]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 6.12
authorSasha Levin <sashal@kernel.org>
Tue, 10 Dec 2024 20:35:44 +0000 (15:35 -0500)
committerSasha Levin <sashal@kernel.org>
Tue, 10 Dec 2024 20:35:44 +0000 (15:35 -0500)
Signed-off-by: Sasha Levin <sashal@kernel.org>
220 files changed:
queue-6.12/accel-qaic-add-aic080-support.patch [new file with mode: 0644]
queue-6.12/acpi-video-force-native-for-apple-macbookpro11-2-and.patch [new file with mode: 0644]
queue-6.12/acpi-x86-add-adev-null-check-to-acpi_quirk_skip_serd.patch [new file with mode: 0644]
queue-6.12/acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch [new file with mode: 0644]
queue-6.12/acpi-x86-clean-up-asus-entries-in-acpi_quirk_skip_dm.patch [new file with mode: 0644]
queue-6.12/acpi-x86-make-uart-skip-quirks-work-on-pci-uarts-wit.patch [new file with mode: 0644]
queue-6.12/af_packet-avoid-erroring-out-after-sock_init_data-in.patch [new file with mode: 0644]
queue-6.12/alsa-hda-conexant-use-the-new-codec-ssid-matching.patch [new file with mode: 0644]
queue-6.12/alsa-hda-realtek-use-codec-ssid-matching-for-lenovo-.patch [new file with mode: 0644]
queue-6.12/alsa-hda-use-own-quirk-lookup-helper.patch [new file with mode: 0644]
queue-6.12/alsa-usb-audio-make-mic-volume-workarounds-globally-.patch [new file with mode: 0644]
queue-6.12/asoc-amd-yc-add-quirk-for-microphone-on-lenovo-think.patch [new file with mode: 0644]
queue-6.12/asoc-amd-yc-fix-internal-mic-on-redmi-g-2022.patch [new file with mode: 0644]
queue-6.12/asoc-hdmi-codec-reorder-channel-allocation-list.patch [new file with mode: 0644]
queue-6.12/asoc-intel-soc-acpi-intel-arl-match-add-rt722-and-rt.patch [new file with mode: 0644]
queue-6.12/asoc-intel-sof_rt5682-add-hdmi-in-capture-with-rt568.patch [new file with mode: 0644]
queue-6.12/asoc-intel-sof_sdw-add-quirk-for-cs42l43-system-usin.patch [new file with mode: 0644]
queue-6.12/asoc-intel-sof_sdw-add-quirks-for-some-new-lenovo-la.patch [new file with mode: 0644]
queue-6.12/asoc-sdw_utils-add-a-quirk-to-allow-the-cs42l43-mic-.patch [new file with mode: 0644]
queue-6.12/asoc-sdw_utils-add-quirk-to-exclude-amplifier-functi.patch [new file with mode: 0644]
queue-6.12/asoc-sdw_utils-add-support-for-exclusion-dai-quirks.patch [new file with mode: 0644]
queue-6.12/block-rcu-protect-disk-conv_zones_bitmap.patch [new file with mode: 0644]
queue-6.12/bluetooth-add-new-quirks-for-ats2851.patch [new file with mode: 0644]
queue-6.12/bluetooth-btusb-add-3-hwids-for-mt7925.patch [new file with mode: 0644]
queue-6.12/bluetooth-btusb-add-new-vid-pid-0489-e111-for-mt7925.patch [new file with mode: 0644]
queue-6.12/bluetooth-btusb-add-new-vid-pid-0489-e124-for-mt7925.patch [new file with mode: 0644]
queue-6.12/bluetooth-btusb-add-rtl8852be-device-0489-e123-to-de.patch [new file with mode: 0644]
queue-6.12/bluetooth-btusb-add-usb-hw-ids-for-mt7920-mt7925.patch [new file with mode: 0644]
queue-6.12/bluetooth-hci_conn-reduce-hci_conn_drop-calls-in-two.patch [new file with mode: 0644]
queue-6.12/bluetooth-hci_conn-use-disable_delayed_work_sync.patch [new file with mode: 0644]
queue-6.12/bluetooth-hci_core-fix-not-checking-skb-length-on-hc.patch [new file with mode: 0644]
queue-6.12/bluetooth-l2cap-do-not-leave-dangling-sk-pointer-on-.patch [new file with mode: 0644]
queue-6.12/bluetooth-rfcomm-avoid-leaving-dangling-sk-pointer-i.patch [new file with mode: 0644]
queue-6.12/bluetooth-set-quirks-for-ats2851.patch [new file with mode: 0644]
queue-6.12/bluetooth-support-new-quirks-for-ats2851.patch [new file with mode: 0644]
queue-6.12/bpf-call-free_htab_elem-after-htab_unlock_bucket.patch [new file with mode: 0644]
queue-6.12/bpf-prevent-tailcall-infinite-loop-caused-by-freplac.patch [new file with mode: 0644]
queue-6.12/bpf-put-bpf_link-s-program-when-link-is-safe-to-be-d.patch [new file with mode: 0644]
queue-6.12/btrfs-avoid-unnecessary-device-path-update-for-the-s.patch [new file with mode: 0644]
queue-6.12/btrfs-canonicalize-the-device-path-before-adding-it.patch [new file with mode: 0644]
queue-6.12/btrfs-do-not-clear-read-only-when-adding-sprout-devi.patch [new file with mode: 0644]
queue-6.12/btrfs-don-t-take-dev_replace-rwsem-on-task-already-h.patch [new file with mode: 0644]
queue-6.12/cleanup-adjust-scoped_guard-macros-to-avoid-potentia.patch [new file with mode: 0644]
queue-6.12/clk-qcom-clk-alpha-pll-add-nss-huayra-alpha-pll-supp.patch [new file with mode: 0644]
queue-6.12/clk-qcom-dispcc-sm8550-enable-support-for-sar2130p.patch [new file with mode: 0644]
queue-6.12/clk-qcom-rcg2-add-clk_rcg2_shared_floor_ops.patch [new file with mode: 0644]
queue-6.12/clk-qcom-rpmh-add-support-for-sar2130p.patch [new file with mode: 0644]
queue-6.12/clk-qcom-tcsrcc-sm8550-add-sar2130p-support.patch [new file with mode: 0644]
queue-6.12/crypto-ecdsa-avoid-signed-integer-overflow-on-signat.patch [new file with mode: 0644]
queue-6.12/dlm-fix-possible-lkb_resource-null-dereference.patch [new file with mode: 0644]
queue-6.12/dma-debug-fix-a-possible-deadlock-on-radix_lock.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-adding-array-index-check-to-prevent-.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-disable-sg-displays-on-cyan-skillfis.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-fix-garbage-or-black-screen-when-res.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-fix-out-of-bounds-access-in-dcn21_li.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-fix-underflow-when-playing-8k-video-.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-full-exit-out-of-ips2-when-all-allow.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-parse-umc_info-or-vram_info-based-on.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-prune-invalid-modes-for-hdmi-output.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-remove-hw-w-a-toggle-if-on-dp2-hpo.patch [new file with mode: 0644]
queue-6.12/drm-amd-display-skip-disable-crtc-in-seemless-bootup.patch [new file with mode: 0644]
queue-6.12/drm-amdgpu-clear-rb_overflow-bit-when-enabling-inter.patch [new file with mode: 0644]
queue-6.12/drm-amdgpu-dereference-the-atcs-acpi-buffer.patch [new file with mode: 0644]
queue-6.12/drm-amdgpu-gfx9-add-cleaner-shader-for-gfx9.4.2.patch [new file with mode: 0644]
queue-6.12/drm-amdgpu-refine-error-handling-in-amdgpu_ttm_tt_pi.patch [new file with mode: 0644]
queue-6.12/drm-amdgpu-set-the-right-amdgpu-sg-segment-limitatio.patch [new file with mode: 0644]
queue-6.12/drm-amdgpu-skip-amdgpu_device_cache_pci_state-under-.patch [new file with mode: 0644]
queue-6.12/drm-amdgpu-vcn-reset-fw_shared-when-vcpu-buffers-cor.patch [new file with mode: 0644]
queue-6.12/drm-bridge-it6505-enable-module-autoloading.patch [new file with mode: 0644]
queue-6.12/drm-display-fix-building-with-gcc-15.patch [new file with mode: 0644]
queue-6.12/drm-mcde-enable-module-autoloading.patch [new file with mode: 0644]
queue-6.12/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch [new file with mode: 0644]
queue-6.12/drm-panel-orientation-quirks-add-quirk-for-aya-neo-f.patch [new file with mode: 0644]
queue-6.12/drm-panel-orientation-quirks-add-quirk-for-aya-neo-g.patch [new file with mode: 0644]
queue-6.12/drm-panel-simple-add-microchip-ac69t88a-lvds-display.patch [new file with mode: 0644]
queue-6.12/drm-panic-add-abgr2101010-support.patch [new file with mode: 0644]
queue-6.12/drm-radeon-r600_cs-fix-possible-int-overflow-in-r600.patch [new file with mode: 0644]
queue-6.12/drm-sched-memset-job-in-drm_sched_job_init.patch [new file with mode: 0644]
queue-6.12/drm-vc4-hdmi-avoid-log-spam-for-audio-start-failure.patch [new file with mode: 0644]
queue-6.12/drm-vc4-hvs-set-axi-panic-modes-for-the-hvs.patch [new file with mode: 0644]
queue-6.12/drm-xe-guc-ct-flush-g2h-worker-in-case-of-g2h-respon.patch [new file with mode: 0644]
queue-6.12/drm-xe-pciid-add-new-pci-id-for-arl.patch [new file with mode: 0644]
queue-6.12/drm-xe-pciids-add-pvc-s-pci-device-id-macros.patch [new file with mode: 0644]
queue-6.12/drm-xe-pciids-separate-arl-and-mtl-pci-ids.patch [new file with mode: 0644]
queue-6.12/drm-xe-pciids-separate-rpl-u-and-rpl-p-pci-ids.patch [new file with mode: 0644]
queue-6.12/drm-xe-ptl-l3bank-mask-is-not-available-on-the-media.patch [new file with mode: 0644]
queue-6.12/drm-xe-xe3-add-initial-set-of-workarounds.patch [new file with mode: 0644]
queue-6.12/dsa-qca8k-use-nested-lock-to-avoid-splat.patch [new file with mode: 0644]
queue-6.12/epoll-annotate-racy-check.patch [new file with mode: 0644]
queue-6.12/ext4-partial-zero-eof-block-on-unaligned-inode-size-.patch [new file with mode: 0644]
queue-6.12/f2fs-add-a-sysfs-node-to-limit-max-read-extent-count.patch [new file with mode: 0644]
queue-6.12/f2fs-fix-f2fs_bug_on-when-uninstalling-filesystem-ca.patch [new file with mode: 0644]
queue-6.12/f2fs-fix-to-shrink-read-extent-node-in-batches.patch [new file with mode: 0644]
queue-6.12/f2fs-print-message-if-fscorrupted-was-found-in-f2fs_.patch [new file with mode: 0644]
queue-6.12/fanotify-allow-reporting-errors-on-failure-to-open-f.patch [new file with mode: 0644]
queue-6.12/firmware-qcom-scm-allow-qseecom-on-dell-xps-13-9345.patch [new file with mode: 0644]
queue-6.12/firmware-qcom-scm-allow-qseecom-on-lenovo-yoga-slim-.patch [new file with mode: 0644]
queue-6.12/fs-ntfs3-fix-case-when-unmarked-clusters-intersect-w.patch [new file with mode: 0644]
queue-6.12/fs-ntfs3-fix-warning-in-ni_fiemap.patch [new file with mode: 0644]
queue-6.12/fsl-fman-validate-cell-index-value-obtained-from-dev.patch [new file with mode: 0644]
queue-6.12/gpio-free-irqs-that-are-still-requested-when-the-chi.patch [new file with mode: 0644]
queue-6.12/hid-add-per-device-quirk-to-force-bind-to-hid-generi.patch [new file with mode: 0644]
queue-6.12/hid-bpf-fix-nkro-on-mistel-md770.patch [new file with mode: 0644]
queue-6.12/hid-magicmouse-apple-magic-trackpad-2-usb-c-driver-s.patch [new file with mode: 0644]
queue-6.12/hwmon-nct6775-add-665-ace-600m-cl-to-asus-wmi-monito.patch [new file with mode: 0644]
queue-6.12/i2c-i801-add-support-for-intel-panther-lake.patch [new file with mode: 0644]
queue-6.12/i3c-mipi-i3c-hci-mask-ring-interrupts-before-ring-st.patch [new file with mode: 0644]
queue-6.12/i3c-use-i3cdev-desc-info-instead-of-calling-i3c_devi.patch [new file with mode: 0644]
queue-6.12/iio-adc-ad7192-properly-check-spi_get_device_match_d.patch [new file with mode: 0644]
queue-6.12/iio-light-ltr501-add-lter0303-to-the-supported-devic.patch [new file with mode: 0644]
queue-6.12/io_uring-tctx-work-around-xa_store-allocation-error-.patch [new file with mode: 0644]
queue-6.12/iommu-amd-fix-corruption-when-mapping-large-pages-fr.patch [new file with mode: 0644]
queue-6.12/irqchip-gicv3-its-add-workaround-for-hip09-its-errat.patch [new file with mode: 0644]
queue-6.12/jfs-add-a-check-to-prevent-array-index-out-of-bounds.patch [new file with mode: 0644]
queue-6.12/jfs-array-index-out-of-bounds-fix-in-dtreadfirst.patch [new file with mode: 0644]
queue-6.12/jfs-fix-array-index-out-of-bounds-in-jfs_readdir.patch [new file with mode: 0644]
queue-6.12/jfs-fix-shift-out-of-bounds-in-dbsplit.patch [new file with mode: 0644]
queue-6.12/kcsan-turn-report_filterlist_lock-into-a-raw_spinloc.patch [new file with mode: 0644]
queue-6.12/kmsan-uninit-value-in-inode_go_dump-5.patch [new file with mode: 0644]
queue-6.12/kselftest-arm64-don-t-leak-pipe-fds-in-pac.exec_sign.patch [new file with mode: 0644]
queue-6.12/kselftest-arm64-log-fp-stress-child-startup-errors-t.patch [new file with mode: 0644]
queue-6.12/leds-class-protect-brightness_show-with-led_cdev-led.patch [new file with mode: 0644]
queue-6.12/loongarch-fix-sleeping-in-atomic-context-for-preempt.patch [new file with mode: 0644]
queue-6.12/mailbox-pcc-check-before-sending-mctp-pcc-response-a.patch [new file with mode: 0644]
queue-6.12/media-cx231xx-add-support-for-dexatek-usb-video-grab.patch [new file with mode: 0644]
queue-6.12/media-uvcvideo-add-a-quirk-for-the-kaiweets-kti-w02-.patch [new file with mode: 0644]
queue-6.12/media-uvcvideo-force-uvc-version-to-1.0a-for-0408-40.patch [new file with mode: 0644]
queue-6.12/media-uvcvideo-realsense-d421-depth-module-metadata.patch [new file with mode: 0644]
queue-6.12/mips-loongson64-dts-really-fix-pcie-port-nodes-for-l.patch [new file with mode: 0644]
queue-6.12/misc-eeprom-eeprom_93cx6-add-quirk-for-extra-read-cl.patch [new file with mode: 0644]
queue-6.12/mmc-core-add-sd-card-quirk-for-broken-poweroff-notif.patch [new file with mode: 0644]
queue-6.12/mmc-sdhci-esdhc-imx-enable-quirks-sdhci_quirk_no_led.patch [new file with mode: 0644]
queue-6.12/mptcp-annotate-data-races-around-subflow-fully_estab.patch [new file with mode: 0644]
queue-6.12/mptcp-fix-possible-integer-overflow-in-mptcp_reset_t.patch [new file with mode: 0644]
queue-6.12/net-af_can-do-not-leave-a-dangling-sk-pointer-in-can.patch [new file with mode: 0644]
queue-6.12/net-ethernet-fs_enet-use-pa-to-format-resource_size_.patch [new file with mode: 0644]
queue-6.12/net-fec_mpc52xx_phy-use-pa-to-format-resource_size_t.patch [new file with mode: 0644]
queue-6.12/net-ieee802154-do-not-leave-a-dangling-sk-pointer-in.patch [new file with mode: 0644]
queue-6.12/net-inet-do-not-leave-a-dangling-sk-pointer-in-inet_.patch [new file with mode: 0644]
queue-6.12/net-inet6-do-not-leave-a-dangling-sk-pointer-in-inet.patch [new file with mode: 0644]
queue-6.12/net-neighbor-clear-error-in-case-strict-check-is-not.patch [new file with mode: 0644]
queue-6.12/net-sched-cbs-fix-integer-overflow-in-cbs_set_port_r.patch [new file with mode: 0644]
queue-6.12/net-sfp-change-quirks-for-alcatel-lucent-g-010s-p.patch [new file with mode: 0644]
queue-6.12/net-stmmac-programming-sequence-for-vlan-packets-wit.patch [new file with mode: 0644]
queue-6.12/net-tcp-add-missing-lockdep-annotations-for-tcp-ao-h.patch [new file with mode: 0644]
queue-6.12/netlink-specs-add-missing-bitset-attrs-to-ethtool-sp.patch [new file with mode: 0644]
queue-6.12/netpoll-use-rcu_access_pointer-in-__netpoll_setup.patch [new file with mode: 0644]
queue-6.12/nvdimm-rectify-the-illogical-code-within-nd_dax_prob.patch [new file with mode: 0644]
queue-6.12/pci-add-acs-quirk-for-wangxun-ff5xxx-nics.patch [new file with mode: 0644]
queue-6.12/pci-add-reset_subordinate-to-reset-hierarchy-below-b.patch [new file with mode: 0644]
queue-6.12/pci-detect-and-trust-built-in-thunderbolt-chips.patch [new file with mode: 0644]
queue-6.12/pci-qcom-add-support-for-ipq9574.patch [new file with mode: 0644]
queue-6.12/pci-starfive-enable-controller-runtime-pm-before-pro.patch [new file with mode: 0644]
queue-6.12/pci-vmd-add-did-8086-b06f-and-8086-b60b-for-intel-cl.patch [new file with mode: 0644]
queue-6.12/pci-vmd-set-devices-to-d0-before-enabling-pm-l1-subs.patch [new file with mode: 0644]
queue-6.12/perf-x86-amd-warn-only-on-new-bits-set.patch [new file with mode: 0644]
queue-6.12/pinctrl-freescale-fix-compile_test-error-with-pinctr.patch [new file with mode: 0644]
queue-6.12/pinctrl-qcom-pmic-gpio-add-support-for-pm8937.patch [new file with mode: 0644]
queue-6.12/pinctrl-qcom-spmi-mpp-add-pm8937-compatible.patch [new file with mode: 0644]
queue-6.12/pinmux-use-sequential-access-to-access-desc-pinmux-d.patch [new file with mode: 0644]
queue-6.12/powerpc-prom_init-fixup-missing-powermac-size-cells.patch [new file with mode: 0644]
queue-6.12/r8169-don-t-apply-udp-padding-quirk-on-rtl8126a.patch [new file with mode: 0644]
queue-6.12/regmap-maple-provide-lockdep-sub-class-for-maple-tre.patch [new file with mode: 0644]
queue-6.12/regulator-qcom-rpmh-update-ranges-for-ftsmps525.patch [new file with mode: 0644]
queue-6.12/remoteproc-qcom-pas-enable-sar2130p-audio-dsp-suppor.patch [new file with mode: 0644]
queue-6.12/revert-nvme-make-keep-alive-synchronous-operation.patch [new file with mode: 0644]
queue-6.12/ring-buffer-limit-time-with-disabled-interrupts-in-r.patch [new file with mode: 0644]
queue-6.12/rocker-fix-link-status-detection-in-rocker_carrier_i.patch [new file with mode: 0644]
queue-6.12/rtc-cmos-avoid-taking-rtc_lock-for-extended-period-o.patch [new file with mode: 0644]
queue-6.12/rtla-fix-consistency-in-getopt_long-for-timerlat_his.patch [new file with mode: 0644]
queue-6.12/rtla-timerlat-make-timerlat_hist_cpu-_count-unsigned.patch [new file with mode: 0644]
queue-6.12/rtla-timerlat-make-timerlat_top_cpu-_count-unsigned-.patch [new file with mode: 0644]
queue-6.12/rtla-utils-add-idle-state-disabling-via-libcpupower.patch [new file with mode: 0644]
queue-6.12/s390-cpum_sf-handle-cpu-hotplug-remove-during-sampli.patch [new file with mode: 0644]
queue-6.12/s390-pci-ignore-rid-for-isolated-vfs.patch [new file with mode: 0644]
queue-6.12/s390-pci-sort-pci-functions-prior-to-creating-virtua.patch [new file with mode: 0644]
queue-6.12/s390-pci-use-topology-id-for-multi-function-devices.patch [new file with mode: 0644]
queue-6.12/samples-bpf-fix-a-resource-leak.patch [new file with mode: 0644]
queue-6.12/sched_ext-add-a-missing-rcu_read_lock-unlock-pair-at.patch [new file with mode: 0644]
queue-6.12/scsi-hisi_sas-add-cond_resched-for-no-forced-preempt.patch [new file with mode: 0644]
queue-6.12/scsi-hisi_sas-create-all-dump-files-during-debugfs-i.patch [new file with mode: 0644]
queue-6.12/scsi-lpfc-call-lpfc_sli4_queue_unset-in-restart-and-.patch [new file with mode: 0644]
queue-6.12/scsi-lpfc-check-sli_active-flag-in-fdmi-cmpl-before-.patch [new file with mode: 0644]
queue-6.12/scsi-lpfc-prevent-ndlp-reference-count-underflow-in-.patch [new file with mode: 0644]
queue-6.12/scsi-st-add-mtiocget-and-mtload-to-ioctls-allowed-af.patch [new file with mode: 0644]
queue-6.12/scsi-st-don-t-modify-unknown-block-number-in-mtiocge.patch [new file with mode: 0644]
queue-6.12/scsi-ufs-core-make-dma-mask-configuration-more-flexi.patch [new file with mode: 0644]
queue-6.12/selftests-resctrl-protect-against-array-overflow-whe.patch [new file with mode: 0644]
queue-6.12/serial-8250_dw-add-sophgo-sg2044-quirk.patch [new file with mode: 0644]
queue-6.12/series
queue-6.12/setlocalversion-work-around-git-describe-performance.patch [new file with mode: 0644]
queue-6.12/smb-client-don-t-try-following-dfs-links-in-cifs_tre.patch [new file with mode: 0644]
queue-6.12/smb-client-memcpy-with-surrounding-object-base-addre.patch [new file with mode: 0644]
queue-6.12/soc-imx8m-probe-the-soc-driver-as-platform-driver.patch [new file with mode: 0644]
queue-6.12/soc-qcom-llcc-use-designated-initializers-for-llc-se.patch [new file with mode: 0644]
queue-6.12/soc-qcom-pd-mapper-add-qcm6490-pd-maps.patch [new file with mode: 0644]
queue-6.12/spi-spi-fsl-lpspi-adjust-type-of-scldiv.patch [new file with mode: 0644]
queue-6.12/thermal-drivers-qcom-tsens-v1-add-support-for-msm893.patch [new file with mode: 0644]
queue-6.12/timekeeping-always-check-for-negative-motion.patch [new file with mode: 0644]
queue-6.12/tools-rtla-enhance-argument-parsing-in-timerlat_load.patch [new file with mode: 0644]
queue-6.12/tools-rtla-fix-collision-with-glibc-sched_attr-sched.patch [new file with mode: 0644]
queue-6.12/tracing-fix-function-name-for-trampoline.patch [new file with mode: 0644]
queue-6.12/tracing-ftrace-disable-preemption-in-syscall-probe.patch [new file with mode: 0644]
queue-6.12/tracing-use-atomic64_inc_return-in-trace_clock_count.patch [new file with mode: 0644]
queue-6.12/usb-chipidea-add-ci_hdrc_has_short_pkt_limit-flag.patch [new file with mode: 0644]
queue-6.12/usb-chipidea-udc-create-bounce-buffer-for-problem-sg.patch [new file with mode: 0644]
queue-6.12/usb-chipidea-udc-handle-usb-error-interrupt-if-ioc-n.patch [new file with mode: 0644]
queue-6.12/usb-chipidea-udc-limit-usb-request-length-to-max-16k.patch [new file with mode: 0644]
queue-6.12/usb-typec-ucsi-do-not-call-acpi-_dsm-method-for-ucsi.patch [new file with mode: 0644]
queue-6.12/usb-typec-ucsi-glink-be-more-precise-on-orientation-.patch [new file with mode: 0644]
queue-6.12/verification-dot2-improve-dot-parser-robustness.patch [new file with mode: 0644]
queue-6.12/virtio-net-fix-overflow-inside-virtnet_rq_alloc.patch [new file with mode: 0644]
queue-6.12/wifi-ath10k-avoid-null-pointer-error-during-sdio-rem.patch [new file with mode: 0644]
queue-6.12/wifi-ath12k-fix-atomic-calls-in-ath12k_mac_op_set_bi.patch [new file with mode: 0644]
queue-6.12/wifi-ath5k-add-pci-id-for-arcadyan-devices.patch [new file with mode: 0644]
queue-6.12/wifi-ath5k-add-pci-id-for-sx76x.patch [new file with mode: 0644]
queue-6.12/wifi-brcmfmac-fix-oops-due-to-null-pointer-dereferen.patch [new file with mode: 0644]
queue-6.12/wifi-ipw2x00-libipw_rx_any-fix-bad-alignment.patch [new file with mode: 0644]
queue-6.12/wifi-rtw88-use-ieee80211_purge_tx_queue-to-purge-tx-.patch [new file with mode: 0644]
queue-6.12/wifi-rtw89-check-return-value-of-ieee80211_probereq_.patch [new file with mode: 0644]

diff --git a/queue-6.12/accel-qaic-add-aic080-support.patch b/queue-6.12/accel-qaic-add-aic080-support.patch
new file mode 100644 (file)
index 0000000..16a0b14
--- /dev/null
@@ -0,0 +1,87 @@
+From 9611de3fad8900921273ab7f3944254d66b13d4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 13:52:09 -0600
+Subject: accel/qaic: Add AIC080 support
+
+From: Jeffrey Hugo <quic_jhugo@quicinc.com>
+
+[ Upstream commit b8128f7815ff135f0333c1b46dcdf1543c41b860 ]
+
+Add basic support for the new AIC080 product. The PCIe Device ID is
+0xa080. AIC080 is a lower cost, lower performance SKU variant of AIC100.
+From the qaic perspective, it is the same as AIC100.
+
+Reviewed-by: Troy Hanson <quic_thanson@quicinc.com>
+Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Reviewed-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241004195209.3910996-1-quic_jhugo@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/accel/qaic/aic080.rst | 14 ++++++++++++++
+ Documentation/accel/qaic/index.rst  |  1 +
+ drivers/accel/qaic/qaic_drv.c       |  4 +++-
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+ create mode 100644 Documentation/accel/qaic/aic080.rst
+
+diff --git a/Documentation/accel/qaic/aic080.rst b/Documentation/accel/qaic/aic080.rst
+new file mode 100644
+index 0000000000000..d563771ea6ce4
+--- /dev/null
++++ b/Documentation/accel/qaic/aic080.rst
+@@ -0,0 +1,14 @@
++.. SPDX-License-Identifier: GPL-2.0-only
++
++===============================
++ Qualcomm Cloud AI 80 (AIC080)
++===============================
++
++Overview
++========
++
++The Qualcomm Cloud AI 80/AIC080 family of products are a derivative of AIC100.
++The number of NSPs and clock rates are reduced to fit within resource
++constrained solutions. The PCIe Product ID is 0xa080.
++
++As a derivative product, all AIC100 documentation applies.
+diff --git a/Documentation/accel/qaic/index.rst b/Documentation/accel/qaic/index.rst
+index ad19b88d1a669..967b9dd8bacea 100644
+--- a/Documentation/accel/qaic/index.rst
++++ b/Documentation/accel/qaic/index.rst
+@@ -10,4 +10,5 @@ accelerator cards.
+ .. toctree::
+    qaic
++   aic080
+    aic100
+diff --git a/drivers/accel/qaic/qaic_drv.c b/drivers/accel/qaic/qaic_drv.c
+index bf10156c334e7..f139c564eadf9 100644
+--- a/drivers/accel/qaic/qaic_drv.c
++++ b/drivers/accel/qaic/qaic_drv.c
+@@ -34,6 +34,7 @@
+ MODULE_IMPORT_NS(DMA_BUF);
++#define PCI_DEV_AIC080                        0xa080
+ #define PCI_DEV_AIC100                        0xa100
+ #define QAIC_NAME                     "qaic"
+ #define QAIC_DESC                     "Qualcomm Cloud AI Accelerators"
+@@ -365,7 +366,7 @@ static struct qaic_device *create_qdev(struct pci_dev *pdev, const struct pci_de
+               return NULL;
+       qdev->dev_state = QAIC_OFFLINE;
+-      if (id->device == PCI_DEV_AIC100) {
++      if (id->device == PCI_DEV_AIC080 || id->device == PCI_DEV_AIC100) {
+               qdev->num_dbc = 16;
+               qdev->dbc = devm_kcalloc(dev, qdev->num_dbc, sizeof(*qdev->dbc), GFP_KERNEL);
+               if (!qdev->dbc)
+@@ -607,6 +608,7 @@ static struct mhi_driver qaic_mhi_driver = {
+ };
+ static const struct pci_device_id qaic_ids[] = {
++      { PCI_DEVICE(PCI_VENDOR_ID_QCOM, PCI_DEV_AIC080), },
+       { PCI_DEVICE(PCI_VENDOR_ID_QCOM, PCI_DEV_AIC100), },
+       { }
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.12/acpi-video-force-native-for-apple-macbookpro11-2-and.patch b/queue-6.12/acpi-video-force-native-for-apple-macbookpro11-2-and.patch
new file mode 100644 (file)
index 0000000..9e8e424
--- /dev/null
@@ -0,0 +1,65 @@
+From e7e19d0e1b1814432d9b4038d45f0e730b2158dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2024 22:25:17 +0000
+Subject: ACPI: video: force native for Apple MacbookPro11,2 and Air7,2
+
+From: Jonathan Denose <jdenose@google.com>
+
+[ Upstream commit 295991836b23c12ddb447f7f583a17fd3616ad7d ]
+
+There is a bug in the Macbook Pro 11,2 and Air 7,2 firmware similar to
+what is described in:
+
+commit 7dc918daaf29 ("ACPI: video: force native for Apple MacbookPro9,2")
+
+This bug causes their backlights not to come back after resume.
+
+Add DMI quirks to select the working native Intel firmware interface
+such that the backlght comes back on after resume.
+
+Signed-off-by: Jonathan Denose <jdenose@google.com>
+Link: https://patch.msgid.link/20241112222516.1.I7fa78e6acbbed56ed5677f5e2dacc098a269d955@changeid
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 015bd8e66c1cf..d507d5e084354 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -549,6 +549,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+               DMI_MATCH(DMI_PRODUCT_NAME, "iMac12,2"),
+               },
+       },
++      {
++       .callback = video_detect_force_native,
++       /* Apple MacBook Air 7,2 */
++       .matches = {
++              DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++              DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir7,2"),
++              },
++      },
+       {
+        .callback = video_detect_force_native,
+        /* Apple MacBook Air 9,1 */
+@@ -565,6 +573,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+               DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro9,2"),
+               },
+       },
++      {
++       .callback = video_detect_force_native,
++       /* Apple MacBook Pro 11,2 */
++       .matches = {
++              DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++              DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro11,2"),
++              },
++      },
+       {
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=1217249 */
+        .callback = video_detect_force_native,
+-- 
+2.43.0
+
diff --git a/queue-6.12/acpi-x86-add-adev-null-check-to-acpi_quirk_skip_serd.patch b/queue-6.12/acpi-x86-add-adev-null-check-to-acpi_quirk_skip_serd.patch
new file mode 100644 (file)
index 0000000..288940e
--- /dev/null
@@ -0,0 +1,42 @@
+From 6fbff47ecd170fd343c55d652b6737ebbc4a644b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2024 23:00:28 +0100
+Subject: ACPI: x86: Add adev NULL check to
+ acpi_quirk_skip_serdev_enumeration()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 4a49194f587a62d972b602e3e1a2c3cfe6567966 ]
+
+acpi_dev_hid_match() does not check for adev == NULL, dereferencing
+it unconditional.
+
+Add a check for adev being NULL before calling acpi_dev_hid_match().
+
+At the moment acpi_quirk_skip_serdev_enumeration() is never called with
+a controller_parent without an ACPI companion, but better safe than sorry.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patch.msgid.link/20241109220028.83047-1-hdegoede@redhat.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index 3eec889d4f5f8..423565c31d5ef 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -536,7 +536,7 @@ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *s
+        * Set skip to true so that the tty core creates a serdev ctrl device.
+        * The backlight driver will manually create the serdev client device.
+        */
+-      if (acpi_dev_hid_match(adev, "DELL0501")) {
++      if (adev && acpi_dev_hid_match(adev, "DELL0501")) {
+               *skip = true;
+               /*
+                * Create a platform dev for dell-uart-backlight to bind to.
+-- 
+2.43.0
+
diff --git a/queue-6.12/acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch b/queue-6.12/acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch
new file mode 100644 (file)
index 0000000..bdeb27a
--- /dev/null
@@ -0,0 +1,62 @@
+From fe83cbc265c171e9a7c906bdeadd679d877a4118 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2024 10:58:24 +0100
+Subject: ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 82f250ed1a1dcde0ad2a1513f85af7f9514635e8 ]
+
+The Acer Iconia One 8 A1-840 (not to be confused with the A1-840FHD which
+is a different model) ships with Android 4.4 as factory OS and has the
+usual broken DSDT issues for x86 Android tablets.
+
+Add quirks to skip ACPI I2C client enumeration and disable ACPI battery/AC
+and ACPI GPIO event handlers.
+
+Also add the "INT33F5" HID for the TI PMIC used on this tablet to the list
+of HIDs for which not to skip i2c_client instantiation, since we do want
+an ACPI instantiated i2c_client for the PMIC.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patch.msgid.link/20241116095825.11660-1-hdegoede@redhat.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index 423565c31d5ef..1bb425b78032a 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -308,6 +308,18 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+                                       ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
+                                       ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+       },
++      {
++              /* Acer Iconia One 8 A1-840 (non FHD version) */
++              .matches = {
++                      DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
++                      DMI_MATCH(DMI_PRODUCT_NAME, "BayTrail"),
++                      /* Above strings are too generic also match BIOS date */
++                      DMI_MATCH(DMI_BIOS_DATE, "04/01/2014"),
++              },
++              .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
++                                      ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
++                                      ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
++      },
+       {
+               .matches = {
+                       DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+@@ -425,6 +437,7 @@ static const struct acpi_device_id i2c_acpi_known_good_ids[] = {
+       { "10EC5640", 0 }, /* RealTek ALC5640 audio codec */
+       { "10EC5651", 0 }, /* RealTek ALC5651 audio codec */
+       { "INT33F4", 0 },  /* X-Powers AXP288 PMIC */
++      { "INT33F5", 0 },  /* TI Dollar Cove PMIC */
+       { "INT33FD", 0 },  /* Intel Crystal Cove PMIC */
+       { "INT34D3", 0 },  /* Intel Whiskey Cove PMIC */
+       { "NPCE69A", 0 },  /* Asus Transformer keyboard dock */
+-- 
+2.43.0
+
diff --git a/queue-6.12/acpi-x86-clean-up-asus-entries-in-acpi_quirk_skip_dm.patch b/queue-6.12/acpi-x86-clean-up-asus-entries-in-acpi_quirk_skip_dm.patch
new file mode 100644 (file)
index 0000000..218e3ea
--- /dev/null
@@ -0,0 +1,80 @@
+From 53ecf42a3778e91184c6d63603f64db98b6173c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2024 10:58:25 +0100
+Subject: ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[]
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit bd8aa15848f5f21951cd0b0d01510b3ad1f777d4 ]
+
+The Asus entries in the acpi_quirk_skip_dmi_ids[] table are the only
+entries without a comment which model they apply to. Add these comments.
+
+The Asus TF103C entry also is in the wrong place for what is supposed to
+be an alphabetically sorted list. Move it up so that the list is properly
+sorted and add a comment that the list is alphabetically sorted.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patch.msgid.link/20241116095825.11660-2-hdegoede@redhat.com
+[ rjw: Changelog and subject edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index 1bb425b78032a..cb45ef5240dab 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -296,6 +296,7 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+       /*
+        * 2. Devices which also have the skip i2c/serdev quirks and which
+        *    need the x86-android-tablets module to properly work.
++       *    Sorted alphabetically.
+        */
+ #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS)
+       {
+@@ -321,6 +322,7 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+                                       ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+       },
+       {
++              /* Asus ME176C tablet */
+               .matches = {
+                       DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                       DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ME176C"),
+@@ -331,23 +333,24 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+                                       ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+       },
+       {
+-              /* Lenovo Yoga Book X90F/L */
++              /* Asus TF103C transformer 2-in-1 */
+               .matches = {
+-                      DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
+-                      DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
+-                      DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"),
++                      DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++                      DMI_MATCH(DMI_PRODUCT_NAME, "TF103C"),
+               },
+               .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
+-                                      ACPI_QUIRK_UART1_SKIP |
+                                       ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
+                                       ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+       },
+       {
++              /* Lenovo Yoga Book X90F/L */
+               .matches = {
+-                      DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+-                      DMI_MATCH(DMI_PRODUCT_NAME, "TF103C"),
++                      DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"),
+               },
+               .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
++                                      ACPI_QUIRK_UART1_SKIP |
+                                       ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
+                                       ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+       },
+-- 
+2.43.0
+
diff --git a/queue-6.12/acpi-x86-make-uart-skip-quirks-work-on-pci-uarts-wit.patch b/queue-6.12/acpi-x86-make-uart-skip-quirks-work-on-pci-uarts-wit.patch
new file mode 100644 (file)
index 0000000..f72296f
--- /dev/null
@@ -0,0 +1,118 @@
+From e61ad4c42c959aef57205a28fc8b076cad205176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2024 22:59:36 +0100
+Subject: ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 7f261203d7c2e0c06e668b25dfaaee091a79ab25 ]
+
+The Vexia EDU ATLA 10 tablet (9V version) which shipped with Android 4.2
+as factory OS has the usual broken DSDT issues for x86 Android tablets.
+
+On top of that this tablet is special because all its LPSS island
+peripherals are enumerated as PCI devices rather then as ACPI devices as
+they typically are.
+
+For the x86-android-tablets kmod to be able to instantiate a serdev client
+for the Bluetooth HCI on this tablet, an ACPI_QUIRK_UART1_SKIP quirk is
+necessary.
+
+Modify acpi_dmi_skip_serdev_enumeration() to work with PCI enumerated
+UARTs without an UID, such as the UARTs on this tablet.
+
+Also make acpi_dmi_skip_serdev_enumeration() exit early if there are no
+quirks, since there is nothing to do then.
+
+And add the necessary quirks for the Vexia EDU ATLA 10 tablet.
+
+This should compile with CONFIG_PCI being unset without issues because
+dev_is_pci() is defined as "(false)" then.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patch.msgid.link/20241109215936.83004-1-hdegoede@redhat.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 47 +++++++++++++++++++++++++++++++++-------
+ 1 file changed, 39 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index 6af546b21574f..3eec889d4f5f8 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -12,6 +12,7 @@
+ #include <linux/acpi.h>
+ #include <linux/dmi.h>
++#include <linux/pci.h>
+ #include <linux/platform_device.h>
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
+@@ -391,6 +392,19 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+               .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
+                                       ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY),
+       },
++      {
++              /* Vexia Edu Atla 10 tablet 9V version */
++              .matches = {
++                      DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++                      DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++                      /* Above strings are too generic, also match on BIOS date */
++                      DMI_MATCH(DMI_BIOS_DATE, "08/25/2014"),
++              },
++              .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
++                                      ACPI_QUIRK_UART1_SKIP |
++                                      ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
++                                      ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
++      },
+       {
+               /* Whitelabel (sold as various brands) TM800A550L */
+               .matches = {
+@@ -439,18 +453,35 @@ static int acpi_dmi_skip_serdev_enumeration(struct device *controller_parent, bo
+       struct acpi_device *adev = ACPI_COMPANION(controller_parent);
+       const struct dmi_system_id *dmi_id;
+       long quirks = 0;
+-      u64 uid;
+-      int ret;
++      u64 uid = 0;
+-      ret = acpi_dev_uid_to_integer(adev, &uid);
+-      if (ret)
++      dmi_id = dmi_first_match(acpi_quirk_skip_dmi_ids);
++      if (!dmi_id)
+               return 0;
+-      dmi_id = dmi_first_match(acpi_quirk_skip_dmi_ids);
+-      if (dmi_id)
+-              quirks = (unsigned long)dmi_id->driver_data;
++      quirks = (unsigned long)dmi_id->driver_data;
++
++      /* uid is left at 0 on errors and 0 is not a valid UART UID */
++      acpi_dev_uid_to_integer(adev, &uid);
++
++      /* For PCI UARTs without an UID */
++      if (!uid && dev_is_pci(controller_parent)) {
++              struct pci_dev *pdev = to_pci_dev(controller_parent);
++
++              /*
++               * Devfn values for PCI UARTs on Bay Trail SoCs, which are
++               * the only devices where this fallback is necessary.
++               */
++              if (pdev->devfn == PCI_DEVFN(0x1e, 3))
++                      uid = 1;
++              else if (pdev->devfn == PCI_DEVFN(0x1e, 4))
++                      uid = 2;
++      }
++
++      if (!uid)
++              return 0;
+-      if (!dev_is_platform(controller_parent)) {
++      if (!dev_is_platform(controller_parent) && !dev_is_pci(controller_parent)) {
+               /* PNP enumerated UARTs */
+               if ((quirks & ACPI_QUIRK_PNP_UART1_SKIP) && uid == 1)
+                       *skip = true;
+-- 
+2.43.0
+
diff --git a/queue-6.12/af_packet-avoid-erroring-out-after-sock_init_data-in.patch b/queue-6.12/af_packet-avoid-erroring-out-after-sock_init_data-in.patch
new file mode 100644 (file)
index 0000000..70bb3a0
--- /dev/null
@@ -0,0 +1,66 @@
+From a89b88de03256abf8d0221b88b007f2fa9db6e2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 16:38:00 +0100
+Subject: af_packet: avoid erroring out after sock_init_data() in
+ packet_create()
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+[ Upstream commit 46f2a11cb82b657fd15bab1c47821b635e03838b ]
+
+After sock_init_data() the allocated sk object is attached to the provided
+sock object. On error, packet_create() frees the sk object leaving the
+dangling pointer in the sock object on return. Some other code may try
+to use this pointer and cause use-after-free.
+
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241014153808.51894-2-ignat@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index a705ec2142540..97774bd4b6cb1 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3421,17 +3421,17 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
+       if (sock->type == SOCK_PACKET)
+               sock->ops = &packet_ops_spkt;
++      po = pkt_sk(sk);
++      err = packet_alloc_pending(po);
++      if (err)
++              goto out_sk_free;
++
+       sock_init_data(sock, sk);
+-      po = pkt_sk(sk);
+       init_completion(&po->skb_completion);
+       sk->sk_family = PF_PACKET;
+       po->num = proto;
+-      err = packet_alloc_pending(po);
+-      if (err)
+-              goto out2;
+-
+       packet_cached_dev_reset(po);
+       sk->sk_destruct = packet_sock_destruct;
+@@ -3463,7 +3463,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
+       sock_prot_inuse_add(net, &packet_proto, 1);
+       return 0;
+-out2:
++out_sk_free:
+       sk_free(sk);
+ out:
+       return err;
+-- 
+2.43.0
+
diff --git a/queue-6.12/alsa-hda-conexant-use-the-new-codec-ssid-matching.patch b/queue-6.12/alsa-hda-conexant-use-the-new-codec-ssid-matching.patch
new file mode 100644 (file)
index 0000000..e04ad70
--- /dev/null
@@ -0,0 +1,76 @@
+From bd07a1e48da8cf04d72de4cd39c804a635b6b27f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 14:02:30 +0200
+Subject: ALSA: hda/conexant: Use the new codec SSID matching
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 1f55e3699fc9ced72400cdca39fe248bf2b288a2 ]
+
+Now we can perform the codec ID matching primarily, and reduce the
+conditional application of the quirk for conflicting PCI SSID between
+System76 and Tuxedo devices.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20241008120233.7154-3-tiwai@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 28 +++++++---------------------
+ 1 file changed, 7 insertions(+), 21 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 4df30976b73a2..2e9f817b948eb 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -828,23 +828,6 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = {
+       {}
+ };
+-/* pincfg quirk for Tuxedo Sirius;
+- * unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14,
+- * which has incompatible pin setup, so we check the codec SSID (luckily
+- * different one!) and conditionally apply the quirk here
+- */
+-static void cxt_fixup_sirius_top_speaker(struct hda_codec *codec,
+-                                       const struct hda_fixup *fix,
+-                                       int action)
+-{
+-      /* ignore for incorrectly picked-up pang14 */
+-      if (codec->core.subsystem_id == 0x278212b3)
+-              return;
+-      /* set up the top speaker pin */
+-      if (action == HDA_FIXUP_ACT_PRE_PROBE)
+-              snd_hda_codec_set_pincfg(codec, 0x1d, 0x82170111);
+-}
+-
+ static const struct hda_fixup cxt_fixups[] = {
+       [CXT_PINCFG_LENOVO_X200] = {
+               .type = HDA_FIXUP_PINS,
+@@ -1009,8 +992,11 @@ static const struct hda_fixup cxt_fixups[] = {
+               .v.pins = cxt_pincfg_sws_js201d,
+       },
+       [CXT_PINCFG_TOP_SPEAKER] = {
+-              .type = HDA_FIXUP_FUNC,
+-              .v.func = cxt_fixup_sirius_top_speaker,
++              .type = HDA_FIXUP_PINS,
++              .v.pins = (const struct hda_pintbl[]) {
++                      { 0x1d, 0x82170111 },
++                      { }
++              },
+       },
+ };
+@@ -1109,8 +1095,8 @@ static const struct hda_quirk cxt5066_fixups[] = {
+       SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
+       SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
+       SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
+-      SND_PCI_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER),
+-      SND_PCI_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER),
++      HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER),
++      HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER),
+       {}
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.12/alsa-hda-realtek-use-codec-ssid-matching-for-lenovo-.patch b/queue-6.12/alsa-hda-realtek-use-codec-ssid-matching-for-lenovo-.patch
new file mode 100644 (file)
index 0000000..c93bee8
--- /dev/null
@@ -0,0 +1,188 @@
+From cf43750f9eae27cfe37bb58818fcab7eb2d01f6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 14:02:31 +0200
+Subject: ALSA: hda/realtek: Use codec SSID matching for Lenovo devices
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 504f052aa3435ab2f15af8b20bc4f4de8ff259c7 ]
+
+Now we can perform the codec ID matching primarily, and reduce the
+conditional application of the quirk for conflicting PCI SSIDs in
+various Lenovo devices.
+
+Here, HDA_CODEC_QUIRK() is applied at first so that the device with
+the codec SSID matching is picked up, followed by SND_PCI_QUIRK() for
+PCI SSID matching with the same ID number.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20241008120233.7154-4-tiwai@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 98 +++--------------------------------
+ 1 file changed, 8 insertions(+), 90 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1138883c68625..2aa8198d3ea1b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7726,8 +7726,6 @@ enum {
+       ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
+       ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
+       ALC298_FIXUP_LENOVO_C940_DUET7,
+-      ALC287_FIXUP_LENOVO_14IRP8_DUETITL,
+-      ALC287_FIXUP_LENOVO_LEGION_7,
+       ALC287_FIXUP_13S_GEN2_SPEAKERS,
+       ALC256_FIXUP_SET_COEF_DEFAULTS,
+       ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+@@ -7772,8 +7770,6 @@ enum {
+       ALC285_FIXUP_ASUS_GU605_SPI_SPEAKER2_TO_DAC1,
+       ALC287_FIXUP_LENOVO_THKPAD_WH_ALC1318,
+       ALC256_FIXUP_CHROME_BOOK,
+-      ALC287_FIXUP_LENOVO_14ARP8_LEGION_IAH7,
+-      ALC287_FIXUP_LENOVO_SSID_17AA3820,
+       ALC245_FIXUP_CLEVO_NOISY_MIC,
+       ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE,
+       ALC233_FIXUP_MEDION_MTL_SPK,
+@@ -7796,72 +7792,6 @@ static void alc298_fixup_lenovo_c940_duet7(struct hda_codec *codec,
+       __snd_hda_apply_fixup(codec, id, action, 0);
+ }
+-/* A special fixup for Lenovo Slim/Yoga Pro 9 14IRP8 and Yoga DuetITL 2021;
+- * 14IRP8 PCI SSID will mistakenly be matched with the DuetITL codec SSID,
+- * so we need to apply a different fixup in this case. The only DuetITL codec
+- * SSID reported so far is the 17aa:3802 while the 14IRP8 has the 17aa:38be
+- * and 17aa:38bf. If it weren't for the PCI SSID, the 14IRP8 models would
+- * have matched correctly by their codecs.
+- */
+-static void alc287_fixup_lenovo_14irp8_duetitl(struct hda_codec *codec,
+-                                            const struct hda_fixup *fix,
+-                                            int action)
+-{
+-      int id;
+-
+-      if (codec->core.subsystem_id == 0x17aa3802)
+-              id = ALC287_FIXUP_YOGA7_14ITL_SPEAKERS; /* DuetITL */
+-      else
+-              id = ALC287_FIXUP_TAS2781_I2C; /* 14IRP8 */
+-      __snd_hda_apply_fixup(codec, id, action, 0);
+-}
+-
+-/* Similar to above the Lenovo Yoga Pro 7 14ARP8 PCI SSID matches the codec SSID of the
+-   Legion Y9000X 2022 IAH7.*/
+-static void alc287_fixup_lenovo_14arp8_legion_iah7(struct hda_codec *codec,
+-                                         const struct hda_fixup *fix,
+-                                         int action)
+-{
+-      int id;
+-
+-      if (codec->core.subsystem_id == 0x17aa386e)
+-              id = ALC287_FIXUP_CS35L41_I2C_2; /* Legion Y9000X 2022 IAH7 */
+-      else
+-              id = ALC285_FIXUP_SPEAKER2_TO_DAC1; /* Yoga Pro 7 14ARP8 */
+-      __snd_hda_apply_fixup(codec, id, action, 0);
+-}
+-
+-/* Another hilarious PCI SSID conflict with Lenovo Legion Pro 7 16ARX8H (with
+- * TAS2781 codec) and Legion 7i 16IAX7 (with CS35L41 codec);
+- * we apply a corresponding fixup depending on the codec SSID instead
+- */
+-static void alc287_fixup_lenovo_legion_7(struct hda_codec *codec,
+-                                       const struct hda_fixup *fix,
+-                                       int action)
+-{
+-      int id;
+-
+-      if (codec->core.subsystem_id == 0x17aa38a8)
+-              id = ALC287_FIXUP_TAS2781_I2C; /* Legion Pro 7 16ARX8H */
+-      else
+-              id = ALC287_FIXUP_CS35L41_I2C_2; /* Legion 7i 16IAX7 */
+-      __snd_hda_apply_fixup(codec, id, action, 0);
+-}
+-
+-/* Yet more conflicting PCI SSID (17aa:3820) on two Lenovo models */
+-static void alc287_fixup_lenovo_ssid_17aa3820(struct hda_codec *codec,
+-                                            const struct hda_fixup *fix,
+-                                            int action)
+-{
+-      int id;
+-
+-      if (codec->core.subsystem_id == 0x17aa3820)
+-              id = ALC269_FIXUP_ASPIRE_HEADSET_MIC; /* IdeaPad 330-17IKB 81DM */
+-      else /* 0x17aa3802 */
+-              id =  ALC287_FIXUP_YOGA7_14ITL_SPEAKERS; /* "Yoga Duet 7 13ITL6 */
+-      __snd_hda_apply_fixup(codec, id, action, 0);
+-}
+-
+ static const struct hda_fixup alc269_fixups[] = {
+       [ALC269_FIXUP_GPIO2] = {
+               .type = HDA_FIXUP_FUNC,
+@@ -9810,14 +9740,6 @@ static const struct hda_fixup alc269_fixups[] = {
+               .type = HDA_FIXUP_FUNC,
+               .v.func = alc298_fixup_lenovo_c940_duet7,
+       },
+-      [ALC287_FIXUP_LENOVO_14IRP8_DUETITL] = {
+-              .type = HDA_FIXUP_FUNC,
+-              .v.func = alc287_fixup_lenovo_14irp8_duetitl,
+-      },
+-      [ALC287_FIXUP_LENOVO_LEGION_7] = {
+-              .type = HDA_FIXUP_FUNC,
+-              .v.func = alc287_fixup_lenovo_legion_7,
+-      },
+       [ALC287_FIXUP_13S_GEN2_SPEAKERS] = {
+               .type = HDA_FIXUP_VERBS,
+               .v.verbs = (const struct hda_verb[]) {
+@@ -10002,10 +9924,6 @@ static const struct hda_fixup alc269_fixups[] = {
+               .chained = true,
+               .chain_id = ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK,
+       },
+-      [ALC287_FIXUP_LENOVO_14ARP8_LEGION_IAH7] = {
+-              .type = HDA_FIXUP_FUNC,
+-              .v.func = alc287_fixup_lenovo_14arp8_legion_iah7,
+-      },
+       [ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN] = {
+               .type = HDA_FIXUP_FUNC,
+               .v.func = alc287_fixup_yoga9_14iap7_bass_spk_pin,
+@@ -10140,10 +10058,6 @@ static const struct hda_fixup alc269_fixups[] = {
+               .chained = true,
+               .chain_id = ALC225_FIXUP_HEADSET_JACK
+       },
+-      [ALC287_FIXUP_LENOVO_SSID_17AA3820] = {
+-              .type = HDA_FIXUP_FUNC,
+-              .v.func = alc287_fixup_lenovo_ssid_17aa3820,
+-      },
+       [ALC245_FIXUP_CLEVO_NOISY_MIC] = {
+               .type = HDA_FIXUP_FUNC,
+               .v.func = alc269_fixup_limit_int_mic_boost,
+@@ -10911,11 +10825,13 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x17aa, 0x31af, "ThinkCentre Station", ALC623_FIXUP_LENOVO_THINKSTATION_P340),
+       SND_PCI_QUIRK(0x17aa, 0x334b, "Lenovo ThinkCentre M70 Gen5", ALC283_FIXUP_HEADSET_MIC),
+       SND_PCI_QUIRK(0x17aa, 0x3801, "Lenovo Yoga9 14IAP7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
+-      SND_PCI_QUIRK(0x17aa, 0x3802, "Lenovo Yoga Pro 9 14IRP8 / DuetITL 2021", ALC287_FIXUP_LENOVO_14IRP8_DUETITL),
++      HDA_CODEC_QUIRK(0x17aa, 0x3802, "DuetITL 2021", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
++      SND_PCI_QUIRK(0x17aa, 0x3802, "Lenovo Yoga Pro 9 14IRP8", ALC287_FIXUP_TAS2781_I2C),
+       SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
+       SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940 / Yoga Duet 7", ALC298_FIXUP_LENOVO_C940_DUET7),
+       SND_PCI_QUIRK(0x17aa, 0x3819, "Lenovo 13s Gen2 ITL", ALC287_FIXUP_13S_GEN2_SPEAKERS),
+-      SND_PCI_QUIRK(0x17aa, 0x3820, "IdeaPad 330 / Yoga Duet 7", ALC287_FIXUP_LENOVO_SSID_17AA3820),
++      HDA_CODEC_QUIRK(0x17aa, 0x3820, "IdeaPad 330-17IKB 81DM", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
++      SND_PCI_QUIRK(0x17aa, 0x3820, "Yoga Duet 7 13ITL6", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
+       SND_PCI_QUIRK(0x17aa, 0x3824, "Legion Y9000X 2020", ALC285_FIXUP_LEGION_Y9000X_SPEAKERS),
+       SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),
+       SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
+@@ -10929,8 +10845,10 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x17aa, 0x3865, "Lenovo 13X", ALC287_FIXUP_CS35L41_I2C_2),
+       SND_PCI_QUIRK(0x17aa, 0x3866, "Lenovo 13X", ALC287_FIXUP_CS35L41_I2C_2),
+       SND_PCI_QUIRK(0x17aa, 0x3869, "Lenovo Yoga7 14IAL7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
+-      SND_PCI_QUIRK(0x17aa, 0x386e, "Legion Y9000X 2022 IAH7 / Yoga Pro 7 14ARP8",  ALC287_FIXUP_LENOVO_14ARP8_LEGION_IAH7),
+-      SND_PCI_QUIRK(0x17aa, 0x386f, "Legion Pro 7/7i", ALC287_FIXUP_LENOVO_LEGION_7),
++      HDA_CODEC_QUIRK(0x17aa, 0x386e, "Legion Y9000X 2022 IAH7", ALC287_FIXUP_CS35L41_I2C_2),
++      SND_PCI_QUIRK(0x17aa, 0x386e, "Yoga Pro 7 14ARP8", ALC285_FIXUP_SPEAKER2_TO_DAC1),
++      HDA_CODEC_QUIRK(0x17aa, 0x386f, "Legion Pro 7 16ARX8H", ALC287_FIXUP_TAS2781_I2C),
++      SND_PCI_QUIRK(0x17aa, 0x386f, "Legion Pro 7i 16IAX7", ALC287_FIXUP_CS35L41_I2C_2),
+       SND_PCI_QUIRK(0x17aa, 0x3870, "Lenovo Yoga 7 14ARB7", ALC287_FIXUP_YOGA7_14ARB7_I2C),
+       SND_PCI_QUIRK(0x17aa, 0x3877, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2),
+       SND_PCI_QUIRK(0x17aa, 0x3878, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2),
+-- 
+2.43.0
+
diff --git a/queue-6.12/alsa-hda-use-own-quirk-lookup-helper.patch b/queue-6.12/alsa-hda-use-own-quirk-lookup-helper.patch
new file mode 100644 (file)
index 0000000..26431a6
--- /dev/null
@@ -0,0 +1,529 @@
+From 8845528b96c06d7d2ac85d0b62230a9deb08c7e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 14:02:29 +0200
+Subject: ALSA: hda: Use own quirk lookup helper
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5b1913a79c3e0518d9c5db343fa9fc4edcea041f ]
+
+For allowing the primary codec SSID matching (that works around the
+conflicting PCI SSID problems), introduce a new struct hda_quirk,
+which is compatible with the existing struct snd_pci_quirk along with
+new helper functions and macros.
+
+The existing snd_pci_quirk tables are replaced with hda_quirk tables
+accordingly, while keeping SND_PCI_QUIRK() entry definitions as is.
+
+This patch shouldn't bring any behavior change, just some renaming and
+shifting the code.  The actual change for the codec SSID matching will
+follow after this.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20241008120233.7154-2-tiwai@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_auto_parser.c     | 61 +++++++++++++++++++++++------
+ sound/pci/hda/hda_local.h           | 22 ++++++++++-
+ sound/pci/hda/patch_analog.c        |  6 +--
+ sound/pci/hda/patch_cirrus.c        |  8 ++--
+ sound/pci/hda/patch_conexant.c      |  8 ++--
+ sound/pci/hda/patch_cs8409-tables.c |  2 +-
+ sound/pci/hda/patch_cs8409.h        |  2 +-
+ sound/pci/hda/patch_realtek.c       | 20 +++++-----
+ sound/pci/hda/patch_sigmatel.c      | 22 +++++------
+ sound/pci/hda/patch_via.c           |  2 +-
+ 10 files changed, 106 insertions(+), 47 deletions(-)
+
+diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
+index 7c6b1fe8dfcce..8e74be038b0fa 100644
+--- a/sound/pci/hda/hda_auto_parser.c
++++ b/sound/pci/hda/hda_auto_parser.c
+@@ -956,6 +956,28 @@ void snd_hda_pick_pin_fixup(struct hda_codec *codec,
+ }
+ EXPORT_SYMBOL_GPL(snd_hda_pick_pin_fixup);
++/* check whether the given quirk entry matches with vendor/device pair */
++static bool hda_quirk_match(u16 vendor, u16 device, const struct hda_quirk *q)
++{
++      if (q->subvendor != vendor)
++              return false;
++      return !q->subdevice ||
++              (device & q->subdevice_mask) == q->subdevice;
++}
++
++/* look through the quirk list and return the matching entry */
++static const struct hda_quirk *
++hda_quirk_lookup_id(u16 vendor, u16 device, const struct hda_quirk *list)
++{
++      const struct hda_quirk *q;
++
++      for (q = list; q->subvendor || q->subdevice; q++) {
++              if (hda_quirk_match(vendor, device, q))
++                      return q;
++      }
++      return NULL;
++}
++
+ /**
+  * snd_hda_pick_fixup - Pick up a fixup matching with PCI/codec SSID or model string
+  * @codec: the HDA codec
+@@ -975,14 +997,16 @@ EXPORT_SYMBOL_GPL(snd_hda_pick_pin_fixup);
+  */
+ void snd_hda_pick_fixup(struct hda_codec *codec,
+                       const struct hda_model_fixup *models,
+-                      const struct snd_pci_quirk *quirk,
++                      const struct hda_quirk *quirk,
+                       const struct hda_fixup *fixlist)
+ {
+-      const struct snd_pci_quirk *q;
++      const struct hda_quirk *q;
+       int id = HDA_FIXUP_ID_NOT_SET;
+       const char *name = NULL;
+       const char *type = NULL;
+       unsigned int vendor, device;
++      u16 pci_vendor, pci_device;
++      u16 codec_vendor, codec_device;
+       if (codec->fixup_id != HDA_FIXUP_ID_NOT_SET)
+               return;
+@@ -1013,27 +1037,42 @@ void snd_hda_pick_fixup(struct hda_codec *codec,
+       if (!quirk)
+               return;
++      if (codec->bus->pci) {
++              pci_vendor = codec->bus->pci->subsystem_vendor;
++              pci_device = codec->bus->pci->subsystem_device;
++      }
++
++      codec_vendor = codec->core.subsystem_id >> 16;
++      codec_device = codec->core.subsystem_id & 0xffff;
++
+       /* match with the SSID alias given by the model string "XXXX:YYYY" */
+       if (codec->modelname &&
+           sscanf(codec->modelname, "%04x:%04x", &vendor, &device) == 2) {
+-              q = snd_pci_quirk_lookup_id(vendor, device, quirk);
++              q = hda_quirk_lookup_id(vendor, device, quirk);
+               if (q) {
+                       type = "alias SSID";
+                       goto found_device;
+               }
+       }
+-      /* match with the PCI SSID */
+-      q = snd_pci_quirk_lookup(codec->bus->pci, quirk);
+-      if (q) {
+-              type = "PCI SSID";
+-              goto found_device;
++      /* match primarily with the PCI SSID */
++      for (q = quirk; q->subvendor || q->subdevice; q++) {
++              /* if the entry is specific to codec SSID, check with it */
++              if (!codec->bus->pci || q->match_codec_ssid) {
++                      if (hda_quirk_match(codec_vendor, codec_device, q)) {
++                              type = "codec SSID";
++                              goto found_device;
++                      }
++              } else {
++                      if (hda_quirk_match(pci_vendor, pci_device, q)) {
++                              type = "PCI SSID";
++                              goto found_device;
++                      }
++              }
+       }
+       /* match with the codec SSID */
+-      q = snd_pci_quirk_lookup_id(codec->core.subsystem_id >> 16,
+-                                  codec->core.subsystem_id & 0xffff,
+-                                  quirk);
++      q = hda_quirk_lookup_id(codec_vendor, codec_device, quirk);
+       if (q) {
+               type = "codec SSID";
+               goto found_device;
+diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
+index 53a5a62b78fa9..b7d926e9eb947 100644
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -292,6 +292,26 @@ struct hda_fixup {
+       } v;
+ };
++/*
++ * extended form of snd_pci_quirk:
++ * for PCI SSID matching, use SND_PCI_QUIRK() like before;
++ * for codec SSID matching, use the new HDA_CODEC_QUIRK() instead
++ */
++struct hda_quirk {
++      unsigned short subvendor;       /* PCI subvendor ID */
++      unsigned short subdevice;       /* PCI subdevice ID */
++      unsigned short subdevice_mask;  /* bitmask to match */
++      bool match_codec_ssid;          /* match only with codec SSID */
++      int value;                      /* value */
++#ifdef CONFIG_SND_DEBUG_VERBOSE
++      const char *name;               /* name of the device (optional) */
++#endif
++};
++
++#define HDA_CODEC_QUIRK(vend, dev, xname, val) \
++      { _SND_PCI_QUIRK_ID(vend, dev), .value = (val), .name = (xname),\
++                      .match_codec_ssid = true }
++
+ struct snd_hda_pin_quirk {
+       unsigned int codec;             /* Codec vendor/device ID */
+       unsigned short subvendor;       /* PCI subvendor ID */
+@@ -351,7 +371,7 @@ void snd_hda_apply_fixup(struct hda_codec *codec, int action);
+ void __snd_hda_apply_fixup(struct hda_codec *codec, int id, int action, int depth);
+ void snd_hda_pick_fixup(struct hda_codec *codec,
+                       const struct hda_model_fixup *models,
+-                      const struct snd_pci_quirk *quirk,
++                      const struct hda_quirk *quirk,
+                       const struct hda_fixup *fixlist);
+ void snd_hda_pick_pin_fixup(struct hda_codec *codec,
+                           const struct snd_hda_pin_quirk *pin_quirk,
+diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
+index 1e9dadcdc51be..56354fe060a1a 100644
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -345,7 +345,7 @@ static const struct hda_fixup ad1986a_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk ad1986a_fixup_tbl[] = {
++static const struct hda_quirk ad1986a_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x103c, 0x30af, "HP B2800", AD1986A_FIXUP_LAPTOP_IMIC),
+       SND_PCI_QUIRK(0x1043, 0x1153, "ASUS M9V", AD1986A_FIXUP_LAPTOP_IMIC),
+       SND_PCI_QUIRK(0x1043, 0x1443, "ASUS Z99He", AD1986A_FIXUP_EAPD),
+@@ -588,7 +588,7 @@ static const struct hda_fixup ad1981_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk ad1981_fixup_tbl[] = {
++static const struct hda_quirk ad1981_fixup_tbl[] = {
+       SND_PCI_QUIRK_VENDOR(0x1014, "Lenovo", AD1981_FIXUP_AMP_OVERRIDE),
+       SND_PCI_QUIRK_VENDOR(0x103c, "HP", AD1981_FIXUP_HP_EAPD),
+       SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", AD1981_FIXUP_AMP_OVERRIDE),
+@@ -1061,7 +1061,7 @@ static const struct hda_fixup ad1884_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk ad1884_fixup_tbl[] = {
++static const struct hda_quirk ad1884_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x103c, 0x2a82, "HP Touchsmart", AD1884_FIXUP_HP_TOUCHSMART),
+       SND_PCI_QUIRK_VENDOR(0x103c, "HP", AD1884_FIXUP_HP_EAPD),
+       SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo Thinkpad", AD1884_FIXUP_THINKPAD),
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index 654724559355e..06e046214a413 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -385,7 +385,7 @@ static const struct hda_model_fixup cs420x_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
++static const struct hda_quirk cs420x_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x10de, 0x0ac0, "MacBookPro 5,3", CS420X_MBP53),
+       SND_PCI_QUIRK(0x10de, 0x0d94, "MacBookAir 3,1(2)", CS420X_MBP55),
+       SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55),
+@@ -634,13 +634,13 @@ static const struct hda_model_fixup cs4208_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk cs4208_fixup_tbl[] = {
++static const struct hda_quirk cs4208_fixup_tbl[] = {
+       SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS4208_MAC_AUTO),
+       {} /* terminator */
+ };
+ /* codec SSID matching */
+-static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {
++static const struct hda_quirk cs4208_mac_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
+       SND_PCI_QUIRK(0x106b, 0x6c00, "MacMini 7,1", CS4208_MACMINI),
+       SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
+@@ -818,7 +818,7 @@ static const struct hda_model_fixup cs421x_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk cs421x_fixup_tbl[] = {
++static const struct hda_quirk cs421x_fixup_tbl[] = {
+       /* Test Intel board + CDB2410  */
+       SND_PCI_QUIRK(0x8086, 0x5001, "DP45SG/CDB4210", CS421X_CDB4210),
+       {} /* terminator */
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index b2bcdf76da305..4df30976b73a2 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1014,7 +1014,7 @@ static const struct hda_fixup cxt_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk cxt5045_fixups[] = {
++static const struct hda_quirk cxt5045_fixups[] = {
+       SND_PCI_QUIRK(0x103c, 0x30d5, "HP 530", CXT_FIXUP_HP_530),
+       SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba P105", CXT_FIXUP_TOSHIBA_P105),
+       /* HP, Packard Bell, Fujitsu-Siemens & Lenovo laptops have
+@@ -1034,7 +1034,7 @@ static const struct hda_model_fixup cxt5045_fixup_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk cxt5047_fixups[] = {
++static const struct hda_quirk cxt5047_fixups[] = {
+       /* HP laptops have really bad sound over 0 dB on NID 0x10.
+        */
+       SND_PCI_QUIRK_VENDOR(0x103c, "HP", CXT_FIXUP_CAP_MIX_AMP_5047),
+@@ -1046,7 +1046,7 @@ static const struct hda_model_fixup cxt5047_fixup_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk cxt5051_fixups[] = {
++static const struct hda_quirk cxt5051_fixups[] = {
+       SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
+       SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
+       {}
+@@ -1057,7 +1057,7 @@ static const struct hda_model_fixup cxt5051_fixup_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk cxt5066_fixups[] = {
++static const struct hda_quirk cxt5066_fixups[] = {
+       SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
+       SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
+       SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
+diff --git a/sound/pci/hda/patch_cs8409-tables.c b/sound/pci/hda/patch_cs8409-tables.c
+index 36b411d1a9609..759f48038273d 100644
+--- a/sound/pci/hda/patch_cs8409-tables.c
++++ b/sound/pci/hda/patch_cs8409-tables.c
+@@ -473,7 +473,7 @@ struct sub_codec dolphin_cs42l42_1 = {
+  *                    Arrays Used for all projects using CS8409
+  ******************************************************************************/
+-const struct snd_pci_quirk cs8409_fixup_tbl[] = {
++const struct hda_quirk cs8409_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x1028, 0x0A11, "Bullseye", CS8409_BULLSEYE),
+       SND_PCI_QUIRK(0x1028, 0x0A12, "Bullseye", CS8409_BULLSEYE),
+       SND_PCI_QUIRK(0x1028, 0x0A23, "Bullseye", CS8409_BULLSEYE),
+diff --git a/sound/pci/hda/patch_cs8409.h b/sound/pci/hda/patch_cs8409.h
+index 937e9387abdc7..5e48115caf096 100644
+--- a/sound/pci/hda/patch_cs8409.h
++++ b/sound/pci/hda/patch_cs8409.h
+@@ -355,7 +355,7 @@ int cs42l42_volume_put(struct snd_kcontrol *kctrl, struct snd_ctl_elem_value *uc
+ extern const struct hda_pcm_stream cs42l42_48k_pcm_analog_playback;
+ extern const struct hda_pcm_stream cs42l42_48k_pcm_analog_capture;
+-extern const struct snd_pci_quirk cs8409_fixup_tbl[];
++extern const struct hda_quirk cs8409_fixup_tbl[];
+ extern const struct hda_model_fixup cs8409_models[];
+ extern const struct hda_fixup cs8409_fixups[];
+ extern const struct hda_verb cs8409_cs42l42_init_verbs[];
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 8d9119d09222b..1138883c68625 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1567,7 +1567,7 @@ static const struct hda_fixup alc880_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk alc880_fixup_tbl[] = {
++static const struct hda_quirk alc880_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x1019, 0x0f69, "Coeus G610P", ALC880_FIXUP_W810),
+       SND_PCI_QUIRK(0x1043, 0x10c3, "ASUS W5A", ALC880_FIXUP_ASUS_W5A),
+       SND_PCI_QUIRK(0x1043, 0x1964, "ASUS Z71V", ALC880_FIXUP_Z71V),
+@@ -1876,7 +1876,7 @@ static const struct hda_fixup alc260_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk alc260_fixup_tbl[] = {
++static const struct hda_quirk alc260_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x1025, 0x007b, "Acer C20x", ALC260_FIXUP_GPIO1),
+       SND_PCI_QUIRK(0x1025, 0x007f, "Acer Aspire 9500", ALC260_FIXUP_COEF),
+       SND_PCI_QUIRK(0x1025, 0x008f, "Acer", ALC260_FIXUP_GPIO1),
+@@ -2568,7 +2568,7 @@ static const struct hda_fixup alc882_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk alc882_fixup_tbl[] = {
++static const struct hda_quirk alc882_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD),
+       SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
+       SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
+@@ -2912,7 +2912,7 @@ static const struct hda_fixup alc262_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk alc262_fixup_tbl[] = {
++static const struct hda_quirk alc262_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x103c, 0x170b, "HP Z200", ALC262_FIXUP_HP_Z200),
+       SND_PCI_QUIRK(0x10cf, 0x1397, "Fujitsu Lifebook S7110", ALC262_FIXUP_FSC_S7110),
+       SND_PCI_QUIRK(0x10cf, 0x142d, "Fujitsu Lifebook E8410", ALC262_FIXUP_BENQ),
+@@ -3073,7 +3073,7 @@ static const struct hda_model_fixup alc268_fixup_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk alc268_fixup_tbl[] = {
++static const struct hda_quirk alc268_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x1025, 0x0139, "Acer TravelMate 6293", ALC268_FIXUP_SPDIF),
+       SND_PCI_QUIRK(0x1025, 0x015b, "Acer AOA 150 (ZG5)", ALC268_FIXUP_INV_DMIC),
+       /* below is codec SSID since multiple Toshiba laptops have the
+@@ -10169,7 +10169,7 @@ static const struct hda_fixup alc269_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk alc269_fixup_tbl[] = {
++static const struct hda_quirk alc269_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x1025, 0x0283, "Acer TravelMate 8371", ALC269_FIXUP_INV_DMIC),
+       SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
+       SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
+@@ -11104,7 +11104,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+       {}
+ };
+-static const struct snd_pci_quirk alc269_fixup_vendor_tbl[] = {
++static const struct hda_quirk alc269_fixup_vendor_tbl[] = {
+       SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
+       SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED),
+       SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
+@@ -12040,7 +12040,7 @@ static const struct hda_fixup alc861_fixups[] = {
+       }
+ };
+-static const struct snd_pci_quirk alc861_fixup_tbl[] = {
++static const struct hda_quirk alc861_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x1043, 0x1253, "ASUS W7J", ALC660_FIXUP_ASUS_W7J),
+       SND_PCI_QUIRK(0x1043, 0x1263, "ASUS Z35HL", ALC660_FIXUP_ASUS_W7J),
+       SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP),
+@@ -12144,7 +12144,7 @@ static const struct hda_fixup alc861vd_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk alc861vd_fixup_tbl[] = {
++static const struct hda_quirk alc861vd_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x103c, 0x30bf, "HP TX1000", ALC861VD_FIX_DALLAS),
+       SND_PCI_QUIRK(0x1043, 0x1339, "ASUS A7-K", ALC660VD_FIX_ASUS_GPIO1),
+       SND_PCI_QUIRK(0x1179, 0xff31, "Toshiba L30-149", ALC861VD_FIX_DALLAS),
+@@ -12945,7 +12945,7 @@ static const struct hda_fixup alc662_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk alc662_fixup_tbl[] = {
++static const struct hda_quirk alc662_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2),
+       SND_PCI_QUIRK(0x1019, 0x9859, "JP-IK LEAP W502", ALC897_FIXUP_HEADSET_MIC_PIN3),
+       SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC),
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index ae1a34c68c616..bde6b73738583 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1462,7 +1462,7 @@ static const struct hda_model_fixup stac9200_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk stac9200_fixup_tbl[] = {
++static const struct hda_quirk stac9200_fixup_tbl[] = {
+       /* SigmaTel reference board */
+       SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
+                     "DFI LanParty", STAC_REF),
+@@ -1683,7 +1683,7 @@ static const struct hda_model_fixup stac925x_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk stac925x_fixup_tbl[] = {
++static const struct hda_quirk stac925x_fixup_tbl[] = {
+       /* SigmaTel reference board */
+       SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668, "DFI LanParty", STAC_REF),
+       SND_PCI_QUIRK(PCI_VENDOR_ID_DFI, 0x3101, "DFI LanParty", STAC_REF),
+@@ -1957,7 +1957,7 @@ static const struct hda_model_fixup stac92hd73xx_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
++static const struct hda_quirk stac92hd73xx_fixup_tbl[] = {
+       /* SigmaTel reference board */
+       SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
+                               "DFI LanParty", STAC_92HD73XX_REF),
+@@ -2753,7 +2753,7 @@ static const struct hda_model_fixup stac92hd83xxx_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = {
++static const struct hda_quirk stac92hd83xxx_fixup_tbl[] = {
+       /* SigmaTel reference board */
+       SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
+                     "DFI LanParty", STAC_92HD83XXX_REF),
+@@ -3236,7 +3236,7 @@ static const struct hda_model_fixup stac92hd71bxx_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk stac92hd71bxx_fixup_tbl[] = {
++static const struct hda_quirk stac92hd71bxx_fixup_tbl[] = {
+       /* SigmaTel reference board */
+       SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
+                     "DFI LanParty", STAC_92HD71BXX_REF),
+@@ -3496,7 +3496,7 @@ static const struct hda_pintbl ecs202_pin_configs[] = {
+ };
+ /* codec SSIDs for Intel Mac sharing the same PCI SSID 8384:7680 */
+-static const struct snd_pci_quirk stac922x_intel_mac_fixup_tbl[] = {
++static const struct hda_quirk stac922x_intel_mac_fixup_tbl[] = {
+       SND_PCI_QUIRK(0x0000, 0x0100, "Mac Mini", STAC_INTEL_MAC_V3),
+       SND_PCI_QUIRK(0x106b, 0x0800, "Mac", STAC_INTEL_MAC_V1),
+       SND_PCI_QUIRK(0x106b, 0x0600, "Mac", STAC_INTEL_MAC_V2),
+@@ -3640,7 +3640,7 @@ static const struct hda_model_fixup stac922x_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk stac922x_fixup_tbl[] = {
++static const struct hda_quirk stac922x_fixup_tbl[] = {
+       /* SigmaTel reference board */
+       SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
+                     "DFI LanParty", STAC_D945_REF),
+@@ -3968,7 +3968,7 @@ static const struct hda_model_fixup stac927x_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk stac927x_fixup_tbl[] = {
++static const struct hda_quirk stac927x_fixup_tbl[] = {
+       /* SigmaTel reference board */
+       SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
+                     "DFI LanParty", STAC_D965_REF),
+@@ -4178,7 +4178,7 @@ static const struct hda_model_fixup stac9205_models[] = {
+       {}
+ };
+-static const struct snd_pci_quirk stac9205_fixup_tbl[] = {
++static const struct hda_quirk stac9205_fixup_tbl[] = {
+       /* SigmaTel reference board */
+       SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
+                     "DFI LanParty", STAC_9205_REF),
+@@ -4255,7 +4255,7 @@ static const struct hda_fixup stac92hd95_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk stac92hd95_fixup_tbl[] = {
++static const struct hda_quirk stac92hd95_fixup_tbl[] = {
+       SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1911, "HP Spectre 13", STAC_92HD95_HP_BASS),
+       {} /* terminator */
+ };
+@@ -5002,7 +5002,7 @@ static const struct hda_fixup stac9872_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk stac9872_fixup_tbl[] = {
++static const struct hda_quirk stac9872_fixup_tbl[] = {
+       SND_PCI_QUIRK_MASK(0x104d, 0xfff0, 0x81e0,
+                          "Sony VAIO F/S", STAC_9872_VAIO),
+       {} /* terminator */
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index a8ef4bb70dd05..d0893059b1b9b 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -1035,7 +1035,7 @@ static const struct hda_fixup via_fixups[] = {
+       },
+ };
+-static const struct snd_pci_quirk vt2002p_fixups[] = {
++static const struct hda_quirk vt2002p_fixups[] = {
+       SND_PCI_QUIRK(0x1043, 0x13f7, "Asus B23E", VIA_FIXUP_POWER_SAVE),
+       SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
+       SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
+-- 
+2.43.0
+
diff --git a/queue-6.12/alsa-usb-audio-make-mic-volume-workarounds-globally-.patch b/queue-6.12/alsa-usb-audio-make-mic-volume-workarounds-globally-.patch
new file mode 100644 (file)
index 0000000..37bfe2a
--- /dev/null
@@ -0,0 +1,197 @@
+From 44a0680ddd6f906d8ef03008daddfdb44d4aa989 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2024 13:02:18 +0100
+Subject: ALSA: usb-audio: Make mic volume workarounds globally applicable
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit d6e6b9218ced5249b9136833ef5ec3f554ec7fde ]
+
+It seems that many webcams have buggy firmware and don't expose the
+mic capture volume with the proper resolution.  We have workarounds in
+mixer.c, but judging from the numbers, those can be better managed as
+global quirk flags.
+
+Link: https://patch.msgid.link/20241105120220.5740-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c    | 58 ++++++++++++--------------------------------
+ sound/usb/quirks.c   | 31 +++++++++++++++++++----
+ sound/usb/usbaudio.h |  4 +++
+ 3 files changed, 45 insertions(+), 48 deletions(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index bd67027c76775..0591da2839269 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1084,6 +1084,21 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+                                 struct snd_kcontrol *kctl)
+ {
+       struct snd_usb_audio *chip = cval->head.mixer->chip;
++
++      if (chip->quirk_flags & QUIRK_FLAG_MIC_RES_384) {
++              if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
++                      usb_audio_info(chip,
++                              "set resolution quirk: cval->res = 384\n");
++                      cval->res = 384;
++              }
++      } else if (chip->quirk_flags & QUIRK_FLAG_MIC_RES_16) {
++              if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
++                      usb_audio_info(chip,
++                              "set resolution quirk: cval->res = 16\n");
++                      cval->res = 16;
++              }
++      }
++
+       switch (chip->usb_id) {
+       case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */
+       case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */
+@@ -1168,27 +1183,6 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+               }
+               break;
+-      case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
+-      case USB_ID(0x046d, 0x0808):
+-      case USB_ID(0x046d, 0x0809):
+-      case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */
+-      case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+-      case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+-      case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
+-      case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
+-      case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */
+-      case USB_ID(0x046d, 0x0991):
+-      case USB_ID(0x046d, 0x09a2): /* QuickCam Communicate Deluxe/S7500 */
+-      /* Most audio usb devices lie about volume resolution.
+-       * Most Logitech webcams have res = 384.
+-       * Probably there is some logitech magic behind this number --fishor
+-       */
+-              if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+-                      usb_audio_info(chip,
+-                              "set resolution quirk: cval->res = 384\n");
+-                      cval->res = 384;
+-              }
+-              break;
+       case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */
+               if ((strstr(kctl->id.name, "Playback Volume") != NULL) ||
+                       strstr(kctl->id.name, "Capture Volume") != NULL) {
+@@ -1197,28 +1191,6 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+                       cval->res = 1;
+               }
+               break;
+-      case USB_ID(0x1224, 0x2a25): /* Jieli Technology USB PHY 2.0 */
+-              if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+-                      usb_audio_info(chip,
+-                              "set resolution quirk: cval->res = 16\n");
+-                      cval->res = 16;
+-              }
+-              break;
+-      case USB_ID(0x1bcf, 0x2283): /* NexiGo N930AF FHD Webcam */
+-      case USB_ID(0x03f0, 0x654a): /* HP 320 FHD Webcam */
+-              if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+-                      usb_audio_info(chip,
+-                              "set resolution quirk: cval->res = 16\n");
+-                      cval->res = 16;
+-              }
+-              break;
+-      case USB_ID(0x1bcf, 0x2281): /* HD Webcam */
+-              if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+-                      usb_audio_info(chip,
+-                              "set resolution quirk: cval->res = 16\n");
+-                      cval->res = 16;
+-              }
+-              break;
+       }
+ }
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 2cded83467c0d..00101875d9a8d 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2144,7 +2144,7 @@ struct usb_audio_quirk_flags_table {
+ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+       /* Device matches */
+       DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
+-                 QUIRK_FLAG_GET_SAMPLE_RATE),
++                 QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
+       DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
+                  QUIRK_FLAG_IGNORE_CTL_ERROR),
+       DEVICE_FLG(0x041e, 0x4080, /* Creative Live Cam VF0610 */
+@@ -2152,10 +2152,31 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+       DEVICE_FLG(0x045e, 0x083c, /* MS USB Link headset */
+                  QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY |
+                  QUIRK_FLAG_DISABLE_AUTOSUSPEND),
++      DEVICE_FLG(0x046d, 0x0807, /* Logitech Webcam C500 */
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
++      DEVICE_FLG(0x046d, 0x0808, /* Logitech Webcam C600 */
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
++      DEVICE_FLG(0x046d, 0x0809,
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
++      DEVICE_FLG(0x046d, 0x0819, /* Logitech Webcam C210 */
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
++      DEVICE_FLG(0x046d, 0x081b, /* HD Webcam c310 */
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
++      DEVICE_FLG(0x046d, 0x081d, /* HD Webcam c510 */
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
++      DEVICE_FLG(0x046d, 0x0825, /* HD Webcam c270 */
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
++      DEVICE_FLG(0x046d, 0x0826, /* HD Webcam c525 */
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+       DEVICE_FLG(0x046d, 0x084c, /* Logitech ConferenceCam Connect */
+                  QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY_1M),
++      DEVICE_FLG(0x046d, 0x08ca, /* Logitech Quickcam Fusion */
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+       DEVICE_FLG(0x046d, 0x0991, /* Logitech QuickCam Pro */
+-                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR),
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR |
++                 QUIRK_FLAG_MIC_RES_384),
++      DEVICE_FLG(0x046d, 0x09a2, /* QuickCam Communicate Deluxe/S7500 */
++                 QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384),
+       DEVICE_FLG(0x046d, 0x09a4, /* Logitech QuickCam E 3500 */
+                  QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR),
+       DEVICE_FLG(0x0499, 0x1509, /* Steinberg UR22 */
+@@ -2223,7 +2244,7 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+       DEVICE_FLG(0x0fd9, 0x0008, /* Hauppauge HVR-950Q */
+                  QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),
+       DEVICE_FLG(0x1224, 0x2a25, /* Jieli Technology USB PHY 2.0 */
+-                 QUIRK_FLAG_GET_SAMPLE_RATE),
++                 QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
+       DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */
+                  QUIRK_FLAG_GET_SAMPLE_RATE),
+       DEVICE_FLG(0x1397, 0x0507, /* Behringer UMC202HD */
+@@ -2261,9 +2282,9 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+       DEVICE_FLG(0x19f7, 0x0035, /* RODE NT-USB+ */
+                  QUIRK_FLAG_GET_SAMPLE_RATE),
+       DEVICE_FLG(0x1bcf, 0x2281, /* HD Webcam */
+-                 QUIRK_FLAG_GET_SAMPLE_RATE),
++                 QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
+       DEVICE_FLG(0x1bcf, 0x2283, /* NexiGo N930AF FHD Webcam */
+-                 QUIRK_FLAG_GET_SAMPLE_RATE),
++                 QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
+       DEVICE_FLG(0x2040, 0x7200, /* Hauppauge HVR-950Q */
+                  QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),
+       DEVICE_FLG(0x2040, 0x7201, /* Hauppauge HVR-950Q-MXL */
+diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
+index b0f042c996087..158ec053dc44d 100644
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -194,6 +194,8 @@ extern bool snd_usb_skip_validation;
+  * QUIRK_FLAG_FIXED_RATE
+  *  Do not set PCM rate (frequency) when only one rate is available
+  *  for the given endpoint.
++ * QUIRK_FLAG_MIC_RES_16 and QUIRK_FLAG_MIC_RES_384
++ *  Set the fixed resolution for Mic Capture Volume (mostly for webcams)
+  */
+ #define QUIRK_FLAG_GET_SAMPLE_RATE    (1U << 0)
+@@ -218,5 +220,7 @@ extern bool snd_usb_skip_validation;
+ #define QUIRK_FLAG_IFACE_SKIP_CLOSE   (1U << 19)
+ #define QUIRK_FLAG_FORCE_IFACE_RESET  (1U << 20)
+ #define QUIRK_FLAG_FIXED_RATE         (1U << 21)
++#define QUIRK_FLAG_MIC_RES_16         (1U << 22)
++#define QUIRK_FLAG_MIC_RES_384                (1U << 23)
+ #endif /* __USBAUDIO_H */
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-amd-yc-add-quirk-for-microphone-on-lenovo-think.patch b/queue-6.12/asoc-amd-yc-add-quirk-for-microphone-on-lenovo-think.patch
new file mode 100644 (file)
index 0000000..aadc015
--- /dev/null
@@ -0,0 +1,46 @@
+From eeed820285b8f91d387ed66e1b841d0cc7d6f46b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 08:56:05 +0100
+Subject: ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6
+ 21M1CTO1WW
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <ukleinek@debian.org>
+
+[ Upstream commit cbc86dd0a4fe9f8c41075328c2e740b68419d639 ]
+
+Add a quirk for Tova's Lenovo Thinkpad T14s with product name 21M1.
+
+Suggested-by: Tova <blueaddagio@laposte.net>
+Link: https://bugs.debian.org/1087673
+Signed-off-by: Uwe Kleine-König <ukleinek@debian.org>
+Link: https://patch.msgid.link/20241122075606.213132-2-ukleinek@debian.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 37820753ab09c..e38c5885dadfb 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -220,6 +220,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+                       DMI_MATCH(DMI_PRODUCT_NAME, "21J6"),
+               }
+       },
++      {
++              .driver_data = &acp6x_card,
++              .matches = {
++                      DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++                      DMI_MATCH(DMI_PRODUCT_NAME, "21M1"),
++              }
++      },
+       {
+               .driver_data = &acp6x_card,
+               .matches = {
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-amd-yc-fix-internal-mic-on-redmi-g-2022.patch b/queue-6.12/asoc-amd-yc-fix-internal-mic-on-redmi-g-2022.patch
new file mode 100644 (file)
index 0000000..fa112eb
--- /dev/null
@@ -0,0 +1,41 @@
+From 5da7326433d86bb8de11bda32744b4ec43816c36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2024 21:58:45 +0300
+Subject: ASoC: amd: yc: fix internal mic on Redmi G 2022
+
+From: Alex Far <anf1980@gmail.com>
+
+[ Upstream commit 67a0463d339059eeeead9cd015afa594659cfdaf ]
+
+This laptop model requires an additional detection quirk to enable the
+internal microphone
+
+Signed-off-by: Alex Far <anf1980@gmail.com>
+Link: https://patch.msgid.link/ZzjrZY3sImcqTtGx@RedmiG
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 5153a68d8c079..37820753ab09c 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -416,6 +416,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+                       DMI_MATCH(DMI_PRODUCT_NAME, "Xiaomi Book Pro 14 2022"),
+               }
+       },
++      {
++              .driver_data = &acp6x_card,
++              .matches = {
++                      DMI_MATCH(DMI_BOARD_VENDOR, "TIMI"),
++                      DMI_MATCH(DMI_PRODUCT_NAME, "Redmi G 2022"),
++              }
++      },
+       {
+               .driver_data = &acp6x_card,
+               .matches = {
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-hdmi-codec-reorder-channel-allocation-list.patch b/queue-6.12/asoc-hdmi-codec-reorder-channel-allocation-list.patch
new file mode 100644 (file)
index 0000000..1a26a55
--- /dev/null
@@ -0,0 +1,210 @@
+From 35583cb5aca5c9abc514654936acdb7df1732542 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2024 04:43:44 +0000
+Subject: ASoC: hdmi-codec: reorder channel allocation list
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 82ff5abc2edcfba0c0f1a1be807795e2876f46e9 ]
+
+The ordering in hdmi_codec_get_ch_alloc_table_idx() results in
+wrong channel allocation for a number of cases, e.g. when ELD
+reports FL|FR|LFE|FC|RL|RR or FL|FR|LFE|FC|RL|RR|RC|RLC|RRC:
+
+ca_id 0x01 with speaker mask FL|FR|LFE is selected instead of
+ca_id 0x03 with speaker mask FL|FR|LFE|FC for 4 channels
+
+and
+
+ca_id 0x04 with speaker mask FL|FR|RC gets selected instead of
+ca_id 0x0b with speaker mask FL|FR|LFE|FC|RL|RR for 6 channels
+
+Fix this by reordering the channel allocation list with most
+specific speaker masks at the top.
+
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Link: https://patch.msgid.link/20241115044344.3510979-1-christianshewitt@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdmi-codec.c | 140 +++++++++++++++++++---------------
+ 1 file changed, 77 insertions(+), 63 deletions(-)
+
+diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
+index 74caae52e1273..d9df29a26f4f2 100644
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -185,84 +185,97 @@ static const struct snd_pcm_chmap_elem hdmi_codec_8ch_chmaps[] = {
+ /*
+  * hdmi_codec_channel_alloc: speaker configuration available for CEA
+  *
+- * This is an ordered list that must match with hdmi_codec_8ch_chmaps struct
++ * This is an ordered list where ca_id must exist in hdmi_codec_8ch_chmaps
+  * The preceding ones have better chances to be selected by
+  * hdmi_codec_get_ch_alloc_table_idx().
+  */
+ static const struct hdmi_codec_cea_spk_alloc hdmi_codec_channel_alloc[] = {
+       { .ca_id = 0x00, .n_ch = 2,
+-        .mask = FL | FR},
+-      /* 2.1 */
+-      { .ca_id = 0x01, .n_ch = 4,
+-        .mask = FL | FR | LFE},
+-      /* Dolby Surround */
++        .mask = FL | FR },
++      { .ca_id = 0x03, .n_ch = 4,
++        .mask = FL | FR | LFE | FC },
+       { .ca_id = 0x02, .n_ch = 4,
+         .mask = FL | FR | FC },
+-      /* surround51 */
++      { .ca_id = 0x01, .n_ch = 4,
++        .mask = FL | FR | LFE },
+       { .ca_id = 0x0b, .n_ch = 6,
+-        .mask = FL | FR | LFE | FC | RL | RR},
+-      /* surround40 */
+-      { .ca_id = 0x08, .n_ch = 6,
+-        .mask = FL | FR | RL | RR },
+-      /* surround41 */
+-      { .ca_id = 0x09, .n_ch = 6,
+-        .mask = FL | FR | LFE | RL | RR },
+-      /* surround50 */
++        .mask = FL | FR | LFE | FC | RL | RR },
+       { .ca_id = 0x0a, .n_ch = 6,
+         .mask = FL | FR | FC | RL | RR },
+-      /* 6.1 */
+-      { .ca_id = 0x0f, .n_ch = 8,
+-        .mask = FL | FR | LFE | FC | RL | RR | RC },
+-      /* surround71 */
++      { .ca_id = 0x09, .n_ch = 6,
++        .mask = FL | FR | LFE | RL | RR },
++      { .ca_id = 0x08, .n_ch = 6,
++        .mask = FL | FR | RL | RR },
++      { .ca_id = 0x07, .n_ch = 6,
++        .mask = FL | FR | LFE | FC | RC },
++      { .ca_id = 0x06, .n_ch = 6,
++        .mask = FL | FR | FC | RC },
++      { .ca_id = 0x05, .n_ch = 6,
++        .mask = FL | FR | LFE | RC },
++      { .ca_id = 0x04, .n_ch = 6,
++        .mask = FL | FR | RC },
+       { .ca_id = 0x13, .n_ch = 8,
+         .mask = FL | FR | LFE | FC | RL | RR | RLC | RRC },
+-      /* others */
+-      { .ca_id = 0x03, .n_ch = 8,
+-        .mask = FL | FR | LFE | FC },
+-      { .ca_id = 0x04, .n_ch = 8,
+-        .mask = FL | FR | RC},
+-      { .ca_id = 0x05, .n_ch = 8,
+-        .mask = FL | FR | LFE | RC },
+-      { .ca_id = 0x06, .n_ch = 8,
+-        .mask = FL | FR | FC | RC },
+-      { .ca_id = 0x07, .n_ch = 8,
+-        .mask = FL | FR | LFE | FC | RC },
+-      { .ca_id = 0x0c, .n_ch = 8,
+-        .mask = FL | FR | RC | RL | RR },
+-      { .ca_id = 0x0d, .n_ch = 8,
+-        .mask = FL | FR | LFE | RL | RR | RC },
+-      { .ca_id = 0x0e, .n_ch = 8,
+-        .mask = FL | FR | FC | RL | RR | RC },
+-      { .ca_id = 0x10, .n_ch = 8,
+-        .mask = FL | FR | RL | RR | RLC | RRC },
+-      { .ca_id = 0x11, .n_ch = 8,
+-        .mask = FL | FR | LFE | RL | RR | RLC | RRC },
++      { .ca_id = 0x1f, .n_ch = 8,
++        .mask = FL | FR | LFE | FC | RL | RR | FLC | FRC },
+       { .ca_id = 0x12, .n_ch = 8,
+         .mask = FL | FR | FC | RL | RR | RLC | RRC },
+-      { .ca_id = 0x14, .n_ch = 8,
+-        .mask = FL | FR | FLC | FRC },
+-      { .ca_id = 0x15, .n_ch = 8,
+-        .mask = FL | FR | LFE | FLC | FRC },
+-      { .ca_id = 0x16, .n_ch = 8,
+-        .mask = FL | FR | FC | FLC | FRC },
+-      { .ca_id = 0x17, .n_ch = 8,
+-        .mask = FL | FR | LFE | FC | FLC | FRC },
+-      { .ca_id = 0x18, .n_ch = 8,
+-        .mask = FL | FR | RC | FLC | FRC },
+-      { .ca_id = 0x19, .n_ch = 8,
+-        .mask = FL | FR | LFE | RC | FLC | FRC },
+-      { .ca_id = 0x1a, .n_ch = 8,
+-        .mask = FL | FR | RC | FC | FLC | FRC },
+-      { .ca_id = 0x1b, .n_ch = 8,
+-        .mask = FL | FR | LFE | RC | FC | FLC | FRC },
+-      { .ca_id = 0x1c, .n_ch = 8,
+-        .mask = FL | FR | RL | RR | FLC | FRC },
+-      { .ca_id = 0x1d, .n_ch = 8,
+-        .mask = FL | FR | LFE | RL | RR | FLC | FRC },
+       { .ca_id = 0x1e, .n_ch = 8,
+         .mask = FL | FR | FC | RL | RR | FLC | FRC },
+-      { .ca_id = 0x1f, .n_ch = 8,
+-        .mask = FL | FR | LFE | FC | RL | RR | FLC | FRC },
++      { .ca_id = 0x11, .n_ch = 8,
++        .mask = FL | FR | LFE | RL | RR | RLC | RRC },
++      { .ca_id = 0x1d, .n_ch = 8,
++        .mask = FL | FR | LFE | RL | RR | FLC | FRC },
++      { .ca_id = 0x10, .n_ch = 8,
++        .mask = FL | FR | RL | RR | RLC | RRC },
++      { .ca_id = 0x1c, .n_ch = 8,
++        .mask = FL | FR | RL | RR | FLC | FRC },
++      { .ca_id = 0x0f, .n_ch = 8,
++        .mask = FL | FR | LFE | FC | RL | RR | RC },
++      { .ca_id = 0x1b, .n_ch = 8,
++        .mask = FL | FR | LFE | RC | FC | FLC | FRC },
++      { .ca_id = 0x0e, .n_ch = 8,
++        .mask = FL | FR | FC | RL | RR | RC },
++      { .ca_id = 0x1a, .n_ch = 8,
++        .mask = FL | FR | RC | FC | FLC | FRC },
++      { .ca_id = 0x0d, .n_ch = 8,
++        .mask = FL | FR | LFE | RL | RR | RC },
++      { .ca_id = 0x19, .n_ch = 8,
++        .mask = FL | FR | LFE | RC | FLC | FRC },
++      { .ca_id = 0x0c, .n_ch = 8,
++        .mask = FL | FR | RC | RL | RR },
++      { .ca_id = 0x18, .n_ch = 8,
++        .mask = FL | FR | RC | FLC | FRC },
++      { .ca_id = 0x17, .n_ch = 8,
++        .mask = FL | FR | LFE | FC | FLC | FRC },
++      { .ca_id = 0x16, .n_ch = 8,
++        .mask = FL | FR | FC | FLC | FRC },
++      { .ca_id = 0x15, .n_ch = 8,
++        .mask = FL | FR | LFE | FLC | FRC },
++      { .ca_id = 0x14, .n_ch = 8,
++        .mask = FL | FR | FLC | FRC },
++      { .ca_id = 0x0b, .n_ch = 8,
++        .mask = FL | FR | LFE | FC | RL | RR },
++      { .ca_id = 0x0a, .n_ch = 8,
++        .mask = FL | FR | FC | RL | RR },
++      { .ca_id = 0x09, .n_ch = 8,
++        .mask = FL | FR | LFE | RL | RR },
++      { .ca_id = 0x08, .n_ch = 8,
++        .mask = FL | FR | RL | RR },
++      { .ca_id = 0x07, .n_ch = 8,
++        .mask = FL | FR | LFE | FC | RC },
++      { .ca_id = 0x06, .n_ch = 8,
++        .mask = FL | FR | FC | RC },
++      { .ca_id = 0x05, .n_ch = 8,
++        .mask = FL | FR | LFE | RC },
++      { .ca_id = 0x04, .n_ch = 8,
++        .mask = FL | FR | RC },
++      { .ca_id = 0x03, .n_ch = 8,
++        .mask = FL | FR | LFE | FC },
++      { .ca_id = 0x02, .n_ch = 8,
++        .mask = FL | FR | FC },
++      { .ca_id = 0x01, .n_ch = 8,
++        .mask = FL | FR | LFE },
+ };
+ struct hdmi_codec_priv {
+@@ -371,7 +384,8 @@ static int hdmi_codec_chmap_ctl_get(struct snd_kcontrol *kcontrol,
+       struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
+       struct hdmi_codec_priv *hcp = info->private_data;
+-      map = info->chmap[hcp->chmap_idx].map;
++      if (hcp->chmap_idx != HDMI_CODEC_CHMAP_IDX_UNKNOWN)
++              map = info->chmap[hcp->chmap_idx].map;
+       for (i = 0; i < info->max_channels; i++) {
+               if (hcp->chmap_idx == HDMI_CODEC_CHMAP_IDX_UNKNOWN)
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-intel-soc-acpi-intel-arl-match-add-rt722-and-rt.patch b/queue-6.12/asoc-intel-soc-acpi-intel-arl-match-add-rt722-and-rt.patch
new file mode 100644 (file)
index 0000000..1a080f1
--- /dev/null
@@ -0,0 +1,125 @@
+From 30aafc46fd75749d2cc01b9be7af981324aa4a83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2024 15:26:31 +0800
+Subject: ASoC: Intel: soc-acpi-intel-arl-match: Add rt722 and rt1320 support
+
+From: Mac Chiang <mac.chiang@intel.com>
+
+[ Upstream commit f193fb888d1da45365daa7d0ff7a964c8305d407 ]
+
+This patch adds support for the rt722 multi-function codec and the
+rt1320 amplifier in the ARL board configuration.
+
+Link 0: RT722 codec with three endpoints: Headset, Speaker, and DMIC.
+Link 2: RT1320 amplifier.
+
+Note:
+The Speaker endpoint on the RT722 codec is not used.
+
+Signed-off-by: Mac Chiang <mac.chiang@intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20241028072631.15536-4-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../intel/common/soc-acpi-intel-arl-match.c   | 63 +++++++++++++++++++
+ 1 file changed, 63 insertions(+)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-arl-match.c b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
+index 072b8486d0727..24d850df77ca8 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-arl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
+@@ -44,6 +44,31 @@ static const struct snd_soc_acpi_endpoint spk_3_endpoint = {
+       .group_id = 1,
+ };
++/*
++ * RT722 is a multi-function codec, three endpoints are created for
++ * its headset, amp and dmic functions.
++ */
++static const struct snd_soc_acpi_endpoint rt722_endpoints[] = {
++      {
++              .num = 0,
++              .aggregated = 0,
++              .group_position = 0,
++              .group_id = 0,
++      },
++      {
++              .num = 1,
++              .aggregated = 0,
++              .group_position = 0,
++              .group_id = 0,
++      },
++      {
++              .num = 2,
++              .aggregated = 0,
++              .group_position = 0,
++              .group_id = 0,
++      },
++};
++
+ static const struct snd_soc_acpi_adr_device cs35l56_2_lr_adr[] = {
+       {
+               .adr = 0x00023001FA355601ull,
+@@ -185,6 +210,24 @@ static const struct snd_soc_acpi_adr_device rt711_sdca_0_adr[] = {
+       }
+ };
++static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = {
++      {
++              .adr = 0x000030025D072201ull,
++              .num_endpoints = ARRAY_SIZE(rt722_endpoints),
++              .endpoints = rt722_endpoints,
++              .name_prefix = "rt722"
++      }
++};
++
++static const struct snd_soc_acpi_adr_device rt1320_2_single_adr[] = {
++      {
++              .adr = 0x000230025D132001ull,
++              .num_endpoints = 1,
++              .endpoints = &single_endpoint,
++              .name_prefix = "rt1320-1"
++      }
++};
++
+ static const struct snd_soc_acpi_link_adr arl_cs42l43_l0[] = {
+       {
+               .mask = BIT(0),
+@@ -287,6 +330,20 @@ static const struct snd_soc_acpi_link_adr arl_sdca_rvp[] = {
+       {}
+ };
++static const struct snd_soc_acpi_link_adr arl_rt722_l0_rt1320_l2[] = {
++      {
++              .mask = BIT(0),
++              .num_adr = ARRAY_SIZE(rt722_0_single_adr),
++              .adr_d = rt722_0_single_adr,
++      },
++      {
++              .mask = BIT(2),
++              .num_adr = ARRAY_SIZE(rt1320_2_single_adr),
++              .adr_d = rt1320_2_single_adr,
++      },
++      {}
++};
++
+ static const struct snd_soc_acpi_codecs arl_essx_83x6 = {
+       .num_codecs = 3,
+       .codecs = { "ESSX8316", "ESSX8326", "ESSX8336"},
+@@ -385,6 +442,12 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_arl_sdw_machines[] = {
+               .drv_name = "sof_sdw",
+               .sof_tplg_filename = "sof-arl-rt711-l0.tplg",
+       },
++      {
++              .link_mask = BIT(0) | BIT(2),
++              .links = arl_rt722_l0_rt1320_l2,
++              .drv_name = "sof_sdw",
++              .sof_tplg_filename = "sof-arl-rt722-l0_rt1320-l2.tplg",
++      },
+       {},
+ };
+ EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_arl_sdw_machines);
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-intel-sof_rt5682-add-hdmi-in-capture-with-rt568.patch b/queue-6.12/asoc-intel-sof_rt5682-add-hdmi-in-capture-with-rt568.patch
new file mode 100644 (file)
index 0000000..de804e5
--- /dev/null
@@ -0,0 +1,68 @@
+From 823ca59b307dc807a539d84c2f324b50f817128b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 11:01:33 +0800
+Subject: ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for
+ MTL.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Balamurugan C <balamurugan.c@intel.com>
+
+[ Upstream commit 0f5d2228a99a4733b2a6652e16255be9caf2616a ]
+
+Added match table entry on mtl machines to support HDMI-In capture
+with rt5682 I2S audio codec. also added the respective quirk
+configuration in rt5682 machine driver.
+
+Signed-off-by: Balamurugan C <balamurugan.c@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20241004030135.67968-2-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_rt5682.c               | 7 +++++++
+ sound/soc/intel/common/soc-acpi-intel-mtl-match.c | 7 +++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
+index bc581fea0e3a1..866589fece7a3 100644
+--- a/sound/soc/intel/boards/sof_rt5682.c
++++ b/sound/soc/intel/boards/sof_rt5682.c
+@@ -870,6 +870,13 @@ static const struct platform_device_id board_ids[] = {
+                                       SOF_SSP_PORT_BT_OFFLOAD(2) |
+                                       SOF_BT_OFFLOAD_PRESENT),
+       },
++      {
++              .name = "mtl_rt5682_c1_h02",
++              .driver_data = (kernel_ulong_t)(SOF_RT5682_MCLK_EN |
++                                      SOF_SSP_PORT_CODEC(1) |
++                                      /* SSP 0 and SSP 2 are used for HDMI IN */
++                                      SOF_SSP_MASK_HDMI_CAPTURE(0x5)),
++      },
+       {
+               .name = "arl_rt5682_c1_h02",
+               .driver_data = (kernel_ulong_t)(SOF_RT5682_MCLK_EN |
+diff --git a/sound/soc/intel/common/soc-acpi-intel-mtl-match.c b/sound/soc/intel/common/soc-acpi-intel-mtl-match.c
+index d4435a34a3a3f..fd02c864e25ef 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-mtl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-mtl-match.c
+@@ -42,6 +42,13 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_machines[] = {
+                                       SND_SOC_ACPI_TPLG_INTEL_SSP_MSB |
+                                       SND_SOC_ACPI_TPLG_INTEL_DMIC_NUMBER,
+       },
++      {
++              .comp_ids = &mtl_rt5682_rt5682s_hp,
++              .drv_name = "mtl_rt5682_c1_h02",
++              .machine_quirk = snd_soc_acpi_codec_list,
++              .quirk_data = &mtl_lt6911_hdmi,
++              .sof_tplg_filename = "sof-mtl-rt5682-ssp1-hdmi-ssp02.tplg",
++      },
+       /* place boards for each headphone codec: sof driver will complete the
+        * tplg name and machine driver will detect the amp type
+        */
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-intel-sof_sdw-add-quirk-for-cs42l43-system-usin.patch b/queue-6.12/asoc-intel-sof_sdw-add-quirk-for-cs42l43-system-usin.patch
new file mode 100644 (file)
index 0000000..9f88ee4
--- /dev/null
@@ -0,0 +1,45 @@
+From 85c04866cb9f1b59c47a239829c41c344007b4d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 11:03:43 +0800
+Subject: ASoC: Intel: sof_sdw: Add quirk for cs42l43 system using host DMICs
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit ea657f6b24e11651a39292082be84ad81a89e525 ]
+
+Add quirk to inform the machine driver to not bind in the cs42l43
+microphone DAI link.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20241016030344.13535-4-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 4a0ab50d1e50d..fa937cc4d8cd1 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -580,6 +580,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+               },
+               .driver_data = (void *)(SOC_SDW_CODEC_SPKR),
+       },
++      {
++              .callback = sof_sdw_quirk_cb,
++              .matches = {
++                      DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "233C")
++              },
++              /* Note this quirk excludes the CODEC mic */
++              .driver_data = (void *)(SOC_SDW_CODEC_MIC),
++      },
+       /* ArrowLake devices */
+       {
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-intel-sof_sdw-add-quirks-for-some-new-lenovo-la.patch b/queue-6.12/asoc-intel-sof_sdw-add-quirks-for-some-new-lenovo-la.patch
new file mode 100644 (file)
index 0000000..ae84127
--- /dev/null
@@ -0,0 +1,74 @@
+From a9389667bac048eccc1cf3f14a37fa19076b1aa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 11:03:44 +0800
+Subject: ASoC: Intel: sof_sdw: Add quirks for some new Lenovo laptops
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 83c062ae81e89f73e3ab85953111a8b3daaaf98e ]
+
+Add some more sidecar amplifier quirks.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20241016030344.13535-5-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 32 ++++++++++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index fa937cc4d8cd1..a58842a8c8a64 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -580,6 +580,30 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+               },
+               .driver_data = (void *)(SOC_SDW_CODEC_SPKR),
+       },
++      {
++              .callback = sof_sdw_quirk_cb,
++              .matches = {
++                      DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "3838")
++              },
++              .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS),
++      },
++      {
++              .callback = sof_sdw_quirk_cb,
++              .matches = {
++                      DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "3832")
++              },
++              .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS),
++      },
++      {
++              .callback = sof_sdw_quirk_cb,
++              .matches = {
++                      DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "380E")
++              },
++              .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS),
++      },
+       {
+               .callback = sof_sdw_quirk_cb,
+               .matches = {
+@@ -589,6 +613,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+               /* Note this quirk excludes the CODEC mic */
+               .driver_data = (void *)(SOC_SDW_CODEC_MIC),
+       },
++      {
++              .callback = sof_sdw_quirk_cb,
++              .matches = {
++                      DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "233B")
++              },
++              .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS),
++      },
+       /* ArrowLake devices */
+       {
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-sdw_utils-add-a-quirk-to-allow-the-cs42l43-mic-.patch b/queue-6.12/asoc-sdw_utils-add-a-quirk-to-allow-the-cs42l43-mic-.patch
new file mode 100644 (file)
index 0000000..da2c219
--- /dev/null
@@ -0,0 +1,52 @@
+From 70ac28852315bdd5c206b37b0dd408796a2026a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 11:03:42 +0800
+Subject: ASoC: sdw_utils: Add a quirk to allow the cs42l43 mic DAI to be
+ ignored
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit a6f7afb39362ef70d08d23e5bfc0a14d69fafea1 ]
+
+To support some systems using host microphones add a quirk to allow the
+cs42l43 microphone DAI link to be ignored.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20241016030344.13535-3-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc_sdw_utils.h       | 1 +
+ sound/soc/sdw_utils/soc_sdw_utils.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/include/sound/soc_sdw_utils.h b/include/sound/soc_sdw_utils.h
+index dc7541b7b6158..0150b3735b4bd 100644
+--- a/include/sound/soc_sdw_utils.h
++++ b/include/sound/soc_sdw_utils.h
+@@ -28,6 +28,7 @@
+  *   - SOC_SDW_CODEC_SPKR | SOF_SIDECAR_AMPS - Not currently supported
+  */
+ #define SOC_SDW_SIDECAR_AMPS          BIT(16)
++#define SOC_SDW_CODEC_MIC             BIT(17)
+ #define SOC_SDW_UNUSED_DAI_ID         -1
+ #define SOC_SDW_JACK_OUT_DAI_ID               0
+diff --git a/sound/soc/sdw_utils/soc_sdw_utils.c b/sound/soc/sdw_utils/soc_sdw_utils.c
+index 863b4d5527cbe..c06963ac7fafa 100644
+--- a/sound/soc/sdw_utils/soc_sdw_utils.c
++++ b/sound/soc/sdw_utils/soc_sdw_utils.c
+@@ -487,6 +487,8 @@ struct asoc_sdw_codec_info codec_info_list[] = {
+                               .rtd_init = asoc_sdw_cs42l43_dmic_rtd_init,
+                               .widgets = generic_dmic_widgets,
+                               .num_widgets = ARRAY_SIZE(generic_dmic_widgets),
++                              .quirk = SOC_SDW_CODEC_MIC,
++                              .quirk_exclude = true,
+                       },
+                       {
+                               .direction = {false, true},
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-sdw_utils-add-quirk-to-exclude-amplifier-functi.patch b/queue-6.12/asoc-sdw_utils-add-quirk-to-exclude-amplifier-functi.patch
new file mode 100644 (file)
index 0000000..7b74341
--- /dev/null
@@ -0,0 +1,41 @@
+From add36da4379538480b781a973643a3e400e9fb26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2024 15:26:29 +0800
+Subject: ASoC: sdw_utils: Add quirk to exclude amplifier function
+
+From: Mac Chiang <mac.chiang@intel.com>
+
+[ Upstream commit 358ee2c1493e5d2c59820ffd8087eb0e367be4c6 ]
+
+When SKUs use the multi-function codec, which integrates
+Headset, Amplifier and DMIC. The corresponding quirks provide
+options to support internal amplifier/DMIC or not.
+
+In the case of RT722, this SKU excludes the internal amplifier and
+use an additional amplifier instead.
+
+Signed-off-by: Mac Chiang <mac.chiang@intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20241028072631.15536-2-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sdw_utils/soc_sdw_utils.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/sdw_utils/soc_sdw_utils.c b/sound/soc/sdw_utils/soc_sdw_utils.c
+index c06963ac7fafa..e6ac5c0fd3bec 100644
+--- a/sound/soc/sdw_utils/soc_sdw_utils.c
++++ b/sound/soc/sdw_utils/soc_sdw_utils.c
+@@ -363,6 +363,8 @@ struct asoc_sdw_codec_info codec_info_list[] = {
+                               .num_controls = ARRAY_SIZE(generic_spk_controls),
+                               .widgets = generic_spk_widgets,
+                               .num_widgets = ARRAY_SIZE(generic_spk_widgets),
++                              .quirk = SOC_SDW_CODEC_SPKR,
++                              .quirk_exclude = true,
+                       },
+                       {
+                               .direction = {false, true},
+-- 
+2.43.0
+
diff --git a/queue-6.12/asoc-sdw_utils-add-support-for-exclusion-dai-quirks.patch b/queue-6.12/asoc-sdw_utils-add-support-for-exclusion-dai-quirks.patch
new file mode 100644 (file)
index 0000000..73ff018
--- /dev/null
@@ -0,0 +1,54 @@
+From e6e3a6a769d2613b6a1724d02958ddfdce509b86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 11:03:41 +0800
+Subject: ASoC: sdw_utils: Add support for exclusion DAI quirks
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 3d9b44d0972be1298400e449cfbcc436df2e988e ]
+
+The system contains a mechanism for certain DAI links to be included
+based on a quirk. Add support for certain DAI links to excluded based on
+a quirk, this is useful in situations where the vast majority of SKUs
+utilise a feature so it is easier to quirk on those that don't.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20241016030344.13535-2-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc_sdw_utils.h       | 1 +
+ sound/soc/sdw_utils/soc_sdw_utils.c | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/sound/soc_sdw_utils.h b/include/sound/soc_sdw_utils.h
+index f68c1f193b3b4..dc7541b7b6158 100644
+--- a/include/sound/soc_sdw_utils.h
++++ b/include/sound/soc_sdw_utils.h
+@@ -59,6 +59,7 @@ struct asoc_sdw_dai_info {
+       int (*rtd_init)(struct snd_soc_pcm_runtime *rtd, struct snd_soc_dai *dai);
+       bool rtd_init_done; /* Indicate that the rtd_init callback is done */
+       unsigned long quirk;
++      bool quirk_exclude;
+ };
+ struct asoc_sdw_codec_info {
+diff --git a/sound/soc/sdw_utils/soc_sdw_utils.c b/sound/soc/sdw_utils/soc_sdw_utils.c
+index a6070f822eb9e..863b4d5527cbe 100644
+--- a/sound/soc/sdw_utils/soc_sdw_utils.c
++++ b/sound/soc/sdw_utils/soc_sdw_utils.c
+@@ -1112,7 +1112,8 @@ int asoc_sdw_parse_sdw_endpoints(struct snd_soc_card *card,
+                               dai_info = &codec_info->dais[adr_end->num];
+                               soc_dai = asoc_sdw_find_dailink(soc_dais, adr_end);
+-                              if (dai_info->quirk && !(dai_info->quirk & ctx->mc_quirk))
++                              if (dai_info->quirk &&
++                                  !(dai_info->quirk_exclude ^ !!(dai_info->quirk & ctx->mc_quirk)))
+                                       continue;
+                               dev_dbg(dev,
+-- 
+2.43.0
+
diff --git a/queue-6.12/block-rcu-protect-disk-conv_zones_bitmap.patch b/queue-6.12/block-rcu-protect-disk-conv_zones_bitmap.patch
new file mode 100644 (file)
index 0000000..039f91d
--- /dev/null
@@ -0,0 +1,141 @@
+From e8895b67ec506e494ac1a4dd17b70283746b119e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 15:42:59 +0900
+Subject: block: RCU protect disk->conv_zones_bitmap
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit d7cb6d7414ea1b33536fa6d11805cb8dceec1f97 ]
+
+Ensure that a disk revalidation changing the conventional zones bitmap
+of a disk does not cause invalid memory references when using the
+disk_zone_is_conv() helper by RCU protecting the disk->conv_zones_bitmap
+pointer.
+
+disk_zone_is_conv() is modified to operate under the RCU read lock and
+the function disk_set_conv_zones_bitmap() is added to update a disk
+conv_zones_bitmap pointer using rcu_replace_pointer() with the disk
+zone_wplugs_lock spinlock held.
+
+disk_free_zone_resources() is modified to call
+disk_update_zone_resources() with a NULL bitmap pointer to free the disk
+conv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in
+disk_update_zone_resources() to set the new (revalidated) bitmap and
+free the old one.
+
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Link: https://lore.kernel.org/r/20241107064300.227731-2-dlemoal@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-zoned.c      | 43 ++++++++++++++++++++++++++++++------------
+ include/linux/blkdev.h |  2 +-
+ 2 files changed, 32 insertions(+), 13 deletions(-)
+
+diff --git a/block/blk-zoned.c b/block/blk-zoned.c
+index 95e517723db3e..0b1184176ce77 100644
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -350,9 +350,15 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, blk_mode_t mode,
+ static inline bool disk_zone_is_conv(struct gendisk *disk, sector_t sector)
+ {
+-      if (!disk->conv_zones_bitmap)
+-              return false;
+-      return test_bit(disk_zone_no(disk, sector), disk->conv_zones_bitmap);
++      unsigned long *bitmap;
++      bool is_conv;
++
++      rcu_read_lock();
++      bitmap = rcu_dereference(disk->conv_zones_bitmap);
++      is_conv = bitmap && test_bit(disk_zone_no(disk, sector), bitmap);
++      rcu_read_unlock();
++
++      return is_conv;
+ }
+ static bool disk_zone_is_last(struct gendisk *disk, struct blk_zone *zone)
+@@ -1455,6 +1461,24 @@ static void disk_destroy_zone_wplugs_hash_table(struct gendisk *disk)
+       disk->zone_wplugs_hash_bits = 0;
+ }
++static unsigned int disk_set_conv_zones_bitmap(struct gendisk *disk,
++                                             unsigned long *bitmap)
++{
++      unsigned int nr_conv_zones = 0;
++      unsigned long flags;
++
++      spin_lock_irqsave(&disk->zone_wplugs_lock, flags);
++      if (bitmap)
++              nr_conv_zones = bitmap_weight(bitmap, disk->nr_zones);
++      bitmap = rcu_replace_pointer(disk->conv_zones_bitmap, bitmap,
++                                   lockdep_is_held(&disk->zone_wplugs_lock));
++      spin_unlock_irqrestore(&disk->zone_wplugs_lock, flags);
++
++      kfree_rcu_mightsleep(bitmap);
++
++      return nr_conv_zones;
++}
++
+ void disk_free_zone_resources(struct gendisk *disk)
+ {
+       if (!disk->zone_wplugs_pool)
+@@ -1478,8 +1502,7 @@ void disk_free_zone_resources(struct gendisk *disk)
+       mempool_destroy(disk->zone_wplugs_pool);
+       disk->zone_wplugs_pool = NULL;
+-      bitmap_free(disk->conv_zones_bitmap);
+-      disk->conv_zones_bitmap = NULL;
++      disk_set_conv_zones_bitmap(disk, NULL);
+       disk->zone_capacity = 0;
+       disk->last_zone_capacity = 0;
+       disk->nr_zones = 0;
+@@ -1538,7 +1561,7 @@ static int disk_update_zone_resources(struct gendisk *disk,
+                                     struct blk_revalidate_zone_args *args)
+ {
+       struct request_queue *q = disk->queue;
+-      unsigned int nr_seq_zones, nr_conv_zones = 0;
++      unsigned int nr_seq_zones, nr_conv_zones;
+       unsigned int pool_size;
+       struct queue_limits lim;
+       int ret;
+@@ -1546,10 +1569,8 @@ static int disk_update_zone_resources(struct gendisk *disk,
+       disk->nr_zones = args->nr_zones;
+       disk->zone_capacity = args->zone_capacity;
+       disk->last_zone_capacity = args->last_zone_capacity;
+-      swap(disk->conv_zones_bitmap, args->conv_zones_bitmap);
+-      if (disk->conv_zones_bitmap)
+-              nr_conv_zones = bitmap_weight(disk->conv_zones_bitmap,
+-                                            disk->nr_zones);
++      nr_conv_zones =
++              disk_set_conv_zones_bitmap(disk, args->conv_zones_bitmap);
+       if (nr_conv_zones >= disk->nr_zones) {
+               pr_warn("%s: Invalid number of conventional zones %u / %u\n",
+                       disk->disk_name, nr_conv_zones, disk->nr_zones);
+@@ -1829,8 +1850,6 @@ int blk_revalidate_disk_zones(struct gendisk *disk)
+               blk_mq_unfreeze_queue(q);
+       }
+-      kfree(args.conv_zones_bitmap);
+-
+       return ret;
+ }
+ EXPORT_SYMBOL_GPL(blk_revalidate_disk_zones);
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index e84a93c401320..6b4bc85f4999b 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -195,7 +195,7 @@ struct gendisk {
+       unsigned int            nr_zones;
+       unsigned int            zone_capacity;
+       unsigned int            last_zone_capacity;
+-      unsigned long           *conv_zones_bitmap;
++      unsigned long __rcu     *conv_zones_bitmap;
+       unsigned int            zone_wplugs_hash_bits;
+       spinlock_t              zone_wplugs_lock;
+       struct mempool_s        *zone_wplugs_pool;
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-add-new-quirks-for-ats2851.patch b/queue-6.12/bluetooth-add-new-quirks-for-ats2851.patch
new file mode 100644 (file)
index 0000000..d30b730
--- /dev/null
@@ -0,0 +1,76 @@
+From 7b545cf3e104c7e2a3558ca1ecc8242531d8b8c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 12:22:44 +0000
+Subject: Bluetooth: Add new quirks for ATS2851
+
+From: Danil Pylaev <danstiv404@gmail.com>
+
+[ Upstream commit 94464a7b71634037b13d54021e0dfd0fb0d8c1f0 ]
+
+This adds quirks for broken extended create connection,
+and write auth payload timeout.
+
+Signed-off-by: Danil Pylaev <danstiv404@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci.h      | 14 ++++++++++++++
+ include/net/bluetooth/hci_core.h | 10 ++++++----
+ 2 files changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
+index a1864cff616ae..5bb4eaa52e14c 100644
+--- a/include/net/bluetooth/hci.h
++++ b/include/net/bluetooth/hci.h
+@@ -301,6 +301,20 @@ enum {
+        */
+       HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT,
++      /*
++       * When this quirk is set, the HCI_OP_LE_EXT_CREATE_CONN command is
++       * disabled. This is required for the Actions Semiconductor ATS2851
++       * based controllers, which erroneously claims to support it.
++       */
++      HCI_QUIRK_BROKEN_EXT_CREATE_CONN,
++
++      /*
++       * When this quirk is set, the command WRITE_AUTH_PAYLOAD_TIMEOUT is
++       * skipped. This is required for the Actions Semiconductor ATS2851
++       * based controllers, due to a race condition in pairing process.
++       */
++      HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT,
++
+       /* When this quirk is set, MSFT extension monitor tracking by
+        * address filter is supported. Since tracking quantity of each
+        * pattern is limited, this feature supports tracking multiple
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 4c185a08c3a3a..c95f7e6ba2551 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1934,8 +1934,8 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
+                          !test_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &(dev)->quirks))
+ /* Use ext create connection if command is supported */
+-#define use_ext_conn(dev) ((dev)->commands[37] & 0x80)
+-
++#define use_ext_conn(dev) (((dev)->commands[37] & 0x80) && \
++      !test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, &(dev)->quirks))
+ /* Extended advertising support */
+ #define ext_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_EXT_ADV))
+@@ -1948,8 +1948,10 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
+  * C24: Mandatory if the LE Controller supports Connection State and either
+  * LE Feature (LL Privacy) or LE Feature (Extended Advertising) is supported
+  */
+-#define use_enhanced_conn_complete(dev) (ll_privacy_capable(dev) || \
+-                                       ext_adv_capable(dev))
++#define use_enhanced_conn_complete(dev) ((ll_privacy_capable(dev) || \
++                                       ext_adv_capable(dev)) && \
++                                       !test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, \
++                                               &(dev)->quirks))
+ /* Periodic advertising support */
+ #define per_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_PERIODIC_ADV))
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-btusb-add-3-hwids-for-mt7925.patch b/queue-6.12/bluetooth-btusb-add-3-hwids-for-mt7925.patch
new file mode 100644 (file)
index 0000000..1418cd7
--- /dev/null
@@ -0,0 +1,62 @@
+From 8c3a7b3ed127cf81a2eb3bb03f699c7e2d9dae56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 22:59:31 +0800
+Subject: Bluetooth: btusb: Add 3 HWIDs for MT7925
+
+From: Jiande Lu <jiande.lu@mediatek.com>
+
+[ Upstream commit de7dcf9d1df4b0009735756d0a2adff09c3f21d4 ]
+
+Add below HWIDs for MediaTek MT7925 USB Bluetooth chip.
+VID 0x0489, PID 0xe14f
+VID 0x0489, PID 0xe150
+VID 0x0489, PID 0xe151
+
+Patch has been tested successfully and controller is recognized
+device pair successfully.
+
+MT7925 module bring up message as below.
+Bluetooth: Core ver 2.22
+Bluetooth: HCI device and connection manager initialized
+Bluetooth: HCI socket layer initialized
+Bluetooth: L2CAP socket layer initialized
+Bluetooth: SCO socket layer initialized
+Bluetooth: hci0: HW/SW Version: 0x00000000, Build Time: 20240816133202
+Bluetooth: hci0: Device setup in 286558 usecs
+Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
+Bluetooth: hci0: AOSP extensions version v1.00
+Bluetooth: BNEP (Ethernet Emulation) ver 1.3
+Bluetooth: BNEP filters: protocol multicast
+Bluetooth: BNEP socket layer initialized
+Bluetooth: MGMT ver 1.22
+Bluetooth: RFCOMM TTY layer initialized
+Bluetooth: RFCOMM socket layer initialized
+Bluetooth: RFCOMM ver 1.11
+
+Signed-off-by: Jiande Lu <jiande.lu@mediatek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 9208b5b7fc86f..11755cb1eb163 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -654,6 +654,12 @@ static const struct usb_device_id quirks_table[] = {
+                                                    BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x0489, 0xe139), .driver_info = BTUSB_MEDIATEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
++      { USB_DEVICE(0x0489, 0xe14f), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
++      { USB_DEVICE(0x0489, 0xe150), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
++      { USB_DEVICE(0x0489, 0xe151), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x13d3, 0x3603), .driver_info = BTUSB_MEDIATEK |
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-btusb-add-new-vid-pid-0489-e111-for-mt7925.patch b/queue-6.12/bluetooth-btusb-add-new-vid-pid-0489-e111-for-mt7925.patch
new file mode 100644 (file)
index 0000000..5c7bedd
--- /dev/null
@@ -0,0 +1,77 @@
+From 80e2ff02141dfb6d2607b93d802a89cfac537222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 11:18:18 +0800
+Subject: Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925
+
+From: Hao Qin <hao.qin@mediatek.com>
+
+[ Upstream commit faa5fd605d2081b6c9fa2355b59582d4ccd24b16 ]
+
+Add VID 0489 & PID e111 for MediaTek MT7925 USB Bluetooth chip.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below.
+
+T:  Bus=02 Lev=02 Prnt=02 Port=04 Cnt=02 Dev#=  4 Spd=480  MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=0489 ProdID=e111 Rev= 1.00
+S:  Manufacturer=MediaTek Inc.
+S:  Product=Wireless_Device
+S:  SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
+E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
+I:  If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Hao Qin <hao.qin@mediatek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 2a8fe85371804..d922fa8e8b3ce 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -642,6 +642,8 @@ static const struct usb_device_id quirks_table[] = {
+                                                    BTUSB_WIDEBAND_SPEECH },
+       /* Additional MediaTek MT7925 Bluetooth devices */
++      { USB_DEVICE(0x0489, 0xe111), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x0489, 0xe113), .driver_info = BTUSB_MEDIATEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x0489, 0xe118), .driver_info = BTUSB_MEDIATEK |
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-btusb-add-new-vid-pid-0489-e124-for-mt7925.patch b/queue-6.12/bluetooth-btusb-add-new-vid-pid-0489-e124-for-mt7925.patch
new file mode 100644 (file)
index 0000000..fae495b
--- /dev/null
@@ -0,0 +1,77 @@
+From cf6824c572178f1dad2485f0138d711532831ba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2024 01:10:14 +0000
+Subject: Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925
+
+From: Jonathan McCrohan <jmccrohan@gmail.com>
+
+[ Upstream commit 679cb60fd60774798719c3e449874a168642a8e6 ]
+
+Add VID 0489 & PID e124 for MediaTek MT7925 USB Bluetooth chip.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below.
+
+T:  Bus=01 Lev=01 Prnt=01 Port=08 Cnt=02 Dev#=  3 Spd=480  MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=0489 ProdID=e124 Rev= 1.00
+S:  Manufacturer=MediaTek Inc.
+S:  Product=Wireless_Device
+S:  SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
+E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
+I:  If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Jonathan McCrohan <jmccrohan@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index d922fa8e8b3ce..9208b5b7fc86f 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -650,6 +650,8 @@ static const struct usb_device_id quirks_table[] = {
+                                                    BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x0489, 0xe11e), .driver_info = BTUSB_MEDIATEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
++      { USB_DEVICE(0x0489, 0xe124), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x0489, 0xe139), .driver_info = BTUSB_MEDIATEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK |
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-btusb-add-rtl8852be-device-0489-e123-to-de.patch b/queue-6.12/bluetooth-btusb-add-rtl8852be-device-0489-e123-to-de.patch
new file mode 100644 (file)
index 0000000..df708ef
--- /dev/null
@@ -0,0 +1,67 @@
+From 06531856d0a420493277a21fde7d8fde15f26a0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 16:37:29 +0800
+Subject: Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
+
+From: Hilda Wu <hildawu@realtek.com>
+
+[ Upstream commit 69b84ffce260ff13826dc10aeb3c3e5c2288a552 ]
+
+Add the support ID 0489:e123 to usb_device_id table for
+Realtek RTL8852B chip.
+
+The device info from /sys/kernel/debug/usb/devices as below.
+
+T:  Bus=01 Lev=01 Prnt=01 Port=07 Cnt=04 Dev#=  7 Spd=12   MxCh= 0
+D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=0489 ProdID=e123 Rev= 0.00
+S:  Manufacturer=Realtek
+S:  Product=Bluetooth Radio
+S:  SerialNumber=00e04c000001
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+
+Signed-off-by: Hilda Wu <hildawu@realtek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 4ccaddb46ddd8..c247fffbd6361 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -524,6 +524,8 @@ static const struct usb_device_id quirks_table[] = {
+                                                    BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x13d3, 0x3591), .driver_info = BTUSB_REALTEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
++      { USB_DEVICE(0x0489, 0xe123), .driver_info = BTUSB_REALTEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-btusb-add-usb-hw-ids-for-mt7920-mt7925.patch b/queue-6.12/bluetooth-btusb-add-usb-hw-ids-for-mt7920-mt7925.patch
new file mode 100644 (file)
index 0000000..a4adc10
--- /dev/null
@@ -0,0 +1,97 @@
+From add269ca46dc4ef27caa0cb21a2f59ba52bc2761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 18:47:50 +0800
+Subject: Bluetooth: btusb: Add USB HW IDs for MT7920/MT7925
+
+From: Jiande Lu <jiande.lu@mediatek.com>
+
+[ Upstream commit a94bc93a305bdcb20cc62978c334cace932b1be0 ]
+
+Add HW IDs for wireless module. These HW IDs are extracted from
+Windows driver inf file and the test for card bring up successful.
+MT7920 HW IDs test with below patch.
+https://patchwork.kernel.org/project/bluetooth/
+patch/20240930081257.23975-1-chris.lu@mediatek.com/
+
+Patch has been tested successfully and controller is recognized
+devices pair successfully.
+
+MT7920 module bring up message as below.
+Bluetooth: Core ver 2.22
+Bluetooth: HCI device and connection manager initialized
+Bluetooth: HCI socket layer initialized
+Bluetooth: L2CAP socket layer initialized
+Bluetooth: SCO socket layer initialized
+Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20240930111457
+Bluetooth: hci0: Device setup in 143004 usecs
+Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection
+command is advertised, but not supported.
+Bluetooth: hci0: AOSP extensions version v1.00
+Bluetooth: hci0: AOSP quality report is supported
+Bluetooth: BNEP (Ethernet Emulation) ver 1.3
+Bluetooth: BNEP filters: protocol multicast
+Bluetooth: BNEP socket layer initialized
+Bluetooth: MGMT ver 1.22
+Bluetooth: RFCOMM TTY layer initialized
+Bluetooth: RFCOMM socket layer initialized
+Bluetooth: RFCOMM ver 1.11
+
+MT7925 module bring up message as below.
+Bluetooth: Core ver 2.22
+Bluetooth: HCI device and connection manager initialized
+Bluetooth: HCI socket layer initialized
+Bluetooth: L2CAP socket layer initialized
+Bluetooth: SCO socket layer initialized
+Bluetooth: hci0: HW/SW Version: 0x00000000, Build Time: 20240816133202
+Bluetooth: hci0: Device setup in 286558 usecs
+Bluetooth: hci0: HCI Enhanced Setup Synchronous
+Connection command is advertised, but not supported.
+Bluetooth: hci0: AOSP extensions version v1.00
+Bluetooth: BNEP (Ethernet Emulation) ver 1.3
+Bluetooth: BNEP filters: protocol multicast
+Bluetooth: BNEP socket layer initialized
+Bluetooth: MGMT ver 1.22
+Bluetooth: RFCOMM TTY layer initialized
+Bluetooth: RFCOMM socket layer initialized
+Bluetooth: RFCOMM ver 1.11
+
+Signed-off-by: Jiande Lu <jiande.lu@mediatek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c247fffbd6361..b44c990bab422 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -565,6 +565,16 @@ static const struct usb_device_id quirks_table[] = {
+       { USB_DEVICE(0x043e, 0x3109), .driver_info = BTUSB_MEDIATEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
++      /* Additional MediaTek MT7920 Bluetooth devices */
++      { USB_DEVICE(0x0489, 0xe134), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
++      { USB_DEVICE(0x13d3, 0x3620), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
++      { USB_DEVICE(0x13d3, 0x3621), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
++      { USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
++
+       /* Additional MediaTek MT7921 Bluetooth devices */
+       { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
+@@ -638,6 +648,8 @@ static const struct usb_device_id quirks_table[] = {
+                                                    BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x0489, 0xe11e), .driver_info = BTUSB_MEDIATEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
++      { USB_DEVICE(0x0489, 0xe139), .driver_info = BTUSB_MEDIATEK |
++                                                   BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK |
+                                                    BTUSB_WIDEBAND_SPEECH },
+       { USB_DEVICE(0x13d3, 0x3603), .driver_info = BTUSB_MEDIATEK |
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-hci_conn-reduce-hci_conn_drop-calls-in-two.patch b/queue-6.12/bluetooth-hci_conn-reduce-hci_conn_drop-calls-in-two.patch
new file mode 100644 (file)
index 0000000..caab095
--- /dev/null
@@ -0,0 +1,62 @@
+From a118710c2e3b87cdf24e3aae0eece1e09c2bbeec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 09:21:25 +0200
+Subject: Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
+
+From: Markus Elfring <elfring@users.sourceforge.net>
+
+[ Upstream commit d96b543c6f3b78b6440b68b5a5bbface553eff28 ]
+
+An hci_conn_drop() call was immediately used after a null pointer check
+for an hci_conn_link() call in two function implementations.
+Thus call such a function only once instead directly before the checks.
+
+This issue was transformed by using the Coccinelle software.
+
+Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 6354cdf9c2b37..a1dfd865d61ab 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2345,13 +2345,9 @@ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst,
+                                         conn->iso_qos.bcast.big);
+       if (parent && parent != conn) {
+               link = hci_conn_link(parent, conn);
+-              if (!link) {
+-                      hci_conn_drop(conn);
+-                      return ERR_PTR(-ENOLINK);
+-              }
+-
+-              /* Link takes the refcount */
+               hci_conn_drop(conn);
++              if (!link)
++                      return ERR_PTR(-ENOLINK);
+       }
+       return conn;
+@@ -2441,15 +2437,12 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
+       }
+       link = hci_conn_link(le, cis);
++      hci_conn_drop(cis);
+       if (!link) {
+               hci_conn_drop(le);
+-              hci_conn_drop(cis);
+               return ERR_PTR(-ENOLINK);
+       }
+-      /* Link takes the refcount */
+-      hci_conn_drop(cis);
+-
+       cis->state = BT_CONNECT;
+       hci_le_create_cis_pending(hdev);
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-hci_conn-use-disable_delayed_work_sync.patch b/queue-6.12/bluetooth-hci_conn-use-disable_delayed_work_sync.patch
new file mode 100644 (file)
index 0000000..58958ef
--- /dev/null
@@ -0,0 +1,43 @@
+From 4403033aa461512f93abb578b36235a4cf4a3f34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 12:34:06 -0400
+Subject: Bluetooth: hci_conn: Use disable_delayed_work_sync
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df ]
+
+This makes use of disable_delayed_work_sync instead
+cancel_delayed_work_sync as it not only cancel the ongoing work but also
+disables new submit which is disarable since the object holding the work
+is about to be freed.
+
+Reported-by: syzbot+2446dd3cb07277388db6@syzkaller.appspotmail.com
+Tested-by: syzbot+2446dd3cb07277388db6@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=2446dd3cb07277388db6
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index a1dfd865d61ab..e6591f487a511 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1128,9 +1128,9 @@ void hci_conn_del(struct hci_conn *conn)
+       hci_conn_unlink(conn);
+-      cancel_delayed_work_sync(&conn->disc_work);
+-      cancel_delayed_work_sync(&conn->auto_accept_work);
+-      cancel_delayed_work_sync(&conn->idle_work);
++      disable_delayed_work_sync(&conn->disc_work);
++      disable_delayed_work_sync(&conn->auto_accept_work);
++      disable_delayed_work_sync(&conn->idle_work);
+       if (conn->type == ACL_LINK) {
+               /* Unacked frames */
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-hci_core-fix-not-checking-skb-length-on-hc.patch b/queue-6.12/bluetooth-hci_core-fix-not-checking-skb-length-on-hc.patch
new file mode 100644 (file)
index 0000000..f26dda7
--- /dev/null
@@ -0,0 +1,65 @@
+From 9e6c7e966a58f83f4b200fd8f9d6d5e53f2106c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 10:16:48 -0400
+Subject: Bluetooth: hci_core: Fix not checking skb length on
+ hci_acldata_packet
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 3fe288a8214e7dd784d1f9b7c9e448244d316b47 ]
+
+This fixes not checking if skb really contains an ACL header otherwise
+the code may attempt to access some uninitilized/invalid memory past the
+valid skb->data.
+
+Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com
+Tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 0ac354db81779..72439764186ed 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3771,18 +3771,22 @@ static void hci_tx_work(struct work_struct *work)
+ /* ACL data packet */
+ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
+ {
+-      struct hci_acl_hdr *hdr = (void *) skb->data;
++      struct hci_acl_hdr *hdr;
+       struct hci_conn *conn;
+       __u16 handle, flags;
+-      skb_pull(skb, HCI_ACL_HDR_SIZE);
++      hdr = skb_pull_data(skb, sizeof(*hdr));
++      if (!hdr) {
++              bt_dev_err(hdev, "ACL packet too small");
++              goto drop;
++      }
+       handle = __le16_to_cpu(hdr->handle);
+       flags  = hci_flags(handle);
+       handle = hci_handle(handle);
+-      BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
+-             handle, flags);
++      bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
++                 handle, flags);
+       hdev->stat.acl_rx++;
+@@ -3801,6 +3805,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
+                          handle);
+       }
++drop:
+       kfree_skb(skb);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-l2cap-do-not-leave-dangling-sk-pointer-on-.patch b/queue-6.12/bluetooth-l2cap-do-not-leave-dangling-sk-pointer-on-.patch
new file mode 100644 (file)
index 0000000..271c80a
--- /dev/null
@@ -0,0 +1,40 @@
+From 9023f26e3b71bc05da47bf20508b80f3d2bae33c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 16:38:01 +0100
+Subject: Bluetooth: L2CAP: do not leave dangling sk pointer on error in
+ l2cap_sock_create()
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+[ Upstream commit 7c4f78cdb8e7501e9f92d291a7d956591bf73be9 ]
+
+bt_sock_alloc() allocates the sk object and attaches it to the provided
+sock object. On error l2cap_sock_alloc() frees the sk object, but the
+dangling pointer is still attached to the sock object, which may create
+use-after-free in other code.
+
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241014153808.51894-3-ignat@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/l2cap_sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index ba437c6f6ee59..18e89e764f3b4 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1886,6 +1886,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
+       chan = l2cap_chan_create();
+       if (!chan) {
+               sk_free(sk);
++              sock->sk = NULL;
+               return NULL;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-rfcomm-avoid-leaving-dangling-sk-pointer-i.patch b/queue-6.12/bluetooth-rfcomm-avoid-leaving-dangling-sk-pointer-i.patch
new file mode 100644 (file)
index 0000000..5d5a998
--- /dev/null
@@ -0,0 +1,52 @@
+From c776e0bc5475d867c55244cbaf58458587bfc6e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 16:38:02 +0100
+Subject: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in
+ rfcomm_sock_alloc()
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+[ Upstream commit 3945c799f12b8d1f49a3b48369ca494d981ac465 ]
+
+bt_sock_alloc() attaches allocated sk object to the provided sock object.
+If rfcomm_dlc_alloc() fails, we release the sk object, but leave the
+dangling pointer in the sock object, which may cause use-after-free.
+
+Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().
+
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241014153808.51894-4-ignat@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/rfcomm/sock.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
+index 8af1bf518321f..40766f8119ed9 100644
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -274,13 +274,13 @@ static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock,
+       struct rfcomm_dlc *d;
+       struct sock *sk;
+-      sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern);
+-      if (!sk)
++      d = rfcomm_dlc_alloc(prio);
++      if (!d)
+               return NULL;
+-      d = rfcomm_dlc_alloc(prio);
+-      if (!d) {
+-              sk_free(sk);
++      sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern);
++      if (!sk) {
++              rfcomm_dlc_free(d);
+               return NULL;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-set-quirks-for-ats2851.patch b/queue-6.12/bluetooth-set-quirks-for-ats2851.patch
new file mode 100644 (file)
index 0000000..db4fcb1
--- /dev/null
@@ -0,0 +1,34 @@
+From a574ff9e4e3c46460e471f2de3f9f0d01fd6e616 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 12:22:46 +0000
+Subject: Bluetooth: Set quirks for ATS2851
+
+From: Danil Pylaev <danstiv404@gmail.com>
+
+[ Upstream commit 677a55ba11a82c2835550a82324cec5fcb2f9e2d ]
+
+This adds quirks for broken ats2851 features.
+
+Signed-off-by: Danil Pylaev <danstiv404@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index b44c990bab422..2a8fe85371804 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -3911,6 +3911,8 @@ static int btusb_probe(struct usb_interface *intf,
+               set_bit(HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT, &hdev->quirks);
+               set_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &hdev->quirks);
+               set_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks);
++              set_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, &hdev->quirks);
++              set_bit(HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT, &hdev->quirks);
+       }
+       if (!reset)
+-- 
+2.43.0
+
diff --git a/queue-6.12/bluetooth-support-new-quirks-for-ats2851.patch b/queue-6.12/bluetooth-support-new-quirks-for-ats2851.patch
new file mode 100644 (file)
index 0000000..d448e94
--- /dev/null
@@ -0,0 +1,68 @@
+From 0492fe082b87a489480ab77848ff49b25d8b3e9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 12:22:45 +0000
+Subject: Bluetooth: Support new quirks for ATS2851
+
+From: Danil Pylaev <danstiv404@gmail.com>
+
+[ Upstream commit 5bd3135924b4570dcecc8793f7771cb8d42d8b19 ]
+
+This adds support for quirks for broken extended create connection,
+and write auth payload timeout.
+
+Signed-off-by: Danil Pylaev <danstiv404@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 7 +++++++
+ net/bluetooth/hci_sync.c  | 9 ++++++++-
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 2e4bd3e961ce0..2b5ba8acd1d84 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3626,6 +3626,13 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
+               goto unlock;
+       }
++      /* We skip the WRITE_AUTH_PAYLOAD_TIMEOUT for ATS2851 based controllers
++       * to avoid unexpected SMP command errors when pairing.
++       */
++      if (test_bit(HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT,
++                   &hdev->quirks))
++              goto notify;
++
+       /* Set the default Authenticated Payload Timeout after
+        * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
+        * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index c0203a2b51075..c86f4e42e69ca 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -4842,6 +4842,13 @@ static const struct {
+       HCI_QUIRK_BROKEN(SET_RPA_TIMEOUT,
+                        "HCI LE Set Random Private Address Timeout command is "
+                        "advertised, but not supported."),
++      HCI_QUIRK_BROKEN(EXT_CREATE_CONN,
++                       "HCI LE Extended Create Connection command is "
++                       "advertised, but not supported."),
++      HCI_QUIRK_BROKEN(WRITE_AUTH_PAYLOAD_TIMEOUT,
++                       "HCI WRITE AUTH PAYLOAD TIMEOUT command leads "
++                       "to unexpected SMP errors when pairing "
++                       "and will not be used."),
+       HCI_QUIRK_BROKEN(LE_CODED,
+                        "HCI LE Coded PHY feature bit is set, "
+                        "but its usage is not supported.")
+@@ -6477,7 +6484,7 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data)
+                                            &own_addr_type);
+       if (err)
+               goto done;
+-
++      /* Send command LE Extended Create Connection if supported */
+       if (use_ext_conn(hdev)) {
+               err = hci_le_ext_create_conn_sync(hdev, conn, own_addr_type);
+               goto done;
+-- 
+2.43.0
+
diff --git a/queue-6.12/bpf-call-free_htab_elem-after-htab_unlock_bucket.patch b/queue-6.12/bpf-call-free_htab_elem-after-htab_unlock_bucket.patch
new file mode 100644 (file)
index 0000000..67f7f2e
--- /dev/null
@@ -0,0 +1,244 @@
+From 1becaf1024568c6a796b7af0f0e1be187cfcb4bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 14:35:40 +0800
+Subject: bpf: Call free_htab_elem() after htab_unlock_bucket()
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit b9e9ed90b10c82a4e9d4d70a2890f06bfcdd3b78 ]
+
+For htab of maps, when the map is removed from the htab, it may hold the
+last reference of the map. bpf_map_fd_put_ptr() will invoke
+bpf_map_free_id() to free the id of the removed map element. However,
+bpf_map_fd_put_ptr() is invoked while holding a bucket lock
+(raw_spin_lock_t), and bpf_map_free_id() attempts to acquire map_idr_lock
+(spinlock_t), triggering the following lockdep warning:
+
+  =============================
+  [ BUG: Invalid wait context ]
+  6.11.0-rc4+ #49 Not tainted
+  -----------------------------
+  test_maps/4881 is trying to lock:
+  ffffffff84884578 (map_idr_lock){+...}-{3:3}, at: bpf_map_free_id.part.0+0x21/0x70
+  other info that might help us debug this:
+  context-{5:5}
+  2 locks held by test_maps/4881:
+   #0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, at: bpf_fd_htab_map_update_elem+0xf9/0x270
+   #1: ffff888149ced148 (&htab->lockdep_key#2){....}-{2:2}, at: htab_map_update_elem+0x178/0xa80
+  stack backtrace:
+  CPU: 0 UID: 0 PID: 4881 Comm: test_maps Not tainted 6.11.0-rc4+ #49
+  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...
+  Call Trace:
+   <TASK>
+   dump_stack_lvl+0x6e/0xb0
+   dump_stack+0x10/0x20
+   __lock_acquire+0x73e/0x36c0
+   lock_acquire+0x182/0x450
+   _raw_spin_lock_irqsave+0x43/0x70
+   bpf_map_free_id.part.0+0x21/0x70
+   bpf_map_put+0xcf/0x110
+   bpf_map_fd_put_ptr+0x9a/0xb0
+   free_htab_elem+0x69/0xe0
+   htab_map_update_elem+0x50f/0xa80
+   bpf_fd_htab_map_update_elem+0x131/0x270
+   htab_map_update_elem+0x50f/0xa80
+   bpf_fd_htab_map_update_elem+0x131/0x270
+   bpf_map_update_value+0x266/0x380
+   __sys_bpf+0x21bb/0x36b0
+   __x64_sys_bpf+0x45/0x60
+   x64_sys_call+0x1b2a/0x20d0
+   do_syscall_64+0x5d/0x100
+   entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+One way to fix the lockdep warning is using raw_spinlock_t for
+map_idr_lock as well. However, bpf_map_alloc_id() invokes
+idr_alloc_cyclic() after acquiring map_idr_lock, it will trigger a
+similar lockdep warning because the slab's lock (s->cpu_slab->lock) is
+still a spinlock.
+
+Instead of changing map_idr_lock's type, fix the issue by invoking
+htab_put_fd_value() after htab_unlock_bucket(). However, only deferring
+the invocation of htab_put_fd_value() is not enough, because the old map
+pointers in htab of maps can not be saved during batched deletion.
+Therefore, also defer the invocation of free_htab_elem(), so these
+to-be-freed elements could be linked together similar to lru map.
+
+There are four callers for ->map_fd_put_ptr:
+
+(1) alloc_htab_elem() (through htab_put_fd_value())
+It invokes ->map_fd_put_ptr() under a raw_spinlock_t. The invocation of
+htab_put_fd_value() can not simply move after htab_unlock_bucket(),
+because the old element has already been stashed in htab->extra_elems.
+It may be reused immediately after htab_unlock_bucket() and the
+invocation of htab_put_fd_value() after htab_unlock_bucket() may release
+the newly-added element incorrectly. Therefore, saving the map pointer
+of the old element for htab of maps before unlocking the bucket and
+releasing the map_ptr after unlock. Beside the map pointer in the old
+element, should do the same thing for the special fields in the old
+element as well.
+
+(2) free_htab_elem() (through htab_put_fd_value())
+Its caller includes __htab_map_lookup_and_delete_elem(),
+htab_map_delete_elem() and __htab_map_lookup_and_delete_batch().
+
+For htab_map_delete_elem(), simply invoke free_htab_elem() after
+htab_unlock_bucket(). For __htab_map_lookup_and_delete_batch(), just
+like lru map, linking the to-be-freed element into node_to_free list
+and invoking free_htab_elem() for these element after unlock. It is safe
+to reuse batch_flink as the link for node_to_free, because these
+elements have been removed from the hash llist.
+
+Because htab of maps doesn't support lookup_and_delete operation,
+__htab_map_lookup_and_delete_elem() doesn't have the problem, so kept
+it as is.
+
+(3) fd_htab_map_free()
+It invokes ->map_fd_put_ptr without raw_spinlock_t.
+
+(4) bpf_fd_htab_map_update_elem()
+It invokes ->map_fd_put_ptr without raw_spinlock_t.
+
+After moving free_htab_elem() outside htab bucket lock scope, using
+pcpu_freelist_push() instead of __pcpu_freelist_push() to disable
+the irq before freeing elements, and protecting the invocations of
+bpf_mem_cache_free() with migrate_{disable|enable} pair.
+
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20241106063542.357743-2-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/hashtab.c | 56 ++++++++++++++++++++++++++++++--------------
+ 1 file changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index b14b87463ee04..3ec941a0ea41c 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -896,9 +896,12 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
+ static void htab_elem_free(struct bpf_htab *htab, struct htab_elem *l)
+ {
+       check_and_free_fields(htab, l);
++
++      migrate_disable();
+       if (htab->map.map_type == BPF_MAP_TYPE_PERCPU_HASH)
+               bpf_mem_cache_free(&htab->pcpu_ma, l->ptr_to_pptr);
+       bpf_mem_cache_free(&htab->ma, l);
++      migrate_enable();
+ }
+ static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
+@@ -948,7 +951,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
+       if (htab_is_prealloc(htab)) {
+               bpf_map_dec_elem_count(&htab->map);
+               check_and_free_fields(htab, l);
+-              __pcpu_freelist_push(&htab->freelist, &l->fnode);
++              pcpu_freelist_push(&htab->freelist, &l->fnode);
+       } else {
+               dec_elem_count(htab);
+               htab_elem_free(htab, l);
+@@ -1018,7 +1021,6 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
+                        */
+                       pl_new = this_cpu_ptr(htab->extra_elems);
+                       l_new = *pl_new;
+-                      htab_put_fd_value(htab, old_elem);
+                       *pl_new = old_elem;
+               } else {
+                       struct pcpu_freelist_node *l;
+@@ -1105,6 +1107,7 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value,
+       struct htab_elem *l_new = NULL, *l_old;
+       struct hlist_nulls_head *head;
+       unsigned long flags;
++      void *old_map_ptr;
+       struct bucket *b;
+       u32 key_size, hash;
+       int ret;
+@@ -1183,12 +1186,27 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value,
+       hlist_nulls_add_head_rcu(&l_new->hash_node, head);
+       if (l_old) {
+               hlist_nulls_del_rcu(&l_old->hash_node);
++
++              /* l_old has already been stashed in htab->extra_elems, free
++               * its special fields before it is available for reuse. Also
++               * save the old map pointer in htab of maps before unlock
++               * and release it after unlock.
++               */
++              old_map_ptr = NULL;
++              if (htab_is_prealloc(htab)) {
++                      if (map->ops->map_fd_put_ptr)
++                              old_map_ptr = fd_htab_map_get_ptr(map, l_old);
++                      check_and_free_fields(htab, l_old);
++              }
++      }
++      htab_unlock_bucket(htab, b, hash, flags);
++      if (l_old) {
++              if (old_map_ptr)
++                      map->ops->map_fd_put_ptr(map, old_map_ptr, true);
+               if (!htab_is_prealloc(htab))
+                       free_htab_elem(htab, l_old);
+-              else
+-                      check_and_free_fields(htab, l_old);
+       }
+-      ret = 0;
++      return 0;
+ err:
+       htab_unlock_bucket(htab, b, hash, flags);
+       return ret;
+@@ -1432,15 +1450,15 @@ static long htab_map_delete_elem(struct bpf_map *map, void *key)
+               return ret;
+       l = lookup_elem_raw(head, hash, key, key_size);
+-
+-      if (l) {
++      if (l)
+               hlist_nulls_del_rcu(&l->hash_node);
+-              free_htab_elem(htab, l);
+-      } else {
++      else
+               ret = -ENOENT;
+-      }
+       htab_unlock_bucket(htab, b, hash, flags);
++
++      if (l)
++              free_htab_elem(htab, l);
+       return ret;
+ }
+@@ -1853,13 +1871,14 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,
+                        * may cause deadlock. See comments in function
+                        * prealloc_lru_pop(). Let us do bpf_lru_push_free()
+                        * after releasing the bucket lock.
++                       *
++                       * For htab of maps, htab_put_fd_value() in
++                       * free_htab_elem() may acquire a spinlock with bucket
++                       * lock being held and it violates the lock rule, so
++                       * invoke free_htab_elem() after unlock as well.
+                        */
+-                      if (is_lru_map) {
+-                              l->batch_flink = node_to_free;
+-                              node_to_free = l;
+-                      } else {
+-                              free_htab_elem(htab, l);
+-                      }
++                      l->batch_flink = node_to_free;
++                      node_to_free = l;
+               }
+               dst_key += key_size;
+               dst_val += value_size;
+@@ -1871,7 +1890,10 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,
+       while (node_to_free) {
+               l = node_to_free;
+               node_to_free = node_to_free->batch_flink;
+-              htab_lru_push_free(htab, l);
++              if (is_lru_map)
++                      htab_lru_push_free(htab, l);
++              else
++                      free_htab_elem(htab, l);
+       }
+ next_batch:
+-- 
+2.43.0
+
diff --git a/queue-6.12/bpf-prevent-tailcall-infinite-loop-caused-by-freplac.patch b/queue-6.12/bpf-prevent-tailcall-infinite-loop-caused-by-freplac.patch
new file mode 100644 (file)
index 0000000..253e068
--- /dev/null
@@ -0,0 +1,312 @@
+From 3e523d952d78e018236652c599e0162ad2a3514e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 23:02:06 +0800
+Subject: bpf: Prevent tailcall infinite loop caused by freplace
+
+From: Leon Hwang <leon.hwang@linux.dev>
+
+[ Upstream commit d6083f040d5d8f8d748462c77e90547097df936e ]
+
+There is a potential infinite loop issue that can occur when using a
+combination of tail calls and freplace.
+
+In an upcoming selftest, the attach target for entry_freplace of
+tailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in
+entry_freplace leads to entry_tc. This results in an infinite loop:
+
+entry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc.
+
+The problem arises because the tail_call_cnt in entry_freplace resets to
+zero each time entry_freplace is executed, causing the tail call mechanism
+to never terminate, eventually leading to a kernel panic.
+
+To fix this issue, the solution is twofold:
+
+1. Prevent updating a program extended by an freplace program to a
+   prog_array map.
+2. Prevent extending a program that is already part of a prog_array map
+   with an freplace program.
+
+This ensures that:
+
+* If a program or its subprogram has been extended by an freplace program,
+  it can no longer be updated to a prog_array map.
+* If a program has been added to a prog_array map, neither it nor its
+  subprograms can be extended by an freplace program.
+
+Moreover, an extension program should not be tailcalled. As such, return
+-EINVAL if the program has a type of BPF_PROG_TYPE_EXT when adding it to a
+prog_array map.
+
+Additionally, fix a minor code style issue by replacing eight spaces with a
+tab for proper formatting.
+
+Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
+Link: https://lore.kernel.org/r/20241015150207.70264-2-leon.hwang@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h     | 17 +++++++++++----
+ kernel/bpf/arraymap.c   | 26 +++++++++++++++++++++--
+ kernel/bpf/core.c       |  1 +
+ kernel/bpf/syscall.c    |  7 +++---
+ kernel/bpf/trampoline.c | 47 ++++++++++++++++++++++++++++++++++-------
+ 5 files changed, 81 insertions(+), 17 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index bc2e3dab0487e..cbe2350912460 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -1300,8 +1300,12 @@ void *__bpf_dynptr_data_rw(const struct bpf_dynptr_kern *ptr, u32 len);
+ bool __bpf_dynptr_is_rdonly(const struct bpf_dynptr_kern *ptr);
+ #ifdef CONFIG_BPF_JIT
+-int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);
+-int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);
++int bpf_trampoline_link_prog(struct bpf_tramp_link *link,
++                           struct bpf_trampoline *tr,
++                           struct bpf_prog *tgt_prog);
++int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
++                             struct bpf_trampoline *tr,
++                             struct bpf_prog *tgt_prog);
+ struct bpf_trampoline *bpf_trampoline_get(u64 key,
+                                         struct bpf_attach_target_info *tgt_info);
+ void bpf_trampoline_put(struct bpf_trampoline *tr);
+@@ -1383,12 +1387,14 @@ void bpf_jit_uncharge_modmem(u32 size);
+ bool bpf_prog_has_trampoline(const struct bpf_prog *prog);
+ #else
+ static inline int bpf_trampoline_link_prog(struct bpf_tramp_link *link,
+-                                         struct bpf_trampoline *tr)
++                                         struct bpf_trampoline *tr,
++                                         struct bpf_prog *tgt_prog)
+ {
+       return -ENOTSUPP;
+ }
+ static inline int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
+-                                           struct bpf_trampoline *tr)
++                                           struct bpf_trampoline *tr,
++                                           struct bpf_prog *tgt_prog)
+ {
+       return -ENOTSUPP;
+ }
+@@ -1492,6 +1498,9 @@ struct bpf_prog_aux {
+       bool xdp_has_frags;
+       bool exception_cb;
+       bool exception_boundary;
++      bool is_extended; /* true if extended by freplace program */
++      u64 prog_array_member_cnt; /* counts how many times as member of prog_array */
++      struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cnt */
+       struct bpf_arena *arena;
+       /* BTF_KIND_FUNC_PROTO for valid attach_btf_id */
+       const struct btf_type *attach_func_proto;
+diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
+index 79660e3fca4c1..6cdbb4c33d31d 100644
+--- a/kernel/bpf/arraymap.c
++++ b/kernel/bpf/arraymap.c
+@@ -947,22 +947,44 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map,
+                                  struct file *map_file, int fd)
+ {
+       struct bpf_prog *prog = bpf_prog_get(fd);
++      bool is_extended;
+       if (IS_ERR(prog))
+               return prog;
+-      if (!bpf_prog_map_compatible(map, prog)) {
++      if (prog->type == BPF_PROG_TYPE_EXT ||
++          !bpf_prog_map_compatible(map, prog)) {
+               bpf_prog_put(prog);
+               return ERR_PTR(-EINVAL);
+       }
++      mutex_lock(&prog->aux->ext_mutex);
++      is_extended = prog->aux->is_extended;
++      if (!is_extended)
++              prog->aux->prog_array_member_cnt++;
++      mutex_unlock(&prog->aux->ext_mutex);
++      if (is_extended) {
++              /* Extended prog can not be tail callee. It's to prevent a
++               * potential infinite loop like:
++               * tail callee prog entry -> tail callee prog subprog ->
++               * freplace prog entry --tailcall-> tail callee prog entry.
++               */
++              bpf_prog_put(prog);
++              return ERR_PTR(-EBUSY);
++      }
++
+       return prog;
+ }
+ static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
++      struct bpf_prog *prog = ptr;
++
++      mutex_lock(&prog->aux->ext_mutex);
++      prog->aux->prog_array_member_cnt--;
++      mutex_unlock(&prog->aux->ext_mutex);
+       /* bpf_prog is freed after one RCU or tasks trace grace period */
+-      bpf_prog_put(ptr);
++      bpf_prog_put(prog);
+ }
+ static u32 prog_fd_array_sys_lookup_elem(void *ptr)
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 5e77c58e06010..233ea78f8f1bd 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -131,6 +131,7 @@ struct bpf_prog *bpf_prog_alloc_no_stats(unsigned int size, gfp_t gfp_extra_flag
+       INIT_LIST_HEAD_RCU(&fp->aux->ksym_prefix.lnode);
+ #endif
+       mutex_init(&fp->aux->used_maps_mutex);
++      mutex_init(&fp->aux->ext_mutex);
+       mutex_init(&fp->aux->dst_mutex);
+       return fp;
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index c5aa127ed4cc0..8405a95e066cf 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -3218,7 +3218,8 @@ static void bpf_tracing_link_release(struct bpf_link *link)
+               container_of(link, struct bpf_tracing_link, link.link);
+       WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link,
+-                                              tr_link->trampoline));
++                                              tr_link->trampoline,
++                                              tr_link->tgt_prog));
+       bpf_trampoline_put(tr_link->trampoline);
+@@ -3358,7 +3359,7 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
+        *   in prog->aux
+        *
+        * - if prog->aux->dst_trampoline is NULL, the program has already been
+-         *   attached to a target and its initial target was cleared (below)
++       *   attached to a target and its initial target was cleared (below)
+        *
+        * - if tgt_prog != NULL, the caller specified tgt_prog_fd +
+        *   target_btf_id using the link_create API.
+@@ -3433,7 +3434,7 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
+       if (err)
+               goto out_unlock;
+-      err = bpf_trampoline_link_prog(&link->link, tr);
++      err = bpf_trampoline_link_prog(&link->link, tr, tgt_prog);
+       if (err) {
+               bpf_link_cleanup(&link_primer);
+               link = NULL;
+diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
+index 1166d9dd3e8b5..ecdd2660561f5 100644
+--- a/kernel/bpf/trampoline.c
++++ b/kernel/bpf/trampoline.c
+@@ -528,7 +528,27 @@ static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog)
+       }
+ }
+-static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)
++static int bpf_freplace_check_tgt_prog(struct bpf_prog *tgt_prog)
++{
++      struct bpf_prog_aux *aux = tgt_prog->aux;
++
++      guard(mutex)(&aux->ext_mutex);
++      if (aux->prog_array_member_cnt)
++              /* Program extensions can not extend target prog when the target
++               * prog has been updated to any prog_array map as tail callee.
++               * It's to prevent a potential infinite loop like:
++               * tgt prog entry -> tgt prog subprog -> freplace prog entry
++               * --tailcall-> tgt prog entry.
++               */
++              return -EBUSY;
++
++      aux->is_extended = true;
++      return 0;
++}
++
++static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link,
++                                    struct bpf_trampoline *tr,
++                                    struct bpf_prog *tgt_prog)
+ {
+       enum bpf_tramp_prog_type kind;
+       struct bpf_tramp_link *link_exiting;
+@@ -549,6 +569,9 @@ static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_tr
+               /* Cannot attach extension if fentry/fexit are in use. */
+               if (cnt)
+                       return -EBUSY;
++              err = bpf_freplace_check_tgt_prog(tgt_prog);
++              if (err)
++                      return err;
+               tr->extension_prog = link->link.prog;
+               return bpf_arch_text_poke(tr->func.addr, BPF_MOD_JUMP, NULL,
+                                         link->link.prog->bpf_func);
+@@ -575,17 +598,21 @@ static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_tr
+       return err;
+ }
+-int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)
++int bpf_trampoline_link_prog(struct bpf_tramp_link *link,
++                           struct bpf_trampoline *tr,
++                           struct bpf_prog *tgt_prog)
+ {
+       int err;
+       mutex_lock(&tr->mutex);
+-      err = __bpf_trampoline_link_prog(link, tr);
++      err = __bpf_trampoline_link_prog(link, tr, tgt_prog);
+       mutex_unlock(&tr->mutex);
+       return err;
+ }
+-static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)
++static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
++                                      struct bpf_trampoline *tr,
++                                      struct bpf_prog *tgt_prog)
+ {
+       enum bpf_tramp_prog_type kind;
+       int err;
+@@ -596,6 +623,8 @@ static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_
+               err = bpf_arch_text_poke(tr->func.addr, BPF_MOD_JUMP,
+                                        tr->extension_prog->bpf_func, NULL);
+               tr->extension_prog = NULL;
++              guard(mutex)(&tgt_prog->aux->ext_mutex);
++              tgt_prog->aux->is_extended = false;
+               return err;
+       }
+       hlist_del_init(&link->tramp_hlist);
+@@ -604,12 +633,14 @@ static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_
+ }
+ /* bpf_trampoline_unlink_prog() should never fail. */
+-int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)
++int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
++                             struct bpf_trampoline *tr,
++                             struct bpf_prog *tgt_prog)
+ {
+       int err;
+       mutex_lock(&tr->mutex);
+-      err = __bpf_trampoline_unlink_prog(link, tr);
++      err = __bpf_trampoline_unlink_prog(link, tr, tgt_prog);
+       mutex_unlock(&tr->mutex);
+       return err;
+ }
+@@ -624,7 +655,7 @@ static void bpf_shim_tramp_link_release(struct bpf_link *link)
+       if (!shim_link->trampoline)
+               return;
+-      WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline));
++      WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL));
+       bpf_trampoline_put(shim_link->trampoline);
+ }
+@@ -738,7 +769,7 @@ int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog,
+               goto err;
+       }
+-      err = __bpf_trampoline_link_prog(&shim_link->link, tr);
++      err = __bpf_trampoline_link_prog(&shim_link->link, tr, NULL);
+       if (err)
+               goto err;
+-- 
+2.43.0
+
diff --git a/queue-6.12/bpf-put-bpf_link-s-program-when-link-is-safe-to-be-d.patch b/queue-6.12/bpf-put-bpf_link-s-program-when-link-is-safe-to-be-d.patch
new file mode 100644 (file)
index 0000000..d8f05c7
--- /dev/null
@@ -0,0 +1,103 @@
+From 942af3898db0cfddfec490e8a5ae6d4b8675821f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 11:17:52 -0700
+Subject: bpf: put bpf_link's program when link is safe to be deallocated
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit f44ec8733a8469143fde1984b5e6931b2e2f6f3f ]
+
+In general, BPF link's underlying BPF program should be considered to be
+reachable through attach hook -> link -> prog chain, and, pessimistically,
+we have to assume that as long as link's memory is not safe to free,
+attach hook's code might hold a pointer to BPF program and use it.
+
+As such, it's not (generally) correct to put link's program early before
+waiting for RCU GPs to go through. More eager bpf_prog_put() that we
+currently do is mostly correct due to BPF program's release code doing
+similar RCU GP waiting, but as will be shown in the following patches,
+BPF program can be non-sleepable (and, thus, reliant on only "classic"
+RCU GP), while BPF link's attach hook can have sleepable semantics and
+needs to be protected by RCU Tasks Trace, and for such cases BPF link
+has to go through RCU Tasks Trace + "classic" RCU GPs before being
+deallocated. And so, if we put BPF program early, we might free BPF
+program before we free BPF link, leading to use-after-free situation.
+
+So, this patch defers bpf_prog_put() until we are ready to perform
+bpf_link's deallocation. At worst, this delays BPF program freeing by
+one extra RCU GP, but that seems completely acceptable. Alternatively,
+we'd need more elaborate ways to determine BPF hook, BPF link, and BPF
+program lifetimes, and how they relate to each other, which seems like
+an unnecessary complication.
+
+Note, for most BPF links we still will perform eager bpf_prog_put() and
+link dealloc, so for those BPF links there are no observable changes
+whatsoever. Only BPF links that use deferred dealloc might notice
+slightly delayed freeing of BPF programs.
+
+Also, to reduce code and logic duplication, extract program put + link
+dealloc logic into bpf_link_dealloc() helper.
+
+Link: https://lore.kernel.org/20241101181754.782341-1-andrii@kernel.org
+Tested-by: Jordan Rife <jrife@google.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 8405a95e066cf..368ae8d231d41 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -2976,12 +2976,24 @@ void bpf_link_inc(struct bpf_link *link)
+       atomic64_inc(&link->refcnt);
+ }
++static void bpf_link_dealloc(struct bpf_link *link)
++{
++      /* now that we know that bpf_link itself can't be reached, put underlying BPF program */
++      if (link->prog)
++              bpf_prog_put(link->prog);
++
++      /* free bpf_link and its containing memory */
++      if (link->ops->dealloc_deferred)
++              link->ops->dealloc_deferred(link);
++      else
++              link->ops->dealloc(link);
++}
++
+ static void bpf_link_defer_dealloc_rcu_gp(struct rcu_head *rcu)
+ {
+       struct bpf_link *link = container_of(rcu, struct bpf_link, rcu);
+-      /* free bpf_link and its containing memory */
+-      link->ops->dealloc_deferred(link);
++      bpf_link_dealloc(link);
+ }
+ static void bpf_link_defer_dealloc_mult_rcu_gp(struct rcu_head *rcu)
+@@ -3003,7 +3015,6 @@ static void bpf_link_free(struct bpf_link *link)
+               sleepable = link->prog->sleepable;
+               /* detach BPF program, clean up used resources */
+               ops->release(link);
+-              bpf_prog_put(link->prog);
+       }
+       if (ops->dealloc_deferred) {
+               /* schedule BPF link deallocation; if underlying BPF program
+@@ -3014,8 +3025,9 @@ static void bpf_link_free(struct bpf_link *link)
+                       call_rcu_tasks_trace(&link->rcu, bpf_link_defer_dealloc_mult_rcu_gp);
+               else
+                       call_rcu(&link->rcu, bpf_link_defer_dealloc_rcu_gp);
+-      } else if (ops->dealloc)
+-              ops->dealloc(link);
++      } else if (ops->dealloc) {
++              bpf_link_dealloc(link);
++      }
+ }
+ static void bpf_link_put_deferred(struct work_struct *work)
+-- 
+2.43.0
+
diff --git a/queue-6.12/btrfs-avoid-unnecessary-device-path-update-for-the-s.patch b/queue-6.12/btrfs-avoid-unnecessary-device-path-update-for-the-s.patch
new file mode 100644 (file)
index 0000000..4f24907
--- /dev/null
@@ -0,0 +1,126 @@
+From 38779dd37b4a69569ddf4e2f5ffce5df4e600dc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2024 12:52:17 +0930
+Subject: btrfs: avoid unnecessary device path update for the same device
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 2e8b6bc0ab41ce41e6dfcc204b6cc01d5abbc952 ]
+
+[PROBLEM]
+It is very common for udev to trigger device scan, and every time a
+mounted btrfs device got re-scan from different soft links, we will get
+some of unnecessary device path updates, this is especially common
+for LVM based storage:
+
+ # lvs
+  scratch1 test -wi-ao---- 10.00g
+  scratch2 test -wi-a----- 10.00g
+  scratch3 test -wi-a----- 10.00g
+  scratch4 test -wi-a----- 10.00g
+  scratch5 test -wi-a----- 10.00g
+  test     test -wi-a----- 10.00g
+
+ # mkfs.btrfs -f /dev/test/scratch1
+ # mount /dev/test/scratch1 /mnt/btrfs
+ # dmesg -c
+ [  205.705234] BTRFS: device fsid 7be2602f-9e35-4ecf-a6ff-9e91d2c182c9 devid 1 transid 6 /dev/mapper/test-scratch1 (253:4) scanned by mount (1154)
+ [  205.710864] BTRFS info (device dm-4): first mount of filesystem 7be2602f-9e35-4ecf-a6ff-9e91d2c182c9
+ [  205.711923] BTRFS info (device dm-4): using crc32c (crc32c-intel) checksum algorithm
+ [  205.713856] BTRFS info (device dm-4): using free-space-tree
+ [  205.722324] BTRFS info (device dm-4): checking UUID tree
+
+So far so good, but even if we just touched any soft link of
+"dm-4", we will get quite some unnecessary device path updates.
+
+ # touch /dev/mapper/test-scratch1
+ # dmesg -c
+ [  469.295796] BTRFS info: devid 1 device path /dev/mapper/test-scratch1 changed to /dev/dm-4 scanned by (udev-worker) (1221)
+ [  469.300494] BTRFS info: devid 1 device path /dev/dm-4 changed to /dev/mapper/test-scratch1 scanned by (udev-worker) (1221)
+
+Such device path rename is unnecessary and can lead to random path
+change due to the udev race.
+
+[CAUSE]
+Inside device_list_add(), we are using a very primitive way checking if
+the device has changed, strcmp().
+
+Which can never handle links well, no matter if it's hard or soft links.
+
+So every different link of the same device will be treated as a different
+device, causing the unnecessary device path update.
+
+[FIX]
+Introduce a helper, is_same_device(), and use path_equal() to properly
+detect the same block device.
+So that the different soft links won't trigger the rename race.
+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1230641
+Reported-by: Fabian Vogt <fvogt@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 38 +++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 37 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 920df7585b0d1..5e75a4e3a5be5 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -732,6 +732,42 @@ const u8 *btrfs_sb_fsid_ptr(const struct btrfs_super_block *sb)
+       return has_metadata_uuid ? sb->metadata_uuid : sb->fsid;
+ }
++static bool is_same_device(struct btrfs_device *device, const char *new_path)
++{
++      struct path old = { .mnt = NULL, .dentry = NULL };
++      struct path new = { .mnt = NULL, .dentry = NULL };
++      char *old_path = NULL;
++      bool is_same = false;
++      int ret;
++
++      if (!device->name)
++              goto out;
++
++      old_path = kzalloc(PATH_MAX, GFP_NOFS);
++      if (!old_path)
++              goto out;
++
++      rcu_read_lock();
++      ret = strscpy(old_path, rcu_str_deref(device->name), PATH_MAX);
++      rcu_read_unlock();
++      if (ret < 0)
++              goto out;
++
++      ret = kern_path(old_path, LOOKUP_FOLLOW, &old);
++      if (ret)
++              goto out;
++      ret = kern_path(new_path, LOOKUP_FOLLOW, &new);
++      if (ret)
++              goto out;
++      if (path_equal(&old, &new))
++              is_same = true;
++out:
++      kfree(old_path);
++      path_put(&old);
++      path_put(&new);
++      return is_same;
++}
++
+ /*
+  * Add new device to list of registered devices
+  *
+@@ -852,7 +888,7 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+                               MAJOR(path_devt), MINOR(path_devt),
+                               current->comm, task_pid_nr(current));
+-      } else if (!device->name || strcmp(device->name->str, path)) {
++      } else if (!device->name || !is_same_device(device, path)) {
+               /*
+                * When FS is already mounted.
+                * 1. If you are here and if the device->name is NULL that
+-- 
+2.43.0
+
diff --git a/queue-6.12/btrfs-canonicalize-the-device-path-before-adding-it.patch b/queue-6.12/btrfs-canonicalize-the-device-path-before-adding-it.patch
new file mode 100644 (file)
index 0000000..08bd7ce
--- /dev/null
@@ -0,0 +1,199 @@
+From c83a6fb76fa1f4850e231c898dabb66f5bf7f3a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2024 14:27:07 +0930
+Subject: btrfs: canonicalize the device path before adding it
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 7e06de7c83a746e58d4701e013182af133395188 ]
+
+[PROBLEM]
+Currently btrfs accepts any file path for its device, resulting some
+weird situation:
+
+ # ./mount_by_fd /dev/test/scratch1  /mnt/btrfs/
+
+The program has the following source code:
+
+ #include <fcntl.h>
+ #include <stdio.h>
+ #include <sys/mount.h>
+
+ int main(int argc, char *argv[]) {
+       int fd = open(argv[1], O_RDWR);
+       char path[256];
+       snprintf(path, sizeof(path), "/proc/self/fd/%d", fd);
+       return mount(path, argv[2], "btrfs", 0, NULL);
+ }
+
+Then we can have the following weird device path:
+
+ BTRFS: device fsid 2378be81-fe12-46d2-a9e8-68cf08dd98d5 devid 1 transid 7 /proc/self/fd/3 (253:2) scanned by mount_by_fd (18440)
+
+Normally it's not a big deal, and later udev can trigger a device path
+rename. But if udev didn't trigger, the device path "/proc/self/fd/3"
+will show up in mtab.
+
+[CAUSE]
+For filename "/proc/self/fd/3", it means the opened file descriptor 3.
+In above case, it's exactly the device we want to open, aka points to
+"/dev/test/scratch1" which is another symlink pointing to "/dev/dm-2".
+
+Inside kernel we solve the mount source using LOOKUP_FOLLOW, which
+follows the symbolic link and grab the proper block device.
+
+But inside btrfs we also save the filename into btrfs_device::name, and
+utilize that member to report our mount source, which leads to the above
+situation.
+
+[FIX]
+Instead of unconditionally trust the path, check if the original file
+(not following the symbolic link) is inside "/dev/", if not, then
+manually lookup the path to its final destination, and use that as our
+device path.
+
+This allows us to still use symbolic links, like
+"/dev/mapper/test-scratch" from LVM2, which is required for fstests runs
+with LVM2 setup.
+
+And for really weird names, like the above case, we solve it to
+"/dev/dm-2" instead.
+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1230641
+Reported-by: Fabian Vogt <fvogt@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 87 +++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 86 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 5e75a4e3a5be5..5895397364aac 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -732,6 +732,78 @@ const u8 *btrfs_sb_fsid_ptr(const struct btrfs_super_block *sb)
+       return has_metadata_uuid ? sb->metadata_uuid : sb->fsid;
+ }
++/*
++ * We can have very weird soft links passed in.
++ * One example is "/proc/self/fd/<fd>", which can be a soft link to
++ * a block device.
++ *
++ * But it's never a good idea to use those weird names.
++ * Here we check if the path (not following symlinks) is a good one inside
++ * "/dev/".
++ */
++static bool is_good_dev_path(const char *dev_path)
++{
++      struct path path = { .mnt = NULL, .dentry = NULL };
++      char *path_buf = NULL;
++      char *resolved_path;
++      bool is_good = false;
++      int ret;
++
++      if (!dev_path)
++              goto out;
++
++      path_buf = kmalloc(PATH_MAX, GFP_KERNEL);
++      if (!path_buf)
++              goto out;
++
++      /*
++       * Do not follow soft link, just check if the original path is inside
++       * "/dev/".
++       */
++      ret = kern_path(dev_path, 0, &path);
++      if (ret)
++              goto out;
++      resolved_path = d_path(&path, path_buf, PATH_MAX);
++      if (IS_ERR(resolved_path))
++              goto out;
++      if (strncmp(resolved_path, "/dev/", strlen("/dev/")))
++              goto out;
++      is_good = true;
++out:
++      kfree(path_buf);
++      path_put(&path);
++      return is_good;
++}
++
++static int get_canonical_dev_path(const char *dev_path, char *canonical)
++{
++      struct path path = { .mnt = NULL, .dentry = NULL };
++      char *path_buf = NULL;
++      char *resolved_path;
++      int ret;
++
++      if (!dev_path) {
++              ret = -EINVAL;
++              goto out;
++      }
++
++      path_buf = kmalloc(PATH_MAX, GFP_KERNEL);
++      if (!path_buf) {
++              ret = -ENOMEM;
++              goto out;
++      }
++
++      ret = kern_path(dev_path, LOOKUP_FOLLOW, &path);
++      if (ret)
++              goto out;
++      resolved_path = d_path(&path, path_buf, PATH_MAX);
++      ret = strscpy(canonical, resolved_path, PATH_MAX);
++out:
++      kfree(path_buf);
++      path_put(&path);
++      return ret;
++}
++
+ static bool is_same_device(struct btrfs_device *device, const char *new_path)
+ {
+       struct path old = { .mnt = NULL, .dentry = NULL };
+@@ -1419,12 +1491,23 @@ struct btrfs_device *btrfs_scan_one_device(const char *path, blk_mode_t flags,
+       bool new_device_added = false;
+       struct btrfs_device *device = NULL;
+       struct file *bdev_file;
++      char *canonical_path = NULL;
+       u64 bytenr;
+       dev_t devt;
+       int ret;
+       lockdep_assert_held(&uuid_mutex);
++      if (!is_good_dev_path(path)) {
++              canonical_path = kmalloc(PATH_MAX, GFP_KERNEL);
++              if (canonical_path) {
++                      ret = get_canonical_dev_path(path, canonical_path);
++                      if (ret < 0) {
++                              kfree(canonical_path);
++                              canonical_path = NULL;
++                      }
++              }
++      }
+       /*
+        * Avoid an exclusive open here, as the systemd-udev may initiate the
+        * device scan which may race with the user's mount or mkfs command,
+@@ -1469,7 +1552,8 @@ struct btrfs_device *btrfs_scan_one_device(const char *path, blk_mode_t flags,
+               goto free_disk_super;
+       }
+-      device = device_list_add(path, disk_super, &new_device_added);
++      device = device_list_add(canonical_path ? : path, disk_super,
++                               &new_device_added);
+       if (!IS_ERR(device) && new_device_added)
+               btrfs_free_stale_devices(device->devt, device);
+@@ -1478,6 +1562,7 @@ struct btrfs_device *btrfs_scan_one_device(const char *path, blk_mode_t flags,
+ error_bdev_put:
+       fput(bdev_file);
++      kfree(canonical_path);
+       return device;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/btrfs-do-not-clear-read-only-when-adding-sprout-devi.patch b/queue-6.12/btrfs-do-not-clear-read-only-when-adding-sprout-devi.patch
new file mode 100644 (file)
index 0000000..d14dfc2
--- /dev/null
@@ -0,0 +1,66 @@
+From 2286ee53d62dc18051fd1e678d035f1b6cf87a54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 14:27:32 -0700
+Subject: btrfs: do not clear read-only when adding sprout device
+
+From: Boris Burkov <boris@bur.io>
+
+[ Upstream commit 70958a949d852cbecc3d46127bf0b24786df0130 ]
+
+If you follow the seed/sprout wiki, it suggests the following workflow:
+
+btrfstune -S 1 seed_dev
+mount seed_dev mnt
+btrfs device add sprout_dev
+mount -o remount,rw mnt
+
+The first mount mounts the FS readonly, which results in not setting
+BTRFS_FS_OPEN, and setting the readonly bit on the sb. The device add
+somewhat surprisingly clears the readonly bit on the sb (though the
+mount is still practically readonly, from the users perspective...).
+Finally, the remount checks the readonly bit on the sb against the flag
+and sees no change, so it does not run the code intended to run on
+ro->rw transitions, leaving BTRFS_FS_OPEN unset.
+
+As a result, when the cleaner_kthread runs, it sees no BTRFS_FS_OPEN and
+does no work. This results in leaking deleted snapshots until we run out
+of space.
+
+I propose fixing it at the first departure from what feels reasonable:
+when we clear the readonly bit on the sb during device add.
+
+A new fstest I have written reproduces the bug and confirms the fix.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Boris Burkov <boris@bur.io>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 5895397364aac..0c4d14c59ebec 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -2842,8 +2842,6 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path
+       set_blocksize(device->bdev_file, BTRFS_BDEV_BLOCKSIZE);
+       if (seeding_dev) {
+-              btrfs_clear_sb_rdonly(sb);
+-
+               /* GFP_KERNEL allocation must not be under device_list_mutex */
+               seed_devices = btrfs_init_sprout(fs_info);
+               if (IS_ERR(seed_devices)) {
+@@ -2986,8 +2984,6 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path
+       mutex_unlock(&fs_info->chunk_mutex);
+       mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+ error_trans:
+-      if (seeding_dev)
+-              btrfs_set_sb_rdonly(sb);
+       if (trans)
+               btrfs_end_transaction(trans);
+ error_free_zone:
+-- 
+2.43.0
+
diff --git a/queue-6.12/btrfs-don-t-take-dev_replace-rwsem-on-task-already-h.patch b/queue-6.12/btrfs-don-t-take-dev_replace-rwsem-on-task-already-h.patch
new file mode 100644 (file)
index 0000000..3b0b7e5
--- /dev/null
@@ -0,0 +1,241 @@
+From 179582136aefa1da50f39fd8d844f2f023ae7821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 09:55:01 +0200
+Subject: btrfs: don't take dev_replace rwsem on task already holding it
+
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+
+[ Upstream commit 8cca35cb29f81eba3e96ec44dad8696c8a2f9138 ]
+
+Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of
+the RAID stripe-tree, we get the following splat from lockdep:
+
+ BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started
+
+ ============================================
+ WARNING: possible recursive locking detected
+ 6.11.0-rc3-btrfs-for-next #599 Not tainted
+ --------------------------------------------
+ btrfs/2326 is trying to acquire lock:
+ ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250
+
+ but task is already holding lock:
+ ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250
+
+ other info that might help us debug this:
+  Possible unsafe locking scenario:
+
+        CPU0
+        ----
+   lock(&fs_info->dev_replace.rwsem);
+   lock(&fs_info->dev_replace.rwsem);
+
+  *** DEADLOCK ***
+
+  May be due to missing lock nesting notation
+
+ 1 lock held by btrfs/2326:
+  #0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250
+
+ stack backtrace:
+ CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599
+ Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
+ Call Trace:
+  <TASK>
+  dump_stack_lvl+0x5b/0x80
+  __lock_acquire+0x2798/0x69d0
+  ? __pfx___lock_acquire+0x10/0x10
+  ? __pfx___lock_acquire+0x10/0x10
+  lock_acquire+0x19d/0x4a0
+  ? btrfs_map_block+0x39f/0x2250
+  ? __pfx_lock_acquire+0x10/0x10
+  ? find_held_lock+0x2d/0x110
+  ? lock_is_held_type+0x8f/0x100
+  down_read+0x8e/0x440
+  ? btrfs_map_block+0x39f/0x2250
+  ? __pfx_down_read+0x10/0x10
+  ? do_raw_read_unlock+0x44/0x70
+  ? _raw_read_unlock+0x23/0x40
+  btrfs_map_block+0x39f/0x2250
+  ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00
+  ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0
+  ? __kasan_slab_alloc+0x6e/0x70
+  ? __pfx_btrfs_map_block+0x10/0x10
+  ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10
+  ? kmem_cache_alloc_noprof+0x1f2/0x300
+  ? mempool_alloc_noprof+0xed/0x2b0
+  btrfs_submit_chunk+0x28d/0x17e0
+  ? __pfx_btrfs_submit_chunk+0x10/0x10
+  ? bvec_alloc+0xd7/0x1b0
+  ? bio_add_folio+0x171/0x270
+  ? __pfx_bio_add_folio+0x10/0x10
+  ? __kasan_check_read+0x20/0x20
+  btrfs_submit_bio+0x37/0x80
+  read_extent_buffer_pages+0x3df/0x6c0
+  btrfs_read_extent_buffer+0x13e/0x5f0
+  read_tree_block+0x81/0xe0
+  read_block_for_search+0x4bd/0x7a0
+  ? __pfx_read_block_for_search+0x10/0x10
+  btrfs_search_slot+0x78d/0x2720
+  ? __pfx_btrfs_search_slot+0x10/0x10
+  ? lock_is_held_type+0x8f/0x100
+  ? kasan_save_track+0x14/0x30
+  ? __kasan_slab_alloc+0x6e/0x70
+  ? kmem_cache_alloc_noprof+0x1f2/0x300
+  btrfs_get_raid_extent_offset+0x181/0x820
+  ? __pfx_lock_acquire+0x10/0x10
+  ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10
+  ? down_read+0x194/0x440
+  ? __pfx_down_read+0x10/0x10
+  ? do_raw_read_unlock+0x44/0x70
+  ? _raw_read_unlock+0x23/0x40
+  btrfs_map_block+0x5b5/0x2250
+  ? __pfx_btrfs_map_block+0x10/0x10
+  scrub_submit_initial_read+0x8fe/0x11b0
+  ? __pfx_scrub_submit_initial_read+0x10/0x10
+  submit_initial_group_read+0x161/0x3a0
+  ? lock_release+0x20e/0x710
+  ? __pfx_submit_initial_group_read+0x10/0x10
+  ? __pfx_lock_release+0x10/0x10
+  scrub_simple_mirror.isra.0+0x3eb/0x580
+  scrub_stripe+0xe4d/0x1440
+  ? lock_release+0x20e/0x710
+  ? __pfx_scrub_stripe+0x10/0x10
+  ? __pfx_lock_release+0x10/0x10
+  ? do_raw_read_unlock+0x44/0x70
+  ? _raw_read_unlock+0x23/0x40
+  scrub_chunk+0x257/0x4a0
+  scrub_enumerate_chunks+0x64c/0xf70
+  ? __mutex_unlock_slowpath+0x147/0x5f0
+  ? __pfx_scrub_enumerate_chunks+0x10/0x10
+  ? bit_wait_timeout+0xb0/0x170
+  ? __up_read+0x189/0x700
+  ? scrub_workers_get+0x231/0x300
+  ? up_write+0x490/0x4f0
+  btrfs_scrub_dev+0x52e/0xcd0
+  ? create_pending_snapshots+0x230/0x250
+  ? __pfx_btrfs_scrub_dev+0x10/0x10
+  btrfs_dev_replace_by_ioctl+0xd69/0x1d00
+  ? lock_acquire+0x19d/0x4a0
+  ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10
+  ? lock_release+0x20e/0x710
+  ? btrfs_ioctl+0xa09/0x74f0
+  ? __pfx_lock_release+0x10/0x10
+  ? do_raw_spin_lock+0x11e/0x240
+  ? __pfx_do_raw_spin_lock+0x10/0x10
+  btrfs_ioctl+0xa14/0x74f0
+  ? lock_acquire+0x19d/0x4a0
+  ? find_held_lock+0x2d/0x110
+  ? __pfx_btrfs_ioctl+0x10/0x10
+  ? lock_release+0x20e/0x710
+  ? do_sigaction+0x3f0/0x860
+  ? __pfx_do_vfs_ioctl+0x10/0x10
+  ? do_raw_spin_lock+0x11e/0x240
+  ? lockdep_hardirqs_on_prepare+0x270/0x3e0
+  ? _raw_spin_unlock_irq+0x28/0x50
+  ? do_sigaction+0x3f0/0x860
+  ? __pfx_do_sigaction+0x10/0x10
+  ? __x64_sys_rt_sigaction+0x18e/0x1e0
+  ? __pfx___x64_sys_rt_sigaction+0x10/0x10
+  ? __x64_sys_close+0x7c/0xd0
+  __x64_sys_ioctl+0x137/0x190
+  do_syscall_64+0x71/0x140
+  entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ RIP: 0033:0x7f0bd1114f9b
+ Code: Unable to access opcode bytes at 0x7f0bd1114f71.
+ RSP: 002b:00007ffc8a8c3130 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+ RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0bd1114f9b
+ RDX: 00007ffc8a8c35e0 RSI: 00000000ca289435 RDI: 0000000000000003
+ RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000007
+ R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffc8a8c6c85
+ R13: 00000000398e72a0 R14: 0000000000004361 R15: 0000000000000004
+  </TASK>
+
+This happens because on RAID stripe-tree filesystems we recurse back into
+btrfs_map_block() on scrub to perform the logical to device physical
+mapping.
+
+But as the device replace task is already holding the dev_replace::rwsem
+we deadlock.
+
+So don't take the dev_replace::rwsem in case our task is the task performing
+the device replace.
+
+Suggested-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/dev-replace.c | 2 ++
+ fs/btrfs/fs.h          | 2 ++
+ fs/btrfs/volumes.c     | 8 +++++---
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 83d5cdd77f293..604399e59a3d1 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -641,6 +641,7 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+               return ret;
+       down_write(&dev_replace->rwsem);
++      dev_replace->replace_task = current;
+       switch (dev_replace->replace_state) {
+       case BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED:
+       case BTRFS_IOCTL_DEV_REPLACE_STATE_FINISHED:
+@@ -994,6 +995,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
+       list_add(&tgt_device->dev_alloc_list, &fs_devices->alloc_list);
+       fs_devices->rw_devices++;
++      dev_replace->replace_task = NULL;
+       up_write(&dev_replace->rwsem);
+       btrfs_rm_dev_replace_blocked(fs_info);
+diff --git a/fs/btrfs/fs.h b/fs/btrfs/fs.h
+index 79f64e383eddf..cbfb225858a59 100644
+--- a/fs/btrfs/fs.h
++++ b/fs/btrfs/fs.h
+@@ -317,6 +317,8 @@ struct btrfs_dev_replace {
+       struct percpu_counter bio_counter;
+       wait_queue_head_t replace_wait;
++
++      struct task_struct *replace_task;
+ };
+ /*
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index eb51b609190fb..920df7585b0d1 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6481,13 +6481,15 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
+       max_len = btrfs_max_io_len(map, map_offset, &io_geom);
+       *length = min_t(u64, map->chunk_len - map_offset, max_len);
+-      down_read(&dev_replace->rwsem);
++      if (dev_replace->replace_task != current)
++              down_read(&dev_replace->rwsem);
++
+       dev_replace_is_ongoing = btrfs_dev_replace_is_ongoing(dev_replace);
+       /*
+        * Hold the semaphore for read during the whole operation, write is
+        * requested at commit time but must wait.
+        */
+-      if (!dev_replace_is_ongoing)
++      if (!dev_replace_is_ongoing && dev_replace->replace_task != current)
+               up_read(&dev_replace->rwsem);
+       switch (map->type & BTRFS_BLOCK_GROUP_PROFILE_MASK) {
+@@ -6627,7 +6629,7 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op,
+       bioc->mirror_num = io_geom.mirror_num;
+ out:
+-      if (dev_replace_is_ongoing) {
++      if (dev_replace_is_ongoing && dev_replace->replace_task != current) {
+               lockdep_assert_held(&dev_replace->rwsem);
+               /* Unlock and let waiting writers proceed */
+               up_read(&dev_replace->rwsem);
+-- 
+2.43.0
+
diff --git a/queue-6.12/cleanup-adjust-scoped_guard-macros-to-avoid-potentia.patch b/queue-6.12/cleanup-adjust-scoped_guard-macros-to-avoid-potentia.patch
new file mode 100644 (file)
index 0000000..edacb48
--- /dev/null
@@ -0,0 +1,171 @@
+From d3ae88e25ff3a38cb8cb2a761a6ab15abcc8cd9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 13:38:14 +0200
+Subject: cleanup: Adjust scoped_guard() macros to avoid potential warning
+
+From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+
+[ Upstream commit fcc22ac5baf06dd17193de44b60dbceea6461983 ]
+
+Change scoped_guard() and scoped_cond_guard() macros to make reasoning
+about them easier for static analysis tools (smatch, compiler
+diagnostics), especially to enable them to tell if the given usage of
+scoped_guard() is with a conditional lock class (interruptible-locks,
+try-locks) or not (like simple mutex_lock()).
+
+Add compile-time error if scoped_cond_guard() is used for non-conditional
+lock class.
+
+Beyond easier tooling and a little shrink reported by bloat-o-meter
+this patch enables developer to write code like:
+
+int foo(struct my_drv *adapter)
+{
+       scoped_guard(spinlock, &adapter->some_spinlock)
+               return adapter->spinlock_protected_var;
+}
+
+Current scoped_guard() implementation does not support that,
+due to compiler complaining:
+error: control reaches end of non-void function [-Werror=return-type]
+
+Technical stuff about the change:
+scoped_guard() macro uses common idiom of using "for" statement to declare
+a scoped variable. Unfortunately, current logic is too hard for compiler
+diagnostics to be sure that there is exactly one loop step; fix that.
+
+To make any loop so trivial that there is no above warning, it must not
+depend on any non-const variable to tell if there are more steps. There is
+no obvious solution for that in C, but one could use the compound
+statement expression with "goto" jumping past the "loop", effectively
+leaving only the subscope part of the loop semantics.
+
+More impl details:
+one more level of macro indirection is now needed to avoid duplicating
+label names;
+I didn't spot any other place that is using the
+"for (...; goto label) if (0) label: break;" idiom, so it's not packed for
+reuse beyond scoped_guard() family, what makes actual macros code cleaner.
+
+There was also a need to introduce const true/false variable per lock
+class, it is used to aid compiler diagnostics reasoning about "exactly
+1 step" loops (note that converting that to function would undo the whole
+benefit).
+
+Big thanks to Andy Shevchenko for help on this patch, both internal and
+public, ranging from whitespace/formatting, through commit message
+clarifications, general improvements, ending with presenting alternative
+approaches - all despite not even liking the idea.
+
+Big thanks to Dmitry Torokhov for the idea of compile-time check for
+scoped_cond_guard() (to use it only with conditional locsk), and general
+improvements for the patch.
+
+Big thanks to David Lechner for idea to cover also scoped_cond_guard().
+
+Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Link: https://lkml.kernel.org/r/20241018113823.171256-1-przemyslaw.kitszel@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cleanup.h | 52 +++++++++++++++++++++++++++++++++--------
+ 1 file changed, 42 insertions(+), 10 deletions(-)
+
+diff --git a/include/linux/cleanup.h b/include/linux/cleanup.h
+index 518bd1fd86fbe..0cc66f8d28e7b 100644
+--- a/include/linux/cleanup.h
++++ b/include/linux/cleanup.h
+@@ -285,14 +285,20 @@ static inline class_##_name##_t class_##_name##ext##_constructor(_init_args) \
+  *      similar to scoped_guard(), except it does fail when the lock
+  *      acquire fails.
+  *
++ *      Only for conditional locks.
+  */
++#define __DEFINE_CLASS_IS_CONDITIONAL(_name, _is_cond)        \
++static __maybe_unused const bool class_##_name##_is_conditional = _is_cond
++
+ #define DEFINE_GUARD(_name, _type, _lock, _unlock) \
++      __DEFINE_CLASS_IS_CONDITIONAL(_name, false); \
+       DEFINE_CLASS(_name, _type, if (_T) { _unlock; }, ({ _lock; _T; }), _type _T); \
+       static inline void * class_##_name##_lock_ptr(class_##_name##_t *_T) \
+       { return (void *)(__force unsigned long)*_T; }
+ #define DEFINE_GUARD_COND(_name, _ext, _condlock) \
++      __DEFINE_CLASS_IS_CONDITIONAL(_name##_ext, true); \
+       EXTEND_CLASS(_name, _ext, \
+                    ({ void *_t = _T; if (_T && !(_condlock)) _t = NULL; _t; }), \
+                    class_##_name##_t _T) \
+@@ -303,17 +309,40 @@ static inline class_##_name##_t class_##_name##ext##_constructor(_init_args) \
+       CLASS(_name, __UNIQUE_ID(guard))
+ #define __guard_ptr(_name) class_##_name##_lock_ptr
++#define __is_cond_ptr(_name) class_##_name##_is_conditional
+-#define scoped_guard(_name, args...)                                  \
+-      for (CLASS(_name, scope)(args),                                 \
+-           *done = NULL; __guard_ptr(_name)(&scope) && !done; done = (void *)1)
+-
+-#define scoped_cond_guard(_name, _fail, args...) \
+-      for (CLASS(_name, scope)(args), \
+-           *done = NULL; !done; done = (void *)1) \
+-              if (!__guard_ptr(_name)(&scope)) _fail; \
+-              else
+-
++/*
++ * Helper macro for scoped_guard().
++ *
++ * Note that the "!__is_cond_ptr(_name)" part of the condition ensures that
++ * compiler would be sure that for the unconditional locks the body of the
++ * loop (caller-provided code glued to the else clause) could not be skipped.
++ * It is needed because the other part - "__guard_ptr(_name)(&scope)" - is too
++ * hard to deduce (even if could be proven true for unconditional locks).
++ */
++#define __scoped_guard(_name, _label, args...)                                \
++      for (CLASS(_name, scope)(args);                                 \
++           __guard_ptr(_name)(&scope) || !__is_cond_ptr(_name);       \
++           ({ goto _label; }))                                        \
++              if (0) {                                                \
++_label:                                                                       \
++                      break;                                          \
++              } else
++
++#define scoped_guard(_name, args...)  \
++      __scoped_guard(_name, __UNIQUE_ID(label), args)
++
++#define __scoped_cond_guard(_name, _fail, _label, args...)            \
++      for (CLASS(_name, scope)(args); true; ({ goto _label; }))       \
++              if (!__guard_ptr(_name)(&scope)) {                      \
++                      BUILD_BUG_ON(!__is_cond_ptr(_name));            \
++                      _fail;                                          \
++_label:                                                                       \
++                      break;                                          \
++              } else
++
++#define scoped_cond_guard(_name, _fail, args...)      \
++      __scoped_cond_guard(_name, _fail, __UNIQUE_ID(label), args)
+ /*
+  * Additional helper macros for generating lock guards with types, either for
+  * locks that don't have a native type (eg. RCU, preempt) or those that need a
+@@ -369,14 +398,17 @@ static inline class_##_name##_t class_##_name##_constructor(void)        \
+ }
+ #define DEFINE_LOCK_GUARD_1(_name, _type, _lock, _unlock, ...)                \
++__DEFINE_CLASS_IS_CONDITIONAL(_name, false);                          \
+ __DEFINE_UNLOCK_GUARD(_name, _type, _unlock, __VA_ARGS__)             \
+ __DEFINE_LOCK_GUARD_1(_name, _type, _lock)
+ #define DEFINE_LOCK_GUARD_0(_name, _lock, _unlock, ...)                       \
++__DEFINE_CLASS_IS_CONDITIONAL(_name, false);                          \
+ __DEFINE_UNLOCK_GUARD(_name, void, _unlock, __VA_ARGS__)              \
+ __DEFINE_LOCK_GUARD_0(_name, _lock)
+ #define DEFINE_LOCK_GUARD_1_COND(_name, _ext, _condlock)              \
++      __DEFINE_CLASS_IS_CONDITIONAL(_name##_ext, true);               \
+       EXTEND_CLASS(_name, _ext,                                       \
+                    ({ class_##_name##_t _t = { .lock = l }, *_T = &_t;\
+                       if (_T->lock && !(_condlock)) _T->lock = NULL;  \
+-- 
+2.43.0
+
diff --git a/queue-6.12/clk-qcom-clk-alpha-pll-add-nss-huayra-alpha-pll-supp.patch b/queue-6.12/clk-qcom-clk-alpha-pll-add-nss-huayra-alpha-pll-supp.patch
new file mode 100644 (file)
index 0000000..26ef4d4
--- /dev/null
@@ -0,0 +1,61 @@
+From 6ba2107e155bd59995e0a270781a526f10a223f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2024 11:35:01 +0530
+Subject: clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for
+ ipq9574
+
+From: Devi Priya <quic_devipriy@quicinc.com>
+
+[ Upstream commit 79dfed29aa3f714e0a94a39b2bfe9ac14ce19a6a ]
+
+Add support for NSS Huayra alpha pll found on ipq9574 SoCs.
+Programming sequence is the same as that of Huayra type Alpha PLL,
+so we can re-use the same.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Devi Priya <quic_devipriy@quicinc.com>
+Link: https://lore.kernel.org/r/20241028060506.246606-2-quic_srichara@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c | 11 +++++++++++
+ drivers/clk/qcom/clk-alpha-pll.h |  1 +
+ 2 files changed, 12 insertions(+)
+
+diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c
+index be9bee6ab65f6..49687512184b9 100644
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -267,6 +267,17 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = {
+               [PLL_OFF_OPMODE] = 0x30,
+               [PLL_OFF_STATUS] = 0x3c,
+       },
++      [CLK_ALPHA_PLL_TYPE_NSS_HUAYRA] =  {
++              [PLL_OFF_L_VAL] = 0x04,
++              [PLL_OFF_ALPHA_VAL] = 0x08,
++              [PLL_OFF_TEST_CTL] = 0x0c,
++              [PLL_OFF_TEST_CTL_U] = 0x10,
++              [PLL_OFF_USER_CTL] = 0x14,
++              [PLL_OFF_CONFIG_CTL] = 0x18,
++              [PLL_OFF_CONFIG_CTL_U] = 0x1c,
++              [PLL_OFF_STATUS] = 0x20,
++      },
++
+ };
+ EXPORT_SYMBOL_GPL(clk_alpha_pll_regs);
+diff --git a/drivers/clk/qcom/clk-alpha-pll.h b/drivers/clk/qcom/clk-alpha-pll.h
+index 55eca04b23a1f..c6d1b8429f951 100644
+--- a/drivers/clk/qcom/clk-alpha-pll.h
++++ b/drivers/clk/qcom/clk-alpha-pll.h
+@@ -32,6 +32,7 @@ enum {
+       CLK_ALPHA_PLL_TYPE_BRAMMO_EVO,
+       CLK_ALPHA_PLL_TYPE_STROMER,
+       CLK_ALPHA_PLL_TYPE_STROMER_PLUS,
++      CLK_ALPHA_PLL_TYPE_NSS_HUAYRA,
+       CLK_ALPHA_PLL_TYPE_MAX,
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.12/clk-qcom-dispcc-sm8550-enable-support-for-sar2130p.patch b/queue-6.12/clk-qcom-dispcc-sm8550-enable-support-for-sar2130p.patch
new file mode 100644 (file)
index 0000000..11569bd
--- /dev/null
@@ -0,0 +1,101 @@
+From 9901b0c8bbaf1e46121c0c77fce075fee8a17c9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 03:24:49 +0200
+Subject: clk: qcom: dispcc-sm8550: enable support for SAR2130P
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 1335c7eb7012f23dc073b8ae4ffcfc1f6e69cfb3 ]
+
+The display clock controller on SAR2130P is very close to the clock
+controller on SM8550 (and SM8650). Reuse existing driver to add support
+for the controller on SAR2130P.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241027-sar2130p-clocks-v5-10-ecad2a1432ba@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/Kconfig         |  4 ++--
+ drivers/clk/qcom/dispcc-sm8550.c | 18 ++++++++++++++++--
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
+index 4444dafa4e3df..9ba675f229b14 100644
+--- a/drivers/clk/qcom/Kconfig
++++ b/drivers/clk/qcom/Kconfig
+@@ -959,10 +959,10 @@ config SM_DISPCC_8450
+ config SM_DISPCC_8550
+       tristate "SM8550 Display Clock Controller"
+       depends on ARM64 || COMPILE_TEST
+-      depends on SM_GCC_8550 || SM_GCC_8650
++      depends on SM_GCC_8550 || SM_GCC_8650 || SAR_GCC_2130P
+       help
+         Support for the display clock controller on Qualcomm Technologies, Inc
+-        SM8550 or SM8650 devices.
++        SAR2130P, SM8550 or SM8650 devices.
+         Say Y if you want to support display devices and functionality such as
+         splash screen.
+diff --git a/drivers/clk/qcom/dispcc-sm8550.c b/drivers/clk/qcom/dispcc-sm8550.c
+index 7f9021ca0ecb0..e41d4104d7702 100644
+--- a/drivers/clk/qcom/dispcc-sm8550.c
++++ b/drivers/clk/qcom/dispcc-sm8550.c
+@@ -75,7 +75,7 @@ static struct pll_vco lucid_ole_vco[] = {
+       { 249600000, 2000000000, 0 },
+ };
+-static const struct alpha_pll_config disp_cc_pll0_config = {
++static struct alpha_pll_config disp_cc_pll0_config = {
+       .l = 0xd,
+       .alpha = 0x6492,
+       .config_ctl_val = 0x20485699,
+@@ -106,7 +106,7 @@ static struct clk_alpha_pll disp_cc_pll0 = {
+       },
+ };
+-static const struct alpha_pll_config disp_cc_pll1_config = {
++static struct alpha_pll_config disp_cc_pll1_config = {
+       .l = 0x1f,
+       .alpha = 0x4000,
+       .config_ctl_val = 0x20485699,
+@@ -594,6 +594,13 @@ static const struct freq_tbl ftbl_disp_cc_mdss_mdp_clk_src[] = {
+       { }
+ };
++static const struct freq_tbl ftbl_disp_cc_mdss_mdp_clk_src_sar2130p[] = {
++      F(200000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
++      F(325000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
++      F(514000000, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
++      { }
++};
++
+ static const struct freq_tbl ftbl_disp_cc_mdss_mdp_clk_src_sm8650[] = {
+       F(19200000, P_BI_TCXO, 1, 0, 0),
+       F(85714286, P_DISP_CC_PLL0_OUT_MAIN, 3, 0, 0),
+@@ -1750,6 +1757,7 @@ static struct qcom_cc_desc disp_cc_sm8550_desc = {
+ };
+ static const struct of_device_id disp_cc_sm8550_match_table[] = {
++      { .compatible = "qcom,sar2130p-dispcc" },
+       { .compatible = "qcom,sm8550-dispcc" },
+       { .compatible = "qcom,sm8650-dispcc" },
+       { }
+@@ -1780,6 +1788,12 @@ static int disp_cc_sm8550_probe(struct platform_device *pdev)
+               disp_cc_mdss_mdp_clk_src.freq_tbl = ftbl_disp_cc_mdss_mdp_clk_src_sm8650;
+               disp_cc_mdss_dptx1_usb_router_link_intf_clk.clkr.hw.init->parent_hws[0] =
+                       &disp_cc_mdss_dptx1_link_div_clk_src.clkr.hw;
++      } else if (of_device_is_compatible(pdev->dev.of_node, "qcom,sar2130p-dispcc")) {
++              disp_cc_pll0_config.l = 0x1f;
++              disp_cc_pll0_config.alpha = 0x4000;
++              disp_cc_pll0_config.user_ctl_val = 0x1;
++              disp_cc_pll1_config.user_ctl_val = 0x1;
++              disp_cc_mdss_mdp_clk_src.freq_tbl = ftbl_disp_cc_mdss_mdp_clk_src_sar2130p;
+       }
+       clk_lucid_ole_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
+-- 
+2.43.0
+
diff --git a/queue-6.12/clk-qcom-rcg2-add-clk_rcg2_shared_floor_ops.patch b/queue-6.12/clk-qcom-rcg2-add-clk_rcg2_shared_floor_ops.patch
new file mode 100644 (file)
index 0000000..be46745
--- /dev/null
@@ -0,0 +1,119 @@
+From 57f04dd9c2a9e5631ecfb740137c9a743dc96536 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 03:24:45 +0200
+Subject: clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit aec8c0e28ce4a1f89fd82fcc06a5cc73147e9817 ]
+
+Generally SDCC clocks use clk_rcg2_floor_ops, however on SAR2130P
+platform it's recommended to use rcg2_shared_ops for all Root Clock
+Generators to park them instead of disabling. Implement a mix of those,
+clk_rcg2_shared_floor_ops.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241027-sar2130p-clocks-v5-6-ecad2a1432ba@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg.h  |  1 +
+ drivers/clk/qcom/clk-rcg2.c | 48 +++++++++++++++++++++++++++++++++----
+ 2 files changed, 44 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/qcom/clk-rcg.h b/drivers/clk/qcom/clk-rcg.h
+index 8e0f3372dc7a8..80f1f4fcd52a6 100644
+--- a/drivers/clk/qcom/clk-rcg.h
++++ b/drivers/clk/qcom/clk-rcg.h
+@@ -198,6 +198,7 @@ extern const struct clk_ops clk_byte2_ops;
+ extern const struct clk_ops clk_pixel_ops;
+ extern const struct clk_ops clk_gfx3d_ops;
+ extern const struct clk_ops clk_rcg2_shared_ops;
++extern const struct clk_ops clk_rcg2_shared_floor_ops;
+ extern const struct clk_ops clk_rcg2_shared_no_init_park_ops;
+ extern const struct clk_ops clk_dp_ops;
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index bf26c5448f006..bf6406f5279a4 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -1186,15 +1186,23 @@ clk_rcg2_shared_force_enable_clear(struct clk_hw *hw, const struct freq_tbl *f)
+       return clk_rcg2_clear_force_enable(hw);
+ }
+-static int clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
+-                                  unsigned long parent_rate)
++static int __clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
++                                    unsigned long parent_rate,
++                                    enum freq_policy policy)
+ {
+       struct clk_rcg2 *rcg = to_clk_rcg2(hw);
+       const struct freq_tbl *f;
+-      f = qcom_find_freq(rcg->freq_tbl, rate);
+-      if (!f)
++      switch (policy) {
++      case FLOOR:
++              f = qcom_find_freq_floor(rcg->freq_tbl, rate);
++              break;
++      case CEIL:
++              f = qcom_find_freq(rcg->freq_tbl, rate);
++              break;
++      default:
+               return -EINVAL;
++      }
+       /*
+        * In case clock is disabled, update the M, N and D registers, cache
+@@ -1207,10 +1215,28 @@ static int clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
+       return clk_rcg2_shared_force_enable_clear(hw, f);
+ }
++static int clk_rcg2_shared_set_rate(struct clk_hw *hw, unsigned long rate,
++                                  unsigned long parent_rate)
++{
++      return __clk_rcg2_shared_set_rate(hw, rate, parent_rate, CEIL);
++}
++
+ static int clk_rcg2_shared_set_rate_and_parent(struct clk_hw *hw,
+               unsigned long rate, unsigned long parent_rate, u8 index)
+ {
+-      return clk_rcg2_shared_set_rate(hw, rate, parent_rate);
++      return __clk_rcg2_shared_set_rate(hw, rate, parent_rate, CEIL);
++}
++
++static int clk_rcg2_shared_set_floor_rate(struct clk_hw *hw, unsigned long rate,
++                                        unsigned long parent_rate)
++{
++      return __clk_rcg2_shared_set_rate(hw, rate, parent_rate, FLOOR);
++}
++
++static int clk_rcg2_shared_set_floor_rate_and_parent(struct clk_hw *hw,
++              unsigned long rate, unsigned long parent_rate, u8 index)
++{
++      return __clk_rcg2_shared_set_rate(hw, rate, parent_rate, FLOOR);
+ }
+ static int clk_rcg2_shared_enable(struct clk_hw *hw)
+@@ -1348,6 +1374,18 @@ const struct clk_ops clk_rcg2_shared_ops = {
+ };
+ EXPORT_SYMBOL_GPL(clk_rcg2_shared_ops);
++const struct clk_ops clk_rcg2_shared_floor_ops = {
++      .enable = clk_rcg2_shared_enable,
++      .disable = clk_rcg2_shared_disable,
++      .get_parent = clk_rcg2_shared_get_parent,
++      .set_parent = clk_rcg2_shared_set_parent,
++      .recalc_rate = clk_rcg2_shared_recalc_rate,
++      .determine_rate = clk_rcg2_determine_floor_rate,
++      .set_rate = clk_rcg2_shared_set_floor_rate,
++      .set_rate_and_parent = clk_rcg2_shared_set_floor_rate_and_parent,
++};
++EXPORT_SYMBOL_GPL(clk_rcg2_shared_floor_ops);
++
+ static int clk_rcg2_shared_no_init_park(struct clk_hw *hw)
+ {
+       struct clk_rcg2 *rcg = to_clk_rcg2(hw);
+-- 
+2.43.0
+
diff --git a/queue-6.12/clk-qcom-rpmh-add-support-for-sar2130p.patch b/queue-6.12/clk-qcom-rpmh-add-support-for-sar2130p.patch
new file mode 100644 (file)
index 0000000..47170b4
--- /dev/null
@@ -0,0 +1,56 @@
+From 23077f4610de731790df221249d03082aa4f1909 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 03:24:46 +0200
+Subject: clk: qcom: rpmh: add support for SAR2130P
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 2cc88de6261f01ebd4e2a3b4e29681fe87d0c089 ]
+
+Define clocks as supported by the RPMh on the SAR2130P platform. The
+msm-5.10 kernel declares just the CXO clock, the RF_CLK1 clock was added
+following recommendation from Taniya Das.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Taniya Das <quic_tdas@quicinc.com>
+Link: https://lore.kernel.org/r/20241027-sar2130p-clocks-v5-7-ecad2a1432ba@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rpmh.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/clk/qcom/clk-rpmh.c b/drivers/clk/qcom/clk-rpmh.c
+index 4acde937114af..eefc322ce3679 100644
+--- a/drivers/clk/qcom/clk-rpmh.c
++++ b/drivers/clk/qcom/clk-rpmh.c
+@@ -389,6 +389,18 @@ DEFINE_CLK_RPMH_BCM(ipa, "IP0");
+ DEFINE_CLK_RPMH_BCM(pka, "PKA0");
+ DEFINE_CLK_RPMH_BCM(qpic_clk, "QP0");
++static struct clk_hw *sar2130p_rpmh_clocks[] = {
++      [RPMH_CXO_CLK]          = &clk_rpmh_bi_tcxo_div1.hw,
++      [RPMH_CXO_CLK_A]        = &clk_rpmh_bi_tcxo_div1_ao.hw,
++      [RPMH_RF_CLK1]          = &clk_rpmh_rf_clk1_a.hw,
++      [RPMH_RF_CLK1_A]        = &clk_rpmh_rf_clk1_a_ao.hw,
++};
++
++static const struct clk_rpmh_desc clk_rpmh_sar2130p = {
++      .clks = sar2130p_rpmh_clocks,
++      .num_clks = ARRAY_SIZE(sar2130p_rpmh_clocks),
++};
++
+ static struct clk_hw *sdm845_rpmh_clocks[] = {
+       [RPMH_CXO_CLK]          = &clk_rpmh_bi_tcxo_div2.hw,
+       [RPMH_CXO_CLK_A]        = &clk_rpmh_bi_tcxo_div2_ao.hw,
+@@ -880,6 +892,7 @@ static int clk_rpmh_probe(struct platform_device *pdev)
+ static const struct of_device_id clk_rpmh_match_table[] = {
+       { .compatible = "qcom,qdu1000-rpmh-clk", .data = &clk_rpmh_qdu1000},
+       { .compatible = "qcom,sa8775p-rpmh-clk", .data = &clk_rpmh_sa8775p},
++      { .compatible = "qcom,sar2130p-rpmh-clk", .data = &clk_rpmh_sar2130p},
+       { .compatible = "qcom,sc7180-rpmh-clk", .data = &clk_rpmh_sc7180},
+       { .compatible = "qcom,sc8180x-rpmh-clk", .data = &clk_rpmh_sc8180x},
+       { .compatible = "qcom,sc8280xp-rpmh-clk", .data = &clk_rpmh_sc8280xp},
+-- 
+2.43.0
+
diff --git a/queue-6.12/clk-qcom-tcsrcc-sm8550-add-sar2130p-support.patch b/queue-6.12/clk-qcom-tcsrcc-sm8550-add-sar2130p-support.patch
new file mode 100644 (file)
index 0000000..939ffc5
--- /dev/null
@@ -0,0 +1,75 @@
+From 11aea245f57e175418fbaee12c16210f4f201784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 03:24:48 +0200
+Subject: clk: qcom: tcsrcc-sm8550: add SAR2130P support
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit d2e0a043530b9d6f37a8de8f05e0725667aba0a6 ]
+
+The SAR2130P platform has the same TCSR Clock Controller as the SM8550,
+except for the lack of the UFS clocks. Extend the SM8550 TCSRCC driver
+to support SAR2130P.
+
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241027-sar2130p-clocks-v5-9-ecad2a1432ba@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/tcsrcc-sm8550.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/tcsrcc-sm8550.c b/drivers/clk/qcom/tcsrcc-sm8550.c
+index e5e8f2e82b949..41d73f92a000a 100644
+--- a/drivers/clk/qcom/tcsrcc-sm8550.c
++++ b/drivers/clk/qcom/tcsrcc-sm8550.c
+@@ -129,6 +129,13 @@ static struct clk_branch tcsr_usb3_clkref_en = {
+       },
+ };
++static struct clk_regmap *tcsr_cc_sar2130p_clocks[] = {
++      [TCSR_PCIE_0_CLKREF_EN] = &tcsr_pcie_0_clkref_en.clkr,
++      [TCSR_PCIE_1_CLKREF_EN] = &tcsr_pcie_1_clkref_en.clkr,
++      [TCSR_USB2_CLKREF_EN] = &tcsr_usb2_clkref_en.clkr,
++      [TCSR_USB3_CLKREF_EN] = &tcsr_usb3_clkref_en.clkr,
++};
++
+ static struct clk_regmap *tcsr_cc_sm8550_clocks[] = {
+       [TCSR_PCIE_0_CLKREF_EN] = &tcsr_pcie_0_clkref_en.clkr,
+       [TCSR_PCIE_1_CLKREF_EN] = &tcsr_pcie_1_clkref_en.clkr,
+@@ -146,6 +153,12 @@ static const struct regmap_config tcsr_cc_sm8550_regmap_config = {
+       .fast_io = true,
+ };
++static const struct qcom_cc_desc tcsr_cc_sar2130p_desc = {
++      .config = &tcsr_cc_sm8550_regmap_config,
++      .clks = tcsr_cc_sar2130p_clocks,
++      .num_clks = ARRAY_SIZE(tcsr_cc_sar2130p_clocks),
++};
++
+ static const struct qcom_cc_desc tcsr_cc_sm8550_desc = {
+       .config = &tcsr_cc_sm8550_regmap_config,
+       .clks = tcsr_cc_sm8550_clocks,
+@@ -153,7 +166,8 @@ static const struct qcom_cc_desc tcsr_cc_sm8550_desc = {
+ };
+ static const struct of_device_id tcsr_cc_sm8550_match_table[] = {
+-      { .compatible = "qcom,sm8550-tcsr" },
++      { .compatible = "qcom,sar2130p-tcsr", .data = &tcsr_cc_sar2130p_desc },
++      { .compatible = "qcom,sm8550-tcsr", .data = &tcsr_cc_sm8550_desc },
+       { }
+ };
+ MODULE_DEVICE_TABLE(of, tcsr_cc_sm8550_match_table);
+@@ -162,7 +176,7 @@ static int tcsr_cc_sm8550_probe(struct platform_device *pdev)
+ {
+       struct regmap *regmap;
+-      regmap = qcom_cc_map(pdev, &tcsr_cc_sm8550_desc);
++      regmap = qcom_cc_map(pdev, of_device_get_match_data(&pdev->dev));
+       if (IS_ERR(regmap))
+               return PTR_ERR(regmap);
+-- 
+2.43.0
+
diff --git a/queue-6.12/crypto-ecdsa-avoid-signed-integer-overflow-on-signat.patch b/queue-6.12/crypto-ecdsa-avoid-signed-integer-overflow-on-signat.patch
new file mode 100644 (file)
index 0000000..23d6e04
--- /dev/null
@@ -0,0 +1,82 @@
+From 88c1a05ff7c5d9946b57699a3cd9b0acb4c14255 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 16:30:24 +0200
+Subject: crypto: ecdsa - Avoid signed integer overflow on signature decoding
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 3b0565c703503f832d6cd7ba805aafa3b330cb9d ]
+
+When extracting a signature component r or s from an ASN.1-encoded
+integer, ecdsa_get_signature_rs() subtracts the expected length
+"bufsize" from the ASN.1 length "vlen" (both of unsigned type size_t)
+and stores the result in "diff" (of signed type ssize_t).
+
+This results in a signed integer overflow if vlen > SSIZE_MAX + bufsize.
+
+The kernel is compiled with -fno-strict-overflow, which implies -fwrapv,
+meaning signed integer overflow is not undefined behavior.  And the
+function does check for overflow:
+
+       if (-diff >= bufsize)
+               return -EINVAL;
+
+So the code is fine in principle but not very obvious.  In the future it
+might trigger a false-positive with CONFIG_UBSAN_SIGNED_WRAP=y.
+
+Avoid by comparing the two unsigned variables directly and erroring out
+if "vlen" is too large.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/ecdsa.c | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+diff --git a/crypto/ecdsa.c b/crypto/ecdsa.c
+index d5a10959ec281..80ef16ae6a40b 100644
+--- a/crypto/ecdsa.c
++++ b/crypto/ecdsa.c
+@@ -36,29 +36,24 @@ static int ecdsa_get_signature_rs(u64 *dest, size_t hdrlen, unsigned char tag,
+                                 const void *value, size_t vlen, unsigned int ndigits)
+ {
+       size_t bufsize = ndigits * sizeof(u64);
+-      ssize_t diff = vlen - bufsize;
+       const char *d = value;
+-      if (!value || !vlen)
++      if (!value || !vlen || vlen > bufsize + 1)
+               return -EINVAL;
+-      /* diff = 0: 'value' has exacly the right size
+-       * diff > 0: 'value' has too many bytes; one leading zero is allowed that
+-       *           makes the value a positive integer; error on more
+-       * diff < 0: 'value' is missing leading zeros
++      /*
++       * vlen may be 1 byte larger than bufsize due to a leading zero byte
++       * (necessary if the most significant bit of the integer is set).
+        */
+-      if (diff > 0) {
++      if (vlen > bufsize) {
+               /* skip over leading zeros that make 'value' a positive int */
+               if (*d == 0) {
+                       vlen -= 1;
+-                      diff--;
+                       d++;
+-              }
+-              if (diff)
++              } else {
+                       return -EINVAL;
++              }
+       }
+-      if (-diff >= bufsize)
+-              return -EINVAL;
+       ecc_digits_from_bytes(d, vlen, dest, ndigits);
+-- 
+2.43.0
+
diff --git a/queue-6.12/dlm-fix-possible-lkb_resource-null-dereference.patch b/queue-6.12/dlm-fix-possible-lkb_resource-null-dereference.patch
new file mode 100644 (file)
index 0000000..1ff5be8
--- /dev/null
@@ -0,0 +1,61 @@
+From eaa0939e6be3ea39d6e12a4caa5f2bfc2ac5d240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 11:13:38 -0400
+Subject: dlm: fix possible lkb_resource null dereference
+
+From: Alexander Aring <aahringo@redhat.com>
+
+[ Upstream commit b98333c67daf887c724cd692e88e2db9418c0861 ]
+
+This patch fixes a possible null pointer dereference when this function is
+called from request_lock() as lkb->lkb_resource is not assigned yet,
+only after validate_lock_args() by calling attach_lkb(). Another issue
+is that a resource name could be a non printable bytearray and we cannot
+assume to be ASCII coded.
+
+The log functionality is probably never being hit when DLM is used in
+normal way and no debug logging is enabled. The null pointer dereference
+can only occur on a new created lkb that does not have the resource
+assigned yet, it probably never hits the null pointer dereference but we
+should be sure that other changes might not change this behaviour and we
+actually can hit the mentioned null pointer dereference.
+
+In this patch we just drop the printout of the resource name, the lkb id
+is enough to make a possible connection to a resource name if this
+exists.
+
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lock.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index 865dc70a9dfc4..dddedaef5e93d 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -2861,16 +2861,14 @@ static int validate_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb,
+       case -EINVAL:
+               /* annoy the user because dlm usage is wrong */
+               WARN_ON(1);
+-              log_error(ls, "%s %d %x %x %x %d %d %s", __func__,
++              log_error(ls, "%s %d %x %x %x %d %d", __func__,
+                         rv, lkb->lkb_id, dlm_iflags_val(lkb), args->flags,
+-                        lkb->lkb_status, lkb->lkb_wait_type,
+-                        lkb->lkb_resource->res_name);
++                        lkb->lkb_status, lkb->lkb_wait_type);
+               break;
+       default:
+-              log_debug(ls, "%s %d %x %x %x %d %d %s", __func__,
++              log_debug(ls, "%s %d %x %x %x %d %d", __func__,
+                         rv, lkb->lkb_id, dlm_iflags_val(lkb), args->flags,
+-                        lkb->lkb_status, lkb->lkb_wait_type,
+-                        lkb->lkb_resource->res_name);
++                        lkb->lkb_status, lkb->lkb_wait_type);
+               break;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/dma-debug-fix-a-possible-deadlock-on-radix_lock.patch b/queue-6.12/dma-debug-fix-a-possible-deadlock-on-radix_lock.patch
new file mode 100644 (file)
index 0000000..97563da
--- /dev/null
@@ -0,0 +1,68 @@
+From 77b0e78624f491e470a486f4eb30ef84751ba2d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 11:06:00 +0100
+Subject: dma-debug: fix a possible deadlock on radix_lock
+
+From: Levi Yun <yeoreum.yun@arm.com>
+
+[ Upstream commit 7543c3e3b9b88212fcd0aaf5cab5588797bdc7de ]
+
+radix_lock() shouldn't be held while holding dma_hash_entry[idx].lock
+otherwise, there's a possible deadlock scenario when
+dma debug API is called holding rq_lock():
+
+CPU0                   CPU1                       CPU2
+dma_free_attrs()
+check_unmap()          add_dma_entry()            __schedule() //out
+                                                  (A) rq_lock()
+get_hash_bucket()
+(A) dma_entry_hash
+                                                  check_sync()
+                       (A) radix_lock()           (W) dma_entry_hash
+dma_entry_free()
+(W) radix_lock()
+                       // CPU2's one
+                       (W) rq_lock()
+
+CPU1 situation can happen when it extending radix tree and
+it tries to wake up kswapd via wake_all_kswapd().
+
+CPU2 situation can happen while perf_event_task_sched_out()
+(i.e. dma sync operation is called while deleting perf_event using
+ etm and etr tmc which are Arm Coresight hwtracing driver backends).
+
+To remove this possible situation, call dma_entry_free() after
+put_hash_bucket() in check_unmap().
+
+Reported-by: Denis Nikitin <denik@chromium.org>
+Closes: https://lists.linaro.org/archives/list/coresight@lists.linaro.org/thread/2WMS7BBSF5OZYB63VT44U5YWLFP5HL6U/#RWM6MLQX5ANBTEQ2PRM7OXCBGCE6NPWU
+Signed-off-by: Levi Yun <yeoreum.yun@arm.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/debug.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index d570535342cb7..f6f0387761d05 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -1052,9 +1052,13 @@ static void check_unmap(struct dma_debug_entry *ref)
+       }
+       hash_bucket_del(entry);
+-      dma_entry_free(entry);
+-
+       put_hash_bucket(bucket, flags);
++
++      /*
++       * Free the entry outside of bucket_lock to avoid ABBA deadlocks
++       * between that and radix_lock.
++       */
++      dma_entry_free(entry);
+ }
+ static void check_for_stack(struct device *dev,
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-adding-array-index-check-to-prevent-.patch b/queue-6.12/drm-amd-display-adding-array-index-check-to-prevent-.patch
new file mode 100644 (file)
index 0000000..70de431
--- /dev/null
@@ -0,0 +1,55 @@
+From 03279babfd5522e8e508365c9925e941856c8de7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 15:50:35 -0400
+Subject: drm/amd/display: Adding array index check to prevent memory
+ corruption
+
+From: Leo Chen <leo.chen@amd.com>
+
+[ Upstream commit 2c437d9a0b496168e1a1defd17b531f0a526dbe9 ]
+
+[Why & How]
+Array indices out of bound caused memory corruption. Adding checks to
+ensure that array index stays in bound.
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Leo Chen <leo.chen@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c    | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+index b46a3afe48ca7..7d68006137a97 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+@@ -257,11 +257,11 @@ static void dcn35_notify_host_router_bw(struct clk_mgr *clk_mgr_base, struct dc_
+       struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
+       uint32_t host_router_bw_kbps[MAX_HOST_ROUTERS_NUM] = { 0 };
+       int i;
+-
+       for (i = 0; i < context->stream_count; ++i) {
+               const struct dc_stream_state *stream = context->streams[i];
+               const struct dc_link *link = stream->link;
+-              uint8_t lowest_dpia_index = 0, hr_index = 0;
++              uint8_t lowest_dpia_index = 0;
++              unsigned int hr_index = 0;
+               if (!link)
+                       continue;
+@@ -271,6 +271,8 @@ static void dcn35_notify_host_router_bw(struct clk_mgr *clk_mgr_base, struct dc_
+                       continue;
+               hr_index = (link->link_index - lowest_dpia_index) / 2;
++              if (hr_index >= MAX_HOST_ROUTERS_NUM)
++                      continue;
+               host_router_bw_kbps[hr_index] += dc_bandwidth_in_kbps_from_timing(
+                       &stream->timing, dc_link_get_highest_encoding_format(link));
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-disable-sg-displays-on-cyan-skillfis.patch b/queue-6.12/drm-amd-display-disable-sg-displays-on-cyan-skillfis.patch
new file mode 100644 (file)
index 0000000..c58efd0
--- /dev/null
@@ -0,0 +1,45 @@
+From 99f5423bce5352de558129c642470c663a7e42c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 09:34:24 -0400
+Subject: drm/amd/display: disable SG displays on cyan skillfish
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 66369db7fdd7d58d78673bf83d2b87ea623efb63 ]
+
+These parts were mainly for compute workloads, but they have
+a display that was available for the console.  These chips
+should support SG display, but I don't know that the support
+was ever validated on Linux so disable it by default. It can
+still be enabled by setting sg_display=1 for those that
+want to play with it.  These systems also generally had large
+carve outs so SG display was less of a factor.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3356
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 24fbde7dd1c42..8c3db8346f300 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1910,7 +1910,11 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
+               else
+                       init_data.flags.gpu_vm_support = (amdgpu_sg_display != 0);
+       } else {
+-              init_data.flags.gpu_vm_support = (amdgpu_sg_display != 0) && (adev->flags & AMD_IS_APU);
++              if (amdgpu_ip_version(adev, DCE_HWIP, 0) == IP_VERSION(2, 0, 3))
++                      init_data.flags.gpu_vm_support = (amdgpu_sg_display == 1);
++              else
++                      init_data.flags.gpu_vm_support =
++                              (amdgpu_sg_display != 0) && (adev->flags & AMD_IS_APU);
+       }
+       adev->mode_info.gpu_vm_support = init_data.flags.gpu_vm_support;
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-fix-garbage-or-black-screen-when-res.patch b/queue-6.12/drm-amd-display-fix-garbage-or-black-screen-when-res.patch
new file mode 100644 (file)
index 0000000..bb34238
--- /dev/null
@@ -0,0 +1,96 @@
+From 16c94b40424373cefe4f912c0cf051e78d722126 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2024 14:43:49 +0800
+Subject: drm/amd/display: Fix garbage or black screen when resetting otg
+
+From: Zhongwei <Zhongwei.Zhang@amd.com>
+
+[ Upstream commit ffa1e31f70d2e97c121709b44a8960f5d7becb10 ]
+
+[Why]
+For some EDP to MIPI panel, disabling OTG when link is alive like boot
+case, the converter might output garbage or show no display because our
+GPU is not sending required pixel data.
+Alos Dig fifo underflow was found which might cause garbage, when
+resetting otg for other types of EDP panels.
+
+[How]
+Skipping resetting OTG if the dig fifo is on. Make sure that the otg for
+the pipe is the one that the dig fifo is selecting via the FE mask.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Zhongwei <Zhongwei.Zhang@amd.com>
+Signed-off-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dc/dio/dcn314/dcn314_dio_stream_encoder.c    | 10 ++++++++++
+ .../amd/display/dc/hwss/dcn314/dcn314_hwseq.c    | 16 ++++++++++++++++
+ 2 files changed, 26 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dio/dcn314/dcn314_dio_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dio/dcn314/dcn314_dio_stream_encoder.c
+index 5b343f745cf33..ae81451a3a725 100644
+--- a/drivers/gpu/drm/amd/display/dc/dio/dcn314/dcn314_dio_stream_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dio/dcn314/dcn314_dio_stream_encoder.c
+@@ -83,6 +83,15 @@ void enc314_disable_fifo(struct stream_encoder *enc)
+       REG_UPDATE(DIG_FIFO_CTRL0, DIG_FIFO_ENABLE, 0);
+ }
++static bool enc314_is_fifo_enabled(struct stream_encoder *enc)
++{
++      struct dcn10_stream_encoder *enc1 = DCN10STRENC_FROM_STRENC(enc);
++      uint32_t reset_val;
++
++      REG_GET(DIG_FIFO_CTRL0, DIG_FIFO_ENABLE, &reset_val);
++      return (reset_val != 0);
++}
++
+ void enc314_dp_set_odm_combine(
+       struct stream_encoder *enc,
+       bool odm_combine)
+@@ -468,6 +477,7 @@ static const struct stream_encoder_funcs dcn314_str_enc_funcs = {
+       .enable_fifo = enc314_enable_fifo,
+       .disable_fifo = enc314_disable_fifo,
++      .is_fifo_enabled = enc314_is_fifo_enabled,
+       .set_input_mode = enc314_set_dig_input_mode,
+ };
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
+index a8e04a39a19e5..efcc1a6b364c2 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
+@@ -355,6 +355,20 @@ void dcn314_calculate_pix_rate_divider(
+       }
+ }
++static bool dcn314_is_pipe_dig_fifo_on(struct pipe_ctx *pipe)
++{
++      return pipe && pipe->stream
++              // Check dig's otg instance.
++              && pipe->stream_res.stream_enc
++              && pipe->stream_res.stream_enc->funcs->dig_source_otg
++              && pipe->stream_res.tg->inst == pipe->stream_res.stream_enc->funcs->dig_source_otg(pipe->stream_res.stream_enc)
++              && pipe->stream->link && pipe->stream->link->link_enc
++              && pipe->stream->link->link_enc->funcs->is_dig_enabled
++              && pipe->stream->link->link_enc->funcs->is_dig_enabled(pipe->stream->link->link_enc)
++              && pipe->stream_res.stream_enc->funcs->is_fifo_enabled
++              && pipe->stream_res.stream_enc->funcs->is_fifo_enabled(pipe->stream_res.stream_enc);
++}
++
+ void dcn314_resync_fifo_dccg_dio(struct dce_hwseq *hws, struct dc *dc, struct dc_state *context, unsigned int current_pipe_idx)
+ {
+       unsigned int i;
+@@ -374,6 +388,8 @@ void dcn314_resync_fifo_dccg_dio(struct dce_hwseq *hws, struct dc *dc, struct dc
+               if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal)) &&
+                       !pipe->stream->apply_seamless_boot_optimization &&
+                       !pipe->stream->apply_edp_fast_boot_optimization) {
++                      if (dcn314_is_pipe_dig_fifo_on(pipe))
++                              continue;
+                       pipe->stream_res.tg->funcs->disable_crtc(pipe->stream_res.tg);
+                       reset_sync_context_for_pipe(dc, context, i);
+                       otg_disabled[i] = true;
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-fix-out-of-bounds-access-in-dcn21_li.patch b/queue-6.12/drm-amd-display-fix-out-of-bounds-access-in-dcn21_li.patch
new file mode 100644 (file)
index 0000000..af1bd6f
--- /dev/null
@@ -0,0 +1,111 @@
+From 39ef80f48fc805253d928d9c115b23957d4681f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2024 20:04:15 +0530
+Subject: drm/amd/display: Fix out-of-bounds access in
+ 'dcn21_link_encoder_create'
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 63de35a8fcfca59ae8750d469a7eb220c7557baf ]
+
+An issue was identified in the dcn21_link_encoder_create function where
+an out-of-bounds access could occur when the hpd_source index was used
+to reference the link_enc_hpd_regs array. This array has a fixed size
+and the index was not being checked against the array's bounds before
+accessing it.
+
+This fix adds a conditional check to ensure that the hpd_source index is
+within the valid range of the link_enc_hpd_regs array. If the index is
+out of bounds, the function now returns NULL to prevent undefined
+behavior.
+
+References:
+
+[   65.920507] ------------[ cut here ]------------
+[   65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29
+[   65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]'
+[   65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G           OE      6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13
+[   65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020
+[   65.920527] Call Trace:
+[   65.920529]  <TASK>
+[   65.920532]  dump_stack_lvl+0x48/0x70
+[   65.920541]  dump_stack+0x10/0x20
+[   65.920543]  __ubsan_handle_out_of_bounds+0xa2/0xe0
+[   65.920549]  dcn21_link_encoder_create+0xd9/0x140 [amdgpu]
+[   65.921009]  link_create+0x6d3/0xed0 [amdgpu]
+[   65.921355]  create_links+0x18a/0x4e0 [amdgpu]
+[   65.921679]  dc_create+0x360/0x720 [amdgpu]
+[   65.921999]  ? dmi_matches+0xa0/0x220
+[   65.922004]  amdgpu_dm_init+0x2b6/0x2c90 [amdgpu]
+[   65.922342]  ? console_unlock+0x77/0x120
+[   65.922348]  ? dev_printk_emit+0x86/0xb0
+[   65.922354]  dm_hw_init+0x15/0x40 [amdgpu]
+[   65.922686]  amdgpu_device_init+0x26a8/0x33a0 [amdgpu]
+[   65.922921]  amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu]
+[   65.923087]  amdgpu_pci_probe+0x1b7/0x630 [amdgpu]
+[   65.923087]  local_pci_probe+0x4b/0xb0
+[   65.923087]  pci_device_probe+0xc8/0x280
+[   65.923087]  really_probe+0x187/0x300
+[   65.923087]  __driver_probe_device+0x85/0x130
+[   65.923087]  driver_probe_device+0x24/0x110
+[   65.923087]  __driver_attach+0xac/0x1d0
+[   65.923087]  ? __pfx___driver_attach+0x10/0x10
+[   65.923087]  bus_for_each_dev+0x7d/0xd0
+[   65.923087]  driver_attach+0x1e/0x30
+[   65.923087]  bus_add_driver+0xf2/0x200
+[   65.923087]  driver_register+0x64/0x130
+[   65.923087]  ? __pfx_amdgpu_init+0x10/0x10 [amdgpu]
+[   65.923087]  __pci_register_driver+0x61/0x70
+[   65.923087]  amdgpu_init+0x7d/0xff0 [amdgpu]
+[   65.923087]  do_one_initcall+0x49/0x310
+[   65.923087]  ? kmalloc_trace+0x136/0x360
+[   65.923087]  do_init_module+0x6a/0x270
+[   65.923087]  load_module+0x1fce/0x23a0
+[   65.923087]  init_module_from_file+0x9c/0xe0
+[   65.923087]  ? init_module_from_file+0x9c/0xe0
+[   65.923087]  idempotent_init_module+0x179/0x230
+[   65.923087]  __x64_sys_finit_module+0x5d/0xa0
+[   65.923087]  do_syscall_64+0x76/0x120
+[   65.923087]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
+[   65.923087] RIP: 0033:0x7f2d80f1e88d
+[   65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48
+[   65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[   65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d
+[   65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f
+[   65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002
+[   65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480
+[   65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0
+[   65.923087]  </TASK>
+[   65.923927] ---[ end trace ]---
+
+Cc: Tom Chung <chiahsuan.chung@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Cc: Roman Li <roman.li@amd.com>
+Cc: Alex Hung <alex.hung@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Roman Li <roman.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c
+index 347e6aaea582f..14b28841657d2 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c
+@@ -1298,7 +1298,7 @@ static struct link_encoder *dcn21_link_encoder_create(
+               kzalloc(sizeof(struct dcn21_link_encoder), GFP_KERNEL);
+       int link_regs_id;
+-      if (!enc21)
++      if (!enc21 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
+               return NULL;
+       link_regs_id =
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-fix-underflow-when-playing-8k-video-.patch b/queue-6.12/drm-amd-display-fix-underflow-when-playing-8k-video-.patch
new file mode 100644 (file)
index 0000000..dbee58f
--- /dev/null
@@ -0,0 +1,42 @@
+From 2c8d3aa2d9b23b247831a1fd92f65abf6cae4e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2024 14:08:34 -0400
+Subject: drm/amd/display: Fix underflow when playing 8K video in full screen
+ mode
+
+From: Leo Ma <hanghong.ma@amd.com>
+
+[ Upstream commit 4007f07a47de4a277f4760cac3aed1b31d973eea ]
+
+[Why&How]
+Flickering observed while playing 8k HEVC-10 bit video in full screen
+mode with black border. We didn't support this case for subvp.
+Make change to the existing check to disable subvp for this corner case.
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Leo Ma <hanghong.ma@amd.com>
+Signed-off-by: Dillon Varone <dillon.varone@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c    | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c
+index 4d6cf856cc96c..8dee0d397e032 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c
+@@ -882,7 +882,7 @@ static void populate_dml21_plane_config_from_plane_state(struct dml2_context *dm
+       plane->immediate_flip = plane_state->flip_immediate;
+       plane->composition.rect_out_height_spans_vactive =
+-              plane_state->dst_rect.height >= stream->timing.v_addressable &&
++              plane_state->dst_rect.height >= stream->src.height &&
+               stream->dst.height >= stream->timing.v_addressable;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-full-exit-out-of-ips2-when-all-allow.patch b/queue-6.12/drm-amd-display-full-exit-out-of-ips2-when-all-allow.patch
new file mode 100644 (file)
index 0000000..753d88e
--- /dev/null
@@ -0,0 +1,78 @@
+From 52903e33e9f0ad734bedb2bf2df7bc38dd1220ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 12:20:23 -0400
+Subject: drm/amd/display: Full exit out of IPS2 when all allow signals have
+ been cleared
+
+From: Leo Chen <leo.chen@amd.com>
+
+[ Upstream commit 0fe33e115fec305c35c66b78ad26e3755ab54b9c ]
+
+[Why]
+A race condition occurs between cursor movement and vertical interrupt control
+thread from OS, with both threads trying to exit IPS2.
+Vertical interrupt control thread clears the prev driver allow signal while not fully
+finishing the IPS2 exit process.
+
+[How]
+We want to detect all the allow signals have been cleared before we perform the full exit.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Leo Chen <leo.chen@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c    | 6 ++++--
+ drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 3 ++-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+index 1e7de0f03290a..ec5009f411eb0 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
++++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+@@ -1294,6 +1294,8 @@ static void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle)
+               memset(&new_signals, 0, sizeof(new_signals));
++              new_signals.bits.allow_idle = 1; /* always set */
++
+               if (dc->config.disable_ips == DMUB_IPS_ENABLE ||
+                   dc->config.disable_ips == DMUB_IPS_DISABLE_DYNAMIC) {
+                       new_signals.bits.allow_pg = 1;
+@@ -1389,7 +1391,7 @@ static void dc_dmub_srv_exit_low_power_state(const struct dc *dc)
+                */
+               dc_dmub_srv->needs_idle_wake = false;
+-              if (prev_driver_signals.bits.allow_ips2 &&
++              if ((prev_driver_signals.bits.allow_ips2 || prev_driver_signals.all == 0) &&
+                   (!dc->debug.optimize_ips_handshake ||
+                    ips_fw->signals.bits.ips2_commit || !ips_fw->signals.bits.in_idle)) {
+                       DC_LOG_IPS(
+@@ -1450,7 +1452,7 @@ static void dc_dmub_srv_exit_low_power_state(const struct dc *dc)
+               }
+               dc_dmub_srv_notify_idle(dc, false);
+-              if (prev_driver_signals.bits.allow_ips1) {
++              if (prev_driver_signals.bits.allow_ips1 || prev_driver_signals.all == 0) {
+                       DC_LOG_IPS(
+                               "wait for IPS1 commit clear (ips1_commit=%u ips2_commit=%u)",
+                               ips_fw->signals.bits.ips1_commit,
+diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+index ebcf68bfae2b3..7835100b37c41 100644
+--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
++++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+@@ -747,7 +747,8 @@ union dmub_shared_state_ips_driver_signals {
+               uint32_t allow_ips1 : 1; /**< 1 is IPS1 is allowed */
+               uint32_t allow_ips2 : 1; /**< 1 is IPS1 is allowed */
+               uint32_t allow_z10 : 1; /**< 1 if Z10 is allowed */
+-              uint32_t reserved_bits : 28; /**< Reversed bits */
++              uint32_t allow_idle : 1; /**< 1 if driver is allowing idle */
++              uint32_t reserved_bits : 27; /**< Reversed bits */
+       } bits;
+       uint32_t all;
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-parse-umc_info-or-vram_info-based-on.patch b/queue-6.12/drm-amd-display-parse-umc_info-or-vram_info-based-on.patch
new file mode 100644 (file)
index 0000000..fbf7b78
--- /dev/null
@@ -0,0 +1,43 @@
+From 610787a45382064cf689ca9021f9587077535dd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 10:52:16 -0400
+Subject: drm/amd/display: parse umc_info or vram_info based on ASIC
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit 2551b4a321a68134360b860113dd460133e856e5 ]
+
+An upstream bug report suggests that there are production dGPUs that are
+older than DCN401 but still have a umc_info in VBIOS tables with the
+same version as expected for a DCN401 product. Hence, reading this
+tables should be guarded with a version check.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3678
+Reviewed-by: Dillon Varone <dillon.varone@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Zaeem Mohamed <zaeem.mohamed@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
+index c9a6de110b742..902491669cbc7 100644
+--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
+@@ -3127,7 +3127,9 @@ static enum bp_result bios_parser_get_vram_info(
+       struct atom_data_revision revision;
+       // vram info moved to umc_info for DCN4x
+-      if (info && DATA_TABLES(umc_info)) {
++      if (dcb->ctx->dce_version >= DCN_VERSION_4_01 &&
++              dcb->ctx->dce_version < DCN_VERSION_MAX &&
++              info && DATA_TABLES(umc_info)) {
+               header = GET_IMAGE(struct atom_common_table_header,
+                                       DATA_TABLES(umc_info));
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-prune-invalid-modes-for-hdmi-output.patch b/queue-6.12/drm-amd-display-prune-invalid-modes-for-hdmi-output.patch
new file mode 100644 (file)
index 0000000..913a73e
--- /dev/null
@@ -0,0 +1,171 @@
+From 6cc986390a2c5278c4db60c3c1b1e03c3267d3b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 18:15:10 -0400
+Subject: drm/amd/display: Prune Invalid Modes For HDMI Output
+
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+
+[ Upstream commit abdd2768d7630bc8ec3403aea24f4197bada3c1f ]
+
+[Why]
+1. HDMI does not have 6 bpc support. Having 6 bpc pass validation
+does not comply with spec.
+2. Validate 420 only for native HDMI, but not apply to pcon use
+case.
+3. Current mode validation log is not readable.
+
+[how]
+1. Cap 8 bpc for dp-hdmi converter.
+2. Validate yuv420 for pcon use case as well,
+   if rgb/yuv444 8bpc cannot fit into pcon bw limitation of
+   the link from the converter to HDMI sink.
+3. Add readable pixel_format and color_depth into debug log.
+
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Signed-off-by: Zaeem Mohamed <zaeem.mohamed@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 ++++++---
+ .../gpu/drm/amd/display/dc/core/dc_debug.c    | 40 +++++++++++++++++++
+ .../gpu/drm/amd/display/dc/core/dc_stream.c   |  6 +--
+ .../gpu/drm/amd/display/dc/inc/core_status.h  |  2 +
+ 4 files changed, 59 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 8c3db8346f300..ad3a3aa72b51f 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -7341,10 +7341,15 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+       const struct drm_connector_state *drm_state = dm_state ? &dm_state->base : NULL;
+       int requested_bpc = drm_state ? drm_state->max_requested_bpc : 8;
+       enum dc_status dc_result = DC_OK;
++      uint8_t bpc_limit = 6;
+       if (!dm_state)
+               return NULL;
++      if (aconnector->dc_link->connector_signal == SIGNAL_TYPE_HDMI_TYPE_A ||
++          aconnector->dc_link->dpcd_caps.dongle_type == DISPLAY_DONGLE_DP_HDMI_CONVERTER)
++              bpc_limit = 8;
++
+       do {
+               stream = create_stream_for_sink(connector, drm_mode,
+                                               dm_state, old_stream,
+@@ -7365,11 +7370,12 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+                       dc_result = dm_validate_stream_and_context(adev->dm.dc, stream);
+               if (dc_result != DC_OK) {
+-                      DRM_DEBUG_KMS("Mode %dx%d (clk %d) failed DC validation with error %d (%s)\n",
++                      DRM_DEBUG_KMS("Mode %dx%d (clk %d) pixel_encoding:%s color_depth:%s failed validation -- %s\n",
+                                     drm_mode->hdisplay,
+                                     drm_mode->vdisplay,
+                                     drm_mode->clock,
+-                                    dc_result,
++                                    dc_pixel_encoding_to_str(stream->timing.pixel_encoding),
++                                    dc_color_depth_to_str(stream->timing.display_color_depth),
+                                     dc_status_to_str(dc_result));
+                       dc_stream_release(stream);
+@@ -7377,10 +7383,13 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+                       requested_bpc -= 2; /* lower bpc to retry validation */
+               }
+-      } while (stream == NULL && requested_bpc >= 6);
++      } while (stream == NULL && requested_bpc >= bpc_limit);
+-      if (dc_result == DC_FAIL_ENC_VALIDATE && !aconnector->force_yuv420_output) {
+-              DRM_DEBUG_KMS("Retry forcing YCbCr420 encoding\n");
++      if ((dc_result == DC_FAIL_ENC_VALIDATE ||
++           dc_result == DC_EXCEED_DONGLE_CAP) &&
++           !aconnector->force_yuv420_output) {
++              DRM_DEBUG_KMS("%s:%d Retry forcing yuv420 encoding\n",
++                                   __func__, __LINE__);
+               aconnector->force_yuv420_output = true;
+               stream = create_validate_stream_for_sink(aconnector, drm_mode,
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_debug.c b/drivers/gpu/drm/amd/display/dc/core/dc_debug.c
+index 801cdbc8117d9..e255c204b7e85 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_debug.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_debug.c
+@@ -434,3 +434,43 @@ char *dc_status_to_str(enum dc_status status)
+       return "Unexpected status error";
+ }
++
++char *dc_pixel_encoding_to_str(enum dc_pixel_encoding pixel_encoding)
++{
++      switch (pixel_encoding) {
++      case PIXEL_ENCODING_RGB:
++              return "RGB";
++      case PIXEL_ENCODING_YCBCR422:
++              return "YUV422";
++      case PIXEL_ENCODING_YCBCR444:
++              return "YUV444";
++      case PIXEL_ENCODING_YCBCR420:
++              return "YUV420";
++      default:
++              return "Unknown";
++      }
++}
++
++char *dc_color_depth_to_str(enum dc_color_depth color_depth)
++{
++      switch (color_depth) {
++      case COLOR_DEPTH_666:
++              return "6-bpc";
++      case COLOR_DEPTH_888:
++              return "8-bpc";
++      case COLOR_DEPTH_101010:
++              return "10-bpc";
++      case COLOR_DEPTH_121212:
++              return "12-bpc";
++      case COLOR_DEPTH_141414:
++              return "14-bpc";
++      case COLOR_DEPTH_161616:
++              return "16-bpc";
++      case COLOR_DEPTH_999:
++              return "9-bpc";
++      case COLOR_DEPTH_111111:
++              return "11-bpc";
++      default:
++              return "Unknown";
++      }
++}
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+index 9a406d74c0dd7..3d93efdc1026d 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+@@ -819,12 +819,12 @@ void dc_stream_log(const struct dc *dc, const struct dc_stream_state *stream)
+                       stream->dst.height,
+                       stream->output_color_space);
+       DC_LOG_DC(
+-                      "\tpix_clk_khz: %d, h_total: %d, v_total: %d, pixelencoder:%d, displaycolorDepth:%d\n",
++                      "\tpix_clk_khz: %d, h_total: %d, v_total: %d, pixel_encoding:%s, color_depth:%s\n",
+                       stream->timing.pix_clk_100hz / 10,
+                       stream->timing.h_total,
+                       stream->timing.v_total,
+-                      stream->timing.pixel_encoding,
+-                      stream->timing.display_color_depth);
++                      dc_pixel_encoding_to_str(stream->timing.pixel_encoding),
++                      dc_color_depth_to_str(stream->timing.display_color_depth));
+       DC_LOG_DC(
+                       "\tlink: %d\n",
+                       stream->link->link_index);
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_status.h b/drivers/gpu/drm/amd/display/dc/inc/core_status.h
+index fa5edd03d0043..b5afd8c3103db 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/core_status.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/core_status.h
+@@ -60,5 +60,7 @@ enum dc_status {
+ };
+ char *dc_status_to_str(enum dc_status status);
++char *dc_pixel_encoding_to_str(enum dc_pixel_encoding pixel_encoding);
++char *dc_color_depth_to_str(enum dc_color_depth color_depth);
+ #endif /* _CORE_STATUS_H_ */
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-remove-hw-w-a-toggle-if-on-dp2-hpo.patch b/queue-6.12/drm-amd-display-remove-hw-w-a-toggle-if-on-dp2-hpo.patch
new file mode 100644 (file)
index 0000000..1d45460
--- /dev/null
@@ -0,0 +1,55 @@
+From 4b0e7a7713864a6096ee1d19bb7133757fe7a820 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 14:06:39 -0400
+Subject: drm/amd/display: Remove hw w/a toggle if on DP2/HPO
+
+From: Ausef Yousof <Ausef.Yousof@amd.com>
+
+[ Upstream commit b4c804628485af2b46f0d24a87190735cac37d61 ]
+
+[why&how]
+Applying a hw w/a only relevant to DIG FIFO causing corruption
+using HPO, do not apply the w/a if on DP2/HPO
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Signed-off-by: Ausef Yousof <Ausef.Yousof@amd.com>
+Signed-off-by: Zaeem Mohamed <zaeem.mohamed@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c  | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+index 7d68006137a97..3bd0d46c17010 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+@@ -132,6 +132,8 @@ static void dcn35_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state *
+       for (i = 0; i < dc->res_pool->pipe_count; ++i) {
+               struct pipe_ctx *old_pipe = &dc->current_state->res_ctx.pipe_ctx[i];
+               struct pipe_ctx *new_pipe = &context->res_ctx.pipe_ctx[i];
++              struct clk_mgr_internal *clk_mgr_internal = TO_CLK_MGR_INTERNAL(clk_mgr_base);
++              struct dccg *dccg = clk_mgr_internal->dccg;
+               struct pipe_ctx *pipe = safe_to_lower
+                       ? &context->res_ctx.pipe_ctx[i]
+                       : &dc->current_state->res_ctx.pipe_ctx[i];
+@@ -148,8 +150,13 @@ static void dcn35_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state *
+               new_pipe->stream_res.stream_enc &&
+               new_pipe->stream_res.stream_enc->funcs->is_fifo_enabled &&
+               new_pipe->stream_res.stream_enc->funcs->is_fifo_enabled(new_pipe->stream_res.stream_enc);
+-              if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal) ||
+-                      !pipe->stream->link_enc) && !stream_changed_otg_dig_on) {
++              bool has_active_hpo = dccg->ctx->dc->link_srv->dp_is_128b_132b_signal(old_pipe) && dccg->ctx->dc->link_srv->dp_is_128b_132b_signal(new_pipe);
++
++              if (!has_active_hpo && !dccg->ctx->dc->link_srv->dp_is_128b_132b_signal(pipe) &&
++                                      (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal) ||
++                                      !pipe->stream->link_enc) && !stream_changed_otg_dig_on)) {
++
++
+                       /* This w/a should not trigger when we have a dig active */
+                       if (disable) {
+                               if (pipe->stream_res.tg && pipe->stream_res.tg->funcs->immediate_disable_crtc)
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amd-display-skip-disable-crtc-in-seemless-bootup.patch b/queue-6.12/drm-amd-display-skip-disable-crtc-in-seemless-bootup.patch
new file mode 100644 (file)
index 0000000..8a912be
--- /dev/null
@@ -0,0 +1,43 @@
+From 39c071a8b0d1ed00ce05bb5844809bee01f58981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Sep 2024 09:33:44 +0800
+Subject: drm/amd/display: skip disable CRTC in seemless bootup case
+
+From: Fudongwang <Fudong.Wang@amd.com>
+
+[ Upstream commit 0e37e4b9afbd08df1f00a70bbb4d1ec273d18c9e ]
+
+Resync FIFO is a workaround to write the same value to
+DENTIST_DISPCLK_CNTL register after programming OTG_PIXEL_RATE_DIV
+register, in case seemless boot, there is no OTG_PIXEL_RATE_DIV register
+update, so skip CRTC disable when resync FIFO to avoid random FIFO error
+and garbage.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Fudongwang <Fudong.Wang@amd.com>
+Signed-off-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
+index 4e93eeedfc1bb..a8e04a39a19e5 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
+@@ -371,7 +371,9 @@ void dcn314_resync_fifo_dccg_dio(struct dce_hwseq *hws, struct dc *dc, struct dc
+               if (pipe->top_pipe || pipe->prev_odm_pipe)
+                       continue;
+-              if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal))) {
++              if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal)) &&
++                      !pipe->stream->apply_seamless_boot_optimization &&
++                      !pipe->stream->apply_edp_fast_boot_optimization) {
+                       pipe->stream_res.tg->funcs->disable_crtc(pipe->stream_res.tg);
+                       reset_sync_context_for_pipe(dc, context, i);
+                       otg_disabled[i] = true;
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amdgpu-clear-rb_overflow-bit-when-enabling-inter.patch b/queue-6.12/drm-amdgpu-clear-rb_overflow-bit-when-enabling-inter.patch
new file mode 100644 (file)
index 0000000..c6d6864
--- /dev/null
@@ -0,0 +1,73 @@
+From 911d2973be967625c51d902c9be634936c20b82d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2024 18:01:23 -0400
+Subject: drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for
+ vega20_ih
+
+From: Victor Lu <victorchengchi.lu@amd.com>
+
+[ Upstream commit 8b22f048331dfd45fdfbf0efdfb1d43deff7518d ]
+
+Port this change to vega20_ih.c:
+commit afbf7955ff01 ("drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts")
+
+Original commit message:
+"Why:
+Setting IH_RB_WPTR register to 0 will not clear the RB_OVERFLOW bit
+if RB_ENABLE is not set.
+
+How to fix:
+Set WPTR_OVERFLOW_CLEAR bit after RB_ENABLE bit is set.
+The RB_ENABLE bit is required to be set, together with
+WPTR_OVERFLOW_ENABLE bit so that setting WPTR_OVERFLOW_CLEAR bit
+would clear the RB_OVERFLOW."
+
+Signed-off-by: Victor Lu <victorchengchi.lu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vega20_ih.c | 27 ++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vega20_ih.c b/drivers/gpu/drm/amd/amdgpu/vega20_ih.c
+index ac439f0565e35..16f5561fb86ec 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vega20_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/vega20_ih.c
+@@ -114,6 +114,33 @@ static int vega20_ih_toggle_ring_interrupts(struct amdgpu_device *adev,
+       tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, RB_ENABLE, (enable ? 1 : 0));
+       tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, RB_GPU_TS_ENABLE, 1);
++      if (enable) {
++              /* Unset the CLEAR_OVERFLOW bit to make sure the next step
++               * is switching the bit from 0 to 1
++               */
++              tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
++              if (amdgpu_sriov_vf(adev) && amdgpu_sriov_reg_indirect_ih(adev)) {
++                      if (psp_reg_program(&adev->psp, ih_regs->psp_reg_id, tmp))
++                              return -ETIMEDOUT;
++              } else {
++                      WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
++              }
++
++              /* Clear RB_OVERFLOW bit */
++              tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
++              if (amdgpu_sriov_vf(adev) && amdgpu_sriov_reg_indirect_ih(adev)) {
++                      if (psp_reg_program(&adev->psp, ih_regs->psp_reg_id, tmp))
++                              return -ETIMEDOUT;
++              } else {
++                      WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp);
++              }
++
++              /* Unset the CLEAR_OVERFLOW bit immediately so new overflows
++               * can be detected.
++               */
++              tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0);
++      }
++
+       /* enable_intr field is only valid in ring0 */
+       if (ih == &adev->irq.ih)
+               tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, ENABLE_INTR, (enable ? 1 : 0));
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amdgpu-dereference-the-atcs-acpi-buffer.patch b/queue-6.12/drm-amdgpu-dereference-the-atcs-acpi-buffer.patch
new file mode 100644 (file)
index 0000000..7b7691c
--- /dev/null
@@ -0,0 +1,36 @@
+From 16419454cc7233444df8df1a66f42ed8932c2a61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 14:54:31 +0800
+Subject: drm/amdgpu: Dereference the ATCS ACPI buffer
+
+From: Prike Liang <Prike.Liang@amd.com>
+
+[ Upstream commit 32e7ee293ff476c67b51be006e986021967bc525 ]
+
+Need to dereference the atcs acpi buffer after
+the method is executed, otherwise it will result in
+a memory leak.
+
+Signed-off-by: Prike Liang <Prike.Liang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+index 7dd55ed57c1d9..b8d4e07d2043e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+@@ -800,6 +800,7 @@ int amdgpu_acpi_power_shift_control(struct amdgpu_device *adev,
+               return -EIO;
+       }
++      kfree(info);
+       return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amdgpu-gfx9-add-cleaner-shader-for-gfx9.4.2.patch b/queue-6.12/drm-amdgpu-gfx9-add-cleaner-shader-for-gfx9.4.2.patch
new file mode 100644 (file)
index 0000000..d8ed639
--- /dev/null
@@ -0,0 +1,305 @@
+From cafb399f1e736a561e1976cf31211438a85fa1d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 07:26:19 +0530
+Subject: drm/amdgpu/gfx9: Add cleaner shader for GFX9.4.2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 9343b904e7198e4804685133327dece7fe709bc1 ]
+
+This commit adds the cleaner shader microcode for GFX9.4.2 GPUs. The
+cleaner shader is a piece of GPU code that is used to clear or
+initialize certain GPU resources, such as Local Data Share (LDS), Vector
+General Purpose Registers (VGPRs), and Scalar General Purpose Registers
+(SGPRs).
+
+Clearing these resources is important for ensuring data isolation
+between different workloads running on the GPU. Without the cleaner
+shader, residual data from a previous workload could potentially be
+accessed by a subsequent workload, leading to data leaks and incorrect
+computation results.
+
+The cleaner shader microcode is represented as an array of 32-bit words
+(`gfx_9_4_2_cleaner_shader_hex`). This array is the binary
+representation of the cleaner shader code, which is written in a
+low-level GPU instruction set.
+
+Also, this patch updates the `gfx_v9_0_sw_init` function to initialize
+the cleaner shader if the MEC firmware version is 88 or higher. It sets
+the `cleaner_shader_ptr` and `cleaner_shader_size` to the appropriate
+values and attempts to initialize the cleaner shader.
+
+When the cleaner shader feature is enabled, the AMDGPU driver loads this
+array into a specific location in the GPU memory. The GPU then reads
+this memory location to fetch and execute the cleaner shader
+instructions.
+
+The cleaner shader is executed automatically by the GPU at the end of
+each workload, before the next workload starts. This ensures that all
+GPU resources are in a clean state before the start of each workload.
+
+This change ensures that the GPU memory is properly cleared between
+different processes, preventing data leakage and enhancing security. It
+also aligns with the serialization mechanism between KGD and KFD,
+ensuring that the GPU state is consistent across different workloads.
+
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Suggested-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c         |  12 ++
+ .../drm/amd/amdgpu/gfx_v9_0_cleaner_shader.h  |  44 ++++-
+ .../amd/amdgpu/gfx_v9_4_2_cleaner_shader.asm  | 153 ++++++++++++++++++
+ 3 files changed, 208 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_2_cleaner_shader.asm
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 785a343a95f0f..e7cd51c95141e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -2223,6 +2223,18 @@ static int gfx_v9_0_sw_init(void *handle)
+       }
+       switch (amdgpu_ip_version(adev, GC_HWIP, 0)) {
++      case IP_VERSION(9, 4, 2):
++              adev->gfx.cleaner_shader_ptr = gfx_9_4_2_cleaner_shader_hex;
++              adev->gfx.cleaner_shader_size = sizeof(gfx_9_4_2_cleaner_shader_hex);
++              if (adev->gfx.mec_fw_version >= 88) {
++                      adev->gfx.enable_cleaner_shader = true;
++                      r = amdgpu_gfx_cleaner_shader_sw_init(adev, adev->gfx.cleaner_shader_size);
++                      if (r) {
++                              adev->gfx.enable_cleaner_shader = false;
++                              dev_err(adev->dev, "Failed to initialize cleaner shader\n");
++                      }
++              }
++              break;
+       default:
+               adev->gfx.enable_cleaner_shader = false;
+               break;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0_cleaner_shader.h b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0_cleaner_shader.h
+index 36c0292b51106..0b6bd09b75299 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0_cleaner_shader.h
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0_cleaner_shader.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: MIT */
+ /*
+- * Copyright 2018 Advanced Micro Devices, Inc.
++ * Copyright 2024 Advanced Micro Devices, Inc.
+  *
+  * Permission is hereby granted, free of charge, to any person obtaining a
+  * copy of this software and associated documentation files (the "Software"),
+@@ -24,3 +24,45 @@
+ static const u32 __maybe_unused gfx_9_0_cleaner_shader_hex[] = {
+       /* Add the cleaner shader code here */
+ };
++
++/* Define the cleaner shader gfx_9_4_2 */
++static const u32 gfx_9_4_2_cleaner_shader_hex[] = {
++      0xbf068100, 0xbf84003b,
++      0xbf8a0000, 0xb07c0000,
++      0xbe8200ff, 0x00000078,
++      0xbf110802, 0x7e000280,
++      0x7e020280, 0x7e040280,
++      0x7e060280, 0x7e080280,
++      0x7e0a0280, 0x7e0c0280,
++      0x7e0e0280, 0x80828802,
++      0xbe803202, 0xbf84fff5,
++      0xbf9c0000, 0xbe8200ff,
++      0x80000000, 0x86020102,
++      0xbf840011, 0xbefe00c1,
++      0xbeff00c1, 0xd28c0001,
++      0x0001007f, 0xd28d0001,
++      0x0002027e, 0x10020288,
++      0xbe8200bf, 0xbefc00c1,
++      0xd89c2000, 0x00020201,
++      0xd89c6040, 0x00040401,
++      0x320202ff, 0x00000400,
++      0x80828102, 0xbf84fff8,
++      0xbefc00ff, 0x0000005c,
++      0xbf800000, 0xbe802c80,
++      0xbe812c80, 0xbe822c80,
++      0xbe832c80, 0x80fc847c,
++      0xbf84fffa, 0xbee60080,
++      0xbee70080, 0xbeea0180,
++      0xbeec0180, 0xbeee0180,
++      0xbef00180, 0xbef20180,
++      0xbef40180, 0xbef60180,
++      0xbef80180, 0xbefa0180,
++      0xbf810000, 0xbf8d0001,
++      0xbefc00ff, 0x0000005c,
++      0xbf800000, 0xbe802c80,
++      0xbe812c80, 0xbe822c80,
++      0xbe832c80, 0x80fc847c,
++      0xbf84fffa, 0xbee60080,
++      0xbee70080, 0xbeea01ff,
++      0x000000ee, 0xbf810000,
++};
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_2_cleaner_shader.asm b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_2_cleaner_shader.asm
+new file mode 100644
+index 0000000000000..35b8cf9070bd9
+--- /dev/null
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_2_cleaner_shader.asm
+@@ -0,0 +1,153 @@
++/* SPDX-License-Identifier: MIT */
++/*
++ * Copyright 2024 Advanced Micro Devices, Inc.
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the "Software"),
++ * to deal in the Software without restriction, including without limitation
++ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
++ * and/or sell copies of the Software, and to permit persons to whom the
++ * Software is furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ * OTHER DEALINGS IN THE SOFTWARE.
++ */
++
++// This shader is to clean LDS, SGPRs and VGPRs. It is  first 64 Dwords or 256 bytes of 192 Dwords cleaner shader.
++//To turn this shader program on for complitaion change this to main and lower shader main to main_1
++
++// MI200 : Clear SGPRs, VGPRs and LDS
++//   Uses two kernels launched separately:
++//   1. Clean VGPRs, LDS, and lower SGPRs
++//        Launches one workgroup per CU, each workgroup with 4x wave64 per SIMD in the CU
++//        Waves are "wave64" and have 128 VGPRs each, which uses all 512 VGPRs per SIMD
++//        Waves in the workgroup share the 64KB of LDS
++//        Each wave clears SGPRs 0 - 95. Because there are 4 waves/SIMD, this is physical SGPRs 0-383
++//        Each wave clears 128 VGPRs, so all 512 in the SIMD
++//        The first wave of the workgroup clears its 64KB of LDS
++//        The shader starts with "S_BARRIER" to ensure SPI has launched all waves of the workgroup
++//          before any wave in the workgroup could end.  Without this, it is possible not all SGPRs get cleared.
++//    2. Clean remaining SGPRs
++//        Launches a workgroup with 24 waves per workgroup, yielding 6 waves per SIMD in each CU
++//        Waves are allocating 96 SGPRs
++//          CP sets up SPI_RESOURCE_RESERVE_* registers to prevent these waves from allocating SGPRs 0-223.
++//          As such, these 6 waves per SIMD are allocated physical SGPRs 224-799
++//        Barriers do not work for >16 waves per workgroup, so we cannot start with S_BARRIER
++//          Instead, the shader starts with an S_SETHALT 1. Once all waves are launched CP will send unhalt command
++//        The shader then clears all SGPRs allocated to it, cleaning out physical SGPRs 224-799
++
++shader main
++  asic(MI200)
++  type(CS)
++  wave_size(64)
++// Note: original source code from SQ team
++
++//   (theorhetical fastest = ~512clks vgpr + 1536 lds + ~128 sgpr  = 2176 clks)
++
++  s_cmp_eq_u32 s0, 1                                // Bit0 is set, sgpr0 is set then clear VGPRS and LDS as FW set COMPUTE_USER_DATA_3
++  s_cbranch_scc0  label_0023                        // Clean VGPRs and LDS if sgpr0 of wave is set, scc = (s3 == 1)
++  S_BARRIER
++
++  s_movk_i32    m0, 0x0000
++  s_mov_b32     s2, 0x00000078  // Loop 128/8=16 times  (loop unrolled for performance)
++  //
++  // CLEAR VGPRs
++  //
++  s_set_gpr_idx_on  s2, 0x8    // enable Dest VGPR indexing
++label_0005:
++  v_mov_b32     v0, 0
++  v_mov_b32     v1, 0
++  v_mov_b32     v2, 0
++  v_mov_b32     v3, 0
++  v_mov_b32     v4, 0
++  v_mov_b32     v5, 0
++  v_mov_b32     v6, 0
++  v_mov_b32     v7, 0
++  s_sub_u32     s2, s2, 8
++  s_set_gpr_idx_idx  s2
++  s_cbranch_scc0  label_0005
++  s_set_gpr_idx_off
++
++  //
++  //
++
++  s_mov_b32     s2, 0x80000000                      // Bit31 is first_wave
++  s_and_b32     s2, s2, s1                          // sgpr0 has tg_size (first_wave) term as in ucode only COMPUTE_PGM_RSRC2.tg_size_en is set
++  s_cbranch_scc0  label_clean_sgpr_1                // Clean LDS if its first wave of ThreadGroup/WorkGroup
++  // CLEAR LDS
++  //
++  s_mov_b32 exec_lo, 0xffffffff
++  s_mov_b32 exec_hi, 0xffffffff
++  v_mbcnt_lo_u32_b32  v1, exec_hi, 0          // Set V1 to thread-ID (0..63)
++  v_mbcnt_hi_u32_b32  v1, exec_lo, v1         // Set V1 to thread-ID (0..63)
++  v_mul_u32_u24  v1, 0x00000008, v1           // * 8, so each thread is a double-dword address (8byte)
++  s_mov_b32     s2, 0x00000003f               // 64 loop iterations
++  s_mov_b32     m0, 0xffffffff
++  // Clear all of LDS space
++  // Each FirstWave of WorkGroup clears 64kbyte block
++
++label_001F:
++  ds_write2_b64  v1, v[2:3], v[2:3] offset1:32
++  ds_write2_b64  v1, v[4:5], v[4:5] offset0:64 offset1:96
++  v_add_co_u32     v1, vcc, 0x00000400, v1
++  s_sub_u32     s2, s2, 1
++  s_cbranch_scc0  label_001F
++  //
++  // CLEAR SGPRs
++  //
++label_clean_sgpr_1:
++  s_mov_b32     m0, 0x0000005c   // Loop 96/4=24 times  (loop unrolled for performance)
++  s_nop 0
++label_sgpr_loop:
++  s_movreld_b32     s0, 0
++  s_movreld_b32     s1, 0
++  s_movreld_b32     s2, 0
++  s_movreld_b32     s3, 0
++  s_sub_u32         m0, m0, 4
++  s_cbranch_scc0  label_sgpr_loop
++
++  //clear vcc, flat scratch
++  s_mov_b32 flat_scratch_lo, 0   //clear  flat scratch lo SGPR
++  s_mov_b32 flat_scratch_hi, 0   //clear  flat scratch hi SGPR
++  s_mov_b64 vcc, 0               //clear vcc
++  s_mov_b64 ttmp0, 0             //Clear ttmp0 and ttmp1
++  s_mov_b64 ttmp2, 0             //Clear ttmp2 and ttmp3
++  s_mov_b64 ttmp4, 0             //Clear ttmp4 and ttmp5
++  s_mov_b64 ttmp6, 0             //Clear ttmp6 and ttmp7
++  s_mov_b64 ttmp8, 0             //Clear ttmp8 and ttmp9
++  s_mov_b64 ttmp10, 0            //Clear ttmp10 and ttmp11
++  s_mov_b64 ttmp12, 0            //Clear ttmp12 and ttmp13
++  s_mov_b64 ttmp14, 0            //Clear ttmp14 and ttmp15
++s_endpgm
++
++label_0023:
++
++  s_sethalt 1
++
++  s_mov_b32     m0, 0x0000005c   // Loop 96/4=24 times  (loop unrolled for performance)
++  s_nop 0
++label_sgpr_loop1:
++
++  s_movreld_b32     s0, 0
++  s_movreld_b32     s1, 0
++  s_movreld_b32     s2, 0
++  s_movreld_b32     s3, 0
++  s_sub_u32         m0, m0, 4
++  s_cbranch_scc0  label_sgpr_loop1
++
++  //clear vcc, flat scratch
++  s_mov_b32 flat_scratch_lo, 0   //clear  flat scratch lo SGPR
++  s_mov_b32 flat_scratch_hi, 0   //clear  flat scratch hi SGPR
++  s_mov_b64 vcc, 0xee            //clear vcc
++
++s_endpgm
++end
++
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amdgpu-refine-error-handling-in-amdgpu_ttm_tt_pi.patch b/queue-6.12/drm-amdgpu-refine-error-handling-in-amdgpu_ttm_tt_pi.patch
new file mode 100644 (file)
index 0000000..3ebb160
--- /dev/null
@@ -0,0 +1,44 @@
+From 4ec0bffe61d5a138e710b640d0af8993d975ae2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 17:21:09 +0800
+Subject: drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
+
+From: Lang Yu <lang.yu@amd.com>
+
+[ Upstream commit 46186667f98fb7158c98f4ff5da62c427761ffcd ]
+
+Free sg table when dma_map_sgtable() failed to avoid memory leak.
+
+Signed-off-by: Lang Yu <lang.yu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index 74adb983ab03e..0637414fc70e0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -812,7 +812,7 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_device *bdev,
+       /* Map SG to device */
+       r = dma_map_sgtable(adev->dev, ttm->sg, direction, 0);
+       if (r)
+-              goto release_sg;
++              goto release_sg_table;
+       /* convert SG to linear array of pages and dma addresses */
+       drm_prime_sg_to_dma_addr_array(ttm->sg, gtt->ttm.dma_address,
+@@ -820,6 +820,8 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_device *bdev,
+       return 0;
++release_sg_table:
++      sg_free_table(ttm->sg);
+ release_sg:
+       kfree(ttm->sg);
+       ttm->sg = NULL;
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amdgpu-set-the-right-amdgpu-sg-segment-limitatio.patch b/queue-6.12/drm-amdgpu-set-the-right-amdgpu-sg-segment-limitatio.patch
new file mode 100644 (file)
index 0000000..88fd195
--- /dev/null
@@ -0,0 +1,85 @@
+From 0190807ee5f20c27b889f72604a9a45278c7f31b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 10:59:17 +0800
+Subject: drm/amdgpu: set the right AMDGPU sg segment limitation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Prike Liang <Prike.Liang@amd.com>
+
+[ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ]
+
+The driver needs to set the correct max_segment_size;
+otherwise debug_dma_map_sg() will complain about the
+over-mapping of the AMDGPU sg length as following:
+
+WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370
+[  364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd
+[  364.049532]  ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii
+[  364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G           OE      6.10.0-custom #492
+[  364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021
+[  364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370
+[  364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05
+[  364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286
+[  364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027
+[  364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680
+[  364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930
+[  364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000
+[  364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800
+[  364.049599] FS:  00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000
+[  364.049601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0
+[  364.049605] Call Trace:
+[  364.049607]  <TASK>
+[  364.049609]  ? show_regs+0x6d/0x80
+[  364.049614]  ? __warn+0x8c/0x140
+[  364.049618]  ? debug_dma_map_sg+0x2dc/0x370
+[  364.049621]  ? report_bug+0x193/0x1a0
+[  364.049627]  ? handle_bug+0x46/0x80
+[  364.049631]  ? exc_invalid_op+0x1d/0x80
+[  364.049635]  ? asm_exc_invalid_op+0x1f/0x30
+[  364.049642]  ? debug_dma_map_sg+0x2dc/0x370
+[  364.049647]  __dma_map_sg_attrs+0x90/0xe0
+[  364.049651]  dma_map_sgtable+0x25/0x40
+[  364.049654]  amdgpu_bo_move+0x59a/0x850 [amdgpu]
+[  364.049935]  ? srso_return_thunk+0x5/0x5f
+[  364.049939]  ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu]
+[  364.050095]  ttm_bo_handle_move_mem+0xc3/0x180 [ttm]
+[  364.050103]  ttm_bo_validate+0xc1/0x160 [ttm]
+[  364.050108]  ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu]
+[  364.050263]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu]
+[  364.050473]  kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu]
+[  364.050680]  kfd_ioctl+0x3c2/0x530 [amdgpu]
+[  364.050866]  ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu]
+[  364.051054]  ? srso_return_thunk+0x5/0x5f
+[  364.051057]  ? tomoyo_file_ioctl+0x20/0x30
+[  364.051063]  __x64_sys_ioctl+0x9c/0xd0
+[  364.051068]  x64_sys_call+0x1219/0x20d0
+[  364.051073]  do_syscall_64+0x51/0x120
+[  364.051077]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[  364.051081] RIP: 0033:0x7fb2d2f1a94f
+
+Signed-off-by: Prike Liang <Prike.Liang@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index 0637414fc70e0..9f922ec50ea2d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -1851,6 +1851,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
+       mutex_init(&adev->mman.gtt_window_lock);
++      dma_set_max_seg_size(adev->dev, UINT_MAX);
+       /* No others user of address space so set it to 0 */
+       r = ttm_device_init(&adev->mman.bdev, &amdgpu_bo_driver, adev->dev,
+                              adev_to_drm(adev)->anon_inode->i_mapping,
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amdgpu-skip-amdgpu_device_cache_pci_state-under-.patch b/queue-6.12/drm-amdgpu-skip-amdgpu_device_cache_pci_state-under-.patch
new file mode 100644 (file)
index 0000000..39bb4c3
--- /dev/null
@@ -0,0 +1,41 @@
+From 79445f2c88b27dc607f366e7f30912c1a6f34ab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 13:40:39 +0800
+Subject: drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
+
+From: Victor Zhao <Victor.Zhao@amd.com>
+
+[ Upstream commit afe260df55ac280cd56306248cb6d8a6b0db095c ]
+
+Under sriov, host driver will save and restore vf pci cfg space during
+reset. And during device init, under sriov, pci_restore_state happens after
+fullaccess released, and it can have race condition with mmio protection
+enable from host side leading to missing interrupts.
+
+So skip amdgpu_device_cache_pci_state for sriov.
+
+Signed-off-by: Victor Zhao <Victor.Zhao@amd.com>
+Acked-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 1f08cb88d51be..07f93f77de7dc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -6344,6 +6344,9 @@ bool amdgpu_device_cache_pci_state(struct pci_dev *pdev)
+       struct amdgpu_device *adev = drm_to_adev(dev);
+       int r;
++      if (amdgpu_sriov_vf(adev))
++              return false;
++
+       r = pci_save_state(pdev);
+       if (!r) {
+               kfree(adev->pci_state);
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-amdgpu-vcn-reset-fw_shared-when-vcpu-buffers-cor.patch b/queue-6.12/drm-amdgpu-vcn-reset-fw_shared-when-vcpu-buffers-cor.patch
new file mode 100644 (file)
index 0000000..4ddf9eb
--- /dev/null
@@ -0,0 +1,104 @@
+From d7f6ed3300129ce810908a97acf3fdb8d4de11c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2024 16:59:30 +0800
+Subject: drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn
+ v4.0.3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit 928cd772e18ffbd7723cb2361db4a8ccf2222235 ]
+
+It is not necessarily corrupted. When there is RAS fatal error, device
+memory access is blocked. Hence vcpu bo cannot be saved to system memory
+as in a regular suspend sequence before going for reset. In other full
+device reset cases, that gets saved and restored during resume.
+
+v2: Remove redundant code like vcn_v4_0 did
+v2: Refine commit message
+v3: Drop the volatile
+v3: Refine commit message
+
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 30 ++++++++++++++++++-------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+index 0fda703363004..6fca2915ea8fd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+@@ -116,6 +116,20 @@ static int vcn_v4_0_3_early_init(void *handle)
+       return amdgpu_vcn_early_init(adev);
+ }
++static int vcn_v4_0_3_fw_shared_init(struct amdgpu_device *adev, int inst_idx)
++{
++      struct amdgpu_vcn4_fw_shared *fw_shared;
++
++      fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
++      fw_shared->present_flag_0 = cpu_to_le32(AMDGPU_FW_SHARED_FLAG_0_UNIFIED_QUEUE);
++      fw_shared->sq.is_enabled = 1;
++
++      if (amdgpu_vcnfw_log)
++              amdgpu_vcn_fwlog_init(&adev->vcn.inst[inst_idx]);
++
++      return 0;
++}
++
+ /**
+  * vcn_v4_0_3_sw_init - sw init for VCN block
+  *
+@@ -148,8 +162,6 @@ static int vcn_v4_0_3_sw_init(void *handle)
+               return r;
+       for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
+-              volatile struct amdgpu_vcn4_fw_shared *fw_shared;
+-
+               vcn_inst = GET_INST(VCN, i);
+               ring = &adev->vcn.inst[i].ring_enc[0];
+@@ -172,12 +184,7 @@ static int vcn_v4_0_3_sw_init(void *handle)
+               if (r)
+                       return r;
+-              fw_shared = adev->vcn.inst[i].fw_shared.cpu_addr;
+-              fw_shared->present_flag_0 = cpu_to_le32(AMDGPU_FW_SHARED_FLAG_0_UNIFIED_QUEUE);
+-              fw_shared->sq.is_enabled = true;
+-
+-              if (amdgpu_vcnfw_log)
+-                      amdgpu_vcn_fwlog_init(&adev->vcn.inst[i]);
++              vcn_v4_0_3_fw_shared_init(adev, i);
+       }
+       if (amdgpu_sriov_vf(adev)) {
+@@ -273,6 +280,8 @@ static int vcn_v4_0_3_hw_init(void *handle)
+               }
+       } else {
+               for (i = 0; i < adev->vcn.num_vcn_inst; ++i) {
++                      struct amdgpu_vcn4_fw_shared *fw_shared;
++
+                       vcn_inst = GET_INST(VCN, i);
+                       ring = &adev->vcn.inst[i].ring_enc[0];
+@@ -296,6 +305,11 @@ static int vcn_v4_0_3_hw_init(void *handle)
+                                       regVCN_RB1_DB_CTRL);
+                       }
++                      /* Re-init fw_shared when RAS fatal error occurred */
++                      fw_shared = adev->vcn.inst[i].fw_shared.cpu_addr;
++                      if (!fw_shared->sq.is_enabled)
++                              vcn_v4_0_3_fw_shared_init(adev, i);
++
+                       r = amdgpu_ring_test_helper(ring);
+                       if (r)
+                               return r;
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-bridge-it6505-enable-module-autoloading.patch b/queue-6.12/drm-bridge-it6505-enable-module-autoloading.patch
new file mode 100644 (file)
index 0000000..91138bb
--- /dev/null
@@ -0,0 +1,36 @@
+From 3dd573d8877c8b86536ede317cb034c2c7f09c2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 11:33:18 +0000
+Subject: drm/bridge: it6505: Enable module autoloading
+
+From: Liao Chen <liaochen4@huawei.com>
+
+[ Upstream commit 1e2ab24cd708b1c864ff983ee1504c0a409d2f8e ]
+
+Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based
+on the alias from of_device_id table.
+
+Signed-off-by: Liao Chen <liaochen4@huawei.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240902113320.903147-2-liaochen4@huawei.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ite-it6505.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
+index 65b57de20203f..008d86cc562af 100644
+--- a/drivers/gpu/drm/bridge/ite-it6505.c
++++ b/drivers/gpu/drm/bridge/ite-it6505.c
+@@ -3507,6 +3507,7 @@ static const struct of_device_id it6505_of_match[] = {
+       { .compatible = "ite,it6505" },
+       { }
+ };
++MODULE_DEVICE_TABLE(of, it6505_of_match);
+ static struct i2c_driver it6505_i2c_driver = {
+       .driver = {
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-display-fix-building-with-gcc-15.patch b/queue-6.12/drm-display-fix-building-with-gcc-15.patch
new file mode 100644 (file)
index 0000000..ce61c84
--- /dev/null
@@ -0,0 +1,55 @@
+From 1379eccbe3e4e0423eae170a44b58d4c8adac327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 14:53:11 +0530
+Subject: drm/display: Fix building with GCC 15
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <brahmajit.xyz@gmail.com>
+
+[ Upstream commit a500f3751d3c861be7e4463c933cf467240cca5d ]
+
+GCC 15 enables -Werror=unterminated-string-initialization by default.
+This results in the following build error
+
+drivers/gpu/drm/display/drm_dp_dual_mode_helper.c: In function â€˜is_hdmi_adaptor’:
+drivers/gpu/drm/display/drm_dp_dual_mode_helper.c:164:17: error: initializer-string for array of
+ â€˜char’ is too long [-Werror=unterminated-string-initialization]
+  164 |                 "DP-HDMI ADAPTOR\x04";
+      |                 ^~~~~~~~~~~~~~~~~~~~~
+
+After discussion with Ville, the fix was to increase the size of
+dp_dual_mode_hdmi_id array by one, so that it can accommodate the NULL
+line character. This should let us build the kernel with GCC 15.
+
+Signed-off-by: Brahmajit Das <brahmajit.xyz@gmail.com>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241002092311.942822-1-brahmajit.xyz@gmail.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/display/drm_dp_dual_mode_helper.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c b/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c
+index 14a2a8473682b..c491e3203bf11 100644
+--- a/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c
++++ b/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c
+@@ -160,11 +160,11 @@ EXPORT_SYMBOL(drm_dp_dual_mode_write);
+ static bool is_hdmi_adaptor(const char hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN])
+ {
+-      static const char dp_dual_mode_hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN] =
++      static const char dp_dual_mode_hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN + 1] =
+               "DP-HDMI ADAPTOR\x04";
+       return memcmp(hdmi_id, dp_dual_mode_hdmi_id,
+-                    sizeof(dp_dual_mode_hdmi_id)) == 0;
++                    DP_DUAL_MODE_HDMI_ID_LEN) == 0;
+ }
+ static bool is_type1_adaptor(uint8_t adaptor_id)
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-mcde-enable-module-autoloading.patch b/queue-6.12/drm-mcde-enable-module-autoloading.patch
new file mode 100644 (file)
index 0000000..929b26c
--- /dev/null
@@ -0,0 +1,36 @@
+From 9a880b63326bd1345c96dc4dbdb9f24e8c27028c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 11:33:20 +0000
+Subject: drm/mcde: Enable module autoloading
+
+From: Liao Chen <liaochen4@huawei.com>
+
+[ Upstream commit 8a16b5cdae26207ff4c22834559384ad3d7bc970 ]
+
+Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based
+on the alias from of_device_id table.
+
+Signed-off-by: Liao Chen <liaochen4@huawei.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240902113320.903147-4-liaochen4@huawei.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mcde/mcde_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c
+index 10c06440c7e73..f1bb38f4e6734 100644
+--- a/drivers/gpu/drm/mcde/mcde_drv.c
++++ b/drivers/gpu/drm/mcde/mcde_drv.c
+@@ -473,6 +473,7 @@ static const struct of_device_id mcde_of_match[] = {
+       },
+       {},
+ };
++MODULE_DEVICE_TABLE(of, mcde_of_match);
+ static struct platform_driver mcde_driver = {
+       .driver = {
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch b/queue-6.12/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch
new file mode 100644 (file)
index 0000000..65405d5
--- /dev/null
@@ -0,0 +1,51 @@
+From 509456c295b69782eea8f8472b7b179107c77816 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 15:18:51 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joaquín Ignacio Aramendía <samsagax@gmail.com>
+
+[ Upstream commit 361ebf5ef843b0aa1704c72eb26b91cf76c3c5b7 ]
+
+Add quirk orientation for AYA NEO 2. The name appears without spaces in
+DMI strings. That made it difficult to reuse the 2021 match. Also the
+display is larger in resolution.
+
+Tested by the JELOS team that has been patching their own kernel for a
+while now and confirmed by users in the AYA NEO and ChimeraOS discord
+servers.
+
+Signed-off-by: Joaquín Ignacio Aramendía <samsagax@gmail.com>
+Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/2b35545b77a9fd8c9699b751ca282226dcecb1dd.1726492131.git.tjakobi@math.uni-bielefeld.de
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 2d84d7ea1ab7a..4864d8406db41 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -184,6 +184,12 @@ static const struct dmi_system_id orientation_data[] = {
+                 DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
+               },
+               .driver_data = (void *)&lcd800x1280_rightside_up,
++      }, {    /* AYA NEO AYANEO 2 */
++              .matches = {
++                DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"),
++                DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYANEO 2"),
++              },
++              .driver_data = (void *)&lcd1200x1920_rightside_up,
+       }, {    /* AYA NEO 2021 */
+               .matches = {
+                 DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"),
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-panel-orientation-quirks-add-quirk-for-aya-neo-f.patch b/queue-6.12/drm-panel-orientation-quirks-add-quirk-for-aya-neo-f.patch
new file mode 100644 (file)
index 0000000..55b505f
--- /dev/null
@@ -0,0 +1,52 @@
+From 5e2750642b10371f490252ca278557ca95e44adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 15:18:53 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joaquín Ignacio Aramendía <samsagax@gmail.com>
+
+[ Upstream commit d7972d735ca80a40a571bf753c138263981a5698 ]
+
+Add quirk orientation for AYA NEO Founder. The name appears with spaces in
+DMI strings as other devices of the brand. The panel is the same as the
+NEXT and 2021 models. Those could not be reused as the former has VENDOR
+name as "AYANEO" without spaces and the latter has "AYADEVICE".
+
+Tested by the JELOS team that has been patching their own kernel for a
+while now and confirmed by users in the AYA NEO and ChimeraOS discord
+servers.
+
+Signed-off-by: Joaquín Ignacio Aramendía <samsagax@gmail.com>
+Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/f71889a0b39f13f4b78481bd030377ca15035680.1726492131.git.tjakobi@math.uni-bielefeld.de
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 4864d8406db41..01a33d33c4aaf 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -202,6 +202,12 @@ static const struct dmi_system_id orientation_data[] = {
+                 DMI_MATCH(DMI_PRODUCT_NAME, "AIR"),
+               },
+               .driver_data = (void *)&lcd1080x1920_leftside_up,
++      }, {    /* AYA NEO Founder */
++              .matches = {
++                DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYA NEO"),
++                DMI_MATCH(DMI_PRODUCT_NAME, "AYA NEO Founder"),
++              },
++              .driver_data = (void *)&lcd800x1280_rightside_up,
+       }, {    /* AYA NEO NEXT */
+               .matches = {
+                 DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"),
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-panel-orientation-quirks-add-quirk-for-aya-neo-g.patch b/queue-6.12/drm-panel-orientation-quirks-add-quirk-for-aya-neo-g.patch
new file mode 100644 (file)
index 0000000..d3973c1
--- /dev/null
@@ -0,0 +1,52 @@
+From 525f6d94c16402f1bc06172d42f65739886639c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 15:18:55 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joaquín Ignacio Aramendía <samsagax@gmail.com>
+
+[ Upstream commit 428656feb972ca99200fc127b5aecb574efd9d3d ]
+
+Add quirk orientation for AYA NEO GEEK. The name appears without
+spaces in DMI strings. The board name is completely different to
+the previous models making it difficult to reuse their quirks
+despite being the same resolution and using the same orientation.
+
+Tested by the JELOS team that has been patching their own kernel for a
+while now and confirmed by users in the AYA NEO and ChimeraOS discord
+servers.
+
+Signed-off-by: Joaquín Ignacio Aramendía <samsagax@gmail.com>
+Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/40350b0d63fe2b54e7cba1e14be50917203f0079.1726492131.git.tjakobi@math.uni-bielefeld.de
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 01a33d33c4aaf..4a73821b81f6f 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -208,6 +208,12 @@ static const struct dmi_system_id orientation_data[] = {
+                 DMI_MATCH(DMI_PRODUCT_NAME, "AYA NEO Founder"),
+               },
+               .driver_data = (void *)&lcd800x1280_rightside_up,
++      }, {    /* AYA NEO GEEK */
++              .matches = {
++                DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"),
++                DMI_MATCH(DMI_PRODUCT_NAME, "GEEK"),
++              },
++              .driver_data = (void *)&lcd800x1280_rightside_up,
+       }, {    /* AYA NEO NEXT */
+               .matches = {
+                 DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"),
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-panel-simple-add-microchip-ac69t88a-lvds-display.patch b/queue-6.12/drm-panel-simple-add-microchip-ac69t88a-lvds-display.patch
new file mode 100644 (file)
index 0000000..3ef90dd
--- /dev/null
@@ -0,0 +1,72 @@
+From 4b625fbb8717f486c94338b95068210532d73cd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2024 14:45:48 +0530
+Subject: drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
+
+From: Manikandan Muralidharan <manikandan.m@microchip.com>
+
+[ Upstream commit 40da1463cd6879f542238b36c1148f517927c595 ]
+
+Add support for Microchip AC69T88A 5 inch TFT LCD 800x480
+Display module with LVDS interface.The panel uses the Sitronix
+ST7262 800x480 Display driver
+
+Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
+Signed-off-by: Dharma Balasubiramani <dharma.b@microchip.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240919091548.430285-2-manikandan.m@microchip.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 86735430462fa..06381c6282097 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -4565,6 +4565,31 @@ static const struct panel_desc yes_optoelectronics_ytc700tlag_05_201c = {
+       .connector_type = DRM_MODE_CONNECTOR_LVDS,
+ };
++static const struct drm_display_mode mchp_ac69t88a_mode = {
++      .clock = 25000,
++      .hdisplay = 800,
++      .hsync_start = 800 + 88,
++      .hsync_end = 800 + 88 + 5,
++      .htotal = 800 + 88 + 5 + 40,
++      .vdisplay = 480,
++      .vsync_start = 480 + 23,
++      .vsync_end = 480 + 23 + 5,
++      .vtotal = 480 + 23 + 5 + 1,
++};
++
++static const struct panel_desc mchp_ac69t88a = {
++      .modes = &mchp_ac69t88a_mode,
++      .num_modes = 1,
++      .bpc = 8,
++      .size = {
++              .width = 108,
++              .height = 65,
++      },
++      .bus_flags = DRM_BUS_FLAG_DE_HIGH,
++      .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA,
++      .connector_type = DRM_MODE_CONNECTOR_LVDS,
++};
++
+ static const struct drm_display_mode arm_rtsm_mode[] = {
+       {
+               .clock = 65000,
+@@ -5048,6 +5073,9 @@ static const struct of_device_id platform_of_match[] = {
+       }, {
+               .compatible = "yes-optoelectronics,ytc700tlag-05-201c",
+               .data = &yes_optoelectronics_ytc700tlag_05_201c,
++      }, {
++              .compatible = "microchip,ac69t88a",
++              .data = &mchp_ac69t88a,
+       }, {
+               /* Must be the last entry */
+               .compatible = "panel-dpi",
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-panic-add-abgr2101010-support.patch b/queue-6.12/drm-panic-add-abgr2101010-support.patch
new file mode 100644 (file)
index 0000000..a3748d8
--- /dev/null
@@ -0,0 +1,50 @@
+From e8bde725b8086e47d07337a1f221cbe37905a875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 20:39:47 +0200
+Subject: drm/panic: Add ABGR2101010 support
+
+From: Jocelyn Falempe <jfalempe@redhat.com>
+
+[ Upstream commit 04596969eea9e73b64d63be52aabfddb382e9ce6 ]
+
+Add support for ABGR2101010, used by the nouveau driver.
+
+Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241022185553.1103384-2-jfalempe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panic.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
+index 74412b7bf936c..0a9ecc1380d2a 100644
+--- a/drivers/gpu/drm/drm_panic.c
++++ b/drivers/gpu/drm/drm_panic.c
+@@ -209,6 +209,14 @@ static u32 convert_xrgb8888_to_argb2101010(u32 pix)
+       return GENMASK(31, 30) /* set alpha bits */ | pix | ((pix >> 8) & 0x00300C03);
+ }
++static u32 convert_xrgb8888_to_abgr2101010(u32 pix)
++{
++      pix = ((pix & 0x00FF0000) >> 14) |
++            ((pix & 0x0000FF00) << 4) |
++            ((pix & 0x000000FF) << 22);
++      return GENMASK(31, 30) /* set alpha bits */ | pix | ((pix >> 8) & 0x00300C03);
++}
++
+ /*
+  * convert_from_xrgb8888 - convert one pixel from xrgb8888 to the desired format
+  * @color: input color, in xrgb8888 format
+@@ -242,6 +250,8 @@ static u32 convert_from_xrgb8888(u32 color, u32 format)
+               return convert_xrgb8888_to_xrgb2101010(color);
+       case DRM_FORMAT_ARGB2101010:
+               return convert_xrgb8888_to_argb2101010(color);
++      case DRM_FORMAT_ABGR2101010:
++              return convert_xrgb8888_to_abgr2101010(color);
+       default:
+               WARN_ONCE(1, "Can't convert to %p4cc\n", &format);
+               return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-radeon-r600_cs-fix-possible-int-overflow-in-r600.patch b/queue-6.12/drm-radeon-r600_cs-fix-possible-int-overflow-in-r600.patch
new file mode 100644 (file)
index 0000000..a64a000
--- /dev/null
@@ -0,0 +1,40 @@
+From a715e8edd923e5ea20817346d7314fa4f182a031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2024 18:07:19 +0300
+Subject: drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
+
+From: Igor Artemiev <Igor.A.Artemiev@mcst.ru>
+
+[ Upstream commit a1e2da6a5072f8abe5b0feaa91a5bcd9dc544a04 ]
+
+It is possible, although unlikely, that an integer overflow will occur
+when the result of radeon_get_ib_value() is shifted to the left.
+
+Avoid it by casting one of the operands to larger data type (u64).
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Signed-off-by: Igor Artemiev <Igor.A.Artemiev@mcst.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index 1b2d31c4d77ca..ac77d1246b945 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -2104,7 +2104,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,
+                               return -EINVAL;
+                       }
+-                      offset = radeon_get_ib_value(p, idx+1) << 8;
++                      offset = (u64)radeon_get_ib_value(p, idx+1) << 8;
+                       if (offset != track->vgt_strmout_bo_offset[idx_value]) {
+                               DRM_ERROR("bad STRMOUT_BASE_UPDATE, bo offset does not match: 0x%llx, 0x%x\n",
+                                         offset, track->vgt_strmout_bo_offset[idx_value]);
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-sched-memset-job-in-drm_sched_job_init.patch b/queue-6.12/drm-sched-memset-job-in-drm_sched_job_init.patch
new file mode 100644 (file)
index 0000000..33680d1
--- /dev/null
@@ -0,0 +1,56 @@
+From d0a6c893de0172427064e39be400a23b0ba5ffec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 12:50:28 +0200
+Subject: drm/sched: memset() 'job' in drm_sched_job_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philipp Stanner <pstanner@redhat.com>
+
+[ Upstream commit 2320c9e6a768d135c7b0039995182bb1a4e4fd22 ]
+
+drm_sched_job_init() has no control over how users allocate struct
+drm_sched_job. Unfortunately, the function can also not set some struct
+members such as job->sched.
+
+This could theoretically lead to UB by users dereferencing the struct's
+pointer members too early.
+
+It is easier to debug such issues if these pointers are initialized to
+NULL, so dereferencing them causes a NULL pointer exception.
+Accordingly, drm_sched_entity_init() does precisely that and initializes
+its struct with memset().
+
+Initialize parameter "job" to 0 in drm_sched_job_init().
+
+Signed-off-by: Philipp Stanner <pstanner@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241021105028.19794-2-pstanner@redhat.com
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/scheduler/sched_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
+index e97c6c60bc96e..416590ea0dc3d 100644
+--- a/drivers/gpu/drm/scheduler/sched_main.c
++++ b/drivers/gpu/drm/scheduler/sched_main.c
+@@ -803,6 +803,14 @@ int drm_sched_job_init(struct drm_sched_job *job,
+               return -EINVAL;
+       }
++      /*
++       * We don't know for sure how the user has allocated. Thus, zero the
++       * struct so that unallowed (i.e., too early) usage of pointers that
++       * this function does not set is guaranteed to lead to a NULL pointer
++       * exception instead of UB.
++       */
++      memset(job, 0, sizeof(*job));
++
+       job->entity = entity;
+       job->credits = credits;
+       job->s_fence = drm_sched_fence_alloc(entity, owner);
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-vc4-hdmi-avoid-log-spam-for-audio-start-failure.patch b/queue-6.12/drm-vc4-hdmi-avoid-log-spam-for-audio-start-failure.patch
new file mode 100644 (file)
index 0000000..d2c54d4
--- /dev/null
@@ -0,0 +1,46 @@
+From 5801a6137ec71d5bf044a498f591ca3c427f4838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:28 +0100
+Subject: drm/vc4: hdmi: Avoid log spam for audio start failure
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit b4e5646178e86665f5caef2894578600f597098a ]
+
+We regularly get dmesg error reports of:
+[   18.184066] hdmi-audio-codec hdmi-audio-codec.3.auto: ASoC: error at snd_soc_dai_startup on i2s-hifi: -19
+[   18.184098]  MAI: soc_pcm_open() failed (-19)
+
+These are generated for any disconnected hdmi interface when pulseaudio
+attempts to open the associated ALSA device (numerous times). Each open
+generates a kernel error message, generating general log spam.
+
+The error messages all come from _soc_pcm_ret in sound/soc/soc-pcm.c#L39
+which suggests returning ENOTSUPP, rather that ENODEV will be quiet.
+And indeed it is.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-5-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 2d7d3e90f3be4..7e0a5ea7ab859 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1924,7 +1924,7 @@ static int vc4_hdmi_audio_startup(struct device *dev, void *data)
+       }
+       if (!vc4_hdmi_audio_can_stream(vc4_hdmi)) {
+-              ret = -ENODEV;
++              ret = -ENOTSUPP;
+               goto out_dev_exit;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-vc4-hvs-set-axi-panic-modes-for-the-hvs.patch b/queue-6.12/drm-vc4-hvs-set-axi-panic-modes-for-the-hvs.patch
new file mode 100644 (file)
index 0000000..42ebe40
--- /dev/null
@@ -0,0 +1,51 @@
+From 2c57f41e4a4783eeedbce4c99978e52b015bf101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:30 +0100
+Subject: drm/vc4: hvs: Set AXI panic modes for the HVS
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 014eccc9da7bfc76a3107fceea37dd60f1d63630 ]
+
+The HVS can change AXI request mode based on how full the COB
+FIFOs are.
+Until now the vc4 driver has been relying on the firmware to
+have set these to sensible values.
+
+With HVS channel 2 now being used for live video, change the
+panic mode for all channels to be explicitly set by the driver,
+and the same for all channels.
+
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-7-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index 863539e1f7e04..c389e82463bfd 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -963,6 +963,17 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
+                             SCALER_DISPCTRL_SCLEIRQ);
++      /* Set AXI panic mode.
++       * VC4 panics when < 2 lines in FIFO.
++       * VC5 panics when less than 1 line in the FIFO.
++       */
++      dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK |
++                    SCALER_DISPCTRL_PANIC1_MASK |
++                    SCALER_DISPCTRL_PANIC2_MASK);
++      dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0);
++      dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1);
++      dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2);
++
+       /* Set AXI panic mode.
+        * VC4 panics when < 2 lines in FIFO.
+        * VC5 panics when less than 1 line in the FIFO.
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-xe-guc-ct-flush-g2h-worker-in-case-of-g2h-respon.patch b/queue-6.12/drm-xe-guc-ct-flush-g2h-worker-in-case-of-g2h-respon.patch
new file mode 100644 (file)
index 0000000..f25de7a
--- /dev/null
@@ -0,0 +1,67 @@
+From 72c96519d298b651014f1f2803a257b6071ffc7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 16:44:10 +0530
+Subject: drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
+
+From: Badal Nilawar <badal.nilawar@intel.com>
+
+[ Upstream commit e5152723380404acb8175e0777b1cea57f319a01 ]
+
+In case if g2h worker doesn't get opportunity to within specified
+timeout delay then flush the g2h worker explicitly.
+
+v2:
+  - Describe change in the comment and add TODO (Matt B/John H)
+  - Add xe_gt_warn on fence done after G2H flush (John H)
+v3:
+  - Updated the comment with root cause
+  - Clean up xe_gt_warn message (John H)
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1620
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2902
+Signed-off-by: Badal Nilawar <badal.nilawar@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Acked-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241017111410.2553784-2-badal.nilawar@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_ct.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c
+index 9c505d3517cd1..cd6a5f09d631e 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ct.c
++++ b/drivers/gpu/drm/xe/xe_guc_ct.c
+@@ -906,6 +906,24 @@ static int guc_ct_send_recv(struct xe_guc_ct *ct, const u32 *action, u32 len,
+               }
+       }
++      /*
++       * Occasionally it is seen that the G2H worker starts running after a delay of more than
++       * a second even after being queued and activated by the Linux workqueue subsystem. This
++       * leads to G2H timeout error. The root cause of issue lies with scheduling latency of
++       * Lunarlake Hybrid CPU. Issue dissappears if we disable Lunarlake atom cores from BIOS
++       * and this is beyond xe kmd.
++       *
++       * TODO: Drop this change once workqueue scheduling delay issue is fixed on LNL Hybrid CPU.
++       */
++      if (!ret) {
++              flush_work(&ct->g2h_worker);
++              if (g2h_fence.done) {
++                      xe_gt_warn(gt, "G2H fence %u, action %04x, done\n",
++                                 g2h_fence.seqno, action[0]);
++                      ret = 1;
++              }
++      }
++
+       /*
+        * Ensure we serialize with completion side to prevent UAF with fence going out of scope on
+        * the stack, since we have no clue if it will fire after the timeout before we can erase
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-xe-pciid-add-new-pci-id-for-arl.patch b/queue-6.12/drm-xe-pciid-add-new-pci-id-for-arl.patch
new file mode 100644 (file)
index 0000000..2967a19
--- /dev/null
@@ -0,0 +1,40 @@
+From 3a0eeb5dd60054f0e50c2c63201a151da029ce23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 17:29:06 +0530
+Subject: drm/xe/pciid: Add new PCI id for ARL
+
+From: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com>
+
+[ Upstream commit 35667a0330612bb25a689e4d3a687d47cede1d7a ]
+
+Add new PCI id for ARL platform.
+
+v2: Fix typo in PCI id (SaiTeja)
+
+Signed-off-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com>
+Reviewed-by: Sai Teja Pottumuttu <sai.teja.pottumuttu@intel.com>
+Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240912115906.2730577-1-dnyaneshwar.bhadane@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/intel/xe_pciids.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/drm/intel/xe_pciids.h b/include/drm/intel/xe_pciids.h
+index 59233eb008628..4ba88d2dccd4b 100644
+--- a/include/drm/intel/xe_pciids.h
++++ b/include/drm/intel/xe_pciids.h
+@@ -179,7 +179,8 @@
+       MACRO__(0x7D41, ## __VA_ARGS__),        \
+       MACRO__(0x7D51, ## __VA_ARGS__),        \
+       MACRO__(0x7D67, ## __VA_ARGS__),        \
+-      MACRO__(0x7DD1, ## __VA_ARGS__)
++      MACRO__(0x7DD1, ## __VA_ARGS__),        \
++      MACRO__(0xB640, ## __VA_ARGS__)
+ /* MTL */
+ #define XE_MTL_IDS(MACRO__, ...)              \
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-xe-pciids-add-pvc-s-pci-device-id-macros.patch b/queue-6.12/drm-xe-pciids-add-pvc-s-pci-device-id-macros.patch
new file mode 100644 (file)
index 0000000..338d923
--- /dev/null
@@ -0,0 +1,58 @@
+From 2cbb49e880cde33a4e081484c980c84d1c0b2773 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 15:06:03 +0300
+Subject: drm/xe/pciids: Add PVC's PCI device ID macros
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rodrigo Vivi <rodrigo.vivi@intel.com>
+
+[ Upstream commit 5b40191152282e1f25d7b9826bcda41be927b39f ]
+
+Add PVC PCI IDs to the xe_pciids.h header. They're not yet used in the
+driver.
+
+Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/6ac1829493a53a3fec889c746648d627a0296892.1725624296.git.jani.nikula@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/intel/xe_pciids.h | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/include/drm/intel/xe_pciids.h b/include/drm/intel/xe_pciids.h
+index 67dad09e62bc8..59233eb008628 100644
+--- a/include/drm/intel/xe_pciids.h
++++ b/include/drm/intel/xe_pciids.h
+@@ -189,6 +189,22 @@
+       MACRO__(0x7D60, ## __VA_ARGS__),        \
+       MACRO__(0x7DD5, ## __VA_ARGS__)
++/* PVC */
++#define XE_PVC_IDS(MACRO__, ...)              \
++      MACRO__(0x0B69, ## __VA_ARGS__),        \
++      MACRO__(0x0B6E, ## __VA_ARGS__),        \
++      MACRO__(0x0BD4, ## __VA_ARGS__),        \
++      MACRO__(0x0BD5, ## __VA_ARGS__),        \
++      MACRO__(0x0BD6, ## __VA_ARGS__),        \
++      MACRO__(0x0BD7, ## __VA_ARGS__),        \
++      MACRO__(0x0BD8, ## __VA_ARGS__),        \
++      MACRO__(0x0BD9, ## __VA_ARGS__),        \
++      MACRO__(0x0BDA, ## __VA_ARGS__),        \
++      MACRO__(0x0BDB, ## __VA_ARGS__),        \
++      MACRO__(0x0BE0, ## __VA_ARGS__),        \
++      MACRO__(0x0BE1, ## __VA_ARGS__),        \
++      MACRO__(0x0BE5, ## __VA_ARGS__)
++
+ #define XE_LNL_IDS(MACRO__, ...) \
+       MACRO__(0x6420, ## __VA_ARGS__), \
+       MACRO__(0x64A0, ## __VA_ARGS__), \
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-xe-pciids-separate-arl-and-mtl-pci-ids.patch b/queue-6.12/drm-xe-pciids-separate-arl-and-mtl-pci-ids.patch
new file mode 100644 (file)
index 0000000..68021fa
--- /dev/null
@@ -0,0 +1,66 @@
+From dd08092041b6d3e638d4625a5c3b5aff024483fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 12:46:49 +0300
+Subject: drm/xe/pciids: separate ARL and MTL PCI IDs
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit cdb56a63f7eef34e89b045fc8bcae8d326bbdb19 ]
+
+Avoid including PCI IDs for one platform to the PCI IDs of another. It's
+more clear to deal with them completely separately at the PCI ID macro
+level.
+
+Reviewed-by: Shekhar Chauhan <shekhar.chauhan@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/a30cb0da7694a8eccceba66d676ac59aa0e96176.1725443121.git.jani.nikula@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pci.c   |  1 +
+ include/drm/intel/xe_pciids.h | 13 ++++++++-----
+ 2 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pci.c b/drivers/gpu/drm/xe/xe_pci.c
+index 8563206f643e6..025d649434673 100644
+--- a/drivers/gpu/drm/xe/xe_pci.c
++++ b/drivers/gpu/drm/xe/xe_pci.c
+@@ -388,6 +388,7 @@ static const struct pci_device_id pciidlist[] = {
+       XE_RPLS_IDS(INTEL_VGA_DEVICE, &adl_s_desc),
+       XE_DG1_IDS(INTEL_VGA_DEVICE, &dg1_desc),
+       XE_ATS_M_IDS(INTEL_VGA_DEVICE, &ats_m_desc),
++      XE_ARL_IDS(INTEL_VGA_DEVICE, &mtl_desc),
+       XE_DG2_IDS(INTEL_VGA_DEVICE, &dg2_desc),
+       XE_MTL_IDS(INTEL_VGA_DEVICE, &mtl_desc),
+       XE_LNL_IDS(INTEL_VGA_DEVICE, &lnl_desc),
+diff --git a/include/drm/intel/xe_pciids.h b/include/drm/intel/xe_pciids.h
+index 7ee7524141f10..67dad09e62bc8 100644
+--- a/include/drm/intel/xe_pciids.h
++++ b/include/drm/intel/xe_pciids.h
+@@ -174,16 +174,19 @@
+       XE_ATS_M150_IDS(MACRO__, ## __VA_ARGS__),\
+       XE_ATS_M75_IDS(MACRO__, ## __VA_ARGS__)
+-/* MTL / ARL */
++/* ARL */
++#define XE_ARL_IDS(MACRO__, ...)              \
++      MACRO__(0x7D41, ## __VA_ARGS__),        \
++      MACRO__(0x7D51, ## __VA_ARGS__),        \
++      MACRO__(0x7D67, ## __VA_ARGS__),        \
++      MACRO__(0x7DD1, ## __VA_ARGS__)
++
++/* MTL */
+ #define XE_MTL_IDS(MACRO__, ...)              \
+       MACRO__(0x7D40, ## __VA_ARGS__),        \
+-      MACRO__(0x7D41, ## __VA_ARGS__),        \
+       MACRO__(0x7D45, ## __VA_ARGS__),        \
+-      MACRO__(0x7D51, ## __VA_ARGS__),        \
+       MACRO__(0x7D55, ## __VA_ARGS__),        \
+       MACRO__(0x7D60, ## __VA_ARGS__),        \
+-      MACRO__(0x7D67, ## __VA_ARGS__),        \
+-      MACRO__(0x7DD1, ## __VA_ARGS__),        \
+       MACRO__(0x7DD5, ## __VA_ARGS__)
+ #define XE_LNL_IDS(MACRO__, ...) \
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-xe-pciids-separate-rpl-u-and-rpl-p-pci-ids.patch b/queue-6.12/drm-xe-pciids-separate-rpl-u-and-rpl-p-pci-ids.patch
new file mode 100644 (file)
index 0000000..fcc7afe
--- /dev/null
@@ -0,0 +1,49 @@
+From 43748c729c9804fdc0b9dd4ecfcae474f52db906 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 12:46:48 +0300
+Subject: drm/xe/pciids: separate RPL-U and RPL-P PCI IDs
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit d454902a690db47f1880f963514bbf0fc7a129a8 ]
+
+Avoid including PCI IDs for one platform to the PCI IDs of another. It's
+more clear to deal with them completely separately at the PCI ID macro
+level.
+
+Reviewed-by: Sai Teja Pottumuttu <sai.teja.pottumuttu@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/4868d36fbfa8c38ea2d490bca82cf6370b8d65dd.1725443121.git.jani.nikula@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pci.c   | 1 +
+ include/drm/intel/xe_pciids.h | 1 -
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pci.c b/drivers/gpu/drm/xe/xe_pci.c
+index 5e962e72c97ea..8563206f643e6 100644
+--- a/drivers/gpu/drm/xe/xe_pci.c
++++ b/drivers/gpu/drm/xe/xe_pci.c
+@@ -383,6 +383,7 @@ static const struct pci_device_id pciidlist[] = {
+       XE_ADLS_IDS(INTEL_VGA_DEVICE, &adl_s_desc),
+       XE_ADLP_IDS(INTEL_VGA_DEVICE, &adl_p_desc),
+       XE_ADLN_IDS(INTEL_VGA_DEVICE, &adl_n_desc),
++      XE_RPLU_IDS(INTEL_VGA_DEVICE, &adl_p_desc),
+       XE_RPLP_IDS(INTEL_VGA_DEVICE, &adl_p_desc),
+       XE_RPLS_IDS(INTEL_VGA_DEVICE, &adl_s_desc),
+       XE_DG1_IDS(INTEL_VGA_DEVICE, &dg1_desc),
+diff --git a/include/drm/intel/xe_pciids.h b/include/drm/intel/xe_pciids.h
+index 644872a35c352..7ee7524141f10 100644
+--- a/include/drm/intel/xe_pciids.h
++++ b/include/drm/intel/xe_pciids.h
+@@ -120,7 +120,6 @@
+ /* RPL-P */
+ #define XE_RPLP_IDS(MACRO__, ...)             \
+-      XE_RPLU_IDS(MACRO__, ## __VA_ARGS__),   \
+       MACRO__(0xA720, ## __VA_ARGS__),        \
+       MACRO__(0xA7A0, ## __VA_ARGS__),        \
+       MACRO__(0xA7A8, ## __VA_ARGS__),        \
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-xe-ptl-l3bank-mask-is-not-available-on-the-media.patch b/queue-6.12/drm-xe-ptl-l3bank-mask-is-not-available-on-the-media.patch
new file mode 100644 (file)
index 0000000..01ba3fc
--- /dev/null
@@ -0,0 +1,192 @@
+From b54c0a967d12a0bee3b26a8559d5f4ce0303ac71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 08:41:44 -0700
+Subject: drm/xe/ptl: L3bank mask is not available on the media GT
+
+From: Shekhar Chauhan <shekhar.chauhan@intel.com>
+
+[ Upstream commit 9ab440a9d0426cf7842240891cc457155db1a97e ]
+
+On PTL platforms with media version 30.00, the fuse registers for
+reporting L3 bank availability to the GT just read out as ~0 and do not
+provide proper values.  Xe does not use the L3 bank mask for anything
+internally; it only passes the mask through to userspace via the GT
+topology query.
+
+Since we don't have any way to get the real L3 bank mask, we don't want
+to pass garbage to userspace.  Passing a zeroed mask or a copy of the
+primary GT's L3 bank mask would also be inaccurate and likely to cause
+confusion for userspace.  The best approach is to simply not include L3
+in the list of masks returned by the topology query in cases where we
+aren't able to provide a meaningful value.  This won't change the
+behavior for any existing platforms (where we can always obtain L3 masks
+successfully for all GTs), it will only prevent us from mis-reporting
+bad information on upcoming platform(s).
+
+There's a good chance this will become a formal workaround in the
+future, but for now we don't have a lineage number so "no_media_l3" is
+used in place of a lineage as the OOB workaround descriptor.
+
+v2:
+ - Re-calculate query size to properly match data returned. (Gustavo)
+ - Update kerneldoc to clarify that the L3bank mask may not be included
+   in the query results if the hardware doesn't make it available.
+   (Gustavo)
+
+Cc: Matt Atwood <matthew.s.atwood@intel.com>
+Cc: Gustavo Sousa <gustavo.sousa@intel.com>
+Signed-off-by: Shekhar Chauhan <shekhar.chauhan@intel.com>
+Co-developed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Acked-by: Francois Dugast <francois.dugast@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241007154143.2021124-2-matthew.d.roper@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_gt_topology.c | 14 ++++++++++
+ drivers/gpu/drm/xe/xe_query.c       | 42 +++++++++++++++++++++--------
+ drivers/gpu/drm/xe/xe_wa_oob.rules  |  1 +
+ include/uapi/drm/xe_drm.h           |  4 ++-
+ 4 files changed, 49 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_gt_topology.c b/drivers/gpu/drm/xe/xe_gt_topology.c
+index 0662f71c6ede7..3e113422b88de 100644
+--- a/drivers/gpu/drm/xe/xe_gt_topology.c
++++ b/drivers/gpu/drm/xe/xe_gt_topology.c
+@@ -5,6 +5,7 @@
+ #include "xe_gt_topology.h"
++#include <generated/xe_wa_oob.h>
+ #include <linux/bitmap.h>
+ #include <linux/compiler.h>
+@@ -12,6 +13,7 @@
+ #include "xe_assert.h"
+ #include "xe_gt.h"
+ #include "xe_mmio.h"
++#include "xe_wa.h"
+ static void
+ load_dss_mask(struct xe_gt *gt, xe_dss_mask_t mask, int numregs, ...)
+@@ -129,6 +131,18 @@ load_l3_bank_mask(struct xe_gt *gt, xe_l3_bank_mask_t l3_bank_mask)
+       struct xe_device *xe = gt_to_xe(gt);
+       u32 fuse3 = xe_mmio_read32(gt, MIRROR_FUSE3);
++      /*
++       * PTL platforms with media version 30.00 do not provide proper values
++       * for the media GT's L3 bank registers.  Skip the readout since we
++       * don't have any way to obtain real values.
++       *
++       * This may get re-described as an official workaround in the future,
++       * but there's no tracking number assigned yet so we use a custom
++       * OOB workaround descriptor.
++       */
++      if (XE_WA(gt, no_media_l3))
++              return;
++
+       if (GRAPHICS_VER(xe) >= 20) {
+               xe_l3_bank_mask_t per_node = {};
+               u32 meml3_en = REG_FIELD_GET(XE2_NODE_ENABLE_MASK, fuse3);
+diff --git a/drivers/gpu/drm/xe/xe_query.c b/drivers/gpu/drm/xe/xe_query.c
+index 848da8e68c7a8..1c96375bd7df7 100644
+--- a/drivers/gpu/drm/xe/xe_query.c
++++ b/drivers/gpu/drm/xe/xe_query.c
+@@ -9,6 +9,7 @@
+ #include <linux/sched/clock.h>
+ #include <drm/ttm/ttm_placement.h>
++#include <generated/xe_wa_oob.h>
+ #include <uapi/drm/xe_drm.h>
+ #include "regs/xe_engine_regs.h"
+@@ -23,6 +24,7 @@
+ #include "xe_macros.h"
+ #include "xe_mmio.h"
+ #include "xe_ttm_vram_mgr.h"
++#include "xe_wa.h"
+ static const u16 xe_to_user_engine_class[] = {
+       [XE_ENGINE_CLASS_RENDER] = DRM_XE_ENGINE_CLASS_RENDER,
+@@ -458,12 +460,23 @@ static int query_hwconfig(struct xe_device *xe,
+ static size_t calc_topo_query_size(struct xe_device *xe)
+ {
+-      return xe->info.gt_count *
+-              (4 * sizeof(struct drm_xe_query_topology_mask) +
+-               sizeof_field(struct xe_gt, fuse_topo.g_dss_mask) +
+-               sizeof_field(struct xe_gt, fuse_topo.c_dss_mask) +
+-               sizeof_field(struct xe_gt, fuse_topo.l3_bank_mask) +
+-               sizeof_field(struct xe_gt, fuse_topo.eu_mask_per_dss));
++      struct xe_gt *gt;
++      size_t query_size = 0;
++      int id;
++
++      for_each_gt(gt, xe, id) {
++              query_size += 3 * sizeof(struct drm_xe_query_topology_mask) +
++                      sizeof_field(struct xe_gt, fuse_topo.g_dss_mask) +
++                      sizeof_field(struct xe_gt, fuse_topo.c_dss_mask) +
++                      sizeof_field(struct xe_gt, fuse_topo.eu_mask_per_dss);
++
++              /* L3bank mask may not be available for some GTs */
++              if (!XE_WA(gt, no_media_l3))
++                      query_size += sizeof(struct drm_xe_query_topology_mask) +
++                              sizeof_field(struct xe_gt, fuse_topo.l3_bank_mask);
++      }
++
++      return query_size;
+ }
+ static int copy_mask(void __user **ptr,
+@@ -516,11 +529,18 @@ static int query_gt_topology(struct xe_device *xe,
+               if (err)
+                       return err;
+-              topo.type = DRM_XE_TOPO_L3_BANK;
+-              err = copy_mask(&query_ptr, &topo, gt->fuse_topo.l3_bank_mask,
+-                              sizeof(gt->fuse_topo.l3_bank_mask));
+-              if (err)
+-                      return err;
++              /*
++               * If the kernel doesn't have a way to obtain a correct L3bank
++               * mask, then it's better to omit L3 from the query rather than
++               * reporting bogus or zeroed information to userspace.
++               */
++              if (!XE_WA(gt, no_media_l3)) {
++                      topo.type = DRM_XE_TOPO_L3_BANK;
++                      err = copy_mask(&query_ptr, &topo, gt->fuse_topo.l3_bank_mask,
++                                      sizeof(gt->fuse_topo.l3_bank_mask));
++                      if (err)
++                              return err;
++              }
+               topo.type = gt->fuse_topo.eu_type == XE_GT_EU_TYPE_SIMD16 ?
+                       DRM_XE_TOPO_SIMD16_EU_PER_DSS :
+diff --git a/drivers/gpu/drm/xe/xe_wa_oob.rules b/drivers/gpu/drm/xe/xe_wa_oob.rules
+index 920ca50601466..0154fbe154e9a 100644
+--- a/drivers/gpu/drm/xe/xe_wa_oob.rules
++++ b/drivers/gpu/drm/xe/xe_wa_oob.rules
+@@ -37,3 +37,4 @@
+ 16023588340   GRAPHICS_VERSION(2001)
+ 14019789679   GRAPHICS_VERSION(1255)
+               GRAPHICS_VERSION_RANGE(1270, 2004)
++no_media_l3   MEDIA_VERSION(3000)
+diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h
+index b6fbe4988f2e9..c4182e95a6195 100644
+--- a/include/uapi/drm/xe_drm.h
++++ b/include/uapi/drm/xe_drm.h
+@@ -512,7 +512,9 @@ struct drm_xe_query_gt_list {
+  *    containing the following in mask:
+  *    ``DSS_COMPUTE    ff ff ff ff 00 00 00 00``
+  *    means 32 DSS are available for compute.
+- *  - %DRM_XE_TOPO_L3_BANK - To query the mask of enabled L3 banks
++ *  - %DRM_XE_TOPO_L3_BANK - To query the mask of enabled L3 banks.  This type
++ *    may be omitted if the driver is unable to query the mask from the
++ *    hardware.
+  *  - %DRM_XE_TOPO_EU_PER_DSS - To query the mask of Execution Units (EU)
+  *    available per Dual Sub Slices (DSS). For example a query response
+  *    containing the following in mask:
+-- 
+2.43.0
+
diff --git a/queue-6.12/drm-xe-xe3-add-initial-set-of-workarounds.patch b/queue-6.12/drm-xe-xe3-add-initial-set-of-workarounds.patch
new file mode 100644 (file)
index 0000000..a2dd8d3
--- /dev/null
@@ -0,0 +1,137 @@
+From 3d4eaf189bf9e33f7bb3d7c21ca2c28174edecfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 13:46:26 -0700
+Subject: drm/xe/xe3: Add initial set of workarounds
+
+From: Gustavo Sousa <gustavo.sousa@intel.com>
+
+[ Upstream commit 081cb8948cfe322076cd23f22f85ba68f73e2c4b ]
+
+Implement the initial set of workarounds for Xe3 IPs.
+
+Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Signed-off-by: Matt Atwood <matthew.s.atwood@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241008204626.55802-2-matthew.s.atwood@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/regs/xe_engine_regs.h |  1 +
+ drivers/gpu/drm/xe/regs/xe_gt_regs.h     |  3 ++
+ drivers/gpu/drm/xe/xe_wa.c               | 47 ++++++++++++++++++++++++
+ drivers/gpu/drm/xe/xe_wa_oob.rules       |  1 +
+ 4 files changed, 52 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/regs/xe_engine_regs.h b/drivers/gpu/drm/xe/regs/xe_engine_regs.h
+index 81b71903675e0..7c78496e6213c 100644
+--- a/drivers/gpu/drm/xe/regs/xe_engine_regs.h
++++ b/drivers/gpu/drm/xe/regs/xe_engine_regs.h
+@@ -186,6 +186,7 @@
+ #define VDBOX_CGCTL3F10(base)                 XE_REG((base) + 0x3f10)
+ #define   IECPUNIT_CLKGATE_DIS                        REG_BIT(22)
++#define   RAMDFTUNIT_CLKGATE_DIS              REG_BIT(9)
+ #define VDBOX_CGCTL3F18(base)                 XE_REG((base) + 0x3f18)
+ #define   ALNUNIT_CLKGATE_DIS                 REG_BIT(13)
+diff --git a/drivers/gpu/drm/xe/regs/xe_gt_regs.h b/drivers/gpu/drm/xe/regs/xe_gt_regs.h
+index bd604b9f08e4f..5404de2aea545 100644
+--- a/drivers/gpu/drm/xe/regs/xe_gt_regs.h
++++ b/drivers/gpu/drm/xe/regs/xe_gt_regs.h
+@@ -286,6 +286,9 @@
+ #define   GAMTLBVEBOX0_CLKGATE_DIS            REG_BIT(16)
+ #define   LTCDD_CLKGATE_DIS                   REG_BIT(10)
++#define UNSLCGCTL9454                         XE_REG(0x9454)
++#define   LSCFE_CLKGATE_DIS                   REG_BIT(4)
++
+ #define XEHP_SLICE_UNIT_LEVEL_CLKGATE         XE_REG_MCR(0x94d4)
+ #define   L3_CR2X_CLKGATE_DIS                 REG_BIT(17)
+ #define   L3_CLKGATE_DIS                      REG_BIT(16)
+diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c
+index 353936a0f877d..37e592b2bf062 100644
+--- a/drivers/gpu/drm/xe/xe_wa.c
++++ b/drivers/gpu/drm/xe/xe_wa.c
+@@ -251,6 +251,34 @@ static const struct xe_rtp_entry_sr gt_was[] = {
+         XE_RTP_ENTRY_FLAG(FOREACH_ENGINE),
+       },
++      /* Xe3_LPG */
++
++      { XE_RTP_NAME("14021871409"),
++        XE_RTP_RULES(GRAPHICS_VERSION(3000), GRAPHICS_STEP(A0, B0)),
++        XE_RTP_ACTIONS(SET(UNSLCGCTL9454, LSCFE_CLKGATE_DIS))
++      },
++
++      /* Xe3_LPM */
++
++      { XE_RTP_NAME("16021867713"),
++        XE_RTP_RULES(MEDIA_VERSION(3000),
++                     ENGINE_CLASS(VIDEO_DECODE)),
++        XE_RTP_ACTIONS(SET(VDBOX_CGCTL3F1C(0), MFXPIPE_CLKGATE_DIS)),
++        XE_RTP_ENTRY_FLAG(FOREACH_ENGINE),
++      },
++      { XE_RTP_NAME("16021865536"),
++        XE_RTP_RULES(MEDIA_VERSION(3000),
++                     ENGINE_CLASS(VIDEO_DECODE)),
++        XE_RTP_ACTIONS(SET(VDBOX_CGCTL3F10(0), IECPUNIT_CLKGATE_DIS)),
++        XE_RTP_ENTRY_FLAG(FOREACH_ENGINE),
++      },
++      { XE_RTP_NAME("14021486841"),
++        XE_RTP_RULES(MEDIA_VERSION(3000), MEDIA_STEP(A0, B0),
++                     ENGINE_CLASS(VIDEO_DECODE)),
++        XE_RTP_ACTIONS(SET(VDBOX_CGCTL3F10(0), RAMDFTUNIT_CLKGATE_DIS)),
++        XE_RTP_ENTRY_FLAG(FOREACH_ENGINE),
++      },
++
+       {}
+ };
+@@ -567,6 +595,13 @@ static const struct xe_rtp_entry_sr engine_was[] = {
+                            XE_RTP_ACTION_FLAG(ENGINE_BASE)))
+       },
++      /* Xe3_LPG */
++
++      { XE_RTP_NAME("14021402888"),
++        XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3001), FUNC(xe_rtp_match_first_render_or_compute)),
++        XE_RTP_ACTIONS(SET(HALF_SLICE_CHICKEN7, CLEAR_OPTIMIZATION_DISABLE))
++      },
++
+       {}
+ };
+@@ -742,6 +777,18 @@ static const struct xe_rtp_entry_sr lrc_was[] = {
+         XE_RTP_ACTIONS(SET(CHICKEN_RASTER_1, DIS_CLIP_NEGATIVE_BOUNDING_BOX))
+       },
++      /* Xe3_LPG */
++      { XE_RTP_NAME("14021490052"),
++        XE_RTP_RULES(GRAPHICS_VERSION(3000), GRAPHICS_STEP(A0, B0),
++                     ENGINE_CLASS(RENDER)),
++        XE_RTP_ACTIONS(SET(FF_MODE,
++                           DIS_MESH_PARTIAL_AUTOSTRIP |
++                           DIS_MESH_AUTOSTRIP),
++                       SET(VFLSKPD,
++                           DIS_PARTIAL_AUTOSTRIP |
++                           DIS_AUTOSTRIP))
++      },
++
+       {}
+ };
+diff --git a/drivers/gpu/drm/xe/xe_wa_oob.rules b/drivers/gpu/drm/xe/xe_wa_oob.rules
+index 0154fbe154e9a..264d6e116499c 100644
+--- a/drivers/gpu/drm/xe/xe_wa_oob.rules
++++ b/drivers/gpu/drm/xe/xe_wa_oob.rules
+@@ -33,6 +33,7 @@
+               GRAPHICS_VERSION(2004)
+ 22019338487   MEDIA_VERSION(2000)
+               GRAPHICS_VERSION(2001)
++              MEDIA_VERSION(3000), MEDIA_STEP(A0, B0)
+ 22019338487_display   PLATFORM(LUNARLAKE)
+ 16023588340   GRAPHICS_VERSION(2001)
+ 14019789679   GRAPHICS_VERSION(1255)
+-- 
+2.43.0
+
diff --git a/queue-6.12/dsa-qca8k-use-nested-lock-to-avoid-splat.patch b/queue-6.12/dsa-qca8k-use-nested-lock-to-avoid-splat.patch
new file mode 100644 (file)
index 0000000..c36ad06
--- /dev/null
@@ -0,0 +1,39 @@
+From faa4ec2074cd555efb18db4c1be3bbbba0a47bad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Nov 2024 18:59:55 +0100
+Subject: dsa: qca8k: Use nested lock to avoid splat
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+[ Upstream commit 078e0d596f7b5952dad8662ace8f20ed2165e2ce ]
+
+qca8k_phy_eth_command() is used to probe the child MDIO bus while the
+parent MDIO is locked. This causes lockdep splat, reporting a possible
+deadlock. It is not an actually deadlock, because different locks are
+used. By making use of mutex_lock_nested() we can avoid this false
+positive.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20241110175955.3053664-1-andrew@lunn.ch
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
+index f8d8c70642c4f..59b4a7240b583 100644
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -673,7 +673,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
+        * We therefore need to lock the MDIO bus onto which the switch is
+        * connected.
+        */
+-      mutex_lock(&priv->bus->mdio_lock);
++      mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED);
+       /* Actually start the request:
+        * 1. Send mdio master packet
+-- 
+2.43.0
+
diff --git a/queue-6.12/epoll-annotate-racy-check.patch b/queue-6.12/epoll-annotate-racy-check.patch
new file mode 100644 (file)
index 0000000..43ebe52
--- /dev/null
@@ -0,0 +1,64 @@
+From 73b0a6101824e344da5910d140ef0c19a3e49681 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2024 11:05:16 +0200
+Subject: epoll: annotate racy check
+
+From: Christian Brauner <brauner@kernel.org>
+
+[ Upstream commit 6474353a5e3d0b2cf610153cea0c61f576a36d0a ]
+
+Epoll relies on a racy fastpath check during __fput() in
+eventpoll_release() to avoid the hit of pointlessly acquiring a
+semaphore. Annotate that race by using WRITE_ONCE() and READ_ONCE().
+
+Link: https://lore.kernel.org/r/66edfb3c.050a0220.3195df.001a.GAE@google.com
+Link: https://lore.kernel.org/r/20240925-fungieren-anbauen-79b334b00542@brauner
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reported-by: syzbot+3b6b32dc50537a49bb4a@syzkaller.appspotmail.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/eventpoll.c            | 6 ++++--
+ include/linux/eventpoll.h | 2 +-
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 1ae4542f0bd88..90fbab6b6f036 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -823,7 +823,8 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
+       to_free = NULL;
+       head = file->f_ep;
+       if (head->first == &epi->fllink && !epi->fllink.next) {
+-              file->f_ep = NULL;
++              /* See eventpoll_release() for details. */
++              WRITE_ONCE(file->f_ep, NULL);
+               if (!is_file_epoll(file)) {
+                       struct epitems_head *v;
+                       v = container_of(head, struct epitems_head, epitems);
+@@ -1603,7 +1604,8 @@ static int attach_epitem(struct file *file, struct epitem *epi)
+                       spin_unlock(&file->f_lock);
+                       goto allocate;
+               }
+-              file->f_ep = head;
++              /* See eventpoll_release() for details. */
++              WRITE_ONCE(file->f_ep, head);
+               to_free = NULL;
+       }
+       hlist_add_head_rcu(&epi->fllink, file->f_ep);
+diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
+index 3337745d81bd6..0c0d00fcd131f 100644
+--- a/include/linux/eventpoll.h
++++ b/include/linux/eventpoll.h
+@@ -42,7 +42,7 @@ static inline void eventpoll_release(struct file *file)
+        * because the file in on the way to be removed and nobody ( but
+        * eventpoll ) has still a reference to this file.
+        */
+-      if (likely(!file->f_ep))
++      if (likely(!READ_ONCE(file->f_ep)))
+               return;
+       /*
+-- 
+2.43.0
+
diff --git a/queue-6.12/ext4-partial-zero-eof-block-on-unaligned-inode-size-.patch b/queue-6.12/ext4-partial-zero-eof-block-on-unaligned-inode-size-.patch
new file mode 100644 (file)
index 0000000..5ae4d3e
--- /dev/null
@@ -0,0 +1,179 @@
+From b54b3a934209bd9c07eb809262479afb8ee68144 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2024 12:07:40 -0400
+Subject: ext4: partial zero eof block on unaligned inode size extension
+
+From: Brian Foster <bfoster@redhat.com>
+
+[ Upstream commit c7fc0366c65628fd69bfc310affec4918199aae2 ]
+
+Using mapped writes, it's technically possible to expose stale
+post-eof data on a truncate up operation. Consider the following
+example:
+
+$ xfs_io -fc "pwrite 0 2k" -c "mmap 0 4k" -c "mwrite 2k 2k" \
+       -c "truncate 8k" -c "pread -v 2k 16" <file>
+...
+00000800:  58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58  XXXXXXXXXXXXXXXX
+...
+
+This shows that the post-eof data written via mwrite lands within
+EOF after a truncate up. While this is deliberate of the test case,
+behavior is somewhat unpredictable because writeback does post-eof
+zeroing, and writeback can occur at any time in the background. For
+example, an fsync inserted between the mwrite and truncate causes
+the subsequent read to instead return zeroes. This basically means
+that there is a race window in this situation between any subsequent
+extending operation and writeback that dictates whether post-eof
+data is exposed to the file or zeroed.
+
+To prevent this problem, perform partial block zeroing as part of
+the various inode size extending operations that are susceptible to
+it. For truncate extension, zero around the original eof similar to
+how truncate down does partial zeroing of the new eof. For extension
+via writes and fallocate related operations, zero the newly exposed
+range of the file to cover any partial zeroing that must occur at
+the original and new eof blocks.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Link: https://patch.msgid.link/20240919160741.208162-2-bfoster@redhat.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c |  7 ++++++-
+ fs/ext4/inode.c   | 51 +++++++++++++++++++++++++++++++++--------------
+ 2 files changed, 42 insertions(+), 16 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 88f98dc440275..60909af2d4a53 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4482,7 +4482,7 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
+       int depth = 0;
+       struct ext4_map_blocks map;
+       unsigned int credits;
+-      loff_t epos;
++      loff_t epos, old_size = i_size_read(inode);
+       BUG_ON(!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS));
+       map.m_lblk = offset;
+@@ -4541,6 +4541,11 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
+                       if (ext4_update_inode_size(inode, epos) & 0x1)
+                               inode_set_mtime_to_ts(inode,
+                                                     inode_get_ctime(inode));
++                      if (epos > old_size) {
++                              pagecache_isize_extended(inode, old_size, epos);
++                              ext4_zero_partial_blocks(handle, inode,
++                                                   old_size, epos - old_size);
++                      }
+               }
+               ret2 = ext4_mark_inode_dirty(handle, inode);
+               ext4_update_inode_fsync_trans(handle, inode, 1);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 99d09cd9c6a37..67a5b937f5a92 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1307,8 +1307,10 @@ static int ext4_write_end(struct file *file,
+       folio_unlock(folio);
+       folio_put(folio);
+-      if (old_size < pos && !verity)
++      if (old_size < pos && !verity) {
+               pagecache_isize_extended(inode, old_size, pos);
++              ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size);
++      }
+       /*
+        * Don't mark the inode dirty under folio lock. First, it unnecessarily
+        * makes the holding time of folio lock longer. Second, it forces lock
+@@ -1423,8 +1425,10 @@ static int ext4_journalled_write_end(struct file *file,
+       folio_unlock(folio);
+       folio_put(folio);
+-      if (old_size < pos && !verity)
++      if (old_size < pos && !verity) {
+               pagecache_isize_extended(inode, old_size, pos);
++              ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size);
++      }
+       if (size_changed) {
+               ret2 = ext4_mark_inode_dirty(handle, inode);
+@@ -2985,7 +2989,8 @@ static int ext4_da_do_write_end(struct address_space *mapping,
+       struct inode *inode = mapping->host;
+       loff_t old_size = inode->i_size;
+       bool disksize_changed = false;
+-      loff_t new_i_size;
++      loff_t new_i_size, zero_len = 0;
++      handle_t *handle;
+       if (unlikely(!folio_buffers(folio))) {
+               folio_unlock(folio);
+@@ -3029,18 +3034,21 @@ static int ext4_da_do_write_end(struct address_space *mapping,
+       folio_unlock(folio);
+       folio_put(folio);
+-      if (old_size < pos)
++      if (pos > old_size) {
+               pagecache_isize_extended(inode, old_size, pos);
++              zero_len = pos - old_size;
++      }
+-      if (disksize_changed) {
+-              handle_t *handle;
++      if (!disksize_changed && !zero_len)
++              return copied;
+-              handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
+-              if (IS_ERR(handle))
+-                      return PTR_ERR(handle);
+-              ext4_mark_inode_dirty(handle, inode);
+-              ext4_journal_stop(handle);
+-      }
++      handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
++      if (IS_ERR(handle))
++              return PTR_ERR(handle);
++      if (zero_len)
++              ext4_zero_partial_blocks(handle, inode, old_size, zero_len);
++      ext4_mark_inode_dirty(handle, inode);
++      ext4_journal_stop(handle);
+       return copied;
+ }
+@@ -5426,6 +5434,14 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+               }
+               if (attr->ia_size != inode->i_size) {
++                      /* attach jbd2 jinode for EOF folio tail zeroing */
++                      if (attr->ia_size & (inode->i_sb->s_blocksize - 1) ||
++                          oldsize & (inode->i_sb->s_blocksize - 1)) {
++                              error = ext4_inode_attach_jinode(inode);
++                              if (error)
++                                      goto err_out;
++                      }
++
+                       handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
+                       if (IS_ERR(handle)) {
+                               error = PTR_ERR(handle);
+@@ -5436,12 +5452,17 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+                               orphan = 1;
+                       }
+                       /*
+-                       * Update c/mtime on truncate up, ext4_truncate() will
+-                       * update c/mtime in shrink case below
++                       * Update c/mtime and tail zero the EOF folio on
++                       * truncate up. ext4_truncate() handles the shrink case
++                       * below.
+                        */
+-                      if (!shrink)
++                      if (!shrink) {
+                               inode_set_mtime_to_ts(inode,
+                                                     inode_set_ctime_current(inode));
++                              if (oldsize & (inode->i_sb->s_blocksize - 1))
++                                      ext4_block_truncate_page(handle,
++                                                      inode->i_mapping, oldsize);
++                      }
+                       if (shrink)
+                               ext4_fc_track_range(handle, inode,
+-- 
+2.43.0
+
diff --git a/queue-6.12/f2fs-add-a-sysfs-node-to-limit-max-read-extent-count.patch b/queue-6.12/f2fs-add-a-sysfs-node-to-limit-max-read-extent-count.patch
new file mode 100644 (file)
index 0000000..8f5ab14
--- /dev/null
@@ -0,0 +1,140 @@
+From 0cea78b4294c2675a07eac7a623e8c1169953f35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 14:50:05 +0800
+Subject: f2fs: add a sysfs node to limit max read extent count per-inode
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 009a8241a8e5a14ea2dd0b8db42dbf283527dd44 ]
+
+Quoted:
+"at this time, there are still 1086911 extent nodes in this zombie
+extent tree that need to be cleaned up.
+
+crash_arm64_sprd_v8.0.3++> extent_tree.node_cnt ffffff80896cc500
+  node_cnt = {
+    counter = 1086911
+  },
+"
+
+As reported by Xiuhong, there will be a huge number of extent nodes
+in extent tree, it may potentially cause:
+- slab memory fragments
+- extreme long time shrink on extent tree
+- low mapping efficiency
+
+Let's add a sysfs node to limit max read extent count for each inode,
+by default, value of this threshold is 10240, it can be updated
+according to user's requirement.
+
+Reported-by: Xiuhong Wang <xiuhong.wang@unisoc.com>
+Closes: https://lore.kernel.org/linux-f2fs-devel/20241112110627.1314632-1-xiuhong.wang@unisoc.com/
+Signed-off-by: Xiuhong Wang <xiuhong.wang@unisoc.com>
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-fs-f2fs |  6 ++++++
+ fs/f2fs/extent_cache.c                  |  5 ++++-
+ fs/f2fs/f2fs.h                          |  4 ++++
+ fs/f2fs/sysfs.c                         | 10 ++++++++++
+ 4 files changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-fs-f2fs b/Documentation/ABI/testing/sysfs-fs-f2fs
+index 513296bb6f297..3e1630c70d8ae 100644
+--- a/Documentation/ABI/testing/sysfs-fs-f2fs
++++ b/Documentation/ABI/testing/sysfs-fs-f2fs
+@@ -822,3 +822,9 @@ Description:       It controls the valid block ratio threshold not to trigger excessiv
+               for zoned deivces. The initial value of it is 95(%). F2FS will stop the
+               background GC thread from intiating GC for sections having valid blocks
+               exceeding the ratio.
++
++What:         /sys/fs/f2fs/<disk>/max_read_extent_count
++Date:         November 2024
++Contact:      "Chao Yu" <chao@kernel.org>
++Description:  It controls max read extent count for per-inode, the value of threshold
++              is 10240 by default.
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 368d9cbdea743..fb09c8e9bc573 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -674,7 +674,9 @@ static void __update_extent_tree_range(struct inode *inode,
+               }
+               if (end < org_end && (type != EX_READ ||
+-                              org_end - end >= F2FS_MIN_EXTENT_LEN)) {
++                      (org_end - end >= F2FS_MIN_EXTENT_LEN &&
++                      atomic_read(&et->node_cnt) <
++                                      sbi->max_read_extent_count))) {
+                       if (parts) {
+                               __set_extent_info(&ei,
+                                       end, org_end - end,
+@@ -1169,6 +1171,7 @@ void f2fs_init_extent_cache_info(struct f2fs_sb_info *sbi)
+       sbi->hot_data_age_threshold = DEF_HOT_DATA_AGE_THRESHOLD;
+       sbi->warm_data_age_threshold = DEF_WARM_DATA_AGE_THRESHOLD;
+       sbi->last_age_weight = LAST_AGE_WEIGHT;
++      sbi->max_read_extent_count = DEF_MAX_READ_EXTENT_COUNT;
+ }
+ int __init f2fs_create_extent_cache(void)
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 93a5e1c24e566..cec3dd205b3df 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -634,6 +634,9 @@ enum {
+ #define DEF_HOT_DATA_AGE_THRESHOLD    262144
+ #define DEF_WARM_DATA_AGE_THRESHOLD   2621440
++/* default max read extent count per inode */
++#define DEF_MAX_READ_EXTENT_COUNT     10240
++
+ /* extent cache type */
+ enum extent_type {
+       EX_READ,
+@@ -1619,6 +1622,7 @@ struct f2fs_sb_info {
+       /* for extent tree cache */
+       struct extent_tree_info extent_tree[NR_EXTENT_CACHES];
+       atomic64_t allocated_data_blocks;       /* for block age extent_cache */
++      unsigned int max_read_extent_count;     /* max read extent count per inode */
+       /* The threshold used for hot and warm data seperation*/
+       unsigned int hot_data_age_threshold;
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index c56e8c8739352..d9a44f03e558b 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -789,6 +789,13 @@ static ssize_t __sbi_store(struct f2fs_attr *a,
+               return count;
+       }
++      if (!strcmp(a->attr.name, "max_read_extent_count")) {
++              if (t > UINT_MAX)
++                      return -EINVAL;
++              *ui = (unsigned int)t;
++              return count;
++      }
++
+       if (!strcmp(a->attr.name, "ipu_policy")) {
+               if (t >= BIT(F2FS_IPU_MAX))
+                       return -EINVAL;
+@@ -1054,6 +1061,8 @@ F2FS_SBI_GENERAL_RW_ATTR(revoked_atomic_block);
+ F2FS_SBI_GENERAL_RW_ATTR(hot_data_age_threshold);
+ F2FS_SBI_GENERAL_RW_ATTR(warm_data_age_threshold);
+ F2FS_SBI_GENERAL_RW_ATTR(last_age_weight);
++/* read extent cache */
++F2FS_SBI_GENERAL_RW_ATTR(max_read_extent_count);
+ #ifdef CONFIG_BLK_DEV_ZONED
+ F2FS_SBI_GENERAL_RO_ATTR(unusable_blocks_per_sec);
+ F2FS_SBI_GENERAL_RW_ATTR(blkzone_alloc_policy);
+@@ -1244,6 +1253,7 @@ static struct attribute *f2fs_attrs[] = {
+       ATTR_LIST(hot_data_age_threshold),
+       ATTR_LIST(warm_data_age_threshold),
+       ATTR_LIST(last_age_weight),
++      ATTR_LIST(max_read_extent_count),
+       NULL,
+ };
+ ATTRIBUTE_GROUPS(f2fs);
+-- 
+2.43.0
+
diff --git a/queue-6.12/f2fs-fix-f2fs_bug_on-when-uninstalling-filesystem-ca.patch b/queue-6.12/f2fs-fix-f2fs_bug_on-when-uninstalling-filesystem-ca.patch
new file mode 100644 (file)
index 0000000..06d80a1
--- /dev/null
@@ -0,0 +1,85 @@
+From f55a308adf85a19fd87903fa50a73b595d66cb5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2024 02:44:00 -0600
+Subject: f2fs: fix f2fs_bug_on when uninstalling filesystem call
+ f2fs_evict_inode.
+
+From: Qi Han <hanqi@vivo.com>
+
+[ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ]
+
+creating a large files during checkpoint disable until it runs out of
+space and then delete it, then remount to enable checkpoint again, and
+then unmount the filesystem triggers the f2fs_bug_on as below:
+
+------------[ cut here ]------------
+kernel BUG at fs/f2fs/inode.c:896!
+CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360
+Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
+RIP: 0010:f2fs_evict_inode+0x58c/0x610
+Call Trace:
+ __die_body+0x15/0x60
+ die+0x33/0x50
+ do_trap+0x10a/0x120
+ f2fs_evict_inode+0x58c/0x610
+ do_error_trap+0x60/0x80
+ f2fs_evict_inode+0x58c/0x610
+ exc_invalid_op+0x53/0x60
+ f2fs_evict_inode+0x58c/0x610
+ asm_exc_invalid_op+0x16/0x20
+ f2fs_evict_inode+0x58c/0x610
+ evict+0x101/0x260
+ dispose_list+0x30/0x50
+ evict_inodes+0x140/0x190
+ generic_shutdown_super+0x2f/0x150
+ kill_block_super+0x11/0x40
+ kill_f2fs_super+0x7d/0x140
+ deactivate_locked_super+0x2a/0x70
+ cleanup_mnt+0xb3/0x140
+ task_work_run+0x61/0x90
+
+The root cause is: creating large files during disable checkpoint
+period results in not enough free segments, so when writing back root
+inode will failed in f2fs_enable_checkpoint. When umount the file
+system after enabling checkpoint, the root inode is dirty in
+f2fs_evict_inode function, which triggers BUG_ON. The steps to
+reproduce are as follows:
+
+dd if=/dev/zero of=f2fs.img bs=1M count=55
+mount f2fs.img f2fs_dir -o checkpoint=disable:10%
+dd if=/dev/zero of=big bs=1M count=50
+sync
+rm big
+mount -o remount,checkpoint=enable f2fs_dir
+umount f2fs_dir
+
+Let's redirty inode when there is not free segments during checkpoint
+is disable.
+
+Signed-off-by: Qi Han <hanqi@vivo.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/inode.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 1ed86df343a5d..10780e37fc7b6 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -775,8 +775,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)
+               !is_inode_flag_set(inode, FI_DIRTY_INODE))
+               return 0;
+-      if (!f2fs_is_checkpoint_ready(sbi))
++      if (!f2fs_is_checkpoint_ready(sbi)) {
++              f2fs_mark_inode_dirty_sync(inode, true);
+               return -ENOSPC;
++      }
+       /*
+        * We need to balance fs here to prevent from producing dirty node pages
+-- 
+2.43.0
+
diff --git a/queue-6.12/f2fs-fix-to-shrink-read-extent-node-in-batches.patch b/queue-6.12/f2fs-fix-to-shrink-read-extent-node-in-batches.patch
new file mode 100644 (file)
index 0000000..8616413
--- /dev/null
@@ -0,0 +1,181 @@
+From 76ef782a832dd3387a912f272b55e96864cf9902 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2024 09:57:50 +0800
+Subject: f2fs: fix to shrink read extent node in batches
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343 ]
+
+We use rwlock to protect core structure data of extent tree during
+its shrink, however, if there is a huge number of extent nodes in
+extent tree, during shrink of extent tree, it may hold rwlock for
+a very long time, which may trigger kernel hang issue.
+
+This patch fixes to shrink read extent node in batches, so that,
+critical region of the rwlock can be shrunk to avoid its extreme
+long time hold.
+
+Reported-by: Xiuhong Wang <xiuhong.wang@unisoc.com>
+Closes: https://lore.kernel.org/linux-f2fs-devel/20241112110627.1314632-1-xiuhong.wang@unisoc.com/
+Signed-off-by: Xiuhong Wang <xiuhong.wang@unisoc.com>
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/extent_cache.c | 69 +++++++++++++++++++++++++-----------------
+ 1 file changed, 41 insertions(+), 28 deletions(-)
+
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 62ac440d94168..368d9cbdea743 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -346,21 +346,22 @@ static struct extent_tree *__grab_extent_tree(struct inode *inode,
+ }
+ static unsigned int __free_extent_tree(struct f2fs_sb_info *sbi,
+-                                      struct extent_tree *et)
++                              struct extent_tree *et, unsigned int nr_shrink)
+ {
+       struct rb_node *node, *next;
+       struct extent_node *en;
+-      unsigned int count = atomic_read(&et->node_cnt);
++      unsigned int count;
+       node = rb_first_cached(&et->root);
+-      while (node) {
++
++      for (count = 0; node && count < nr_shrink; count++) {
+               next = rb_next(node);
+               en = rb_entry(node, struct extent_node, rb_node);
+               __release_extent_node(sbi, et, en);
+               node = next;
+       }
+-      return count - atomic_read(&et->node_cnt);
++      return count;
+ }
+ static void __drop_largest_extent(struct extent_tree *et,
+@@ -579,6 +580,30 @@ static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi,
+       return en;
+ }
++static unsigned int __destroy_extent_node(struct inode *inode,
++                                      enum extent_type type)
++{
++      struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
++      struct extent_tree *et = F2FS_I(inode)->extent_tree[type];
++      unsigned int nr_shrink = type == EX_READ ?
++                              READ_EXTENT_CACHE_SHRINK_NUMBER :
++                              AGE_EXTENT_CACHE_SHRINK_NUMBER;
++      unsigned int node_cnt = 0;
++
++      if (!et || !atomic_read(&et->node_cnt))
++              return 0;
++
++      while (atomic_read(&et->node_cnt)) {
++              write_lock(&et->lock);
++              node_cnt += __free_extent_tree(sbi, et, nr_shrink);
++              write_unlock(&et->lock);
++      }
++
++      f2fs_bug_on(sbi, atomic_read(&et->node_cnt));
++
++      return node_cnt;
++}
++
+ static void __update_extent_tree_range(struct inode *inode,
+                       struct extent_info *tei, enum extent_type type)
+ {
+@@ -717,9 +742,6 @@ static void __update_extent_tree_range(struct inode *inode,
+               }
+       }
+-      if (is_inode_flag_set(inode, FI_NO_EXTENT))
+-              __free_extent_tree(sbi, et);
+-
+       if (et->largest_updated) {
+               et->largest_updated = false;
+               updated = true;
+@@ -737,6 +759,9 @@ static void __update_extent_tree_range(struct inode *inode,
+ out_read_extent_cache:
+       write_unlock(&et->lock);
++      if (is_inode_flag_set(inode, FI_NO_EXTENT))
++              __destroy_extent_node(inode, EX_READ);
++
+       if (updated)
+               f2fs_mark_inode_dirty_sync(inode, true);
+ }
+@@ -899,10 +924,14 @@ static unsigned int __shrink_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink
+       list_for_each_entry_safe(et, next, &eti->zombie_list, list) {
+               if (atomic_read(&et->node_cnt)) {
+                       write_lock(&et->lock);
+-                      node_cnt += __free_extent_tree(sbi, et);
++                      node_cnt += __free_extent_tree(sbi, et,
++                                      nr_shrink - node_cnt - tree_cnt);
+                       write_unlock(&et->lock);
+               }
+-              f2fs_bug_on(sbi, atomic_read(&et->node_cnt));
++
++              if (atomic_read(&et->node_cnt))
++                      goto unlock_out;
++
+               list_del_init(&et->list);
+               radix_tree_delete(&eti->extent_tree_root, et->ino);
+               kmem_cache_free(extent_tree_slab, et);
+@@ -1041,23 +1070,6 @@ unsigned int f2fs_shrink_age_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink
+       return __shrink_extent_tree(sbi, nr_shrink, EX_BLOCK_AGE);
+ }
+-static unsigned int __destroy_extent_node(struct inode *inode,
+-                                      enum extent_type type)
+-{
+-      struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+-      struct extent_tree *et = F2FS_I(inode)->extent_tree[type];
+-      unsigned int node_cnt = 0;
+-
+-      if (!et || !atomic_read(&et->node_cnt))
+-              return 0;
+-
+-      write_lock(&et->lock);
+-      node_cnt = __free_extent_tree(sbi, et);
+-      write_unlock(&et->lock);
+-
+-      return node_cnt;
+-}
+-
+ void f2fs_destroy_extent_node(struct inode *inode)
+ {
+       __destroy_extent_node(inode, EX_READ);
+@@ -1066,7 +1078,6 @@ void f2fs_destroy_extent_node(struct inode *inode)
+ static void __drop_extent_tree(struct inode *inode, enum extent_type type)
+ {
+-      struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+       struct extent_tree *et = F2FS_I(inode)->extent_tree[type];
+       bool updated = false;
+@@ -1074,7 +1085,6 @@ static void __drop_extent_tree(struct inode *inode, enum extent_type type)
+               return;
+       write_lock(&et->lock);
+-      __free_extent_tree(sbi, et);
+       if (type == EX_READ) {
+               set_inode_flag(inode, FI_NO_EXTENT);
+               if (et->largest.len) {
+@@ -1083,6 +1093,9 @@ static void __drop_extent_tree(struct inode *inode, enum extent_type type)
+               }
+       }
+       write_unlock(&et->lock);
++
++      __destroy_extent_node(inode, type);
++
+       if (updated)
+               f2fs_mark_inode_dirty_sync(inode, true);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/f2fs-print-message-if-fscorrupted-was-found-in-f2fs_.patch b/queue-6.12/f2fs-print-message-if-fscorrupted-was-found-in-f2fs_.patch
new file mode 100644 (file)
index 0000000..1d055a3
--- /dev/null
@@ -0,0 +1,44 @@
+From 5c83a117ec2f3a7e3cb4741a567644ea4fea82e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2024 14:58:50 +0800
+Subject: f2fs: print message if fscorrupted was found in f2fs_new_node_page()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 81520c684ca67aea6a589461a3caebb9b11dcc90 ]
+
+If fs corruption occurs in f2fs_new_node_page(), let's print
+more information about corrupted metadata into kernel log.
+
+Meanwhile, it updates to record ERROR_INCONSISTENT_NAT instead
+of ERROR_INVALID_BLKADDR if blkaddr in nat entry is not
+NULL_ADDR which means nat bitmap and nat entry is inconsistent.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index af36c6d6542b8..4d7b9fd6ef31a 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1341,7 +1341,12 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs)
+               err = -EFSCORRUPTED;
+               dec_valid_node_count(sbi, dn->inode, !ofs);
+               set_sbi_flag(sbi, SBI_NEED_FSCK);
+-              f2fs_handle_error(sbi, ERROR_INVALID_BLKADDR);
++              f2fs_warn_ratelimited(sbi,
++                      "f2fs_new_node_page: inconsistent nat entry, "
++                      "ino:%u, nid:%u, blkaddr:%u, ver:%u, flag:%u",
++                      new_ni.ino, new_ni.nid, new_ni.blk_addr,
++                      new_ni.version, new_ni.flag);
++              f2fs_handle_error(sbi, ERROR_INCONSISTENT_NAT);
+               goto fail;
+       }
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.12/fanotify-allow-reporting-errors-on-failure-to-open-f.patch b/queue-6.12/fanotify-allow-reporting-errors-on-failure-to-open-f.patch
new file mode 100644 (file)
index 0000000..2e702ac
--- /dev/null
@@ -0,0 +1,231 @@
+From 6c2f0eda9b512ca99f67f3b35066f73de1e96c2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 16:29:22 +0200
+Subject: fanotify: allow reporting errors on failure to open fd
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 522249f05c5551aec9ec0ba9b6438f1ec19c138d ]
+
+When working in "fd mode", fanotify_read() needs to open an fd
+from a dentry to report event->fd to userspace.
+
+Opening an fd from dentry can fail for several reasons.
+For example, when tasks are gone and we try to open their
+/proc files or we try to open a WRONLY file like in sysfs
+or when trying to open a file that was deleted on the
+remote network server.
+
+Add a new flag FAN_REPORT_FD_ERROR for fanotify_init().
+For a group with FAN_REPORT_FD_ERROR, we will send the
+event with the error instead of the open fd, otherwise
+userspace may not get the error at all.
+
+For an overflow event, we report -EBADF to avoid confusing FAN_NOFD
+with -EPERM.  Similarly for pidfd open errors we report either -ESRCH
+or the open error instead of FAN_NOPIDFD and FAN_EPIDFD.
+
+In any case, userspace will not know which file failed to
+open, so add a debug print for further investigation.
+
+Reported-by: Krishna Vivek Vitta <kvitta@microsoft.com>
+Link: https://lore.kernel.org/linux-fsdevel/SI2P153MB07182F3424619EDDD1F393EED46D2@SI2P153MB0718.APCP153.PROD.OUTLOOK.COM/
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20241003142922.111539-1-amir73il@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/notify/fanotify/fanotify_user.c | 85 +++++++++++++++++-------------
+ include/linux/fanotify.h           |  1 +
+ include/uapi/linux/fanotify.h      |  1 +
+ 3 files changed, 50 insertions(+), 37 deletions(-)
+
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 9644bc72e4573..8e2d43fc6f7c1 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -266,13 +266,6 @@ static int create_fd(struct fsnotify_group *group, const struct path *path,
+                              group->fanotify_data.f_flags | __FMODE_NONOTIFY,
+                              current_cred());
+       if (IS_ERR(new_file)) {
+-              /*
+-               * we still send an event even if we can't open the file.  this
+-               * can happen when say tasks are gone and we try to open their
+-               * /proc files or we try to open a WRONLY file like in sysfs
+-               * we just send the errno to userspace since there isn't much
+-               * else we can do.
+-               */
+               put_unused_fd(client_fd);
+               client_fd = PTR_ERR(new_file);
+       } else {
+@@ -663,7 +656,7 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
+       unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES);
+       unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD;
+       struct file *f = NULL, *pidfd_file = NULL;
+-      int ret, pidfd = FAN_NOPIDFD, fd = FAN_NOFD;
++      int ret, pidfd = -ESRCH, fd = -EBADF;
+       pr_debug("%s: group=%p event=%p\n", __func__, group, event);
+@@ -691,10 +684,39 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
+       if (!FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) &&
+           path && path->mnt && path->dentry) {
+               fd = create_fd(group, path, &f);
+-              if (fd < 0)
+-                      return fd;
++              /*
++               * Opening an fd from dentry can fail for several reasons.
++               * For example, when tasks are gone and we try to open their
++               * /proc files or we try to open a WRONLY file like in sysfs
++               * or when trying to open a file that was deleted on the
++               * remote network server.
++               *
++               * For a group with FAN_REPORT_FD_ERROR, we will send the
++               * event with the error instead of the open fd, otherwise
++               * Userspace may not get the error at all.
++               * In any case, userspace will not know which file failed to
++               * open, so add a debug print for further investigation.
++               */
++              if (fd < 0) {
++                      pr_debug("fanotify: create_fd(%pd2) failed err=%d\n",
++                               path->dentry, fd);
++                      if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR)) {
++                              /*
++                               * Historically, we've handled EOPENSTALE in a
++                               * special way and silently dropped such
++                               * events. Now we have to keep it to maintain
++                               * backward compatibility...
++                               */
++                              if (fd == -EOPENSTALE)
++                                      fd = 0;
++                              return fd;
++                      }
++              }
+       }
+-      metadata.fd = fd;
++      if (FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR))
++              metadata.fd = fd;
++      else
++              metadata.fd = fd >= 0 ? fd : FAN_NOFD;
+       if (pidfd_mode) {
+               /*
+@@ -709,18 +731,16 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
+                * The PIDTYPE_TGID check for an event->pid is performed
+                * preemptively in an attempt to catch out cases where the event
+                * listener reads events after the event generating process has
+-               * already terminated. Report FAN_NOPIDFD to the event listener
+-               * in those cases, with all other pidfd creation errors being
+-               * reported as FAN_EPIDFD.
++               * already terminated.  Depending on flag FAN_REPORT_FD_ERROR,
++               * report either -ESRCH or FAN_NOPIDFD to the event listener in
++               * those cases with all other pidfd creation errors reported as
++               * the error code itself or as FAN_EPIDFD.
+                */
+-              if (metadata.pid == 0 ||
+-                  !pid_has_task(event->pid, PIDTYPE_TGID)) {
+-                      pidfd = FAN_NOPIDFD;
+-              } else {
++              if (metadata.pid && pid_has_task(event->pid, PIDTYPE_TGID))
+                       pidfd = pidfd_prepare(event->pid, 0, &pidfd_file);
+-                      if (pidfd < 0)
+-                              pidfd = FAN_EPIDFD;
+-              }
++
++              if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0)
++                      pidfd = pidfd == -ESRCH ? FAN_NOPIDFD : FAN_EPIDFD;
+       }
+       ret = -EFAULT;
+@@ -737,9 +757,6 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
+       buf += FAN_EVENT_METADATA_LEN;
+       count -= FAN_EVENT_METADATA_LEN;
+-      if (fanotify_is_perm_event(event->mask))
+-              FANOTIFY_PERM(event)->fd = fd;
+-
+       if (info_mode) {
+               ret = copy_info_records_to_user(event, info, info_mode, pidfd,
+                                               buf, count);
+@@ -753,15 +770,18 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
+       if (pidfd_file)
+               fd_install(pidfd, pidfd_file);
++      if (fanotify_is_perm_event(event->mask))
++              FANOTIFY_PERM(event)->fd = fd;
++
+       return metadata.event_len;
+ out_close_fd:
+-      if (fd != FAN_NOFD) {
++      if (f) {
+               put_unused_fd(fd);
+               fput(f);
+       }
+-      if (pidfd >= 0) {
++      if (pidfd_file) {
+               put_unused_fd(pidfd);
+               fput(pidfd_file);
+       }
+@@ -828,15 +848,6 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
+               }
+               ret = copy_event_to_user(group, event, buf, count);
+-              if (unlikely(ret == -EOPENSTALE)) {
+-                      /*
+-                       * We cannot report events with stale fd so drop it.
+-                       * Setting ret to 0 will continue the event loop and
+-                       * do the right thing if there are no more events to
+-                       * read (i.e. return bytes read, -EAGAIN or wait).
+-                       */
+-                      ret = 0;
+-              }
+               /*
+                * Permission events get queued to wait for response.  Other
+@@ -845,7 +856,7 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
+               if (!fanotify_is_perm_event(event->mask)) {
+                       fsnotify_destroy_event(group, &event->fse);
+               } else {
+-                      if (ret <= 0) {
++                      if (ret <= 0 || FANOTIFY_PERM(event)->fd < 0) {
+                               spin_lock(&group->notification_lock);
+                               finish_permission_event(group,
+                                       FANOTIFY_PERM(event), FAN_DENY, NULL);
+@@ -1954,7 +1965,7 @@ static int __init fanotify_user_setup(void)
+                                    FANOTIFY_DEFAULT_MAX_USER_MARKS);
+       BUILD_BUG_ON(FANOTIFY_INIT_FLAGS & FANOTIFY_INTERNAL_GROUP_FLAGS);
+-      BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 12);
++      BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 13);
+       BUILD_BUG_ON(HWEIGHT32(FANOTIFY_MARK_FLAGS) != 11);
+       fanotify_mark_cache = KMEM_CACHE(fanotify_mark,
+diff --git a/include/linux/fanotify.h b/include/linux/fanotify.h
+index 4f1c4f6031180..89ff45bd6f01b 100644
+--- a/include/linux/fanotify.h
++++ b/include/linux/fanotify.h
+@@ -36,6 +36,7 @@
+ #define FANOTIFY_ADMIN_INIT_FLAGS     (FANOTIFY_PERM_CLASSES | \
+                                        FAN_REPORT_TID | \
+                                        FAN_REPORT_PIDFD | \
++                                       FAN_REPORT_FD_ERROR | \
+                                        FAN_UNLIMITED_QUEUE | \
+                                        FAN_UNLIMITED_MARKS)
+diff --git a/include/uapi/linux/fanotify.h b/include/uapi/linux/fanotify.h
+index a37de58ca571a..34f221d3a1b95 100644
+--- a/include/uapi/linux/fanotify.h
++++ b/include/uapi/linux/fanotify.h
+@@ -60,6 +60,7 @@
+ #define FAN_REPORT_DIR_FID    0x00000400      /* Report unique directory id */
+ #define FAN_REPORT_NAME               0x00000800      /* Report events with name */
+ #define FAN_REPORT_TARGET_FID 0x00001000      /* Report dirent target id  */
++#define FAN_REPORT_FD_ERROR   0x00002000      /* event->fd can report error */
+ /* Convenience macro - FAN_REPORT_NAME requires FAN_REPORT_DIR_FID */
+ #define FAN_REPORT_DFID_NAME  (FAN_REPORT_DIR_FID | FAN_REPORT_NAME)
+-- 
+2.43.0
+
diff --git a/queue-6.12/firmware-qcom-scm-allow-qseecom-on-dell-xps-13-9345.patch b/queue-6.12/firmware-qcom-scm-allow-qseecom-on-dell-xps-13-9345.patch
new file mode 100644 (file)
index 0000000..625c605
--- /dev/null
@@ -0,0 +1,36 @@
+From 46df9ed62f2033fc3418c342b8c78e3b87fdbebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 23:10:08 +0200
+Subject: firmware: qcom: scm: Allow QSEECOM on Dell XPS 13 9345
+
+From: Aleksandrs Vinarskis <alex.vinarskis@gmail.com>
+
+[ Upstream commit 304c250ba121f5c505be3fc13dec984016f3c032 ]
+
+Allow particular machine accessing eg. efivars.
+
+Signed-off-by: Aleksandrs Vinarskis <alex.vinarskis@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Stefan Schmidt <stefan.schmidt@linaro.org>
+Link: https://lore.kernel.org/r/20241003211139.9296-3-alex.vinarskis@gmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index f019e0b787cb7..14afd68664a91 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -1742,6 +1742,7 @@ EXPORT_SYMBOL_GPL(qcom_scm_qseecom_app_send);
+  + any potential issues with this, only allow validated machines for now.
+  */
+ static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = {
++      { .compatible = "dell,xps13-9345" },
+       { .compatible = "lenovo,flex-5g" },
+       { .compatible = "lenovo,thinkpad-t14s" },
+       { .compatible = "lenovo,thinkpad-x13s", },
+-- 
+2.43.0
+
diff --git a/queue-6.12/firmware-qcom-scm-allow-qseecom-on-lenovo-yoga-slim-.patch b/queue-6.12/firmware-qcom-scm-allow-qseecom-on-lenovo-yoga-slim-.patch
new file mode 100644 (file)
index 0000000..658589e
--- /dev/null
@@ -0,0 +1,36 @@
+From 1a572d516f3bd08cf83238118cef92476667e105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2024 15:44:21 +0200
+Subject: firmware: qcom: scm: Allow QSEECOM on Lenovo Yoga Slim 7x
+
+From: Maya Matuszczyk <maccraft123mc@gmail.com>
+
+[ Upstream commit c6fa2834afc6a6fe210415ec253a61e6eafdf651 ]
+
+Allow QSEECOM on Lenovo Yoga Slim 7x, to enable accessing EFI variables.
+
+Signed-off-by: Maya Matuszczyk <maccraft123mc@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240919134421.112643-2-maccraft123mc@gmail.com
+[bjorn: Rewrote commit message]
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index 2e4260ba5f793..f019e0b787cb7 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -1745,6 +1745,7 @@ static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = {
+       { .compatible = "lenovo,flex-5g" },
+       { .compatible = "lenovo,thinkpad-t14s" },
+       { .compatible = "lenovo,thinkpad-x13s", },
++      { .compatible = "lenovo,yoga-slim7x" },
+       { .compatible = "microsoft,romulus13", },
+       { .compatible = "microsoft,romulus15", },
+       { .compatible = "qcom,sc8180x-primus" },
+-- 
+2.43.0
+
diff --git a/queue-6.12/fs-ntfs3-fix-case-when-unmarked-clusters-intersect-w.patch b/queue-6.12/fs-ntfs3-fix-case-when-unmarked-clusters-intersect-w.patch
new file mode 100644 (file)
index 0000000..bfc7351
--- /dev/null
@@ -0,0 +1,86 @@
+From 05c7062ac1f99305e403b358cb636c3a7ec45988 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 20:09:24 +0300
+Subject: fs/ntfs3: Fix case when unmarked clusters intersect with zone
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36 ]
+
+Reported-by: syzbot+7f3761b790fa41d0f3d5@syzkaller.appspotmail.com
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/run.c | 40 ++++++++++++++++++++++++++++++----------
+ 1 file changed, 30 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
+index 58e988cd80490..48566dff0dc92 100644
+--- a/fs/ntfs3/run.c
++++ b/fs/ntfs3/run.c
+@@ -1055,8 +1055,8 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+ {
+       int ret, err;
+       CLST next_vcn, lcn, len;
+-      size_t index;
+-      bool ok;
++      size_t index, done;
++      bool ok, zone;
+       struct wnd_bitmap *wnd;
+       ret = run_unpack(run, sbi, ino, svcn, evcn, vcn, run_buf, run_buf_size);
+@@ -1087,8 +1087,9 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+                       continue;
+               down_read_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS);
++              zone = max(wnd->zone_bit, lcn) < min(wnd->zone_end, lcn + len);
+               /* Check for free blocks. */
+-              ok = wnd_is_used(wnd, lcn, len);
++              ok = !zone && wnd_is_used(wnd, lcn, len);
+               up_read(&wnd->rw_lock);
+               if (ok)
+                       continue;
+@@ -1096,14 +1097,33 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+               /* Looks like volume is corrupted. */
+               ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
+-              if (down_write_trylock(&wnd->rw_lock)) {
+-                      /* Mark all zero bits as used in range [lcn, lcn+len). */
+-                      size_t done;
+-                      err = wnd_set_used_safe(wnd, lcn, len, &done);
+-                      up_write(&wnd->rw_lock);
+-                      if (err)
+-                              return err;
++              if (!down_write_trylock(&wnd->rw_lock))
++                      continue;
++
++              if (zone) {
++                      /*
++                       * Range [lcn, lcn + len) intersects with zone.
++                       * To avoid complex with zone just turn it off.
++                       */
++                      wnd_zone_set(wnd, 0, 0);
++              }
++
++              /* Mark all zero bits as used in range [lcn, lcn+len). */
++              err = wnd_set_used_safe(wnd, lcn, len, &done);
++              if (zone) {
++                      /* Restore zone. Lock mft run. */
++                      struct rw_semaphore *lock;
++                      lock = is_mounted(sbi) ? &sbi->mft.ni->file.run_lock :
++                                               NULL;
++                      if (lock)
++                              down_read(lock);
++                      ntfs_refresh_zone(sbi);
++                      if (lock)
++                              up_read(lock);
+               }
++              up_write(&wnd->rw_lock);
++              if (err)
++                      return err;
+       }
+       return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.12/fs-ntfs3-fix-warning-in-ni_fiemap.patch b/queue-6.12/fs-ntfs3-fix-warning-in-ni_fiemap.patch
new file mode 100644 (file)
index 0000000..5a5eef0
--- /dev/null
@@ -0,0 +1,293 @@
+From aab420a5a4d69c6c51d8164a4d4946d9532f8340 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 10:48:15 +0300
+Subject: fs/ntfs3: Fix warning in ni_fiemap
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit e2705dd3d16d1000f1fd8193d82447065de8c899 ]
+
+Use local runs_tree instead of cached. This way excludes rw_semaphore lock.
+
+Reported-by: syzbot+1c25748a40fe79b8a119@syzkaller.appspotmail.com
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c  |   9 ++--
+ fs/ntfs3/frecord.c | 103 +++++++--------------------------------------
+ fs/ntfs3/ntfs_fs.h |   3 +-
+ 3 files changed, 21 insertions(+), 94 deletions(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index 0763202d00c99..8d789b017fa9b 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -977,7 +977,7 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn,
+       /* Check for compressed frame. */
+       err = attr_is_frame_compressed(ni, attr_b, vcn >> NTFS_LZNT_CUNIT,
+-                                     &hint);
++                                     &hint, run);
+       if (err)
+               goto out;
+@@ -1521,16 +1521,16 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr,
+  * attr_is_frame_compressed - Used to detect compressed frame.
+  *
+  * attr - base (primary) attribute segment.
++ * run  - run to use, usually == &ni->file.run.
+  * Only base segments contains valid 'attr->nres.c_unit'
+  */
+ int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr,
+-                           CLST frame, CLST *clst_data)
++                           CLST frame, CLST *clst_data, struct runs_tree *run)
+ {
+       int err;
+       u32 clst_frame;
+       CLST clen, lcn, vcn, alen, slen, vcn_next;
+       size_t idx;
+-      struct runs_tree *run;
+       *clst_data = 0;
+@@ -1542,7 +1542,6 @@ int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr,
+       clst_frame = 1u << attr->nres.c_unit;
+       vcn = frame * clst_frame;
+-      run = &ni->file.run;
+       if (!run_lookup_entry(run, vcn, &lcn, &clen, &idx)) {
+               err = attr_load_runs_vcn(ni, attr->type, attr_name(attr),
+@@ -1678,7 +1677,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size,
+       if (err)
+               goto out;
+-      err = attr_is_frame_compressed(ni, attr_b, frame, &clst_data);
++      err = attr_is_frame_compressed(ni, attr_b, frame, &clst_data, run);
+       if (err)
+               goto out;
+diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
+index 41c7ffad27901..c33e818b3164c 100644
+--- a/fs/ntfs3/frecord.c
++++ b/fs/ntfs3/frecord.c
+@@ -1900,46 +1900,6 @@ enum REPARSE_SIGN ni_parse_reparse(struct ntfs_inode *ni, struct ATTRIB *attr,
+       return REPARSE_LINK;
+ }
+-/*
+- * fiemap_fill_next_extent_k - a copy of fiemap_fill_next_extent
+- * but it uses 'fe_k' instead of fieinfo->fi_extents_start
+- */
+-static int fiemap_fill_next_extent_k(struct fiemap_extent_info *fieinfo,
+-                                   struct fiemap_extent *fe_k, u64 logical,
+-                                   u64 phys, u64 len, u32 flags)
+-{
+-      struct fiemap_extent extent;
+-
+-      /* only count the extents */
+-      if (fieinfo->fi_extents_max == 0) {
+-              fieinfo->fi_extents_mapped++;
+-              return (flags & FIEMAP_EXTENT_LAST) ? 1 : 0;
+-      }
+-
+-      if (fieinfo->fi_extents_mapped >= fieinfo->fi_extents_max)
+-              return 1;
+-
+-      if (flags & FIEMAP_EXTENT_DELALLOC)
+-              flags |= FIEMAP_EXTENT_UNKNOWN;
+-      if (flags & FIEMAP_EXTENT_DATA_ENCRYPTED)
+-              flags |= FIEMAP_EXTENT_ENCODED;
+-      if (flags & (FIEMAP_EXTENT_DATA_TAIL | FIEMAP_EXTENT_DATA_INLINE))
+-              flags |= FIEMAP_EXTENT_NOT_ALIGNED;
+-
+-      memset(&extent, 0, sizeof(extent));
+-      extent.fe_logical = logical;
+-      extent.fe_physical = phys;
+-      extent.fe_length = len;
+-      extent.fe_flags = flags;
+-
+-      memcpy(fe_k + fieinfo->fi_extents_mapped, &extent, sizeof(extent));
+-
+-      fieinfo->fi_extents_mapped++;
+-      if (fieinfo->fi_extents_mapped == fieinfo->fi_extents_max)
+-              return 1;
+-      return (flags & FIEMAP_EXTENT_LAST) ? 1 : 0;
+-}
+-
+ /*
+  * ni_fiemap - Helper for file_fiemap().
+  *
+@@ -1950,11 +1910,9 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+             __u64 vbo, __u64 len)
+ {
+       int err = 0;
+-      struct fiemap_extent *fe_k = NULL;
+       struct ntfs_sb_info *sbi = ni->mi.sbi;
+       u8 cluster_bits = sbi->cluster_bits;
+-      struct runs_tree *run;
+-      struct rw_semaphore *run_lock;
++      struct runs_tree run;
+       struct ATTRIB *attr;
+       CLST vcn = vbo >> cluster_bits;
+       CLST lcn, clen;
+@@ -1965,13 +1923,11 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+       u32 flags;
+       bool ok;
++      run_init(&run);
+       if (S_ISDIR(ni->vfs_inode.i_mode)) {
+-              run = &ni->dir.alloc_run;
+               attr = ni_find_attr(ni, NULL, NULL, ATTR_ALLOC, I30_NAME,
+                                   ARRAY_SIZE(I30_NAME), NULL, NULL);
+-              run_lock = &ni->dir.run_lock;
+       } else {
+-              run = &ni->file.run;
+               attr = ni_find_attr(ni, NULL, NULL, ATTR_DATA, NULL, 0, NULL,
+                                   NULL);
+               if (!attr) {
+@@ -1986,7 +1942,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+                               "fiemap is not supported for compressed file (cp -r)");
+                       goto out;
+               }
+-              run_lock = &ni->file.run_lock;
+       }
+       if (!attr || !attr->non_res) {
+@@ -1998,51 +1953,33 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+               goto out;
+       }
+-      /*
+-       * To avoid lock problems replace pointer to user memory by pointer to kernel memory.
+-       */
+-      fe_k = kmalloc_array(fieinfo->fi_extents_max,
+-                           sizeof(struct fiemap_extent),
+-                           GFP_NOFS | __GFP_ZERO);
+-      if (!fe_k) {
+-              err = -ENOMEM;
+-              goto out;
+-      }
+-
+       end = vbo + len;
+       alloc_size = le64_to_cpu(attr->nres.alloc_size);
+       if (end > alloc_size)
+               end = alloc_size;
+-      down_read(run_lock);
+       while (vbo < end) {
+               if (idx == -1) {
+-                      ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx);
++                      ok = run_lookup_entry(&run, vcn, &lcn, &clen, &idx);
+               } else {
+                       CLST vcn_next = vcn;
+-                      ok = run_get_entry(run, ++idx, &vcn, &lcn, &clen) &&
++                      ok = run_get_entry(&run, ++idx, &vcn, &lcn, &clen) &&
+                            vcn == vcn_next;
+                       if (!ok)
+                               vcn = vcn_next;
+               }
+               if (!ok) {
+-                      up_read(run_lock);
+-                      down_write(run_lock);
+-
+                       err = attr_load_runs_vcn(ni, attr->type,
+                                                attr_name(attr),
+-                                               attr->name_len, run, vcn);
+-
+-                      up_write(run_lock);
+-                      down_read(run_lock);
++                                               attr->name_len, &run, vcn);
+                       if (err)
+                               break;
+-                      ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx);
++                      ok = run_lookup_entry(&run, vcn, &lcn, &clen, &idx);
+                       if (!ok) {
+                               err = -EINVAL;
+@@ -2067,8 +2004,9 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+               } else if (is_attr_compressed(attr)) {
+                       CLST clst_data;
+-                      err = attr_is_frame_compressed(
+-                              ni, attr, vcn >> attr->nres.c_unit, &clst_data);
++                      err = attr_is_frame_compressed(ni, attr,
++                                                     vcn >> attr->nres.c_unit,
++                                                     &clst_data, &run);
+                       if (err)
+                               break;
+                       if (clst_data < NTFS_LZNT_CLUSTERS)
+@@ -2097,8 +2035,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+                       if (vbo + dlen >= end)
+                               flags |= FIEMAP_EXTENT_LAST;
+-                      err = fiemap_fill_next_extent_k(fieinfo, fe_k, vbo, lbo,
+-                                                      dlen, flags);
++                      err = fiemap_fill_next_extent(fieinfo, vbo, lbo, dlen,
++                                                    flags);
+                       if (err < 0)
+                               break;
+@@ -2119,8 +2057,7 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+               if (vbo + bytes >= end)
+                       flags |= FIEMAP_EXTENT_LAST;
+-              err = fiemap_fill_next_extent_k(fieinfo, fe_k, vbo, lbo, bytes,
+-                                              flags);
++              err = fiemap_fill_next_extent(fieinfo, vbo, lbo, bytes, flags);
+               if (err < 0)
+                       break;
+               if (err == 1) {
+@@ -2131,19 +2068,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+               vbo += bytes;
+       }
+-      up_read(run_lock);
+-
+-      /*
+-       * Copy to user memory out of lock
+-       */
+-      if (copy_to_user(fieinfo->fi_extents_start, fe_k,
+-                       fieinfo->fi_extents_max *
+-                               sizeof(struct fiemap_extent))) {
+-              err = -EFAULT;
+-      }
+-
+ out:
+-      kfree(fe_k);
++      run_close(&run);
+       return err;
+ }
+@@ -2672,7 +2598,8 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages,
+               down_write(&ni->file.run_lock);
+               run_truncate_around(run, le64_to_cpu(attr->nres.svcn));
+               frame = frame_vbo >> (cluster_bits + NTFS_LZNT_CUNIT);
+-              err = attr_is_frame_compressed(ni, attr, frame, &clst_data);
++              err = attr_is_frame_compressed(ni, attr, frame, &clst_data,
++                                             run);
+               up_write(&ni->file.run_lock);
+               if (err)
+                       goto out1;
+diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
+index 26e1e1379c04e..cd8e8374bb5a0 100644
+--- a/fs/ntfs3/ntfs_fs.h
++++ b/fs/ntfs3/ntfs_fs.h
+@@ -446,7 +446,8 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr,
+                       struct runs_tree *run, u64 frame, u64 frames,
+                       u8 frame_bits, u32 *ondisk_size, u64 *vbo_data);
+ int attr_is_frame_compressed(struct ntfs_inode *ni, struct ATTRIB *attr,
+-                           CLST frame, CLST *clst_data);
++                           CLST frame, CLST *clst_data,
++                           struct runs_tree *run);
+ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size,
+                       u64 new_valid);
+ int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes);
+-- 
+2.43.0
+
diff --git a/queue-6.12/fsl-fman-validate-cell-index-value-obtained-from-dev.patch b/queue-6.12/fsl-fman-validate-cell-index-value-obtained-from-dev.patch
new file mode 100644 (file)
index 0000000..dff520f
--- /dev/null
@@ -0,0 +1,75 @@
+From 25e8a222e15b6b004cb8f54c71605b7a7556d89c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2024 09:58:24 +0300
+Subject: fsl/fman: Validate cell-index value obtained from Device Tree
+
+From: Aleksandr Mishin <amishin@t-argos.ru>
+
+[ Upstream commit bd50c4125c98bd1a86f8e514872159700a9c678c ]
+
+Cell-index value is obtained from Device Tree and then used to calculate
+the index for accessing arrays port_mfl[], mac_mfl[] and intr_mng[].
+In case of broken DT due to any error cell-index can contain any value
+and it is possible to go beyond the array boundaries which can lead
+at least to memory corruption.
+
+Validate cell-index value obtained from Device Tree.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Reviewed-by: Sean Anderson <sean.anderson@seco.com>
+Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
+Link: https://patch.msgid.link/20241028065824.15452-1-amishin@t-argos.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman.c | 1 -
+ drivers/net/ethernet/freescale/fman/fman.h | 3 +++
+ drivers/net/ethernet/freescale/fman/mac.c  | 5 +++++
+ 3 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
+index d96028f01770c..fb416d60dcd72 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -24,7 +24,6 @@
+ /* General defines */
+ #define FMAN_LIODN_TBL                        64      /* size of LIODN table */
+-#define MAX_NUM_OF_MACS                       10
+ #define FM_NUM_OF_FMAN_CTRL_EVENT_REGS        4
+ #define BASE_RX_PORTID                        0x08
+ #define BASE_TX_PORTID                        0x28
+diff --git a/drivers/net/ethernet/freescale/fman/fman.h b/drivers/net/ethernet/freescale/fman/fman.h
+index 2ea575a46675b..74eb62eba0d7f 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.h
++++ b/drivers/net/ethernet/freescale/fman/fman.h
+@@ -74,6 +74,9 @@
+ #define BM_MAX_NUM_OF_POOLS           64 /* Buffers pools */
+ #define FMAN_PORT_MAX_EXT_POOLS_NUM   8  /* External BM pools per Rx port */
++/* General defines */
++#define MAX_NUM_OF_MACS                       10
++
+ struct fman; /* FMan data */
+ /* Enum for defining port types */
+diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
+index 11da139082e1b..1916a2ac48b9f 100644
+--- a/drivers/net/ethernet/freescale/fman/mac.c
++++ b/drivers/net/ethernet/freescale/fman/mac.c
+@@ -259,6 +259,11 @@ static int mac_probe(struct platform_device *_of_dev)
+               err = -EINVAL;
+               goto _return_dev_put;
+       }
++      if (val >= MAX_NUM_OF_MACS) {
++              dev_err(dev, "cell-index value is too big for %pOF\n", mac_node);
++              err = -EINVAL;
++              goto _return_dev_put;
++      }
+       priv->cell_index = (u8)val;
+       /* Get the MAC address */
+-- 
+2.43.0
+
diff --git a/queue-6.12/gpio-free-irqs-that-are-still-requested-when-the-chi.patch b/queue-6.12/gpio-free-irqs-that-are-still-requested-when-the-chi.patch
new file mode 100644 (file)
index 0000000..c72e8a7
--- /dev/null
@@ -0,0 +1,99 @@
+From 97e3501eae7a095be75b565db2eb29d224580dc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2024 15:51:04 +0200
+Subject: gpio: free irqs that are still requested when the chip is being
+ removed
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit ec8b6f55b98146c41dcf15e8189eb43291e35e89 ]
+
+If we remove a GPIO chip that is also an interrupt controller with users
+not having freed some interrupts, we'll end up leaking resources as
+indicated by the following warning:
+
+  remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'gpio'
+
+As there's no way of notifying interrupt users about the irqchip going
+away and the interrupt subsystem is not plugged into the driver model and
+so not all cases can be handled by devlinks, we need to make sure to free
+all interrupts before the complete the removal of the provider.
+
+Reviewed-by: Herve Codina <herve.codina@bootlin.com>
+Tested-by: Herve Codina <herve.codina@bootlin.com>
+Link: https://lore.kernel.org/r/20240919135104.3583-1-brgl@bgdev.pl
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 2b02655abb56e..44372f8647d51 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -14,6 +14,7 @@
+ #include <linux/idr.h>
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
++#include <linux/irqdesc.h>
+ #include <linux/kernel.h>
+ #include <linux/list.h>
+ #include <linux/lockdep.h>
+@@ -713,6 +714,45 @@ bool gpiochip_line_is_valid(const struct gpio_chip *gc,
+ }
+ EXPORT_SYMBOL_GPL(gpiochip_line_is_valid);
++static void gpiod_free_irqs(struct gpio_desc *desc)
++{
++      int irq = gpiod_to_irq(desc);
++      struct irq_desc *irqd = irq_to_desc(irq);
++      void *cookie;
++
++      for (;;) {
++              /*
++               * Make sure the action doesn't go away while we're
++               * dereferencing it. Retrieve and store the cookie value.
++               * If the irq is freed after we release the lock, that's
++               * alright - the underlying maple tree lookup will return NULL
++               * and nothing will happen in free_irq().
++               */
++              scoped_guard(mutex, &irqd->request_mutex) {
++                      if (!irq_desc_has_action(irqd))
++                              return;
++
++                      cookie = irqd->action->dev_id;
++              }
++
++              free_irq(irq, cookie);
++      }
++}
++
++/*
++ * The chip is going away but there may be users who had requested interrupts
++ * on its GPIO lines who have no idea about its removal and have no way of
++ * being notified about it. We need to free any interrupts still in use here or
++ * we'll leak memory and resources (like procfs files).
++ */
++static void gpiochip_free_remaining_irqs(struct gpio_chip *gc)
++{
++      struct gpio_desc *desc;
++
++      for_each_gpio_desc_with_flag(gc, desc, FLAG_USED_AS_IRQ)
++              gpiod_free_irqs(desc);
++}
++
+ static void gpiodev_release(struct device *dev)
+ {
+       struct gpio_device *gdev = to_gpio_device(dev);
+@@ -1125,6 +1165,7 @@ void gpiochip_remove(struct gpio_chip *gc)
+       /* FIXME: should the legacy sysfs handling be moved to gpio_device? */
+       gpiochip_sysfs_unregister(gdev);
+       gpiochip_free_hogs(gc);
++      gpiochip_free_remaining_irqs(gc);
+       scoped_guard(mutex, &gpio_devices_lock)
+               list_del_rcu(&gdev->list);
+-- 
+2.43.0
+
diff --git a/queue-6.12/hid-add-per-device-quirk-to-force-bind-to-hid-generi.patch b/queue-6.12/hid-add-per-device-quirk-to-force-bind-to-hid-generi.patch
new file mode 100644 (file)
index 0000000..5872796
--- /dev/null
@@ -0,0 +1,80 @@
+From e9ce743ec31a1ae09095ab6b8fa8a26459890b74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 16:30:12 +0200
+Subject: HID: add per device quirk to force bind to hid-generic
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+[ Upstream commit 645c224ac5f6e0013931c342ea707b398d24d410 ]
+
+We already have the possibility to force not binding to hid-generic and
+rely on a dedicated driver, but we couldn't do the other way around.
+
+This is useful for BPF programs where we are fixing the report descriptor
+and the events, but want to avoid a specialized driver to come after BPF
+which would unwind everything that is done there.
+
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Link: https://patch.msgid.link/20241001-hid-bpf-hid-generic-v3-8-2ef1019468df@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c    | 5 +++--
+ drivers/hid/hid-generic.c | 3 +++
+ include/linux/hid.h       | 2 ++
+ 3 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 582fd234eec78..935ccc38d1295 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -2674,9 +2674,10 @@ static bool hid_check_device_match(struct hid_device *hdev,
+       /*
+        * hid-generic implements .match(), so we must be dealing with a
+        * different HID driver here, and can simply check if
+-       * hid_ignore_special_drivers is set or not.
++       * hid_ignore_special_drivers or HID_QUIRK_IGNORE_SPECIAL_DRIVER
++       * are set or not.
+        */
+-      return !hid_ignore_special_drivers;
++      return !hid_ignore_special_drivers && !(hdev->quirks & HID_QUIRK_IGNORE_SPECIAL_DRIVER);
+ }
+ static int __hid_device_probe(struct hid_device *hdev, struct hid_driver *hdrv)
+diff --git a/drivers/hid/hid-generic.c b/drivers/hid/hid-generic.c
+index d2439399fb357..9e04c6d0fcc87 100644
+--- a/drivers/hid/hid-generic.c
++++ b/drivers/hid/hid-generic.c
+@@ -40,6 +40,9 @@ static bool hid_generic_match(struct hid_device *hdev,
+       if (ignore_special_driver)
+               return true;
++      if (hdev->quirks & HID_QUIRK_IGNORE_SPECIAL_DRIVER)
++              return true;
++
+       if (hdev->quirks & HID_QUIRK_HAVE_SPECIAL_DRIVER)
+               return false;
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 121d5b8bc8675..a7d60a1c72a09 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -359,6 +359,7 @@ struct hid_item {
+  * | @HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP:
+  * | @HID_QUIRK_HAVE_SPECIAL_DRIVER:
+  * | @HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE:
++ * | @HID_QUIRK_IGNORE_SPECIAL_DRIVER
+  * | @HID_QUIRK_FULLSPEED_INTERVAL:
+  * | @HID_QUIRK_NO_INIT_REPORTS:
+  * | @HID_QUIRK_NO_IGNORE:
+@@ -384,6 +385,7 @@ struct hid_item {
+ #define HID_QUIRK_HAVE_SPECIAL_DRIVER         BIT(19)
+ #define HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE        BIT(20)
+ #define HID_QUIRK_NOINVERT                    BIT(21)
++#define HID_QUIRK_IGNORE_SPECIAL_DRIVER               BIT(22)
+ #define HID_QUIRK_FULLSPEED_INTERVAL          BIT(28)
+ #define HID_QUIRK_NO_INIT_REPORTS             BIT(29)
+ #define HID_QUIRK_NO_IGNORE                   BIT(30)
+-- 
+2.43.0
+
diff --git a/queue-6.12/hid-bpf-fix-nkro-on-mistel-md770.patch b/queue-6.12/hid-bpf-fix-nkro-on-mistel-md770.patch
new file mode 100644 (file)
index 0000000..b7d36d9
--- /dev/null
@@ -0,0 +1,191 @@
+From d603286859327a5205e3a4ad57d6b1a17c7aacc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 18:34:58 +0200
+Subject: HID: bpf: Fix NKRO on Mistel MD770
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+[ Upstream commit 9bc089307e8dff7797233308372b4a90ce8f79be ]
+
+Mistel MD770 keyboard (using Holtek Semiconductor, Inc. controller) has
+a quirk in report descriptor in one of its interfaces (more detail in
+the source file). Fix up the descriptor to allow NKRO to work again.
+
+Tested by loading the BPF program and confirming that 8 simultaneous
+keypresses work.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218495
+Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/122
+Signed-off-by: Tatsuyuki Ishi <ishitatsuyuki@gmail.com>
+Acked-by: Jiri Kosina <jkosina@suse.com>
+Link: https://patch.msgid.link/20241017-import_bpf_6-13-v2-1-6a7acb89a97f@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/bpf/progs/Mistel__MD770.bpf.c | 154 ++++++++++++++++++++++
+ 1 file changed, 154 insertions(+)
+ create mode 100644 drivers/hid/bpf/progs/Mistel__MD770.bpf.c
+
+diff --git a/drivers/hid/bpf/progs/Mistel__MD770.bpf.c b/drivers/hid/bpf/progs/Mistel__MD770.bpf.c
+new file mode 100644
+index 0000000000000..fb8b5a6968b12
+--- /dev/null
++++ b/drivers/hid/bpf/progs/Mistel__MD770.bpf.c
+@@ -0,0 +1,154 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2024 Tatsuyuki Ishi
++ */
++
++#include "vmlinux.h"
++#include "hid_bpf.h"
++#include "hid_bpf_helpers.h"
++#include <bpf/bpf_tracing.h>
++
++#define VID_HOLTEK    0x04D9
++#define PID_MD770     0x0339
++#define RDESC_SIZE    203
++
++HID_BPF_CONFIG(
++      HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, VID_HOLTEK, PID_MD770)
++);
++
++/*
++ * The Mistel MD770 keyboard reports the first 6 simultaneous key presses
++ * through the first interface, and anything beyond that through a second
++ * interface. Unfortunately, the second interface's report descriptor has an
++ * error, causing events to be malformed and ignored. This HID-BPF driver
++ * fixes the descriptor to allow NKRO to work again.
++ *
++ * For reference, this is the original report descriptor:
++ *
++ * 0x05, 0x01,        // Usage Page (Generic Desktop)        0
++ * 0x09, 0x80,        // Usage (System Control)              2
++ * 0xa1, 0x01,        // Collection (Application)            4
++ * 0x85, 0x01,        //  Report ID (1)                      6
++ * 0x19, 0x81,        //  Usage Minimum (129)                8
++ * 0x29, 0x83,        //  Usage Maximum (131)                10
++ * 0x15, 0x00,        //  Logical Minimum (0)                12
++ * 0x25, 0x01,        //  Logical Maximum (1)                14
++ * 0x95, 0x03,        //  Report Count (3)                   16
++ * 0x75, 0x01,        //  Report Size (1)                    18
++ * 0x81, 0x02,        //  Input (Data,Var,Abs)               20
++ * 0x95, 0x01,        //  Report Count (1)                   22
++ * 0x75, 0x05,        //  Report Size (5)                    24
++ * 0x81, 0x01,        //  Input (Cnst,Arr,Abs)               26
++ * 0xc0,              // End Collection                      28
++ * 0x05, 0x0c,        // Usage Page (Consumer Devices)       29
++ * 0x09, 0x01,        // Usage (Consumer Control)            31
++ * 0xa1, 0x01,        // Collection (Application)            33
++ * 0x85, 0x02,        //  Report ID (2)                      35
++ * 0x15, 0x00,        //  Logical Minimum (0)                37
++ * 0x25, 0x01,        //  Logical Maximum (1)                39
++ * 0x95, 0x12,        //  Report Count (18)                  41
++ * 0x75, 0x01,        //  Report Size (1)                    43
++ * 0x0a, 0x83, 0x01,  //  Usage (AL Consumer Control Config) 45
++ * 0x0a, 0x8a, 0x01,  //  Usage (AL Email Reader)            48
++ * 0x0a, 0x92, 0x01,  //  Usage (AL Calculator)              51
++ * 0x0a, 0x94, 0x01,  //  Usage (AL Local Machine Browser)   54
++ * 0x09, 0xcd,        //  Usage (Play/Pause)                 57
++ * 0x09, 0xb7,        //  Usage (Stop)                       59
++ * 0x09, 0xb6,        //  Usage (Scan Previous Track)        61
++ * 0x09, 0xb5,        //  Usage (Scan Next Track)            63
++ * 0x09, 0xe2,        //  Usage (Mute)                       65
++ * 0x09, 0xea,        //  Usage (Volume Down)                67
++ * 0x09, 0xe9,        //  Usage (Volume Up)                  69
++ * 0x0a, 0x21, 0x02,  //  Usage (AC Search)                  71
++ * 0x0a, 0x23, 0x02,  //  Usage (AC Home)                    74
++ * 0x0a, 0x24, 0x02,  //  Usage (AC Back)                    77
++ * 0x0a, 0x25, 0x02,  //  Usage (AC Forward)                 80
++ * 0x0a, 0x26, 0x02,  //  Usage (AC Stop)                    83
++ * 0x0a, 0x27, 0x02,  //  Usage (AC Refresh)                 86
++ * 0x0a, 0x2a, 0x02,  //  Usage (AC Bookmarks)               89
++ * 0x81, 0x02,        //  Input (Data,Var,Abs)               92
++ * 0x95, 0x01,        //  Report Count (1)                   94
++ * 0x75, 0x0e,        //  Report Size (14)                   96
++ * 0x81, 0x01,        //  Input (Cnst,Arr,Abs)               98
++ * 0xc0,              // End Collection                      100
++ * 0x05, 0x01,        // Usage Page (Generic Desktop)        101
++ * 0x09, 0x02,        // Usage (Mouse)                       103
++ * 0xa1, 0x01,        // Collection (Application)            105
++ * 0x09, 0x01,        //  Usage (Pointer)                    107
++ * 0xa1, 0x00,        //  Collection (Physical)              109
++ * 0x85, 0x03,        //   Report ID (3)                     111
++ * 0x05, 0x09,        //   Usage Page (Button)               113
++ * 0x19, 0x01,        //   Usage Minimum (1)                 115
++ * 0x29, 0x08,        //   Usage Maximum (8)                 117
++ * 0x15, 0x00,        //   Logical Minimum (0)               119
++ * 0x25, 0x01,        //   Logical Maximum (1)               121
++ * 0x75, 0x01,        //   Report Size (1)                   123
++ * 0x95, 0x08,        //   Report Count (8)                  125
++ * 0x81, 0x02,        //   Input (Data,Var,Abs)              127
++ * 0x05, 0x01,        //   Usage Page (Generic Desktop)      129
++ * 0x09, 0x30,        //   Usage (X)                         131
++ * 0x09, 0x31,        //   Usage (Y)                         133
++ * 0x16, 0x01, 0x80,  //   Logical Minimum (-32767)          135
++ * 0x26, 0xff, 0x7f,  //   Logical Maximum (32767)           138
++ * 0x75, 0x10,        //   Report Size (16)                  141
++ * 0x95, 0x02,        //   Report Count (2)                  143
++ * 0x81, 0x06,        //   Input (Data,Var,Rel)              145
++ * 0x09, 0x38,        //   Usage (Wheel)                     147
++ * 0x15, 0x81,        //   Logical Minimum (-127)            149
++ * 0x25, 0x7f,        //   Logical Maximum (127)             151
++ * 0x75, 0x08,        //   Report Size (8)                   153
++ * 0x95, 0x01,        //   Report Count (1)                  155
++ * 0x81, 0x06,        //   Input (Data,Var,Rel)              157
++ * 0x05, 0x0c,        //   Usage Page (Consumer Devices)     159
++ * 0x0a, 0x38, 0x02,  //   Usage (AC Pan)                    161
++ * 0x95, 0x01,        //   Report Count (1)                  164
++ * 0x81, 0x06,        //   Input (Data,Var,Rel)              166
++ * 0xc0,              //  End Collection                     168
++ * 0xc0,              // End Collection                      169
++ * 0x05, 0x01,        // Usage Page (Generic Desktop)        170
++ * 0x09, 0x06,        // Usage (Keyboard)                    172
++ * 0xa1, 0x01,        // Collection (Application)            174
++ * 0x85, 0x04,        //  Report ID (4)                      176
++ * 0x05, 0x07,        //  Usage Page (Keyboard)              178
++ * 0x95, 0x01,        //  Report Count (1)                   180
++ * 0x75, 0x08,        //  Report Size (8)                    182
++ * 0x81, 0x03,        //  Input (Cnst,Var,Abs)               184
++ * 0x95, 0xe8,        //  Report Count (232)                 186
++ * 0x75, 0x01,        //  Report Size (1)                    188
++ * 0x15, 0x00,        //  Logical Minimum (0)                190
++ * 0x25, 0x01,        //  Logical Maximum (1)                192
++ * 0x05, 0x07,        //  Usage Page (Keyboard)              194
++ * 0x19, 0x00,        //  Usage Minimum (0)                  196
++ * 0x29, 0xe7,        //  Usage Maximum (231)                198
++ * 0x81, 0x00,        //  Input (Data,Arr,Abs)               200  <- change to 0x81, 0x02 (Data,Var,Abs)
++ * 0xc0,              // End Collection                      202
++ */
++
++SEC(HID_BPF_RDESC_FIXUP)
++int BPF_PROG(hid_rdesc_fixup_mistel_md770, struct hid_bpf_ctx *hctx)
++{
++      __u8 *data = hid_bpf_get_data(hctx, 0, HID_MAX_DESCRIPTOR_SIZE);
++
++      if (!data)
++              return 0; /* EPERM check */
++
++      if (data[201] == 0x00)
++              data[201] = 0x02;
++
++      return 0;
++}
++
++HID_BPF_OPS(mistel_md770) = {
++      .hid_rdesc_fixup = (void *)hid_rdesc_fixup_mistel_md770,
++};
++
++SEC("syscall")
++int probe(struct hid_bpf_probe_args *ctx)
++{
++      ctx->retval = ctx->rdesc_size != RDESC_SIZE;
++      if (ctx->retval)
++              ctx->retval = -EINVAL;
++
++      return 0;
++}
++
++char _license[] SEC("license") = "GPL";
+-- 
+2.43.0
+
diff --git a/queue-6.12/hid-magicmouse-apple-magic-trackpad-2-usb-c-driver-s.patch b/queue-6.12/hid-magicmouse-apple-magic-trackpad-2-usb-c-driver-s.patch
new file mode 100644 (file)
index 0000000..761a4ed
--- /dev/null
@@ -0,0 +1,203 @@
+From 990308d7ba9112dbd75ca822bcdfaaf45e3f5e3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2024 22:49:28 +0100
+Subject: HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
+
+From: Callahan Kovacs <callahankovacs@gmail.com>
+
+[ Upstream commit 87a2f10395c82c2b4687bb8611a6c5663a12f9e7 ]
+
+Adds driver support for the USB-C model of Apple's Magic Trackpad 2.
+
+The 2024 USB-C model is compatible with the existing Magic Trackpad 2
+driver but has a different hardware ID.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219470
+Signed-off-by: Callahan Kovacs <callahankovacs@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h        |  1 +
+ drivers/hid/hid-magicmouse.c | 56 ++++++++++++++++++++++++++----------
+ 2 files changed, 42 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 92cff3f2658cf..0f23be98c56e2 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -94,6 +94,7 @@
+ #define USB_DEVICE_ID_APPLE_MAGICMOUSE2       0x0269
+ #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD     0x030e
+ #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD2    0x0265
++#define USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC       0x0324
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI     0x020e
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_ISO      0x020f
+ #define USB_DEVICE_ID_APPLE_GEYSER_ANSI       0x0214
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index 8a73b59e0827b..ec110dea87726 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -227,7 +227,9 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda
+               touch_minor = tdata[4];
+               state = tdata[7] & TOUCH_STATE_MASK;
+               down = state != TOUCH_STATE_NONE;
+-      } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
++      } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++                 input->id.product ==
++                         USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
+               id = tdata[8] & 0xf;
+               x = (tdata[1] << 27 | tdata[0] << 19) >> 19;
+               y = -((tdata[3] << 30 | tdata[2] << 22 | tdata[1] << 14) >> 19);
+@@ -259,8 +261,9 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda
+       /* If requested, emulate a scroll wheel by detecting small
+        * vertical touch motions.
+        */
+-      if (emulate_scroll_wheel && (input->id.product !=
+-                      USB_DEVICE_ID_APPLE_MAGICTRACKPAD2)) {
++      if (emulate_scroll_wheel &&
++          input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 &&
++          input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
+               unsigned long now = jiffies;
+               int step_x = msc->touches[id].scroll_x - x;
+               int step_y = msc->touches[id].scroll_y - y;
+@@ -359,7 +362,9 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda
+               input_report_abs(input, ABS_MT_POSITION_X, x);
+               input_report_abs(input, ABS_MT_POSITION_Y, y);
+-              if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2)
++              if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++                  input->id.product ==
++                          USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC)
+                       input_report_abs(input, ABS_MT_PRESSURE, pressure);
+               if (report_undeciphered) {
+@@ -367,7 +372,9 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda
+                           input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE2)
+                               input_event(input, EV_MSC, MSC_RAW, tdata[7]);
+                       else if (input->id.product !=
+-                                      USB_DEVICE_ID_APPLE_MAGICTRACKPAD2)
++                                       USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 &&
++                               input->id.product !=
++                                       USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC)
+                               input_event(input, EV_MSC, MSC_RAW, tdata[8]);
+               }
+       }
+@@ -493,7 +500,9 @@ static int magicmouse_raw_event(struct hid_device *hdev,
+               magicmouse_emit_buttons(msc, clicks & 3);
+               input_report_rel(input, REL_X, x);
+               input_report_rel(input, REL_Y, y);
+-      } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
++      } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++                 input->id.product ==
++                         USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
+               input_mt_sync_frame(input);
+               input_report_key(input, BTN_MOUSE, clicks & 1);
+       } else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
+@@ -545,7 +554,9 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
+                       __set_bit(REL_WHEEL_HI_RES, input->relbit);
+                       __set_bit(REL_HWHEEL_HI_RES, input->relbit);
+               }
+-      } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
++      } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++                 input->id.product ==
++                         USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
+               /* If the trackpad has been connected to a Mac, the name is
+                * automatically personalized, e.g., "José Expósito's Trackpad".
+                * When connected through Bluetooth, the personalized name is
+@@ -621,7 +632,9 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
+                                 MOUSE_RES_X);
+               input_abs_set_res(input, ABS_MT_POSITION_Y,
+                                 MOUSE_RES_Y);
+-      } else if (input->id.product ==  USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
++      } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++                 input->id.product ==
++                         USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
+               input_set_abs_params(input, ABS_MT_PRESSURE, 0, 253, 0, 0);
+               input_set_abs_params(input, ABS_PRESSURE, 0, 253, 0, 0);
+               input_set_abs_params(input, ABS_MT_ORIENTATION, -3, 4, 0, 0);
+@@ -660,7 +673,8 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
+       input_set_events_per_packet(input, 60);
+       if (report_undeciphered &&
+-          input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
++          input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 &&
++          input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
+               __set_bit(EV_MSC, input->evbit);
+               __set_bit(MSC_RAW, input->mscbit);
+       }
+@@ -685,7 +699,9 @@ static int magicmouse_input_mapping(struct hid_device *hdev,
+       /* Magic Trackpad does not give relative data after switching to MT */
+       if ((hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD ||
+-           hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) &&
++           hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++           hi->input->id.product ==
++                   USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) &&
+           field->flags & HID_MAIN_ITEM_RELATIVE)
+               return -1;
+@@ -721,7 +737,8 @@ static int magicmouse_enable_multitouch(struct hid_device *hdev)
+       int ret;
+       int feature_size;
+-      if (hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
++      if (hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++          hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
+               if (hdev->vendor == BT_VENDOR_ID_APPLE) {
+                       feature_size = sizeof(feature_mt_trackpad2_bt);
+                       feature = feature_mt_trackpad2_bt;
+@@ -766,7 +783,8 @@ static int magicmouse_fetch_battery(struct hid_device *hdev)
+       if (!hdev->battery || hdev->vendor != USB_VENDOR_ID_APPLE ||
+           (hdev->product != USB_DEVICE_ID_APPLE_MAGICMOUSE2 &&
+-           hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2))
++           hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 &&
++           hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC))
+               return -1;
+       report_enum = &hdev->report_enum[hdev->battery_report_type];
+@@ -835,7 +853,9 @@ static int magicmouse_probe(struct hid_device *hdev,
+       if (id->vendor == USB_VENDOR_ID_APPLE &&
+           (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2 ||
+-           (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 && hdev->type != HID_TYPE_USBMOUSE)))
++           ((id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++             id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) &&
++            hdev->type != HID_TYPE_USBMOUSE)))
+               return 0;
+       if (!msc->input) {
+@@ -850,7 +870,8 @@ static int magicmouse_probe(struct hid_device *hdev,
+       else if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2)
+               report = hid_register_report(hdev, HID_INPUT_REPORT,
+                       MOUSE2_REPORT_ID, 0);
+-      else if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
++      else if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++               id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) {
+               if (id->vendor == BT_VENDOR_ID_APPLE)
+                       report = hid_register_report(hdev, HID_INPUT_REPORT,
+                               TRACKPAD2_BT_REPORT_ID, 0);
+@@ -920,7 +941,8 @@ static const __u8 *magicmouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+        */
+       if (hdev->vendor == USB_VENDOR_ID_APPLE &&
+           (hdev->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2 ||
+-           hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) &&
++           hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 ||
++           hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) &&
+           *rsize == 83 && rdesc[46] == 0x84 && rdesc[58] == 0x85) {
+               hid_info(hdev,
+                        "fixing up magicmouse battery report descriptor\n");
+@@ -951,6 +973,10 @@ static const struct hid_device_id magic_mice[] = {
+               USB_DEVICE_ID_APPLE_MAGICTRACKPAD2), .driver_data = 0 },
+       { HID_USB_DEVICE(USB_VENDOR_ID_APPLE,
+               USB_DEVICE_ID_APPLE_MAGICTRACKPAD2), .driver_data = 0 },
++      { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE,
++              USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC), .driver_data = 0 },
++      { HID_USB_DEVICE(USB_VENDOR_ID_APPLE,
++              USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC), .driver_data = 0 },
+       { }
+ };
+ MODULE_DEVICE_TABLE(hid, magic_mice);
+-- 
+2.43.0
+
diff --git a/queue-6.12/hwmon-nct6775-add-665-ace-600m-cl-to-asus-wmi-monito.patch b/queue-6.12/hwmon-nct6775-add-665-ace-600m-cl-to-asus-wmi-monito.patch
new file mode 100644 (file)
index 0000000..26a3b83
--- /dev/null
@@ -0,0 +1,45 @@
+From ec645b7ce4da3e3051a630e228b3443006478b91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 09:46:10 +0200
+Subject: hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list
+
+From: Sarah Maedel <sarah.maedel@hetzner-cloud.de>
+
+[ Upstream commit ccae49e5cf6ebda1a7fa5d2ca99500987c7420c4 ]
+
+Boards such as
+* Pro WS 665-ACE
+* Pro WS 600M-CL
+have got a nct6775 chip, but by default there's no use of it
+because of resource conflict with WMI method.
+
+Add affected boards to the WMI monitoring list.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807
+Co-developed-by: Tommy Giesler <tommy.giesler@hetzner.com>
+Signed-off-by: Tommy Giesler <tommy.giesler@hetzner.com>
+Signed-off-by: Sarah Maedel <sarah.maedel@hetzner-cloud.de>
+Message-ID: <20241018074611.358619-1-sarah.maedel@hetzner-cloud.de>
+[groeck: Change commit message to imperative mood]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775-platform.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c
+index 096f1daa8f2bc..1218a3b449a80 100644
+--- a/drivers/hwmon/nct6775-platform.c
++++ b/drivers/hwmon/nct6775-platform.c
+@@ -1350,6 +1350,8 @@ static const char * const asus_msi_boards[] = {
+       "Pro H610M-CT D4",
+       "Pro H610T D4",
+       "Pro Q670M-C",
++      "Pro WS 600M-CL",
++      "Pro WS 665-ACE",
+       "Pro WS W680-ACE",
+       "Pro WS W680-ACE IPMI",
+       "Pro WS W790-ACE",
+-- 
+2.43.0
+
diff --git a/queue-6.12/i2c-i801-add-support-for-intel-panther-lake.patch b/queue-6.12/i2c-i801-add-support-for-intel-panther-lake.patch
new file mode 100644 (file)
index 0000000..45878ee
--- /dev/null
@@ -0,0 +1,78 @@
+From 26ce85a940a5b555a8e51d9391c2c45d7e312cd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 16:27:19 +0300
+Subject: i2c: i801: Add support for Intel Panther Lake
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit bd492b58371295d3ae26162b9666be584abad68a ]
+
+Add SMBus PCI IDs on Intel Panther Lake-P and -U.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/i2c/busses/i2c-i801.rst | 1 +
+ drivers/i2c/busses/Kconfig            | 1 +
+ drivers/i2c/busses/i2c-i801.c         | 6 ++++++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/Documentation/i2c/busses/i2c-i801.rst b/Documentation/i2c/busses/i2c-i801.rst
+index c840b597912c8..47e8ac5b7099f 100644
+--- a/Documentation/i2c/busses/i2c-i801.rst
++++ b/Documentation/i2c/busses/i2c-i801.rst
+@@ -49,6 +49,7 @@ Supported adapters:
+   * Intel Meteor Lake (SOC and PCH)
+   * Intel Birch Stream (SOC)
+   * Intel Arrow Lake (SOC)
++  * Intel Panther Lake (SOC)
+    Datasheets: Publicly available at the Intel website
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 6b3ba7e5723aa..2254abda5c46c 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -160,6 +160,7 @@ config I2C_I801
+           Meteor Lake (SOC and PCH)
+           Birch Stream (SOC)
+           Arrow Lake (SOC)
++          Panther Lake (SOC)
+         This driver can also be built as a module.  If so, the module
+         will be called i2c-i801.
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 299fe9d3afab0..75dab01d43a75 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -81,6 +81,8 @@
+  * Meteor Lake PCH-S (PCH)    0x7f23  32      hard    yes     yes     yes
+  * Birch Stream (SOC)         0x5796  32      hard    yes     yes     yes
+  * Arrow Lake-H (SOC)         0x7722  32      hard    yes     yes     yes
++ * Panther Lake-H (SOC)               0xe322  32      hard    yes     yes     yes
++ * Panther Lake-P (SOC)               0xe422  32      hard    yes     yes     yes
+  *
+  * Features supported by this driver:
+  * Software PEC                               no
+@@ -261,6 +263,8 @@
+ #define PCI_DEVICE_ID_INTEL_CANNONLAKE_H_SMBUS                0xa323
+ #define PCI_DEVICE_ID_INTEL_COMETLAKE_V_SMBUS         0xa3a3
+ #define PCI_DEVICE_ID_INTEL_METEOR_LAKE_SOC_S_SMBUS   0xae22
++#define PCI_DEVICE_ID_INTEL_PANTHER_LAKE_H_SMBUS      0xe322
++#define PCI_DEVICE_ID_INTEL_PANTHER_LAKE_P_SMBUS      0xe422
+ struct i801_mux_config {
+       char *gpio_chip;
+@@ -1055,6 +1059,8 @@ static const struct pci_device_id i801_ids[] = {
+       { PCI_DEVICE_DATA(INTEL, METEOR_LAKE_PCH_S_SMBUS,       FEATURES_ICH5 | FEATURE_TCO_CNL) },
+       { PCI_DEVICE_DATA(INTEL, BIRCH_STREAM_SMBUS,            FEATURES_ICH5 | FEATURE_TCO_CNL) },
+       { PCI_DEVICE_DATA(INTEL, ARROW_LAKE_H_SMBUS,            FEATURES_ICH5 | FEATURE_TCO_CNL) },
++      { PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_H_SMBUS,          FEATURES_ICH5 | FEATURE_TCO_CNL) },
++      { PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_P_SMBUS,          FEATURES_ICH5 | FEATURE_TCO_CNL) },
+       { 0, }
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.12/i3c-mipi-i3c-hci-mask-ring-interrupts-before-ring-st.patch b/queue-6.12/i3c-mipi-i3c-hci-mask-ring-interrupts-before-ring-st.patch
new file mode 100644 (file)
index 0000000..83bfa06
--- /dev/null
@@ -0,0 +1,44 @@
+From 7bc71bf1b58d37a6fba94c8aeee6d64cca235669 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2024 17:44:31 +0300
+Subject: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit 6ca2738174e4ee44edb2ab2d86ce74f015a0cc32 ]
+
+Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when
+the ring is being stopped. Depending on timing between ring stop request
+completion, interrupt handler removal and code execution this may lead
+to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run
+after the io_data pointer is set to NULL in hci_dma_cleanup().
+
+Prevent this my masking the ring interrupts before ring stop request.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Link: https://lore.kernel.org/r/20240920144432.62370-2-jarkko.nikula@linux.intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
+index a918e96b21fdd..13adc58400942 100644
+--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
+@@ -159,10 +159,10 @@ static void hci_dma_cleanup(struct i3c_hci *hci)
+       for (i = 0; i < rings->total; i++) {
+               rh = &rings->headers[i];
++              rh_reg_write(INTR_SIGNAL_ENABLE, 0);
+               rh_reg_write(RING_CONTROL, 0);
+               rh_reg_write(CR_SETUP, 0);
+               rh_reg_write(IBI_SETUP, 0);
+-              rh_reg_write(INTR_SIGNAL_ENABLE, 0);
+               if (rh->xfer)
+                       dma_free_coherent(&hci->master.dev,
+-- 
+2.43.0
+
diff --git a/queue-6.12/i3c-use-i3cdev-desc-info-instead-of-calling-i3c_devi.patch b/queue-6.12/i3c-use-i3cdev-desc-info-instead-of-calling-i3c_devi.patch
new file mode 100644 (file)
index 0000000..9ff2c3f
--- /dev/null
@@ -0,0 +1,113 @@
+From d04bd77bacd2286312bdab4373ec3271bb0edb88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 21:25:39 +0800
+Subject: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info()
+ to avoid deadlock
+
+From: Defa Li <defa.li@mediatek.com>
+
+[ Upstream commit 6cf7b65f7029914dc0cd7db86fac9ee5159008c6 ]
+
+A deadlock may happen since the i3c_master_register() acquires
+&i3cbus->lock twice. See the log below.
+Use i3cdev->desc->info instead of calling i3c_device_info() to
+avoid acquiring the lock twice.
+
+v2:
+  - Modified the title and commit message
+
+============================================
+WARNING: possible recursive locking detected
+6.11.0-mainline
+--------------------------------------------
+init/1 is trying to acquire lock:
+f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_bus_normaluse_lock
+
+but task is already holding lock:
+f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+       CPU0
+       ----
+  lock(&i3cbus->lock);
+  lock(&i3cbus->lock);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+2 locks held by init/1:
+ #0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: __driver_attach
+ #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register
+
+stack backtrace:
+CPU: 6 UID: 0 PID: 1 Comm: init
+Call trace:
+ dump_backtrace+0xfc/0x17c
+ show_stack+0x18/0x28
+ dump_stack_lvl+0x40/0xc0
+ dump_stack+0x18/0x24
+ print_deadlock_bug+0x388/0x390
+ __lock_acquire+0x18bc/0x32ec
+ lock_acquire+0x134/0x2b0
+ down_read+0x50/0x19c
+ i3c_bus_normaluse_lock+0x14/0x24
+ i3c_device_get_info+0x24/0x58
+ i3c_device_uevent+0x34/0xa4
+ dev_uevent+0x310/0x384
+ kobject_uevent_env+0x244/0x414
+ kobject_uevent+0x14/0x20
+ device_add+0x278/0x460
+ device_register+0x20/0x34
+ i3c_master_register_new_i3c_devs+0x78/0x154
+ i3c_master_register+0x6a0/0x6d4
+ mtk_i3c_master_probe+0x3b8/0x4d8
+ platform_probe+0xa0/0xe0
+ really_probe+0x114/0x454
+ __driver_probe_device+0xa0/0x15c
+ driver_probe_device+0x3c/0x1ac
+ __driver_attach+0xc4/0x1f0
+ bus_for_each_dev+0x104/0x160
+ driver_attach+0x24/0x34
+ bus_add_driver+0x14c/0x294
+ driver_register+0x68/0x104
+ __platform_driver_register+0x20/0x30
+ init_module+0x20/0xfe4
+ do_one_initcall+0x184/0x464
+ do_init_module+0x58/0x1ec
+ load_module+0xefc/0x10c8
+ __arm64_sys_finit_module+0x238/0x33c
+ invoke_syscall+0x58/0x10c
+ el0_svc_common+0xa8/0xdc
+ do_el0_svc+0x1c/0x28
+ el0_svc+0x50/0xac
+ el0t_64_sync_handler+0x70/0xbc
+ el0t_64_sync+0x1a8/0x1ac
+
+Signed-off-by: Defa Li <defa.li@mediatek.com>
+Link: https://lore.kernel.org/r/20241107132549.25439-1-defa.li@mediatek.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
+index 770908cff2434..42310c9a00c2d 100644
+--- a/drivers/i3c/master.c
++++ b/drivers/i3c/master.c
+@@ -282,7 +282,8 @@ static int i3c_device_uevent(const struct device *dev, struct kobj_uevent_env *e
+       struct i3c_device_info devinfo;
+       u16 manuf, part, ext;
+-      i3c_device_get_info(i3cdev, &devinfo);
++      if (i3cdev->desc)
++              devinfo = i3cdev->desc->info;
+       manuf = I3C_PID_MANUF_ID(devinfo.pid);
+       part = I3C_PID_PART_ID(devinfo.pid);
+       ext = I3C_PID_EXTRA_INFO(devinfo.pid);
+-- 
+2.43.0
+
diff --git a/queue-6.12/iio-adc-ad7192-properly-check-spi_get_device_match_d.patch b/queue-6.12/iio-adc-ad7192-properly-check-spi_get_device_match_d.patch
new file mode 100644 (file)
index 0000000..8719106
--- /dev/null
@@ -0,0 +1,37 @@
+From c6301b7d334d99c2cf88c2e7b53aa13371faf551 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 17:01:21 +0200
+Subject: iio: adc: ad7192: properly check spi_get_device_match_data()
+
+From: Nuno Sa <nuno.sa@analog.com>
+
+[ Upstream commit b7f99fa1b64af2f696b13cec581cb4cd7d3982b8 ]
+
+spi_get_device_match_data() can return a NULL pointer. Hence, let's
+check for it.
+
+Signed-off-by: Nuno Sa <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20241014-fix-error-check-v1-1-089e1003d12f@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7192.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iio/adc/ad7192.c b/drivers/iio/adc/ad7192.c
+index 7042ddfdfc03e..955e9eff0099e 100644
+--- a/drivers/iio/adc/ad7192.c
++++ b/drivers/iio/adc/ad7192.c
+@@ -1394,6 +1394,9 @@ static int ad7192_probe(struct spi_device *spi)
+       st->int_vref_mv = ret == -ENODEV ? avdd_mv : ret / MILLI;
+       st->chip_info = spi_get_device_match_data(spi);
++      if (!st->chip_info)
++              return -ENODEV;
++
+       indio_dev->name = st->chip_info->name;
+       indio_dev->modes = INDIO_DIRECT_MODE;
+       indio_dev->info = st->chip_info->info;
+-- 
+2.43.0
+
diff --git a/queue-6.12/iio-light-ltr501-add-lter0303-to-the-supported-devic.patch b/queue-6.12/iio-light-ltr501-add-lter0303-to-the-supported-devic.patch
new file mode 100644 (file)
index 0000000..86a4043
--- /dev/null
@@ -0,0 +1,41 @@
+From a13cf23713a9e39afe39fa9b3bcc0d6ac2daa559 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 22:05:12 +0300
+Subject: iio: light: ltr501: Add LTER0303 to the supported devices
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c26acb09ccbef47d1fddaf0783c1392d0462122c ]
+
+It has been found that the (non-vendor issued) ACPI ID for Lite-On
+LTR303 is present in Microsoft catalog. Add it to the list of the
+supported devices.
+
+Link: https://www.catalog.update.microsoft.com/Search.aspx?q=lter0303
+Closes: https://lore.kernel.org/r/9cdda3e0-d56e-466f-911f-96ffd6f602c8@redhat.com
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20241024191200.229894-24-andriy.shevchenko@linux.intel.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/light/ltr501.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
+index 8c516ede91161..640a5d3aa2c6e 100644
+--- a/drivers/iio/light/ltr501.c
++++ b/drivers/iio/light/ltr501.c
+@@ -1613,6 +1613,8 @@ static const struct acpi_device_id ltr_acpi_match[] = {
+       { "LTER0501", ltr501 },
+       { "LTER0559", ltr559 },
+       { "LTER0301", ltr301 },
++      /* https://www.catalog.update.microsoft.com/Search.aspx?q=lter0303 */
++      { "LTER0303", ltr303 },
+       { },
+ };
+ MODULE_DEVICE_TABLE(acpi, ltr_acpi_match);
+-- 
+2.43.0
+
diff --git a/queue-6.12/io_uring-tctx-work-around-xa_store-allocation-error-.patch b/queue-6.12/io_uring-tctx-work-around-xa_store-allocation-error-.patch
new file mode 100644 (file)
index 0000000..4a96860
--- /dev/null
@@ -0,0 +1,62 @@
+From a681644e8c790337a6f6d359b1186b7de708ec27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2024 07:20:28 -0700
+Subject: io_uring/tctx: work around xa_store() allocation error issue
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 7eb75ce7527129d7f1fee6951566af409a37a1c4 ]
+
+syzbot triggered the following WARN_ON:
+
+WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51
+
+which is the
+
+WARN_ON_ONCE(!xa_empty(&tctx->xa));
+
+sanity check in __io_uring_free() when a io_uring_task is going through
+its final put. The syzbot test case includes injecting memory allocation
+failures, and it very much looks like xa_store() can fail one of its
+memory allocations and end up with ->head being non-NULL even though no
+entries exist in the xarray.
+
+Until this issue gets sorted out, work around it by attempting to
+iterate entries in our xarray, and WARN_ON_ONCE() if one is found.
+
+Reported-by: syzbot+cc36d44ec9f368e443d3@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/io-uring/673c1643.050a0220.87769.0066.GAE@google.com/
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/tctx.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/io_uring/tctx.c b/io_uring/tctx.c
+index c043fe93a3f23..84f6a83857204 100644
+--- a/io_uring/tctx.c
++++ b/io_uring/tctx.c
+@@ -47,8 +47,19 @@ static struct io_wq *io_init_wq_offload(struct io_ring_ctx *ctx,
+ void __io_uring_free(struct task_struct *tsk)
+ {
+       struct io_uring_task *tctx = tsk->io_uring;
++      struct io_tctx_node *node;
++      unsigned long index;
+-      WARN_ON_ONCE(!xa_empty(&tctx->xa));
++      /*
++       * Fault injection forcing allocation errors in the xa_store() path
++       * can lead to xa_empty() returning false, even though no actual
++       * node is stored in the xarray. Until that gets sorted out, attempt
++       * an iteration here and warn if any entries are found.
++       */
++      xa_for_each(&tctx->xa, index, node) {
++              WARN_ON_ONCE(1);
++              break;
++      }
+       WARN_ON_ONCE(tctx->io_wq);
+       WARN_ON_ONCE(tctx->cached_refs);
+-- 
+2.43.0
+
diff --git a/queue-6.12/iommu-amd-fix-corruption-when-mapping-large-pages-fr.patch b/queue-6.12/iommu-amd-fix-corruption-when-mapping-large-pages-fr.patch
new file mode 100644 (file)
index 0000000..fe3fad1
--- /dev/null
@@ -0,0 +1,83 @@
+From 71e3335f38deaecf15f324ecc0ddf0219b3c7adc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 14:12:19 -0300
+Subject: iommu/amd: Fix corruption when mapping large pages from 0
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit e3a682eaf2af51a83f5313145ef592ce50fa787f ]
+
+If a page is mapped starting at 0 that is equal to or larger than can fit
+in the current mode (number of table levels) it results in corrupting the
+mapping as the following logic assumes the mode is correct for the page
+size being requested.
+
+There are two issues here, the check if the address fits within the table
+uses the start address, it should use the last address to ensure that last
+byte of the mapping fits within the current table mode.
+
+The second is if the mapping is exactly the size of the full page table it
+has to add another level to instead hold a single IOPTE for the large
+size.
+
+Since both corner cases require a 0 IOVA to be hit and doesn't start until
+a page size of 2^48 it is unlikely to ever hit in a real system.
+
+Reported-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/0-v1-27ab08d646a1+29-amd_0map_jgg@nvidia.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/io_pgtable.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/amd/io_pgtable.c b/drivers/iommu/amd/io_pgtable.c
+index 804b788f3f167..f3399087859fd 100644
+--- a/drivers/iommu/amd/io_pgtable.c
++++ b/drivers/iommu/amd/io_pgtable.c
+@@ -118,6 +118,7 @@ static void free_sub_pt(u64 *root, int mode, struct list_head *freelist)
+  */
+ static bool increase_address_space(struct amd_io_pgtable *pgtable,
+                                  unsigned long address,
++                                 unsigned int page_size_level,
+                                  gfp_t gfp)
+ {
+       struct io_pgtable_cfg *cfg = &pgtable->pgtbl.cfg;
+@@ -133,7 +134,8 @@ static bool increase_address_space(struct amd_io_pgtable *pgtable,
+       spin_lock_irqsave(&domain->lock, flags);
+-      if (address <= PM_LEVEL_SIZE(pgtable->mode))
++      if (address <= PM_LEVEL_SIZE(pgtable->mode) &&
++          pgtable->mode - 1 >= page_size_level)
+               goto out;
+       ret = false;
+@@ -163,18 +165,21 @@ static u64 *alloc_pte(struct amd_io_pgtable *pgtable,
+                     gfp_t gfp,
+                     bool *updated)
+ {
++      unsigned long last_addr = address + (page_size - 1);
+       struct io_pgtable_cfg *cfg = &pgtable->pgtbl.cfg;
+       int level, end_lvl;
+       u64 *pte, *page;
+       BUG_ON(!is_power_of_2(page_size));
+-      while (address > PM_LEVEL_SIZE(pgtable->mode)) {
++      while (last_addr > PM_LEVEL_SIZE(pgtable->mode) ||
++             pgtable->mode - 1 < PAGE_SIZE_LEVEL(page_size)) {
+               /*
+                * Return an error if there is no memory to update the
+                * page-table.
+                */
+-              if (!increase_address_space(pgtable, address, gfp))
++              if (!increase_address_space(pgtable, last_addr,
++                                          PAGE_SIZE_LEVEL(page_size), gfp))
+                       return NULL;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/irqchip-gicv3-its-add-workaround-for-hip09-its-errat.patch b/queue-6.12/irqchip-gicv3-its-add-workaround-for-hip09-its-errat.patch
new file mode 100644 (file)
index 0000000..17fa307
--- /dev/null
@@ -0,0 +1,181 @@
+From f3627bd412448fd75d387a654e166f9a33e792f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2024 16:01:26 +0800
+Subject: irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
+
+From: Zhou Wang <wangzhou1@hisilicon.com>
+
+[ Upstream commit f82e62d470cc990ebd9d691f931dd418e4e9cea9 ]
+
+When enabling GICv4.1 in hip09, VMAPP fails to clear some caches during
+the unmap operation, which can causes vSGIs to be lost.
+
+To fix the issue, invalidate the related vPE cache through GICR_INVALLR
+after VMOVP.
+
+Suggested-by: Marc Zyngier <maz@kernel.org>
+Co-developed-by: Nianyao Tang <tangnianyao@huawei.com>
+Signed-off-by: Nianyao Tang <tangnianyao@huawei.com>
+Signed-off-by: Zhou Wang <wangzhou1@hisilicon.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst |  2 +
+ arch/arm64/Kconfig                          | 11 +++++
+ drivers/irqchip/irq-gic-v3-its.c            | 50 ++++++++++++++++-----
+ 3 files changed, 52 insertions(+), 11 deletions(-)
+
+diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst
+index 65bfab1b18614..77db10e944f03 100644
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -258,6 +258,8 @@ stable kernels.
+ | Hisilicon      | Hip{08,09,10,10C| #162001900      | N/A                         |
+ |                | ,11} SMMU PMCG  |                 |                             |
+ +----------------+-----------------+-----------------+-----------------------------+
++| Hisilicon      | Hip09           | #162100801      | HISILICON_ERRATUM_162100801 |
+++----------------+-----------------+-----------------+-----------------------------+
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Qualcomm Tech. | Kryo/Falkor v1  | E1003           | QCOM_FALKOR_ERRATUM_1003    |
+ +----------------+-----------------+-----------------+-----------------------------+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 22f8a7bca6d21..a11a7a42edbfb 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1232,6 +1232,17 @@ config HISILICON_ERRATUM_161600802
+         If unsure, say Y.
++config HISILICON_ERRATUM_162100801
++      bool "Hip09 162100801 erratum support"
++      default y
++      help
++        When enabling GICv4.1 in hip09, VMAPP will fail to clear some caches
++        during unmapping operation, which will cause some vSGIs lost.
++        To fix the issue, invalidate related vPE cache through GICR_INVALLR
++        after VMOVP.
++
++        If unsure, say Y.
++
+ config QCOM_FALKOR_ERRATUM_1003
+       bool "Falkor E1003: Incorrect translation due to ASID change"
+       default y
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 52f625e07658c..d9b6ec844cdda 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -44,6 +44,7 @@
+ #define ITS_FLAGS_WORKAROUND_CAVIUM_22375     (1ULL << 1)
+ #define ITS_FLAGS_WORKAROUND_CAVIUM_23144     (1ULL << 2)
+ #define ITS_FLAGS_FORCE_NON_SHAREABLE         (1ULL << 3)
++#define ITS_FLAGS_WORKAROUND_HISILICON_162100801      (1ULL << 4)
+ #define RD_LOCAL_LPI_ENABLED                    BIT(0)
+ #define RD_LOCAL_PENDTABLE_PREALLOCATED         BIT(1)
+@@ -61,6 +62,7 @@ static u32 lpi_id_bits;
+ #define LPI_PENDBASE_SZ               ALIGN(BIT(LPI_NRBITS) / 8, SZ_64K)
+ static u8 __ro_after_init lpi_prop_prio;
++static struct its_node *find_4_1_its(void);
+ /*
+  * Collection structure - just an ID, and a redistributor address to
+@@ -3797,6 +3799,20 @@ static void its_vpe_db_proxy_move(struct its_vpe *vpe, int from, int to)
+       raw_spin_unlock_irqrestore(&vpe_proxy.lock, flags);
+ }
++static void its_vpe_4_1_invall_locked(int cpu, struct its_vpe *vpe)
++{
++      void __iomem *rdbase;
++      u64 val;
++
++      val  = GICR_INVALLR_V;
++      val |= FIELD_PREP(GICR_INVALLR_VPEID, vpe->vpe_id);
++
++      guard(raw_spinlock)(&gic_data_rdist_cpu(cpu)->rd_lock);
++      rdbase = per_cpu_ptr(gic_rdists->rdist, cpu)->rd_base;
++      gic_write_lpir(val, rdbase + GICR_INVALLR);
++      wait_for_syncr(rdbase);
++}
++
+ static int its_vpe_set_affinity(struct irq_data *d,
+                               const struct cpumask *mask_val,
+                               bool force)
+@@ -3804,6 +3820,7 @@ static int its_vpe_set_affinity(struct irq_data *d,
+       struct its_vpe *vpe = irq_data_get_irq_chip_data(d);
+       unsigned int from, cpu = nr_cpu_ids;
+       struct cpumask *table_mask;
++      struct its_node *its;
+       unsigned long flags;
+       /*
+@@ -3866,6 +3883,11 @@ static int its_vpe_set_affinity(struct irq_data *d,
+       vpe->col_idx = cpu;
+       its_send_vmovp(vpe);
++
++      its = find_4_1_its();
++      if (its && its->flags & ITS_FLAGS_WORKAROUND_HISILICON_162100801)
++              its_vpe_4_1_invall_locked(cpu, vpe);
++
+       its_vpe_db_proxy_move(vpe, from, cpu);
+ out:
+@@ -4173,22 +4195,12 @@ static void its_vpe_4_1_deschedule(struct its_vpe *vpe,
+ static void its_vpe_4_1_invall(struct its_vpe *vpe)
+ {
+-      void __iomem *rdbase;
+       unsigned long flags;
+-      u64 val;
+       int cpu;
+-      val  = GICR_INVALLR_V;
+-      val |= FIELD_PREP(GICR_INVALLR_VPEID, vpe->vpe_id);
+-
+       /* Target the redistributor this vPE is currently known on */
+       cpu = vpe_to_cpuid_lock(vpe, &flags);
+-      raw_spin_lock(&gic_data_rdist_cpu(cpu)->rd_lock);
+-      rdbase = per_cpu_ptr(gic_rdists->rdist, cpu)->rd_base;
+-      gic_write_lpir(val, rdbase + GICR_INVALLR);
+-
+-      wait_for_syncr(rdbase);
+-      raw_spin_unlock(&gic_data_rdist_cpu(cpu)->rd_lock);
++      its_vpe_4_1_invall_locked(cpu, vpe);
+       vpe_to_cpuid_unlock(vpe, flags);
+ }
+@@ -4781,6 +4793,14 @@ static bool its_set_non_coherent(void *data)
+       return true;
+ }
++static bool __maybe_unused its_enable_quirk_hip09_162100801(void *data)
++{
++      struct its_node *its = data;
++
++      its->flags |= ITS_FLAGS_WORKAROUND_HISILICON_162100801;
++      return true;
++}
++
+ static const struct gic_quirk its_quirks[] = {
+ #ifdef CONFIG_CAVIUM_ERRATUM_22375
+       {
+@@ -4827,6 +4847,14 @@ static const struct gic_quirk its_quirks[] = {
+               .init   = its_enable_quirk_hip07_161600802,
+       },
+ #endif
++#ifdef CONFIG_HISILICON_ERRATUM_162100801
++      {
++              .desc   = "ITS: Hip09 erratum 162100801",
++              .iidr   = 0x00051736,
++              .mask   = 0xffffffff,
++              .init   = its_enable_quirk_hip09_162100801,
++      },
++#endif
+ #ifdef CONFIG_ROCKCHIP_ERRATUM_3588001
+       {
+               .desc   = "ITS: Rockchip erratum RK3588001",
+-- 
+2.43.0
+
diff --git a/queue-6.12/jfs-add-a-check-to-prevent-array-index-out-of-bounds.patch b/queue-6.12/jfs-add-a-check-to-prevent-array-index-out-of-bounds.patch
new file mode 100644 (file)
index 0000000..44d01f1
--- /dev/null
@@ -0,0 +1,39 @@
+From 1720a98af9b45ab4279d660081b20575591e1b43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 01:51:38 +0530
+Subject: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
+
+From: Nihar Chaithanya <niharchaithanya@gmail.com>
+
+[ Upstream commit a174706ba4dad895c40b1d2277bade16dfacdcd9 ]
+
+When the value of lp is 0 at the beginning of the for loop, it will
+become negative in the next assignment and we should bail out.
+
+Reported-by: syzbot+412dea214d8baa3f7483@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=412dea214d8baa3f7483
+Tested-by: syzbot+412dea214d8baa3f7483@syzkaller.appspotmail.com
+Signed-off-by: Nihar Chaithanya <niharchaithanya@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 39957361a7eed..f9009e4f9ffd8 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -2891,6 +2891,9 @@ static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)
+       /* bubble the new value up the tree as required.
+        */
+       for (k = 0; k < le32_to_cpu(tp->dmt_height); k++) {
++              if (lp == 0)
++                      break;
++
+               /* get the index of the first leaf of the 4 leaf
+                * group containing the specified leaf (leafno).
+                */
+-- 
+2.43.0
+
diff --git a/queue-6.12/jfs-array-index-out-of-bounds-fix-in-dtreadfirst.patch b/queue-6.12/jfs-array-index-out-of-bounds-fix-in-dtreadfirst.patch
new file mode 100644 (file)
index 0000000..caf47d0
--- /dev/null
@@ -0,0 +1,43 @@
+From 5e4b4795c340043c0989665beb3f4107f2ca0818 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Sep 2024 14:07:22 +0530
+Subject: jfs: array-index-out-of-bounds fix in dtReadFirst
+
+From: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
+
+[ Upstream commit ca84a2c9be482836b86d780244f0357e5a778c46 ]
+
+The value of stbl can be sometimes out of bounds due
+to a bad filesystem. Added a check with appopriate return
+of error code in that case.
+
+Reported-by: syzbot+65fa06e29859e41a83f3@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3
+Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dtree.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
+index 5d3127ca68a42..69fd936fbdb37 100644
+--- a/fs/jfs/jfs_dtree.c
++++ b/fs/jfs/jfs_dtree.c
+@@ -3086,6 +3086,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack)
+               /* get the leftmost entry */
+               stbl = DT_GETSTBL(p);
++
++              if (stbl[0] < 0 || stbl[0] > 127) {
++                      DT_PUTPAGE(mp);
++                      jfs_error(ip->i_sb, "stbl[0] out of bound\n");
++                      return -EIO;
++              }
++
+               xd = (pxd_t *) & p->slot[stbl[0]];
+               /* get the child page block address */
+-- 
+2.43.0
+
diff --git a/queue-6.12/jfs-fix-array-index-out-of-bounds-in-jfs_readdir.patch b/queue-6.12/jfs-fix-array-index-out-of-bounds-in-jfs_readdir.patch
new file mode 100644 (file)
index 0000000..f388acd
--- /dev/null
@@ -0,0 +1,43 @@
+From f0c7e4bba704752b0f53a10c29ed1dbdf0427f61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 11:35:47 +0530
+Subject: jfs: fix array-index-out-of-bounds in jfs_readdir
+
+From: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
+
+[ Upstream commit 839f102efb168f02dfdd46717b7c6dddb26b015e ]
+
+The stbl might contain some invalid values. Added a check to
+return error code in that case.
+
+Reported-by: syzbot+0315f8fe99120601ba88@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=0315f8fe99120601ba88
+Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dtree.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
+index 69fd936fbdb37..8f85177f284b5 100644
+--- a/fs/jfs/jfs_dtree.c
++++ b/fs/jfs/jfs_dtree.c
+@@ -2891,6 +2891,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
+               stbl = DT_GETSTBL(p);
+               for (i = index; i < p->header.nextindex; i++) {
++                      if (stbl[i] < 0 || stbl[i] > 127) {
++                              jfs_err("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld",
++                                      i, stbl[i], (long)ip->i_ino, (long long)bn);
++                              free_page(dirent_buf);
++                              DT_PUTPAGE(mp);
++                              return -EIO;
++                      }
++
+                       d = (struct ldtentry *) & p->slot[stbl[i]];
+                       if (((long) jfs_dirent + d->namlen + 1) >
+-- 
+2.43.0
+
diff --git a/queue-6.12/jfs-fix-shift-out-of-bounds-in-dbsplit.patch b/queue-6.12/jfs-fix-shift-out-of-bounds-in-dbsplit.patch
new file mode 100644 (file)
index 0000000..e392f6c
--- /dev/null
@@ -0,0 +1,39 @@
+From 068ec6f5b39f087dc0d7af68a7780d557b91aad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 13:42:18 +0530
+Subject: jfs: fix shift-out-of-bounds in dbSplit
+
+From: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
+
+[ Upstream commit a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d ]
+
+When dmt_budmin is less than zero, it causes errors
+in the later stages. Added a check to return an error beforehand
+in dbAllocCtl itself.
+
+Reported-by: syzbot+b5ca8a249162c4b9a7d0@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0
+Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 3ab410059dc20..39957361a7eed 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -1820,6 +1820,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results)
+                       return -EIO;
+               dp = (struct dmap *) mp->data;
++              if (dp->tree.budmin < 0)
++                      return -EIO;
++
+               /* try to allocate the blocks.
+                */
+               rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results);
+-- 
+2.43.0
+
diff --git a/queue-6.12/kcsan-turn-report_filterlist_lock-into-a-raw_spinloc.patch b/queue-6.12/kcsan-turn-report_filterlist_lock-into-a-raw_spinloc.patch
new file mode 100644 (file)
index 0000000..8b38328
--- /dev/null
@@ -0,0 +1,212 @@
+From 6857072db8e14ae220e00c122c62eb55129adffd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 16:00:45 +0200
+Subject: kcsan: Turn report_filterlist_lock into a raw_spinlock
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 59458fa4ddb47e7891c61b4a928d13d5f5b00aa0 ]
+
+Ran Xiaokai reports that with a KCSAN-enabled PREEMPT_RT kernel, we can see
+splats like:
+
+| BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
+| in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
+| preempt_count: 10002, expected: 0
+| RCU nest depth: 0, expected: 0
+| no locks held by swapper/1/0.
+| irq event stamp: 156674
+| hardirqs last  enabled at (156673): [<ffffffff81130bd9>] do_idle+0x1f9/0x240
+| hardirqs last disabled at (156674): [<ffffffff82254f84>] sysvec_apic_timer_interrupt+0x14/0xc0
+| softirqs last  enabled at (0): [<ffffffff81099f47>] copy_process+0xfc7/0x4b60
+| softirqs last disabled at (0): [<0000000000000000>] 0x0
+| Preemption disabled at:
+| [<ffffffff814a3e2a>] paint_ptr+0x2a/0x90
+| CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.11.0+ #3
+| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014
+| Call Trace:
+|  <IRQ>
+|  dump_stack_lvl+0x7e/0xc0
+|  dump_stack+0x1d/0x30
+|  __might_resched+0x1a2/0x270
+|  rt_spin_lock+0x68/0x170
+|  kcsan_skip_report_debugfs+0x43/0xe0
+|  print_report+0xb5/0x590
+|  kcsan_report_known_origin+0x1b1/0x1d0
+|  kcsan_setup_watchpoint+0x348/0x650
+|  __tsan_unaligned_write1+0x16d/0x1d0
+|  hrtimer_interrupt+0x3d6/0x430
+|  __sysvec_apic_timer_interrupt+0xe8/0x3a0
+|  sysvec_apic_timer_interrupt+0x97/0xc0
+|  </IRQ>
+
+On a detected data race, KCSAN's reporting logic checks if it should
+filter the report. That list is protected by the report_filterlist_lock
+*non-raw* spinlock which may sleep on RT kernels.
+
+Since KCSAN may report data races in any context, convert it to a
+raw_spinlock.
+
+This requires being careful about when to allocate memory for the filter
+list itself which can be done via KCSAN's debugfs interface. Concurrent
+modification of the filter list via debugfs should be rare: the chosen
+strategy is to optimistically pre-allocate memory before the critical
+section and discard if unused.
+
+Link: https://lore.kernel.org/all/20240925143154.2322926-1-ranxiaokai627@163.com/
+Reported-by: Ran Xiaokai <ran.xiaokai@zte.com.cn>
+Tested-by: Ran Xiaokai <ran.xiaokai@zte.com.cn>
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kcsan/debugfs.c | 74 ++++++++++++++++++++----------------------
+ 1 file changed, 36 insertions(+), 38 deletions(-)
+
+diff --git a/kernel/kcsan/debugfs.c b/kernel/kcsan/debugfs.c
+index 53b21ae30e00e..b14072071889f 100644
+--- a/kernel/kcsan/debugfs.c
++++ b/kernel/kcsan/debugfs.c
+@@ -46,14 +46,8 @@ static struct {
+       int             used;           /* number of elements used */
+       bool            sorted;         /* if elements are sorted */
+       bool            whitelist;      /* if list is a blacklist or whitelist */
+-} report_filterlist = {
+-      .addrs          = NULL,
+-      .size           = 8,            /* small initial size */
+-      .used           = 0,
+-      .sorted         = false,
+-      .whitelist      = false,        /* default is blacklist */
+-};
+-static DEFINE_SPINLOCK(report_filterlist_lock);
++} report_filterlist;
++static DEFINE_RAW_SPINLOCK(report_filterlist_lock);
+ /*
+  * The microbenchmark allows benchmarking KCSAN core runtime only. To run
+@@ -110,7 +104,7 @@ bool kcsan_skip_report_debugfs(unsigned long func_addr)
+               return false;
+       func_addr -= offset; /* Get function start */
+-      spin_lock_irqsave(&report_filterlist_lock, flags);
++      raw_spin_lock_irqsave(&report_filterlist_lock, flags);
+       if (report_filterlist.used == 0)
+               goto out;
+@@ -127,7 +121,7 @@ bool kcsan_skip_report_debugfs(unsigned long func_addr)
+               ret = !ret;
+ out:
+-      spin_unlock_irqrestore(&report_filterlist_lock, flags);
++      raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
+       return ret;
+ }
+@@ -135,9 +129,9 @@ static void set_report_filterlist_whitelist(bool whitelist)
+ {
+       unsigned long flags;
+-      spin_lock_irqsave(&report_filterlist_lock, flags);
++      raw_spin_lock_irqsave(&report_filterlist_lock, flags);
+       report_filterlist.whitelist = whitelist;
+-      spin_unlock_irqrestore(&report_filterlist_lock, flags);
++      raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
+ }
+ /* Returns 0 on success, error-code otherwise. */
+@@ -145,6 +139,9 @@ static ssize_t insert_report_filterlist(const char *func)
+ {
+       unsigned long flags;
+       unsigned long addr = kallsyms_lookup_name(func);
++      unsigned long *delay_free = NULL;
++      unsigned long *new_addrs = NULL;
++      size_t new_size = 0;
+       ssize_t ret = 0;
+       if (!addr) {
+@@ -152,32 +149,33 @@ static ssize_t insert_report_filterlist(const char *func)
+               return -ENOENT;
+       }
+-      spin_lock_irqsave(&report_filterlist_lock, flags);
++retry_alloc:
++      /*
++       * Check if we need an allocation, and re-validate under the lock. Since
++       * the report_filterlist_lock is a raw, cannot allocate under the lock.
++       */
++      if (data_race(report_filterlist.used == report_filterlist.size)) {
++              new_size = (report_filterlist.size ?: 4) * 2;
++              delay_free = new_addrs = kmalloc_array(new_size, sizeof(unsigned long), GFP_KERNEL);
++              if (!new_addrs)
++                      return -ENOMEM;
++      }
+-      if (report_filterlist.addrs == NULL) {
+-              /* initial allocation */
+-              report_filterlist.addrs =
+-                      kmalloc_array(report_filterlist.size,
+-                                    sizeof(unsigned long), GFP_ATOMIC);
+-              if (report_filterlist.addrs == NULL) {
+-                      ret = -ENOMEM;
+-                      goto out;
+-              }
+-      } else if (report_filterlist.used == report_filterlist.size) {
+-              /* resize filterlist */
+-              size_t new_size = report_filterlist.size * 2;
+-              unsigned long *new_addrs =
+-                      krealloc(report_filterlist.addrs,
+-                               new_size * sizeof(unsigned long), GFP_ATOMIC);
+-
+-              if (new_addrs == NULL) {
+-                      /* leave filterlist itself untouched */
+-                      ret = -ENOMEM;
+-                      goto out;
++      raw_spin_lock_irqsave(&report_filterlist_lock, flags);
++      if (report_filterlist.used == report_filterlist.size) {
++              /* Check we pre-allocated enough, and retry if not. */
++              if (report_filterlist.used >= new_size) {
++                      raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
++                      kfree(new_addrs); /* kfree(NULL) is safe */
++                      delay_free = new_addrs = NULL;
++                      goto retry_alloc;
+               }
++              if (report_filterlist.used)
++                      memcpy(new_addrs, report_filterlist.addrs, report_filterlist.used * sizeof(unsigned long));
++              delay_free = report_filterlist.addrs; /* free the old list */
++              report_filterlist.addrs = new_addrs;  /* switch to the new list */
+               report_filterlist.size = new_size;
+-              report_filterlist.addrs = new_addrs;
+       }
+       /* Note: deduplicating should be done in userspace. */
+@@ -185,9 +183,9 @@ static ssize_t insert_report_filterlist(const char *func)
+               kallsyms_lookup_name(func);
+       report_filterlist.sorted = false;
+-out:
+-      spin_unlock_irqrestore(&report_filterlist_lock, flags);
++      raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
++      kfree(delay_free);
+       return ret;
+ }
+@@ -204,13 +202,13 @@ static int show_info(struct seq_file *file, void *v)
+       }
+       /* show filter functions, and filter type */
+-      spin_lock_irqsave(&report_filterlist_lock, flags);
++      raw_spin_lock_irqsave(&report_filterlist_lock, flags);
+       seq_printf(file, "\n%s functions: %s\n",
+                  report_filterlist.whitelist ? "whitelisted" : "blacklisted",
+                  report_filterlist.used == 0 ? "none" : "");
+       for (i = 0; i < report_filterlist.used; ++i)
+               seq_printf(file, " %ps\n", (void *)report_filterlist.addrs[i]);
+-      spin_unlock_irqrestore(&report_filterlist_lock, flags);
++      raw_spin_unlock_irqrestore(&report_filterlist_lock, flags);
+       return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/kmsan-uninit-value-in-inode_go_dump-5.patch b/queue-6.12/kmsan-uninit-value-in-inode_go_dump-5.patch
new file mode 100644 (file)
index 0000000..313261f
--- /dev/null
@@ -0,0 +1,42 @@
+From 47256fd4fb191e5643761264adf919e9cc1d43df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 22:58:01 +0200
+Subject: KMSAN: uninit-value in inode_go_dump (5)
+
+From: Qianqiang Liu <qianqiang.liu@163.com>
+
+[ Upstream commit f9417fcfca3c5e30a0b961e7250fab92cfa5d123 ]
+
+When mounting of a corrupted disk image fails, the error message printed
+can reference uninitialized inode fields.  To prevent that from happening,
+always initialize those fields.
+
+Reported-by: syzbot+aa0730b0a42646eb1359@syzkaller.appspotmail.com
+Signed-off-by: Qianqiang Liu <qianqiang.liu@163.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index e22c1edc32b39..b9cef63c78717 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -1537,11 +1537,13 @@ static struct inode *gfs2_alloc_inode(struct super_block *sb)
+       if (!ip)
+               return NULL;
+       ip->i_no_addr = 0;
++      ip->i_no_formal_ino = 0;
+       ip->i_flags = 0;
+       ip->i_gl = NULL;
+       gfs2_holder_mark_uninitialized(&ip->i_iopen_gh);
+       memset(&ip->i_res, 0, sizeof(ip->i_res));
+       RB_CLEAR_NODE(&ip->i_res.rs_node);
++      ip->i_diskflags = 0;
+       ip->i_rahead = 0;
+       return &ip->i_inode;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/kselftest-arm64-don-t-leak-pipe-fds-in-pac.exec_sign.patch b/queue-6.12/kselftest-arm64-don-t-leak-pipe-fds-in-pac.exec_sign.patch
new file mode 100644 (file)
index 0000000..94d4f35
--- /dev/null
@@ -0,0 +1,39 @@
+From dbb295226809ec5045b724d56cbc9c39eecb5b65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2024 16:18:55 +0000
+Subject: kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 27141b690547da5650a420f26ec369ba142a9ebb ]
+
+The PAC exec_sign_all() test spawns some child processes, creating pipes
+to be stdin and stdout for the child. It cleans up most of the file
+descriptors that are created as part of this but neglects to clean up the
+parent end of the child stdin and stdout. Add the missing close() calls.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20241111-arm64-pac-test-collisions-v1-1-171875f37e44@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/pauth/pac.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/testing/selftests/arm64/pauth/pac.c b/tools/testing/selftests/arm64/pauth/pac.c
+index b743daa772f55..5a07b3958fbf2 100644
+--- a/tools/testing/selftests/arm64/pauth/pac.c
++++ b/tools/testing/selftests/arm64/pauth/pac.c
+@@ -182,6 +182,9 @@ int exec_sign_all(struct signatures *signed_vals, size_t val)
+               return -1;
+       }
++      close(new_stdin[1]);
++      close(new_stdout[0]);
++
+       return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/kselftest-arm64-log-fp-stress-child-startup-errors-t.patch b/queue-6.12/kselftest-arm64-log-fp-stress-child-startup-errors-t.patch
new file mode 100644 (file)
index 0000000..960fa85
--- /dev/null
@@ -0,0 +1,71 @@
+From c315489816b372041434d02b522ea3efc9834412 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2024 00:20:45 +0100
+Subject: kselftest/arm64: Log fp-stress child startup errors to stdout
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit dca93d29845dfed60910ba13dbfb6ae6a0e19f6d ]
+
+Currently if we encounter an error between fork() and exec() of a child
+process we log the error to stderr. This means that the errors don't get
+annotated with the child information which makes diagnostics harder and
+means that if we miss the exit signal from the child we can deadlock
+waiting for output from the child. Improve robustness and output quality
+by logging to stdout instead.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20241023-arm64-fp-stress-exec-fail-v1-1-ee3c62932c15@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/fp/fp-stress.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/fp/fp-stress.c b/tools/testing/selftests/arm64/fp/fp-stress.c
+index faac24bdefeb9..80f22789504d6 100644
+--- a/tools/testing/selftests/arm64/fp/fp-stress.c
++++ b/tools/testing/selftests/arm64/fp/fp-stress.c
+@@ -79,7 +79,7 @@ static void child_start(struct child_data *child, const char *program)
+                */
+               ret = dup2(pipefd[1], 1);
+               if (ret == -1) {
+-                      fprintf(stderr, "dup2() %d\n", errno);
++                      printf("dup2() %d\n", errno);
+                       exit(EXIT_FAILURE);
+               }
+@@ -89,7 +89,7 @@ static void child_start(struct child_data *child, const char *program)
+                */
+               ret = dup2(startup_pipe[0], 3);
+               if (ret == -1) {
+-                      fprintf(stderr, "dup2() %d\n", errno);
++                      printf("dup2() %d\n", errno);
+                       exit(EXIT_FAILURE);
+               }
+@@ -107,16 +107,15 @@ static void child_start(struct child_data *child, const char *program)
+                */
+               ret = read(3, &i, sizeof(i));
+               if (ret < 0)
+-                      fprintf(stderr, "read(startp pipe) failed: %s (%d)\n",
+-                              strerror(errno), errno);
++                      printf("read(startp pipe) failed: %s (%d)\n",
++                             strerror(errno), errno);
+               if (ret > 0)
+-                      fprintf(stderr, "%d bytes of data on startup pipe\n",
+-                              ret);
++                      printf("%d bytes of data on startup pipe\n", ret);
+               close(3);
+               ret = execl(program, program, NULL);
+-              fprintf(stderr, "execl(%s) failed: %d (%s)\n",
+-                      program, errno, strerror(errno));
++              printf("execl(%s) failed: %d (%s)\n",
++                     program, errno, strerror(errno));
+               exit(EXIT_FAILURE);
+       } else {
+-- 
+2.43.0
+
diff --git a/queue-6.12/leds-class-protect-brightness_show-with-led_cdev-led.patch b/queue-6.12/leds-class-protect-brightness_show-with-led_cdev-led.patch
new file mode 100644 (file)
index 0000000..88f0497
--- /dev/null
@@ -0,0 +1,174 @@
+From 34257f8869f6187a2b73a24990b8322c4cc3b5ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2024 21:35:27 +0530
+Subject: leds: class: Protect brightness_show() with led_cdev->led_access
+ mutex
+
+From: Mukesh Ojha <quic_mojha@quicinc.com>
+
+[ Upstream commit 4ca7cd938725a4050dcd62ae9472e931d603118d ]
+
+There is NULL pointer issue observed if from Process A where hid device
+being added which results in adding a led_cdev addition and later a
+another call to access of led_cdev attribute from Process B can result
+in NULL pointer issue.
+
+Use mutex led_cdev->led_access to protect access to led->cdev and its
+attribute inside brightness_show() and max_brightness_show() and also
+update the comment for mutex that it should be used to protect the led
+class device fields.
+
+       Process A                               Process B
+
+ kthread+0x114
+ worker_thread+0x244
+ process_scheduled_works+0x248
+ uhid_device_add_worker+0x24
+ hid_add_device+0x120
+ device_add+0x268
+ bus_probe_device+0x94
+ device_initial_probe+0x14
+ __device_attach+0xfc
+ bus_for_each_drv+0x10c
+ __device_attach_driver+0x14c
+ driver_probe_device+0x3c
+ __driver_probe_device+0xa0
+ really_probe+0x190
+ hid_device_probe+0x130
+ ps_probe+0x990
+ ps_led_register+0x94
+ devm_led_classdev_register_ext+0x58
+ led_classdev_register_ext+0x1f8
+ device_create_with_groups+0x48
+ device_create_groups_vargs+0xc8
+ device_add+0x244
+ kobject_uevent+0x14
+ kobject_uevent_env[jt]+0x224
+ mutex_unlock[jt]+0xc4
+ __mutex_unlock_slowpath+0xd4
+ wake_up_q+0x70
+ try_to_wake_up[jt]+0x48c
+ preempt_schedule_common+0x28
+ __schedule+0x628
+ __switch_to+0x174
+                                               el0t_64_sync+0x1a8/0x1ac
+                                               el0t_64_sync_handler+0x68/0xbc
+                                               el0_svc+0x38/0x68
+                                               do_el0_svc+0x1c/0x28
+                                               el0_svc_common+0x80/0xe0
+                                               invoke_syscall+0x58/0x114
+                                               __arm64_sys_read+0x1c/0x2c
+                                               ksys_read+0x78/0xe8
+                                               vfs_read+0x1e0/0x2c8
+                                               kernfs_fop_read_iter+0x68/0x1b4
+                                               seq_read_iter+0x158/0x4ec
+                                               kernfs_seq_show+0x44/0x54
+                                               sysfs_kf_seq_show+0xb4/0x130
+                                               dev_attr_show+0x38/0x74
+                                               brightness_show+0x20/0x4c
+                                               dualshock4_led_get_brightness+0xc/0x74
+
+[ 3313.874295][ T4013] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060
+[ 3313.874301][ T4013] Mem abort info:
+[ 3313.874303][ T4013]   ESR = 0x0000000096000006
+[ 3313.874305][ T4013]   EC = 0x25: DABT (current EL), IL = 32 bits
+[ 3313.874307][ T4013]   SET = 0, FnV = 0
+[ 3313.874309][ T4013]   EA = 0, S1PTW = 0
+[ 3313.874311][ T4013]   FSC = 0x06: level 2 translation fault
+[ 3313.874313][ T4013] Data abort info:
+[ 3313.874314][ T4013]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
+[ 3313.874316][ T4013]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+[ 3313.874318][ T4013]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+[ 3313.874320][ T4013] user pgtable: 4k pages, 39-bit VAs, pgdp=00000008f2b0a000
+..
+
+[ 3313.874332][ T4013] Dumping ftrace buffer:
+[ 3313.874334][ T4013]    (ftrace buffer empty)
+..
+..
+[ dd3313.874639][ T4013] CPU: 6 PID: 4013 Comm: InputReader
+[ 3313.874648][ T4013] pc : dualshock4_led_get_brightness+0xc/0x74
+[ 3313.874653][ T4013] lr : led_update_brightness+0x38/0x60
+[ 3313.874656][ T4013] sp : ffffffc0b910bbd0
+..
+..
+[ 3313.874685][ T4013] Call trace:
+[ 3313.874687][ T4013]  dualshock4_led_get_brightness+0xc/0x74
+[ 3313.874690][ T4013]  brightness_show+0x20/0x4c
+[ 3313.874692][ T4013]  dev_attr_show+0x38/0x74
+[ 3313.874696][ T4013]  sysfs_kf_seq_show+0xb4/0x130
+[ 3313.874700][ T4013]  kernfs_seq_show+0x44/0x54
+[ 3313.874703][ T4013]  seq_read_iter+0x158/0x4ec
+[ 3313.874705][ T4013]  kernfs_fop_read_iter+0x68/0x1b4
+[ 3313.874708][ T4013]  vfs_read+0x1e0/0x2c8
+[ 3313.874711][ T4013]  ksys_read+0x78/0xe8
+[ 3313.874714][ T4013]  __arm64_sys_read+0x1c/0x2c
+[ 3313.874718][ T4013]  invoke_syscall+0x58/0x114
+[ 3313.874721][ T4013]  el0_svc_common+0x80/0xe0
+[ 3313.874724][ T4013]  do_el0_svc+0x1c/0x28
+[ 3313.874727][ T4013]  el0_svc+0x38/0x68
+[ 3313.874730][ T4013]  el0t_64_sync_handler+0x68/0xbc
+[ 3313.874732][ T4013]  el0t_64_sync+0x1a8/0x1ac
+
+Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Reviewed-by: Anish Kumar <yesanishhere@gmail.com>
+Link: https://lore.kernel.org/r/20241103160527.82487-1-quic_mojha@quicinc.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/led-class.c | 14 +++++++++++---
+ include/linux/leds.h     |  2 +-
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
+index 06b97fd49ad9a..f69f4e928d614 100644
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -29,11 +29,14 @@ static ssize_t brightness_show(struct device *dev,
+               struct device_attribute *attr, char *buf)
+ {
+       struct led_classdev *led_cdev = dev_get_drvdata(dev);
++      unsigned int brightness;
+-      /* no lock needed for this */
++      mutex_lock(&led_cdev->led_access);
+       led_update_brightness(led_cdev);
++      brightness = led_cdev->brightness;
++      mutex_unlock(&led_cdev->led_access);
+-      return sprintf(buf, "%u\n", led_cdev->brightness);
++      return sprintf(buf, "%u\n", brightness);
+ }
+ static ssize_t brightness_store(struct device *dev,
+@@ -70,8 +73,13 @@ static ssize_t max_brightness_show(struct device *dev,
+               struct device_attribute *attr, char *buf)
+ {
+       struct led_classdev *led_cdev = dev_get_drvdata(dev);
++      unsigned int max_brightness;
++
++      mutex_lock(&led_cdev->led_access);
++      max_brightness = led_cdev->max_brightness;
++      mutex_unlock(&led_cdev->led_access);
+-      return sprintf(buf, "%u\n", led_cdev->max_brightness);
++      return sprintf(buf, "%u\n", max_brightness);
+ }
+ static DEVICE_ATTR_RO(max_brightness);
+diff --git a/include/linux/leds.h b/include/linux/leds.h
+index e5968c3ed4ae0..2337f516fa7c2 100644
+--- a/include/linux/leds.h
++++ b/include/linux/leds.h
+@@ -238,7 +238,7 @@ struct led_classdev {
+       struct kernfs_node      *brightness_hw_changed_kn;
+ #endif
+-      /* Ensures consistent access to the LED Flash Class device */
++      /* Ensures consistent access to the LED class device */
+       struct mutex            led_access;
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.12/loongarch-fix-sleeping-in-atomic-context-for-preempt.patch b/queue-6.12/loongarch-fix-sleeping-in-atomic-context-for-preempt.patch
new file mode 100644 (file)
index 0000000..7375078
--- /dev/null
@@ -0,0 +1,80 @@
+From 691d3f24dc37e0bdf115dcd0a44fb56f422e8b54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 15:47:48 +0800
+Subject: LoongArch: Fix sleeping in atomic context for PREEMPT_RT
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 88fd2b70120d52c1010257d36776876941375490 ]
+
+Commit bab1c299f3945ffe79 ("LoongArch: Fix sleeping in atomic context in
+setup_tlb_handler()") changes the gfp flag from GFP_KERNEL to GFP_ATOMIC
+for alloc_pages_node(). However, for PREEMPT_RT kernels we can still get
+a "sleeping in atomic context" error:
+
+[    0.372259] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
+[    0.372266] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
+[    0.372268] preempt_count: 1, expected: 0
+[    0.372270] RCU nest depth: 1, expected: 1
+[    0.372272] 3 locks held by swapper/1/0:
+[    0.372274]  #0: 900000000c9f5e60 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x524/0x1c60
+[    0.372294]  #1: 90000000087013b8 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x50/0x140
+[    0.372305]  #2: 900000047fffd388 (&zone->lock){+.+.}-{3:3}, at: __rmqueue_pcplist+0x30c/0xea0
+[    0.372314] irq event stamp: 0
+[    0.372316] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
+[    0.372322] hardirqs last disabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0
+[    0.372329] softirqs last  enabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0
+[    0.372335] softirqs last disabled at (0): [<0000000000000000>] 0x0
+[    0.372341] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7+ #1891
+[    0.372346] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022
+[    0.372349] Stack : 0000000000000089 9000000005a0db9c 90000000071519c8 9000000100388000
+[    0.372486]         900000010038b890 0000000000000000 900000010038b898 9000000007e53788
+[    0.372492]         900000000815bcc8 900000000815bcc0 900000010038b700 0000000000000001
+[    0.372498]         0000000000000001 4b031894b9d6b725 00000000055ec000 9000000100338fc0
+[    0.372503]         00000000000000c4 0000000000000001 000000000000002d 0000000000000003
+[    0.372509]         0000000000000030 0000000000000003 00000000055ec000 0000000000000003
+[    0.372515]         900000000806d000 9000000007e53788 00000000000000b0 0000000000000004
+[    0.372521]         0000000000000000 0000000000000000 900000000c9f5f10 0000000000000000
+[    0.372526]         90000000076f12d8 9000000007e53788 9000000005924778 0000000000000000
+[    0.372532]         00000000000000b0 0000000000000004 0000000000000000 0000000000070000
+[    0.372537]         ...
+[    0.372540] Call Trace:
+[    0.372542] [<9000000005924778>] show_stack+0x38/0x180
+[    0.372548] [<90000000071519c4>] dump_stack_lvl+0x94/0xe4
+[    0.372555] [<900000000599b880>] __might_resched+0x1a0/0x260
+[    0.372561] [<90000000071675cc>] rt_spin_lock+0x4c/0x140
+[    0.372565] [<9000000005cbb768>] __rmqueue_pcplist+0x308/0xea0
+[    0.372570] [<9000000005cbed84>] get_page_from_freelist+0x564/0x1c60
+[    0.372575] [<9000000005cc0d98>] __alloc_pages_noprof+0x218/0x1820
+[    0.372580] [<900000000593b36c>] tlb_init+0x1ac/0x298
+[    0.372585] [<9000000005924b74>] per_cpu_trap_init+0x114/0x140
+[    0.372589] [<9000000005921964>] cpu_probe+0x4e4/0xa60
+[    0.372592] [<9000000005934874>] start_secondary+0x34/0xc0
+[    0.372599] [<900000000715615c>] smpboot_entry+0x64/0x6c
+
+This is because in PREEMPT_RT kernels normal spinlocks are replaced by
+rt spinlocks and rt_spin_lock() will cause sleeping. Fix it by disabling
+NUMA optimization completely for PREEMPT_RT kernels.
+
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/mm/tlb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c
+index 5ac9beb5f0935..3b427b319db21 100644
+--- a/arch/loongarch/mm/tlb.c
++++ b/arch/loongarch/mm/tlb.c
+@@ -289,7 +289,7 @@ static void setup_tlb_handler(int cpu)
+               /* Avoid lockdep warning */
+               rcutree_report_cpu_starting(cpu);
+-#ifdef CONFIG_NUMA
++#if defined(CONFIG_NUMA) && !defined(CONFIG_PREEMPT_RT)
+               vec_sz = sizeof(exception_handlers);
+               if (pcpu_handlers[cpu])
+-- 
+2.43.0
+
diff --git a/queue-6.12/mailbox-pcc-check-before-sending-mctp-pcc-response-a.patch b/queue-6.12/mailbox-pcc-check-before-sending-mctp-pcc-response-a.patch
new file mode 100644 (file)
index 0000000..ff1a69b
--- /dev/null
@@ -0,0 +1,166 @@
+From 9bbd93b9709e14cf58f64664cda8bee29794962b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2024 14:02:14 -0500
+Subject: mailbox: pcc: Check before sending MCTP PCC response ACK
+
+From: Adam Young <admiyo@os.amperecomputing.com>
+
+[ Upstream commit 7f9e19f207be0c534d517d65e01417ba968cdd34 ]
+
+Type 4 PCC channels have an option to send back a response
+to the platform when they are done processing the request.
+The flag to indicate whether or not to respond is inside
+the message body, and thus is not available to the pcc
+mailbox.
+
+If the flag is not set, still set command completion
+bit after processing message.
+
+In order to read the flag, this patch maps the shared
+buffer to virtual memory. To avoid duplication of mapping
+the shared buffer is then made available to be used by
+the driver that uses the mailbox.
+
+Signed-off-by: Adam Young <admiyo@os.amperecomputing.com>
+Cc: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/pcc.c | 61 +++++++++++++++++++++++++++++++++++++------
+ include/acpi/pcc.h    |  7 +++++
+ 2 files changed, 60 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
+index 94885e411085a..82102a4c5d688 100644
+--- a/drivers/mailbox/pcc.c
++++ b/drivers/mailbox/pcc.c
+@@ -269,6 +269,35 @@ static bool pcc_mbox_cmd_complete_check(struct pcc_chan_info *pchan)
+       return !!val;
+ }
++static void check_and_ack(struct pcc_chan_info *pchan, struct mbox_chan *chan)
++{
++      struct acpi_pcct_ext_pcc_shared_memory pcc_hdr;
++
++      if (pchan->type != ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE)
++              return;
++      /* If the memory region has not been mapped, we cannot
++       * determine if we need to send the message, but we still
++       * need to set the cmd_update flag before returning.
++       */
++      if (pchan->chan.shmem == NULL) {
++              pcc_chan_reg_read_modify_write(&pchan->cmd_update);
++              return;
++      }
++      memcpy_fromio(&pcc_hdr, pchan->chan.shmem,
++                    sizeof(struct acpi_pcct_ext_pcc_shared_memory));
++      /*
++       * The PCC slave subspace channel needs to set the command complete bit
++       * after processing message. If the PCC_ACK_FLAG is set, it should also
++       * ring the doorbell.
++       *
++       * The PCC master subspace channel clears chan_in_use to free channel.
++       */
++      if (le32_to_cpup(&pcc_hdr.flags) & PCC_ACK_FLAG_MASK)
++              pcc_send_data(chan, NULL);
++      else
++              pcc_chan_reg_read_modify_write(&pchan->cmd_update);
++}
++
+ /**
+  * pcc_mbox_irq - PCC mailbox interrupt handler
+  * @irq:      interrupt number
+@@ -306,14 +335,7 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
+       mbox_chan_received_data(chan, NULL);
+-      /*
+-       * The PCC slave subspace channel needs to set the command complete bit
+-       * and ring doorbell after processing message.
+-       *
+-       * The PCC master subspace channel clears chan_in_use to free channel.
+-       */
+-      if (pchan->type == ACPI_PCCT_TYPE_EXT_PCC_SLAVE_SUBSPACE)
+-              pcc_send_data(chan, NULL);
++      check_and_ack(pchan, chan);
+       pchan->chan_in_use = false;
+       return IRQ_HANDLED;
+@@ -365,14 +387,37 @@ EXPORT_SYMBOL_GPL(pcc_mbox_request_channel);
+ void pcc_mbox_free_channel(struct pcc_mbox_chan *pchan)
+ {
+       struct mbox_chan *chan = pchan->mchan;
++      struct pcc_chan_info *pchan_info;
++      struct pcc_mbox_chan *pcc_mbox_chan;
+       if (!chan || !chan->cl)
+               return;
++      pchan_info = chan->con_priv;
++      pcc_mbox_chan = &pchan_info->chan;
++      if (pcc_mbox_chan->shmem) {
++              iounmap(pcc_mbox_chan->shmem);
++              pcc_mbox_chan->shmem = NULL;
++      }
+       mbox_free_channel(chan);
+ }
+ EXPORT_SYMBOL_GPL(pcc_mbox_free_channel);
++int pcc_mbox_ioremap(struct mbox_chan *chan)
++{
++      struct pcc_chan_info *pchan_info;
++      struct pcc_mbox_chan *pcc_mbox_chan;
++
++      if (!chan || !chan->cl)
++              return -1;
++      pchan_info = chan->con_priv;
++      pcc_mbox_chan = &pchan_info->chan;
++      pcc_mbox_chan->shmem = ioremap(pcc_mbox_chan->shmem_base_addr,
++                                     pcc_mbox_chan->shmem_size);
++      return 0;
++}
++EXPORT_SYMBOL_GPL(pcc_mbox_ioremap);
++
+ /**
+  * pcc_send_data - Called from Mailbox Controller code. Used
+  *            here only to ring the channel doorbell. The PCC client
+diff --git a/include/acpi/pcc.h b/include/acpi/pcc.h
+index 9b373d172a776..699c1a37b8e78 100644
+--- a/include/acpi/pcc.h
++++ b/include/acpi/pcc.h
+@@ -12,6 +12,7 @@
+ struct pcc_mbox_chan {
+       struct mbox_chan *mchan;
+       u64 shmem_base_addr;
++      void __iomem *shmem;
+       u64 shmem_size;
+       u32 latency;
+       u32 max_access_rate;
+@@ -31,11 +32,13 @@ struct pcc_mbox_chan {
+ #define PCC_CMD_COMPLETION_NOTIFY     BIT(0)
+ #define MAX_PCC_SUBSPACES     256
++#define PCC_ACK_FLAG_MASK     0x1
+ #ifdef CONFIG_PCC
+ extern struct pcc_mbox_chan *
+ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id);
+ extern void pcc_mbox_free_channel(struct pcc_mbox_chan *chan);
++extern int pcc_mbox_ioremap(struct mbox_chan *chan);
+ #else
+ static inline struct pcc_mbox_chan *
+ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id)
+@@ -43,6 +46,10 @@ pcc_mbox_request_channel(struct mbox_client *cl, int subspace_id)
+       return ERR_PTR(-ENODEV);
+ }
+ static inline void pcc_mbox_free_channel(struct pcc_mbox_chan *chan) { }
++static inline int pcc_mbox_ioremap(struct mbox_chan *chan)
++{
++      return 0;
++};
+ #endif
+ #endif /* _PCC_H */
+-- 
+2.43.0
+
diff --git a/queue-6.12/media-cx231xx-add-support-for-dexatek-usb-video-grab.patch b/queue-6.12/media-cx231xx-add-support-for-dexatek-usb-video-grab.patch
new file mode 100644 (file)
index 0000000..46f79d6
--- /dev/null
@@ -0,0 +1,50 @@
+From 73a6a543e1e5d0702aa9bcea655b065689a3205d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 19:40:40 +1000
+Subject: media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
+
+From: Rohan Barar <rohan.barar@gmail.com>
+
+[ Upstream commit 61a830bc0ea69a05d8a4534f825c6aa618263649 ]
+
+Add Dexatek Technology Ltd USB Video Grabber 1d19:6108 to the cx231xx
+driver. This device is sold under the name "BAUHN DVD Maker (DK8723)" by
+ALDI in Australia.
+
+This device is similar to 1d19:6109, which is already included in cx231xx.
+
+Both video and audio capture function correctly after installing the
+patched cx231xx driver.
+
+Patch Changelog
+v1:
+ - Initial submission.
+v2:
+ - Fix SoB + Improve subject.
+v3:
+ - Rephrase message to not exceed 75 characters per line.
+ - Removed reference to external GitHub URL.
+
+Signed-off-by: Rohan Barar <rohan.barar@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/cx231xx/cx231xx-cards.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
+index 92efe6c1f47ba..bda729b42d05f 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
+@@ -994,6 +994,8 @@ const unsigned int cx231xx_bcount = ARRAY_SIZE(cx231xx_boards);
+ /* table of devices that work with this driver */
+ struct usb_device_id cx231xx_id_table[] = {
++      {USB_DEVICE(0x1D19, 0x6108),
++      .driver_info = CX231XX_BOARD_PV_XCAPTURE_USB},
+       {USB_DEVICE(0x1D19, 0x6109),
+       .driver_info = CX231XX_BOARD_PV_XCAPTURE_USB},
+       {USB_DEVICE(0x0572, 0x5A3C),
+-- 
+2.43.0
+
diff --git a/queue-6.12/media-uvcvideo-add-a-quirk-for-the-kaiweets-kti-w02-.patch b/queue-6.12/media-uvcvideo-add-a-quirk-for-the-kaiweets-kti-w02-.patch
new file mode 100644 (file)
index 0000000..1e4e22c
--- /dev/null
@@ -0,0 +1,245 @@
+From 0c55e5e7198a7deaf4eaa8dad18e3eaad6522693 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2024 20:05:40 +0200
+Subject: media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
+
+From: David Given <dg@cowlark.com>
+
+[ Upstream commit b2ec92bb5605452d539a7aa1e42345b95acd8583 ]
+
+Adds a quirk to make the NXP Semiconductors 1fc9:009b chipset work.
+
+lsusb for the device reports:
+
+Bus 003 Device 011: ID 1fc9:009b NXP Semiconductors IR VIDEO
+Device Descriptor:
+  bLength                18
+  bDescriptorType         1
+  bcdUSB               2.00
+  bDeviceClass          239 Miscellaneous Device
+  bDeviceSubClass         2 [unknown]
+  bDeviceProtocol         1 Interface Association
+  bMaxPacketSize0        64
+  idVendor           0x1fc9 NXP Semiconductors
+  idProduct          0x009b IR VIDEO
+  bcdDevice            1.01
+  iManufacturer           1 Guide sensmart
+  iProduct                2 IR VIDEO
+  iSerial                 0
+  bNumConfigurations      1
+  Configuration Descriptor:
+    bLength                 9
+    bDescriptorType         2
+    wTotalLength       0x00c2
+    bNumInterfaces          2
+    bConfigurationValue     1
+    iConfiguration          0
+    bmAttributes         0xc0
+      Self Powered
+    MaxPower              100mA
+    Interface Association:
+      bLength                 8
+      bDescriptorType        11
+      bFirstInterface         0
+      bInterfaceCount         2
+      bFunctionClass         14 Video
+      bFunctionSubClass       3 Video Interface Collection
+      bFunctionProtocol       0
+      iFunction               3 IR Camera
+    Interface Descriptor:
+      bLength                 9
+      bDescriptorType         4
+      bInterfaceNumber        0
+      bAlternateSetting       0
+      bNumEndpoints           1
+      bInterfaceClass        14 Video
+      bInterfaceSubClass      1 Video Control
+      bInterfaceProtocol      0
+      iInterface              0
+      VideoControl Interface Descriptor:
+        bLength                13
+        bDescriptorType        36
+        bDescriptorSubtype      1 (HEADER)
+        bcdUVC               1.00
+        wTotalLength       0x0033
+        dwClockFrequency        6.000000MHz
+        bInCollection           1
+        baInterfaceNr( 0)       1
+      VideoControl Interface Descriptor:
+        bLength                18
+        bDescriptorType        36
+        bDescriptorSubtype      2 (INPUT_TERMINAL)
+        bTerminalID             1
+        wTerminalType      0x0201 Camera Sensor
+        bAssocTerminal          0
+        iTerminal               0
+        wObjectiveFocalLengthMin      0
+        wObjectiveFocalLengthMax      0
+        wOcularFocalLength            0
+        bControlSize                  3
+        bmControls           0x00000000
+      VideoControl Interface Descriptor:
+        bLength                 9
+        bDescriptorType        36
+        bDescriptorSubtype      3 (OUTPUT_TERMINAL)
+        bTerminalID             2
+        wTerminalType      0x0101 USB Streaming
+        bAssocTerminal          0
+        bSourceID               1
+        iTerminal               0
+      VideoControl Interface Descriptor:
+        bLength                11
+        bDescriptorType        36
+        bDescriptorSubtype      5 (PROCESSING_UNIT)
+      Warning: Descriptor too short
+        bUnitID                 3
+        bSourceID               1
+        wMaxMultiplier          0
+        bControlSize            2
+        bmControls     0x00000000
+        iProcessing             0
+        bmVideoStandards     0x62
+          NTSC - 525/60
+          PAL - 525/60
+      Endpoint Descriptor:
+        bLength                 7
+        bDescriptorType         5
+        bEndpointAddress     0x81  EP 1 IN
+        bmAttributes            3
+          Transfer Type            Interrupt
+          Synch Type               None
+          Usage Type               Data
+        wMaxPacketSize     0x0008  1x 8 bytes
+        bInterval               1
+    Interface Descriptor:
+      bLength                 9
+      bDescriptorType         4
+      bInterfaceNumber        1
+      bAlternateSetting       0
+      bNumEndpoints           0
+      bInterfaceClass        14 Video
+      bInterfaceSubClass      2 Video Streaming
+      bInterfaceProtocol      0
+      iInterface              0
+      VideoStreaming Interface Descriptor:
+        bLength                            14
+        bDescriptorType                    36
+        bDescriptorSubtype                  1 (INPUT_HEADER)
+        bNumFormats                         1
+        wTotalLength                   0x0055
+        bEndpointAddress                 0x82  EP 2 IN
+        bmInfo                              0
+        bTerminalLink                       2
+        bStillCaptureMethod                 2
+        bTriggerSupport                     0
+        bTriggerUsage                       0
+        bControlSize                        1
+        bmaControls( 0)                     0
+      VideoStreaming Interface Descriptor:
+        bLength                            27
+        bDescriptorType                    36
+        bDescriptorSubtype                  4 (FORMAT_UNCOMPRESSED)
+        bFormatIndex                        1
+        bNumFrameDescriptors                1
+        guidFormat                            {e436eb7b-524f-11ce-9f53-0020af0ba770}
+        bBitsPerPixel                      16
+        bDefaultFrameIndex                  1
+        bAspectRatioX                       0
+        bAspectRatioY                       0
+        bmInterlaceFlags                 0x00
+          Interlaced stream or variable: No
+          Fields per frame: 2 fields
+          Field 1 first: No
+          Field pattern: Field 1 only
+        bCopyProtect                        0
+      VideoStreaming Interface Descriptor:
+        bLength                            34
+        bDescriptorType                    36
+        bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
+        bFrameIndex                         1
+        bmCapabilities                   0x00
+          Still image unsupported
+        wWidth                            240
+        wHeight                           322
+        dwMinBitRate                 12364800
+        dwMaxBitRate                 30912000
+        dwMaxVideoFrameBufferSize      154560
+        dwDefaultFrameInterval         400000
+        bFrameIntervalType                  2
+        dwFrameInterval( 0)            400000
+        dwFrameInterval( 1)           1000000
+      VideoStreaming Interface Descriptor:
+        bLength                            10
+        bDescriptorType                    36
+        bDescriptorSubtype                  3 (STILL_IMAGE_FRAME)
+        bEndpointAddress                 0x00  EP 0 OUT
+        bNumImageSizePatterns               1
+        wWidth( 0)                        240
+        wHeight( 0)                       322
+        bNumCompressionPatterns             0
+    Interface Descriptor:
+      bLength                 9
+      bDescriptorType         4
+      bInterfaceNumber        1
+      bAlternateSetting       1
+      bNumEndpoints           1
+      bInterfaceClass        14 Video
+      bInterfaceSubClass      2 Video Streaming
+      bInterfaceProtocol      0
+      iInterface              0
+      Endpoint Descriptor:
+        bLength                 7
+        bDescriptorType         5
+        bEndpointAddress     0x82  EP 2 IN
+        bmAttributes            5
+          Transfer Type            Isochronous
+          Synch Type               Asynchronous
+          Usage Type               Data
+        wMaxPacketSize     0x0400  1x 1024 bytes
+        bInterval               1
+Device Status:     0x0001
+  Self Powered
+
+Signed-off-by: David Given <dg@cowlark.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://lore.kernel.org/r/20240918180540.10830-2-dg@cowlark.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 03aa6e5f117c7..17aa313613356 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -2474,6 +2474,8 @@ static const struct uvc_device_info uvc_quirk_force_y8 = {
+  * The Logitech cameras listed below have their interface class set to
+  * VENDOR_SPEC because they don't announce themselves as UVC devices, even
+  * though they are compliant.
++ *
++ * Sort these by vendor/product ID.
+  */
+ static const struct usb_device_id uvc_ids[] = {
+       /* Quanta ACER HD User Facing */
+@@ -3010,6 +3012,15 @@ static const struct usb_device_id uvc_ids[] = {
+         .bInterfaceProtocol   = 0,
+         .driver_info          = UVC_INFO_QUIRK(UVC_QUIRK_PROBE_MINMAX
+                                       | UVC_QUIRK_IGNORE_SELECTOR_UNIT) },
++      /* NXP Semiconductors IR VIDEO */
++      { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
++                              | USB_DEVICE_ID_MATCH_INT_INFO,
++        .idVendor             = 0x1fc9,
++        .idProduct            = 0x009b,
++        .bInterfaceClass      = USB_CLASS_VIDEO,
++        .bInterfaceSubClass   = 1,
++        .bInterfaceProtocol   = 0,
++        .driver_info          = (kernel_ulong_t)&uvc_quirk_probe_minmax },
+       /* Oculus VR Positional Tracker DK2 */
+       { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                               | USB_DEVICE_ID_MATCH_INT_INFO,
+-- 
+2.43.0
+
diff --git a/queue-6.12/media-uvcvideo-force-uvc-version-to-1.0a-for-0408-40.patch b/queue-6.12/media-uvcvideo-force-uvc-version-to-1.0a-for-0408-40.patch
new file mode 100644 (file)
index 0000000..bddbe74
--- /dev/null
@@ -0,0 +1,50 @@
+From 190efba735cdb17f813216888936624c99a6a5cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2024 13:33:29 +0000
+Subject: media: uvcvideo: Force UVC version to 1.0a for 0408:4033
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit c9df99302fff53b6007666136b9f43fbac7ee3d8 ]
+
+The Quanta ACER HD User Facing camera reports a UVC 1.50 version, but
+implements UVC 1.0a as shown by the UVC probe control being 26 bytes
+long. Force the UVC version for that device.
+
+Reported-by: Giuliano Lotta <giuliano.lotta@gmail.com>
+Closes: https://lore.kernel.org/linux-media/fce4f906-d69b-417d-9f13-bf69fe5c81e3@koyu.space/
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://lore.kernel.org/r/20240924-uvc-quanta-v1-1-2de023863767@chromium.org
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 17aa313613356..9f38a9b23c018 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -2479,6 +2479,17 @@ static const struct uvc_device_info uvc_quirk_force_y8 = {
+  */
+ static const struct usb_device_id uvc_ids[] = {
+       /* Quanta ACER HD User Facing */
++      { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
++                              | USB_DEVICE_ID_MATCH_INT_INFO,
++        .idVendor             = 0x0408,
++        .idProduct            = 0x4033,
++        .bInterfaceClass      = USB_CLASS_VIDEO,
++        .bInterfaceSubClass   = 1,
++        .bInterfaceProtocol   = UVC_PC_PROTOCOL_15,
++        .driver_info          = (kernel_ulong_t)&(const struct uvc_device_info){
++              .uvc_version = 0x010a,
++        } },
++      /* Quanta ACER HD User Facing */
+       { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                               | USB_DEVICE_ID_MATCH_INT_INFO,
+         .idVendor             = 0x0408,
+-- 
+2.43.0
+
diff --git a/queue-6.12/media-uvcvideo-realsense-d421-depth-module-metadata.patch b/queue-6.12/media-uvcvideo-realsense-d421-depth-module-metadata.patch
new file mode 100644 (file)
index 0000000..f0a3091
--- /dev/null
@@ -0,0 +1,45 @@
+From 89d8769661a73f9fb712f57774783deaafc1d7f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2024 17:27:50 +0300
+Subject: media: uvcvideo: RealSense D421 Depth module metadata
+
+From: Dmitry Perchanov <dmitry.perchanov@intel.com>
+
+[ Upstream commit c6104297c965a5ee9d4b9d0d5d9cdd224d8fd59e ]
+
+RealSense(R) D421 Depth module is low cost solution for 3D-stereo
+vision. The module supports extended sensor metadata format D4XX.
+
+Signed-off-by: Dmitry Perchanov <dmitry.perchanov@intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://lore.kernel.org/r/d1fbfbbff5c8247a3130499985a53218c5b55c61.camel@intel.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 675be4858366f..03aa6e5f117c7 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -3118,6 +3118,15 @@ static const struct usb_device_id uvc_ids[] = {
+         .bInterfaceSubClass   = 1,
+         .bInterfaceProtocol   = 0,
+         .driver_info          = UVC_INFO_META(V4L2_META_FMT_D4XX) },
++      /* Intel D421 Depth Module */
++      { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
++                              | USB_DEVICE_ID_MATCH_INT_INFO,
++        .idVendor             = 0x8086,
++        .idProduct            = 0x1155,
++        .bInterfaceClass      = USB_CLASS_VIDEO,
++        .bInterfaceSubClass   = 1,
++        .bInterfaceProtocol   = 0,
++        .driver_info          = UVC_INFO_META(V4L2_META_FMT_D4XX) },
+       /* Generic USB Video Class */
+       { USB_INTERFACE_INFO(USB_CLASS_VIDEO, 1, UVC_PC_PROTOCOL_UNDEFINED) },
+       { USB_INTERFACE_INFO(USB_CLASS_VIDEO, 1, UVC_PC_PROTOCOL_15) },
+-- 
+2.43.0
+
diff --git a/queue-6.12/mips-loongson64-dts-really-fix-pcie-port-nodes-for-l.patch b/queue-6.12/mips-loongson64-dts-really-fix-pcie-port-nodes-for-l.patch
new file mode 100644 (file)
index 0000000..0b8a636
--- /dev/null
@@ -0,0 +1,268 @@
+From 8b388973d120780eed4219e3287dc0d6beea9dab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Nov 2024 11:57:37 +0800
+Subject: MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
+
+From: Xi Ruoyao <xry111@xry111.site>
+
+[ Upstream commit 4fbd66d8254cedfd1218393f39d83b6c07a01917 ]
+
+Fix the dtc warnings:
+
+    arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: '#interrupt-cells' found, but node is not an interrupt provider
+    arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: '#interrupt-cells' found, but node is not an interrupt provider
+    arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider'
+
+And a runtime warning introduced in commit 045b14ca5c36 ("of: WARN on
+deprecated #address-cells/#size-cells handling"):
+
+    WARNING: CPU: 0 PID: 1 at drivers/of/base.c:106 of_bus_n_addr_cells+0x9c/0xe0
+    Missing '#address-cells' in /bus@10000000/pci@1a000000/pci_bridge@9,0
+
+The fix is similar to commit d89a415ff8d5 ("MIPS: Loongson64: DTS: Fix PCIe
+port nodes for ls7a"), which has fixed the issue for ls2k (despite its
+subject mentions ls7a).
+
+Signed-off-by: Xi Ruoyao <xry111@xry111.site>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 73 +++++++++++++++++++----
+ 1 file changed, 60 insertions(+), 13 deletions(-)
+
+diff --git a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi
+index cce9428afc41f..ee71045883e7e 100644
+--- a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi
++++ b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi
+@@ -70,7 +70,6 @@
+                       device_type = "pci";
+                       #address-cells = <3>;
+                       #size-cells = <2>;
+-                      #interrupt-cells = <2>;
+                       msi-parent = <&msi>;
+                       reg = <0 0x1a000000 0 0x02000000>,
+@@ -234,7 +233,7 @@
+                               };
+                       };
+-                      pci_bridge@9,0 {
++                      pcie@9,0 {
+                               compatible = "pci0014,7a19.1",
+                                                  "pci0014,7a19",
+                                                  "pciclass060400",
+@@ -244,12 +243,16 @@
+                               interrupts = <32 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 32 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@a,0 {
++                      pcie@a,0 {
+                               compatible = "pci0014,7a09.1",
+                                                  "pci0014,7a09",
+                                                  "pciclass060400",
+@@ -259,12 +262,16 @@
+                               interrupts = <33 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 33 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@b,0 {
++                      pcie@b,0 {
+                               compatible = "pci0014,7a09.1",
+                                                  "pci0014,7a09",
+                                                  "pciclass060400",
+@@ -274,12 +281,16 @@
+                               interrupts = <34 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 34 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@c,0 {
++                      pcie@c,0 {
+                               compatible = "pci0014,7a09.1",
+                                                  "pci0014,7a09",
+                                                  "pciclass060400",
+@@ -289,12 +300,16 @@
+                               interrupts = <35 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 35 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@d,0 {
++                      pcie@d,0 {
+                               compatible = "pci0014,7a19.1",
+                                                  "pci0014,7a19",
+                                                  "pciclass060400",
+@@ -304,12 +319,16 @@
+                               interrupts = <36 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 36 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@e,0 {
++                      pcie@e,0 {
+                               compatible = "pci0014,7a09.1",
+                                                  "pci0014,7a09",
+                                                  "pciclass060400",
+@@ -319,12 +338,16 @@
+                               interrupts = <37 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 37 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@f,0 {
++                      pcie@f,0 {
+                               compatible = "pci0014,7a29.1",
+                                                  "pci0014,7a29",
+                                                  "pciclass060400",
+@@ -334,12 +357,16 @@
+                               interrupts = <40 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 40 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@10,0 {
++                      pcie@10,0 {
+                               compatible = "pci0014,7a19.1",
+                                                  "pci0014,7a19",
+                                                  "pciclass060400",
+@@ -349,12 +376,16 @@
+                               interrupts = <41 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 41 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@11,0 {
++                      pcie@11,0 {
+                               compatible = "pci0014,7a29.1",
+                                                  "pci0014,7a29",
+                                                  "pciclass060400",
+@@ -364,12 +395,16 @@
+                               interrupts = <42 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 42 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@12,0 {
++                      pcie@12,0 {
+                               compatible = "pci0014,7a19.1",
+                                                  "pci0014,7a19",
+                                                  "pciclass060400",
+@@ -379,12 +414,16 @@
+                               interrupts = <43 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 43 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@13,0 {
++                      pcie@13,0 {
+                               compatible = "pci0014,7a29.1",
+                                                  "pci0014,7a29",
+                                                  "pciclass060400",
+@@ -394,12 +433,16 @@
+                               interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 38 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+-                      pci_bridge@14,0 {
++                      pcie@14,0 {
+                               compatible = "pci0014,7a19.1",
+                                                  "pci0014,7a19",
+                                                  "pciclass060400",
+@@ -409,9 +452,13 @@
+                               interrupts = <39 IRQ_TYPE_LEVEL_HIGH>;
+                               interrupt-parent = <&pic>;
++                              #address-cells = <3>;
++                              #size-cells = <2>;
++                              device_type = "pci";
+                               #interrupt-cells = <1>;
+                               interrupt-map-mask = <0 0 0 0>;
+                               interrupt-map = <0 0 0 0 &pic 39 IRQ_TYPE_LEVEL_HIGH>;
++                              ranges;
+                       };
+               };
+-- 
+2.43.0
+
diff --git a/queue-6.12/misc-eeprom-eeprom_93cx6-add-quirk-for-extra-read-cl.patch b/queue-6.12/misc-eeprom-eeprom_93cx6-add-quirk-for-extra-read-cl.patch
new file mode 100644 (file)
index 0000000..b95cc57
--- /dev/null
@@ -0,0 +1,119 @@
+From a3ae242f3259b2c1770227cd15d19d13c267101c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 11:12:33 -0400
+Subject: misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
+
+From: Parker Newman <pnewman@connecttech.com>
+
+[ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ]
+
+Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before
+reading data from the EEPROM.
+
+The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing
+of the op-code/address from the host to the EEPROM and the reading of
+the actual data from the EEPROM.
+
+More info can be found on page 6 of the AT93C46 datasheet (linked below).
+Similar notes are found in other 93xx6 datasheets.
+
+In summary the read operation for a 93Cx6 EEPROM is:
+Write to EEPROM:       110[A5-A0]      (9 bits)
+Read from EEPROM:      0[D15-D0]       (17 bits)
+
+Where:
+       110 is the start bit and READ OpCode
+       [A5-A0] is the address to read from
+       0 is a "dummy bit" preceding the actual data
+       [D15-D0] is the actual data.
+
+Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy
+bit should be clocked out on the last address bit clock cycle meaning it
+should be discarded naturally.
+
+However, depending on the hardware configuration sometimes this dummy
+bit is not discarded. This is the case with Exar PCI UARTs which require
+an extra clock cycle between sending the address and reading the data.
+
+Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46D-Datasheet.pdf
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Parker Newman <pnewman@connecttech.com>
+Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.1727880931.git.pnewman@connecttech.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++
+ include/linux/eeprom_93cx6.h       | 11 +++++++++++
+ 2 files changed, 21 insertions(+)
+
+diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c
+index 9627294fe3e95..4c9827fe92173 100644
+--- a/drivers/misc/eeprom/eeprom_93cx6.c
++++ b/drivers/misc/eeprom/eeprom_93cx6.c
+@@ -186,6 +186,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word,
+       eeprom_93cx6_write_bits(eeprom, command,
+               PCI_EEPROM_WIDTH_OPCODE + eeprom->width);
++      if (has_quirk_extra_read_cycle(eeprom)) {
++              eeprom_93cx6_pulse_high(eeprom);
++              eeprom_93cx6_pulse_low(eeprom);
++      }
++
+       /*
+        * Read the requested 16 bits.
+        */
+@@ -252,6 +257,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte,
+       eeprom_93cx6_write_bits(eeprom, command,
+               PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1);
++      if (has_quirk_extra_read_cycle(eeprom)) {
++              eeprom_93cx6_pulse_high(eeprom);
++              eeprom_93cx6_pulse_low(eeprom);
++      }
++
+       /*
+        * Read the requested 8 bits.
+        */
+diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h
+index c860c72a921d0..3a485cc0e0fa0 100644
+--- a/include/linux/eeprom_93cx6.h
++++ b/include/linux/eeprom_93cx6.h
+@@ -11,6 +11,8 @@
+       Supported chipsets: 93c46, 93c56 and 93c66.
+  */
++#include <linux/bits.h>
++
+ /*
+  * EEPROM operation defines.
+  */
+@@ -34,6 +36,7 @@
+  * @register_write(struct eeprom_93cx6 *eeprom): handler to
+  * write to the eeprom register by using all reg_* fields.
+  * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines
++ * @quirks: eeprom or controller quirks
+  * @drive_data: Set if we're driving the data line.
+  * @reg_data_in: register field to indicate data input
+  * @reg_data_out: register field to indicate data output
+@@ -50,6 +53,9 @@ struct eeprom_93cx6 {
+       void (*register_write)(struct eeprom_93cx6 *eeprom);
+       int width;
++      unsigned int quirks;
++/* Some EEPROMs require an extra clock cycle before reading */
++#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE     BIT(0)
+       char drive_data;
+       char reg_data_in;
+@@ -71,3 +77,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable);
+ extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom,
+                              u8 addr, u16 data);
++
++static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom)
++{
++      return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE;
++}
+-- 
+2.43.0
+
diff --git a/queue-6.12/mmc-core-add-sd-card-quirk-for-broken-poweroff-notif.patch b/queue-6.12/mmc-core-add-sd-card-quirk-for-broken-poweroff-notif.patch
new file mode 100644 (file)
index 0000000..11ced53
--- /dev/null
@@ -0,0 +1,114 @@
+From 2a7ab972d6b528f86dc8cee103503c023a7b1f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 18:44:17 +0900
+Subject: mmc: core: Add SD card quirk for broken poweroff notification
+
+From: Keita Aihara <keita.aihara@sony.com>
+
+[ Upstream commit cd068d51594d9635bf6688fc78717572b78bce6a ]
+
+GIGASTONE Gaming Plus microSD cards manufactured on 02/2022 report that
+they support poweroff notification and cache, but they are not working
+correctly.
+
+Flush Cache bit never gets cleared in sd_flush_cache() and Poweroff
+Notification Ready bit also never gets set to 1 within 1 second from the
+end of busy of CMD49 in sd_poweroff_notify().
+
+This leads to I/O error and runtime PM error state.
+
+I observed that the same card manufactured on 01/2024 works as expected.
+
+This problem seems similar to the Kingston cards fixed with
+commit c467c8f08185 ("mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston
+Canvas Go Plus from 11/2019") and should be handled using quirks.
+
+CID for the problematic card is here.
+12345641535443002000000145016200
+
+Manufacturer ID is 0x12 and defined as CID_MANFID_GIGASTONE as of now,
+but would like comments on what naming is appropriate because MID list
+is not public and not sure it's right.
+
+Signed-off-by: Keita Aihara <keita.aihara@sony.com>
+Link: https://lore.kernel.org/r/20240913094417.GA4191647@sony.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/card.h   | 7 +++++++
+ drivers/mmc/core/quirks.h | 9 +++++++++
+ drivers/mmc/core/sd.c     | 2 +-
+ include/linux/mmc/card.h  | 1 +
+ 4 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
+index 64dcb463a4f49..3205feb1e8ff6 100644
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -85,6 +85,7 @@ struct mmc_fixup {
+ #define CID_MANFID_SANDISK_SD   0x3
+ #define CID_MANFID_ATP          0x9
+ #define CID_MANFID_TOSHIBA      0x11
++#define CID_MANFID_GIGASTONE    0x12
+ #define CID_MANFID_MICRON       0x13
+ #define CID_MANFID_SAMSUNG      0x15
+ #define CID_MANFID_APACER       0x27
+@@ -287,4 +288,10 @@ static inline int mmc_card_broken_cache_flush(const struct mmc_card *c)
+ {
+       return c->quirks & MMC_QUIRK_BROKEN_CACHE_FLUSH;
+ }
++
++static inline int mmc_card_broken_sd_poweroff_notify(const struct mmc_card *c)
++{
++      return c->quirks & MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY;
++}
++
+ #endif
+diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
+index 92905fc46436d..89b512905be14 100644
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -25,6 +25,15 @@ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = {
+                  0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
+                  MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++      /*
++       * GIGASTONE Gaming Plus microSD cards manufactured on 02/2022 never
++       * clear Flush Cache bit and set Poweroff Notification Ready bit.
++       */
++      _FIXUP_EXT("ASTC", CID_MANFID_GIGASTONE, 0x3456, 2022, 2,
++                 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++                 MMC_QUIRK_BROKEN_SD_CACHE | MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY,
++                 EXT_CSD_REV_ANY),
++
+       END_FIXUP
+ };
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index 1d09f0f2e7697..63915541c0e49 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1113,7 +1113,7 @@ static int sd_parse_ext_reg_power(struct mmc_card *card, u8 fno, u8 page,
+       card->ext_power.rev = reg_buf[0] & 0xf;
+       /* Power Off Notification support at bit 4. */
+-      if (reg_buf[1] & BIT(4))
++      if ((reg_buf[1] & BIT(4)) && !mmc_card_broken_sd_poweroff_notify(card))
+               card->ext_power.feature_support |= SD_EXT_POWER_OFF_NOTIFY;
+       /* Power Sustenance support at bit 5. */
+diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
+index f39bce3223654..eb67d3d5ff5b2 100644
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -294,6 +294,7 @@ struct mmc_card {
+ #define MMC_QUIRK_BROKEN_SD_DISCARD   (1<<14) /* Disable broken SD discard support */
+ #define MMC_QUIRK_BROKEN_SD_CACHE     (1<<15) /* Disable broken SD cache support */
+ #define MMC_QUIRK_BROKEN_CACHE_FLUSH  (1<<16) /* Don't flush cache until the write has occurred */
++#define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY   (1<<17) /* Disable broken SD poweroff notify support */
+       bool                    written_flag;   /* Indicates eMMC has been written since power on */
+       bool                    reenable_cmdq;  /* Re-enable Command Queue */
+-- 
+2.43.0
+
diff --git a/queue-6.12/mmc-sdhci-esdhc-imx-enable-quirks-sdhci_quirk_no_led.patch b/queue-6.12/mmc-sdhci-esdhc-imx-enable-quirks-sdhci_quirk_no_led.patch
new file mode 100644 (file)
index 0000000..992b17b
--- /dev/null
@@ -0,0 +1,75 @@
+From 785c78cd150b6646af773e45ed377be5bee40430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 14:20:16 +0800
+Subject: mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 4dede2b76f4a760e948e1a49b1520881cb459bd3 ]
+
+Enable SDHCI_QUIRK_NO_LED for i.MX7ULP, i.MX8MM, i.MX8QXP and
+i.MXRT1050. Even there is LCTL register bit, there is no IOMUX PAD
+for it. So there is no sense to enable LED for SDHCI for these SoCs.
+
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Haibo Chen <haibo.chen@nxp.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20240923062016.1165868-1-peng.fan@oss.nxp.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-esdhc-imx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index 8f0bc6dca2b04..ef3a44f2dff16 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -238,6 +238,7 @@ struct esdhc_platform_data {
+ struct esdhc_soc_data {
+       u32 flags;
++      u32 quirks;
+ };
+ static const struct esdhc_soc_data esdhc_imx25_data = {
+@@ -309,10 +310,12 @@ static struct esdhc_soc_data usdhc_imx7ulp_data = {
+                       | ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200
+                       | ESDHC_FLAG_PMQOS | ESDHC_FLAG_HS400
+                       | ESDHC_FLAG_STATE_LOST_IN_LPMODE,
++      .quirks = SDHCI_QUIRK_NO_LED,
+ };
+ static struct esdhc_soc_data usdhc_imxrt1050_data = {
+       .flags = ESDHC_FLAG_USDHC | ESDHC_FLAG_STD_TUNING
+                       | ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200,
++      .quirks = SDHCI_QUIRK_NO_LED,
+ };
+ static struct esdhc_soc_data usdhc_imx8qxp_data = {
+@@ -321,6 +324,7 @@ static struct esdhc_soc_data usdhc_imx8qxp_data = {
+                       | ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES
+                       | ESDHC_FLAG_STATE_LOST_IN_LPMODE
+                       | ESDHC_FLAG_CLK_RATE_LOST_IN_PM_RUNTIME,
++      .quirks = SDHCI_QUIRK_NO_LED,
+ };
+ static struct esdhc_soc_data usdhc_imx8mm_data = {
+@@ -328,6 +332,7 @@ static struct esdhc_soc_data usdhc_imx8mm_data = {
+                       | ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200
+                       | ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES
+                       | ESDHC_FLAG_STATE_LOST_IN_LPMODE,
++      .quirks = SDHCI_QUIRK_NO_LED,
+ };
+ struct pltfm_imx_data {
+@@ -1687,6 +1692,7 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
+       imx_data->socdata = device_get_match_data(&pdev->dev);
++      host->quirks |= imx_data->socdata->quirks;
+       if (imx_data->socdata->flags & ESDHC_FLAG_PMQOS)
+               cpu_latency_qos_add_request(&imx_data->pm_qos_req, 0);
+-- 
+2.43.0
+
diff --git a/queue-6.12/mptcp-annotate-data-races-around-subflow-fully_estab.patch b/queue-6.12/mptcp-annotate-data-races-around-subflow-fully_estab.patch
new file mode 100644 (file)
index 0000000..8b4bc7d
--- /dev/null
@@ -0,0 +1,142 @@
+From 90c7cdcd3710d945a08e2c15684814b6b85ce734 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 17:14:04 +0200
+Subject: mptcp: annotate data-races around subflow->fully_established
+
+From: Gang Yan <yangang@kylinos.cn>
+
+[ Upstream commit 581c8cbfa934aaa555daa4e843242fcecc160f05 ]
+
+We introduce the same handling for potential data races with the
+'fully_established' flag in subflow as previously done for
+msk->fully_established.
+
+Additionally, we make a crucial change: convert the subflow's
+'fully_established' from 'bit_field' to 'bool' type. This is
+necessary because methods for avoiding data races don't work well
+with 'bit_field'. Specifically, the 'READ_ONCE' needs to know
+the size of the variable being accessed, which is not supported in
+'bit_field'. Also, 'test_bit' expect the address of 'bit_field'.
+
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/516
+Signed-off-by: Gang Yan <yangang@kylinos.cn>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20241021-net-next-mptcp-misc-6-13-v1-2-1ef02746504a@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/diag.c     | 2 +-
+ net/mptcp/options.c  | 4 ++--
+ net/mptcp/protocol.c | 2 +-
+ net/mptcp/protocol.h | 6 +++---
+ net/mptcp/subflow.c  | 4 ++--
+ 5 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/net/mptcp/diag.c b/net/mptcp/diag.c
+index 2d3efb405437d..02205f7994d75 100644
+--- a/net/mptcp/diag.c
++++ b/net/mptcp/diag.c
+@@ -47,7 +47,7 @@ static int subflow_get_info(struct sock *sk, struct sk_buff *skb)
+               flags |= MPTCP_SUBFLOW_FLAG_BKUP_REM;
+       if (sf->request_bkup)
+               flags |= MPTCP_SUBFLOW_FLAG_BKUP_LOC;
+-      if (sf->fully_established)
++      if (READ_ONCE(sf->fully_established))
+               flags |= MPTCP_SUBFLOW_FLAG_FULLY_ESTABLISHED;
+       if (sf->conn_finished)
+               flags |= MPTCP_SUBFLOW_FLAG_CONNECTED;
+diff --git a/net/mptcp/options.c b/net/mptcp/options.c
+index 370c3836b7712..1603b3702e220 100644
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -461,7 +461,7 @@ static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb,
+               return false;
+       /* MPC/MPJ needed only on 3rd ack packet, DATA_FIN and TCP shutdown take precedence */
+-      if (subflow->fully_established || snd_data_fin_enable ||
++      if (READ_ONCE(subflow->fully_established) || snd_data_fin_enable ||
+           subflow->snd_isn != TCP_SKB_CB(skb)->seq ||
+           sk->sk_state != TCP_ESTABLISHED)
+               return false;
+@@ -930,7 +930,7 @@ static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk,
+       /* here we can process OoO, in-window pkts, only in-sequence 4th ack
+        * will make the subflow fully established
+        */
+-      if (likely(subflow->fully_established)) {
++      if (likely(READ_ONCE(subflow->fully_established))) {
+               /* on passive sockets, check for 3rd ack retransmission
+                * note that msk is always set by subflow_syn_recv_sock()
+                * for mp_join subflows
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 48d480982b787..47ee616f69c2d 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -3519,7 +3519,7 @@ static void schedule_3rdack_retransmission(struct sock *ssk)
+       struct tcp_sock *tp = tcp_sk(ssk);
+       unsigned long timeout;
+-      if (mptcp_subflow_ctx(ssk)->fully_established)
++      if (READ_ONCE(mptcp_subflow_ctx(ssk)->fully_established))
+               return;
+       /* reschedule with a timeout above RTT, as we must look only for drop */
+diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
+index 568a72702b080..a93e661ef5c43 100644
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -513,7 +513,6 @@ struct mptcp_subflow_context {
+               request_bkup : 1,
+               mp_capable : 1,     /* remote is MPTCP capable */
+               mp_join : 1,        /* remote is JOINing */
+-              fully_established : 1,      /* path validated */
+               pm_notified : 1,    /* PM hook called for established status */
+               conn_finished : 1,
+               map_valid : 1,
+@@ -532,10 +531,11 @@ struct mptcp_subflow_context {
+               is_mptfo : 1,       /* subflow is doing TFO */
+               close_event_done : 1,       /* has done the post-closed part */
+               mpc_drop : 1,       /* the MPC option has been dropped in a rtx */
+-              __unused : 8;
++              __unused : 9;
+       bool    data_avail;
+       bool    scheduled;
+       bool    pm_listener;        /* a listener managed by the kernel PM? */
++      bool    fully_established;  /* path validated */
+       u32     remote_nonce;
+       u64     thmac;
+       u32     local_nonce;
+@@ -780,7 +780,7 @@ static inline bool __tcp_can_send(const struct sock *ssk)
+ static inline bool __mptcp_subflow_active(struct mptcp_subflow_context *subflow)
+ {
+       /* can't send if JOIN hasn't completed yet (i.e. is usable for mptcp) */
+-      if (subflow->request_join && !subflow->fully_established)
++      if (subflow->request_join && !READ_ONCE(subflow->fully_established))
+               return false;
+       return __tcp_can_send(mptcp_subflow_tcp_sock(subflow));
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index 6170f2fff71e4..860903e064225 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -800,7 +800,7 @@ void __mptcp_subflow_fully_established(struct mptcp_sock *msk,
+                                      const struct mptcp_options_received *mp_opt)
+ {
+       subflow_set_remote_key(msk, subflow, mp_opt);
+-      subflow->fully_established = 1;
++      WRITE_ONCE(subflow->fully_established, true);
+       WRITE_ONCE(msk->fully_established, true);
+       if (subflow->is_mptfo)
+@@ -2062,7 +2062,7 @@ static void subflow_ulp_clone(const struct request_sock *req,
+       } else if (subflow_req->mp_join) {
+               new_ctx->ssn_offset = subflow_req->ssn_offset;
+               new_ctx->mp_join = 1;
+-              new_ctx->fully_established = 1;
++              WRITE_ONCE(new_ctx->fully_established, true);
+               new_ctx->remote_key_valid = 1;
+               new_ctx->backup = subflow_req->backup;
+               new_ctx->request_bkup = subflow_req->request_bkup;
+-- 
+2.43.0
+
diff --git a/queue-6.12/mptcp-fix-possible-integer-overflow-in-mptcp_reset_t.patch b/queue-6.12/mptcp-fix-possible-integer-overflow-in-mptcp_reset_t.patch
new file mode 100644 (file)
index 0000000..07f3202
--- /dev/null
@@ -0,0 +1,40 @@
+From 14ce6125d7e5a5357c0110aa59002dc438ca99d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 13:36:57 +0300
+Subject: mptcp: fix possible integer overflow in mptcp_reset_tout_timer
+
+From: Dmitry Kandybka <d.kandybka@gmail.com>
+
+[ Upstream commit b169e76ebad22cbd055101ee5aa1a7bed0e66606 ]
+
+In 'mptcp_reset_tout_timer', promote 'probe_timestamp' to unsigned long
+to avoid possible integer overflow. Compile tested only.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Dmitry Kandybka <d.kandybka@gmail.com>
+Link: https://patch.msgid.link/20241107103657.1560536-1-d.kandybka@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/protocol.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 47ee616f69c2d..8a8e8fee337f5 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -2728,8 +2728,8 @@ void mptcp_reset_tout_timer(struct mptcp_sock *msk, unsigned long fail_tout)
+       if (!fail_tout && !inet_csk(sk)->icsk_mtup.probe_timestamp)
+               return;
+-      close_timeout = inet_csk(sk)->icsk_mtup.probe_timestamp - tcp_jiffies32 + jiffies +
+-                      mptcp_close_timeout(sk);
++      close_timeout = (unsigned long)inet_csk(sk)->icsk_mtup.probe_timestamp -
++                      tcp_jiffies32 + jiffies + mptcp_close_timeout(sk);
+       /* the close timeout takes precedence on the fail one, and here at least one of
+        * them is active
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-af_can-do-not-leave-a-dangling-sk-pointer-in-can.patch b/queue-6.12/net-af_can-do-not-leave-a-dangling-sk-pointer-in-can.patch
new file mode 100644 (file)
index 0000000..bba4f0e
--- /dev/null
@@ -0,0 +1,39 @@
+From db505f4917a5a8ad5e7d3408425b4757c59ea62e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 16:38:03 +0100
+Subject: net: af_can: do not leave a dangling sk pointer in can_create()
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+[ Upstream commit 811a7ca7320c062e15d0f5b171fe6ad8592d1434 ]
+
+On error can_create() frees the allocated sk object, but sock_init_data()
+has already attached it to the provided sock object. This will leave a
+dangling sk pointer in the sock object and may cause use-after-free later.
+
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Link: https://patch.msgid.link/20241014153808.51894-5-ignat@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/af_can.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 707576eeeb582..01f3fbb3b67dc 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -171,6 +171,7 @@ static int can_create(struct net *net, struct socket *sock, int protocol,
+               /* release sk on errors */
+               sock_orphan(sk);
+               sock_put(sk);
++              sock->sk = NULL;
+       }
+  errout:
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-ethernet-fs_enet-use-pa-to-format-resource_size_.patch b/queue-6.12/net-ethernet-fs_enet-use-pa-to-format-resource_size_.patch
new file mode 100644 (file)
index 0000000..9b3e16f
--- /dev/null
@@ -0,0 +1,57 @@
+From 60342ef3d10f4a80bded2ce782ef034807c2e723 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 11:48:08 +0100
+Subject: net: ethernet: fs_enet: Use %pa to format resource_size_t
+
+From: Simon Horman <horms@kernel.org>
+
+[ Upstream commit 45fe45fada261e1e83fce2a07fa22835aec1cf0a ]
+
+The correct format string for resource_size_t is %pa which
+acts on the address of the variable to be formatted [1].
+
+[1] https://elixir.bootlin.com/linux/v6.11.3/source/Documentation/core-api/printk-formats.rst#L229
+
+Introduced by commit 9d9326d3bc0e ("phy: Change mii_bus id field to a string")
+
+Flagged by gcc-14 as:
+
+drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c: In function 'fs_mii_bitbang_init':
+drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c:126:46: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Wformat=]
+  126 |         snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start);
+      |                                             ~^   ~~~~~~~~~
+      |                                              |      |
+      |                                              |      resource_size_t {aka long long unsigned int}
+      |                                              unsigned int
+      |                                             %llx
+
+No functional change intended.
+Compile tested only.
+
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Closes: https://lore.kernel.org/netdev/711d7f6d-b785-7560-f4dc-c6aad2cce99@linux-m68k.org/
+Signed-off-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
+Link: https://patch.msgid.link/20241014-net-pa-fmt-v1-2-dcc9afb8858b@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
+index 2e210a0035584..249b482e32d3b 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
++++ b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
+@@ -123,7 +123,7 @@ static int fs_mii_bitbang_init(struct mii_bus *bus, struct device_node *np)
+        * we get is an int, and the odds of multiple bitbang mdio buses
+        * is low enough that it's not worth going too crazy.
+        */
+-      snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start);
++      snprintf(bus->id, MII_BUS_ID_SIZE, "%pa", &res.start);
+       data = of_get_property(np, "fsl,mdio-pin", &len);
+       if (!data || len != 4)
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-fec_mpc52xx_phy-use-pa-to-format-resource_size_t.patch b/queue-6.12/net-fec_mpc52xx_phy-use-pa-to-format-resource_size_t.patch
new file mode 100644 (file)
index 0000000..6729b11
--- /dev/null
@@ -0,0 +1,57 @@
+From a3cd08daf2d18a075f390827afe8dd61e88691b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 11:48:07 +0100
+Subject: net: fec_mpc52xx_phy: Use %pa to format resource_size_t
+
+From: Simon Horman <horms@kernel.org>
+
+[ Upstream commit 020bfdc4ed94be472138c891bde4d14241cf00fd ]
+
+The correct format string for resource_size_t is %pa which
+acts on the address of the variable to be formatted [1].
+
+[1] https://elixir.bootlin.com/linux/v6.11.3/source/Documentation/core-api/printk-formats.rst#L229
+
+Introduced by commit 9d9326d3bc0e ("phy: Change mii_bus id field to a string")
+
+Flagged by gcc-14 as:
+
+drivers/net/ethernet/freescale/fec_mpc52xx_phy.c: In function 'mpc52xx_fec_mdio_probe':
+drivers/net/ethernet/freescale/fec_mpc52xx_phy.c:97:46: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Wformat=]
+   97 |         snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start);
+      |                                             ~^   ~~~~~~~~~
+      |                                              |      |
+      |                                              |      resource_size_t {aka long long unsigned int}
+      |                                              unsigned int
+      |                                             %llx
+
+No functional change intended.
+Compile tested only.
+
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Closes: https://lore.kernel.org/netdev/711d7f6d-b785-7560-f4dc-c6aad2cce99@linux-m68k.org/
+Signed-off-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
+Link: https://patch.msgid.link/20241014-net-pa-fmt-v1-1-dcc9afb8858b@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_mpc52xx_phy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c b/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c
+index 39689826cc8ff..ce253aac5344c 100644
+--- a/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c
++++ b/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c
+@@ -94,7 +94,7 @@ static int mpc52xx_fec_mdio_probe(struct platform_device *of)
+               goto out_free;
+       }
+-      snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start);
++      snprintf(bus->id, MII_BUS_ID_SIZE, "%pa", &res.start);
+       bus->priv = priv;
+       bus->parent = dev;
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-ieee802154-do-not-leave-a-dangling-sk-pointer-in.patch b/queue-6.12/net-ieee802154-do-not-leave-a-dangling-sk-pointer-in.patch
new file mode 100644 (file)
index 0000000..1343e3a
--- /dev/null
@@ -0,0 +1,62 @@
+From 1bfa5632f06fc4fcb8a2e29f82803736f572c178 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 16:38:04 +0100
+Subject: net: ieee802154: do not leave a dangling sk pointer in
+ ieee802154_create()
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+[ Upstream commit b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d ]
+
+sock_init_data() attaches the allocated sk object to the provided sock
+object. If ieee802154_create() fails later, the allocated sk object is
+freed, but the dangling pointer remains in the provided sock object, which
+may allow use-after-free.
+
+Clear the sk pointer in the sock object on error.
+
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241014153808.51894-6-ignat@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ieee802154/socket.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
+index 990a83455dcfb..18d267921bb53 100644
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -1043,19 +1043,21 @@ static int ieee802154_create(struct net *net, struct socket *sock,
+       if (sk->sk_prot->hash) {
+               rc = sk->sk_prot->hash(sk);
+-              if (rc) {
+-                      sk_common_release(sk);
+-                      goto out;
+-              }
++              if (rc)
++                      goto out_sk_release;
+       }
+       if (sk->sk_prot->init) {
+               rc = sk->sk_prot->init(sk);
+               if (rc)
+-                      sk_common_release(sk);
++                      goto out_sk_release;
+       }
+ out:
+       return rc;
++out_sk_release:
++      sk_common_release(sk);
++      sock->sk = NULL;
++      goto out;
+ }
+ static const struct net_proto_family ieee802154_family_ops = {
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-inet-do-not-leave-a-dangling-sk-pointer-in-inet_.patch b/queue-6.12/net-inet-do-not-leave-a-dangling-sk-pointer-in-inet_.patch
new file mode 100644 (file)
index 0000000..746014f
--- /dev/null
@@ -0,0 +1,76 @@
+From 2577163fcc2d174521e1801e186de568ee3e8834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 16:38:05 +0100
+Subject: net: inet: do not leave a dangling sk pointer in inet_create()
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+[ Upstream commit 9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff ]
+
+sock_init_data() attaches the allocated sk object to the provided sock
+object. If inet_create() fails later, the sk object is freed, but the
+sock object retains the dangling pointer, which may create use-after-free
+later.
+
+Clear the sk pointer in the sock object on error.
+
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241014153808.51894-7-ignat@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/af_inet.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index b24d74616637a..8095e82de8083 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -376,32 +376,30 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
+               inet->inet_sport = htons(inet->inet_num);
+               /* Add to protocol hash chains. */
+               err = sk->sk_prot->hash(sk);
+-              if (err) {
+-                      sk_common_release(sk);
+-                      goto out;
+-              }
++              if (err)
++                      goto out_sk_release;
+       }
+       if (sk->sk_prot->init) {
+               err = sk->sk_prot->init(sk);
+-              if (err) {
+-                      sk_common_release(sk);
+-                      goto out;
+-              }
++              if (err)
++                      goto out_sk_release;
+       }
+       if (!kern) {
+               err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk);
+-              if (err) {
+-                      sk_common_release(sk);
+-                      goto out;
+-              }
++              if (err)
++                      goto out_sk_release;
+       }
+ out:
+       return err;
+ out_rcu_unlock:
+       rcu_read_unlock();
+       goto out;
++out_sk_release:
++      sk_common_release(sk);
++      sock->sk = NULL;
++      goto out;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-inet6-do-not-leave-a-dangling-sk-pointer-in-inet.patch b/queue-6.12/net-inet6-do-not-leave-a-dangling-sk-pointer-in-inet.patch
new file mode 100644 (file)
index 0000000..e29751f
--- /dev/null
@@ -0,0 +1,75 @@
+From 8a518a79fe448e70c494aee5d2f5a09dfa981096 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 16:38:06 +0100
+Subject: net: inet6: do not leave a dangling sk pointer in inet6_create()
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+[ Upstream commit 9df99c395d0f55fb444ef39f4d6f194ca437d884 ]
+
+sock_init_data() attaches the allocated sk pointer to the provided sock
+object. If inet6_create() fails later, the sk object is released, but the
+sock object retains the dangling sk pointer, which may cause use-after-free
+later.
+
+Clear the sock sk pointer on error.
+
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241014153808.51894-8-ignat@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/af_inet6.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index ba69b86f1c7d5..f60ec8b0f8ea4 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -252,31 +252,29 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
+                */
+               inet->inet_sport = htons(inet->inet_num);
+               err = sk->sk_prot->hash(sk);
+-              if (err) {
+-                      sk_common_release(sk);
+-                      goto out;
+-              }
++              if (err)
++                      goto out_sk_release;
+       }
+       if (sk->sk_prot->init) {
+               err = sk->sk_prot->init(sk);
+-              if (err) {
+-                      sk_common_release(sk);
+-                      goto out;
+-              }
++              if (err)
++                      goto out_sk_release;
+       }
+       if (!kern) {
+               err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk);
+-              if (err) {
+-                      sk_common_release(sk);
+-                      goto out;
+-              }
++              if (err)
++                      goto out_sk_release;
+       }
+ out:
+       return err;
+ out_rcu_unlock:
+       rcu_read_unlock();
+       goto out;
++out_sk_release:
++      sk_common_release(sk);
++      sock->sk = NULL;
++      goto out;
+ }
+ static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-neighbor-clear-error-in-case-strict-check-is-not.patch b/queue-6.12/net-neighbor-clear-error-in-case-strict-check-is-not.patch
new file mode 100644 (file)
index 0000000..b8ade65
--- /dev/null
@@ -0,0 +1,42 @@
+From d211982064bbbb3219d645e45dfcb4c235f24121 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2024 16:32:21 -0800
+Subject: net/neighbor: clear error in case strict check is not set
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 0de6a472c3b38432b2f184bd64eb70d9ea36d107 ]
+
+Commit 51183d233b5a ("net/neighbor: Update neigh_dump_info for strict
+data checking") added strict checking. The err variable is not cleared,
+so if we find no table to dump we will return the validation error even
+if user did not want strict checking.
+
+I think the only way to hit this is to send an buggy request, and ask
+for a table which doesn't exist, so there's no point treating this
+as a real fix. I only noticed it because a syzbot repro depended on it
+to trigger another bug.
+
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20241115003221.733593-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 77b819cd995b2..cc58315a40a79 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -2876,6 +2876,7 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
+       err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack);
+       if (err < 0 && cb->strict_check)
+               return err;
++      err = 0;
+       s_t = cb->args[0];
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-sched-cbs-fix-integer-overflow-in-cbs_set_port_r.patch b/queue-6.12/net-sched-cbs-fix-integer-overflow-in-cbs_set_port_r.patch
new file mode 100644 (file)
index 0000000..8fd0775
--- /dev/null
@@ -0,0 +1,40 @@
+From 5207d5a40c23ea161737b8a604be3403d7b97c3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Oct 2024 15:45:29 +0300
+Subject: net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
+
+From: Elena Salomatkina <esalomatkina@ispras.ru>
+
+[ Upstream commit 397006ba5d918f9b74e734867e8fddbc36dc2282 ]
+
+The subsequent calculation of port_rate = speed * 1000 * BYTES_PER_KBIT,
+where the BYTES_PER_KBIT is of type LL, may cause an overflow.
+At least when speed = SPEED_20000, the expression to the left of port_rate
+will be greater than INT_MAX.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Elena Salomatkina <esalomatkina@ispras.ru>
+Link: https://patch.msgid.link/20241013124529.1043-1-esalomatkina@ispras.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_cbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
+index 939425da18955..8c9a0400c8622 100644
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -310,7 +310,7 @@ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
+ {
+       struct ethtool_link_ksettings ecmd;
+       int speed = SPEED_10;
+-      int port_rate;
++      s64 port_rate;
+       int err;
+       err = __ethtool_get_link_ksettings(dev, &ecmd);
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-sfp-change-quirks-for-alcatel-lucent-g-010s-p.patch b/queue-6.12/net-sfp-change-quirks-for-alcatel-lucent-g-010s-p.patch
new file mode 100644 (file)
index 0000000..2c46190
--- /dev/null
@@ -0,0 +1,37 @@
+From 8791a6d212d2dd9f13871c70380d106d460c0e9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Oct 2024 01:39:17 +0800
+Subject: net: sfp: change quirks for Alcatel Lucent G-010S-P
+
+From: Shengyu Qu <wiagn233@outlook.com>
+
+[ Upstream commit 90cb5f1776ba371478e2b08fbf7018c7bd781a8d ]
+
+Seems Alcatel Lucent G-010S-P also have the same problem that it uses
+TX_FAULT pin for SOC uart. So apply sfp_fixup_ignore_tx_fault to it.
+
+Signed-off-by: Shengyu Qu <wiagn233@outlook.com>
+Link: https://patch.msgid.link/TYCPR01MB84373677E45A7BFA5A28232C98792@TYCPR01MB8437.jpnprd01.prod.outlook.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/sfp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index a5684ef5884bd..dcec92625cf65 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -466,7 +466,8 @@ static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id,
+ static const struct sfp_quirk sfp_quirks[] = {
+       // Alcatel Lucent G-010S-P can operate at 2500base-X, but incorrectly
+       // report 2500MBd NRZ in their EEPROM
+-      SFP_QUIRK_M("ALCATELLUCENT", "G010SP", sfp_quirk_2500basex),
++      SFP_QUIRK("ALCATELLUCENT", "G010SP", sfp_quirk_2500basex,
++                sfp_fixup_ignore_tx_fault),
+       // Alcatel Lucent G-010S-A can operate at 2500base-X, but report 3.2GBd
+       // NRZ in their EEPROM
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-stmmac-programming-sequence-for-vlan-packets-wit.patch b/queue-6.12/net-stmmac-programming-sequence-for-vlan-packets-wit.patch
new file mode 100644 (file)
index 0000000..562c99c
--- /dev/null
@@ -0,0 +1,116 @@
+From d30b12949156917c068b4e21d4ed2261ccbb92ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 16:43:13 -0700
+Subject: net: stmmac: Programming sequence for VLAN packets with split header
+
+From: Abhishek Chauhan <quic_abchauha@quicinc.com>
+
+[ Upstream commit d10f1a4e44c3bf874701f86f8cc43490e1956acf ]
+
+Currently reset state configuration of split header works fine for
+non-tagged packets and we see no corruption in payload of any size
+
+We need additional programming sequence with reset configuration to
+handle VLAN tagged packets to avoid corruption in payload for packets
+of size greater than 256 bytes.
+
+Without this change ping application complains about corruption
+in payload when the size of the VLAN packet exceeds 256 bytes.
+
+With this change tagged and non-tagged packets of any size works fine
+and there is no corruption seen.
+
+Current configuration which has the issue for VLAN packet
+----------------------------------------------------------
+
+Split happens at the position at Layer 3 header
+|MAC-DA|MAC-SA|Vlan Tag|Ether type|IP header|IP data|Rest of the payload|
+                         2 bytes            ^
+                                            |
+
+With the fix we are making sure that the split happens now at
+Layer 2 which is end of ethernet header and start of IP payload
+
+Ip traffic split
+-----------------
+
+Bits which take care of this are SPLM and SPLOFST
+SPLM = Split mode is set to Layer 2
+SPLOFST = These bits indicate the value of offset from the beginning
+of Length/Type field at which header split should take place when the
+appropriate SPLM is selected. Reset value is 2bytes.
+
+Un-tagged data (without VLAN)
+|MAC-DA|MAC-SA|Ether type|IP header|IP data|Rest of the payload|
+                  2bytes ^
+                        |
+
+Tagged data (with VLAN)
+|MAC-DA|MAC-SA|VLAN Tag|Ether type|IP header|IP data|Rest of the payload|
+                          2bytes  ^
+                                 |
+
+Non-IP traffic split such AV packet
+------------------------------------
+
+Bits which take care of this are
+SAVE = Split AV Enable
+SAVO = Split AV Offset, similar to SPLOFST but this is for AVTP
+packets.
+
+|Preamble|MAC-DA|MAC-SA|VLAN tag|Ether type|IEEE 1722 payload|CRC|
+                                   2bytes ^
+                                          |
+
+Signed-off-by: Abhishek Chauhan <quic_abchauha@quicinc.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20241016234313.3992214-1-quic_abchauha@quicinc.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4.h     | 5 +++++
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+index 93a78fd0737b6..28fff6cab812e 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+@@ -44,6 +44,7 @@
+ #define GMAC_MDIO_DATA                        0x00000204
+ #define GMAC_GPIO_STATUS              0x0000020C
+ #define GMAC_ARP_ADDR                 0x00000210
++#define GMAC_EXT_CFG1                 0x00000238
+ #define GMAC_ADDR_HIGH(reg)           (0x300 + reg * 8)
+ #define GMAC_ADDR_LOW(reg)            (0x304 + reg * 8)
+ #define GMAC_L3L4_CTRL(reg)           (0x900 + (reg) * 0x30)
+@@ -284,6 +285,10 @@ enum power_event {
+ #define GMAC_HW_FEAT_DVLAN            BIT(5)
+ #define GMAC_HW_FEAT_NRVF             GENMASK(2, 0)
++/* MAC extended config 1 */
++#define GMAC_CONFIG1_SAVE_EN          BIT(24)
++#define GMAC_CONFIG1_SPLM(v)          FIELD_PREP(GENMASK(9, 8), v)
++
+ /* GMAC GPIO Status reg */
+ #define GMAC_GPO0                     BIT(16)
+ #define GMAC_GPO1                     BIT(17)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+index 77b35abc6f6fa..22a044d93e172 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+@@ -534,6 +534,11 @@ static void dwmac4_enable_sph(struct stmmac_priv *priv, void __iomem *ioaddr,
+       value |= GMAC_CONFIG_HDSMS_256; /* Segment max 256 bytes */
+       writel(value, ioaddr + GMAC_EXT_CONFIG);
++      value = readl(ioaddr + GMAC_EXT_CFG1);
++      value |= GMAC_CONFIG1_SPLM(1); /* Split mode set to L2OFST */
++      value |= GMAC_CONFIG1_SAVE_EN; /* Enable Split AV mode */
++      writel(value, ioaddr + GMAC_EXT_CFG1);
++
+       value = readl(ioaddr + DMA_CHAN_CONTROL(dwmac4_addrs, chan));
+       if (en)
+               value |= DMA_CONTROL_SPH;
+-- 
+2.43.0
+
diff --git a/queue-6.12/net-tcp-add-missing-lockdep-annotations-for-tcp-ao-h.patch b/queue-6.12/net-tcp-add-missing-lockdep-annotations-for-tcp-ao-h.patch
new file mode 100644 (file)
index 0000000..93bb30b
--- /dev/null
@@ -0,0 +1,248 @@
+From ebef77dff6207b2037f566de75dbd95e14369323 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 04:22:33 +0000
+Subject: net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
+
+From: Dmitry Safonov <0x7f454c46@gmail.com>
+
+[ Upstream commit 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 ]
+
+Under CONFIG_PROVE_RCU_LIST + CONFIG_RCU_EXPERT
+hlist_for_each_entry_rcu() provides very helpful splats, which help
+to find possible issues. I missed CONFIG_RCU_EXPERT=y in my testing
+config the same as described in
+a3e4bf7f9675 ("configs/debug: make sure PROVE_RCU_LIST=y takes effect").
+
+The fix itself is trivial: add the very same lockdep annotations
+as were used to dereference ao_info from the socket.
+
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Closes: https://lore.kernel.org/netdev/20241028152645.35a8be66@kernel.org/
+Signed-off-by: Dmitry Safonov <0x7f454c46@gmail.com>
+Link: https://patch.msgid.link/20241030-tcp-ao-hlist-lockdep-annotate-v1-1-bf641a64d7c6@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tcp_ao.h |  3 ++-
+ net/ipv4/tcp_ao.c    | 42 +++++++++++++++++++++++-------------------
+ net/ipv4/tcp_ipv4.c  |  3 ++-
+ net/ipv6/tcp_ipv6.c  |  4 ++--
+ 4 files changed, 29 insertions(+), 23 deletions(-)
+
+diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h
+index 1d46460d0fefa..df655ce6987d3 100644
+--- a/include/net/tcp_ao.h
++++ b/include/net/tcp_ao.h
+@@ -183,7 +183,8 @@ int tcp_ao_hash_skb(unsigned short int family,
+                   const u8 *tkey, int hash_offset, u32 sne);
+ int tcp_parse_ao(struct sock *sk, int cmd, unsigned short int family,
+                sockptr_t optval, int optlen);
+-struct tcp_ao_key *tcp_ao_established_key(struct tcp_ao_info *ao,
++struct tcp_ao_key *tcp_ao_established_key(const struct sock *sk,
++                                        struct tcp_ao_info *ao,
+                                         int sndid, int rcvid);
+ int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk,
+                            struct request_sock *req, struct sk_buff *skb,
+diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c
+index db6516092daf5..bbb8d5f0eae7d 100644
+--- a/net/ipv4/tcp_ao.c
++++ b/net/ipv4/tcp_ao.c
+@@ -109,12 +109,13 @@ bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code)
+  * it's known that the keys in ao_info are matching peer's
+  * family/address/VRF/etc.
+  */
+-struct tcp_ao_key *tcp_ao_established_key(struct tcp_ao_info *ao,
++struct tcp_ao_key *tcp_ao_established_key(const struct sock *sk,
++                                        struct tcp_ao_info *ao,
+                                         int sndid, int rcvid)
+ {
+       struct tcp_ao_key *key;
+-      hlist_for_each_entry_rcu(key, &ao->head, node) {
++      hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk)) {
+               if ((sndid >= 0 && key->sndid != sndid) ||
+                   (rcvid >= 0 && key->rcvid != rcvid))
+                       continue;
+@@ -205,7 +206,7 @@ static struct tcp_ao_key *__tcp_ao_do_lookup(const struct sock *sk, int l3index,
+       if (!ao)
+               return NULL;
+-      hlist_for_each_entry_rcu(key, &ao->head, node) {
++      hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk)) {
+               u8 prefixlen = min(prefix, key->prefixlen);
+               if (!tcp_ao_key_cmp(key, l3index, addr, prefixlen,
+@@ -793,7 +794,7 @@ int tcp_ao_prepare_reset(const struct sock *sk, struct sk_buff *skb,
+               if (!ao_info)
+                       return -ENOENT;
+-              *key = tcp_ao_established_key(ao_info, aoh->rnext_keyid, -1);
++              *key = tcp_ao_established_key(sk, ao_info, aoh->rnext_keyid, -1);
+               if (!*key)
+                       return -ENOENT;
+               *traffic_key = snd_other_key(*key);
+@@ -979,7 +980,7 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb,
+                */
+               key = READ_ONCE(info->rnext_key);
+               if (key->rcvid != aoh->keyid) {
+-                      key = tcp_ao_established_key(info, -1, aoh->keyid);
++                      key = tcp_ao_established_key(sk, info, -1, aoh->keyid);
+                       if (!key)
+                               goto key_not_found;
+               }
+@@ -1003,7 +1004,7 @@ tcp_inbound_ao_hash(struct sock *sk, const struct sk_buff *skb,
+                                                  aoh->rnext_keyid,
+                                                  tcp_ao_hdr_maclen(aoh));
+                       /* If the key is not found we do nothing. */
+-                      key = tcp_ao_established_key(info, aoh->rnext_keyid, -1);
++                      key = tcp_ao_established_key(sk, info, aoh->rnext_keyid, -1);
+                       if (key)
+                               /* pairs with tcp_ao_del_cmd */
+                               WRITE_ONCE(info->current_key, key);
+@@ -1163,7 +1164,7 @@ void tcp_ao_established(struct sock *sk)
+       if (!ao)
+               return;
+-      hlist_for_each_entry_rcu(key, &ao->head, node)
++      hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk))
+               tcp_ao_cache_traffic_keys(sk, ao, key);
+ }
+@@ -1180,7 +1181,7 @@ void tcp_ao_finish_connect(struct sock *sk, struct sk_buff *skb)
+       WRITE_ONCE(ao->risn, tcp_hdr(skb)->seq);
+       ao->rcv_sne = 0;
+-      hlist_for_each_entry_rcu(key, &ao->head, node)
++      hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk))
+               tcp_ao_cache_traffic_keys(sk, ao, key);
+ }
+@@ -1256,14 +1257,14 @@ int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk,
+       key_head = rcu_dereference(hlist_first_rcu(&new_ao->head));
+       first_key = hlist_entry_safe(key_head, struct tcp_ao_key, node);
+-      key = tcp_ao_established_key(new_ao, tcp_rsk(req)->ao_keyid, -1);
++      key = tcp_ao_established_key(req_to_sk(req), new_ao, tcp_rsk(req)->ao_keyid, -1);
+       if (key)
+               new_ao->current_key = key;
+       else
+               new_ao->current_key = first_key;
+       /* set rnext_key */
+-      key = tcp_ao_established_key(new_ao, -1, tcp_rsk(req)->ao_rcv_next);
++      key = tcp_ao_established_key(req_to_sk(req), new_ao, -1, tcp_rsk(req)->ao_rcv_next);
+       if (key)
+               new_ao->rnext_key = key;
+       else
+@@ -1857,12 +1858,12 @@ static int tcp_ao_del_cmd(struct sock *sk, unsigned short int family,
+        * if there's any.
+        */
+       if (cmd.set_current) {
+-              new_current = tcp_ao_established_key(ao_info, cmd.current_key, -1);
++              new_current = tcp_ao_established_key(sk, ao_info, cmd.current_key, -1);
+               if (!new_current)
+                       return -ENOENT;
+       }
+       if (cmd.set_rnext) {
+-              new_rnext = tcp_ao_established_key(ao_info, -1, cmd.rnext);
++              new_rnext = tcp_ao_established_key(sk, ao_info, -1, cmd.rnext);
+               if (!new_rnext)
+                       return -ENOENT;
+       }
+@@ -1902,7 +1903,8 @@ static int tcp_ao_del_cmd(struct sock *sk, unsigned short int family,
+        * "It is presumed that an MKT affecting a particular
+        * connection cannot be destroyed during an active connection"
+        */
+-      hlist_for_each_entry_rcu(key, &ao_info->head, node) {
++      hlist_for_each_entry_rcu(key, &ao_info->head, node,
++                               lockdep_sock_is_held(sk)) {
+               if (cmd.sndid != key->sndid ||
+                   cmd.rcvid != key->rcvid)
+                       continue;
+@@ -2000,14 +2002,14 @@ static int tcp_ao_info_cmd(struct sock *sk, unsigned short int family,
+        * if there's any.
+        */
+       if (cmd.set_current) {
+-              new_current = tcp_ao_established_key(ao_info, cmd.current_key, -1);
++              new_current = tcp_ao_established_key(sk, ao_info, cmd.current_key, -1);
+               if (!new_current) {
+                       err = -ENOENT;
+                       goto out;
+               }
+       }
+       if (cmd.set_rnext) {
+-              new_rnext = tcp_ao_established_key(ao_info, -1, cmd.rnext);
++              new_rnext = tcp_ao_established_key(sk, ao_info, -1, cmd.rnext);
+               if (!new_rnext) {
+                       err = -ENOENT;
+                       goto out;
+@@ -2101,7 +2103,8 @@ int tcp_v4_parse_ao(struct sock *sk, int cmd, sockptr_t optval, int optlen)
+  * The layout of the fields in the user and kernel structures is expected to
+  * be the same (including in the 32bit vs 64bit case).
+  */
+-static int tcp_ao_copy_mkts_to_user(struct tcp_ao_info *ao_info,
++static int tcp_ao_copy_mkts_to_user(const struct sock *sk,
++                                  struct tcp_ao_info *ao_info,
+                                   sockptr_t optval, sockptr_t optlen)
+ {
+       struct tcp_ao_getsockopt opt_in, opt_out;
+@@ -2229,7 +2232,8 @@ static int tcp_ao_copy_mkts_to_user(struct tcp_ao_info *ao_info,
+       /* May change in RX, while we're dumping, pre-fetch it */
+       current_key = READ_ONCE(ao_info->current_key);
+-      hlist_for_each_entry_rcu(key, &ao_info->head, node) {
++      hlist_for_each_entry_rcu(key, &ao_info->head, node,
++                               lockdep_sock_is_held(sk)) {
+               if (opt_in.get_all)
+                       goto match;
+@@ -2309,7 +2313,7 @@ int tcp_ao_get_mkts(struct sock *sk, sockptr_t optval, sockptr_t optlen)
+       if (!ao_info)
+               return -ENOENT;
+-      return tcp_ao_copy_mkts_to_user(ao_info, optval, optlen);
++      return tcp_ao_copy_mkts_to_user(sk, ao_info, optval, optlen);
+ }
+ int tcp_ao_get_sock_info(struct sock *sk, sockptr_t optval, sockptr_t optlen)
+@@ -2396,7 +2400,7 @@ int tcp_ao_set_repair(struct sock *sk, sockptr_t optval, unsigned int optlen)
+       WRITE_ONCE(ao->snd_sne, cmd.snd_sne);
+       WRITE_ONCE(ao->rcv_sne, cmd.rcv_sne);
+-      hlist_for_each_entry_rcu(key, &ao->head, node)
++      hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk))
+               tcp_ao_cache_traffic_keys(sk, ao, key);
+       return 0;
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 5afe5e57c89b5..a7cd433a54c9a 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1053,7 +1053,8 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
+                       }
+                       if (aoh)
+-                              key.ao_key = tcp_ao_established_key(ao_info, aoh->rnext_keyid, -1);
++                              key.ao_key = tcp_ao_established_key(sk, ao_info,
++                                                                  aoh->rnext_keyid, -1);
+               }
+       }
+       if (key.ao_key) {
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index c9de5ef8f2675..59173f58ce992 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1169,8 +1169,8 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
+                       if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh))
+                               goto out;
+                       if (aoh)
+-                              key.ao_key = tcp_ao_established_key(ao_info,
+-                                              aoh->rnext_keyid, -1);
++                              key.ao_key = tcp_ao_established_key(sk, ao_info,
++                                                                  aoh->rnext_keyid, -1);
+               }
+       }
+       if (key.ao_key) {
+-- 
+2.43.0
+
diff --git a/queue-6.12/netlink-specs-add-missing-bitset-attrs-to-ethtool-sp.patch b/queue-6.12/netlink-specs-add-missing-bitset-attrs-to-ethtool-sp.patch
new file mode 100644 (file)
index 0000000..aebcac7
--- /dev/null
@@ -0,0 +1,45 @@
+From 7ba37d40c4e904b9554d92a50ae15bd62bfab060 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 10:06:30 +0100
+Subject: netlink: specs: Add missing bitset attrs to ethtool spec
+
+From: Donald Hunter <donald.hunter@gmail.com>
+
+[ Upstream commit b0b3683419b45e2971b6d413c506cb818b268d35 ]
+
+There are a couple of attributes missing from the 'bitset' attribute-set
+in the ethtool netlink spec. Add them to the spec.
+
+Reported-by: Kory Maincent <kory.maincent@bootlin.com>
+Closes: https://lore.kernel.org/netdev/20241017180551.1259bf5c@kmaincent-XPS-13-7390/
+Signed-off-by: Donald Hunter <donald.hunter@gmail.com>
+Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
+Tested-by: Kory Maincent <kory.maincent@bootlin.com>
+Link: https://patch.msgid.link/20241018090630.22212-1-donald.hunter@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/netlink/specs/ethtool.yaml | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/netlink/specs/ethtool.yaml b/Documentation/netlink/specs/ethtool.yaml
+index 6a050d755b9cb..f6c5d8214c7e9 100644
+--- a/Documentation/netlink/specs/ethtool.yaml
++++ b/Documentation/netlink/specs/ethtool.yaml
+@@ -96,7 +96,12 @@ attribute-sets:
+         name: bits
+         type: nest
+         nested-attributes: bitset-bits
+-
++      -
++        name: value
++        type: binary
++      -
++        name: mask
++        type: binary
+   -
+     name: string
+     attributes:
+-- 
+2.43.0
+
diff --git a/queue-6.12/netpoll-use-rcu_access_pointer-in-__netpoll_setup.patch b/queue-6.12/netpoll-use-rcu_access_pointer-in-__netpoll_setup.patch
new file mode 100644 (file)
index 0000000..7d4254b
--- /dev/null
@@ -0,0 +1,44 @@
+From 57e9770c3178c2f1743e648a1763cf2527074dd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 03:15:17 -0800
+Subject: netpoll: Use rcu_access_pointer() in __netpoll_setup
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit c69c5e10adb903ae2438d4f9c16eccf43d1fcbc1 ]
+
+The ndev->npinfo pointer in __netpoll_setup() is RCU-protected but is being
+accessed directly for a NULL check. While no RCU read lock is held in this
+context, we should still use proper RCU primitives for consistency and
+correctness.
+
+Replace the direct NULL check with rcu_access_pointer(), which is the
+appropriate primitive when only checking for NULL without dereferencing
+the pointer. This function provides the necessary ordering guarantees
+without requiring RCU read-side protection.
+
+Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Link: https://patch.msgid.link/20241118-netpoll_rcu-v1-1-a1888dcb4a02@debian.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/netpoll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index aa49b92e9194b..45fb60bc48039 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -626,7 +626,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
+               goto out;
+       }
+-      if (!ndev->npinfo) {
++      if (!rcu_access_pointer(ndev->npinfo)) {
+               npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL);
+               if (!npinfo) {
+                       err = -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.12/nvdimm-rectify-the-illogical-code-within-nd_dax_prob.patch b/queue-6.12/nvdimm-rectify-the-illogical-code-within-nd_dax_prob.patch
new file mode 100644 (file)
index 0000000..fb241db
--- /dev/null
@@ -0,0 +1,65 @@
+From 24b455d06b36de186159713cd789b69b7ef4bd2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2024 08:55:26 +0000
+Subject: nvdimm: rectify the illogical code within nd_dax_probe()
+
+From: Yi Yang <yiyang13@huawei.com>
+
+[ Upstream commit b61352101470f8b68c98af674e187cfaa7c43504 ]
+
+When nd_dax is NULL, nd_pfn is consequently NULL as well. Nevertheless,
+it is inadvisable to perform pointer arithmetic or address-taking on a
+NULL pointer.
+Introduce the nd_dax_devinit() function to enhance the code's logic and
+improve its readability.
+
+Signed-off-by: Yi Yang <yiyang13@huawei.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://patch.msgid.link/20241108085526.527957-1-yiyang13@huawei.com
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/dax_devs.c | 4 ++--
+ drivers/nvdimm/nd.h       | 7 +++++++
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
+index 6b4922de30477..37b743acbb7ba 100644
+--- a/drivers/nvdimm/dax_devs.c
++++ b/drivers/nvdimm/dax_devs.c
+@@ -106,12 +106,12 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
+       nvdimm_bus_lock(&ndns->dev);
+       nd_dax = nd_dax_alloc(nd_region);
+-      nd_pfn = &nd_dax->nd_pfn;
+-      dax_dev = nd_pfn_devinit(nd_pfn, ndns);
++      dax_dev = nd_dax_devinit(nd_dax, ndns);
+       nvdimm_bus_unlock(&ndns->dev);
+       if (!dax_dev)
+               return -ENOMEM;
+       pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
++      nd_pfn = &nd_dax->nd_pfn;
+       nd_pfn->pfn_sb = pfn_sb;
+       rc = nd_pfn_validate(nd_pfn, DAX_SIG);
+       dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : "<none>");
+diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
+index 2dbb1dca17b53..5ca06e9a2d292 100644
+--- a/drivers/nvdimm/nd.h
++++ b/drivers/nvdimm/nd.h
+@@ -600,6 +600,13 @@ struct nd_dax *to_nd_dax(struct device *dev);
+ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns);
+ bool is_nd_dax(const struct device *dev);
+ struct device *nd_dax_create(struct nd_region *nd_region);
++static inline struct device *nd_dax_devinit(struct nd_dax *nd_dax,
++                                          struct nd_namespace_common *ndns)
++{
++      if (!nd_dax)
++              return NULL;
++      return nd_pfn_devinit(&nd_dax->nd_pfn, ndns);
++}
+ #else
+ static inline int nd_dax_probe(struct device *dev,
+               struct nd_namespace_common *ndns)
+-- 
+2.43.0
+
diff --git a/queue-6.12/pci-add-acs-quirk-for-wangxun-ff5xxx-nics.patch b/queue-6.12/pci-add-acs-quirk-for-wangxun-ff5xxx-nics.patch
new file mode 100644 (file)
index 0000000..053b345
--- /dev/null
@@ -0,0 +1,63 @@
+From c25b033e3e2c74b47c6cf4fa3d4892784098aa88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2024 10:46:04 +0800
+Subject: PCI: Add ACS quirk for Wangxun FF5xxx NICs
+
+From: Mengyuan Lou <mengyuanlou@net-swift.com>
+
+[ Upstream commit aa46a3736afcb7b0793766d22479b8b99fc1b322 ]
+
+Wangxun FF5xxx NICs are similar to SFxxx, RP1000 and RP2000 NICs.  They may
+be multi-function devices, but they do not advertise an ACS capability.
+
+But the hardware does isolate FF5xxx functions as though it had an ACS
+capability and PCI_ACS_RR and PCI_ACS_CR were set in the ACS Control
+register, i.e., all peer-to-peer traffic is directed upstream instead of
+being routed internally.
+
+Add ACS quirk for FF5xxx NICs in pci_quirk_wangxun_nic_acs() so the
+functions can be in independent IOMMU groups.
+
+Link: https://lore.kernel.org/r/E16053DB2B80E9A5+20241115024604.30493-1-mengyuanlou@net-swift.com
+Signed-off-by: Mengyuan Lou <mengyuanlou@net-swift.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index dccb60c1d9cc3..8103bc24a54ea 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4996,18 +4996,21 @@ static int pci_quirk_brcm_acs(struct pci_dev *dev, u16 acs_flags)
+ }
+ /*
+- * Wangxun 10G/1G NICs have no ACS capability, and on multi-function
+- * devices, peer-to-peer transactions are not be used between the functions.
+- * So add an ACS quirk for below devices to isolate functions.
++ * Wangxun 40G/25G/10G/1G NICs have no ACS capability, but on
++ * multi-function devices, the hardware isolates the functions by
++ * directing all peer-to-peer traffic upstream as though PCI_ACS_RR and
++ * PCI_ACS_CR were set.
+  * SFxxx 1G NICs(em).
+  * RP1000/RP2000 10G NICs(sp).
++ * FF5xxx 40G/25G/10G NICs(aml).
+  */
+ static int  pci_quirk_wangxun_nic_acs(struct pci_dev *dev, u16 acs_flags)
+ {
+       switch (dev->device) {
+-      case 0x0100 ... 0x010F:
+-      case 0x1001:
+-      case 0x2001:
++      case 0x0100 ... 0x010F: /* EM */
++      case 0x1001: case 0x2001: /* SP */
++      case 0x5010: case 0x5025: case 0x5040: /* AML */
++      case 0x5110: case 0x5125: case 0x5140: /* AML */
+               return pci_acs_ctrl_enabled(acs_flags,
+                       PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/pci-add-reset_subordinate-to-reset-hierarchy-below-b.patch b/queue-6.12/pci-add-reset_subordinate-to-reset-hierarchy-below-b.patch
new file mode 100644 (file)
index 0000000..7d43d51
--- /dev/null
@@ -0,0 +1,130 @@
+From 83364e8e4d24d2dc58975f2073bc66d3b3bf4df2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 15:27:54 -0700
+Subject: PCI: Add 'reset_subordinate' to reset hierarchy below bridge
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 2fa046449a82a7d0f6d9721dd83e348816038444 ]
+
+The "bus" and "cxl_bus" reset methods reset a device by asserting Secondary
+Bus Reset on the bridge leading to the device.  These only work if the
+device is the only device below the bridge.
+
+Add a sysfs 'reset_subordinate' attribute on bridges that can assert
+Secondary Bus Reset regardless of how many devices are below the bridge.
+
+This resets all the devices below a bridge in a single command, including
+the locking and config space save/restore that reset methods normally do.
+
+This may be the only way to reset devices that don't support other reset
+methods (ACPI, FLR, PM reset, etc).
+
+Link: https://lore.kernel.org/r/20241025222755.3756162-1-kbusch@meta.com
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+[bhelgaas: commit log, add capable(CAP_SYS_ADMIN) check]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
+Reviewed-by: Amey Narkhede <ameynarkhede03@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-bus-pci | 11 +++++++++++
+ drivers/pci/pci-sysfs.c                 | 26 +++++++++++++++++++++++++
+ drivers/pci/pci.c                       |  2 +-
+ drivers/pci/pci.h                       |  1 +
+ 4 files changed, 39 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-bus-pci b/Documentation/ABI/testing/sysfs-bus-pci
+index 7f63c7e977735..5da6a14dc326b 100644
+--- a/Documentation/ABI/testing/sysfs-bus-pci
++++ b/Documentation/ABI/testing/sysfs-bus-pci
+@@ -163,6 +163,17 @@ Description:
+               will be present in sysfs.  Writing 1 to this file
+               will perform reset.
++What:         /sys/bus/pci/devices/.../reset_subordinate
++Date:         October 2024
++Contact:      linux-pci@vger.kernel.org
++Description:
++              This is visible only for bridge devices. If you want to reset
++              all devices attached through the subordinate bus of a specific
++              bridge device, writing 1 to this will try to do it.  This will
++              affect all devices attached to the system through this bridge
++              similiar to writing 1 to their individual "reset" file, so use
++              with caution.
++
+ What:         /sys/bus/pci/devices/.../vpd
+ Date:         February 2008
+ Contact:      Ben Hutchings <bwh@kernel.org>
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 5d0f4db1cab78..3e5a117f5b5d6 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -521,6 +521,31 @@ static ssize_t bus_rescan_store(struct device *dev,
+ static struct device_attribute dev_attr_bus_rescan = __ATTR(rescan, 0200, NULL,
+                                                           bus_rescan_store);
++static ssize_t reset_subordinate_store(struct device *dev,
++                              struct device_attribute *attr,
++                              const char *buf, size_t count)
++{
++      struct pci_dev *pdev = to_pci_dev(dev);
++      struct pci_bus *bus = pdev->subordinate;
++      unsigned long val;
++
++      if (!capable(CAP_SYS_ADMIN))
++              return -EPERM;
++
++      if (kstrtoul(buf, 0, &val) < 0)
++              return -EINVAL;
++
++      if (val) {
++              int ret = __pci_reset_bus(bus);
++
++              if (ret)
++                      return ret;
++      }
++
++      return count;
++}
++static DEVICE_ATTR_WO(reset_subordinate);
++
+ #if defined(CONFIG_PM) && defined(CONFIG_ACPI)
+ static ssize_t d3cold_allowed_store(struct device *dev,
+                                   struct device_attribute *attr,
+@@ -625,6 +650,7 @@ static struct attribute *pci_dev_attrs[] = {
+ static struct attribute *pci_bridge_attrs[] = {
+       &dev_attr_subordinate_bus_number.attr,
+       &dev_attr_secondary_bus_number.attr,
++      &dev_attr_reset_subordinate.attr,
+       NULL,
+ };
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 08f170fd3efb3..dd3c6dcb47ae4 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5885,7 +5885,7 @@ EXPORT_SYMBOL_GPL(pci_probe_reset_bus);
+  *
+  * Same as above except return -EAGAIN if the bus cannot be locked
+  */
+-static int __pci_reset_bus(struct pci_bus *bus)
++int __pci_reset_bus(struct pci_bus *bus)
+ {
+       int rc;
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 14d00ce45bfa9..1cdc2c9547a7e 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -104,6 +104,7 @@ bool pci_reset_supported(struct pci_dev *dev);
+ void pci_init_reset_methods(struct pci_dev *dev);
+ int pci_bridge_secondary_bus_reset(struct pci_dev *dev);
+ int pci_bus_error_reset(struct pci_dev *dev);
++int __pci_reset_bus(struct pci_bus *bus);
+ struct pci_cap_saved_data {
+       u16             cap_nr;
+-- 
+2.43.0
+
diff --git a/queue-6.12/pci-detect-and-trust-built-in-thunderbolt-chips.patch b/queue-6.12/pci-detect-and-trust-built-in-thunderbolt-chips.patch
new file mode 100644 (file)
index 0000000..0a1e7da
--- /dev/null
@@ -0,0 +1,276 @@
+From 440ecdb12c324f395b020110ddb1e69bf836d13c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 17:57:45 +0000
+Subject: PCI: Detect and trust built-in Thunderbolt chips
+
+From: Esther Shimanovich <eshimanovich@chromium.org>
+
+[ Upstream commit 3b96b895127b7c0aed63d82c974b46340e8466c1 ]
+
+Some computers with CPUs that lack Thunderbolt features use discrete
+Thunderbolt chips to add Thunderbolt functionality. These Thunderbolt
+chips are located within the chassis; between the Root Port labeled
+ExternalFacingPort and the USB-C port.
+
+These Thunderbolt PCIe devices should be labeled as fixed and trusted, as
+they are built into the computer. Otherwise, security policies that rely on
+those flags may have unintended results, such as preventing USB-C ports
+from enumerating.
+
+Detect the above scenario through the process of elimination.
+
+  1) Integrated Thunderbolt host controllers already have Thunderbolt
+     implemented, so anything outside their external facing Root Port is
+     removable and untrusted.
+
+     Detect them using the following properties:
+
+       - Most integrated host controllers have the "usb4-host-interface"
+         ACPI property, as described here:
+
+         https://learn.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports#mapping-native-protocols-pcie-displayport-tunneled-through-usb4-to-usb4-host-routers
+
+       - Integrated Thunderbolt PCIe Root Ports before Alder Lake do not
+         have the "usb4-host-interface" ACPI property. Identify those by
+         their PCI IDs instead.
+
+  2) If a Root Port does not have integrated Thunderbolt capabilities, but
+     has the "ExternalFacingPort" ACPI property, that means the
+     manufacturer has opted to use a discrete Thunderbolt host controller
+     that is built into the computer.
+
+     This host controller can be identified by virtue of being located
+     directly below an external-facing Root Port that lacks integrated
+     Thunderbolt. Label it as trusted and fixed.
+
+     Everything downstream from it is untrusted and removable.
+
+The "ExternalFacingPort" ACPI property is described here:
+https://learn.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports#identifying-externally-exposed-pcie-root-ports
+
+Link: https://lore.kernel.org/r/20240910-trust-tbt-fix-v5-1-7a7a42a5f496@chromium.org
+Suggested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Esther Shimanovich <eshimanovich@chromium.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Tested-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/pci/acpi.c | 119 ++++++++++++++++++++++++++++++++++++++++++++
+ drivers/pci/probe.c |  30 ++++++++---
+ include/linux/pci.h |   6 +++
+ 3 files changed, 148 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
+index 55c4b07ec1f63..0c316bae1726e 100644
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -250,6 +250,125 @@ void __init pci_acpi_crs_quirks(void)
+               pr_info("Please notify linux-pci@vger.kernel.org so future kernels can do this automatically\n");
+ }
++/*
++ * Check if pdev is part of a PCIe switch that is directly below the
++ * specified bridge.
++ */
++static bool pcie_switch_directly_under(struct pci_dev *bridge,
++                                     struct pci_dev *pdev)
++{
++      struct pci_dev *parent = pci_upstream_bridge(pdev);
++
++      /* If the device doesn't have a parent, it's not under anything */
++      if (!parent)
++              return false;
++
++      /*
++       * If the device has a PCIe type, check if it is below the
++       * corresponding PCIe switch components (if applicable). Then check
++       * if its upstream port is directly beneath the specified bridge.
++       */
++      switch (pci_pcie_type(pdev)) {
++      case PCI_EXP_TYPE_UPSTREAM:
++              return parent == bridge;
++
++      case PCI_EXP_TYPE_DOWNSTREAM:
++              if (pci_pcie_type(parent) != PCI_EXP_TYPE_UPSTREAM)
++                      return false;
++              parent = pci_upstream_bridge(parent);
++              return parent == bridge;
++
++      case PCI_EXP_TYPE_ENDPOINT:
++              if (pci_pcie_type(parent) != PCI_EXP_TYPE_DOWNSTREAM)
++                      return false;
++              parent = pci_upstream_bridge(parent);
++              if (!parent || pci_pcie_type(parent) != PCI_EXP_TYPE_UPSTREAM)
++                      return false;
++              parent = pci_upstream_bridge(parent);
++              return parent == bridge;
++      }
++
++      return false;
++}
++
++static bool pcie_has_usb4_host_interface(struct pci_dev *pdev)
++{
++      struct fwnode_handle *fwnode;
++
++      /*
++       * For USB4, the tunneled PCIe Root or Downstream Ports are marked
++       * with the "usb4-host-interface" ACPI property, so we look for
++       * that first. This should cover most cases.
++       */
++      fwnode = fwnode_find_reference(dev_fwnode(&pdev->dev),
++                                     "usb4-host-interface", 0);
++      if (!IS_ERR(fwnode)) {
++              fwnode_handle_put(fwnode);
++              return true;
++      }
++
++      /*
++       * Any integrated Thunderbolt 3/4 PCIe Root Ports from Intel
++       * before Alder Lake do not have the "usb4-host-interface"
++       * property so we use their PCI IDs instead. All these are
++       * tunneled. This list is not expected to grow.
++       */
++      if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
++              switch (pdev->device) {
++              /* Ice Lake Thunderbolt 3 PCIe Root Ports */
++              case 0x8a1d:
++              case 0x8a1f:
++              case 0x8a21:
++              case 0x8a23:
++              /* Tiger Lake-LP Thunderbolt 4 PCIe Root Ports */
++              case 0x9a23:
++              case 0x9a25:
++              case 0x9a27:
++              case 0x9a29:
++              /* Tiger Lake-H Thunderbolt 4 PCIe Root Ports */
++              case 0x9a2b:
++              case 0x9a2d:
++              case 0x9a2f:
++              case 0x9a31:
++                      return true;
++              }
++      }
++
++      return false;
++}
++
++bool arch_pci_dev_is_removable(struct pci_dev *pdev)
++{
++      struct pci_dev *parent, *root;
++
++      /* pdev without a parent or Root Port is never tunneled */
++      parent = pci_upstream_bridge(pdev);
++      if (!parent)
++              return false;
++      root = pcie_find_root_port(pdev);
++      if (!root)
++              return false;
++
++      /* Internal PCIe devices are not tunneled */
++      if (!root->external_facing)
++              return false;
++
++      /* Anything directly behind a "usb4-host-interface" is tunneled */
++      if (pcie_has_usb4_host_interface(parent))
++              return true;
++
++      /*
++       * Check if this is a discrete Thunderbolt/USB4 controller that is
++       * directly behind the non-USB4 PCIe Root Port marked as
++       * "ExternalFacingPort". Those are not behind a PCIe tunnel.
++       */
++      if (pcie_switch_directly_under(root, pdev))
++              return false;
++
++      /* PCIe devices after the discrete chip are tunneled */
++      return true;
++}
++
+ #ifdef        CONFIG_PCI_MMCONFIG
+ static int check_segment(u16 seg, struct device *dev, char *estr)
+ {
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index f1615805f5b07..ebb0c1d5cae25 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1633,23 +1633,33 @@ static void set_pcie_thunderbolt(struct pci_dev *dev)
+ static void set_pcie_untrusted(struct pci_dev *dev)
+ {
+-      struct pci_dev *parent;
++      struct pci_dev *parent = pci_upstream_bridge(dev);
++      if (!parent)
++              return;
+       /*
+-       * If the upstream bridge is untrusted we treat this device
++       * If the upstream bridge is untrusted we treat this device as
+        * untrusted as well.
+        */
+-      parent = pci_upstream_bridge(dev);
+-      if (parent && (parent->untrusted || parent->external_facing))
++      if (parent->untrusted) {
++              dev->untrusted = true;
++              return;
++      }
++
++      if (arch_pci_dev_is_removable(dev)) {
++              pci_dbg(dev, "marking as untrusted\n");
+               dev->untrusted = true;
++      }
+ }
+ static void pci_set_removable(struct pci_dev *dev)
+ {
+       struct pci_dev *parent = pci_upstream_bridge(dev);
++      if (!parent)
++              return;
+       /*
+-       * We (only) consider everything downstream from an external_facing
++       * We (only) consider everything tunneled below an external_facing
+        * device to be removable by the user. We're mainly concerned with
+        * consumer platforms with user accessible thunderbolt ports that are
+        * vulnerable to DMA attacks, and we expect those ports to be marked by
+@@ -1659,9 +1669,15 @@ static void pci_set_removable(struct pci_dev *dev)
+        * accessible to user / may not be removed by end user, and thus not
+        * exposed as "removable" to userspace.
+        */
+-      if (parent &&
+-          (parent->external_facing || dev_is_removable(&parent->dev)))
++      if (dev_is_removable(&parent->dev)) {
++              dev_set_removable(&dev->dev, DEVICE_REMOVABLE);
++              return;
++      }
++
++      if (arch_pci_dev_is_removable(dev)) {
++              pci_dbg(dev, "marking as removable\n");
+               dev_set_removable(&dev->dev, DEVICE_REMOVABLE);
++      }
+ }
+ /**
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 573b4c4c2be61..4e77c4230c0a1 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2609,6 +2609,12 @@ pci_host_bridge_acpi_msi_domain(struct pci_bus *bus) { return NULL; }
+ static inline bool pci_pr3_present(struct pci_dev *pdev) { return false; }
+ #endif
++#if defined(CONFIG_X86) && defined(CONFIG_ACPI)
++bool arch_pci_dev_is_removable(struct pci_dev *pdev);
++#else
++static inline bool arch_pci_dev_is_removable(struct pci_dev *pdev) { return false; }
++#endif
++
+ #ifdef CONFIG_EEH
+ static inline struct eeh_dev *pci_dev_to_eeh_dev(struct pci_dev *pdev)
+ {
+-- 
+2.43.0
+
diff --git a/queue-6.12/pci-qcom-add-support-for-ipq9574.patch b/queue-6.12/pci-qcom-add-support-for-ipq9574.patch
new file mode 100644 (file)
index 0000000..b00f209
--- /dev/null
@@ -0,0 +1,48 @@
+From 5f1cb1f99e60311fc60c4d7480e4f3f3e402e48b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2024 11:18:03 +0530
+Subject: PCI: qcom: Add support for IPQ9574
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: devi priya <quic_devipriy@quicinc.com>
+
+[ Upstream commit a63b74f2e35be3829f256922037ae5cee6bb844a ]
+
+Add the new IPQ9574 platform which is based on the Qcom IP rev. 1.27.0
+and Synopsys IP rev. 5.80a.
+
+The platform itself has four PCIe Gen3 controllers: two single-lane and
+two dual-lane, all are based on Synopsys IP rev. 5.70a. As such, reuse
+all the members of 'ops_2_9_0'.
+
+Link: https://lore.kernel.org/r/20240801054803.3015572-5-quic_srichara@quicinc.com
+Co-developed-by: Anusha Rao <quic_anusha@quicinc.com>
+Signed-off-by: Anusha Rao <quic_anusha@quicinc.com>
+Signed-off-by: devi priya <quic_devipriy@quicinc.com>
+Signed-off-by: Sricharan Ramabadhran <quic_srichara@quicinc.com>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof WilczyÅ„ski <kwilczynski@kernel.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index b5447228696dc..6483e1874477e 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1830,6 +1830,7 @@ static const struct of_device_id qcom_pcie_match[] = {
+       { .compatible = "qcom,pcie-ipq8064-v2", .data = &cfg_2_1_0 },
+       { .compatible = "qcom,pcie-ipq8074", .data = &cfg_2_3_3 },
+       { .compatible = "qcom,pcie-ipq8074-gen3", .data = &cfg_2_9_0 },
++      { .compatible = "qcom,pcie-ipq9574", .data = &cfg_2_9_0 },
+       { .compatible = "qcom,pcie-msm8996", .data = &cfg_2_3_2 },
+       { .compatible = "qcom,pcie-qcs404", .data = &cfg_2_4_0 },
+       { .compatible = "qcom,pcie-sa8540p", .data = &cfg_sc8280xp },
+-- 
+2.43.0
+
diff --git a/queue-6.12/pci-starfive-enable-controller-runtime-pm-before-pro.patch b/queue-6.12/pci-starfive-enable-controller-runtime-pm-before-pro.patch
new file mode 100644 (file)
index 0000000..d0d496d
--- /dev/null
@@ -0,0 +1,64 @@
+From 7c05400d7dc695c4cdadaf905721508180506c89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2024 14:11:52 +0530
+Subject: PCI: starfive: Enable controller runtime PM before probing host
+ bridge
+
+From: Mayank Rana <quic_mrana@quicinc.com>
+
+[ Upstream commit 6168efbebace0db443185d4c6701ca8170a8788d ]
+
+A PCI controller device, e.g., StarFive, is parent to PCI host bridge
+device. We must enable runtime PM of the controller before enabling runtime
+PM of the host bridge, which will happen in pci_host_probe(), to avoid this
+warning:
+
+  pcie-starfive 940000000.pcie: Enabling runtime PM for inactive device with active children
+
+Fix this issue by enabling StarFive controller device's runtime PM before
+calling pci_host_probe() in plda_pcie_host_init().
+
+Link: https://lore.kernel.org/r/20241111-runtime_pm-v7-1-9c164eefcd87@quicinc.com
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Mayank Rana <quic_mrana@quicinc.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/plda/pcie-starfive.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/plda/pcie-starfive.c b/drivers/pci/controller/plda/pcie-starfive.c
+index c9933ecf68338..0564fdce47c2a 100644
+--- a/drivers/pci/controller/plda/pcie-starfive.c
++++ b/drivers/pci/controller/plda/pcie-starfive.c
+@@ -404,6 +404,9 @@ static int starfive_pcie_probe(struct platform_device *pdev)
+       if (ret)
+               return ret;
++      pm_runtime_enable(&pdev->dev);
++      pm_runtime_get_sync(&pdev->dev);
++
+       plda->host_ops = &sf_host_ops;
+       plda->num_events = PLDA_MAX_EVENT_NUM;
+       /* mask doorbell event */
+@@ -413,11 +416,12 @@ static int starfive_pcie_probe(struct platform_device *pdev)
+       plda->events_bitmap <<= PLDA_NUM_DMA_EVENTS;
+       ret = plda_pcie_host_init(&pcie->plda, &starfive_pcie_ops,
+                                 &stf_pcie_event);
+-      if (ret)
++      if (ret) {
++              pm_runtime_put_sync(&pdev->dev);
++              pm_runtime_disable(&pdev->dev);
+               return ret;
++      }
+-      pm_runtime_enable(&pdev->dev);
+-      pm_runtime_get_sync(&pdev->dev);
+       platform_set_drvdata(pdev, pcie);
+       return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.12/pci-vmd-add-did-8086-b06f-and-8086-b60b-for-intel-cl.patch b/queue-6.12/pci-vmd-add-did-8086-b06f-and-8086-b60b-for-intel-cl.patch
new file mode 100644 (file)
index 0000000..81c18f0
--- /dev/null
@@ -0,0 +1,42 @@
+From d1ba6fc77a4df60300ee036c1b8b1ac9a4f51330 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2024 10:56:57 -0700
+Subject: PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nirmal Patel <nirmal.patel@linux.ntel.com>
+
+[ Upstream commit b727484cace4be22be9321cc0bc9487648ba447b ]
+
+Add support for this VMD device which supports the bus restriction mode.
+The feature that turns off vector 0 for MSI-X remapping is also enabled.
+
+Link: https://lore.kernel.org/r/20241011175657.249948-1-nirmal.patel@linux.intel.com
+Signed-off-by: Nirmal Patel <nirmal.patel@linux.ntel.com>
+Signed-off-by: Krzysztof WilczyÅ„ski <kwilczynski@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/vmd.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index 264a180403a0e..8a036d6b7d497 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -1100,6 +1100,10 @@ static const struct pci_device_id vmd_ids[] = {
+               .driver_data = VMD_FEATS_CLIENT,},
+       {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_VMD_9A0B),
+               .driver_data = VMD_FEATS_CLIENT,},
++      {PCI_VDEVICE(INTEL, 0xb60b),
++                .driver_data = VMD_FEATS_CLIENT,},
++      {PCI_VDEVICE(INTEL, 0xb06f),
++                .driver_data = VMD_FEATS_CLIENT,},
+       {0,}
+ };
+ MODULE_DEVICE_TABLE(pci, vmd_ids);
+-- 
+2.43.0
+
diff --git a/queue-6.12/pci-vmd-set-devices-to-d0-before-enabling-pm-l1-subs.patch b/queue-6.12/pci-vmd-set-devices-to-d0-before-enabling-pm-l1-subs.patch
new file mode 100644 (file)
index 0000000..616ed36
--- /dev/null
@@ -0,0 +1,81 @@
+From 1953a78f6f4706e5495e7506ba885e8636fb89f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 16:34:38 +0800
+Subject: PCI: vmd: Set devices to D0 before enabling PM L1 Substates
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jian-Hong Pan <jhp@endlessos.org>
+
+[ Upstream commit d66041063192497a4a97d21dbf86b79a03a7f4fb ]
+
+The remapped PCIe Root Port and the child device have PM L1 Substates
+capability, but they are disabled originally.
+
+Here is a failed example on ASUS B1400CEAE:
+
+  Capabilities: [900 v1] L1 PM Substates
+        L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1- ASPM_L1.2+ ASPM_L1.1- L1_PM_Substates+
+                  PortCommonModeRestoreTime=32us PortTPowerOnTime=10us
+        L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2+ ASPM_L1.1-
+                   T_CommonMode=0us LTR1.2_Threshold=101376ns
+        L1SubCtl2: T_PwrOn=50us
+
+Enable PCI-PM L1 PM Substates for devices below VMD while they are in D0
+(see PCIe r6.0, sec 5.5.4).
+
+Link: https://lore.kernel.org/r/20241001083438.10070-4-jhp@endlessos.org
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218394
+Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
+Signed-off-by: Krzysztof WilczyÅ„ski <kwilczynski@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/vmd.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index 8a036d6b7d497..9d9596947350f 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -740,11 +740,9 @@ static int vmd_pm_enable_quirk(struct pci_dev *pdev, void *userdata)
+       if (!(features & VMD_FEAT_BIOS_PM_QUIRK))
+               return 0;
+-      pci_enable_link_state_locked(pdev, PCIE_LINK_STATE_ALL);
+-
+       pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_LTR);
+       if (!pos)
+-              return 0;
++              goto out_state_change;
+       /*
+        * Skip if the max snoop LTR is non-zero, indicating BIOS has set it
+@@ -752,7 +750,7 @@ static int vmd_pm_enable_quirk(struct pci_dev *pdev, void *userdata)
+        */
+       pci_read_config_dword(pdev, pos + PCI_LTR_MAX_SNOOP_LAT, &ltr_reg);
+       if (!!(ltr_reg & (PCI_LTR_VALUE_MASK | PCI_LTR_SCALE_MASK)))
+-              return 0;
++              goto out_state_change;
+       /*
+        * Set the default values to the maximum required by the platform to
+@@ -764,6 +762,13 @@ static int vmd_pm_enable_quirk(struct pci_dev *pdev, void *userdata)
+       pci_write_config_dword(pdev, pos + PCI_LTR_MAX_SNOOP_LAT, ltr_reg);
+       pci_info(pdev, "VMD: Default LTR value set by driver\n");
++out_state_change:
++      /*
++       * Ensure devices are in D0 before enabling PCI-PM L1 PM Substates, per
++       * PCIe r6.0, sec 5.5.4.
++       */
++      pci_set_power_state_locked(pdev, PCI_D0);
++      pci_enable_link_state_locked(pdev, PCIE_LINK_STATE_ALL);
+       return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/perf-x86-amd-warn-only-on-new-bits-set.patch b/queue-6.12/perf-x86-amd-warn-only-on-new-bits-set.patch
new file mode 100644 (file)
index 0000000..2b6ea27
--- /dev/null
@@ -0,0 +1,70 @@
+From 32147505c76fcd974a57ef42b7acd720bd2f88bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 07:10:19 -0700
+Subject: perf/x86/amd: Warn only on new bits set
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit de20037e1b3c2f2ca97b8c12b8c7bca8abd509a7 ]
+
+Warning at every leaking bits can cause a flood of message, triggering
+various stall-warning mechanisms to fire, including CSD locks, which
+makes the machine to be unusable.
+
+Track the bits that are being leaked, and only warn when a new bit is
+set.
+
+That said, this patch will help with the following issues:
+
+1) It will tell us which bits are being set, so, it is easy to
+   communicate it back to vendor, and to do a root-cause analyzes.
+
+2) It avoid the machine to be unusable, because, worst case
+   scenario, the user gets less than 60 WARNs (one per unhandled bit).
+
+Suggested-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Sandipan Das <sandipan.das@amd.com>
+Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
+Link: https://lkml.kernel.org/r/20241001141020.2620361-1-leitao@debian.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/amd/core.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index 920e3a640cadd..b4a1a2576510e 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -943,11 +943,12 @@ static int amd_pmu_v2_snapshot_branch_stack(struct perf_branch_entry *entries, u
+ static int amd_pmu_v2_handle_irq(struct pt_regs *regs)
+ {
+       struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
++      static atomic64_t status_warned = ATOMIC64_INIT(0);
++      u64 reserved, status, mask, new_bits, prev_bits;
+       struct perf_sample_data data;
+       struct hw_perf_event *hwc;
+       struct perf_event *event;
+       int handled = 0, idx;
+-      u64 reserved, status, mask;
+       bool pmu_enabled;
+       /*
+@@ -1012,7 +1013,12 @@ static int amd_pmu_v2_handle_irq(struct pt_regs *regs)
+        * the corresponding PMCs are expected to be inactive according to the
+        * active_mask
+        */
+-      WARN_ON(status > 0);
++      if (status > 0) {
++              prev_bits = atomic64_fetch_or(status, &status_warned);
++              // A new bit was set for the very first time.
++              new_bits = status & ~prev_bits;
++              WARN(new_bits, "New overflows for inactive PMCs: %llx\n", new_bits);
++      }
+       /* Clear overflow and freeze bits */
+       amd_pmu_ack_global_status(~status);
+-- 
+2.43.0
+
diff --git a/queue-6.12/pinctrl-freescale-fix-compile_test-error-with-pinctr.patch b/queue-6.12/pinctrl-freescale-fix-compile_test-error-with-pinctr.patch
new file mode 100644 (file)
index 0000000..f82571e
--- /dev/null
@@ -0,0 +1,40 @@
+From 0049f3ae2c5c8e32e75b9358730a86a54eccfd43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 11:23:09 +0200
+Subject: pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
+
+From: Esben Haabendal <esben@geanix.com>
+
+[ Upstream commit 58414a31c5713afb5449fd74a26a843d34cc62e8 ]
+
+When PINCTRL_IMX_SCU was selected by PINCTRL_IMX8DXL or PINCTRL_IMX8QM
+combined with COMPILE_TEST on a non-arm platforms, the IMX_SCU
+dependency could not be enabled.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202410031439.GyTSa0kX-lkp@intel.com/
+Closes: https://lore.kernel.org/oe-kbuild-all/202410030852.q0Hukplf-lkp@intel.com/
+Signed-off-by: Esben Haabendal <esben@geanix.com>
+Link: https://lore.kernel.org/20241003-imx-pinctrl-compile-test-fix-v1-1-145ca1948cc3@geanix.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/freescale/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/freescale/Kconfig b/drivers/pinctrl/freescale/Kconfig
+index 3b59d71890045..139bc0fb8a9db 100644
+--- a/drivers/pinctrl/freescale/Kconfig
++++ b/drivers/pinctrl/freescale/Kconfig
+@@ -20,7 +20,7 @@ config PINCTRL_IMX_SCMI
+ config PINCTRL_IMX_SCU
+       tristate
+-      depends on IMX_SCU
++      depends on IMX_SCU || COMPILE_TEST
+       select PINCTRL_IMX
+ config PINCTRL_IMX1_CORE
+-- 
+2.43.0
+
diff --git a/queue-6.12/pinctrl-qcom-pmic-gpio-add-support-for-pm8937.patch b/queue-6.12/pinctrl-qcom-pmic-gpio-add-support-for-pm8937.patch
new file mode 100644 (file)
index 0000000..cbfe467
--- /dev/null
@@ -0,0 +1,39 @@
+From 2f26414b58d40c6c5c8349f93f3186281d5c85a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 02:19:43 +0100
+Subject: pinctrl: qcom-pmic-gpio: add support for PM8937
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Czémán <barnabas.czeman@mainlining.org>
+
+[ Upstream commit 89265a58ff24e3885c2c9ca722bc3aaa47018be9 ]
+
+PM8937 has 8 GPIO-s with holes on GPIO3, GPIO4 and GPIO6.
+
+Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/20241031-msm8917-v2-2-8a075faa89b1@mainlining.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+index a0eb4e01b3a75..1b7eecff3ffa4 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+@@ -1226,6 +1226,8 @@ static const struct of_device_id pmic_gpio_of_match[] = {
+       { .compatible = "qcom,pm8550ve-gpio", .data = (void *) 8 },
+       { .compatible = "qcom,pm8550vs-gpio", .data = (void *) 6 },
+       { .compatible = "qcom,pm8916-gpio", .data = (void *) 4 },
++      /* pm8937 has 8 GPIOs with holes on 3, 4 and 6 */
++      { .compatible = "qcom,pm8937-gpio", .data = (void *) 8 },
+       { .compatible = "qcom,pm8941-gpio", .data = (void *) 36 },
+       /* pm8950 has 8 GPIOs with holes on 3 */
+       { .compatible = "qcom,pm8950-gpio", .data = (void *) 8 },
+-- 
+2.43.0
+
diff --git a/queue-6.12/pinctrl-qcom-spmi-mpp-add-pm8937-compatible.patch b/queue-6.12/pinctrl-qcom-spmi-mpp-add-pm8937-compatible.patch
new file mode 100644 (file)
index 0000000..028eb10
--- /dev/null
@@ -0,0 +1,39 @@
+From dd3e034aab632cc75ceed0875b53a1eb552c9fe9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 02:19:45 +0100
+Subject: pinctrl: qcom: spmi-mpp: Add PM8937 compatible
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Czémán <barnabas.czeman@mainlining.org>
+
+[ Upstream commit f755261190e88f5d19fe0a3b762f0bbaff6bd438 ]
+
+The PM8937 provides 4 MPPs.
+Add a compatible to support them.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
+Link: https://lore.kernel.org/20241031-msm8917-v2-4-8a075faa89b1@mainlining.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-spmi-mpp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+index d16ece90d926c..5fa04e7c1d5c4 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+@@ -983,6 +983,7 @@ static const struct of_device_id pmic_mpp_of_match[] = {
+       { .compatible = "qcom,pm8226-mpp", .data = (void *) 8 },
+       { .compatible = "qcom,pm8841-mpp", .data = (void *) 4 },
+       { .compatible = "qcom,pm8916-mpp", .data = (void *) 4 },
++      { .compatible = "qcom,pm8937-mpp", .data = (void *) 4 },
+       { .compatible = "qcom,pm8941-mpp", .data = (void *) 8 },
+       { .compatible = "qcom,pm8950-mpp", .data = (void *) 4 },
+       { .compatible = "qcom,pmi8950-mpp", .data = (void *) 4 },
+-- 
+2.43.0
+
diff --git a/queue-6.12/pinmux-use-sequential-access-to-access-desc-pinmux-d.patch b/queue-6.12/pinmux-use-sequential-access-to-access-desc-pinmux-d.patch
new file mode 100644 (file)
index 0000000..76240d0
--- /dev/null
@@ -0,0 +1,336 @@
+From c44f55dd0c8778d75f474c74706684ed42d9e5a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 00:59:30 +0530
+Subject: pinmux: Use sequential access to access desc->pinmux data
+
+From: Mukesh Ojha <quic_mojha@quicinc.com>
+
+[ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ]
+
+When two client of the same gpio call pinctrl_select_state() for the
+same functionality, we are seeing NULL pointer issue while accessing
+desc->mux_owner.
+
+Let's say two processes A, B executing in pin_request() for the same pin
+and process A updates the desc->mux_usecount but not yet updated the
+desc->mux_owner while process B see the desc->mux_usecount which got
+updated by A path and further executes strcmp and while accessing
+desc->mux_owner it crashes with NULL pointer.
+
+Serialize the access to mux related setting with a mutex lock.
+
+       cpu0 (process A)                        cpu1(process B)
+
+pinctrl_select_state() {                 pinctrl_select_state() {
+  pin_request() {                              pin_request() {
+  ...
+                                                ....
+    } else {
+         desc->mux_usecount++;
+                                               desc->mux_usecount && strcmp(desc->mux_owner, owner)) {
+
+         if (desc->mux_usecount > 1)
+               return 0;
+         desc->mux_owner = owner;
+
+  }                                            }
+
+Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Link: https://lore.kernel.org/20241014192930.1539673-1-quic_mojha@quicinc.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/core.c   |   3 +
+ drivers/pinctrl/core.h   |   1 +
+ drivers/pinctrl/pinmux.c | 173 ++++++++++++++++++++++-----------------
+ 3 files changed, 100 insertions(+), 77 deletions(-)
+
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index 4061890a17483..b3eec63c00ba0 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -220,6 +220,9 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev,
+       /* Set owner */
+       pindesc->pctldev = pctldev;
++#ifdef CONFIG_PINMUX
++      mutex_init(&pindesc->mux_lock);
++#endif
+       /* Copy basic pin info */
+       if (pin->name) {
+diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h
+index 4e07707d2435b..d6c24978e7081 100644
+--- a/drivers/pinctrl/core.h
++++ b/drivers/pinctrl/core.h
+@@ -177,6 +177,7 @@ struct pin_desc {
+       const char *mux_owner;
+       const struct pinctrl_setting_mux *mux_setting;
+       const char *gpio_owner;
++      struct mutex mux_lock;
+ #endif
+ };
+diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c
+index 02033ea1c6438..0743190da59e8 100644
+--- a/drivers/pinctrl/pinmux.c
++++ b/drivers/pinctrl/pinmux.c
+@@ -14,6 +14,7 @@
+ #include <linux/array_size.h>
+ #include <linux/ctype.h>
++#include <linux/cleanup.h>
+ #include <linux/debugfs.h>
+ #include <linux/device.h>
+ #include <linux/err.h>
+@@ -93,6 +94,7 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned int pin)
+       if (!desc || !ops)
+               return true;
++      guard(mutex)(&desc->mux_lock);
+       if (ops->strict && desc->mux_usecount)
+               return false;
+@@ -127,29 +129,31 @@ static int pin_request(struct pinctrl_dev *pctldev,
+       dev_dbg(pctldev->dev, "request pin %d (%s) for %s\n",
+               pin, desc->name, owner);
+-      if ((!gpio_range || ops->strict) &&
+-          desc->mux_usecount && strcmp(desc->mux_owner, owner)) {
+-              dev_err(pctldev->dev,
+-                      "pin %s already requested by %s; cannot claim for %s\n",
+-                      desc->name, desc->mux_owner, owner);
+-              goto out;
+-      }
++      scoped_guard(mutex, &desc->mux_lock) {
++              if ((!gpio_range || ops->strict) &&
++                  desc->mux_usecount && strcmp(desc->mux_owner, owner)) {
++                      dev_err(pctldev->dev,
++                              "pin %s already requested by %s; cannot claim for %s\n",
++                              desc->name, desc->mux_owner, owner);
++                      goto out;
++              }
+-      if ((gpio_range || ops->strict) && desc->gpio_owner) {
+-              dev_err(pctldev->dev,
+-                      "pin %s already requested by %s; cannot claim for %s\n",
+-                      desc->name, desc->gpio_owner, owner);
+-              goto out;
+-      }
++              if ((gpio_range || ops->strict) && desc->gpio_owner) {
++                      dev_err(pctldev->dev,
++                              "pin %s already requested by %s; cannot claim for %s\n",
++                              desc->name, desc->gpio_owner, owner);
++                      goto out;
++              }
+-      if (gpio_range) {
+-              desc->gpio_owner = owner;
+-      } else {
+-              desc->mux_usecount++;
+-              if (desc->mux_usecount > 1)
+-                      return 0;
++              if (gpio_range) {
++                      desc->gpio_owner = owner;
++              } else {
++                      desc->mux_usecount++;
++                      if (desc->mux_usecount > 1)
++                              return 0;
+-              desc->mux_owner = owner;
++                      desc->mux_owner = owner;
++              }
+       }
+       /* Let each pin increase references to this module */
+@@ -178,12 +182,14 @@ static int pin_request(struct pinctrl_dev *pctldev,
+ out_free_pin:
+       if (status) {
+-              if (gpio_range) {
+-                      desc->gpio_owner = NULL;
+-              } else {
+-                      desc->mux_usecount--;
+-                      if (!desc->mux_usecount)
+-                              desc->mux_owner = NULL;
++              scoped_guard(mutex, &desc->mux_lock) {
++                      if (gpio_range) {
++                              desc->gpio_owner = NULL;
++                      } else {
++                              desc->mux_usecount--;
++                              if (!desc->mux_usecount)
++                                      desc->mux_owner = NULL;
++                      }
+               }
+       }
+ out:
+@@ -219,15 +225,17 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin,
+               return NULL;
+       }
+-      if (!gpio_range) {
+-              /*
+-               * A pin should not be freed more times than allocated.
+-               */
+-              if (WARN_ON(!desc->mux_usecount))
+-                      return NULL;
+-              desc->mux_usecount--;
+-              if (desc->mux_usecount)
+-                      return NULL;
++      scoped_guard(mutex, &desc->mux_lock) {
++              if (!gpio_range) {
++                      /*
++                       * A pin should not be freed more times than allocated.
++                       */
++                      if (WARN_ON(!desc->mux_usecount))
++                              return NULL;
++                      desc->mux_usecount--;
++                      if (desc->mux_usecount)
++                              return NULL;
++              }
+       }
+       /*
+@@ -239,13 +247,15 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin,
+       else if (ops->free)
+               ops->free(pctldev, pin);
+-      if (gpio_range) {
+-              owner = desc->gpio_owner;
+-              desc->gpio_owner = NULL;
+-      } else {
+-              owner = desc->mux_owner;
+-              desc->mux_owner = NULL;
+-              desc->mux_setting = NULL;
++      scoped_guard(mutex, &desc->mux_lock) {
++              if (gpio_range) {
++                      owner = desc->gpio_owner;
++                      desc->gpio_owner = NULL;
++              } else {
++                      owner = desc->mux_owner;
++                      desc->mux_owner = NULL;
++                      desc->mux_setting = NULL;
++              }
+       }
+       module_put(pctldev->owner);
+@@ -458,7 +468,8 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting)
+                                pins[i]);
+                       continue;
+               }
+-              desc->mux_setting = &(setting->data.mux);
++              scoped_guard(mutex, &desc->mux_lock)
++                      desc->mux_setting = &(setting->data.mux);
+       }
+       ret = ops->set_mux(pctldev, setting->data.mux.func,
+@@ -472,8 +483,10 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting)
+ err_set_mux:
+       for (i = 0; i < num_pins; i++) {
+               desc = pin_desc_get(pctldev, pins[i]);
+-              if (desc)
+-                      desc->mux_setting = NULL;
++              if (desc) {
++                      scoped_guard(mutex, &desc->mux_lock)
++                              desc->mux_setting = NULL;
++              }
+       }
+ err_pin_request:
+       /* On error release all taken pins */
+@@ -492,6 +505,7 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting)
+       unsigned int num_pins = 0;
+       int i;
+       struct pin_desc *desc;
++      bool is_equal;
+       if (pctlops->get_group_pins)
+               ret = pctlops->get_group_pins(pctldev, setting->data.mux.group,
+@@ -517,7 +531,10 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting)
+                                pins[i]);
+                       continue;
+               }
+-              if (desc->mux_setting == &(setting->data.mux)) {
++              scoped_guard(mutex, &desc->mux_lock)
++                      is_equal = (desc->mux_setting == &(setting->data.mux));
++
++              if (is_equal) {
+                       pin_free(pctldev, pins[i], NULL);
+               } else {
+                       const char *gname;
+@@ -608,40 +625,42 @@ static int pinmux_pins_show(struct seq_file *s, void *what)
+               if (desc == NULL)
+                       continue;
+-              if (desc->mux_owner &&
+-                  !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev)))
+-                      is_hog = true;
+-
+-              if (pmxops->strict) {
+-                      if (desc->mux_owner)
+-                              seq_printf(s, "pin %d (%s): device %s%s",
+-                                         pin, desc->name, desc->mux_owner,
++              scoped_guard(mutex, &desc->mux_lock) {
++                      if (desc->mux_owner &&
++                          !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev)))
++                              is_hog = true;
++
++                      if (pmxops->strict) {
++                              if (desc->mux_owner)
++                                      seq_printf(s, "pin %d (%s): device %s%s",
++                                                 pin, desc->name, desc->mux_owner,
++                                                 is_hog ? " (HOG)" : "");
++                              else if (desc->gpio_owner)
++                                      seq_printf(s, "pin %d (%s): GPIO %s",
++                                                 pin, desc->name, desc->gpio_owner);
++                              else
++                                      seq_printf(s, "pin %d (%s): UNCLAIMED",
++                                                 pin, desc->name);
++                      } else {
++                              /* For non-strict controllers */
++                              seq_printf(s, "pin %d (%s): %s %s%s", pin, desc->name,
++                                         desc->mux_owner ? desc->mux_owner
++                                         : "(MUX UNCLAIMED)",
++                                         desc->gpio_owner ? desc->gpio_owner
++                                         : "(GPIO UNCLAIMED)",
+                                          is_hog ? " (HOG)" : "");
+-                      else if (desc->gpio_owner)
+-                              seq_printf(s, "pin %d (%s): GPIO %s",
+-                                         pin, desc->name, desc->gpio_owner);
++                      }
++
++                      /* If mux: print function+group claiming the pin */
++                      if (desc->mux_setting)
++                              seq_printf(s, " function %s group %s\n",
++                                         pmxops->get_function_name(pctldev,
++                                              desc->mux_setting->func),
++                                         pctlops->get_group_name(pctldev,
++                                              desc->mux_setting->group));
+                       else
+-                              seq_printf(s, "pin %d (%s): UNCLAIMED",
+-                                         pin, desc->name);
+-              } else {
+-                      /* For non-strict controllers */
+-                      seq_printf(s, "pin %d (%s): %s %s%s", pin, desc->name,
+-                                 desc->mux_owner ? desc->mux_owner
+-                                 : "(MUX UNCLAIMED)",
+-                                 desc->gpio_owner ? desc->gpio_owner
+-                                 : "(GPIO UNCLAIMED)",
+-                                 is_hog ? " (HOG)" : "");
++                              seq_putc(s, '\n');
+               }
+-
+-              /* If mux: print function+group claiming the pin */
+-              if (desc->mux_setting)
+-                      seq_printf(s, " function %s group %s\n",
+-                                 pmxops->get_function_name(pctldev,
+-                                      desc->mux_setting->func),
+-                                 pctlops->get_group_name(pctldev,
+-                                      desc->mux_setting->group));
+-              else
+-                      seq_putc(s, '\n');
+       }
+       mutex_unlock(&pctldev->mutex);
+-- 
+2.43.0
+
diff --git a/queue-6.12/powerpc-prom_init-fixup-missing-powermac-size-cells.patch b/queue-6.12/powerpc-prom_init-fixup-missing-powermac-size-cells.patch
new file mode 100644 (file)
index 0000000..0a693fd
--- /dev/null
@@ -0,0 +1,103 @@
+From 47f5017854acdbd5e6ab011a1f7deabc81122b9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2024 13:57:10 +1100
+Subject: powerpc/prom_init: Fixup missing powermac #size-cells
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit cf89c9434af122f28a3552e6f9cc5158c33ce50a ]
+
+On some powermacs `escc` nodes are missing `#size-cells` properties,
+which is deprecated and now triggers a warning at boot since commit
+045b14ca5c36 ("of: WARN on deprecated #address-cells/#size-cells
+handling").
+
+For example:
+
+  Missing '#size-cells' in /pci@f2000000/mac-io@c/escc@13000
+  WARNING: CPU: 0 PID: 0 at drivers/of/base.c:133 of_bus_n_size_cells+0x98/0x108
+  Hardware name: PowerMac3,1 7400 0xc0209 PowerMac
+  ...
+  Call Trace:
+    of_bus_n_size_cells+0x98/0x108 (unreliable)
+    of_bus_default_count_cells+0x40/0x60
+    __of_get_address+0xc8/0x21c
+    __of_address_to_resource+0x5c/0x228
+    pmz_init_port+0x5c/0x2ec
+    pmz_probe.isra.0+0x144/0x1e4
+    pmz_console_init+0x10/0x48
+    console_init+0xcc/0x138
+    start_kernel+0x5c4/0x694
+
+As powermacs boot via prom_init it's possible to add the missing
+properties to the device tree during boot, avoiding the warning. Note
+that `escc-legacy` nodes are also missing `#size-cells` properties, but
+they are skipped by the macio driver, so leave them alone.
+
+Depends-on: 045b14ca5c36 ("of: WARN on deprecated #address-cells/#size-cells handling")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20241126025710.591683-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom_init.c | 29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
+index fbb68fc28ed3a..935568d68196d 100644
+--- a/arch/powerpc/kernel/prom_init.c
++++ b/arch/powerpc/kernel/prom_init.c
+@@ -2932,7 +2932,7 @@ static void __init fixup_device_tree_chrp(void)
+ #endif
+ #if defined(CONFIG_PPC64) && defined(CONFIG_PPC_PMAC)
+-static void __init fixup_device_tree_pmac(void)
++static void __init fixup_device_tree_pmac64(void)
+ {
+       phandle u3, i2c, mpic;
+       u32 u3_rev;
+@@ -2972,7 +2972,31 @@ static void __init fixup_device_tree_pmac(void)
+                    &parent, sizeof(parent));
+ }
+ #else
+-#define fixup_device_tree_pmac()
++#define fixup_device_tree_pmac64()
++#endif
++
++#ifdef CONFIG_PPC_PMAC
++static void __init fixup_device_tree_pmac(void)
++{
++      __be32 val = 1;
++      char type[8];
++      phandle node;
++
++      // Some pmacs are missing #size-cells on escc nodes
++      for (node = 0; prom_next_node(&node); ) {
++              type[0] = '\0';
++              prom_getprop(node, "device_type", type, sizeof(type));
++              if (prom_strcmp(type, "escc"))
++                      continue;
++
++              if (prom_getproplen(node, "#size-cells") != PROM_ERROR)
++                      continue;
++
++              prom_setprop(node, NULL, "#size-cells", &val, sizeof(val));
++      }
++}
++#else
++static inline void fixup_device_tree_pmac(void) { }
+ #endif
+ #ifdef CONFIG_PPC_EFIKA
+@@ -3197,6 +3221,7 @@ static void __init fixup_device_tree(void)
+       fixup_device_tree_maple_memory_controller();
+       fixup_device_tree_chrp();
+       fixup_device_tree_pmac();
++      fixup_device_tree_pmac64();
+       fixup_device_tree_efika();
+       fixup_device_tree_pasemi();
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/r8169-don-t-apply-udp-padding-quirk-on-rtl8126a.patch b/queue-6.12/r8169-don-t-apply-udp-padding-quirk-on-rtl8126a.patch
new file mode 100644 (file)
index 0000000..e02e060
--- /dev/null
@@ -0,0 +1,57 @@
+From c76922a9011cb605c322e3df13a89993491baf3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 07:44:23 +0200
+Subject: r8169: don't apply UDP padding quirk on RTL8126A
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 87e26448dbda4523b73a894d96f0f788506d3795 ]
+
+Vendor drivers r8125/r8126 indicate that this quirk isn't needed
+any longer for RTL8126A. Mimic this in r8169.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/d1317187-aa81-4a69-b831-678436e4de62@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 713a89bb21e93..5ed2818bac257 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4233,8 +4233,8 @@ static unsigned int rtl8125_quirk_udp_padto(struct rtl8169_private *tp,
+ {
+       unsigned int padto = 0, len = skb->len;
+-      if (rtl_is_8125(tp) && len < 128 + RTL_MIN_PATCH_LEN &&
+-          rtl_skb_is_udp(skb) && skb_transport_header_was_set(skb)) {
++      if (len < 128 + RTL_MIN_PATCH_LEN && rtl_skb_is_udp(skb) &&
++          skb_transport_header_was_set(skb)) {
+               unsigned int trans_data_len = skb_tail_pointer(skb) -
+                                             skb_transport_header(skb);
+@@ -4258,9 +4258,15 @@ static unsigned int rtl8125_quirk_udp_padto(struct rtl8169_private *tp,
+ static unsigned int rtl_quirk_packet_padto(struct rtl8169_private *tp,
+                                          struct sk_buff *skb)
+ {
+-      unsigned int padto;
++      unsigned int padto = 0;
+-      padto = rtl8125_quirk_udp_padto(tp, skb);
++      switch (tp->mac_version) {
++      case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_63:
++              padto = rtl8125_quirk_udp_padto(tp, skb);
++              break;
++      default:
++              break;
++      }
+       switch (tp->mac_version) {
+       case RTL_GIGA_MAC_VER_34:
+-- 
+2.43.0
+
diff --git a/queue-6.12/regmap-maple-provide-lockdep-sub-class-for-maple-tre.patch b/queue-6.12/regmap-maple-provide-lockdep-sub-class-for-maple-tre.patch
new file mode 100644 (file)
index 0000000..e583085
--- /dev/null
@@ -0,0 +1,125 @@
+From 4ad8c537e51f2cc63acef4d9f30ccf6e73a79cbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 18:37:04 +0200
+Subject: regmap: maple: Provide lockdep (sub)class for maple tree's internal
+ lock
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 1ed9b927e7dd8b8cff13052efe212a8ff72ec51d ]
+
+In some cases when using the maple tree register cache, the lockdep
+validator might complain about invalid deadlocks:
+
+[7.131886]  Possible interrupt unsafe locking scenario:
+
+[7.131890]        CPU0                    CPU1
+[7.131893]        ----                    ----
+[7.131896]   lock(&mt->ma_lock);
+[7.131904]                                local_irq_disable();
+[7.131907]                                lock(rockchip_drm_vop2:3114:(&vop2_regmap_config)->lock);
+[7.131916]                                lock(&mt->ma_lock);
+[7.131925]   <Interrupt>
+[7.131928]     lock(rockchip_drm_vop2:3114:(&vop2_regmap_config)->lock);
+[7.131936]
+                *** DEADLOCK ***
+
+[7.131939] no locks held by swapper/0/0.
+[7.131944]
+               the shortest dependencies between 2nd lock and 1st lock:
+[7.131950]  -> (&mt->ma_lock){+.+.}-{2:2} {
+[7.131966]     HARDIRQ-ON-W at:
+[7.131973]                       lock_acquire+0x200/0x330
+[7.131986]                       _raw_spin_lock+0x50/0x70
+[7.131998]                       regcache_maple_write+0x68/0xe0
+[7.132010]                       regcache_write+0x6c/0x90
+[7.132019]                       _regmap_read+0x19c/0x1d0
+[7.132029]                       _regmap_update_bits+0xc0/0x148
+[7.132038]                       regmap_update_bits_base+0x6c/0xa8
+[7.132048]                       rk8xx_probe+0x22c/0x3d8
+[7.132057]                       rk8xx_spi_probe+0x74/0x88
+[7.132065]                       spi_probe+0xa8/0xe0
+
+[...]
+
+[7.132675]   }
+[7.132678]   ... key      at: [<ffff800082943c20>] __key.0+0x0/0x10
+[7.132691]   ... acquired at:
+[7.132695]    _raw_spin_lock+0x50/0x70
+[7.132704]    regcache_maple_write+0x68/0xe0
+[7.132714]    regcache_write+0x6c/0x90
+[7.132724]    _regmap_read+0x19c/0x1d0
+[7.132732]    _regmap_update_bits+0xc0/0x148
+[7.132741]    regmap_field_update_bits_base+0x74/0xb8
+[7.132751]    vop2_plane_atomic_update+0x480/0x14d8 [rockchipdrm]
+[7.132820]    drm_atomic_helper_commit_planes+0x1a0/0x320 [drm_kms_helper]
+
+[...]
+
+[7.135112] -> (rockchip_drm_vop2:3114:(&vop2_regmap_config)->lock){-...}-{2:2} {
+[7.135130]    IN-HARDIRQ-W at:
+[7.135136]                     lock_acquire+0x200/0x330
+[7.135147]                     _raw_spin_lock_irqsave+0x6c/0x98
+[7.135157]                     regmap_lock_spinlock+0x20/0x40
+[7.135166]                     regmap_read+0x44/0x90
+[7.135175]                     vop2_isr+0x90/0x290 [rockchipdrm]
+[7.135225]                     __handle_irq_event_percpu+0x124/0x2d0
+
+In the example above, the validator seems to get the scope of
+dependencies wrong, since the regmap instance used in rk8xx-spi driver
+has nothing to do with the instance from vop2.
+
+Improve validation by sharing the regmap's lockdep class with the maple
+tree's internal lock, while also providing a subclass for the latter.
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://patch.msgid.link/20241031-regmap-maple-lockdep-fix-v2-1-06a3710f3623@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/internal.h       | 1 +
+ drivers/base/regmap/regcache-maple.c | 3 +++
+ drivers/base/regmap/regmap.c         | 1 +
+ 3 files changed, 5 insertions(+)
+
+diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
+index 83acccdc10089..bdb450436cbc5 100644
+--- a/drivers/base/regmap/internal.h
++++ b/drivers/base/regmap/internal.h
+@@ -59,6 +59,7 @@ struct regmap {
+                       unsigned long raw_spinlock_flags;
+               };
+       };
++      struct lock_class_key *lock_key;
+       regmap_lock lock;
+       regmap_unlock unlock;
+       void *lock_arg; /* This is passed to lock/unlock functions */
+diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c
+index 8d27d3653ea3e..23da7b31d7153 100644
+--- a/drivers/base/regmap/regcache-maple.c
++++ b/drivers/base/regmap/regcache-maple.c
+@@ -355,6 +355,9 @@ static int regcache_maple_init(struct regmap *map)
+       mt_init(mt);
++      if (!mt_external_lock(mt) && map->lock_key)
++              lockdep_set_class_and_subclass(&mt->ma_lock, map->lock_key, 1);
++
+       if (!map->num_reg_defaults)
+               return 0;
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 7ef8577aeb100..e3e2afc2c83c6 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -756,6 +756,7 @@ struct regmap *__regmap_init(struct device *dev,
+                                                  lock_key, lock_name);
+               }
+               map->lock_arg = map;
++              map->lock_key = lock_key;
+       }
+       /*
+-- 
+2.43.0
+
diff --git a/queue-6.12/regulator-qcom-rpmh-update-ranges-for-ftsmps525.patch b/queue-6.12/regulator-qcom-rpmh-update-ranges-for-ftsmps525.patch
new file mode 100644 (file)
index 0000000..5871a25
--- /dev/null
@@ -0,0 +1,163 @@
+From d91b78ef0ee10130a6d78d0a749a6f1952e4457f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2024 16:26:45 -0800
+Subject: regulator: qcom-rpmh: Update ranges for FTSMPS525
+
+From: Melody Olvera <quic_molvera@quicinc.com>
+
+[ Upstream commit eeecf953d697cb7f0d916f9908a2b9f451bb2667 ]
+
+All FTSMPS525 regulators support LV and MV ranges; however,
+the boot loader firmware will determine which range to use as
+the device boots.
+
+Nonetheless, the driver cannot determine which range was selected,
+so hardcoding the ranges as either LV or MV will not cover all cases
+as it's possible for the firmware to select a range not supported by
+the driver's current hardcoded values.
+
+To this end, combine the ranges for the FTSMPS525s into one struct
+and point all regulators to the updated combined struct. This should
+work on all boards regardless of which range is selected by the firmware
+and more accurately caputres the capability of this regulator on a
+hardware level.
+
+Signed-off-by: Melody Olvera <quic_molvera@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://patch.msgid.link/20241112002645.2803506-1-quic_molvera@quicinc.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/qcom-rpmh-regulator.c | 83 +++++++++++--------------
+ 1 file changed, 36 insertions(+), 47 deletions(-)
+
+diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c
+index 6c343b4b9d15a..7870722b6ee21 100644
+--- a/drivers/regulator/qcom-rpmh-regulator.c
++++ b/drivers/regulator/qcom-rpmh-regulator.c
+@@ -843,26 +843,15 @@ static const struct rpmh_vreg_hw_data pmic5_ftsmps520 = {
+       .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
+ };
+-static const struct rpmh_vreg_hw_data pmic5_ftsmps525_lv = {
++static const struct rpmh_vreg_hw_data pmic5_ftsmps525 = {
+       .regulator_type = VRM,
+       .ops = &rpmh_regulator_vrm_ops,
+       .voltage_ranges = (struct linear_range[]) {
+               REGULATOR_LINEAR_RANGE(300000, 0, 267, 4000),
++              REGULATOR_LINEAR_RANGE(1376000, 268, 438, 8000),
+       },
+-      .n_linear_ranges = 1,
+-      .n_voltages = 268,
+-      .pmic_mode_map = pmic_mode_map_pmic5_smps,
+-      .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
+-};
+-
+-static const struct rpmh_vreg_hw_data pmic5_ftsmps525_mv = {
+-      .regulator_type = VRM,
+-      .ops = &rpmh_regulator_vrm_ops,
+-      .voltage_ranges = (struct linear_range[]) {
+-              REGULATOR_LINEAR_RANGE(600000, 0, 267, 8000),
+-      },
+-      .n_linear_ranges = 1,
+-      .n_voltages = 268,
++      .n_linear_ranges = 2,
++      .n_voltages = 439,
+       .pmic_mode_map = pmic_mode_map_pmic5_smps,
+       .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
+ };
+@@ -1190,12 +1179,12 @@ static const struct rpmh_vreg_init_data pm8550_vreg_data[] = {
+ };
+ static const struct rpmh_vreg_init_data pm8550vs_vreg_data[] = {
+-      RPMH_VREG("smps1",  "smp%s1",  &pmic5_ftsmps525_lv, "vdd-s1"),
+-      RPMH_VREG("smps2",  "smp%s2",  &pmic5_ftsmps525_lv, "vdd-s2"),
+-      RPMH_VREG("smps3",  "smp%s3",  &pmic5_ftsmps525_lv, "vdd-s3"),
+-      RPMH_VREG("smps4",  "smp%s4",  &pmic5_ftsmps525_lv, "vdd-s4"),
+-      RPMH_VREG("smps5",  "smp%s5",  &pmic5_ftsmps525_lv, "vdd-s5"),
+-      RPMH_VREG("smps6",  "smp%s6",  &pmic5_ftsmps525_mv, "vdd-s6"),
++      RPMH_VREG("smps1",  "smp%s1",  &pmic5_ftsmps525, "vdd-s1"),
++      RPMH_VREG("smps2",  "smp%s2",  &pmic5_ftsmps525, "vdd-s2"),
++      RPMH_VREG("smps3",  "smp%s3",  &pmic5_ftsmps525, "vdd-s3"),
++      RPMH_VREG("smps4",  "smp%s4",  &pmic5_ftsmps525, "vdd-s4"),
++      RPMH_VREG("smps5",  "smp%s5",  &pmic5_ftsmps525, "vdd-s5"),
++      RPMH_VREG("smps6",  "smp%s6",  &pmic5_ftsmps525, "vdd-s6"),
+       RPMH_VREG("ldo1",   "ldo%s1",  &pmic5_nldo515,   "vdd-l1"),
+       RPMH_VREG("ldo2",   "ldo%s2",  &pmic5_nldo515,   "vdd-l2"),
+       RPMH_VREG("ldo3",   "ldo%s3",  &pmic5_nldo515,   "vdd-l3"),
+@@ -1203,14 +1192,14 @@ static const struct rpmh_vreg_init_data pm8550vs_vreg_data[] = {
+ };
+ static const struct rpmh_vreg_init_data pm8550ve_vreg_data[] = {
+-      RPMH_VREG("smps1", "smp%s1", &pmic5_ftsmps525_lv, "vdd-s1"),
+-      RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps525_lv, "vdd-s2"),
+-      RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps525_lv, "vdd-s3"),
+-      RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps525_mv, "vdd-s4"),
+-      RPMH_VREG("smps5", "smp%s5", &pmic5_ftsmps525_lv, "vdd-s5"),
+-      RPMH_VREG("smps6", "smp%s6", &pmic5_ftsmps525_lv, "vdd-s6"),
+-      RPMH_VREG("smps7", "smp%s7", &pmic5_ftsmps525_lv, "vdd-s7"),
+-      RPMH_VREG("smps8", "smp%s8", &pmic5_ftsmps525_lv, "vdd-s8"),
++      RPMH_VREG("smps1", "smp%s1", &pmic5_ftsmps525, "vdd-s1"),
++      RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps525, "vdd-s2"),
++      RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps525, "vdd-s3"),
++      RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps525, "vdd-s4"),
++      RPMH_VREG("smps5", "smp%s5", &pmic5_ftsmps525, "vdd-s5"),
++      RPMH_VREG("smps6", "smp%s6", &pmic5_ftsmps525, "vdd-s6"),
++      RPMH_VREG("smps7", "smp%s7", &pmic5_ftsmps525, "vdd-s7"),
++      RPMH_VREG("smps8", "smp%s8", &pmic5_ftsmps525, "vdd-s8"),
+       RPMH_VREG("ldo1",  "ldo%s1", &pmic5_nldo515,   "vdd-l1"),
+       RPMH_VREG("ldo2",  "ldo%s2", &pmic5_nldo515,   "vdd-l2"),
+       RPMH_VREG("ldo3",  "ldo%s3", &pmic5_nldo515,   "vdd-l3"),
+@@ -1218,14 +1207,14 @@ static const struct rpmh_vreg_init_data pm8550ve_vreg_data[] = {
+ };
+ static const struct rpmh_vreg_init_data pmc8380_vreg_data[] = {
+-      RPMH_VREG("smps1", "smp%s1", &pmic5_ftsmps525_lv, "vdd-s1"),
+-      RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps525_lv, "vdd-s2"),
+-      RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps525_lv, "vdd-s3"),
+-      RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps525_mv, "vdd-s4"),
+-      RPMH_VREG("smps5", "smp%s5", &pmic5_ftsmps525_lv, "vdd-s5"),
+-      RPMH_VREG("smps6", "smp%s6", &pmic5_ftsmps525_lv, "vdd-s6"),
+-      RPMH_VREG("smps7", "smp%s7", &pmic5_ftsmps525_lv, "vdd-s7"),
+-      RPMH_VREG("smps8", "smp%s8", &pmic5_ftsmps525_lv, "vdd-s8"),
++      RPMH_VREG("smps1", "smp%s1", &pmic5_ftsmps525, "vdd-s1"),
++      RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps525, "vdd-s2"),
++      RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps525, "vdd-s3"),
++      RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps525, "vdd-s4"),
++      RPMH_VREG("smps5", "smp%s5", &pmic5_ftsmps525, "vdd-s5"),
++      RPMH_VREG("smps6", "smp%s6", &pmic5_ftsmps525, "vdd-s6"),
++      RPMH_VREG("smps7", "smp%s7", &pmic5_ftsmps525, "vdd-s7"),
++      RPMH_VREG("smps8", "smp%s8", &pmic5_ftsmps525, "vdd-s8"),
+       RPMH_VREG("ldo1",  "ldo%s1", &pmic5_nldo515,   "vdd-l1"),
+       RPMH_VREG("ldo2",  "ldo%s2", &pmic5_nldo515,   "vdd-l2"),
+       RPMH_VREG("ldo3",  "ldo%s3", &pmic5_nldo515,   "vdd-l3"),
+@@ -1409,16 +1398,16 @@ static const struct rpmh_vreg_init_data pmx65_vreg_data[] = {
+ };
+ static const struct rpmh_vreg_init_data pmx75_vreg_data[] = {
+-      RPMH_VREG("smps1",   "smp%s1",    &pmic5_ftsmps525_lv, "vdd-s1"),
+-      RPMH_VREG("smps2",   "smp%s2",    &pmic5_ftsmps525_lv, "vdd-s2"),
+-      RPMH_VREG("smps3",   "smp%s3",    &pmic5_ftsmps525_lv, "vdd-s3"),
+-      RPMH_VREG("smps4",   "smp%s4",    &pmic5_ftsmps525_mv, "vdd-s4"),
+-      RPMH_VREG("smps5",   "smp%s5",    &pmic5_ftsmps525_lv, "vdd-s5"),
+-      RPMH_VREG("smps6",   "smp%s6",    &pmic5_ftsmps525_lv, "vdd-s6"),
+-      RPMH_VREG("smps7",   "smp%s7",    &pmic5_ftsmps525_lv, "vdd-s7"),
+-      RPMH_VREG("smps8",   "smp%s8",    &pmic5_ftsmps525_lv, "vdd-s8"),
+-      RPMH_VREG("smps9",   "smp%s9",    &pmic5_ftsmps525_lv, "vdd-s9"),
+-      RPMH_VREG("smps10",  "smp%s10",   &pmic5_ftsmps525_lv, "vdd-s10"),
++      RPMH_VREG("smps1",   "smp%s1",    &pmic5_ftsmps525, "vdd-s1"),
++      RPMH_VREG("smps2",   "smp%s2",    &pmic5_ftsmps525, "vdd-s2"),
++      RPMH_VREG("smps3",   "smp%s3",    &pmic5_ftsmps525, "vdd-s3"),
++      RPMH_VREG("smps4",   "smp%s4",    &pmic5_ftsmps525, "vdd-s4"),
++      RPMH_VREG("smps5",   "smp%s5",    &pmic5_ftsmps525, "vdd-s5"),
++      RPMH_VREG("smps6",   "smp%s6",    &pmic5_ftsmps525, "vdd-s6"),
++      RPMH_VREG("smps7",   "smp%s7",    &pmic5_ftsmps525, "vdd-s7"),
++      RPMH_VREG("smps8",   "smp%s8",    &pmic5_ftsmps525, "vdd-s8"),
++      RPMH_VREG("smps9",   "smp%s9",    &pmic5_ftsmps525, "vdd-s9"),
++      RPMH_VREG("smps10",  "smp%s10",   &pmic5_ftsmps525, "vdd-s10"),
+       RPMH_VREG("ldo1",    "ldo%s1",    &pmic5_nldo515,   "vdd-l1"),
+       RPMH_VREG("ldo2",    "ldo%s2",    &pmic5_nldo515,   "vdd-l2-18"),
+       RPMH_VREG("ldo3",    "ldo%s3",    &pmic5_nldo515,   "vdd-l3"),
+-- 
+2.43.0
+
diff --git a/queue-6.12/remoteproc-qcom-pas-enable-sar2130p-audio-dsp-suppor.patch b/queue-6.12/remoteproc-qcom-pas-enable-sar2130p-audio-dsp-suppor.patch
new file mode 100644 (file)
index 0000000..3de2867
--- /dev/null
@@ -0,0 +1,36 @@
+From 350aa0a351e5c231e427460c745021b5a86681e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 01:09:45 +0300
+Subject: remoteproc: qcom: pas: enable SAR2130P audio DSP support
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 009e288c989b3fe548a45c82da407d7bd00418a9 ]
+
+Enable support for the Audio DSP on the Qualcomm SAR2130P platform,
+reusing the SM8350 resources.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241027-sar2130p-adsp-v1-3-bd204e39d24e@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pas.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
+index 793b1d274be33..1a2d08ec9de9e 100644
+--- a/drivers/remoteproc/qcom_q6v5_pas.c
++++ b/drivers/remoteproc/qcom_q6v5_pas.c
+@@ -1433,6 +1433,7 @@ static const struct of_device_id adsp_of_match[] = {
+       { .compatible = "qcom,sa8775p-cdsp1-pas", .data = &sa8775p_cdsp1_resource},
+       { .compatible = "qcom,sa8775p-gpdsp0-pas", .data = &sa8775p_gpdsp0_resource},
+       { .compatible = "qcom,sa8775p-gpdsp1-pas", .data = &sa8775p_gpdsp1_resource},
++      { .compatible = "qcom,sar2130p-adsp-pas", .data = &sm8350_adsp_resource},
+       { .compatible = "qcom,sc7180-adsp-pas", .data = &sm8250_adsp_resource},
+       { .compatible = "qcom,sc7180-mpss-pas", .data = &mpss_resource_init},
+       { .compatible = "qcom,sc7280-adsp-pas", .data = &sm8350_adsp_resource},
+-- 
+2.43.0
+
diff --git a/queue-6.12/revert-nvme-make-keep-alive-synchronous-operation.patch b/queue-6.12/revert-nvme-make-keep-alive-synchronous-operation.patch
new file mode 100644 (file)
index 0000000..1897b54
--- /dev/null
@@ -0,0 +1,94 @@
+From f8a828aa79e0af00e2951385fdcb9613f4800b59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2024 11:42:08 +0530
+Subject: Revert "nvme: make keep-alive synchronous operation"
+
+From: Nilay Shroff <nilay@linux.ibm.com>
+
+[ Upstream commit 84488282166de6b6760ada8030e87aaa08bce3aa ]
+
+This reverts commit d06923670b5a5f609603d4a9fee4dec02d38de9c.
+
+It was realized that the fix implemented to contain the race condition
+among the keep alive task and the fabric shutdown code path in the commit
+d06923670b5ia ("nvme: make keep-alive synchronous operation") is not
+optimal. The reason being keep-alive runs under the workqueue and making
+it synchronous would waste a workqueue context.
+Furthermore, we later found that the above race condition is a regression
+caused due to the changes implemented in commit a54a93d0e359 ("nvme: move
+stopping keep-alive into nvme_uninit_ctrl()"). So we decided to revert the
+commit d06923670b5a ("nvme: make keep-alive synchronous operation") and
+then fix the regression.
+
+Link: https://lore.kernel.org/all/196f4013-3bbf-43ff-98b4-9cb2a96c20c2@grimberg.me/
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index ec03b25eacbbc..249914b90dbfa 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1303,9 +1303,10 @@ static void nvme_queue_keep_alive_work(struct nvme_ctrl *ctrl)
+       queue_delayed_work(nvme_wq, &ctrl->ka_work, delay);
+ }
+-static void nvme_keep_alive_finish(struct request *rq,
+-              blk_status_t status, struct nvme_ctrl *ctrl)
++static enum rq_end_io_ret nvme_keep_alive_end_io(struct request *rq,
++                                               blk_status_t status)
+ {
++      struct nvme_ctrl *ctrl = rq->end_io_data;
+       unsigned long rtt = jiffies - (rq->deadline - rq->timeout);
+       unsigned long delay = nvme_keep_alive_work_period(ctrl);
+       enum nvme_ctrl_state state = nvme_ctrl_state(ctrl);
+@@ -1322,17 +1323,20 @@ static void nvme_keep_alive_finish(struct request *rq,
+               delay = 0;
+       }
++      blk_mq_free_request(rq);
++
+       if (status) {
+               dev_err(ctrl->device,
+                       "failed nvme_keep_alive_end_io error=%d\n",
+                               status);
+-              return;
++              return RQ_END_IO_NONE;
+       }
+       ctrl->ka_last_check_time = jiffies;
+       ctrl->comp_seen = false;
+       if (state == NVME_CTRL_LIVE || state == NVME_CTRL_CONNECTING)
+               queue_delayed_work(nvme_wq, &ctrl->ka_work, delay);
++      return RQ_END_IO_NONE;
+ }
+ static void nvme_keep_alive_work(struct work_struct *work)
+@@ -1341,7 +1345,6 @@ static void nvme_keep_alive_work(struct work_struct *work)
+                       struct nvme_ctrl, ka_work);
+       bool comp_seen = ctrl->comp_seen;
+       struct request *rq;
+-      blk_status_t status;
+       ctrl->ka_last_check_time = jiffies;
+@@ -1364,9 +1367,9 @@ static void nvme_keep_alive_work(struct work_struct *work)
+       nvme_init_request(rq, &ctrl->ka_cmd);
+       rq->timeout = ctrl->kato * HZ;
+-      status = blk_execute_rq(rq, false);
+-      nvme_keep_alive_finish(rq, status, ctrl);
+-      blk_mq_free_request(rq);
++      rq->end_io = nvme_keep_alive_end_io;
++      rq->end_io_data = ctrl;
++      blk_execute_rq_nowait(rq, false);
+ }
+ static void nvme_start_keep_alive(struct nvme_ctrl *ctrl)
+-- 
+2.43.0
+
diff --git a/queue-6.12/ring-buffer-limit-time-with-disabled-interrupts-in-r.patch b/queue-6.12/ring-buffer-limit-time-with-disabled-interrupts-in-r.patch
new file mode 100644 (file)
index 0000000..5a7f434
--- /dev/null
@@ -0,0 +1,221 @@
+From 39956b850f0c9d72e8d2c2c6fcb3ddd8183cfea4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 13:27:46 +0200
+Subject: ring-buffer: Limit time with disabled interrupts in rb_check_pages()
+
+From: Petr Pavlu <petr.pavlu@suse.com>
+
+[ Upstream commit b237e1f7d2273fdcffac20100b72c002bdd770dd ]
+
+The function rb_check_pages() validates the integrity of a specified
+per-CPU tracing ring buffer. It does so by traversing the underlying
+linked list and checking its next and prev links.
+
+To guarantee that the list isn't modified during the check, a caller
+typically needs to take cpu_buffer->reader_lock. This prevents the check
+from running concurrently, for example, with a potential reader which
+can make the list temporarily inconsistent when swapping its old reader
+page into the buffer.
+
+A problem with this approach is that the time when interrupts are
+disabled is non-deterministic, dependent on the ring buffer size. This
+particularly affects PREEMPT_RT because the reader_lock is a raw
+spinlock which doesn't become sleepable on PREEMPT_RT kernels.
+
+Modify the check so it still attempts to traverse the entire list, but
+gives up the reader_lock between checking individual pages. Introduce
+for this purpose a new variable ring_buffer_per_cpu.cnt which is bumped
+any time the list is modified. The value is used by rb_check_pages() to
+detect such a change and restart the check.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://lore.kernel.org/20241015112810.27203-1-petr.pavlu@suse.com
+Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ring_buffer.c | 98 ++++++++++++++++++++++++++++----------
+ 1 file changed, 72 insertions(+), 26 deletions(-)
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 5807116bcd0bf..366eb4c4f28e5 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -482,6 +482,8 @@ struct ring_buffer_per_cpu {
+       unsigned long                   nr_pages;
+       unsigned int                    current_context;
+       struct list_head                *pages;
++      /* pages generation counter, incremented when the list changes */
++      unsigned long                   cnt;
+       struct buffer_page              *head_page;     /* read from head */
+       struct buffer_page              *tail_page;     /* write to tail */
+       struct buffer_page              *commit_page;   /* committed pages */
+@@ -1475,40 +1477,87 @@ static void rb_check_bpage(struct ring_buffer_per_cpu *cpu_buffer,
+       RB_WARN_ON(cpu_buffer, val & RB_FLAG_MASK);
+ }
++static bool rb_check_links(struct ring_buffer_per_cpu *cpu_buffer,
++                         struct list_head *list)
++{
++      if (RB_WARN_ON(cpu_buffer,
++                     rb_list_head(rb_list_head(list->next)->prev) != list))
++              return false;
++
++      if (RB_WARN_ON(cpu_buffer,
++                     rb_list_head(rb_list_head(list->prev)->next) != list))
++              return false;
++
++      return true;
++}
++
+ /**
+  * rb_check_pages - integrity check of buffer pages
+  * @cpu_buffer: CPU buffer with pages to test
+  *
+  * As a safety measure we check to make sure the data pages have not
+  * been corrupted.
+- *
+- * Callers of this function need to guarantee that the list of pages doesn't get
+- * modified during the check. In particular, if it's possible that the function
+- * is invoked with concurrent readers which can swap in a new reader page then
+- * the caller should take cpu_buffer->reader_lock.
+  */
+ static void rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer)
+ {
+-      struct list_head *head = rb_list_head(cpu_buffer->pages);
+-      struct list_head *tmp;
++      struct list_head *head, *tmp;
++      unsigned long buffer_cnt;
++      unsigned long flags;
++      int nr_loops = 0;
+-      if (RB_WARN_ON(cpu_buffer,
+-                      rb_list_head(rb_list_head(head->next)->prev) != head))
++      /*
++       * Walk the linked list underpinning the ring buffer and validate all
++       * its next and prev links.
++       *
++       * The check acquires the reader_lock to avoid concurrent processing
++       * with code that could be modifying the list. However, the lock cannot
++       * be held for the entire duration of the walk, as this would make the
++       * time when interrupts are disabled non-deterministic, dependent on the
++       * ring buffer size. Therefore, the code releases and re-acquires the
++       * lock after checking each page. The ring_buffer_per_cpu.cnt variable
++       * is then used to detect if the list was modified while the lock was
++       * not held, in which case the check needs to be restarted.
++       *
++       * The code attempts to perform the check at most three times before
++       * giving up. This is acceptable because this is only a self-validation
++       * to detect problems early on. In practice, the list modification
++       * operations are fairly spaced, and so this check typically succeeds at
++       * most on the second try.
++       */
++again:
++      if (++nr_loops > 3)
+               return;
+-      if (RB_WARN_ON(cpu_buffer,
+-                      rb_list_head(rb_list_head(head->prev)->next) != head))
+-              return;
++      raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
++      head = rb_list_head(cpu_buffer->pages);
++      if (!rb_check_links(cpu_buffer, head))
++              goto out_locked;
++      buffer_cnt = cpu_buffer->cnt;
++      tmp = head;
++      raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+-      for (tmp = rb_list_head(head->next); tmp != head; tmp = rb_list_head(tmp->next)) {
+-              if (RB_WARN_ON(cpu_buffer,
+-                              rb_list_head(rb_list_head(tmp->next)->prev) != tmp))
+-                      return;
++      while (true) {
++              raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+-              if (RB_WARN_ON(cpu_buffer,
+-                              rb_list_head(rb_list_head(tmp->prev)->next) != tmp))
+-                      return;
++              if (buffer_cnt != cpu_buffer->cnt) {
++                      /* The list was updated, try again. */
++                      raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
++                      goto again;
++              }
++
++              tmp = rb_list_head(tmp->next);
++              if (tmp == head)
++                      /* The iteration circled back, all is done. */
++                      goto out_locked;
++
++              if (!rb_check_links(cpu_buffer, tmp))
++                      goto out_locked;
++
++              raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+       }
++
++out_locked:
++      raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+ }
+ /*
+@@ -2532,6 +2581,7 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
+       /* make sure pages points to a valid page in the ring buffer */
+       cpu_buffer->pages = next_page;
++      cpu_buffer->cnt++;
+       /* update head page */
+       if (head_bit)
+@@ -2638,6 +2688,7 @@ rb_insert_pages(struct ring_buffer_per_cpu *cpu_buffer)
+                        * pointer to point to end of list
+                        */
+                       head_page->prev = last_page;
++                      cpu_buffer->cnt++;
+                       success = true;
+                       break;
+               }
+@@ -2873,12 +2924,8 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
+                */
+               synchronize_rcu();
+               for_each_buffer_cpu(buffer, cpu) {
+-                      unsigned long flags;
+-
+                       cpu_buffer = buffer->buffers[cpu];
+-                      raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+                       rb_check_pages(cpu_buffer);
+-                      raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+               }
+               atomic_dec(&buffer->record_disabled);
+       }
+@@ -5296,6 +5343,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+       rb_list_head(reader->list.next)->prev = &cpu_buffer->reader_page->list;
+       rb_inc_page(&cpu_buffer->head_page);
++      cpu_buffer->cnt++;
+       local_inc(&cpu_buffer->pages_read);
+       /* Finally update the reader page to the new head */
+@@ -5835,12 +5883,9 @@ void
+ ring_buffer_read_finish(struct ring_buffer_iter *iter)
+ {
+       struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
+-      unsigned long flags;
+       /* Use this opportunity to check the integrity of the ring buffer. */
+-      raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+       rb_check_pages(cpu_buffer);
+-      raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+       atomic_dec(&cpu_buffer->resize_disabled);
+       kfree(iter->event);
+@@ -6757,6 +6802,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
+               /* Install the new pages, remove the head from the list */
+               cpu_buffer->pages = cpu_buffer->new_pages.next;
+               list_del_init(&cpu_buffer->new_pages);
++              cpu_buffer->cnt++;
+               cpu_buffer->head_page
+                       = list_entry(cpu_buffer->pages, struct buffer_page, list);
+-- 
+2.43.0
+
diff --git a/queue-6.12/rocker-fix-link-status-detection-in-rocker_carrier_i.patch b/queue-6.12/rocker-fix-link-status-detection-in-rocker_carrier_i.patch
new file mode 100644 (file)
index 0000000..d8371b0
--- /dev/null
@@ -0,0 +1,39 @@
+From be31f96a08890efa916ddade97e1b655fc0be834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2024 18:19:46 +0300
+Subject: rocker: fix link status detection in rocker_carrier_init()
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit e64285ff41bb7a934bd815bd38f31119be62ac37 ]
+
+Since '1 << rocker_port->pport' may be undefined for port >= 32,
+cast the left operand to 'unsigned long long' like it's done in
+'rocker_port_set_enable()' above. Compile tested only.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Link: https://patch.msgid.link/20241114151946.519047-1-dmantipov@yandex.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/rocker/rocker_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
+index 84fa911c78db5..fe0bf1d3217af 100644
+--- a/drivers/net/ethernet/rocker/rocker_main.c
++++ b/drivers/net/ethernet/rocker/rocker_main.c
+@@ -2502,7 +2502,7 @@ static void rocker_carrier_init(const struct rocker_port *rocker_port)
+       u64 link_status = rocker_read64(rocker, PORT_PHYS_LINK_STATUS);
+       bool link_up;
+-      link_up = link_status & (1 << rocker_port->pport);
++      link_up = link_status & (1ULL << rocker_port->pport);
+       if (link_up)
+               netif_carrier_on(rocker_port->dev);
+       else
+-- 
+2.43.0
+
diff --git a/queue-6.12/rtc-cmos-avoid-taking-rtc_lock-for-extended-period-o.patch b/queue-6.12/rtc-cmos-avoid-taking-rtc_lock-for-extended-period-o.patch
new file mode 100644 (file)
index 0000000..cd2bc51
--- /dev/null
@@ -0,0 +1,95 @@
+From a16d6eb31af96f5eb117bddff53d6326b433d1b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 13:14:57 -0700
+Subject: rtc: cmos: avoid taking rtc_lock for extended period of time
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 0a6efab33eab4e973db26d9f90c3e97a7a82e399 ]
+
+On my device reading entirety of /sys/devices/pnp0/00:03/cmos_nvram0/nvmem
+takes about 9 msec during which time interrupts are off on the CPU that
+does the read and the thread that performs the read can not be migrated
+or preempted by another higher priority thread (RT or not).
+
+Allow readers and writers be preempted by taking and releasing rtc_lock
+spinlock for each individual byte read or written rather than once per
+read/write request.
+
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Reviewed-by: Mateusz JoÅ„czyk <mat.jonczyk@o2.pl>
+Link: https://lore.kernel.org/r/Zxv8QWR21AV4ztC5@google.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-cmos.c | 31 +++++++++++++++----------------
+ 1 file changed, 15 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index 35dca2accbb8d..5849d2970bba4 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -645,18 +645,17 @@ static int cmos_nvram_read(void *priv, unsigned int off, void *val,
+       unsigned char *buf = val;
+       off += NVRAM_OFFSET;
+-      spin_lock_irq(&rtc_lock);
+-      for (; count; count--, off++) {
++      for (; count; count--, off++, buf++) {
++              guard(spinlock_irq)(&rtc_lock);
+               if (off < 128)
+-                      *buf++ = CMOS_READ(off);
++                      *buf = CMOS_READ(off);
+               else if (can_bank2)
+-                      *buf++ = cmos_read_bank2(off);
++                      *buf = cmos_read_bank2(off);
+               else
+-                      break;
++                      return -EIO;
+       }
+-      spin_unlock_irq(&rtc_lock);
+-      return count ? -EIO : 0;
++      return 0;
+ }
+ static int cmos_nvram_write(void *priv, unsigned int off, void *val,
+@@ -671,23 +670,23 @@ static int cmos_nvram_write(void *priv, unsigned int off, void *val,
+        * NVRAM to update, updating checksums is also part of its job.
+        */
+       off += NVRAM_OFFSET;
+-      spin_lock_irq(&rtc_lock);
+-      for (; count; count--, off++) {
++      for (; count; count--, off++, buf++) {
+               /* don't trash RTC registers */
+               if (off == cmos->day_alrm
+                               || off == cmos->mon_alrm
+                               || off == cmos->century)
+-                      buf++;
+-              else if (off < 128)
+-                      CMOS_WRITE(*buf++, off);
++                      continue;
++
++              guard(spinlock_irq)(&rtc_lock);
++              if (off < 128)
++                      CMOS_WRITE(*buf, off);
+               else if (can_bank2)
+-                      cmos_write_bank2(*buf++, off);
++                      cmos_write_bank2(*buf, off);
+               else
+-                      break;
++                      return -EIO;
+       }
+-      spin_unlock_irq(&rtc_lock);
+-      return count ? -EIO : 0;
++      return 0;
+ }
+ /*----------------------------------------------------------------*/
+-- 
+2.43.0
+
diff --git a/queue-6.12/rtla-fix-consistency-in-getopt_long-for-timerlat_his.patch b/queue-6.12/rtla-fix-consistency-in-getopt_long-for-timerlat_his.patch
new file mode 100644 (file)
index 0000000..c0b3bfd
--- /dev/null
@@ -0,0 +1,45 @@
+From 6bf3ee049d6fd11286071919d0ae17b6f74d31eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 16:34:17 +0200
+Subject: rtla: Fix consistency in getopt_long for timerlat_hist
+
+From: Gabriele Monaco <gmonaco@redhat.com>
+
+[ Upstream commit cfb1ea216c1656a4112becbc4bf757891933b902 ]
+
+Commit e9a4062e1527 ("rtla: Add --trace-buffer-size option") adds a new
+long option to rtla utilities, but among all affected files,
+timerlat_hist misses a trailing `:` in the corresponding short option
+inside the getopt string (e.g. `\3:`). This patch propagates the `:`.
+
+Although this change is not functionally required, it improves
+consistency and slightly reduces the likelihood a future change would
+introduce a problem.
+
+Cc: John Kacur <jkacur@redhat.com>
+Cc: Luis Goncalves <lgoncalv@redhat.com>
+Cc: Tomas Glozar <tglozar@redhat.com>
+Link: https://lore.kernel.org/20240926143417.54039-1-gmonaco@redhat.com
+Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/timerlat_hist.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/tracing/rtla/src/timerlat_hist.c b/tools/tracing/rtla/src/timerlat_hist.c
+index 829511a712224..f6aa83ff15659 100644
+--- a/tools/tracing/rtla/src/timerlat_hist.c
++++ b/tools/tracing/rtla/src/timerlat_hist.c
+@@ -778,7 +778,7 @@ static struct timerlat_hist_params
+               /* getopt_long stores the option index here. */
+               int option_index = 0;
+-              c = getopt_long(argc, argv, "a:c:C::b:d:e:E:DhH:i:knp:P:s:t::T:uU0123456:7:8:9\1\2:\3",
++              c = getopt_long(argc, argv, "a:c:C::b:d:e:E:DhH:i:knp:P:s:t::T:uU0123456:7:8:9\1\2:\3:",
+                                long_options, &option_index);
+               /* detect the end of the options. */
+-- 
+2.43.0
+
diff --git a/queue-6.12/rtla-timerlat-make-timerlat_hist_cpu-_count-unsigned.patch b/queue-6.12/rtla-timerlat-make-timerlat_hist_cpu-_count-unsigned.patch
new file mode 100644 (file)
index 0000000..a8583ea
--- /dev/null
@@ -0,0 +1,78 @@
+From ad1dff8b8345a05f5e5ebdb5fb36cbba898e195e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2024 14:10:15 +0200
+Subject: rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
+
+From: Tomas Glozar <tglozar@redhat.com>
+
+[ Upstream commit 76b3102148135945b013797fac9b206273f0f777 ]
+
+Do the same fix as in previous commit also for timerlat-hist.
+
+Link: https://lore.kernel.org/20241011121015.2868751-2-tglozar@redhat.com
+Reported-by: Attila Fazekas <afazekas@redhat.com>
+Signed-off-by: Tomas Glozar <tglozar@redhat.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/timerlat_hist.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/tools/tracing/rtla/src/timerlat_hist.c b/tools/tracing/rtla/src/timerlat_hist.c
+index f6aa83ff15659..ae55cd7912833 100644
+--- a/tools/tracing/rtla/src/timerlat_hist.c
++++ b/tools/tracing/rtla/src/timerlat_hist.c
+@@ -62,9 +62,9 @@ struct timerlat_hist_cpu {
+       int                     *thread;
+       int                     *user;
+-      int                     irq_count;
+-      int                     thread_count;
+-      int                     user_count;
++      unsigned long long      irq_count;
++      unsigned long long      thread_count;
++      unsigned long long      user_count;
+       unsigned long long      min_irq;
+       unsigned long long      sum_irq;
+@@ -304,15 +304,15 @@ timerlat_print_summary(struct timerlat_hist_params *params,
+                       continue;
+               if (!params->no_irq)
+-                      trace_seq_printf(trace->seq, "%9d ",
++                      trace_seq_printf(trace->seq, "%9llu ",
+                                       data->hist[cpu].irq_count);
+               if (!params->no_thread)
+-                      trace_seq_printf(trace->seq, "%9d ",
++                      trace_seq_printf(trace->seq, "%9llu ",
+                                       data->hist[cpu].thread_count);
+               if (params->user_hist)
+-                      trace_seq_printf(trace->seq, "%9d ",
++                      trace_seq_printf(trace->seq, "%9llu ",
+                                        data->hist[cpu].user_count);
+       }
+       trace_seq_printf(trace->seq, "\n");
+@@ -488,15 +488,15 @@ timerlat_print_stats_all(struct timerlat_hist_params *params,
+               trace_seq_printf(trace->seq, "count:");
+       if (!params->no_irq)
+-              trace_seq_printf(trace->seq, "%9d ",
++              trace_seq_printf(trace->seq, "%9llu ",
+                                sum.irq_count);
+       if (!params->no_thread)
+-              trace_seq_printf(trace->seq, "%9d ",
++              trace_seq_printf(trace->seq, "%9llu ",
+                                sum.thread_count);
+       if (params->user_hist)
+-              trace_seq_printf(trace->seq, "%9d ",
++              trace_seq_printf(trace->seq, "%9llu ",
+                                sum.user_count);
+       trace_seq_printf(trace->seq, "\n");
+-- 
+2.43.0
+
diff --git a/queue-6.12/rtla-timerlat-make-timerlat_top_cpu-_count-unsigned-.patch b/queue-6.12/rtla-timerlat-make-timerlat_top_cpu-_count-unsigned-.patch
new file mode 100644 (file)
index 0000000..70ac344
--- /dev/null
@@ -0,0 +1,72 @@
+From 05f3df905838daf622a78596893aa8c741f491ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2024 14:10:14 +0200
+Subject: rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
+
+From: Tomas Glozar <tglozar@redhat.com>
+
+[ Upstream commit 4eba4723c5254ba8251ecb7094a5078d5c300646 ]
+
+Most fields of struct timerlat_top_cpu are unsigned long long, but the
+fields {irq,thread,user}_count are int (32-bit signed).
+
+This leads to overflow when tracing on a large number of CPUs for a long
+enough time:
+$ rtla timerlat top -a20 -c 1-127 -d 12h
+...
+  0 12:00:00   |          IRQ Timer Latency (us)        |         Thread Timer Latency (us)
+CPU COUNT      |      cur       min       avg       max |      cur       min       avg       max
+ 1 #43200096  |        0         0         1         2 |        3         2         6        12
+...
+127 #43200096  |        0         0         1         2 |        3         2         5        11
+ALL #119144 e4 |                  0         5         4 |                  2        28        16
+
+The average latency should be 0-1 for IRQ and 5-6 for thread, but is
+reported as 5 and 28, about 4 to 5 times more, due to the count
+overflowing when summed over all CPUs: 43200096 * 127 = 5486412192,
+however, 1191444898 (= 5486412192 mod MAX_INT) is reported instead, as
+seen on the last line of the output, and the averages are thus ~4.6
+times higher than they should be (5486412192 / 1191444898 = ~4.6).
+
+Fix the issue by changing {irq,thread,user}_count fields to unsigned
+long long, similarly to other fields in struct timerlat_top_cpu and to
+the count variable in timerlat_top_print_sum.
+
+Link: https://lore.kernel.org/20241011121015.2868751-1-tglozar@redhat.com
+Reported-by: Attila Fazekas <afazekas@redhat.com>
+Signed-off-by: Tomas Glozar <tglozar@redhat.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/timerlat_top.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/tracing/rtla/src/timerlat_top.c b/tools/tracing/rtla/src/timerlat_top.c
+index 3b62519a412fc..ac2ff38a57ee5 100644
+--- a/tools/tracing/rtla/src/timerlat_top.c
++++ b/tools/tracing/rtla/src/timerlat_top.c
+@@ -54,9 +54,9 @@ struct timerlat_top_params {
+ };
+ struct timerlat_top_cpu {
+-      int                     irq_count;
+-      int                     thread_count;
+-      int                     user_count;
++      unsigned long long      irq_count;
++      unsigned long long      thread_count;
++      unsigned long long      user_count;
+       unsigned long long      cur_irq;
+       unsigned long long      min_irq;
+@@ -280,7 +280,7 @@ static void timerlat_top_print(struct osnoise_tool *top, int cpu)
+       /*
+        * Unless trace is being lost, IRQ counter is always the max.
+        */
+-      trace_seq_printf(s, "%3d #%-9d |", cpu, cpu_data->irq_count);
++      trace_seq_printf(s, "%3d #%-9llu |", cpu, cpu_data->irq_count);
+       if (!cpu_data->irq_count) {
+               trace_seq_printf(s, "%s %s %s %s |", no_value, no_value, no_value, no_value);
+-- 
+2.43.0
+
diff --git a/queue-6.12/rtla-utils-add-idle-state-disabling-via-libcpupower.patch b/queue-6.12/rtla-utils-add-idle-state-disabling-via-libcpupower.patch
new file mode 100644 (file)
index 0000000..2d0532f
--- /dev/null
@@ -0,0 +1,217 @@
+From 354bcd3b3efd600f4d23cee6898a6968659bb3a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 16:09:11 +0200
+Subject: rtla/utils: Add idle state disabling via libcpupower
+
+From: Tomas Glozar <tglozar@redhat.com>
+
+[ Upstream commit 083d29d3784319e9e9fab3ac02683a7b26ae3480 ]
+
+Add functions to utils.c to disable idle states through functions of
+libcpupower. This will serve as the basis for disabling idle states
+per cpu when running timerlat.
+
+Link: https://lore.kernel.org/20241017140914.3200454-4-tglozar@redhat.com
+Signed-off-by: Tomas Glozar <tglozar@redhat.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/utils.c | 150 +++++++++++++++++++++++++++++++++
+ tools/tracing/rtla/src/utils.h |  13 +++
+ 2 files changed, 163 insertions(+)
+
+diff --git a/tools/tracing/rtla/src/utils.c b/tools/tracing/rtla/src/utils.c
+index 0735fcb827ed7..230f9fc7502dd 100644
+--- a/tools/tracing/rtla/src/utils.c
++++ b/tools/tracing/rtla/src/utils.c
+@@ -4,6 +4,9 @@
+  */
+ #define _GNU_SOURCE
++#ifdef HAVE_LIBCPUPOWER_SUPPORT
++#include <cpuidle.h>
++#endif /* HAVE_LIBCPUPOWER_SUPPORT */
+ #include <dirent.h>
+ #include <stdarg.h>
+ #include <stdlib.h>
+@@ -519,6 +522,153 @@ int set_cpu_dma_latency(int32_t latency)
+       return fd;
+ }
++#ifdef HAVE_LIBCPUPOWER_SUPPORT
++static unsigned int **saved_cpu_idle_disable_state;
++static size_t saved_cpu_idle_disable_state_alloc_ctr;
++
++/*
++ * save_cpu_idle_state_disable - save disable for all idle states of a cpu
++ *
++ * Saves the current disable of all idle states of a cpu, to be subsequently
++ * restored via restore_cpu_idle_disable_state.
++ *
++ * Return: idle state count on success, negative on error
++ */
++int save_cpu_idle_disable_state(unsigned int cpu)
++{
++      unsigned int nr_states;
++      unsigned int state;
++      int disabled;
++      int nr_cpus;
++
++      nr_states = cpuidle_state_count(cpu);
++
++      if (nr_states == 0)
++              return 0;
++
++      if (saved_cpu_idle_disable_state == NULL) {
++              nr_cpus = sysconf(_SC_NPROCESSORS_CONF);
++              saved_cpu_idle_disable_state = calloc(nr_cpus, sizeof(unsigned int *));
++              if (!saved_cpu_idle_disable_state)
++                      return -1;
++      }
++
++      saved_cpu_idle_disable_state[cpu] = calloc(nr_states, sizeof(unsigned int));
++      if (!saved_cpu_idle_disable_state[cpu])
++              return -1;
++      saved_cpu_idle_disable_state_alloc_ctr++;
++
++      for (state = 0; state < nr_states; state++) {
++              disabled = cpuidle_is_state_disabled(cpu, state);
++              if (disabled < 0)
++                      return disabled;
++              saved_cpu_idle_disable_state[cpu][state] = disabled;
++      }
++
++      return nr_states;
++}
++
++/*
++ * restore_cpu_idle_disable_state - restore disable for all idle states of a cpu
++ *
++ * Restores the current disable state of all idle states of a cpu that was
++ * previously saved by save_cpu_idle_disable_state.
++ *
++ * Return: idle state count on success, negative on error
++ */
++int restore_cpu_idle_disable_state(unsigned int cpu)
++{
++      unsigned int nr_states;
++      unsigned int state;
++      int disabled;
++      int result;
++
++      nr_states = cpuidle_state_count(cpu);
++
++      if (nr_states == 0)
++              return 0;
++
++      if (!saved_cpu_idle_disable_state)
++              return -1;
++
++      for (state = 0; state < nr_states; state++) {
++              if (!saved_cpu_idle_disable_state[cpu])
++                      return -1;
++              disabled = saved_cpu_idle_disable_state[cpu][state];
++              result = cpuidle_state_disable(cpu, state, disabled);
++              if (result < 0)
++                      return result;
++      }
++
++      free(saved_cpu_idle_disable_state[cpu]);
++      saved_cpu_idle_disable_state[cpu] = NULL;
++      saved_cpu_idle_disable_state_alloc_ctr--;
++      if (saved_cpu_idle_disable_state_alloc_ctr == 0) {
++              free(saved_cpu_idle_disable_state);
++              saved_cpu_idle_disable_state = NULL;
++      }
++
++      return nr_states;
++}
++
++/*
++ * free_cpu_idle_disable_states - free saved idle state disable for all cpus
++ *
++ * Frees the memory used for storing cpu idle state disable for all cpus
++ * and states.
++ *
++ * Normally, the memory is freed automatically in
++ * restore_cpu_idle_disable_state; this is mostly for cleaning up after an
++ * error.
++ */
++void free_cpu_idle_disable_states(void)
++{
++      int cpu;
++      int nr_cpus;
++
++      if (!saved_cpu_idle_disable_state)
++              return;
++
++      nr_cpus = sysconf(_SC_NPROCESSORS_CONF);
++
++      for (cpu = 0; cpu < nr_cpus; cpu++) {
++              free(saved_cpu_idle_disable_state[cpu]);
++              saved_cpu_idle_disable_state[cpu] = NULL;
++      }
++
++      free(saved_cpu_idle_disable_state);
++      saved_cpu_idle_disable_state = NULL;
++}
++
++/*
++ * set_deepest_cpu_idle_state - limit idle state of cpu
++ *
++ * Disables all idle states deeper than the one given in
++ * deepest_state (assuming states with higher number are deeper).
++ *
++ * This is used to reduce the exit from idle latency. Unlike
++ * set_cpu_dma_latency, it can disable idle states per cpu.
++ *
++ * Return: idle state count on success, negative on error
++ */
++int set_deepest_cpu_idle_state(unsigned int cpu, unsigned int deepest_state)
++{
++      unsigned int nr_states;
++      unsigned int state;
++      int result;
++
++      nr_states = cpuidle_state_count(cpu);
++
++      for (state = deepest_state + 1; state < nr_states; state++) {
++              result = cpuidle_state_disable(cpu, state, 1);
++              if (result < 0)
++                      return result;
++      }
++
++      return nr_states;
++}
++#endif /* HAVE_LIBCPUPOWER_SUPPORT */
++
+ #define _STR(x) #x
+ #define STR(x) _STR(x)
+diff --git a/tools/tracing/rtla/src/utils.h b/tools/tracing/rtla/src/utils.h
+index 99c9cf81bcd02..101d4799a0090 100644
+--- a/tools/tracing/rtla/src/utils.h
++++ b/tools/tracing/rtla/src/utils.h
+@@ -66,6 +66,19 @@ int set_comm_sched_attr(const char *comm_prefix, struct sched_attr *attr);
+ int set_comm_cgroup(const char *comm_prefix, const char *cgroup);
+ int set_pid_cgroup(pid_t pid, const char *cgroup);
+ int set_cpu_dma_latency(int32_t latency);
++#ifdef HAVE_LIBCPUPOWER_SUPPORT
++int save_cpu_idle_disable_state(unsigned int cpu);
++int restore_cpu_idle_disable_state(unsigned int cpu);
++void free_cpu_idle_disable_states(void);
++int set_deepest_cpu_idle_state(unsigned int cpu, unsigned int state);
++static inline int have_libcpupower_support(void) { return 1; }
++#else
++static inline int save_cpu_idle_disable_state(unsigned int cpu) { return -1; }
++static inline int restore_cpu_idle_disable_state(unsigned int cpu) { return -1; }
++static inline void free_cpu_idle_disable_states(void) { }
++static inline int set_deepest_cpu_idle_state(unsigned int cpu, unsigned int state) { return -1; }
++static inline int have_libcpupower_support(void) { return 0; }
++#endif /* HAVE_LIBCPUPOWER_SUPPORT */
+ int auto_house_keeping(cpu_set_t *monitored_cpus);
+ #define ns_to_usf(x) (((double)x/1000))
+-- 
+2.43.0
+
diff --git a/queue-6.12/s390-cpum_sf-handle-cpu-hotplug-remove-during-sampli.patch b/queue-6.12/s390-cpum_sf-handle-cpu-hotplug-remove-during-sampli.patch
new file mode 100644 (file)
index 0000000..1ec3a5e
--- /dev/null
@@ -0,0 +1,80 @@
+From b5e055c50d0bf5cfcdb8b8bca105e114e0d40466 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 12:27:53 +0200
+Subject: s390/cpum_sf: Handle CPU hotplug remove during sampling
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit a0bd7dacbd51c632b8e2c0500b479af564afadf3 ]
+
+CPU hotplug remove handling triggers the following function
+call sequence:
+
+   CPUHP_AP_PERF_S390_SF_ONLINE  --> s390_pmu_sf_offline_cpu()
+   ...
+   CPUHP_AP_PERF_ONLINE          --> perf_event_exit_cpu()
+
+The s390 CPUMF sampling CPU hotplug handler invokes:
+
+ s390_pmu_sf_offline_cpu()
+ +-->  cpusf_pmu_setup()
+       +--> setup_pmc_cpu()
+            +--> deallocate_buffers()
+
+This function de-allocates all sampling data buffers (SDBs) allocated
+for that CPU at event initialization. It also clears the
+PMU_F_RESERVED bit. The CPU is gone and can not be sampled.
+
+With the event still being active on the removed CPU, the CPU event
+hotplug support in kernel performance subsystem triggers the
+following function calls on the removed CPU:
+
+  perf_event_exit_cpu()
+  +--> perf_event_exit_cpu_context()
+       +--> __perf_event_exit_context()
+           +--> __perf_remove_from_context()
+                +--> event_sched_out()
+                     +--> cpumsf_pmu_del()
+                          +--> cpumsf_pmu_stop()
+                                +--> hw_perf_event_update()
+
+to stop and remove the event. During removal of the event, the
+sampling device driver tries to read out the remaining samples from
+the sample data buffers (SDBs). But they have already been freed
+(and may have been re-assigned). This may lead to a use after free
+situation in which case the samples are most likely invalid. In the
+best case the memory has not been reassigned and still contains
+valid data.
+
+Remedy this situation and check if the CPU is still in reserved
+state (bit PMU_F_RESERVED set). In this case the SDBs have not been
+released an contain valid data. This is always the case when
+the event is removed (and no CPU hotplug off occured).
+If the PMU_F_RESERVED bit is not set, the SDB buffers are gone.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 3317f4878eaa7..331e0654d61d7 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -1780,7 +1780,9 @@ static void cpumsf_pmu_stop(struct perf_event *event, int flags)
+       event->hw.state |= PERF_HES_STOPPED;
+       if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) {
+-              hw_perf_event_update(event, 1);
++              /* CPU hotplug off removes SDBs. No samples to extract. */
++              if (cpuhw->flags & PMU_F_RESERVED)
++                      hw_perf_event_update(event, 1);
+               event->hw.state |= PERF_HES_UPTODATE;
+       }
+       perf_pmu_enable(event->pmu);
+-- 
+2.43.0
+
diff --git a/queue-6.12/s390-pci-ignore-rid-for-isolated-vfs.patch b/queue-6.12/s390-pci-ignore-rid-for-isolated-vfs.patch
new file mode 100644 (file)
index 0000000..e4446a8
--- /dev/null
@@ -0,0 +1,140 @@
+From 37058381f44df870f8ff3b0108e84396a87baeb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 16:08:31 +0200
+Subject: s390/pci: Ignore RID for isolated VFs
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 25f39d3dcb48bbc824a77d16b3d977f0f3713cfe ]
+
+Ensure that VFs used in isolation, that is with their parent PF not
+visible to the configuration but with their RID exposed, are treated
+compatibly with existing isolated VF use cases without exposed RID
+including RoCE Express VFs. This allows creating configurations where
+one LPAR manages PFs while their child VFs are used by other LPARs. This
+gives the LPAR managing the PFs a role analogous to that of the
+hypervisor in a typical use case of passing child VFs to guests.
+
+Instead of creating a multifunction struct zpci_bus whenever a PCI
+function with RID exposed is discovered only create such a bus for
+configured physical functions and only consider multifunction busses
+when searching for an existing bus. Additionally only set zdev->devfn to
+the devfn part of the RID once the function is added to a multifunction
+bus.
+
+This also fixes probing of more than 7 such isolated VFs from the same
+physical bus. This is because common PCI code in pci_scan_slot() only
+looks for more functions when pdev->multifunction is set which somewhat
+counter intutively is not the case for VFs.
+
+Note that PFs are looked at before their child VFs is guaranteed because
+we sort the zpci_list by RID ascending.
+
+Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com>
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci_bus.c | 33 ++++++++++++++++++++-------------
+ arch/s390/pci/pci_clp.c |  2 --
+ 2 files changed, 20 insertions(+), 15 deletions(-)
+
+diff --git a/arch/s390/pci/pci_bus.c b/arch/s390/pci/pci_bus.c
+index 54879e773e4a3..1b74a000ff645 100644
+--- a/arch/s390/pci/pci_bus.c
++++ b/arch/s390/pci/pci_bus.c
+@@ -168,9 +168,16 @@ void zpci_bus_scan_busses(void)
+       mutex_unlock(&zbus_list_lock);
+ }
++static bool zpci_bus_is_multifunction_root(struct zpci_dev *zdev)
++{
++      return !s390_pci_no_rid && zdev->rid_available &&
++              zpci_is_device_configured(zdev) &&
++              !zdev->vfn;
++}
++
+ /* zpci_bus_create_pci_bus - Create the PCI bus associated with this zbus
+  * @zbus: the zbus holding the zdevices
+- * @fr: PCI root function that will determine the bus's domain, and bus speeed
++ * @fr: PCI root function that will determine the bus's domain, and bus speed
+  * @ops: the pci operations
+  *
+  * The PCI function @fr determines the domain (its UID), multifunction property
+@@ -188,7 +195,7 @@ static int zpci_bus_create_pci_bus(struct zpci_bus *zbus, struct zpci_dev *fr, s
+               return domain;
+       zbus->domain_nr = domain;
+-      zbus->multifunction = fr->rid_available;
++      zbus->multifunction = zpci_bus_is_multifunction_root(fr);
+       zbus->max_bus_speed = fr->max_bus_speed;
+       /*
+@@ -238,6 +245,8 @@ static struct zpci_bus *zpci_bus_get(int topo, bool topo_is_tid)
+       mutex_lock(&zbus_list_lock);
+       list_for_each_entry(zbus, &zbus_list, bus_next) {
++              if (!zbus->multifunction)
++                      continue;
+               if (topo_is_tid == zbus->topo_is_tid && topo == zbus->topo) {
+                       kref_get(&zbus->kref);
+                       goto out_unlock;
+@@ -293,19 +302,22 @@ static int zpci_bus_add_device(struct zpci_bus *zbus, struct zpci_dev *zdev)
+ {
+       int rc = -EINVAL;
++      if (zbus->multifunction) {
++              if (!zdev->rid_available) {
++                      WARN_ONCE(1, "rid_available not set for multifunction\n");
++                      return rc;
++              }
++              zdev->devfn = zdev->rid & ZPCI_RID_MASK_DEVFN;
++      }
++
+       if (zbus->function[zdev->devfn]) {
+               pr_err("devfn %04x is already assigned\n", zdev->devfn);
+               return rc;
+       }
+-
+       zdev->zbus = zbus;
+       zbus->function[zdev->devfn] = zdev;
+       zpci_nb_devices++;
+-      if (zbus->multifunction && !zdev->rid_available) {
+-              WARN_ONCE(1, "rid_available not set for multifunction\n");
+-              goto error;
+-      }
+       rc = zpci_init_slot(zdev);
+       if (rc)
+               goto error;
+@@ -332,13 +344,8 @@ int zpci_bus_device_register(struct zpci_dev *zdev, struct pci_ops *ops)
+               return -ENOSPC;
+       }
+-      if (zdev->devfn >= ZPCI_FUNCTIONS_PER_BUS)
+-              return -EINVAL;
+-
+       topo = topo_is_tid ? zdev->tid : zdev->pchid;
+-      if (!s390_pci_no_rid && zdev->rid_available)
+-              zbus = zpci_bus_get(topo, topo_is_tid);
+-
++      zbus = zpci_bus_get(topo, topo_is_tid);
+       if (!zbus) {
+               zbus = zpci_bus_alloc(topo, topo_is_tid);
+               if (!zbus)
+diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
+index e222036874e51..74dac6da03d5b 100644
+--- a/arch/s390/pci/pci_clp.c
++++ b/arch/s390/pci/pci_clp.c
+@@ -168,8 +168,6 @@ static int clp_store_query_pci_fn(struct zpci_dev *zdev,
+       zdev->rid_available = response->rid_avail;
+       if (zdev->rid_available)
+               zdev->rid = response->rid;
+-      if (!s390_pci_no_rid && zdev->rid_available)
+-              zdev->devfn = response->rid & ZPCI_RID_MASK_DEVFN;
+       zdev->tid_avail = response->tid_avail;
+       if (zdev->tid_avail)
+               zdev->tid = response->tid;
+-- 
+2.43.0
+
diff --git a/queue-6.12/s390-pci-sort-pci-functions-prior-to-creating-virtua.patch b/queue-6.12/s390-pci-sort-pci-functions-prior-to-creating-virtua.patch
new file mode 100644 (file)
index 0000000..e274a41
--- /dev/null
@@ -0,0 +1,283 @@
+From db1360fec42a86365b6287c3196c648cccbc16ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 16:08:29 +0200
+Subject: s390/pci: Sort PCI functions prior to creating virtual busses
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 0467cdde8c4320bbfdb31a8cff1277b202f677fc ]
+
+Instead of relying on the observed but not architected firmware behavior
+that PCI functions from the same card are listed in ascending RID order
+in clp_list_pci() ensure this by sorting. To allow for sorting separate
+the initial clp_list_pci() and creation of the virtual PCI busses.
+
+Note that fundamentally in our per-PCI function hotplug design non RID
+order of discovery is still possible. For example when the two PFs of
+a two port NIC are hotplugged after initial boot and in descending RID
+order. In this case the virtual PCI bus would be created by the second
+PF using that PF's UID as domain number instead of that of the first PF.
+Thus the domain number would then change from the UID of the second PF
+to that of the first PF on reboot but there is really nothing we can do
+about that since changing domain numbers at runtime seems even worse.
+This only impacts the domain number as the RIDs are consistent and thus
+even with just the second PF visible it will show up in the correct
+position on the virtual bus.
+
+Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com>
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/pci.h |  5 ++-
+ arch/s390/pci/pci.c         | 69 ++++++++++++++++++++++++++++++++-----
+ arch/s390/pci/pci_clp.c     | 12 ++++---
+ arch/s390/pci/pci_event.c   | 13 ++++---
+ 4 files changed, 82 insertions(+), 17 deletions(-)
+
+diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
+index 30b20ce9a7003..b10801fa73569 100644
+--- a/arch/s390/include/asm/pci.h
++++ b/arch/s390/include/asm/pci.h
+@@ -129,6 +129,7 @@ struct zpci_dev {
+       u16             vfn;            /* virtual function number */
+       u16             pchid;          /* physical channel ID */
+       u16             maxstbl;        /* Maximum store block size */
++      u16             rid;            /* RID as supplied by firmware */
+       u8              pfgid;          /* function group ID */
+       u8              pft;            /* pci function type */
+       u8              port;
+@@ -210,12 +211,14 @@ extern struct airq_iv *zpci_aif_sbv;
+ ----------------------------------------------------------------------------- */
+ /* Base stuff */
+ struct zpci_dev *zpci_create_device(u32 fid, u32 fh, enum zpci_state state);
++int zpci_add_device(struct zpci_dev *zdev);
+ int zpci_enable_device(struct zpci_dev *);
+ int zpci_disable_device(struct zpci_dev *);
+ int zpci_scan_configured_device(struct zpci_dev *zdev, u32 fh);
+ int zpci_deconfigure_device(struct zpci_dev *zdev);
+ void zpci_device_reserved(struct zpci_dev *zdev);
+ bool zpci_is_device_configured(struct zpci_dev *zdev);
++int zpci_scan_devices(void);
+ int zpci_hot_reset_device(struct zpci_dev *zdev);
+ int zpci_register_ioat(struct zpci_dev *, u8, u64, u64, u64, u8 *);
+@@ -225,7 +228,7 @@ void zpci_update_fh(struct zpci_dev *zdev, u32 fh);
+ /* CLP */
+ int clp_setup_writeback_mio(void);
+-int clp_scan_pci_devices(void);
++int clp_scan_pci_devices(struct list_head *scan_list);
+ int clp_query_pci_fn(struct zpci_dev *zdev);
+ int clp_enable_fh(struct zpci_dev *zdev, u32 *fh, u8 nr_dma_as);
+ int clp_disable_fh(struct zpci_dev *zdev, u32 *fh);
+diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
+index 635fd8f2acbaa..2a5299888ca86 100644
+--- a/arch/s390/pci/pci.c
++++ b/arch/s390/pci/pci.c
+@@ -29,6 +29,7 @@
+ #include <linux/pci.h>
+ #include <linux/printk.h>
+ #include <linux/lockdep.h>
++#include <linux/list_sort.h>
+ #include <asm/isc.h>
+ #include <asm/airq.h>
+@@ -788,7 +789,6 @@ struct zpci_dev *zpci_create_device(u32 fid, u32 fh, enum zpci_state state)
+       struct zpci_dev *zdev;
+       int rc;
+-      zpci_dbg(1, "add fid:%x, fh:%x, c:%d\n", fid, fh, state);
+       zdev = kzalloc(sizeof(*zdev), GFP_KERNEL);
+       if (!zdev)
+               return ERR_PTR(-ENOMEM);
+@@ -808,6 +808,19 @@ struct zpci_dev *zpci_create_device(u32 fid, u32 fh, enum zpci_state state)
+       mutex_init(&zdev->fmb_lock);
+       mutex_init(&zdev->kzdev_lock);
++      return zdev;
++
++error:
++      zpci_dbg(0, "crt fid:%x, rc:%d\n", fid, rc);
++      kfree(zdev);
++      return ERR_PTR(rc);
++}
++
++int zpci_add_device(struct zpci_dev *zdev)
++{
++      int rc;
++
++      zpci_dbg(1, "add fid:%x, fh:%x, c:%d\n", zdev->fid, zdev->fh, zdev->state);
+       rc = zpci_init_iommu(zdev);
+       if (rc)
+               goto error;
+@@ -819,15 +832,13 @@ struct zpci_dev *zpci_create_device(u32 fid, u32 fh, enum zpci_state state)
+       spin_lock(&zpci_list_lock);
+       list_add_tail(&zdev->entry, &zpci_list);
+       spin_unlock(&zpci_list_lock);
+-
+-      return zdev;
++      return 0;
+ error_destroy_iommu:
+       zpci_destroy_iommu(zdev);
+ error:
+-      zpci_dbg(0, "add fid:%x, rc:%d\n", fid, rc);
+-      kfree(zdev);
+-      return ERR_PTR(rc);
++      zpci_dbg(0, "add fid:%x, rc:%d\n", zdev->fid, rc);
++      return rc;
+ }
+ bool zpci_is_device_configured(struct zpci_dev *zdev)
+@@ -1069,6 +1080,49 @@ bool zpci_is_enabled(void)
+       return s390_pci_initialized;
+ }
++static int zpci_cmp_rid(void *priv, const struct list_head *a,
++                      const struct list_head *b)
++{
++      struct zpci_dev *za = container_of(a, struct zpci_dev, entry);
++      struct zpci_dev *zb = container_of(b, struct zpci_dev, entry);
++
++      /*
++       * PCI functions without RID available maintain original order
++       * between themselves but sort before those with RID.
++       */
++      if (za->rid == zb->rid)
++              return za->rid_available > zb->rid_available;
++      /*
++       * PCI functions with RID sort by RID ascending.
++       */
++      return za->rid > zb->rid;
++}
++
++static void zpci_add_devices(struct list_head *scan_list)
++{
++      struct zpci_dev *zdev, *tmp;
++
++      list_sort(NULL, scan_list, &zpci_cmp_rid);
++      list_for_each_entry_safe(zdev, tmp, scan_list, entry) {
++              list_del_init(&zdev->entry);
++              zpci_add_device(zdev);
++      }
++}
++
++int zpci_scan_devices(void)
++{
++      LIST_HEAD(scan_list);
++      int rc;
++
++      rc = clp_scan_pci_devices(&scan_list);
++      if (rc)
++              return rc;
++
++      zpci_add_devices(&scan_list);
++      zpci_bus_scan_busses();
++      return 0;
++}
++
+ static int __init pci_base_init(void)
+ {
+       int rc;
+@@ -1098,10 +1152,9 @@ static int __init pci_base_init(void)
+       if (rc)
+               goto out_irq;
+-      rc = clp_scan_pci_devices();
++      rc = zpci_scan_devices();
+       if (rc)
+               goto out_find;
+-      zpci_bus_scan_busses();
+       s390_pci_initialized = 1;
+       return 0;
+diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
+index 6f55a59a08711..f7430086e9739 100644
+--- a/arch/s390/pci/pci_clp.c
++++ b/arch/s390/pci/pci_clp.c
+@@ -164,8 +164,10 @@ static int clp_store_query_pci_fn(struct zpci_dev *zdev,
+       zdev->port = response->port;
+       zdev->uid = response->uid;
+       zdev->fmb_length = sizeof(u32) * response->fmb_len;
+-      zdev->rid_available = response->rid_avail;
+       zdev->is_physfn = response->is_physfn;
++      zdev->rid_available = response->rid_avail;
++      if (zdev->rid_available)
++              zdev->rid = response->rid;
+       if (!s390_pci_no_rid && zdev->rid_available)
+               zdev->devfn = response->rid & ZPCI_RID_MASK_DEVFN;
+@@ -407,6 +409,7 @@ static int clp_find_pci(struct clp_req_rsp_list_pci *rrb, u32 fid,
+ static void __clp_add(struct clp_fh_list_entry *entry, void *data)
+ {
++      struct list_head *scan_list = data;
+       struct zpci_dev *zdev;
+       if (!entry->vendor_id)
+@@ -417,10 +420,11 @@ static void __clp_add(struct clp_fh_list_entry *entry, void *data)
+               zpci_zdev_put(zdev);
+               return;
+       }
+-      zpci_create_device(entry->fid, entry->fh, entry->config_state);
++      zdev = zpci_create_device(entry->fid, entry->fh, entry->config_state);
++      list_add_tail(&zdev->entry, scan_list);
+ }
+-int clp_scan_pci_devices(void)
++int clp_scan_pci_devices(struct list_head *scan_list)
+ {
+       struct clp_req_rsp_list_pci *rrb;
+       int rc;
+@@ -429,7 +433,7 @@ int clp_scan_pci_devices(void)
+       if (!rrb)
+               return -ENOMEM;
+-      rc = clp_list_pci(rrb, NULL, __clp_add);
++      rc = clp_list_pci(rrb, scan_list, __clp_add);
+       clp_free_block(rrb);
+       return rc;
+diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
+index d4f19d33914cb..47f934f4e828e 100644
+--- a/arch/s390/pci/pci_event.c
++++ b/arch/s390/pci/pci_event.c
+@@ -340,6 +340,7 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
+                       zdev = zpci_create_device(ccdf->fid, ccdf->fh, ZPCI_FN_STATE_CONFIGURED);
+                       if (IS_ERR(zdev))
+                               break;
++                      zpci_add_device(zdev);
+               } else {
+                       /* the configuration request may be stale */
+                       if (zdev->state != ZPCI_FN_STATE_STANDBY)
+@@ -349,10 +350,14 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
+               zpci_scan_configured_device(zdev, ccdf->fh);
+               break;
+       case 0x0302: /* Reserved -> Standby */
+-              if (!zdev)
+-                      zpci_create_device(ccdf->fid, ccdf->fh, ZPCI_FN_STATE_STANDBY);
+-              else
++              if (!zdev) {
++                      zdev = zpci_create_device(ccdf->fid, ccdf->fh, ZPCI_FN_STATE_STANDBY);
++                      if (IS_ERR(zdev))
++                              break;
++                      zpci_add_device(zdev);
++              } else {
+                       zpci_update_fh(zdev, ccdf->fh);
++              }
+               break;
+       case 0x0303: /* Deconfiguration requested */
+               if (zdev) {
+@@ -381,7 +386,7 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
+               break;
+       case 0x0306: /* 0x308 or 0x302 for multiple devices */
+               zpci_remove_reserved_devices();
+-              clp_scan_pci_devices();
++              zpci_scan_devices();
+               break;
+       case 0x0308: /* Standby -> Reserved */
+               if (!zdev)
+-- 
+2.43.0
+
diff --git a/queue-6.12/s390-pci-use-topology-id-for-multi-function-devices.patch b/queue-6.12/s390-pci-use-topology-id-for-multi-function-devices.patch
new file mode 100644 (file)
index 0000000..204fdf1
--- /dev/null
@@ -0,0 +1,172 @@
+From 70c8f33a62879359c274da949cfe698c7b120098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 16:08:30 +0200
+Subject: s390/pci: Use topology ID for multi-function devices
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 126034faaac5f356822c4a9bebfa75664da11056 ]
+
+The newly introduced topology ID (TID) field in the CLP Query PCI
+Function explicitly identifies groups of PCI functions whose RIDs belong
+to the same (sub-)topology. When available use the TID instead of the
+PCHID to match zPCI busses/domains for multi-function devices. Note that
+currently only a single PCI bus per TID is supported. This change is
+required because in future machines the PCHID will not identify a PCI
+card but a specific port in the case of some multi-port NICs while from
+a PCI point of view the entire card is a subtopology.
+
+Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com>
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/pci.h     |  9 ++++++---
+ arch/s390/include/asm/pci_clp.h |  8 +++++---
+ arch/s390/pci/pci_bus.c         | 17 ++++++++++-------
+ arch/s390/pci/pci_clp.c         |  3 +++
+ 4 files changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
+index b10801fa73569..83789e39d1d5e 100644
+--- a/arch/s390/include/asm/pci.h
++++ b/arch/s390/include/asm/pci.h
+@@ -106,9 +106,10 @@ struct zpci_bus {
+       struct list_head        resources;
+       struct list_head        bus_next;
+       struct resource         bus_resource;
+-      int                     pchid;
++      int                     topo;           /* TID if topo_is_tid, PCHID otherwise */
+       int                     domain_nr;
+-      bool                    multifunction;
++      u8                      multifunction   : 1;
++      u8                      topo_is_tid     : 1;
+       enum pci_bus_speed      max_bus_speed;
+ };
+@@ -130,6 +131,7 @@ struct zpci_dev {
+       u16             pchid;          /* physical channel ID */
+       u16             maxstbl;        /* Maximum store block size */
+       u16             rid;            /* RID as supplied by firmware */
++      u16             tid;            /* Topology for which RID is valid */
+       u8              pfgid;          /* function group ID */
+       u8              pft;            /* pci function type */
+       u8              port;
+@@ -140,7 +142,8 @@ struct zpci_dev {
+       u8              is_physfn       : 1;
+       u8              util_str_avail  : 1;
+       u8              irqs_registered : 1;
+-      u8              reserved        : 2;
++      u8              tid_avail       : 1;
++      u8              reserved        : 1;
+       unsigned int    devfn;          /* DEVFN part of the RID*/
+       u8 pfip[CLP_PFIP_NR_SEGMENTS];  /* pci function internal path */
+diff --git a/arch/s390/include/asm/pci_clp.h b/arch/s390/include/asm/pci_clp.h
+index f0c677ddd2706..14afb9ce91f3b 100644
+--- a/arch/s390/include/asm/pci_clp.h
++++ b/arch/s390/include/asm/pci_clp.h
+@@ -110,7 +110,8 @@ struct clp_req_query_pci {
+ struct clp_rsp_query_pci {
+       struct clp_rsp_hdr hdr;
+       u16 vfn;                        /* virtual fn number */
+-      u16                     :  3;
++      u16                     :  2;
++      u16 tid_avail           :  1;
+       u16 rid_avail           :  1;
+       u16 is_physfn           :  1;
+       u16 reserved1           :  1;
+@@ -130,8 +131,9 @@ struct clp_rsp_query_pci {
+       u64 edma;                       /* end dma as */
+ #define ZPCI_RID_MASK_DEVFN 0x00ff
+       u16 rid;                        /* BUS/DEVFN PCI address */
+-      u16 reserved0;
+-      u32 reserved[10];
++      u32 reserved0;
++      u16 tid;
++      u32 reserved[9];
+       u32 uid;                        /* user defined id */
+       u8 util_str[CLP_UTIL_STR_LEN];  /* utility string */
+       u32 reserved2[16];
+diff --git a/arch/s390/pci/pci_bus.c b/arch/s390/pci/pci_bus.c
+index daa5d7450c7d3..54879e773e4a3 100644
+--- a/arch/s390/pci/pci_bus.c
++++ b/arch/s390/pci/pci_bus.c
+@@ -232,13 +232,13 @@ static void zpci_bus_put(struct zpci_bus *zbus)
+       kref_put(&zbus->kref, zpci_bus_release);
+ }
+-static struct zpci_bus *zpci_bus_get(int pchid)
++static struct zpci_bus *zpci_bus_get(int topo, bool topo_is_tid)
+ {
+       struct zpci_bus *zbus;
+       mutex_lock(&zbus_list_lock);
+       list_for_each_entry(zbus, &zbus_list, bus_next) {
+-              if (pchid == zbus->pchid) {
++              if (topo_is_tid == zbus->topo_is_tid && topo == zbus->topo) {
+                       kref_get(&zbus->kref);
+                       goto out_unlock;
+               }
+@@ -249,7 +249,7 @@ static struct zpci_bus *zpci_bus_get(int pchid)
+       return zbus;
+ }
+-static struct zpci_bus *zpci_bus_alloc(int pchid)
++static struct zpci_bus *zpci_bus_alloc(int topo, bool topo_is_tid)
+ {
+       struct zpci_bus *zbus;
+@@ -257,7 +257,8 @@ static struct zpci_bus *zpci_bus_alloc(int pchid)
+       if (!zbus)
+               return NULL;
+-      zbus->pchid = pchid;
++      zbus->topo = topo;
++      zbus->topo_is_tid = topo_is_tid;
+       INIT_LIST_HEAD(&zbus->bus_next);
+       mutex_lock(&zbus_list_lock);
+       list_add_tail(&zbus->bus_next, &zbus_list);
+@@ -321,8 +322,9 @@ static int zpci_bus_add_device(struct zpci_bus *zbus, struct zpci_dev *zdev)
+ int zpci_bus_device_register(struct zpci_dev *zdev, struct pci_ops *ops)
+ {
++      bool topo_is_tid = zdev->tid_avail;
+       struct zpci_bus *zbus = NULL;
+-      int rc = -EBADF;
++      int topo, rc = -EBADF;
+       if (zpci_nb_devices == ZPCI_NR_DEVICES) {
+               pr_warn("Adding PCI function %08x failed because the configured limit of %d is reached\n",
+@@ -333,11 +335,12 @@ int zpci_bus_device_register(struct zpci_dev *zdev, struct pci_ops *ops)
+       if (zdev->devfn >= ZPCI_FUNCTIONS_PER_BUS)
+               return -EINVAL;
++      topo = topo_is_tid ? zdev->tid : zdev->pchid;
+       if (!s390_pci_no_rid && zdev->rid_available)
+-              zbus = zpci_bus_get(zdev->pchid);
++              zbus = zpci_bus_get(topo, topo_is_tid);
+       if (!zbus) {
+-              zbus = zpci_bus_alloc(zdev->pchid);
++              zbus = zpci_bus_alloc(topo, topo_is_tid);
+               if (!zbus)
+                       return -ENOMEM;
+       }
+diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
+index f7430086e9739..e222036874e51 100644
+--- a/arch/s390/pci/pci_clp.c
++++ b/arch/s390/pci/pci_clp.c
+@@ -170,6 +170,9 @@ static int clp_store_query_pci_fn(struct zpci_dev *zdev,
+               zdev->rid = response->rid;
+       if (!s390_pci_no_rid && zdev->rid_available)
+               zdev->devfn = response->rid & ZPCI_RID_MASK_DEVFN;
++      zdev->tid_avail = response->tid_avail;
++      if (zdev->tid_avail)
++              zdev->tid = response->tid;
+       memcpy(zdev->pfip, response->pfip, sizeof(zdev->pfip));
+       if (response->util_str_avail) {
+-- 
+2.43.0
+
diff --git a/queue-6.12/samples-bpf-fix-a-resource-leak.patch b/queue-6.12/samples-bpf-fix-a-resource-leak.patch
new file mode 100644 (file)
index 0000000..b7a5bb6
--- /dev/null
@@ -0,0 +1,39 @@
+From ed0a56b9ca5033a03cb572a6caa80e59b821cf34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 18:41:26 -0700
+Subject: samples/bpf: Fix a resource leak
+
+From: Zhu Jun <zhujun2@cmss.chinamobile.com>
+
+[ Upstream commit f3ef53174b23246fe9bc2bbc2542f3a3856fa1e2 ]
+
+The opened file should be closed in show_sockopts(), otherwise resource
+leak will occur that this problem was discovered by reading code
+
+Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20241010014126.2573-1-zhujun2@cmss.chinamobile.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/test_cgrp2_sock.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/samples/bpf/test_cgrp2_sock.c b/samples/bpf/test_cgrp2_sock.c
+index a0811df888f45..8ca2a445ffa15 100644
+--- a/samples/bpf/test_cgrp2_sock.c
++++ b/samples/bpf/test_cgrp2_sock.c
+@@ -178,8 +178,10 @@ static int show_sockopts(int family)
+               return 1;
+       }
+-      if (get_bind_to_device(sd, name, sizeof(name)) < 0)
++      if (get_bind_to_device(sd, name, sizeof(name)) < 0) {
++              close(sd);
+               return 1;
++      }
+       mark = get_somark(sd);
+       prio = get_priority(sd);
+-- 
+2.43.0
+
diff --git a/queue-6.12/sched_ext-add-a-missing-rcu_read_lock-unlock-pair-at.patch b/queue-6.12/sched_ext-add-a-missing-rcu_read_lock-unlock-pair-at.patch
new file mode 100644 (file)
index 0000000..0c40dba
--- /dev/null
@@ -0,0 +1,128 @@
+From a645f346c2beefb575749848f249566bb3850a31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2024 15:29:05 +0900
+Subject: sched_ext: add a missing rcu_read_lock/unlock pair at
+ scx_select_cpu_dfl()
+
+From: Changwoo Min <multics69@gmail.com>
+
+[ Upstream commit f39489fea677ad78ca4ce1ab2d204a6639b868dc ]
+
+When getting an LLC CPU mask in the default CPU selection policy,
+scx_select_cpu_dfl(), a pointer to the sched_domain is dereferenced
+using rcu_read_lock() without holding rcu_read_lock(). Such an unprotected
+dereference often causes the following warning and can cause an invalid
+memory access in the worst case.
+
+Therefore, protect dereference of a sched_domain pointer using a pair
+of rcu_read_lock() and unlock().
+
+[   20.996135] =============================
+[   20.996345] WARNING: suspicious RCU usage
+[   20.996563] 6.11.0-virtme #17 Tainted: G        W
+[   20.996576] -----------------------------
+[   20.996576] kernel/sched/ext.c:3323 suspicious rcu_dereference_check() usage!
+[   20.996576]
+[   20.996576] other info that might help us debug this:
+[   20.996576]
+[   20.996576]
+[   20.996576] rcu_scheduler_active = 2, debug_locks = 1
+[   20.996576] 4 locks held by kworker/8:1/140:
+[   20.996576]  #0: ffff8b18c00dd348 ((wq_completion)pm){+.+.}-{0:0}, at: process_one_work+0x4a0/0x590
+[   20.996576]  #1: ffffb3da01f67e58 ((work_completion)(&dev->power.work)){+.+.}-{0:0}, at: process_one_work+0x1ba/0x590
+[   20.996576]  #2: ffffffffa316f9f0 (&rcu_state.gp_wq){..-.}-{2:2}, at: swake_up_one+0x15/0x60
+[   20.996576]  #3: ffff8b1880398a60 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0x59/0x7d0
+[   20.996576]
+[   20.996576] stack backtrace:
+[   20.996576] CPU: 8 UID: 0 PID: 140 Comm: kworker/8:1 Tainted: G        W          6.11.0-virtme #17
+[   20.996576] Tainted: [W]=WARN
+[   20.996576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014
+[   20.996576] Workqueue: pm pm_runtime_work
+[   20.996576] Sched_ext: simple (disabling+all), task: runnable_at=-6ms
+[   20.996576] Call Trace:
+[   20.996576]  <IRQ>
+[   20.996576]  dump_stack_lvl+0x6f/0xb0
+[   20.996576]  lockdep_rcu_suspicious.cold+0x4e/0x96
+[   20.996576]  scx_select_cpu_dfl+0x234/0x260
+[   20.996576]  select_task_rq_scx+0xfb/0x190
+[   20.996576]  select_task_rq+0x47/0x110
+[   20.996576]  try_to_wake_up+0x110/0x7d0
+[   20.996576]  swake_up_one+0x39/0x60
+[   20.996576]  rcu_core+0xb08/0xe50
+[   20.996576]  ? srso_alias_return_thunk+0x5/0xfbef5
+[   20.996576]  ? mark_held_locks+0x40/0x70
+[   20.996576]  handle_softirqs+0xd3/0x410
+[   20.996576]  irq_exit_rcu+0x78/0xa0
+[   20.996576]  sysvec_apic_timer_interrupt+0x73/0x80
+[   20.996576]  </IRQ>
+[   20.996576]  <TASK>
+[   20.996576]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
+[   20.996576] RIP: 0010:_raw_spin_unlock_irqrestore+0x36/0x70
+[   20.996576] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 11 b4 36 ff 48 89 df e8 99 0d 37 ff f7 c5 00 02 00 00 75 17 9c 58 f6 c4 02 75 2b <65> ff 0d 5b 55 3c 5e 74 16 5b 5d e9 95 8e 28 00 e8 a5 ee 44 ff 9c
+[   20.996576] RSP: 0018:ffffb3da01f67d20 EFLAGS: 00000246
+[   20.996576] RAX: 0000000000000002 RBX: ffffffffa4640220 RCX: 0000000000000040
+[   20.996576] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffa1c7b27b
+[   20.996576] RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000000
+[   20.996576] R10: 0000000000000001 R11: 000000000000021c R12: 0000000000000246
+[   20.996576] R13: ffff8b1881363958 R14: 0000000000000000 R15: ffff8b1881363800
+[   20.996576]  ? _raw_spin_unlock_irqrestore+0x4b/0x70
+[   20.996576]  serial_port_runtime_resume+0xd4/0x1a0
+[   20.996576]  ? __pfx_serial_port_runtime_resume+0x10/0x10
+[   20.996576]  __rpm_callback+0x44/0x170
+[   20.996576]  ? __pfx_serial_port_runtime_resume+0x10/0x10
+[   20.996576]  rpm_callback+0x55/0x60
+[   20.996576]  ? __pfx_serial_port_runtime_resume+0x10/0x10
+[   20.996576]  rpm_resume+0x582/0x7b0
+[   20.996576]  pm_runtime_work+0x7c/0xb0
+[   20.996576]  process_one_work+0x1fb/0x590
+[   20.996576]  worker_thread+0x18e/0x350
+[   20.996576]  ? __pfx_worker_thread+0x10/0x10
+[   20.996576]  kthread+0xe2/0x110
+[   20.996576]  ? __pfx_kthread+0x10/0x10
+[   20.996576]  ret_from_fork+0x34/0x50
+[   20.996576]  ? __pfx_kthread+0x10/0x10
+[   20.996576]  ret_from_fork_asm+0x1a/0x30
+[   20.996576]  </TASK>
+[   21.056592] sched_ext: BPF scheduler "simple" disabled (unregistered from user space)
+
+Signed-off-by: Changwoo Min <changwoo@igalia.com>
+Acked-by: Andrea Righi <arighi@nvidia.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/ext.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
+index 16613631543f1..79bb18651cdb8 100644
+--- a/kernel/sched/ext.c
++++ b/kernel/sched/ext.c
+@@ -3105,6 +3105,12 @@ static s32 scx_select_cpu_dfl(struct task_struct *p, s32 prev_cpu,
+       *found = false;
++
++      /*
++       * This is necessary to protect llc_cpus.
++       */
++      rcu_read_lock();
++
+       /*
+        * If WAKE_SYNC, the waker's local DSQ is empty, and the system is
+        * under utilized, wake up @p to the local DSQ of the waker. Checking
+@@ -3147,9 +3153,12 @@ static s32 scx_select_cpu_dfl(struct task_struct *p, s32 prev_cpu,
+       if (cpu >= 0)
+               goto cpu_found;
++      rcu_read_unlock();
+       return prev_cpu;
+ cpu_found:
++      rcu_read_unlock();
++
+       *found = true;
+       return cpu;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/scsi-hisi_sas-add-cond_resched-for-no-forced-preempt.patch b/queue-6.12/scsi-hisi_sas-add-cond_resched-for-no-forced-preempt.patch
new file mode 100644 (file)
index 0000000..20aac55
--- /dev/null
@@ -0,0 +1,87 @@
+From c35bb0c903981a4c028e82037c3adb3297a9f2ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 10:18:16 +0800
+Subject: scsi: hisi_sas: Add cond_resched() for no forced preemption model
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit 2233c4a0b948211743659b24c13d6bd059fa75fc ]
+
+For no forced preemption model kernel, in the scenario where the
+expander is connected to 12 high performance SAS SSDs, the following
+call trace may occur:
+
+[  214.409199][  C240] watchdog: BUG: soft lockup - CPU#240 stuck for 22s! [irq/149-hisi_sa:3211]
+[  214.568533][  C240] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--)
+[  214.575224][  C240] pc : fput_many+0x8c/0xdc
+[  214.579480][  C240] lr : fput+0x1c/0xf0
+[  214.583302][  C240] sp : ffff80002de2b900
+[  214.587298][  C240] x29: ffff80002de2b900 x28: ffff1082aa412000
+[  214.593291][  C240] x27: ffff3062a0348c08 x26: ffff80003a9f6000
+[  214.599284][  C240] x25: ffff1062bbac5c40 x24: 0000000000001000
+[  214.605277][  C240] x23: 000000000000000a x22: 0000000000000001
+[  214.611270][  C240] x21: 0000000000001000 x20: 0000000000000000
+[  214.617262][  C240] x19: ffff3062a41ae580 x18: 0000000000010000
+[  214.623255][  C240] x17: 0000000000000001 x16: ffffdb3a6efe5fc0
+[  214.629248][  C240] x15: ffffffffffffffff x14: 0000000003ffffff
+[  214.635241][  C240] x13: 000000000000ffff x12: 000000000000029c
+[  214.641234][  C240] x11: 0000000000000006 x10: ffff80003a9f7fd0
+[  214.647226][  C240] x9 : ffffdb3a6f0482fc x8 : 0000000000000001
+[  214.653219][  C240] x7 : 0000000000000002 x6 : 0000000000000080
+[  214.659212][  C240] x5 : ffff55480ee9b000 x4 : fffffde7f94c6554
+[  214.665205][  C240] x3 : 0000000000000002 x2 : 0000000000000020
+[  214.671198][  C240] x1 : 0000000000000021 x0 : ffff3062a41ae5b8
+[  214.677191][  C240] Call trace:
+[  214.680320][  C240]  fput_many+0x8c/0xdc
+[  214.684230][  C240]  fput+0x1c/0xf0
+[  214.687707][  C240]  aio_complete_rw+0xd8/0x1fc
+[  214.692225][  C240]  blkdev_bio_end_io+0x98/0x140
+[  214.696917][  C240]  bio_endio+0x160/0x1bc
+[  214.701001][  C240]  blk_update_request+0x1c8/0x3bc
+[  214.705867][  C240]  scsi_end_request+0x3c/0x1f0
+[  214.710471][  C240]  scsi_io_completion+0x7c/0x1a0
+[  214.715249][  C240]  scsi_finish_command+0x104/0x140
+[  214.720200][  C240]  scsi_softirq_done+0x90/0x180
+[  214.724892][  C240]  blk_mq_complete_request+0x5c/0x70
+[  214.730016][  C240]  scsi_mq_done+0x48/0xac
+[  214.734194][  C240]  sas_scsi_task_done+0xbc/0x16c [libsas]
+[  214.739758][  C240]  slot_complete_v3_hw+0x260/0x760 [hisi_sas_v3_hw]
+[  214.746185][  C240]  cq_thread_v3_hw+0xbc/0x190 [hisi_sas_v3_hw]
+[  214.752179][  C240]  irq_thread_fn+0x34/0xa4
+[  214.756435][  C240]  irq_thread+0xc4/0x130
+[  214.760520][  C240]  kthread+0x108/0x13c
+[  214.764430][  C240]  ret_from_fork+0x10/0x18
+
+This is because in the hisi_sas driver, both the hardware interrupt
+handler and the interrupt thread are executed on the same CPU. In the
+performance test scenario, function irq_wait_for_interrupt() will always
+return 0 if lots of interrupts occurs and the CPU will be continuously
+consumed. As a result, the CPU cannot run the watchdog thread. When the
+watchdog time exceeds the specified time, call trace occurs.
+
+To fix it, add cond_resched() to execute the watchdog thread.
+
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Link: https://lore.kernel.org/r/20241008021822.2617339-8-liyihang9@huawei.com
+Reviewed-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 4cd3a3eab6f1c..a7401bade099a 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -2493,6 +2493,7 @@ static int complete_v3_hw(struct hisi_sas_cq *cq)
+       /* update rd_point */
+       cq->rd_point = rd_point;
+       hisi_sas_write32(hisi_hba, COMPL_Q_0_RD_PTR + (0x14 * queue), rd_point);
++      cond_resched();
+       return completed;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/scsi-hisi_sas-create-all-dump-files-during-debugfs-i.patch b/queue-6.12/scsi-hisi_sas-create-all-dump-files-during-debugfs-i.patch
new file mode 100644 (file)
index 0000000..d1e31ca
--- /dev/null
@@ -0,0 +1,367 @@
+From bb9dea412f1941c9c4a7c5cd07462eea9a389440 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 10:18:21 +0800
+Subject: scsi: hisi_sas: Create all dump files during debugfs initialization
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit 9f564f15f88490b484e02442dc4c4b11640ea172 ]
+
+For the current debugfs of hisi_sas, after user triggers dump, the
+driver allocate memory space to save the register information and create
+debugfs files to display the saved information. In this process, the
+debugfs files created after each dump.
+
+Therefore, when the dump is triggered while the driver is unbind, the
+following hang occurs:
+
+[67840.853907] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0
+[67840.862947] Mem abort info:
+[67840.865855]   ESR = 0x0000000096000004
+[67840.869713]   EC = 0x25: DABT (current EL), IL = 32 bits
+[67840.875125]   SET = 0, FnV = 0
+[67840.878291]   EA = 0, S1PTW = 0
+[67840.881545]   FSC = 0x04: level 0 translation fault
+[67840.886528] Data abort info:
+[67840.889524]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
+[67840.895117]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+[67840.900284]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+[67840.905709] user pgtable: 4k pages, 48-bit VAs, pgdp=0000002803a1f000
+[67840.912263] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000
+[67840.919177] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
+[67840.996435] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[67841.003628] pc : down_write+0x30/0x98
+[67841.007546] lr : start_creating.part.0+0x60/0x198
+[67841.012495] sp : ffff8000b979ba20
+[67841.016046] x29: ffff8000b979ba20 x28: 0000000000000010 x27: 0000000000024b40
+[67841.023412] x26: 0000000000000012 x25: ffff20202b355ae8 x24: ffff20202b35a8c8
+[67841.030779] x23: ffffa36877928208 x22: ffffa368b4972240 x21: ffff8000b979bb18
+[67841.038147] x20: ffff00281dc1e3c0 x19: fffffffffffffffe x18: 0000000000000020
+[67841.045515] x17: 0000000000000000 x16: ffffa368b128a530 x15: ffffffffffffffff
+[67841.052888] x14: ffff8000b979bc18 x13: ffffffffffffffff x12: ffff8000b979bb18
+[67841.060263] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa368b1289b18
+[67841.067640] x8 : 0000000000000012 x7 : 0000000000000000 x6 : 00000000000003a9
+[67841.075014] x5 : 0000000000000000 x4 : ffff002818c5cb00 x3 : 0000000000000001
+[67841.082388] x2 : 0000000000000000 x1 : ffff002818c5cb00 x0 : 00000000000000a0
+[67841.089759] Call trace:
+[67841.092456]  down_write+0x30/0x98
+[67841.096017]  start_creating.part.0+0x60/0x198
+[67841.100613]  debugfs_create_dir+0x48/0x1f8
+[67841.104950]  debugfs_create_files_v3_hw+0x88/0x348 [hisi_sas_v3_hw]
+[67841.111447]  debugfs_snapshot_regs_v3_hw+0x708/0x798 [hisi_sas_v3_hw]
+[67841.118111]  debugfs_trigger_dump_v3_hw_write+0x9c/0x120 [hisi_sas_v3_hw]
+[67841.125115]  full_proxy_write+0x68/0xc8
+[67841.129175]  vfs_write+0xd8/0x3f0
+[67841.132708]  ksys_write+0x70/0x108
+[67841.136317]  __arm64_sys_write+0x24/0x38
+[67841.140440]  invoke_syscall+0x50/0x128
+[67841.144385]  el0_svc_common.constprop.0+0xc8/0xf0
+[67841.149273]  do_el0_svc+0x24/0x38
+[67841.152773]  el0_svc+0x38/0xd8
+[67841.156009]  el0t_64_sync_handler+0xc0/0xc8
+[67841.160361]  el0t_64_sync+0x1a4/0x1a8
+[67841.164189] Code: b9000882 d2800002 d2800023 f9800011 (c85ffc05)
+[67841.170443] ---[ end trace 0000000000000000 ]---
+
+To fix this issue, create all directories and files during debugfs
+initialization. In this way, the driver only needs to allocate memory
+space to save information each time the user triggers dumping.
+
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Link: https://lore.kernel.org/r/20241008021822.2617339-13-liyihang9@huawei.com
+Reviewed-by: Xingui Yang <yangxingui@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 99 ++++++++++++++++++++------
+ 1 file changed, 77 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index a7401bade099a..cd394d8c9f07f 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -3551,6 +3551,11 @@ debugfs_to_reg_name_v3_hw(int off, int base_off,
+       return NULL;
+ }
++static bool debugfs_dump_is_generated_v3_hw(void *p)
++{
++      return p ? true : false;
++}
++
+ static void debugfs_print_reg_v3_hw(u32 *regs_val, struct seq_file *s,
+                                   const struct hisi_sas_debugfs_reg *reg)
+ {
+@@ -3576,6 +3581,9 @@ static int debugfs_global_v3_hw_show(struct seq_file *s, void *p)
+ {
+       struct hisi_sas_debugfs_regs *global = s->private;
++      if (!debugfs_dump_is_generated_v3_hw(global->data))
++              return -EPERM;
++
+       debugfs_print_reg_v3_hw(global->data, s,
+                               &debugfs_global_reg);
+@@ -3587,6 +3595,9 @@ static int debugfs_axi_v3_hw_show(struct seq_file *s, void *p)
+ {
+       struct hisi_sas_debugfs_regs *axi = s->private;
++      if (!debugfs_dump_is_generated_v3_hw(axi->data))
++              return -EPERM;
++
+       debugfs_print_reg_v3_hw(axi->data, s,
+                               &debugfs_axi_reg);
+@@ -3598,6 +3609,9 @@ static int debugfs_ras_v3_hw_show(struct seq_file *s, void *p)
+ {
+       struct hisi_sas_debugfs_regs *ras = s->private;
++      if (!debugfs_dump_is_generated_v3_hw(ras->data))
++              return -EPERM;
++
+       debugfs_print_reg_v3_hw(ras->data, s,
+                               &debugfs_ras_reg);
+@@ -3610,6 +3624,9 @@ static int debugfs_port_v3_hw_show(struct seq_file *s, void *p)
+       struct hisi_sas_debugfs_port *port = s->private;
+       const struct hisi_sas_debugfs_reg *reg_port = &debugfs_port_reg;
++      if (!debugfs_dump_is_generated_v3_hw(port->data))
++              return -EPERM;
++
+       debugfs_print_reg_v3_hw(port->data, s, reg_port);
+       return 0;
+@@ -3665,6 +3682,9 @@ static int debugfs_cq_v3_hw_show(struct seq_file *s, void *p)
+       struct hisi_sas_debugfs_cq *debugfs_cq = s->private;
+       int slot;
++      if (!debugfs_dump_is_generated_v3_hw(debugfs_cq->complete_hdr))
++              return -EPERM;
++
+       for (slot = 0; slot < HISI_SAS_QUEUE_SLOTS; slot++)
+               debugfs_cq_show_slot_v3_hw(s, slot, debugfs_cq);
+@@ -3686,8 +3706,12 @@ static void debugfs_dq_show_slot_v3_hw(struct seq_file *s, int slot,
+ static int debugfs_dq_v3_hw_show(struct seq_file *s, void *p)
+ {
++      struct hisi_sas_debugfs_dq *debugfs_dq = s->private;
+       int slot;
++      if (!debugfs_dump_is_generated_v3_hw(debugfs_dq->hdr))
++              return -EPERM;
++
+       for (slot = 0; slot < HISI_SAS_QUEUE_SLOTS; slot++)
+               debugfs_dq_show_slot_v3_hw(s, slot, s->private);
+@@ -3701,6 +3725,9 @@ static int debugfs_iost_v3_hw_show(struct seq_file *s, void *p)
+       struct hisi_sas_iost *iost = debugfs_iost->iost;
+       int i, max_command_entries = HISI_SAS_MAX_COMMANDS;
++      if (!debugfs_dump_is_generated_v3_hw(iost))
++              return -EPERM;
++
+       for (i = 0; i < max_command_entries; i++, iost++) {
+               __le64 *data = &iost->qw0;
+@@ -3720,6 +3747,9 @@ static int debugfs_iost_cache_v3_hw_show(struct seq_file *s, void *p)
+       int i, tab_idx;
+       __le64 *iost;
++      if (!debugfs_dump_is_generated_v3_hw(iost_cache))
++              return -EPERM;
++
+       for (i = 0; i < HISI_SAS_IOST_ITCT_CACHE_NUM; i++, iost_cache++) {
+               /*
+                * Data struct of IOST cache:
+@@ -3743,6 +3773,9 @@ static int debugfs_itct_v3_hw_show(struct seq_file *s, void *p)
+       struct hisi_sas_debugfs_itct *debugfs_itct = s->private;
+       struct hisi_sas_itct *itct = debugfs_itct->itct;
++      if (!debugfs_dump_is_generated_v3_hw(itct))
++              return -EPERM;
++
+       for (i = 0; i < HISI_SAS_MAX_ITCT_ENTRIES; i++, itct++) {
+               __le64 *data = &itct->qw0;
+@@ -3762,6 +3795,9 @@ static int debugfs_itct_cache_v3_hw_show(struct seq_file *s, void *p)
+       int i, tab_idx;
+       __le64 *itct;
++      if (!debugfs_dump_is_generated_v3_hw(itct_cache))
++              return -EPERM;
++
+       for (i = 0; i < HISI_SAS_IOST_ITCT_CACHE_NUM; i++, itct_cache++) {
+               /*
+                * Data struct of ITCT cache:
+@@ -3779,10 +3815,9 @@ static int debugfs_itct_cache_v3_hw_show(struct seq_file *s, void *p)
+ }
+ DEFINE_SHOW_ATTRIBUTE(debugfs_itct_cache_v3_hw);
+-static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)
++static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba, int index)
+ {
+       u64 *debugfs_timestamp;
+-      int dump_index = hisi_hba->debugfs_dump_index;
+       struct dentry *dump_dentry;
+       struct dentry *dentry;
+       char name[256];
+@@ -3790,17 +3825,17 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)
+       int c;
+       int d;
+-      snprintf(name, 256, "%d", dump_index);
++      snprintf(name, 256, "%d", index);
+       dump_dentry = debugfs_create_dir(name, hisi_hba->debugfs_dump_dentry);
+-      debugfs_timestamp = &hisi_hba->debugfs_timestamp[dump_index];
++      debugfs_timestamp = &hisi_hba->debugfs_timestamp[index];
+       debugfs_create_u64("timestamp", 0400, dump_dentry,
+                          debugfs_timestamp);
+       debugfs_create_file("global", 0400, dump_dentry,
+-                          &hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL],
++                          &hisi_hba->debugfs_regs[index][DEBUGFS_GLOBAL],
+                           &debugfs_global_v3_hw_fops);
+       /* Create port dir and files */
+@@ -3809,7 +3844,7 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)
+               snprintf(name, 256, "%d", p);
+               debugfs_create_file(name, 0400, dentry,
+-                                  &hisi_hba->debugfs_port_reg[dump_index][p],
++                                  &hisi_hba->debugfs_port_reg[index][p],
+                                   &debugfs_port_v3_hw_fops);
+       }
+@@ -3819,7 +3854,7 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)
+               snprintf(name, 256, "%d", c);
+               debugfs_create_file(name, 0400, dentry,
+-                                  &hisi_hba->debugfs_cq[dump_index][c],
++                                  &hisi_hba->debugfs_cq[index][c],
+                                   &debugfs_cq_v3_hw_fops);
+       }
+@@ -3829,32 +3864,32 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)
+               snprintf(name, 256, "%d", d);
+               debugfs_create_file(name, 0400, dentry,
+-                                  &hisi_hba->debugfs_dq[dump_index][d],
++                                  &hisi_hba->debugfs_dq[index][d],
+                                   &debugfs_dq_v3_hw_fops);
+       }
+       debugfs_create_file("iost", 0400, dump_dentry,
+-                          &hisi_hba->debugfs_iost[dump_index],
++                          &hisi_hba->debugfs_iost[index],
+                           &debugfs_iost_v3_hw_fops);
+       debugfs_create_file("iost_cache", 0400, dump_dentry,
+-                          &hisi_hba->debugfs_iost_cache[dump_index],
++                          &hisi_hba->debugfs_iost_cache[index],
+                           &debugfs_iost_cache_v3_hw_fops);
+       debugfs_create_file("itct", 0400, dump_dentry,
+-                          &hisi_hba->debugfs_itct[dump_index],
++                          &hisi_hba->debugfs_itct[index],
+                           &debugfs_itct_v3_hw_fops);
+       debugfs_create_file("itct_cache", 0400, dump_dentry,
+-                          &hisi_hba->debugfs_itct_cache[dump_index],
++                          &hisi_hba->debugfs_itct_cache[index],
+                           &debugfs_itct_cache_v3_hw_fops);
+       debugfs_create_file("axi", 0400, dump_dentry,
+-                          &hisi_hba->debugfs_regs[dump_index][DEBUGFS_AXI],
++                          &hisi_hba->debugfs_regs[index][DEBUGFS_AXI],
+                           &debugfs_axi_v3_hw_fops);
+       debugfs_create_file("ras", 0400, dump_dentry,
+-                          &hisi_hba->debugfs_regs[dump_index][DEBUGFS_RAS],
++                          &hisi_hba->debugfs_regs[index][DEBUGFS_RAS],
+                           &debugfs_ras_v3_hw_fops);
+ }
+@@ -4517,22 +4552,34 @@ static void debugfs_release_v3_hw(struct hisi_hba *hisi_hba, int dump_index)
+       int i;
+       devm_kfree(dev, hisi_hba->debugfs_iost_cache[dump_index].cache);
++      hisi_hba->debugfs_iost_cache[dump_index].cache = NULL;
+       devm_kfree(dev, hisi_hba->debugfs_itct_cache[dump_index].cache);
++      hisi_hba->debugfs_itct_cache[dump_index].cache = NULL;
+       devm_kfree(dev, hisi_hba->debugfs_iost[dump_index].iost);
++      hisi_hba->debugfs_iost[dump_index].iost = NULL;
+       devm_kfree(dev, hisi_hba->debugfs_itct[dump_index].itct);
++      hisi_hba->debugfs_itct[dump_index].itct = NULL;
+-      for (i = 0; i < hisi_hba->queue_count; i++)
++      for (i = 0; i < hisi_hba->queue_count; i++) {
+               devm_kfree(dev, hisi_hba->debugfs_dq[dump_index][i].hdr);
++              hisi_hba->debugfs_dq[dump_index][i].hdr = NULL;
++      }
+-      for (i = 0; i < hisi_hba->queue_count; i++)
++      for (i = 0; i < hisi_hba->queue_count; i++) {
+               devm_kfree(dev,
+                          hisi_hba->debugfs_cq[dump_index][i].complete_hdr);
++              hisi_hba->debugfs_cq[dump_index][i].complete_hdr = NULL;
++      }
+-      for (i = 0; i < DEBUGFS_REGS_NUM; i++)
++      for (i = 0; i < DEBUGFS_REGS_NUM; i++) {
+               devm_kfree(dev, hisi_hba->debugfs_regs[dump_index][i].data);
++              hisi_hba->debugfs_regs[dump_index][i].data = NULL;
++      }
+-      for (i = 0; i < hisi_hba->n_phy; i++)
++      for (i = 0; i < hisi_hba->n_phy; i++) {
+               devm_kfree(dev, hisi_hba->debugfs_port_reg[dump_index][i].data);
++              hisi_hba->debugfs_port_reg[dump_index][i].data = NULL;
++      }
+ }
+ static const struct hisi_sas_debugfs_reg *debugfs_reg_array_v3_hw[DEBUGFS_REGS_NUM] = {
+@@ -4659,8 +4706,6 @@ static int debugfs_snapshot_regs_v3_hw(struct hisi_hba *hisi_hba)
+       debugfs_snapshot_itct_reg_v3_hw(hisi_hba);
+       debugfs_snapshot_iost_reg_v3_hw(hisi_hba);
+-      debugfs_create_files_v3_hw(hisi_hba);
+-
+       debugfs_snapshot_restore_v3_hw(hisi_hba);
+       hisi_hba->debugfs_dump_index++;
+@@ -4744,6 +4789,17 @@ static void debugfs_bist_init_v3_hw(struct hisi_hba *hisi_hba)
+       hisi_hba->debugfs_bist_linkrate = SAS_LINK_RATE_1_5_GBPS;
+ }
++static void debugfs_dump_init_v3_hw(struct hisi_hba *hisi_hba)
++{
++      int i;
++
++      hisi_hba->debugfs_dump_dentry =
++                      debugfs_create_dir("dump", hisi_hba->debugfs_dir);
++
++      for (i = 0; i < hisi_sas_debugfs_dump_count; i++)
++              debugfs_create_files_v3_hw(hisi_hba, i);
++}
++
+ static void debugfs_exit_v3_hw(struct hisi_hba *hisi_hba)
+ {
+       debugfs_remove_recursive(hisi_hba->debugfs_dir);
+@@ -4764,8 +4820,7 @@ static void debugfs_init_v3_hw(struct hisi_hba *hisi_hba)
+       /* create bist structures */
+       debugfs_bist_init_v3_hw(hisi_hba);
+-      hisi_hba->debugfs_dump_dentry =
+-                      debugfs_create_dir("dump", hisi_hba->debugfs_dir);
++      debugfs_dump_init_v3_hw(hisi_hba);
+       debugfs_phy_down_cnt_init_v3_hw(hisi_hba);
+       debugfs_fifo_init_v3_hw(hisi_hba);
+-- 
+2.43.0
+
diff --git a/queue-6.12/scsi-lpfc-call-lpfc_sli4_queue_unset-in-restart-and-.patch b/queue-6.12/scsi-lpfc-call-lpfc_sli4_queue_unset-in-restart-and-.patch
new file mode 100644 (file)
index 0000000..923dd51
--- /dev/null
@@ -0,0 +1,184 @@
+From 646274d387f52defecbc51188181d7ee6ab4f6ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 15:32:11 -0700
+Subject: scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit d35f7672715d1ff3e3ad9bb4ae6ac6cb484200fe ]
+
+During initialization, the driver allocates wq->pring in lpfc_wq_create
+and lpfc_sli4_queue_unset() is the only place where kfree(wq->pring) is
+called.
+
+There is a possible memory leak in lpfc_sli_brdrestart_s4() (restart)
+and lpfc_pci_remove_one_s4() (rmmod) paths because there are no calls to
+lpfc_sli4_queue_unset() to kfree() the wq->pring.
+
+Fix by inserting a call to lpfc_sli4_queue_unset() in
+lpfc_sli_brdrestart_s4() and lpfc_sli4_hba_unset() routines.  Also, add
+a check for the SLI_ACTIVE flag before issuing the Q_DESTROY mailbox
+command.  If not set, then the mailbox command will obviously fail.  In
+such cases, skip issuing the mailbox command and only execute the driver
+resource clean up portions of the lpfc_*q_destroy routines.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20241031223219.152342-4-justintee8345@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_init.c |  2 ++
+ drivers/scsi/lpfc/lpfc_sli.c  | 41 ++++++++++++++++++++++++++++++-----
+ 2 files changed, 38 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 0dd451009b079..a3658ef1141b2 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -13518,6 +13518,8 @@ lpfc_sli4_hba_unset(struct lpfc_hba *phba)
+       /* Disable FW logging to host memory */
+       lpfc_ras_stop_fwlog(phba);
++      lpfc_sli4_queue_unset(phba);
++
+       /* Reset SLI4 HBA FCoE function */
+       lpfc_pci_function_reset(phba);
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 2ec6e55771b45..6748fba48a07e 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -5291,6 +5291,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba)
+                       "0296 Restart HBA Data: x%x x%x\n",
+                       phba->pport->port_state, psli->sli_flag);
++      lpfc_sli4_queue_unset(phba);
++
+       rc = lpfc_sli4_brdreset(phba);
+       if (rc) {
+               phba->link_state = LPFC_HBA_ERROR;
+@@ -17625,6 +17627,9 @@ lpfc_eq_destroy(struct lpfc_hba *phba, struct lpfc_queue *eq)
+       if (!eq)
+               return -ENODEV;
++      if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
++              goto list_remove;
++
+       mbox = mempool_alloc(eq->phba->mbox_mem_pool, GFP_KERNEL);
+       if (!mbox)
+               return -ENOMEM;
+@@ -17651,10 +17656,12 @@ lpfc_eq_destroy(struct lpfc_hba *phba, struct lpfc_queue *eq)
+                               shdr_status, shdr_add_status, rc);
+               status = -ENXIO;
+       }
++      mempool_free(mbox, eq->phba->mbox_mem_pool);
++list_remove:
+       /* Remove eq from any list */
+       list_del_init(&eq->list);
+-      mempool_free(mbox, eq->phba->mbox_mem_pool);
++
+       return status;
+ }
+@@ -17682,6 +17689,10 @@ lpfc_cq_destroy(struct lpfc_hba *phba, struct lpfc_queue *cq)
+       /* sanity check on queue memory */
+       if (!cq)
+               return -ENODEV;
++
++      if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
++              goto list_remove;
++
+       mbox = mempool_alloc(cq->phba->mbox_mem_pool, GFP_KERNEL);
+       if (!mbox)
+               return -ENOMEM;
+@@ -17707,9 +17718,11 @@ lpfc_cq_destroy(struct lpfc_hba *phba, struct lpfc_queue *cq)
+                               shdr_status, shdr_add_status, rc);
+               status = -ENXIO;
+       }
++      mempool_free(mbox, cq->phba->mbox_mem_pool);
++
++list_remove:
+       /* Remove cq from any list */
+       list_del_init(&cq->list);
+-      mempool_free(mbox, cq->phba->mbox_mem_pool);
+       return status;
+ }
+@@ -17737,6 +17750,10 @@ lpfc_mq_destroy(struct lpfc_hba *phba, struct lpfc_queue *mq)
+       /* sanity check on queue memory */
+       if (!mq)
+               return -ENODEV;
++
++      if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
++              goto list_remove;
++
+       mbox = mempool_alloc(mq->phba->mbox_mem_pool, GFP_KERNEL);
+       if (!mbox)
+               return -ENOMEM;
+@@ -17762,9 +17779,11 @@ lpfc_mq_destroy(struct lpfc_hba *phba, struct lpfc_queue *mq)
+                               shdr_status, shdr_add_status, rc);
+               status = -ENXIO;
+       }
++      mempool_free(mbox, mq->phba->mbox_mem_pool);
++
++list_remove:
+       /* Remove mq from any list */
+       list_del_init(&mq->list);
+-      mempool_free(mbox, mq->phba->mbox_mem_pool);
+       return status;
+ }
+@@ -17792,6 +17811,10 @@ lpfc_wq_destroy(struct lpfc_hba *phba, struct lpfc_queue *wq)
+       /* sanity check on queue memory */
+       if (!wq)
+               return -ENODEV;
++
++      if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
++              goto list_remove;
++
+       mbox = mempool_alloc(wq->phba->mbox_mem_pool, GFP_KERNEL);
+       if (!mbox)
+               return -ENOMEM;
+@@ -17816,11 +17839,13 @@ lpfc_wq_destroy(struct lpfc_hba *phba, struct lpfc_queue *wq)
+                               shdr_status, shdr_add_status, rc);
+               status = -ENXIO;
+       }
++      mempool_free(mbox, wq->phba->mbox_mem_pool);
++
++list_remove:
+       /* Remove wq from any list */
+       list_del_init(&wq->list);
+       kfree(wq->pring);
+       wq->pring = NULL;
+-      mempool_free(mbox, wq->phba->mbox_mem_pool);
+       return status;
+ }
+@@ -17850,6 +17875,10 @@ lpfc_rq_destroy(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+       /* sanity check on queue memory */
+       if (!hrq || !drq)
+               return -ENODEV;
++
++      if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
++              goto list_remove;
++
+       mbox = mempool_alloc(hrq->phba->mbox_mem_pool, GFP_KERNEL);
+       if (!mbox)
+               return -ENOMEM;
+@@ -17890,9 +17919,11 @@ lpfc_rq_destroy(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+                               shdr_status, shdr_add_status, rc);
+               status = -ENXIO;
+       }
++      mempool_free(mbox, hrq->phba->mbox_mem_pool);
++
++list_remove:
+       list_del_init(&hrq->list);
+       list_del_init(&drq->list);
+-      mempool_free(mbox, hrq->phba->mbox_mem_pool);
+       return status;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/scsi-lpfc-check-sli_active-flag-in-fdmi-cmpl-before-.patch b/queue-6.12/scsi-lpfc-check-sli_active-flag-in-fdmi-cmpl-before-.patch
new file mode 100644 (file)
index 0000000..4e3c7d9
--- /dev/null
@@ -0,0 +1,77 @@
+From b36d296203ca325d9dc20fad088881053581fa36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 15:32:13 -0700
+Subject: scsi: lpfc: Check SLI_ACTIVE flag in FDMI cmpl before submitting
+ follow up FDMI
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 98f8d3588097e321be70f83b844fa67d4828fe5c ]
+
+The lpfc_cmpl_ct_disc_fdmi() routine has incorrect logic that treats an
+FDMI completion with error LOCAL_REJECT/SLI_ABORTED as a success status.
+Under the erroneous assumption of successful completion, the routine
+proceeds to issue follow up FDMI commands, which may never complete if
+the HBA is in an errata state as indicated by the errored completion
+status.  Fix by freeing FDMI cmd resources and early return when the
+LPFC_SLI_ACTIVE flag is not set and a LOCAL_REJECT/SLI_ABORTED or
+SLI_DOWN status is received.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20241031223219.152342-6-justintee8345@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_ct.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index 134bc96dd1340..ce3a1f42713dd 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -2226,6 +2226,11 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+               ulp_status, ulp_word4, latt);
+       if (latt || ulp_status) {
++              lpfc_printf_vlog(vport, KERN_WARNING, LOG_DISCOVERY,
++                               "0229 FDMI cmd %04x failed, latt = %d "
++                               "ulp_status: (x%x/x%x), sli_flag x%x\n",
++                               be16_to_cpu(fdmi_cmd), latt, ulp_status,
++                               ulp_word4, phba->sli.sli_flag);
+               /* Look for a retryable error */
+               if (ulp_status == IOSTAT_LOCAL_REJECT) {
+@@ -2234,8 +2239,16 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+                       case IOERR_SLI_DOWN:
+                               /* Driver aborted this IO.  No retry as error
+                                * is likely Offline->Online or some adapter
+-                               * error.  Recovery will try again.
++                               * error.  Recovery will try again, but if port
++                               * is not active there's no point to continue
++                               * issuing follow up FDMI commands.
+                                */
++                              if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE)) {
++                                      free_ndlp = cmdiocb->ndlp;
++                                      lpfc_ct_free_iocb(phba, cmdiocb);
++                                      lpfc_nlp_put(free_ndlp);
++                                      return;
++                              }
+                               break;
+                       case IOERR_ABORT_IN_PROGRESS:
+                       case IOERR_SEQUENCE_TIMEOUT:
+@@ -2256,12 +2269,6 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+                               break;
+                       }
+               }
+-
+-              lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
+-                               "0229 FDMI cmd %04x latt = %d "
+-                               "ulp_status: x%x, rid x%x\n",
+-                               be16_to_cpu(fdmi_cmd), latt, ulp_status,
+-                               ulp_word4);
+       }
+       free_ndlp = cmdiocb->ndlp;
+-- 
+2.43.0
+
diff --git a/queue-6.12/scsi-lpfc-prevent-ndlp-reference-count-underflow-in-.patch b/queue-6.12/scsi-lpfc-prevent-ndlp-reference-count-underflow-in-.patch
new file mode 100644 (file)
index 0000000..6138c20
--- /dev/null
@@ -0,0 +1,104 @@
+From e8d21d83daeca8f1fbfe20b974ca39ed2c5552e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 15:32:15 -0700
+Subject: scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo
+ callback
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 4281f44ea8bfedd25938a0031bebba1473ece9ad ]
+
+Current dev_loss_tmo handling checks whether there has been a previous
+call to unregister with SCSI transport.  If so, the NDLP kref count is
+decremented a second time in dev_loss_tmo as the final kref release.
+However, this can sometimes result in a reference count underflow if
+there is also a race to unregister with NVMe transport as well.  Add a
+check for NVMe transport registration before decrementing the final
+kref.  If NVMe transport is still registered, then the NVMe transport
+unregistration is designated as the final kref decrement.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20241031223219.152342-8-justintee8345@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 36 +++++++++++++++++++++-----------
+ 1 file changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index 9241075f72fa4..6e8d8a96c54fb 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -155,6 +155,7 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)
+       struct lpfc_hba   *phba;
+       struct lpfc_work_evt *evtp;
+       unsigned long iflags;
++      bool nvme_reg = false;
+       ndlp = ((struct lpfc_rport_data *)rport->dd_data)->pnode;
+       if (!ndlp)
+@@ -177,38 +178,49 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)
+       /* Don't schedule a worker thread event if the vport is going down. */
+       if (test_bit(FC_UNLOADING, &vport->load_flag) ||
+           !test_bit(HBA_SETUP, &phba->hba_flag)) {
++
+               spin_lock_irqsave(&ndlp->lock, iflags);
+               ndlp->rport = NULL;
++              if (ndlp->fc4_xpt_flags & NVME_XPT_REGD)
++                      nvme_reg = true;
++
+               /* The scsi_transport is done with the rport so lpfc cannot
+-               * call to unregister. Remove the scsi transport reference
+-               * and clean up the SCSI transport node details.
++               * call to unregister.
+                */
+-              if (ndlp->fc4_xpt_flags & (NLP_XPT_REGD | SCSI_XPT_REGD)) {
++              if (ndlp->fc4_xpt_flags & SCSI_XPT_REGD) {
+                       ndlp->fc4_xpt_flags &= ~SCSI_XPT_REGD;
+-                      /* NVME transport-registered rports need the
+-                       * NLP_XPT_REGD flag to complete an unregister.
++                      /* If NLP_XPT_REGD was cleared in lpfc_nlp_unreg_node,
++                       * unregister calls were made to the scsi and nvme
++                       * transports and refcnt was already decremented. Clear
++                       * the NLP_XPT_REGD flag only if the NVME Rport is
++                       * confirmed unregistered.
+                        */
+-                      if (!(ndlp->fc4_xpt_flags & NVME_XPT_REGD))
++                      if (!nvme_reg && ndlp->fc4_xpt_flags & NLP_XPT_REGD) {
+                               ndlp->fc4_xpt_flags &= ~NLP_XPT_REGD;
++                              spin_unlock_irqrestore(&ndlp->lock, iflags);
++                              lpfc_nlp_put(ndlp); /* may free ndlp */
++                      } else {
++                              spin_unlock_irqrestore(&ndlp->lock, iflags);
++                      }
++              } else {
+                       spin_unlock_irqrestore(&ndlp->lock, iflags);
+-                      lpfc_nlp_put(ndlp);
+-                      spin_lock_irqsave(&ndlp->lock, iflags);
+               }
++              spin_lock_irqsave(&ndlp->lock, iflags);
++
+               /* Only 1 thread can drop the initial node reference.  If
+                * another thread has set NLP_DROPPED, this thread is done.
+                */
+-              if (!(ndlp->fc4_xpt_flags & NVME_XPT_REGD) &&
+-                  !(ndlp->nlp_flag & NLP_DROPPED)) {
+-                      ndlp->nlp_flag |= NLP_DROPPED;
++              if (nvme_reg || (ndlp->nlp_flag & NLP_DROPPED)) {
+                       spin_unlock_irqrestore(&ndlp->lock, iflags);
+-                      lpfc_nlp_put(ndlp);
+                       return;
+               }
++              ndlp->nlp_flag |= NLP_DROPPED;
+               spin_unlock_irqrestore(&ndlp->lock, iflags);
++              lpfc_nlp_put(ndlp);
+               return;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/scsi-st-add-mtiocget-and-mtload-to-ioctls-allowed-af.patch b/queue-6.12/scsi-st-add-mtiocget-and-mtload-to-ioctls-allowed-af.patch
new file mode 100644 (file)
index 0000000..2f46680
--- /dev/null
@@ -0,0 +1,90 @@
+From 5cd842f1b082ac6a5a0f90ab1fef67c94aa29f39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 11:57:22 +0200
+Subject: scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device
+ reset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kai Mäkisara <Kai.Makisara@kolumbus.fi>
+
+[ Upstream commit 0b120edb37dc9dd8ca82893d386922eb6b16f860 ]
+
+Most drives rewind the tape when the device is reset. Reading and writing
+are not allowed until something is done to make the tape position match the
+user's expectation (e.g., rewind the tape). Add MTIOCGET and MTLOAD to
+operations allowed after reset. MTIOCGET is modified to not touch the tape
+if pos_unknown is non-zero. The tape location is known after MTLOAD.
+
+Signed-off-by: Kai Mäkisara <Kai.Makisara@kolumbus.fi>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219419#c14
+Link: https://lore.kernel.org/r/20241106095723.63254-3-Kai.Makisara@kolumbus.fi
+Reviewed-by: John Meneghini <jmeneghi@redhat.com>
+Tested-by: John Meneghini <jmeneghi@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/st.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index 8d27e6caf0277..c9038284bc893 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -3506,6 +3506,7 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg)
+       int i, cmd_nr, cmd_type, bt;
+       int retval = 0;
+       unsigned int blk;
++      bool cmd_mtiocget;
+       struct scsi_tape *STp = file->private_data;
+       struct st_modedef *STm;
+       struct st_partstat *STps;
+@@ -3619,6 +3620,7 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg)
+                        */
+                       if (mtc.mt_op != MTREW &&
+                           mtc.mt_op != MTOFFL &&
++                          mtc.mt_op != MTLOAD &&
+                           mtc.mt_op != MTRETEN &&
+                           mtc.mt_op != MTERASE &&
+                           mtc.mt_op != MTSEEK &&
+@@ -3732,17 +3734,28 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg)
+               goto out;
+       }
++      cmd_mtiocget = cmd_type == _IOC_TYPE(MTIOCGET) && cmd_nr == _IOC_NR(MTIOCGET);
++
+       if ((i = flush_buffer(STp, 0)) < 0) {
+-              retval = i;
+-              goto out;
+-      }
+-      if (STp->can_partitions &&
+-          (i = switch_partition(STp)) < 0) {
+-              retval = i;
+-              goto out;
++              if (cmd_mtiocget && STp->pos_unknown) {
++                      /* flush fails -> modify status accordingly */
++                      reset_state(STp);
++                      STp->pos_unknown = 1;
++              } else { /* return error */
++                      retval = i;
++                      goto out;
++              }
++      } else { /* flush_buffer succeeds */
++              if (STp->can_partitions) {
++                      i = switch_partition(STp);
++                      if (i < 0) {
++                              retval = i;
++                              goto out;
++                      }
++              }
+       }
+-      if (cmd_type == _IOC_TYPE(MTIOCGET) && cmd_nr == _IOC_NR(MTIOCGET)) {
++      if (cmd_mtiocget) {
+               struct mtget mt_status;
+               if (_IOC_SIZE(cmd_in) != sizeof(struct mtget)) {
+-- 
+2.43.0
+
diff --git a/queue-6.12/scsi-st-don-t-modify-unknown-block-number-in-mtiocge.patch b/queue-6.12/scsi-st-don-t-modify-unknown-block-number-in-mtiocge.patch
new file mode 100644 (file)
index 0000000..61c07a1
--- /dev/null
@@ -0,0 +1,42 @@
+From 972a6d31debade08284ab45c2948cea9f3db3a59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 11:57:21 +0200
+Subject: scsi: st: Don't modify unknown block number in MTIOCGET
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kai Mäkisara <Kai.Makisara@kolumbus.fi>
+
+[ Upstream commit 5bb2d6179d1a8039236237e1e94cfbda3be1ed9e ]
+
+Struct mtget field mt_blkno -1 means it is unknown. Don't add anything to
+it.
+
+Signed-off-by: Kai Mäkisara <Kai.Makisara@kolumbus.fi>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219419#c14
+Link: https://lore.kernel.org/r/20241106095723.63254-2-Kai.Makisara@kolumbus.fi
+Reviewed-by: John Meneghini <jmeneghi@redhat.com>
+Tested-by: John Meneghini <jmeneghi@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/st.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index beb88f25dbb99..8d27e6caf0277 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -3756,7 +3756,7 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg)
+                   ((STp->density << MT_ST_DENSITY_SHIFT) & MT_ST_DENSITY_MASK);
+               mt_status.mt_blkno = STps->drv_block;
+               mt_status.mt_fileno = STps->drv_file;
+-              if (STp->block_size != 0) {
++              if (STp->block_size != 0 && mt_status.mt_blkno >= 0) {
+                       if (STps->rw == ST_WRITING)
+                               mt_status.mt_blkno +=
+                                   (STp->buffer)->buffer_bytes / STp->block_size;
+-- 
+2.43.0
+
diff --git a/queue-6.12/scsi-ufs-core-make-dma-mask-configuration-more-flexi.patch b/queue-6.12/scsi-ufs-core-make-dma-mask-configuration-more-flexi.patch
new file mode 100644 (file)
index 0000000..d025dd3
--- /dev/null
@@ -0,0 +1,119 @@
+From b4953257e1d7d01109d4951ff572f241cd174031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 12:47:39 -0700
+Subject: scsi: ufs: core: Make DMA mask configuration more flexible
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 78bc671bd1501e2f6c571e063301a4fdc5db53b2 ]
+
+Replace UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS with
+ufs_hba_variant_ops::set_dma_mask.  Update the Renesas driver
+accordingly.  This patch enables supporting other configurations than
+32-bit or 64-bit DMA addresses, e.g. 36-bit DMA addresses.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20241018194753.775074-1-bvanassche@acm.org
+Reviewed-by: Avri Altman <Avri.Altman@wdc.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c      | 4 ++--
+ drivers/ufs/host/ufs-renesas.c | 9 ++++++++-
+ include/ufs/ufshcd.h           | 9 +++------
+ 3 files changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index b09198c69766b..cfebe4a1af9e8 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -2411,8 +2411,6 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)
+       int err;
+       hba->capabilities = ufshcd_readl(hba, REG_CONTROLLER_CAPABILITIES);
+-      if (hba->quirks & UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS)
+-              hba->capabilities &= ~MASK_64_ADDRESSING_SUPPORT;
+       /* nutrs and nutmrs are 0 based values */
+       hba->nutrs = (hba->capabilities & MASK_TRANSFER_REQUESTS_SLOTS_SDB) + 1;
+@@ -10344,6 +10342,8 @@ EXPORT_SYMBOL_GPL(ufshcd_dealloc_host);
+  */
+ static int ufshcd_set_dma_mask(struct ufs_hba *hba)
+ {
++      if (hba->vops && hba->vops->set_dma_mask)
++              return hba->vops->set_dma_mask(hba);
+       if (hba->capabilities & MASK_64_ADDRESSING_SUPPORT) {
+               if (!dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(64)))
+                       return 0;
+diff --git a/drivers/ufs/host/ufs-renesas.c b/drivers/ufs/host/ufs-renesas.c
+index b3a5fc2d44e72..21a64b34397d8 100644
+--- a/drivers/ufs/host/ufs-renesas.c
++++ b/drivers/ufs/host/ufs-renesas.c
+@@ -7,6 +7,7 @@
+ #include <linux/clk.h>
+ #include <linux/delay.h>
++#include <linux/dma-mapping.h>
+ #include <linux/err.h>
+ #include <linux/iopoll.h>
+ #include <linux/kernel.h>
+@@ -364,14 +365,20 @@ static int ufs_renesas_init(struct ufs_hba *hba)
+               return -ENOMEM;
+       ufshcd_set_variant(hba, priv);
+-      hba->quirks |= UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS | UFSHCD_QUIRK_HIBERN_FASTAUTO;
++      hba->quirks |= UFSHCD_QUIRK_HIBERN_FASTAUTO;
+       return 0;
+ }
++static int ufs_renesas_set_dma_mask(struct ufs_hba *hba)
++{
++      return dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(32));
++}
++
+ static const struct ufs_hba_variant_ops ufs_renesas_vops = {
+       .name           = "renesas",
+       .init           = ufs_renesas_init,
++      .set_dma_mask   = ufs_renesas_set_dma_mask,
+       .setup_clocks   = ufs_renesas_setup_clocks,
+       .hce_enable_notify = ufs_renesas_hce_enable_notify,
+       .dbg_register_dump = ufs_renesas_dbg_register_dump,
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index 1db754b4a4d62..8932ec5bd7c02 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -299,6 +299,8 @@ struct ufs_pwr_mode_info {
+  * @max_num_rtt: maximum RTT supported by the host
+  * @init: called when the driver is initialized
+  * @exit: called to cleanup everything done in init
++ * @set_dma_mask: For setting another DMA mask than indicated by the 64AS
++ *    capability bit.
+  * @get_ufs_hci_version: called to get UFS HCI version
+  * @clk_scale_notify: notifies that clks are scaled up/down
+  * @setup_clocks: called before touching any of the controller registers
+@@ -343,6 +345,7 @@ struct ufs_hba_variant_ops {
+       int     (*init)(struct ufs_hba *);
+       void    (*exit)(struct ufs_hba *);
+       u32     (*get_ufs_hci_version)(struct ufs_hba *);
++      int     (*set_dma_mask)(struct ufs_hba *);
+       int     (*clk_scale_notify)(struct ufs_hba *, bool,
+                                   enum ufs_notify_change_status);
+       int     (*setup_clocks)(struct ufs_hba *, bool,
+@@ -625,12 +628,6 @@ enum ufshcd_quirks {
+        */
+       UFSHCD_QUIRK_SKIP_PH_CONFIGURATION              = 1 << 16,
+-      /*
+-       * This quirk needs to be enabled if the host controller has
+-       * 64-bit addressing supported capability but it doesn't work.
+-       */
+-      UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS               = 1 << 17,
+-
+       /*
+        * This quirk needs to be enabled if the host controller has
+        * auto-hibernate capability but it's FASTAUTO only.
+-- 
+2.43.0
+
diff --git a/queue-6.12/selftests-resctrl-protect-against-array-overflow-whe.patch b/queue-6.12/selftests-resctrl-protect-against-array-overflow-whe.patch
new file mode 100644 (file)
index 0000000..d2ab89e
--- /dev/null
@@ -0,0 +1,78 @@
+From d6b45cfcdb12ca9b0b50111478009eacd1efef4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 14:18:42 -0700
+Subject: selftests/resctrl: Protect against array overflow when reading
+ strings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+[ Upstream commit 46058430fc5d39c114f7e1b9c6ff14c9f41bd531 ]
+
+resctrl selftests discover system properties via a variety of sysfs files.
+The MBM and MBA tests need to discover the event and umask with which to
+configure the performance event used to measure read memory bandwidth.
+This is done by parsing the contents of
+/sys/bus/event_source/devices/uncore_imc_<imc instance>/events/cas_count_read
+Similarly, the resctrl selftests discover the cache size via
+/sys/bus/cpu/devices/cpu<id>/cache/index<index>/size.
+
+Take care to do bounds checking when using fscanf() to read the
+contents of files into a string buffer because by default fscanf() assumes
+arbitrarily long strings. If the file contains more bytes than the array
+can accommodate then an overflow will occur.
+
+Provide a maximum field width to the conversion specifier to protect
+against array overflow. The maximum is one less than the array size because
+string input stores a terminating null byte that is not covered by the
+maximum field width.
+
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/resctrl_val.c | 4 ++--
+ tools/testing/selftests/resctrl/resctrlfs.c   | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c
+index f118f659e8960..e92e4f463f37b 100644
+--- a/tools/testing/selftests/resctrl/resctrl_val.c
++++ b/tools/testing/selftests/resctrl/resctrl_val.c
+@@ -159,7 +159,7 @@ static int read_from_imc_dir(char *imc_dir, int count)
+               return -1;
+       }
+-      if (fscanf(fp, "%s", cas_count_cfg) <= 0) {
++      if (fscanf(fp, "%1023s", cas_count_cfg) <= 0) {
+               ksft_perror("Could not get iMC cas count read");
+               fclose(fp);
+@@ -177,7 +177,7 @@ static int read_from_imc_dir(char *imc_dir, int count)
+               return -1;
+       }
+-      if  (fscanf(fp, "%s", cas_count_cfg) <= 0) {
++      if  (fscanf(fp, "%1023s", cas_count_cfg) <= 0) {
+               ksft_perror("Could not get iMC cas count write");
+               fclose(fp);
+diff --git a/tools/testing/selftests/resctrl/resctrlfs.c b/tools/testing/selftests/resctrl/resctrlfs.c
+index 250c320349a78..a53cd1cb6e0c6 100644
+--- a/tools/testing/selftests/resctrl/resctrlfs.c
++++ b/tools/testing/selftests/resctrl/resctrlfs.c
+@@ -182,7 +182,7 @@ int get_cache_size(int cpu_no, const char *cache_type, unsigned long *cache_size
+               return -1;
+       }
+-      if (fscanf(fp, "%s", cache_str) <= 0) {
++      if (fscanf(fp, "%63s", cache_str) <= 0) {
+               ksft_perror("Could not get cache_size");
+               fclose(fp);
+-- 
+2.43.0
+
diff --git a/queue-6.12/serial-8250_dw-add-sophgo-sg2044-quirk.patch b/queue-6.12/serial-8250_dw-add-sophgo-sg2044-quirk.patch
new file mode 100644 (file)
index 0000000..d6f5f7f
--- /dev/null
@@ -0,0 +1,53 @@
+From 3ce9b49a53de8e0c04f0fcb30f88712788b96f16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 14:21:03 +0800
+Subject: serial: 8250_dw: Add Sophgo SG2044 quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit cad4dda82c7eedcfc22597267e710ccbcf39d572 ]
+
+SG2044 relys on an internal divisor when calculating bitrate, which
+means a wrong clock for the most common bitrates. So add a quirk for
+this uart device to skip the set rate call and only relys on the
+internal UART divisor.
+
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Link: https://lore.kernel.org/r/20241024062105.782330-4-inochiama@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index ab9e7f2042602..51894c93c8a31 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -750,7 +750,7 @@ static const struct dw8250_platform_data dw8250_renesas_rzn1_data = {
+       .quirks = DW_UART_QUIRK_CPR_VALUE | DW_UART_QUIRK_IS_DMA_FC,
+ };
+-static const struct dw8250_platform_data dw8250_starfive_jh7100_data = {
++static const struct dw8250_platform_data dw8250_skip_set_rate_data = {
+       .usr_reg = DW_UART_USR,
+       .quirks = DW_UART_QUIRK_SKIP_SET_RATE,
+ };
+@@ -760,7 +760,8 @@ static const struct of_device_id dw8250_of_match[] = {
+       { .compatible = "cavium,octeon-3860-uart", .data = &dw8250_octeon_3860_data },
+       { .compatible = "marvell,armada-38x-uart", .data = &dw8250_armada_38x_data },
+       { .compatible = "renesas,rzn1-uart", .data = &dw8250_renesas_rzn1_data },
+-      { .compatible = "starfive,jh7100-uart", .data = &dw8250_starfive_jh7100_data },
++      { .compatible = "sophgo,sg2044-uart", .data = &dw8250_skip_set_rate_data },
++      { .compatible = "starfive,jh7100-uart", .data = &dw8250_skip_set_rate_data },
+       { /* Sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(of, dw8250_of_match);
+-- 
+2.43.0
+
index 01aefa7e9157107b0a93dccd319594cb17fc0e8d..21ba656170c1e487a919b3603b120cc1013a38c7 100644 (file)
@@ -218,3 +218,222 @@ mm-respect-mmap-hint-address-when-aligning-for-thp.patch
 scsi-ufs-pltfrm-drop-pm-runtime-reference-count-after-ufshcd_remove.patch
 memblock-allow-zero-threshold-in-validate_numa_converage.patch
 rust-enable-arbitrary_self_types-and-remove-receiver.patch
+s390-pci-sort-pci-functions-prior-to-creating-virtua.patch
+s390-pci-use-topology-id-for-multi-function-devices.patch
+s390-pci-ignore-rid-for-isolated-vfs.patch
+epoll-annotate-racy-check.patch
+kselftest-arm64-log-fp-stress-child-startup-errors-t.patch
+s390-cpum_sf-handle-cpu-hotplug-remove-during-sampli.patch
+block-rcu-protect-disk-conv_zones_bitmap.patch
+btrfs-don-t-take-dev_replace-rwsem-on-task-already-h.patch
+btrfs-avoid-unnecessary-device-path-update-for-the-s.patch
+btrfs-canonicalize-the-device-path-before-adding-it.patch
+btrfs-do-not-clear-read-only-when-adding-sprout-devi.patch
+kselftest-arm64-don-t-leak-pipe-fds-in-pac.exec_sign.patch
+ext4-partial-zero-eof-block-on-unaligned-inode-size-.patch
+crypto-ecdsa-avoid-signed-integer-overflow-on-signat.patch
+kcsan-turn-report_filterlist_lock-into-a-raw_spinloc.patch
+hwmon-nct6775-add-665-ace-600m-cl-to-asus-wmi-monito.patch
+acpi-x86-make-uart-skip-quirks-work-on-pci-uarts-wit.patch
+acpi-x86-add-adev-null-check-to-acpi_quirk_skip_serd.patch
+acpi-video-force-native-for-apple-macbookpro11-2-and.patch
+perf-x86-amd-warn-only-on-new-bits-set.patch
+cleanup-adjust-scoped_guard-macros-to-avoid-potentia.patch
+timekeeping-always-check-for-negative-motion.patch
+gpio-free-irqs-that-are-still-requested-when-the-chi.patch
+spi-spi-fsl-lpspi-adjust-type-of-scldiv.patch
+soc-qcom-llcc-use-designated-initializers-for-llc-se.patch
+hid-add-per-device-quirk-to-force-bind-to-hid-generi.patch
+firmware-qcom-scm-allow-qseecom-on-lenovo-yoga-slim-.patch
+soc-qcom-pd-mapper-add-qcm6490-pd-maps.patch
+media-uvcvideo-realsense-d421-depth-module-metadata.patch
+media-uvcvideo-add-a-quirk-for-the-kaiweets-kti-w02-.patch
+media-uvcvideo-force-uvc-version-to-1.0a-for-0408-40.patch
+media-cx231xx-add-support-for-dexatek-usb-video-grab.patch
+mmc-core-add-sd-card-quirk-for-broken-poweroff-notif.patch
+mmc-sdhci-esdhc-imx-enable-quirks-sdhci_quirk_no_led.patch
+firmware-qcom-scm-allow-qseecom-on-dell-xps-13-9345.patch
+soc-imx8m-probe-the-soc-driver-as-platform-driver.patch
+hid-bpf-fix-nkro-on-mistel-md770.patch
+regmap-maple-provide-lockdep-sub-class-for-maple-tre.patch
+selftests-resctrl-protect-against-array-overflow-whe.patch
+sched_ext-add-a-missing-rcu_read_lock-unlock-pair-at.patch
+hid-magicmouse-apple-magic-trackpad-2-usb-c-driver-s.patch
+drm-xe-pciids-separate-rpl-u-and-rpl-p-pci-ids.patch
+drm-xe-pciids-separate-arl-and-mtl-pci-ids.patch
+drm-vc4-hdmi-avoid-log-spam-for-audio-start-failure.patch
+drm-vc4-hvs-set-axi-panic-modes-for-the-hvs.patch
+drm-xe-pciids-add-pvc-s-pci-device-id-macros.patch
+wifi-rtw88-use-ieee80211_purge_tx_queue-to-purge-tx-.patch
+drm-xe-pciid-add-new-pci-id-for-arl.patch
+drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch
+drm-panel-orientation-quirks-add-quirk-for-aya-neo-f.patch
+drm-panel-orientation-quirks-add-quirk-for-aya-neo-g.patch
+drm-bridge-it6505-enable-module-autoloading.patch
+drm-mcde-enable-module-autoloading.patch
+wifi-rtw89-check-return-value-of-ieee80211_probereq_.patch
+drm-amd-display-fix-out-of-bounds-access-in-dcn21_li.patch
+drm-radeon-r600_cs-fix-possible-int-overflow-in-r600.patch
+asoc-intel-sof_rt5682-add-hdmi-in-capture-with-rt568.patch
+dlm-fix-possible-lkb_resource-null-dereference.patch
+drm-amd-display-skip-disable-crtc-in-seemless-bootup.patch
+drm-amd-display-fix-garbage-or-black-screen-when-res.patch
+drm-amd-display-disable-sg-displays-on-cyan-skillfis.patch
+drm-xe-ptl-l3bank-mask-is-not-available-on-the-media.patch
+drm-xe-xe3-add-initial-set-of-workarounds.patch
+drm-display-fix-building-with-gcc-15.patch
+alsa-hda-use-own-quirk-lookup-helper.patch
+alsa-hda-conexant-use-the-new-codec-ssid-matching.patch
+alsa-hda-realtek-use-codec-ssid-matching-for-lenovo-.patch
+r8169-don-t-apply-udp-padding-quirk-on-rtl8126a.patch
+samples-bpf-fix-a-resource-leak.patch
+wifi-ath12k-fix-atomic-calls-in-ath12k_mac_op_set_bi.patch
+accel-qaic-add-aic080-support.patch
+drm-amd-display-full-exit-out-of-ips2-when-all-allow.patch
+net-fec_mpc52xx_phy-use-pa-to-format-resource_size_t.patch
+net-ethernet-fs_enet-use-pa-to-format-resource_size_.patch
+net-sched-cbs-fix-integer-overflow-in-cbs_set_port_r.patch
+af_packet-avoid-erroring-out-after-sock_init_data-in.patch
+bluetooth-l2cap-do-not-leave-dangling-sk-pointer-on-.patch
+bluetooth-rfcomm-avoid-leaving-dangling-sk-pointer-i.patch
+net-af_can-do-not-leave-a-dangling-sk-pointer-in-can.patch
+net-ieee802154-do-not-leave-a-dangling-sk-pointer-in.patch
+net-inet-do-not-leave-a-dangling-sk-pointer-in-inet_.patch
+net-inet6-do-not-leave-a-dangling-sk-pointer-in-inet.patch
+wifi-ath10k-avoid-null-pointer-error-during-sdio-rem.patch
+wifi-ath5k-add-pci-id-for-sx76x.patch
+wifi-ath5k-add-pci-id-for-arcadyan-devices.patch
+fanotify-allow-reporting-errors-on-failure-to-open-f.patch
+bpf-prevent-tailcall-infinite-loop-caused-by-freplac.patch
+asoc-sdw_utils-add-support-for-exclusion-dai-quirks.patch
+asoc-sdw_utils-add-a-quirk-to-allow-the-cs42l43-mic-.patch
+asoc-intel-sof_sdw-add-quirk-for-cs42l43-system-usin.patch
+asoc-intel-sof_sdw-add-quirks-for-some-new-lenovo-la.patch
+drm-xe-guc-ct-flush-g2h-worker-in-case-of-g2h-respon.patch
+drm-panel-simple-add-microchip-ac69t88a-lvds-display.patch
+net-sfp-change-quirks-for-alcatel-lucent-g-010s-p.patch
+net-stmmac-programming-sequence-for-vlan-packets-wit.patch
+drm-sched-memset-job-in-drm_sched_job_init.patch
+drm-amd-display-adding-array-index-check-to-prevent-.patch
+drm-amdgpu-gfx9-add-cleaner-shader-for-gfx9.4.2.patch
+drm-amdgpu-clear-rb_overflow-bit-when-enabling-inter.patch
+drm-amdgpu-dereference-the-atcs-acpi-buffer.patch
+netlink-specs-add-missing-bitset-attrs-to-ethtool-sp.patch
+drm-amdgpu-refine-error-handling-in-amdgpu_ttm_tt_pi.patch
+asoc-sdw_utils-add-quirk-to-exclude-amplifier-functi.patch
+asoc-intel-soc-acpi-intel-arl-match-add-rt722-and-rt.patch
+drm-amd-display-fix-underflow-when-playing-8k-video-.patch
+mptcp-annotate-data-races-around-subflow-fully_estab.patch
+dma-debug-fix-a-possible-deadlock-on-radix_lock.patch
+jfs-array-index-out-of-bounds-fix-in-dtreadfirst.patch
+jfs-fix-shift-out-of-bounds-in-dbsplit.patch
+jfs-fix-array-index-out-of-bounds-in-jfs_readdir.patch
+jfs-add-a-check-to-prevent-array-index-out-of-bounds.patch
+fsl-fman-validate-cell-index-value-obtained-from-dev.patch
+net-tcp-add-missing-lockdep-annotations-for-tcp-ao-h.patch
+drm-panic-add-abgr2101010-support.patch
+drm-amd-display-remove-hw-w-a-toggle-if-on-dp2-hpo.patch
+drm-amd-display-parse-umc_info-or-vram_info-based-on.patch
+drm-amd-display-prune-invalid-modes-for-hdmi-output.patch
+drm-amdgpu-skip-amdgpu_device_cache_pci_state-under-.patch
+virtio-net-fix-overflow-inside-virtnet_rq_alloc.patch
+alsa-usb-audio-make-mic-volume-workarounds-globally-.patch
+drm-amdgpu-set-the-right-amdgpu-sg-segment-limitatio.patch
+wifi-ipw2x00-libipw_rx_any-fix-bad-alignment.patch
+wifi-brcmfmac-fix-oops-due-to-null-pointer-dereferen.patch
+bpf-call-free_htab_elem-after-htab_unlock_bucket.patch
+mptcp-fix-possible-integer-overflow-in-mptcp_reset_t.patch
+dsa-qca8k-use-nested-lock-to-avoid-splat.patch
+i2c-i801-add-support-for-intel-panther-lake.patch
+bluetooth-hci_conn-reduce-hci_conn_drop-calls-in-two.patch
+bluetooth-btusb-add-rtl8852be-device-0489-e123-to-de.patch
+bluetooth-btusb-add-usb-hw-ids-for-mt7920-mt7925.patch
+bluetooth-hci_conn-use-disable_delayed_work_sync.patch
+bluetooth-hci_core-fix-not-checking-skb-length-on-hc.patch
+bluetooth-add-new-quirks-for-ats2851.patch
+bluetooth-support-new-quirks-for-ats2851.patch
+bluetooth-set-quirks-for-ats2851.patch
+bluetooth-btusb-add-new-vid-pid-0489-e111-for-mt7925.patch
+bluetooth-btusb-add-new-vid-pid-0489-e124-for-mt7925.patch
+bluetooth-btusb-add-3-hwids-for-mt7925.patch
+asoc-hdmi-codec-reorder-channel-allocation-list.patch
+rocker-fix-link-status-detection-in-rocker_carrier_i.patch
+net-neighbor-clear-error-in-case-strict-check-is-not.patch
+netpoll-use-rcu_access_pointer-in-__netpoll_setup.patch
+pinctrl-freescale-fix-compile_test-error-with-pinctr.patch
+rtla-fix-consistency-in-getopt_long-for-timerlat_his.patch
+tracing-ftrace-disable-preemption-in-syscall-probe.patch
+tracing-use-atomic64_inc_return-in-trace_clock_count.patch
+tools-rtla-fix-collision-with-glibc-sched_attr-sched.patch
+rtla-timerlat-make-timerlat_top_cpu-_count-unsigned-.patch
+rtla-timerlat-make-timerlat_hist_cpu-_count-unsigned.patch
+scsi-hisi_sas-add-cond_resched-for-no-forced-preempt.patch
+scsi-hisi_sas-create-all-dump-files-during-debugfs-i.patch
+rtla-utils-add-idle-state-disabling-via-libcpupower.patch
+ring-buffer-limit-time-with-disabled-interrupts-in-r.patch
+pinmux-use-sequential-access-to-access-desc-pinmux-d.patch
+scsi-ufs-core-make-dma-mask-configuration-more-flexi.patch
+iommu-amd-fix-corruption-when-mapping-large-pages-fr.patch
+bpf-put-bpf_link-s-program-when-link-is-safe-to-be-d.patch
+scsi-lpfc-call-lpfc_sli4_queue_unset-in-restart-and-.patch
+scsi-lpfc-check-sli_active-flag-in-fdmi-cmpl-before-.patch
+scsi-lpfc-prevent-ndlp-reference-count-underflow-in-.patch
+clk-qcom-rcg2-add-clk_rcg2_shared_floor_ops.patch
+clk-qcom-rpmh-add-support-for-sar2130p.patch
+clk-qcom-tcsrcc-sm8550-add-sar2130p-support.patch
+clk-qcom-dispcc-sm8550-enable-support-for-sar2130p.patch
+clk-qcom-clk-alpha-pll-add-nss-huayra-alpha-pll-supp.patch
+leds-class-protect-brightness_show-with-led_cdev-led.patch
+scsi-st-don-t-modify-unknown-block-number-in-mtiocge.patch
+scsi-st-add-mtiocget-and-mtload-to-ioctls-allowed-af.patch
+pinctrl-qcom-pmic-gpio-add-support-for-pm8937.patch
+pinctrl-qcom-spmi-mpp-add-pm8937-compatible.patch
+thermal-drivers-qcom-tsens-v1-add-support-for-msm893.patch
+nvdimm-rectify-the-illogical-code-within-nd_dax_prob.patch
+smb-client-memcpy-with-surrounding-object-base-addre.patch
+tracing-fix-function-name-for-trampoline.patch
+tools-rtla-enhance-argument-parsing-in-timerlat_load.patch
+verification-dot2-improve-dot-parser-robustness.patch
+mailbox-pcc-check-before-sending-mctp-pcc-response-a.patch
+f2fs-fix-f2fs_bug_on-when-uninstalling-filesystem-ca.patch
+kmsan-uninit-value-in-inode_go_dump-5.patch
+i3c-mipi-i3c-hci-mask-ring-interrupts-before-ring-st.patch
+pci-qcom-add-support-for-ipq9574.patch
+pci-vmd-add-did-8086-b06f-and-8086-b60b-for-intel-cl.patch
+pci-vmd-set-devices-to-d0-before-enabling-pm-l1-subs.patch
+pci-detect-and-trust-built-in-thunderbolt-chips.patch
+pci-starfive-enable-controller-runtime-pm-before-pro.patch
+pci-add-reset_subordinate-to-reset-hierarchy-below-b.patch
+pci-add-acs-quirk-for-wangxun-ff5xxx-nics.patch
+remoteproc-qcom-pas-enable-sar2130p-audio-dsp-suppor.patch
+i3c-use-i3cdev-desc-info-instead-of-calling-i3c_devi.patch
+f2fs-print-message-if-fscorrupted-was-found-in-f2fs_.patch
+f2fs-fix-to-shrink-read-extent-node-in-batches.patch
+f2fs-add-a-sysfs-node-to-limit-max-read-extent-count.patch
+acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch
+acpi-x86-clean-up-asus-entries-in-acpi_quirk_skip_dm.patch
+loongarch-fix-sleeping-in-atomic-context-for-preempt.patch
+fs-ntfs3-fix-warning-in-ni_fiemap.patch
+fs-ntfs3-fix-case-when-unmarked-clusters-intersect-w.patch
+regulator-qcom-rpmh-update-ranges-for-ftsmps525.patch
+usb-chipidea-add-ci_hdrc_has_short_pkt_limit-flag.patch
+usb-chipidea-udc-limit-usb-request-length-to-max-16k.patch
+usb-chipidea-udc-create-bounce-buffer-for-problem-sg.patch
+usb-chipidea-udc-handle-usb-error-interrupt-if-ioc-n.patch
+usb-typec-ucsi-do-not-call-acpi-_dsm-method-for-ucsi.patch
+iio-adc-ad7192-properly-check-spi_get_device_match_d.patch
+iio-light-ltr501-add-lter0303-to-the-supported-devic.patch
+usb-typec-ucsi-glink-be-more-precise-on-orientation-.patch
+asoc-amd-yc-fix-internal-mic-on-redmi-g-2022.patch
+drm-amdgpu-vcn-reset-fw_shared-when-vcpu-buffers-cor.patch
+mips-loongson64-dts-really-fix-pcie-port-nodes-for-l.patch
+asoc-amd-yc-add-quirk-for-microphone-on-lenovo-think.patch
+powerpc-prom_init-fixup-missing-powermac-size-cells.patch
+misc-eeprom-eeprom_93cx6-add-quirk-for-extra-read-cl.patch
+rtc-cmos-avoid-taking-rtc_lock-for-extended-period-o.patch
+serial-8250_dw-add-sophgo-sg2044-quirk.patch
+revert-nvme-make-keep-alive-synchronous-operation.patch
+irqchip-gicv3-its-add-workaround-for-hip09-its-errat.patch
+smb-client-don-t-try-following-dfs-links-in-cifs_tre.patch
+setlocalversion-work-around-git-describe-performance.patch
+io_uring-tctx-work-around-xa_store-allocation-error-.patch
diff --git a/queue-6.12/setlocalversion-work-around-git-describe-performance.patch b/queue-6.12/setlocalversion-work-around-git-describe-performance.patch
new file mode 100644 (file)
index 0000000..ca37680
--- /dev/null
@@ -0,0 +1,178 @@
+From 16e9a7b3e6fbcafa2e3090aef526616efc14a5e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 12:01:54 +0100
+Subject: setlocalversion: work around "git describe" performance
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 523f3dbc187a9618d4fd80c2b438e4d490705dcd ]
+
+Contrary to expectations, passing a single candidate tag to "git
+describe" is slower than not passing any --match options.
+
+  $ time git describe --debug
+  ...
+  traversed 10619 commits
+  ...
+  v6.12-rc5-63-g0fc810ae3ae1
+
+  real    0m0.169s
+
+  $ time git describe --match=v6.12-rc5 --debug
+  ...
+  traversed 1310024 commits
+  v6.12-rc5-63-g0fc810ae3ae1
+
+  real    0m1.281s
+
+In fact, the --debug output shows that git traverses all or most of
+history. For some repositories and/or git versions, those 1.3s are
+actually 10-15 seconds.
+
+This has been acknowledged as a performance bug in git [1], and a fix
+is on its way [2]. However, no solution is yet in git.git, and even
+when one lands, it will take quite a while before it finds its way to
+a release and for $random_kernel_developer to pick that up.
+
+So rewrite the logic to use plumbing commands. For each of the
+candidate values of $tag, we ask: (1) is $tag even an annotated
+tag? (2) Is it eligible to describe HEAD, i.e. an ancestor of
+HEAD? (3) If so, how many commits are in $tag..HEAD?
+
+I have tested that this produces the same output as the current script
+for ~700 random commits between v6.9..v6.10. For those 700 commits,
+and in my git repo, the 'make -s kernelrelease' command is on average
+~4 times faster with this patch applied (geometric mean of ratios).
+
+For the commit mentioned in Josh's original report [3], the
+time-consuming part of setlocalversion goes from
+
+$ time git describe --match=v6.12-rc5 c1e939a21eb1
+v6.12-rc5-44-gc1e939a21eb1
+
+real    0m1.210s
+
+to
+
+$ time git rev-list --count --left-right v6.12-rc5..c1e939a21eb1
+0       44
+
+real    0m0.037s
+
+[1] https://lore.kernel.org/git/20241101113910.GA2301440@coredump.intra.peff.net/
+[2] https://lore.kernel.org/git/20241106192236.GC880133@coredump.intra.peff.net/
+[3] https://lore.kernel.org/lkml/309549cafdcfe50c4fceac3263220cc3d8b109b2.1730337435.git.jpoimboe@kernel.org/
+
+Reported-by: Sean Christopherson <seanjc@google.com>
+Closes: https://lore.kernel.org/lkml/ZPtlxmdIJXOe0sEy@google.com/
+Reported-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Closes: https://lore.kernel.org/lkml/309549cafdcfe50c4fceac3263220cc3d8b109b2.1730337435.git.jpoimboe@kernel.org/
+Tested-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/setlocalversion | 54 +++++++++++++++++++++++++++++------------
+ 1 file changed, 38 insertions(+), 16 deletions(-)
+
+diff --git a/scripts/setlocalversion b/scripts/setlocalversion
+index 38b96c6797f40..5818465abba98 100755
+--- a/scripts/setlocalversion
++++ b/scripts/setlocalversion
+@@ -30,6 +30,27 @@ if test $# -gt 0 -o ! -d "$srctree"; then
+       usage
+ fi
++try_tag() {
++      tag="$1"
++
++      # Is $tag an annotated tag?
++      [ "$(git cat-file -t "$tag" 2> /dev/null)" = tag ] || return 1
++
++      # Is it an ancestor of HEAD, and if so, how many commits are in $tag..HEAD?
++      # shellcheck disable=SC2046 # word splitting is the point here
++      set -- $(git rev-list --count --left-right "$tag"...HEAD 2> /dev/null)
++
++      # $1 is 0 if and only if $tag is an ancestor of HEAD. Use
++      # string comparison, because $1 is empty if the 'git rev-list'
++      # command somehow failed.
++      [ "$1" = 0 ] || return 1
++
++      # $2 is the number of commits in the range $tag..HEAD, possibly 0.
++      count="$2"
++
++      return 0
++}
++
+ scm_version()
+ {
+       local short=false
+@@ -61,33 +82,33 @@ scm_version()
+       # stable kernel:    6.1.7      ->  v6.1.7
+       version_tag=v$(echo "${KERNELVERSION}" | sed -E 's/^([0-9]+\.[0-9]+)\.0(.*)$/\1\2/')
++      # try_tag initializes count if the tag is usable.
++      count=
++
+       # If a localversion* file exists, and the corresponding
+       # annotated tag exists and is an ancestor of HEAD, use
+       # it. This is the case in linux-next.
+-      tag=${file_localversion#-}
+-      desc=
+-      if [ -n "${tag}" ]; then
+-              desc=$(git describe --match=$tag 2>/dev/null)
++      if [ -n "${file_localversion#-}" ] ; then
++              try_tag "${file_localversion#-}"
+       fi
+       # Otherwise, if a localversion* file exists, and the tag
+       # obtained by appending it to the tag derived from
+       # KERNELVERSION exists and is an ancestor of HEAD, use
+       # it. This is e.g. the case in linux-rt.
+-      if [ -z "${desc}" ] && [ -n "${file_localversion}" ]; then
+-              tag="${version_tag}${file_localversion}"
+-              desc=$(git describe --match=$tag 2>/dev/null)
++      if [ -z "${count}" ] && [ -n "${file_localversion}" ]; then
++              try_tag "${version_tag}${file_localversion}"
+       fi
+       # Otherwise, default to the annotated tag derived from KERNELVERSION.
+-      if [ -z "${desc}" ]; then
+-              tag="${version_tag}"
+-              desc=$(git describe --match=$tag 2>/dev/null)
++      if [ -z "${count}" ]; then
++              try_tag "${version_tag}"
+       fi
+-      # If we are at the tagged commit, we ignore it because the version is
+-      # well-defined.
+-      if [ "${tag}" != "${desc}" ]; then
++      # If we are at the tagged commit, we ignore it because the
++      # version is well-defined. If none of the attempted tags exist
++      # or were usable, $count is still empty.
++      if [ -z "${count}" ] || [ "${count}" -gt 0 ]; then
+               # If only the short version is requested, don't bother
+               # running further git commands
+@@ -95,14 +116,15 @@ scm_version()
+                       echo "+"
+                       return
+               fi
++
+               # If we are past the tagged commit, we pretty print it.
+               # (like 6.1.0-14595-g292a089d78d3)
+-              if [ -n "${desc}" ]; then
+-                      echo "${desc}" | awk -F- '{printf("-%05d", $(NF-1))}'
++              if [ -n "${count}" ]; then
++                      printf "%s%05d" "-" "${count}"
+               fi
+               # Add -g and exactly 12 hex chars.
+-              printf '%s%s' -g "$(echo $head | cut -c1-12)"
++              printf '%s%.12s' -g "$head"
+       fi
+       if ${no_dirty}; then
+-- 
+2.43.0
+
diff --git a/queue-6.12/smb-client-don-t-try-following-dfs-links-in-cifs_tre.patch b/queue-6.12/smb-client-don-t-try-following-dfs-links-in-cifs_tre.patch
new file mode 100644 (file)
index 0000000..4be3312
--- /dev/null
@@ -0,0 +1,268 @@
+From cae2fac493742569b69df57f82aa0fdff7e3676f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2024 15:55:53 -0300
+Subject: smb: client: don't try following DFS links in cifs_tree_connect()
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+[ Upstream commit 36008fe6e3dc588e5e9ceae6e82c7f69399eb5d8 ]
+
+We can't properly support chasing DFS links in cifs_tree_connect()
+because
+
+  (1) We don't support creating new sessions while we're reconnecting,
+      which would be required for DFS interlinks.
+
+  (2) ->is_path_accessible() can't be called from cifs_tree_connect()
+     as it would deadlock with smb2_reconnect().  This is required for
+     checking if new DFS target is a nested DFS link.
+
+By unconditionally trying to get an DFS referral from new DFS target
+isn't correct because if the new DFS target (interlink) is an DFS
+standalone namespace, then we would end up getting -ELOOP and then
+potentially leaving tcon disconnected.
+
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/dfs.c | 188 ++++----------------------------------------
+ 1 file changed, 17 insertions(+), 171 deletions(-)
+
+diff --git a/fs/smb/client/dfs.c b/fs/smb/client/dfs.c
+index 3f6077c68d68a..c35953843373e 100644
+--- a/fs/smb/client/dfs.c
++++ b/fs/smb/client/dfs.c
+@@ -321,49 +321,6 @@ int dfs_mount_share(struct cifs_mount_ctx *mnt_ctx)
+       return rc;
+ }
+-/* Update dfs referral path of superblock */
+-static int update_server_fullpath(struct TCP_Server_Info *server, struct cifs_sb_info *cifs_sb,
+-                                const char *target)
+-{
+-      int rc = 0;
+-      size_t len = strlen(target);
+-      char *refpath, *npath;
+-
+-      if (unlikely(len < 2 || *target != '\\'))
+-              return -EINVAL;
+-
+-      if (target[1] == '\\') {
+-              len += 1;
+-              refpath = kmalloc(len, GFP_KERNEL);
+-              if (!refpath)
+-                      return -ENOMEM;
+-
+-              scnprintf(refpath, len, "%s", target);
+-      } else {
+-              len += sizeof("\\");
+-              refpath = kmalloc(len, GFP_KERNEL);
+-              if (!refpath)
+-                      return -ENOMEM;
+-
+-              scnprintf(refpath, len, "\\%s", target);
+-      }
+-
+-      npath = dfs_cache_canonical_path(refpath, cifs_sb->local_nls, cifs_remap(cifs_sb));
+-      kfree(refpath);
+-
+-      if (IS_ERR(npath)) {
+-              rc = PTR_ERR(npath);
+-      } else {
+-              mutex_lock(&server->refpath_lock);
+-              spin_lock(&server->srv_lock);
+-              kfree(server->leaf_fullpath);
+-              server->leaf_fullpath = npath;
+-              spin_unlock(&server->srv_lock);
+-              mutex_unlock(&server->refpath_lock);
+-      }
+-      return rc;
+-}
+-
+ static int target_share_matches_server(struct TCP_Server_Info *server, char *share,
+                                      bool *target_match)
+ {
+@@ -388,77 +345,22 @@ static int target_share_matches_server(struct TCP_Server_Info *server, char *sha
+       return rc;
+ }
+-static void __tree_connect_ipc(const unsigned int xid, char *tree,
+-                             struct cifs_sb_info *cifs_sb,
+-                             struct cifs_ses *ses)
+-{
+-      struct TCP_Server_Info *server = ses->server;
+-      struct cifs_tcon *tcon = ses->tcon_ipc;
+-      int rc;
+-
+-      spin_lock(&ses->ses_lock);
+-      spin_lock(&ses->chan_lock);
+-      if (cifs_chan_needs_reconnect(ses, server) ||
+-          ses->ses_status != SES_GOOD) {
+-              spin_unlock(&ses->chan_lock);
+-              spin_unlock(&ses->ses_lock);
+-              cifs_server_dbg(FYI, "%s: skipping ipc reconnect due to disconnected ses\n",
+-                              __func__);
+-              return;
+-      }
+-      spin_unlock(&ses->chan_lock);
+-      spin_unlock(&ses->ses_lock);
+-
+-      cifs_server_lock(server);
+-      scnprintf(tree, MAX_TREE_SIZE, "\\\\%s\\IPC$", server->hostname);
+-      cifs_server_unlock(server);
+-
+-      rc = server->ops->tree_connect(xid, ses, tree, tcon,
+-                                     cifs_sb->local_nls);
+-      cifs_server_dbg(FYI, "%s: tree_reconnect %s: %d\n", __func__, tree, rc);
+-      spin_lock(&tcon->tc_lock);
+-      if (rc) {
+-              tcon->status = TID_NEED_TCON;
+-      } else {
+-              tcon->status = TID_GOOD;
+-              tcon->need_reconnect = false;
+-      }
+-      spin_unlock(&tcon->tc_lock);
+-}
+-
+-static void tree_connect_ipc(const unsigned int xid, char *tree,
+-                           struct cifs_sb_info *cifs_sb,
+-                           struct cifs_tcon *tcon)
+-{
+-      struct cifs_ses *ses = tcon->ses;
+-
+-      __tree_connect_ipc(xid, tree, cifs_sb, ses);
+-      __tree_connect_ipc(xid, tree, cifs_sb, CIFS_DFS_ROOT_SES(ses));
+-}
+-
+-static int __tree_connect_dfs_target(const unsigned int xid, struct cifs_tcon *tcon,
+-                                   struct cifs_sb_info *cifs_sb, char *tree, bool islink,
+-                                   struct dfs_cache_tgt_list *tl)
++static int tree_connect_dfs_target(const unsigned int xid,
++                                 struct cifs_tcon *tcon,
++                                 struct cifs_sb_info *cifs_sb,
++                                 char *tree, bool islink,
++                                 struct dfs_cache_tgt_list *tl)
+ {
+-      int rc;
++      const struct smb_version_operations *ops = tcon->ses->server->ops;
+       struct TCP_Server_Info *server = tcon->ses->server;
+-      const struct smb_version_operations *ops = server->ops;
+-      struct cifs_ses *root_ses = CIFS_DFS_ROOT_SES(tcon->ses);
+-      char *share = NULL, *prefix = NULL;
+       struct dfs_cache_tgt_iterator *tit;
++      char *share = NULL, *prefix = NULL;
+       bool target_match;
+-
+-      tit = dfs_cache_get_tgt_iterator(tl);
+-      if (!tit) {
+-              rc = -ENOENT;
+-              goto out;
+-      }
++      int rc = -ENOENT;
+       /* Try to tree connect to all dfs targets */
+-      for (; tit; tit = dfs_cache_get_next_tgt(tl, tit)) {
+-              const char *target = dfs_cache_get_tgt_name(tit);
+-              DFS_CACHE_TGT_LIST(ntl);
+-
++      for (tit = dfs_cache_get_tgt_iterator(tl);
++           tit; tit = dfs_cache_get_next_tgt(tl, tit)) {
+               kfree(share);
+               kfree(prefix);
+               share = prefix = NULL;
+@@ -479,69 +381,16 @@ static int __tree_connect_dfs_target(const unsigned int xid, struct cifs_tcon *t
+               }
+               dfs_cache_noreq_update_tgthint(server->leaf_fullpath + 1, tit);
+-              tree_connect_ipc(xid, tree, cifs_sb, tcon);
+-
+               scnprintf(tree, MAX_TREE_SIZE, "\\%s", share);
+-              if (!islink) {
+-                      rc = ops->tree_connect(xid, tcon->ses, tree, tcon, cifs_sb->local_nls);
+-                      break;
+-              }
+-
+-              /*
+-               * If no dfs referrals were returned from link target, then just do a TREE_CONNECT
+-               * to it.  Otherwise, cache the dfs referral and then mark current tcp ses for
+-               * reconnect so either the demultiplex thread or the echo worker will reconnect to
+-               * newly resolved target.
+-               */
+-              if (dfs_cache_find(xid, root_ses, cifs_sb->local_nls, cifs_remap(cifs_sb), target,
+-                                 NULL, &ntl)) {
+-                      rc = ops->tree_connect(xid, tcon->ses, tree, tcon, cifs_sb->local_nls);
+-                      if (rc)
+-                              continue;
+-
++              rc = ops->tree_connect(xid, tcon->ses, tree,
++                                     tcon, tcon->ses->local_nls);
++              if (islink && !rc && cifs_sb)
+                       rc = cifs_update_super_prepath(cifs_sb, prefix);
+-              } else {
+-                      /* Target is another dfs share */
+-                      rc = update_server_fullpath(server, cifs_sb, target);
+-                      dfs_cache_free_tgts(tl);
+-
+-                      if (!rc) {
+-                              rc = -EREMOTE;
+-                              list_replace_init(&ntl.tl_list, &tl->tl_list);
+-                      } else
+-                              dfs_cache_free_tgts(&ntl);
+-              }
+               break;
+       }
+-out:
+       kfree(share);
+       kfree(prefix);
+-
+-      return rc;
+-}
+-
+-static int tree_connect_dfs_target(const unsigned int xid, struct cifs_tcon *tcon,
+-                                 struct cifs_sb_info *cifs_sb, char *tree, bool islink,
+-                                 struct dfs_cache_tgt_list *tl)
+-{
+-      int rc;
+-      int num_links = 0;
+-      struct TCP_Server_Info *server = tcon->ses->server;
+-      char *old_fullpath = server->leaf_fullpath;
+-
+-      do {
+-              rc = __tree_connect_dfs_target(xid, tcon, cifs_sb, tree, islink, tl);
+-              if (!rc || rc != -EREMOTE)
+-                      break;
+-      } while (rc = -ELOOP, ++num_links < MAX_NESTED_LINKS);
+-      /*
+-       * If we couldn't tree connect to any targets from last referral path, then
+-       * retry it from newly resolved dfs referral.
+-       */
+-      if (rc && server->leaf_fullpath != old_fullpath)
+-              cifs_signal_cifsd_for_reconnect(server, true);
+-
+       dfs_cache_free_tgts(tl);
+       return rc;
+ }
+@@ -596,14 +445,11 @@ int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon, const stru
+       if (!IS_ERR(sb))
+               cifs_sb = CIFS_SB(sb);
+-      /*
+-       * Tree connect to last share in @tcon->tree_name whether dfs super or
+-       * cached dfs referral was not found.
+-       */
+-      if (!cifs_sb || !server->leaf_fullpath ||
++      /* Tree connect to last share in @tcon->tree_name if no DFS referral */
++      if (!server->leaf_fullpath ||
+           dfs_cache_noreq_find(server->leaf_fullpath + 1, &ref, &tl)) {
+-              rc = ops->tree_connect(xid, tcon->ses, tcon->tree_name, tcon,
+-                                     cifs_sb ? cifs_sb->local_nls : nlsc);
++              rc = ops->tree_connect(xid, tcon->ses, tcon->tree_name,
++                                     tcon, tcon->ses->local_nls);
+               goto out;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/smb-client-memcpy-with-surrounding-object-base-addre.patch b/queue-6.12/smb-client-memcpy-with-surrounding-object-base-addre.patch
new file mode 100644 (file)
index 0000000..8455c7e
--- /dev/null
@@ -0,0 +1,44 @@
+From 04404a271c7492be910220b6f18e47d24d455751 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Nov 2024 03:32:09 -0800
+Subject: smb: client: memcpy() with surrounding object base address
+
+From: Kees Cook <kees@kernel.org>
+
+[ Upstream commit f69b0187f8745a7a9584f6b13f5e792594b88b2e ]
+
+Like commit f1f047bd7ce0 ("smb: client: Fix -Wstringop-overflow issues"),
+adjust the memcpy() destination address to be based off the surrounding
+object rather than based off the 4-byte "Protocol" member. This avoids a
+build-time warning when compiling under CONFIG_FORTIFY_SOURCE with GCC 15:
+
+In function 'fortify_memcpy_chk',
+    inlined from 'CIFSSMBSetPathInfo' at ../fs/smb/client/cifssmb.c:5358:2:
+../include/linux/fortify-string.h:571:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
+  571 |                         __write_overflow_field(p_size_field, size);
+      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Kees Cook <kees@kernel.org>
+Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifssmb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
+index c6f15dbe860a4..0eae60731c20c 100644
+--- a/fs/smb/client/cifssmb.c
++++ b/fs/smb/client/cifssmb.c
+@@ -5406,7 +5406,7 @@ CIFSSMBSetPathInfo(const unsigned int xid, struct cifs_tcon *tcon,
+       param_offset = offsetof(struct smb_com_transaction2_spi_req,
+                               InformationLevel) - 4;
+       offset = param_offset + params;
+-      data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
++      data_offset = (char *)pSMB + offsetof(typeof(*pSMB), hdr.Protocol) + offset;
+       pSMB->ParameterOffset = cpu_to_le16(param_offset);
+       pSMB->DataOffset = cpu_to_le16(offset);
+       pSMB->SetupCount = 1;
+-- 
+2.43.0
+
diff --git a/queue-6.12/soc-imx8m-probe-the-soc-driver-as-platform-driver.patch b/queue-6.12/soc-imx8m-probe-the-soc-driver-as-platform-driver.patch
new file mode 100644 (file)
index 0000000..b59de6b
--- /dev/null
@@ -0,0 +1,273 @@
+From 6b8936fa1071fa2a5f234e346d9fb7b33a79c502 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2024 20:49:16 +0200
+Subject: soc: imx8m: Probe the SoC driver as platform driver
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 9cc832d37799dbea950c4c8a34721b02b8b5a8ff ]
+
+With driver_async_probe=* on kernel command line, the following trace is
+produced because on i.MX8M Plus hardware because the soc-imx8m.c driver
+calls of_clk_get_by_name() which returns -EPROBE_DEFER because the clock
+driver is not yet probed. This was not detected during regular testing
+without driver_async_probe.
+
+Convert the SoC code to platform driver and instantiate a platform device
+in its current device_initcall() to probe the platform driver. Rework
+.soc_revision callback to always return valid error code and return SoC
+revision via parameter. This way, if anything in the .soc_revision callback
+return -EPROBE_DEFER, it gets propagated to .probe and the .probe will get
+retried later.
+
+"
+------------[ cut here ]------------
+WARNING: CPU: 1 PID: 1 at drivers/soc/imx/soc-imx8m.c:115 imx8mm_soc_revision+0xdc/0x180
+CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-next-20240924-00002-g2062bb554dea #603
+Hardware name: DH electronics i.MX8M Plus DHCOM Premium Developer Kit (3) (DT)
+pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : imx8mm_soc_revision+0xdc/0x180
+lr : imx8mm_soc_revision+0xd0/0x180
+sp : ffff8000821fbcc0
+x29: ffff8000821fbce0 x28: 0000000000000000 x27: ffff800081810120
+x26: ffff8000818a9970 x25: 0000000000000006 x24: 0000000000824311
+x23: ffff8000817f42c8 x22: ffff0000df8be210 x21: fffffffffffffdfb
+x20: ffff800082780000 x19: 0000000000000001 x18: ffffffffffffffff
+x17: ffff800081fff418 x16: ffff8000823e1000 x15: ffff0000c03b65e8
+x14: ffff0000c00051b0 x13: ffff800082790000 x12: 0000000000000801
+x11: ffff80008278ffff x10: ffff80008209d3a6 x9 : ffff80008062e95c
+x8 : ffff8000821fb9a0 x7 : 0000000000000000 x6 : 00000000000080e3
+x5 : ffff0000df8c03d8 x4 : 0000000000000000 x3 : 0000000000000000
+x2 : 0000000000000000 x1 : fffffffffffffdfb x0 : fffffffffffffdfb
+Call trace:
+ imx8mm_soc_revision+0xdc/0x180
+ imx8_soc_init+0xb0/0x1e0
+ do_one_initcall+0x94/0x1a8
+ kernel_init_freeable+0x240/0x2a8
+ kernel_init+0x28/0x140
+ ret_from_fork+0x10/0x20
+---[ end trace 0000000000000000 ]---
+SoC: i.MX8MP revision 1.1
+"
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/soc-imx8m.c | 107 ++++++++++++++++++++++++++++--------
+ 1 file changed, 85 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c
+index fe111bae38c8e..5ea8887828c06 100644
+--- a/drivers/soc/imx/soc-imx8m.c
++++ b/drivers/soc/imx/soc-imx8m.c
+@@ -30,7 +30,7 @@
+ struct imx8_soc_data {
+       char *name;
+-      u32 (*soc_revision)(void);
++      int (*soc_revision)(u32 *socrev);
+ };
+ static u64 soc_uid;
+@@ -51,24 +51,29 @@ static u32 imx8mq_soc_revision_from_atf(void)
+ static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; };
+ #endif
+-static u32 __init imx8mq_soc_revision(void)
++static int imx8mq_soc_revision(u32 *socrev)
+ {
+       struct device_node *np;
+       void __iomem *ocotp_base;
+       u32 magic;
+       u32 rev;
+       struct clk *clk;
++      int ret;
+       np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp");
+       if (!np)
+-              return 0;
++              return -EINVAL;
+       ocotp_base = of_iomap(np, 0);
+-      WARN_ON(!ocotp_base);
++      if (!ocotp_base) {
++              ret = -EINVAL;
++              goto err_iomap;
++      }
++
+       clk = of_clk_get_by_name(np, NULL);
+       if (IS_ERR(clk)) {
+-              WARN_ON(IS_ERR(clk));
+-              return 0;
++              ret = PTR_ERR(clk);
++              goto err_clk;
+       }
+       clk_prepare_enable(clk);
+@@ -88,32 +93,45 @@ static u32 __init imx8mq_soc_revision(void)
+       soc_uid <<= 32;
+       soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW);
++      *socrev = rev;
++
+       clk_disable_unprepare(clk);
+       clk_put(clk);
+       iounmap(ocotp_base);
+       of_node_put(np);
+-      return rev;
++      return 0;
++
++err_clk:
++      iounmap(ocotp_base);
++err_iomap:
++      of_node_put(np);
++      return ret;
+ }
+-static void __init imx8mm_soc_uid(void)
++static int imx8mm_soc_uid(void)
+ {
+       void __iomem *ocotp_base;
+       struct device_node *np;
+       struct clk *clk;
++      int ret = 0;
+       u32 offset = of_machine_is_compatible("fsl,imx8mp") ?
+                    IMX8MP_OCOTP_UID_OFFSET : 0;
+       np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp");
+       if (!np)
+-              return;
++              return -EINVAL;
+       ocotp_base = of_iomap(np, 0);
+-      WARN_ON(!ocotp_base);
++      if (!ocotp_base) {
++              ret = -EINVAL;
++              goto err_iomap;
++      }
++
+       clk = of_clk_get_by_name(np, NULL);
+       if (IS_ERR(clk)) {
+-              WARN_ON(IS_ERR(clk));
+-              return;
++              ret = PTR_ERR(clk);
++              goto err_clk;
+       }
+       clk_prepare_enable(clk);
+@@ -124,31 +142,41 @@ static void __init imx8mm_soc_uid(void)
+       clk_disable_unprepare(clk);
+       clk_put(clk);
++
++err_clk:
+       iounmap(ocotp_base);
++err_iomap:
+       of_node_put(np);
++
++      return ret;
+ }
+-static u32 __init imx8mm_soc_revision(void)
++static int imx8mm_soc_revision(u32 *socrev)
+ {
+       struct device_node *np;
+       void __iomem *anatop_base;
+-      u32 rev;
++      int ret;
+       np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop");
+       if (!np)
+-              return 0;
++              return -EINVAL;
+       anatop_base = of_iomap(np, 0);
+-      WARN_ON(!anatop_base);
++      if (!anatop_base) {
++              ret = -EINVAL;
++              goto err_iomap;
++      }
+-      rev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM);
++      *socrev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM);
+       iounmap(anatop_base);
+       of_node_put(np);
+-      imx8mm_soc_uid();
++      return imx8mm_soc_uid();
+-      return rev;
++err_iomap:
++      of_node_put(np);
++      return ret;
+ }
+ static const struct imx8_soc_data imx8mq_soc_data = {
+@@ -184,7 +212,7 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = {
+       kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf,  soc_rev & 0xf) : \
+       "unknown"
+-static int __init imx8_soc_init(void)
++static int imx8m_soc_probe(struct platform_device *pdev)
+ {
+       struct soc_device_attribute *soc_dev_attr;
+       struct soc_device *soc_dev;
+@@ -212,8 +240,11 @@ static int __init imx8_soc_init(void)
+       data = id->data;
+       if (data) {
+               soc_dev_attr->soc_id = data->name;
+-              if (data->soc_revision)
+-                      soc_rev = data->soc_revision();
++              if (data->soc_revision) {
++                      ret = data->soc_revision(&soc_rev);
++                      if (ret)
++                              goto free_soc;
++              }
+       }
+       soc_dev_attr->revision = imx8_revision(soc_rev);
+@@ -251,6 +282,38 @@ static int __init imx8_soc_init(void)
+       kfree(soc_dev_attr);
+       return ret;
+ }
++
++static struct platform_driver imx8m_soc_driver = {
++      .probe = imx8m_soc_probe,
++      .driver = {
++              .name = "imx8m-soc",
++      },
++};
++
++static int __init imx8_soc_init(void)
++{
++      struct platform_device *pdev;
++      int ret;
++
++      /* No match means this is non-i.MX8M hardware, do nothing. */
++      if (!of_match_node(imx8_soc_match, of_root))
++              return 0;
++
++      ret = platform_driver_register(&imx8m_soc_driver);
++      if (ret) {
++              pr_err("Failed to register imx8m-soc platform driver: %d\n", ret);
++              return ret;
++      }
++
++      pdev = platform_device_register_simple("imx8m-soc", -1, NULL, 0);
++      if (IS_ERR(pdev)) {
++              pr_err("Failed to register imx8m-soc platform device: %ld\n", PTR_ERR(pdev));
++              platform_driver_unregister(&imx8m_soc_driver);
++              return PTR_ERR(pdev);
++      }
++
++      return 0;
++}
+ device_initcall(imx8_soc_init);
+ MODULE_DESCRIPTION("NXP i.MX8M SoC driver");
+ MODULE_LICENSE("GPL");
+-- 
+2.43.0
+
diff --git a/queue-6.12/soc-qcom-llcc-use-designated-initializers-for-llc-se.patch b/queue-6.12/soc-qcom-llcc-use-designated-initializers-for-llc-se.patch
new file mode 100644 (file)
index 0000000..f390bd5
--- /dev/null
@@ -0,0 +1,2731 @@
+From 11386be3fc5b19bc191d109a279978d591c104a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 17:01:39 +0200
+Subject: soc: qcom: llcc: Use designated initializers for LLC settings
+
+From: Konrad Dybcio <quic_kdybcio@quicinc.com>
+
+[ Upstream commit 20a0a05f40faf82f64f1c2ad3e9f5006b80ca0cb ]
+
+The current way of storing the configuration is very much
+unmaintainable. Convert the data to use designated initializers to make
+it easier both to understand and add/update the slice configuration
+data.
+
+Signed-off-by: Konrad Dybcio <quic_kdybcio@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240910-topic-llcc_unwrap-v2-1-f0487c983373@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/llcc-qcom.c | 2644 ++++++++++++++++++++++++++++++----
+ 1 file changed, 2375 insertions(+), 269 deletions(-)
+
+diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c
+index 28bcc65e91beb..a470285f54a87 100644
+--- a/drivers/soc/qcom/llcc-qcom.c
++++ b/drivers/soc/qcom/llcc-qcom.c
+@@ -153,325 +153,2431 @@ enum llcc_reg_offset {
+ };
+ static const struct llcc_slice_config sa8775p_data[] =  {
+-      {LLCC_CPUSS,    1, 2048, 1, 0, 0x00FF, 0x0, 0, 0, 0, 1, 1, 0, 0},
+-      {LLCC_VIDSC0,   2, 512, 3, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_CPUSS1,   3, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_CPUHWT,   5, 512, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_AUDIO,    6, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CMPT,     10, 4096, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_GPUHTW,   11, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_GPU,      12, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 1, 0},
+-      {LLCC_MMUHWT,   13, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 0, 1, 0, 0},
+-      {LLCC_CMPTDMA,  15, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_DISP,     16, 4096, 2, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_VIDFW,    17, 3072, 1, 0, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_AUDHW,    22, 1024, 1, 1, 0x00FF, 0x0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CVP,      28, 256, 3, 1, 0x00FF, 0x0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_APTCM,    30, 1024, 3, 1, 0x0, 0xF0, 1, 0, 0, 1, 0, 0, 0},
+-      {LLCC_WRCACHE,    31, 512, 1, 1, 0x00FF, 0x0, 0, 0, 0, 0, 1, 0, 0},
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 2048,
++              .priority = 1,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CPUSS1,
++              .slice_id = 3,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CPUHWT,
++              .slice_id = 5,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 4096,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .write_scid_en = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 13,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CMPTDMA,
++              .slice_id = 15,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 4096,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_VIDFW,
++              .slice_id = 17,
++              .max_cap = 3072,
++              .priority = 1,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CVP,
++              .slice_id = 28,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 1024,
++              .priority = 3,
++              .fixed_size = true,
++              .res_ways = 0xf0,
++              .cache_mode = 1,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      },
+ };
+ static const struct llcc_slice_config sc7180_data[] =  {
+-      { LLCC_CPUSS,    1,  256, 1, 0, 0xf, 0x0, 0, 0, 0, 1, 1 },
+-      { LLCC_MDM,      8,  128, 1, 0, 0xf, 0x0, 0, 0, 0, 1, 0 },
+-      { LLCC_GPUHTW,   11, 128, 1, 0, 0xf, 0x0, 0, 0, 0, 1, 0 },
+-      { LLCC_GPU,      12, 128, 1, 0, 0xf, 0x0, 0, 0, 0, 1, 0 },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 256,
++              .priority = 1,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MDM,
++              .slice_id = 8,
++              .max_cap = 128,
++              .priority = 1,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 128,
++              .priority = 1,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 128,
++              .priority = 1,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      },
+ };
+ static const struct llcc_slice_config sc7280_data[] =  {
+-      { LLCC_CPUSS,    1,  768, 1, 0, 0x3f, 0x0, 0, 0, 0, 1, 1, 0},
+-      { LLCC_MDMHPGRW, 7,  512, 2, 1, 0x3f, 0x0, 0, 0, 0, 1, 0, 0},
+-      { LLCC_CMPT,     10, 768, 1, 1, 0x3f, 0x0, 0, 0, 0, 1, 0, 0},
+-      { LLCC_GPUHTW,   11, 256, 1, 1, 0x3f, 0x0, 0, 0, 0, 1, 0, 0},
+-      { LLCC_GPU,      12, 512, 1, 0, 0x3f, 0x0, 0, 0, 0, 1, 0, 0},
+-      { LLCC_MMUHWT,   13, 256, 1, 1, 0x3f, 0x0, 0, 0, 0, 0, 1, 0},
+-      { LLCC_MDMPNG,   21, 768, 0, 1, 0x3f, 0x0, 0, 0, 0, 1, 0, 0},
+-      { LLCC_WLHW,     24, 256, 1, 1, 0x3f, 0x0, 0, 0, 0, 1, 0, 0},
+-      { LLCC_MODPE,    29, 64,  1, 1, 0x3f, 0x0, 0, 0, 0, 1, 0, 0},
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 768,
++              .priority = 1,
++              .bonus_ways = 0x3f,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 7,
++              .max_cap = 512,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0x3f,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 768,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0x3f,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0x3f,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 512,
++              .priority = 1,
++              .bonus_ways = 0x3f,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 13,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0x3f,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 21,
++              .max_cap = 768,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0x3f,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WLHW,
++              .slice_id = 24,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0x3f,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 64,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0x3f,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      },
+ };
+ static const struct llcc_slice_config sc8180x_data[] = {
+-      { LLCC_CPUSS,    1, 6144,  1, 1, 0xfff, 0x0,   0, 0, 0, 1, 1 },
+-      { LLCC_VIDSC0,   2, 512,   2, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_VIDSC1,   3, 512,   2, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_AUDIO,    6, 1024,  1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_MDMHPGRW, 7, 3072,  1, 1, 0x3ff, 0xc00, 0, 0, 0, 1, 0 },
+-      { LLCC_MDM,      8, 3072,  1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_MODHW,    9, 1024,  1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_CMPT,     10, 6144, 1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_GPUHTW,   11, 1024, 1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_GPU,      12, 5120, 1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_MMUHWT,   13, 1024, 1, 1, 0xfff, 0x0,   0, 0, 0, 0, 1 },
+-      { LLCC_CMPTDMA,  15, 6144, 1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_DISP,     16, 6144, 1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_VIDFW,    17, 1024, 1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_MDMHPFX,  20, 1024, 2, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_MDMPNG,   21, 1024, 0, 1, 0xc,   0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_AUDHW,    22, 1024, 1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_NPU,      23, 6144, 1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_WLHW,     24, 6144, 1, 1, 0xfff, 0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_MODPE,    29, 512,  1, 1, 0xc,   0x0,   0, 0, 0, 1, 0 },
+-      { LLCC_APTCM,    30, 512,  3, 1, 0x0,   0x1,   1, 0, 0, 1, 0 },
+-      { LLCC_WRCACHE,  31, 128,  1, 1, 0xfff, 0x0,   0, 0, 0, 0, 0 },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_VIDSC1,
++              .slice_id = 3,
++              .max_cap = 512,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 7,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0x3ff,
++              .res_ways = 0xc00,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDM,
++              .slice_id = 8,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODHW,
++              .slice_id = 9,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 5120,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 13,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CMPTDMA,
++              .slice_id = 15,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_VIDFW,
++              .slice_id = 17,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMHPFX,
++              .slice_id = 20,
++              .max_cap = 1024,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 21,
++              .max_cap = 1024,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0xc,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_NPU,
++              .slice_id = 23,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WLHW,
++              .slice_id = 24,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xc,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .res_ways = 0x1,
++              .cache_mode = 1,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 128,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      },
+ };
+ static const struct llcc_slice_config sc8280xp_data[] = {
+-      { LLCC_CPUSS,    1,  6144, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 1, 0 },
+-      { LLCC_VIDSC0,   2,  512,  3, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_AUDIO,    6,  1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 0, 0 },
+-      { LLCC_CMPT,     10, 6144, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 0, 0 },
+-      { LLCC_GPUHTW,   11, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_GPU,      12, 4096, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 1 },
+-      { LLCC_MMUHWT,   13, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_DISP,     16, 6144, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_AUDHW,    22, 2048, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_ECC,      26, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_CVP,      28, 512,  3, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_APTCM,    30, 1024, 3, 1, 0x0,   0x1, 1, 0, 0, 1, 0, 0 },
+-      { LLCC_WRCACHE,  31, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_CVPFW,    17, 512,  1, 0, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_CPUSS1,   3, 2048, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_CPUHWT,   5, 512,  1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 4096,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .write_scid_en = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 13,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 2048,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_ECC,
++              .slice_id = 26,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CVP,
++              .slice_id = 28,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 1024,
++              .priority = 3,
++              .fixed_size = true,
++              .res_ways = 0x1,
++              .cache_mode = 1,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CVPFW,
++              .slice_id = 17,
++              .max_cap = 512,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CPUSS1,
++              .slice_id = 3,
++              .max_cap = 2048,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CPUHWT,
++              .slice_id = 5,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      },
+ };
+-static const struct llcc_slice_config sdm845_data[] =  {
+-      { LLCC_CPUSS,    1,  2816, 1, 0, 0xffc, 0x2,   0, 0, 1, 1, 1 },
+-      { LLCC_VIDSC0,   2,  512,  2, 1, 0x0,   0x0f0, 0, 0, 1, 1, 0 },
+-      { LLCC_VIDSC1,   3,  512,  2, 1, 0x0,   0x0f0, 0, 0, 1, 1, 0 },
+-      { LLCC_ROTATOR,  4,  563,  2, 1, 0x0,   0x00e, 2, 0, 1, 1, 0 },
+-      { LLCC_VOICE,    5,  2816, 1, 0, 0xffc, 0x2,   0, 0, 1, 1, 0 },
+-      { LLCC_AUDIO,    6,  2816, 1, 0, 0xffc, 0x2,   0, 0, 1, 1, 0 },
+-      { LLCC_MDMHPGRW, 7,  1024, 2, 0, 0xfc,  0xf00, 0, 0, 1, 1, 0 },
+-      { LLCC_MDM,      8,  2816, 1, 0, 0xffc, 0x2,   0, 0, 1, 1, 0 },
+-      { LLCC_CMPT,     10, 2816, 1, 0, 0xffc, 0x2,   0, 0, 1, 1, 0 },
+-      { LLCC_GPUHTW,   11, 512,  1, 1, 0xc,   0x0,   0, 0, 1, 1, 0 },
+-      { LLCC_GPU,      12, 2304, 1, 0, 0xff0, 0x2,   0, 0, 1, 1, 0 },
+-      { LLCC_MMUHWT,   13, 256,  2, 0, 0x0,   0x1,   0, 0, 1, 0, 1 },
+-      { LLCC_CMPTDMA,  15, 2816, 1, 0, 0xffc, 0x2,   0, 0, 1, 1, 0 },
+-      { LLCC_DISP,     16, 2816, 1, 0, 0xffc, 0x2,   0, 0, 1, 1, 0 },
+-      { LLCC_VIDFW,    17, 2816, 1, 0, 0xffc, 0x2,   0, 0, 1, 1, 0 },
+-      { LLCC_MDMHPFX,  20, 1024, 2, 1, 0x0,   0xf00, 0, 0, 1, 1, 0 },
+-      { LLCC_MDMPNG,   21, 1024, 0, 1, 0x1e,  0x0,   0, 0, 1, 1, 0 },
+-      { LLCC_AUDHW,    22, 1024, 1, 1, 0xffc, 0x2,   0, 0, 1, 1, 0 },
++static const struct llcc_slice_config sdm845_data[] =  {{
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 2816,
++              .priority = 1,
++              .bonus_ways = 0xffc,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 2,
++              .fixed_size = true,
++              .res_ways = 0xf0,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_VIDSC1,
++              .slice_id = 3,
++              .max_cap = 512,
++              .priority = 2,
++              .fixed_size = true,
++              .res_ways = 0xf0,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_ROTATOR,
++              .slice_id = 4,
++              .max_cap = 563,
++              .priority = 2,
++              .fixed_size = true,
++              .res_ways = 0xe,
++              .cache_mode = 2,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_VOICE,
++              .slice_id = 5,
++              .max_cap = 2816,
++              .priority = 1,
++              .bonus_ways = 0xffc,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 2816,
++              .priority = 1,
++              .bonus_ways = 0xffc,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 7,
++              .max_cap = 1024,
++              .priority = 2,
++              .bonus_ways = 0xfc,
++              .res_ways = 0xf00,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDM,
++              .slice_id = 8,
++              .max_cap = 2816,
++              .priority = 1,
++              .bonus_ways = 0xffc,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 2816,
++              .priority = 1,
++              .bonus_ways = 0xffc,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xc,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 2304,
++              .priority = 1,
++              .bonus_ways = 0xff0,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 13,
++              .max_cap = 256,
++              .priority = 2,
++              .res_ways = 0x1,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CMPTDMA,
++              .slice_id = 15,
++              .max_cap = 2816,
++              .priority = 1,
++              .bonus_ways = 0xffc,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 2816,
++              .priority = 1,
++              .bonus_ways = 0xffc,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_VIDFW,
++              .slice_id = 17,
++              .max_cap = 2816,
++              .priority = 1,
++              .bonus_ways = 0xffc,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMHPFX,
++              .slice_id = 20,
++              .max_cap = 1024,
++              .priority = 2,
++              .fixed_size = true,
++              .res_ways = 0xf00,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 21,
++              .max_cap = 1024,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0x1e,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffc,
++              .res_ways = 0x2,
++              .cache_mode = 0,
++              .dis_cap_alloc = true,
++              .retain_on_pc = true,
++      },
+ };
+ static const struct llcc_slice_config sm6350_data[] =  {
+-      { LLCC_CPUSS,    1,  768, 1, 0, 0xFFF, 0x0, 0, 0, 0, 0, 1, 1 },
+-      { LLCC_MDM,      8,  512, 2, 0, 0xFFF, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_GPUHTW,   11, 256, 1, 0, 0xFFF, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_GPU,      12, 512, 1, 0, 0xFFF, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_MDMPNG,   21, 768, 0, 1, 0xFFF, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_NPU,      23, 768, 1, 0, 0xFFF, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_MODPE,    29,  64, 1, 1, 0xFFF, 0x0, 0, 0, 0, 0, 1, 0 },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 768,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++              .write_scid_en = true,
++      }, {
++              .usecase_id = LLCC_MDM,
++              .slice_id = 8,
++              .max_cap = 512,
++              .priority = 2,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 256,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 512,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 21,
++              .max_cap = 768,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_NPU,
++              .slice_id = 23,
++              .max_cap = 768,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 64,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      },
+ };
+ static const struct llcc_slice_config sm7150_data[] =  {
+-      { LLCC_CPUSS,    1,  512, 1, 0, 0xF, 0x0, 0, 0, 0, 1, 1 },
+-      { LLCC_MDM,      8,  128, 2, 0, 0xF, 0x0, 0, 0, 0, 1, 0 },
+-      { LLCC_GPUHTW,   11, 256, 1, 1, 0xF, 0x0, 0, 0, 0, 1, 0 },
+-      { LLCC_GPU,      12, 256, 1, 1, 0xF, 0x0, 0, 0, 0, 1, 0 },
+-      { LLCC_NPU,      23, 512, 1, 0, 0xF, 0x0, 0, 0, 0, 1, 0 },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 512,
++              .priority = 1,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MDM,
++              .slice_id = 8,
++              .max_cap = 128,
++              .priority = 2,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_NPU,
++              .slice_id = 23,
++              .max_cap = 512,
++              .priority = 1,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      },
+ };
+ static const struct llcc_slice_config sm8150_data[] =  {
+-      {  LLCC_CPUSS,    1, 3072, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 1 },
+-      {  LLCC_VIDSC0,   2, 512,  2, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_VIDSC1,   3, 512,  2, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_AUDIO,    6, 1024, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_MDMHPGRW, 7, 3072, 1, 0, 0xFF,  0xF00, 0, 0, 0, 1, 0 },
+-      {  LLCC_MDM,      8, 3072, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_MODHW,    9, 1024, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_CMPT,    10, 3072, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_GPUHTW , 11, 512,  1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_GPU,     12, 2560, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_MMUHWT,  13, 1024, 1, 1, 0xFFF, 0x0,   0, 0, 0, 0, 1 },
+-      {  LLCC_CMPTDMA, 15, 3072, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_DISP,    16, 3072, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_MDMHPFX, 20, 1024, 2, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_MDMHPFX, 21, 1024, 0, 1, 0xF,   0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_AUDHW,   22, 1024, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_NPU,     23, 3072, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_WLHW,    24, 3072, 1, 1, 0xFFF, 0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_MODPE,   29, 256,  1, 1, 0xF,   0x0,   0, 0, 0, 1, 0 },
+-      {  LLCC_APTCM,   30, 256,  3, 1, 0x0,   0x1,   1, 0, 0, 1, 0 },
+-      {  LLCC_WRCACHE, 31, 128,  1, 1, 0xFFF, 0x0,   0, 0, 0, 0, 0 },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_VIDSC1,
++              .slice_id = 3,
++              .max_cap = 512,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 7,
++              .max_cap = 3072,
++              .priority = 1,
++              .bonus_ways = 0xff,
++              .res_ways = 0xf00,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDM,
++              .slice_id = 8,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODHW,
++              .slice_id = 9,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 2560,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 13,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CMPTDMA,
++              .slice_id = 15,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMHPFX,
++              .slice_id = 20,
++              .max_cap = 1024,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMHPFX,
++              .slice_id = 21,
++              .max_cap = 1024,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_NPU,
++              .slice_id = 23,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WLHW,
++              .slice_id = 24,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .res_ways = 0x1,
++              .cache_mode = 1,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 128,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      },
+ };
+ static const struct llcc_slice_config sm8250_data[] =  {
+-      { LLCC_CPUSS,    1, 3072, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 1, 0 },
+-      { LLCC_VIDSC0,   2, 512,  3, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_AUDIO,    6, 1024, 1, 0, 0xfff, 0x0, 0, 0, 0, 0, 0, 0 },
+-      { LLCC_CMPT,    10, 1024, 1, 0, 0xfff, 0x0, 0, 0, 0, 0, 0, 0 },
+-      { LLCC_GPUHTW,  11, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_GPU,     12, 1024, 1, 0, 0xfff, 0x0, 0, 0, 0, 1, 0, 1 },
+-      { LLCC_MMUHWT,  13, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_CMPTDMA, 15, 1024, 1, 0, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_DISP,    16, 3072, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_VIDFW,   17, 512,  1, 0, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_AUDHW,   22, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_NPU,     23, 3072, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_WLHW,    24, 1024, 1, 0, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_CVP,     28, 256,  3, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_APTCM,   30, 128,  3, 0, 0x0,   0x3, 1, 0, 0, 1, 0, 0 },
+-      { LLCC_WRCACHE, 31, 256,  1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 1024,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 1024,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 1024,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .write_scid_en = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 13,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CMPTDMA,
++              .slice_id = 15,
++              .max_cap = 1024,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_VIDFW,
++              .slice_id = 17,
++              .max_cap = 512,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_NPU,
++              .slice_id = 23,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WLHW,
++              .slice_id = 24,
++              .max_cap = 1024,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CVP,
++              .slice_id = 28,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 128,
++              .priority = 3,
++              .res_ways = 0x3,
++              .cache_mode = 1,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      },
+ };
+ static const struct llcc_slice_config sm8350_data[] =  {
+-      { LLCC_CPUSS,    1, 3072,  1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 1 },
+-      { LLCC_VIDSC0,   2, 512,   3, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_AUDIO,    6, 1024,  1, 1, 0xfff, 0x0, 0, 0, 0, 0, 0, 0 },
+-      { LLCC_MDMHPGRW, 7, 1024,  3, 0, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_MODHW,    9, 1024,  1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_CMPT,     10, 3072, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_GPUHTW,   11, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_GPU,      12, 1024, 1, 0, 0xfff, 0x0, 0, 0, 0, 1, 1, 0 },
+-      { LLCC_MMUHWT,   13, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 0, 1 },
+-      { LLCC_DISP,     16, 3072, 2, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_MDMPNG,   21, 1024, 0, 1, 0xf,   0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_AUDHW,    22, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_CVP,      28, 512,  3, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_MODPE,    29, 256,  1, 1, 0xf,   0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_APTCM,    30, 1024, 3, 1, 0x0,   0x1, 1, 0, 0, 0, 1, 0 },
+-      { LLCC_WRCACHE,  31, 512,  1, 1, 0xfff, 0x0, 0, 0, 0, 0, 0, 1 },
+-      { LLCC_CVPFW,    17, 512,  1, 0, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_CPUSS1,   3, 1024,  1, 1, 0xfff, 0x0, 0, 0, 0, 0, 1, 0 },
+-      { LLCC_CPUHWT,   5, 512,   1, 1, 0xfff, 0x0, 0, 0, 0, 0, 0, 1 },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++              .write_scid_en = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 7,
++              .max_cap = 1024,
++              .priority = 3,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MODHW,
++              .slice_id = 9,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 1024,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 13,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .write_scid_en = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 3072,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 21,
++              .max_cap = 1024,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CVP,
++              .slice_id = 28,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 1024,
++              .priority = 3,
++              .fixed_size = true,
++              .res_ways = 0x1,
++              .cache_mode = 1,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .write_scid_en = true,
++      }, {
++              .usecase_id = LLCC_CVPFW,
++              .slice_id = 17,
++              .max_cap = 512,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CPUSS1,
++              .slice_id = 3,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CPUHWT,
++              .slice_id = 5,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .write_scid_en = true,
++      },
+ };
+ static const struct llcc_slice_config sm8450_data[] =  {
+-      {LLCC_CPUSS,     1, 3072, 1, 0, 0xFFFF, 0x0,   0, 0, 0, 1, 1, 0, 0 },
+-      {LLCC_VIDSC0,    2,  512, 3, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_AUDIO,     6, 1024, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0 },
+-      {LLCC_MDMHPGRW,  7, 1024, 3, 0, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_MODHW,     9, 1024, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_CMPT,     10, 4096, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_GPUHTW,   11,  512, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_GPU,      12, 2048, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 1, 0 },
+-      {LLCC_MMUHWT,   13,  768, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 0, 1, 0, 0 },
+-      {LLCC_DISP,     16, 4096, 2, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_MDMPNG,   21, 1024, 1, 1, 0xF000, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_AUDHW,    22, 1024, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0 },
+-      {LLCC_CVP,      28,  256, 3, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_MODPE,    29,   64, 1, 1, 0xF000, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_APTCM,    30, 1024, 3, 1, 0x0,    0xF0,  1, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_WRCACHE,  31,  512, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 0, 1, 0, 0 },
+-      {LLCC_CVPFW,    17,  512, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_CPUSS1,    3, 1024, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_CAMEXP0,   4,  256, 3, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_CPUMTE,   23,  256, 1, 1, 0x0FFF, 0x0,   0, 0, 0, 0, 1, 0, 0 },
+-      {LLCC_CPUHWT,    5,  512, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 1, 0, 0 },
+-      {LLCC_CAMEXP1,  27,  256, 3, 1, 0xFFFF, 0x0,   0, 0, 0, 1, 0, 0, 0 },
+-      {LLCC_AENPU,     8, 2048, 1, 1, 0xFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0 },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 3072,
++              .priority = 1,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 7,
++              .max_cap = 1024,
++              .priority = 3,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODHW,
++              .slice_id = 9,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 4096,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 12,
++              .max_cap = 2048,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .write_scid_en = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 13,
++              .max_cap = 768,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 4096,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 21,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xf000,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CVP,
++              .slice_id = 28,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 64,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xf000,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 1024,
++              .priority = 3,
++              .fixed_size = true,
++              .res_ways = 0xf0,
++              .cache_mode = 1,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CVPFW,
++              .slice_id = 17,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CPUSS1,
++              .slice_id = 3,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CAMEXP0,
++              .slice_id = 4,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_CPUMTE,
++              .slice_id = 23,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CPUHWT,
++              .slice_id = 5,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CAMEXP1,
++              .slice_id = 27,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_AENPU,
++              .slice_id = 8,
++              .max_cap = 2048,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffff,
++              .cache_mode = 0,
++      },
+ };
+ static const struct llcc_slice_config sm8550_data[] =  {
+-      {LLCC_CPUSS,     1, 5120, 1, 0, 0xFFFFFF, 0x0,   0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_VIDSC0,    2,  512, 4, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_AUDIO,     6, 1024, 1, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_MDMHPGRW, 25, 1024, 4, 0, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_MODHW,    26, 1024, 1, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_CMPT,     10, 4096, 1, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_GPUHTW,   11,  512, 1, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_GPU,       9, 3096, 1, 0, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_MMUHWT,   18,  768, 1, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_DISP,     16, 6144, 1, 1, 0xFFFFFF, 0x0,   2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_MDMPNG,   27, 1024, 0, 1, 0xF00000, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_AUDHW,    22, 1024, 1, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_CVP,       8,  256, 4, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_MODPE,    29,   64, 1, 1, 0xF00000, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, },
+-      {LLCC_WRCACHE,  31,  512, 1, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_CAMEXP0,   4,  256, 4, 1,      0xF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_CPUHWT,    5,  512, 1, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_CAMEXP1,   7, 3200, 3, 1, 0xFFFFF0, 0x0,   2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_CMPTHCP,  17,  256, 4, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_LCPDARE,  30,  128, 4, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, },
+-      {LLCC_AENPU,     3, 3072, 1, 1, 0xFE01FF, 0x0,   2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_ISLAND1,  12, 1792, 7, 1,   0xFE00, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_ISLAND4,  15,  256, 7, 1,  0x10000, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_CAMEXP2,  19, 3200, 3, 1, 0xFFFFF0, 0x0,   2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_CAMEXP3,  20, 3200, 2, 1, 0xFFFFF0, 0x0,   2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_CAMEXP4,  21, 3200, 2, 1, 0xFFFFF0, 0x0,   2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_DISP_WB,  23, 1024, 4, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_DISP_1,   24, 6144, 1, 1, 0xFFFFFF, 0x0,   2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+-      {LLCC_VIDVSP,   28,  256, 4, 1, 0xFFFFFF, 0x0,   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 5120,
++              .priority = 1,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++              .write_scid_en = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 25,
++              .max_cap = 1024,
++              .priority = 4,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_MODHW,
++              .slice_id = 26,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 4096,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 9,
++              .max_cap = 3096,
++              .priority = 1,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .write_scid_en = true,
++              .write_scid_cacheable_en = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 18,
++              .max_cap = 768,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 27,
++              .max_cap = 1024,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0xf00000,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CVP,
++              .slice_id = 8,
++              .max_cap = 256,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 64,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xf00000,
++              .cache_mode = 0,
++              .alloc_oneway_en = true,
++              .vict_prio = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CAMEXP0,
++              .slice_id = 4,
++              .max_cap = 256,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CPUHWT,
++              .slice_id = 5,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CAMEXP1,
++              .slice_id = 7,
++              .max_cap = 3200,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfffff0,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_CMPTHCP,
++              .slice_id = 17,
++              .max_cap = 256,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_LCPDARE,
++              .slice_id = 30,
++              .max_cap = 128,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++              .alloc_oneway_en = true,
++              .vict_prio = true,
++      }, {
++              .usecase_id = LLCC_AENPU,
++              .slice_id = 3,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfe01ff,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_ISLAND1,
++              .slice_id = 12,
++              .max_cap = 1792,
++              .priority = 7,
++              .fixed_size = true,
++              .bonus_ways = 0xfe00,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_ISLAND4,
++              .slice_id = 15,
++              .max_cap = 256,
++              .priority = 7,
++              .fixed_size = true,
++              .bonus_ways = 0x10000,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CAMEXP2,
++              .slice_id = 19,
++              .max_cap = 3200,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfffff0,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_CAMEXP3,
++              .slice_id = 20,
++              .max_cap = 3200,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xfffff0,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_CAMEXP4,
++              .slice_id = 21,
++              .max_cap = 3200,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xfffff0,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_DISP_WB,
++              .slice_id = 23,
++              .max_cap = 1024,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_DISP_1,
++              .slice_id = 24,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_VIDVSP,
++              .slice_id = 28,
++              .max_cap = 256,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      },
+ };
+ static const struct llcc_slice_config sm8650_data[] = {
+-      {LLCC_CPUSS,     1, 5120, 1, 0, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_VIDSC0,    2,  512, 3, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_AUDIO,     6,  512, 1, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_MDMHPGRW, 25, 1024, 3, 0, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_MODHW,    26, 1024, 1, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CMPT,     10, 4096, 1, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_GPUHTW,   11,  512, 1, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_GPU,       9, 3096, 1, 0, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_MMUHWT,   18,  768, 1, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_DISP,     16, 6144, 1, 1, 0xFFFFFF, 0x0,      2, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_MDMHPFX,  24, 1024, 3, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_MDMPNG,   27, 1024, 0, 1, 0x000000, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_AUDHW,    22, 1024, 1, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CVP,       8,  256, 3, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_MODPE,    29,  128, 1, 1, 0xF00000, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_WRCACHE,  31,  512, 1, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CAMEXP0,   4,  256, 3, 1,      0xF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CAMEXP1,   7, 3200, 3, 1, 0xFFFFF0, 0x0,      2, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CMPTHCP,  17,  256, 3, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_LCPDARE,  30,  128, 3, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_AENPU,     3, 3072, 1, 1, 0xFFFFFF, 0x0,      2, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_ISLAND1,  12, 5888, 7, 1,      0x0, 0x7FFFFF, 0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_DISP_WB,  23, 1024, 3, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_VIDVSP,   28,  256, 3, 1, 0xFFFFFF, 0x0,      0, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 5120,
++              .priority = 1,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++              .stale_en = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 25,
++              .max_cap = 1024,
++              .priority = 3,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_MODHW,
++              .slice_id = 26,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 4096,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 9,
++              .max_cap = 3096,
++              .priority = 1,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .write_scid_en = true,
++              .write_scid_cacheable_en = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 18,
++              .max_cap = 768,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_DISP,
++              .slice_id = 16,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_MDMHPFX,
++              .slice_id = 24,
++              .max_cap = 1024,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 27,
++              .max_cap = 1024,
++              .priority = 0,
++              .fixed_size = true,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CVP,
++              .slice_id = 8,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 128,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xf00000,
++              .cache_mode = 0,
++              .alloc_oneway_en = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_CAMEXP0,
++              .slice_id = 4,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xf,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CAMEXP1,
++              .slice_id = 7,
++              .max_cap = 3200,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfffff0,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_CMPTHCP,
++              .slice_id = 17,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_LCPDARE,
++              .slice_id = 30,
++              .max_cap = 128,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++              .alloc_oneway_en = true,
++      }, {
++              .usecase_id = LLCC_AENPU,
++              .slice_id = 3,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_ISLAND1,
++              .slice_id = 12,
++              .max_cap = 5888,
++              .priority = 7,
++              .fixed_size = true,
++              .res_ways = 0x7fffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_DISP_WB,
++              .slice_id = 23,
++              .max_cap = 1024,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_VIDVSP,
++              .slice_id = 28,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffffff,
++              .cache_mode = 0,
++      },
+ };
+ static const struct llcc_slice_config qdu1000_data_2ch[] = {
+-      { LLCC_MDMHPGRW, 7, 512, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_MODHW,    9, 256, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_MDMPNG,  21, 256, 0, 1, 0x3,   0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_ECC,     26, 512, 3, 1, 0xffc, 0x0, 0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_MODPE,   29, 256, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_APTCM,   30, 256, 3, 1, 0x0,   0xc, 1, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_WRCACHE, 31, 128, 1, 1, 0x3,   0x0, 0, 0, 0, 0, 1, 0, 0 },
++      {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 7,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODHW,
++              .slice_id = 9,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 21,
++              .max_cap = 256,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0x3,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_ECC,
++              .slice_id = 26,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffc,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 256,
++              .priority = 3,
++              .fixed_size = true,
++              .res_ways = 0xc,
++              .cache_mode = 1,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 128,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0x3,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      },
+ };
+ static const struct llcc_slice_config qdu1000_data_4ch[] = {
+-      { LLCC_MDMHPGRW, 7, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_MODHW,    9, 512,  1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_MDMPNG,  21, 512,  0, 1, 0x3,   0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_ECC,     26, 1024, 3, 1, 0xffc, 0x0, 0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_MODPE,   29, 512,  1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_APTCM,   30, 512,  3, 1, 0x0,   0xc, 1, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_WRCACHE, 31, 256,  1, 1, 0x3,   0x0, 0, 0, 0, 0, 1, 0, 0 },
++      {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 7,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODHW,
++              .slice_id = 9,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 21,
++              .max_cap = 512,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0x3,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_ECC,
++              .slice_id = 26,
++              .max_cap = 1024,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffc,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .res_ways = 0xc,
++              .cache_mode = 1,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 256,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0x3,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      },
+ };
+ static const struct llcc_slice_config qdu1000_data_8ch[] = {
+-      { LLCC_MDMHPGRW, 7, 2048, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_MODHW,    9, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_MDMPNG,  21, 1024, 0, 1, 0x3,   0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_ECC,     26, 2048, 3, 1, 0xffc, 0x0, 0, 0, 0, 0, 1, 0, 0 },
+-      { LLCC_MODPE,   29, 1024, 1, 1, 0xfff, 0x0, 0, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_APTCM,   30, 1024, 3, 1, 0x0,   0xc, 1, 0, 0, 1, 0, 0, 0 },
+-      { LLCC_WRCACHE, 31, 512,  1, 1, 0x3,   0x0, 0, 0, 0, 0, 1, 0, 0 },
++      {
++              .usecase_id = LLCC_MDMHPGRW,
++              .slice_id = 7,
++              .max_cap = 2048,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MODHW,
++              .slice_id = 9,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_MDMPNG,
++              .slice_id = 21,
++              .max_cap = 1024,
++              .priority = 0,
++              .fixed_size = true,
++              .bonus_ways = 0x3,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_ECC,
++              .slice_id = 26,
++              .max_cap = 2048,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffc,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_MODPE,
++              .slice_id = 29,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_APTCM,
++              .slice_id = 30,
++              .max_cap = 1024,
++              .priority = 3,
++              .fixed_size = true,
++              .res_ways = 0xc,
++              .cache_mode = 1,
++              .retain_on_pc = true,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0x3,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      },
+ };
+ static const struct llcc_slice_config x1e80100_data[] = {
+-      {LLCC_CPUSS,     1, 6144, 1, 1, 0xFFF, 0x0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_VIDSC0,    2,  512, 4, 1, 0xFFF, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_AUDIO,     6, 1024, 1, 1, 0xFFF, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CMPT,     10, 6144, 1, 1, 0xFFF, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_GPUHTW,   11,  512, 1, 1, 0xFFF, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_GPU,       9, 4608, 1, 0, 0xFFF, 0x0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_MMUHWT,   18,  512, 1, 1, 0xFFF, 0x0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_AUDHW,    22, 1024, 1, 1, 0xFFF, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CVP,       8,  512, 4, 1, 0xFFF, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_WRCACHE,  31, 1024, 1, 1, 0xFFF, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CAMEXP0,   4,  256, 4, 1,   0x3, 0x0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CAMEXP1,   7, 3072, 3, 1, 0xFFC, 0x0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_LCPDARE,  30,  512, 3, 1, 0xFFF, 0x0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0},
+-      {LLCC_AENPU,     3, 3072, 1, 1, 0xFFF, 0x0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_ISLAND1,  12, 2048, 7, 1,   0x0, 0xF, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CAMEXP2,  19, 3072, 3, 1, 0xFFC, 0x0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CAMEXP3,  20, 3072, 2, 1, 0xFFC, 0x0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+-      {LLCC_CAMEXP4,  21, 3072, 2, 1, 0xFFC, 0x0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
++      {
++              .usecase_id = LLCC_CPUSS,
++              .slice_id = 1,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_VIDSC0,
++              .slice_id = 2,
++              .max_cap = 512,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_AUDIO,
++              .slice_id = 6,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CMPT,
++              .slice_id = 10,
++              .max_cap = 6144,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_GPUHTW,
++              .slice_id = 11,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_GPU,
++              .slice_id = 9,
++              .max_cap = 4608,
++              .priority = 1,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .write_scid_en = true,
++              .write_scid_cacheable_en = true,
++              .stale_en = true,
++      }, {
++              .usecase_id = LLCC_MMUHWT,
++              .slice_id = 18,
++              .max_cap = 512,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++      }, {
++              .usecase_id = LLCC_AUDHW,
++              .slice_id = 22,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CVP,
++              .slice_id = 8,
++              .max_cap = 512,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_WRCACHE,
++              .slice_id = 31,
++              .max_cap = 1024,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CAMEXP0,
++              .slice_id = 4,
++              .max_cap = 256,
++              .priority = 4,
++              .fixed_size = true,
++              .bonus_ways = 0x3,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CAMEXP1,
++              .slice_id = 7,
++              .max_cap = 3072,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffc,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_LCPDARE,
++              .slice_id = 30,
++              .max_cap = 512,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 0,
++              .activate_on_init = true,
++              .alloc_oneway_en = true,
++      }, {
++              .usecase_id = LLCC_AENPU,
++              .slice_id = 3,
++              .max_cap = 3072,
++              .priority = 1,
++              .fixed_size = true,
++              .bonus_ways = 0xfff,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_ISLAND1,
++              .slice_id = 12,
++              .max_cap = 2048,
++              .priority = 7,
++              .fixed_size = true,
++              .res_ways = 0xf,
++              .cache_mode = 0,
++      }, {
++              .usecase_id = LLCC_CAMEXP2,
++              .slice_id = 19,
++              .max_cap = 3072,
++              .priority = 3,
++              .fixed_size = true,
++              .bonus_ways = 0xffc,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_CAMEXP3,
++              .slice_id = 20,
++              .max_cap = 3072,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xffc,
++              .cache_mode = 2,
++      }, {
++              .usecase_id = LLCC_CAMEXP4,
++              .slice_id = 21,
++              .max_cap = 3072,
++              .priority = 2,
++              .fixed_size = true,
++              .bonus_ways = 0xffc,
++              .cache_mode = 2,
++      },
+ };
+ static const struct llcc_edac_reg_offset llcc_v1_edac_reg_offset = {
+-- 
+2.43.0
+
diff --git a/queue-6.12/soc-qcom-pd-mapper-add-qcm6490-pd-maps.patch b/queue-6.12/soc-qcom-pd-mapper-add-qcm6490-pd-maps.patch
new file mode 100644 (file)
index 0000000..072346d
--- /dev/null
@@ -0,0 +1,40 @@
+From b5ce8000898f493deafd2447dab5a12ba74ca23b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 20:47:29 -0700
+Subject: soc: qcom: pd-mapper: Add QCM6490 PD maps
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 31a95fe0851afbbc697b6be96c8a81a01d65aa5f ]
+
+The QCM6490 is a variant of SC7280, with the usual set of protection
+domains, and hence the need for a PD-mapper. In particular USB Type-C
+port management and battery management is pmic_glink based.
+
+Add an entry to the kernel, to avoid the need for userspace to provide
+this service.
+
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241004-qcm6490-pd-mapper-v1-1-d6f4bc3bffa3@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/qcom_pd_mapper.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/qcom/qcom_pd_mapper.c b/drivers/soc/qcom/qcom_pd_mapper.c
+index c940f4da28ed5..6e30f08761aa4 100644
+--- a/drivers/soc/qcom/qcom_pd_mapper.c
++++ b/drivers/soc/qcom/qcom_pd_mapper.c
+@@ -540,6 +540,7 @@ static const struct of_device_id qcom_pdm_domains[] __maybe_unused = {
+       { .compatible = "qcom,msm8996", .data = msm8996_domains, },
+       { .compatible = "qcom,msm8998", .data = msm8998_domains, },
+       { .compatible = "qcom,qcm2290", .data = qcm2290_domains, },
++      { .compatible = "qcom,qcm6490", .data = sc7280_domains, },
+       { .compatible = "qcom,qcs404", .data = qcs404_domains, },
+       { .compatible = "qcom,sc7180", .data = sc7180_domains, },
+       { .compatible = "qcom,sc7280", .data = sc7280_domains, },
+-- 
+2.43.0
+
diff --git a/queue-6.12/spi-spi-fsl-lpspi-adjust-type-of-scldiv.patch b/queue-6.12/spi-spi-fsl-lpspi-adjust-type-of-scldiv.patch
new file mode 100644 (file)
index 0000000..ddedcba
--- /dev/null
@@ -0,0 +1,58 @@
+From e35e04827a85f31d3bd754ad7410df6b86612358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 11:30:54 +0200
+Subject: spi: spi-fsl-lpspi: Adjust type of scldiv
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit fa8ecda9876ac1e7b29257aa82af1fd0695496e2 ]
+
+The target value of scldiv is just a byte, but its calculation in
+fsl_lpspi_set_bitrate could be negative. So use an adequate type to store
+the result and avoid overflows. After that this needs range check
+adjustments, but this should make the code less opaque.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20240930093056.93418-2-wahrenst@gmx.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 9573b8fa4fbfc..29b9676fe43d8 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -315,9 +315,10 @@ static void fsl_lpspi_set_watermark(struct fsl_lpspi_data *fsl_lpspi)
+ static int fsl_lpspi_set_bitrate(struct fsl_lpspi_data *fsl_lpspi)
+ {
+       struct lpspi_config config = fsl_lpspi->config;
+-      unsigned int perclk_rate, scldiv, div;
++      unsigned int perclk_rate, div;
+       u8 prescale_max;
+       u8 prescale;
++      int scldiv;
+       perclk_rate = clk_get_rate(fsl_lpspi->clk_per);
+       prescale_max = fsl_lpspi->devtype_data->prescale_max;
+@@ -338,13 +339,13 @@ static int fsl_lpspi_set_bitrate(struct fsl_lpspi_data *fsl_lpspi)
+       for (prescale = 0; prescale <= prescale_max; prescale++) {
+               scldiv = div / (1 << prescale) - 2;
+-              if (scldiv < 256) {
++              if (scldiv >= 0 && scldiv < 256) {
+                       fsl_lpspi->config.prescale = prescale;
+                       break;
+               }
+       }
+-      if (scldiv >= 256)
++      if (scldiv < 0 || scldiv >= 256)
+               return -EINVAL;
+       writel(scldiv | (scldiv << 8) | ((scldiv >> 1) << 16),
+-- 
+2.43.0
+
diff --git a/queue-6.12/thermal-drivers-qcom-tsens-v1-add-support-for-msm893.patch b/queue-6.12/thermal-drivers-qcom-tsens-v1-add-support-for-msm893.patch
new file mode 100644 (file)
index 0000000..66a1eaf
--- /dev/null
@@ -0,0 +1,103 @@
+From 5f5f76bcff9e0fa9c59e5f605ae4b48b43299aa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 16:11:46 +0100
+Subject: thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Czémán <barnabas.czeman@mainlining.org>
+
+[ Upstream commit e2ffb6c3a40ee714160e35e61f0a984028b5d550 ]
+
+Add support for tsens v1.4 block what can be found in
+MSM8937 and MSM8917.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
+Link: https://lore.kernel.org/r/20241113-msm8917-v6-5-c348fb599fef@mainlining.org
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/tsens-v1.c | 21 ++++++++++++++-------
+ drivers/thermal/qcom/tsens.c    |  3 +++
+ drivers/thermal/qcom/tsens.h    |  2 +-
+ 3 files changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c
+index dc1c4ae2d8b01..1a7874676f68e 100644
+--- a/drivers/thermal/qcom/tsens-v1.c
++++ b/drivers/thermal/qcom/tsens-v1.c
+@@ -162,28 +162,35 @@ struct tsens_plat_data data_tsens_v1 = {
+       .fields = tsens_v1_regfields,
+ };
+-static const struct tsens_ops ops_8956 = {
+-      .init           = init_8956,
++static const struct tsens_ops ops_common = {
++      .init           = init_common,
+       .calibrate      = tsens_calibrate_common,
+       .get_temp       = get_temp_tsens_valid,
+ };
+-struct tsens_plat_data data_8956 = {
++struct tsens_plat_data data_8937 = {
+       .num_sensors    = 11,
+-      .ops            = &ops_8956,
++      .ops            = &ops_common,
+       .feat           = &tsens_v1_feat,
+       .fields         = tsens_v1_regfields,
+ };
+-static const struct tsens_ops ops_8976 = {
+-      .init           = init_common,
++static const struct tsens_ops ops_8956 = {
++      .init           = init_8956,
+       .calibrate      = tsens_calibrate_common,
+       .get_temp       = get_temp_tsens_valid,
+ };
++struct tsens_plat_data data_8956 = {
++      .num_sensors    = 11,
++      .ops            = &ops_8956,
++      .feat           = &tsens_v1_feat,
++      .fields         = tsens_v1_regfields,
++};
++
+ struct tsens_plat_data data_8976 = {
+       .num_sensors    = 11,
+-      .ops            = &ops_8976,
++      .ops            = &ops_common,
+       .feat           = &tsens_v1_feat,
+       .fields         = tsens_v1_regfields,
+ };
+diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c
+index 0b4421bf47854..d2db804692f01 100644
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -1119,6 +1119,9 @@ static const struct of_device_id tsens_table[] = {
+       }, {
+               .compatible = "qcom,msm8916-tsens",
+               .data = &data_8916,
++      }, {
++              .compatible = "qcom,msm8937-tsens",
++              .data = &data_8937,
+       }, {
+               .compatible = "qcom,msm8939-tsens",
+               .data = &data_8939,
+diff --git a/drivers/thermal/qcom/tsens.h b/drivers/thermal/qcom/tsens.h
+index cab39de045b10..7b36a0318fa6a 100644
+--- a/drivers/thermal/qcom/tsens.h
++++ b/drivers/thermal/qcom/tsens.h
+@@ -647,7 +647,7 @@ extern struct tsens_plat_data data_8960;
+ extern struct tsens_plat_data data_8226, data_8909, data_8916, data_8939, data_8974, data_9607;
+ /* TSENS v1 targets */
+-extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956;
++extern struct tsens_plat_data data_tsens_v1, data_8937, data_8976, data_8956;
+ /* TSENS v2 targets */
+ extern struct tsens_plat_data data_8996, data_ipq8074, data_tsens_v2;
+-- 
+2.43.0
+
diff --git a/queue-6.12/timekeeping-always-check-for-negative-motion.patch b/queue-6.12/timekeeping-always-check-for-negative-motion.patch
new file mode 100644 (file)
index 0000000..6cfd5ac
--- /dev/null
@@ -0,0 +1,88 @@
+From 1a2179251657be9f1b44b112f5fbd0f31eef3edb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 13:04:08 +0100
+Subject: timekeeping: Always check for negative motion
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit c163e40af9b2331b2c629fd4ec8b703ed4d4ae39 ]
+
+clocksource_delta() has two variants. One with a check for negative motion,
+which is only selected by x86. This is a historic leftover as this function
+was previously used in the time getter hot paths.
+
+Since 135225a363ae timekeeping_cycles_to_ns() has unconditional protection
+against this as a by-product of the protection against 64bit math overflow.
+
+clocksource_delta() is only used in the clocksource watchdog and in
+timekeeping_advance(). The extra conditional there is not hurting anyone.
+
+Remove the config option and unconditionally prevent negative motion of the
+readout.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: John Stultz <jstultz@google.com>
+Link: https://lore.kernel.org/all/20241031120328.599430157@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig                   | 1 -
+ kernel/time/Kconfig                | 5 -----
+ kernel/time/timekeeping_internal.h | 7 -------
+ 3 files changed, 13 deletions(-)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 7b9a7e8f39acc..171be04eca1f5 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -145,7 +145,6 @@ config X86
+       select ARCH_HAS_PARANOID_L1D_FLUSH
+       select BUILDTIME_TABLE_SORT
+       select CLKEVT_I8253
+-      select CLOCKSOURCE_VALIDATE_LAST_CYCLE
+       select CLOCKSOURCE_WATCHDOG
+       # Word-size accesses may read uninitialized data past the trailing \0
+       # in strings and cause false KMSAN reports.
+diff --git a/kernel/time/Kconfig b/kernel/time/Kconfig
+index 8ebb6d5a106be..b0b97a60aaa6f 100644
+--- a/kernel/time/Kconfig
++++ b/kernel/time/Kconfig
+@@ -17,11 +17,6 @@ config ARCH_CLOCKSOURCE_DATA
+ config ARCH_CLOCKSOURCE_INIT
+       bool
+-# Clocksources require validation of the clocksource against the last
+-# cycle update - x86/TSC misfeature
+-config CLOCKSOURCE_VALIDATE_LAST_CYCLE
+-      bool
+-
+ # Timekeeping vsyscall support
+ config GENERIC_TIME_VSYSCALL
+       bool
+diff --git a/kernel/time/timekeeping_internal.h b/kernel/time/timekeeping_internal.h
+index 4ca2787d1642e..1d4854d5c386e 100644
+--- a/kernel/time/timekeeping_internal.h
++++ b/kernel/time/timekeeping_internal.h
+@@ -15,7 +15,6 @@ extern void tk_debug_account_sleep_time(const struct timespec64 *t);
+ #define tk_debug_account_sleep_time(x)
+ #endif
+-#ifdef CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE
+ static inline u64 clocksource_delta(u64 now, u64 last, u64 mask)
+ {
+       u64 ret = (now - last) & mask;
+@@ -26,12 +25,6 @@ static inline u64 clocksource_delta(u64 now, u64 last, u64 mask)
+        */
+       return ret & ~(mask >> 1) ? 0 : ret;
+ }
+-#else
+-static inline u64 clocksource_delta(u64 now, u64 last, u64 mask)
+-{
+-      return (now - last) & mask;
+-}
+-#endif
+ /* Semi public for serialization of non timekeeper VDSO updates. */
+ extern raw_spinlock_t timekeeper_lock;
+-- 
+2.43.0
+
diff --git a/queue-6.12/tools-rtla-enhance-argument-parsing-in-timerlat_load.patch b/queue-6.12/tools-rtla-enhance-argument-parsing-in-timerlat_load.patch
new file mode 100644 (file)
index 0000000..a5a42ab
--- /dev/null
@@ -0,0 +1,63 @@
+From c5b36ba98770e4996fc6a5a4b228ee76c24fe854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 15:12:30 +0000
+Subject: tools/rtla: Enhance argument parsing in timerlat_load.py
+
+From: furkanonder <furkanonder@protonmail.com>
+
+[ Upstream commit bd26818343dc02936a4f2f7b63368d5e1e1773c8 ]
+
+The enhancements made to timerlat_load.py are aimed at improving the clarity of argument parsing.
+
+Summary of Changes:
+- The cpu argument is now specified as an integer type in the argument
+  parser to enforce input validation, and the construction of affinity_mask
+  has been simplified to directly use the integer value of args.cpu.
+- The prio argument is similarly updated to be of integer type for
+  consistency and validation, eliminating the need for the conversion of
+  args.prio to an integer, as this is now handled by the argument parser.
+
+Cc: "jkacur@redhat.com" <jkacur@redhat.com>
+Cc: "lgoncalv@redhat.com" <lgoncalv@redhat.com>
+Link: https://lore.kernel.org/QfgO7ayKD9dsLk8_ZDebkAV0OF7wla7UmasbP9CBmui_sChOeizy512t3RqCHTjvQoUBUDP8dwEOVCdHQ5KvVNEiP69CynMY94SFDERWl94=@protonmail.com
+Signed-off-by: Furkan Onder <furkanonder@protonmail.com>
+Reviewed-by: Tomas Glozar <tglozar@redhat.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/sample/timerlat_load.py | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/tools/tracing/rtla/sample/timerlat_load.py b/tools/tracing/rtla/sample/timerlat_load.py
+index 8cc5eb2d2e69e..52eccb6225f92 100644
+--- a/tools/tracing/rtla/sample/timerlat_load.py
++++ b/tools/tracing/rtla/sample/timerlat_load.py
+@@ -25,13 +25,12 @@ import sys
+ import os
+ parser = argparse.ArgumentParser(description='user-space timerlat thread in Python')
+-parser.add_argument("cpu", help='CPU to run timerlat thread')
+-parser.add_argument("-p", "--prio", help='FIFO priority')
+-
++parser.add_argument("cpu", type=int, help='CPU to run timerlat thread')
++parser.add_argument("-p", "--prio", type=int, help='FIFO priority')
+ args = parser.parse_args()
+ try:
+-    affinity_mask = { int(args.cpu) }
++    affinity_mask = {args.cpu}
+ except:
+     print("Invalid cpu: " + args.cpu)
+     exit(1)
+@@ -44,7 +43,7 @@ except:
+ if (args.prio):
+     try:
+-        param = os.sched_param(int(args.prio))
++        param = os.sched_param(args.prio)
+         os.sched_setscheduler(0, os.SCHED_FIFO, param)
+     except:
+         print("Error setting priority")
+-- 
+2.43.0
+
diff --git a/queue-6.12/tools-rtla-fix-collision-with-glibc-sched_attr-sched.patch b/queue-6.12/tools-rtla-fix-collision-with-glibc-sched_attr-sched.patch
new file mode 100644 (file)
index 0000000..2b87194
--- /dev/null
@@ -0,0 +1,86 @@
+From 37439bc3ee240a5e481148bafcf847569a0381a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 17:09:48 +0200
+Subject: tools/rtla: fix collision with glibc sched_attr/sched_set_attr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Stancek <jstancek@redhat.com>
+
+[ Upstream commit 0eecee340672c4b512f6f4a8c6add26df05d130c ]
+
+glibc commit 21571ca0d703 ("Linux: Add the sched_setattr
+and sched_getattr functions") now also provides 'struct sched_attr'
+and sched_setattr() which collide with the ones from rtla.
+
+  In file included from src/trace.c:11:
+  src/utils.h:49:8: error: redefinition of â€˜struct sched_attr’
+     49 | struct sched_attr {
+        |        ^~~~~~~~~~
+  In file included from /usr/include/bits/sched.h:60,
+                   from /usr/include/sched.h:43,
+                   from /usr/include/tracefs/tracefs.h:10,
+                   from src/trace.c:4:
+  /usr/include/linux/sched/types.h:98:8: note: originally defined here
+     98 | struct sched_attr {
+        |        ^~~~~~~~~~
+
+Define 'struct sched_attr' conditionally, similar to what strace did:
+  https://lore.kernel.org/all/20240930222913.3981407-1-raj.khem@gmail.com/
+and rename rtla's version of sched_setattr() to avoid collision.
+
+Link: https://lore.kernel.org/8088f66a7a57c1b209cd8ae0ae7c336a7f8c930d.1728572865.git.jstancek@redhat.com
+Signed-off-by: Jan Stancek <jstancek@redhat.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/src/utils.c | 4 ++--
+ tools/tracing/rtla/src/utils.h | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/tracing/rtla/src/utils.c b/tools/tracing/rtla/src/utils.c
+index 9ac71a66840c1..0735fcb827ed7 100644
+--- a/tools/tracing/rtla/src/utils.c
++++ b/tools/tracing/rtla/src/utils.c
+@@ -233,7 +233,7 @@ long parse_ns_duration(char *val)
+ #define SCHED_DEADLINE                6
+-static inline int sched_setattr(pid_t pid, const struct sched_attr *attr,
++static inline int syscall_sched_setattr(pid_t pid, const struct sched_attr *attr,
+                               unsigned int flags) {
+       return syscall(__NR_sched_setattr, pid, attr, flags);
+ }
+@@ -243,7 +243,7 @@ int __set_sched_attr(int pid, struct sched_attr *attr)
+       int flags = 0;
+       int retval;
+-      retval = sched_setattr(pid, attr, flags);
++      retval = syscall_sched_setattr(pid, attr, flags);
+       if (retval < 0) {
+               err_msg("Failed to set sched attributes to the pid %d: %s\n",
+                       pid, strerror(errno));
+diff --git a/tools/tracing/rtla/src/utils.h b/tools/tracing/rtla/src/utils.h
+index d44513e6c66a0..99c9cf81bcd02 100644
+--- a/tools/tracing/rtla/src/utils.h
++++ b/tools/tracing/rtla/src/utils.h
+@@ -46,6 +46,7 @@ update_sum(unsigned long long *a, unsigned long long *b)
+       *a += *b;
+ }
++#ifndef SCHED_ATTR_SIZE_VER0
+ struct sched_attr {
+       uint32_t size;
+       uint32_t sched_policy;
+@@ -56,6 +57,7 @@ struct sched_attr {
+       uint64_t sched_deadline;
+       uint64_t sched_period;
+ };
++#endif /* SCHED_ATTR_SIZE_VER0 */
+ int parse_prio(char *arg, struct sched_attr *sched_param);
+ int parse_cpu_set(char *cpu_list, cpu_set_t *set);
+-- 
+2.43.0
+
diff --git a/queue-6.12/tracing-fix-function-name-for-trampoline.patch b/queue-6.12/tracing-fix-function-name-for-trampoline.patch
new file mode 100644 (file)
index 0000000..e9138cb
--- /dev/null
@@ -0,0 +1,163 @@
+From bc36d16e99b15a7e5577b1f4275426fe53b1115f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 07:14:53 +0000
+Subject: tracing: Fix function name for trampoline
+
+From: Tatsuya S <tatsuya.s2862@gmail.com>
+
+[ Upstream commit 6ce5a6f0a07d37cc377df08a8d8a9c283420f323 ]
+
+The issue that unrelated function name is shown on stack trace like
+following even though it should be trampoline code address is caused by
+the creation of trampoline code in the area where .init.text section
+of module was freed after module is loaded.
+
+bash-1344    [002] .....    43.644608: <stack trace>
+=> (MODULE INIT FUNCTION)
+=> vfs_write
+=> ksys_write
+=> do_syscall_64
+=> entry_SYSCALL_64_after_hwframe
+
+To resolve this, when function address of stack trace entry is in
+trampoline, output without looking up symbol name.
+
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://lore.kernel.org/20241021071454.34610-2-tatsuya.s2862@gmail.com
+Signed-off-by: Tatsuya S <tatsuya.s2862@gmail.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace.c        | 33 +++++++++++++++++++++++++--------
+ kernel/trace/trace.h        |  7 +++++++
+ kernel/trace/trace_output.c |  4 ++++
+ 3 files changed, 36 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 6a891e00aa7f4..17d2ffde0bb60 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -988,7 +988,8 @@ static inline void trace_access_lock_init(void)
+ #endif
+ #ifdef CONFIG_STACKTRACE
+-static void __ftrace_trace_stack(struct trace_buffer *buffer,
++static void __ftrace_trace_stack(struct trace_array *tr,
++                               struct trace_buffer *buffer,
+                                unsigned int trace_ctx,
+                                int skip, struct pt_regs *regs);
+ static inline void ftrace_trace_stack(struct trace_array *tr,
+@@ -997,7 +998,8 @@ static inline void ftrace_trace_stack(struct trace_array *tr,
+                                     int skip, struct pt_regs *regs);
+ #else
+-static inline void __ftrace_trace_stack(struct trace_buffer *buffer,
++static inline void __ftrace_trace_stack(struct trace_array *tr,
++                                      struct trace_buffer *buffer,
+                                       unsigned int trace_ctx,
+                                       int skip, struct pt_regs *regs)
+ {
+@@ -2947,7 +2949,8 @@ struct ftrace_stacks {
+ static DEFINE_PER_CPU(struct ftrace_stacks, ftrace_stacks);
+ static DEFINE_PER_CPU(int, ftrace_stack_reserve);
+-static void __ftrace_trace_stack(struct trace_buffer *buffer,
++static void __ftrace_trace_stack(struct trace_array *tr,
++                               struct trace_buffer *buffer,
+                                unsigned int trace_ctx,
+                                int skip, struct pt_regs *regs)
+ {
+@@ -2994,6 +2997,20 @@ static void __ftrace_trace_stack(struct trace_buffer *buffer,
+               nr_entries = stack_trace_save(fstack->calls, size, skip);
+       }
++#ifdef CONFIG_DYNAMIC_FTRACE
++      /* Mark entry of stack trace as trampoline code */
++      if (tr->ops && tr->ops->trampoline) {
++              unsigned long tramp_start = tr->ops->trampoline;
++              unsigned long tramp_end = tramp_start + tr->ops->trampoline_size;
++              unsigned long *calls = fstack->calls;
++
++              for (int i = 0; i < nr_entries; i++) {
++                      if (calls[i] >= tramp_start && calls[i] < tramp_end)
++                              calls[i] = FTRACE_TRAMPOLINE_MARKER;
++              }
++      }
++#endif
++
+       event = __trace_buffer_lock_reserve(buffer, TRACE_STACK,
+                                   struct_size(entry, caller, nr_entries),
+                                   trace_ctx);
+@@ -3024,7 +3041,7 @@ static inline void ftrace_trace_stack(struct trace_array *tr,
+       if (!(tr->trace_flags & TRACE_ITER_STACKTRACE))
+               return;
+-      __ftrace_trace_stack(buffer, trace_ctx, skip, regs);
++      __ftrace_trace_stack(tr, buffer, trace_ctx, skip, regs);
+ }
+ void __trace_stack(struct trace_array *tr, unsigned int trace_ctx,
+@@ -3033,7 +3050,7 @@ void __trace_stack(struct trace_array *tr, unsigned int trace_ctx,
+       struct trace_buffer *buffer = tr->array_buffer.buffer;
+       if (rcu_is_watching()) {
+-              __ftrace_trace_stack(buffer, trace_ctx, skip, NULL);
++              __ftrace_trace_stack(tr, buffer, trace_ctx, skip, NULL);
+               return;
+       }
+@@ -3050,7 +3067,7 @@ void __trace_stack(struct trace_array *tr, unsigned int trace_ctx,
+               return;
+       ct_irq_enter_irqson();
+-      __ftrace_trace_stack(buffer, trace_ctx, skip, NULL);
++      __ftrace_trace_stack(tr, buffer, trace_ctx, skip, NULL);
+       ct_irq_exit_irqson();
+ }
+@@ -3067,8 +3084,8 @@ void trace_dump_stack(int skip)
+       /* Skip 1 to skip this function. */
+       skip++;
+ #endif
+-      __ftrace_trace_stack(printk_trace->array_buffer.buffer,
+-                           tracing_gen_ctx(), skip, NULL);
++      __ftrace_trace_stack(printk_trace, printk_trace->array_buffer.buffer,
++                              tracing_gen_ctx(), skip, NULL);
+ }
+ EXPORT_SYMBOL_GPL(trace_dump_stack);
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index c866991b9c78b..30d6675c78cfe 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -2176,4 +2176,11 @@ static inline int rv_init_interface(void)
+ }
+ #endif
++/*
++ * This is used only to distinguish
++ * function address from trampoline code.
++ * So this value has no meaning.
++ */
++#define FTRACE_TRAMPOLINE_MARKER  ((unsigned long) INT_MAX)
++
+ #endif /* _LINUX_KERNEL_TRACE_H */
+diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
+index 868f2f912f280..c14573e5a9033 100644
+--- a/kernel/trace/trace_output.c
++++ b/kernel/trace/trace_output.c
+@@ -1246,6 +1246,10 @@ static enum print_line_t trace_stack_print(struct trace_iterator *iter,
+                       break;
+               trace_seq_puts(s, " => ");
++              if ((*p) == FTRACE_TRAMPOLINE_MARKER) {
++                      trace_seq_puts(s, "[FTRACE TRAMPOLINE]\n");
++                      continue;
++              }
+               seq_print_ip_sym(s, (*p) + delta, flags);
+               trace_seq_putc(s, '\n');
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/tracing-ftrace-disable-preemption-in-syscall-probe.patch b/queue-6.12/tracing-ftrace-disable-preemption-in-syscall-probe.patch
new file mode 100644 (file)
index 0000000..e44394a
--- /dev/null
@@ -0,0 +1,145 @@
+From 89d6728210d47117bf0c94fd9bb691a4475e4d92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 21:07:12 -0400
+Subject: tracing/ftrace: disable preemption in syscall probe
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+[ Upstream commit 13d750c2c03e9861e15268574ed2c239cca9c9d5 ]
+
+In preparation for allowing system call enter/exit instrumentation to
+handle page faults, make sure that ftrace can handle this change by
+explicitly disabling preemption within the ftrace system call tracepoint
+probes to respect the current expectations within ftrace ring buffer
+code.
+
+This change does not yet allow ftrace to take page faults per se within
+its probe, but allows its existing probes to adapt to the upcoming
+change.
+
+Cc: Michael Jeanson <mjeanson@efficios.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Yonghong Song <yhs@fb.com>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com>
+Cc: bpf@vger.kernel.org
+Cc: Joel Fernandes <joel@joelfernandes.org>
+Link: https://lore.kernel.org/20241009010718.2050182-3-mathieu.desnoyers@efficios.com
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/trace_events.h  | 36 +++++++++++++++++++++++++++++++----
+ kernel/trace/trace_syscalls.c | 12 ++++++++++++
+ 2 files changed, 44 insertions(+), 4 deletions(-)
+
+diff --git a/include/trace/trace_events.h b/include/trace/trace_events.h
+index c2f9cabf154d1..fa0d51cad57a8 100644
+--- a/include/trace/trace_events.h
++++ b/include/trace/trace_events.h
+@@ -244,6 +244,9 @@ static struct trace_event_fields trace_event_fields_##call[] = {   \
+       tstruct                                                         \
+       {} };
++#undef DECLARE_EVENT_SYSCALL_CLASS
++#define DECLARE_EVENT_SYSCALL_CLASS DECLARE_EVENT_CLASS
++
+ #undef DEFINE_EVENT_PRINT
+ #define DEFINE_EVENT_PRINT(template, name, proto, args, print)
+@@ -374,11 +377,11 @@ static inline notrace int trace_event_get_offsets_##call(                \
+ #include "stages/stage6_event_callback.h"
+-#undef DECLARE_EVENT_CLASS
+-#define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print)        \
+-                                                                      \
++
++#undef __DECLARE_EVENT_CLASS
++#define __DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print) \
+ static notrace void                                                   \
+-trace_event_raw_event_##call(void *__data, proto)                     \
++do_trace_event_raw_event_##call(void *__data, proto)                  \
+ {                                                                     \
+       struct trace_event_file *trace_file = __data;                   \
+       struct trace_event_data_offsets_##call __maybe_unused __data_offsets;\
+@@ -403,6 +406,29 @@ trace_event_raw_event_##call(void *__data, proto)                 \
+                                                                       \
+       trace_event_buffer_commit(&fbuffer);                            \
+ }
++
++#undef DECLARE_EVENT_CLASS
++#define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print)        \
++__DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \
++                    PARAMS(assign), PARAMS(print))                    \
++static notrace void                                                   \
++trace_event_raw_event_##call(void *__data, proto)                     \
++{                                                                     \
++      do_trace_event_raw_event_##call(__data, args);                  \
++}
++
++#undef DECLARE_EVENT_SYSCALL_CLASS
++#define DECLARE_EVENT_SYSCALL_CLASS(call, proto, args, tstruct, assign, print) \
++__DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \
++                    PARAMS(assign), PARAMS(print))                    \
++static notrace void                                                   \
++trace_event_raw_event_##call(void *__data, proto)                     \
++{                                                                     \
++      preempt_disable_notrace();                                      \
++      do_trace_event_raw_event_##call(__data, args);                  \
++      preempt_enable_notrace();                                       \
++}
++
+ /*
+  * The ftrace_test_probe is compiled out, it is only here as a build time check
+  * to make sure that if the tracepoint handling changes, the ftrace probe will
+@@ -418,6 +444,8 @@ static inline void ftrace_test_probe_##call(void)                  \
+ #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
++#undef __DECLARE_EVENT_CLASS
++
+ #include "stages/stage7_class_define.h"
+ #undef DECLARE_EVENT_CLASS
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index 785733245eadf..f9b21bac9d45e 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -299,6 +299,12 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
+       int syscall_nr;
+       int size;
++      /*
++       * Syscall probe called with preemption enabled, but the ring
++       * buffer and per-cpu data require preemption to be disabled.
++       */
++      guard(preempt_notrace)();
++
+       syscall_nr = trace_get_syscall_nr(current, regs);
+       if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+               return;
+@@ -338,6 +344,12 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
+       struct trace_event_buffer fbuffer;
+       int syscall_nr;
++      /*
++       * Syscall probe called with preemption enabled, but the ring
++       * buffer and per-cpu data require preemption to be disabled.
++       */
++      guard(preempt_notrace)();
++
+       syscall_nr = trace_get_syscall_nr(current, regs);
+       if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+               return;
+-- 
+2.43.0
+
diff --git a/queue-6.12/tracing-use-atomic64_inc_return-in-trace_clock_count.patch b/queue-6.12/tracing-use-atomic64_inc_return-in-trace_clock_count.patch
new file mode 100644 (file)
index 0000000..201e5b4
--- /dev/null
@@ -0,0 +1,38 @@
+From b51e124eeaeb3b52dace1310e62b461dfe235dd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 10:56:28 +0200
+Subject: tracing: Use atomic64_inc_return() in trace_clock_counter()
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit eb887c4567d1b0e7684c026fe7df44afa96589e6 ]
+
+Use atomic64_inc_return(&ref) instead of atomic64_add_return(1, &ref)
+to use optimized implementation and ease register pressure around
+the primitive for targets that implement optimized variant.
+
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://lore.kernel.org/20241007085651.48544-1-ubizjak@gmail.com
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_clock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
+index 4702efb00ff21..4cb2ebc439be6 100644
+--- a/kernel/trace/trace_clock.c
++++ b/kernel/trace/trace_clock.c
+@@ -154,5 +154,5 @@ static atomic64_t trace_counter;
+  */
+ u64 notrace trace_clock_counter(void)
+ {
+-      return atomic64_add_return(1, &trace_counter);
++      return atomic64_inc_return(&trace_counter);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.12/usb-chipidea-add-ci_hdrc_has_short_pkt_limit-flag.patch b/queue-6.12/usb-chipidea-add-ci_hdrc_has_short_pkt_limit-flag.patch
new file mode 100644 (file)
index 0000000..5c63d1e
--- /dev/null
@@ -0,0 +1,90 @@
+From 26fb343dc76add82da59cfca2e22395fa3b05765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 16:12:01 +0800
+Subject: usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit ec841b8d73cff37f8960e209017efe1eb2fb21f2 ]
+
+Currently, the imx deivice controller has below limitations:
+
+1. can't generate short packet interrupt if IOC not set in dTD. So if one
+   request span more than one dTDs and only the last dTD set IOC, the usb
+   request will pending there if no more data comes.
+2. the controller can't accurately deliver data to differtent usb requests
+   in some cases due to short packet. For example: one usb request span 3
+   dTDs, then if the controller received a short packet the next packet
+   will go to 2nd dTD of current request rather than the first dTD of next
+   request.
+3. can't build a bus packet use multiple dTDs. For example: controller
+   needs to send one packet of 512 bytes use dTD1 (200 bytes) + dTD2
+   (312 bytes), actually the host side will see 200 bytes short packet.
+
+Based on these limits, add CI_HDRC_HAS_SHORT_PKT_LIMIT flag and use it on
+imx platforms.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://lore.kernel.org/r/20240923081203.2851768-1-xu.yang_2@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/ci.h          | 1 +
+ drivers/usb/chipidea/ci_hdrc_imx.c | 1 +
+ drivers/usb/chipidea/core.c        | 2 ++
+ include/linux/usb/chipidea.h       | 1 +
+ 4 files changed, 5 insertions(+)
+
+diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h
+index 2a38e1eb65466..e4b003d060c26 100644
+--- a/drivers/usb/chipidea/ci.h
++++ b/drivers/usb/chipidea/ci.h
+@@ -260,6 +260,7 @@ struct ci_hdrc {
+       bool                            b_sess_valid_event;
+       bool                            imx28_write_fix;
+       bool                            has_portsc_pec_bug;
++      bool                            has_short_pkt_limit;
+       bool                            supports_runtime_pm;
+       bool                            in_lpm;
+       bool                            wakeup_int;
+diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
+index c64ab0e07ea03..17b3ac2ac8a1e 100644
+--- a/drivers/usb/chipidea/ci_hdrc_imx.c
++++ b/drivers/usb/chipidea/ci_hdrc_imx.c
+@@ -342,6 +342,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
+       struct ci_hdrc_platform_data pdata = {
+               .name           = dev_name(&pdev->dev),
+               .capoffset      = DEF_CAPOFFSET,
++              .flags          = CI_HDRC_HAS_SHORT_PKT_LIMIT,
+               .notify_event   = ci_hdrc_imx_notify_event,
+       };
+       int ret;
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index 835bf2428dc6e..5aa16dbfc289c 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -1076,6 +1076,8 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+               CI_HDRC_SUPPORTS_RUNTIME_PM);
+       ci->has_portsc_pec_bug = !!(ci->platdata->flags &
+               CI_HDRC_HAS_PORTSC_PEC_MISSED);
++      ci->has_short_pkt_limit = !!(ci->platdata->flags &
++              CI_HDRC_HAS_SHORT_PKT_LIMIT);
+       platform_set_drvdata(pdev, ci);
+       ret = hw_device_init(ci, base);
+diff --git a/include/linux/usb/chipidea.h b/include/linux/usb/chipidea.h
+index 5a7f96684ea22..ebdfef124b2bc 100644
+--- a/include/linux/usb/chipidea.h
++++ b/include/linux/usb/chipidea.h
+@@ -65,6 +65,7 @@ struct ci_hdrc_platform_data {
+ #define CI_HDRC_PHY_VBUS_CONTROL      BIT(16)
+ #define CI_HDRC_HAS_PORTSC_PEC_MISSED BIT(17)
+ #define CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS      BIT(18)
++#define       CI_HDRC_HAS_SHORT_PKT_LIMIT     BIT(19)
+       enum usb_dr_mode        dr_mode;
+ #define CI_HDRC_CONTROLLER_RESET_EVENT                0
+ #define CI_HDRC_CONTROLLER_STOPPED_EVENT      1
+-- 
+2.43.0
+
diff --git a/queue-6.12/usb-chipidea-udc-create-bounce-buffer-for-problem-sg.patch b/queue-6.12/usb-chipidea-udc-create-bounce-buffer-for-problem-sg.patch
new file mode 100644 (file)
index 0000000..c7aba2c
--- /dev/null
@@ -0,0 +1,258 @@
+From 4e40a5010b4ba44e46ace034829341d58766ef8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 16:12:03 +0800
+Subject: usb: chipidea: udc: create bounce buffer for problem sglist entries
+ if possible
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit edfcc455c85ccc5855f0c329ca5a2d85cc9fc6c6 ]
+
+The chipidea controller doesn't fully support sglist, such as it can not
+transfer data spanned more dTDs to form a bus packet, so it can only work
+on very limited cases.
+
+The limitations as below:
+1. the end address of the first sg buffer must be 4KB aligned.
+2. the start and end address of the middle sg buffer must be 4KB aligned.
+3. the start address of the first sg buffer must be 4KB aligned.
+
+However, not all the use cases violate these limitations. To make the
+controller compatible with most of the cases, this will try to bounce the
+problem sglist entries which can be found by sglist_get_invalid_entry().
+Then a bounced line buffer (the size will roundup to page size) will be
+allocated to replace the remaining problem sg entries. The data will be
+copied between problem sg entries and bounce buffer according to the
+transfer direction. The bounce buffer will be freed when the request
+completed.
+
+Acked-by: Peter Chen <peter.chen@kernel.com>
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Link: https://lore.kernel.org/r/20240923081203.2851768-3-xu.yang_2@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/udc.c | 148 +++++++++++++++++++++++++++++++++++++
+ drivers/usb/chipidea/udc.h |   2 +
+ 2 files changed, 150 insertions(+)
+
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index d3556416dae4f..f0fcaf2b1f334 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -10,6 +10,7 @@
+ #include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/dmapool.h>
++#include <linux/dma-direct.h>
+ #include <linux/err.h>
+ #include <linux/irqreturn.h>
+ #include <linux/kernel.h>
+@@ -540,6 +541,126 @@ static int prepare_td_for_sg(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq)
+       return ret;
+ }
++/*
++ * Verify if the scatterlist is valid by iterating each sg entry.
++ * Return invalid sg entry index which is less than num_sgs.
++ */
++static int sglist_get_invalid_entry(struct device *dma_dev, u8 dir,
++                      struct usb_request *req)
++{
++      int i;
++      struct scatterlist *s = req->sg;
++
++      if (req->num_sgs == 1)
++              return 1;
++
++      dir = dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
++
++      for (i = 0; i < req->num_sgs; i++, s = sg_next(s)) {
++              /* Only small sg (generally last sg) may be bounced. If
++               * that happens. we can't ensure the addr is page-aligned
++               * after dma map.
++               */
++              if (dma_kmalloc_needs_bounce(dma_dev, s->length, dir))
++                      break;
++
++              /* Make sure each sg start address (except first sg) is
++               * page-aligned and end address (except last sg) is also
++               * page-aligned.
++               */
++              if (i == 0) {
++                      if (!IS_ALIGNED(s->offset + s->length,
++                                              CI_HDRC_PAGE_SIZE))
++                              break;
++              } else {
++                      if (s->offset)
++                              break;
++                      if (!sg_is_last(s) && !IS_ALIGNED(s->length,
++                                              CI_HDRC_PAGE_SIZE))
++                              break;
++              }
++      }
++
++      return i;
++}
++
++static int sglist_do_bounce(struct ci_hw_req *hwreq, int index,
++                      bool copy, unsigned int *bounced)
++{
++      void *buf;
++      int i, ret, nents, num_sgs;
++      unsigned int rest, rounded;
++      struct scatterlist *sg, *src, *dst;
++
++      nents = index + 1;
++      ret = sg_alloc_table(&hwreq->sgt, nents, GFP_KERNEL);
++      if (ret)
++              return ret;
++
++      sg = src = hwreq->req.sg;
++      num_sgs = hwreq->req.num_sgs;
++      rest = hwreq->req.length;
++      dst = hwreq->sgt.sgl;
++
++      for (i = 0; i < index; i++) {
++              memcpy(dst, src, sizeof(*src));
++              rest -= src->length;
++              src = sg_next(src);
++              dst = sg_next(dst);
++      }
++
++      /* create one bounce buffer */
++      rounded = round_up(rest, CI_HDRC_PAGE_SIZE);
++      buf = kmalloc(rounded, GFP_KERNEL);
++      if (!buf) {
++              sg_free_table(&hwreq->sgt);
++              return -ENOMEM;
++      }
++
++      sg_set_buf(dst, buf, rounded);
++
++      hwreq->req.sg = hwreq->sgt.sgl;
++      hwreq->req.num_sgs = nents;
++      hwreq->sgt.sgl = sg;
++      hwreq->sgt.nents = num_sgs;
++
++      if (copy)
++              sg_copy_to_buffer(src, num_sgs - index, buf, rest);
++
++      *bounced = rest;
++
++      return 0;
++}
++
++static void sglist_do_debounce(struct ci_hw_req *hwreq, bool copy)
++{
++      void *buf;
++      int i, nents, num_sgs;
++      struct scatterlist *sg, *src, *dst;
++
++      sg = hwreq->req.sg;
++      num_sgs = hwreq->req.num_sgs;
++      src = sg_last(sg, num_sgs);
++      buf = sg_virt(src);
++
++      if (copy) {
++              dst = hwreq->sgt.sgl;
++              for (i = 0; i < num_sgs - 1; i++)
++                      dst = sg_next(dst);
++
++              nents = hwreq->sgt.nents - num_sgs + 1;
++              sg_copy_from_buffer(dst, nents, buf, sg_dma_len(src));
++      }
++
++      hwreq->req.sg = hwreq->sgt.sgl;
++      hwreq->req.num_sgs = hwreq->sgt.nents;
++      hwreq->sgt.sgl = sg;
++      hwreq->sgt.nents = num_sgs;
++
++      kfree(buf);
++      sg_free_table(&hwreq->sgt);
++}
++
+ /**
+  * _hardware_enqueue: configures a request at hardware level
+  * @hwep:   endpoint
+@@ -552,6 +673,8 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq)
+       struct ci_hdrc *ci = hwep->ci;
+       int ret = 0;
+       struct td_node *firstnode, *lastnode;
++      unsigned int bounced_size;
++      struct scatterlist *sg;
+       /* don't queue twice */
+       if (hwreq->req.status == -EALREADY)
+@@ -559,11 +682,29 @@ static int _hardware_enqueue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq)
+       hwreq->req.status = -EALREADY;
++      if (hwreq->req.num_sgs && hwreq->req.length &&
++              ci->has_short_pkt_limit) {
++              ret = sglist_get_invalid_entry(ci->dev->parent, hwep->dir,
++                                      &hwreq->req);
++              if (ret < hwreq->req.num_sgs) {
++                      ret = sglist_do_bounce(hwreq, ret, hwep->dir == TX,
++                                      &bounced_size);
++                      if (ret)
++                              return ret;
++              }
++      }
++
+       ret = usb_gadget_map_request_by_dev(ci->dev->parent,
+                                           &hwreq->req, hwep->dir);
+       if (ret)
+               return ret;
++      if (hwreq->sgt.sgl) {
++              /* We've mapped a bigger buffer, now recover the actual size */
++              sg = sg_last(hwreq->req.sg, hwreq->req.num_sgs);
++              sg_dma_len(sg) = min(sg_dma_len(sg), bounced_size);
++      }
++
+       if (hwreq->req.num_mapped_sgs)
+               ret = prepare_td_for_sg(hwep, hwreq);
+       else
+@@ -733,6 +874,10 @@ static int _hardware_dequeue(struct ci_hw_ep *hwep, struct ci_hw_req *hwreq)
+       usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent,
+                                       &hwreq->req, hwep->dir);
++      /* sglist bounced */
++      if (hwreq->sgt.sgl)
++              sglist_do_debounce(hwreq, hwep->dir == RX);
++
+       hwreq->req.actual += actual;
+       if (hwreq->req.status)
+@@ -1580,6 +1725,9 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
+       usb_gadget_unmap_request(&hwep->ci->gadget, req, hwep->dir);
++      if (hwreq->sgt.sgl)
++              sglist_do_debounce(hwreq, false);
++
+       req->status = -ECONNRESET;
+       if (hwreq->req.complete != NULL) {
+diff --git a/drivers/usb/chipidea/udc.h b/drivers/usb/chipidea/udc.h
+index 5193df1e18c75..c8a47389a46bb 100644
+--- a/drivers/usb/chipidea/udc.h
++++ b/drivers/usb/chipidea/udc.h
+@@ -69,11 +69,13 @@ struct td_node {
+  * @req: request structure for gadget drivers
+  * @queue: link to QH list
+  * @tds: link to TD list
++ * @sgt: hold original sglist when bounce sglist
+  */
+ struct ci_hw_req {
+       struct usb_request      req;
+       struct list_head        queue;
+       struct list_head        tds;
++      struct sg_table         sgt;
+ };
+ #ifdef CONFIG_USB_CHIPIDEA_UDC
+-- 
+2.43.0
+
diff --git a/queue-6.12/usb-chipidea-udc-handle-usb-error-interrupt-if-ioc-n.patch b/queue-6.12/usb-chipidea-udc-handle-usb-error-interrupt-if-ioc-n.patch
new file mode 100644 (file)
index 0000000..fe5d027
--- /dev/null
@@ -0,0 +1,44 @@
+From 59ae112bb50d5b845c75d5ca7ea1b14169b6d0d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 10:29:04 +0800
+Subject: usb: chipidea: udc: handle USB Error Interrupt if IOC not set
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 548f48b66c0c5d4b9795a55f304b7298cde2a025 ]
+
+As per USBSTS register description about UEI:
+
+  When completion of a USB transaction results in an error condition, this
+  bit is set by the Host/Device Controller. This bit is set along with the
+  USBINT bit, if the TD on which the error interrupt occurred also had its
+  interrupt on complete (IOC) bit set.
+
+UI is set only when IOC set. Add checking UEI to fix miss call
+isr_tr_complete_handler() when IOC have not set and transfer error happen.
+
+Acked-by: Peter Chen <peter.chen@kernel.com>
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Link: https://lore.kernel.org/r/20240926022906.473319-1-xu.yang_2@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index f0fcaf2b1f334..fd6032874bf33 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -2217,7 +2217,7 @@ static irqreturn_t udc_irq(struct ci_hdrc *ci)
+                       }
+               }
+-              if (USBi_UI  & intr)
++              if ((USBi_UI | USBi_UEI) & intr)
+                       isr_tr_complete_handler(ci);
+               if ((USBi_SLI & intr) && !(ci->suspended)) {
+-- 
+2.43.0
+
diff --git a/queue-6.12/usb-chipidea-udc-limit-usb-request-length-to-max-16k.patch b/queue-6.12/usb-chipidea-udc-limit-usb-request-length-to-max-16k.patch
new file mode 100644 (file)
index 0000000..3a00af7
--- /dev/null
@@ -0,0 +1,58 @@
+From 16f8d3b0fb12043f953bc2e967dddfc4aff80790 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 16:12:02 +0800
+Subject: usb: chipidea: udc: limit usb request length to max 16KB
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit ca8d18aa7b0f22d66a3ca9a90d8f73431b8eca89 ]
+
+To let the device controller work properly on short packet limitations,
+one usb request should only correspond to one dTD. Then every dTD will
+set IOC. In theory, each dTD support up to 20KB data transfer if the
+offset is 0. Due to we cannot predetermine the offset, this will limit
+the usb request length to max 16KB. This should be fine since most of
+the user transfer data based on this size policy.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://lore.kernel.org/r/20240923081203.2851768-2-xu.yang_2@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/ci.h  | 1 +
+ drivers/usb/chipidea/udc.c | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h
+index e4b003d060c26..97437de52ef68 100644
+--- a/drivers/usb/chipidea/ci.h
++++ b/drivers/usb/chipidea/ci.h
+@@ -25,6 +25,7 @@
+ #define TD_PAGE_COUNT      5
+ #define CI_HDRC_PAGE_SIZE  4096ul /* page size for TD's */
+ #define ENDPT_MAX          32
++#define CI_MAX_REQ_SIZE       (4 * CI_HDRC_PAGE_SIZE)
+ #define CI_MAX_BUF_SIZE       (TD_PAGE_COUNT * CI_HDRC_PAGE_SIZE)
+ /******************************************************************************
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 69ef3cd8d4f83..d3556416dae4f 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -960,6 +960,12 @@ static int _ep_queue(struct usb_ep *ep, struct usb_request *req,
+               return -EMSGSIZE;
+       }
++      if (ci->has_short_pkt_limit &&
++              hwreq->req.length > CI_MAX_REQ_SIZE) {
++              dev_err(hwep->ci->dev, "request length too big (max 16KB)\n");
++              return -EMSGSIZE;
++      }
++
+       /* first nuke then test link, e.g. previous status has not sent */
+       if (!list_empty(&hwreq->queue)) {
+               dev_err(hwep->ci->dev, "request already in queue\n");
+-- 
+2.43.0
+
diff --git a/queue-6.12/usb-typec-ucsi-do-not-call-acpi-_dsm-method-for-ucsi.patch b/queue-6.12/usb-typec-ucsi-do-not-call-acpi-_dsm-method-for-ucsi.patch
new file mode 100644 (file)
index 0000000..486c42d
--- /dev/null
@@ -0,0 +1,117 @@
+From 3e1a7780bf1b8d0564f70139dd1a9230cbf18411 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2024 14:13:42 +0530
+Subject: usb: typec: ucsi: Do not call ACPI _DSM method for UCSI read
+ operations
+
+From: Saranya Gopal <saranya.gopal@intel.com>
+
+[ Upstream commit fa48d7e81624efdf398b990a9049e9cd75a5aead ]
+
+ACPI _DSM methods are needed only for UCSI write operations and for reading
+CCI during RESET_PPM operation. So, remove _DSM calls from other places.
+While there, remove the Zenbook quirk also since the default behavior
+now aligns with the Zenbook quirk. With this change, GET_CONNECTOR_STATUS
+returns at least 6 seconds faster than before in Arrowlake-S platforms.
+
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Saranya Gopal <saranya.gopal@intel.com>
+Reviewed-by: Christian A. Ehrhardt <lk@c--e.de>
+Link: https://lore.kernel.org/r/20240830084342.460109-1-saranya.gopal@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi_acpi.c | 56 +++---------------------------
+ 1 file changed, 5 insertions(+), 51 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c
+index 7a5dff8d9cc6c..accf15ff1306a 100644
+--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
++++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
+@@ -61,9 +61,11 @@ static int ucsi_acpi_read_cci(struct ucsi *ucsi, u32 *cci)
+       struct ucsi_acpi *ua = ucsi_get_drvdata(ucsi);
+       int ret;
+-      ret = ucsi_acpi_dsm(ua, UCSI_DSM_FUNC_READ);
+-      if (ret)
+-              return ret;
++      if (UCSI_COMMAND(ua->cmd) == UCSI_PPM_RESET) {
++              ret = ucsi_acpi_dsm(ua, UCSI_DSM_FUNC_READ);
++              if (ret)
++                      return ret;
++      }
+       memcpy(cci, ua->base + UCSI_CCI, sizeof(*cci));
+@@ -73,11 +75,6 @@ static int ucsi_acpi_read_cci(struct ucsi *ucsi, u32 *cci)
+ static int ucsi_acpi_read_message_in(struct ucsi *ucsi, void *val, size_t val_len)
+ {
+       struct ucsi_acpi *ua = ucsi_get_drvdata(ucsi);
+-      int ret;
+-
+-      ret = ucsi_acpi_dsm(ua, UCSI_DSM_FUNC_READ);
+-      if (ret)
+-              return ret;
+       memcpy(val, ua->base + UCSI_MESSAGE_IN, val_len);
+@@ -102,42 +99,6 @@ static const struct ucsi_operations ucsi_acpi_ops = {
+       .async_control = ucsi_acpi_async_control
+ };
+-static int
+-ucsi_zenbook_read_cci(struct ucsi *ucsi, u32 *cci)
+-{
+-      struct ucsi_acpi *ua = ucsi_get_drvdata(ucsi);
+-      int ret;
+-
+-      if (UCSI_COMMAND(ua->cmd) == UCSI_PPM_RESET) {
+-              ret = ucsi_acpi_dsm(ua, UCSI_DSM_FUNC_READ);
+-              if (ret)
+-                      return ret;
+-      }
+-
+-      memcpy(cci, ua->base + UCSI_CCI, sizeof(*cci));
+-
+-      return 0;
+-}
+-
+-static int
+-ucsi_zenbook_read_message_in(struct ucsi *ucsi, void *val, size_t val_len)
+-{
+-      struct ucsi_acpi *ua = ucsi_get_drvdata(ucsi);
+-
+-      /* UCSI_MESSAGE_IN is never read for PPM_RESET, return stored data */
+-      memcpy(val, ua->base + UCSI_MESSAGE_IN, val_len);
+-
+-      return 0;
+-}
+-
+-static const struct ucsi_operations ucsi_zenbook_ops = {
+-      .read_version = ucsi_acpi_read_version,
+-      .read_cci = ucsi_zenbook_read_cci,
+-      .read_message_in = ucsi_zenbook_read_message_in,
+-      .sync_control = ucsi_sync_control_common,
+-      .async_control = ucsi_acpi_async_control
+-};
+-
+ static int ucsi_gram_read_message_in(struct ucsi *ucsi, void *val, size_t val_len)
+ {
+       u16 bogus_change = UCSI_CONSTAT_POWER_LEVEL_CHANGE |
+@@ -190,13 +151,6 @@ static const struct ucsi_operations ucsi_gram_ops = {
+ };
+ static const struct dmi_system_id ucsi_acpi_quirks[] = {
+-      {
+-              .matches = {
+-                      DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+-                      DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"),
+-              },
+-              .driver_data = (void *)&ucsi_zenbook_ops,
+-      },
+       {
+               .matches = {
+                       DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+-- 
+2.43.0
+
diff --git a/queue-6.12/usb-typec-ucsi-glink-be-more-precise-on-orientation-.patch b/queue-6.12/usb-typec-ucsi-glink-be-more-precise-on-orientation-.patch
new file mode 100644 (file)
index 0000000..b79b0aa
--- /dev/null
@@ -0,0 +1,52 @@
+From 0bdfc05eee593635bf06119f948917f3a21c31fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2024 02:04:15 +0200
+Subject: usb: typec: ucsi: glink: be more precise on orientation-aware ports
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit de9df030ccb5d3e31ee0c715d74cd77c619748f8 ]
+
+Instead of checking if any of the USB-C ports have orientation GPIO and
+thus is orientation-aware, check for the GPIO for the port being
+registered. There are no boards that are affected by this change at this
+moment, so the patch is not marked as a fix, but it might affect other
+boards in future.
+
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241109-ucsi-glue-fixes-v2-2-8b21ff4f9fbe@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi_glink.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi_glink.c b/drivers/usb/typec/ucsi/ucsi_glink.c
+index f7000d383a4e6..9b6cb76e63280 100644
+--- a/drivers/usb/typec/ucsi/ucsi_glink.c
++++ b/drivers/usb/typec/ucsi/ucsi_glink.c
+@@ -172,12 +172,12 @@ static int pmic_glink_ucsi_async_control(struct ucsi *__ucsi, u64 command)
+ static void pmic_glink_ucsi_update_connector(struct ucsi_connector *con)
+ {
+       struct pmic_glink_ucsi *ucsi = ucsi_get_drvdata(con->ucsi);
+-      int i;
+-      for (i = 0; i < PMIC_GLINK_MAX_PORTS; i++) {
+-              if (ucsi->port_orientation[i])
+-                      con->typec_cap.orientation_aware = true;
+-      }
++      if (con->num > PMIC_GLINK_MAX_PORTS ||
++          !ucsi->port_orientation[con->num - 1])
++              return;
++
++      con->typec_cap.orientation_aware = true;
+ }
+ static void pmic_glink_ucsi_connector_status(struct ucsi_connector *con)
+-- 
+2.43.0
+
diff --git a/queue-6.12/verification-dot2-improve-dot-parser-robustness.patch b/queue-6.12/verification-dot2-improve-dot-parser-robustness.patch
new file mode 100644 (file)
index 0000000..dd2f890
--- /dev/null
@@ -0,0 +1,99 @@
+From 67601b1ea03e550966c6d5a5edc17cb6cf09bc99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 08:42:39 +0200
+Subject: verification/dot2: Improve dot parser robustness
+
+From: Gabriele Monaco <gmonaco@redhat.com>
+
+[ Upstream commit 571f8b3f866a6d990a50fe5c89fe0ea78784d70b ]
+
+This patch makes the dot parser used by dot2c and dot2k slightly more
+robust, namely:
+* allows parsing files with the gv extension (GraphViz)
+* correctly parses edges with any indentation
+    * used to work only with a single character (e.g. '\t')
+Additionally it fixes a couple of warnings reported by pylint such as
+wrong indentation and comparison to False instead of `not ...`
+
+Link: https://lore.kernel.org/20241017064238.41394-2-gmonaco@redhat.com
+Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/verification/dot2/automata.py | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/tools/verification/dot2/automata.py b/tools/verification/dot2/automata.py
+index baffeb960ff0b..bdeb98baa8b06 100644
+--- a/tools/verification/dot2/automata.py
++++ b/tools/verification/dot2/automata.py
+@@ -29,11 +29,11 @@ class Automata:
+     def __get_model_name(self):
+         basename = ntpath.basename(self.__dot_path)
+-        if basename.endswith(".dot") == False:
++        if not basename.endswith(".dot") and not basename.endswith(".gv"):
+             print("not a dot file")
+             raise Exception("not a dot file: %s" % self.__dot_path)
+-        model_name = basename[0:-4]
++        model_name = ntpath.splitext(basename)[0]
+         if model_name.__len__() == 0:
+             raise Exception("not a dot file: %s" % self.__dot_path)
+@@ -68,9 +68,9 @@ class Automata:
+     def __get_cursor_begin_events(self):
+         cursor = 0
+         while self.__dot_lines[cursor].split()[0] != "{node":
+-           cursor += 1
++            cursor += 1
+         while self.__dot_lines[cursor].split()[0] == "{node":
+-           cursor += 1
++            cursor += 1
+         # skip initial state transition
+         cursor += 1
+         return cursor
+@@ -94,11 +94,11 @@ class Automata:
+                 initial_state = state[7:]
+             else:
+                 states.append(state)
+-                if self.__dot_lines[cursor].__contains__("doublecircle") == True:
++                if "doublecircle" in self.__dot_lines[cursor]:
+                     final_states.append(state)
+                     has_final_states = True
+-                if self.__dot_lines[cursor].__contains__("ellipse") == True:
++                if "ellipse" in self.__dot_lines[cursor]:
+                     final_states.append(state)
+                     has_final_states = True
+@@ -110,7 +110,7 @@ class Automata:
+         # Insert the initial state at the bein og the states
+         states.insert(0, initial_state)
+-        if has_final_states == False:
++        if not has_final_states:
+             final_states.append(initial_state)
+         return states, initial_state, final_states
+@@ -120,7 +120,7 @@ class Automata:
+         cursor = self.__get_cursor_begin_events()
+         events = []
+-        while self.__dot_lines[cursor][1] == '"':
++        while self.__dot_lines[cursor].lstrip()[0] == '"':
+             # transitions have the format:
+             # "all_fired" -> "both_fired" [ label = "disable_irq" ];
+             #  ------------ event is here ------------^^^^^
+@@ -161,7 +161,7 @@ class Automata:
+         # and we are back! Let's fill the matrix
+         cursor = self.__get_cursor_begin_events()
+-        while self.__dot_lines[cursor][1] == '"':
++        while self.__dot_lines[cursor].lstrip()[0] == '"':
+             if self.__dot_lines[cursor].split()[1] == "->":
+                 line = self.__dot_lines[cursor].split()
+                 origin_state = line[0].replace('"','').replace(',','_')
+-- 
+2.43.0
+
diff --git a/queue-6.12/virtio-net-fix-overflow-inside-virtnet_rq_alloc.patch b/queue-6.12/virtio-net-fix-overflow-inside-virtnet_rq_alloc.patch
new file mode 100644 (file)
index 0000000..8e19a1d
--- /dev/null
@@ -0,0 +1,80 @@
+From 3f66e24cdbee6d4c94b867413ac067ccc6252064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 16:46:12 +0800
+Subject: virtio-net: fix overflow inside virtnet_rq_alloc
+
+From: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+
+[ Upstream commit 6aacd1484468361d1d04badfe75f264fa5314864 ]
+
+When the frag just got a page, then may lead to regression on VM.
+Specially if the sysctl net.core.high_order_alloc_disable value is 1,
+then the frag always get a page when do refill.
+
+Which could see reliable crashes or scp failure (scp a file 100M in size
+to VM).
+
+The issue is that the virtnet_rq_dma takes up 16 bytes at the beginning
+of a new frag. When the frag size is larger than PAGE_SIZE,
+everything is fine. However, if the frag is only one page and the
+total size of the buffer and virtnet_rq_dma is larger than one page, an
+overflow may occur.
+
+The commit f9dac92ba908 ("virtio_ring: enable premapped mode whatever
+use_dma_api") introduced this problem. And we reverted some commits to
+fix this in last linux version. Now we try to enable it and fix this
+bug directly.
+
+Here, when the frag size is not enough, we reduce the buffer len to fix
+this problem.
+
+Reported-by: "Si-Wei Liu" <si-wei.liu@oracle.com>
+Tested-by: Darren Kenny <darren.kenny@oracle.com>
+Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 53a038fcbe991..c897afef0b414 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -946,9 +946,6 @@ static void *virtnet_rq_alloc(struct receive_queue *rq, u32 size, gfp_t gfp)
+       void *buf, *head;
+       dma_addr_t addr;
+-      if (unlikely(!skb_page_frag_refill(size, alloc_frag, gfp)))
+-              return NULL;
+-
+       head = page_address(alloc_frag->page);
+       if (rq->do_dma) {
+@@ -2443,6 +2440,9 @@ static int add_recvbuf_small(struct virtnet_info *vi, struct receive_queue *rq,
+       len = SKB_DATA_ALIGN(len) +
+             SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++      if (unlikely(!skb_page_frag_refill(len, &rq->alloc_frag, gfp)))
++              return -ENOMEM;
++
+       buf = virtnet_rq_alloc(rq, len, gfp);
+       if (unlikely(!buf))
+               return -ENOMEM;
+@@ -2545,6 +2545,12 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi,
+        */
+       len = get_mergeable_buf_len(rq, &rq->mrg_avg_pkt_len, room);
++      if (unlikely(!skb_page_frag_refill(len + room, alloc_frag, gfp)))
++              return -ENOMEM;
++
++      if (!alloc_frag->offset && len + room + sizeof(struct virtnet_rq_dma) > alloc_frag->size)
++              len -= sizeof(struct virtnet_rq_dma);
++
+       buf = virtnet_rq_alloc(rq, len + room, gfp);
+       if (unlikely(!buf))
+               return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.12/wifi-ath10k-avoid-null-pointer-error-during-sdio-rem.patch b/queue-6.12/wifi-ath10k-avoid-null-pointer-error-during-sdio-rem.patch
new file mode 100644 (file)
index 0000000..d630094
--- /dev/null
@@ -0,0 +1,105 @@
+From 01602edef27f21dcf76cef5c28380975ccb14023 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 10:22:46 +0800
+Subject: wifi: ath10k: avoid NULL pointer error during sdio remove
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kang Yang <quic_kangyang@quicinc.com>
+
+[ Upstream commit 95c38953cb1ecf40399a676a1f85dfe2b5780a9a ]
+
+When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio
+workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON
+is set to yes, kernel panic will happen:
+Call trace:
+ destroy_workqueue+0x1c/0x258
+ ath10k_sdio_remove+0x84/0x94
+ sdio_bus_remove+0x50/0x16c
+ device_release_driver_internal+0x188/0x25c
+ device_driver_detach+0x20/0x2c
+
+This is because during 'rmmod ath10k', ath10k_sdio_remove() will call
+ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release()
+will finally be called in ath10k_core_destroy(). This function will free
+struct cfg80211_registered_device *rdev and all its members, including
+wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio
+workqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON.
+
+After device release, destroy_workqueue() will use NULL pointer then the
+kernel panic happen.
+
+Call trace:
+ath10k_sdio_remove
+  ->ath10k_core_unregister
+    â€¦â€¦
+    ->ath10k_core_stop
+      ->ath10k_hif_stop
+        ->ath10k_sdio_irq_disable
+    ->ath10k_hif_power_down
+      ->del_timer_sync(&ar_sdio->sleep_timer)
+  ->ath10k_core_destroy
+    ->ath10k_mac_destroy
+      ->ieee80211_free_hw
+        ->wiphy_free
+    â€¦â€¦
+          ->wiphy_dev_release
+  ->destroy_workqueue
+
+Need to call destroy_workqueue() before ath10k_core_destroy(), free
+the work queue buffer first and then free pointer of work queue by
+ath10k_core_destroy(). This order matches the error path order in
+ath10k_sdio_probe().
+
+No work will be queued on sdio workqueue between it is destroyed and
+ath10k_core_destroy() is called. Based on the call_stack above, the
+reason is:
+Only ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and
+ath10k_sdio_irq_disable() will queue work on sdio workqueue.
+Sleep timer will be deleted before ath10k_core_destroy() in
+ath10k_hif_power_down().
+ath10k_sdio_irq_disable() only be called in ath10k_hif_stop().
+ath10k_core_unregister() will call ath10k_hif_power_down() to stop hif
+bus, so ath10k_sdio_hif_tx_sg() won't be called anymore.
+
+Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189
+
+Signed-off-by: Kang Yang <quic_kangyang@quicinc.com>
+Tested-by: David Ruth <druth@chromium.org>
+Reviewed-by: David Ruth <druth@chromium.org>
+Link: https://patch.msgid.link/20241008022246.1010-1-quic_kangyang@quicinc.com
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/sdio.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index 08a6f36a6be9c..6805357ee29e6 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -3,7 +3,7 @@
+  * Copyright (c) 2004-2011 Atheros Communications Inc.
+  * Copyright (c) 2011-2012,2017 Qualcomm Atheros, Inc.
+  * Copyright (c) 2016-2017 Erik Stromdahl <erik.stromdahl@gmail.com>
+- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ #include <linux/module.h>
+@@ -2648,9 +2648,9 @@ static void ath10k_sdio_remove(struct sdio_func *func)
+       netif_napi_del(&ar->napi);
+-      ath10k_core_destroy(ar);
+-
+       destroy_workqueue(ar_sdio->workqueue);
++
++      ath10k_core_destroy(ar);
+ }
+ static const struct sdio_device_id ath10k_sdio_devices[] = {
+-- 
+2.43.0
+
diff --git a/queue-6.12/wifi-ath12k-fix-atomic-calls-in-ath12k_mac_op_set_bi.patch b/queue-6.12/wifi-ath12k-fix-atomic-calls-in-ath12k_mac_op_set_bi.patch
new file mode 100644 (file)
index 0000000..81b7ed9
--- /dev/null
@@ -0,0 +1,171 @@
+From baf71e304654d37d9ef8b51035f8c87441d7d0ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 19:59:27 +0300
+Subject: wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
+
+From: Kalle Valo <quic_kvalo@quicinc.com>
+
+[ Upstream commit 8fac3266c68a8e647240b8ac8d0b82f1821edf85 ]
+
+When I try to manually set bitrates:
+
+iw wlan0 set bitrates legacy-2.4 1
+
+I get sleeping from invalid context error, see below. Fix that by switching to
+use recently introduced ieee80211_iterate_stations_mtx().
+
+Do note that WCN6855 firmware is still crashing, I'm not sure if that firmware
+even supports bitrate WMI commands and should we consider disabling
+ath12k_mac_op_set_bitrate_mask() for WCN6855? But that's for another patch.
+
+BUG: sleeping function called from invalid context at drivers/net/wireless/ath/ath12k/wmi.c:420
+in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 2236, name: iw
+preempt_count: 0, expected: 0
+RCU nest depth: 1, expected: 0
+3 locks held by iw/2236:
+ #0: ffffffffabc6f1d8 (cb_lock){++++}-{3:3}, at: genl_rcv+0x14/0x40
+ #1: ffff888138410810 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_pre_doit+0x54d/0x800 [cfg80211]
+ #2: ffffffffab2cfaa0 (rcu_read_lock){....}-{1:2}, at: ieee80211_iterate_stations_atomic+0x2f/0x200 [mac80211]
+CPU: 3 UID: 0 PID: 2236 Comm: iw Not tainted 6.11.0-rc7-wt-ath+ #1772
+Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0xa4/0xe0
+ dump_stack+0x10/0x20
+ __might_resched+0x363/0x5a0
+ ? __alloc_skb+0x165/0x340
+ __might_sleep+0xad/0x160
+ ath12k_wmi_cmd_send+0xb1/0x3d0 [ath12k]
+ ? ath12k_wmi_init_wcn7850+0xa40/0xa40 [ath12k]
+ ? __netdev_alloc_skb+0x45/0x7b0
+ ? __asan_memset+0x39/0x40
+ ? ath12k_wmi_alloc_skb+0xf0/0x150 [ath12k]
+ ? reacquire_held_locks+0x4d0/0x4d0
+ ath12k_wmi_set_peer_param+0x340/0x5b0 [ath12k]
+ ath12k_mac_disable_peer_fixed_rate+0xa3/0x110 [ath12k]
+ ? ath12k_mac_vdev_stop+0x4f0/0x4f0 [ath12k]
+ ieee80211_iterate_stations_atomic+0xd4/0x200 [mac80211]
+ ath12k_mac_op_set_bitrate_mask+0x5d2/0x1080 [ath12k]
+ ? ath12k_mac_vif_chan+0x320/0x320 [ath12k]
+ drv_set_bitrate_mask+0x267/0x470 [mac80211]
+ ieee80211_set_bitrate_mask+0x4cc/0x8a0 [mac80211]
+ ? __this_cpu_preempt_check+0x13/0x20
+ nl80211_set_tx_bitrate_mask+0x2bc/0x530 [cfg80211]
+ ? nl80211_parse_tx_bitrate_mask+0x2320/0x2320 [cfg80211]
+ ? trace_contention_end+0xef/0x140
+ ? rtnl_unlock+0x9/0x10
+ ? nl80211_pre_doit+0x557/0x800 [cfg80211]
+ genl_family_rcv_msg_doit+0x1f0/0x2e0
+ ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250
+ ? ns_capable+0x57/0xd0
+ genl_family_rcv_msg+0x34c/0x600
+ ? genl_family_rcv_msg_dumpit+0x310/0x310
+ ? __lock_acquire+0xc62/0x1de0
+ ? he_set_mcs_mask.isra.0+0x8d0/0x8d0 [cfg80211]
+ ? nl80211_parse_tx_bitrate_mask+0x2320/0x2320 [cfg80211]
+ ? cfg80211_external_auth_request+0x690/0x690 [cfg80211]
+ genl_rcv_msg+0xa0/0x130
+ netlink_rcv_skb+0x14c/0x400
+ ? genl_family_rcv_msg+0x600/0x600
+ ? netlink_ack+0xd70/0xd70
+ ? rwsem_optimistic_spin+0x4f0/0x4f0
+ ? genl_rcv+0x14/0x40
+ ? down_read_killable+0x580/0x580
+ ? netlink_deliver_tap+0x13e/0x350
+ ? __this_cpu_preempt_check+0x13/0x20
+ genl_rcv+0x23/0x40
+ netlink_unicast+0x45e/0x790
+ ? netlink_attachskb+0x7f0/0x7f0
+ netlink_sendmsg+0x7eb/0xdb0
+ ? netlink_unicast+0x790/0x790
+ ? __this_cpu_preempt_check+0x13/0x20
+ ? selinux_socket_sendmsg+0x31/0x40
+ ? netlink_unicast+0x790/0x790
+ __sock_sendmsg+0xc9/0x160
+ ____sys_sendmsg+0x620/0x990
+ ? kernel_sendmsg+0x30/0x30
+ ? __copy_msghdr+0x410/0x410
+ ? __kasan_check_read+0x11/0x20
+ ? mark_lock+0xe6/0x1470
+ ___sys_sendmsg+0xe9/0x170
+ ? copy_msghdr_from_user+0x120/0x120
+ ? __lock_acquire+0xc62/0x1de0
+ ? do_fault_around+0x2c6/0x4e0
+ ? do_user_addr_fault+0x8c1/0xde0
+ ? reacquire_held_locks+0x220/0x4d0
+ ? do_user_addr_fault+0x8c1/0xde0
+ ? __kasan_check_read+0x11/0x20
+ ? __fdget+0x4e/0x1d0
+ ? sockfd_lookup_light+0x1a/0x170
+ __sys_sendmsg+0xd2/0x180
+ ? __sys_sendmsg_sock+0x20/0x20
+ ? reacquire_held_locks+0x4d0/0x4d0
+ ? debug_smp_processor_id+0x17/0x20
+ __x64_sys_sendmsg+0x72/0xb0
+ ? lockdep_hardirqs_on+0x7d/0x100
+ x64_sys_call+0x894/0x9f0
+ do_syscall_64+0x64/0x130
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+RIP: 0033:0x7f230fe04807
+Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
+RSP: 002b:00007ffe996a7ea8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+RAX: ffffffffffffffda RBX: 0000556f9f9c3390 RCX: 00007f230fe04807
+RDX: 0000000000000000 RSI: 00007ffe996a7ee0 RDI: 0000000000000003
+RBP: 0000556f9f9c88c0 R08: 0000000000000002 R09: 0000000000000000
+R10: 0000556f965ca190 R11: 0000000000000246 R12: 0000556f9f9c8780
+R13: 00007ffe996a7ee0 R14: 0000556f9f9c87d0 R15: 0000556f9f9c88c0
+ </TASK>
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://patch.msgid.link/20241007165932.78081-2-kvalo@kernel.org
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/mac.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
+index 6d0784a21558e..8946141aa0dce 100644
+--- a/drivers/net/wireless/ath/ath12k/mac.c
++++ b/drivers/net/wireless/ath/ath12k/mac.c
+@@ -8186,9 +8186,9 @@ ath12k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw,
+                                   arvif->vdev_id, ret);
+                       goto out;
+               }
+-              ieee80211_iterate_stations_atomic(hw,
+-                                                ath12k_mac_disable_peer_fixed_rate,
+-                                                arvif);
++              ieee80211_iterate_stations_mtx(hw,
++                                             ath12k_mac_disable_peer_fixed_rate,
++                                             arvif);
+       } else if (ath12k_mac_bitrate_mask_get_single_nss(ar, band, mask,
+                                                         &single_nss)) {
+               rate = WMI_FIXED_RATE_NONE;
+@@ -8233,16 +8233,16 @@ ath12k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw,
+                       goto out;
+               }
+-              ieee80211_iterate_stations_atomic(hw,
+-                                                ath12k_mac_disable_peer_fixed_rate,
+-                                                arvif);
++              ieee80211_iterate_stations_mtx(hw,
++                                             ath12k_mac_disable_peer_fixed_rate,
++                                             arvif);
+               mutex_lock(&ar->conf_mutex);
+               arvif->bitrate_mask = *mask;
+-              ieee80211_iterate_stations_atomic(hw,
+-                                                ath12k_mac_set_bitrate_mask_iter,
+-                                                arvif);
++              ieee80211_iterate_stations_mtx(hw,
++                                             ath12k_mac_set_bitrate_mask_iter,
++                                             arvif);
+               mutex_unlock(&ar->conf_mutex);
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.12/wifi-ath5k-add-pci-id-for-arcadyan-devices.patch b/queue-6.12/wifi-ath5k-add-pci-id-for-arcadyan-devices.patch
new file mode 100644 (file)
index 0000000..40e0d72
--- /dev/null
@@ -0,0 +1,34 @@
+From be4ae7460a1cca41fb2a292b29b5960050557e68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 11:07:16 -0700
+Subject: wifi: ath5k: add PCI ID for Arcadyan devices
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit f3ced9bb90b0a287a1fa6184d16b0f104a78fa90 ]
+
+Arcadyan made routers with this PCI ID containing an AR2417.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://patch.msgid.link/20240930180716.139894-3-rosenp@gmail.com
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath5k/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c
+index b3137f60e8791..f5ca2fe0d0749 100644
+--- a/drivers/net/wireless/ath/ath5k/pci.c
++++ b/drivers/net/wireless/ath/ath5k/pci.c
+@@ -47,6 +47,7 @@ static const struct pci_device_id ath5k_pci_id_table[] = {
+       { PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */
+       { PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */
+       { PCI_VDEVICE(ATHEROS, 0xff16) }, /* Gigaset SX76[23] AR241[34]A */
++      { PCI_VDEVICE(ATHEROS, 0xff1a) }, /* Arcadyan ARV45XX AR2417 */
+       { PCI_VDEVICE(ATHEROS, 0xff1b) }, /* AR5BXB63 */
+       { 0 }
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.12/wifi-ath5k-add-pci-id-for-sx76x.patch b/queue-6.12/wifi-ath5k-add-pci-id-for-sx76x.patch
new file mode 100644 (file)
index 0000000..542a688
--- /dev/null
@@ -0,0 +1,34 @@
+From 7c722a6f4537bcb55b8c219d0c456ae10f257e27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 11:07:15 -0700
+Subject: wifi: ath5k: add PCI ID for SX76X
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit da0474012402d4729b98799d71a54c35dc5c5de3 ]
+
+This is in two devices made by Gigaset, SX762 and SX763.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://patch.msgid.link/20240930180716.139894-2-rosenp@gmail.com
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath5k/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c
+index b51fce5ae2602..b3137f60e8791 100644
+--- a/drivers/net/wireless/ath/ath5k/pci.c
++++ b/drivers/net/wireless/ath/ath5k/pci.c
+@@ -46,6 +46,7 @@ static const struct pci_device_id ath5k_pci_id_table[] = {
+       { PCI_VDEVICE(ATHEROS, 0x001b) }, /* 5413 Eagle */
+       { PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */
+       { PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */
++      { PCI_VDEVICE(ATHEROS, 0xff16) }, /* Gigaset SX76[23] AR241[34]A */
+       { PCI_VDEVICE(ATHEROS, 0xff1b) }, /* AR5BXB63 */
+       { 0 }
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.12/wifi-brcmfmac-fix-oops-due-to-null-pointer-dereferen.patch b/queue-6.12/wifi-brcmfmac-fix-oops-due-to-null-pointer-dereferen.patch
new file mode 100644 (file)
index 0000000..290a4f5
--- /dev/null
@@ -0,0 +1,52 @@
+From 779b2385df0a0634ace62c7b234bac966f84a1e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 14:28:13 +0100
+Subject: wifi: brcmfmac: Fix oops due to NULL pointer dereference in
+ brcmf_sdiod_sglist_rw()
+
+From: Norbert van Bolhuis <nvbolhuis@gmail.com>
+
+[ Upstream commit 857282b819cbaa0675aaab1e7542e2c0579f52d7 ]
+
+This patch fixes a NULL pointer dereference bug in brcmfmac that occurs
+when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs
+are sent from the pkt queue.
+
+The problem is the number of entries in the pre-allocated sgtable, it is
+nents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1.
+Given the default [rt]xglom_size=32 it's actually 35 which is too small.
+Worst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB
+is added for each original SKB if tailroom isn't enough to hold tail_pad.
+At least one sg entry is needed for each SKB. So, eventually the "skb_queue_walk loop"
+in brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return
+NULL and this causes the oops.
+
+The patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle
+the worst-case.
+Btw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464
+additional bytes of memory.
+
+Signed-off-by: Norbert van Bolhuis <nvbolhuis@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20241107132903.13513-1-nvbolhuis@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+index d35262335eaf7..8a1e337642448 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -770,7 +770,7 @@ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev)
+       nents = max_t(uint, BRCMF_DEFAULT_RXGLOM_SIZE,
+                     sdiodev->settings->bus.sdio.txglomsz);
+-      nents += (nents >> 4) + 1;
++      nents *= 2;
+       WARN_ON(nents > sdiodev->max_segment_count);
+-- 
+2.43.0
+
diff --git a/queue-6.12/wifi-ipw2x00-libipw_rx_any-fix-bad-alignment.patch b/queue-6.12/wifi-ipw2x00-libipw_rx_any-fix-bad-alignment.patch
new file mode 100644 (file)
index 0000000..8f79ae1
--- /dev/null
@@ -0,0 +1,53 @@
+From a1bccbe954f0242ff67e3dfd68c0b1dba3c1ed69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 14:07:25 +0800
+Subject: wifi: ipw2x00: libipw_rx_any(): fix bad alignment
+
+From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+
+[ Upstream commit 4fa4f049dc0d9741b16c96bcbf0108c85368a2b9 ]
+
+This patch fixes incorrect code alignment.
+
+./drivers/net/wireless/intel/ipw2x00/libipw_rx.c:871:2-3: code aligned with following code on line 882.
+./drivers/net/wireless/intel/ipw2x00/libipw_rx.c:886:2-3: code aligned with following code on line 900.
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=11381
+Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20241101060725.54640-1-jiapeng.chong@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_rx.c b/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
+index 48d6870bbf4e2..9a97ab9b89ae8 100644
+--- a/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
++++ b/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
+@@ -870,8 +870,8 @@ void libipw_rx_any(struct libipw_device *ieee,
+       switch (ieee->iw_mode) {
+       case IW_MODE_ADHOC:
+               /* our BSS and not from/to DS */
+-              if (ether_addr_equal(hdr->addr3, ieee->bssid))
+-              if ((fc & (IEEE80211_FCTL_TODS+IEEE80211_FCTL_FROMDS)) == 0) {
++              if (ether_addr_equal(hdr->addr3, ieee->bssid) &&
++                  ((fc & (IEEE80211_FCTL_TODS + IEEE80211_FCTL_FROMDS)) == 0)) {
+                       /* promisc: get all */
+                       if (ieee->dev->flags & IFF_PROMISC)
+                               is_packet_for_us = 1;
+@@ -885,8 +885,8 @@ void libipw_rx_any(struct libipw_device *ieee,
+               break;
+       case IW_MODE_INFRA:
+               /* our BSS (== from our AP) and from DS */
+-              if (ether_addr_equal(hdr->addr2, ieee->bssid))
+-              if ((fc & (IEEE80211_FCTL_TODS+IEEE80211_FCTL_FROMDS)) == IEEE80211_FCTL_FROMDS) {
++              if (ether_addr_equal(hdr->addr2, ieee->bssid) &&
++                  ((fc & (IEEE80211_FCTL_TODS + IEEE80211_FCTL_FROMDS)) == IEEE80211_FCTL_FROMDS)) {
+                       /* promisc: get all */
+                       if (ieee->dev->flags & IFF_PROMISC)
+                               is_packet_for_us = 1;
+-- 
+2.43.0
+
diff --git a/queue-6.12/wifi-rtw88-use-ieee80211_purge_tx_queue-to-purge-tx-.patch b/queue-6.12/wifi-rtw88-use-ieee80211_purge_tx_queue-to-purge-tx-.patch
new file mode 100644 (file)
index 0000000..1225c45
--- /dev/null
@@ -0,0 +1,128 @@
+From de812344926df3b52a74b731681a12e37de62ae6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2024 09:42:55 +0800
+Subject: wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 3e5e4a801aaf4283390cc34959c6c48f910ca5ea ]
+
+When removing kernel modules by:
+   rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core
+
+Driver uses skb_queue_purge() to purge TX skb, but not report tx status
+causing "Have pending ack frames!" warning. Use ieee80211_purge_tx_queue()
+to correct this.
+
+Since ieee80211_purge_tx_queue() doesn't take locks, to prevent racing
+between TX work and purge TX queue, flush and destroy TX work in advance.
+
+   wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local
+     choice (Reason: 3=DEAUTH_LEAVING)
+   ------------[ cut here ]------------
+   Have pending ack frames!
+   WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691
+       ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
+   CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C
+       6.10.1-200.fc40.aarch64 #1
+   Hardware name: pine64 Pine64 PinePhone Braveheart
+      (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024
+   pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+   pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
+   lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
+   sp : ffff80008c1b37b0
+   x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000
+   x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0
+   x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff
+   x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000
+   x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000
+   x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964
+   x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0
+   x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001
+   x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
+   x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000
+   Call trace:
+    ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
+    idr_for_each+0x74/0x110
+    ieee80211_free_hw+0x44/0xe8 [mac80211]
+    rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]
+    sdio_bus_remove+0x44/0x180
+    device_remove+0x54/0x90
+    device_release_driver_internal+0x1d4/0x238
+    driver_detach+0x54/0xc0
+    bus_remove_driver+0x78/0x108
+    driver_unregister+0x38/0x78
+    sdio_unregister_driver+0x2c/0x40
+    rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]
+    __do_sys_delete_module.isra.0+0x190/0x338
+    __arm64_sys_delete_module+0x1c/0x30
+    invoke_syscall+0x74/0x100
+    el0_svc_common.constprop.0+0x48/0xf0
+    do_el0_svc+0x24/0x38
+    el0_svc+0x3c/0x158
+    el0t_64_sync_handler+0x120/0x138
+    el0t_64_sync+0x194/0x198
+   ---[ end trace 0000000000000000 ]---
+
+Reported-by: Peter Robinson <pbrobinson@gmail.com>
+Closes: https://lore.kernel.org/linux-wireless/CALeDE9OAa56KMzgknaCD3quOgYuEHFx9_hcT=OFgmMAb+8MPyA@mail.gmail.com/
+Tested-by: Ping-Ke Shih <pkshih@realtek.com> # 8723DU
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20240822014255.10211-2-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 6 +++---
+ drivers/net/wireless/realtek/rtw88/usb.c  | 5 +++--
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c
+index 21d0754dd7f6a..b67e551fcee3e 100644
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -1297,12 +1297,12 @@ static void rtw_sdio_deinit_tx(struct rtw_dev *rtwdev)
+       struct rtw_sdio *rtwsdio = (struct rtw_sdio *)rtwdev->priv;
+       int i;
+-      for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++)
+-              skb_queue_purge(&rtwsdio->tx_queue[i]);
+-
+       flush_workqueue(rtwsdio->txwq);
+       destroy_workqueue(rtwsdio->txwq);
+       kfree(rtwsdio->tx_handler_data);
++
++      for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++)
++              ieee80211_purge_tx_queue(rtwdev->hw, &rtwsdio->tx_queue[i]);
+ }
+ int rtw_sdio_probe(struct sdio_func *sdio_func,
+diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
+index b17a429bcd299..07695294767ac 100644
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -423,10 +423,11 @@ static void rtw_usb_tx_handler(struct work_struct *work)
+ static void rtw_usb_tx_queue_purge(struct rtw_usb *rtwusb)
+ {
++      struct rtw_dev *rtwdev = rtwusb->rtwdev;
+       int i;
+       for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++)
+-              skb_queue_purge(&rtwusb->tx_queue[i]);
++              ieee80211_purge_tx_queue(rtwdev->hw, &rtwusb->tx_queue[i]);
+ }
+ static void rtw_usb_write_port_complete(struct urb *urb)
+@@ -888,9 +889,9 @@ static void rtw_usb_deinit_tx(struct rtw_dev *rtwdev)
+ {
+       struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
+-      rtw_usb_tx_queue_purge(rtwusb);
+       flush_workqueue(rtwusb->txwq);
+       destroy_workqueue(rtwusb->txwq);
++      rtw_usb_tx_queue_purge(rtwusb);
+ }
+ static int rtw_usb_intf_init(struct rtw_dev *rtwdev,
+-- 
+2.43.0
+
diff --git a/queue-6.12/wifi-rtw89-check-return-value-of-ieee80211_probereq_.patch b/queue-6.12/wifi-rtw89-check-return-value-of-ieee80211_probereq_.patch
new file mode 100644 (file)
index 0000000..b08175d
--- /dev/null
@@ -0,0 +1,38 @@
+From dee9960e13ee47e3cec13ad994a6a3e970ddd975 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2024 16:12:14 +0800
+Subject: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 630d5d8f2bf6b340202b6bc2c05d794bbd8e4c1c ]
+
+The return value of ieee80211_probereq_get() might be NULL, so check it
+before using to avoid NULL pointer access.
+
+Addresses-Coverity-ID: 1529805 ("Dereference null return value")
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20240919081216.28505-2-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/fw.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index 13a7c39ceb6f5..e6bceef691e9b 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -6074,6 +6074,9 @@ static int rtw89_update_6ghz_rnr_chan(struct rtw89_dev *rtwdev,
+               skb = ieee80211_probereq_get(rtwdev->hw, rtwvif_link->mac_addr,
+                                            NULL, 0, req->ie_len);
++              if (!skb)
++                      return -ENOMEM;
++
+               skb_put_data(skb, ies->ies[NL80211_BAND_6GHZ], ies->len[NL80211_BAND_6GHZ]);
+               skb_put_data(skb, ies->common_ies, ies->common_ie_len);
+               hdr = (struct ieee80211_hdr *)skb->data;
+-- 
+2.43.0
+