]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 6.6
authorSasha Levin <sashal@kernel.org>
Tue, 8 Oct 2024 06:02:20 +0000 (02:02 -0400)
committerSasha Levin <sashal@kernel.org>
Tue, 8 Oct 2024 06:02:20 +0000 (02:02 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
40 files changed:
queue-6.6/acpi-battery-fix-possible-crash-when-unregistering-a.patch [new file with mode: 0644]
queue-6.6/acpi-battery-simplify-battery-hook-locking.patch [new file with mode: 0644]
queue-6.6/arm64-cputype-add-neoverse-n3-definitions.patch [new file with mode: 0644]
queue-6.6/arm64-errata-expand-speculative-ssbs-workaround-once.patch [new file with mode: 0644]
queue-6.6/btrfs-drop-the-backref-cache-during-relocation-if-we.patch [new file with mode: 0644]
queue-6.6/btrfs-relocation-constify-parameters-where-possible.patch [new file with mode: 0644]
queue-6.6/btrfs-relocation-return-bool-from-btrfs_should_ignor.patch [new file with mode: 0644]
queue-6.6/build-id-require-program-headers-to-be-right-after-e.patch [new file with mode: 0644]
queue-6.6/clk-qcom-gcc-sc8180x-add-gpll9-support.patch [new file with mode: 0644]
queue-6.6/cpufreq-intel_pstate-make-hwp_notify_lock-a-raw-spin.patch [new file with mode: 0644]
queue-6.6/drm-amd-display-allow-backlight-to-go-below-amdgpu_d.patch [new file with mode: 0644]
queue-6.6/dt-bindings-clock-qcom-add-gpll9-support-on-gcc-sc81.patch [new file with mode: 0644]
queue-6.6/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch [new file with mode: 0644]
queue-6.6/i2c-core-lock-address-during-client-device-instantia.patch [new file with mode: 0644]
queue-6.6/i2c-create-debugfs-entry-per-adapter.patch [new file with mode: 0644]
queue-6.6/i2c-synquacer-deal-with-optional-pclk-correctly.patch [new file with mode: 0644]
queue-6.6/i2c-synquacer-remove-a-clk-reference-from-struct-syn.patch [new file with mode: 0644]
queue-6.6/iio-pressure-bmp280-allow-multiple-chips-id-per-fami.patch [new file with mode: 0644]
queue-6.6/iio-pressure-bmp280-fix-regmap-for-bmp280-device.patch [new file with mode: 0644]
queue-6.6/iio-pressure-bmp280-fix-waiting-time-for-bmp3xx-conf.patch [new file with mode: 0644]
queue-6.6/iio-pressure-bmp280-improve-indentation-and-line-wra.patch [new file with mode: 0644]
queue-6.6/iio-pressure-bmp280-use-bme-prefix-for-bme280-specif.patch [new file with mode: 0644]
queue-6.6/io_uring-net-harden-multishot-termination-case-for-r.patch [new file with mode: 0644]
queue-6.6/kconfig-qconf-fix-buffer-overflow-in-debug-links.patch [new file with mode: 0644]
queue-6.6/lib-buildid-harden-build-id-parsing-logic.patch [new file with mode: 0644]
queue-6.6/media-i2c-imx335-enable-regulator-supplies.patch [new file with mode: 0644]
queue-6.6/media-imx335-fix-reset-gpio-handling.patch [new file with mode: 0644]
queue-6.6/mm-z3fold-deprecate-config_z3fold.patch [new file with mode: 0644]
queue-6.6/net-mana-add-support-for-page-sizes-other-than-4kb-o.patch [new file with mode: 0644]
queue-6.6/net-mana-enable-mana-driver-on-arm64-with-4k-page-si.patch [new file with mode: 0644]
queue-6.6/platform-x86-x86-android-tablets-create-a-platform_d.patch [new file with mode: 0644]
queue-6.6/platform-x86-x86-android-tablets-fix-use-after-free-.patch [new file with mode: 0644]
queue-6.6/r8169-add-tally-counter-fields-added-with-rtl8125.patch [new file with mode: 0644]
queue-6.6/r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch [new file with mode: 0644]
queue-6.6/rdma-mana_ib-use-the-correct-page-table-index-based-.patch [new file with mode: 0644]
queue-6.6/remoteproc-k3-r5-acquire-mailbox-handle-during-probe.patch [new file with mode: 0644]
queue-6.6/remoteproc-k3-r5-delay-notification-of-wakeup-event.patch [new file with mode: 0644]
queue-6.6/sched-psi-fix-bogus-pressure-spikes-from-aggregation.patch [new file with mode: 0644]
queue-6.6/series
queue-6.6/uprobes-fix-kernel-info-leak-via-uprobes-vma.patch [new file with mode: 0644]

diff --git a/queue-6.6/acpi-battery-fix-possible-crash-when-unregistering-a.patch b/queue-6.6/acpi-battery-fix-possible-crash-when-unregistering-a.patch
new file mode 100644 (file)
index 0000000..a3c1266
--- /dev/null
@@ -0,0 +1,69 @@
+From b9b13c86d7f5f592e2e25c775c75c9fc2a7d09ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 23:28:34 +0200
+Subject: ACPI: battery: Fix possible crash when unregistering a battery hook
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 76959aff14a0012ad6b984ec7686d163deccdc16 ]
+
+When a battery hook returns an error when adding a new battery, then
+the battery hook is automatically unregistered.
+However the battery hook provider cannot know that, so it will later
+call battery_hook_unregister() on the already unregistered battery
+hook, resulting in a crash.
+
+Fix this by using the list head to mark already unregistered battery
+hooks as already being unregistered so that they can be ignored by
+battery_hook_unregister().
+
+Fixes: fa93854f7a7e ("battery: Add the battery hooking API")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20241001212835.341788-3-W_Armin@gmx.de
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/battery.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index a14852b612bba..e3cbaf3c3bbc1 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -715,7 +715,7 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook)
+               if (!hook->remove_battery(battery->bat, hook))
+                       power_supply_changed(battery->bat);
+       }
+-      list_del(&hook->list);
++      list_del_init(&hook->list);
+       pr_info("extension unregistered: %s\n", hook->name);
+ }
+@@ -723,7 +723,14 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook)
+ void battery_hook_unregister(struct acpi_battery_hook *hook)
+ {
+       mutex_lock(&hook_mutex);
+-      battery_hook_unregister_unlocked(hook);
++      /*
++       * Ignore already unregistered battery hooks. This might happen
++       * if a battery hook was previously unloaded due to an error when
++       * adding a new battery.
++       */
++      if (!list_empty(&hook->list))
++              battery_hook_unregister_unlocked(hook);
++
+       mutex_unlock(&hook_mutex);
+ }
+ EXPORT_SYMBOL_GPL(battery_hook_unregister);
+@@ -733,7 +740,6 @@ void battery_hook_register(struct acpi_battery_hook *hook)
+       struct acpi_battery *battery;
+       mutex_lock(&hook_mutex);
+-      INIT_LIST_HEAD(&hook->list);
+       list_add(&hook->list, &battery_hook_list);
+       /*
+        * Now that the driver is registered, we need
+-- 
+2.43.0
+
diff --git a/queue-6.6/acpi-battery-simplify-battery-hook-locking.patch b/queue-6.6/acpi-battery-simplify-battery-hook-locking.patch
new file mode 100644 (file)
index 0000000..6a57f01
--- /dev/null
@@ -0,0 +1,96 @@
+From 325417cada364a3a96e8e344f5d88a325ed88a3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 23:28:33 +0200
+Subject: ACPI: battery: Simplify battery hook locking
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 86309cbed26139e1caae7629dcca1027d9a28e75 ]
+
+Move the conditional locking from __battery_hook_unregister()
+into battery_hook_unregister() and rename the low-level function
+to simplify the locking during battery hook removal.
+
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20241001212835.341788-2-W_Armin@gmx.de
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: 76959aff14a0 ("ACPI: battery: Fix possible crash when unregistering a battery hook")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/battery.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 7f7ad94f22b91..a14852b612bba 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -703,28 +703,28 @@ static LIST_HEAD(acpi_battery_list);
+ static LIST_HEAD(battery_hook_list);
+ static DEFINE_MUTEX(hook_mutex);
+-static void __battery_hook_unregister(struct acpi_battery_hook *hook, int lock)
++static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook)
+ {
+       struct acpi_battery *battery;
++
+       /*
+        * In order to remove a hook, we first need to
+        * de-register all the batteries that are registered.
+        */
+-      if (lock)
+-              mutex_lock(&hook_mutex);
+       list_for_each_entry(battery, &acpi_battery_list, list) {
+               if (!hook->remove_battery(battery->bat, hook))
+                       power_supply_changed(battery->bat);
+       }
+       list_del(&hook->list);
+-      if (lock)
+-              mutex_unlock(&hook_mutex);
++
+       pr_info("extension unregistered: %s\n", hook->name);
+ }
+ void battery_hook_unregister(struct acpi_battery_hook *hook)
+ {
+-      __battery_hook_unregister(hook, 1);
++      mutex_lock(&hook_mutex);
++      battery_hook_unregister_unlocked(hook);
++      mutex_unlock(&hook_mutex);
+ }
+ EXPORT_SYMBOL_GPL(battery_hook_unregister);
+@@ -750,7 +750,7 @@ void battery_hook_register(struct acpi_battery_hook *hook)
+                        * hooks.
+                        */
+                       pr_err("extension failed to load: %s", hook->name);
+-                      __battery_hook_unregister(hook, 0);
++                      battery_hook_unregister_unlocked(hook);
+                       goto end;
+               }
+@@ -789,7 +789,7 @@ static void battery_hook_add_battery(struct acpi_battery *battery)
+                        */
+                       pr_err("error in extension, unloading: %s",
+                                       hook_node->name);
+-                      __battery_hook_unregister(hook_node, 0);
++                      battery_hook_unregister_unlocked(hook_node);
+               }
+       }
+       mutex_unlock(&hook_mutex);
+@@ -822,7 +822,7 @@ static void __exit battery_hook_exit(void)
+        * need to remove the hooks.
+        */
+       list_for_each_entry_safe(hook, ptr, &battery_hook_list, list) {
+-              __battery_hook_unregister(hook, 1);
++              battery_hook_unregister(hook);
+       }
+       mutex_destroy(&hook_mutex);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-cputype-add-neoverse-n3-definitions.patch b/queue-6.6/arm64-cputype-add-neoverse-n3-definitions.patch
new file mode 100644 (file)
index 0000000..96de5be
--- /dev/null
@@ -0,0 +1,52 @@
+From 3249efc382a1a762d4bcb98330144da4fe7afc37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 13:08:20 +0100
+Subject: arm64: cputype: Add Neoverse-N3 definitions
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 924725707d80bc2588cefafef76ff3f164d299bc ]
+
+Add cputype definitions for Neoverse-N3. These will be used for errata
+detection in subsequent patches.
+
+These values can be found in Table A-261 ("MIDR_EL1 bit descriptions")
+in issue 02 of the Neoverse-N3 TRM, which can be found at:
+
+  https://developer.arm.com/documentation/107997/0000/?lang=en
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: James Morse <james.morse@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20240930111705.3352047-2-mark.rutland@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+[ Mark: trivial backport ]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/cputype.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index 5a7dfeb8e8eb5..488f8e7513495 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -94,6 +94,7 @@
+ #define ARM_CPU_PART_NEOVERSE_V3      0xD84
+ #define ARM_CPU_PART_CORTEX_X925      0xD85
+ #define ARM_CPU_PART_CORTEX_A725      0xD87
++#define ARM_CPU_PART_NEOVERSE_N3      0xD8E
+ #define APM_CPU_PART_XGENE            0x000
+ #define APM_CPU_VAR_POTENZA           0x00
+@@ -176,6 +177,7 @@
+ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3)
+ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925)
+ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725)
++#define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3)
+ #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
+ #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
+ #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-errata-expand-speculative-ssbs-workaround-once.patch b/queue-6.6/arm64-errata-expand-speculative-ssbs-workaround-once.patch
new file mode 100644 (file)
index 0000000..bf20acc
--- /dev/null
@@ -0,0 +1,114 @@
+From c75df3e79cdaefa147a071b7ee2cc648b0445124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 13:08:21 +0100
+Subject: arm64: errata: Expand speculative SSBS workaround once more
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 081eb7932c2b244f63317a982c5e3990e2c7fbdd ]
+
+A number of Arm Ltd CPUs suffer from errata whereby an MSR to the SSBS
+special-purpose register does not affect subsequent speculative
+instructions, permitting speculative store bypassing for a window of
+time.
+
+We worked around this for a number of CPUs in commits:
+
+* 7187bb7d0b5c7dfa ("arm64: errata: Add workaround for Arm errata 3194386 and 3312417")
+* 75b3c43eab594bfb ("arm64: errata: Expand speculative SSBS workaround")
+* 145502cac7ea70b5 ("arm64: errata: Expand speculative SSBS workaround (again)")
+
+Since then, a (hopefully final) batch of updates have been published,
+with two more affected CPUs. For the affected CPUs the existing
+mitigation is sufficient, as described in their respective Software
+Developer Errata Notice (SDEN) documents:
+
+* Cortex-A715 (MP148) SDEN v15.0, erratum 3456084
+  https://developer.arm.com/documentation/SDEN-2148827/1500/
+
+* Neoverse-N3 (MP195) SDEN v5.0, erratum 3456111
+  https://developer.arm.com/documentation/SDEN-3050973/0500/
+
+Enable the existing mitigation by adding the relevant MIDRs to
+erratum_spec_ssbs_list, and update silicon-errata.rst and the
+Kconfig text accordingly.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: James Morse <james.morse@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20240930111705.3352047-3-mark.rutland@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+[ Mark: fix conflict in silicon-errata.rst ]
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/arch/arm64/silicon-errata.rst | 4 ++++
+ arch/arm64/Kconfig                          | 2 ++
+ arch/arm64/kernel/cpu_errata.c              | 2 ++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst
+index 815be40244f79..3cf806733083c 100644
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -141,6 +141,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM            | Cortex-A715     | #2645198        | ARM64_ERRATUM_2645198       |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM            | Cortex-A715     | #3456084        | ARM64_ERRATUM_3194386       |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM            | Cortex-A720     | #3456091        | ARM64_ERRATUM_3194386       |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM            | Cortex-A725     | #3456106        | ARM64_ERRATUM_3194386       |
+@@ -177,6 +179,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM            | Neoverse-N2     | #3324339        | ARM64_ERRATUM_3194386       |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM            | Neoverse-N3     | #3456111        | ARM64_ERRATUM_3194386       |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM            | Neoverse-V1     | #3324341        | ARM64_ERRATUM_3194386       |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM            | Neoverse-V2     | #3324336        | ARM64_ERRATUM_3194386       |
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index fbd840c0948b5..eab866d690334 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1079,6 +1079,7 @@ config ARM64_ERRATUM_3194386
+         * ARM Cortex-A78C erratum 3324346
+         * ARM Cortex-A78C erratum 3324347
+         * ARM Cortex-A710 erratam 3324338
++        * ARM Cortex-A715 errartum 3456084
+         * ARM Cortex-A720 erratum 3456091
+         * ARM Cortex-A725 erratum 3456106
+         * ARM Cortex-X1 erratum 3324344
+@@ -1089,6 +1090,7 @@ config ARM64_ERRATUM_3194386
+         * ARM Cortex-X925 erratum 3324334
+         * ARM Neoverse-N1 erratum 3324349
+         * ARM Neoverse N2 erratum 3324339
++        * ARM Neoverse-N3 erratum 3456111
+         * ARM Neoverse-V1 erratum 3324341
+         * ARM Neoverse V2 erratum 3324336
+         * ARM Neoverse-V3 erratum 3312417
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 437f96205e4fc..463b48d0f9250 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -455,6 +455,7 @@ static const struct midr_range erratum_spec_ssbs_list[] = {
+       MIDR_ALL_VERSIONS(MIDR_CORTEX_A78),
+       MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
+       MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
++      MIDR_ALL_VERSIONS(MIDR_CORTEX_A715),
+       MIDR_ALL_VERSIONS(MIDR_CORTEX_A720),
+       MIDR_ALL_VERSIONS(MIDR_CORTEX_A725),
+       MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
+@@ -466,6 +467,7 @@ static const struct midr_range erratum_spec_ssbs_list[] = {
+       MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100),
+       MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
+       MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
++      MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N3),
+       MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
+       MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2),
+       MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3),
+-- 
+2.43.0
+
diff --git a/queue-6.6/btrfs-drop-the-backref-cache-during-relocation-if-we.patch b/queue-6.6/btrfs-drop-the-backref-cache-during-relocation-if-we.patch
new file mode 100644 (file)
index 0000000..e4815e5
--- /dev/null
@@ -0,0 +1,214 @@
+From 6b98c95b9f5cb72dfb253611015d57f67ce8e133 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2024 16:50:22 -0400
+Subject: btrfs: drop the backref cache during relocation if we commit
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit db7e68b522c01eb666cfe1f31637775f18997811 ]
+
+Since the inception of relocation we have maintained the backref cache
+across transaction commits, updating the backref cache with the new
+bytenr whenever we COWed blocks that were in the cache, and then
+updating their bytenr once we detected a transaction id change.
+
+This works as long as we're only ever modifying blocks, not changing the
+structure of the tree.
+
+However relocation does in fact change the structure of the tree.  For
+example, if we are relocating a data extent, we will look up all the
+leaves that point to this data extent.  We will then call
+do_relocation() on each of these leaves, which will COW down to the leaf
+and then update the file extent location.
+
+But, a key feature of do_relocation() is the pending list.  This is all
+the pending nodes that we modified when we updated the file extent item.
+We will then process all of these blocks via finish_pending_nodes, which
+calls do_relocation() on all of the nodes that led up to that leaf.
+
+The purpose of this is to make sure we don't break sharing unless we
+absolutely have to.  Consider the case that we have 3 snapshots that all
+point to this leaf through the same nodes, the initial COW would have
+created a whole new path.  If we did this for all 3 snapshots we would
+end up with 3x the number of nodes we had originally.  To avoid this we
+will cycle through each of the snapshots that point to each of these
+nodes and update their pointers to point at the new nodes.
+
+Once we update the pointer to the new node we will drop the node we
+removed the link for and all of its children via btrfs_drop_subtree().
+This is essentially just btrfs_drop_snapshot(), but for an arbitrary
+point in the snapshot.
+
+The problem with this is that we will never reflect this in the backref
+cache.  If we do this btrfs_drop_snapshot() for a node that is in the
+backref tree, we will leave the node in the backref tree.  This becomes
+a problem when we change the transid, as now the backref cache has
+entire subtrees that no longer exist, but exist as if they still are
+pointed to by the same roots.
+
+In the best case scenario you end up with "adding refs to an existing
+tree ref" errors from insert_inline_extent_backref(), where we attempt
+to link in nodes on roots that are no longer valid.
+
+Worst case you will double free some random block and re-use it when
+there's still references to the block.
+
+This is extremely subtle, and the consequences are quite bad.  There
+isn't a way to make sure our backref cache is consistent between
+transid's.
+
+In order to fix this we need to simply evict the entire backref cache
+anytime we cross transid's.  This reduces performance in that we have to
+rebuild this backref cache every time we change transid's, but fixes the
+bug.
+
+This has existed since relocation was added, and is a pretty critical
+bug.  There's a lot more cleanup that can be done now that this
+functionality is going away, but this patch is as small as possible in
+order to fix the problem and make it easy for us to backport it to all
+the kernels it needs to be backported to.
+
+Followup series will dismantle more of this code and simplify relocation
+drastically to remove this functionality.
+
+We have a reproducer that reproduced the corruption within a few minutes
+of running.  With this patch it survives several iterations/hours of
+running the reproducer.
+
+Fixes: 3fd0a5585eb9 ("Btrfs: Metadata ENOSPC handling for balance")
+CC: stable@vger.kernel.org
+Reviewed-by: Boris Burkov <boris@bur.io>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/backref.c    | 12 ++++---
+ fs/btrfs/relocation.c | 75 ++-----------------------------------------
+ 2 files changed, 11 insertions(+), 76 deletions(-)
+
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index df223ebf2551c..a2ba1c7fc16af 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -3098,10 +3098,14 @@ void btrfs_backref_release_cache(struct btrfs_backref_cache *cache)
+               btrfs_backref_cleanup_node(cache, node);
+       }
+-      cache->last_trans = 0;
+-
+-      for (i = 0; i < BTRFS_MAX_LEVEL; i++)
+-              ASSERT(list_empty(&cache->pending[i]));
++      for (i = 0; i < BTRFS_MAX_LEVEL; i++) {
++              while (!list_empty(&cache->pending[i])) {
++                      node = list_first_entry(&cache->pending[i],
++                                              struct btrfs_backref_node,
++                                              list);
++                      btrfs_backref_cleanup_node(cache, node);
++              }
++      }
+       ASSERT(list_empty(&cache->pending_edge));
+       ASSERT(list_empty(&cache->useless_node));
+       ASSERT(list_empty(&cache->changed));
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 6e590da98742b..299eac696eb42 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -235,70 +235,6 @@ static struct btrfs_backref_node *walk_down_backref(
+       return NULL;
+ }
+-static void update_backref_node(struct btrfs_backref_cache *cache,
+-                              struct btrfs_backref_node *node, u64 bytenr)
+-{
+-      struct rb_node *rb_node;
+-      rb_erase(&node->rb_node, &cache->rb_root);
+-      node->bytenr = bytenr;
+-      rb_node = rb_simple_insert(&cache->rb_root, node->bytenr, &node->rb_node);
+-      if (rb_node)
+-              btrfs_backref_panic(cache->fs_info, bytenr, -EEXIST);
+-}
+-
+-/*
+- * update backref cache after a transaction commit
+- */
+-static int update_backref_cache(struct btrfs_trans_handle *trans,
+-                              struct btrfs_backref_cache *cache)
+-{
+-      struct btrfs_backref_node *node;
+-      int level = 0;
+-
+-      if (cache->last_trans == 0) {
+-              cache->last_trans = trans->transid;
+-              return 0;
+-      }
+-
+-      if (cache->last_trans == trans->transid)
+-              return 0;
+-
+-      /*
+-       * detached nodes are used to avoid unnecessary backref
+-       * lookup. transaction commit changes the extent tree.
+-       * so the detached nodes are no longer useful.
+-       */
+-      while (!list_empty(&cache->detached)) {
+-              node = list_entry(cache->detached.next,
+-                                struct btrfs_backref_node, list);
+-              btrfs_backref_cleanup_node(cache, node);
+-      }
+-
+-      while (!list_empty(&cache->changed)) {
+-              node = list_entry(cache->changed.next,
+-                                struct btrfs_backref_node, list);
+-              list_del_init(&node->list);
+-              BUG_ON(node->pending);
+-              update_backref_node(cache, node, node->new_bytenr);
+-      }
+-
+-      /*
+-       * some nodes can be left in the pending list if there were
+-       * errors during processing the pending nodes.
+-       */
+-      for (level = 0; level < BTRFS_MAX_LEVEL; level++) {
+-              list_for_each_entry(node, &cache->pending[level], list) {
+-                      BUG_ON(!node->pending);
+-                      if (node->bytenr == node->new_bytenr)
+-                              continue;
+-                      update_backref_node(cache, node, node->new_bytenr);
+-              }
+-      }
+-
+-      cache->last_trans = 0;
+-      return 1;
+-}
+-
+ static bool reloc_root_is_dead(const struct btrfs_root *root)
+ {
+       /*
+@@ -557,9 +493,6 @@ static int clone_backref_node(struct btrfs_trans_handle *trans,
+       struct btrfs_backref_edge *new_edge;
+       struct rb_node *rb_node;
+-      if (cache->last_trans > 0)
+-              update_backref_cache(trans, cache);
+-
+       rb_node = rb_simple_search(&cache->rb_root, src->commit_root->start);
+       if (rb_node) {
+               node = rb_entry(rb_node, struct btrfs_backref_node, rb_node);
+@@ -3682,11 +3615,9 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
+                       break;
+               }
+ restart:
+-              if (update_backref_cache(trans, &rc->backref_cache)) {
+-                      btrfs_end_transaction(trans);
+-                      trans = NULL;
+-                      continue;
+-              }
++              if (rc->backref_cache.last_trans != trans->transid)
++                      btrfs_backref_release_cache(&rc->backref_cache);
++              rc->backref_cache.last_trans = trans->transid;
+               ret = find_next_extent(rc, path, &key);
+               if (ret < 0)
+-- 
+2.43.0
+
diff --git a/queue-6.6/btrfs-relocation-constify-parameters-where-possible.patch b/queue-6.6/btrfs-relocation-constify-parameters-where-possible.patch
new file mode 100644 (file)
index 0000000..c7b54ad
--- /dev/null
@@ -0,0 +1,229 @@
+From 861e1398f70e051251ee35ea90353554dee616c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 13:07:29 +0200
+Subject: btrfs: relocation: constify parameters where possible
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit ab7c8bbf3a088730e58da224bcad512f1dd9ca74 ]
+
+Lots of the functions in relocation.c don't change pointer parameters
+but lack the annotations. Add them and reformat according to current
+coding style if needed.
+
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Stable-dep-of: db7e68b522c0 ("btrfs: drop the backref cache during relocation if we commit")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/relocation.c | 56 +++++++++++++++++++++----------------------
+ fs/btrfs/relocation.h |  9 +++----
+ 2 files changed, 33 insertions(+), 32 deletions(-)
+
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 1f4fd6c86fb00..6e590da98742b 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -299,7 +299,7 @@ static int update_backref_cache(struct btrfs_trans_handle *trans,
+       return 1;
+ }
+-static bool reloc_root_is_dead(struct btrfs_root *root)
++static bool reloc_root_is_dead(const struct btrfs_root *root)
+ {
+       /*
+        * Pair with set_bit/clear_bit in clean_dirty_subvols and
+@@ -320,7 +320,7 @@ static bool reloc_root_is_dead(struct btrfs_root *root)
+  * from no reloc root.  But btrfs_should_ignore_reloc_root() below is a
+  * special case.
+  */
+-static bool have_reloc_root(struct btrfs_root *root)
++static bool have_reloc_root(const struct btrfs_root *root)
+ {
+       if (reloc_root_is_dead(root))
+               return false;
+@@ -329,7 +329,7 @@ static bool have_reloc_root(struct btrfs_root *root)
+       return true;
+ }
+-bool btrfs_should_ignore_reloc_root(struct btrfs_root *root)
++bool btrfs_should_ignore_reloc_root(const struct btrfs_root *root)
+ {
+       struct btrfs_root *reloc_root;
+@@ -546,7 +546,7 @@ static noinline_for_stack struct btrfs_backref_node *build_backref_tree(
+  */
+ static int clone_backref_node(struct btrfs_trans_handle *trans,
+                             struct reloc_control *rc,
+-                            struct btrfs_root *src,
++                            const struct btrfs_root *src,
+                             struct btrfs_root *dest)
+ {
+       struct btrfs_root *reloc_root = src->reloc_root;
+@@ -1186,9 +1186,9 @@ int replace_file_extents(struct btrfs_trans_handle *trans,
+       return ret;
+ }
+-static noinline_for_stack
+-int memcmp_node_keys(struct extent_buffer *eb, int slot,
+-                   struct btrfs_path *path, int level)
++static noinline_for_stack int memcmp_node_keys(const struct extent_buffer *eb,
++                                             int slot, const struct btrfs_path *path,
++                                             int level)
+ {
+       struct btrfs_disk_key key1;
+       struct btrfs_disk_key key2;
+@@ -1517,8 +1517,8 @@ int walk_down_reloc_tree(struct btrfs_root *root, struct btrfs_path *path,
+  * [min_key, max_key)
+  */
+ static int invalidate_extent_cache(struct btrfs_root *root,
+-                                 struct btrfs_key *min_key,
+-                                 struct btrfs_key *max_key)
++                                 const struct btrfs_key *min_key,
++                                 const struct btrfs_key *max_key)
+ {
+       struct btrfs_fs_info *fs_info = root->fs_info;
+       struct inode *inode = NULL;
+@@ -2829,7 +2829,7 @@ int relocate_tree_blocks(struct btrfs_trans_handle *trans,
+ static noinline_for_stack int prealloc_file_extent_cluster(
+                               struct btrfs_inode *inode,
+-                              struct file_extent_cluster *cluster)
++                              const struct file_extent_cluster *cluster)
+ {
+       u64 alloc_hint = 0;
+       u64 start;
+@@ -2964,7 +2964,7 @@ static noinline_for_stack int setup_relocation_extent_mapping(struct inode *inod
+ /*
+  * Allow error injection to test balance/relocation cancellation
+  */
+-noinline int btrfs_should_cancel_balance(struct btrfs_fs_info *fs_info)
++noinline int btrfs_should_cancel_balance(const struct btrfs_fs_info *fs_info)
+ {
+       return atomic_read(&fs_info->balance_cancel_req) ||
+               atomic_read(&fs_info->reloc_cancel_req) ||
+@@ -2972,7 +2972,7 @@ noinline int btrfs_should_cancel_balance(struct btrfs_fs_info *fs_info)
+ }
+ ALLOW_ERROR_INJECTION(btrfs_should_cancel_balance, TRUE);
+-static u64 get_cluster_boundary_end(struct file_extent_cluster *cluster,
++static u64 get_cluster_boundary_end(const struct file_extent_cluster *cluster,
+                                   int cluster_nr)
+ {
+       /* Last extent, use cluster end directly */
+@@ -2984,7 +2984,7 @@ static u64 get_cluster_boundary_end(struct file_extent_cluster *cluster,
+ }
+ static int relocate_one_page(struct inode *inode, struct file_ra_state *ra,
+-                           struct file_extent_cluster *cluster,
++                           const struct file_extent_cluster *cluster,
+                            int *cluster_nr, unsigned long page_index)
+ {
+       struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+@@ -3119,7 +3119,7 @@ static int relocate_one_page(struct inode *inode, struct file_ra_state *ra,
+ }
+ static int relocate_file_extent_cluster(struct inode *inode,
+-                                      struct file_extent_cluster *cluster)
++                                      const struct file_extent_cluster *cluster)
+ {
+       u64 offset = BTRFS_I(inode)->index_cnt;
+       unsigned long index;
+@@ -3157,9 +3157,9 @@ static int relocate_file_extent_cluster(struct inode *inode,
+       return ret;
+ }
+-static noinline_for_stack
+-int relocate_data_extent(struct inode *inode, struct btrfs_key *extent_key,
+-                       struct file_extent_cluster *cluster)
++static noinline_for_stack int relocate_data_extent(struct inode *inode,
++                              const struct btrfs_key *extent_key,
++                              struct file_extent_cluster *cluster)
+ {
+       int ret;
+@@ -3192,7 +3192,7 @@ int relocate_data_extent(struct inode *inode, struct btrfs_key *extent_key,
+  * the major work is getting the generation and level of the block
+  */
+ static int add_tree_block(struct reloc_control *rc,
+-                        struct btrfs_key *extent_key,
++                        const struct btrfs_key *extent_key,
+                         struct btrfs_path *path,
+                         struct rb_root *blocks)
+ {
+@@ -3443,11 +3443,10 @@ static int delete_v1_space_cache(struct extent_buffer *leaf,
+ /*
+  * helper to find all tree blocks that reference a given data extent
+  */
+-static noinline_for_stack
+-int add_data_references(struct reloc_control *rc,
+-                      struct btrfs_key *extent_key,
+-                      struct btrfs_path *path,
+-                      struct rb_root *blocks)
++static noinline_for_stack int add_data_references(struct reloc_control *rc,
++                                                const struct btrfs_key *extent_key,
++                                                struct btrfs_path *path,
++                                                struct rb_root *blocks)
+ {
+       struct btrfs_backref_walk_ctx ctx = { 0 };
+       struct ulist_iterator leaf_uiter;
+@@ -3873,9 +3872,9 @@ static void delete_orphan_inode(struct btrfs_trans_handle *trans,
+  * helper to create inode for data relocation.
+  * the inode is in data relocation tree and its link count is 0
+  */
+-static noinline_for_stack
+-struct inode *create_reloc_inode(struct btrfs_fs_info *fs_info,
+-                               struct btrfs_block_group *group)
++static noinline_for_stack struct inode *create_reloc_inode(
++                                      struct btrfs_fs_info *fs_info,
++                                      const struct btrfs_block_group *group)
+ {
+       struct inode *inode = NULL;
+       struct btrfs_trans_handle *trans;
+@@ -4421,7 +4420,8 @@ int btrfs_reloc_clone_csums(struct btrfs_ordered_extent *ordered)
+ }
+ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
+-                        struct btrfs_root *root, struct extent_buffer *buf,
++                        struct btrfs_root *root,
++                        const struct extent_buffer *buf,
+                         struct extent_buffer *cow)
+ {
+       struct btrfs_fs_info *fs_info = root->fs_info;
+@@ -4560,7 +4560,7 @@ int btrfs_reloc_post_snapshot(struct btrfs_trans_handle *trans,
+  *
+  * Return U64_MAX if no running relocation.
+  */
+-u64 btrfs_get_reloc_bg_bytenr(struct btrfs_fs_info *fs_info)
++u64 btrfs_get_reloc_bg_bytenr(const struct btrfs_fs_info *fs_info)
+ {
+       u64 logical = U64_MAX;
+diff --git a/fs/btrfs/relocation.h b/fs/btrfs/relocation.h
+index af749c780b4e7..5fb60f2deb530 100644
+--- a/fs/btrfs/relocation.h
++++ b/fs/btrfs/relocation.h
+@@ -10,15 +10,16 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,
+ int btrfs_recover_relocation(struct btrfs_fs_info *fs_info);
+ int btrfs_reloc_clone_csums(struct btrfs_ordered_extent *ordered);
+ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
+-                        struct btrfs_root *root, struct extent_buffer *buf,
++                        struct btrfs_root *root,
++                        const struct extent_buffer *buf,
+                         struct extent_buffer *cow);
+ void btrfs_reloc_pre_snapshot(struct btrfs_pending_snapshot *pending,
+                             u64 *bytes_to_reserve);
+ int btrfs_reloc_post_snapshot(struct btrfs_trans_handle *trans,
+                             struct btrfs_pending_snapshot *pending);
+-int btrfs_should_cancel_balance(struct btrfs_fs_info *fs_info);
++int btrfs_should_cancel_balance(const struct btrfs_fs_info *fs_info);
+ struct btrfs_root *find_reloc_root(struct btrfs_fs_info *fs_info, u64 bytenr);
+-bool btrfs_should_ignore_reloc_root(struct btrfs_root *root);
+-u64 btrfs_get_reloc_bg_bytenr(struct btrfs_fs_info *fs_info);
++bool btrfs_should_ignore_reloc_root(const struct btrfs_root *root);
++u64 btrfs_get_reloc_bg_bytenr(const struct btrfs_fs_info *fs_info);
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.6/btrfs-relocation-return-bool-from-btrfs_should_ignor.patch b/queue-6.6/btrfs-relocation-return-bool-from-btrfs_should_ignor.patch
new file mode 100644 (file)
index 0000000..855f97f
--- /dev/null
@@ -0,0 +1,83 @@
+From 672bbdb39106b9f2e610300cdd2bb15f287c2630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 13:07:25 +0200
+Subject: btrfs: relocation: return bool from btrfs_should_ignore_reloc_root
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 32f2abca380fedc60f7a8d3288e4c9586672e207 ]
+
+btrfs_should_ignore_reloc_root() is a predicate so it should return
+bool.
+
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Stable-dep-of: db7e68b522c0 ("btrfs: drop the backref cache during relocation if we commit")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/relocation.c | 19 +++++++++----------
+ fs/btrfs/relocation.h |  2 +-
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 05b2a59ce8897..1f4fd6c86fb00 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -329,31 +329,30 @@ static bool have_reloc_root(struct btrfs_root *root)
+       return true;
+ }
+-int btrfs_should_ignore_reloc_root(struct btrfs_root *root)
++bool btrfs_should_ignore_reloc_root(struct btrfs_root *root)
+ {
+       struct btrfs_root *reloc_root;
+       if (!test_bit(BTRFS_ROOT_SHAREABLE, &root->state))
+-              return 0;
++              return false;
+       /* This root has been merged with its reloc tree, we can ignore it */
+       if (reloc_root_is_dead(root))
+-              return 1;
++              return true;
+       reloc_root = root->reloc_root;
+       if (!reloc_root)
+-              return 0;
++              return false;
+       if (btrfs_header_generation(reloc_root->commit_root) ==
+           root->fs_info->running_transaction->transid)
+-              return 0;
++              return false;
+       /*
+-       * if there is reloc tree and it was created in previous
+-       * transaction backref lookup can find the reloc tree,
+-       * so backref node for the fs tree root is useless for
+-       * relocation.
++       * If there is reloc tree and it was created in previous transaction
++       * backref lookup can find the reloc tree, so backref node for the fs
++       * tree root is useless for relocation.
+        */
+-      return 1;
++      return true;
+ }
+ /*
+diff --git a/fs/btrfs/relocation.h b/fs/btrfs/relocation.h
+index 77d69f6ae967c..af749c780b4e7 100644
+--- a/fs/btrfs/relocation.h
++++ b/fs/btrfs/relocation.h
+@@ -18,7 +18,7 @@ int btrfs_reloc_post_snapshot(struct btrfs_trans_handle *trans,
+                             struct btrfs_pending_snapshot *pending);
+ int btrfs_should_cancel_balance(struct btrfs_fs_info *fs_info);
+ struct btrfs_root *find_reloc_root(struct btrfs_fs_info *fs_info, u64 bytenr);
+-int btrfs_should_ignore_reloc_root(struct btrfs_root *root);
++bool btrfs_should_ignore_reloc_root(struct btrfs_root *root);
+ u64 btrfs_get_reloc_bg_bytenr(struct btrfs_fs_info *fs_info);
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.6/build-id-require-program-headers-to-be-right-after-e.patch b/queue-6.6/build-id-require-program-headers-to-be-right-after-e.patch
new file mode 100644 (file)
index 0000000..9c81ac2
--- /dev/null
@@ -0,0 +1,66 @@
+From 5806715b646c58b9f18a3ddc2baa1e1e79c4ae94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2024 21:39:33 +0300
+Subject: build-id: require program headers to be right after ELF header
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+[ Upstream commit 961a2851324561caed579764ffbee3db82b32829 ]
+
+Neither ELF spec not ELF loader require program header to be placed right
+after ELF header, but build-id code very much assumes such placement:
+
+See
+
+       find_get_page(vma->vm_file->f_mapping, 0);
+
+line and checks against PAGE_SIZE.
+
+Returns errors for now until someone rewrites build-id parser
+to be more inline with load_elf_binary().
+
+Link: https://lkml.kernel.org/r/d58bc281-6ca7-467a-9a64-40fa214bd63e@p183
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: 905415ff3ffb ("lib/buildid: harden build ID parsing logic")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/buildid.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/lib/buildid.c b/lib/buildid.c
+index e3a7acdeef0ed..cdc0950f73843 100644
+--- a/lib/buildid.c
++++ b/lib/buildid.c
+@@ -73,6 +73,13 @@ static int get_build_id_32(const void *page_addr, unsigned char *build_id,
+       Elf32_Phdr *phdr;
+       int i;
++      /*
++       * FIXME
++       * Neither ELF spec nor ELF loader require that program headers
++       * start immediately after ELF header.
++       */
++      if (ehdr->e_phoff != sizeof(Elf32_Ehdr))
++              return -EINVAL;
+       /* only supports phdr that fits in one page */
+       if (ehdr->e_phnum >
+           (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr))
+@@ -98,6 +105,13 @@ static int get_build_id_64(const void *page_addr, unsigned char *build_id,
+       Elf64_Phdr *phdr;
+       int i;
++      /*
++       * FIXME
++       * Neither ELF spec nor ELF loader require that program headers
++       * start immediately after ELF header.
++       */
++      if (ehdr->e_phoff != sizeof(Elf64_Ehdr))
++              return -EINVAL;
+       /* only supports phdr that fits in one page */
+       if (ehdr->e_phnum >
+           (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr))
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-qcom-gcc-sc8180x-add-gpll9-support.patch b/queue-6.6/clk-qcom-gcc-sc8180x-add-gpll9-support.patch
new file mode 100644 (file)
index 0000000..cf03e22
--- /dev/null
@@ -0,0 +1,71 @@
+From 2cbac7e701d4dd122454b2ffe93683c8d35b99d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2024 10:43:03 +0530
+Subject: clk: qcom: gcc-sc8180x: Add GPLL9 support
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+[ Upstream commit 818a2f8d5e4ad2c1e39a4290158fe8e39a744c70 ]
+
+Add the missing GPLL9 pll and fix the gcc_parents_7 data to use
+the correct pll hw.
+
+Fixes: 4433594bbe5d ("clk: qcom: gcc: Add global clock controller driver for SC8180x")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Link: https://lore.kernel.org/r/20240812-gcc-sc8180x-fixes-v2-3-8b3eaa5fb856@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sc8180x.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-sc8180x.c b/drivers/clk/qcom/gcc-sc8180x.c
+index 283bda4d1e701..ec0c45881c67a 100644
+--- a/drivers/clk/qcom/gcc-sc8180x.c
++++ b/drivers/clk/qcom/gcc-sc8180x.c
+@@ -142,6 +142,23 @@ static struct clk_alpha_pll gpll7 = {
+       },
+ };
++static struct clk_alpha_pll gpll9 = {
++      .offset = 0x1c000,
++      .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_TRION],
++      .clkr = {
++              .enable_reg = 0x52000,
++              .enable_mask = BIT(9),
++              .hw.init = &(const struct clk_init_data) {
++                      .name = "gpll9",
++                      .parent_data = &(const struct clk_parent_data) {
++                              .fw_name = "bi_tcxo",
++                      },
++                      .num_parents = 1,
++                      .ops = &clk_alpha_pll_fixed_trion_ops,
++              },
++      },
++};
++
+ static const struct parent_map gcc_parent_map_0[] = {
+       { P_BI_TCXO, 0 },
+       { P_GPLL0_OUT_MAIN, 1 },
+@@ -241,7 +258,7 @@ static const struct parent_map gcc_parent_map_7[] = {
+ static const struct clk_parent_data gcc_parents_7[] = {
+       { .fw_name = "bi_tcxo", },
+       { .hw = &gpll0.clkr.hw },
+-      { .name = "gppl9" },
++      { .hw = &gpll9.clkr.hw },
+       { .hw = &gpll4.clkr.hw },
+       { .hw = &gpll0_out_even.clkr.hw },
+ };
+@@ -4419,6 +4436,7 @@ static struct clk_regmap *gcc_sc8180x_clocks[] = {
+       [GPLL1] = &gpll1.clkr,
+       [GPLL4] = &gpll4.clkr,
+       [GPLL7] = &gpll7.clkr,
++      [GPLL9] = &gpll9.clkr,
+ };
+ static const struct qcom_reset_map gcc_sc8180x_resets[] = {
+-- 
+2.43.0
+
diff --git a/queue-6.6/cpufreq-intel_pstate-make-hwp_notify_lock-a-raw-spin.patch b/queue-6.6/cpufreq-intel_pstate-make-hwp_notify_lock-a-raw-spin.patch
new file mode 100644 (file)
index 0000000..3a4c875
--- /dev/null
@@ -0,0 +1,113 @@
+From 12ece7b7eda838489b08fbe44e0445d67af49266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2024 22:51:07 +0200
+Subject: cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <ukleinek@debian.org>
+
+commit 8b4865cd904650cbed7f2407e653934c621b8127 upstream.
+
+notify_hwp_interrupt() is called via sysvec_thermal() ->
+smp_thermal_vector() -> intel_thermal_interrupt() in hard irq context.
+For this reason it must not use a simple spin_lock that sleeps with
+PREEMPT_RT enabled. So convert it to a raw spinlock.
+
+Reported-by: xiao sheng wen <atzlinux@sina.com>
+Link: https://bugs.debian.org/1076483
+Signed-off-by: Uwe Kleine-König <ukleinek@debian.org>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Tested-by: xiao sheng wen <atzlinux@sina.com>
+Link: https://patch.msgid.link/20240919081121.10784-2-ukleinek@debian.org
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+[ukleinek: Backport to v6.6.y]
+Signed-off-by: Uwe Kleine-König <ukleinek@debian.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/intel_pstate.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 0ee3a04bb1022..8a4fdf212ce0d 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -1632,7 +1632,7 @@ static void intel_pstate_notify_work(struct work_struct *work)
+       wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_STATUS, 0);
+ }
+-static DEFINE_SPINLOCK(hwp_notify_lock);
++static DEFINE_RAW_SPINLOCK(hwp_notify_lock);
+ static cpumask_t hwp_intr_enable_mask;
+ void notify_hwp_interrupt(void)
+@@ -1649,7 +1649,7 @@ void notify_hwp_interrupt(void)
+       if (!(value & 0x01))
+               return;
+-      spin_lock_irqsave(&hwp_notify_lock, flags);
++      raw_spin_lock_irqsave(&hwp_notify_lock, flags);
+       if (!cpumask_test_cpu(this_cpu, &hwp_intr_enable_mask))
+               goto ack_intr;
+@@ -1673,13 +1673,13 @@ void notify_hwp_interrupt(void)
+       schedule_delayed_work(&cpudata->hwp_notify_work, msecs_to_jiffies(10));
+-      spin_unlock_irqrestore(&hwp_notify_lock, flags);
++      raw_spin_unlock_irqrestore(&hwp_notify_lock, flags);
+       return;
+ ack_intr:
+       wrmsrl_safe(MSR_HWP_STATUS, 0);
+-      spin_unlock_irqrestore(&hwp_notify_lock, flags);
++      raw_spin_unlock_irqrestore(&hwp_notify_lock, flags);
+ }
+ static void intel_pstate_disable_hwp_interrupt(struct cpudata *cpudata)
+@@ -1692,10 +1692,10 @@ static void intel_pstate_disable_hwp_interrupt(struct cpudata *cpudata)
+       /* wrmsrl_on_cpu has to be outside spinlock as this can result in IPC */
+       wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_INTERRUPT, 0x00);
+-      spin_lock_irqsave(&hwp_notify_lock, flags);
++      raw_spin_lock_irqsave(&hwp_notify_lock, flags);
+       if (cpumask_test_and_clear_cpu(cpudata->cpu, &hwp_intr_enable_mask))
+               cancel_delayed_work(&cpudata->hwp_notify_work);
+-      spin_unlock_irqrestore(&hwp_notify_lock, flags);
++      raw_spin_unlock_irqrestore(&hwp_notify_lock, flags);
+ }
+ static void intel_pstate_enable_hwp_interrupt(struct cpudata *cpudata)
+@@ -1704,10 +1704,10 @@ static void intel_pstate_enable_hwp_interrupt(struct cpudata *cpudata)
+       if (boot_cpu_has(X86_FEATURE_HWP_NOTIFY)) {
+               unsigned long flags;
+-              spin_lock_irqsave(&hwp_notify_lock, flags);
++              raw_spin_lock_irqsave(&hwp_notify_lock, flags);
+               INIT_DELAYED_WORK(&cpudata->hwp_notify_work, intel_pstate_notify_work);
+               cpumask_set_cpu(cpudata->cpu, &hwp_intr_enable_mask);
+-              spin_unlock_irqrestore(&hwp_notify_lock, flags);
++              raw_spin_unlock_irqrestore(&hwp_notify_lock, flags);
+               /* wrmsrl_on_cpu has to be outside spinlock as this can result in IPC */
+               wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_INTERRUPT, 0x01);
+@@ -3136,10 +3136,10 @@ static void intel_pstate_driver_cleanup(void)
+                       if (intel_pstate_driver == &intel_pstate)
+                               intel_pstate_clear_update_util_hook(cpu);
+-                      spin_lock(&hwp_notify_lock);
++                      raw_spin_lock(&hwp_notify_lock);
+                       kfree(all_cpu_data[cpu]);
+                       WRITE_ONCE(all_cpu_data[cpu], NULL);
+-                      spin_unlock(&hwp_notify_lock);
++                      raw_spin_unlock(&hwp_notify_lock);
+               }
+       }
+       cpus_read_unlock();
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-amd-display-allow-backlight-to-go-below-amdgpu_d.patch b/queue-6.6/drm-amd-display-allow-backlight-to-go-below-amdgpu_d.patch
new file mode 100644 (file)
index 0000000..4014e59
--- /dev/null
@@ -0,0 +1,47 @@
+From 4412a727ca15c4487cf841c233a737f74df89f09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Sep 2024 14:28:37 -0500
+Subject: drm/amd/display: Allow backlight to go below
+ `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT`
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 87d749a6aab73d8069d0345afaa98297816cb220 ]
+
+The issue with panel power savings compatibility below
+`AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` happens at
+`AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` as well.
+
+That issue will be fixed separately, so don't prevent the backlight
+brightness from going that low.
+
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Thomas Weißschuh <linux@weissschuh.net>
+Link: https://lore.kernel.org/amd-gfx/be04226a-a9e3-4a45-a83b-6d263c6557d8@t-8ch.de/T/#m400dee4e2fc61fe9470334d20a7c8c89c9aef44f
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 3636872429d19..a3f17c572bf06 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4064,7 +4064,7 @@ static void amdgpu_dm_update_backlight_caps(struct amdgpu_display_manager *dm,
+               int spread = caps.max_input_signal - caps.min_input_signal;
+               if (caps.max_input_signal > AMDGPU_DM_DEFAULT_MAX_BACKLIGHT ||
+-                  caps.min_input_signal < AMDGPU_DM_DEFAULT_MIN_BACKLIGHT ||
++                  caps.min_input_signal < 0 ||
+                   spread > AMDGPU_DM_DEFAULT_MAX_BACKLIGHT ||
+                   spread < AMDGPU_DM_MIN_SPREAD) {
+                       DRM_DEBUG_KMS("DM: Invalid backlight caps: min=%d, max=%d\n",
+-- 
+2.43.0
+
diff --git a/queue-6.6/dt-bindings-clock-qcom-add-gpll9-support-on-gcc-sc81.patch b/queue-6.6/dt-bindings-clock-qcom-add-gpll9-support-on-gcc-sc81.patch
new file mode 100644 (file)
index 0000000..99b4744
--- /dev/null
@@ -0,0 +1,37 @@
+From d24ccf1e2ce7475dcd16e7a0958701575f501240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2024 10:43:02 +0530
+Subject: dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+[ Upstream commit 648b4bde0aca2980ebc0b90cdfbb80d222370c3d ]
+
+Add the missing GPLL9 which is required for the gcc sdcc2 clock.
+
+Fixes: 0fadcdfdcf57 ("dt-bindings: clock: Add SC8180x GCC binding")
+Cc: stable@vger.kernel.org
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Link: https://lore.kernel.org/r/20240812-gcc-sc8180x-fixes-v2-2-8b3eaa5fb856@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/dt-bindings/clock/qcom,gcc-sc8180x.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/dt-bindings/clock/qcom,gcc-sc8180x.h b/include/dt-bindings/clock/qcom,gcc-sc8180x.h
+index 90c6e021a0356..2569f874fe13c 100644
+--- a/include/dt-bindings/clock/qcom,gcc-sc8180x.h
++++ b/include/dt-bindings/clock/qcom,gcc-sc8180x.h
+@@ -248,6 +248,7 @@
+ #define GCC_USB3_SEC_CLKREF_CLK                                       238
+ #define GCC_UFS_MEM_CLKREF_EN                                 239
+ #define GCC_UFS_CARD_CLKREF_EN                                        240
++#define GPLL9                                                 241
+ #define GCC_EMAC_BCR                                          0
+ #define GCC_GPU_BCR                                           1
+-- 
+2.43.0
+
diff --git a/queue-6.6/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch b/queue-6.6/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch
new file mode 100644 (file)
index 0000000..2fd5644
--- /dev/null
@@ -0,0 +1,38 @@
+From f704a2be34d9edf3ac7b0ca9f646bd39fd21ecef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:26 +0530
+Subject: dt-bindings: clock: qcom: Add missing UFS QREF clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 26447dad8119fd084d7c6f167c3026700b701666 ]
+
+Add missing QREF clocks for UFS MEM and UFS CARD controllers.
+
+Fixes: 0fadcdfdcf57 ("dt-bindings: clock: Add SC8180x GCC binding")
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-3-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: 648b4bde0aca ("dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/dt-bindings/clock/qcom,gcc-sc8180x.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/dt-bindings/clock/qcom,gcc-sc8180x.h b/include/dt-bindings/clock/qcom,gcc-sc8180x.h
+index e893415ae13d0..90c6e021a0356 100644
+--- a/include/dt-bindings/clock/qcom,gcc-sc8180x.h
++++ b/include/dt-bindings/clock/qcom,gcc-sc8180x.h
+@@ -246,6 +246,8 @@
+ #define GCC_PCIE_3_CLKREF_CLK                                 236
+ #define GCC_USB3_PRIM_CLKREF_CLK                              237
+ #define GCC_USB3_SEC_CLKREF_CLK                                       238
++#define GCC_UFS_MEM_CLKREF_EN                                 239
++#define GCC_UFS_CARD_CLKREF_EN                                        240
+ #define GCC_EMAC_BCR                                          0
+ #define GCC_GPU_BCR                                           1
+-- 
+2.43.0
+
diff --git a/queue-6.6/i2c-core-lock-address-during-client-device-instantia.patch b/queue-6.6/i2c-core-lock-address-during-client-device-instantia.patch
new file mode 100644 (file)
index 0000000..002f4f4
--- /dev/null
@@ -0,0 +1,118 @@
+From b0dcbd43674eae6796c28e524d86431cbbe2ee09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2024 21:44:50 +0200
+Subject: i2c: core: Lock address during client device instantiation
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 8d3cefaf659265aa82b0373a563fdb9d16a2b947 ]
+
+Krzysztof reported an issue [0] which is caused by parallel attempts to
+instantiate the same I2C client device. This can happen if driver
+supports auto-detection, but certain devices are also instantiated
+explicitly.
+The original change isn't actually wrong, it just revealed that I2C core
+isn't prepared yet to handle this scenario.
+Calls to i2c_new_client_device() can be nested, therefore we can't use a
+simple mutex here. Parallel instantiation of devices at different addresses
+is ok, so we just have to prevent parallel instantiation at the same address.
+We can use a bitmap with one bit per 7-bit I2C client address, and atomic
+bit operations to set/check/clear bits.
+Now a parallel attempt to instantiate a device at the same address will
+result in -EBUSY being returned, avoiding the "sysfs: cannot create duplicate
+filename" splash.
+
+Note: This patch version includes small cosmetic changes to the Tested-by
+      version, only functional change is that address locking is supported
+      for slave addresses too.
+
+[0] https://lore.kernel.org/linux-i2c/9479fe4e-eb0c-407e-84c0-bd60c15baf74@ans.pl/T/#m12706546e8e2414d8f1a0dc61c53393f731685cc
+
+Fixes: caba40ec3531 ("eeprom: at24: Probe for DDR3 thermal sensor in the SPD case")
+Cc: stable@vger.kernel.org
+Tested-by: Krzysztof Piotr Oledzki <ole@ans.pl>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-base.c | 28 ++++++++++++++++++++++++++++
+ include/linux/i2c.h         |  3 +++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 9d918a7dfddae..943f0021d6a2c 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -915,6 +915,27 @@ int i2c_dev_irq_from_resources(const struct resource *resources,
+       return 0;
+ }
++/*
++ * Serialize device instantiation in case it can be instantiated explicitly
++ * and by auto-detection
++ */
++static int i2c_lock_addr(struct i2c_adapter *adap, unsigned short addr,
++                       unsigned short flags)
++{
++      if (!(flags & I2C_CLIENT_TEN) &&
++          test_and_set_bit(addr, adap->addrs_in_instantiation))
++              return -EBUSY;
++
++      return 0;
++}
++
++static void i2c_unlock_addr(struct i2c_adapter *adap, unsigned short addr,
++                          unsigned short flags)
++{
++      if (!(flags & I2C_CLIENT_TEN))
++              clear_bit(addr, adap->addrs_in_instantiation);
++}
++
+ /**
+  * i2c_new_client_device - instantiate an i2c device
+  * @adap: the adapter managing the device
+@@ -962,6 +983,10 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf
+               goto out_err_silent;
+       }
++      status = i2c_lock_addr(adap, client->addr, client->flags);
++      if (status)
++              goto out_err_silent;
++
+       /* Check for address business */
+       status = i2c_check_addr_busy(adap, i2c_encode_flags_to_addr(client));
+       if (status)
+@@ -993,6 +1018,8 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf
+       dev_dbg(&adap->dev, "client [%s] registered with bus id %s\n",
+               client->name, dev_name(&client->dev));
++      i2c_unlock_addr(adap, client->addr, client->flags);
++
+       return client;
+ out_remove_swnode:
+@@ -1004,6 +1031,7 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf
+       dev_err(&adap->dev,
+               "Failed to register i2c client %s at 0x%02x (%d)\n",
+               client->name, client->addr, status);
++      i2c_unlock_addr(adap, client->addr, client->flags);
+ out_err_silent:
+       if (need_put)
+               put_device(&client->dev);
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index 033de64d09bba..a3166100f0cce 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -748,6 +748,9 @@ struct i2c_adapter {
+       struct regulator *bus_regulator;
+       struct dentry *debugfs;
++
++      /* 7bit address space */
++      DECLARE_BITMAP(addrs_in_instantiation, 1 << 7);
+ };
+ #define to_i2c_adapter(d) container_of(d, struct i2c_adapter, dev)
+-- 
+2.43.0
+
diff --git a/queue-6.6/i2c-create-debugfs-entry-per-adapter.patch b/queue-6.6/i2c-create-debugfs-entry-per-adapter.patch
new file mode 100644 (file)
index 0000000..1c7cb5a
--- /dev/null
@@ -0,0 +1,102 @@
+From 9aa01d4ec68b0fb752f0491873c5f1b941566b92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Nov 2023 17:54:41 -0500
+Subject: i2c: create debugfs entry per adapter
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 73febd775bdbdb98c81255ff85773ac410ded5c4 ]
+
+Two drivers already implement custom debugfs handling for their
+i2c_adapter and more will come. So, let the core create a debugfs
+directory per adapter and pass that to drivers for their debugfs files.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Stable-dep-of: 8d3cefaf6592 ("i2c: core: Lock address during client device instantiation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-base.c | 11 +++++++++++
+ include/linux/i2c.h         |  2 ++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 1e873ff0a624d..9d918a7dfddae 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -16,6 +16,7 @@
+ #include <linux/acpi.h>
+ #include <linux/clk/clk-conf.h>
+ #include <linux/completion.h>
++#include <linux/debugfs.h>
+ #include <linux/delay.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+@@ -67,6 +68,8 @@ static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver);
+ static DEFINE_STATIC_KEY_FALSE(i2c_trace_msg_key);
+ static bool is_registered;
++static struct dentry *i2c_debugfs_root;
++
+ int i2c_transfer_trace_reg(void)
+ {
+       static_branch_inc(&i2c_trace_msg_key);
+@@ -1523,6 +1526,8 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
+               goto out_list;
+       }
++      adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root);
++
+       res = i2c_setup_smbus_alert(adap);
+       if (res)
+               goto out_reg;
+@@ -1562,6 +1567,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
+       return 0;
+ out_reg:
++      debugfs_remove_recursive(adap->debugfs);
+       init_completion(&adap->dev_released);
+       device_unregister(&adap->dev);
+       wait_for_completion(&adap->dev_released);
+@@ -1763,6 +1769,8 @@ void i2c_del_adapter(struct i2c_adapter *adap)
+       i2c_host_notify_irq_teardown(adap);
++      debugfs_remove_recursive(adap->debugfs);
++
+       /* wait until all references to the device are gone
+        *
+        * FIXME: This is old code and should ideally be replaced by an
+@@ -2060,6 +2068,8 @@ static int __init i2c_init(void)
+       is_registered = true;
++      i2c_debugfs_root = debugfs_create_dir("i2c", NULL);
++
+ #ifdef CONFIG_I2C_COMPAT
+       i2c_adapter_compat_class = class_compat_register("i2c-adapter");
+       if (!i2c_adapter_compat_class) {
+@@ -2098,6 +2108,7 @@ static void __exit i2c_exit(void)
+ #ifdef CONFIG_I2C_COMPAT
+       class_compat_unregister(i2c_adapter_compat_class);
+ #endif
++      debugfs_remove_recursive(i2c_debugfs_root);
+       bus_unregister(&i2c_bus_type);
+       tracepoint_synchronize_unregister();
+ }
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index 32cf5708d5a5b..033de64d09bba 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -746,6 +746,8 @@ struct i2c_adapter {
+       struct irq_domain *host_notify_domain;
+       struct regulator *bus_regulator;
++
++      struct dentry *debugfs;
+ };
+ #define to_i2c_adapter(d) container_of(d, struct i2c_adapter, dev)
+-- 
+2.43.0
+
diff --git a/queue-6.6/i2c-synquacer-deal-with-optional-pclk-correctly.patch b/queue-6.6/i2c-synquacer-deal-with-optional-pclk-correctly.patch
new file mode 100644 (file)
index 0000000..aa41e19
--- /dev/null
@@ -0,0 +1,47 @@
+From 57c15c027cad8dd14a8916fa165abb4341459f82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 12:46:31 +0200
+Subject: i2c: synquacer: Deal with optional PCLK correctly
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit f2990f8630531a99cad4dc5c44cb2a11ded42492 ]
+
+ACPI boot does not provide clocks and regulators, but instead, provides
+the PCLK rate directly, and enables the clock in firmware. So deal
+gracefully with this.
+
+Fixes: 55750148e559 ("i2c: synquacer: Fix an error handling path in synquacer_i2c_probe()")
+Cc: stable@vger.kernel.org # v6.10+
+Cc: Andi Shyti <andi.shyti@kernel.org>
+Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-synquacer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c
+index e774b9f499b63..9bb69a8ab6582 100644
+--- a/drivers/i2c/busses/i2c-synquacer.c
++++ b/drivers/i2c/busses/i2c-synquacer.c
+@@ -550,12 +550,13 @@ static int synquacer_i2c_probe(struct platform_device *pdev)
+       device_property_read_u32(&pdev->dev, "socionext,pclk-rate",
+                                &i2c->pclkrate);
+-      pclk = devm_clk_get_enabled(&pdev->dev, "pclk");
++      pclk = devm_clk_get_optional_enabled(&pdev->dev, "pclk");
+       if (IS_ERR(pclk))
+               return dev_err_probe(&pdev->dev, PTR_ERR(pclk),
+                                    "failed to get and enable clock\n");
+-      i2c->pclkrate = clk_get_rate(pclk);
++      if (pclk)
++              i2c->pclkrate = clk_get_rate(pclk);
+       if (i2c->pclkrate < SYNQUACER_I2C_MIN_CLK_RATE ||
+           i2c->pclkrate > SYNQUACER_I2C_MAX_CLK_RATE)
+-- 
+2.43.0
+
diff --git a/queue-6.6/i2c-synquacer-remove-a-clk-reference-from-struct-syn.patch b/queue-6.6/i2c-synquacer-remove-a-clk-reference-from-struct-syn.patch
new file mode 100644 (file)
index 0000000..2714722
--- /dev/null
@@ -0,0 +1,64 @@
+From fc6f41807cd7c6bc8cc6889e28b4f5a3afefb43d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jan 2024 13:48:25 +0100
+Subject: i2c: synquacer: Remove a clk reference from struct synquacer_i2c
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit e6722ea6b9ed731f7392277d76ca912dfffca7ee ]
+
+'pclk' is only used locally in the probe. Remove it from the
+'synquacer_i2c' structure.
+
+Also remove a useless debug message.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Stable-dep-of: f2990f863053 ("i2c: synquacer: Deal with optional PCLK correctly")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-synquacer.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c
+index a73f5bb9a1645..e774b9f499b63 100644
+--- a/drivers/i2c/busses/i2c-synquacer.c
++++ b/drivers/i2c/busses/i2c-synquacer.c
+@@ -138,7 +138,6 @@ struct synquacer_i2c {
+       int                     irq;
+       struct device           *dev;
+       void __iomem            *base;
+-      struct clk              *pclk;
+       u32                     pclkrate;
+       u32                     speed_khz;
+       u32                     timeout_ms;
+@@ -535,6 +534,7 @@ static const struct i2c_adapter synquacer_i2c_ops = {
+ static int synquacer_i2c_probe(struct platform_device *pdev)
+ {
+       struct synquacer_i2c *i2c;
++      struct clk *pclk;
+       u32 bus_speed;
+       int ret;
+@@ -550,13 +550,12 @@ static int synquacer_i2c_probe(struct platform_device *pdev)
+       device_property_read_u32(&pdev->dev, "socionext,pclk-rate",
+                                &i2c->pclkrate);
+-      i2c->pclk = devm_clk_get_enabled(&pdev->dev, "pclk");
+-      if (IS_ERR(i2c->pclk))
+-              return dev_err_probe(&pdev->dev, PTR_ERR(i2c->pclk),
++      pclk = devm_clk_get_enabled(&pdev->dev, "pclk");
++      if (IS_ERR(pclk))
++              return dev_err_probe(&pdev->dev, PTR_ERR(pclk),
+                                    "failed to get and enable clock\n");
+-      dev_dbg(&pdev->dev, "clock source %p\n", i2c->pclk);
+-      i2c->pclkrate = clk_get_rate(i2c->pclk);
++      i2c->pclkrate = clk_get_rate(pclk);
+       if (i2c->pclkrate < SYNQUACER_I2C_MIN_CLK_RATE ||
+           i2c->pclkrate > SYNQUACER_I2C_MAX_CLK_RATE)
+-- 
+2.43.0
+
diff --git a/queue-6.6/iio-pressure-bmp280-allow-multiple-chips-id-per-fami.patch b/queue-6.6/iio-pressure-bmp280-allow-multiple-chips-id-per-fami.patch
new file mode 100644 (file)
index 0000000..1ccbde0
--- /dev/null
@@ -0,0 +1,145 @@
+From 399b83593538517e48cdd1e53b8ca0924cca50ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Oct 2023 19:22:20 +0200
+Subject: iio: pressure: bmp280: Allow multiple chips id per family of devices
+
+From: Angel Iglesias <ang.iglesiasg@gmail.com>
+
+[ Upstream commit 33564435c8084ff29837c9ed9bb9574ec957751d ]
+
+Improve device detection in certain chip families known to have
+various chip IDs. When no ID matches, give a warning but follow
+along what device said on the firmware side and try to configure
+it.
+
+Signed-off-by: Angel Iglesias <ang.iglesiasg@gmail.com>
+Link: https://lore.kernel.org/r/eade22d11e9de4405ea19fdaa5a8249143ae94df.1697994521.git.ang.iglesiasg@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Stable-dep-of: b9065b0250e1 ("iio: pressure: bmp280: Fix regmap for BMP280 device")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/pressure/bmp280-core.c | 35 ++++++++++++++++++++++--------
+ drivers/iio/pressure/bmp280.h      |  3 ++-
+ 2 files changed, 28 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index a65630d5742f0..ac72b175ffcc1 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -794,10 +794,12 @@ static int bmp280_chip_config(struct bmp280_data *data)
+ }
+ static const int bmp280_oversampling_avail[] = { 1, 2, 4, 8, 16 };
++static const u8 bmp280_chip_ids[] = { BMP280_CHIP_ID };
+ const struct bmp280_chip_info bmp280_chip_info = {
+       .id_reg = BMP280_REG_ID,
+-      .chip_id = BMP280_CHIP_ID,
++      .chip_id = bmp280_chip_ids,
++      .num_chip_id = ARRAY_SIZE(bmp280_chip_ids),
+       .regmap_config = &bmp280_regmap_config,
+       .start_up_time = 2000,
+       .channels = bmp280_channels,
+@@ -846,9 +848,12 @@ static int bme280_chip_config(struct bmp280_data *data)
+       return bmp280_chip_config(data);
+ }
++static const u8 bme280_chip_ids[] = { BME280_CHIP_ID };
++
+ const struct bmp280_chip_info bme280_chip_info = {
+       .id_reg = BMP280_REG_ID,
+-      .chip_id = BME280_CHIP_ID,
++      .chip_id = bme280_chip_ids,
++      .num_chip_id = ARRAY_SIZE(bme280_chip_ids),
+       .regmap_config = &bmp280_regmap_config,
+       .start_up_time = 2000,
+       .channels = bmp280_channels,
+@@ -1220,10 +1225,12 @@ static int bmp380_chip_config(struct bmp280_data *data)
+ static const int bmp380_oversampling_avail[] = { 1, 2, 4, 8, 16, 32 };
+ static const int bmp380_iir_filter_coeffs_avail[] = { 1, 2, 4, 8, 16, 32, 64, 128};
++static const u8 bmp380_chip_ids[] = { BMP380_CHIP_ID };
+ const struct bmp280_chip_info bmp380_chip_info = {
+       .id_reg = BMP380_REG_ID,
+-      .chip_id = BMP380_CHIP_ID,
++      .chip_id = bmp380_chip_ids,
++      .num_chip_id = ARRAY_SIZE(bmp380_chip_ids),
+       .regmap_config = &bmp380_regmap_config,
+       .start_up_time = 2000,
+       .channels = bmp380_channels,
+@@ -1720,10 +1727,12 @@ static int bmp580_chip_config(struct bmp280_data *data)
+ }
+ static const int bmp580_oversampling_avail[] = { 1, 2, 4, 8, 16, 32, 64, 128 };
++static const u8 bmp580_chip_ids[] = { BMP580_CHIP_ID, BMP580_CHIP_ID_ALT };
+ const struct bmp280_chip_info bmp580_chip_info = {
+       .id_reg = BMP580_REG_CHIP_ID,
+-      .chip_id = BMP580_CHIP_ID,
++      .chip_id = bmp580_chip_ids,
++      .num_chip_id = ARRAY_SIZE(bmp580_chip_ids),
+       .regmap_config = &bmp580_regmap_config,
+       .start_up_time = 2000,
+       .channels = bmp380_channels,
+@@ -1983,10 +1992,12 @@ static int bmp180_chip_config(struct bmp280_data *data)
+ static const int bmp180_oversampling_temp_avail[] = { 1 };
+ static const int bmp180_oversampling_press_avail[] = { 1, 2, 4, 8 };
++static const u8 bmp180_chip_ids[] = { BMP180_CHIP_ID };
+ const struct bmp280_chip_info bmp180_chip_info = {
+       .id_reg = BMP280_REG_ID,
+-      .chip_id = BMP180_CHIP_ID,
++      .chip_id = bmp180_chip_ids,
++      .num_chip_id = ARRAY_SIZE(bmp180_chip_ids),
+       .regmap_config = &bmp180_regmap_config,
+       .start_up_time = 2000,
+       .channels = bmp280_channels,
+@@ -2077,6 +2088,7 @@ int bmp280_common_probe(struct device *dev,
+       struct bmp280_data *data;
+       struct gpio_desc *gpiod;
+       unsigned int chip_id;
++      unsigned int i;
+       int ret;
+       indio_dev = devm_iio_device_alloc(dev, sizeof(*data));
+@@ -2142,12 +2154,17 @@ int bmp280_common_probe(struct device *dev,
+       ret = regmap_read(regmap, data->chip_info->id_reg, &chip_id);
+       if (ret < 0)
+               return ret;
+-      if (chip_id != data->chip_info->chip_id) {
+-              dev_err(dev, "bad chip id: expected %x got %x\n",
+-                      data->chip_info->chip_id, chip_id);
+-              return -EINVAL;
++
++      for (i = 0; i < data->chip_info->num_chip_id; i++) {
++              if (chip_id == data->chip_info->chip_id[i]) {
++                      dev_info(dev, "0x%x is a known chip id for %s\n", chip_id, name);
++                      break;
++              }
+       }
++      if (i == data->chip_info->num_chip_id)
++              dev_warn(dev, "bad chip id: 0x%x is not a known chip id\n", chip_id);
++
+       if (data->chip_info->preinit) {
+               ret = data->chip_info->preinit(data);
+               if (ret)
+diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h
+index 9d9f4ce2baa6e..a44ea33221635 100644
+--- a/drivers/iio/pressure/bmp280.h
++++ b/drivers/iio/pressure/bmp280.h
+@@ -418,7 +418,8 @@ struct bmp280_data {
+ struct bmp280_chip_info {
+       unsigned int id_reg;
+-      const unsigned int chip_id;
++      const u8 *chip_id;
++      int num_chip_id;
+       const struct regmap_config *regmap_config;
+-- 
+2.43.0
+
diff --git a/queue-6.6/iio-pressure-bmp280-fix-regmap-for-bmp280-device.patch b/queue-6.6/iio-pressure-bmp280-fix-regmap-for-bmp280-device.patch
new file mode 100644 (file)
index 0000000..a40cb16
--- /dev/null
@@ -0,0 +1,137 @@
+From 66c0d6e31094c10458bed2eee0926c8682e61f60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jul 2024 23:15:49 +0200
+Subject: iio: pressure: bmp280: Fix regmap for BMP280 device
+
+From: Vasileios Amoiridis <vassilisamir@gmail.com>
+
+[ Upstream commit b9065b0250e1705935445ede0a18c1850afe7b75 ]
+
+Up to now, the BMP280 device is using the regmap of the BME280 which
+has registers that exist only in the BME280 device.
+
+Fixes: 14e8015f8569 ("iio: pressure: bmp280: split driver in logical parts")
+Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
+Link: https://patch.msgid.link/20240711211558.106327-2-vassilisamir@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/pressure/bmp280-core.c   |  2 +-
+ drivers/iio/pressure/bmp280-regmap.c | 45 ++++++++++++++++++++++++++--
+ drivers/iio/pressure/bmp280.h        |  1 +
+ 3 files changed, 44 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index 8f70fd72f132a..3ba718b11c464 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -852,7 +852,7 @@ const struct bmp280_chip_info bme280_chip_info = {
+       .id_reg = BMP280_REG_ID,
+       .chip_id = bme280_chip_ids,
+       .num_chip_id = ARRAY_SIZE(bme280_chip_ids),
+-      .regmap_config = &bmp280_regmap_config,
++      .regmap_config = &bme280_regmap_config,
+       .start_up_time = 2000,
+       .channels = bmp280_channels,
+       .num_channels = 3,
+diff --git a/drivers/iio/pressure/bmp280-regmap.c b/drivers/iio/pressure/bmp280-regmap.c
+index fa52839474b18..d27d68edd9065 100644
+--- a/drivers/iio/pressure/bmp280-regmap.c
++++ b/drivers/iio/pressure/bmp280-regmap.c
+@@ -41,7 +41,7 @@ const struct regmap_config bmp180_regmap_config = {
+ };
+ EXPORT_SYMBOL_NS(bmp180_regmap_config, IIO_BMP280);
+-static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg)
++static bool bme280_is_writeable_reg(struct device *dev, unsigned int reg)
+ {
+       switch (reg) {
+       case BMP280_REG_CONFIG:
+@@ -54,7 +54,35 @@ static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg)
+       }
+ }
++static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg)
++{
++      switch (reg) {
++      case BMP280_REG_CONFIG:
++      case BMP280_REG_CTRL_MEAS:
++      case BMP280_REG_RESET:
++              return true;
++      default:
++              return false;
++      }
++}
++
+ static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg)
++{
++      switch (reg) {
++      case BMP280_REG_TEMP_XLSB:
++      case BMP280_REG_TEMP_LSB:
++      case BMP280_REG_TEMP_MSB:
++      case BMP280_REG_PRESS_XLSB:
++      case BMP280_REG_PRESS_LSB:
++      case BMP280_REG_PRESS_MSB:
++      case BMP280_REG_STATUS:
++              return true;
++      default:
++              return false;
++      }
++}
++
++static bool bme280_is_volatile_reg(struct device *dev, unsigned int reg)
+ {
+       switch (reg) {
+       case BME280_REG_HUMIDITY_LSB:
+@@ -71,7 +99,6 @@ static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg)
+               return false;
+       }
+ }
+-
+ static bool bmp380_is_writeable_reg(struct device *dev, unsigned int reg)
+ {
+       switch (reg) {
+@@ -167,7 +194,7 @@ const struct regmap_config bmp280_regmap_config = {
+       .reg_bits = 8,
+       .val_bits = 8,
+-      .max_register = BME280_REG_HUMIDITY_LSB,
++      .max_register = BMP280_REG_TEMP_XLSB,
+       .cache_type = REGCACHE_RBTREE,
+       .writeable_reg = bmp280_is_writeable_reg,
+@@ -175,6 +202,18 @@ const struct regmap_config bmp280_regmap_config = {
+ };
+ EXPORT_SYMBOL_NS(bmp280_regmap_config, IIO_BMP280);
++const struct regmap_config bme280_regmap_config = {
++      .reg_bits = 8,
++      .val_bits = 8,
++
++      .max_register = BME280_REG_HUMIDITY_LSB,
++      .cache_type = REGCACHE_RBTREE,
++
++      .writeable_reg = bme280_is_writeable_reg,
++      .volatile_reg = bme280_is_volatile_reg,
++};
++EXPORT_SYMBOL_NS(bme280_regmap_config, IIO_BMP280);
++
+ const struct regmap_config bmp380_regmap_config = {
+       .reg_bits = 8,
+       .val_bits = 8,
+diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h
+index 1a6903a917add..b60e551b7d318 100644
+--- a/drivers/iio/pressure/bmp280.h
++++ b/drivers/iio/pressure/bmp280.h
+@@ -468,6 +468,7 @@ extern const struct bmp280_chip_info bmp580_chip_info;
+ /* Regmap configurations */
+ extern const struct regmap_config bmp180_regmap_config;
+ extern const struct regmap_config bmp280_regmap_config;
++extern const struct regmap_config bme280_regmap_config;
+ extern const struct regmap_config bmp380_regmap_config;
+ extern const struct regmap_config bmp580_regmap_config;
+-- 
+2.43.0
+
diff --git a/queue-6.6/iio-pressure-bmp280-fix-waiting-time-for-bmp3xx-conf.patch b/queue-6.6/iio-pressure-bmp280-fix-waiting-time-for-bmp3xx-conf.patch
new file mode 100644 (file)
index 0000000..c264d90
--- /dev/null
@@ -0,0 +1,47 @@
+From 29b97d5e12a4580ac3af54f98065bc4a03b40b13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jul 2024 23:15:50 +0200
+Subject: iio: pressure: bmp280: Fix waiting time for BMP3xx configuration
+
+From: Vasileios Amoiridis <vassilisamir@gmail.com>
+
+[ Upstream commit 262a6634bcc4f0c1c53d13aa89882909f281a6aa ]
+
+According to the datasheet, both pressure and temperature can go up to
+oversampling x32. With this option, the maximum measurement time is not
+80ms (this is for press x32 and temp x2), but it is 130ms nominal
+(calculated from table 3.9.2) and since most of the maximum values
+are around +15%, it is configured to 150ms.
+
+Fixes: 8d329309184d ("iio: pressure: bmp280: Add support for BMP380 sensor family")
+Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
+Link: https://patch.msgid.link/20240711211558.106327-3-vassilisamir@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/pressure/bmp280-core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index 3ba718b11c464..84f6b333c9195 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -1203,10 +1203,11 @@ static int bmp380_chip_config(struct bmp280_data *data)
+               }
+               /*
+                * Waits for measurement before checking configuration error
+-               * flag. Selected longest measure time indicated in
+-               * section 3.9.1 in the datasheet.
++               * flag. Selected longest measurement time, calculated from
++               * formula in datasheet section 3.9.2 with an offset of ~+15%
++               * as it seen as well in table 3.9.1.
+                */
+-              msleep(80);
++              msleep(150);
+               /* Check config error flag */
+               ret = regmap_read(data->regmap, BMP380_REG_ERROR, &tmp);
+-- 
+2.43.0
+
diff --git a/queue-6.6/iio-pressure-bmp280-improve-indentation-and-line-wra.patch b/queue-6.6/iio-pressure-bmp280-improve-indentation-and-line-wra.patch
new file mode 100644 (file)
index 0000000..1a0f4fb
--- /dev/null
@@ -0,0 +1,368 @@
+From 042ba03dc0ccd66bc07b06eef215ebf984319d8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2024 21:00:37 +0200
+Subject: iio: pressure: bmp280: Improve indentation and line wrapping
+
+From: Vasileios Amoiridis <vassilisamir@gmail.com>
+
+[ Upstream commit 439ce8961bdd2e925c1f6adc82ce9fe3931e2c08 ]
+
+Fix indentations that are not following the standards, remove
+extra white lines and add missing white lines.
+
+Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
+Link: https://lore.kernel.org/r/20240429190046.24252-2-vassilisamir@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Stable-dep-of: b9065b0250e1 ("iio: pressure: bmp280: Fix regmap for BMP280 device")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/pressure/bmp280-core.c | 108 ++++++++++++++++-------------
+ drivers/iio/pressure/bmp280-spi.c  |   4 +-
+ 2 files changed, 61 insertions(+), 51 deletions(-)
+
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index ac72b175ffcc1..dac2a4e237929 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -51,7 +51,6 @@
+  */
+ enum { AC1, AC2, AC3, AC4, AC5, AC6, B1, B2, MB, MC, MD };
+-
+ enum bmp380_odr {
+       BMP380_ODR_200HZ,
+       BMP380_ODR_100HZ,
+@@ -180,18 +179,19 @@ static int bmp280_read_calib(struct bmp280_data *data)
+       struct bmp280_calib *calib = &data->calib.bmp280;
+       int ret;
+-
+       /* Read temperature and pressure calibration values. */
+       ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_TEMP_START,
+-                             data->bmp280_cal_buf, sizeof(data->bmp280_cal_buf));
++                             data->bmp280_cal_buf,
++                             sizeof(data->bmp280_cal_buf));
+       if (ret < 0) {
+               dev_err(data->dev,
+-                      "failed to read temperature and pressure calibration parameters\n");
++                      "failed to read calibration parameters\n");
+               return ret;
+       }
+-      /* Toss the temperature and pressure calibration data into the entropy pool */
+-      add_device_randomness(data->bmp280_cal_buf, sizeof(data->bmp280_cal_buf));
++      /* Toss calibration data into the entropy pool */
++      add_device_randomness(data->bmp280_cal_buf,
++                            sizeof(data->bmp280_cal_buf));
+       /* Parse temperature calibration values. */
+       calib->T1 = le16_to_cpu(data->bmp280_cal_buf[T1]);
+@@ -222,7 +222,7 @@ static int bme280_read_calib(struct bmp280_data *data)
+       /* Load shared calibration params with bmp280 first */
+       ret = bmp280_read_calib(data);
+       if  (ret < 0) {
+-              dev_err(dev, "failed to read common bmp280 calibration parameters\n");
++              dev_err(dev, "failed to read calibration parameters\n");
+               return ret;
+       }
+@@ -282,6 +282,7 @@ static int bme280_read_calib(struct bmp280_data *data)
+       return 0;
+ }
++
+ /*
+  * Returns humidity in percent, resolution is 0.01 percent. Output value of
+  * "47445" represents 47445/1024 = 46.333 %RH.
+@@ -304,7 +305,7 @@ static u32 bmp280_compensate_humidity(struct bmp280_data *data,
+       var = clamp_val(var, 0, 419430400);
+       return var >> 12;
+-};
++}
+ /*
+  * Returns temperature in DegC, resolution is 0.01 DegC.  Output value of
+@@ -537,7 +538,7 @@ static int bmp280_read_raw(struct iio_dev *indio_dev,
+ }
+ static int bmp280_write_oversampling_ratio_humid(struct bmp280_data *data,
+-                                             int val)
++                                               int val)
+ {
+       const int *avail = data->chip_info->oversampling_humid_avail;
+       const int n = data->chip_info->num_oversampling_humid_avail;
+@@ -562,7 +563,7 @@ static int bmp280_write_oversampling_ratio_humid(struct bmp280_data *data,
+ }
+ static int bmp280_write_oversampling_ratio_temp(struct bmp280_data *data,
+-                                             int val)
++                                              int val)
+ {
+       const int *avail = data->chip_info->oversampling_temp_avail;
+       const int n = data->chip_info->num_oversampling_temp_avail;
+@@ -587,7 +588,7 @@ static int bmp280_write_oversampling_ratio_temp(struct bmp280_data *data,
+ }
+ static int bmp280_write_oversampling_ratio_press(struct bmp280_data *data,
+-                                             int val)
++                                               int val)
+ {
+       const int *avail = data->chip_info->oversampling_press_avail;
+       const int n = data->chip_info->num_oversampling_press_avail;
+@@ -771,13 +772,12 @@ static int bmp280_chip_config(struct bmp280_data *data)
+       int ret;
+       ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS,
+-                               BMP280_OSRS_TEMP_MASK |
+-                               BMP280_OSRS_PRESS_MASK |
+-                               BMP280_MODE_MASK,
+-                               osrs | BMP280_MODE_NORMAL);
++                              BMP280_OSRS_TEMP_MASK |
++                              BMP280_OSRS_PRESS_MASK |
++                              BMP280_MODE_MASK,
++                              osrs | BMP280_MODE_NORMAL);
+       if (ret < 0) {
+-              dev_err(data->dev,
+-                      "failed to write ctrl_meas register\n");
++              dev_err(data->dev, "failed to write ctrl_meas register\n");
+               return ret;
+       }
+@@ -785,8 +785,7 @@ static int bmp280_chip_config(struct bmp280_data *data)
+                                BMP280_FILTER_MASK,
+                                BMP280_FILTER_4X);
+       if (ret < 0) {
+-              dev_err(data->dev,
+-                      "failed to write config register\n");
++              dev_err(data->dev, "failed to write config register\n");
+               return ret;
+       }
+@@ -925,8 +924,8 @@ static int bmp380_cmd(struct bmp280_data *data, u8 cmd)
+ }
+ /*
+- * Returns temperature in Celsius degrees, resolution is 0.01º C. Output value of
+- * "5123" equals 51.2º C. t_fine carries fine temperature as global value.
++ * Returns temperature in Celsius degrees, resolution is 0.01º C. Output value
++ * of "5123" equals 51.2º C. t_fine carries fine temperature as global value.
+  *
+  * Taken from datasheet, Section Appendix 9, "Compensation formula" and repo
+  * https://github.com/BoschSensortec/BMP3-Sensor-API.
+@@ -1068,7 +1067,8 @@ static int bmp380_read_calib(struct bmp280_data *data)
+       /* Read temperature and pressure calibration data */
+       ret = regmap_bulk_read(data->regmap, BMP380_REG_CALIB_TEMP_START,
+-                             data->bmp380_cal_buf, sizeof(data->bmp380_cal_buf));
++                             data->bmp380_cal_buf,
++                             sizeof(data->bmp380_cal_buf));
+       if (ret) {
+               dev_err(data->dev,
+                       "failed to read temperature calibration parameters\n");
+@@ -1076,7 +1076,8 @@ static int bmp380_read_calib(struct bmp280_data *data)
+       }
+       /* Toss the temperature calibration data into the entropy pool */
+-      add_device_randomness(data->bmp380_cal_buf, sizeof(data->bmp380_cal_buf));
++      add_device_randomness(data->bmp380_cal_buf,
++                            sizeof(data->bmp380_cal_buf));
+       /* Parse calibration values */
+       calib->T1 = get_unaligned_le16(&data->bmp380_cal_buf[BMP380_T1]);
+@@ -1158,7 +1159,8 @@ static int bmp380_chip_config(struct bmp280_data *data)
+       /* Configure output data rate */
+       ret = regmap_update_bits_check(data->regmap, BMP380_REG_ODR,
+-                                     BMP380_ODRS_MASK, data->sampling_freq, &aux);
++                                     BMP380_ODRS_MASK, data->sampling_freq,
++                                     &aux);
+       if (ret) {
+               dev_err(data->dev, "failed to write ODR selection register\n");
+               return ret;
+@@ -1177,12 +1179,13 @@ static int bmp380_chip_config(struct bmp280_data *data)
+       if (change) {
+               /*
+-               * The configurations errors are detected on the fly during a measurement
+-               * cycle. If the sampling frequency is too low, it's faster to reset
+-               * the measurement loop than wait until the next measurement is due.
++               * The configurations errors are detected on the fly during a
++               * measurement cycle. If the sampling frequency is too low, it's
++               * faster to reset the measurement loop than wait until the next
++               * measurement is due.
+                *
+-               * Resets sensor measurement loop toggling between sleep and normal
+-               * operating modes.
++               * Resets sensor measurement loop toggling between sleep and
++               * normal operating modes.
+                */
+               ret = regmap_write_bits(data->regmap, BMP380_REG_POWER_CONTROL,
+                                       BMP380_MODE_MASK,
+@@ -1200,22 +1203,21 @@ static int bmp380_chip_config(struct bmp280_data *data)
+                       return ret;
+               }
+               /*
+-               * Waits for measurement before checking configuration error flag.
+-               * Selected longest measure time indicated in section 3.9.1
+-               * in the datasheet.
++               * Waits for measurement before checking configuration error
++               * flag. Selected longest measure time indicated in
++               * section 3.9.1 in the datasheet.
+                */
+               msleep(80);
+               /* Check config error flag */
+               ret = regmap_read(data->regmap, BMP380_REG_ERROR, &tmp);
+               if (ret) {
+-                      dev_err(data->dev,
+-                              "failed to read error register\n");
++                      dev_err(data->dev, "failed to read error register\n");
+                       return ret;
+               }
+               if (tmp & BMP380_ERR_CONF_MASK) {
+                       dev_warn(data->dev,
+-                              "sensor flagged configuration as incompatible\n");
++                               "sensor flagged configuration as incompatible\n");
+                       return -EINVAL;
+               }
+       }
+@@ -1315,9 +1317,11 @@ static int bmp580_nvm_operation(struct bmp280_data *data, bool is_write)
+       }
+       /* Start NVM operation sequence */
+-      ret = regmap_write(data->regmap, BMP580_REG_CMD, BMP580_CMD_NVM_OP_SEQ_0);
++      ret = regmap_write(data->regmap, BMP580_REG_CMD,
++                         BMP580_CMD_NVM_OP_SEQ_0);
+       if (ret) {
+-              dev_err(data->dev, "failed to send nvm operation's first sequence\n");
++              dev_err(data->dev,
++                      "failed to send nvm operation's first sequence\n");
+               return ret;
+       }
+       if (is_write) {
+@@ -1325,7 +1329,8 @@ static int bmp580_nvm_operation(struct bmp280_data *data, bool is_write)
+               ret = regmap_write(data->regmap, BMP580_REG_CMD,
+                                  BMP580_CMD_NVM_WRITE_SEQ_1);
+               if (ret) {
+-                      dev_err(data->dev, "failed to send nvm write sequence\n");
++                      dev_err(data->dev,
++                              "failed to send nvm write sequence\n");
+                       return ret;
+               }
+               /* Datasheet says on 4.8.1.2 it takes approximately 10ms */
+@@ -1336,7 +1341,8 @@ static int bmp580_nvm_operation(struct bmp280_data *data, bool is_write)
+               ret = regmap_write(data->regmap, BMP580_REG_CMD,
+                                  BMP580_CMD_NVM_READ_SEQ_1);
+               if (ret) {
+-                      dev_err(data->dev, "failed to send nvm read sequence\n");
++                      dev_err(data->dev,
++                              "failed to send nvm read sequence\n");
+                       return ret;
+               }
+               /* Datasheet says on 4.8.1.1 it takes approximately 200us */
+@@ -1499,8 +1505,8 @@ static int bmp580_nvmem_read(void *priv, unsigned int offset, void *val,
+               if (ret)
+                       goto exit;
+-              ret = regmap_bulk_read(data->regmap, BMP580_REG_NVM_DATA_LSB, &data->le16,
+-                                     sizeof(data->le16));
++              ret = regmap_bulk_read(data->regmap, BMP580_REG_NVM_DATA_LSB,
++                                     &data->le16, sizeof(data->le16));
+               if (ret) {
+                       dev_err(data->dev, "error reading nvm data regs\n");
+                       goto exit;
+@@ -1544,7 +1550,8 @@ static int bmp580_nvmem_write(void *priv, unsigned int offset, void *val,
+       while (bytes >= sizeof(*buf)) {
+               addr = bmp580_nvmem_addrs[offset / sizeof(*buf)];
+-              ret = regmap_write(data->regmap, BMP580_REG_NVM_ADDR, BMP580_NVM_PROG_EN |
++              ret = regmap_write(data->regmap, BMP580_REG_NVM_ADDR,
++                                 BMP580_NVM_PROG_EN |
+                                  FIELD_PREP(BMP580_NVM_ROW_ADDR_MASK, addr));
+               if (ret) {
+                       dev_err(data->dev, "error writing nvm address\n");
+@@ -1552,8 +1559,8 @@ static int bmp580_nvmem_write(void *priv, unsigned int offset, void *val,
+               }
+               data->le16 = cpu_to_le16(*buf++);
+-              ret = regmap_bulk_write(data->regmap, BMP580_REG_NVM_DATA_LSB, &data->le16,
+-                                      sizeof(data->le16));
++              ret = regmap_bulk_write(data->regmap, BMP580_REG_NVM_DATA_LSB,
++                                      &data->le16, sizeof(data->le16));
+               if (ret) {
+                       dev_err(data->dev, "error writing LSB NVM data regs\n");
+                       goto exit;
+@@ -1660,7 +1667,8 @@ static int bmp580_chip_config(struct bmp280_data *data)
+                 BMP580_OSR_PRESS_EN;
+       ret = regmap_update_bits_check(data->regmap, BMP580_REG_OSR_CONFIG,
+-                                     BMP580_OSR_TEMP_MASK | BMP580_OSR_PRESS_MASK |
++                                     BMP580_OSR_TEMP_MASK |
++                                     BMP580_OSR_PRESS_MASK |
+                                      BMP580_OSR_PRESS_EN,
+                                      reg_val, &aux);
+       if (ret) {
+@@ -1711,7 +1719,8 @@ static int bmp580_chip_config(struct bmp280_data *data)
+                */
+               ret = regmap_read(data->regmap, BMP580_REG_EFF_OSR, &tmp);
+               if (ret) {
+-                      dev_err(data->dev, "error reading effective OSR register\n");
++                      dev_err(data->dev,
++                              "error reading effective OSR register\n");
+                       return ret;
+               }
+               if (!(tmp & BMP580_EFF_OSR_VALID_ODR)) {
+@@ -1846,7 +1855,8 @@ static int bmp180_read_calib(struct bmp280_data *data)
+       }
+       /* Toss the calibration data into the entropy pool */
+-      add_device_randomness(data->bmp180_cal_buf, sizeof(data->bmp180_cal_buf));
++      add_device_randomness(data->bmp180_cal_buf,
++                            sizeof(data->bmp180_cal_buf));
+       calib->AC1 = be16_to_cpu(data->bmp180_cal_buf[AC1]);
+       calib->AC2 = be16_to_cpu(data->bmp180_cal_buf[AC2]);
+@@ -1961,8 +1971,7 @@ static u32 bmp180_compensate_press(struct bmp280_data *data, s32 adc_press)
+       return p + ((x1 + x2 + 3791) >> 4);
+ }
+-static int bmp180_read_press(struct bmp280_data *data,
+-                           int *val, int *val2)
++static int bmp180_read_press(struct bmp280_data *data, int *val, int *val2)
+ {
+       u32 comp_press;
+       s32 adc_press;
+@@ -2239,6 +2248,7 @@ static int bmp280_runtime_resume(struct device *dev)
+       ret = regulator_bulk_enable(BMP280_NUM_SUPPLIES, data->supplies);
+       if (ret)
+               return ret;
++
+       usleep_range(data->start_up_time, data->start_up_time + 100);
+       return data->chip_info->chip_config(data);
+ }
+diff --git a/drivers/iio/pressure/bmp280-spi.c b/drivers/iio/pressure/bmp280-spi.c
+index 9de923228a9f4..47122da8e716d 100644
+--- a/drivers/iio/pressure/bmp280-spi.c
++++ b/drivers/iio/pressure/bmp280-spi.c
+@@ -12,7 +12,7 @@
+ #include "bmp280.h"
+ static int bmp280_regmap_spi_write(void *context, const void *data,
+-                                   size_t count)
++                                 size_t count)
+ {
+       struct device *dev = context;
+       struct spi_device *spi = to_spi_device(dev);
+@@ -29,7 +29,7 @@ static int bmp280_regmap_spi_write(void *context, const void *data,
+ }
+ static int bmp280_regmap_spi_read(void *context, const void *reg,
+-                                  size_t reg_size, void *val, size_t val_size)
++                                size_t reg_size, void *val, size_t val_size)
+ {
+       struct device *dev = context;
+       struct spi_device *spi = to_spi_device(dev);
+-- 
+2.43.0
+
diff --git a/queue-6.6/iio-pressure-bmp280-use-bme-prefix-for-bme280-specif.patch b/queue-6.6/iio-pressure-bmp280-use-bme-prefix-for-bme280-specif.patch
new file mode 100644 (file)
index 0000000..b47068e
--- /dev/null
@@ -0,0 +1,290 @@
+From b50e8262fc726c3792745b124299512510b77530 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2024 21:00:38 +0200
+Subject: iio: pressure: bmp280: Use BME prefix for BME280 specifics
+
+From: Vasileios Amoiridis <vassilisamir@gmail.com>
+
+[ Upstream commit b23be4cd99a6f1f46963b87952632268174e62c1 ]
+
+Change the rest of the defines and function names that are
+used specifically by the BME280 humidity sensor to BME280
+as it is done for the rest of the BMP{0,1,3,5}80 sensors.
+
+Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com>
+Link: https://lore.kernel.org/r/20240429190046.24252-3-vassilisamir@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Stable-dep-of: b9065b0250e1 ("iio: pressure: bmp280: Fix regmap for BMP280 device")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/pressure/bmp280-core.c   | 37 +++++++++++------------
+ drivers/iio/pressure/bmp280-regmap.c |  8 ++---
+ drivers/iio/pressure/bmp280.h        | 45 +++++++++++++++-------------
+ 3 files changed, 46 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index dac2a4e237929..8f70fd72f132a 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -234,14 +234,14 @@ static int bme280_read_calib(struct bmp280_data *data)
+        * Humidity data is only available on BME280.
+        */
+-      ret = regmap_read(data->regmap, BMP280_REG_COMP_H1, &tmp);
++      ret = regmap_read(data->regmap, BME280_REG_COMP_H1, &tmp);
+       if (ret < 0) {
+               dev_err(dev, "failed to read H1 comp value\n");
+               return ret;
+       }
+       calib->H1 = tmp;
+-      ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_H2,
++      ret = regmap_bulk_read(data->regmap, BME280_REG_COMP_H2,
+                              &data->le16, sizeof(data->le16));
+       if (ret < 0) {
+               dev_err(dev, "failed to read H2 comp value\n");
+@@ -249,14 +249,14 @@ static int bme280_read_calib(struct bmp280_data *data)
+       }
+       calib->H2 = sign_extend32(le16_to_cpu(data->le16), 15);
+-      ret = regmap_read(data->regmap, BMP280_REG_COMP_H3, &tmp);
++      ret = regmap_read(data->regmap, BME280_REG_COMP_H3, &tmp);
+       if (ret < 0) {
+               dev_err(dev, "failed to read H3 comp value\n");
+               return ret;
+       }
+       calib->H3 = tmp;
+-      ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_H4,
++      ret = regmap_bulk_read(data->regmap, BME280_REG_COMP_H4,
+                              &data->be16, sizeof(data->be16));
+       if (ret < 0) {
+               dev_err(dev, "failed to read H4 comp value\n");
+@@ -265,15 +265,15 @@ static int bme280_read_calib(struct bmp280_data *data)
+       calib->H4 = sign_extend32(((be16_to_cpu(data->be16) >> 4) & 0xff0) |
+                                 (be16_to_cpu(data->be16) & 0xf), 11);
+-      ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_H5,
++      ret = regmap_bulk_read(data->regmap, BME280_REG_COMP_H5,
+                              &data->le16, sizeof(data->le16));
+       if (ret < 0) {
+               dev_err(dev, "failed to read H5 comp value\n");
+               return ret;
+       }
+-      calib->H5 = sign_extend32(FIELD_GET(BMP280_COMP_H5_MASK, le16_to_cpu(data->le16)), 11);
++      calib->H5 = sign_extend32(FIELD_GET(BME280_COMP_H5_MASK, le16_to_cpu(data->le16)), 11);
+-      ret = regmap_read(data->regmap, BMP280_REG_COMP_H6, &tmp);
++      ret = regmap_read(data->regmap, BME280_REG_COMP_H6, &tmp);
+       if (ret < 0) {
+               dev_err(dev, "failed to read H6 comp value\n");
+               return ret;
+@@ -289,7 +289,7 @@ static int bme280_read_calib(struct bmp280_data *data)
+  *
+  * Taken from BME280 datasheet, Section 4.2.3, "Compensation formula".
+  */
+-static u32 bmp280_compensate_humidity(struct bmp280_data *data,
++static u32 bme280_compensate_humidity(struct bmp280_data *data,
+                                     s32 adc_humidity)
+ {
+       struct bmp280_calib *calib = &data->calib.bmp280;
+@@ -429,7 +429,7 @@ static int bmp280_read_press(struct bmp280_data *data,
+       return IIO_VAL_FRACTIONAL;
+ }
+-static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2)
++static int bme280_read_humid(struct bmp280_data *data, int *val, int *val2)
+ {
+       u32 comp_humidity;
+       s32 adc_humidity;
+@@ -440,7 +440,7 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2)
+       if (ret < 0)
+               return ret;
+-      ret = regmap_bulk_read(data->regmap, BMP280_REG_HUMIDITY_MSB,
++      ret = regmap_bulk_read(data->regmap, BME280_REG_HUMIDITY_MSB,
+                              &data->be16, sizeof(data->be16));
+       if (ret < 0) {
+               dev_err(data->dev, "failed to read humidity\n");
+@@ -453,7 +453,7 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2)
+               dev_err(data->dev, "reading humidity skipped\n");
+               return -EIO;
+       }
+-      comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
++      comp_humidity = bme280_compensate_humidity(data, adc_humidity);
+       *val = comp_humidity * 1000 / 1024;
+@@ -537,7 +537,7 @@ static int bmp280_read_raw(struct iio_dev *indio_dev,
+       return ret;
+ }
+-static int bmp280_write_oversampling_ratio_humid(struct bmp280_data *data,
++static int bme280_write_oversampling_ratio_humid(struct bmp280_data *data,
+                                                int val)
+ {
+       const int *avail = data->chip_info->oversampling_humid_avail;
+@@ -681,7 +681,7 @@ static int bmp280_write_raw(struct iio_dev *indio_dev,
+               mutex_lock(&data->lock);
+               switch (chan->type) {
+               case IIO_HUMIDITYRELATIVE:
+-                      ret = bmp280_write_oversampling_ratio_humid(data, val);
++                      ret = bme280_write_oversampling_ratio_humid(data, val);
+                       break;
+               case IIO_PRESSURE:
+                       ret = bmp280_write_oversampling_ratio_press(data, val);
+@@ -831,16 +831,15 @@ EXPORT_SYMBOL_NS(bmp280_chip_info, IIO_BMP280);
+ static int bme280_chip_config(struct bmp280_data *data)
+ {
+-      u8 osrs = FIELD_PREP(BMP280_OSRS_HUMIDITY_MASK, data->oversampling_humid + 1);
++      u8 osrs = FIELD_PREP(BME280_OSRS_HUMIDITY_MASK, data->oversampling_humid + 1);
+       int ret;
+       /*
+        * Oversampling of humidity must be set before oversampling of
+        * temperature/pressure is set to become effective.
+        */
+-      ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_HUMIDITY,
+-                                BMP280_OSRS_HUMIDITY_MASK, osrs);
+-
++      ret = regmap_update_bits(data->regmap, BME280_REG_CTRL_HUMIDITY,
++                               BME280_OSRS_HUMIDITY_MASK, osrs);
+       if (ret < 0)
+               return ret;
+@@ -868,12 +867,12 @@ const struct bmp280_chip_info bme280_chip_info = {
+       .oversampling_humid_avail = bmp280_oversampling_avail,
+       .num_oversampling_humid_avail = ARRAY_SIZE(bmp280_oversampling_avail),
+-      .oversampling_humid_default = BMP280_OSRS_HUMIDITY_16X - 1,
++      .oversampling_humid_default = BME280_OSRS_HUMIDITY_16X - 1,
+       .chip_config = bme280_chip_config,
+       .read_temp = bmp280_read_temp,
+       .read_press = bmp280_read_press,
+-      .read_humid = bmp280_read_humid,
++      .read_humid = bme280_read_humid,
+       .read_calib = bme280_read_calib,
+ };
+ EXPORT_SYMBOL_NS(bme280_chip_info, IIO_BMP280);
+diff --git a/drivers/iio/pressure/bmp280-regmap.c b/drivers/iio/pressure/bmp280-regmap.c
+index 3ee56720428c5..fa52839474b18 100644
+--- a/drivers/iio/pressure/bmp280-regmap.c
++++ b/drivers/iio/pressure/bmp280-regmap.c
+@@ -45,7 +45,7 @@ static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg)
+ {
+       switch (reg) {
+       case BMP280_REG_CONFIG:
+-      case BMP280_REG_CTRL_HUMIDITY:
++      case BME280_REG_CTRL_HUMIDITY:
+       case BMP280_REG_CTRL_MEAS:
+       case BMP280_REG_RESET:
+               return true;
+@@ -57,8 +57,8 @@ static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg)
+ static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg)
+ {
+       switch (reg) {
+-      case BMP280_REG_HUMIDITY_LSB:
+-      case BMP280_REG_HUMIDITY_MSB:
++      case BME280_REG_HUMIDITY_LSB:
++      case BME280_REG_HUMIDITY_MSB:
+       case BMP280_REG_TEMP_XLSB:
+       case BMP280_REG_TEMP_LSB:
+       case BMP280_REG_TEMP_MSB:
+@@ -167,7 +167,7 @@ const struct regmap_config bmp280_regmap_config = {
+       .reg_bits = 8,
+       .val_bits = 8,
+-      .max_register = BMP280_REG_HUMIDITY_LSB,
++      .max_register = BME280_REG_HUMIDITY_LSB,
+       .cache_type = REGCACHE_RBTREE,
+       .writeable_reg = bmp280_is_writeable_reg,
+diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h
+index a44ea33221635..1a6903a917add 100644
+--- a/drivers/iio/pressure/bmp280.h
++++ b/drivers/iio/pressure/bmp280.h
+@@ -192,8 +192,6 @@
+ #define BMP380_PRESS_SKIPPED          0x800000
+ /* BMP280 specific registers */
+-#define BMP280_REG_HUMIDITY_LSB               0xFE
+-#define BMP280_REG_HUMIDITY_MSB               0xFD
+ #define BMP280_REG_TEMP_XLSB          0xFC
+ #define BMP280_REG_TEMP_LSB           0xFB
+ #define BMP280_REG_TEMP_MSB           0xFA
+@@ -207,15 +205,6 @@
+ #define BMP280_REG_CONFIG             0xF5
+ #define BMP280_REG_CTRL_MEAS          0xF4
+ #define BMP280_REG_STATUS             0xF3
+-#define BMP280_REG_CTRL_HUMIDITY      0xF2
+-
+-/* Due to non linear mapping, and data sizes we can't do a bulk read */
+-#define BMP280_REG_COMP_H1            0xA1
+-#define BMP280_REG_COMP_H2            0xE1
+-#define BMP280_REG_COMP_H3            0xE3
+-#define BMP280_REG_COMP_H4            0xE4
+-#define BMP280_REG_COMP_H5            0xE5
+-#define BMP280_REG_COMP_H6            0xE7
+ #define BMP280_REG_COMP_TEMP_START    0x88
+ #define BMP280_COMP_TEMP_REG_COUNT    6
+@@ -223,8 +212,6 @@
+ #define BMP280_REG_COMP_PRESS_START   0x8E
+ #define BMP280_COMP_PRESS_REG_COUNT   18
+-#define BMP280_COMP_H5_MASK           GENMASK(15, 4)
+-
+ #define BMP280_CONTIGUOUS_CALIB_REGS  (BMP280_COMP_TEMP_REG_COUNT + \
+                                        BMP280_COMP_PRESS_REG_COUNT)
+@@ -235,14 +222,6 @@
+ #define BMP280_FILTER_8X              3
+ #define BMP280_FILTER_16X             4
+-#define BMP280_OSRS_HUMIDITY_MASK     GENMASK(2, 0)
+-#define BMP280_OSRS_HUMIDITY_SKIP     0
+-#define BMP280_OSRS_HUMIDITY_1X               1
+-#define BMP280_OSRS_HUMIDITY_2X               2
+-#define BMP280_OSRS_HUMIDITY_4X               3
+-#define BMP280_OSRS_HUMIDITY_8X               4
+-#define BMP280_OSRS_HUMIDITY_16X      5
+-
+ #define BMP280_OSRS_TEMP_MASK         GENMASK(7, 5)
+ #define BMP280_OSRS_TEMP_SKIP         0
+ #define BMP280_OSRS_TEMP_1X           1
+@@ -264,6 +243,30 @@
+ #define BMP280_MODE_FORCED            1
+ #define BMP280_MODE_NORMAL            3
++/* BME280 specific registers */
++#define BME280_REG_HUMIDITY_LSB               0xFE
++#define BME280_REG_HUMIDITY_MSB               0xFD
++
++#define BME280_REG_CTRL_HUMIDITY      0xF2
++
++/* Due to non linear mapping, and data sizes we can't do a bulk read */
++#define BME280_REG_COMP_H1            0xA1
++#define BME280_REG_COMP_H2            0xE1
++#define BME280_REG_COMP_H3            0xE3
++#define BME280_REG_COMP_H4            0xE4
++#define BME280_REG_COMP_H5            0xE5
++#define BME280_REG_COMP_H6            0xE7
++
++#define BME280_COMP_H5_MASK           GENMASK(15, 4)
++
++#define BME280_OSRS_HUMIDITY_MASK     GENMASK(2, 0)
++#define BME280_OSRS_HUMIDITY_SKIP     0
++#define BME280_OSRS_HUMIDITY_1X               1
++#define BME280_OSRS_HUMIDITY_2X               2
++#define BME280_OSRS_HUMIDITY_4X               3
++#define BME280_OSRS_HUMIDITY_8X               4
++#define BME280_OSRS_HUMIDITY_16X      5
++
+ /* BMP180 specific registers */
+ #define BMP180_REG_OUT_XLSB           0xF8
+ #define BMP180_REG_OUT_LSB            0xF7
+-- 
+2.43.0
+
diff --git a/queue-6.6/io_uring-net-harden-multishot-termination-case-for-r.patch b/queue-6.6/io_uring-net-harden-multishot-termination-case-for-r.patch
new file mode 100644 (file)
index 0000000..5584cce
--- /dev/null
@@ -0,0 +1,61 @@
+From cb7ff26400e66e2ce214690e6a2325fbb827511e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 07:08:10 -0600
+Subject: io_uring/net: harden multishot termination case for recv
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit c314094cb4cfa6fc5a17f4881ead2dfebfa717a7 ]
+
+If the recv returns zero, or an error, then it doesn't matter if more
+data has already been received for this buffer. A condition like that
+should terminate the multishot receive. Rather than pass in the
+collected return value, pass in whether to terminate or keep the recv
+going separately.
+
+Note that this isn't a bug right now, as the only way to get there is
+via setting MSG_WAITALL with multishot receive. And if an application
+does that, then -EINVAL is returned anyway. But it seems like an easy
+bug to introduce, so let's make it a bit more explicit.
+
+Link: https://github.com/axboe/liburing/issues/1246
+Cc: stable@vger.kernel.org
+Fixes: b3fdea6ecb55 ("io_uring: multishot recv")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/net.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/io_uring/net.c b/io_uring/net.c
+index cf1060fb04f43..7412904387bfa 100644
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@ -930,6 +930,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags)
+       int ret, min_ret = 0;
+       bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
+       size_t len = sr->len;
++      bool mshot_finished;
+       if (!(req->flags & REQ_F_POLLED) &&
+           (sr->flags & IORING_RECVSEND_POLL_FIRST))
+@@ -999,6 +1000,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags)
+               req_set_fail(req);
+       }
++      mshot_finished = ret <= 0;
+       if (ret > 0)
+               ret += sr->done_io;
+       else if (sr->done_io)
+@@ -1006,7 +1008,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags)
+       else
+               io_kbuf_recycle(req, issue_flags);
+-      if (!io_recv_finish(req, &ret, &msg, ret <= 0, issue_flags))
++      if (!io_recv_finish(req, &ret, &msg, mshot_finished, issue_flags))
+               goto retry_multishot;
+       return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.6/kconfig-qconf-fix-buffer-overflow-in-debug-links.patch b/queue-6.6/kconfig-qconf-fix-buffer-overflow-in-debug-links.patch
new file mode 100644 (file)
index 0000000..d514129
--- /dev/null
@@ -0,0 +1,43 @@
+From ededfd6433c92f64522122c3e546ad8b2b13f264 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 18:02:22 +0900
+Subject: kconfig: qconf: fix buffer overflow in debug links
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 984ed20ece1c6c20789ece040cbff3eb1a388fa9 ]
+
+If you enable "Option -> Show Debug Info" and click a link, the program
+terminates with the following error:
+
+    *** buffer overflow detected ***: terminated
+
+The buffer overflow is caused by the following line:
+
+    strcat(data, "$");
+
+The buffer needs one more byte to accommodate the additional character.
+
+Fixes: c4f7398bee9c ("kconfig: qconf: make debug links work again")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/qconf.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
+index 620a3527c767a..4f3ba3debc08e 100644
+--- a/scripts/kconfig/qconf.cc
++++ b/scripts/kconfig/qconf.cc
+@@ -1174,7 +1174,7 @@ void ConfigInfoView::clicked(const QUrl &url)
+ {
+       QByteArray str = url.toEncoded();
+       const std::size_t count = str.size();
+-      char *data = new char[count + 1];
++      char *data = new char[count + 2];  // '$' + '\0'
+       struct symbol **result;
+       struct menu *m = NULL;
+-- 
+2.43.0
+
diff --git a/queue-6.6/lib-buildid-harden-build-id-parsing-logic.patch b/queue-6.6/lib-buildid-harden-build-id-parsing-logic.patch
new file mode 100644 (file)
index 0000000..e6db9ca
--- /dev/null
@@ -0,0 +1,177 @@
+From 56ac1f323f02ee15ed9f42f99fb78356abfda50e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 10:42:23 -0700
+Subject: lib/buildid: harden build ID parsing logic
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 905415ff3ffb1d7e5afa62bacabd79776bd24606 ]
+
+Harden build ID parsing logic, adding explicit READ_ONCE() where it's
+important to have a consistent value read and validated just once.
+
+Also, as pointed out by Andi Kleen, we need to make sure that entire ELF
+note is within a page bounds, so move the overflow check up and add an
+extra note_size boundaries validation.
+
+Fixes tag below points to the code that moved this code into
+lib/buildid.c, and then subsequently was used in perf subsystem, making
+this code exposed to perf_event_open() users in v5.12+.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
+Reviewed-by: Jann Horn <jannh@google.com>
+Suggested-by: Andi Kleen <ak@linux.intel.com>
+Fixes: bd7525dacd7e ("bpf: Move stack_map_get_build_id into lib")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20240829174232.3133883-2-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/buildid.c | 76 +++++++++++++++++++++++++++++----------------------
+ 1 file changed, 44 insertions(+), 32 deletions(-)
+
+diff --git a/lib/buildid.c b/lib/buildid.c
+index cdc0950f73843..d3bc3d0528d5c 100644
+--- a/lib/buildid.c
++++ b/lib/buildid.c
+@@ -18,31 +18,37 @@ static int parse_build_id_buf(unsigned char *build_id,
+                             const void *note_start,
+                             Elf32_Word note_size)
+ {
+-      Elf32_Word note_offs = 0, new_offs;
+-
+-      while (note_offs + sizeof(Elf32_Nhdr) < note_size) {
+-              Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_offs);
++      const char note_name[] = "GNU";
++      const size_t note_name_sz = sizeof(note_name);
++      u64 note_off = 0, new_off, name_sz, desc_sz;
++      const char *data;
++
++      while (note_off + sizeof(Elf32_Nhdr) < note_size &&
++             note_off + sizeof(Elf32_Nhdr) > note_off /* overflow */) {
++              Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_off);
++
++              name_sz = READ_ONCE(nhdr->n_namesz);
++              desc_sz = READ_ONCE(nhdr->n_descsz);
++
++              new_off = note_off + sizeof(Elf32_Nhdr);
++              if (check_add_overflow(new_off, ALIGN(name_sz, 4), &new_off) ||
++                  check_add_overflow(new_off, ALIGN(desc_sz, 4), &new_off) ||
++                  new_off > note_size)
++                      break;
+               if (nhdr->n_type == BUILD_ID &&
+-                  nhdr->n_namesz == sizeof("GNU") &&
+-                  !strcmp((char *)(nhdr + 1), "GNU") &&
+-                  nhdr->n_descsz > 0 &&
+-                  nhdr->n_descsz <= BUILD_ID_SIZE_MAX) {
+-                      memcpy(build_id,
+-                             note_start + note_offs +
+-                             ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr),
+-                             nhdr->n_descsz);
+-                      memset(build_id + nhdr->n_descsz, 0,
+-                             BUILD_ID_SIZE_MAX - nhdr->n_descsz);
++                  name_sz == note_name_sz &&
++                  memcmp(nhdr + 1, note_name, note_name_sz) == 0 &&
++                  desc_sz > 0 && desc_sz <= BUILD_ID_SIZE_MAX) {
++                      data = note_start + note_off + ALIGN(note_name_sz, 4);
++                      memcpy(build_id, data, desc_sz);
++                      memset(build_id + desc_sz, 0, BUILD_ID_SIZE_MAX - desc_sz);
+                       if (size)
+-                              *size = nhdr->n_descsz;
++                              *size = desc_sz;
+                       return 0;
+               }
+-              new_offs = note_offs + sizeof(Elf32_Nhdr) +
+-                      ALIGN(nhdr->n_namesz, 4) + ALIGN(nhdr->n_descsz, 4);
+-              if (new_offs <= note_offs)  /* overflow */
+-                      break;
+-              note_offs = new_offs;
++
++              note_off = new_off;
+       }
+       return -EINVAL;
+@@ -71,7 +77,7 @@ static int get_build_id_32(const void *page_addr, unsigned char *build_id,
+ {
+       Elf32_Ehdr *ehdr = (Elf32_Ehdr *)page_addr;
+       Elf32_Phdr *phdr;
+-      int i;
++      __u32 i, phnum;
+       /*
+        * FIXME
+@@ -80,18 +86,19 @@ static int get_build_id_32(const void *page_addr, unsigned char *build_id,
+        */
+       if (ehdr->e_phoff != sizeof(Elf32_Ehdr))
+               return -EINVAL;
++
++      phnum = READ_ONCE(ehdr->e_phnum);
+       /* only supports phdr that fits in one page */
+-      if (ehdr->e_phnum >
+-          (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr))
++      if (phnum > (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr))
+               return -EINVAL;
+       phdr = (Elf32_Phdr *)(page_addr + sizeof(Elf32_Ehdr));
+-      for (i = 0; i < ehdr->e_phnum; ++i) {
++      for (i = 0; i < phnum; ++i) {
+               if (phdr[i].p_type == PT_NOTE &&
+                   !parse_build_id(page_addr, build_id, size,
+-                                  page_addr + phdr[i].p_offset,
+-                                  phdr[i].p_filesz))
++                                  page_addr + READ_ONCE(phdr[i].p_offset),
++                                  READ_ONCE(phdr[i].p_filesz)))
+                       return 0;
+       }
+       return -EINVAL;
+@@ -103,7 +110,7 @@ static int get_build_id_64(const void *page_addr, unsigned char *build_id,
+ {
+       Elf64_Ehdr *ehdr = (Elf64_Ehdr *)page_addr;
+       Elf64_Phdr *phdr;
+-      int i;
++      __u32 i, phnum;
+       /*
+        * FIXME
+@@ -112,18 +119,19 @@ static int get_build_id_64(const void *page_addr, unsigned char *build_id,
+        */
+       if (ehdr->e_phoff != sizeof(Elf64_Ehdr))
+               return -EINVAL;
++
++      phnum = READ_ONCE(ehdr->e_phnum);
+       /* only supports phdr that fits in one page */
+-      if (ehdr->e_phnum >
+-          (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr))
++      if (phnum > (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr))
+               return -EINVAL;
+       phdr = (Elf64_Phdr *)(page_addr + sizeof(Elf64_Ehdr));
+-      for (i = 0; i < ehdr->e_phnum; ++i) {
++      for (i = 0; i < phnum; ++i) {
+               if (phdr[i].p_type == PT_NOTE &&
+                   !parse_build_id(page_addr, build_id, size,
+-                                  page_addr + phdr[i].p_offset,
+-                                  phdr[i].p_filesz))
++                                  page_addr + READ_ONCE(phdr[i].p_offset),
++                                  READ_ONCE(phdr[i].p_filesz)))
+                       return 0;
+       }
+       return -EINVAL;
+@@ -152,6 +160,10 @@ int build_id_parse(struct vm_area_struct *vma, unsigned char *build_id,
+       page = find_get_page(vma->vm_file->f_mapping, 0);
+       if (!page)
+               return -EFAULT; /* page not mapped */
++      if (!PageUptodate(page)) {
++              put_page(page);
++              return -EFAULT;
++      }
+       ret = -EINVAL;
+       page_addr = kmap_atomic(page);
+-- 
+2.43.0
+
diff --git a/queue-6.6/media-i2c-imx335-enable-regulator-supplies.patch b/queue-6.6/media-i2c-imx335-enable-regulator-supplies.patch
new file mode 100644 (file)
index 0000000..14e562a
--- /dev/null
@@ -0,0 +1,122 @@
+From d7c20dae9f77c5eabca99ec8dabef42c03c47498 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 18:29:46 +0530
+Subject: media: i2c: imx335: Enable regulator supplies
+
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+[ Upstream commit fea91ee73b7cd19f08017221923d789f984abc54 ]
+
+Provide support for enabling and disabling regulator supplies to control
+power to the camera sensor.
+
+While updating the power on function, document that a sleep is
+represented as 'T4' in the datasheet power on sequence.
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Stable-dep-of: 99d30e2fdea4 ("media: imx335: Fix reset-gpio handling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx335.c | 36 ++++++++++++++++++++++++++++++++++--
+ 1 file changed, 34 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/imx335.c b/drivers/media/i2c/imx335.c
+index 26869abd77a67..771f13b524baf 100644
+--- a/drivers/media/i2c/imx335.c
++++ b/drivers/media/i2c/imx335.c
+@@ -75,6 +75,12 @@ struct imx335_reg_list {
+       const struct imx335_reg *regs;
+ };
++static const char * const imx335_supply_name[] = {
++      "avdd", /* Analog (2.9V) supply */
++      "ovdd", /* Digital I/O (1.8V) supply */
++      "dvdd", /* Digital Core (1.2V) supply */
++};
++
+ /**
+  * struct imx335_mode - imx335 sensor mode structure
+  * @width: Frame width
+@@ -108,6 +114,7 @@ struct imx335_mode {
+  * @sd: V4L2 sub-device
+  * @pad: Media pad. Only one pad supported
+  * @reset_gpio: Sensor reset gpio
++ * @supplies: Regulator supplies to handle power control
+  * @inclk: Sensor input clock
+  * @ctrl_handler: V4L2 control handler
+  * @link_freq_ctrl: Pointer to link frequency control
+@@ -127,6 +134,8 @@ struct imx335 {
+       struct v4l2_subdev sd;
+       struct media_pad pad;
+       struct gpio_desc *reset_gpio;
++      struct regulator_bulk_data supplies[ARRAY_SIZE(imx335_supply_name)];
++
+       struct clk *inclk;
+       struct v4l2_ctrl_handler ctrl_handler;
+       struct v4l2_ctrl *link_freq_ctrl;
+@@ -790,6 +799,17 @@ static int imx335_parse_hw_config(struct imx335 *imx335)
+               return PTR_ERR(imx335->reset_gpio);
+       }
++      for (i = 0; i < ARRAY_SIZE(imx335_supply_name); i++)
++              imx335->supplies[i].supply = imx335_supply_name[i];
++
++      ret = devm_regulator_bulk_get(imx335->dev,
++                                    ARRAY_SIZE(imx335_supply_name),
++                                    imx335->supplies);
++      if (ret) {
++              dev_err(imx335->dev, "Failed to get regulators\n");
++              return ret;
++      }
++
+       /* Get sensor input clock */
+       imx335->inclk = devm_clk_get(imx335->dev, NULL);
+       if (IS_ERR(imx335->inclk)) {
+@@ -868,6 +888,17 @@ static int imx335_power_on(struct device *dev)
+       struct imx335 *imx335 = to_imx335(sd);
+       int ret;
++      ret = regulator_bulk_enable(ARRAY_SIZE(imx335_supply_name),
++                                  imx335->supplies);
++      if (ret) {
++              dev_err(dev, "%s: failed to enable regulators\n",
++                      __func__);
++              return ret;
++      }
++
++      usleep_range(500, 550); /* Tlow */
++
++      /* Set XCLR */
+       gpiod_set_value_cansleep(imx335->reset_gpio, 1);
+       ret = clk_prepare_enable(imx335->inclk);
+@@ -876,12 +907,13 @@ static int imx335_power_on(struct device *dev)
+               goto error_reset;
+       }
+-      usleep_range(20, 22);
++      usleep_range(20, 22); /* T4 */
+       return 0;
+ error_reset:
+       gpiod_set_value_cansleep(imx335->reset_gpio, 0);
++      regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies);
+       return ret;
+ }
+@@ -898,8 +930,8 @@ static int imx335_power_off(struct device *dev)
+       struct imx335 *imx335 = to_imx335(sd);
+       gpiod_set_value_cansleep(imx335->reset_gpio, 0);
+-
+       clk_disable_unprepare(imx335->inclk);
++      regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies);
+       return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/media-imx335-fix-reset-gpio-handling.patch b/queue-6.6/media-imx335-fix-reset-gpio-handling.patch
new file mode 100644 (file)
index 0000000..c85d0d5
--- /dev/null
@@ -0,0 +1,79 @@
+From 9e988135d9903a31a781ebbad70549fbf87b4b77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2024 11:41:52 +0530
+Subject: media: imx335: Fix reset-gpio handling
+
+From: Umang Jain <umang.jain@ideasonboard.com>
+
+[ Upstream commit 99d30e2fdea4086be4e66e2deb10de854b547ab8 ]
+
+Rectify the logical value of reset-gpio so that it is set to
+0 (disabled) during power-on and to 1 (enabled) during power-off.
+
+Set the reset-gpio to GPIO_OUT_HIGH at initialization time to make
+sure it starts off in reset. Also drop the "Set XCLR" comment which
+is not-so-informative.
+
+The existing usage of imx335 had reset-gpios polarity inverted
+(GPIO_ACTIVE_HIGH) in their device-tree sources. With this patch
+included, those DTS will not be able to stream imx335 anymore. The
+reset-gpio polarity will need to be rectified in the device-tree
+sources as shown in [1] example, in order to get imx335 functional
+again (as it remains in reset prior to this fix).
+
+Cc: stable@vger.kernel.org
+Fixes: 45d19b5fb9ae ("media: i2c: Add imx335 camera sensor driver")
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://lore.kernel.org/linux-media/20240729110437.199428-1-umang.jain@ideasonboard.com/
+Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx335.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/i2c/imx335.c b/drivers/media/i2c/imx335.c
+index 771f13b524baf..cb3f4fc66a174 100644
+--- a/drivers/media/i2c/imx335.c
++++ b/drivers/media/i2c/imx335.c
+@@ -792,7 +792,7 @@ static int imx335_parse_hw_config(struct imx335 *imx335)
+       /* Request optional reset pin */
+       imx335->reset_gpio = devm_gpiod_get_optional(imx335->dev, "reset",
+-                                                   GPIOD_OUT_LOW);
++                                                   GPIOD_OUT_HIGH);
+       if (IS_ERR(imx335->reset_gpio)) {
+               dev_err(imx335->dev, "failed to get reset gpio %ld",
+                       PTR_ERR(imx335->reset_gpio));
+@@ -898,8 +898,7 @@ static int imx335_power_on(struct device *dev)
+       usleep_range(500, 550); /* Tlow */
+-      /* Set XCLR */
+-      gpiod_set_value_cansleep(imx335->reset_gpio, 1);
++      gpiod_set_value_cansleep(imx335->reset_gpio, 0);
+       ret = clk_prepare_enable(imx335->inclk);
+       if (ret) {
+@@ -912,7 +911,7 @@ static int imx335_power_on(struct device *dev)
+       return 0;
+ error_reset:
+-      gpiod_set_value_cansleep(imx335->reset_gpio, 0);
++      gpiod_set_value_cansleep(imx335->reset_gpio, 1);
+       regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies);
+       return ret;
+@@ -929,7 +928,7 @@ static int imx335_power_off(struct device *dev)
+       struct v4l2_subdev *sd = dev_get_drvdata(dev);
+       struct imx335 *imx335 = to_imx335(sd);
+-      gpiod_set_value_cansleep(imx335->reset_gpio, 0);
++      gpiod_set_value_cansleep(imx335->reset_gpio, 1);
+       clk_disable_unprepare(imx335->inclk);
+       regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies);
+-- 
+2.43.0
+
diff --git a/queue-6.6/mm-z3fold-deprecate-config_z3fold.patch b/queue-6.6/mm-z3fold-deprecate-config_z3fold.patch
new file mode 100644 (file)
index 0000000..5ab6721
--- /dev/null
@@ -0,0 +1,163 @@
+From 28bbb2e3f6fbb1c8679803834e8646c7a5369e7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 19:25:12 +0000
+Subject: mm: z3fold: deprecate CONFIG_Z3FOLD
+
+From: Yosry Ahmed <yosryahmed@google.com>
+
+The z3fold compressed pages allocator is rarely used, most users use
+zsmalloc.  The only disadvantage of zsmalloc in comparison is the
+dependency on MMU, and zbud is a more common option for !MMU as it was the
+default zswap allocator for a long time.
+
+Historically, zsmalloc had worse latency than zbud and z3fold but offered
+better memory savings.  This is no longer the case as shown by a simple
+recent analysis [1].  That analysis showed that z3fold does not have any
+advantage over zsmalloc or zbud considering both performance and memory
+usage.  In a kernel build test on tmpfs in a limited cgroup, z3fold took
+3% more time and used 1.8% more memory.  The latency of zswap_load() was
+7% higher, and that of zswap_store() was 10% higher.  Zsmalloc is better
+in all metrics.
+
+Moreover, z3fold apparently has latent bugs, which was made noticeable by
+a recent soft lockup bug report with z3fold [2].  Switching to zsmalloc
+not only fixed the problem, but also reduced the swap usage from 6~8G to
+1~2G.  Other users have also reported being bitten by mistakenly enabling
+z3fold.
+
+Other than hurting users, z3fold is repeatedly causing wasted engineering
+effort.  Apart from investigating the above bug, it came up in multiple
+development discussions (e.g.  [3]) as something we need to handle, when
+there aren't any legit users (at least not intentionally).
+
+The natural course of action is to deprecate z3fold, and remove in a few
+cycles if no objections are raised from active users.  Next on the list
+should be zbud, as it offers marginal latency gains at the cost of huge
+memory waste when compared to zsmalloc.  That one will need to wait until
+zsmalloc does not depend on MMU.
+
+Rename the user-visible config option from CONFIG_Z3FOLD to
+CONFIG_Z3FOLD_DEPRECATED so that users with CONFIG_Z3FOLD=y get a new
+prompt with explanation during make oldconfig.  Also, remove
+CONFIG_Z3FOLD=y from defconfigs.
+
+[1]https://lore.kernel.org/lkml/CAJD7tkbRF6od-2x_L8-A1QL3=2Ww13sCj4S3i4bNndqF+3+_Vg@mail.gmail.com/
+[2]https://lore.kernel.org/lkml/EF0ABD3E-A239-4111-A8AB-5C442E759CF3@gmail.com/
+[3]https://lore.kernel.org/lkml/CAJD7tkbnmeVugfunffSovJf9FAgy9rhBVt_tx=nxUveLUfqVsA@mail.gmail.com/
+
+[arnd@arndb.de: deprecate ZSWAP_ZPOOL_DEFAULT_Z3FOLD as well]
+  Link: https://lkml.kernel.org/r/20240909202625.1054880-1-arnd@kernel.org
+Link: https://lkml.kernel.org/r/20240904233343.933462-1-yosryahmed@google.com
+Signed-off-by: Yosry Ahmed <yosryahmed@google.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Chris Down <chris@chrisdown.name>
+Acked-by: Nhat Pham <nphamcs@gmail.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Vitaly Wool <vitaly.wool@konsulko.com>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Huacai Chen <chenhuacai@kernel.org>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Naveen N. Rao <naveen.n.rao@linux.ibm.com>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: WANG Xuerui <kernel@xen0n.name>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+(cherry picked from commit 7a2369b74abf76cd3e54c45b30f6addb497f831b)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/configs/loongson3_defconfig |  1 -
+ arch/powerpc/configs/ppc64_defconfig       |  1 -
+ mm/Kconfig                                 | 25 ++++++++++++++++------
+ 3 files changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig
+index a3b52aaa83b33..e5f70642ed206 100644
+--- a/arch/loongarch/configs/loongson3_defconfig
++++ b/arch/loongarch/configs/loongson3_defconfig
+@@ -83,7 +83,6 @@ CONFIG_ZPOOL=y
+ CONFIG_ZSWAP=y
+ CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD=y
+ CONFIG_ZBUD=y
+-CONFIG_Z3FOLD=y
+ CONFIG_ZSMALLOC=m
+ # CONFIG_COMPAT_BRK is not set
+ CONFIG_MEMORY_HOTPLUG=y
+diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
+index 6e7b9e8fd2251..65e518dde2c2f 100644
+--- a/arch/powerpc/configs/ppc64_defconfig
++++ b/arch/powerpc/configs/ppc64_defconfig
+@@ -81,7 +81,6 @@ CONFIG_MODULE_SIG_SHA512=y
+ CONFIG_PARTITION_ADVANCED=y
+ CONFIG_BINFMT_MISC=m
+ CONFIG_ZSWAP=y
+-CONFIG_Z3FOLD=y
+ CONFIG_ZSMALLOC=y
+ # CONFIG_SLAB_MERGE_DEFAULT is not set
+ CONFIG_SLAB_FREELIST_RANDOM=y
+diff --git a/mm/Kconfig b/mm/Kconfig
+index ece4f2847e2b4..c11cd01169e8d 100644
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -147,12 +147,15 @@ config ZSWAP_ZPOOL_DEFAULT_ZBUD
+       help
+         Use the zbud allocator as the default allocator.
+-config ZSWAP_ZPOOL_DEFAULT_Z3FOLD
+-      bool "z3fold"
+-      select Z3FOLD
++config ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED
++      bool "z3foldi (DEPRECATED)"
++      select Z3FOLD_DEPRECATED
+       help
+         Use the z3fold allocator as the default allocator.
++        Deprecated and scheduled for removal in a few cycles,
++        see CONFIG_Z3FOLD_DEPRECATED.
++
+ config ZSWAP_ZPOOL_DEFAULT_ZSMALLOC
+       bool "zsmalloc"
+       select ZSMALLOC
+@@ -164,7 +167,7 @@ config ZSWAP_ZPOOL_DEFAULT
+        string
+        depends on ZSWAP
+        default "zbud" if ZSWAP_ZPOOL_DEFAULT_ZBUD
+-       default "z3fold" if ZSWAP_ZPOOL_DEFAULT_Z3FOLD
++       default "z3fold" if ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED
+        default "zsmalloc" if ZSWAP_ZPOOL_DEFAULT_ZSMALLOC
+        default ""
+@@ -178,15 +181,25 @@ config ZBUD
+         deterministic reclaim properties that make it preferable to a higher
+         density approach when reclaim will be used.
+-config Z3FOLD
+-      tristate "3:1 compression allocator (z3fold)"
++config Z3FOLD_DEPRECATED
++      tristate "3:1 compression allocator (z3fold) (DEPRECATED)"
+       depends on ZSWAP
+       help
++        Deprecated and scheduled for removal in a few cycles. If you have
++        a good reason for using Z3FOLD over ZSMALLOC, please contact
++        linux-mm@kvack.org and the zswap maintainers.
++
+         A special purpose allocator for storing compressed pages.
+         It is designed to store up to three compressed pages per physical
+         page. It is a ZBUD derivative so the simplicity and determinism are
+         still there.
++config Z3FOLD
++      tristate
++      default y if Z3FOLD_DEPRECATED=y
++      default m if Z3FOLD_DEPRECATED=m
++      depends on Z3FOLD_DEPRECATED
++
+ config ZSMALLOC
+       tristate
+       prompt "N:1 compression allocator (zsmalloc)" if ZSWAP
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-mana-add-support-for-page-sizes-other-than-4kb-o.patch b/queue-6.6/net-mana-add-support-for-page-sizes-other-than-4kb-o.patch
new file mode 100644 (file)
index 0000000..5f2da81
--- /dev/null
@@ -0,0 +1,259 @@
+From 2464c87876ed0c7a9978ae776305f00dc823f868 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jun 2024 13:17:26 -0700
+Subject: net: mana: Add support for page sizes other than 4KB on ARM64
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+[ Upstream commit 382d1741b5b2feffef7942dd074206372afe1a96 ]
+
+As defined by the MANA Hardware spec, the queue size for DMA is 4KB
+minimal, and power of 2. And, the HWC queue size has to be exactly
+4KB.
+
+To support page sizes other than 4KB on ARM64, define the minimal
+queue size as a macro separately from the PAGE_SIZE, which we always
+assumed it to be 4KB before supporting ARM64.
+
+Also, add MANA specific macros and update code related to size
+alignment, DMA region calculations, etc.
+
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Link: https://lore.kernel.org/r/1718655446-6576-1-git-send-email-haiyangz@microsoft.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 9e517a8e9d9a ("RDMA/mana_ib: use the correct page table index based on hardware page size")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microsoft/Kconfig            |  2 +-
+ drivers/net/ethernet/microsoft/mana/gdma_main.c   | 10 +++++-----
+ drivers/net/ethernet/microsoft/mana/hw_channel.c  | 14 +++++++-------
+ drivers/net/ethernet/microsoft/mana/mana_en.c     |  8 ++++----
+ drivers/net/ethernet/microsoft/mana/shm_channel.c | 13 +++++++------
+ include/net/mana/gdma.h                           | 10 +++++++++-
+ include/net/mana/mana.h                           |  3 ++-
+ 7 files changed, 35 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/net/ethernet/microsoft/Kconfig b/drivers/net/ethernet/microsoft/Kconfig
+index 286f0d5697a16..901fbffbf718e 100644
+--- a/drivers/net/ethernet/microsoft/Kconfig
++++ b/drivers/net/ethernet/microsoft/Kconfig
+@@ -18,7 +18,7 @@ if NET_VENDOR_MICROSOFT
+ config MICROSOFT_MANA
+       tristate "Microsoft Azure Network Adapter (MANA) support"
+       depends on PCI_MSI
+-      depends on X86_64 || (ARM64 && !CPU_BIG_ENDIAN && ARM64_4K_PAGES)
++      depends on X86_64 || (ARM64 && !CPU_BIG_ENDIAN)
+       depends on PCI_HYPERV
+       select AUXILIARY_BUS
+       select PAGE_POOL
+diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c
+index 6367de0c2c2e8..ae014e21eb605 100644
+--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c
++++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c
+@@ -179,7 +179,7 @@ int mana_gd_alloc_memory(struct gdma_context *gc, unsigned int length,
+       dma_addr_t dma_handle;
+       void *buf;
+-      if (length < PAGE_SIZE || !is_power_of_2(length))
++      if (length < MANA_PAGE_SIZE || !is_power_of_2(length))
+               return -EINVAL;
+       gmi->dev = gc->dev;
+@@ -720,7 +720,7 @@ EXPORT_SYMBOL_NS(mana_gd_destroy_dma_region, NET_MANA);
+ static int mana_gd_create_dma_region(struct gdma_dev *gd,
+                                    struct gdma_mem_info *gmi)
+ {
+-      unsigned int num_page = gmi->length / PAGE_SIZE;
++      unsigned int num_page = gmi->length / MANA_PAGE_SIZE;
+       struct gdma_create_dma_region_req *req = NULL;
+       struct gdma_create_dma_region_resp resp = {};
+       struct gdma_context *gc = gd->gdma_context;
+@@ -730,10 +730,10 @@ static int mana_gd_create_dma_region(struct gdma_dev *gd,
+       int err;
+       int i;
+-      if (length < PAGE_SIZE || !is_power_of_2(length))
++      if (length < MANA_PAGE_SIZE || !is_power_of_2(length))
+               return -EINVAL;
+-      if (offset_in_page(gmi->virt_addr) != 0)
++      if (!MANA_PAGE_ALIGNED(gmi->virt_addr))
+               return -EINVAL;
+       hwc = gc->hwc.driver_data;
+@@ -754,7 +754,7 @@ static int mana_gd_create_dma_region(struct gdma_dev *gd,
+       req->page_addr_list_len = num_page;
+       for (i = 0; i < num_page; i++)
+-              req->page_addr_list[i] = gmi->dma_handle +  i * PAGE_SIZE;
++              req->page_addr_list[i] = gmi->dma_handle +  i * MANA_PAGE_SIZE;
+       err = mana_gd_send_request(gc, req_msg_size, req, sizeof(resp), &resp);
+       if (err)
+diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c
+index 236daa0535ba0..9d6426d4158e3 100644
+--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c
++++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c
+@@ -366,12 +366,12 @@ static int mana_hwc_create_cq(struct hw_channel_context *hwc, u16 q_depth,
+       int err;
+       eq_size = roundup_pow_of_two(GDMA_EQE_SIZE * q_depth);
+-      if (eq_size < MINIMUM_SUPPORTED_PAGE_SIZE)
+-              eq_size = MINIMUM_SUPPORTED_PAGE_SIZE;
++      if (eq_size < MANA_MIN_QSIZE)
++              eq_size = MANA_MIN_QSIZE;
+       cq_size = roundup_pow_of_two(GDMA_CQE_SIZE * q_depth);
+-      if (cq_size < MINIMUM_SUPPORTED_PAGE_SIZE)
+-              cq_size = MINIMUM_SUPPORTED_PAGE_SIZE;
++      if (cq_size < MANA_MIN_QSIZE)
++              cq_size = MANA_MIN_QSIZE;
+       hwc_cq = kzalloc(sizeof(*hwc_cq), GFP_KERNEL);
+       if (!hwc_cq)
+@@ -433,7 +433,7 @@ static int mana_hwc_alloc_dma_buf(struct hw_channel_context *hwc, u16 q_depth,
+       dma_buf->num_reqs = q_depth;
+-      buf_size = PAGE_ALIGN(q_depth * max_msg_size);
++      buf_size = MANA_PAGE_ALIGN(q_depth * max_msg_size);
+       gmi = &dma_buf->mem_info;
+       err = mana_gd_alloc_memory(gc, buf_size, gmi);
+@@ -501,8 +501,8 @@ static int mana_hwc_create_wq(struct hw_channel_context *hwc,
+       else
+               queue_size = roundup_pow_of_two(GDMA_MAX_SQE_SIZE * q_depth);
+-      if (queue_size < MINIMUM_SUPPORTED_PAGE_SIZE)
+-              queue_size = MINIMUM_SUPPORTED_PAGE_SIZE;
++      if (queue_size < MANA_MIN_QSIZE)
++              queue_size = MANA_MIN_QSIZE;
+       hwc_wq = kzalloc(sizeof(*hwc_wq), GFP_KERNEL);
+       if (!hwc_wq)
+diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
+index d8cce3771af21..89852bbc877c1 100644
+--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
+@@ -1902,10 +1902,10 @@ static int mana_create_txq(struct mana_port_context *apc,
+        *  to prevent overflow.
+        */
+       txq_size = MAX_SEND_BUFFERS_PER_QUEUE * 32;
+-      BUILD_BUG_ON(!PAGE_ALIGNED(txq_size));
++      BUILD_BUG_ON(!MANA_PAGE_ALIGNED(txq_size));
+       cq_size = MAX_SEND_BUFFERS_PER_QUEUE * COMP_ENTRY_SIZE;
+-      cq_size = PAGE_ALIGN(cq_size);
++      cq_size = MANA_PAGE_ALIGN(cq_size);
+       gc = gd->gdma_context;
+@@ -2203,8 +2203,8 @@ static struct mana_rxq *mana_create_rxq(struct mana_port_context *apc,
+       if (err)
+               goto out;
+-      rq_size = PAGE_ALIGN(rq_size);
+-      cq_size = PAGE_ALIGN(cq_size);
++      rq_size = MANA_PAGE_ALIGN(rq_size);
++      cq_size = MANA_PAGE_ALIGN(cq_size);
+       /* Create RQ */
+       memset(&spec, 0, sizeof(spec));
+diff --git a/drivers/net/ethernet/microsoft/mana/shm_channel.c b/drivers/net/ethernet/microsoft/mana/shm_channel.c
+index 5553af9c8085a..0f1679ebad96b 100644
+--- a/drivers/net/ethernet/microsoft/mana/shm_channel.c
++++ b/drivers/net/ethernet/microsoft/mana/shm_channel.c
+@@ -6,6 +6,7 @@
+ #include <linux/io.h>
+ #include <linux/mm.h>
++#include <net/mana/gdma.h>
+ #include <net/mana/shm_channel.h>
+ #define PAGE_FRAME_L48_WIDTH_BYTES 6
+@@ -155,8 +156,8 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr,
+               return err;
+       }
+-      if (!PAGE_ALIGNED(eq_addr) || !PAGE_ALIGNED(cq_addr) ||
+-          !PAGE_ALIGNED(rq_addr) || !PAGE_ALIGNED(sq_addr))
++      if (!MANA_PAGE_ALIGNED(eq_addr) || !MANA_PAGE_ALIGNED(cq_addr) ||
++          !MANA_PAGE_ALIGNED(rq_addr) || !MANA_PAGE_ALIGNED(sq_addr))
+               return -EINVAL;
+       if ((eq_msix_index & VECTOR_MASK) != eq_msix_index)
+@@ -183,7 +184,7 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr,
+       /* EQ addr: low 48 bits of frame address */
+       shmem = (u64 *)ptr;
+-      frame_addr = PHYS_PFN(eq_addr);
++      frame_addr = MANA_PFN(eq_addr);
+       *shmem = frame_addr & PAGE_FRAME_L48_MASK;
+       all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) <<
+               (frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS);
+@@ -191,7 +192,7 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr,
+       /* CQ addr: low 48 bits of frame address */
+       shmem = (u64 *)ptr;
+-      frame_addr = PHYS_PFN(cq_addr);
++      frame_addr = MANA_PFN(cq_addr);
+       *shmem = frame_addr & PAGE_FRAME_L48_MASK;
+       all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) <<
+               (frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS);
+@@ -199,7 +200,7 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr,
+       /* RQ addr: low 48 bits of frame address */
+       shmem = (u64 *)ptr;
+-      frame_addr = PHYS_PFN(rq_addr);
++      frame_addr = MANA_PFN(rq_addr);
+       *shmem = frame_addr & PAGE_FRAME_L48_MASK;
+       all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) <<
+               (frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS);
+@@ -207,7 +208,7 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr,
+       /* SQ addr: low 48 bits of frame address */
+       shmem = (u64 *)ptr;
+-      frame_addr = PHYS_PFN(sq_addr);
++      frame_addr = MANA_PFN(sq_addr);
+       *shmem = frame_addr & PAGE_FRAME_L48_MASK;
+       all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) <<
+               (frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS);
+diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h
+index 88b6ef7ce1a6e..3965343fdee0c 100644
+--- a/include/net/mana/gdma.h
++++ b/include/net/mana/gdma.h
+@@ -222,7 +222,15 @@ struct gdma_dev {
+       struct auxiliary_device *adev;
+ };
+-#define MINIMUM_SUPPORTED_PAGE_SIZE PAGE_SIZE
++/* MANA_PAGE_SIZE is the DMA unit */
++#define MANA_PAGE_SHIFT 12
++#define MANA_PAGE_SIZE BIT(MANA_PAGE_SHIFT)
++#define MANA_PAGE_ALIGN(x) ALIGN((x), MANA_PAGE_SIZE)
++#define MANA_PAGE_ALIGNED(addr) IS_ALIGNED((unsigned long)(addr), MANA_PAGE_SIZE)
++#define MANA_PFN(a) ((a) >> MANA_PAGE_SHIFT)
++
++/* Required by HW */
++#define MANA_MIN_QSIZE MANA_PAGE_SIZE
+ #define GDMA_CQE_SIZE 64
+ #define GDMA_EQE_SIZE 16
+diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h
+index 28e110f733ffd..7892b79854f62 100644
+--- a/include/net/mana/mana.h
++++ b/include/net/mana/mana.h
+@@ -42,7 +42,8 @@ enum TRI_STATE {
+ #define MAX_SEND_BUFFERS_PER_QUEUE 256
+-#define EQ_SIZE (8 * PAGE_SIZE)
++#define EQ_SIZE (8 * MANA_PAGE_SIZE)
++
+ #define LOG2_EQ_THROTTLE 3
+ #define MAX_PORTS_IN_MANA_DEV 256
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-mana-enable-mana-driver-on-arm64-with-4k-page-si.patch b/queue-6.6/net-mana-enable-mana-driver-on-arm64-with-4k-page-si.patch
new file mode 100644 (file)
index 0000000..31d380a
--- /dev/null
@@ -0,0 +1,39 @@
+From f6f355125170e3b913622aeb514bd5202f91eb99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 May 2024 13:29:01 -0700
+Subject: net: mana: Enable MANA driver on ARM64 with 4K page size
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+[ Upstream commit 40a1d11fc670ac03c5dc2e5a9724b330e74f38b0 ]
+
+Change the Kconfig dependency, so this driver can be built and run on ARM64
+with 4K page size.
+16/64K page sizes are not supported yet.
+
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Link: https://lore.kernel.org/r/1715632141-8089-1-git-send-email-haiyangz@microsoft.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 9e517a8e9d9a ("RDMA/mana_ib: use the correct page table index based on hardware page size")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microsoft/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/microsoft/Kconfig b/drivers/net/ethernet/microsoft/Kconfig
+index 01eb7445ead95..286f0d5697a16 100644
+--- a/drivers/net/ethernet/microsoft/Kconfig
++++ b/drivers/net/ethernet/microsoft/Kconfig
+@@ -17,7 +17,8 @@ if NET_VENDOR_MICROSOFT
+ config MICROSOFT_MANA
+       tristate "Microsoft Azure Network Adapter (MANA) support"
+-      depends on PCI_MSI && X86_64
++      depends on PCI_MSI
++      depends on X86_64 || (ARM64 && !CPU_BIG_ENDIAN && ARM64_4K_PAGES)
+       depends on PCI_HYPERV
+       select AUXILIARY_BUS
+       select PAGE_POOL
+-- 
+2.43.0
+
diff --git a/queue-6.6/platform-x86-x86-android-tablets-create-a-platform_d.patch b/queue-6.6/platform-x86-x86-android-tablets-create-a-platform_d.patch
new file mode 100644 (file)
index 0000000..e100aff
--- /dev/null
@@ -0,0 +1,189 @@
+From 825a577f1cd2fb4ed109c396a3015f1c139a73f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Sep 2023 16:18:13 +0200
+Subject: platform/x86: x86-android-tablets: Create a platform_device from
+ module_init()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 8b57d33a6fdbb53d03da762b31e65a1027f74caf ]
+
+Create a platform_device from module_init() and change
+x86_android_tablet_init() / cleanup() into platform_device
+probe() and remove() functions.
+
+This is a preparation patch for refactoring x86_android_tablet_get_gpiod()
+to no longer use gpiolib private functions like gpiochip_find().
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20230909141816.58358-6-hdegoede@redhat.com
+Stable-dep-of: 2fae3129c0c0 ("platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/x86/x86-android-tablets/core.c   | 51 ++++++++++++++-----
+ 1 file changed, 38 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c
+index 2fd6060a31bb0..ebfd9a3dac957 100644
+--- a/drivers/platform/x86/x86-android-tablets/core.c
++++ b/drivers/platform/x86/x86-android-tablets/core.c
+@@ -25,6 +25,8 @@
+ #include "../../../gpio/gpiolib.h"
+ #include "../../../gpio/gpiolib-acpi.h"
++static struct platform_device *x86_android_tablet_device;
++
+ static int gpiochip_find_match_label(struct gpio_chip *gc, void *data)
+ {
+       return gc->label && !strcmp(gc->label, data);
+@@ -224,7 +226,7 @@ static __init int x86_instantiate_serdev(const struct x86_serdev_info *info, int
+       return ret;
+ }
+-static void x86_android_tablet_cleanup(void)
++static void x86_android_tablet_remove(struct platform_device *pdev)
+ {
+       int i;
+@@ -255,7 +257,7 @@ static void x86_android_tablet_cleanup(void)
+       software_node_unregister(bat_swnode);
+ }
+-static __init int x86_android_tablet_init(void)
++static __init int x86_android_tablet_probe(struct platform_device *pdev)
+ {
+       const struct x86_dev_info *dev_info;
+       const struct dmi_system_id *id;
+@@ -267,6 +269,8 @@ static __init int x86_android_tablet_init(void)
+               return -ENODEV;
+       dev_info = id->driver_data;
++      /* Allow x86_android_tablet_device use before probe() exits */
++      x86_android_tablet_device = pdev;
+       /*
+        * The broken DSDTs on these devices often also include broken
+@@ -303,7 +307,7 @@ static __init int x86_android_tablet_init(void)
+       if (dev_info->init) {
+               ret = dev_info->init();
+               if (ret < 0) {
+-                      x86_android_tablet_cleanup();
++                      x86_android_tablet_remove(pdev);
+                       return ret;
+               }
+               exit_handler = dev_info->exit;
+@@ -311,7 +315,7 @@ static __init int x86_android_tablet_init(void)
+       i2c_clients = kcalloc(dev_info->i2c_client_count, sizeof(*i2c_clients), GFP_KERNEL);
+       if (!i2c_clients) {
+-              x86_android_tablet_cleanup();
++              x86_android_tablet_remove(pdev);
+               return -ENOMEM;
+       }
+@@ -319,7 +323,7 @@ static __init int x86_android_tablet_init(void)
+       for (i = 0; i < i2c_client_count; i++) {
+               ret = x86_instantiate_i2c_client(dev_info, i);
+               if (ret < 0) {
+-                      x86_android_tablet_cleanup();
++                      x86_android_tablet_remove(pdev);
+                       return ret;
+               }
+       }
+@@ -327,7 +331,7 @@ static __init int x86_android_tablet_init(void)
+       /* + 1 to make space for (optional) gpio_keys_button pdev */
+       pdevs = kcalloc(dev_info->pdev_count + 1, sizeof(*pdevs), GFP_KERNEL);
+       if (!pdevs) {
+-              x86_android_tablet_cleanup();
++              x86_android_tablet_remove(pdev);
+               return -ENOMEM;
+       }
+@@ -335,14 +339,14 @@ static __init int x86_android_tablet_init(void)
+       for (i = 0; i < pdev_count; i++) {
+               pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]);
+               if (IS_ERR(pdevs[i])) {
+-                      x86_android_tablet_cleanup();
++                      x86_android_tablet_remove(pdev);
+                       return PTR_ERR(pdevs[i]);
+               }
+       }
+       serdevs = kcalloc(dev_info->serdev_count, sizeof(*serdevs), GFP_KERNEL);
+       if (!serdevs) {
+-              x86_android_tablet_cleanup();
++              x86_android_tablet_remove(pdev);
+               return -ENOMEM;
+       }
+@@ -350,7 +354,7 @@ static __init int x86_android_tablet_init(void)
+       for (i = 0; i < serdev_count; i++) {
+               ret = x86_instantiate_serdev(&dev_info->serdev_info[i], i);
+               if (ret < 0) {
+-                      x86_android_tablet_cleanup();
++                      x86_android_tablet_remove(pdev);
+                       return ret;
+               }
+       }
+@@ -361,7 +365,7 @@ static __init int x86_android_tablet_init(void)
+               buttons = kcalloc(dev_info->gpio_button_count, sizeof(*buttons), GFP_KERNEL);
+               if (!buttons) {
+-                      x86_android_tablet_cleanup();
++                      x86_android_tablet_remove(pdev);
+                       return -ENOMEM;
+               }
+@@ -369,7 +373,7 @@ static __init int x86_android_tablet_init(void)
+                       ret = x86_android_tablet_get_gpiod(dev_info->gpio_button[i].chip,
+                                                          dev_info->gpio_button[i].pin, &gpiod);
+                       if (ret < 0) {
+-                              x86_android_tablet_cleanup();
++                              x86_android_tablet_remove(pdev);
+                               return ret;
+                       }
+@@ -384,7 +388,7 @@ static __init int x86_android_tablet_init(void)
+                                                                 PLATFORM_DEVID_AUTO,
+                                                                 &pdata, sizeof(pdata));
+               if (IS_ERR(pdevs[pdev_count])) {
+-                      x86_android_tablet_cleanup();
++                      x86_android_tablet_remove(pdev);
+                       return PTR_ERR(pdevs[pdev_count]);
+               }
+               pdev_count++;
+@@ -393,8 +397,29 @@ static __init int x86_android_tablet_init(void)
+       return 0;
+ }
++static struct platform_driver x86_android_tablet_driver = {
++      .driver = {
++              .name = KBUILD_MODNAME,
++      },
++      .remove_new = x86_android_tablet_remove,
++};
++
++static int __init x86_android_tablet_init(void)
++{
++      x86_android_tablet_device = platform_create_bundle(&x86_android_tablet_driver,
++                                                 x86_android_tablet_probe,
++                                                 NULL, 0, NULL, 0);
++
++      return PTR_ERR_OR_ZERO(x86_android_tablet_device);
++}
+ module_init(x86_android_tablet_init);
+-module_exit(x86_android_tablet_cleanup);
++
++static void __exit x86_android_tablet_exit(void)
++{
++      platform_device_unregister(x86_android_tablet_device);
++      platform_driver_unregister(&x86_android_tablet_driver);
++}
++module_exit(x86_android_tablet_exit);
+ MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
+ MODULE_DESCRIPTION("X86 Android tablets DSDT fixups driver");
+-- 
+2.43.0
+
diff --git a/queue-6.6/platform-x86-x86-android-tablets-fix-use-after-free-.patch b/queue-6.6/platform-x86-x86-android-tablets-fix-use-after-free-.patch
new file mode 100644 (file)
index 0000000..f5b8488
--- /dev/null
@@ -0,0 +1,58 @@
+From 43f954625e8f70e0b77928d363f85ee86b5be406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Oct 2024 15:05:45 +0200
+Subject: platform/x86: x86-android-tablets: Fix use after free on
+ platform_device_register() errors
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 2fae3129c0c08e72b1fe93e61fd8fd203252094a ]
+
+x86_android_tablet_remove() frees the pdevs[] array, so it should not
+be used after calling x86_android_tablet_remove().
+
+When platform_device_register() fails, store the pdevs[x] PTR_ERR() value
+into the local ret variable before calling x86_android_tablet_remove()
+to avoid using pdevs[] after it has been freed.
+
+Fixes: 5eba0141206e ("platform/x86: x86-android-tablets: Add support for instantiating platform-devs")
+Fixes: e2200d3f26da ("platform/x86: x86-android-tablets: Add gpio_keys support to x86_android_tablet_init()")
+Cc: stable@vger.kernel.org
+Reported-by: Aleksandr Burakov <a.burakov@rosalinux.ru>
+Closes: https://lore.kernel.org/platform-driver-x86/20240917120458.7300-1-a.burakov@rosalinux.ru/
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20241005130545.64136-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/x86-android-tablets/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c
+index ebfd9a3dac957..a0fa0b6859c9c 100644
+--- a/drivers/platform/x86/x86-android-tablets/core.c
++++ b/drivers/platform/x86/x86-android-tablets/core.c
+@@ -339,8 +339,9 @@ static __init int x86_android_tablet_probe(struct platform_device *pdev)
+       for (i = 0; i < pdev_count; i++) {
+               pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]);
+               if (IS_ERR(pdevs[i])) {
++                      ret = PTR_ERR(pdevs[i]);
+                       x86_android_tablet_remove(pdev);
+-                      return PTR_ERR(pdevs[i]);
++                      return ret;
+               }
+       }
+@@ -388,8 +389,9 @@ static __init int x86_android_tablet_probe(struct platform_device *pdev)
+                                                                 PLATFORM_DEVID_AUTO,
+                                                                 &pdata, sizeof(pdata));
+               if (IS_ERR(pdevs[pdev_count])) {
++                      ret = PTR_ERR(pdevs[pdev_count]);
+                       x86_android_tablet_remove(pdev);
+-                      return PTR_ERR(pdevs[pdev_count]);
++                      return ret;
+               }
+               pdev_count++;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.6/r8169-add-tally-counter-fields-added-with-rtl8125.patch b/queue-6.6/r8169-add-tally-counter-fields-added-with-rtl8125.patch
new file mode 100644 (file)
index 0000000..7858bc7
--- /dev/null
@@ -0,0 +1,66 @@
+From 684b9f7be346ee40a627d3b957b07c29a3fabc74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Sep 2024 23:04:46 +0200
+Subject: r8169: add tally counter fields added with RTL8125
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a ]
+
+RTL8125 added fields to the tally counter, what may result in the chip
+dma'ing these new fields to unallocated memory. Therefore make sure
+that the allocated memory area is big enough to hold all of the
+tally counter values, even if we use only parts of it.
+
+Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125")
+Cc: stable@vger.kernel.org
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/741d26a9-2b2b-485d-91d9-ecb302e345b5@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 382ba8b04cbfa..b499d8ea6d216 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -567,6 +567,33 @@ struct rtl8169_counters {
+       __le32  rx_multicast;
+       __le16  tx_aborted;
+       __le16  tx_underrun;
++      /* new since RTL8125 */
++      __le64 tx_octets;
++      __le64 rx_octets;
++      __le64 rx_multicast64;
++      __le64 tx_unicast64;
++      __le64 tx_broadcast64;
++      __le64 tx_multicast64;
++      __le32 tx_pause_on;
++      __le32 tx_pause_off;
++      __le32 tx_pause_all;
++      __le32 tx_deferred;
++      __le32 tx_late_collision;
++      __le32 tx_all_collision;
++      __le32 tx_aborted32;
++      __le32 align_errors32;
++      __le32 rx_frame_too_long;
++      __le32 rx_runt;
++      __le32 rx_pause_on;
++      __le32 rx_pause_off;
++      __le32 rx_pause_all;
++      __le32 rx_unknown_opcode;
++      __le32 rx_mac_error;
++      __le32 tx_underrun32;
++      __le32 rx_mac_missed;
++      __le32 rx_tcam_dropped;
++      __le32 tdu;
++      __le32 rdu;
+ };
+ struct rtl8169_tc_offsets {
+-- 
+2.43.0
+
diff --git a/queue-6.6/r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch b/queue-6.6/r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch
new file mode 100644 (file)
index 0000000..033c158
--- /dev/null
@@ -0,0 +1,48 @@
+From 4d8f89ef94b242465c79b909f07bc2ad9b1f8ecb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 15:00:21 +0100
+Subject: r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 8df9439389a44fb2cc4ef695e08d6a8870b1616c ]
+
+There is a spelling mistake in the struct field tx_underun, rename
+it to tx_underrun.
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20240909140021.64884-1-colin.i.king@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: ced8e8b8f40a ("r8169: add tally counter fields added with RTL8125")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 8a732edac15a0..382ba8b04cbfa 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -566,7 +566,7 @@ struct rtl8169_counters {
+       __le64  rx_broadcast;
+       __le32  rx_multicast;
+       __le16  tx_aborted;
+-      __le16  tx_underun;
++      __le16  tx_underrun;
+ };
+ struct rtl8169_tc_offsets {
+@@ -1726,7 +1726,7 @@ static void rtl8169_get_ethtool_stats(struct net_device *dev,
+       data[9] = le64_to_cpu(counters->rx_broadcast);
+       data[10] = le32_to_cpu(counters->rx_multicast);
+       data[11] = le16_to_cpu(counters->tx_aborted);
+-      data[12] = le16_to_cpu(counters->tx_underun);
++      data[12] = le16_to_cpu(counters->tx_underrun);
+ }
+ static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data)
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-mana_ib-use-the-correct-page-table-index-based-.patch b/queue-6.6/rdma-mana_ib-use-the-correct-page-table-index-based-.patch
new file mode 100644 (file)
index 0000000..51cb91e
--- /dev/null
@@ -0,0 +1,39 @@
+From eae359c686f29ebbb8f381bd6d96df6711c2f451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2024 08:16:32 -0700
+Subject: RDMA/mana_ib: use the correct page table index based on hardware page
+ size
+
+From: Long Li <longli@microsoft.com>
+
+[ Upstream commit 9e517a8e9d9a303bf9bde35e5c5374795544c152 ]
+
+MANA hardware uses 4k page size. When calculating the page table index,
+it should use the hardware page size, not the system page size.
+
+Cc: stable@vger.kernel.org
+Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter")
+Signed-off-by: Long Li <longli@microsoft.com>
+Link: https://patch.msgid.link/1725030993-16213-1-git-send-email-longli@linuxonhyperv.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c
+index 5dd5b9803f4e5..85717482a616e 100644
+--- a/drivers/infiniband/hw/mana/main.c
++++ b/drivers/infiniband/hw/mana/main.c
+@@ -359,7 +359,7 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+       create_req->length = umem->length;
+       create_req->offset_in_page = ib_umem_dma_offset(umem, page_sz);
+-      create_req->gdma_page_type = order_base_2(page_sz) - PAGE_SHIFT;
++      create_req->gdma_page_type = order_base_2(page_sz) - MANA_PAGE_SHIFT;
+       create_req->page_count = num_pages_total;
+       ibdev_dbg(&dev->ib_dev, "size_dma_region %lu num_pages_total %lu\n",
+-- 
+2.43.0
+
diff --git a/queue-6.6/remoteproc-k3-r5-acquire-mailbox-handle-during-probe.patch b/queue-6.6/remoteproc-k3-r5-acquire-mailbox-handle-during-probe.patch
new file mode 100644 (file)
index 0000000..9d9e583
--- /dev/null
@@ -0,0 +1,195 @@
+From 3bd46c452f19aa999fbb5dea93093d4c8a176d72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2024 13:11:26 +0530
+Subject: remoteproc: k3-r5: Acquire mailbox handle during probe routine
+
+From: Beleswar Padhi <b-padhi@ti.com>
+
+[ Upstream commit f3f11cfe890733373ddbb1ce8991ccd4ee5e79e1 ]
+
+Acquire the mailbox handle during device probe and do not release handle
+in stop/detach routine or error paths. This removes the redundant
+requests for mbox handle later during rproc start/attach. This also
+allows to defer remoteproc driver's probe if mailbox is not probed yet.
+
+Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
+Link: https://lore.kernel.org/r/20240808074127.2688131-3-b-padhi@ti.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Stable-dep-of: 8fa052c29e50 ("remoteproc: k3-r5: Delay notification of wakeup event")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/ti_k3_r5_remoteproc.c | 78 +++++++++---------------
+ 1 file changed, 30 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/remoteproc/ti_k3_r5_remoteproc.c b/drivers/remoteproc/ti_k3_r5_remoteproc.c
+index 7c48f41808fa3..15fc663389096 100644
+--- a/drivers/remoteproc/ti_k3_r5_remoteproc.c
++++ b/drivers/remoteproc/ti_k3_r5_remoteproc.c
+@@ -194,6 +194,10 @@ static void k3_r5_rproc_mbox_callback(struct mbox_client *client, void *data)
+       const char *name = kproc->rproc->name;
+       u32 msg = omap_mbox_message(data);
++      /* Do not forward message from a detached core */
++      if (kproc->rproc->state == RPROC_DETACHED)
++              return;
++
+       dev_dbg(dev, "mbox msg: 0x%x\n", msg);
+       switch (msg) {
+@@ -229,6 +233,10 @@ static void k3_r5_rproc_kick(struct rproc *rproc, int vqid)
+       mbox_msg_t msg = (mbox_msg_t)vqid;
+       int ret;
++      /* Do not forward message to a detached core */
++      if (kproc->rproc->state == RPROC_DETACHED)
++              return;
++
+       /* send the index of the triggered virtqueue in the mailbox payload */
+       ret = mbox_send_message(kproc->mbox, (void *)msg);
+       if (ret < 0)
+@@ -399,12 +407,9 @@ static int k3_r5_rproc_request_mbox(struct rproc *rproc)
+       client->knows_txdone = false;
+       kproc->mbox = mbox_request_channel(client, 0);
+-      if (IS_ERR(kproc->mbox)) {
+-              ret = -EBUSY;
+-              dev_err(dev, "mbox_request_channel failed: %ld\n",
+-                      PTR_ERR(kproc->mbox));
+-              return ret;
+-      }
++      if (IS_ERR(kproc->mbox))
++              return dev_err_probe(dev, PTR_ERR(kproc->mbox),
++                                   "mbox_request_channel failed\n");
+       /*
+        * Ping the remote processor, this is only for sanity-sake for now;
+@@ -552,10 +557,6 @@ static int k3_r5_rproc_start(struct rproc *rproc)
+       u32 boot_addr;
+       int ret;
+-      ret = k3_r5_rproc_request_mbox(rproc);
+-      if (ret)
+-              return ret;
+-
+       boot_addr = rproc->bootaddr;
+       /* TODO: add boot_addr sanity checking */
+       dev_dbg(dev, "booting R5F core using boot addr = 0x%x\n", boot_addr);
+@@ -564,7 +565,7 @@ static int k3_r5_rproc_start(struct rproc *rproc)
+       core = kproc->core;
+       ret = ti_sci_proc_set_config(core->tsp, boot_addr, 0, 0);
+       if (ret)
+-              goto put_mbox;
++              return ret;
+       /* unhalt/run all applicable cores */
+       if (cluster->mode == CLUSTER_MODE_LOCKSTEP) {
+@@ -580,13 +581,12 @@ static int k3_r5_rproc_start(struct rproc *rproc)
+               if (core != core0 && core0->rproc->state == RPROC_OFFLINE) {
+                       dev_err(dev, "%s: can not start core 1 before core 0\n",
+                               __func__);
+-                      ret = -EPERM;
+-                      goto put_mbox;
++                      return -EPERM;
+               }
+               ret = k3_r5_core_run(core);
+               if (ret)
+-                      goto put_mbox;
++                      return ret;
+       }
+       return 0;
+@@ -596,8 +596,6 @@ static int k3_r5_rproc_start(struct rproc *rproc)
+               if (k3_r5_core_halt(core))
+                       dev_warn(core->dev, "core halt back failed\n");
+       }
+-put_mbox:
+-      mbox_free_channel(kproc->mbox);
+       return ret;
+ }
+@@ -658,8 +656,6 @@ static int k3_r5_rproc_stop(struct rproc *rproc)
+                       goto out;
+       }
+-      mbox_free_channel(kproc->mbox);
+-
+       return 0;
+ unroll_core_halt:
+@@ -674,42 +670,22 @@ static int k3_r5_rproc_stop(struct rproc *rproc)
+ /*
+  * Attach to a running R5F remote processor (IPC-only mode)
+  *
+- * The R5F attach callback only needs to request the mailbox, the remote
+- * processor is already booted, so there is no need to issue any TI-SCI
+- * commands to boot the R5F cores in IPC-only mode. This callback is invoked
+- * only in IPC-only mode.
++ * The R5F attach callback is a NOP. The remote processor is already booted, and
++ * all required resources have been acquired during probe routine, so there is
++ * no need to issue any TI-SCI commands to boot the R5F cores in IPC-only mode.
++ * This callback is invoked only in IPC-only mode and exists because
++ * rproc_validate() checks for its existence.
+  */
+-static int k3_r5_rproc_attach(struct rproc *rproc)
+-{
+-      struct k3_r5_rproc *kproc = rproc->priv;
+-      struct device *dev = kproc->dev;
+-      int ret;
+-
+-      ret = k3_r5_rproc_request_mbox(rproc);
+-      if (ret)
+-              return ret;
+-
+-      dev_info(dev, "R5F core initialized in IPC-only mode\n");
+-      return 0;
+-}
++static int k3_r5_rproc_attach(struct rproc *rproc) { return 0; }
+ /*
+  * Detach from a running R5F remote processor (IPC-only mode)
+  *
+- * The R5F detach callback performs the opposite operation to attach callback
+- * and only needs to release the mailbox, the R5F cores are not stopped and
+- * will be left in booted state in IPC-only mode. This callback is invoked
+- * only in IPC-only mode.
++ * The R5F detach callback is a NOP. The R5F cores are not stopped and will be
++ * left in booted state in IPC-only mode. This callback is invoked only in
++ * IPC-only mode and exists for sanity sake.
+  */
+-static int k3_r5_rproc_detach(struct rproc *rproc)
+-{
+-      struct k3_r5_rproc *kproc = rproc->priv;
+-      struct device *dev = kproc->dev;
+-
+-      mbox_free_channel(kproc->mbox);
+-      dev_info(dev, "R5F core deinitialized in IPC-only mode\n");
+-      return 0;
+-}
++static int k3_r5_rproc_detach(struct rproc *rproc) { return 0; }
+ /*
+  * This function implements the .get_loaded_rsc_table() callback and is used
+@@ -1277,6 +1253,10 @@ static int k3_r5_cluster_rproc_init(struct platform_device *pdev)
+               kproc->rproc = rproc;
+               core->rproc = rproc;
++              ret = k3_r5_rproc_request_mbox(rproc);
++              if (ret)
++                      return ret;
++
+               ret = k3_r5_rproc_configure_mode(kproc);
+               if (ret < 0)
+                       goto err_config;
+@@ -1395,6 +1375,8 @@ static void k3_r5_cluster_rproc_exit(void *data)
+                       }
+               }
++              mbox_free_channel(kproc->mbox);
++
+               rproc_del(rproc);
+               k3_r5_reserved_mem_exit(kproc);
+-- 
+2.43.0
+
diff --git a/queue-6.6/remoteproc-k3-r5-delay-notification-of-wakeup-event.patch b/queue-6.6/remoteproc-k3-r5-delay-notification-of-wakeup-event.patch
new file mode 100644 (file)
index 0000000..142b5c7
--- /dev/null
@@ -0,0 +1,57 @@
+From 776d9622c6d6a3b926e67c8bb1af1b5c35a9e15b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2024 16:20:04 +0530
+Subject: remoteproc: k3-r5: Delay notification of wakeup event
+
+From: Udit Kumar <u-kumar1@ti.com>
+
+[ Upstream commit 8fa052c29e509f3e47d56d7fc2ca28094d78c60a ]
+
+Few times, core1 was scheduled to boot first before core0, which leads
+to error:
+
+'k3_r5_rproc_start: can not start core 1 before core 0'.
+
+This was happening due to some scheduling between prepare and start
+callback. The probe function waits for event, which is getting
+triggered by prepare callback. To avoid above condition move event
+trigger to start instead of prepare callback.
+
+Fixes: 61f6f68447ab ("remoteproc: k3-r5: Wait for core0 power-up before powering up core1")
+Signed-off-by: Udit Kumar <u-kumar1@ti.com>
+[ Applied wakeup event trigger only for Split-Mode booted rprocs ]
+Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240820105004.2788327-1-b-padhi@ti.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/ti_k3_r5_remoteproc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/remoteproc/ti_k3_r5_remoteproc.c b/drivers/remoteproc/ti_k3_r5_remoteproc.c
+index 15fc663389096..5491b1b17ca36 100644
+--- a/drivers/remoteproc/ti_k3_r5_remoteproc.c
++++ b/drivers/remoteproc/ti_k3_r5_remoteproc.c
+@@ -469,8 +469,6 @@ static int k3_r5_rproc_prepare(struct rproc *rproc)
+                       ret);
+               return ret;
+       }
+-      core->released_from_reset = true;
+-      wake_up_interruptible(&cluster->core_transition);
+       /*
+        * Newer IP revisions like on J7200 SoCs support h/w auto-initialization
+@@ -587,6 +585,9 @@ static int k3_r5_rproc_start(struct rproc *rproc)
+               ret = k3_r5_core_run(core);
+               if (ret)
+                       return ret;
++
++              core->released_from_reset = true;
++              wake_up_interruptible(&cluster->core_transition);
+       }
+       return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.6/sched-psi-fix-bogus-pressure-spikes-from-aggregation.patch b/queue-6.6/sched-psi-fix-bogus-pressure-spikes-from-aggregation.patch
new file mode 100644 (file)
index 0000000..eaf2b32
--- /dev/null
@@ -0,0 +1,185 @@
+From 07c94e3c55806362787fcb3fb61f17303f871a27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 07:29:05 -0400
+Subject: sched: psi: fix bogus pressure spikes from aggregation race
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+[ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ]
+
+Brandon reports sporadic, non-sensical spikes in cumulative pressure
+time (total=) when reading cpu.pressure at a high rate. This is due to
+a race condition between reader aggregation and tasks changing states.
+
+While it affects all states and all resources captured by PSI, in
+practice it most likely triggers with CPU pressure, since scheduling
+events are so frequent compared to other resource events.
+
+The race context is the live snooping of ongoing stalls during a
+pressure read. The read aggregates per-cpu records for stalls that
+have concluded, but will also incorporate ad-hoc the duration of any
+active state that hasn't been recorded yet. This is important to get
+timely measurements of ongoing stalls. Those ad-hoc samples are
+calculated on-the-fly up to the current time on that CPU; since the
+stall hasn't concluded, it's expected that this is the minimum amount
+of stall time that will enter the per-cpu records once it does.
+
+The problem is that the path that concludes the state uses a CPU clock
+read that is not synchronized against aggregators; the clock is read
+outside of the seqlock protection. This allows aggregators to race and
+snoop a stall with a longer duration than will actually be recorded.
+
+With the recorded stall time being less than the last snapshot
+remembered by the aggregator, a subsequent sample will underflow and
+observe a bogus delta value, resulting in an erratic jump in pressure.
+
+Fix this by moving the clock read of the state change into the seqlock
+protection. This ensures no aggregation can snoop live stalls past the
+time that's recorded when the state concludes.
+
+Reported-by: Brandon Duffany <brandon@buildbuddy.io>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194
+Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/
+Fixes: df77430639c9 ("psi: Reduce calls to sched_clock() in psi")
+Cc: stable@vger.kernel.org
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Reviewed-by: Chengming Zhou <chengming.zhou@linux.dev>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/psi.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
+index 431971acc7632..f97e1473389ff 100644
+--- a/kernel/sched/psi.c
++++ b/kernel/sched/psi.c
+@@ -776,13 +776,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now)
+ }
+ static void psi_group_change(struct psi_group *group, int cpu,
+-                           unsigned int clear, unsigned int set, u64 now,
++                           unsigned int clear, unsigned int set,
+                            bool wake_clock)
+ {
+       struct psi_group_cpu *groupc;
+       unsigned int t, m;
+       enum psi_states s;
+       u32 state_mask;
++      u64 now;
+       lockdep_assert_rq_held(cpu_rq(cpu));
+       groupc = per_cpu_ptr(group->pcpu, cpu);
+@@ -797,6 +798,7 @@ static void psi_group_change(struct psi_group *group, int cpu,
+        * SOME and FULL time these may have resulted in.
+        */
+       write_seqcount_begin(&groupc->seq);
++      now = cpu_clock(cpu);
+       /*
+        * Start with TSK_ONCPU, which doesn't have a corresponding
+@@ -910,18 +912,15 @@ void psi_task_change(struct task_struct *task, int clear, int set)
+ {
+       int cpu = task_cpu(task);
+       struct psi_group *group;
+-      u64 now;
+       if (!task->pid)
+               return;
+       psi_flags_change(task, clear, set);
+-      now = cpu_clock(cpu);
+-
+       group = task_psi_group(task);
+       do {
+-              psi_group_change(group, cpu, clear, set, now, true);
++              psi_group_change(group, cpu, clear, set, true);
+       } while ((group = group->parent));
+ }
+@@ -930,7 +929,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next,
+ {
+       struct psi_group *group, *common = NULL;
+       int cpu = task_cpu(prev);
+-      u64 now = cpu_clock(cpu);
+       if (next->pid) {
+               psi_flags_change(next, 0, TSK_ONCPU);
+@@ -947,7 +945,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next,
+                               break;
+                       }
+-                      psi_group_change(group, cpu, 0, TSK_ONCPU, now, true);
++                      psi_group_change(group, cpu, 0, TSK_ONCPU, true);
+               } while ((group = group->parent));
+       }
+@@ -985,7 +983,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next,
+               do {
+                       if (group == common)
+                               break;
+-                      psi_group_change(group, cpu, clear, set, now, wake_clock);
++                      psi_group_change(group, cpu, clear, set, wake_clock);
+               } while ((group = group->parent));
+               /*
+@@ -997,7 +995,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next,
+               if ((prev->psi_flags ^ next->psi_flags) & ~TSK_ONCPU) {
+                       clear &= ~TSK_ONCPU;
+                       for (; group; group = group->parent)
+-                              psi_group_change(group, cpu, clear, set, now, wake_clock);
++                              psi_group_change(group, cpu, clear, set, wake_clock);
+               }
+       }
+ }
+@@ -1008,8 +1006,8 @@ void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_st
+       int cpu = task_cpu(curr);
+       struct psi_group *group;
+       struct psi_group_cpu *groupc;
+-      u64 now, irq;
+       s64 delta;
++      u64 irq;
+       if (!curr->pid)
+               return;
+@@ -1019,7 +1017,6 @@ void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_st
+       if (prev && task_psi_group(prev) == group)
+               return;
+-      now = cpu_clock(cpu);
+       irq = irq_time_read(cpu);
+       delta = (s64)(irq - rq->psi_irq_time);
+       if (delta < 0)
+@@ -1027,12 +1024,15 @@ void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_st
+       rq->psi_irq_time = irq;
+       do {
++              u64 now;
++
+               if (!group->enabled)
+                       continue;
+               groupc = per_cpu_ptr(group->pcpu, cpu);
+               write_seqcount_begin(&groupc->seq);
++              now = cpu_clock(cpu);
+               record_times(groupc, now);
+               groupc->times[PSI_IRQ_FULL] += delta;
+@@ -1231,11 +1231,9 @@ void psi_cgroup_restart(struct psi_group *group)
+       for_each_possible_cpu(cpu) {
+               struct rq *rq = cpu_rq(cpu);
+               struct rq_flags rf;
+-              u64 now;
+               rq_lock_irq(rq, &rf);
+-              now = cpu_clock(cpu);
+-              psi_group_change(group, cpu, 0, 0, now, true);
++              psi_group_change(group, cpu, 0, 0, true);
+               rq_unlock_irq(rq, &rf);
+       }
+ }
+-- 
+2.43.0
+
index 4c52328198598bbcad2835cd9071be1c72097d14..d6fffca1fbf78062abe12ee8f82d0b9225b627f8 100644 (file)
@@ -324,3 +324,42 @@ drm-i915-gem-fix-bitwise-and-logical-and-mixup.patch
 drm-sched-add-locking-to-drm_sched_entity_modify_sched.patch
 drm-amd-display-add-hdr-workaround-for-specific-edp.patch
 drm-amd-display-fix-system-hang-while-resume-with-tbt-monitor.patch
+cpufreq-intel_pstate-make-hwp_notify_lock-a-raw-spin.patch
+kconfig-qconf-fix-buffer-overflow-in-debug-links.patch
+platform-x86-x86-android-tablets-create-a-platform_d.patch
+platform-x86-x86-android-tablets-fix-use-after-free-.patch
+i2c-create-debugfs-entry-per-adapter.patch
+i2c-core-lock-address-during-client-device-instantia.patch
+i2c-synquacer-remove-a-clk-reference-from-struct-syn.patch
+i2c-synquacer-deal-with-optional-pclk-correctly.patch
+arm64-cputype-add-neoverse-n3-definitions.patch
+arm64-errata-expand-speculative-ssbs-workaround-once.patch
+io_uring-net-harden-multishot-termination-case-for-r.patch
+uprobes-fix-kernel-info-leak-via-uprobes-vma.patch
+mm-z3fold-deprecate-config_z3fold.patch
+drm-amd-display-allow-backlight-to-go-below-amdgpu_d.patch
+build-id-require-program-headers-to-be-right-after-e.patch
+lib-buildid-harden-build-id-parsing-logic.patch
+sched-psi-fix-bogus-pressure-spikes-from-aggregation.patch
+net-mana-enable-mana-driver-on-arm64-with-4k-page-si.patch
+net-mana-add-support-for-page-sizes-other-than-4kb-o.patch
+rdma-mana_ib-use-the-correct-page-table-index-based-.patch
+media-i2c-imx335-enable-regulator-supplies.patch
+media-imx335-fix-reset-gpio-handling.patch
+remoteproc-k3-r5-acquire-mailbox-handle-during-probe.patch
+remoteproc-k3-r5-delay-notification-of-wakeup-event.patch
+dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch
+dt-bindings-clock-qcom-add-gpll9-support-on-gcc-sc81.patch
+iio-pressure-bmp280-allow-multiple-chips-id-per-fami.patch
+iio-pressure-bmp280-improve-indentation-and-line-wra.patch
+iio-pressure-bmp280-use-bme-prefix-for-bme280-specif.patch
+iio-pressure-bmp280-fix-regmap-for-bmp280-device.patch
+iio-pressure-bmp280-fix-waiting-time-for-bmp3xx-conf.patch
+r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch
+r8169-add-tally-counter-fields-added-with-rtl8125.patch
+clk-qcom-gcc-sc8180x-add-gpll9-support.patch
+acpi-battery-simplify-battery-hook-locking.patch
+acpi-battery-fix-possible-crash-when-unregistering-a.patch
+btrfs-relocation-return-bool-from-btrfs_should_ignor.patch
+btrfs-relocation-constify-parameters-where-possible.patch
+btrfs-drop-the-backref-cache-during-relocation-if-we.patch
diff --git a/queue-6.6/uprobes-fix-kernel-info-leak-via-uprobes-vma.patch b/queue-6.6/uprobes-fix-kernel-info-leak-via-uprobes-vma.patch
new file mode 100644 (file)
index 0000000..10498c2
--- /dev/null
@@ -0,0 +1,43 @@
+From c2a609463a8899c64a7d844f37dde9dedd6abf0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 19:46:01 +0200
+Subject: uprobes: fix kernel info leak via "[uprobes]" vma
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 34820304cc2cd1804ee1f8f3504ec77813d29c8e upstream.
+
+xol_add_vma() maps the uninitialized page allocated by __create_xol_area()
+into userspace. On some architectures (x86) this memory is readable even
+without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ,
+although this doesn't really matter, debugger can read this memory anyway.
+
+Link: https://lore.kernel.org/all/20240929162047.GA12611@redhat.com/
+
+Reported-by: Will Deacon <will@kernel.org>
+Fixes: d4b3b6384f98 ("uprobes/core: Allocate XOL slots for uprobes use")
+Cc: stable@vger.kernel.org
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 6876b7f152b10..6dac0b5798213 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1491,7 +1491,7 @@ static struct xol_area *__create_xol_area(unsigned long vaddr)
+       area->xol_mapping.name = "[uprobes]";
+       area->xol_mapping.pages = area->pages;
+-      area->pages[0] = alloc_page(GFP_HIGHUSER);
++      area->pages[0] = alloc_page(GFP_HIGHUSER | __GFP_ZERO);
+       if (!area->pages[0])
+               goto free_bitmap;
+       area->pages[1] = NULL;
+-- 
+2.43.0
+