches.kernel.org/6.2.3-654-thermal-intel-intel_pch-Add-support-for-Wellsbu.patch + patches.kernel.org/6.2.3-655-clocksource-Suspend-the-watchdog-temporarily-wh.patch + patches.kernel.org/6.2.3-656-crypto-hisilicon-Wipe-entire-pool-on-error.patch + patches.kernel.org/6.2.3-657-net-bcmgenet-Add-a-check-for-oversized-packets.patch + patches.kernel.org/6.2.3-658-m68k-Check-syscall_trace_enter-return-code.patch + patches.kernel.org/6.2.3-659-s390-mm-ptdump-avoid-Kasan-vs-Memcpy-Real-marke.patch + patches.kernel.org/6.2.3-660-netfilter-nf_tables-NULL-pointer-dereference-in.patch + patches.kernel.org/6.2.3-661-can-isotp-check-CAN-address-family-in-isotp_bin.patch + patches.kernel.org/6.2.3-662-gcc-plugins-drop-std-gnu-11-to-fix-GCC-13-build.patch + patches.kernel.org/6.2.3-663-tools-power-x86-intel-speed-select-Add-Emerald-.patch + patches.kernel.org/6.2.3-664-platform-x86-dell-ddv-Add-support-for-interface.patch + patches.kernel.org/6.2.3-665-wifi-mt76-dma-free-rx_head-in-mt76_dma_rx_clean.patch + patches.kernel.org/6.2.3-666-ACPI-video-Fix-Lenovo-Ideapad-Z570-DMI-match.patch + patches.kernel.org/6.2.3-667-net-mlx5-fw_tracer-Fix-debug-print.patch + patches.kernel.org/6.2.3-668-coda-Avoid-partial-allocation-of-sig_inputArgs.patch + patches.kernel.org/6.2.3-669-uaccess-Add-minimum-bounds-check-on-kernel-buff.patch + patches.kernel.org/6.2.3-670-s390-idle-mark-arch_cpu_idle-noinstr.patch + patches.kernel.org/6.2.3-671-time-debug-Fix-memory-leak-with-using-debugfs_l.patch + patches.kernel.org/6.2.3-672-PM-domains-fix-memory-leak-with-using-debugfs_l.patch + patches.kernel.org/6.2.3-673-PM-EM-fix-memory-leak-with-using-debugfs_lookup.patch + patches.kernel.org/6.2.3-674-Bluetooth-Fix-issue-with-Actions-Semi-ATS2851-b.patch + patches.kernel.org/6.2.3-675-Bluetooth-btusb-Add-new-PID-VID-0489-e0f2-for-M.patch + patches.kernel.org/6.2.3-676-Bluetooth-btusb-Add-VID-PID-13d3-3529-for-Realt.patch + patches.kernel.org/6.2.3-677-wifi-rtw89-debug-avoid-invalid-access-on-RTW89_.patch + patches.kernel.org/6.2.3-678-hv_netvsc-Check-status-in-SEND_RNDIS_PKT-comple.patch + patches.kernel.org/6.2.3-679-s390-kfence-fix-page-fault-reporting.patch + patches.kernel.org/6.2.3-680-devlink-Fix-TP_STRUCT_entry-in-trace-of-devlink.patch + patches.kernel.org/6.2.3-681-scm-add-user-copy-checks-to-put_cmsg.patch + patches.kernel.org/6.2.3-682-drm-panel-orientation-quirks-Add-quirk-for-Leno.patch + patches.kernel.org/6.2.3-683-drm-panel-orientation-quirks-Add-quirk-for-Dyna.patch + patches.kernel.org/6.2.3-684-drm-amd-display-Reduce-expected-sdp-bandwidth-f.patch + patches.kernel.org/6.2.3-685-drm-amd-display-Revert-Reduce-delay-when-sink-d.patch + patches.kernel.org/6.2.3-686-drm-amd-display-Fix-potential-null-deref-in-dm_.patch + patches.kernel.org/6.2.3-687-drm-omap-dsi-Fix-excessive-stack-usage.patch + patches.kernel.org/6.2.3-688-HID-Add-Mapping-for-System-Microphone-Mute.patch + patches.kernel.org/6.2.3-689-drm-tiny-ili9486-Do-not-assume-8-bit-only-SPI-c.patch + patches.kernel.org/6.2.3-690-drm-amd-display-Defer-DIG-FIFO-disable-after-VI.patch + patches.kernel.org/6.2.3-691-drm-radeon-free-iio-for-atombios-when-driver-sh.patch + patches.kernel.org/6.2.3-692-drm-amd-Avoid-BUG-for-case-of-SRIOV-missing-IP-.patch + patches.kernel.org/6.2.3-693-drm-amdkfd-Page-aligned-memory-reserve-size.patch + patches.kernel.org/6.2.3-694-scsi-lpfc-Fix-use-after-free-KFENCE-violation-d.patch + patches.kernel.org/6.2.3-695-Revert-fbcon-don-t-lose-the-console-font-across.patch + patches.kernel.org/6.2.3-696-drm-amd-Avoid-ASSERT-for-some-message-failures.patch + patches.kernel.org/6.2.3-697-drm-amd-display-Fix-memory-leakage.patch + patches.kernel.org/6.2.3-698-drm-amd-display-fix-mapping-to-non-allocated-ad.patch + patches.kernel.org/6.2.3-699-HID-uclogic-Add-frame-type-quirk.patch + patches.kernel.org/6.2.3-700-HID-uclogic-Add-battery-quirk.patch + patches.kernel.org/6.2.3-701-HID-uclogic-Add-support-for-XP-PEN-Deco-Pro-SW.patch + patches.kernel.org/6.2.3-702-HID-uclogic-Add-support-for-XP-PEN-Deco-Pro-MW.patch + patches.kernel.org/6.2.3-703-drm-msm-dsi-Add-missing-check-for-alloc_ordered.patch + patches.kernel.org/6.2.3-704-drm-rcar-du-Add-quirk-for-H3-ES1.x-pclk-workaro.patch + patches.kernel.org/6.2.3-705-drm-rcar-du-Fix-setting-a-reserved-bit-in-DPLLC.patch + patches.kernel.org/6.2.3-706-drm-drm_print-correct-format-problem.patch + patches.kernel.org/6.2.3-707-drm-amd-display-Set-hvm_enabled-flag-for-S-G-mo.patch + patches.kernel.org/6.2.3-708-drm-client-Test-for-connectors-before-sending-h.patch + patches.kernel.org/6.2.3-709-habanalabs-extend-fatal-messages-to-contain-PCI.patch + patches.kernel.org/6.2.3-710-habanalabs-fix-bug-in-timestamps-registration-c.patch + patches.kernel.org/6.2.3-711-docs-scripts-gdb-add-necessary-make-scripts_gdb.patch + patches.kernel.org/6.2.3-712-drm-msm-dpu-Add-DSC-hardware-blocks-to-register.patch + patches.kernel.org/6.2.3-713-ASoC-soc-compress-Reposition-and-add-pcm_mutex.patch + patches.kernel.org/6.2.3-714-ASoC-kirkwood-Iterate-over-array-indexes-instea.patch + patches.kernel.org/6.2.3-715-regulator-max77802-Bounds-check-regulator-id-ag.patch + patches.kernel.org/6.2.3-716-regulator-s5m8767-Bounds-check-id-indexing-into.patch + patches.kernel.org/6.2.3-717-Revert-drm-amdgpu-TA-unload-messages-are-not-ac.patch + patches.kernel.org/6.2.3-718-drm-amd-display-fix-FCLK-pstate-change-underflo.patch + patches.kernel.org/6.2.3-719-gfs2-Improve-gfs2_make_fs_rw-error-handling.patch + patches.kernel.org/6.2.3-720-hwmon-coretemp-Simplify-platform-device-handlin.patch + patches.kernel.org/6.2.3-721-hwmon-nct6775-Directly-call-ASUS-ACPI-WMI-metho.patch + patches.kernel.org/6.2.3-722-hwmon-nct6775-B650-B660-X670-ASUS-boards-suppor.patch + patches.kernel.org/6.2.3-723-pinctrl-at91-use-devm_kasprintf-to-avoid-potent.patch + patches.kernel.org/6.2.3-724-drm-amd-display-Do-not-commit-pipe-when-updatin.patch + patches.kernel.org/6.2.3-725-scsi-snic-Fix-memory-leak-with-using-debugfs_lo.patch + patches.kernel.org/6.2.3-726-scsi-ufs-core-Fix-device-management-cmd-timeout.patch + patches.kernel.org/6.2.3-727-HID-logitech-hidpp-Don-t-restart-communication-.patch + patches.kernel.org/6.2.3-728-drm-amd-display-Enable-P-state-validation-check.patch + patches.kernel.org/6.2.3-729-drm-panel-orientation-quirks-Add-quirk-for-Leno.patch + patches.kernel.org/6.2.3-730-drm-amd-display-Disable-HUBP-DPP-PG-on-DCN314-f.patch + patches.kernel.org/6.2.3-731-drm-amd-display-disable-SubVP-DRR-to-prevent-un.patch + patches.kernel.org/6.2.3-732-dm-thin-add-cond_resched-to-various-workqueue-l.patch + patches.kernel.org/6.2.3-733-dm-cache-add-cond_resched-to-various-workqueue-.patch + patches.kernel.org/6.2.3-734-nfsd-zero-out-pointers-after-putting-nfsd_files.patch + patches.kernel.org/6.2.3-735-nfsd-don-t-hand-out-delegation-on-setuid-files-.patch + patches.kernel.org/6.2.3-736-cifs-prevent-data-race-in-smb2_reconnect.patch + patches.kernel.org/6.2.3-737-drm-i915-mtl-Correct-implementation-of-Wa_18018.patch + patches.kernel.org/6.2.3-738-drm-shmem-helper-Revert-accidental-non-GPL-expo.patch + patches.kernel.org/6.2.3-739-driver-core-fw_devlink-Avoid-spurious-error-mes.patch + patches.kernel.org/6.2.3-740-wifi-rtl8xxxu-fixing-transmisison-failure-for-r.patch + patches.kernel.org/6.2.3-741-firmware-coreboot-framebuffer-Ignore-reserved-p.patch + patches.kernel.org/6.2.3-742-block-don-t-allow-multiple-bios-for-IOCB_NOWAIT.patch + patches.kernel.org/6.2.3-743-block-clear-bio-bi_bdev-when-putting-a-bio-back.patch + patches.kernel.org/6.2.3-744-block-be-a-bit-more-careful-in-checking-for-NUL.patch + patches.kernel.org/6.2.3-745-rtc-pm8xxx-fix-set-alarm-race.patch + patches.kernel.org/6.2.3-746-ipmi-ipmb-Fix-the-MODULE_PARM_DESC-associated-t.patch + patches.kernel.org/6.2.3-747-ipmi-ssif-resend_msg-cannot-fail.patch + patches.kernel.org/6.2.3-748-ipmi_ssif-Rename-idle-state-and-check.patch + patches.kernel.org/6.2.3-749-ipmi-ssif-Add-a-timer-between-request-retries.patch + patches.kernel.org/6.2.3-750-io_uring-Replace-0-length-array-with-flexible-a.patch + patches.kernel.org/6.2.3-751-io_uring-use-user-visible-tail-in-io_uring_poll.patch + patches.kernel.org/6.2.3-752-io_uring-handle-TIF_NOTIFY_RESUME-when-checking.patch + patches.kernel.org/6.2.3-753-io_uring-add-a-conditional-reschedule-to-the-IO.patch + patches.kernel.org/6.2.3-754-io_uring-add-reschedule-point-to-handle_tw_list.patch + patches.kernel.org/6.2.3-755-io_uring-rsrc-disallow-multi-source-reg-buffers.patch + patches.kernel.org/6.2.3-756-io_uring-remove-MSG_NOSIGNAL-from-recvmsg.patch + patches.kernel.org/6.2.3-757-io_uring-poll-allow-some-retries-for-poll-trigg.patch + patches.kernel.org/6.2.3-758-io_uring-fix-fget-leak-when-fs-don-t-support-no.patch + patches.kernel.org/6.2.3-759-s390-extmem-return-correct-segment-type-in-__se.patch + patches.kernel.org/6.2.3-760-s390-discard-.interp-section.patch + patches.kernel.org/6.2.3-761-s390-ipl-add-DEFINE_GENERIC_LOADPARM.patch + patches.kernel.org/6.2.3-762-s390-ipl-add-loadparm-parameter-to-eckd-ipl-rei.patch + patches.kernel.org/6.2.3-763-s390-kprobes-fix-irq-mask-clobbering-on-kprobe-.patch + patches.kernel.org/6.2.3-764-s390-kprobes-fix-current_kprobe-never-cleared-a.patch + patches.kernel.org/6.2.3-765-KVM-s390-disable-migration-mode-when-dirty-trac.patch + patches.kernel.org/6.2.3-766-cifs-improve-checking-of-DFS-links-over-STATUS_.patch + patches.kernel.org/6.2.3-767-cifs-Fix-uninitialized-memory-read-in-smb3_qfs_.patch + patches.kernel.org/6.2.3-768-cifs-Fix-uninitialized-memory-reads-for-oparms..patch + patches.kernel.org/6.2.3-769-cifs-fix-mount-on-old-smb-servers.patch + patches.kernel.org/6.2.3-770-cifs-introduce-cifs_io_parms-in-smb2_async_writ.patch + patches.kernel.org/6.2.3-771-cifs-split-out-smb3_use_rdma_offload-helper.patch + patches.kernel.org/6.2.3-772-cifs-don-t-try-to-use-rdma-offload-on-encrypted.patch + patches.kernel.org/6.2.3-773-cifs-Check-the-lease-context-if-we-actually-got.patch + patches.kernel.org/6.2.3-774-cifs-return-a-single-use-cfid-if-we-did-not-get.patch + patches.kernel.org/6.2.3-775-scsi-mpi3mr-Fix-missing-mrioc-evtack_cmds-initi.patch + patches.kernel.org/6.2.3-776-scsi-mpi3mr-Fix-issues-in-mpi3mr_get_all_tgt_in.patch + patches.kernel.org/6.2.3-777-scsi-mpi3mr-Remove-unnecessary-memcpy-to-alltgt.patch + patches.kernel.org/6.2.3-778-btrfs-hold-block-group-refcount-during-async-di.patch + patches.kernel.org/6.2.3-779-btrfs-sysfs-update-fs-features-directory-asynch.patch + patches.kernel.org/6.2.3-780-locking-rwsem-Prevent-non-first-waiter-from-spi.patch + patches.kernel.org/6.2.3-781-ksmbd-fix-wrong-data-area-length-for-smb2-lock-.patch + patches.kernel.org/6.2.3-782-ksmbd-do-not-allow-the-actual-frame-length-to-b.patch + patches.kernel.org/6.2.3-783-ksmbd-fix-possible-memory-leak-in-smb2_lock.patch + patches.kernel.org/6.2.3-784-torture-Fix-hang-during-kthread-shutdown-phase.patch + patches.kernel.org/6.2.3-785-ARM-dts-exynos-correct-HDMI-phy-compatible-in-E.patch + patches.kernel.org/6.2.3-786-io_uring-mark-task-TASK_RUNNING-before-handling.patch + patches.kernel.org/6.2.3-787-hfs-fix-missing-hfs_bnode_get-in-__hfs_bnode_cr.patch + patches.kernel.org/6.2.3-788-fs-hfsplus-fix-UAF-issue-in-hfsplus_put_super.patch + patches.kernel.org/6.2.3-789-exfat-fix-reporting-fs-error-when-reading-dir-b.patch + patches.kernel.org/6.2.3-790-exfat-fix-unexpected-EOF-while-reading-dir.patch + patches.kernel.org/6.2.3-791-exfat-redefine-DIR_DELETED-as-the-bad-cluster-n.patch + patches.kernel.org/6.2.3-792-exfat-fix-inode-i_blocks-for-non-512-byte-secto.patch + patches.kernel.org/6.2.3-793-fs-dlm-start-midcomms-before-scand.patch + patches.kernel.org/6.2.3-794-fs-dlm-fix-use-after-free-in-midcomms-commit.patch + patches.kernel.org/6.2.3-795-fs-dlm-be-sure-to-call-dlm_send_queue_flush.patch + patches.kernel.org/6.2.3-796-fs-dlm-fix-race-setting-stop-tx-flag.patch + patches.kernel.org/6.2.3-797-fs-dlm-don-t-set-stop-rx-flag-after-node-reset.patch + patches.kernel.org/6.2.3-798-fs-dlm-move-sending-fin-message-into-state-chan.patch + patches.kernel.org/6.2.3-799-fs-dlm-send-FIN-ack-back-in-right-cases.patch + patches.kernel.org/6.2.3-800-f2fs-fix-information-leak-in-f2fs_move_inline_d.patch + patches.kernel.org/6.2.3-801-f2fs-retry-to-update-the-inode-page-given-data-.patch + patches.kernel.org/6.2.3-802-f2fs-fix-cgroup-writeback-accounting-with-fs-la.patch + patches.kernel.org/6.2.3-803-f2fs-fix-kernel-crash-due-to-null-io-bio.patch + patches.kernel.org/6.2.3-804-f2fs-Revert-f2fs-truncate-blocks-in-batch-in-__.patch + patches.kernel.org/6.2.3-805-ocfs2-fix-defrag-path-triggering-jbd2-ASSERT.patch + patches.kernel.org/6.2.3-806-ocfs2-fix-non-auto-defrag-path-not-working-issu.patch + patches.kernel.org/6.2.3-807-fs-cramfs-inode.c-initialize-file_ra_state.patch + patches.kernel.org/6.2.3-808-selftests-landlock-Skip-overlayfs-tests-when-no.patch + patches.kernel.org/6.2.3-809-selftests-landlock-Test-ptrace-as-much-as-possi.patch + patches.kernel.org/6.2.3-810-udf-Truncate-added-extents-on-failed-expansion.patch + patches.kernel.org/6.2.3-811-udf-Do-not-bother-merging-very-long-extents.patch + patches.kernel.org/6.2.3-812-udf-Do-not-update-file-length-for-failed-writes.patch + patches.kernel.org/6.2.3-813-udf-Preserve-link-count-of-system-files.patch + patches.kernel.org/6.2.3-814-udf-Detect-system-inodes-linked-into-directory-.patch + patches.kernel.org/6.2.3-815-udf-Fix-file-corruption-when-appending-just-aft.patch + patches.kernel.org/6.2.3-816-md-don-t-update-recovery_cp-when-curr_resync-is.patch + patches.kernel.org/6.2.3-817-KVM-Destroy-target-device-if-coalesced-MMIO-unr.patch + patches.kernel.org/6.2.3-818-KVM-VMX-Fix-crash-due-to-uninitialized-current_.patch + patches.kernel.org/6.2.3-819-KVM-Register-dev-kvm-as-the-_very_-last-thing-d.patch + patches.kernel.org/6.2.3-820-KVM-x86-Purge-highest-ISR-cache-when-updating-A.patch + patches.kernel.org/6.2.3-821-KVM-x86-Blindly-get-current-x2APIC-reg-value-on.patch + patches.kernel.org/6.2.3-822-KVM-x86-Don-t-inhibit-APICv-AVIC-on-xAPIC-ID-ch.patch + patches.kernel.org/6.2.3-823-KVM-x86-Don-t-inhibit-APICv-AVIC-if-xAPIC-ID-mi.patch + patches.kernel.org/6.2.3-824-KVM-SVM-Flush-the-current-TLB-when-activating-A.patch + patches.kernel.org/6.2.3-825-KVM-SVM-Process-ICR-on-AVIC-IPI-delivery-failur.patch + patches.kernel.org/6.2.3-826-KVM-SVM-Don-t-put-load-AVIC-when-setting-virtua.patch + patches.kernel.org/6.2.3-827-KVM-x86-Inject-GP-if-WRMSR-sets-reserved-bits-i.patch + patches.kernel.org/6.2.3-828-KVM-x86-Inject-GP-on-x2APIC-WRMSR-that-sets-res.patch + patches.kernel.org/6.2.3-829-KVM-SVM-Fix-potential-overflow-in-SEV-s-send-re.patch + patches.kernel.org/6.2.3-830-KVM-SVM-hyper-v-placate-modpost-section-mismatc.patch + patches.kernel.org/6.2.3-831-selftests-x86-Fix-incorrect-kernel-headers-sear.patch + patches.kernel.org/6.2.3-832-x86-virt-Force-GIF-1-prior-to-disabling-SVM-for.patch + patches.kernel.org/6.2.3-833-x86-crash-Disable-virt-in-core-NMI-crash-handle.patch + patches.kernel.org/6.2.3-834-x86-reboot-Disable-virtualization-in-an-emergen.patch + patches.kernel.org/6.2.3-835-x86-reboot-Disable-SVM-not-just-VMX-when-stoppi.patch + patches.kernel.org/6.2.3-836-x86-kprobes-Fix-__recover_optprobed_insn-check-.patch + patches.kernel.org/6.2.3-837-x86-kprobes-Fix-arch_check_optimized_kprobe-che.patch + patches.kernel.org/6.2.3-838-x86-microcode-amd-Remove-load_microcode_amd-s-b.patch + patches.kernel.org/6.2.3-839-x86-microcode-AMD-Add-a-cpu-parameter-to-the-re.patch + patches.kernel.org/6.2.3-840-x86-microcode-AMD-Fix-mixed-steppings-support.patch + patches.kernel.org/6.2.3-841-x86-speculation-Allow-enabling-STIBP-with-legac.patch + patches.kernel.org/6.2.3-842-Documentation-hw-vuln-Document-the-interaction-.patch + patches.kernel.org/6.2.3-843-virt-sev-guest-Return-EIO-if-certificate-buffer.patch + patches.kernel.org/6.2.3-844-brd-mark-as-nowait-compatible.patch + patches.kernel.org/6.2.3-845-brd-return-0-error-from-brd_insert_page.patch + patches.kernel.org/6.2.3-846-brd-check-for-REQ_NOWAIT-and-set-correct-page-a.patch + patches.kernel.org/6.2.3-847-ima-fix-error-handling-logic-when-file-measurem.patch + patches.kernel.org/6.2.3-848-ima-Align-ima_file_mmap-parameters-with-mmap_fi.patch + patches.kernel.org/6.2.3-849-selftests-powerpc-Fix-incorrect-kernel-headers-.patch + patches.kernel.org/6.2.3-850-selftests-ftrace-Fix-eprobe-syntax-test-case-to.patch + patches.kernel.org/6.2.3-851-selftests-sched-Fix-incorrect-kernel-headers-se.patch + patches.kernel.org/6.2.3-852-selftests-core-Fix-incorrect-kernel-headers-sea.patch + patches.kernel.org/6.2.3-853-selftests-pid_namespace-Fix-incorrect-kernel-he.patch + patches.kernel.org/6.2.3-854-selftests-arm64-Fix-incorrect-kernel-headers-se.patch + patches.kernel.org/6.2.3-855-selftests-clone3-Fix-incorrect-kernel-headers-s.patch + patches.kernel.org/6.2.3-856-selftests-pidfd-Fix-incorrect-kernel-headers-se.patch + patches.kernel.org/6.2.3-857-selftests-membarrier-Fix-incorrect-kernel-heade.patch + patches.kernel.org/6.2.3-858-selftests-kcmp-Fix-incorrect-kernel-headers-sea.patch + patches.kernel.org/6.2.3-859-selftests-media_tests-Fix-incorrect-kernel-head.patch + patches.kernel.org/6.2.3-860-selftests-gpio-Fix-incorrect-kernel-headers-sea.patch + patches.kernel.org/6.2.3-861-selftests-filesystems-Fix-incorrect-kernel-head.patch + patches.kernel.org/6.2.3-862-selftests-user_events-Fix-incorrect-kernel-head.patch + patches.kernel.org/6.2.3-863-selftests-ptp-Fix-incorrect-kernel-headers-sear.patch + patches.kernel.org/6.2.3-864-selftests-sync-Fix-incorrect-kernel-headers-sea.patch + patches.kernel.org/6.2.3-865-selftests-rseq-Fix-incorrect-kernel-headers-sea.patch + patches.kernel.org/6.2.3-866-selftests-move_mount_set_group-Fix-incorrect-ke.patch + patches.kernel.org/6.2.3-867-selftests-mount_setattr-Fix-incorrect-kernel-he.patch + patches.kernel.org/6.2.3-868-selftests-perf_events-Fix-incorrect-kernel-head.patch + patches.kernel.org/6.2.3-869-selftests-ipc-Fix-incorrect-kernel-headers-sear.patch + patches.kernel.org/6.2.3-870-selftests-futex-Fix-incorrect-kernel-headers-se.patch + patches.kernel.org/6.2.3-871-selftests-drivers-Fix-incorrect-kernel-headers-.patch + patches.kernel.org/6.2.3-872-selftests-dmabuf-heaps-Fix-incorrect-kernel-hea.patch + patches.kernel.org/6.2.3-873-selftests-vm-Fix-incorrect-kernel-headers-searc.patch + patches.kernel.org/6.2.3-874-selftests-seccomp-Fix-incorrect-kernel-headers-.patch + patches.kernel.org/6.2.3-875-irqdomain-Fix-association-race.patch + patches.kernel.org/6.2.3-876-irqdomain-Fix-disassociation-race.patch + patches.kernel.org/6.2.3-877-irqdomain-Look-for-existing-mapping-only-once.patch + patches.kernel.org/6.2.3-878-irqdomain-Drop-bogus-fwspec-mapping-error-handl.patch + patches.kernel.org/6.2.3-879-irqdomain-Refactor-__irq_domain_alloc_irqs.patch + patches.kernel.org/6.2.3-880-irqdomain-Fix-mapping-creation-race.patch + patches.kernel.org/6.2.3-881-irqdomain-Fix-domain-registration-race.patch + patches.kernel.org/6.2.3-882-crypto-qat-fix-out-of-bounds-read.patch + patches.kernel.org/6.2.3-883-mm-damon-paddr-fix-missing-folio_put.patch + patches.kernel.org/6.2.3-884-ALSA-ice1712-Do-not-left-ice-gpio_mutex-locked-.patch + patches.kernel.org/6.2.3-885-ALSA-hda-realtek-Add-quirk-for-HP-EliteDesk-800.patch + patches.kernel.org/6.2.3-886-jbd2-fix-data-missing-when-reusing-bh-which-is-.patch + patches.kernel.org/6.2.3-887-ext4-optimize-ea_inode-block-expansion.patch + patches.kernel.org/6.2.3-888-ext4-refuse-to-create-ea-block-when-umounted.patch + patches.kernel.org/6.2.3-889-cxl-pmem-Fix-nvdimm-registration-races.patch + patches.kernel.org/6.2.3-890-Input-exc3000-properly-stop-timer-on-shutdown.patch + patches.kernel.org/6.2.3-891-mtd-spi-nor-sfdp-Fix-index-value-for-SCCR-dword.patch + patches.kernel.org/6.2.3-892-mtd-spi-nor-spansion-Consider-reserved-bits-in-.patch + patches.kernel.org/6.2.3-893-mtd-spi-nor-Fix-shift-out-of-bounds-in-spi_nor_.patch + patches.kernel.org/6.2.3-894-dm-send-just-one-event-on-resize-not-two.patch + patches.kernel.org/6.2.3-895-dm-add-cond_resched-to-dm_wq_work.patch + patches.kernel.org/6.2.3-896-dm-add-cond_resched-to-dm_wq_requeue_work.patch + patches.kernel.org/6.2.3-897-wifi-rtw88-use-RTW_FLAG_POWERON-flag-to-prevent.patch + patches.kernel.org/6.2.3-898-wifi-rtl8xxxu-Use-a-longer-retry-limit-of-48.patch + patches.kernel.org/6.2.3-899-wifi-ath11k-allow-system-suspend-to-survive-ath.patch + patches.kernel.org/6.2.3-900-wifi-cfg80211-Fix-use-after-free-for-wext.patch + patches.kernel.org/6.2.3-901-wifi-cfg80211-Set-SSID-if-it-is-not-already-set.patch + patches.kernel.org/6.2.3-902-cpuidle-add-ARCH_SUSPEND_POSSIBLE-dependencies.patch + patches.kernel.org/6.2.3-903-qede-fix-interrupt-coalescing-configuration.patch + patches.kernel.org/6.2.3-904-thermal-intel-powerclamp-Fix-cur_state-for-mult.patch + patches.kernel.org/6.2.3-905-dm-flakey-fix-logic-when-corrupting-a-bio.patch + patches.kernel.org/6.2.3-906-dm-cache-free-background-tracker-s-queued-work-.patch + patches.kernel.org/6.2.3-907-dm-flakey-don-t-corrupt-the-zero-page.patch + patches.kernel.org/6.2.3-908-dm-flakey-fix-a-bug-with-32-bit-highmem-systems.patch + patches.kernel.org/6.2.3-909-hwmon-peci-cputemp-Fix-off-by-one-in-coretemp_l.patch + patches.kernel.org/6.2.3-910-hwmon-nct6775-Fix-incorrect-parenthesization-in.patch + patches.kernel.org/6.2.3-911-spi-intel-Check-number-of-chip-selects-after-re.patch + patches.kernel.org/6.2.3-912-ARM-dts-qcom-sdx65-Add-Qcom-SMMU-500-as-the-fal.patch + patches.kernel.org/6.2.3-913-ARM-dts-qcom-sdx55-Add-Qcom-SMMU-500-as-the-fal.patch + patches.kernel.org/6.2.3-914-ARM-dts-exynos-correct-TMU-phandle-in-Exynos421.patch + patches.kernel.org/6.2.3-915-ARM-dts-exynos-correct-TMU-phandle-in-Exynos4.patch + patches.kernel.org/6.2.3-916-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch + patches.kernel.org/6.2.3-917-ARM-dts-exynos-correct-TMU-phandle-in-Exynos525.patch + patches.kernel.org/6.2.3-918-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-XU.patch + patches.kernel.org/6.2.3-919-ARM-dts-exynos-correct-TMU-phandle-in-Odroid-HC.patch + patches.kernel.org/6.2.3-920-arm64-acpi-Fix-possible-memory-leak-of-ffh_ctxt.patch + patches.kernel.org/6.2.3-921-arm64-mm-hugetlb-Disable-HUGETLB_PAGE_OPTIMIZE_.patch + patches.kernel.org/6.2.3-922-arm64-Reset-KASAN-tag-in-copy_highpage-with-HW-.patch + patches.kernel.org/6.2.3-923-fuse-add-inode-permission-checks-to-fileattr_ge.patch + patches.kernel.org/6.2.3-924-rbd-avoid-use-after-free-in-do_rbd_add-when-rbd.patch + patches.kernel.org/6.2.3-925-ceph-update-the-time-stamps-and-try-to-drop-the.patch + patches.kernel.org/6.2.3-926-regulator-core-Use-ktime_get_boottime-to-determ.patch + patches.kernel.org/6.2.3-927-panic-fix-the-panic_print-NMI-backtrace-setting.patch + patches.kernel.org/6.2.3-928-mm-hwpoison-convert-TTU_IGNORE_HWPOISON-to-TTU_.patch + patches.kernel.org/6.2.3-929-genirq-msi-platform-msi-Ensure-that-MSI-descrip.patch + patches.kernel.org/6.2.3-930-genirq-msi-Take-the-per-device-MSI-lock-before-.patch + patches.kernel.org/6.2.3-931-spi-spi-sn-f-ospi-fix-duplicate-flag-while-assi.patch + patches.kernel.org/6.2.3-932-alpha-fix-FEN-fault-handling.patch + patches.kernel.org/6.2.3-933-dax-kmem-Fix-leak-of-memory-hotplug-resources.patch + patches.kernel.org/6.2.3-934-mips-fix-syscall_get_nr.patch + patches.kernel.org/6.2.3-935-media-ipu3-cio2-Fix-PM-runtime-usage_count-in-d.patch + patches.kernel.org/6.2.3-936-remoteproc-mtk_scp-Move-clk-ops-outside-send_lo.patch + patches.kernel.org/6.2.3-937-vfio-Fix-NULL-pointer-dereference-caused-by-uni.patch + patches.kernel.org/6.2.3-938-docs-gdbmacros-print-newest-record.patch + patches.kernel.org/6.2.3-939-mm-memcontrol-deprecate-charge-moving.patch + patches.kernel.org/6.2.3-940-mm-thp-check-and-bail-out-if-page-in-deferred-q.patch + patches.kernel.org/6.2.3-941-ktest.pl-Give-back-console-on-Ctrt-C-on-monitor.patch + patches.kernel.org/6.2.3-942-kprobes-Fix-to-handle-forcibly-unoptimized-kpro.patch + patches.kernel.org/6.2.3-943-ktest.pl-Fix-missing-end_monitor-when-machine-c.patch + patches.kernel.org/6.2.3-944-ktest.pl-Add-RUN_TIMEOUT-option-with-default-un.patch + patches.kernel.org/6.2.3-945-memory-tier-release-the-new_memtier-in-find_cre.patch + patches.kernel.org/6.2.3-946-ring-buffer-Handle-race-between-rb_move_tail-an.patch + patches.kernel.org/6.2.3-947-tools-bootconfig-fix-single-used-for-logical-co.patch + patches.kernel.org/6.2.3-948-tracing-eprobe-Fix-to-add-filter-on-eprobe-desc.patch + patches.kernel.org/6.2.3-949-iommu-amd-Add-a-length-limitation-for-the-ivrs_.patch + patches.kernel.org/6.2.3-950-scsi-aacraid-Allocate-cmd_priv-with-scsicmd.patch + patches.kernel.org/6.2.3-951-scsi-qla2xxx-Fix-link-failure-in-NPIV-environme.patch + patches.kernel.org/6.2.3-952-scsi-qla2xxx-Check-if-port-is-online-before-sen.patch + patches.kernel.org/6.2.3-953-scsi-qla2xxx-Fix-DMA-API-call-trace-on-NVMe-LS-.patch + patches.kernel.org/6.2.3-954-scsi-qla2xxx-Remove-unintended-flag-clearing.patch + patches.kernel.org/6.2.3-955-scsi-qla2xxx-Fix-erroneous-link-down.patch + patches.kernel.org/6.2.3-956-scsi-qla2xxx-Remove-increment-of-interface-err-.patch + patches.kernel.org/6.2.3-957-scsi-ses-Don-t-attach-if-enclosure-has-no-compo.patch + patches.kernel.org/6.2.3-958-scsi-ses-Fix-slab-out-of-bounds-in-ses_enclosur.patch + patches.kernel.org/6.2.3-959-scsi-ses-Fix-possible-addl_desc_ptr-out-of-boun.patch + patches.kernel.org/6.2.3-960-scsi-ses-Fix-possible-desc_ptr-out-of-bounds-ac.patch + patches.kernel.org/6.2.3-961-scsi-ses-Fix-slab-out-of-bounds-in-ses_intf_rem.patch + patches.kernel.org/6.2.3-962-RISC-V-add-a-spin_shadow_stack-declaration.patch + patches.kernel.org/6.2.3-963-riscv-Avoid-enabling-interrupts-in-die.patch + patches.kernel.org/6.2.3-964-riscv-mm-fix-regression-due-to-update_mmu_cache.patch + patches.kernel.org/6.2.3-965-riscv-jump_label-Fixup-unaligned-arch_static_br.patch + patches.kernel.org/6.2.3-966-riscv-ftrace-Fixup-panic-by-disabling-preemptio.patch + patches.kernel.org/6.2.3-967-riscv-mm-Perform-BPF-exhandler-fixup-on-page-fa.patch + patches.kernel.org/6.2.3-968-riscv-ftrace-Remove-wasted-nops-for-RISCV_ISA_C.patch + patches.kernel.org/6.2.3-969-riscv-ftrace-Reduce-the-detour-code-size-to-hal.patch + patches.kernel.org/6.2.3-970-MIPS-DTS-CI20-fix-otg-power-gpio.patch + patches.kernel.org/6.2.3-971-PCI-PM-Observe-reset-delay-irrespective-of-brid.patch + patches.kernel.org/6.2.3-972-PCI-Unify-delay-handling-for-reset-and-resume.patch + patches.kernel.org/6.2.3-973-PCI-hotplug-Allow-marking-devices-as-disconnect.patch + patches.kernel.org/6.2.3-974-PCI-Avoid-FLR-for-AMD-FCH-AHCI-adapters.patch + patches.kernel.org/6.2.3-975-PCI-DPC-Await-readiness-of-secondary-bus-after-.patch + patches.kernel.org/6.2.3-976-bus-mhi-ep-Only-send-ENOTCONN-status-if-client-.patch + patches.kernel.org/6.2.3-977-bus-mhi-ep-Move-chan-lock-to-the-start-of-proce.patch + patches.kernel.org/6.2.3-978-bus-mhi-ep-Save-channel-state-locally-during-su.patch + patches.kernel.org/6.2.3-979-iommufd-Make-sure-to-zero-vfio_iommu_type1_info.patch + patches.kernel.org/6.2.3-980-iommufd-Do-not-add-the-same-hwpt-to-the-ioas-hw.patch + patches.kernel.org/6.2.3-981-iommu-vt-d-Avoid-superfluous-IOTLB-tracking-in-.patch + patches.kernel.org/6.2.3-982-iommu-vt-d-Fix-PASID-directory-pointer-coherenc.patch + patches.kernel.org/6.2.3-983-vfio-type1-exclude-mdevs-from-VFIO_UPDATE_VADDR.patch + patches.kernel.org/6.2.3-984-vfio-type1-prevent-underflow-of-locked_vm-via-e.patch + patches.kernel.org/6.2.3-985-vfio-type1-track-locked_vm-per-dma.patch + patches.kernel.org/6.2.3-986-vfio-type1-restore-locked_vm.patch + patches.kernel.org/6.2.3-987-drm-amd-Fix-initialization-for-nbio-7.5.1.patch + patches.kernel.org/6.2.3-988-drm-i915-quirks-Add-inverted-backlight-quirk-fo.patch + patches.kernel.org/6.2.3-989-drm-radeon-Fix-eDP-for-single-display-iMac11-2.patch + patches.kernel.org/6.2.3-990-drm-i915-Don-t-use-stolen-memory-for-ring-buffe.patch + patches.kernel.org/6.2.3-991-drm-i915-Don-t-use-BAR-mappings-for-ring-buffer.patch + patches.kernel.org/6.2.3-992-drm-gud-Fix-UBSAN-warning.patch + patches.kernel.org/6.2.3-993-drm-edid-fix-AVI-infoframe-aspect-ratio-handlin.patch + patches.kernel.org/6.2.3-994-drm-edid-fix-parsing-of-3D-modes-from-HDMI-VSDB.patch + patches.kernel.org/6.2.3-995-qede-avoid-uninitialized-entries-in-coal_entry-.patch + patches.kernel.org/6.2.3-996-brd-use-radix_tree_maybe_preload-instead-of-rad.patch + patches.kernel.org/6.2.3-997-net-avoid-double-iput-when-sock_alloc_file-fail.patch + patches.kernel.org/6.2.3-998-Linux-6.2.3.patch ######################################################## # Build fixes that apply to the vanilla kernel too. @@ -66,7 +1064,6 @@ patches.rpmify/Add-ksym-provides-tool.patch patches.rpmify/Revert-kconfig-only-write-CONFIG_FOO-is-not-set-for-.patch patches.rpmify/BTF-Don-t-break-ABI-when-debuginfo-is-disabled.patch - patches.rpmify/bpf_doc-Fix-build-error-with-older-python-versions.patch ######################################################## # The sorted section should contain all patches that are