From: Sasha Levin Date: Wed, 27 Mar 2024 11:08:38 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v6.7.12~224 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2081da2c0dab5693aaac56591aa1f7965d6afda0;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/acpi-cppc-use-access_width-over-bit_width-for-system.patch b/queue-6.6/acpi-cppc-use-access_width-over-bit_width-for-system.patch new file mode 100644 index 00000000000..8569c83d971 --- /dev/null +++ b/queue-6.6/acpi-cppc-use-access_width-over-bit_width-for-system.patch @@ -0,0 +1,188 @@ +From f4e47b7d72e1671ae691546bb8d3836e88f81d7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 11:25:59 -0800 +Subject: ACPI: CPPC: Use access_width over bit_width for system memory + accesses + +From: Jarred White + +[ Upstream commit 2f4a4d63a193be6fd530d180bb13c3592052904c ] + +To align with ACPI 6.3+, since bit_width can be any 8-bit value, it +cannot be depended on to be always on a clean 8b boundary. This was +uncovered on the Cobalt 100 platform. + +SError Interrupt on CPU26, code 0xbe000011 -- SError + CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted 5.15.2.1-13 #1 + Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION + pstate: 62400009 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) + pc : cppc_get_perf_caps+0xec/0x410 + lr : cppc_get_perf_caps+0xe8/0x410 + sp : ffff8000155ab730 + x29: ffff8000155ab730 x28: ffff0080139d0038 x27: ffff0080139d0078 + x26: 0000000000000000 x25: ffff0080139d0058 x24: 00000000ffffffff + x23: ffff0080139d0298 x22: ffff0080139d0278 x21: 0000000000000000 + x20: ffff00802b251910 x19: ffff0080139d0000 x18: ffffffffffffffff + x17: 0000000000000000 x16: ffffdc7e111bad04 x15: ffff00802b251008 + x14: ffffffffffffffff x13: ffff013f1fd63300 x12: 0000000000000006 + x11: ffffdc7e128f4420 x10: 0000000000000000 x9 : ffffdc7e111badec + x8 : ffff00802b251980 x7 : 0000000000000000 x6 : ffff0080139d0028 + x5 : 0000000000000000 x4 : ffff0080139d0018 x3 : 00000000ffffffff + x2 : 0000000000000008 x1 : ffff8000155ab7a0 x0 : 0000000000000000 + Kernel panic - not syncing: Asynchronous SError Interrupt + CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted +5.15.2.1-13 #1 + Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION + Call trace: + dump_backtrace+0x0/0x1e0 + show_stack+0x24/0x30 + dump_stack_lvl+0x8c/0xb8 + dump_stack+0x18/0x34 + panic+0x16c/0x384 + add_taint+0x0/0xc0 + arm64_serror_panic+0x7c/0x90 + arm64_is_fatal_ras_serror+0x34/0xa4 + do_serror+0x50/0x6c + el1h_64_error_handler+0x40/0x74 + el1h_64_error+0x7c/0x80 + cppc_get_perf_caps+0xec/0x410 + cppc_cpufreq_cpu_init+0x74/0x400 [cppc_cpufreq] + cpufreq_online+0x2dc/0xa30 + cpufreq_add_dev+0xc0/0xd4 + subsys_interface_register+0x134/0x14c + cpufreq_register_driver+0x1b0/0x354 + cppc_cpufreq_init+0x1a8/0x1000 [cppc_cpufreq] + do_one_initcall+0x50/0x250 + do_init_module+0x60/0x27c + load_module+0x2300/0x2570 + __do_sys_finit_module+0xa8/0x114 + __arm64_sys_finit_module+0x2c/0x3c + invoke_syscall+0x78/0x100 + el0_svc_common.constprop.0+0x180/0x1a0 + do_el0_svc+0x84/0xa0 + el0_svc+0x2c/0xc0 + el0t_64_sync_handler+0xa4/0x12c + el0t_64_sync+0x1a4/0x1a8 + +Instead, use access_width to determine the size and use the offset and +width to shift and mask the bits to read/write out. Make sure to add a +check for system memory since pcc redefines the access_width to +subspace id. + +If access_width is not set, then fall back to using bit_width. + +Signed-off-by: Jarred White +Reviewed-by: Easwar Hariharan +Cc: 5.15+ # 5.15+ +[ rjw: Subject and changelog edits, comment adjustments ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/cppc_acpi.c | 31 ++++++++++++++++++++++++++----- + 1 file changed, 26 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 7ff269a78c208..bcc5d8f5bb5ee 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -163,6 +163,13 @@ show_cppc_data(cppc_get_perf_caps, cppc_perf_caps, nominal_freq); + show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf); + show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time); + ++/* Check for valid access_width, otherwise, fallback to using bit_width */ ++#define GET_BIT_WIDTH(reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width) ++ ++/* Shift and apply the mask for CPC reads/writes */ ++#define MASK_VAL(reg, val) ((val) >> ((reg)->bit_offset & \ ++ GENMASK(((reg)->bit_width), 0))) ++ + static ssize_t show_feedback_ctrs(struct kobject *kobj, + struct kobj_attribute *attr, char *buf) + { +@@ -777,6 +784,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + } else if (gas_t->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) { + if (gas_t->address) { + void __iomem *addr; ++ size_t access_width; + + if (!osc_cpc_flexible_adr_space_confirmed) { + pr_debug("Flexible address space capability not supported\n"); +@@ -784,7 +792,8 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + goto out_free; + } + +- addr = ioremap(gas_t->address, gas_t->bit_width/8); ++ access_width = GET_BIT_WIDTH(gas_t) / 8; ++ addr = ioremap(gas_t->address, access_width); + if (!addr) + goto out_free; + cpc_ptr->cpc_regs[i-2].sys_mem_vaddr = addr; +@@ -980,6 +989,7 @@ int __weak cpc_write_ffh(int cpunum, struct cpc_reg *reg, u64 val) + static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) + { + void __iomem *vaddr = NULL; ++ int size; + int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu); + struct cpc_reg *reg = ®_res->cpc_entry.reg; + +@@ -991,7 +1001,7 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) + *val = 0; + + if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_IO) { +- u32 width = 8 << (reg->access_width - 1); ++ u32 width = GET_BIT_WIDTH(reg); + u32 val_u32; + acpi_status status; + +@@ -1015,7 +1025,9 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) + return acpi_os_read_memory((acpi_physical_address)reg->address, + val, reg->bit_width); + +- switch (reg->bit_width) { ++ size = GET_BIT_WIDTH(reg); ++ ++ switch (size) { + case 8: + *val = readb_relaxed(vaddr); + break; +@@ -1034,18 +1046,22 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) + return -EFAULT; + } + ++ if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) ++ *val = MASK_VAL(reg, *val); ++ + return 0; + } + + static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val) + { + int ret_val = 0; ++ int size; + void __iomem *vaddr = NULL; + int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu); + struct cpc_reg *reg = ®_res->cpc_entry.reg; + + if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_IO) { +- u32 width = 8 << (reg->access_width - 1); ++ u32 width = GET_BIT_WIDTH(reg); + acpi_status status; + + status = acpi_os_write_port((acpi_io_address)reg->address, +@@ -1067,7 +1083,12 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val) + return acpi_os_write_memory((acpi_physical_address)reg->address, + val, reg->bit_width); + +- switch (reg->bit_width) { ++ size = GET_BIT_WIDTH(reg); ++ ++ if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) ++ val = MASK_VAL(reg, val); ++ ++ switch (size) { + case 8: + writeb_relaxed(val, vaddr); + break; +-- +2.43.0 + diff --git a/queue-6.6/ahci-asm1064-asm1166-don-t-limit-reported-ports.patch b/queue-6.6/ahci-asm1064-asm1166-don-t-limit-reported-ports.patch new file mode 100644 index 00000000000..870503e9645 --- /dev/null +++ b/queue-6.6/ahci-asm1064-asm1166-don-t-limit-reported-ports.patch @@ -0,0 +1,89 @@ +From c47756d25666933188afb30855679200fff1ee43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 22:46:50 +0100 +Subject: ahci: asm1064: asm1166: don't limit reported ports + +From: Conrad Kostecki + +[ Upstream commit 6cd8adc3e18960f6e59d797285ed34ef473cc896 ] + +Previously, patches have been added to limit the reported count of SATA +ports for asm1064 and asm1166 SATA controllers, as those controllers do +report more ports than physically having. + +While it is allowed to report more ports than physically having in CAP.NP, +it is not allowed to report more ports than physically having in the PI +(Ports Implemented) register, which is what these HBAs do. +(This is a AHCI spec violation.) + +Unfortunately, it seems that the PMP implementation in these ASMedia HBAs +is also violating the AHCI and SATA-IO PMP specification. + +What these HBAs do is that they do not report that they support PMP +(CAP.SPM (Supports Port Multiplier) is not set). + +Instead, they have decided to add extra "virtual" ports in the PI register +that is used if a port multiplier is connected to any of the physical +ports of the HBA. + +Enumerating the devices behind the PMP as specified in the AHCI and +SATA-IO specifications, by using PMP READ and PMP WRITE commands to the +physical ports of the HBA is not possible, you have to use the "virtual" +ports. + +This is of course bad, because this gives us no way to detect the device +and vendor ID of the PMP actually connected to the HBA, which means that +we can not apply the proper PMP quirks for the PMP that is connected to +the HBA. + +Limiting the port map will thus stop these controllers from working with +SATA Port Multipliers. + +This patch reverts both patches for asm1064 and asm1166, so old behavior +is restored and SATA PMP will work again, but it will also reintroduce the +(minutes long) extra boot time for the ASMedia controllers that do not +have a PMP connected (either on the PCIe card itself, or an external PMP). + +However, a longer boot time for some, is the lesser evil compared to some +other users not being able to detect their drives at all. + +Fixes: 0077a504e1a4 ("ahci: asm1166: correct count of reported ports") +Fixes: 9815e3961754 ("ahci: asm1064: correct count of reported ports") +Cc: stable@vger.kernel.org +Reported-by: Matt +Signed-off-by: Conrad Kostecki +Reviewed-by: Hans de Goede +[cassel: rewrote commit message] +Signed-off-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 13 ------------- + 1 file changed, 13 deletions(-) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 9933ad9737bb2..535de3ed60f23 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -670,19 +670,6 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets"); + static void ahci_pci_save_initial_config(struct pci_dev *pdev, + struct ahci_host_priv *hpriv) + { +- if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA) { +- switch (pdev->device) { +- case 0x1166: +- dev_info(&pdev->dev, "ASM1166 has only six ports\n"); +- hpriv->saved_port_map = 0x3f; +- break; +- case 0x1064: +- dev_info(&pdev->dev, "ASM1064 has only four ports\n"); +- hpriv->saved_port_map = 0xf; +- break; +- } +- } +- + if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) { + dev_info(&pdev->dev, "JMB361 has only one port\n"); + hpriv->saved_port_map = 1; +-- +2.43.0 + diff --git a/queue-6.6/ahci-asm1064-correct-count-of-reported-ports.patch b/queue-6.6/ahci-asm1064-correct-count-of-reported-ports.patch new file mode 100644 index 00000000000..f74e0bed170 --- /dev/null +++ b/queue-6.6/ahci-asm1064-correct-count-of-reported-ports.patch @@ -0,0 +1,60 @@ +From 9cb5b94ad716733ca984894ddd28cc2c3211d912 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 17:57:57 +0100 +Subject: ahci: asm1064: correct count of reported ports + +From: Andrey Jr. Melnikov + +[ Upstream commit 9815e39617541ef52d0dfac4be274ad378c6dc09 ] + +The ASM1064 SATA host controller always reports wrongly, +that it has 24 ports. But in reality, it only has four ports. + +before: +ahci 0000:04:00.0: SSS flag set, parallel bus scan disabled +ahci 0000:04:00.0: AHCI 0001.0301 32 slots 24 ports 6 Gbps 0xffff0f impl SATA mode +ahci 0000:04:00.0: flags: 64bit ncq sntf stag pm led only pio sxs deso sadm sds apst + +after: +ahci 0000:04:00.0: ASM1064 has only four ports +ahci 0000:04:00.0: forcing port_map 0xffff0f -> 0xf +ahci 0000:04:00.0: SSS flag set, parallel bus scan disabled +ahci 0000:04:00.0: AHCI 0001.0301 32 slots 24 ports 6 Gbps 0xf impl SATA mode +ahci 0000:04:00.0: flags: 64bit ncq sntf stag pm led only pio sxs deso sadm sds apst + +Signed-off-by: "Andrey Jr. Melnikov" +Signed-off-by: Niklas Cassel +Stable-dep-of: 6cd8adc3e189 ("ahci: asm1064: asm1166: don't limit reported ports") +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 90d33c519f4c6..9933ad9737bb2 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -670,9 +670,17 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets"); + static void ahci_pci_save_initial_config(struct pci_dev *pdev, + struct ahci_host_priv *hpriv) + { +- if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && pdev->device == 0x1166) { +- dev_info(&pdev->dev, "ASM1166 has only six ports\n"); +- hpriv->saved_port_map = 0x3f; ++ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA) { ++ switch (pdev->device) { ++ case 0x1166: ++ dev_info(&pdev->dev, "ASM1166 has only six ports\n"); ++ hpriv->saved_port_map = 0x3f; ++ break; ++ case 0x1064: ++ dev_info(&pdev->dev, "ASM1064 has only four ports\n"); ++ hpriv->saved_port_map = 0xf; ++ break; ++ } + } + + if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) { +-- +2.43.0 + diff --git a/queue-6.6/arm-dts-marvell-fix-maxium-maxim-typo-in-brownstone-.patch b/queue-6.6/arm-dts-marvell-fix-maxium-maxim-typo-in-brownstone-.patch new file mode 100644 index 00000000000..d001533a81b --- /dev/null +++ b/queue-6.6/arm-dts-marvell-fix-maxium-maxim-typo-in-brownstone-.patch @@ -0,0 +1,46 @@ +From 7305316009bf0e651ffb598814d3d769de282093 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 19:39:32 +0100 +Subject: arm: dts: marvell: Fix maxium->maxim typo in brownstone dts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duje Mihanović + +[ Upstream commit 831e0cd4f9ee15a4f02ae10b67e7fdc10eb2b4fc ] + +Fix an obvious spelling error in the PMIC compatible in the MMP2 +Brownstone DTS file. + +Fixes: 58f1193e6210 ("mfd: max8925: Add dts") +Cc: +Signed-off-by: Duje Mihanović +Reported-by: Krzysztof Kozlowski +Closes: https://lore.kernel.org/linux-devicetree/1410884282-18041-1-git-send-email-k.kozlowski@samsung.com/ +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20240125-brownstone-typo-fix-v2-1-45bc48a0c81c@skole.hr +[krzysztof: Just 10 years to take a patch, not bad! Rephrased commit + msg] +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/marvell/mmp2-brownstone.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/marvell/mmp2-brownstone.dts b/arch/arm/boot/dts/marvell/mmp2-brownstone.dts +index 04f1ae1382e7a..bc64348b82185 100644 +--- a/arch/arm/boot/dts/marvell/mmp2-brownstone.dts ++++ b/arch/arm/boot/dts/marvell/mmp2-brownstone.dts +@@ -28,7 +28,7 @@ &uart3 { + &twsi1 { + status = "okay"; + pmic: max8925@3c { +- compatible = "maxium,max8925"; ++ compatible = "maxim,max8925"; + reg = <0x3c>; + interrupts = <1>; + interrupt-parent = <&intcmux4>; +-- +2.43.0 + diff --git a/queue-6.6/arm64-dts-qcom-sc7280-add-additional-msi-interrupts.patch b/queue-6.6/arm64-dts-qcom-sc7280-add-additional-msi-interrupts.patch new file mode 100644 index 00000000000..b9b0f99265f --- /dev/null +++ b/queue-6.6/arm64-dts-qcom-sc7280-add-additional-msi-interrupts.patch @@ -0,0 +1,51 @@ +From 914cb2e1efafa0792ce957cc32534f07e11a82a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 19:32:36 +0530 +Subject: arm64: dts: qcom: sc7280: Add additional MSI interrupts + +From: Krishna chaitanya chundru + +[ Upstream commit b8ba66b40da3230a8675cb5dd5c2dea5bce24d62 ] + +Current MSI's mapping doesn't have all the vectors. This platform +supports 8 vectors each vector supports 32 MSI's, so total MSI's +supported is 256. + +Add all the MSI groups supported for this PCIe instance in this platform. + +Fixes: 92e0ee9f83b3 ("arm64: dts: qcom: sc7280: Add PCIe and PHY related nodes") +cc: stable@vger.kernel.org +Signed-off-by: Krishna chaitanya chundru +Link: https://lore.kernel.org/r/20231218-additional_msi-v1-1-de6917392684@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 8e330d2e2e224..b75de7caaa7e5 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -2098,8 +2098,16 @@ pcie1: pci@1c08000 { + ranges = <0x01000000 0x0 0x00000000 0x0 0x40200000 0x0 0x100000>, + <0x02000000 0x0 0x40300000 0x0 0x40300000 0x0 0x1fd00000>; + +- interrupts = ; +- interrupt-names = "msi"; ++ interrupts = , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; ++ interrupt-names = "msi0", "msi1", "msi2", "msi3", ++ "msi4", "msi5", "msi6", "msi7"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; + interrupt-map = <0 0 0 1 &intc 0 0 0 434 IRQ_TYPE_LEVEL_HIGH>, +-- +2.43.0 + diff --git a/queue-6.6/arm64-dts-qcom-sm8550-mtp-correct-wcd9385-tx-port-ma.patch b/queue-6.6/arm64-dts-qcom-sm8550-mtp-correct-wcd9385-tx-port-ma.patch new file mode 100644 index 00000000000..08d53c441ce --- /dev/null +++ b/queue-6.6/arm64-dts-qcom-sm8550-mtp-correct-wcd9385-tx-port-ma.patch @@ -0,0 +1,44 @@ +From 80bc136df5fbf3c3ea064db7f02ced09eeee704a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 17:45:03 +0100 +Subject: arm64: dts: qcom: sm8550-mtp: correct WCD9385 TX port mapping + +From: Krzysztof Kozlowski + +[ Upstream commit b66966b1bbc0aa58f7af83cbd56d5a206892857c ] + +WCD9385 audio codec TX port mapping was copied form HDK8450, but in fact +it is offset by one. Correct it to fix recording via analogue +microphones. + +The change is based on QRD8550 and should be correct here as well, but +was not tested on MTP8550. + +Cc: stable@vger.kernel.org +Fixes: a541667c86a9 ("arm64: dts: qcom: sm8550-mtp: add WCD9385 audio-codec") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Neil Armstrong +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240124164505.293202-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8550-mtp.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8550-mtp.dts b/arch/arm64/boot/dts/qcom/sm8550-mtp.dts +index f29cce5186acd..c4bfe43471f7c 100644 +--- a/arch/arm64/boot/dts/qcom/sm8550-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/sm8550-mtp.dts +@@ -743,7 +743,7 @@ &swr2 { + wcd_tx: codec@0,3 { + compatible = "sdw20217010d00"; + reg = <0 3>; +- qcom,tx-port-mapping = <1 1 2 3>; ++ qcom,tx-port-mapping = <2 2 3 4>; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.6/arm64-dts-qcom-sm8550-qrd-correct-wcd9385-tx-port-ma.patch b/queue-6.6/arm64-dts-qcom-sm8550-qrd-correct-wcd9385-tx-port-ma.patch new file mode 100644 index 00000000000..0d21ffcc74f --- /dev/null +++ b/queue-6.6/arm64-dts-qcom-sm8550-qrd-correct-wcd9385-tx-port-ma.patch @@ -0,0 +1,40 @@ +From f71e5a7dcf8f598f29e777bdc621bef927889198 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 17:45:02 +0100 +Subject: arm64: dts: qcom: sm8550-qrd: correct WCD9385 TX port mapping + +From: Krzysztof Kozlowski + +[ Upstream commit 8ca7fbd92c1b28edb5d5df7aeb8bb4886ddb9829 ] + +WCD9385 audio codec TX port mapping was copied form HDK8450, but in fact +it is offset by one. Correct it to fix recording via analogue +microphones. + +Cc: stable@vger.kernel.org +Fixes: 83fae950c992 ("arm64: dts: qcom: sm8550-qrd: add WCD9385 audio-codec") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240124164505.293202-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8550-qrd.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8550-qrd.dts b/arch/arm64/boot/dts/qcom/sm8550-qrd.dts +index 2c09ce8aeafd9..7a70cc5942797 100644 +--- a/arch/arm64/boot/dts/qcom/sm8550-qrd.dts ++++ b/arch/arm64/boot/dts/qcom/sm8550-qrd.dts +@@ -835,7 +835,7 @@ &swr2 { + wcd_tx: codec@0,3 { + compatible = "sdw20217010d00"; + reg = <0 3>; +- qcom,tx-port-mapping = <1 1 2 3>; ++ qcom,tx-port-mapping = <2 2 3 4>; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.6/block-clear-zone-limits-for-a-non-zoned-stacked-queu.patch b/queue-6.6/block-clear-zone-limits-for-a-non-zoned-stacked-queu.patch new file mode 100644 index 00000000000..78c755e84df --- /dev/null +++ b/queue-6.6/block-clear-zone-limits-for-a-non-zoned-stacked-queu.patch @@ -0,0 +1,44 @@ +From 2370a62b4ad92d8b4fc9ac9b729ea32ef805158e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 22:17:23 +0900 +Subject: block: Clear zone limits for a non-zoned stacked queue + +From: Damien Le Moal + +[ Upstream commit c8f6f88d25929ad2f290b428efcae3b526f3eab0 ] + +Device mapper may create a non-zoned mapped device out of a zoned device +(e.g., the dm-zoned target). In such case, some queue limit such as the +max_zone_append_sectors and zone_write_granularity endup being non zero +values for a block device that is not zoned. Avoid this by clearing +these limits in blk_stack_limits() when the stacked zoned limit is +false. + +Fixes: 3093a479727b ("block: inherit the zoned characteristics in blk_stack_limits") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Link: https://lore.kernel.org/r/20240222131724.1803520-1-dlemoal@kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 0046b447268f9..7019b8e204d96 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -686,6 +686,10 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + t->zone_write_granularity = max(t->zone_write_granularity, + b->zone_write_granularity); + t->zoned = max(t->zoned, b->zoned); ++ if (!t->zoned) { ++ t->zone_write_granularity = 0; ++ t->max_zone_append_sectors = 0; ++ } + return ret; + } + EXPORT_SYMBOL(blk_stack_limits); +-- +2.43.0 + diff --git a/queue-6.6/block-fix-page-refcounts-for-unaligned-buffers-in-__.patch b/queue-6.6/block-fix-page-refcounts-for-unaligned-buffers-in-__.patch new file mode 100644 index 00000000000..25992b1d2e9 --- /dev/null +++ b/queue-6.6/block-fix-page-refcounts-for-unaligned-buffers-in-__.patch @@ -0,0 +1,54 @@ +From 3e3f9948aeacaeed5c5d6053b8ca92b04fae0fc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 13:08:09 -0500 +Subject: block: Fix page refcounts for unaligned buffers in + __bio_release_pages() + +From: Tony Battersby + +[ Upstream commit 38b43539d64b2fa020b3b9a752a986769f87f7a6 ] + +Fix an incorrect number of pages being released for buffers that do not +start at the beginning of a page. + +Fixes: 1b151e2435fc ("block: Remove special-casing of compound pages") +Cc: stable@vger.kernel.org +Signed-off-by: Tony Battersby +Tested-by: Greg Edwards +Link: https://lore.kernel.org/r/86e592a9-98d4-4cff-a646-0c0084328356@cybernetics.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/block/bio.c b/block/bio.c +index 270f6b99926ea..62419aa09d731 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -1149,7 +1149,7 @@ void __bio_release_pages(struct bio *bio, bool mark_dirty) + + bio_for_each_folio_all(fi, bio) { + struct page *page; +- size_t done = 0; ++ size_t nr_pages; + + if (mark_dirty) { + folio_lock(fi.folio); +@@ -1157,10 +1157,11 @@ void __bio_release_pages(struct bio *bio, bool mark_dirty) + folio_unlock(fi.folio); + } + page = folio_page(fi.folio, fi.offset / PAGE_SIZE); ++ nr_pages = (fi.offset + fi.length - 1) / PAGE_SIZE - ++ fi.offset / PAGE_SIZE + 1; + do { + bio_release_page(bio, page++); +- done += PAGE_SIZE; +- } while (done < fi.length); ++ } while (--nr_pages != 0); + } + } + EXPORT_SYMBOL_GPL(__bio_release_pages); +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-btnxpuart-fix-btnxpuart_close.patch b/queue-6.6/bluetooth-btnxpuart-fix-btnxpuart_close.patch new file mode 100644 index 00000000000..43b6dd5a638 --- /dev/null +++ b/queue-6.6/bluetooth-btnxpuart-fix-btnxpuart_close.patch @@ -0,0 +1,59 @@ +From 5ff0ce871c4865efac44957e59885829fd572b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 19:14:21 +0100 +Subject: Bluetooth: btnxpuart: Fix btnxpuart_close + +From: Marcel Ziswiler + +[ Upstream commit 664130c0b0309b360bc5bdd40a30604a9387bde8 ] + +Fix scheduling while atomic BUG in btnxpuart_close(), properly +purge the transmit queue and free the receive skb. + +[ 10.973809] BUG: scheduling while atomic: kworker/u9:0/80/0x00000002 +... +[ 10.980740] CPU: 3 PID: 80 Comm: kworker/u9:0 Not tainted 6.8.0-rc7-0.0.0-devel-00005-g61fdfceacf09 #1 +[ 10.980751] Hardware name: Toradex Verdin AM62 WB on Dahlia Board (DT) +[ 10.980760] Workqueue: hci0 hci_power_off [bluetooth] +[ 10.981169] Call trace: +... +[ 10.981363] uart_update_mctrl+0x58/0x78 +[ 10.981373] uart_dtr_rts+0x104/0x114 +[ 10.981381] tty_port_shutdown+0xd4/0xdc +[ 10.981396] tty_port_close+0x40/0xbc +[ 10.981407] uart_close+0x34/0x9c +[ 10.981414] ttyport_close+0x50/0x94 +[ 10.981430] serdev_device_close+0x40/0x50 +[ 10.981442] btnxpuart_close+0x24/0x98 [btnxpuart] +[ 10.981469] hci_dev_close_sync+0x2d8/0x718 [bluetooth] +[ 10.981728] hci_dev_do_close+0x2c/0x70 [bluetooth] +[ 10.981862] hci_power_off+0x20/0x64 [bluetooth] + +Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets") +Cc: stable@vger.kernel.org +Signed-off-by: Marcel Ziswiler +Reviewed-by: Neeraj Sanjay Kale +Signed-off-by: Francesco Dolcini +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btnxpuart.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c +index 951fe3014a3f3..abccd571cf3ee 100644 +--- a/drivers/bluetooth/btnxpuart.c ++++ b/drivers/bluetooth/btnxpuart.c +@@ -1234,6 +1234,9 @@ static int btnxpuart_close(struct hci_dev *hdev) + + ps_wakeup(nxpdev); + serdev_device_close(nxpdev->serdev); ++ skb_queue_purge(&nxpdev->txq); ++ kfree_skb(nxpdev->rx_skb); ++ nxpdev->rx_skb = NULL; + clear_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state); + return 0; + } +-- +2.43.0 + diff --git a/queue-6.6/bounds-support-non-power-of-two-config_nr_cpus.patch b/queue-6.6/bounds-support-non-power-of-two-config_nr_cpus.patch new file mode 100644 index 00000000000..10bb9d84ab6 --- /dev/null +++ b/queue-6.6/bounds-support-non-power-of-two-config_nr_cpus.patch @@ -0,0 +1,46 @@ +From eb6974ccfb790b152ec61c9d8d247f775f6ad62a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Oct 2023 15:55:49 +0100 +Subject: bounds: support non-power-of-two CONFIG_NR_CPUS + +From: Matthew Wilcox (Oracle) + +[ Upstream commit f2d5dcb48f7ba9e3ff249d58fc1fa963d374e66a ] + +ilog2() rounds down, so for example when PowerPC 85xx sets CONFIG_NR_CPUS +to 24, we will only allocate 4 bits to store the number of CPUs instead of +5. Use bits_per() instead, which rounds up. Found by code inspection. +The effect of this would probably be a misaccounting when doing NUMA +balancing, so to a user, it would only be a performance penalty. The +effects may be more wide-spread; it's hard to tell. + +Link: https://lkml.kernel.org/r/20231010145549.1244748-1-willy@infradead.org +Signed-off-by: Matthew Wilcox (Oracle) +Fixes: 90572890d202 ("mm: numa: Change page last {nid,pid} into {cpu,pid}") +Reviewed-by: Rik van Riel +Acked-by: Mel Gorman +Cc: Peter Zijlstra +Cc: Ingo Molnar +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/bounds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bounds.c b/kernel/bounds.c +index b529182e8b04f..c5a9fcd2d6228 100644 +--- a/kernel/bounds.c ++++ b/kernel/bounds.c +@@ -19,7 +19,7 @@ int main(void) + DEFINE(NR_PAGEFLAGS, __NR_PAGEFLAGS); + DEFINE(MAX_NR_ZONES, __MAX_NR_ZONES); + #ifdef CONFIG_SMP +- DEFINE(NR_CPUS_BITS, ilog2(CONFIG_NR_CPUS)); ++ DEFINE(NR_CPUS_BITS, bits_per(CONFIG_NR_CPUS)); + #endif + DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t)); + #ifdef CONFIG_LRU_GEN +-- +2.43.0 + diff --git a/queue-6.6/btrfs-fix-off-by-one-chunk-length-calculation-at-con.patch b/queue-6.6/btrfs-fix-off-by-one-chunk-length-calculation-at-con.patch new file mode 100644 index 00000000000..4659c04cc0f --- /dev/null +++ b/queue-6.6/btrfs-fix-off-by-one-chunk-length-calculation-at-con.patch @@ -0,0 +1,48 @@ +From 09beeff5fc96dfd6f7069a941da80c823e749aa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 10:37:04 +0000 +Subject: btrfs: fix off-by-one chunk length calculation at + contains_pending_extent() + +From: Filipe Manana + +[ Upstream commit ae6bd7f9b46a29af52ebfac25d395757e2031d0d ] + +At contains_pending_extent() the value of the end offset of a chunk we +found in the device's allocation state io tree is inclusive, so when +we calculate the length we pass to the in_range() macro, we must sum +1 to the expression "physical_end - physical_offset". + +In practice the wrong calculation should be harmless as chunks sizes +are never 1 byte and we should never have 1 byte ranges of unallocated +space. Nevertheless fix the wrong calculation. + +Reported-by: Alex Lyakas +Link: https://lore.kernel.org/linux-btrfs/CAOcd+r30e-f4R-5x-S7sV22RJPe7+pgwherA6xqN2_qe7o4XTg@mail.gmail.com/ +Fixes: 1c11b63eff2a ("btrfs: replace pending/pinned chunks lists with io tree") +CC: stable@vger.kernel.org # 6.1+ +Reviewed-by: Josef Bacik +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 722a1dde75636..36adbb3d096a9 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -1432,7 +1432,7 @@ static bool contains_pending_extent(struct btrfs_device *device, u64 *start, + + if (in_range(physical_start, *start, len) || + in_range(*start, physical_start, +- physical_end - physical_start)) { ++ physical_end + 1 - physical_start)) { + *start = physical_end + 1; + return true; + } +-- +2.43.0 + diff --git a/queue-6.6/btrfs-qgroup-always-free-reserved-space-for-extent-r.patch b/queue-6.6/btrfs-qgroup-always-free-reserved-space-for-extent-r.patch new file mode 100644 index 00000000000..84150348d1e --- /dev/null +++ b/queue-6.6/btrfs-qgroup-always-free-reserved-space-for-extent-r.patch @@ -0,0 +1,100 @@ +From 8b1e63a0d4afb42de1c74bc23d056415526c9b47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 18:13:38 +1030 +Subject: btrfs: qgroup: always free reserved space for extent records + +From: Qu Wenruo + +[ Upstream commit d139ded8b9cdb897bb9539eb33311daf9a177fd2 ] + +[BUG] +If qgroup is marked inconsistent (e.g. caused by operations needing full +subtree rescan, like creating a snapshot and assign to a higher level +qgroup), btrfs would immediately start leaking its data reserved space. + +The following script can easily reproduce it: + + mkfs.btrfs -O quota -f $dev + mount $dev $mnt + btrfs subvolume create $mnt/subv1 + btrfs qgroup create 1/0 $mnt + + # This snapshot creation would mark qgroup inconsistent, + # as the ownership involves different higher level qgroup, thus + # we have to rescan both source and snapshot, which can be very + # time consuming, thus here btrfs just choose to mark qgroup + # inconsistent, and let users to determine when to do the rescan. + btrfs subv snapshot -i 1/0 $mnt/subv1 $mnt/snap1 + + # Now this write would lead to qgroup rsv leak. + xfs_io -f -c "pwrite 0 64k" $mnt/file1 + + # And at unmount time, btrfs would report 64K DATA rsv space leaked. + umount $mnt + +And we would have the following dmesg output for the unmount: + + BTRFS info (device dm-1): last unmount of filesystem 14a3d84e-f47b-4f72-b053-a8a36eef74d3 + BTRFS warning (device dm-1): qgroup 0/5 has unreleased space, type 0 rsv 65536 + +[CAUSE] +Since commit e15e9f43c7ca ("btrfs: introduce +BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING to skip qgroup accounting"), +we introduce a mode for btrfs qgroup to skip the timing consuming +backref walk, if the qgroup is already inconsistent. + +But this skip also covered the data reserved freeing, thus the qgroup +reserved space for each newly created data extent would not be freed, +thus cause the leakage. + +[FIX] +Make the data extent reserved space freeing mandatory. + +The qgroup reserved space handling is way cheaper compared to the +backref walking part, and we always have the super sensitive leak +detector, thus it's definitely worth to always free the qgroup +reserved data space. + +Reported-by: Fabian Vogt +Fixes: e15e9f43c7ca ("btrfs: introduce BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING to skip qgroup accounting") +CC: stable@vger.kernel.org # 6.1+ +Link: https://bugzilla.suse.com/show_bug.cgi?id=1216196 +Reviewed-by: Filipe Manana +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/qgroup.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 9acdd0f91a5ae..312c7f8853866 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2833,11 +2833,6 @@ int btrfs_qgroup_account_extents(struct btrfs_trans_handle *trans) + ctx.roots = NULL; + } + +- /* Free the reserved data space */ +- btrfs_qgroup_free_refroot(fs_info, +- record->data_rsv_refroot, +- record->data_rsv, +- BTRFS_QGROUP_RSV_DATA); + /* + * Use BTRFS_SEQ_LAST as time_seq to do special search, + * which doesn't lock tree or delayed_refs and search +@@ -2861,6 +2856,11 @@ int btrfs_qgroup_account_extents(struct btrfs_trans_handle *trans) + record->old_roots = NULL; + new_roots = NULL; + } ++ /* Free the reserved data space */ ++ btrfs_qgroup_free_refroot(fs_info, ++ record->data_rsv_refroot, ++ record->data_rsv, ++ BTRFS_QGROUP_RSV_DATA); + cleanup: + ulist_free(record->old_roots); + ulist_free(new_roots); +-- +2.43.0 + diff --git a/queue-6.6/cifs-add-xid-to-query-server-interface-call.patch b/queue-6.6/cifs-add-xid-to-query-server-interface-call.patch new file mode 100644 index 00000000000..7711ef0bbb9 --- /dev/null +++ b/queue-6.6/cifs-add-xid-to-query-server-interface-call.patch @@ -0,0 +1,49 @@ +From d240dd3ec41b17cecce9451f43a91193f0f6d971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 11:00:08 +0000 +Subject: cifs: add xid to query server interface call + +From: Shyam Prasad N + +[ Upstream commit 4cf6e1101a25ca5e63d48adf49b0a8a64bae790f ] + +We were passing 0 as the xid for the call to query +server interfaces. This is not great for debugging. +This change adds a real xid. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Bharath SM +Signed-off-by: Steve French +Stable-dep-of: 13c0a74747cb ("cifs: make sure server interfaces are requested only for SMB3+") +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index a4147e999736a..2a564f19dbb39 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -119,6 +119,7 @@ static int reconn_set_ipaddr_from_hostname(struct TCP_Server_Info *server) + static void smb2_query_server_interfaces(struct work_struct *work) + { + int rc; ++ int xid; + struct cifs_tcon *tcon = container_of(work, + struct cifs_tcon, + query_interfaces.work); +@@ -126,7 +127,10 @@ static void smb2_query_server_interfaces(struct work_struct *work) + /* + * query server network interfaces, in case they change + */ +- rc = SMB3_request_interfaces(0, tcon, false); ++ xid = get_xid(); ++ rc = SMB3_request_interfaces(xid, tcon, false); ++ free_xid(xid); ++ + if (rc) { + if (rc == -EOPNOTSUPP) + return; +-- +2.43.0 + diff --git a/queue-6.6/cifs-allow-changing-password-during-remount.patch b/queue-6.6/cifs-allow-changing-password-during-remount.patch new file mode 100644 index 00000000000..723804e6860 --- /dev/null +++ b/queue-6.6/cifs-allow-changing-password-during-remount.patch @@ -0,0 +1,138 @@ +From 1e3ecac4cb397c1611bce1e94b282289696c5f32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 00:40:01 -0600 +Subject: cifs: allow changing password during remount + +From: Steve French + +[ Upstream commit c1eb537bf4560b3ad4df606c266c665624f3b502 ] + +There are cases where a session is disconnected and password has changed +on the server (or expired) for this user and this currently can not +be fixed without unmount and mounting again. This patch allows +remount to change the password (for the non Kerberos case, Kerberos +ticket refresh is handled differently) when the session is disconnected +and the user can not reconnect due to still using old password. + +Future patches should also allow us to setup the keyring (cifscreds) +to have an "alternate password" so we would be able to change +the password before the session drops (without the risk of races +between when the password changes and the disconnect occurs - +ie cases where the old password is still needed because the new +password has not fully rolled out to all servers yet). + +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifs_debug.c | 2 ++ + fs/smb/client/cifsglob.h | 1 + + fs/smb/client/fs_context.c | 27 ++++++++++++++++++++++----- + fs/smb/client/smb2pdu.c | 5 +++++ + 4 files changed, 30 insertions(+), 5 deletions(-) + +diff --git a/fs/smb/client/cifs_debug.c b/fs/smb/client/cifs_debug.c +index 3230ed7eaddec..7206167f4184a 100644 +--- a/fs/smb/client/cifs_debug.c ++++ b/fs/smb/client/cifs_debug.c +@@ -486,6 +486,8 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) + ses->ses_count, ses->serverOS, ses->serverNOS, + ses->capabilities, ses->ses_status); + } ++ if (ses->expired_pwd) ++ seq_puts(m, "password no longer valid "); + spin_unlock(&ses->ses_lock); + + seq_printf(m, "\n\tSecurity type: %s ", +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index 57bf6b406c590..91a4061233f1a 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -1052,6 +1052,7 @@ struct cifs_ses { + enum securityEnum sectype; /* what security flavor was specified? */ + bool sign; /* is signing required? */ + bool domainAuto:1; ++ bool expired_pwd; /* track if access denied or expired pwd so can know if need to update */ + unsigned int flags; + __u16 session_flags; + __u8 smb3signingkey[SMB3_SIGN_KEY_SIZE]; +diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c +index 6ecbf48d0f0c6..e4a6b240d2263 100644 +--- a/fs/smb/client/fs_context.c ++++ b/fs/smb/client/fs_context.c +@@ -771,7 +771,7 @@ static void smb3_fs_context_free(struct fs_context *fc) + */ + static int smb3_verify_reconfigure_ctx(struct fs_context *fc, + struct smb3_fs_context *new_ctx, +- struct smb3_fs_context *old_ctx) ++ struct smb3_fs_context *old_ctx, bool need_recon) + { + if (new_ctx->posix_paths != old_ctx->posix_paths) { + cifs_errorf(fc, "can not change posixpaths during remount\n"); +@@ -797,8 +797,15 @@ static int smb3_verify_reconfigure_ctx(struct fs_context *fc, + } + if (new_ctx->password && + (!old_ctx->password || strcmp(new_ctx->password, old_ctx->password))) { +- cifs_errorf(fc, "can not change password during remount\n"); +- return -EINVAL; ++ if (need_recon == false) { ++ cifs_errorf(fc, ++ "can not change password of active session during remount\n"); ++ return -EINVAL; ++ } else if (old_ctx->sectype == Kerberos) { ++ cifs_errorf(fc, ++ "can not change password for Kerberos via remount\n"); ++ return -EINVAL; ++ } + } + if (new_ctx->domainname && + (!old_ctx->domainname || strcmp(new_ctx->domainname, old_ctx->domainname))) { +@@ -842,9 +849,14 @@ static int smb3_reconfigure(struct fs_context *fc) + struct smb3_fs_context *ctx = smb3_fc2context(fc); + struct dentry *root = fc->root; + struct cifs_sb_info *cifs_sb = CIFS_SB(root->d_sb); ++ struct cifs_ses *ses = cifs_sb_master_tcon(cifs_sb)->ses; ++ bool need_recon = false; + int rc; + +- rc = smb3_verify_reconfigure_ctx(fc, ctx, cifs_sb->ctx); ++ if (ses->expired_pwd) ++ need_recon = true; ++ ++ rc = smb3_verify_reconfigure_ctx(fc, ctx, cifs_sb->ctx, need_recon); + if (rc) + return rc; + +@@ -857,7 +869,12 @@ static int smb3_reconfigure(struct fs_context *fc) + STEAL_STRING(cifs_sb, ctx, UNC); + STEAL_STRING(cifs_sb, ctx, source); + STEAL_STRING(cifs_sb, ctx, username); +- STEAL_STRING_SENSITIVE(cifs_sb, ctx, password); ++ if (need_recon == false) ++ STEAL_STRING_SENSITIVE(cifs_sb, ctx, password); ++ else { ++ kfree_sensitive(ses->password); ++ ses->password = kstrdup(ctx->password, GFP_KERNEL); ++ } + STEAL_STRING(cifs_sb, ctx, domainname); + STEAL_STRING(cifs_sb, ctx, nodename); + STEAL_STRING(cifs_sb, ctx, iocharset); +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 9d34a55fdb5e4..fca55702b51ad 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -1536,6 +1536,11 @@ SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data) + &sess_data->buf0_type, + CIFS_LOG_ERROR | CIFS_SESS_OP, &rsp_iov); + cifs_small_buf_release(sess_data->iov[0].iov_base); ++ if (rc == 0) ++ sess_data->ses->expired_pwd = false; ++ else if ((rc == -EACCES) || (rc == -EKEYEXPIRED) || (rc == -EKEYREVOKED)) ++ sess_data->ses->expired_pwd = true; ++ + memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec)); + + return rc; +-- +2.43.0 + diff --git a/queue-6.6/cifs-delete-unnecessary-null-checks-in-cifs_chan_upd.patch b/queue-6.6/cifs-delete-unnecessary-null-checks-in-cifs_chan_upd.patch new file mode 100644 index 00000000000..c5aa350f8d4 --- /dev/null +++ b/queue-6.6/cifs-delete-unnecessary-null-checks-in-cifs_chan_upd.patch @@ -0,0 +1,66 @@ +From 006946b1e744a5d978f5c6ca0acae76cf1f36f60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 12:07:59 +0300 +Subject: cifs: delete unnecessary NULL checks in cifs_chan_update_iface() + +From: Dan Carpenter + +[ Upstream commit c3a11c0ec66c1e0652e3a2bb4f5cc74eea0ba486 ] + +We return early if "iface" is NULL so there is no need to check here. +Delete those checks. + +Signed-off-by: Dan Carpenter +Signed-off-by: Steve French +Stable-dep-of: 16a57d768111 ("cifs: reduce warning log level for server not advertising interfaces") +Signed-off-by: Sasha Levin +--- + fs/smb/client/sess.c | 26 +++++++++++--------------- + 1 file changed, 11 insertions(+), 15 deletions(-) + +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index 0d76757528e49..8dadb21292d16 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -464,27 +464,23 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + &old_iface->sockaddr); + } else if (!chan_index) { + /* special case: update interface for primary channel */ +- if (iface) { +- cifs_dbg(FYI, "referencing primary channel iface: %pIS\n", +- &iface->sockaddr); +- iface->num_channels++; +- iface->weight_fulfilled++; +- } ++ cifs_dbg(FYI, "referencing primary channel iface: %pIS\n", ++ &iface->sockaddr); ++ iface->num_channels++; ++ iface->weight_fulfilled++; + } + spin_unlock(&ses->iface_lock); + +- if (iface) { +- spin_lock(&ses->chan_lock); +- chan_index = cifs_ses_get_chan_index(ses, server); +- if (chan_index == CIFS_INVAL_CHAN_INDEX) { +- spin_unlock(&ses->chan_lock); +- return 0; +- } +- +- ses->chans[chan_index].iface = iface; ++ spin_lock(&ses->chan_lock); ++ chan_index = cifs_ses_get_chan_index(ses, server); ++ if (chan_index == CIFS_INVAL_CHAN_INDEX) { + spin_unlock(&ses->chan_lock); ++ return 0; + } + ++ ses->chans[chan_index].iface = iface; ++ spin_unlock(&ses->chan_lock); ++ + return rc; + } + +-- +2.43.0 + diff --git a/queue-6.6/cifs-do-not-let-cifs_chan_update_iface-deallocate-ch.patch b/queue-6.6/cifs-do-not-let-cifs_chan_update_iface-deallocate-ch.patch new file mode 100644 index 00000000000..f3e99f203f0 --- /dev/null +++ b/queue-6.6/cifs-do-not-let-cifs_chan_update_iface-deallocate-ch.patch @@ -0,0 +1,116 @@ +From d7cdeb65f0d231f916e573d85ece1dca4633d7e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Dec 2023 17:16:56 +0000 +Subject: cifs: do not let cifs_chan_update_iface deallocate channels + +From: Shyam Prasad N + +[ Upstream commit 12d1e301bdfd1f2e2f371432dedef7cce8f01c4a ] + +cifs_chan_update_iface is meant to check and update the server +interface used for a channel when the existing server interface +is no longer available. + +So far, this handler had the code to remove an interface entry +even if a new candidate interface is not available. Allowing +this leads to several corner cases to handle. + +This change makes the logic much simpler by not deallocating +the current channel interface entry if a new interface is not +found to replace it with. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Stable-dep-of: 16a57d768111 ("cifs: reduce warning log level for server not advertising interfaces") +Signed-off-by: Sasha Levin +--- + fs/smb/client/sess.c | 50 +++++++++++++++++--------------------------- + 1 file changed, 19 insertions(+), 31 deletions(-) + +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index 2fc2fbb260bf0..0d76757528e49 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -438,7 +438,7 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + cifs_dbg(FYI, "unable to find a suitable iface\n"); + } + +- if (!chan_index && !iface) { ++ if (!iface) { + cifs_dbg(FYI, "unable to get the interface matching: %pIS\n", + &ss); + spin_unlock(&ses->iface_lock); +@@ -446,7 +446,7 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + } + + /* now drop the ref to the current iface */ +- if (old_iface && iface) { ++ if (old_iface) { + cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n", + &old_iface->sockaddr, + &iface->sockaddr); +@@ -459,44 +459,32 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + + kref_put(&old_iface->refcount, release_iface); + } else if (old_iface) { +- cifs_dbg(FYI, "releasing ref to iface: %pIS\n", ++ /* if a new candidate is not found, keep things as is */ ++ cifs_dbg(FYI, "could not replace iface: %pIS\n", + &old_iface->sockaddr); +- +- old_iface->num_channels--; +- if (old_iface->weight_fulfilled) +- old_iface->weight_fulfilled--; +- +- kref_put(&old_iface->refcount, release_iface); + } else if (!chan_index) { + /* special case: update interface for primary channel */ +- cifs_dbg(FYI, "referencing primary channel iface: %pIS\n", +- &iface->sockaddr); +- iface->num_channels++; +- iface->weight_fulfilled++; +- } else { +- WARN_ON(!iface); +- cifs_dbg(FYI, "adding new iface: %pIS\n", &iface->sockaddr); ++ if (iface) { ++ cifs_dbg(FYI, "referencing primary channel iface: %pIS\n", ++ &iface->sockaddr); ++ iface->num_channels++; ++ iface->weight_fulfilled++; ++ } + } + spin_unlock(&ses->iface_lock); + +- spin_lock(&ses->chan_lock); +- chan_index = cifs_ses_get_chan_index(ses, server); +- if (chan_index == CIFS_INVAL_CHAN_INDEX) { ++ if (iface) { ++ spin_lock(&ses->chan_lock); ++ chan_index = cifs_ses_get_chan_index(ses, server); ++ if (chan_index == CIFS_INVAL_CHAN_INDEX) { ++ spin_unlock(&ses->chan_lock); ++ return 0; ++ } ++ ++ ses->chans[chan_index].iface = iface; + spin_unlock(&ses->chan_lock); +- return 0; + } + +- ses->chans[chan_index].iface = iface; +- +- /* No iface is found. if secondary chan, drop connection */ +- if (!iface && SERVER_IS_CHAN(server)) +- ses->chans[chan_index].server = NULL; +- +- spin_unlock(&ses->chan_lock); +- +- if (!iface && SERVER_IS_CHAN(server)) +- cifs_put_tcp_session(server, false); +- + return rc; + } + +-- +2.43.0 + diff --git a/queue-6.6/cifs-make-cifs_chan_update_iface-a-void-function.patch b/queue-6.6/cifs-make-cifs_chan_update_iface-a-void-function.patch new file mode 100644 index 00000000000..9c5a771f7e3 --- /dev/null +++ b/queue-6.6/cifs-make-cifs_chan_update_iface-a-void-function.patch @@ -0,0 +1,119 @@ +From ba963b043c73598988cd14f7cd59e22e43e04866 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 12:08:29 +0300 +Subject: cifs: make cifs_chan_update_iface() a void function + +From: Dan Carpenter + +[ Upstream commit 8d606c311b75e81063b4ea650b301cbe0c4ed5e1 ] + +The return values for cifs_chan_update_iface() didn't match what the +documentation said and nothing was checking them anyway. Just make it +a void function. + +Signed-off-by: Dan Carpenter +Signed-off-by: Steve French +Stable-dep-of: 16a57d768111 ("cifs: reduce warning log level for server not advertising interfaces") +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsproto.h | 2 +- + fs/smb/client/sess.c | 17 +++++++---------- + 2 files changed, 8 insertions(+), 11 deletions(-) + +diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h +index 0cff4f5af1793..ed257612bf0bc 100644 +--- a/fs/smb/client/cifsproto.h ++++ b/fs/smb/client/cifsproto.h +@@ -654,7 +654,7 @@ cifs_chan_is_iface_active(struct cifs_ses *ses, + struct TCP_Server_Info *server); + void + cifs_disable_secondary_channels(struct cifs_ses *ses); +-int ++void + cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server); + int + SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_mount); +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index 8dadb21292d16..16554216f2f95 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -355,10 +355,9 @@ cifs_disable_secondary_channels(struct cifs_ses *ses) + + /* + * update the iface for the channel if necessary. +- * will return 0 when iface is updated, 1 if removed, 2 otherwise + * Must be called with chan_lock held. + */ +-int ++void + cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + { + unsigned int chan_index; +@@ -367,20 +366,19 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + struct cifs_server_iface *old_iface = NULL; + struct cifs_server_iface *last_iface = NULL; + struct sockaddr_storage ss; +- int rc = 0; + + spin_lock(&ses->chan_lock); + chan_index = cifs_ses_get_chan_index(ses, server); + if (chan_index == CIFS_INVAL_CHAN_INDEX) { + spin_unlock(&ses->chan_lock); +- return 0; ++ return; + } + + if (ses->chans[chan_index].iface) { + old_iface = ses->chans[chan_index].iface; + if (old_iface->is_active) { + spin_unlock(&ses->chan_lock); +- return 1; ++ return; + } + } + spin_unlock(&ses->chan_lock); +@@ -393,7 +391,7 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + if (!ses->iface_count) { + spin_unlock(&ses->iface_lock); + cifs_dbg(VFS, "server %s does not advertise interfaces\n", ses->server->hostname); +- return 0; ++ return; + } + + last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface, +@@ -433,7 +431,6 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + } + + if (list_entry_is_head(iface, &ses->iface_list, iface_head)) { +- rc = 1; + iface = NULL; + cifs_dbg(FYI, "unable to find a suitable iface\n"); + } +@@ -442,7 +439,7 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + cifs_dbg(FYI, "unable to get the interface matching: %pIS\n", + &ss); + spin_unlock(&ses->iface_lock); +- return 0; ++ return; + } + + /* now drop the ref to the current iface */ +@@ -475,13 +472,13 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + chan_index = cifs_ses_get_chan_index(ses, server); + if (chan_index == CIFS_INVAL_CHAN_INDEX) { + spin_unlock(&ses->chan_lock); +- return 0; ++ return; + } + + ses->chans[chan_index].iface = iface; + spin_unlock(&ses->chan_lock); + +- return rc; ++ return; + } + + /* +-- +2.43.0 + diff --git a/queue-6.6/cifs-make-sure-server-interfaces-are-requested-only-.patch b/queue-6.6/cifs-make-sure-server-interfaces-are-requested-only-.patch new file mode 100644 index 00000000000..1164556fe9e --- /dev/null +++ b/queue-6.6/cifs-make-sure-server-interfaces-are-requested-only-.patch @@ -0,0 +1,115 @@ +From d0449ee246c4376b977d74ee3b32f5083a5827ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 10:40:41 +0000 +Subject: cifs: make sure server interfaces are requested only for SMB3+ +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shyam Prasad N + +[ Upstream commit 13c0a74747cb7fdadf58c5d3a7d52cfca2d51736 ] + +Some code paths for querying server interfaces make a false +assumption that it will only get called for SMB3+. Since this +function now can get called from a generic code paths, the correct +thing to do is to have specific handler for this functionality +per SMB dialect, and call this handler. + +This change adds such a handler and implements this handler only +for SMB 3.0 and 3.1.1. + +Cc: stable@vger.kernel.org +Cc: Jan Čermák +Reported-by: Paulo Alcantara +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsglob.h | 3 +++ + fs/smb/client/connect.c | 6 +++++- + fs/smb/client/smb2ops.c | 2 ++ + fs/smb/client/smb2pdu.c | 5 +++-- + 4 files changed, 13 insertions(+), 3 deletions(-) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index 91a4061233f1a..35a12413bbee6 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -339,6 +339,9 @@ struct smb_version_operations { + /* informational QFS call */ + void (*qfs_tcon)(const unsigned int, struct cifs_tcon *, + struct cifs_sb_info *); ++ /* query for server interfaces */ ++ int (*query_server_interfaces)(const unsigned int, struct cifs_tcon *, ++ bool); + /* check if a path is accessible or not */ + int (*is_path_accessible)(const unsigned int, struct cifs_tcon *, + struct cifs_sb_info *, const char *); +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index 2a564f19dbb39..4c958129181d3 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -123,12 +123,16 @@ static void smb2_query_server_interfaces(struct work_struct *work) + struct cifs_tcon *tcon = container_of(work, + struct cifs_tcon, + query_interfaces.work); ++ struct TCP_Server_Info *server = tcon->ses->server; + + /* + * query server network interfaces, in case they change + */ ++ if (!server->ops->query_server_interfaces) ++ return; ++ + xid = get_xid(); +- rc = SMB3_request_interfaces(xid, tcon, false); ++ rc = server->ops->query_server_interfaces(xid, tcon, false); + free_xid(xid); + + if (rc) { +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 5850f861e7e13..978a9f409857a 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -5436,6 +5436,7 @@ struct smb_version_operations smb30_operations = { + .tree_connect = SMB2_tcon, + .tree_disconnect = SMB2_tdis, + .qfs_tcon = smb3_qfs_tcon, ++ .query_server_interfaces = SMB3_request_interfaces, + .is_path_accessible = smb2_is_path_accessible, + .can_echo = smb2_can_echo, + .echo = SMB2_echo, +@@ -5550,6 +5551,7 @@ struct smb_version_operations smb311_operations = { + .tree_connect = SMB2_tcon, + .tree_disconnect = SMB2_tdis, + .qfs_tcon = smb3_qfs_tcon, ++ .query_server_interfaces = SMB3_request_interfaces, + .is_path_accessible = smb2_is_path_accessible, + .can_echo = smb2_can_echo, + .echo = SMB2_echo, +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index fca55702b51ad..4d7d0bdf7a472 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -409,14 +409,15 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + spin_unlock(&ses->ses_lock); + + if (!rc && +- (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { ++ (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL) && ++ server->ops->query_server_interfaces) { + mutex_unlock(&ses->session_mutex); + + /* + * query server network interfaces, in case they change + */ + xid = get_xid(); +- rc = SMB3_request_interfaces(xid, tcon, false); ++ rc = server->ops->query_server_interfaces(xid, tcon, false); + free_xid(xid); + + if (rc == -EOPNOTSUPP && ses->chan_count > 1) { +-- +2.43.0 + diff --git a/queue-6.6/cifs-open_cached_dir-add-file_read_ea-to-desired-acc.patch b/queue-6.6/cifs-open_cached_dir-add-file_read_ea-to-desired-acc.patch new file mode 100644 index 00000000000..7ba172e9d75 --- /dev/null +++ b/queue-6.6/cifs-open_cached_dir-add-file_read_ea-to-desired-acc.patch @@ -0,0 +1,41 @@ +From 7275cdaf095f8bdf622f4157dcdceb0c29be60ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 17:53:44 +0300 +Subject: cifs: open_cached_dir(): add FILE_READ_EA to desired access + +From: Eugene Korenevsky + +[ Upstream commit f1b8224b4e6ed59e7e6f5c548673c67410098d8d ] + +Since smb2_query_eas() reads EA and uses cached directory, +open_cached_dir() should request FILE_READ_EA access. + +Otherwise listxattr() and getxattr() will fail with EACCES +(0xc0000022 STATUS_ACCESS_DENIED SMB status). + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218543 +Cc: stable@vger.kernel.org +Signed-off-by: Eugene Korenevsky +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cached_dir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c +index 5730c65ffb40d..15e1215bc4e5a 100644 +--- a/fs/smb/client/cached_dir.c ++++ b/fs/smb/client/cached_dir.c +@@ -233,7 +233,8 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + .tcon = tcon, + .path = path, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE), +- .desired_access = FILE_READ_DATA | FILE_READ_ATTRIBUTES, ++ .desired_access = FILE_READ_DATA | FILE_READ_ATTRIBUTES | ++ FILE_READ_EA, + .disposition = FILE_OPEN, + .fid = pfid, + }; +-- +2.43.0 + diff --git a/queue-6.6/cifs-prevent-updating-file-size-from-server-if-we-ha.patch b/queue-6.6/cifs-prevent-updating-file-size-from-server-if-we-ha.patch new file mode 100644 index 00000000000..8b77d6efb23 --- /dev/null +++ b/queue-6.6/cifs-prevent-updating-file-size-from-server-if-we-ha.patch @@ -0,0 +1,169 @@ +From 75b2e463c78a8d1c924d0633879abbc22f27efa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 23:09:52 +0530 +Subject: cifs: prevent updating file size from server if we have a read/write + lease + +From: Bharath SM + +[ Upstream commit e4b61f3b1c67f5068590965f64ea6e8d5d5bd961 ] + +In cases of large directories, the readdir operation may span multiple +round trips to retrieve contents. This introduces a potential race +condition in case of concurrent write and readdir operations. If the +readdir operation initiates before a write has been processed by the +server, it may update the file size attribute to an older value. +Address this issue by avoiding file size updates from readdir when we +have read/write lease. + +Scenario: +1) process1: open dir xyz +2) process1: readdir instance 1 on xyz +3) process2: create file.txt for write +4) process2: write x bytes to file.txt +5) process2: close file.txt +6) process2: open file.txt for read +7) process1: readdir 2 - overwrites file.txt inode size to 0 +8) process2: read contents of file.txt - bug, short read with 0 bytes + +Cc: stable@vger.kernel.org +Reviewed-by: Shyam Prasad N +Signed-off-by: Bharath SM +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsproto.h | 6 ++++-- + fs/smb/client/file.c | 8 +++++--- + fs/smb/client/inode.c | 13 +++++++------ + fs/smb/client/readdir.c | 2 +- + 4 files changed, 17 insertions(+), 12 deletions(-) + +diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h +index 260a6299bddb8..0cff4f5af1793 100644 +--- a/fs/smb/client/cifsproto.h ++++ b/fs/smb/client/cifsproto.h +@@ -144,7 +144,8 @@ extern int cifs_reconnect(struct TCP_Server_Info *server, + extern int checkSMB(char *buf, unsigned int len, struct TCP_Server_Info *srvr); + extern bool is_valid_oplock_break(char *, struct TCP_Server_Info *); + extern bool backup_cred(struct cifs_sb_info *); +-extern bool is_size_safe_to_change(struct cifsInodeInfo *, __u64 eof); ++extern bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 eof, ++ bool from_readdir); + extern void cifs_update_eof(struct cifsInodeInfo *cifsi, loff_t offset, + unsigned int bytes_written); + extern struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *, int); +@@ -201,7 +202,8 @@ extern void cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, + struct cifs_sb_info *cifs_sb); + extern void cifs_dir_info_to_fattr(struct cifs_fattr *, FILE_DIRECTORY_INFO *, + struct cifs_sb_info *); +-extern int cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr); ++extern int cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr, ++ bool from_readdir); + extern struct inode *cifs_iget(struct super_block *sb, + struct cifs_fattr *fattr); + +diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c +index c156460eb5587..c711d5eb2987e 100644 +--- a/fs/smb/client/file.c ++++ b/fs/smb/client/file.c +@@ -329,7 +329,7 @@ int cifs_posix_open(const char *full_path, struct inode **pinode, + } + } else { + cifs_revalidate_mapping(*pinode); +- rc = cifs_fattr_to_inode(*pinode, &fattr); ++ rc = cifs_fattr_to_inode(*pinode, &fattr, false); + } + + posix_open_ret: +@@ -4766,12 +4766,14 @@ static int is_inode_writable(struct cifsInodeInfo *cifs_inode) + refreshing the inode only on increases in the file size + but this is tricky to do without racing with writebehind + page caching in the current Linux kernel design */ +-bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file) ++bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file, ++ bool from_readdir) + { + if (!cifsInode) + return true; + +- if (is_inode_writable(cifsInode)) { ++ if (is_inode_writable(cifsInode) || ++ ((cifsInode->oplock & CIFS_CACHE_RW_FLG) != 0 && from_readdir)) { + /* This inode is open for write at least once */ + struct cifs_sb_info *cifs_sb; + +diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c +index 471abc99bbf02..cb9e719e67ae2 100644 +--- a/fs/smb/client/inode.c ++++ b/fs/smb/client/inode.c +@@ -147,7 +147,8 @@ cifs_nlink_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr) + + /* populate an inode with info from a cifs_fattr struct */ + int +-cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr) ++cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr, ++ bool from_readdir) + { + struct cifsInodeInfo *cifs_i = CIFS_I(inode); + struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); +@@ -199,7 +200,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr) + * Can't safely change the file size here if the client is writing to + * it due to potential races. + */ +- if (is_size_safe_to_change(cifs_i, fattr->cf_eof)) { ++ if (is_size_safe_to_change(cifs_i, fattr->cf_eof, from_readdir)) { + i_size_write(inode, fattr->cf_eof); + + /* +@@ -368,7 +369,7 @@ static int update_inode_info(struct super_block *sb, + CIFS_I(*inode)->time = 0; /* force reval */ + return -ESTALE; + } +- return cifs_fattr_to_inode(*inode, fattr); ++ return cifs_fattr_to_inode(*inode, fattr, false); + } + + #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY +@@ -403,7 +404,7 @@ cifs_get_file_info_unix(struct file *filp) + } else + goto cifs_gfiunix_out; + +- rc = cifs_fattr_to_inode(inode, &fattr); ++ rc = cifs_fattr_to_inode(inode, &fattr, false); + + cifs_gfiunix_out: + free_xid(xid); +@@ -928,7 +929,7 @@ cifs_get_file_info(struct file *filp) + fattr.cf_uniqueid = CIFS_I(inode)->uniqueid; + fattr.cf_flags |= CIFS_FATTR_NEED_REVAL; + /* if filetype is different, return error */ +- rc = cifs_fattr_to_inode(inode, &fattr); ++ rc = cifs_fattr_to_inode(inode, &fattr, false); + cgfi_exit: + cifs_free_open_info(&data); + free_xid(xid); +@@ -1467,7 +1468,7 @@ cifs_iget(struct super_block *sb, struct cifs_fattr *fattr) + } + + /* can't fail - see cifs_find_inode() */ +- cifs_fattr_to_inode(inode, fattr); ++ cifs_fattr_to_inode(inode, fattr, false); + if (sb->s_flags & SB_NOATIME) + inode->i_flags |= S_NOATIME | S_NOCMTIME; + if (inode->i_state & I_NEW) { +diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c +index 520c490e844b5..56033e4e4bae9 100644 +--- a/fs/smb/client/readdir.c ++++ b/fs/smb/client/readdir.c +@@ -148,7 +148,7 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name, + rc = -ESTALE; + } + } +- if (!rc && !cifs_fattr_to_inode(inode, fattr)) { ++ if (!rc && !cifs_fattr_to_inode(inode, fattr, true)) { + dput(dentry); + return; + } +-- +2.43.0 + diff --git a/queue-6.6/cifs-reduce-warning-log-level-for-server-not-adverti.patch b/queue-6.6/cifs-reduce-warning-log-level-for-server-not-adverti.patch new file mode 100644 index 00000000000..f57e2fc90e0 --- /dev/null +++ b/queue-6.6/cifs-reduce-warning-log-level-for-server-not-adverti.patch @@ -0,0 +1,55 @@ +From be351a7c49da42f0463d0ad9b602de6721365d3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 10:40:40 +0000 +Subject: cifs: reduce warning log level for server not advertising interfaces +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shyam Prasad N + +[ Upstream commit 16a57d7681110b25708c7042688412238e6f73a9 ] + +Several users have reported this log getting dumped too regularly to +kernel log. The likely root cause has been identified, and it suggests +that this situation is expected for some configurations +(for example SMB2.1). + +Since the function returns appropriately even for such cases, it is +fairly harmless to make this a debug log. When needed, the verbosity +can be increased to capture this log. + +Cc: stable@vger.kernel.org +Reported-by: Jan Čermák +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/sess.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index 16554216f2f95..e4168cd8b6c28 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -224,7 +224,7 @@ int cifs_try_adding_channels(struct cifs_ses *ses) + spin_lock(&ses->iface_lock); + if (!ses->iface_count) { + spin_unlock(&ses->iface_lock); +- cifs_dbg(VFS, "server %s does not advertise interfaces\n", ++ cifs_dbg(ONCE, "server %s does not advertise interfaces\n", + ses->server->hostname); + break; + } +@@ -390,7 +390,7 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) + spin_lock(&ses->iface_lock); + if (!ses->iface_count) { + spin_unlock(&ses->iface_lock); +- cifs_dbg(VFS, "server %s does not advertise interfaces\n", ses->server->hostname); ++ cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname); + return; + } + +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-gcc-ipq5018-fix-terminating-of-frequency-ta.patch b/queue-6.6/clk-qcom-gcc-ipq5018-fix-terminating-of-frequency-ta.patch new file mode 100644 index 00000000000..03a2df16b3a --- /dev/null +++ b/queue-6.6/clk-qcom-gcc-ipq5018-fix-terminating-of-frequency-ta.patch @@ -0,0 +1,57 @@ +From 108bff37dfe0da13d470e76ef6ab3a7a2a826273 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:46 +0100 +Subject: clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit 90ad946fff70f312b8d23226afc38c13ddd88c4b ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-1-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq5018.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c +index cc2331d729fb6..3136ba1c2a59c 100644 +--- a/drivers/clk/qcom/gcc-ipq5018.c ++++ b/drivers/clk/qcom/gcc-ipq5018.c +@@ -856,6 +856,7 @@ static struct clk_rcg2 lpass_sway_clk_src = { + + static const struct freq_tbl ftbl_pcie0_aux_clk_src[] = { + F(2000000, P_XO, 12, 0, 0), ++ { } + }; + + static struct clk_rcg2 pcie0_aux_clk_src = { +@@ -1098,6 +1099,7 @@ static const struct freq_tbl ftbl_qpic_io_macro_clk_src[] = { + F(100000000, P_GPLL0, 8, 0, 0), + F(200000000, P_GPLL0, 4, 0, 0), + F(320000000, P_GPLL0, 2.5, 0, 0), ++ { } + }; + + static struct clk_rcg2 qpic_io_macro_clk_src = { +@@ -1193,6 +1195,7 @@ static struct clk_rcg2 ubi0_axi_clk_src = { + static const struct freq_tbl ftbl_ubi0_core_clk_src[] = { + F(850000000, P_UBI32_PLL, 1, 0, 0), + F(1000000000, P_UBI32_PLL, 1, 0, 0), ++ { } + }; + + static struct clk_rcg2 ubi0_core_clk_src = { +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch b/queue-6.6/clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch new file mode 100644 index 00000000000..266a4dc25f8 --- /dev/null +++ b/queue-6.6/clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch @@ -0,0 +1,51 @@ +From 5c79e9dec84fcc68b4329a7921476c74507d43c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:47 +0100 +Subject: clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit cdbc6e2d8108bc47895e5a901cfcaf799b00ca8d ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Only compile tested. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-2-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index f9494fa1b8716..2e4189e770d3f 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -1554,6 +1554,7 @@ static struct clk_regmap_div nss_ubi0_div_clk_src = { + + static const struct freq_tbl ftbl_pcie_aux_clk_src[] = { + F(24000000, P_XO, 1, 0, 0), ++ { } + }; + + static const struct clk_parent_data gcc_xo_gpll0_core_pi_sleep_clk[] = { +@@ -1734,6 +1735,7 @@ static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = { + F(160000000, P_GPLL0, 5, 0, 0), + F(216000000, P_GPLL6, 5, 0, 0), + F(308570000, P_GPLL6, 3.5, 0, 0), ++ { } + }; + + static const struct clk_parent_data gcc_xo_gpll0_gpll6_gpll0_div2[] = { +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch b/queue-6.6/clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch new file mode 100644 index 00000000000..d3bbd911b84 --- /dev/null +++ b/queue-6.6/clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch @@ -0,0 +1,51 @@ +From 5e8b61779e758177ac7838f4388c08fd042059f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:48 +0100 +Subject: clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit 1040ef5ed95d6fd2628bad387d78a61633e09429 ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Only compile tested. + +Fixes: 9607f6224b39 ("clk: qcom: ipq8074: add PCIE, USB and SDCC clocks") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-3-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq8074.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index b7faf12a511a1..7bc679871f324 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -644,6 +644,7 @@ static struct clk_rcg2 pcie0_axi_clk_src = { + + static const struct freq_tbl ftbl_pcie_aux_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), ++ { } + }; + + static const struct clk_parent_data gcc_xo_gpll0_sleep_clk[] = { +@@ -795,6 +796,7 @@ static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), + F(160000000, P_GPLL0, 5, 0, 0), + F(308570000, P_GPLL6, 3.5, 0, 0), ++ { } + }; + + static const struct clk_parent_data gcc_xo_gpll0_gpll6_gpll0_div2[] = { +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-gcc-ipq9574-fix-terminating-of-frequency-ta.patch b/queue-6.6/clk-qcom-gcc-ipq9574-fix-terminating-of-frequency-ta.patch new file mode 100644 index 00000000000..96e82af7732 --- /dev/null +++ b/queue-6.6/clk-qcom-gcc-ipq9574-fix-terminating-of-frequency-ta.patch @@ -0,0 +1,43 @@ +From 517dbe888c94ee23f5d5cc6c19b58d3c20f24cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:49 +0100 +Subject: clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit bd2b6395671d823caa38d8e4d752de2448ae61e1 ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Only compile tested. + +Fixes: d75b82cff488 ("clk: qcom: Add Global Clock Controller driver for IPQ9574") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-4-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq9574.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-ipq9574.c b/drivers/clk/qcom/gcc-ipq9574.c +index e8190108e1aef..0a3f846695b80 100644 +--- a/drivers/clk/qcom/gcc-ipq9574.c ++++ b/drivers/clk/qcom/gcc-ipq9574.c +@@ -2082,6 +2082,7 @@ static struct clk_branch gcc_sdcc1_apps_clk = { + static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = { + F(150000000, P_GPLL4, 8, 0, 0), + F(300000000, P_GPLL4, 4, 0, 0), ++ { } + }; + + static struct clk_rcg2 sdcc1_ice_core_clk_src = { +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-gcc-sdm845-add-soft-dependency-on-rpmhpd.patch b/queue-6.6/clk-qcom-gcc-sdm845-add-soft-dependency-on-rpmhpd.patch new file mode 100644 index 00000000000..2760570c92f --- /dev/null +++ b/queue-6.6/clk-qcom-gcc-sdm845-add-soft-dependency-on-rpmhpd.patch @@ -0,0 +1,40 @@ +From 76487cddb90121bbfb8584b7a935397842652143 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 11:58:14 +0530 +Subject: clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd + +From: Amit Pundir + +[ Upstream commit 1d9054e3a4fd36e2949e616f7360bdb81bcc1921 ] + +With the addition of RPMh power domain to the GCC node in +device tree, we noticed a significant delay in getting the +UFS driver probed on AOSP which futher led to mount failures +because Android do not support rootwait. So adding a soft +dependency on RPMh power domain which informs modprobe to +load rpmhpd module before gcc-sdm845. + +Cc: stable@vger.kernel.org # v5.4+ +Fixes: 4b6ea15c0a11 ("arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC") +Suggested-by: Manivannan Sadhasivam +Signed-off-by: Amit Pundir +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240123062814.2555649-1-amit.pundir@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sdm845.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c +index 725cd52d2398e..ea4c3bf4fb9bf 100644 +--- a/drivers/clk/qcom/gcc-sdm845.c ++++ b/drivers/clk/qcom/gcc-sdm845.c +@@ -4037,3 +4037,4 @@ module_exit(gcc_sdm845_exit); + MODULE_DESCRIPTION("QTI GCC SDM845 Driver"); + MODULE_LICENSE("GPL v2"); + MODULE_ALIAS("platform:gcc-sdm845"); ++MODULE_SOFTDEP("pre: rpmhpd"); +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch b/queue-6.6/clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch new file mode 100644 index 00000000000..7e38711dc4e --- /dev/null +++ b/queue-6.6/clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch @@ -0,0 +1,51 @@ +From f4db3ad4539e3181396f3b6875f55674b6aa38f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:51 +0100 +Subject: clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit a903cfd38d8dee7e754fb89fd1bebed99e28003d ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Only compile tested. + +Fixes: 2b46cd23a5a2 ("clk: qcom: Add APQ8084 Multimedia Clock Controller (MMCC) support") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-6-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-apq8084.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/mmcc-apq8084.c b/drivers/clk/qcom/mmcc-apq8084.c +index 02fc21208dd14..c89700ab93f9c 100644 +--- a/drivers/clk/qcom/mmcc-apq8084.c ++++ b/drivers/clk/qcom/mmcc-apq8084.c +@@ -348,6 +348,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = { + F(333430000, P_MMPLL1, 3.5, 0, 0), + F(400000000, P_MMPLL0, 2, 0, 0), + F(466800000, P_MMPLL1, 2.5, 0, 0), ++ { } + }; + + static struct clk_rcg2 mmss_axi_clk_src = { +@@ -372,6 +373,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = { + F(150000000, P_GPLL0, 4, 0, 0), + F(228570000, P_MMPLL0, 3.5, 0, 0), + F(320000000, P_MMPLL0, 2.5, 0, 0), ++ { } + }; + + static struct clk_rcg2 ocmemnoc_clk_src = { +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch b/queue-6.6/clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch new file mode 100644 index 00000000000..dd4362842a2 --- /dev/null +++ b/queue-6.6/clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch @@ -0,0 +1,51 @@ +From 425107db7223433cd203b666441a1dd976c14a43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:52 +0100 +Subject: clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96 ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Only compile tested. + +Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-7-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index 1f3bd302fe6ed..6df22a67f02d3 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -290,6 +290,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = { + F(291750000, P_MMPLL1, 4, 0, 0), + F(400000000, P_MMPLL0, 2, 0, 0), + F(466800000, P_MMPLL1, 2.5, 0, 0), ++ { } + }; + + static struct clk_rcg2 mmss_axi_clk_src = { +@@ -314,6 +315,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = { + F(150000000, P_GPLL0, 4, 0, 0), + F(291750000, P_MMPLL1, 4, 0, 0), + F(400000000, P_MMPLL0, 2, 0, 0), ++ { } + }; + + static struct clk_rcg2 ocmemnoc_clk_src = { +-- +2.43.0 + diff --git a/queue-6.6/cpufreq-amd-pstate-fix-min_perf-assignment-in-amd_ps.patch b/queue-6.6/cpufreq-amd-pstate-fix-min_perf-assignment-in-amd_ps.patch new file mode 100644 index 00000000000..aff33f54aef --- /dev/null +++ b/queue-6.6/cpufreq-amd-pstate-fix-min_perf-assignment-in-amd_ps.patch @@ -0,0 +1,41 @@ +From db2db5e2ff05434913ee8efe63e7bca4bcf19b5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 16:42:26 +0100 +Subject: cpufreq: amd-pstate: Fix min_perf assignment in + amd_pstate_adjust_perf() + +From: Tor Vic + +[ Upstream commit b26ffbf800ae3c8d01bdf90d9cd8a37e1606ff06 ] + +In the function amd_pstate_adjust_perf(), the 'min_perf' variable is set +to 'highest_perf' instead of 'lowest_perf'. + +Fixes: 1d215f0319c2 ("cpufreq: amd-pstate: Add fast switch function for AMD P-State") +Reported-by: Oleksandr Natalenko +Reviewed-by: Perry Yuan +Signed-off-by: Tor Vic +Reviewed-by: Mario Limonciello +Cc: 6.1+ # 6.1+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd-pstate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c +index 1791d37fbc53c..07f3419954396 100644 +--- a/drivers/cpufreq/amd-pstate.c ++++ b/drivers/cpufreq/amd-pstate.c +@@ -570,7 +570,7 @@ static void amd_pstate_adjust_perf(unsigned int cpu, + if (target_perf < capacity) + des_perf = DIV_ROUND_UP(cap_perf * target_perf, capacity); + +- min_perf = READ_ONCE(cpudata->highest_perf); ++ min_perf = READ_ONCE(cpudata->lowest_perf); + if (_min_perf < capacity) + min_perf = DIV_ROUND_UP(cap_perf * _min_perf, capacity); + +-- +2.43.0 + diff --git a/queue-6.6/cpufreq-dt-always-allocate-zeroed-cpumask.patch b/queue-6.6/cpufreq-dt-always-allocate-zeroed-cpumask.patch new file mode 100644 index 00000000000..ea6935c1b9e --- /dev/null +++ b/queue-6.6/cpufreq-dt-always-allocate-zeroed-cpumask.patch @@ -0,0 +1,46 @@ +From 2b489aec1cb94d59e5b33a3c8d602babc784412f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 13:54:57 +0100 +Subject: cpufreq: dt: always allocate zeroed cpumask + +From: Marek Szyprowski + +[ Upstream commit d2399501c2c081eac703ca9597ceb83c7875a537 ] + +Commit 0499a78369ad ("ARM64: Dynamically allocate cpumasks and increase +supported CPUs to 512") changed the handling of cpumasks on ARM 64bit, +what resulted in the strange issues and warnings during cpufreq-dt +initialization on some big.LITTLE platforms. + +This was caused by mixing OPPs between big and LITTLE cores, because +OPP-sharing information between big and LITTLE cores is computed on +cpumask, which in turn was not zeroed on allocation. Fix this by +switching to zalloc_cpumask_var() call. + +Fixes: dc279ac6e5b4 ("cpufreq: dt: Refactor initialization to handle probe deferral properly") +CC: stable@vger.kernel.org # v5.10+ +Signed-off-by: Marek Szyprowski +Reviewed-by: Christoph Lameter (Ampere) +Reviewed-by: Dhruva Gole +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c +index 8bd6e5e8f121c..2d83bbc65dd0b 100644 +--- a/drivers/cpufreq/cpufreq-dt.c ++++ b/drivers/cpufreq/cpufreq-dt.c +@@ -208,7 +208,7 @@ static int dt_cpufreq_early_init(struct device *dev, int cpu) + if (!priv) + return -ENOMEM; + +- if (!alloc_cpumask_var(&priv->cpus, GFP_KERNEL)) ++ if (!zalloc_cpumask_var(&priv->cpus, GFP_KERNEL)) + return -ENOMEM; + + cpumask_set_cpu(cpu, priv->cpus); +-- +2.43.0 + diff --git a/queue-6.6/cpufreq-limit-resolving-a-frequency-to-policy-min-ma.patch b/queue-6.6/cpufreq-limit-resolving-a-frequency-to-policy-min-ma.patch new file mode 100644 index 00000000000..6c9a1f1d6aa --- /dev/null +++ b/queue-6.6/cpufreq-limit-resolving-a-frequency-to-policy-min-ma.patch @@ -0,0 +1,64 @@ +From 40b627c931de9d9d0d1ec4ba1e8beb076a225dc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 14:43:51 +0530 +Subject: cpufreq: Limit resolving a frequency to policy min/max + +From: Shivnandan Kumar + +[ Upstream commit d394abcb12bb1a6f309c1221fdb8e73594ecf1b4 ] + +Resolving a frequency to an efficient one should not transgress +policy->max (which can be set for thermal reason) and policy->min. + +Currently, there is possibility where scaling_cur_freq can exceed +scaling_max_freq when scaling_max_freq is an inefficient frequency. + +Add a check to ensure that resolving a frequency will respect +policy->min/max. + +Cc: All applicable +Fixes: 1f39fa0dccff ("cpufreq: Introducing CPUFREQ_RELATION_E") +Signed-off-by: Shivnandan Kumar +[ rjw: Whitespace adjustment, changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/linux/cpufreq.h | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h +index 71d186d6933a5..3a4cefb25ba61 100644 +--- a/include/linux/cpufreq.h ++++ b/include/linux/cpufreq.h +@@ -1021,6 +1021,18 @@ static inline int cpufreq_table_find_index_c(struct cpufreq_policy *policy, + efficiencies); + } + ++static inline bool cpufreq_is_in_limits(struct cpufreq_policy *policy, int idx) ++{ ++ unsigned int freq; ++ ++ if (idx < 0) ++ return false; ++ ++ freq = policy->freq_table[idx].frequency; ++ ++ return freq == clamp_val(freq, policy->min, policy->max); ++} ++ + static inline int cpufreq_frequency_table_target(struct cpufreq_policy *policy, + unsigned int target_freq, + unsigned int relation) +@@ -1054,7 +1066,8 @@ static inline int cpufreq_frequency_table_target(struct cpufreq_policy *policy, + return 0; + } + +- if (idx < 0 && efficiencies) { ++ /* Limit frequency index to honor policy->min/max */ ++ if (!cpufreq_is_in_limits(policy, idx) && efficiencies) { + efficiencies = false; + goto retry; + } +-- +2.43.0 + diff --git a/queue-6.6/crypto-qat-resolve-race-condition-during-aer-recover.patch b/queue-6.6/crypto-qat-resolve-race-condition-during-aer-recover.patch new file mode 100644 index 00000000000..42bdb99ded7 --- /dev/null +++ b/queue-6.6/crypto-qat-resolve-race-condition-during-aer-recover.patch @@ -0,0 +1,92 @@ +From 8d9599e2e1860370081e5516c9b59836ac40f4ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 13:43:42 +0100 +Subject: crypto: qat - resolve race condition during AER recovery + +From: Damian Muszynski + +[ Upstream commit 7d42e097607c4d246d99225bf2b195b6167a210c ] + +During the PCI AER system's error recovery process, the kernel driver +may encounter a race condition with freeing the reset_data structure's +memory. If the device restart will take more than 10 seconds the function +scheduling that restart will exit due to a timeout, and the reset_data +structure will be freed. However, this data structure is used for +completion notification after the restart is completed, which leads +to a UAF bug. + +This results in a KFENCE bug notice. + + BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat] + Use-after-free read at 0x00000000bc56fddf (in kfence-#142): + adf_device_reset_worker+0x38/0xa0 [intel_qat] + process_one_work+0x173/0x340 + +To resolve this race condition, the memory associated to the container +of the work_struct is freed on the worker if the timeout expired, +otherwise on the function that schedules the worker. +The timeout detection can be done by checking if the caller is +still waiting for completion or not by using completion_done() function. + +Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework") +Cc: +Signed-off-by: Damian Muszynski +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/qat/qat_common/adf_aer.c | 22 ++++++++++++++----- + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/intel/qat/qat_common/adf_aer.c b/drivers/crypto/intel/qat/qat_common/adf_aer.c +index a39e70bd4b21b..621d14ea3b81a 100644 +--- a/drivers/crypto/intel/qat/qat_common/adf_aer.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_aer.c +@@ -92,7 +92,8 @@ static void adf_device_reset_worker(struct work_struct *work) + if (adf_dev_restart(accel_dev)) { + /* The device hanged and we can't restart it so stop here */ + dev_err(&GET_DEV(accel_dev), "Restart device failed\n"); +- if (reset_data->mode == ADF_DEV_RESET_ASYNC) ++ if (reset_data->mode == ADF_DEV_RESET_ASYNC || ++ completion_done(&reset_data->compl)) + kfree(reset_data); + WARN(1, "QAT: device restart failed. Device is unusable\n"); + return; +@@ -100,11 +101,19 @@ static void adf_device_reset_worker(struct work_struct *work) + adf_dev_restarted_notify(accel_dev); + clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status); + +- /* The dev is back alive. Notify the caller if in sync mode */ +- if (reset_data->mode == ADF_DEV_RESET_SYNC) +- complete(&reset_data->compl); +- else ++ /* ++ * The dev is back alive. Notify the caller if in sync mode ++ * ++ * If device restart will take a more time than expected, ++ * the schedule_reset() function can timeout and exit. This can be ++ * detected by calling the completion_done() function. In this case ++ * the reset_data structure needs to be freed here. ++ */ ++ if (reset_data->mode == ADF_DEV_RESET_ASYNC || ++ completion_done(&reset_data->compl)) + kfree(reset_data); ++ else ++ complete(&reset_data->compl); + } + + static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev, +@@ -137,8 +146,9 @@ static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev, + dev_err(&GET_DEV(accel_dev), + "Reset device timeout expired\n"); + ret = -EFAULT; ++ } else { ++ kfree(reset_data); + } +- kfree(reset_data); + return ret; + } + return 0; +-- +2.43.0 + diff --git a/queue-6.6/cxl-trace-properly-initialize-cxl_poison-region-name.patch b/queue-6.6/cxl-trace-properly-initialize-cxl_poison-region-name.patch new file mode 100644 index 00000000000..f6d5feaa0b2 --- /dev/null +++ b/queue-6.6/cxl-trace-properly-initialize-cxl_poison-region-name.patch @@ -0,0 +1,89 @@ +From 9251464200d978433a0c450763e2ec5f7be55455 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 13:12:17 -0700 +Subject: cxl/trace: Properly initialize cxl_poison region name + +From: Alison Schofield + +[ Upstream commit 6c871260965255a1c142fb77ccee58b172d1690b ] + +The TP_STRUCT__entry that gets assigned the region name, or an +empty string if no region is present, is erroneously initialized +to the cxl_region pointer. It needs to be properly initialized +otherwise it's length is wrong and garbage chars can appear in +the kernel trace output: /sys/kernel/tracing/trace + +The bad initialization was due in part to a naming conflict with +the parameter: struct cxl_region *region. The field 'region' is +already exposed externally as the region name, so changing that +to something logical, like 'region_name' is not an option. Instead +rename the internal only struct cxl_region to the commonly used +'cxlr'. + +Impact is that tooling depending on that trace data can miss +picking up a valid event when searching by region name. The +TP_printk() output, if enabled, does emit the correct region +names in the dmesg log. + +This was found during testing of the cxl-list option to report +media-errors for a region. + +Cc: Davidlohr Bueso +Cc: Jonathan Cameron +Cc: Dave Jiang +Cc: Vishal Verma +Cc: stable@vger.kernel.org +Fixes: ddf49d57b841 ("cxl/trace: Add TRACE support for CXL media-error records") +Signed-off-by: Alison Schofield +Reviewed-by: Ira Weiny +Acked-by: Dan Williams +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/trace.h | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/cxl/core/trace.h b/drivers/cxl/core/trace.h +index a0b5819bc70b3..f01d0709c9c32 100644 +--- a/drivers/cxl/core/trace.h ++++ b/drivers/cxl/core/trace.h +@@ -642,18 +642,18 @@ u64 cxl_trace_hpa(struct cxl_region *cxlr, struct cxl_memdev *memdev, u64 dpa); + + TRACE_EVENT(cxl_poison, + +- TP_PROTO(struct cxl_memdev *cxlmd, struct cxl_region *region, ++ TP_PROTO(struct cxl_memdev *cxlmd, struct cxl_region *cxlr, + const struct cxl_poison_record *record, u8 flags, + __le64 overflow_ts, enum cxl_poison_trace_type trace_type), + +- TP_ARGS(cxlmd, region, record, flags, overflow_ts, trace_type), ++ TP_ARGS(cxlmd, cxlr, record, flags, overflow_ts, trace_type), + + TP_STRUCT__entry( + __string(memdev, dev_name(&cxlmd->dev)) + __string(host, dev_name(cxlmd->dev.parent)) + __field(u64, serial) + __field(u8, trace_type) +- __string(region, region) ++ __string(region, cxlr ? dev_name(&cxlr->dev) : "") + __field(u64, overflow_ts) + __field(u64, hpa) + __field(u64, dpa) +@@ -673,10 +673,10 @@ TRACE_EVENT(cxl_poison, + __entry->source = cxl_poison_record_source(record); + __entry->trace_type = trace_type; + __entry->flags = flags; +- if (region) { +- __assign_str(region, dev_name(®ion->dev)); +- memcpy(__entry->uuid, ®ion->params.uuid, 16); +- __entry->hpa = cxl_trace_hpa(region, cxlmd, ++ if (cxlr) { ++ __assign_str(region, dev_name(&cxlr->dev)); ++ memcpy(__entry->uuid, &cxlr->params.uuid, 16); ++ __entry->hpa = cxl_trace_hpa(cxlr, cxlmd, + __entry->dpa); + } else { + __assign_str(region, ""); +-- +2.43.0 + diff --git a/queue-6.6/dlm-fix-user-space-lkb-refcounting.patch b/queue-6.6/dlm-fix-user-space-lkb-refcounting.patch new file mode 100644 index 00000000000..86ef5f9731a --- /dev/null +++ b/queue-6.6/dlm-fix-user-space-lkb-refcounting.patch @@ -0,0 +1,66 @@ +From 0a0485c4b278968db53baa875063e498de6fd2a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 13:05:07 -0400 +Subject: dlm: fix user space lkb refcounting +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Aring + +[ Upstream commit 2ab3d705ca5d4f7ea345a21c3da41a447a549649 ] + +This patch fixes to check on the right return value if it was the last +callback. The rv variable got overwritten by the return of +copy_result_to_user(). Fixing it by introducing a second variable for +the return value and don't let rv being overwritten. + +Cc: stable@vger.kernel.org +Fixes: 61bed0baa4db ("fs: dlm: use a non-static queue for callbacks") +Reported-by: Valentin Vidić +Closes: https://lore.kernel.org/gfs2/Ze4qSvzGJDt5yxC3@valentin-vidic.from.hr +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/user.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/dlm/user.c b/fs/dlm/user.c +index 695e691b38b31..9f9b68448830e 100644 +--- a/fs/dlm/user.c ++++ b/fs/dlm/user.c +@@ -806,7 +806,7 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count, + struct dlm_lkb *lkb; + DECLARE_WAITQUEUE(wait, current); + struct dlm_callback *cb; +- int rv, copy_lvb = 0; ++ int rv, ret, copy_lvb = 0; + int old_mode, new_mode; + + if (count == sizeof(struct dlm_device_version)) { +@@ -906,9 +906,9 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count, + trace_dlm_ast(lkb->lkb_resource->res_ls, lkb); + } + +- rv = copy_result_to_user(lkb->lkb_ua, +- test_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags), +- cb->flags, cb->mode, copy_lvb, buf, count); ++ ret = copy_result_to_user(lkb->lkb_ua, ++ test_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags), ++ cb->flags, cb->mode, copy_lvb, buf, count); + + kref_put(&cb->ref, dlm_release_callback); + +@@ -916,7 +916,7 @@ static ssize_t device_read(struct file *file, char __user *buf, size_t count, + if (rv == DLM_DEQUEUE_CALLBACK_LAST) + dlm_put_lkb(lkb); + +- return rv; ++ return ret; + } + + static __poll_t device_poll(struct file *file, poll_table *wait) +-- +2.43.0 + diff --git a/queue-6.6/dm-raid-fix-lockdep-waring-in-pers-hot_add_disk.patch b/queue-6.6/dm-raid-fix-lockdep-waring-in-pers-hot_add_disk.patch new file mode 100644 index 00000000000..702758f911b --- /dev/null +++ b/queue-6.6/dm-raid-fix-lockdep-waring-in-pers-hot_add_disk.patch @@ -0,0 +1,49 @@ +From 03b6302b16568735c98c5658aefb1f39d76f4d79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 15:23:06 +0800 +Subject: dm-raid: fix lockdep waring in "pers->hot_add_disk" + +From: Yu Kuai + +[ Upstream commit 95009ae904b1e9dca8db6f649f2d7c18a6e42c75 ] + +The lockdep assert is added by commit a448af25becf ("md/raid10: remove +rcu protection to access rdev from conf") in print_conf(). And I didn't +notice that dm-raid is calling "pers->hot_add_disk" without holding +'reconfig_mutex'. + +"pers->hot_add_disk" read and write many fields that is protected by +'reconfig_mutex', and raid_resume() already grab the lock in other +contex. Hence fix this problem by protecting "pers->host_add_disk" +with the lock. + +Fixes: 9092c02d9435 ("DM RAID: Add ability to restore transiently failed devices on resume") +Fixes: a448af25becf ("md/raid10: remove rcu protection to access rdev from conf") +Cc: stable@vger.kernel.org # v6.7+ +Signed-off-by: Yu Kuai +Signed-off-by: Xiao Ni +Acked-by: Mike Snitzer +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240305072306.2562024-10-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/dm-raid.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index 3d8ee9eb59ea6..385e24f55ec00 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -4042,7 +4042,9 @@ static void raid_resume(struct dm_target *ti) + * Take this opportunity to check whether any failed + * devices are reachable again. + */ ++ mddev_lock_nointr(mddev); + attempt_restore_of_faulty_devices(rs); ++ mddev_unlock(mddev); + } + + if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags)) { +-- +2.43.0 + diff --git a/queue-6.6/dm-snapshot-fix-lockup-in-dm_exception_table_exit.patch b/queue-6.6/dm-snapshot-fix-lockup-in-dm_exception_table_exit.patch new file mode 100644 index 00000000000..02bd1d58236 --- /dev/null +++ b/queue-6.6/dm-snapshot-fix-lockup-in-dm_exception_table_exit.patch @@ -0,0 +1,40 @@ +From 466c692aeb78906f44b998250c9e39b3961311f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 18:43:11 +0100 +Subject: dm snapshot: fix lockup in dm_exception_table_exit + +From: Mikulas Patocka + +[ Upstream commit 6e7132ed3c07bd8a6ce3db4bb307ef2852b322dc ] + +There was reported lockup when we exit a snapshot with many exceptions. +Fix this by adding "cond_resched" to the loop that frees the exceptions. + +Reported-by: John Pittman +Cc: stable@vger.kernel.org +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-snap.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index bf7a574499a34..0ace06d1bee38 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -684,8 +684,10 @@ static void dm_exception_table_exit(struct dm_exception_table *et, + for (i = 0; i < size; i++) { + slot = et->table + i; + +- hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) ++ hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) { + kmem_cache_free(mem, ex); ++ cond_resched(); ++ } + } + + kvfree(et->table); +-- +2.43.0 + diff --git a/queue-6.6/docs-restore-smart-quotes-for-quotes.patch b/queue-6.6/docs-restore-smart-quotes-for-quotes.patch new file mode 100644 index 00000000000..c9f8899eeb1 --- /dev/null +++ b/queue-6.6/docs-restore-smart-quotes-for-quotes.patch @@ -0,0 +1,57 @@ +From 5ed1a3b1a62a8d3e108a4728c04fe9c4db397dc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Feb 2024 18:46:00 +0900 +Subject: docs: Restore "smart quotes" for quotes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Akira Yokosawa + +[ Upstream commit fe2562582bffe675721e77e00b3bf5bfa1d7aeab ] + +Commit eaae75754d81 ("docs: turn off "smart quotes" in the HTML build") +disabled conversion of quote marks along with that of dashes. +Despite the short summary, the change affects not only HTML build +but also other build targets including PDF. + +However, as "smart quotes" had been enabled for more than half a +decade already, quite a few readers of HTML pages are likely expecting +conversions of "foo" -> “foo” and 'bar' -> ‘bar’. + +Furthermore, in LaTeX typesetting convention, it is common to use +distinct marks for opening and closing quote marks. + +To satisfy such readers' expectation, restore conversion of quotes +only by setting smartquotes_action [1]. + +Link: [1] https://www.sphinx-doc.org/en/master/usage/configuration.html#confval-smartquotes_action +Cc: stable@vger.kernel.org # v6.4 +Signed-off-by: Akira Yokosawa +Signed-off-by: Jonathan Corbet +Link: https://lore.kernel.org/r/20240225094600.65628-1-akiyks@gmail.com +Signed-off-by: Sasha Levin +--- + Documentation/conf.py | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/Documentation/conf.py b/Documentation/conf.py +index dfc19c915d5c4..e385e24fe9e72 100644 +--- a/Documentation/conf.py ++++ b/Documentation/conf.py +@@ -345,9 +345,9 @@ sys.stderr.write("Using %s theme\n" % html_theme) + html_static_path = ['sphinx-static'] + + # If true, Docutils "smart quotes" will be used to convert quotes and dashes +-# to typographically correct entities. This will convert "--" to "—", +-# which is not always what we want, so disable it. +-smartquotes = False ++# to typographically correct entities. However, conversion of "--" to "—" ++# is not always what we want, so enable only quotes. ++smartquotes_action = 'q' + + # Custom sidebar templates, maps document names to template names. + # Note that the RTD theme ignores this +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-fix-noise-issue-on-hdmi-av-mute.patch b/queue-6.6/drm-amd-display-fix-noise-issue-on-hdmi-av-mute.patch new file mode 100644 index 00000000000..8002e84d9a8 --- /dev/null +++ b/queue-6.6/drm-amd-display-fix-noise-issue-on-hdmi-av-mute.patch @@ -0,0 +1,59 @@ +From a87146549dfa817f926ae3b01b9abcf9d791d315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 08:35:07 -0400 +Subject: drm/amd/display: Fix noise issue on HDMI AV mute + +From: Leo Ma + +[ Upstream commit 69e3be6893a7e668660b05a966bead82bbddb01d ] + +[Why] +When mode switching is triggered there is momentary noise visible on +some HDMI TV or displays. + +[How] +Wait for 2 frames to make sure we have enough time to send out AV mute +and sink receives a full frame. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Reviewed-by: Wenjing Liu +Acked-by: Wayne Lin +Signed-off-by: Leo Ma +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +index 255713ec29bb0..ba47a1c8eec10 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +@@ -619,10 +619,20 @@ void dcn30_set_avmute(struct pipe_ctx *pipe_ctx, bool enable) + if (pipe_ctx == NULL) + return; + +- if (dc_is_hdmi_signal(pipe_ctx->stream->signal) && pipe_ctx->stream_res.stream_enc != NULL) ++ if (dc_is_hdmi_signal(pipe_ctx->stream->signal) && pipe_ctx->stream_res.stream_enc != NULL) { + pipe_ctx->stream_res.stream_enc->funcs->set_avmute( + pipe_ctx->stream_res.stream_enc, + enable); ++ ++ /* Wait for two frame to make sure AV mute is sent out */ ++ if (enable) { ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ } ++ } + } + + void dcn30_update_info_frame(struct pipe_ctx *pipe_ctx) +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-return-the-correct-hdcp-error-code.patch b/queue-6.6/drm-amd-display-return-the-correct-hdcp-error-code.patch new file mode 100644 index 00000000000..c42d0290f7c --- /dev/null +++ b/queue-6.6/drm-amd-display-return-the-correct-hdcp-error-code.patch @@ -0,0 +1,42 @@ +From 513cdb6bc0ed59e85a75fb23ba2b2acc55961543 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 13:29:51 -0700 +Subject: drm/amd/display: Return the correct HDCP error code + +From: Rodrigo Siqueira + +[ Upstream commit e64b3f55e458ce7e2087a0051f47edabf74545e7 ] + +[WHY & HOW] +If the display is null when creating an HDCP session, return a proper +error code. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Acked-by: Alex Hung +Signed-off-by: Rodrigo Siqueira +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c +index ee67a35c2a8ed..ff930a71e496a 100644 +--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c ++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c +@@ -513,6 +513,9 @@ enum mod_hdcp_status mod_hdcp_hdcp2_create_session(struct mod_hdcp *hdcp) + hdcp_cmd = (struct ta_hdcp_shared_memory *)psp->hdcp_context.context.mem_context.shared_buf; + memset(hdcp_cmd, 0, sizeof(struct ta_hdcp_shared_memory)); + ++ if (!display) ++ return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND; ++ + hdcp_cmd->in_msg.hdcp2_create_session_v2.display_handle = display->index; + + if (hdcp->connection.link.adjust.hdcp2.force_type == MOD_HDCP_FORCE_TYPE_0) +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch b/queue-6.6/drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch new file mode 100644 index 00000000000..e0108a42bee --- /dev/null +++ b/queue-6.6/drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch @@ -0,0 +1,42 @@ +From 05742ff1d75a7bb4f9a7f8cd7685104987ccf135 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 18:07:34 -0400 +Subject: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philip Yang + +[ Upstream commit 6c6064cbe58b43533e3451ad6a8ba9736c109ac3 ] + +Otherwise after the GTT bo is released, the GTT and gart space is freed +but amdgpu_ttm_backend_unbind will not clear the gart page table entry +and leave valid mapping entry pointing to the stale system page. Then +if GPU access the gart address mistakely, it will read undefined value +instead page fault, harder to debug and reproduce the real issue. + +Cc: stable@vger.kernel.org +Signed-off-by: Philip Yang +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index f573909332c01..928107d0bfea4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -869,6 +869,7 @@ static void amdgpu_ttm_gart_bind(struct amdgpu_device *adev, + amdgpu_gart_bind(adev, gtt->offset, ttm->num_pages, + gtt->ttm.dma_address, flags); + } ++ gtt->bound = true; + } + + /* +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-add-edid_read-hook-and-drm_bridge_edid_re.patch b/queue-6.6/drm-bridge-add-edid_read-hook-and-drm_bridge_edid_re.patch new file mode 100644 index 00000000000..14bf627b5c8 --- /dev/null +++ b/queue-6.6/drm-bridge-add-edid_read-hook-and-drm_bridge_edid_re.patch @@ -0,0 +1,150 @@ +From a1341861ae08e2f732cb413c81d4c142a8f46e84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 21:37:07 +0200 +Subject: drm/bridge: add ->edid_read hook and drm_bridge_edid_read() + +From: Jani Nikula + +[ Upstream commit d807ad80d811ba0c22adfd871e2a46491f80d6e2 ] + +Add new struct drm_edid based ->edid_read hook and +drm_bridge_edid_read() function to call the hook. + +v2: Include drm/drm_edid.h + +Signed-off-by: Jani Nikula +Reviewed-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/9d08d22eaffcb9c59a2b677e45d7e61fc689bc2f.1706038510.git.jani.nikula@intel.com +Stable-dep-of: 171b711b26cc ("drm/bridge: lt8912b: do not return negative values from .get_modes()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_bridge.c | 46 +++++++++++++++++++++++++++++++++++- + include/drm/drm_bridge.h | 33 ++++++++++++++++++++++++++ + 2 files changed, 78 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c +index 39e68e45bb124..67354afbd7168 100644 +--- a/drivers/gpu/drm/drm_bridge.c ++++ b/drivers/gpu/drm/drm_bridge.c +@@ -27,8 +27,9 @@ + #include + + #include +-#include + #include ++#include ++#include + #include + #include + #include +@@ -1206,6 +1207,47 @@ int drm_bridge_get_modes(struct drm_bridge *bridge, + } + EXPORT_SYMBOL_GPL(drm_bridge_get_modes); + ++/** ++ * drm_bridge_edid_read - read the EDID data of the connected display ++ * @bridge: bridge control structure ++ * @connector: the connector to read EDID for ++ * ++ * If the bridge supports output EDID retrieval, as reported by the ++ * DRM_BRIDGE_OP_EDID bridge ops flag, call &drm_bridge_funcs.edid_read to get ++ * the EDID and return it. Otherwise return NULL. ++ * ++ * If &drm_bridge_funcs.edid_read is not set, fall back to using ++ * drm_bridge_get_edid() and wrapping it in struct drm_edid. ++ * ++ * RETURNS: ++ * The retrieved EDID on success, or NULL otherwise. ++ */ ++const struct drm_edid *drm_bridge_edid_read(struct drm_bridge *bridge, ++ struct drm_connector *connector) ++{ ++ if (!(bridge->ops & DRM_BRIDGE_OP_EDID)) ++ return NULL; ++ ++ /* Transitional: Fall back to ->get_edid. */ ++ if (!bridge->funcs->edid_read) { ++ const struct drm_edid *drm_edid; ++ struct edid *edid; ++ ++ edid = drm_bridge_get_edid(bridge, connector); ++ if (!edid) ++ return NULL; ++ ++ drm_edid = drm_edid_alloc(edid, (edid->extensions + 1) * EDID_LENGTH); ++ ++ kfree(edid); ++ ++ return drm_edid; ++ } ++ ++ return bridge->funcs->edid_read(bridge, connector); ++} ++EXPORT_SYMBOL_GPL(drm_bridge_edid_read); ++ + /** + * drm_bridge_get_edid - get the EDID data of the connected display + * @bridge: bridge control structure +@@ -1215,6 +1257,8 @@ EXPORT_SYMBOL_GPL(drm_bridge_get_modes); + * DRM_BRIDGE_OP_EDID bridge ops flag, call &drm_bridge_funcs.get_edid to + * get the EDID and return it. Otherwise return NULL. + * ++ * Deprecated. Prefer using drm_bridge_edid_read(). ++ * + * RETURNS: + * The retrieved EDID on success, or NULL otherwise. + */ +diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h +index 103ff57fc83cf..b20cfe5bf30b3 100644 +--- a/include/drm/drm_bridge.h ++++ b/include/drm/drm_bridge.h +@@ -555,6 +555,37 @@ struct drm_bridge_funcs { + int (*get_modes)(struct drm_bridge *bridge, + struct drm_connector *connector); + ++ /** ++ * @edid_read: ++ * ++ * Read the EDID data of the connected display. ++ * ++ * The @edid_read callback is the preferred way of reporting mode ++ * information for a display connected to the bridge output. Bridges ++ * that support reading EDID shall implement this callback and leave ++ * the @get_modes callback unimplemented. ++ * ++ * The caller of this operation shall first verify the output ++ * connection status and refrain from reading EDID from a disconnected ++ * output. ++ * ++ * This callback is optional. Bridges that implement it shall set the ++ * DRM_BRIDGE_OP_EDID flag in their &drm_bridge->ops. ++ * ++ * The connector parameter shall be used for the sole purpose of EDID ++ * retrieval, and shall not be stored internally by bridge drivers for ++ * future usage. ++ * ++ * RETURNS: ++ * ++ * An edid structure newly allocated with drm_edid_alloc() or returned ++ * from drm_edid_read() family of functions on success, or NULL ++ * otherwise. The caller is responsible for freeing the returned edid ++ * structure with drm_edid_free(). ++ */ ++ const struct drm_edid *(*edid_read)(struct drm_bridge *bridge, ++ struct drm_connector *connector); ++ + /** + * @get_edid: + * +@@ -888,6 +919,8 @@ drm_atomic_helper_bridge_propagate_bus_fmt(struct drm_bridge *bridge, + enum drm_connector_status drm_bridge_detect(struct drm_bridge *bridge); + int drm_bridge_get_modes(struct drm_bridge *bridge, + struct drm_connector *connector); ++const struct drm_edid *drm_bridge_edid_read(struct drm_bridge *bridge, ++ struct drm_connector *connector); + struct edid *drm_bridge_get_edid(struct drm_bridge *bridge, + struct drm_connector *connector); + void drm_bridge_hpd_enable(struct drm_bridge *bridge, +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-lt8912b-clear-the-edid-property-on-failur.patch b/queue-6.6/drm-bridge-lt8912b-clear-the-edid-property-on-failur.patch new file mode 100644 index 00000000000..e522fdaf000 --- /dev/null +++ b/queue-6.6/drm-bridge-lt8912b-clear-the-edid-property-on-failur.patch @@ -0,0 +1,44 @@ +From 09f4a06cce880f07895715181a385076b8d1a05a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 21:37:11 +0200 +Subject: drm/bridge: lt8912b: clear the EDID property on failures + +From: Jani Nikula + +[ Upstream commit 29e032296da5d6294378ffa8bad8e976c5aadbf5 ] + +If EDID read fails, clear the EDID property. + +Cc: Adrien Grassein +Cc: Andrzej Hajda +Cc: Neil Armstrong +Cc: Robert Foss +Cc: Laurent Pinchart +Cc: Jonas Karlman +Cc: Jernej Skrabec +Signed-off-by: Jani Nikula +Reviewed-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/2080adaadf4bba3d85f58c42c065caf9aad9a4ef.1706038510.git.jani.nikula@intel.com +Stable-dep-of: 171b711b26cc ("drm/bridge: lt8912b: do not return negative values from .get_modes()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt8912b.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c +index 491c08306f81a..f0ebd56b4736a 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c ++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c +@@ -436,8 +436,8 @@ static int lt8912_connector_get_modes(struct drm_connector *connector) + u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24; + + drm_edid = drm_bridge_edid_read(lt->hdmi_port, connector); ++ drm_edid_connector_update(connector, drm_edid); + if (drm_edid) { +- drm_edid_connector_update(connector, drm_edid); + num = drm_edid_connector_add_modes(connector); + } else { + return ret; +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-lt8912b-do-not-return-negative-values-fro.patch b/queue-6.6/drm-bridge-lt8912b-do-not-return-negative-values-fro.patch new file mode 100644 index 00000000000..9bfe163b290 --- /dev/null +++ b/queue-6.6/drm-bridge-lt8912b-do-not-return-negative-values-fro.patch @@ -0,0 +1,60 @@ +From ec4fa6a2d82528b3e5aa53f01ca0b1daa03f26e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:42 +0200 +Subject: drm/bridge: lt8912b: do not return negative values from .get_modes() + +From: Jani Nikula + +[ Upstream commit 171b711b26cce208bb628526b1b368aeec7b6fa4 ] + +The .get_modes() hooks aren't supposed to return negative error +codes. Return 0 for no modes, whatever the reason. + +Cc: Adrien Grassein +Cc: stable@vger.kernel.org +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/dcdddcbcb64b6f6cdc55022ee50c10dee8ddbc3d.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt8912b.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c +index f0ebd56b4736a..e5839c89a355a 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c ++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c +@@ -430,23 +430,21 @@ lt8912_connector_mode_valid(struct drm_connector *connector, + static int lt8912_connector_get_modes(struct drm_connector *connector) + { + const struct drm_edid *drm_edid; +- int ret = -1; +- int num = 0; + struct lt8912 *lt = connector_to_lt8912(connector); + u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24; ++ int ret, num; + + drm_edid = drm_bridge_edid_read(lt->hdmi_port, connector); + drm_edid_connector_update(connector, drm_edid); +- if (drm_edid) { +- num = drm_edid_connector_add_modes(connector); +- } else { +- return ret; +- } ++ if (!drm_edid) ++ return 0; ++ ++ num = drm_edid_connector_add_modes(connector); + + ret = drm_display_info_set_bus_formats(&connector->display_info, + &bus_format, 1); +- if (ret) +- num = ret; ++ if (ret < 0) ++ num = 0; + + drm_edid_free(drm_edid); + return num; +-- +2.43.0 + diff --git a/queue-6.6/drm-bridge-lt8912b-use-drm_bridge_edid_read.patch b/queue-6.6/drm-bridge-lt8912b-use-drm_bridge_edid_read.patch new file mode 100644 index 00000000000..3aeed9ce963 --- /dev/null +++ b/queue-6.6/drm-bridge-lt8912b-use-drm_bridge_edid_read.patch @@ -0,0 +1,65 @@ +From 2f7e492f1b0b9f5ebd16e46304c6b44a356065ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 21:37:10 +0200 +Subject: drm/bridge: lt8912b: use drm_bridge_edid_read() + +From: Jani Nikula + +[ Upstream commit 60d1fe1a7f302cc1151b155ac2d134db59bb1420 ] + +Prefer using the struct drm_edid based functions. + +cc: Adrien Grassein +Cc: Andrzej Hajda +Cc: Neil Armstrong +Cc: Robert Foss +Cc: Laurent Pinchart +Cc: Jonas Karlman +Cc: Jernej Skrabec +Signed-off-by: Jani Nikula +Reviewed-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/32c9b52fe6fa7cbad6bfd0ff00041876977e02ea.1706038510.git.jani.nikula@intel.com +Stable-dep-of: 171b711b26cc ("drm/bridge: lt8912b: do not return negative values from .get_modes()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt8912b.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt8912b.c b/drivers/gpu/drm/bridge/lontium-lt8912b.c +index 03532efb893bb..491c08306f81a 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt8912b.c ++++ b/drivers/gpu/drm/bridge/lontium-lt8912b.c +@@ -429,16 +429,16 @@ lt8912_connector_mode_valid(struct drm_connector *connector, + + static int lt8912_connector_get_modes(struct drm_connector *connector) + { +- struct edid *edid; ++ const struct drm_edid *drm_edid; + int ret = -1; + int num = 0; + struct lt8912 *lt = connector_to_lt8912(connector); + u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24; + +- edid = drm_bridge_get_edid(lt->hdmi_port, connector); +- if (edid) { +- drm_connector_update_edid_property(connector, edid); +- num = drm_add_edid_modes(connector, edid); ++ drm_edid = drm_bridge_edid_read(lt->hdmi_port, connector); ++ if (drm_edid) { ++ drm_edid_connector_update(connector, drm_edid); ++ num = drm_edid_connector_add_modes(connector); + } else { + return ret; + } +@@ -448,7 +448,7 @@ static int lt8912_connector_get_modes(struct drm_connector *connector) + if (ret) + num = ret; + +- kfree(edid); ++ drm_edid_free(drm_edid); + return num; + } + +-- +2.43.0 + diff --git a/queue-6.6/drm-etnaviv-restore-some-id-values.patch b/queue-6.6/drm-etnaviv-restore-some-id-values.patch new file mode 100644 index 00000000000..533ad4e9db9 --- /dev/null +++ b/queue-6.6/drm-etnaviv-restore-some-id-values.patch @@ -0,0 +1,75 @@ +From bf50f35d08c7a0172eb01e062ecac4cf262d911b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 14:28:11 +0100 +Subject: drm/etnaviv: Restore some id values + +From: Christian Gmeiner + +[ Upstream commit b735ee173f84d5d0d0733c53946a83c12d770d05 ] + +The hwdb selection logic as a feature that allows it to mark some fields +as 'don't care'. If we match with such a field we memcpy(..) +the current etnaviv_chip_identity into ident. + +This step can overwrite some id values read from the GPU with the +'don't care' value. + +Fix this issue by restoring the affected values after the memcpy(..). + +As this is crucial for user space to know when this feature works as +expected increment the minor version too. + +Fixes: 4078a1186dd3 ("drm/etnaviv: update hwdb selection logic") +Cc: stable@vger.kernel.org +Signed-off-by: Christian Gmeiner +Reviewed-by: Tomeu Vizoso +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_drv.c | 2 +- + drivers/gpu/drm/etnaviv/etnaviv_hwdb.c | 9 +++++++++ + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c +index a8d3fa81e4ec5..f9bc837e22bdd 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c +@@ -494,7 +494,7 @@ static const struct drm_driver etnaviv_drm_driver = { + .desc = "etnaviv DRM", + .date = "20151214", + .major = 1, +- .minor = 3, ++ .minor = 4, + }; + + /* +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c b/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c +index 67201242438be..8665f2658d51b 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c +@@ -265,6 +265,9 @@ static const struct etnaviv_chip_identity etnaviv_chip_identities[] = { + bool etnaviv_fill_identity_from_hwdb(struct etnaviv_gpu *gpu) + { + struct etnaviv_chip_identity *ident = &gpu->identity; ++ const u32 product_id = ident->product_id; ++ const u32 customer_id = ident->customer_id; ++ const u32 eco_id = ident->eco_id; + int i; + + for (i = 0; i < ARRAY_SIZE(etnaviv_chip_identities); i++) { +@@ -278,6 +281,12 @@ bool etnaviv_fill_identity_from_hwdb(struct etnaviv_gpu *gpu) + etnaviv_chip_identities[i].eco_id == ~0U)) { + memcpy(ident, &etnaviv_chip_identities[i], + sizeof(*ident)); ++ ++ /* Restore some id values as ~0U aka 'don't care' might been used. */ ++ ident->product_id = product_id; ++ ident->customer_id = customer_id; ++ ident->eco_id = eco_id; ++ + return true; + } + } +-- +2.43.0 + diff --git a/queue-6.6/drm-exynos-do-not-return-negative-values-from-.get_m.patch b/queue-6.6/drm-exynos-do-not-return-negative-values-from-.get_m.patch new file mode 100644 index 00000000000..c48af8d5f68 --- /dev/null +++ b/queue-6.6/drm-exynos-do-not-return-negative-values-from-.get_m.patch @@ -0,0 +1,67 @@ +From ae6683afd04e5e32d311b9b4926055709d7f39a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:41 +0200 +Subject: drm/exynos: do not return negative values from .get_modes() + +From: Jani Nikula + +[ Upstream commit 13d5b040363c7ec0ac29c2de9cf661a24a8aa531 ] + +The .get_modes() hooks aren't supposed to return negative error +codes. Return 0 for no modes, whatever the reason. + +Cc: Inki Dae +Cc: Seung-Woo Kim +Cc: Kyungmin Park +Cc: stable@vger.kernel.org +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/d8665f620d9c252aa7d5a4811ff6b16e773903a2.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_vidi.c | 4 ++-- + drivers/gpu/drm/exynos/exynos_hdmi.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c +index f5e1adfcaa514..fb941a8c99f0f 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c +@@ -316,14 +316,14 @@ static int vidi_get_modes(struct drm_connector *connector) + */ + if (!ctx->raw_edid) { + DRM_DEV_DEBUG_KMS(ctx->dev, "raw_edid is null.\n"); +- return -EFAULT; ++ return 0; + } + + edid_len = (1 + ctx->raw_edid->extensions) * EDID_LENGTH; + edid = kmemdup(ctx->raw_edid, edid_len, GFP_KERNEL); + if (!edid) { + DRM_DEV_DEBUG_KMS(ctx->dev, "failed to allocate edid\n"); +- return -ENOMEM; ++ return 0; + } + + drm_connector_update_edid_property(connector, edid); +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index dd9903eab563e..eff51bfc46440 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -887,11 +887,11 @@ static int hdmi_get_modes(struct drm_connector *connector) + int ret; + + if (!hdata->ddc_adpt) +- return -ENODEV; ++ return 0; + + edid = drm_get_edid(connector, hdata->ddc_adpt); + if (!edid) +- return -ENODEV; ++ return 0; + + hdata->dvi_mode = !connector->display_info.is_hdmi; + DRM_DEV_DEBUG_KMS(hdata->dev, "%s : width[%d] x height[%d]\n", +-- +2.43.0 + diff --git a/queue-6.6/drm-i915-add-missing-to-__assign_str-macros-in-trace.patch b/queue-6.6/drm-i915-add-missing-to-__assign_str-macros-in-trace.patch new file mode 100644 index 00000000000..9ade720495d --- /dev/null +++ b/queue-6.6/drm-i915-add-missing-to-__assign_str-macros-in-trace.patch @@ -0,0 +1,65 @@ +From fafa9a553f0ad1fcc9cba62182a7dbc29fe5cbab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 13:30:57 -0500 +Subject: drm/i915: Add missing ; to __assign_str() macros in tracepoint code +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steven Rostedt (Google) + +[ Upstream commit 0df4c388a1e310400a6e90fb10b286e2673756f0 ] + +I'm working on improving the __assign_str() and __string() macros to be +more efficient, and removed some unneeded semicolons. This triggered a bug +in the build as some of the __assign_str() macros in intel_display_trace +was missing a terminating semicolon. + +Link: https://lore.kernel.org/linux-trace-kernel/20240222133057.2af72a19@gandalf.local.home + +Cc: Daniel Vetter +Cc: David Airlie +Cc: stable@vger.kernel.org +Fixes: 2ceea5d88048b ("drm/i915: Print plane name in fbc tracepoints") +Reviewed-by: Ville Syrjälä +Acked-by: Rodrigo Vivi +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_display_trace.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display_trace.h b/drivers/gpu/drm/i915/display/intel_display_trace.h +index 99bdb833591ce..7862e7cefe027 100644 +--- a/drivers/gpu/drm/i915/display/intel_display_trace.h ++++ b/drivers/gpu/drm/i915/display/intel_display_trace.h +@@ -411,7 +411,7 @@ TRACE_EVENT(intel_fbc_activate, + struct intel_crtc *crtc = intel_crtc_for_pipe(to_i915(plane->base.dev), + plane->pipe); + __assign_str(dev, __dev_name_kms(plane)); +- __assign_str(name, plane->base.name) ++ __assign_str(name, plane->base.name); + __entry->pipe = crtc->pipe; + __entry->frame = intel_crtc_get_vblank_counter(crtc); + __entry->scanline = intel_get_crtc_scanline(crtc); +@@ -438,7 +438,7 @@ TRACE_EVENT(intel_fbc_deactivate, + struct intel_crtc *crtc = intel_crtc_for_pipe(to_i915(plane->base.dev), + plane->pipe); + __assign_str(dev, __dev_name_kms(plane)); +- __assign_str(name, plane->base.name) ++ __assign_str(name, plane->base.name); + __entry->pipe = crtc->pipe; + __entry->frame = intel_crtc_get_vblank_counter(crtc); + __entry->scanline = intel_get_crtc_scanline(crtc); +@@ -465,7 +465,7 @@ TRACE_EVENT(intel_fbc_nuke, + struct intel_crtc *crtc = intel_crtc_for_pipe(to_i915(plane->base.dev), + plane->pipe); + __assign_str(dev, __dev_name_kms(plane)); +- __assign_str(name, plane->base.name) ++ __assign_str(name, plane->base.name); + __entry->pipe = crtc->pipe; + __entry->frame = intel_crtc_get_vblank_counter(crtc); + __entry->scanline = intel_get_crtc_scanline(crtc); +-- +2.43.0 + diff --git a/queue-6.6/drm-imx-ipuv3-do-not-return-negative-values-from-.ge.patch b/queue-6.6/drm-imx-ipuv3-do-not-return-negative-values-from-.ge.patch new file mode 100644 index 00000000000..1aae9f58b04 --- /dev/null +++ b/queue-6.6/drm-imx-ipuv3-do-not-return-negative-values-from-.ge.patch @@ -0,0 +1,47 @@ +From 60d0d52c97777207a21040a1ec24dc007a634e8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:43 +0200 +Subject: drm/imx/ipuv3: do not return negative values from .get_modes() + +From: Jani Nikula + +[ Upstream commit c2da9ada64962fcd2e6395ed9987b9874ea032d3 ] + +The .get_modes() hooks aren't supposed to return negative error +codes. Return 0 for no modes, whatever the reason. + +Cc: Philipp Zabel +Cc: stable@vger.kernel.org +Acked-by: Philipp Zabel +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/311f6eec96d47949b16a670529f4d89fcd97aefa.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/ipuv3/parallel-display.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/imx/ipuv3/parallel-display.c b/drivers/gpu/drm/imx/ipuv3/parallel-display.c +index 0fa0b590830b6..c62df2557dc65 100644 +--- a/drivers/gpu/drm/imx/ipuv3/parallel-display.c ++++ b/drivers/gpu/drm/imx/ipuv3/parallel-display.c +@@ -72,14 +72,14 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) + int ret; + + if (!mode) +- return -EINVAL; ++ return 0; + + ret = of_get_drm_display_mode(np, &imxpd->mode, + &imxpd->bus_flags, + OF_USE_NATIVE_MODE); + if (ret) { + drm_mode_destroy(connector->dev, mode); +- return ret; ++ return 0; + } + + drm_mode_copy(mode, &imxpd->mode); +-- +2.43.0 + diff --git a/queue-6.6/drm-panel-do-not-return-negative-error-codes-from-dr.patch b/queue-6.6/drm-panel-do-not-return-negative-error-codes-from-dr.patch new file mode 100644 index 00000000000..32666866e74 --- /dev/null +++ b/queue-6.6/drm-panel-do-not-return-negative-error-codes-from-dr.patch @@ -0,0 +1,74 @@ +From 67d70d5325ab9067b6c37ce08ad5f670d21cfbc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:40 +0200 +Subject: drm/panel: do not return negative error codes from + drm_panel_get_modes() + +From: Jani Nikula + +[ Upstream commit fc4e97726530241d96dd7db72eb65979217422c9 ] + +None of the callers of drm_panel_get_modes() expect it to return +negative error codes. Either they propagate the return value in their +struct drm_connector_helper_funcs .get_modes() hook (which is also not +supposed to return negative codes), or add it to other counts leading to +bogus values. + +On the other hand, many of the struct drm_panel_funcs .get_modes() hooks +do return negative error codes, so handle them gracefully instead of +propagating further. + +Return 0 for no modes, whatever the reason. + +Cc: Neil Armstrong +Cc: Jessica Zhang +Cc: Sam Ravnborg +Cc: stable@vger.kernel.org +Reviewed-by: Neil Armstrong +Reviewed-by: Jessica Zhang +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/79f559b72d8c493940417304e222a4b04dfa19c4.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c +index e814020bbcd3b..cfbe020de54e0 100644 +--- a/drivers/gpu/drm/drm_panel.c ++++ b/drivers/gpu/drm/drm_panel.c +@@ -274,19 +274,24 @@ EXPORT_SYMBOL(drm_panel_disable); + * The modes probed from the panel are automatically added to the connector + * that the panel is attached to. + * +- * Return: The number of modes available from the panel on success or a +- * negative error code on failure. ++ * Return: The number of modes available from the panel on success, or 0 on ++ * failure (no modes). + */ + int drm_panel_get_modes(struct drm_panel *panel, + struct drm_connector *connector) + { + if (!panel) +- return -EINVAL; ++ return 0; + +- if (panel->funcs && panel->funcs->get_modes) +- return panel->funcs->get_modes(panel, connector); ++ if (panel->funcs && panel->funcs->get_modes) { ++ int num; + +- return -EOPNOTSUPP; ++ num = panel->funcs->get_modes(panel, connector); ++ if (num > 0) ++ return num; ++ } ++ ++ return 0; + } + EXPORT_SYMBOL(drm_panel_get_modes); + +-- +2.43.0 + diff --git a/queue-6.6/drm-probe-helper-warn-about-negative-.get_modes.patch b/queue-6.6/drm-probe-helper-warn-about-negative-.get_modes.patch new file mode 100644 index 00000000000..40cabbc7050 --- /dev/null +++ b/queue-6.6/drm-probe-helper-warn-about-negative-.get_modes.patch @@ -0,0 +1,61 @@ +From c09e107863d915fa4bcda303126add7a7506f75a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:39 +0200 +Subject: drm/probe-helper: warn about negative .get_modes() + +From: Jani Nikula + +[ Upstream commit 7af03e688792293ba33149fb8df619a8dff90e80 ] + +The .get_modes() callback is supposed to return the number of modes, +never a negative error code. If a negative value is returned, it'll just +be interpreted as a negative count, and added to previous calculations. + +Document the rules, but handle the negative values gracefully with an +error message. + +Cc: stable@vger.kernel.org +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/50208c866facc33226a3c77b82bb96aeef8ef310.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_probe_helper.c | 7 +++++++ + include/drm/drm_modeset_helper_vtables.h | 3 ++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index 3f479483d7d80..15ed974bcb988 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -419,6 +419,13 @@ static int drm_helper_probe_get_modes(struct drm_connector *connector) + + count = connector_funcs->get_modes(connector); + ++ /* The .get_modes() callback should not return negative values. */ ++ if (count < 0) { ++ drm_err(connector->dev, ".get_modes() returned %pe\n", ++ ERR_PTR(count)); ++ count = 0; ++ } ++ + /* + * Fallback for when DDC probe failed in drm_get_edid() and thus skipped + * override/firmware EDID. +diff --git a/include/drm/drm_modeset_helper_vtables.h b/include/drm/drm_modeset_helper_vtables.h +index e3c3ac6159094..159213786e6e1 100644 +--- a/include/drm/drm_modeset_helper_vtables.h ++++ b/include/drm/drm_modeset_helper_vtables.h +@@ -898,7 +898,8 @@ struct drm_connector_helper_funcs { + * + * RETURNS: + * +- * The number of modes added by calling drm_mode_probed_add(). ++ * The number of modes added by calling drm_mode_probed_add(). Return 0 ++ * on failures (no modes) instead of negative error codes. + */ + int (*get_modes)(struct drm_connector *connector); + +-- +2.43.0 + diff --git a/queue-6.6/drm-ttm-make-sure-the-mapped-tt-pages-are-decrypted-.patch b/queue-6.6/drm-ttm-make-sure-the-mapped-tt-pages-are-decrypted-.patch new file mode 100644 index 00000000000..ba1d89675ed --- /dev/null +++ b/queue-6.6/drm-ttm-make-sure-the-mapped-tt-pages-are-decrypted-.patch @@ -0,0 +1,163 @@ +From 0360b23b949b965f81569f2cceb6e06d8bafe61c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 08:51:05 -0500 +Subject: drm/ttm: Make sure the mapped tt pages are decrypted when needed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zack Rusin + +[ Upstream commit 71ce046327cfd3aef3f93d1c44e091395eb03f8f ] + +Some drivers require the mapped tt pages to be decrypted. In an ideal +world this would have been handled by the dma layer, but the TTM page +fault handling would have to be rewritten to able to do that. + +A side-effect of the TTM page fault handling is using a dma allocation +per order (via ttm_pool_alloc_page) which makes it impossible to just +trivially use dma_mmap_attrs. As a result ttm has to be very careful +about trying to make its pgprot for the mapped tt pages match what +the dma layer thinks it is. At the ttm layer it's possible to +deduce the requirement to have tt pages decrypted by checking +whether coherent dma allocations have been requested and the system +is running with confidential computing technologies. + +This approach isn't ideal but keeping TTM matching DMAs expectations +for the page properties is in general fragile, unfortunately proper +fix would require a rewrite of TTM's page fault handling. + +Fixes vmwgfx with SEV enabled. + +v2: Explicitly include cc_platform.h +v3: Use CC_ATTR_GUEST_MEM_ENCRYPT instead of CC_ATTR_MEM_ENCRYPT to +limit the scope to guests and log when memory decryption is enabled. + +Signed-off-by: Zack Rusin +Fixes: 3bf3710e3718 ("drm/ttm: Add a generic TTM memcpy move for page-based iomem") +Reviewed-by: Thomas Hellström +Acked-by: Christian König +Cc: Huang Rui +Cc: dri-devel@lists.freedesktop.org +Cc: linux-kernel@vger.kernel.org +Cc: # v5.14+ +Link: https://patchwork.freedesktop.org/patch/msgid/20230926040359.3040017-1-zack@kde.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_bo_util.c | 13 +++++++++++-- + drivers/gpu/drm/ttm/ttm_tt.c | 13 +++++++++++++ + include/drm/ttm/ttm_tt.h | 9 ++++++++- + 3 files changed, 32 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c +index fd9fd3d15101c..0b3f4267130c4 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo_util.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c +@@ -294,7 +294,13 @@ pgprot_t ttm_io_prot(struct ttm_buffer_object *bo, struct ttm_resource *res, + enum ttm_caching caching; + + man = ttm_manager_type(bo->bdev, res->mem_type); +- caching = man->use_tt ? bo->ttm->caching : res->bus.caching; ++ if (man->use_tt) { ++ caching = bo->ttm->caching; ++ if (bo->ttm->page_flags & TTM_TT_FLAG_DECRYPTED) ++ tmp = pgprot_decrypted(tmp); ++ } else { ++ caching = res->bus.caching; ++ } + + return ttm_prot_from_caching(caching, tmp); + } +@@ -337,6 +343,8 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo, + .no_wait_gpu = false + }; + struct ttm_tt *ttm = bo->ttm; ++ struct ttm_resource_manager *man = ++ ttm_manager_type(bo->bdev, bo->resource->mem_type); + pgprot_t prot; + int ret; + +@@ -346,7 +354,8 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo, + if (ret) + return ret; + +- if (num_pages == 1 && ttm->caching == ttm_cached) { ++ if (num_pages == 1 && ttm->caching == ttm_cached && ++ !(man->use_tt && (ttm->page_flags & TTM_TT_FLAG_DECRYPTED))) { + /* + * We're mapping a single page, and the desired + * page protection is consistent with the bo. +diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c +index e0a77671edd6c..43eaffa7faae3 100644 +--- a/drivers/gpu/drm/ttm/ttm_tt.c ++++ b/drivers/gpu/drm/ttm/ttm_tt.c +@@ -31,11 +31,14 @@ + + #define pr_fmt(fmt) "[TTM] " fmt + ++#include + #include + #include + #include + #include + #include ++#include ++#include + #include + #include + +@@ -60,6 +63,7 @@ static atomic_long_t ttm_dma32_pages_allocated; + int ttm_tt_create(struct ttm_buffer_object *bo, bool zero_alloc) + { + struct ttm_device *bdev = bo->bdev; ++ struct drm_device *ddev = bo->base.dev; + uint32_t page_flags = 0; + + dma_resv_assert_held(bo->base.resv); +@@ -81,6 +85,15 @@ int ttm_tt_create(struct ttm_buffer_object *bo, bool zero_alloc) + pr_err("Illegal buffer object type\n"); + return -EINVAL; + } ++ /* ++ * When using dma_alloc_coherent with memory encryption the ++ * mapped TT pages need to be decrypted or otherwise the drivers ++ * will end up sending encrypted mem to the gpu. ++ */ ++ if (bdev->pool.use_dma_alloc && cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) { ++ page_flags |= TTM_TT_FLAG_DECRYPTED; ++ drm_info(ddev, "TT memory decryption enabled."); ++ } + + bo->ttm = bdev->funcs->ttm_tt_create(bo, page_flags); + if (unlikely(bo->ttm == NULL)) +diff --git a/include/drm/ttm/ttm_tt.h b/include/drm/ttm/ttm_tt.h +index a4eff85b1f449..2b9d856ff388d 100644 +--- a/include/drm/ttm/ttm_tt.h ++++ b/include/drm/ttm/ttm_tt.h +@@ -79,6 +79,12 @@ struct ttm_tt { + * page_flags = TTM_TT_FLAG_EXTERNAL | + * TTM_TT_FLAG_EXTERNAL_MAPPABLE; + * ++ * TTM_TT_FLAG_DECRYPTED: The mapped ttm pages should be marked as ++ * not encrypted. The framework will try to match what the dma layer ++ * is doing, but note that it is a little fragile because ttm page ++ * fault handling abuses the DMA api a bit and dma_map_attrs can't be ++ * used to assure pgprot always matches. ++ * + * TTM_TT_FLAG_PRIV_POPULATED: TTM internal only. DO NOT USE. This is + * set by TTM after ttm_tt_populate() has successfully returned, and is + * then unset when TTM calls ttm_tt_unpopulate(). +@@ -87,8 +93,9 @@ struct ttm_tt { + #define TTM_TT_FLAG_ZERO_ALLOC BIT(1) + #define TTM_TT_FLAG_EXTERNAL BIT(2) + #define TTM_TT_FLAG_EXTERNAL_MAPPABLE BIT(3) ++#define TTM_TT_FLAG_DECRYPTED BIT(4) + +-#define TTM_TT_FLAG_PRIV_POPULATED BIT(4) ++#define TTM_TT_FLAG_PRIV_POPULATED BIT(5) + uint32_t page_flags; + /** @num_pages: Number of pages in the page array. */ + uint32_t num_pages; +-- +2.43.0 + diff --git a/queue-6.6/drm-vc4-hdmi-do-not-return-negative-values-from-.get.patch b/queue-6.6/drm-vc4-hdmi-do-not-return-negative-values-from-.get.patch new file mode 100644 index 00000000000..5798a466b0e --- /dev/null +++ b/queue-6.6/drm-vc4-hdmi-do-not-return-negative-values-from-.get.patch @@ -0,0 +1,39 @@ +From bfff5a02a2e1011505d8a04a8f9704d92bf3268e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:44 +0200 +Subject: drm/vc4: hdmi: do not return negative values from .get_modes() + +From: Jani Nikula + +[ Upstream commit abf493988e380f25242c1023275c68bd3579c9ce ] + +The .get_modes() hooks aren't supposed to return negative error +codes. Return 0 for no modes, whatever the reason. + +Cc: Maxime Ripard +Cc: stable@vger.kernel.org +Acked-by: Maxime Ripard +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/dcda6d4003e2c6192987916b35c7304732800e08.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 25c9c71256d35..4626fe9aac563 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -508,7 +508,7 @@ static int vc4_hdmi_connector_get_modes(struct drm_connector *connector) + edid = drm_get_edid(connector, vc4_hdmi->ddc); + cec_s_phys_addr_from_edid(vc4_hdmi->cec_adap, edid); + if (!edid) +- return -ENODEV; ++ return 0; + + drm_connector_update_edid_property(connector, edid); + ret = drm_add_edid_modes(connector, edid); +-- +2.43.0 + diff --git a/queue-6.6/drm-vmwgfx-fix-possible-null-pointer-derefence-with-.patch b/queue-6.6/drm-vmwgfx-fix-possible-null-pointer-derefence-with-.patch new file mode 100644 index 00000000000..a76ba2de311 --- /dev/null +++ b/queue-6.6/drm-vmwgfx-fix-possible-null-pointer-derefence-with-.patch @@ -0,0 +1,103 @@ +From 89e79bc092f4539a1fb9d9fbb8e64af84fb27eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 15:03:05 -0500 +Subject: drm/vmwgfx: Fix possible null pointer derefence with invalid contexts + +From: Zack Rusin + +[ Upstream commit 517621b7060096e48e42f545fa6646fc00252eac ] + +vmw_context_cotable can return either an error or a null pointer and its +usage sometimes went unchecked. Subsequent code would then try to access +either a null pointer or an error value. + +The invalid dereferences were only possible with malformed userspace +apps which never properly initialized the rendering contexts. + +Check the results of vmw_context_cotable to fix the invalid derefs. + +Thanks: +ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab +who was the first person to discover it. +Niels De Graef who reported it and helped to track down the poc. + +Fixes: 9c079b8ce8bf ("drm/vmwgfx: Adapt execbuf to the new validation api") +Cc: # v4.20+ +Reported-by: Niels De Graef +Signed-off-by: Zack Rusin +Cc: Martin Krastev +Cc: Maaz Mombasawala +Cc: Ian Forbes +Cc: Broadcom internal kernel review list +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: Maaz Mombasawala +Reviewed-by: Martin Krastev +Link: https://patchwork.freedesktop.org/patch/msgid/20240110200305.94086-1-zack.rusin@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +index 36987ef3fc300..5fef0b31c1179 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -447,7 +447,7 @@ static int vmw_resource_context_res_add(struct vmw_private *dev_priv, + vmw_res_type(ctx) == vmw_res_dx_context) { + for (i = 0; i < cotable_max; ++i) { + res = vmw_context_cotable(ctx, i); +- if (IS_ERR(res)) ++ if (IS_ERR_OR_NULL(res)) + continue; + + ret = vmw_execbuf_res_val_add(sw_context, res, +@@ -1266,6 +1266,8 @@ static int vmw_cmd_dx_define_query(struct vmw_private *dev_priv, + return -EINVAL; + + cotable_res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXQUERY); ++ if (IS_ERR_OR_NULL(cotable_res)) ++ return cotable_res ? PTR_ERR(cotable_res) : -EINVAL; + ret = vmw_cotable_notify(cotable_res, cmd->body.queryId); + + return ret; +@@ -2484,6 +2486,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv, + return ret; + + res = vmw_context_cotable(ctx_node->ctx, vmw_view_cotables[view_type]); ++ if (IS_ERR_OR_NULL(res)) ++ return res ? PTR_ERR(res) : -EINVAL; + ret = vmw_cotable_notify(res, cmd->defined_id); + if (unlikely(ret != 0)) + return ret; +@@ -2569,8 +2573,8 @@ static int vmw_cmd_dx_so_define(struct vmw_private *dev_priv, + + so_type = vmw_so_cmd_to_type(header->id); + res = vmw_context_cotable(ctx_node->ctx, vmw_so_cotables[so_type]); +- if (IS_ERR(res)) +- return PTR_ERR(res); ++ if (IS_ERR_OR_NULL(res)) ++ return res ? PTR_ERR(res) : -EINVAL; + cmd = container_of(header, typeof(*cmd), header); + ret = vmw_cotable_notify(res, cmd->defined_id); + +@@ -2689,6 +2693,8 @@ static int vmw_cmd_dx_define_shader(struct vmw_private *dev_priv, + return -EINVAL; + + res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXSHADER); ++ if (IS_ERR_OR_NULL(res)) ++ return res ? PTR_ERR(res) : -EINVAL; + ret = vmw_cotable_notify(res, cmd->body.shaderId); + if (ret) + return ret; +@@ -3010,6 +3016,8 @@ static int vmw_cmd_dx_define_streamoutput(struct vmw_private *dev_priv, + } + + res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_STREAMOUTPUT); ++ if (IS_ERR_OR_NULL(res)) ++ return res ? PTR_ERR(res) : -EINVAL; + ret = vmw_cotable_notify(res, cmd->body.soid); + if (ret) + return ret; +-- +2.43.0 + diff --git a/queue-6.6/drm-vmwgfx-fix-the-lifetime-of-the-bo-cursor-memory.patch b/queue-6.6/drm-vmwgfx-fix-the-lifetime-of-the-bo-cursor-memory.patch new file mode 100644 index 00000000000..f1a34ef2f66 --- /dev/null +++ b/queue-6.6/drm-vmwgfx-fix-the-lifetime-of-the-bo-cursor-memory.patch @@ -0,0 +1,75 @@ +From 32e70bc63cbbe1b4c753aa5fab73321a83bc06e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 15:08:04 -0500 +Subject: drm/vmwgfx: Fix the lifetime of the bo cursor memory + +From: Zack Rusin + +[ Upstream commit 9a9e8a7159ca09af9b1a300a6c8e8b6ff7501c76 ] + +The cleanup can be dispatched while the atomic update is still active, +which means that the memory acquired in the atomic update needs to +not be invalidated by the cleanup. The buffer objects in vmw_plane_state +instead of using the builtin map_and_cache were trying to handle +the lifetime of the mapped memory themselves, leading to crashes. + +Use the map_and_cache instead of trying to manage the lifetime of the +buffer objects held by the vmw_plane_state. + +Fixes kernel oops'es in IGT's kms_cursor_legacy forked-bo. + +Signed-off-by: Zack Rusin +Fixes: bb6780aa5a1d ("drm/vmwgfx: Diff cursors when using cmds") +Cc: # v6.2+ +Reviewed-by: Martin Krastev +Link: https://patchwork.freedesktop.org/patch/msgid/20240126200804.732454-6-zack.rusin@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 13 +------------ + 1 file changed, 1 insertion(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index 496ff2a6144c1..5681a1b42aa24 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -184,13 +184,12 @@ static u32 vmw_du_cursor_mob_size(u32 w, u32 h) + */ + static u32 *vmw_du_cursor_plane_acquire_image(struct vmw_plane_state *vps) + { +- bool is_iomem; + if (vps->surf) { + if (vps->surf_mapped) + return vmw_bo_map_and_cache(vps->surf->res.guest_memory_bo); + return vps->surf->snooper.image; + } else if (vps->bo) +- return ttm_kmap_obj_virtual(&vps->bo->map, &is_iomem); ++ return vmw_bo_map_and_cache(vps->bo); + return NULL; + } + +@@ -652,22 +651,12 @@ vmw_du_cursor_plane_cleanup_fb(struct drm_plane *plane, + { + struct vmw_cursor_plane *vcp = vmw_plane_to_vcp(plane); + struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state); +- bool is_iomem; + + if (vps->surf_mapped) { + vmw_bo_unmap(vps->surf->res.guest_memory_bo); + vps->surf_mapped = false; + } + +- if (vps->bo && ttm_kmap_obj_virtual(&vps->bo->map, &is_iomem)) { +- const int ret = ttm_bo_reserve(&vps->bo->tbo, true, false, NULL); +- +- if (likely(ret == 0)) { +- ttm_bo_kunmap(&vps->bo->map); +- ttm_bo_unreserve(&vps->bo->tbo); +- } +- } +- + vmw_du_cursor_plane_unmap_cm(vps); + vmw_du_put_cursor_mob(vcp, vps); + +-- +2.43.0 + diff --git a/queue-6.6/drm-vmwgfx-unmap-the-surface-before-resetting-it-on-.patch b/queue-6.6/drm-vmwgfx-unmap-the-surface-before-resetting-it-on-.patch new file mode 100644 index 00000000000..59cd671042b --- /dev/null +++ b/queue-6.6/drm-vmwgfx-unmap-the-surface-before-resetting-it-on-.patch @@ -0,0 +1,127 @@ +From 7e3ea7ecd8ea19606e1eae453da78062bf539544 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Dec 2023 00:25:40 -0500 +Subject: drm/vmwgfx: Unmap the surface before resetting it on a plane state + +From: Zack Rusin + +[ Upstream commit 27571c64f1855881753e6f33c3186573afbab7ba ] + +Switch to a new plane state requires unreferencing of all held surfaces. +In the work required for mob cursors the mapped surfaces started being +cached but the variable indicating whether the surface is currently +mapped was not being reset. This leads to crashes as the duplicated +state, incorrectly, indicates the that surface is mapped even when +no surface is present. That's because after unreferencing the surface +it's perfectly possible for the plane to be backed by a bo instead of a +surface. + +Reset the surface mapped flag when unreferencing the plane state surface +to fix null derefs in cleanup. Fixes crashes in KDE KWin 6.0 on Wayland: + +Oops: 0000 [#1] PREEMPT SMP PTI +CPU: 4 PID: 2533 Comm: kwin_wayland Not tainted 6.7.0-rc3-vmwgfx #2 +Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 +RIP: 0010:vmw_du_cursor_plane_cleanup_fb+0x124/0x140 [vmwgfx] +Code: 00 00 00 75 3a 48 83 c4 10 5b 5d c3 cc cc cc cc 48 8b b3 a8 00 00 00 48 c7 c7 99 90 43 c0 e8 93 c5 db ca 48 8b 83 a8 00 00 00 <48> 8b 78 28 e8 e3 f> +RSP: 0018:ffffb6b98216fa80 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: ffff969d84cdcb00 RCX: 0000000000000027 +RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff969e75f21600 +RBP: ffff969d4143dc50 R08: 0000000000000000 R09: ffffb6b98216f920 +R10: 0000000000000003 R11: ffff969e7feb3b10 R12: 0000000000000000 +R13: 0000000000000000 R14: 000000000000027b R15: ffff969d49c9fc00 +FS: 00007f1e8f1b4180(0000) GS:ffff969e75f00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000028 CR3: 0000000104006004 CR4: 00000000003706f0 +Call Trace: + + ? __die+0x23/0x70 + ? page_fault_oops+0x171/0x4e0 + ? exc_page_fault+0x7f/0x180 + ? asm_exc_page_fault+0x26/0x30 + ? vmw_du_cursor_plane_cleanup_fb+0x124/0x140 [vmwgfx] + drm_atomic_helper_cleanup_planes+0x9b/0xc0 + commit_tail+0xd1/0x130 + drm_atomic_helper_commit+0x11a/0x140 + drm_atomic_commit+0x97/0xd0 + ? __pfx___drm_printfn_info+0x10/0x10 + drm_atomic_helper_update_plane+0xf5/0x160 + drm_mode_cursor_universal+0x10e/0x270 + drm_mode_cursor_common+0x102/0x230 + ? __pfx_drm_mode_cursor2_ioctl+0x10/0x10 + drm_ioctl_kernel+0xb2/0x110 + drm_ioctl+0x26d/0x4b0 + ? __pfx_drm_mode_cursor2_ioctl+0x10/0x10 + ? __pfx_drm_ioctl+0x10/0x10 + vmw_generic_ioctl+0xa4/0x110 [vmwgfx] + __x64_sys_ioctl+0x94/0xd0 + do_syscall_64+0x61/0xe0 + ? __x64_sys_ioctl+0xaf/0xd0 + ? syscall_exit_to_user_mode+0x2b/0x40 + ? do_syscall_64+0x70/0xe0 + ? __x64_sys_ioctl+0xaf/0xd0 + ? syscall_exit_to_user_mode+0x2b/0x40 + ? do_syscall_64+0x70/0xe0 + ? exc_page_fault+0x7f/0x180 + entry_SYSCALL_64_after_hwframe+0x6e/0x76 +RIP: 0033:0x7f1e93f279ed +Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff f> +RSP: 002b:00007ffca0faf600 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +RAX: ffffffffffffffda RBX: 000055db876ed2c0 RCX: 00007f1e93f279ed +RDX: 00007ffca0faf6c0 RSI: 00000000c02464bb RDI: 0000000000000015 +RBP: 00007ffca0faf650 R08: 000055db87184010 R09: 0000000000000007 +R10: 000055db886471a0 R11: 0000000000000246 R12: 00007ffca0faf6c0 +R13: 00000000c02464bb R14: 0000000000000015 R15: 00007ffca0faf790 + +Modules linked in: snd_seq_dummy snd_hrtimer nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_ine> +CR2: 0000000000000028 +---[ end trace 0000000000000000 ]--- +RIP: 0010:vmw_du_cursor_plane_cleanup_fb+0x124/0x140 [vmwgfx] +Code: 00 00 00 75 3a 48 83 c4 10 5b 5d c3 cc cc cc cc 48 8b b3 a8 00 00 00 48 c7 c7 99 90 43 c0 e8 93 c5 db ca 48 8b 83 a8 00 00 00 <48> 8b 78 28 e8 e3 f> +RSP: 0018:ffffb6b98216fa80 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: ffff969d84cdcb00 RCX: 0000000000000027 +RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff969e75f21600 +RBP: ffff969d4143dc50 R08: 0000000000000000 R09: ffffb6b98216f920 +R10: 0000000000000003 R11: ffff969e7feb3b10 R12: 0000000000000000 +R13: 0000000000000000 R14: 000000000000027b R15: ffff969d49c9fc00 +FS: 00007f1e8f1b4180(0000) GS:ffff969e75f00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000028 CR3: 0000000104006004 CR4: 00000000003706f0 + +Signed-off-by: Zack Rusin +Fixes: 485d98d472d5 ("drm/vmwgfx: Add support for CursorMob and CursorBypass 4") +Reported-by: Stefan Hoffmeister +Closes: https://gitlab.freedesktop.org/drm/misc/-/issues/34 +Cc: Martin Krastev +Cc: Maaz Mombasawala +Cc: Ian Forbes +Cc: Broadcom internal kernel review list +Cc: dri-devel@lists.freedesktop.org +Cc: # v5.19+ +Acked-by: Javier Martinez Canillas +Reviewed-by: Maaz Mombasawala +Reviewed-by: Martin Krastev +Link: https://patchwork.freedesktop.org/patch/msgid/20231224052540.605040-1-zack.rusin@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index b51578918cf8d..496ff2a6144c1 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -703,6 +703,10 @@ vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane, + int ret = 0; + + if (vps->surf) { ++ if (vps->surf_mapped) { ++ vmw_bo_unmap(vps->surf->res.guest_memory_bo); ++ vps->surf_mapped = false; ++ } + vmw_surface_unreference(&vps->surf); + vps->surf = NULL; + } +-- +2.43.0 + diff --git a/queue-6.6/ext4-correct-best-extent-lstart-adjustment-logic.patch b/queue-6.6/ext4-correct-best-extent-lstart-adjustment-logic.patch new file mode 100644 index 00000000000..bd3a71c6849 --- /dev/null +++ b/queue-6.6/ext4-correct-best-extent-lstart-adjustment-logic.patch @@ -0,0 +1,95 @@ +From 92e6713edf91617463c842d12ddf73e0fea38b7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 22:18:45 +0800 +Subject: ext4: correct best extent lstart adjustment logic + +From: Baokun Li + +[ Upstream commit 4fbf8bc733d14bceb16dda46a3f5e19c6a9621c5 ] + +When yangerkun review commit 93cdf49f6eca ("ext4: Fix best extent lstart +adjustment logic in ext4_mb_new_inode_pa()"), it was found that the best +extent did not completely cover the original request after adjusting the +best extent lstart in ext4_mb_new_inode_pa() as follows: + + original request: 2/10(8) + normalized request: 0/64(64) + best extent: 0/9(9) + +When we check if best ex can be kept at start of goal, ac_o_ex.fe_logical +is 2 less than the adjusted best extent logical end 9, so we think the +adjustment is done. But obviously 0/9(9) doesn't cover 2/10(8), so we +should determine here if the original request logical end is less than or +equal to the adjusted best extent logical end. + +In addition, add a comment stating when adjusted best_ex will not cover +the original request, and remove the duplicate assertion because adjusting +lstart makes no change to b_ex.fe_len. + +Link: https://lore.kernel.org/r/3630fa7f-b432-7afd-5f79-781bc3b2c5ea@huawei.com +Fixes: 93cdf49f6eca ("ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()") +Cc: +Signed-off-by: yangerkun +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Reviewed-by: Ojaswin Mujoo +Link: https://lore.kernel.org/r/20240201141845.1879253-1-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index ea5ac2636632b..257b70c5ded45 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -5184,10 +5184,16 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + .fe_len = ac->ac_orig_goal_len, + }; + loff_t orig_goal_end = extent_logical_end(sbi, &ex); ++ loff_t o_ex_end = extent_logical_end(sbi, &ac->ac_o_ex); + +- /* we can't allocate as much as normalizer wants. +- * so, found space must get proper lstart +- * to cover original request */ ++ /* ++ * We can't allocate as much as normalizer wants, so we try ++ * to get proper lstart to cover the original request, except ++ * when the goal doesn't cover the original request as below: ++ * ++ * orig_ex:2045/2055(10), isize:8417280 -> normalized:0/2048 ++ * best_ex:0/200(200) -> adjusted: 1848/2048(200) ++ */ + BUG_ON(ac->ac_g_ex.fe_logical > ac->ac_o_ex.fe_logical); + BUG_ON(ac->ac_g_ex.fe_len < ac->ac_o_ex.fe_len); + +@@ -5199,7 +5205,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + * 1. Check if best ex can be kept at end of goal (before + * cr_best_avail trimmed it) and still cover original start + * 2. Else, check if best ex can be kept at start of goal and +- * still cover original start ++ * still cover original end + * 3. Else, keep the best ex at start of original request. + */ + ex.fe_len = ac->ac_b_ex.fe_len; +@@ -5209,7 +5215,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + goto adjust_bex; + + ex.fe_logical = ac->ac_g_ex.fe_logical; +- if (ac->ac_o_ex.fe_logical < extent_logical_end(sbi, &ex)) ++ if (o_ex_end <= extent_logical_end(sbi, &ex)) + goto adjust_bex; + + ex.fe_logical = ac->ac_o_ex.fe_logical; +@@ -5217,7 +5223,6 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + ac->ac_b_ex.fe_logical = ex.fe_logical; + + BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical); +- BUG_ON(ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len); + BUG_ON(extent_logical_end(sbi, &ex) > orig_goal_end); + } + +-- +2.43.0 + diff --git a/queue-6.6/ext4-fix-corruption-during-on-line-resize.patch b/queue-6.6/ext4-fix-corruption-during-on-line-resize.patch new file mode 100644 index 00000000000..86424703fb7 --- /dev/null +++ b/queue-6.6/ext4-fix-corruption-during-on-line-resize.patch @@ -0,0 +1,79 @@ +From 09ddf78b7fc5b82eda385ffc2dbc0ffbd3c05e9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 15:50:09 +0000 +Subject: ext4: fix corruption during on-line resize + +From: Maximilian Heyne + +[ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] + +We observed a corruption during on-line resize of a file system that is +larger than 16 TiB with 4k block size. With having more then 2^32 blocks +resize_inode is turned off by default by mke2fs. The issue can be +reproduced on a smaller file system for convenience by explicitly +turning off resize_inode. An on-line resize across an 8 GiB boundary (the +size of a meta block group in this setup) then leads to a corruption: + + dev=/dev/ # should be >= 16 GiB + mkdir -p /corruption + /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) + mount -t ext4 $dev /corruption + + dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) + sha1sum /corruption/test + # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test + + /sbin/resize2fs $dev $((2*2**21)) + # drop page cache to force reload the block from disk + echo 1 > /proc/sys/vm/drop_caches + + sha1sum /corruption/test + # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test + +2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per +block group and 2^6 are the number of block groups that make a meta +block group. + +The last checksum might be different depending on how the file is laid +out across the physical blocks. The actual corruption occurs at physical +block 63*2^15 = 2064384 which would be the location of the backup of the +meta block group's block descriptor. During the on-line resize the file +system will be converted to meta_bg starting at s_first_meta_bg which is +2 in the example - meaning all block groups after 16 GiB. However, in +ext4_flex_group_add we might add block groups that are not part of the +first meta block group yet. In the reproducer we achieved this by +substracting the size of a whole block group from the point where the +meta block group would start. This must be considered when updating the +backup block group descriptors to follow the non-meta_bg layout. The fix +is to add a test whether the group to add is already part of the meta +block group or not. + +Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") +Cc: +Signed-off-by: Maximilian Heyne +Tested-by: Srivathsa Dara +Reviewed-by: Srivathsa Dara +Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/resize.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index be280268da9fe..5f105171df7b5 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1605,7 +1605,8 @@ static int ext4_flex_group_add(struct super_block *sb, + int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); + int gdb_num_end = ((group + flex_gd->count - 1) / + EXT4_DESC_PER_BLOCK(sb)); +- int meta_bg = ext4_has_feature_meta_bg(sb); ++ int meta_bg = ext4_has_feature_meta_bg(sb) && ++ gdb_num >= le32_to_cpu(es->s_first_meta_bg); + sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr - + ext4_group_first_block_no(sb, 0); + sector_t old_gdb = 0; +-- +2.43.0 + diff --git a/queue-6.6/f2fs-mark-inode-dirty-for-fi_atomic_committed-flag.patch b/queue-6.6/f2fs-mark-inode-dirty-for-fi_atomic_committed-flag.patch new file mode 100644 index 00000000000..6f21e3ecf6d --- /dev/null +++ b/queue-6.6/f2fs-mark-inode-dirty-for-fi_atomic_committed-flag.patch @@ -0,0 +1,57 @@ +From 5e4e07c5fe8d957f66acc2395db51b6609d6c987 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 20:26:19 +0900 +Subject: f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag + +From: Sunmin Jeong + +[ Upstream commit 4bf78322346f6320313683dc9464e5423423ad5c ] + +In f2fs_update_inode, i_size of the atomic file isn't updated until +FI_ATOMIC_COMMITTED flag is set. When committing atomic write right +after the writeback of the inode, i_size of the raw inode will not be +updated. It can cause the atomicity corruption due to a mismatch between +old file size and new data. + +To prevent the problem, let's mark inode dirty for FI_ATOMIC_COMMITTED + +Atomic write thread Writeback thread + __writeback_single_inode + write_inode + f2fs_update_inode + - skip i_size update + f2fs_ioc_commit_atomic_write + f2fs_commit_atomic_write + set_inode_flag(inode, FI_ATOMIC_COMMITTED) + f2fs_do_sync_file + f2fs_fsync_node_pages + - skip f2fs_update_inode since the inode is clean + +Fixes: 3db1de0e582c ("f2fs: change the current atomic write way") +Cc: stable@vger.kernel.org #v5.19+ +Reviewed-by: Sungjong Seo +Reviewed-by: Yeongjin Gil +Signed-off-by: Sunmin Jeong +Reviewed-by: Daeho Jeong +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 5c87f472da3d3..f37907f015873 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -3024,6 +3024,7 @@ static inline void __mark_inode_dirty_flag(struct inode *inode, + case FI_INLINE_DOTS: + case FI_PIN_FILE: + case FI_COMPRESS_RELEASED: ++ case FI_ATOMIC_COMMITTED: + f2fs_mark_inode_dirty_sync(inode, true); + } + } +-- +2.43.0 + diff --git a/queue-6.6/f2fs-truncate-page-cache-before-clearing-flags-when-.patch b/queue-6.6/f2fs-truncate-page-cache-before-clearing-flags-when-.patch new file mode 100644 index 00000000000..6d37fdeb9cf --- /dev/null +++ b/queue-6.6/f2fs-truncate-page-cache-before-clearing-flags-when-.patch @@ -0,0 +1,64 @@ +From 82c0091bc8c4dec778679538217db6137bb0b46d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 20:26:20 +0900 +Subject: f2fs: truncate page cache before clearing flags when aborting atomic + write + +From: Sunmin Jeong + +[ Upstream commit 74b0ebcbdde4c7fe23c979e4cfc2fdbf349c39a3 ] + +In f2fs_do_write_data_page, FI_ATOMIC_FILE flag selects the target inode +between the original inode and COW inode. When aborting atomic write and +writeback occur simultaneously, invalid data can be written to original +inode if the FI_ATOMIC_FILE flag is cleared meanwhile. + +To prevent the problem, let's truncate all pages before clearing the flag + +Atomic write thread Writeback thread + f2fs_abort_atomic_write + clear_inode_flag(inode, FI_ATOMIC_FILE) + __writeback_single_inode + do_writepages + f2fs_do_write_data_page + - use dn of original inode + truncate_inode_pages_final + +Fixes: 3db1de0e582c ("f2fs: change the current atomic write way") +Cc: stable@vger.kernel.org #v5.19+ +Reviewed-by: Sungjong Seo +Reviewed-by: Yeongjin Gil +Signed-off-by: Sunmin Jeong +Reviewed-by: Daeho Jeong +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 0edd9feff6185..4549964819731 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -192,6 +192,9 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean) + if (!f2fs_is_atomic_file(inode)) + return; + ++ if (clean) ++ truncate_inode_pages_final(inode->i_mapping); ++ + release_atomic_write_cnt(inode); + clear_inode_flag(inode, FI_ATOMIC_COMMITTED); + clear_inode_flag(inode, FI_ATOMIC_REPLACE); +@@ -201,7 +204,6 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean) + F2FS_I(inode)->atomic_write_task = NULL; + + if (clean) { +- truncate_inode_pages_final(inode->i_mapping); + f2fs_i_size_write(inode, fi->original_i_size); + fi->original_i_size = 0; + } +-- +2.43.0 + diff --git a/queue-6.6/fat-fix-uninitialized-field-in-nostale-filehandles.patch b/queue-6.6/fat-fix-uninitialized-field-in-nostale-filehandles.patch new file mode 100644 index 00000000000..6efc0849afe --- /dev/null +++ b/queue-6.6/fat-fix-uninitialized-field-in-nostale-filehandles.patch @@ -0,0 +1,49 @@ +From 98d53a000148bcd4b82754ae883903bb0386e708 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Feb 2024 13:26:26 +0100 +Subject: fat: fix uninitialized field in nostale filehandles + +From: Jan Kara + +[ Upstream commit fde2497d2bc3a063d8af88b258dbadc86bd7b57c ] + +When fat_encode_fh_nostale() encodes file handle without a parent it +stores only first 10 bytes of the file handle. However the length of the +file handle must be a multiple of 4 so the file handle is actually 12 +bytes long and the last two bytes remain uninitialized. This is not +great at we potentially leak uninitialized information with the handle +to userspace. Properly initialize the full handle length. + +Link: https://lkml.kernel.org/r/20240205122626.13701-1-jack@suse.cz +Reported-by: syzbot+3ce5dea5b1539ff36769@syzkaller.appspotmail.com +Fixes: ea3983ace6b7 ("fat: restructure export_operations") +Signed-off-by: Jan Kara +Acked-by: OGAWA Hirofumi +Cc: Amir Goldstein +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/fat/nfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/fat/nfs.c b/fs/fat/nfs.c +index 3626eb585a983..93c97bf45b061 100644 +--- a/fs/fat/nfs.c ++++ b/fs/fat/nfs.c +@@ -130,6 +130,12 @@ fat_encode_fh_nostale(struct inode *inode, __u32 *fh, int *lenp, + fid->parent_i_gen = parent->i_generation; + type = FILEID_FAT_WITH_PARENT; + *lenp = FAT_FID_SIZE_WITH_PARENT; ++ } else { ++ /* ++ * We need to initialize this field because the fh is actually ++ * 12 bytes long ++ */ ++ fid->parent_i_pos_hi = 0; + } + + return type; +-- +2.43.0 + diff --git a/queue-6.6/fuse-don-t-unhash-root.patch b/queue-6.6/fuse-don-t-unhash-root.patch new file mode 100644 index 00000000000..cc4e843f946 --- /dev/null +++ b/queue-6.6/fuse-don-t-unhash-root.patch @@ -0,0 +1,54 @@ +From b0303e227e2ee9b85508e3fb2c6a2fda4f4f787b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 16:50:49 +0100 +Subject: fuse: don't unhash root + +From: Miklos Szeredi + +[ Upstream commit b1fe686a765e6c0d71811d825b5a1585a202b777 ] + +The root inode is assumed to be always hashed. Do not unhash the root +inode even if it is marked BAD. + +Fixes: 5d069dbe8aaf ("fuse: fix bad inode") +Cc: # v5.11 +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/fuse_i.h | 1 - + fs/fuse/inode.c | 7 +++++-- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h +index 9377c46f14c4a..3e65cdc946316 100644 +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -939,7 +939,6 @@ static inline bool fuse_stale_inode(const struct inode *inode, int generation, + + static inline void fuse_make_bad(struct inode *inode) + { +- remove_inode_hash(inode); + set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); + } + +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index 59743813563e5..23ab31b967a13 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -472,8 +472,11 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid, + } else if (fuse_stale_inode(inode, generation, attr)) { + /* nodeid was reused, any I/O on the old inode should fail */ + fuse_make_bad(inode); +- iput(inode); +- goto retry; ++ if (inode != d_inode(sb->s_root)) { ++ remove_inode_hash(inode); ++ iput(inode); ++ goto retry; ++ } + } + fi = get_fuse_inode(inode); + spin_lock(&fi->lock); +-- +2.43.0 + diff --git a/queue-6.6/fuse-fix-root-lookup-with-nonzero-generation.patch b/queue-6.6/fuse-fix-root-lookup-with-nonzero-generation.patch new file mode 100644 index 00000000000..ba10aa877b3 --- /dev/null +++ b/queue-6.6/fuse-fix-root-lookup-with-nonzero-generation.patch @@ -0,0 +1,48 @@ +From 68616245acfcf3da7b6792417a78e5ea3065dc45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 16:50:49 +0100 +Subject: fuse: fix root lookup with nonzero generation + +From: Miklos Szeredi + +[ Upstream commit 68ca1b49e430f6534d0774a94147a823e3b8b26e ] + +The root inode has a fixed nodeid and generation (1, 0). + +Prior to the commit 15db16837a35 ("fuse: fix illegal access to inode with +reused nodeid") generation number on lookup was ignored. After this commit +lookup with the wrong generation number resulted in the inode being +unhashed. This is correct for non-root inodes, but replacing the root +inode is wrong and results in weird behavior. + +Fix by reverting to the old behavior if ignoring the generation for the +root inode, but issuing a warning in dmesg. + +Reported-by: Antonio SJ Musumeci +Closes: https://lore.kernel.org/all/CAOQ4uxhek5ytdN8Yz2tNEOg5ea4NkBb4nk0FGPjPk_9nz-VG3g@mail.gmail.com/ +Fixes: 15db16837a35 ("fuse: fix illegal access to inode with reused nodeid") +Cc: # v5.14 +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/dir.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index a4ad01a78e826..a8a7fc0e17547 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -391,6 +391,10 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name + err = -EIO; + if (fuse_invalid_attr(&outarg->attr)) + goto out_put_forget; ++ if (outarg->nodeid == FUSE_ROOT_ID && outarg->generation != 0) { ++ pr_warn_once("root generation should be zero\n"); ++ outarg->generation = 0; ++ } + + *inode = fuse_iget(sb, outarg->nodeid, outarg->generation, + &outarg->attr, ATTR_TIMEOUT(outarg), +-- +2.43.0 + diff --git a/queue-6.6/fuse-fix-vm_mayshare-and-direct_io_allow_mmap.patch b/queue-6.6/fuse-fix-vm_mayshare-and-direct_io_allow_mmap.patch new file mode 100644 index 00000000000..c85234dd5d0 --- /dev/null +++ b/queue-6.6/fuse-fix-vm_mayshare-and-direct_io_allow_mmap.patch @@ -0,0 +1,65 @@ +From ce87ca6c5e8d42c7aa9f9dfee1bfcd61254197e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 14:33:23 +0100 +Subject: fuse: fix VM_MAYSHARE and direct_io_allow_mmap + +From: Bernd Schubert + +[ Upstream commit 9511176bbaee0ac60ecc84e7b01cf5972a59ea17 ] + +There were multiple issues with direct_io_allow_mmap: + + - fuse_link_write_file() was missing, resulting in warnings in + fuse_write_file_get() and EIO from msync() + + - "vma->vm_ops = &fuse_file_vm_ops" was not set, but especially + fuse_page_mkwrite is needed. + +The semantics of invalidate_inode_pages2() is so far not clearly defined in +fuse_file_mmap. It dates back to commit 3121bfe76311 ("fuse: fix +"direct_io" private mmap") Though, as direct_io_allow_mmap is a new +feature, that was for MAP_PRIVATE only. As invalidate_inode_pages2() is +calling into fuse_launder_folio() and writes out dirty pages, it should be +safe to call invalidate_inode_pages2 for MAP_PRIVATE and MAP_SHARED as +well. + +Cc: Hao Xu +Cc: stable@vger.kernel.org +Fixes: e78662e818f9 ("fuse: add a new fuse init flag to relax restrictions in no cache mode") +Signed-off-by: Bernd Schubert +Reviewed-by: Amir Goldstein +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/file.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index a660f1f21540a..cc9651a01351c 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -2467,7 +2467,8 @@ static int fuse_file_mmap(struct file *file, struct vm_area_struct *vma) + return fuse_dax_mmap(file, vma); + + if (ff->open_flags & FOPEN_DIRECT_IO) { +- /* Can't provide the coherency needed for MAP_SHARED ++ /* ++ * Can't provide the coherency needed for MAP_SHARED + * if FUSE_DIRECT_IO_ALLOW_MMAP isn't set. + */ + if ((vma->vm_flags & VM_MAYSHARE) && !fc->direct_io_allow_mmap) +@@ -2475,7 +2476,10 @@ static int fuse_file_mmap(struct file *file, struct vm_area_struct *vma) + + invalidate_inode_pages2(file->f_mapping); + +- return generic_file_mmap(file, vma); ++ if (!(vma->vm_flags & VM_MAYSHARE)) { ++ /* MAP_PRIVATE */ ++ return generic_file_mmap(file, vma); ++ } + } + + if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE)) +-- +2.43.0 + diff --git a/queue-6.6/fuse-replace-remaining-make_bad_inode-with-fuse_make.patch b/queue-6.6/fuse-replace-remaining-make_bad_inode-with-fuse_make.patch new file mode 100644 index 00000000000..1d334872250 --- /dev/null +++ b/queue-6.6/fuse-replace-remaining-make_bad_inode-with-fuse_make.patch @@ -0,0 +1,35 @@ +From ff53af8a13b29bbc672b6f5d825bbc3a80571479 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 16:50:49 +0100 +Subject: fuse: replace remaining make_bad_inode() with fuse_make_bad() + +From: Miklos Szeredi + +[ Upstream commit 82e081aebe4d9c26e196c8260005cc4762b57a5d ] + +fuse_do_statx() was added with the wrong helper. + +Fixes: d3045530bdd2 ("fuse: implement statx") +Cc: # v6.6 +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index d707e6987da91..a4ad01a78e826 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -1210,7 +1210,7 @@ static int fuse_do_statx(struct inode *inode, struct file *file, + if (((sx->mask & STATX_SIZE) && !fuse_valid_size(sx->size)) || + ((sx->mask & STATX_TYPE) && (!fuse_valid_type(sx->mode) || + inode_wrong_type(inode, sx->mode)))) { +- make_bad_inode(inode); ++ fuse_make_bad(inode); + return -EIO; + } + +-- +2.43.0 + diff --git a/queue-6.6/hwmon-amc6821-add-of_match-table.patch b/queue-6.6/hwmon-amc6821-add-of_match-table.patch new file mode 100644 index 00000000000..f040feff913 --- /dev/null +++ b/queue-6.6/hwmon-amc6821-add-of_match-table.patch @@ -0,0 +1,56 @@ +From d10609e89d8801603117aefa4db267dafe300a0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 12:06:58 +0100 +Subject: hwmon: (amc6821) add of_match table + +From: Josua Mayer + +[ Upstream commit 3f003fda98a7a8d5f399057d92e6ed56b468657c ] + +Add of_match table for "ti,amc6821" compatible string. +This fixes automatic driver loading by userspace when using device-tree, +and if built as a module like major linux distributions do. + +While devices probe just fine with i2c_device_id table, userspace can't +match the "ti,amc6821" compatible string from dt with the plain +"amc6821" device id. As a result, the kernel module can not be loaded. + +Cc: stable@vger.kernel.org +Signed-off-by: Josua Mayer +Link: https://lore.kernel.org/r/20240307-amc6821-of-match-v1-1-5f40464a3110@solid-run.com +[groeck: Cleaned up patch description] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/amc6821.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c +index 2a7a4b6b00942..9b02b304c2f5d 100644 +--- a/drivers/hwmon/amc6821.c ++++ b/drivers/hwmon/amc6821.c +@@ -934,10 +934,21 @@ static const struct i2c_device_id amc6821_id[] = { + + MODULE_DEVICE_TABLE(i2c, amc6821_id); + ++static const struct of_device_id __maybe_unused amc6821_of_match[] = { ++ { ++ .compatible = "ti,amc6821", ++ .data = (void *)amc6821, ++ }, ++ { } ++}; ++ ++MODULE_DEVICE_TABLE(of, amc6821_of_match); ++ + static struct i2c_driver amc6821_driver = { + .class = I2C_CLASS_HWMON, + .driver = { + .name = "amc6821", ++ .of_match_table = of_match_ptr(amc6821_of_match), + }, + .probe = amc6821_probe, + .id_table = amc6821_id, +-- +2.43.0 + diff --git a/queue-6.6/iio-adc-rockchip_saradc-fix-bitmask-for-channels-on-.patch b/queue-6.6/iio-adc-rockchip_saradc-fix-bitmask-for-channels-on-.patch new file mode 100644 index 00000000000..fcda3f4ccb5 --- /dev/null +++ b/queue-6.6/iio-adc-rockchip_saradc-fix-bitmask-for-channels-on-.patch @@ -0,0 +1,42 @@ +From e17be8886c61f0fb67dbe372c40d2e44d3b63b05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 13:45:21 +0100 +Subject: iio: adc: rockchip_saradc: fix bitmask for channels on SARADCv2 + +From: Quentin Schulz + +[ Upstream commit b0a4546df24a4f8c59b2d05ae141bd70ceccc386 ] + +The SARADCv2 on RK3588 (the only SoC currently supported that has an +SARADCv2) selects the channel through the channel_sel bitfield which is +the 4 lowest bits, therefore the mask should be GENMASK(3, 0) and not +GENMASK(15, 0). + +Fixes: 757953f8ec69 ("iio: adc: rockchip_saradc: Add support for RK3588") +Signed-off-by: Quentin Schulz +Reviewed-by: Heiko Stuebner +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240223-saradcv2-chan-mask-v1-1-84b06a0f623a@theobroma-systems.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/rockchip_saradc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c +index dd94667a623bd..2da8d6f3241a1 100644 +--- a/drivers/iio/adc/rockchip_saradc.c ++++ b/drivers/iio/adc/rockchip_saradc.c +@@ -52,7 +52,7 @@ + #define SARADC2_START BIT(4) + #define SARADC2_SINGLE_MODE BIT(5) + +-#define SARADC2_CONV_CHANNELS GENMASK(15, 0) ++#define SARADC2_CONV_CHANNELS GENMASK(3, 0) + + struct rockchip_saradc; + +-- +2.43.0 + diff --git a/queue-6.6/iio-adc-rockchip_saradc-use-mask-for-write_enable-bi.patch b/queue-6.6/iio-adc-rockchip_saradc-use-mask-for-write_enable-bi.patch new file mode 100644 index 00000000000..08e7fd5a16e --- /dev/null +++ b/queue-6.6/iio-adc-rockchip_saradc-use-mask-for-write_enable-bi.patch @@ -0,0 +1,63 @@ +From 95daac79254d11b91f4cf1e43055b8976f5c2b5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 13:45:22 +0100 +Subject: iio: adc: rockchip_saradc: use mask for write_enable bitfield + +From: Quentin Schulz + +[ Upstream commit 5b4e4b72034f85f7a0cdd147d3d729c5a22c8764 ] + +Some of the registers on the SARADCv2 have bits write protected except +if another bit is set. This is usually done by having the lowest 16 bits +store the data to write and the highest 16 bits specify which of the 16 +lowest bits should have their value written to the hardware block. + +The write_enable mask for the channel selection was incorrect because it +was just the value shifted by 16 bits, which means it would only ever +write bits and never clear them. So e.g. if someone starts a conversion +on channel 5, the lowest 4 bits would be 0x5, then starts a conversion +on channel 0, it would still be 5. + +Instead of shifting the value by 16 as the mask, let's use the OR'ing of +the appropriate masks shifted by 16. + +Note that this is not an issue currently because the only SARADCv2 +currently supported has a reset defined in its Device Tree, that reset +resets the SARADC controller before starting a conversion on a channel. +However, this reset is handled as optional by the probe function and +thus proper masking should be used in the event an SARADCv2 without a +reset ever makes it upstream. + +Fixes: 757953f8ec69 ("iio: adc: rockchip_saradc: Add support for RK3588") +Signed-off-by: Quentin Schulz +Reviewed-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20240223-saradcv2-chan-mask-v1-2-84b06a0f623a@theobroma-systems.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/rockchip_saradc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c +index 2da8d6f3241a1..1c0042fbbb548 100644 +--- a/drivers/iio/adc/rockchip_saradc.c ++++ b/drivers/iio/adc/rockchip_saradc.c +@@ -102,12 +102,12 @@ static void rockchip_saradc_start_v2(struct rockchip_saradc *info, int chn) + writel_relaxed(0xc, info->regs + SARADC_T_DAS_SOC); + writel_relaxed(0x20, info->regs + SARADC_T_PD_SOC); + val = FIELD_PREP(SARADC2_EN_END_INT, 1); +- val |= val << 16; ++ val |= SARADC2_EN_END_INT << 16; + writel_relaxed(val, info->regs + SARADC2_END_INT_EN); + val = FIELD_PREP(SARADC2_START, 1) | + FIELD_PREP(SARADC2_SINGLE_MODE, 1) | + FIELD_PREP(SARADC2_CONV_CHANNELS, chn); +- val |= val << 16; ++ val |= (SARADC2_START | SARADC2_SINGLE_MODE | SARADC2_CONV_CHANNELS) << 16; + writel(val, info->regs + SARADC2_CONV_CON); + } + +-- +2.43.0 + diff --git a/queue-6.6/io_uring-clean-rings-on-no_mmap-alloc-fail.patch b/queue-6.6/io_uring-clean-rings-on-no_mmap-alloc-fail.patch new file mode 100644 index 00000000000..9ef4af39702 --- /dev/null +++ b/queue-6.6/io_uring-clean-rings-on-no_mmap-alloc-fail.patch @@ -0,0 +1,49 @@ +From db35b678c29063057e80668a71eb5fbdb427ffdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 14:56:27 +0000 +Subject: io_uring: clean rings on NO_MMAP alloc fail + +From: Pavel Begunkov + +[ Upstream commit cef59d1ea7170ec753182302645a0191c8aa3382 ] + +We make a few cancellation judgements based on ctx->rings, so let's +zero it afer deallocation for IORING_SETUP_NO_MMAP just like it's +done with the mmap case. Likely, it's not a real problem, but zeroing +is safer and better tested. + +Cc: stable@vger.kernel.org +Fixes: 03d89a2de25bbc ("io_uring: support for user allocated memory for rings/sqes") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/9ff6cdf91429b8a51699c210e1f6af6ea3f8bdcf.1710255382.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index aabb367b24bc0..aed10bae50acb 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2750,14 +2750,15 @@ static void io_rings_free(struct io_ring_ctx *ctx) + if (!(ctx->flags & IORING_SETUP_NO_MMAP)) { + io_mem_free(ctx->rings); + io_mem_free(ctx->sq_sqes); +- ctx->rings = NULL; +- ctx->sq_sqes = NULL; + } else { + io_pages_free(&ctx->ring_pages, ctx->n_ring_pages); + ctx->n_ring_pages = 0; + io_pages_free(&ctx->sqe_pages, ctx->n_sqe_pages); + ctx->n_sqe_pages = 0; + } ++ ++ ctx->rings = NULL; ++ ctx->sq_sqes = NULL; + } + + void *io_mem_alloc(size_t size) +-- +2.43.0 + diff --git a/queue-6.6/io_uring-fix-mshot-io-wq-checks.patch b/queue-6.6/io_uring-fix-mshot-io-wq-checks.patch new file mode 100644 index 00000000000..539ecca780d --- /dev/null +++ b/queue-6.6/io_uring-fix-mshot-io-wq-checks.patch @@ -0,0 +1,40 @@ +From 657b785c73dddeb427f3b5dcca78b5cfaea0b413 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 13:55:56 +0000 +Subject: io_uring: fix mshot io-wq checks + +From: Pavel Begunkov + +[ Upstream commit 3a96378e22cc46c7c49b5911f6c8631527a133a9 ] + +When checking for concurrent CQE posting, we're not only interested in +requests running from the poll handler but also strayed requests ended +up in normal io-wq execution. We're disallowing multishots in general +from io-wq, not only when they came in a certain way. + +Cc: stable@vger.kernel.org +Fixes: 17add5cea2bba ("io_uring: force multishot CQEs into task context") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/d8c5b36a39258036f93301cd60d3cd295e40653d.1709905727.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/net.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/net.c b/io_uring/net.c +index 386a6745ae32f..5a4001139e288 100644 +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -87,7 +87,7 @@ static inline bool io_check_multishot(struct io_kiocb *req, + * generic paths but multipoll may decide to post extra cqes. + */ + return !(issue_flags & IO_URING_F_IOWQ) || +- !(issue_flags & IO_URING_F_MULTISHOT) || ++ !(req->flags & REQ_F_APOLL_MULTISHOT) || + !req->ctx->task_complete; + } + +-- +2.43.0 + diff --git a/queue-6.6/io_uring-net-correctly-handle-multishot-recvmsg-retr.patch b/queue-6.6/io_uring-net-correctly-handle-multishot-recvmsg-retr.patch new file mode 100644 index 00000000000..620c5505002 --- /dev/null +++ b/queue-6.6/io_uring-net-correctly-handle-multishot-recvmsg-retr.patch @@ -0,0 +1,40 @@ +From 6d287bffa0b7d6e6c748ffb91d62001ee7e47695 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 17:48:03 -0700 +Subject: io_uring/net: correctly handle multishot recvmsg retry setup + +From: Jens Axboe + +[ Upstream commit deaef31bc1ec7966698a427da8c161930830e1cf ] + +If we loop for multishot receive on the initial attempt, and then abort +later on to wait for more, we miss a case where we should be copying the +io_async_msghdr from the stack to stable storage. This leads to the next +retry potentially failing, if the application had the msghdr on the +stack. + +Cc: stable@vger.kernel.org +Fixes: 9bb66906f23e ("io_uring: support multishot in recvmsg") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/net.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/io_uring/net.c b/io_uring/net.c +index 4aaeada03f1e7..386a6745ae32f 100644 +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -915,7 +915,8 @@ int io_recvmsg(struct io_kiocb *req, unsigned int issue_flags) + kfree(kmsg->free_iov); + io_netmsg_recycle(req, issue_flags); + req->flags &= ~REQ_F_NEED_CLEANUP; +- } ++ } else if (ret == -EAGAIN) ++ return io_setup_async_msg(req, kmsg, issue_flags); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/kasan-test-avoid-gcc-warning-for-intentional-overflo.patch b/queue-6.6/kasan-test-avoid-gcc-warning-for-intentional-overflo.patch new file mode 100644 index 00000000000..d6b22670a48 --- /dev/null +++ b/queue-6.6/kasan-test-avoid-gcc-warning-for-intentional-overflo.patch @@ -0,0 +1,56 @@ +From f6e169c153c8510edd4db282dba661189180025e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 12:15:52 +0100 +Subject: kasan/test: avoid gcc warning for intentional overflow + +From: Arnd Bergmann + +[ Upstream commit e10aea105e9ed14b62a11844fec6aaa87c6935a3 ] + +The out-of-bounds test allocates an object that is three bytes too short +in order to validate the bounds checking. Starting with gcc-14, this +causes a compile-time warning as gcc has grown smart enough to understand +the sizeof() logic: + +mm/kasan/kasan_test.c: In function 'kmalloc_oob_16': +mm/kasan/kasan_test.c:443:14: error: allocation of insufficient size '13' for type 'struct ' with size '16' [-Werror=alloc-size] + 443 | ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); + | ^ + +Hide the actual computation behind a RELOC_HIDE() that ensures +the compiler misses the intentional bug. + +Link: https://lkml.kernel.org/r/20240212111609.869266-1-arnd@kernel.org +Fixes: 3f15801cdc23 ("lib: add kasan test module") +Signed-off-by: Arnd Bergmann +Reviewed-by: Andrey Konovalov +Cc: Alexander Potapenko +Cc: Andrey Ryabinin +Cc: Arnd Bergmann +Cc: Dmitry Vyukov +Cc: Marco Elver +Cc: Vincenzo Frascino +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/kasan/kasan_test.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c +index b61cc6a42541a..0119075d2e58e 100644 +--- a/mm/kasan/kasan_test.c ++++ b/mm/kasan/kasan_test.c +@@ -450,7 +450,8 @@ static void kmalloc_oob_16(struct kunit *test) + /* This test is specifically crafted for the generic mode. */ + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); + +- ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); ++ /* RELOC_HIDE to prevent gcc from warning about short alloc */ ++ ptr1 = RELOC_HIDE(kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL), 0); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); + + ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); +-- +2.43.0 + diff --git a/queue-6.6/kbuild-move-wenum-compare-conditional-enum-conversio.patch b/queue-6.6/kbuild-move-wenum-compare-conditional-enum-conversio.patch new file mode 100644 index 00000000000..8dcee491921 --- /dev/null +++ b/queue-6.6/kbuild-move-wenum-compare-conditional-enum-conversio.patch @@ -0,0 +1,72 @@ +From a85935b08bc1f1a5eb9e48d22c86d9ce98b2e5f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 15:12:47 -0700 +Subject: kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 + +From: Nathan Chancellor + +[ Upstream commit 75b5ab134bb5f657ef7979a59106dce0657e8d87 ] + +Clang enables -Wenum-enum-conversion and -Wenum-compare-conditional +under -Wenum-conversion. A recent change in Clang strengthened these +warnings and they appear frequently in common builds, primarily due to +several instances in common headers but there are quite a few drivers +that have individual instances as well. + + include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] + 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + + | ~~~~~~~~~~~~~~~~~~~~~ ^ + 509 | item]; + | ~~~~ + + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c:955:24: warning: conditional expression between different enumeration types ('enum iwl_mac_beacon_flags' and 'enum iwl_mac_beacon_flags_v1') [-Wenum-compare-conditional] + 955 | flags |= is_new_rate ? IWL_MAC_BEACON_CCK + | ^ ~~~~~~~~~~~~~~~~~~ + 956 | : IWL_MAC_BEACON_CCK_V1; + | ~~~~~~~~~~~~~~~~~~~~~ + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c:1120:21: warning: conditional expression between different enumeration types ('enum iwl_mac_beacon_flags' and 'enum iwl_mac_beacon_flags_v1') [-Wenum-compare-conditional] + 1120 | 0) > 10 ? + | ^ + 1121 | IWL_MAC_BEACON_FILS : + | ~~~~~~~~~~~~~~~~~~~ + 1122 | IWL_MAC_BEACON_FILS_V1; + | ~~~~~~~~~~~~~~~~~~~~~~ + +Doing arithmetic between or returning two different types of enums could +be a bug, so each of the instance of the warning needs to be evaluated. +Unfortunately, as mentioned above, there are many instances of this +warning in many different configurations, which can break the build when +CONFIG_WERROR is enabled. + +To avoid introducing new instances of the warnings while cleaning up the +disruption for the majority of users, disable these warnings for the +default build while leaving them on for W=1 builds. + +Cc: stable@vger.kernel.org +Closes: https://github.com/ClangBuiltLinux/linux/issues/2002 +Link: https://github.com/llvm/llvm-project/commit/8c2ae42b3e1c6aa7c18f873edcebff7c0b45a37e +Acked-by: Yonghong Song +Signed-off-by: Nathan Chancellor +Acked-by: Arnd Bergmann +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/Makefile.extrawarn | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn +index 2fe6f2828d376..16c750bb95faf 100644 +--- a/scripts/Makefile.extrawarn ++++ b/scripts/Makefile.extrawarn +@@ -143,6 +143,8 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) + KBUILD_CFLAGS += -Wno-tautological-constant-out-of-range-compare + KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access) + KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict) ++KBUILD_CFLAGS += -Wno-enum-compare-conditional ++KBUILD_CFLAGS += -Wno-enum-enum-conversion + endif + + endif +-- +2.43.0 + diff --git a/queue-6.6/ksmbd-replace-generic_fillattr-with-vfs_getattr.patch b/queue-6.6/ksmbd-replace-generic_fillattr-with-vfs_getattr.patch new file mode 100644 index 00000000000..8666ef58cd9 --- /dev/null +++ b/queue-6.6/ksmbd-replace-generic_fillattr-with-vfs_getattr.patch @@ -0,0 +1,479 @@ +From 391c8f35dfc82f53be2bc7acd083f03ee6bbdc18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 10:58:19 +0100 +Subject: ksmbd: replace generic_fillattr with vfs_getattr + +From: Marios Makassikis + +[ Upstream commit 5614c8c487f6af627614dd2efca038e4afe0c6d7 ] + +generic_fillattr should not be used outside of ->getattr +implementations. + +Use vfs_getattr instead, and adapt functions to return an +error code to the caller. + +Cc: stable@vger.kernel.org +Signed-off-by: Marios Makassikis +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 170 ++++++++++++++++++++++++------------- + fs/smb/server/smb_common.c | 11 ++- + fs/smb/server/vfs.c | 12 ++- + 3 files changed, 127 insertions(+), 66 deletions(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 0c97d3c860726..f6cc5d2730ffb 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -3828,11 +3828,16 @@ static int process_query_dir_entries(struct smb2_query_dir_private *priv) + } + + ksmbd_kstat.kstat = &kstat; +- if (priv->info_level != FILE_NAMES_INFORMATION) +- ksmbd_vfs_fill_dentry_attrs(priv->work, +- idmap, +- dent, +- &ksmbd_kstat); ++ if (priv->info_level != FILE_NAMES_INFORMATION) { ++ rc = ksmbd_vfs_fill_dentry_attrs(priv->work, ++ idmap, ++ dent, ++ &ksmbd_kstat); ++ if (rc) { ++ dput(dent); ++ continue; ++ } ++ } + + rc = smb2_populate_readdir_entry(priv->work->conn, + priv->info_level, +@@ -4480,6 +4485,7 @@ static int get_file_basic_info(struct smb2_query_info_rsp *rsp, + struct smb2_file_basic_info *basic_info; + struct kstat stat; + u64 time; ++ int ret; + + if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { + pr_err("no right to read the attributes : 0x%x\n", +@@ -4487,9 +4493,12 @@ static int get_file_basic_info(struct smb2_query_info_rsp *rsp, + return -EACCES; + } + ++ ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (ret) ++ return ret; ++ + basic_info = (struct smb2_file_basic_info *)rsp->Buffer; +- generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, +- file_inode(fp->filp), &stat); + basic_info->CreationTime = cpu_to_le64(fp->create_time); + time = ksmbd_UnixTimeToNT(stat.atime); + basic_info->LastAccessTime = cpu_to_le64(time); +@@ -4504,27 +4513,31 @@ static int get_file_basic_info(struct smb2_query_info_rsp *rsp, + return 0; + } + +-static void get_file_standard_info(struct smb2_query_info_rsp *rsp, +- struct ksmbd_file *fp, void *rsp_org) ++static int get_file_standard_info(struct smb2_query_info_rsp *rsp, ++ struct ksmbd_file *fp, void *rsp_org) + { + struct smb2_file_standard_info *sinfo; + unsigned int delete_pending; +- struct inode *inode; + struct kstat stat; ++ int ret; + +- inode = file_inode(fp->filp); +- generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, inode, &stat); ++ ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (ret) ++ return ret; + + sinfo = (struct smb2_file_standard_info *)rsp->Buffer; + delete_pending = ksmbd_inode_pending_delete(fp); + +- sinfo->AllocationSize = cpu_to_le64(inode->i_blocks << 9); ++ sinfo->AllocationSize = cpu_to_le64(stat.blocks << 9); + sinfo->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); + sinfo->NumberOfLinks = cpu_to_le32(get_nlink(&stat) - delete_pending); + sinfo->DeletePending = delete_pending; + sinfo->Directory = S_ISDIR(stat.mode) ? 1 : 0; + rsp->OutputBufferLength = + cpu_to_le32(sizeof(struct smb2_file_standard_info)); ++ ++ return 0; + } + + static void get_file_alignment_info(struct smb2_query_info_rsp *rsp, +@@ -4546,11 +4559,11 @@ static int get_file_all_info(struct ksmbd_work *work, + struct ksmbd_conn *conn = work->conn; + struct smb2_file_all_info *file_info; + unsigned int delete_pending; +- struct inode *inode; + struct kstat stat; + int conv_len; + char *filename; + u64 time; ++ int ret; + + if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { + ksmbd_debug(SMB, "no right to read the attributes : 0x%x\n", +@@ -4562,8 +4575,10 @@ static int get_file_all_info(struct ksmbd_work *work, + if (IS_ERR(filename)) + return PTR_ERR(filename); + +- inode = file_inode(fp->filp); +- generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, inode, &stat); ++ ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (ret) ++ return ret; + + ksmbd_debug(SMB, "filename = %s\n", filename); + delete_pending = ksmbd_inode_pending_delete(fp); +@@ -4579,7 +4594,7 @@ static int get_file_all_info(struct ksmbd_work *work, + file_info->Attributes = fp->f_ci->m_fattr; + file_info->Pad1 = 0; + file_info->AllocationSize = +- cpu_to_le64(inode->i_blocks << 9); ++ cpu_to_le64(stat.blocks << 9); + file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); + file_info->NumberOfLinks = + cpu_to_le32(get_nlink(&stat) - delete_pending); +@@ -4623,10 +4638,10 @@ static void get_file_alternate_info(struct ksmbd_work *work, + cpu_to_le32(sizeof(struct smb2_file_alt_name_info) + conv_len); + } + +-static void get_file_stream_info(struct ksmbd_work *work, +- struct smb2_query_info_rsp *rsp, +- struct ksmbd_file *fp, +- void *rsp_org) ++static int get_file_stream_info(struct ksmbd_work *work, ++ struct smb2_query_info_rsp *rsp, ++ struct ksmbd_file *fp, ++ void *rsp_org) + { + struct ksmbd_conn *conn = work->conn; + struct smb2_file_stream_info *file_info; +@@ -4637,9 +4652,13 @@ static void get_file_stream_info(struct ksmbd_work *work, + int nbytes = 0, streamlen, stream_name_len, next, idx = 0; + int buf_free_len; + struct smb2_query_info_req *req = ksmbd_req_buf_next(work); ++ int ret; ++ ++ ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (ret) ++ return ret; + +- generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, +- file_inode(fp->filp), &stat); + file_info = (struct smb2_file_stream_info *)rsp->Buffer; + + buf_free_len = +@@ -4720,29 +4739,37 @@ static void get_file_stream_info(struct ksmbd_work *work, + kvfree(xattr_list); + + rsp->OutputBufferLength = cpu_to_le32(nbytes); ++ ++ return 0; + } + +-static void get_file_internal_info(struct smb2_query_info_rsp *rsp, +- struct ksmbd_file *fp, void *rsp_org) ++static int get_file_internal_info(struct smb2_query_info_rsp *rsp, ++ struct ksmbd_file *fp, void *rsp_org) + { + struct smb2_file_internal_info *file_info; + struct kstat stat; ++ int ret; ++ ++ ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (ret) ++ return ret; + +- generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, +- file_inode(fp->filp), &stat); + file_info = (struct smb2_file_internal_info *)rsp->Buffer; + file_info->IndexNumber = cpu_to_le64(stat.ino); + rsp->OutputBufferLength = + cpu_to_le32(sizeof(struct smb2_file_internal_info)); ++ ++ return 0; + } + + static int get_file_network_open_info(struct smb2_query_info_rsp *rsp, + struct ksmbd_file *fp, void *rsp_org) + { + struct smb2_file_ntwrk_info *file_info; +- struct inode *inode; + struct kstat stat; + u64 time; ++ int ret; + + if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) { + pr_err("no right to read the attributes : 0x%x\n", +@@ -4750,10 +4777,12 @@ static int get_file_network_open_info(struct smb2_query_info_rsp *rsp, + return -EACCES; + } + +- file_info = (struct smb2_file_ntwrk_info *)rsp->Buffer; ++ ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (ret) ++ return ret; + +- inode = file_inode(fp->filp); +- generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, inode, &stat); ++ file_info = (struct smb2_file_ntwrk_info *)rsp->Buffer; + + file_info->CreationTime = cpu_to_le64(fp->create_time); + time = ksmbd_UnixTimeToNT(stat.atime); +@@ -4763,8 +4792,7 @@ static int get_file_network_open_info(struct smb2_query_info_rsp *rsp, + time = ksmbd_UnixTimeToNT(stat.ctime); + file_info->ChangeTime = cpu_to_le64(time); + file_info->Attributes = fp->f_ci->m_fattr; +- file_info->AllocationSize = +- cpu_to_le64(inode->i_blocks << 9); ++ file_info->AllocationSize = cpu_to_le64(stat.blocks << 9); + file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size); + file_info->Reserved = cpu_to_le32(0); + rsp->OutputBufferLength = +@@ -4804,14 +4832,17 @@ static void get_file_mode_info(struct smb2_query_info_rsp *rsp, + cpu_to_le32(sizeof(struct smb2_file_mode_info)); + } + +-static void get_file_compression_info(struct smb2_query_info_rsp *rsp, +- struct ksmbd_file *fp, void *rsp_org) ++static int get_file_compression_info(struct smb2_query_info_rsp *rsp, ++ struct ksmbd_file *fp, void *rsp_org) + { + struct smb2_file_comp_info *file_info; + struct kstat stat; ++ int ret; + +- generic_fillattr(file_mnt_idmap(fp->filp), STATX_BASIC_STATS, +- file_inode(fp->filp), &stat); ++ ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (ret) ++ return ret; + + file_info = (struct smb2_file_comp_info *)rsp->Buffer; + file_info->CompressedFileSize = cpu_to_le64(stat.blocks << 9); +@@ -4823,6 +4854,8 @@ static void get_file_compression_info(struct smb2_query_info_rsp *rsp, + + rsp->OutputBufferLength = + cpu_to_le32(sizeof(struct smb2_file_comp_info)); ++ ++ return 0; + } + + static int get_file_attribute_tag_info(struct smb2_query_info_rsp *rsp, +@@ -4844,7 +4877,7 @@ static int get_file_attribute_tag_info(struct smb2_query_info_rsp *rsp, + return 0; + } + +-static void find_file_posix_info(struct smb2_query_info_rsp *rsp, ++static int find_file_posix_info(struct smb2_query_info_rsp *rsp, + struct ksmbd_file *fp, void *rsp_org) + { + struct smb311_posix_qinfo *file_info; +@@ -4852,24 +4885,31 @@ static void find_file_posix_info(struct smb2_query_info_rsp *rsp, + struct mnt_idmap *idmap = file_mnt_idmap(fp->filp); + vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode); + vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode); ++ struct kstat stat; + u64 time; + int out_buf_len = sizeof(struct smb311_posix_qinfo) + 32; ++ int ret; ++ ++ ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (ret) ++ return ret; + + file_info = (struct smb311_posix_qinfo *)rsp->Buffer; + file_info->CreationTime = cpu_to_le64(fp->create_time); +- time = ksmbd_UnixTimeToNT(inode_get_atime(inode)); ++ time = ksmbd_UnixTimeToNT(stat.atime); + file_info->LastAccessTime = cpu_to_le64(time); +- time = ksmbd_UnixTimeToNT(inode_get_mtime(inode)); ++ time = ksmbd_UnixTimeToNT(stat.mtime); + file_info->LastWriteTime = cpu_to_le64(time); +- time = ksmbd_UnixTimeToNT(inode_get_ctime(inode)); ++ time = ksmbd_UnixTimeToNT(stat.ctime); + file_info->ChangeTime = cpu_to_le64(time); + file_info->DosAttributes = fp->f_ci->m_fattr; +- file_info->Inode = cpu_to_le64(inode->i_ino); +- file_info->EndOfFile = cpu_to_le64(inode->i_size); +- file_info->AllocationSize = cpu_to_le64(inode->i_blocks << 9); +- file_info->HardLinks = cpu_to_le32(inode->i_nlink); +- file_info->Mode = cpu_to_le32(inode->i_mode & 0777); +- file_info->DeviceId = cpu_to_le32(inode->i_rdev); ++ file_info->Inode = cpu_to_le64(stat.ino); ++ file_info->EndOfFile = cpu_to_le64(stat.size); ++ file_info->AllocationSize = cpu_to_le64(stat.blocks << 9); ++ file_info->HardLinks = cpu_to_le32(stat.nlink); ++ file_info->Mode = cpu_to_le32(stat.mode & 0777); ++ file_info->DeviceId = cpu_to_le32(stat.rdev); + + /* + * Sids(32) contain two sids(Domain sid(16), UNIX group sid(16)). +@@ -4882,6 +4922,8 @@ static void find_file_posix_info(struct smb2_query_info_rsp *rsp, + SIDUNIX_GROUP, (struct smb_sid *)&file_info->Sids[16]); + + rsp->OutputBufferLength = cpu_to_le32(out_buf_len); ++ ++ return 0; + } + + static int smb2_get_info_file(struct ksmbd_work *work, +@@ -4930,7 +4972,7 @@ static int smb2_get_info_file(struct ksmbd_work *work, + break; + + case FILE_STANDARD_INFORMATION: +- get_file_standard_info(rsp, fp, work->response_buf); ++ rc = get_file_standard_info(rsp, fp, work->response_buf); + break; + + case FILE_ALIGNMENT_INFORMATION: +@@ -4946,11 +4988,11 @@ static int smb2_get_info_file(struct ksmbd_work *work, + break; + + case FILE_STREAM_INFORMATION: +- get_file_stream_info(work, rsp, fp, work->response_buf); ++ rc = get_file_stream_info(work, rsp, fp, work->response_buf); + break; + + case FILE_INTERNAL_INFORMATION: +- get_file_internal_info(rsp, fp, work->response_buf); ++ rc = get_file_internal_info(rsp, fp, work->response_buf); + break; + + case FILE_NETWORK_OPEN_INFORMATION: +@@ -4974,7 +5016,7 @@ static int smb2_get_info_file(struct ksmbd_work *work, + break; + + case FILE_COMPRESSION_INFORMATION: +- get_file_compression_info(rsp, fp, work->response_buf); ++ rc = get_file_compression_info(rsp, fp, work->response_buf); + break; + + case FILE_ATTRIBUTE_TAG_INFORMATION: +@@ -4985,7 +5027,7 @@ static int smb2_get_info_file(struct ksmbd_work *work, + pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n"); + rc = -EOPNOTSUPP; + } else { +- find_file_posix_info(rsp, fp, work->response_buf); ++ rc = find_file_posix_info(rsp, fp, work->response_buf); + } + break; + default: +@@ -5398,7 +5440,6 @@ int smb2_close(struct ksmbd_work *work) + struct smb2_close_rsp *rsp; + struct ksmbd_conn *conn = work->conn; + struct ksmbd_file *fp; +- struct inode *inode; + u64 time; + int err = 0; + +@@ -5453,24 +5494,33 @@ int smb2_close(struct ksmbd_work *work) + rsp->Reserved = 0; + + if (req->Flags == SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB) { ++ struct kstat stat; ++ int ret; ++ + fp = ksmbd_lookup_fd_fast(work, volatile_id); + if (!fp) { + err = -ENOENT; + goto out; + } + +- inode = file_inode(fp->filp); ++ ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (ret) { ++ ksmbd_fd_put(work, fp); ++ goto out; ++ } ++ + rsp->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB; +- rsp->AllocationSize = S_ISDIR(inode->i_mode) ? 0 : +- cpu_to_le64(inode->i_blocks << 9); +- rsp->EndOfFile = cpu_to_le64(inode->i_size); ++ rsp->AllocationSize = S_ISDIR(stat.mode) ? 0 : ++ cpu_to_le64(stat.blocks << 9); ++ rsp->EndOfFile = cpu_to_le64(stat.size); + rsp->Attributes = fp->f_ci->m_fattr; + rsp->CreationTime = cpu_to_le64(fp->create_time); +- time = ksmbd_UnixTimeToNT(inode_get_atime(inode)); ++ time = ksmbd_UnixTimeToNT(stat.atime); + rsp->LastAccessTime = cpu_to_le64(time); +- time = ksmbd_UnixTimeToNT(inode_get_mtime(inode)); ++ time = ksmbd_UnixTimeToNT(stat.mtime); + rsp->LastWriteTime = cpu_to_le64(time); +- time = ksmbd_UnixTimeToNT(inode_get_ctime(inode)); ++ time = ksmbd_UnixTimeToNT(stat.ctime); + rsp->ChangeTime = cpu_to_le64(time); + ksmbd_fd_put(work, fp); + } else { +diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c +index 7c98bf699772f..fcaf373cc0080 100644 +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -457,10 +457,13 @@ int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level, + } + + ksmbd_kstat.kstat = &kstat; +- ksmbd_vfs_fill_dentry_attrs(work, +- idmap, +- dentry, +- &ksmbd_kstat); ++ rc = ksmbd_vfs_fill_dentry_attrs(work, ++ idmap, ++ dentry, ++ &ksmbd_kstat); ++ if (rc) ++ break; ++ + rc = fn(conn, info_level, d_info, &ksmbd_kstat); + if (rc) + break; +diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c +index 4277750a6da1b..a8936aba7710e 100644 +--- a/fs/smb/server/vfs.c ++++ b/fs/smb/server/vfs.c +@@ -1669,11 +1669,19 @@ int ksmbd_vfs_fill_dentry_attrs(struct ksmbd_work *work, + struct dentry *dentry, + struct ksmbd_kstat *ksmbd_kstat) + { ++ struct ksmbd_share_config *share_conf = work->tcon->share_conf; + u64 time; + int rc; ++ struct path path = { ++ .mnt = share_conf->vfs_path.mnt, ++ .dentry = dentry, ++ }; + +- generic_fillattr(idmap, STATX_BASIC_STATS, d_inode(dentry), +- ksmbd_kstat->kstat); ++ rc = vfs_getattr(&path, ksmbd_kstat->kstat, ++ STATX_BASIC_STATS | STATX_BTIME, ++ AT_STATX_SYNC_AS_STAT); ++ if (rc) ++ return rc; + + time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->ctime); + ksmbd_kstat->create_time = time; +-- +2.43.0 + diff --git a/queue-6.6/ksmbd-retrieve-number-of-blocks-using-vfs_getattr-in.patch b/queue-6.6/ksmbd-retrieve-number-of-blocks-using-vfs_getattr-in.patch new file mode 100644 index 00000000000..647134f1c42 --- /dev/null +++ b/queue-6.6/ksmbd-retrieve-number-of-blocks-using-vfs_getattr-in.patch @@ -0,0 +1,61 @@ +From 7da6eb3810d444392222f9127d04bbd9251357f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 10:58:21 +0100 +Subject: ksmbd: retrieve number of blocks using vfs_getattr in + set_file_allocation_info + +From: Marios Makassikis + +[ Upstream commit 34cd86b6632718b7df3999d96f51e63de41c5e4f ] + +Use vfs_getattr() to retrieve stat information, rather than make +assumptions about how a filesystem fills inode structs. + +Cc: stable@vger.kernel.org +Signed-off-by: Marios Makassikis +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index f6cc5d2730ffb..199c31c275e5b 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -5809,15 +5809,21 @@ static int set_file_allocation_info(struct ksmbd_work *work, + + loff_t alloc_blks; + struct inode *inode; ++ struct kstat stat; + int rc; + + if (!(fp->daccess & FILE_WRITE_DATA_LE)) + return -EACCES; + ++ rc = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (rc) ++ return rc; ++ + alloc_blks = (le64_to_cpu(file_alloc_info->AllocationSize) + 511) >> 9; + inode = file_inode(fp->filp); + +- if (alloc_blks > inode->i_blocks) { ++ if (alloc_blks > stat.blocks) { + smb_break_all_levII_oplock(work, fp, 1); + rc = vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0, + alloc_blks * 512); +@@ -5825,7 +5831,7 @@ static int set_file_allocation_info(struct ksmbd_work *work, + pr_err("vfs_fallocate is failed : %d\n", rc); + return rc; + } +- } else if (alloc_blks < inode->i_blocks) { ++ } else if (alloc_blks < stat.blocks) { + loff_t size; + + /* +-- +2.43.0 + diff --git a/queue-6.6/kvm-always-flush-async-pf-workqueue-when-vcpu-is-bei.patch b/queue-6.6/kvm-always-flush-async-pf-workqueue-when-vcpu-is-bei.patch new file mode 100644 index 00000000000..d3394fae9c1 --- /dev/null +++ b/queue-6.6/kvm-always-flush-async-pf-workqueue-when-vcpu-is-bei.patch @@ -0,0 +1,183 @@ +From 081dc95179b16dec6ecd71a09b68f12727cc5f23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 17:15:30 -0800 +Subject: KVM: Always flush async #PF workqueue when vCPU is being destroyed + +From: Sean Christopherson + +[ Upstream commit 3d75b8aa5c29058a512db29da7cbee8052724157 ] + +Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its +completion queue, e.g. when a VM and all its vCPUs is being destroyed. +KVM must ensure that none of its workqueue callbacks is running when the +last reference to the KVM _module_ is put. Gifting a reference to the +associated VM prevents the workqueue callback from dereferencing freed +vCPU/VM memory, but does not prevent the KVM module from being unloaded +before the callback completes. + +Drop the misguided VM refcount gifting, as calling kvm_put_kvm() from +async_pf_execute() if kvm_put_kvm() flushes the async #PF workqueue will +result in deadlock. async_pf_execute() can't return until kvm_put_kvm() +finishes, and kvm_put_kvm() can't return until async_pf_execute() finishes: + + WARNING: CPU: 8 PID: 251 at virt/kvm/kvm_main.c:1435 kvm_put_kvm+0x2d/0x320 [kvm] + Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel kvm irqbypass + CPU: 8 PID: 251 Comm: kworker/8:1 Tainted: G W 6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 + Workqueue: events async_pf_execute [kvm] + RIP: 0010:kvm_put_kvm+0x2d/0x320 [kvm] + Call Trace: + + async_pf_execute+0x198/0x260 [kvm] + process_one_work+0x145/0x2d0 + worker_thread+0x27e/0x3a0 + kthread+0xba/0xe0 + ret_from_fork+0x2d/0x50 + ret_from_fork_asm+0x11/0x20 + + ---[ end trace 0000000000000000 ]--- + INFO: task kworker/8:1:251 blocked for more than 120 seconds. + Tainted: G W 6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119 + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + task:kworker/8:1 state:D stack:0 pid:251 ppid:2 flags:0x00004000 + Workqueue: events async_pf_execute [kvm] + Call Trace: + + __schedule+0x33f/0xa40 + schedule+0x53/0xc0 + schedule_timeout+0x12a/0x140 + __wait_for_common+0x8d/0x1d0 + __flush_work.isra.0+0x19f/0x2c0 + kvm_clear_async_pf_completion_queue+0x129/0x190 [kvm] + kvm_arch_destroy_vm+0x78/0x1b0 [kvm] + kvm_put_kvm+0x1c1/0x320 [kvm] + async_pf_execute+0x198/0x260 [kvm] + process_one_work+0x145/0x2d0 + worker_thread+0x27e/0x3a0 + kthread+0xba/0xe0 + ret_from_fork+0x2d/0x50 + ret_from_fork_asm+0x11/0x20 + + +If kvm_clear_async_pf_completion_queue() actually flushes the workqueue, +then there's no need to gift async_pf_execute() a reference because all +invocations of async_pf_execute() will be forced to complete before the +vCPU and its VM are destroyed/freed. And that in turn fixes the module +unloading bug as __fput() won't do module_put() on the last vCPU reference +until the vCPU has been freed, e.g. if closing the vCPU file also puts the +last reference to the KVM module. + +Note that kvm_check_async_pf_completion() may also take the work item off +the completion queue and so also needs to flush the work queue, as the +work will not be seen by kvm_clear_async_pf_completion_queue(). Waiting +on the workqueue could theoretically delay a vCPU due to waiting for the +work to complete, but that's a very, very small chance, and likely a very +small delay. kvm_arch_async_page_present_queued() unconditionally makes a +new request, i.e. will effectively delay entering the guest, so the +remaining work is really just: + + trace_kvm_async_pf_completed(addr, cr2_or_gpa); + + __kvm_vcpu_wake_up(vcpu); + + mmput(mm); + +and mmput() can't drop the last reference to the page tables if the vCPU is +still alive, i.e. the vCPU won't get stuck tearing down page tables. + +Add a helper to do the flushing, specifically to deal with "wakeup all" +work items, as they aren't actually work items, i.e. are never placed in a +workqueue. Trying to flush a bogus workqueue entry rightly makes +__flush_work() complain (kudos to whoever added that sanity check). + +Note, commit 5f6de5cbebee ("KVM: Prevent module exit until all VMs are +freed") *tried* to fix the module refcounting issue by having VMs grab a +reference to the module, but that only made the bug slightly harder to hit +as it gave async_pf_execute() a bit more time to complete before the KVM +module could be unloaded. + +Fixes: af585b921e5d ("KVM: Halt vcpu if page it tries to access is swapped out") +Cc: stable@vger.kernel.org +Cc: David Matlack +Reviewed-by: Xu Yilun +Reviewed-by: Vitaly Kuznetsov +Link: https://lore.kernel.org/r/20240110011533.503302-2-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Sasha Levin +--- + virt/kvm/async_pf.c | 31 ++++++++++++++++++++++++++----- + 1 file changed, 26 insertions(+), 5 deletions(-) + +diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c +index e033c79d528e0..28658b9e0d968 100644 +--- a/virt/kvm/async_pf.c ++++ b/virt/kvm/async_pf.c +@@ -87,7 +87,27 @@ static void async_pf_execute(struct work_struct *work) + __kvm_vcpu_wake_up(vcpu); + + mmput(mm); +- kvm_put_kvm(vcpu->kvm); ++} ++ ++static void kvm_flush_and_free_async_pf_work(struct kvm_async_pf *work) ++{ ++ /* ++ * The async #PF is "done", but KVM must wait for the work item itself, ++ * i.e. async_pf_execute(), to run to completion. If KVM is a module, ++ * KVM must ensure *no* code owned by the KVM (the module) can be run ++ * after the last call to module_put(). Note, flushing the work item ++ * is always required when the item is taken off the completion queue. ++ * E.g. even if the vCPU handles the item in the "normal" path, the VM ++ * could be terminated before async_pf_execute() completes. ++ * ++ * Wake all events skip the queue and go straight done, i.e. don't ++ * need to be flushed (but sanity check that the work wasn't queued). ++ */ ++ if (work->wakeup_all) ++ WARN_ON_ONCE(work->work.func); ++ else ++ flush_work(&work->work); ++ kmem_cache_free(async_pf_cache, work); + } + + void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu) +@@ -114,7 +134,6 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu) + #else + if (cancel_work_sync(&work->work)) { + mmput(work->mm); +- kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */ + kmem_cache_free(async_pf_cache, work); + } + #endif +@@ -126,7 +145,10 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu) + list_first_entry(&vcpu->async_pf.done, + typeof(*work), link); + list_del(&work->link); +- kmem_cache_free(async_pf_cache, work); ++ ++ spin_unlock(&vcpu->async_pf.lock); ++ kvm_flush_and_free_async_pf_work(work); ++ spin_lock(&vcpu->async_pf.lock); + } + spin_unlock(&vcpu->async_pf.lock); + +@@ -151,7 +173,7 @@ void kvm_check_async_pf_completion(struct kvm_vcpu *vcpu) + + list_del(&work->queue); + vcpu->async_pf.queued--; +- kmem_cache_free(async_pf_cache, work); ++ kvm_flush_and_free_async_pf_work(work); + } + } + +@@ -186,7 +208,6 @@ bool kvm_setup_async_pf(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, + work->arch = *arch; + work->mm = current->mm; + mmget(work->mm); +- kvm_get_kvm(work->vcpu->kvm); + + INIT_WORK(&work->work, async_pf_execute); + +-- +2.43.0 + diff --git a/queue-6.6/kvm-x86-xen-inject-vcpu-upcall-vector-when-local-api.patch b/queue-6.6/kvm-x86-xen-inject-vcpu-upcall-vector-when-local-api.patch new file mode 100644 index 00000000000..55c1f1c6471 --- /dev/null +++ b/queue-6.6/kvm-x86-xen-inject-vcpu-upcall-vector-when-local-api.patch @@ -0,0 +1,124 @@ +From 32bde352efbc1e6352eba7995ea0ea1c4e664e21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 11:49:16 +0000 +Subject: KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled + +From: David Woodhouse + +[ Upstream commit 8e62bf2bfa46367e14d0ffdcde5aada08759497c ] + +Linux guests since commit b1c3497e604d ("x86/xen: Add support for +HVMOP_set_evtchn_upcall_vector") in v6.0 onwards will use the per-vCPU +upcall vector when it's advertised in the Xen CPUID leaves. + +This upcall is injected through the guest's local APIC as an MSI, unlike +the older system vector which was merely injected by the hypervisor any +time the CPU was able to receive an interrupt and the upcall_pending +flags is set in its vcpu_info. + +Effectively, that makes the per-CPU upcall edge triggered instead of +level triggered, which results in the upcall being lost if the MSI is +delivered when the local APIC is *disabled*. + +Xen checks the vcpu_info->evtchn_upcall_pending flag when the local APIC +for a vCPU is software enabled (in fact, on any write to the SPIV +register which doesn't disable the APIC). Do the same in KVM since KVM +doesn't provide a way for userspace to intervene and trap accesses to +the SPIV register of a local APIC emulated by KVM. + +Fixes: fde0451be8fb3 ("KVM: x86/xen: Support per-vCPU event channel upcall via local APIC") +Signed-off-by: David Woodhouse +Reviewed-by: Paul Durrant +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240227115648.3104-3-dwmw2@infradead.org +Signed-off-by: Sean Christopherson +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/lapic.c | 5 ++++- + arch/x86/kvm/xen.c | 2 +- + arch/x86/kvm/xen.h | 18 ++++++++++++++++++ + 3 files changed, 23 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 245b20973caee..23fab75993a51 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -41,6 +41,7 @@ + #include "ioapic.h" + #include "trace.h" + #include "x86.h" ++#include "xen.h" + #include "cpuid.h" + #include "hyperv.h" + #include "smm.h" +@@ -499,8 +500,10 @@ static inline void apic_set_spiv(struct kvm_lapic *apic, u32 val) + } + + /* Check if there are APF page ready requests pending */ +- if (enabled) ++ if (enabled) { + kvm_make_request(KVM_REQ_APF_READY, apic->vcpu); ++ kvm_xen_sw_enable_lapic(apic->vcpu); ++ } + } + + static inline void kvm_apic_set_xapic_id(struct kvm_lapic *apic, u8 id) +diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c +index 40edf4d1974c5..0ea6016ad132a 100644 +--- a/arch/x86/kvm/xen.c ++++ b/arch/x86/kvm/xen.c +@@ -471,7 +471,7 @@ void kvm_xen_update_runstate(struct kvm_vcpu *v, int state) + kvm_xen_update_runstate_guest(v, state == RUNSTATE_runnable); + } + +-static void kvm_xen_inject_vcpu_vector(struct kvm_vcpu *v) ++void kvm_xen_inject_vcpu_vector(struct kvm_vcpu *v) + { + struct kvm_lapic_irq irq = { }; + int r; +diff --git a/arch/x86/kvm/xen.h b/arch/x86/kvm/xen.h +index f8f1fe22d0906..f5841d9000aeb 100644 +--- a/arch/x86/kvm/xen.h ++++ b/arch/x86/kvm/xen.h +@@ -18,6 +18,7 @@ extern struct static_key_false_deferred kvm_xen_enabled; + + int __kvm_xen_has_interrupt(struct kvm_vcpu *vcpu); + void kvm_xen_inject_pending_events(struct kvm_vcpu *vcpu); ++void kvm_xen_inject_vcpu_vector(struct kvm_vcpu *vcpu); + int kvm_xen_vcpu_set_attr(struct kvm_vcpu *vcpu, struct kvm_xen_vcpu_attr *data); + int kvm_xen_vcpu_get_attr(struct kvm_vcpu *vcpu, struct kvm_xen_vcpu_attr *data); + int kvm_xen_hvm_set_attr(struct kvm *kvm, struct kvm_xen_hvm_attr *data); +@@ -36,6 +37,19 @@ int kvm_xen_setup_evtchn(struct kvm *kvm, + const struct kvm_irq_routing_entry *ue); + void kvm_xen_update_tsc_info(struct kvm_vcpu *vcpu); + ++static inline void kvm_xen_sw_enable_lapic(struct kvm_vcpu *vcpu) ++{ ++ /* ++ * The local APIC is being enabled. If the per-vCPU upcall vector is ++ * set and the vCPU's evtchn_upcall_pending flag is set, inject the ++ * interrupt. ++ */ ++ if (static_branch_unlikely(&kvm_xen_enabled.key) && ++ vcpu->arch.xen.vcpu_info_cache.active && ++ vcpu->arch.xen.upcall_vector && __kvm_xen_has_interrupt(vcpu)) ++ kvm_xen_inject_vcpu_vector(vcpu); ++} ++ + static inline bool kvm_xen_msr_enabled(struct kvm *kvm) + { + return static_branch_unlikely(&kvm_xen_enabled.key) && +@@ -101,6 +115,10 @@ static inline void kvm_xen_destroy_vcpu(struct kvm_vcpu *vcpu) + { + } + ++static inline void kvm_xen_sw_enable_lapic(struct kvm_vcpu *vcpu) ++{ ++} ++ + static inline bool kvm_xen_msr_enabled(struct kvm *kvm) + { + return false; +-- +2.43.0 + diff --git a/queue-6.6/landlock-warn-once-if-a-landlock-action-is-requested.patch b/queue-6.6/landlock-warn-once-if-a-landlock-action-is-requested.patch new file mode 100644 index 00000000000..44fd576b7b0 --- /dev/null +++ b/queue-6.6/landlock-warn-once-if-a-landlock-action-is-requested.patch @@ -0,0 +1,83 @@ +From b0efa7996fff396a578ffc420c755f22f02f24cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 12:05:50 +0100 +Subject: landlock: Warn once if a Landlock action is requested while disabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 782191c74875cc33b50263e21d76080b1411884d ] + +Because sandboxing can be used as an opportunistic security measure, +user space may not log unsupported features. Let the system +administrator know if an application tries to use Landlock but failed +because it isn't enabled at boot time. This may be caused by boot +loader configurations with outdated "lsm" kernel's command-line +parameter. + +Cc: stable@vger.kernel.org +Fixes: 265885daf3e5 ("landlock: Add syscall implementations") +Reviewed-by: Kees Cook +Reviewed-by: Günther Noack +Link: https://lore.kernel.org/r/20240227110550.3702236-2-mic@digikod.net +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + security/landlock/syscalls.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c +index 245cc650a4dc9..336bedaa3af68 100644 +--- a/security/landlock/syscalls.c ++++ b/security/landlock/syscalls.c +@@ -32,6 +32,18 @@ + #include "ruleset.h" + #include "setup.h" + ++static bool is_initialized(void) ++{ ++ if (likely(landlock_initialized)) ++ return true; ++ ++ pr_warn_once( ++ "Disabled but requested by user space. " ++ "You should enable Landlock at boot time: " ++ "https://docs.kernel.org/userspace-api/landlock.html#boot-time-configuration\n"); ++ return false; ++} ++ + /** + * copy_min_struct_from_user - Safe future-proof argument copying + * +@@ -165,7 +177,7 @@ SYSCALL_DEFINE3(landlock_create_ruleset, + /* Build-time checks. */ + build_check_abi(); + +- if (!landlock_initialized) ++ if (!is_initialized()) + return -EOPNOTSUPP; + + if (flags) { +@@ -311,7 +323,7 @@ SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd, + struct landlock_ruleset *ruleset; + int res, err; + +- if (!landlock_initialized) ++ if (!is_initialized()) + return -EOPNOTSUPP; + + /* No flag for now. */ +@@ -402,7 +414,7 @@ SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32, + struct landlock_cred_security *new_llcred; + int err; + +- if (!landlock_initialized) ++ if (!is_initialized()) + return -EOPNOTSUPP; + + /* +-- +2.43.0 + diff --git a/queue-6.6/leds-trigger-netdev-fix-kernel-panic-on-interface-re.patch b/queue-6.6/leds-trigger-netdev-fix-kernel-panic-on-interface-re.patch new file mode 100644 index 00000000000..39750d17813 --- /dev/null +++ b/queue-6.6/leds-trigger-netdev-fix-kernel-panic-on-interface-re.patch @@ -0,0 +1,65 @@ +From 876944ab46acd73a739675dce60358e614e26332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Feb 2024 00:54:01 +0100 +Subject: leds: trigger: netdev: Fix kernel panic on interface rename trig + notify + +From: Christian Marangi + +[ Upstream commit 415798bc07dd1c1ae3a656aa026580816e0b9fe8 ] + +Commit d5e01266e7f5 ("leds: trigger: netdev: add additional specific link +speed mode") in the various changes, reworked the way to set the LINKUP +mode in commit cee4bd16c319 ("leds: trigger: netdev: Recheck +NETDEV_LED_MODE_LINKUP on dev rename") and moved it to a generic function. + +This changed the logic where, in the previous implementation the dev +from the trigger event was used to check if the carrier was ok, but in +the new implementation with the generic function, the dev in +trigger_data is used instead. + +This is problematic and cause a possible kernel panic due to the fact +that the dev in the trigger_data still reference the old one as the +new one (passed from the trigger event) still has to be hold and saved +in the trigger_data struct (done in the NETDEV_REGISTER case). + +On calling of get_device_state(), an invalid net_dev is used and this +cause a kernel panic. + +To handle this correctly, move the call to get_device_state() after the +new net_dev is correctly set in trigger_data (in the NETDEV_REGISTER +case) and correctly parse the new dev. + +Fixes: d5e01266e7f5 ("leds: trigger: netdev: add additional specific link speed mode") +Cc: stable@vger.kernel.org +Signed-off-by: Christian Marangi +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20240203235413.1146-1-ansuelsmth@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/trigger/ledtrig-netdev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c +index d76214fa9ad86..79719fc8a08fb 100644 +--- a/drivers/leds/trigger/ledtrig-netdev.c ++++ b/drivers/leds/trigger/ledtrig-netdev.c +@@ -462,12 +462,12 @@ static int netdev_trig_notify(struct notifier_block *nb, + trigger_data->duplex = DUPLEX_UNKNOWN; + switch (evt) { + case NETDEV_CHANGENAME: +- get_device_state(trigger_data); +- fallthrough; + case NETDEV_REGISTER: + dev_put(trigger_data->net_dev); + dev_hold(dev); + trigger_data->net_dev = dev; ++ if (evt == NETDEV_CHANGENAME) ++ get_device_state(trigger_data); + break; + case NETDEV_UNREGISTER: + dev_put(trigger_data->net_dev); +-- +2.43.0 + diff --git a/queue-6.6/loongarch-change-__my_cpu_offset-definition-to-avoid.patch b/queue-6.6/loongarch-change-__my_cpu_offset-definition-to-avoid.patch new file mode 100644 index 00000000000..9494cd68eee --- /dev/null +++ b/queue-6.6/loongarch-change-__my_cpu_offset-definition-to-avoid.patch @@ -0,0 +1,58 @@ +From 39b2642fe680aaa45ed0ded811acc303323cd9f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 15:50:34 +0800 +Subject: LoongArch: Change __my_cpu_offset definition to avoid + mis-optimization + +From: Huacai Chen + +[ Upstream commit c87e12e0e8c1241410e758e181ca6bf23efa5b5b ] + +From GCC commit 3f13154553f8546a ("df-scan: remove ad-hoc handling of +global regs in asms"), global registers will no longer be forced to add +to the def-use chain. Then current_thread_info(), current_stack_pointer +and __my_cpu_offset may be lifted out of the loop because they are no +longer treated as "volatile variables". + +This optimization is still correct for the current_thread_info() and +current_stack_pointer usages because they are associated to a thread. +However it is wrong for __my_cpu_offset because it is associated to a +CPU rather than a thread: if the thread migrates to a different CPU in +the loop, __my_cpu_offset should be changed. + +Change __my_cpu_offset definition to treat it as a "volatile variable", +in order to avoid such a mis-optimization. + +Cc: stable@vger.kernel.org +Reported-by: Xiaotian Wu +Reported-by: Miao Wang +Signed-off-by: Xing Li +Signed-off-by: Hongchen Zhang +Signed-off-by: Rui Wang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/percpu.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/loongarch/include/asm/percpu.h b/arch/loongarch/include/asm/percpu.h +index ed5da02b1cf6f..7e804140500f1 100644 +--- a/arch/loongarch/include/asm/percpu.h ++++ b/arch/loongarch/include/asm/percpu.h +@@ -29,7 +29,12 @@ static inline void set_my_cpu_offset(unsigned long off) + __my_cpu_offset = off; + csr_write64(off, PERCPU_BASE_KS); + } +-#define __my_cpu_offset __my_cpu_offset ++ ++#define __my_cpu_offset \ ++({ \ ++ __asm__ __volatile__("":"+r"(__my_cpu_offset)); \ ++ __my_cpu_offset; \ ++}) + + #define PERCPU_OP(op, asm_op, c_op) \ + static __always_inline unsigned long __percpu_##op(void *ptr, \ +-- +2.43.0 + diff --git a/queue-6.6/loongarch-crypto-clean-up-useless-assignment-operati.patch b/queue-6.6/loongarch-crypto-clean-up-useless-assignment-operati.patch new file mode 100644 index 00000000000..68344bd26bf --- /dev/null +++ b/queue-6.6/loongarch-crypto-clean-up-useless-assignment-operati.patch @@ -0,0 +1,50 @@ +From 18ed51cd1e5cfcb1ca527acdfbaeab57ab3a612c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 15:50:34 +0800 +Subject: LoongArch/crypto: Clean up useless assignment operations + +From: Yuli Wang + +[ Upstream commit fea1c949f6ca5059e12de00d0483645debc5b206 ] + +The LoongArch CRC32 hw acceleration is based on arch/mips/crypto/ +crc32-mips.c. While the MIPS code supports both MIPS32 and MIPS64, +but LoongArch32 lacks the CRC instruction. As a result, the line +"len -= sizeof(u32)" is unnecessary. + +Removing it can make context code style more unified and improve +code readability. + +Cc: stable@vger.kernel.org +Reviewed-by: WANG Xuerui +Suggested-by: Wentao Guan +Signed-off-by: Yuli Wang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/crypto/crc32-loongarch.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/loongarch/crypto/crc32-loongarch.c b/arch/loongarch/crypto/crc32-loongarch.c +index 1f2a2c3839bcb..1e8ff57a46ca6 100644 +--- a/arch/loongarch/crypto/crc32-loongarch.c ++++ b/arch/loongarch/crypto/crc32-loongarch.c +@@ -44,7 +44,6 @@ static u32 crc32_loongarch_hw(u32 crc_, const u8 *p, unsigned int len) + + CRC32(crc, value, w); + p += sizeof(u32); +- len -= sizeof(u32); + } + + if (len & sizeof(u16)) { +@@ -80,7 +79,6 @@ static u32 crc32c_loongarch_hw(u32 crc_, const u8 *p, unsigned int len) + + CRC32C(crc, value, w); + p += sizeof(u32); +- len -= sizeof(u32); + } + + if (len & sizeof(u16)) { +-- +2.43.0 + diff --git a/queue-6.6/loongarch-define-the-__io_aw-hook-as-mmiowb.patch b/queue-6.6/loongarch-define-the-__io_aw-hook-as-mmiowb.patch new file mode 100644 index 00000000000..c6b4ca53d62 --- /dev/null +++ b/queue-6.6/loongarch-define-the-__io_aw-hook-as-mmiowb.patch @@ -0,0 +1,117 @@ +From 2b62f6e20369bf49c95859d693b080c8b7d1b4b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 15:50:34 +0800 +Subject: LoongArch: Define the __io_aw() hook as mmiowb() + +From: Huacai Chen + +[ Upstream commit 9c68ece8b2a5c5ff9b2fcaea923dd73efeb174cd ] + +Commit fb24ea52f78e0d595852e ("drivers: Remove explicit invocations of +mmiowb()") remove all mmiowb() in drivers, but it says: + +"NOTE: mmiowb() has only ever guaranteed ordering in conjunction with +spin_unlock(). However, pairing each mmiowb() removal in this patch with +the corresponding call to spin_unlock() is not at all trivial, so there +is a small chance that this change may regress any drivers incorrectly +relying on mmiowb() to order MMIO writes between CPUs using lock-free +synchronisation." + +The mmio in radeon_ring_commit() is protected by a mutex rather than a +spinlock, but in the mutex fastpath it behaves similar to spinlock. We +can add mmiowb() calls in the radeon driver but the maintainer says he +doesn't like such a workaround, and radeon is not the only example of +mutex protected mmio. + +So we should extend the mmiowb tracking system from spinlock to mutex, +and maybe other locking primitives. This is not easy and error prone, so +we solve it in the architectural code, by simply defining the __io_aw() +hook as mmiowb(). And we no longer need to override queued_spin_unlock() +so use the generic definition. + +Without this, we get such an error when run 'glxgears' on weak ordering +architectures such as LoongArch: + +radeon 0000:04:00.0: ring 0 stalled for more than 10324msec +radeon 0000:04:00.0: ring 3 stalled for more than 10240msec +radeon 0000:04:00.0: GPU lockup (current fence id 0x000000000001f412 last fence id 0x000000000001f414 on ring 3) +radeon 0000:04:00.0: GPU lockup (current fence id 0x000000000000f940 last fence id 0x000000000000f941 on ring 0) +radeon 0000:04:00.0: scheduling IB failed (-35). +[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) +radeon 0000:04:00.0: scheduling IB failed (-35). +[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) +radeon 0000:04:00.0: scheduling IB failed (-35). +[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) +radeon 0000:04:00.0: scheduling IB failed (-35). +[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) +radeon 0000:04:00.0: scheduling IB failed (-35). +[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) +radeon 0000:04:00.0: scheduling IB failed (-35). +[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) +radeon 0000:04:00.0: scheduling IB failed (-35). +[drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) + +Link: https://lore.kernel.org/dri-devel/29df7e26-d7a8-4f67-b988-44353c4270ac@amd.com/T/#t +Link: https://lore.kernel.org/linux-arch/20240301130532.3953167-1-chenhuacai@loongson.cn/T/#t +Cc: stable@vger.kernel.org +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/Kbuild | 1 + + arch/loongarch/include/asm/io.h | 2 ++ + arch/loongarch/include/asm/qspinlock.h | 18 ------------------ + 3 files changed, 3 insertions(+), 18 deletions(-) + delete mode 100644 arch/loongarch/include/asm/qspinlock.h + +diff --git a/arch/loongarch/include/asm/Kbuild b/arch/loongarch/include/asm/Kbuild +index 93783fa24f6e9..dede0b422cfb9 100644 +--- a/arch/loongarch/include/asm/Kbuild ++++ b/arch/loongarch/include/asm/Kbuild +@@ -4,6 +4,7 @@ generic-y += mcs_spinlock.h + generic-y += parport.h + generic-y += early_ioremap.h + generic-y += qrwlock.h ++generic-y += qspinlock.h + generic-y += rwsem.h + generic-y += segment.h + generic-y += user.h +diff --git a/arch/loongarch/include/asm/io.h b/arch/loongarch/include/asm/io.h +index c486c2341b662..4a8adcca329b8 100644 +--- a/arch/loongarch/include/asm/io.h ++++ b/arch/loongarch/include/asm/io.h +@@ -71,6 +71,8 @@ extern void __memcpy_fromio(void *to, const volatile void __iomem *from, size_t + #define memcpy_fromio(a, c, l) __memcpy_fromio((a), (c), (l)) + #define memcpy_toio(c, a, l) __memcpy_toio((c), (a), (l)) + ++#define __io_aw() mmiowb() ++ + #include + + #define ARCH_HAS_VALID_PHYS_ADDR_RANGE +diff --git a/arch/loongarch/include/asm/qspinlock.h b/arch/loongarch/include/asm/qspinlock.h +deleted file mode 100644 +index 34f43f8ad5912..0000000000000 +--- a/arch/loongarch/include/asm/qspinlock.h ++++ /dev/null +@@ -1,18 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0 */ +-#ifndef _ASM_QSPINLOCK_H +-#define _ASM_QSPINLOCK_H +- +-#include +- +-#define queued_spin_unlock queued_spin_unlock +- +-static inline void queued_spin_unlock(struct qspinlock *lock) +-{ +- compiletime_assert_atomic_type(lock->locked); +- c_sync(); +- WRITE_ONCE(lock->locked, 0); +-} +- +-#include +- +-#endif /* _ASM_QSPINLOCK_H */ +-- +2.43.0 + diff --git a/queue-6.6/mac802154-fix-llsec-key-resources-release-in-mac8021.patch b/queue-6.6/mac802154-fix-llsec-key-resources-release-in-mac8021.patch new file mode 100644 index 00000000000..1b91743fd58 --- /dev/null +++ b/queue-6.6/mac802154-fix-llsec-key-resources-release-in-mac8021.patch @@ -0,0 +1,134 @@ +From ce3339135da77c985696a3ccd0806e6e9434c07b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 19:38:39 +0300 +Subject: mac802154: fix llsec key resources release in mac802154_llsec_key_del + +From: Fedor Pchelkin + +[ Upstream commit e8a1e58345cf40b7b272e08ac7b32328b2543e40 ] + +mac802154_llsec_key_del() can free resources of a key directly without +following the RCU rules for waiting before the end of a grace period. This +may lead to use-after-free in case llsec_lookup_key() is traversing the +list of keys in parallel with a key deletion: + +refcount_t: addition on 0; use-after-free. +WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 +Modules linked in: +CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 +RIP: 0010:refcount_warn_saturate+0x162/0x2a0 +Call Trace: + + llsec_lookup_key.isra.0+0x890/0x9e0 + mac802154_llsec_encrypt+0x30c/0x9c0 + ieee802154_subif_start_xmit+0x24/0x1e0 + dev_hard_start_xmit+0x13e/0x690 + sch_direct_xmit+0x2ae/0xbc0 + __dev_queue_xmit+0x11dd/0x3c20 + dgram_sendmsg+0x90b/0xd60 + __sys_sendto+0x466/0x4c0 + __x64_sys_sendto+0xe0/0x1c0 + do_syscall_64+0x45/0xf0 + entry_SYSCALL_64_after_hwframe+0x6e/0x76 + +Also, ieee802154_llsec_key_entry structures are not freed by +mac802154_llsec_key_del(): + +unreferenced object 0xffff8880613b6980 (size 64): + comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) + hex dump (first 32 bytes): + 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... + 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ + backtrace: + [] __kmem_cache_alloc_node+0x1e2/0x2d0 + [] kmalloc_trace+0x25/0xc0 + [] mac802154_llsec_key_add+0xac9/0xcf0 + [] ieee802154_add_llsec_key+0x5a/0x80 + [] nl802154_add_llsec_key+0x426/0x5b0 + [] genl_family_rcv_msg_doit+0x1fe/0x2f0 + [] genl_rcv_msg+0x531/0x7d0 + [] netlink_rcv_skb+0x169/0x440 + [] genl_rcv+0x28/0x40 + [] netlink_unicast+0x53c/0x820 + [] netlink_sendmsg+0x93b/0xe60 + [] ____sys_sendmsg+0xac5/0xca0 + [] ___sys_sendmsg+0x11d/0x1c0 + [] __sys_sendmsg+0xfa/0x1d0 + [] do_syscall_64+0x45/0xf0 + [] entry_SYSCALL_64_after_hwframe+0x6e/0x76 + +Handle the proper resource release in the RCU callback function +mac802154_llsec_key_del_rcu(). + +Note that if llsec_lookup_key() finds a key, it gets a refcount via +llsec_key_get() and locally copies key id from key_entry (which is a +list element). So it's safe to call llsec_key_put() and free the list +entry after the RCU grace period elapses. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: 5d637d5aabd8 ("mac802154: add llsec structures and mutators") +Cc: stable@vger.kernel.org +Signed-off-by: Fedor Pchelkin +Acked-by: Alexander Aring +Message-ID: <20240228163840.6667-1-pchelkin@ispras.ru> +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + include/net/cfg802154.h | 1 + + net/mac802154/llsec.c | 18 +++++++++++++----- + 2 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h +index f79ce133e51a7..519d23941b541 100644 +--- a/include/net/cfg802154.h ++++ b/include/net/cfg802154.h +@@ -378,6 +378,7 @@ struct ieee802154_llsec_key { + + struct ieee802154_llsec_key_entry { + struct list_head list; ++ struct rcu_head rcu; + + struct ieee802154_llsec_key_id id; + struct ieee802154_llsec_key *key; +diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c +index 8d2eabc71bbeb..f13b07ebfb98a 100644 +--- a/net/mac802154/llsec.c ++++ b/net/mac802154/llsec.c +@@ -265,19 +265,27 @@ int mac802154_llsec_key_add(struct mac802154_llsec *sec, + return -ENOMEM; + } + ++static void mac802154_llsec_key_del_rcu(struct rcu_head *rcu) ++{ ++ struct ieee802154_llsec_key_entry *pos; ++ struct mac802154_llsec_key *mkey; ++ ++ pos = container_of(rcu, struct ieee802154_llsec_key_entry, rcu); ++ mkey = container_of(pos->key, struct mac802154_llsec_key, key); ++ ++ llsec_key_put(mkey); ++ kfree_sensitive(pos); ++} ++ + int mac802154_llsec_key_del(struct mac802154_llsec *sec, + const struct ieee802154_llsec_key_id *key) + { + struct ieee802154_llsec_key_entry *pos; + + list_for_each_entry(pos, &sec->table.keys, list) { +- struct mac802154_llsec_key *mkey; +- +- mkey = container_of(pos->key, struct mac802154_llsec_key, key); +- + if (llsec_key_id_equal(&pos->id, key)) { + list_del_rcu(&pos->list); +- llsec_key_put(mkey); ++ call_rcu(&pos->rcu, mac802154_llsec_key_del_rcu); + return 0; + } + } +-- +2.43.0 + diff --git a/queue-6.6/md-md-bitmap-fix-incorrect-usage-for-sb_index.patch b/queue-6.6/md-md-bitmap-fix-incorrect-usage-for-sb_index.patch new file mode 100644 index 00000000000..ff7431fe4e2 --- /dev/null +++ b/queue-6.6/md-md-bitmap-fix-incorrect-usage-for-sb_index.patch @@ -0,0 +1,82 @@ +From 4031b7b76b5cabc448d806ab9da3f20b3dceef49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 20:11:28 +0800 +Subject: md/md-bitmap: fix incorrect usage for sb_index + +From: Heming Zhao + +[ Upstream commit ecbd8ebb51bf7e4939d83b9e6022a55cac44ef06 ] + +Commit d7038f951828 ("md-bitmap: don't use ->index for pages backing the +bitmap file") removed page->index from bitmap code, but left wrong code +logic for clustered-md. current code never set slot offset for cluster +nodes, will sometimes cause crash in clustered env. + +Call trace (partly): + md_bitmap_file_set_bit+0x110/0x1d8 [md_mod] + md_bitmap_startwrite+0x13c/0x240 [md_mod] + raid1_make_request+0x6b0/0x1c08 [raid1] + md_handle_request+0x1dc/0x368 [md_mod] + md_submit_bio+0x80/0xf8 [md_mod] + __submit_bio+0x178/0x300 + submit_bio_noacct_nocheck+0x11c/0x338 + submit_bio_noacct+0x134/0x614 + submit_bio+0x28/0xdc + submit_bh_wbc+0x130/0x1cc + submit_bh+0x1c/0x28 + +Fixes: d7038f951828 ("md-bitmap: don't use ->index for pages backing the bitmap file") +Cc: stable@vger.kernel.org # v6.6+ +Signed-off-by: Heming Zhao +Reviewed-by: Christoph Hellwig +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240223121128.28985-1-heming.zhao@suse.com +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 6f9ff14971f98..42d4c38ba54d5 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -234,7 +234,8 @@ static int __write_sb_page(struct md_rdev *rdev, struct bitmap *bitmap, + sector_t doff; + + bdev = (rdev->meta_bdev) ? rdev->meta_bdev : rdev->bdev; +- if (pg_index == store->file_pages - 1) { ++ /* we compare length (page numbers), not page offset. */ ++ if ((pg_index - store->sb_index) == store->file_pages - 1) { + unsigned int last_page_size = store->bytes & (PAGE_SIZE - 1); + + if (last_page_size == 0) +@@ -438,8 +439,8 @@ static void filemap_write_page(struct bitmap *bitmap, unsigned long pg_index, + struct page *page = store->filemap[pg_index]; + + if (mddev_is_clustered(bitmap->mddev)) { +- pg_index += bitmap->cluster_slot * +- DIV_ROUND_UP(store->bytes, PAGE_SIZE); ++ /* go to node bitmap area starting point */ ++ pg_index += store->sb_index; + } + + if (store->file) +@@ -952,6 +953,7 @@ static void md_bitmap_file_set_bit(struct bitmap *bitmap, sector_t block) + unsigned long index = file_page_index(store, chunk); + unsigned long node_offset = 0; + ++ index += store->sb_index; + if (mddev_is_clustered(bitmap->mddev)) + node_offset = bitmap->cluster_slot * store->file_pages; + +@@ -982,6 +984,7 @@ static void md_bitmap_file_clear_bit(struct bitmap *bitmap, sector_t block) + unsigned long index = file_page_index(store, chunk); + unsigned long node_offset = 0; + ++ index += store->sb_index; + if (mddev_is_clustered(bitmap->mddev)) + node_offset = bitmap->cluster_slot * store->file_pages; + +-- +2.43.0 + diff --git a/queue-6.6/md-raid5-fix-atomicity-violation-in-raid5_cache_coun.patch b/queue-6.6/md-raid5-fix-atomicity-violation-in-raid5_cache_coun.patch new file mode 100644 index 00000000000..082db79441c --- /dev/null +++ b/queue-6.6/md-raid5-fix-atomicity-violation-in-raid5_cache_coun.patch @@ -0,0 +1,119 @@ +From c631b9d86d4bb8145ab0788ddce1d06640c13fd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jan 2024 15:10:17 +0800 +Subject: md/raid5: fix atomicity violation in raid5_cache_count + +From: Gui-Dong Han <2045gemini@gmail.com> + +[ Upstream commit dfd2bf436709b2bccb78c2dda550dde93700efa7 ] + +In raid5_cache_count(): + if (conf->max_nr_stripes < conf->min_nr_stripes) + return 0; + return conf->max_nr_stripes - conf->min_nr_stripes; +The current check is ineffective, as the values could change immediately +after being checked. + +In raid5_set_cache_size(): + ... + conf->min_nr_stripes = size; + ... + while (size > conf->max_nr_stripes) + conf->min_nr_stripes = conf->max_nr_stripes; + ... + +Due to intermediate value updates in raid5_set_cache_size(), concurrent +execution of raid5_cache_count() and raid5_set_cache_size() may lead to +inconsistent reads of conf->max_nr_stripes and conf->min_nr_stripes. +The current checks are ineffective as values could change immediately +after being checked, raising the risk of conf->min_nr_stripes exceeding +conf->max_nr_stripes and potentially causing an integer overflow. + +This possible bug is found by an experimental static analysis tool +developed by our team. This tool analyzes the locking APIs to extract +function pairs that can be concurrently executed, and then analyzes the +instructions in the paired functions to identify possible concurrency bugs +including data races and atomicity violations. The above possible bug is +reported when our tool analyzes the source code of Linux 6.2. + +To resolve this issue, it is suggested to introduce local variables +'min_stripes' and 'max_stripes' in raid5_cache_count() to ensure the +values remain stable throughout the check. Adding locks in +raid5_cache_count() fails to resolve atomicity violations, as +raid5_set_cache_size() may hold intermediate values of +conf->min_nr_stripes while unlocked. With this patch applied, our tool no +longer reports the bug, with the kernel configuration allyesconfig for +x86_64. Due to the lack of associated hardware, we cannot test the patch +in runtime testing, and just verify it according to the code logic. + +Fixes: edbe83ab4c27 ("md/raid5: allow the stripe_cache to grow and shrink.") +Cc: stable@vger.kernel.org +Signed-off-by: Gui-Dong Han <2045gemini@gmail.com> +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240112071017.16313-1-2045gemini@gmail.com +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid5.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 68d86dbecb4ac..212bf85edad03 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2420,7 +2420,7 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp) + atomic_inc(&conf->active_stripes); + + raid5_release_stripe(sh); +- conf->max_nr_stripes++; ++ WRITE_ONCE(conf->max_nr_stripes, conf->max_nr_stripes + 1); + return 1; + } + +@@ -2717,7 +2717,7 @@ static int drop_one_stripe(struct r5conf *conf) + shrink_buffers(sh); + free_stripe(conf->slab_cache, sh); + atomic_dec(&conf->active_stripes); +- conf->max_nr_stripes--; ++ WRITE_ONCE(conf->max_nr_stripes, conf->max_nr_stripes - 1); + return 1; + } + +@@ -6901,7 +6901,7 @@ raid5_set_cache_size(struct mddev *mddev, int size) + if (size <= 16 || size > 32768) + return -EINVAL; + +- conf->min_nr_stripes = size; ++ WRITE_ONCE(conf->min_nr_stripes, size); + mutex_lock(&conf->cache_size_mutex); + while (size < conf->max_nr_stripes && + drop_one_stripe(conf)) +@@ -6913,7 +6913,7 @@ raid5_set_cache_size(struct mddev *mddev, int size) + mutex_lock(&conf->cache_size_mutex); + while (size > conf->max_nr_stripes) + if (!grow_one_stripe(conf, GFP_KERNEL)) { +- conf->min_nr_stripes = conf->max_nr_stripes; ++ WRITE_ONCE(conf->min_nr_stripes, conf->max_nr_stripes); + result = -ENOMEM; + break; + } +@@ -7478,11 +7478,13 @@ static unsigned long raid5_cache_count(struct shrinker *shrink, + struct shrink_control *sc) + { + struct r5conf *conf = container_of(shrink, struct r5conf, shrinker); ++ int max_stripes = READ_ONCE(conf->max_nr_stripes); ++ int min_stripes = READ_ONCE(conf->min_nr_stripes); + +- if (conf->max_nr_stripes < conf->min_nr_stripes) ++ if (max_stripes < min_stripes) + /* unlikely, but not impossible */ + return 0; +- return conf->max_nr_stripes - conf->min_nr_stripes; ++ return max_stripes - min_stripes; + } + + static struct r5conf *setup_conf(struct mddev *mddev) +-- +2.43.0 + diff --git a/queue-6.6/media-mc-add-local-pad-to-pipeline-regardless-of-the.patch b/queue-6.6/media-mc-add-local-pad-to-pipeline-regardless-of-the.patch new file mode 100644 index 00000000000..f1bf5d05fc9 --- /dev/null +++ b/queue-6.6/media-mc-add-local-pad-to-pipeline-regardless-of-the.patch @@ -0,0 +1,80 @@ +From 202cc7db651502af16a0e981f3ac310d6789005b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jan 2024 15:55:40 +0200 +Subject: media: mc: Add local pad to pipeline regardless of the link state + +From: Laurent Pinchart + +[ Upstream commit 78f0daa026d4c5e192d31801d1be6caf88250220 ] + +When building pipelines by following links, the +media_pipeline_explore_next_link() function only traverses enabled +links. The remote pad of a disabled link is not added to the pipeline, +and neither is the local pad. While the former is correct as disabled +links should not be followed, not adding the local pad breaks processing +of the MEDIA_PAD_FL_MUST_CONNECT flag. + +The MEDIA_PAD_FL_MUST_CONNECT flag is checked in the +__media_pipeline_start() function that iterates over all pads after +populating the pipeline. If the pad is not present, the check gets +skipped, rendering it useless. + +Fix this by adding the local pad of all links regardless of their state, +only skipping the remote pad for disabled links. + +Cc: stable@vger.kernel.org # 6.1 +Fixes: ae219872834a ("media: mc: entity: Rewrite media_pipeline_start()") +Reported-by: Frieder Schrempf +Closes: https://lore.kernel.org/linux-media/7658a15a-80c5-219f-2477-2a94ba6c6ba1@kontron.de +Signed-off-by: Laurent Pinchart +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/mc/mc-entity.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c +index 83468d4a440b3..737fc14e92dd3 100644 +--- a/drivers/media/mc/mc-entity.c ++++ b/drivers/media/mc/mc-entity.c +@@ -607,13 +607,6 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, + link->source->entity->name, link->source->index, + link->sink->entity->name, link->sink->index); + +- /* Skip links that are not enabled. */ +- if (!(link->flags & MEDIA_LNK_FL_ENABLED)) { +- dev_dbg(walk->mdev->dev, +- "media pipeline: skipping link (disabled)\n"); +- return 0; +- } +- + /* Get the local pad and remote pad. */ + if (link->source->entity == pad->entity) { + local = link->source; +@@ -635,13 +628,20 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, + } + + /* +- * Add the local and remote pads of the link to the pipeline and push +- * them to the stack, if they're not already present. ++ * Add the local pad of the link to the pipeline and push it to the ++ * stack, if not already present. + */ + ret = media_pipeline_add_pad(pipe, walk, local); + if (ret) + return ret; + ++ /* Similarly, add the remote pad, but only if the link is enabled. */ ++ if (!(link->flags & MEDIA_LNK_FL_ENABLED)) { ++ dev_dbg(walk->mdev->dev, ++ "media pipeline: skipping link (disabled)\n"); ++ return 0; ++ } ++ + ret = media_pipeline_add_pad(pipe, walk, remote); + if (ret) + return ret; +-- +2.43.0 + diff --git a/queue-6.6/media-mc-add-num_links-flag-to-media_pad.patch b/queue-6.6/media-mc-add-num_links-flag-to-media_pad.patch new file mode 100644 index 00000000000..6b475647f9d --- /dev/null +++ b/queue-6.6/media-mc-add-num_links-flag-to-media_pad.patch @@ -0,0 +1,70 @@ +From 0efa4c513a3177222e7ecfa70b3cba8467a9532f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 00:30:02 +0200 +Subject: media: mc: Add num_links flag to media_pad + +From: Laurent Pinchart + +[ Upstream commit baeddf94aa61879b118f2faa37ed126d772670cc ] + +Maintain a counter of the links connected to a pad in the media_pad +structure. This helps checking if a pad is connected to anything, which +will be used in the pipeline building code. + +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Laurent Pinchart +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/mc/mc-entity.c | 6 ++++++ + include/media/media-entity.h | 2 ++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c +index 330d876f41945..c5f44cbf9f877 100644 +--- a/drivers/media/mc/mc-entity.c ++++ b/drivers/media/mc/mc-entity.c +@@ -1025,6 +1025,9 @@ static void __media_entity_remove_link(struct media_entity *entity, + + /* Remove the reverse links for a data link. */ + if ((link->flags & MEDIA_LNK_FL_LINK_TYPE) == MEDIA_LNK_FL_DATA_LINK) { ++ link->source->num_links--; ++ link->sink->num_links--; ++ + if (link->source->entity == entity) + remote = link->sink->entity; + else +@@ -1130,6 +1133,9 @@ media_create_pad_link(struct media_entity *source, u16 source_pad, + sink->num_links++; + source->num_links++; + ++ link->source->num_links++; ++ link->sink->num_links++; ++ + return 0; + } + EXPORT_SYMBOL_GPL(media_create_pad_link); +diff --git a/include/media/media-entity.h b/include/media/media-entity.h +index 2b6cd343ee9e0..4d95893c89846 100644 +--- a/include/media/media-entity.h ++++ b/include/media/media-entity.h +@@ -225,6 +225,7 @@ enum media_pad_signal_type { + * @graph_obj: Embedded structure containing the media object common data + * @entity: Entity this pad belongs to + * @index: Pad index in the entity pads array, numbered from 0 to n ++ * @num_links: Number of links connected to this pad + * @sig_type: Type of the signal inside a media pad + * @flags: Pad flags, as defined in + * :ref:`include/uapi/linux/media.h ` +@@ -236,6 +237,7 @@ struct media_pad { + struct media_gobj graph_obj; /* must be first field in struct */ + struct media_entity *entity; + u16 index; ++ u16 num_links; + enum media_pad_signal_type sig_type; + unsigned long flags; + +-- +2.43.0 + diff --git a/queue-6.6/media-mc-expand-must_connect-flag-to-always-require-.patch b/queue-6.6/media-mc-expand-must_connect-flag-to-always-require-.patch new file mode 100644 index 00000000000..33acb7eb32c --- /dev/null +++ b/queue-6.6/media-mc-expand-must_connect-flag-to-always-require-.patch @@ -0,0 +1,190 @@ +From 8247feb6175082c1c3a29aed000ddad76c4cea33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 01:04:52 +0200 +Subject: media: mc: Expand MUST_CONNECT flag to always require an enabled link + +From: Laurent Pinchart + +[ Upstream commit b3decc5ce7d778224d266423b542326ad469cb5f ] + +The MEDIA_PAD_FL_MUST_CONNECT flag indicates that the pad requires an +enabled link to stream, but only if it has any link at all. This makes +little sense, as if a pad is part of a pipeline, there are very few use +cases for an active link to be mandatory only if links exist at all. A +review of in-tree drivers confirms they all need an enabled link for +pads marked with the MEDIA_PAD_FL_MUST_CONNECT flag. + +Expand the scope of the flag by rejecting pads that have no links at +all. This requires modifying the pipeline build code to add those pads +to the pipeline. + +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Laurent Pinchart +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../media/mediactl/media-types.rst | 11 ++-- + drivers/media/mc/mc-entity.c | 53 +++++++++++++++---- + 2 files changed, 48 insertions(+), 16 deletions(-) + +diff --git a/Documentation/userspace-api/media/mediactl/media-types.rst b/Documentation/userspace-api/media/mediactl/media-types.rst +index 0ffeece1e0c8e..6332e8395263b 100644 +--- a/Documentation/userspace-api/media/mediactl/media-types.rst ++++ b/Documentation/userspace-api/media/mediactl/media-types.rst +@@ -375,12 +375,11 @@ Types and flags used to represent the media graph elements + are origins of links. + + * - ``MEDIA_PAD_FL_MUST_CONNECT`` +- - If this flag is set and the pad is linked to any other pad, then +- at least one of those links must be enabled for the entity to be +- able to stream. There could be temporary reasons (e.g. device +- configuration dependent) for the pad to need enabled links even +- when this flag isn't set; the absence of the flag doesn't imply +- there is none. ++ - If this flag is set, then for this pad to be able to stream, it must ++ be connected by at least one enabled link. There could be temporary ++ reasons (e.g. device configuration dependent) for the pad to need ++ enabled links even when this flag isn't set; the absence of the flag ++ doesn't imply there is none. + + + One and only one of ``MEDIA_PAD_FL_SINK`` and ``MEDIA_PAD_FL_SOURCE`` +diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c +index 7da899bc9d08f..21c354067f44a 100644 +--- a/drivers/media/mc/mc-entity.c ++++ b/drivers/media/mc/mc-entity.c +@@ -522,14 +522,15 @@ static int media_pipeline_walk_push(struct media_pipeline_walk *walk, + + /* + * Move the top entry link cursor to the next link. If all links of the entry +- * have been visited, pop the entry itself. ++ * have been visited, pop the entry itself. Return true if the entry has been ++ * popped. + */ +-static void media_pipeline_walk_pop(struct media_pipeline_walk *walk) ++static bool media_pipeline_walk_pop(struct media_pipeline_walk *walk) + { + struct media_pipeline_walk_entry *entry; + + if (WARN_ON(walk->stack.top < 0)) +- return; ++ return false; + + entry = media_pipeline_walk_top(walk); + +@@ -539,7 +540,7 @@ static void media_pipeline_walk_pop(struct media_pipeline_walk *walk) + walk->stack.top); + + walk->stack.top--; +- return; ++ return true; + } + + entry->links = entry->links->next; +@@ -547,6 +548,8 @@ static void media_pipeline_walk_pop(struct media_pipeline_walk *walk) + dev_dbg(walk->mdev->dev, + "media pipeline: moved entry %u to next link\n", + walk->stack.top); ++ ++ return false; + } + + /* Free all memory allocated while walking the pipeline. */ +@@ -596,11 +599,12 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, + struct media_link *link; + struct media_pad *local; + struct media_pad *remote; ++ bool last_link; + int ret; + + origin = entry->pad; + link = list_entry(entry->links, typeof(*link), list); +- media_pipeline_walk_pop(walk); ++ last_link = media_pipeline_walk_pop(walk); + + dev_dbg(walk->mdev->dev, + "media pipeline: exploring link '%s':%u -> '%s':%u\n", +@@ -625,7 +629,7 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, + local->index)) { + dev_dbg(walk->mdev->dev, + "media pipeline: skipping link (no route)\n"); +- return 0; ++ goto done; + } + + /* +@@ -640,13 +644,44 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, + if (!(link->flags & MEDIA_LNK_FL_ENABLED)) { + dev_dbg(walk->mdev->dev, + "media pipeline: skipping link (disabled)\n"); +- return 0; ++ goto done; + } + + ret = media_pipeline_add_pad(pipe, walk, remote); + if (ret) + return ret; + ++done: ++ /* ++ * If we're done iterating over links, iterate over pads of the entity. ++ * This is necessary to discover pads that are not connected with any ++ * link. Those are dead ends from a pipeline exploration point of view, ++ * but are still part of the pipeline and need to be added to enable ++ * proper validation. ++ */ ++ if (!last_link) ++ return 0; ++ ++ dev_dbg(walk->mdev->dev, ++ "media pipeline: adding unconnected pads of '%s'\n", ++ local->entity->name); ++ ++ media_entity_for_each_pad(origin->entity, local) { ++ /* ++ * Skip the origin pad (already handled), pad that have links ++ * (already discovered through iterating over links) and pads ++ * not internally connected. ++ */ ++ if (origin == local || !local->num_links || ++ !media_entity_has_pad_interdep(origin->entity, origin->index, ++ local->index)) ++ continue; ++ ++ ret = media_pipeline_add_pad(pipe, walk, local); ++ if (ret) ++ return ret; ++ } ++ + return 0; + } + +@@ -758,7 +793,6 @@ __must_check int __media_pipeline_start(struct media_pad *pad, + struct media_pad *pad = ppad->pad; + struct media_entity *entity = pad->entity; + bool has_enabled_link = false; +- bool has_link = false; + struct media_link *link; + + dev_dbg(mdev->dev, "Validating pad '%s':%u\n", pad->entity->name, +@@ -788,7 +822,6 @@ __must_check int __media_pipeline_start(struct media_pad *pad, + /* Record if the pad has links and enabled links. */ + if (link->flags & MEDIA_LNK_FL_ENABLED) + has_enabled_link = true; +- has_link = true; + + /* + * Validate the link if it's enabled and has the +@@ -826,7 +859,7 @@ __must_check int __media_pipeline_start(struct media_pad *pad, + * 3. If the pad has the MEDIA_PAD_FL_MUST_CONNECT flag set, + * ensure that it has either no link or an enabled link. + */ +- if ((pad->flags & MEDIA_PAD_FL_MUST_CONNECT) && has_link && ++ if ((pad->flags & MEDIA_PAD_FL_MUST_CONNECT) && + !has_enabled_link) { + dev_dbg(mdev->dev, + "Pad '%s':%u must be connected by an enabled link\n", +-- +2.43.0 + diff --git a/queue-6.6/media-mc-fix-flags-handling-when-creating-pad-links.patch b/queue-6.6/media-mc-fix-flags-handling-when-creating-pad-links.patch new file mode 100644 index 00000000000..05911676a0f --- /dev/null +++ b/queue-6.6/media-mc-fix-flags-handling-when-creating-pad-links.patch @@ -0,0 +1,59 @@ +From e5e4dc2e9c4619752f960c0062179d7b5d59499f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 00:24:12 +0200 +Subject: media: mc: Fix flags handling when creating pad links + +From: Laurent Pinchart + +[ Upstream commit 422f7af75d03d50895938d38bc9cb8be759c440f ] + +The media_create_pad_link() function doesn't correctly clear reject link +type flags, nor does it set the DATA_LINK flag. It only works because +the MEDIA_LNK_FL_DATA_LINK flag's value is 0. + +Fix it by returning an error if any link type flag is set. This doesn't +introduce any regression, as nobody calls the media_create_pad_link() +function with link type flags (easily checked by grepping for the flag +in the source code, there are very few hits). + +Set the MEDIA_LNK_FL_DATA_LINK explicitly, which is a no-op that the +compiler will optimize out, but is still useful to make the code more +explicit and easier to understand. + +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Laurent Pinchart +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/mc/mc-entity.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c +index 737fc14e92dd3..330d876f41945 100644 +--- a/drivers/media/mc/mc-entity.c ++++ b/drivers/media/mc/mc-entity.c +@@ -1079,6 +1079,11 @@ media_create_pad_link(struct media_entity *source, u16 source_pad, + struct media_link *link; + struct media_link *backlink; + ++ if (flags & MEDIA_LNK_FL_LINK_TYPE) ++ return -EINVAL; ++ ++ flags |= MEDIA_LNK_FL_DATA_LINK; ++ + if (WARN_ON(!source || !sink) || + WARN_ON(source_pad >= source->num_pads) || + WARN_ON(sink_pad >= sink->num_pads)) +@@ -1094,7 +1099,7 @@ media_create_pad_link(struct media_entity *source, u16 source_pad, + + link->source = &source->pads[source_pad]; + link->sink = &sink->pads[sink_pad]; +- link->flags = flags & ~MEDIA_LNK_FL_INTERFACE_LINK; ++ link->flags = flags; + + /* Initialize graph object embedded at the new link */ + media_gobj_create(source->graph_obj.mdev, MEDIA_GRAPH_LINK, +-- +2.43.0 + diff --git a/queue-6.6/media-mc-rename-pad-variable-to-clarify-intent.patch b/queue-6.6/media-mc-rename-pad-variable-to-clarify-intent.patch new file mode 100644 index 00000000000..a25624d9d84 --- /dev/null +++ b/queue-6.6/media-mc-rename-pad-variable-to-clarify-intent.patch @@ -0,0 +1,68 @@ +From 0603e6e9a5ae937de8efcfe58e64dc7b1f12c46b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 00:30:02 +0200 +Subject: media: mc: Rename pad variable to clarify intent + +From: Laurent Pinchart + +[ Upstream commit 9ec9109cf9f611e3ec9ed0355afcc7aae5e73176 ] + +The pad local variable in the media_pipeline_explore_next_link() +function is used to store the pad through which the entity has been +reached. Rename it to origin to reflect that and make the code easier to +read. This will be even more important in subsequent commits when +expanding the function with additional logic. + +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Laurent Pinchart +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/mc/mc-entity.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c +index c5f44cbf9f877..7da899bc9d08f 100644 +--- a/drivers/media/mc/mc-entity.c ++++ b/drivers/media/mc/mc-entity.c +@@ -592,13 +592,13 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, + struct media_pipeline_walk *walk) + { + struct media_pipeline_walk_entry *entry = media_pipeline_walk_top(walk); +- struct media_pad *pad; ++ struct media_pad *origin; + struct media_link *link; + struct media_pad *local; + struct media_pad *remote; + int ret; + +- pad = entry->pad; ++ origin = entry->pad; + link = list_entry(entry->links, typeof(*link), list); + media_pipeline_walk_pop(walk); + +@@ -608,7 +608,7 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, + link->sink->entity->name, link->sink->index); + + /* Get the local pad and remote pad. */ +- if (link->source->entity == pad->entity) { ++ if (link->source->entity == origin->entity) { + local = link->source; + remote = link->sink; + } else { +@@ -620,8 +620,9 @@ static int media_pipeline_explore_next_link(struct media_pipeline *pipe, + * Skip links that originate from a different pad than the incoming pad + * that is not connected internally in the entity to the incoming pad. + */ +- if (pad != local && +- !media_entity_has_pad_interdep(pad->entity, pad->index, local->index)) { ++ if (origin != local && ++ !media_entity_has_pad_interdep(origin->entity, origin->index, ++ local->index)) { + dev_dbg(walk->mdev->dev, + "media pipeline: skipping link (no route)\n"); + return 0; +-- +2.43.0 + diff --git a/queue-6.6/media-nxp-imx8-isi-check-whether-crossbar-pad-is-non.patch b/queue-6.6/media-nxp-imx8-isi-check-whether-crossbar-pad-is-non.patch new file mode 100644 index 00000000000..676c27ba5da --- /dev/null +++ b/queue-6.6/media-nxp-imx8-isi-check-whether-crossbar-pad-is-non.patch @@ -0,0 +1,57 @@ +From 40a8d1ee8fff5be8713b0c68b5bf2962cd79b47b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 16:06:04 +0100 +Subject: media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before + access + +From: Marek Vasut + +[ Upstream commit eb2f932100288dbb881eadfed02e1459c6b9504c ] + +When translating source to sink streams in the crossbar subdev, the +driver tries to locate the remote subdev connected to the sink pad. The +remote pad may be NULL, if userspace tries to enable a stream that ends +at an unconnected crossbar sink. When that occurs, the driver +dereferences the NULL pad, leading to a crash. + +Prevent the crash by checking if the pad is NULL before using it, and +return an error if it is. + +Cc: stable@vger.kernel.org # 6.1 +Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") +Signed-off-by: Marek Vasut +Reviewed-by: Kieran Bingham +Reviewed-by: Fabio Estevam +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20231201150614.63300-1-marex@denx.de +Signed-off-by: Laurent Pinchart +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c +index 792f031e032ae..44354931cf8a1 100644 +--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c ++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c +@@ -160,8 +160,14 @@ mxc_isi_crossbar_xlate_streams(struct mxc_isi_crossbar *xbar, + } + + pad = media_pad_remote_pad_first(&xbar->pads[sink_pad]); +- sd = media_entity_to_v4l2_subdev(pad->entity); ++ if (!pad) { ++ dev_dbg(xbar->isi->dev, ++ "no pad connected to crossbar input %u\n", ++ sink_pad); ++ return ERR_PTR(-EPIPE); ++ } + ++ sd = media_entity_to_v4l2_subdev(pad->entity); + if (!sd) { + dev_dbg(xbar->isi->dev, + "no entity connected to crossbar input %u\n", +-- +2.43.0 + diff --git a/queue-6.6/media-nxp-imx8-isi-mark-all-crossbar-sink-pads-as-mu.patch b/queue-6.6/media-nxp-imx8-isi-mark-all-crossbar-sink-pads-as-mu.patch new file mode 100644 index 00000000000..f525827a642 --- /dev/null +++ b/queue-6.6/media-nxp-imx8-isi-mark-all-crossbar-sink-pads-as-mu.patch @@ -0,0 +1,55 @@ +From f7a7bce06adfa520283d009831de4daafa7f7cb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 04:16:29 +0200 +Subject: media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT + +From: Laurent Pinchart + +[ Upstream commit 9b71021b2ea537632b01e51e3f003df24a637858 ] + +All the sink pads of the crossbar switch require an active link if +they're part of the pipeline. Mark them with the +MEDIA_PAD_FL_MUST_CONNECT flag to fail pipeline validation if they're +not connected. This allows removing a manual check when translating +streams. + +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Laurent Pinchart +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c +index 44354931cf8a1..c9a4d091b5707 100644 +--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c ++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c +@@ -160,13 +160,6 @@ mxc_isi_crossbar_xlate_streams(struct mxc_isi_crossbar *xbar, + } + + pad = media_pad_remote_pad_first(&xbar->pads[sink_pad]); +- if (!pad) { +- dev_dbg(xbar->isi->dev, +- "no pad connected to crossbar input %u\n", +- sink_pad); +- return ERR_PTR(-EPIPE); +- } +- + sd = media_entity_to_v4l2_subdev(pad->entity); + if (!sd) { + dev_dbg(xbar->isi->dev, +@@ -471,7 +464,8 @@ int mxc_isi_crossbar_init(struct mxc_isi_dev *isi) + } + + for (i = 0; i < xbar->num_sinks; ++i) +- xbar->pads[i].flags = MEDIA_PAD_FL_SINK; ++ xbar->pads[i].flags = MEDIA_PAD_FL_SINK ++ | MEDIA_PAD_FL_MUST_CONNECT; + for (i = 0; i < xbar->num_sources; ++i) + xbar->pads[i + xbar->num_sinks].flags = MEDIA_PAD_FL_SOURCE; + +-- +2.43.0 + diff --git a/queue-6.6/media-staging-ipu3-imgu-set-fields-before-media_enti.patch b/queue-6.6/media-staging-ipu3-imgu-set-fields-before-media_enti.patch new file mode 100644 index 00000000000..d52385bcbb1 --- /dev/null +++ b/queue-6.6/media-staging-ipu3-imgu-set-fields-before-media_enti.patch @@ -0,0 +1,81 @@ +From 01e03eadc62f903c40f66e8d139783a44a937d99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 17:09:09 +0900 +Subject: media: staging: ipu3-imgu: Set fields before media_entity_pads_init() + +From: Hidenori Kobayashi + +[ Upstream commit 87318b7092670d4086bfec115a0280a60c51c2dd ] + +The imgu driver fails to probe with the following message because it +does not set the pad's flags before calling media_entity_pads_init(). + +[ 14.596315] ipu3-imgu 0000:00:05.0: failed initialize subdev media entity (-22) +[ 14.596322] ipu3-imgu 0000:00:05.0: failed to register subdev0 ret (-22) +[ 14.596327] ipu3-imgu 0000:00:05.0: failed to register pipes (-22) +[ 14.596331] ipu3-imgu 0000:00:05.0: failed to create V4L2 devices (-22) + +Fix the initialization order so that the driver probe succeeds. The ops +initialization is also moved together for readability. + +Fixes: a0ca1627b450 ("media: staging/intel-ipu3: Add v4l2 driver based on media framework") +Cc: # 6.7 +Cc: Dan Carpenter +Signed-off-by: Hidenori Kobayashi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/ipu3/ipu3-v4l2.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/staging/media/ipu3/ipu3-v4l2.c b/drivers/staging/media/ipu3/ipu3-v4l2.c +index e530767e80a5d..55cc44a401bc4 100644 +--- a/drivers/staging/media/ipu3/ipu3-v4l2.c ++++ b/drivers/staging/media/ipu3/ipu3-v4l2.c +@@ -1069,6 +1069,11 @@ static int imgu_v4l2_subdev_register(struct imgu_device *imgu, + struct imgu_media_pipe *imgu_pipe = &imgu->imgu_pipe[pipe]; + + /* Initialize subdev media entity */ ++ imgu_sd->subdev.entity.ops = &imgu_media_ops; ++ for (i = 0; i < IMGU_NODE_NUM; i++) { ++ imgu_sd->subdev_pads[i].flags = imgu_pipe->nodes[i].output ? ++ MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE; ++ } + r = media_entity_pads_init(&imgu_sd->subdev.entity, IMGU_NODE_NUM, + imgu_sd->subdev_pads); + if (r) { +@@ -1076,11 +1081,6 @@ static int imgu_v4l2_subdev_register(struct imgu_device *imgu, + "failed initialize subdev media entity (%d)\n", r); + return r; + } +- imgu_sd->subdev.entity.ops = &imgu_media_ops; +- for (i = 0; i < IMGU_NODE_NUM; i++) { +- imgu_sd->subdev_pads[i].flags = imgu_pipe->nodes[i].output ? +- MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE; +- } + + /* Initialize subdev */ + v4l2_subdev_init(&imgu_sd->subdev, &imgu_subdev_ops); +@@ -1177,15 +1177,15 @@ static int imgu_v4l2_node_setup(struct imgu_device *imgu, unsigned int pipe, + } + + /* Initialize media entities */ ++ node->vdev_pad.flags = node->output ? ++ MEDIA_PAD_FL_SOURCE : MEDIA_PAD_FL_SINK; ++ vdev->entity.ops = NULL; + r = media_entity_pads_init(&vdev->entity, 1, &node->vdev_pad); + if (r) { + dev_err(dev, "failed initialize media entity (%d)\n", r); + mutex_destroy(&node->lock); + return r; + } +- node->vdev_pad.flags = node->output ? +- MEDIA_PAD_FL_SOURCE : MEDIA_PAD_FL_SINK; +- vdev->entity.ops = NULL; + + /* Initialize vbq */ + vbq->type = node->vdev_fmt.type; +-- +2.43.0 + diff --git a/queue-6.6/media-xc4000-fix-atomicity-violation-in-xc4000_get_f.patch b/queue-6.6/media-xc4000-fix-atomicity-violation-in-xc4000_get_f.patch new file mode 100644 index 00000000000..ace2b1ba869 --- /dev/null +++ b/queue-6.6/media-xc4000-fix-atomicity-violation-in-xc4000_get_f.patch @@ -0,0 +1,79 @@ +From f4e3bf6a27c5d7e0f95db859b9b3b6e4fdbc4a82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Dec 2023 13:50:30 +0800 +Subject: media: xc4000: Fix atomicity violation in xc4000_get_frequency + +From: Gui-Dong Han <2045gemini@gmail.com> + +[ Upstream commit 36d503ad547d1c75758a6fcdbec2806f1b6aeb41 ] + +In xc4000_get_frequency(): + *freq = priv->freq_hz + priv->freq_offset; +The code accesses priv->freq_hz and priv->freq_offset without holding any +lock. + +In xc4000_set_params(): + // Code that updates priv->freq_hz and priv->freq_offset + ... + +xc4000_get_frequency() and xc4000_set_params() may execute concurrently, +risking inconsistent reads of priv->freq_hz and priv->freq_offset. Since +these related data may update during reading, it can result in incorrect +frequency calculation, leading to atomicity violations. + +This possible bug is found by an experimental static analysis tool +developed by our team, BassCheck[1]. This tool analyzes the locking APIs +to extract function pairs that can be concurrently executed, and then +analyzes the instructions in the paired functions to identify possible +concurrency bugs including data races and atomicity violations. The above +possible bug is reported when our tool analyzes the source code of +Linux 6.2. + +To address this issue, it is proposed to add a mutex lock pair in +xc4000_get_frequency() to ensure atomicity. With this patch applied, our +tool no longer reports the possible bug, with the kernel configuration +allyesconfig for x86_64. Due to the lack of associated hardware, we cannot +test the patch in runtime testing, and just verify it according to the +code logic. + +[1] https://sites.google.com/view/basscheck/ + +Fixes: 4c07e32884ab ("[media] xc4000: Fix get_frequency()") +Cc: stable@vger.kernel.org +Reported-by: BassCheck +Signed-off-by: Gui-Dong Han <2045gemini@gmail.com> +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/tuners/xc4000.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c +index 57ded9ff3f043..29bc63021c5aa 100644 +--- a/drivers/media/tuners/xc4000.c ++++ b/drivers/media/tuners/xc4000.c +@@ -1515,10 +1515,10 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq) + { + struct xc4000_priv *priv = fe->tuner_priv; + ++ mutex_lock(&priv->lock); + *freq = priv->freq_hz + priv->freq_offset; + + if (debug) { +- mutex_lock(&priv->lock); + if ((priv->cur_fw.type + & (BASE | FM | DTV6 | DTV7 | DTV78 | DTV8)) == BASE) { + u16 snr = 0; +@@ -1529,8 +1529,8 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq) + return 0; + } + } +- mutex_unlock(&priv->lock); + } ++ mutex_unlock(&priv->lock); + + dprintk(1, "%s()\n", __func__); + +-- +2.43.0 + diff --git a/queue-6.6/memtest-use-read-write-_once-in-memory-scanning.patch b/queue-6.6/memtest-use-read-write-_once-in-memory-scanning.patch new file mode 100644 index 00000000000..7b418407ca6 --- /dev/null +++ b/queue-6.6/memtest-use-read-write-_once-in-memory-scanning.patch @@ -0,0 +1,45 @@ +From cfb811a3d71042a312828735ccb77067b90eec51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 16:04:23 +0800 +Subject: memtest: use {READ,WRITE}_ONCE in memory scanning + +From: Qiang Zhang + +[ Upstream commit 82634d7e24271698e50a3ec811e5f50de790a65f ] + +memtest failed to find bad memory when compiled with clang. So use +{WRITE,READ}_ONCE to access memory to avoid compiler over optimization. + +Link: https://lkml.kernel.org/r/20240312080422.691222-1-qiang4.zhang@intel.com +Signed-off-by: Qiang Zhang +Cc: Bill Wendling +Cc: Justin Stitt +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/memtest.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/memtest.c b/mm/memtest.c +index 32f3e9dda8370..c2c609c391199 100644 +--- a/mm/memtest.c ++++ b/mm/memtest.c +@@ -51,10 +51,10 @@ static void __init memtest(u64 pattern, phys_addr_t start_phys, phys_addr_t size + last_bad = 0; + + for (p = start; p < end; p++) +- *p = pattern; ++ WRITE_ONCE(*p, pattern); + + for (p = start; p < end; p++, start_phys_aligned += incr) { +- if (*p == pattern) ++ if (READ_ONCE(*p) == pattern) + continue; + if (start_phys_aligned == last_bad + incr) { + last_bad += incr; +-- +2.43.0 + diff --git a/queue-6.6/mm-swap-fix-race-between-free_swap_and_cache-and-swa.patch b/queue-6.6/mm-swap-fix-race-between-free_swap_and_cache-and-swa.patch new file mode 100644 index 00000000000..2f2045f071c --- /dev/null +++ b/queue-6.6/mm-swap-fix-race-between-free_swap_and_cache-and-swa.patch @@ -0,0 +1,119 @@ +From d82ebefef505b22f73c728be052bbfa4ceb1795c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 14:03:56 +0000 +Subject: mm: swap: fix race between free_swap_and_cache() and swapoff() + +From: Ryan Roberts + +[ Upstream commit 82b1c07a0af603e3c47b906c8e991dc96f01688e ] + +There was previously a theoretical window where swapoff() could run and +teardown a swap_info_struct while a call to free_swap_and_cache() was +running in another thread. This could cause, amongst other bad +possibilities, swap_page_trans_huge_swapped() (called by +free_swap_and_cache()) to access the freed memory for swap_map. + +This is a theoretical problem and I haven't been able to provoke it from a +test case. But there has been agreement based on code review that this is +possible (see link below). + +Fix it by using get_swap_device()/put_swap_device(), which will stall +swapoff(). There was an extra check in _swap_info_get() to confirm that +the swap entry was not free. This isn't present in get_swap_device() +because it doesn't make sense in general due to the race between getting +the reference and swapoff. So I've added an equivalent check directly in +free_swap_and_cache(). + +Details of how to provoke one possible issue (thanks to David Hildenbrand +for deriving this): + +--8<----- + +__swap_entry_free() might be the last user and result in +"count == SWAP_HAS_CACHE". + +swapoff->try_to_unuse() will stop as soon as soon as si->inuse_pages==0. + +So the question is: could someone reclaim the folio and turn +si->inuse_pages==0, before we completed swap_page_trans_huge_swapped(). + +Imagine the following: 2 MiB folio in the swapcache. Only 2 subpages are +still references by swap entries. + +Process 1 still references subpage 0 via swap entry. +Process 2 still references subpage 1 via swap entry. + +Process 1 quits. Calls free_swap_and_cache(). +-> count == SWAP_HAS_CACHE +[then, preempted in the hypervisor etc.] + +Process 2 quits. Calls free_swap_and_cache(). +-> count == SWAP_HAS_CACHE + +Process 2 goes ahead, passes swap_page_trans_huge_swapped(), and calls +__try_to_reclaim_swap(). + +__try_to_reclaim_swap()->folio_free_swap()->delete_from_swap_cache()-> +put_swap_folio()->free_swap_slot()->swapcache_free_entries()-> +swap_entry_free()->swap_range_free()-> +... +WRITE_ONCE(si->inuse_pages, si->inuse_pages - nr_entries); + +What stops swapoff to succeed after process 2 reclaimed the swap cache +but before process1 finished its call to swap_page_trans_huge_swapped()? + +--8<----- + +Link: https://lkml.kernel.org/r/20240306140356.3974886-1-ryan.roberts@arm.com +Fixes: 7c00bafee87c ("mm/swap: free swap slots in batch") +Closes: https://lore.kernel.org/linux-mm/65a66eb9-41f8-4790-8db2-0c70ea15979f@redhat.com/ +Signed-off-by: Ryan Roberts +Cc: David Hildenbrand +Cc: "Huang, Ying" +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/swapfile.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 750314fff0c46..eada1351753e3 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -1226,6 +1226,11 @@ static unsigned char __swap_entry_free_locked(struct swap_info_struct *p, + * with get_swap_device() and put_swap_device(), unless the swap + * functions call get/put_swap_device() by themselves. + * ++ * Note that when only holding the PTL, swapoff might succeed immediately ++ * after freeing a swap entry. Therefore, immediately after ++ * __swap_entry_free(), the swap info might become stale and should not ++ * be touched without a prior get_swap_device(). ++ * + * Check whether swap entry is valid in the swap device. If so, + * return pointer to swap_info_struct, and keep the swap entry valid + * via preventing the swap device from being swapoff, until +@@ -1603,13 +1608,19 @@ int free_swap_and_cache(swp_entry_t entry) + if (non_swap_entry(entry)) + return 1; + +- p = _swap_info_get(entry); ++ p = get_swap_device(entry); + if (p) { ++ if (WARN_ON(data_race(!p->swap_map[swp_offset(entry)]))) { ++ put_swap_device(p); ++ return 0; ++ } ++ + count = __swap_entry_free(p, entry); + if (count == SWAP_HAS_CACHE && + !swap_page_trans_huge_swapped(p, entry)) + __try_to_reclaim_swap(p, swp_offset(entry), + TTRS_UNMAPPED | TTRS_FULL); ++ put_swap_device(p); + } + return p != NULL; + } +-- +2.43.0 + diff --git a/queue-6.6/mmc-core-fix-switch-on-gp3-partition.patch b/queue-6.6/mmc-core-fix-switch-on-gp3-partition.patch new file mode 100644 index 00000000000..baaeedbd52e --- /dev/null +++ b/queue-6.6/mmc-core-fix-switch-on-gp3-partition.patch @@ -0,0 +1,86 @@ +From 56d5c17e3f8a6991c2b75a27cd470b0251fe22f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 10:44:38 +0900 +Subject: mmc: core: Fix switch on gp3 partition + +From: Dominique Martinet + +[ Upstream commit 4af59a8df5ea930038cd3355e822f5eedf4accc1 ] + +Commit e7794c14fd73 ("mmc: rpmb: fixes pause retune on all RPMB +partitions.") added a mask check for 'part_type', but the mask used was +wrong leading to the code intended for rpmb also being executed for GP3. + +On some MMCs (but not all) this would make gp3 partition inaccessible: +armadillo:~# head -c 1 < /dev/mmcblk2gp3 +head: standard input: I/O error +armadillo:~# dmesg -c +[ 422.976583] mmc2: running CQE recovery +[ 423.058182] mmc2: running CQE recovery +[ 423.137607] mmc2: running CQE recovery +[ 423.137802] blk_update_request: I/O error, dev mmcblk2gp3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 4 prio class 0 +[ 423.237125] mmc2: running CQE recovery +[ 423.318206] mmc2: running CQE recovery +[ 423.397680] mmc2: running CQE recovery +[ 423.397837] blk_update_request: I/O error, dev mmcblk2gp3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 +[ 423.408287] Buffer I/O error on dev mmcblk2gp3, logical block 0, async page read + +the part_type values of interest here are defined as follow: +main 0 +boot0 1 +boot1 2 +rpmb 3 +gp0 4 +gp1 5 +gp2 6 +gp3 7 + +so mask with EXT_CSD_PART_CONFIG_ACC_MASK (7) to correctly identify rpmb + +Fixes: e7794c14fd73 ("mmc: rpmb: fixes pause retune on all RPMB partitions.") +Cc: stable@vger.kernel.org +Cc: Jorge Ramirez-Ortiz +Signed-off-by: Dominique Martinet +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240306-mmc-partswitch-v1-1-bf116985d950@codewreck.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 32d49100dff51..86efa6084696e 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -874,10 +874,11 @@ static const struct block_device_operations mmc_bdops = { + static int mmc_blk_part_switch_pre(struct mmc_card *card, + unsigned int part_type) + { +- const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB; ++ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK; ++ const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB; + int ret = 0; + +- if ((part_type & mask) == mask) { ++ if ((part_type & mask) == rpmb) { + if (card->ext_csd.cmdq_en) { + ret = mmc_cmdq_disable(card); + if (ret) +@@ -892,10 +893,11 @@ static int mmc_blk_part_switch_pre(struct mmc_card *card, + static int mmc_blk_part_switch_post(struct mmc_card *card, + unsigned int part_type) + { +- const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB; ++ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK; ++ const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB; + int ret = 0; + +- if ((part_type & mask) == mask) { ++ if ((part_type & mask) == rpmb) { + mmc_retune_unpause(card->host); + if (card->reenable_cmdq && !card->ext_csd.cmdq_en) + ret = mmc_cmdq_enable(card); +-- +2.43.0 + diff --git a/queue-6.6/mmc-tmio-avoid-concurrent-runs-of-mmc_request_done.patch b/queue-6.6/mmc-tmio-avoid-concurrent-runs-of-mmc_request_done.patch new file mode 100644 index 00000000000..57395ef6a7d --- /dev/null +++ b/queue-6.6/mmc-tmio-avoid-concurrent-runs-of-mmc_request_done.patch @@ -0,0 +1,51 @@ +From f3cab26fb111daf753e4606d225125d352c8688d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 11:42:56 +0100 +Subject: mmc: tmio: avoid concurrent runs of mmc_request_done() + +From: Wolfram Sang + +[ Upstream commit e8d1b41e69d72c62865bebe8f441163ec00b3d44 ] + +With the to-be-fixed commit, the reset_work handler cleared 'host->mrq' +outside of the spinlock protected critical section. That leaves a small +race window during execution of 'tmio_mmc_reset()' where the done_work +handler could grab a pointer to the now invalid 'host->mrq'. Both would +use it to call mmc_request_done() causing problems (see link below). + +However, 'host->mrq' cannot simply be cleared earlier inside the +critical section. That would allow new mrqs to come in asynchronously +while the actual reset of the controller still needs to be done. So, +like 'tmio_mmc_set_ios()', an ERR_PTR is used to prevent new mrqs from +coming in but still avoiding concurrency between work handlers. + +Reported-by: Dirk Behme +Closes: https://lore.kernel.org/all/20240220061356.3001761-1-dirk.behme@de.bosch.com/ +Fixes: df3ef2d3c92c ("mmc: protect the tmio_mmc driver against a theoretical race") +Signed-off-by: Wolfram Sang +Tested-by: Dirk Behme +Reviewed-by: Dirk Behme +Cc: stable@vger.kernel.org # 3.0+ +Link: https://lore.kernel.org/r/20240305104423.3177-2-wsa+renesas@sang-engineering.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/tmio_mmc_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index be7f18fd4836a..c253d176db691 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -259,6 +259,8 @@ static void tmio_mmc_reset_work(struct work_struct *work) + else + mrq->cmd->error = -ETIMEDOUT; + ++ /* No new calls yet, but disallow concurrent tmio_mmc_done_work() */ ++ host->mrq = ERR_PTR(-EBUSY); + host->cmd = NULL; + host->data = NULL; + +-- +2.43.0 + diff --git a/queue-6.6/mtd-rawnand-constrain-even-more-when-continuous-read.patch b/queue-6.6/mtd-rawnand-constrain-even-more-when-continuous-read.patch new file mode 100644 index 00000000000..20ac486b850 --- /dev/null +++ b/queue-6.6/mtd-rawnand-constrain-even-more-when-continuous-read.patch @@ -0,0 +1,70 @@ +From 8136fe0336a3055a3215f56b24b62d06946b832d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 12:53:14 +0100 +Subject: mtd: rawnand: Constrain even more when continuous reads are enabled + +From: Miquel Raynal + +[ Upstream commit 78ffbefba8d7822b232585570b293de5bc397da6 ] + +As a matter of fact, continuous reads require additional handling at the +operation level in order for them to work properly. The core helpers do +have this additional logic now, but any time a controller implements its +own page helper, this extra logic is "lost". This means we need another +level of per-controller driver checks to ensure they can leverage +continuous reads. This is for now unsupported, so in order to ensure +continuous reads are enabled only when fully using the core page +helpers, we need to add more initial checks. + +Also, as performance is not relevant during raw accesses, we also +prevent these from enabling the feature. + +This should solve the issue seen with controllers such as the STM32 FMC2 +when in sequencer mode. In this case, the continuous read feature would +be enabled but not leveraged, and most importantly not disabled, leading +to further operations to fail. + +Reported-by: Christophe Kerello +Fixes: 003fe4b9545b ("mtd: rawnand: Support for sequential cache reads") +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Tested-by: Christophe Kerello +Link: https://lore.kernel.org/linux-mtd/20240307115315.1942678-1-miquel.raynal@bootlin.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/nand_base.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c +index 9118b5753c553..c059ac4c19f11 100644 +--- a/drivers/mtd/nand/raw/nand_base.c ++++ b/drivers/mtd/nand/raw/nand_base.c +@@ -3578,7 +3578,8 @@ static int nand_do_read_ops(struct nand_chip *chip, loff_t from, + oob = ops->oobbuf; + oob_required = oob ? 1 : 0; + +- rawnand_enable_cont_reads(chip, page, readlen, col); ++ if (likely(ops->mode != MTD_OPS_RAW)) ++ rawnand_enable_cont_reads(chip, page, readlen, col); + + while (1) { + struct mtd_ecc_stats ecc_stats = mtd->ecc_stats; +@@ -5196,6 +5197,15 @@ static void rawnand_late_check_supported_ops(struct nand_chip *chip) + if (!nand_has_exec_op(chip)) + return; + ++ /* ++ * For now, continuous reads can only be used with the core page helpers. ++ * This can be extended later. ++ */ ++ if (!(chip->ecc.read_page == nand_read_page_hwecc || ++ chip->ecc.read_page == nand_read_page_syndrome || ++ chip->ecc.read_page == nand_read_page_swecc)) ++ return; ++ + rawnand_check_cont_read_support(chip); + } + +-- +2.43.0 + diff --git a/queue-6.6/mtd-rawnand-fix-and-simplify-again-the-continuous-re.patch b/queue-6.6/mtd-rawnand-fix-and-simplify-again-the-continuous-re.patch new file mode 100644 index 00000000000..61ed8e3a976 --- /dev/null +++ b/queue-6.6/mtd-rawnand-fix-and-simplify-again-the-continuous-re.patch @@ -0,0 +1,86 @@ +From 1f9686c7177f1ba0384605bae079c5684f2be1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 12:55:43 +0100 +Subject: mtd: rawnand: Fix and simplify again the continuous read derivations + +From: Miquel Raynal + +[ Upstream commit c7ee7c8d4b60fe46d4861b1200bc1c7ab657960a ] + +We need to avoid the first page if we don't read it entirely. +We need to avoid the last page if we don't read it entirely. +While rather simple, this logic has been failed in the previous +fix. This time I wrote about 30 unit tests locally to check each +possible condition, hopefully I covered them all. + +Reported-by: Christophe Kerello +Closes: https://lore.kernel.org/linux-mtd/20240221175327.42f7076d@xps-13/T/#m399bacb10db8f58f6b1f0149a1df867ec086bb0a +Suggested-by: Christophe Kerello +Fixes: 828f6df1bcba ("mtd: rawnand: Clarify conditions to enable continuous reads") +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Tested-by: Christophe Kerello +Link: https://lore.kernel.org/linux-mtd/20240223115545.354541-2-miquel.raynal@bootlin.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/nand_base.c | 34 +++++++++++++++++++------------- + 1 file changed, 20 insertions(+), 14 deletions(-) + +diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c +index 76167b8ca9dda..9118b5753c553 100644 +--- a/drivers/mtd/nand/raw/nand_base.c ++++ b/drivers/mtd/nand/raw/nand_base.c +@@ -3461,30 +3461,36 @@ static void rawnand_enable_cont_reads(struct nand_chip *chip, unsigned int page, + u32 readlen, int col) + { + struct mtd_info *mtd = nand_to_mtd(chip); +- unsigned int end_page, end_col; ++ unsigned int first_page, last_page; + + chip->cont_read.ongoing = false; + + if (!chip->controller->supported_op.cont_read) + return; + +- end_page = DIV_ROUND_UP(col + readlen, mtd->writesize); +- end_col = (col + readlen) % mtd->writesize; ++ /* ++ * Don't bother making any calculations if the length is too small. ++ * Side effect: avoids possible integer underflows below. ++ */ ++ if (readlen < (2 * mtd->writesize)) ++ return; + ++ /* Derive the page where continuous read should start (the first full page read) */ ++ first_page = page; + if (col) +- page++; +- +- if (end_col && end_page) +- end_page--; ++ first_page++; + +- if (page + 1 > end_page) +- return; +- +- chip->cont_read.first_page = page; +- chip->cont_read.last_page = end_page; +- chip->cont_read.ongoing = true; ++ /* Derive the page where continuous read should stop (the last full page read) */ ++ last_page = page + ((col + readlen) / mtd->writesize) - 1; + +- rawnand_cap_cont_reads(chip); ++ /* Configure and enable continuous read when suitable */ ++ if (first_page < last_page) { ++ chip->cont_read.first_page = first_page; ++ chip->cont_read.last_page = last_page; ++ chip->cont_read.ongoing = true; ++ /* May reset the ongoing flag */ ++ rawnand_cap_cont_reads(chip); ++ } + } + + static void rawnand_cont_read_skip_first_page(struct nand_chip *chip, unsigned int page) +-- +2.43.0 + diff --git a/queue-6.6/mtd-rawnand-meson-fix-scrambling-mode-value-in-comma.patch b/queue-6.6/mtd-rawnand-meson-fix-scrambling-mode-value-in-comma.patch new file mode 100644 index 00000000000..2edbe399ee2 --- /dev/null +++ b/queue-6.6/mtd-rawnand-meson-fix-scrambling-mode-value-in-comma.patch @@ -0,0 +1,39 @@ +From 15bf94568fe8fbaa542f8f42e989f0e4b04dd8fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 00:45:51 +0300 +Subject: mtd: rawnand: meson: fix scrambling mode value in command macro + +From: Arseniy Krasnov + +[ Upstream commit ef6f463599e16924cdd02ce5056ab52879dc008c ] + +Scrambling mode is enabled by value (1 << 19). NFC_CMD_SCRAMBLER_ENABLE +is already (1 << 19), so there is no need to shift it again in CMDRWGEN +macro. + +Signed-off-by: Arseniy Krasnov +Cc: +Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20240210214551.441610-1-avkrasnov@salutedevices.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/meson_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index a506e658d4624..439e9593c8ed1 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -63,7 +63,7 @@ + #define CMDRWGEN(cmd_dir, ran, bch, short_mode, page_size, pages) \ + ( \ + (cmd_dir) | \ +- ((ran) << 19) | \ ++ (ran) | \ + ((bch) << 14) | \ + ((short_mode) << 13) | \ + (((page_size) & 0x7f) << 6) | \ +-- +2.43.0 + diff --git a/queue-6.6/net-esp-fix-bad-handling-of-pages-from-page_pool.patch b/queue-6.6/net-esp-fix-bad-handling-of-pages-from-page_pool.patch new file mode 100644 index 00000000000..20d22b3aba0 --- /dev/null +++ b/queue-6.6/net-esp-fix-bad-handling-of-pages-from-page_pool.patch @@ -0,0 +1,196 @@ +From 7e89d36c324a7134f2b69f48fedd9900b9f343d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 17:26:00 +0200 +Subject: net: esp: fix bad handling of pages from page_pool + +From: Dragos Tatulea + +[ Upstream commit c3198822c6cb9fb588e446540485669cc81c5d34 ] + +When the skb is reorganized during esp_output (!esp->inline), the pages +coming from the original skb fragments are supposed to be released back +to the system through put_page. But if the skb fragment pages are +originating from a page_pool, calling put_page on them will trigger a +page_pool leak which will eventually result in a crash. + +This leak can be easily observed when using CONFIG_DEBUG_VM and doing +ipsec + gre (non offloaded) forwarding: + + BUG: Bad page state in process ksoftirqd/16 pfn:1451b6 + page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6 + flags: 0x200000000000000(node=0|zone=2) + page_type: 0xffffffff() + raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000 + raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000 + page dumped because: page_pool leak + Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core] + CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + Call Trace: + + dump_stack_lvl+0x36/0x50 + bad_page+0x70/0xf0 + free_unref_page_prepare+0x27a/0x460 + free_unref_page+0x38/0x120 + esp_ssg_unref.isra.0+0x15f/0x200 + esp_output_tail+0x66d/0x780 + esp_xmit+0x2c5/0x360 + validate_xmit_xfrm+0x313/0x370 + ? validate_xmit_skb+0x1d/0x330 + validate_xmit_skb_list+0x4c/0x70 + sch_direct_xmit+0x23e/0x350 + __dev_queue_xmit+0x337/0xba0 + ? nf_hook_slow+0x3f/0xd0 + ip_finish_output2+0x25e/0x580 + iptunnel_xmit+0x19b/0x240 + ip_tunnel_xmit+0x5fb/0xb60 + ipgre_xmit+0x14d/0x280 [ip_gre] + dev_hard_start_xmit+0xc3/0x1c0 + __dev_queue_xmit+0x208/0xba0 + ? nf_hook_slow+0x3f/0xd0 + ip_finish_output2+0x1ca/0x580 + ip_sublist_rcv_finish+0x32/0x40 + ip_sublist_rcv+0x1b2/0x1f0 + ? ip_rcv_finish_core.constprop.0+0x460/0x460 + ip_list_rcv+0x103/0x130 + __netif_receive_skb_list_core+0x181/0x1e0 + netif_receive_skb_list_internal+0x1b3/0x2c0 + napi_gro_receive+0xc8/0x200 + gro_cell_poll+0x52/0x90 + __napi_poll+0x25/0x1a0 + net_rx_action+0x28e/0x300 + __do_softirq+0xc3/0x276 + ? sort_range+0x20/0x20 + run_ksoftirqd+0x1e/0x30 + smpboot_thread_fn+0xa6/0x130 + kthread+0xcd/0x100 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x31/0x50 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork_asm+0x11/0x20 + + +The suggested fix is to introduce a new wrapper (skb_page_unref) that +covers page refcounting for page_pool pages as well. + +Cc: stable@vger.kernel.org +Fixes: 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling") +Reported-and-tested-by: Anatoli N.Chechelnickiy +Reported-by: Ian Kumlien +Link: https://lore.kernel.org/netdev/CAA85sZvvHtrpTQRqdaOx6gd55zPAVsqMYk_Lwh4Md5knTq7AyA@mail.gmail.com +Signed-off-by: Dragos Tatulea +Reviewed-by: Mina Almasry +Reviewed-by: Jakub Kicinski +Acked-by: Ilias Apalodimas +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 10 ++++++++++ + net/ipv4/esp4.c | 8 ++++---- + net/ipv6/esp6.c | 8 ++++---- + 3 files changed, 18 insertions(+), 8 deletions(-) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index ddfe86deb4e7f..2922059908cc5 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -3438,6 +3438,16 @@ static inline void skb_frag_ref(struct sk_buff *skb, int f) + + bool napi_pp_put_page(struct page *page, bool napi_safe); + ++static inline void ++skb_page_unref(const struct sk_buff *skb, struct page *page, bool napi_safe) ++{ ++#ifdef CONFIG_PAGE_POOL ++ if (skb->pp_recycle && napi_pp_put_page(page, napi_safe)) ++ return; ++#endif ++ put_page(page); ++} ++ + static inline void + napi_frag_unref(skb_frag_t *frag, bool recycle, bool napi_safe) + { +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index 4ccfc104f13a5..fe501d2186bcf 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -95,7 +95,7 @@ static inline struct scatterlist *esp_req_sg(struct crypto_aead *aead, + __alignof__(struct scatterlist)); + } + +-static void esp_ssg_unref(struct xfrm_state *x, void *tmp) ++static void esp_ssg_unref(struct xfrm_state *x, void *tmp, struct sk_buff *skb) + { + struct crypto_aead *aead = x->data; + int extralen = 0; +@@ -114,7 +114,7 @@ static void esp_ssg_unref(struct xfrm_state *x, void *tmp) + */ + if (req->src != req->dst) + for (sg = sg_next(req->src); sg; sg = sg_next(sg)) +- put_page(sg_page(sg)); ++ skb_page_unref(skb, sg_page(sg), false); + } + + #ifdef CONFIG_INET_ESPINTCP +@@ -260,7 +260,7 @@ static void esp_output_done(void *data, int err) + } + + tmp = ESP_SKB_CB(skb)->tmp; +- esp_ssg_unref(x, tmp); ++ esp_ssg_unref(x, tmp, skb); + kfree(tmp); + + if (xo && (xo->flags & XFRM_DEV_RESUME)) { +@@ -639,7 +639,7 @@ int esp_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * + } + + if (sg != dsg) +- esp_ssg_unref(x, tmp); ++ esp_ssg_unref(x, tmp, skb); + + if (!err && x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) + err = esp_output_tail_tcp(x, skb); +diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c +index 2cc1a45742d82..a3fa3eda388a4 100644 +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -112,7 +112,7 @@ static inline struct scatterlist *esp_req_sg(struct crypto_aead *aead, + __alignof__(struct scatterlist)); + } + +-static void esp_ssg_unref(struct xfrm_state *x, void *tmp) ++static void esp_ssg_unref(struct xfrm_state *x, void *tmp, struct sk_buff *skb) + { + struct crypto_aead *aead = x->data; + int extralen = 0; +@@ -131,7 +131,7 @@ static void esp_ssg_unref(struct xfrm_state *x, void *tmp) + */ + if (req->src != req->dst) + for (sg = sg_next(req->src); sg; sg = sg_next(sg)) +- put_page(sg_page(sg)); ++ skb_page_unref(skb, sg_page(sg), false); + } + + #ifdef CONFIG_INET6_ESPINTCP +@@ -294,7 +294,7 @@ static void esp_output_done(void *data, int err) + } + + tmp = ESP_SKB_CB(skb)->tmp; +- esp_ssg_unref(x, tmp); ++ esp_ssg_unref(x, tmp, skb); + kfree(tmp); + + esp_output_encap_csum(skb); +@@ -677,7 +677,7 @@ int esp6_output_tail(struct xfrm_state *x, struct sk_buff *skb, struct esp_info + } + + if (sg != dsg) +- esp_ssg_unref(x, tmp); ++ esp_ssg_unref(x, tmp, skb); + + if (!err && x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) + err = esp_output_tail_tcp(x, skb); +-- +2.43.0 + diff --git a/queue-6.6/net-hns3-tracing-fix-hclgevf-trace-event-strings.patch b/queue-6.6/net-hns3-tracing-fix-hclgevf-trace-event-strings.patch new file mode 100644 index 00000000000..9ee5948a92e --- /dev/null +++ b/queue-6.6/net-hns3-tracing-fix-hclgevf-trace-event-strings.patch @@ -0,0 +1,153 @@ +From 2c2c0a67eb6a0bf6ba1d752ceb5e00caa0cee27f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 09:34:54 -0400 +Subject: net: hns3: tracing: fix hclgevf trace event strings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steven Rostedt (Google) + +[ Upstream commit 3f9952e8d80cca2da3b47ecd5ad9ec16cfd1a649 ] + +The __string() and __assign_str() helper macros of the TRACE_EVENT() macro +are going through some optimizations where only the source string of +__string() will be used and the __assign_str() source will be ignored and +later removed. + +To make sure that there's no issues, a new check is added between the +__string() src argument and the __assign_str() src argument that does a +strcmp() to make sure they are the same string. + +The hclgevf trace events have: + + __assign_str(devname, &hdev->nic.kinfo.netdev->name); + +Which triggers the warning: + +hclgevf_trace.h:34:39: error: passing argument 1 of ‘strcmp’ from incompatible pointer type [-Werror=incompatible-pointer-types] + 34 | __assign_str(devname, &hdev->nic.kinfo.netdev->name); + [..] +arch/x86/include/asm/string_64.h:75:24: note: expected ‘const char *’ but argument is of type ‘char (*)[16]’ + 75 | int strcmp(const char *cs, const char *ct); + | ~~~~~~~~~~~~^~ + +Because __assign_str() now has: + + WARN_ON_ONCE(__builtin_constant_p(src) ? \ + strcmp((src), __data_offsets.dst##_ptr_) : \ + (src) != __data_offsets.dst##_ptr_); \ + +The problem is the '&' on hdev->nic.kinfo.netdev->name. That's because +that name is: + + char name[IFNAMSIZ] + +Where passing an address '&' of a char array is not compatible with strcmp(). + +The '&' is not necessary, remove it. + +Link: https://lore.kernel.org/linux-trace-kernel/20240313093454.3909afe7@gandalf.local.home + +Cc: netdev +Cc: Yisen Zhuang +Cc: Salil Mehta +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Yufeng Mo +Cc: Huazhong Tan +Cc: stable@vger.kernel.org +Acked-by: Paolo Abeni +Reviewed-by: Jijie Shao +Fixes: d8355240cf8fb ("net: hns3: add trace event support for PF/VF mailbox") +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h | 8 ++++---- + .../net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h +index 8510b88d49820..f3cd5a376eca9 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h +@@ -24,7 +24,7 @@ TRACE_EVENT(hclge_pf_mbx_get, + __field(u8, code) + __field(u8, subcode) + __string(pciname, pci_name(hdev->pdev)) +- __string(devname, &hdev->vport[0].nic.kinfo.netdev->name) ++ __string(devname, hdev->vport[0].nic.kinfo.netdev->name) + __array(u32, mbx_data, PF_GET_MBX_LEN) + ), + +@@ -33,7 +33,7 @@ TRACE_EVENT(hclge_pf_mbx_get, + __entry->code = req->msg.code; + __entry->subcode = req->msg.subcode; + __assign_str(pciname, pci_name(hdev->pdev)); +- __assign_str(devname, &hdev->vport[0].nic.kinfo.netdev->name); ++ __assign_str(devname, hdev->vport[0].nic.kinfo.netdev->name); + memcpy(__entry->mbx_data, req, + sizeof(struct hclge_mbx_vf_to_pf_cmd)); + ), +@@ -56,7 +56,7 @@ TRACE_EVENT(hclge_pf_mbx_send, + __field(u8, vfid) + __field(u16, code) + __string(pciname, pci_name(hdev->pdev)) +- __string(devname, &hdev->vport[0].nic.kinfo.netdev->name) ++ __string(devname, hdev->vport[0].nic.kinfo.netdev->name) + __array(u32, mbx_data, PF_SEND_MBX_LEN) + ), + +@@ -64,7 +64,7 @@ TRACE_EVENT(hclge_pf_mbx_send, + __entry->vfid = req->dest_vfid; + __entry->code = le16_to_cpu(req->msg.code); + __assign_str(pciname, pci_name(hdev->pdev)); +- __assign_str(devname, &hdev->vport[0].nic.kinfo.netdev->name); ++ __assign_str(devname, hdev->vport[0].nic.kinfo.netdev->name); + memcpy(__entry->mbx_data, req, + sizeof(struct hclge_mbx_pf_to_vf_cmd)); + ), +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h +index 5d4895bb57a17..b259e95dd53c2 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h +@@ -23,7 +23,7 @@ TRACE_EVENT(hclge_vf_mbx_get, + __field(u8, vfid) + __field(u16, code) + __string(pciname, pci_name(hdev->pdev)) +- __string(devname, &hdev->nic.kinfo.netdev->name) ++ __string(devname, hdev->nic.kinfo.netdev->name) + __array(u32, mbx_data, VF_GET_MBX_LEN) + ), + +@@ -31,7 +31,7 @@ TRACE_EVENT(hclge_vf_mbx_get, + __entry->vfid = req->dest_vfid; + __entry->code = le16_to_cpu(req->msg.code); + __assign_str(pciname, pci_name(hdev->pdev)); +- __assign_str(devname, &hdev->nic.kinfo.netdev->name); ++ __assign_str(devname, hdev->nic.kinfo.netdev->name); + memcpy(__entry->mbx_data, req, + sizeof(struct hclge_mbx_pf_to_vf_cmd)); + ), +@@ -55,7 +55,7 @@ TRACE_EVENT(hclge_vf_mbx_send, + __field(u8, code) + __field(u8, subcode) + __string(pciname, pci_name(hdev->pdev)) +- __string(devname, &hdev->nic.kinfo.netdev->name) ++ __string(devname, hdev->nic.kinfo.netdev->name) + __array(u32, mbx_data, VF_SEND_MBX_LEN) + ), + +@@ -64,7 +64,7 @@ TRACE_EVENT(hclge_vf_mbx_send, + __entry->code = req->msg.code; + __entry->subcode = req->msg.subcode; + __assign_str(pciname, pci_name(hdev->pdev)); +- __assign_str(devname, &hdev->nic.kinfo.netdev->name); ++ __assign_str(devname, hdev->nic.kinfo.netdev->name); + memcpy(__entry->mbx_data, req, + sizeof(struct hclge_mbx_vf_to_pf_cmd)); + ), +-- +2.43.0 + diff --git a/queue-6.6/nfs-fix-uaf-in-direct-writes.patch b/queue-6.6/nfs-fix-uaf-in-direct-writes.patch new file mode 100644 index 00000000000..4589ae8753d --- /dev/null +++ b/queue-6.6/nfs-fix-uaf-in-direct-writes.patch @@ -0,0 +1,125 @@ +From 212965ff36ff9a506594daf306dd629f20f1393a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 11:49:57 -0500 +Subject: nfs: fix UAF in direct writes + +From: Josef Bacik + +[ Upstream commit 17f46b803d4f23c66cacce81db35fef3adb8f2af ] + +In production we have been hitting the following warning consistently + +------------[ cut here ]------------ +refcount_t: underflow; use-after-free. +WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 +Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] +RIP: 0010:refcount_warn_saturate+0x9c/0xe0 +PKRU: 55555554 +Call Trace: + + ? __warn+0x9f/0x130 + ? refcount_warn_saturate+0x9c/0xe0 + ? report_bug+0xcc/0x150 + ? handle_bug+0x3d/0x70 + ? exc_invalid_op+0x16/0x40 + ? asm_exc_invalid_op+0x16/0x20 + ? refcount_warn_saturate+0x9c/0xe0 + nfs_direct_write_schedule_work+0x237/0x250 [nfs] + process_one_work+0x12f/0x4a0 + worker_thread+0x14e/0x3b0 + ? ZSTD_getCParams_internal+0x220/0x220 + kthread+0xdc/0x120 + ? __btf_name_valid+0xa0/0xa0 + ret_from_fork+0x1f/0x30 + +This is because we're completing the nfs_direct_request twice in a row. + +The source of this is when we have our commit requests to submit, we +process them and send them off, and then in the completion path for the +commit requests we have + +if (nfs_commit_end(cinfo.mds)) + nfs_direct_write_complete(dreq); + +However since we're submitting asynchronous requests we sometimes have +one that completes before we submit the next one, so we end up calling +complete on the nfs_direct_request twice. + +The only other place we use nfs_generic_commit_list() is in +__nfs_commit_inode, which wraps this call in a + +nfs_commit_begin(); +nfs_commit_end(); + +Which is a common pattern for this style of completion handling, one +that is also repeated in the direct code with get_dreq()/put_dreq() +calls around where we process events as well as in the completion paths. + +Fix this by using the same pattern for the commit requests. + +Before with my 200 node rocksdb stress running this warning would pop +every 10ish minutes. With my patch the stress test has been running for +several hours without popping. + +Signed-off-by: Josef Bacik +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/direct.c | 11 +++++++++-- + fs/nfs/write.c | 2 +- + include/linux/nfs_fs.h | 1 + + 3 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 5918c67dae0da..b6f801e73bfdc 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -668,10 +668,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq) + LIST_HEAD(mds_list); + + nfs_init_cinfo_from_dreq(&cinfo, dreq); ++ nfs_commit_begin(cinfo.mds); + nfs_scan_commit(dreq->inode, &mds_list, &cinfo); + res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo); +- if (res < 0) /* res == -ENOMEM */ +- nfs_direct_write_reschedule(dreq); ++ if (res < 0) { /* res == -ENOMEM */ ++ spin_lock(&dreq->lock); ++ if (dreq->flags == 0) ++ dreq->flags = NFS_ODIRECT_RESCHED_WRITES; ++ spin_unlock(&dreq->lock); ++ } ++ if (nfs_commit_end(cinfo.mds)) ++ nfs_direct_write_complete(dreq); + } + + static void nfs_direct_write_clear_reqs(struct nfs_direct_req *dreq) +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 4a250f65fa759..7d03811f44a4b 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1661,7 +1661,7 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) + !atomic_read(&cinfo->rpcs_out)); + } + +-static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) ++void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) + { + atomic_inc(&cinfo->rpcs_out); + } +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index 279262057a925..832b7e354b4e3 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -612,6 +612,7 @@ int nfs_wb_folio_cancel(struct inode *inode, struct folio *folio); + extern int nfs_commit_inode(struct inode *, int); + extern struct nfs_commit_data *nfs_commitdata_alloc(void); + extern void nfs_commit_free(struct nfs_commit_data *data); ++void nfs_commit_begin(struct nfs_mds_commit_info *cinfo); + bool nfs_commit_end(struct nfs_mds_commit_info *cinfo); + + static inline bool nfs_have_writebacks(const struct inode *inode) +-- +2.43.0 + diff --git a/queue-6.6/nfs-read-unlock-folio-on-nfs_page_create_from_folio-.patch b/queue-6.6/nfs-read-unlock-folio-on-nfs_page_create_from_folio-.patch new file mode 100644 index 00000000000..60fa3b92e8d --- /dev/null +++ b/queue-6.6/nfs-read-unlock-folio-on-nfs_page_create_from_folio-.patch @@ -0,0 +1,40 @@ +From c781149a0c42881be1cbbbeea250763ffc599b13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 09:41:18 -0500 +Subject: NFS: Read unlock folio on nfs_page_create_from_folio() error + +From: Benjamin Coddington + +[ Upstream commit 11974eec839c167362af685aae5f5e1baaf979eb ] + +The netfs conversion lost a folio_unlock() for the case where +nfs_page_create_from_folio() returns an error (usually -ENOMEM). Restore +it. + +Reported-by: David Jeffery +Cc: # 6.4+ +Fixes: 000dbe0bec05 ("NFS: Convert buffered read paths to use netfs when fscache is enabled") +Signed-off-by: Benjamin Coddington +Acked-by: Dave Wysochanski +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/read.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/read.c b/fs/nfs/read.c +index 7dc21a48e3e7b..a142287d86f68 100644 +--- a/fs/nfs/read.c ++++ b/fs/nfs/read.c +@@ -305,6 +305,8 @@ int nfs_read_add_folio(struct nfs_pageio_descriptor *pgio, + new = nfs_page_create_from_folio(ctx, folio, 0, aligned_len); + if (IS_ERR(new)) { + error = PTR_ERR(new); ++ if (nfs_netfs_folio_unlock(folio)) ++ folio_unlock(folio); + goto out; + } + +-- +2.43.0 + diff --git a/queue-6.6/nfsd-fix-nfsd_clid_class-use-of-__string_len-macro.patch b/queue-6.6/nfsd-fix-nfsd_clid_class-use-of-__string_len-macro.patch new file mode 100644 index 00000000000..403e49ace49 --- /dev/null +++ b/queue-6.6/nfsd-fix-nfsd_clid_class-use-of-__string_len-macro.patch @@ -0,0 +1,57 @@ +From 455b80776ef27041ad2dccc24db7203a712217d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 12:28:28 -0500 +Subject: NFSD: Fix nfsd_clid_class use of __string_len() macro + +From: Steven Rostedt (Google) + +[ Upstream commit 9388a2aa453321bcf1ad2603959debea9e6ab6d4 ] + +I'm working on restructuring the __string* macros so that it doesn't need +to recalculate the string twice. That is, it will save it off when +processing __string() and the __assign_str() will not need to do the work +again as it currently does. + +Currently __string_len(item, src, len) doesn't actually use "src", but my +changes will require src to be correct as that is where the __assign_str() +will get its value from. + +The event class nfsd_clid_class has: + + __string_len(name, name, clp->cl_name.len) + +But the second "name" does not exist and causes my changes to fail to +build. That second parameter should be: clp->cl_name.data. + +Link: https://lore.kernel.org/linux-trace-kernel/20240222122828.3d8d213c@gandalf.local.home + +Cc: Neil Brown +Cc: Olga Kornievskaia +Cc: Dai Ngo +Cc: Tom Talpey +Cc: stable@vger.kernel.org +Fixes: d27b74a8675ca ("NFSD: Use new __string_len C macros for nfsd_clid_class") +Acked-by: Chuck Lever +Acked-by: Jeff Layton +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + fs/nfsd/trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h +index 8039043488718..d7ed49eef5911 100644 +--- a/fs/nfsd/trace.h ++++ b/fs/nfsd/trace.h +@@ -843,7 +843,7 @@ DECLARE_EVENT_CLASS(nfsd_clid_class, + __array(unsigned char, addr, sizeof(struct sockaddr_in6)) + __field(unsigned long, flavor) + __array(unsigned char, verifier, NFS4_VERIFIER_SIZE) +- __string_len(name, name, clp->cl_name.len) ++ __string_len(name, clp->cl_name.data, clp->cl_name.len) + ), + TP_fast_assign( + __entry->cl_boot = clp->cl_clientid.cl_boot; +-- +2.43.0 + diff --git a/queue-6.6/nilfs2-fix-failure-to-detect-dat-corruption-in-btree.patch b/queue-6.6/nilfs2-fix-failure-to-detect-dat-corruption-in-btree.patch new file mode 100644 index 00000000000..5df8b0a2430 --- /dev/null +++ b/queue-6.6/nilfs2-fix-failure-to-detect-dat-corruption-in-btree.patch @@ -0,0 +1,131 @@ +From a229f0a15e9ec23bbfcc788b6a9911fd6039347d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 19:58:26 +0900 +Subject: nilfs2: fix failure to detect DAT corruption in btree and direct + mappings + +From: Ryusuke Konishi + +[ Upstream commit f2f26b4a84a0ef41791bd2d70861c8eac748f4ba ] + +Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". + +This resolves a kernel BUG reported by syzbot. Since there are two +flaws involved, I've made each one a separate patch. + +The first patch alone resolves the syzbot-reported bug, but I think +both fixes should be sent to stable, so I've tagged them as such. + +This patch (of 2): + +Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data +to a nilfs2 file system whose metadata is corrupted. + +There are two flaws involved in this issue. + +The first flaw is that when nilfs_get_block() locates a data block using +btree or direct mapping, if the disk address translation routine +nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata +corruption, it can be passed back to nilfs_get_block(). This causes +nilfs_get_block() to misidentify an existing block as non-existent, +causing both data block lookup and insertion to fail inconsistently. + +The second flaw is that nilfs_get_block() returns a successful status in +this inconsistent state. This causes the caller __block_write_begin_int() +or others to request a read even though the buffer is not mapped, +resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc() +failing. + +This fixes the first issue by changing the return value to code -EINVAL +when a conversion using DAT fails with code -ENOENT, avoiding the +conflicting condition that leads to the kernel bug described above. Here, +code -EINVAL indicates that metadata corruption was detected during the +block lookup, which will be properly handled as a file system error and +converted to -EIO when passing through the nilfs2 bmap layer. + +Link: https://lkml.kernel.org/r/20240313105827.5296-1-konishi.ryusuke@gmail.com +Link: https://lkml.kernel.org/r/20240313105827.5296-2-konishi.ryusuke@gmail.com +Fixes: c3a7abf06ce7 ("nilfs2: support contiguous lookup of blocks") +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+cfed5b56649bddf80d6e@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=cfed5b56649bddf80d6e +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/btree.c | 9 +++++++-- + fs/nilfs2/direct.c | 9 +++++++-- + 2 files changed, 14 insertions(+), 4 deletions(-) + +diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c +index 13592e82eaf68..65659fa0372e6 100644 +--- a/fs/nilfs2/btree.c ++++ b/fs/nilfs2/btree.c +@@ -724,7 +724,7 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree, + dat = nilfs_bmap_get_dat(btree); + ret = nilfs_dat_translate(dat, ptr, &blocknr); + if (ret < 0) +- goto out; ++ goto dat_error; + ptr = blocknr; + } + cnt = 1; +@@ -743,7 +743,7 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree, + if (dat) { + ret = nilfs_dat_translate(dat, ptr2, &blocknr); + if (ret < 0) +- goto out; ++ goto dat_error; + ptr2 = blocknr; + } + if (ptr2 != ptr + cnt || ++cnt == maxblocks) +@@ -781,6 +781,11 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree, + out: + nilfs_btree_free_path(path); + return ret; ++ ++ dat_error: ++ if (ret == -ENOENT) ++ ret = -EINVAL; /* Notify bmap layer of metadata corruption */ ++ goto out; + } + + static void nilfs_btree_promote_key(struct nilfs_bmap *btree, +diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c +index 4c85914f2abc3..893ab36824cc2 100644 +--- a/fs/nilfs2/direct.c ++++ b/fs/nilfs2/direct.c +@@ -66,7 +66,7 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct, + dat = nilfs_bmap_get_dat(direct); + ret = nilfs_dat_translate(dat, ptr, &blocknr); + if (ret < 0) +- return ret; ++ goto dat_error; + ptr = blocknr; + } + +@@ -79,7 +79,7 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct, + if (dat) { + ret = nilfs_dat_translate(dat, ptr2, &blocknr); + if (ret < 0) +- return ret; ++ goto dat_error; + ptr2 = blocknr; + } + if (ptr2 != ptr + cnt) +@@ -87,6 +87,11 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct, + } + *ptrp = ptr; + return cnt; ++ ++ dat_error: ++ if (ret == -ENOENT) ++ ret = -EINVAL; /* Notify bmap layer of metadata corruption */ ++ return ret; + } + + static __u64 +-- +2.43.0 + diff --git a/queue-6.6/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch b/queue-6.6/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch new file mode 100644 index 00000000000..f25f3159e0d --- /dev/null +++ b/queue-6.6/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch @@ -0,0 +1,44 @@ +From 68616dca6bac5d3732172d0584e44e7c917b96e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 19:58:27 +0900 +Subject: nilfs2: prevent kernel bug at submit_bh_wbc() + +From: Ryusuke Konishi + +[ Upstream commit 269cdf353b5bdd15f1a079671b0f889113865f20 ] + +Fix a bug where nilfs_get_block() returns a successful status when +searching and inserting the specified block both fail inconsistently. If +this inconsistent behavior is not due to a previously fixed bug, then an +unexpected race is occurring, so return a temporary error -EAGAIN instead. + +This prevents callers such as __block_write_begin_int() from requesting a +read into a buffer that is not mapped, which would cause the BUG_ON check +for the BH_Mapped flag in submit_bh_wbc() to fail. + +Link: https://lkml.kernel.org/r/20240313105827.5296-3-konishi.ryusuke@gmail.com +Fixes: 1f5abe7e7dbc ("nilfs2: replace BUG_ON and BUG calls triggerable from ioctl") +Signed-off-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c +index 1a8bd59934761..8e1afa39a62e1 100644 +--- a/fs/nilfs2/inode.c ++++ b/fs/nilfs2/inode.c +@@ -112,7 +112,7 @@ int nilfs_get_block(struct inode *inode, sector_t blkoff, + "%s (ino=%lu): a race condition while inserting a data block at offset=%llu", + __func__, inode->i_ino, + (unsigned long long)blkoff); +- err = 0; ++ err = -EAGAIN; + } + nilfs_transaction_abort(inode->i_sb); + goto out; +-- +2.43.0 + diff --git a/queue-6.6/nvmem-meson-efuse-fix-function-pointer-type-mismatch.patch b/queue-6.6/nvmem-meson-efuse-fix-function-pointer-type-mismatch.patch new file mode 100644 index 00000000000..4c1fb5df4c9 --- /dev/null +++ b/queue-6.6/nvmem-meson-efuse-fix-function-pointer-type-mismatch.patch @@ -0,0 +1,80 @@ +From 784f331ea795bda15b173de0e59c6f71bad91889 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Feb 2024 11:40:23 +0000 +Subject: nvmem: meson-efuse: fix function pointer type mismatch + +From: Jerome Brunet + +[ Upstream commit cbd38332c140829ab752ba4e727f98be5c257f18 ] + +clang-16 warns about casting functions to incompatible types, as is done +here to call clk_disable_unprepare: + +drivers/nvmem/meson-efuse.c:78:12: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 78 | (void(*)(void *))clk_disable_unprepare, + +The pattern of getting, enabling and setting a disable callback for a +clock can be replaced with devm_clk_get_enabled(), which also fixes +this warning. + +Fixes: 611fbca1c861 ("nvmem: meson-efuse: add peripheral clock") +Cc: Stable@vger.kernel.org +Reported-by: Arnd Bergmann +Signed-off-by: Jerome Brunet +Reviewed-by: Martin Blumenstingl +Acked-by: Arnd Bergmann +Reviewed-by: Justin Stitt +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20240224114023.85535-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/meson-efuse.c | 25 +++---------------------- + 1 file changed, 3 insertions(+), 22 deletions(-) + +diff --git a/drivers/nvmem/meson-efuse.c b/drivers/nvmem/meson-efuse.c +index d6b533497ce1a..ba2714bef8d0e 100644 +--- a/drivers/nvmem/meson-efuse.c ++++ b/drivers/nvmem/meson-efuse.c +@@ -47,7 +47,6 @@ static int meson_efuse_probe(struct platform_device *pdev) + struct nvmem_config *econfig; + struct clk *clk; + unsigned int size; +- int ret; + + sm_np = of_parse_phandle(pdev->dev.of_node, "secure-monitor", 0); + if (!sm_np) { +@@ -60,27 +59,9 @@ static int meson_efuse_probe(struct platform_device *pdev) + if (!fw) + return -EPROBE_DEFER; + +- clk = devm_clk_get(dev, NULL); +- if (IS_ERR(clk)) { +- ret = PTR_ERR(clk); +- if (ret != -EPROBE_DEFER) +- dev_err(dev, "failed to get efuse gate"); +- return ret; +- } +- +- ret = clk_prepare_enable(clk); +- if (ret) { +- dev_err(dev, "failed to enable gate"); +- return ret; +- } +- +- ret = devm_add_action_or_reset(dev, +- (void(*)(void *))clk_disable_unprepare, +- clk); +- if (ret) { +- dev_err(dev, "failed to add disable callback"); +- return ret; +- } ++ clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(clk)) ++ return dev_err_probe(dev, PTR_ERR(clk), "failed to get efuse gate"); + + if (meson_sm_call(fw, SM_EFUSE_USER_MAX, &size, 0, 0, 0, 0, 0) < 0) { + dev_err(dev, "failed to get max user"); +-- +2.43.0 + diff --git a/queue-6.6/parisc-avoid-clobbering-the-c-b-bits-in-the-psw-with.patch b/queue-6.6/parisc-avoid-clobbering-the-c-b-bits-in-the-psw-with.patch new file mode 100644 index 00000000000..94baf2bcd54 --- /dev/null +++ b/queue-6.6/parisc-avoid-clobbering-the-c-b-bits-in-the-psw-with.patch @@ -0,0 +1,64 @@ +From a1487a09f23101efad78e67e854f4edcf48f2a76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 16:40:51 +0100 +Subject: parisc: Avoid clobbering the C/B bits in the PSW with tophys and + tovirt macros + +From: John David Anglin + +[ Upstream commit 4603fbaa76b5e703b38ac8cc718102834eb6e330 ] + +Use add,l to avoid clobbering the C/B bits in the PSW. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Cc: stable@vger.kernel.org # v5.10+ +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/assembly.h | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/arch/parisc/include/asm/assembly.h b/arch/parisc/include/asm/assembly.h +index 5937d5edaba1e..000a28e1c5e8d 100644 +--- a/arch/parisc/include/asm/assembly.h ++++ b/arch/parisc/include/asm/assembly.h +@@ -97,26 +97,28 @@ + * version takes two arguments: a src and destination register. + * However, the source and destination registers can not be + * the same register. ++ * ++ * We use add,l to avoid clobbering the C/B bits in the PSW. + */ + + .macro tophys grvirt, grphys +- ldil L%(__PAGE_OFFSET), \grphys +- sub \grvirt, \grphys, \grphys ++ ldil L%(-__PAGE_OFFSET), \grphys ++ addl \grvirt, \grphys, \grphys + .endm +- ++ + .macro tovirt grphys, grvirt + ldil L%(__PAGE_OFFSET), \grvirt +- add \grphys, \grvirt, \grvirt ++ addl \grphys, \grvirt, \grvirt + .endm + + .macro tophys_r1 gr +- ldil L%(__PAGE_OFFSET), %r1 +- sub \gr, %r1, \gr ++ ldil L%(-__PAGE_OFFSET), %r1 ++ addl \gr, %r1, \gr + .endm +- ++ + .macro tovirt_r1 gr + ldil L%(__PAGE_OFFSET), %r1 +- add \gr, %r1, \gr ++ addl \gr, %r1, \gr + .endm + + .macro delay value +-- +2.43.0 + diff --git a/queue-6.6/parisc-fix-csum_ipv6_magic-on-32-bit-systems.patch b/queue-6.6/parisc-fix-csum_ipv6_magic-on-32-bit-systems.patch new file mode 100644 index 00000000000..1457461a73d --- /dev/null +++ b/queue-6.6/parisc-fix-csum_ipv6_magic-on-32-bit-systems.patch @@ -0,0 +1,55 @@ +From c9dd78a6bb90b5206fe88d551ffcdf6339ea380d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 11:15:56 -0800 +Subject: parisc: Fix csum_ipv6_magic on 32-bit systems + +From: Guenter Roeck + +[ Upstream commit 4408ba75e4ba80c91fde7e10bccccf388f5c09be ] + +Calculating the IPv6 checksum on 32-bit systems missed overflows when +adding the proto+len fields into the checksum. This results in the +following unit test failure. + + # test_csum_ipv6_magic: ASSERTION FAILED at lib/checksum_kunit.c:506 + Expected ( u64)csum_result == ( u64)expected, but + ( u64)csum_result == 46722 (0xb682) + ( u64)expected == 46721 (0xb681) + not ok 5 test_csum_ipv6_magic + +This is probably rarely seen in the real world because proto+len are +usually small values which will rarely result in overflows when calculating +the checksum. However, the unit test code uses large values for the length +field, causing the test to fail. + +Fix the problem by adding the missing carry into the final checksum. + +Cc: Palmer Dabbelt +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Tested-by: Charlie Jenkins +Reviewed-by: Charlie Jenkins +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/checksum.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h +index f705e5dd10742..e619e67440db9 100644 +--- a/arch/parisc/include/asm/checksum.h ++++ b/arch/parisc/include/asm/checksum.h +@@ -163,7 +163,8 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr, + " ldw,ma 4(%2), %7\n" /* 4th daddr */ + " addc %6, %0, %0\n" + " addc %7, %0, %0\n" +-" addc %3, %0, %0\n" /* fold in proto+len, catch carry */ ++" addc %3, %0, %0\n" /* fold in proto+len */ ++" addc 0, %0, %0\n" /* add carry */ + + #endif + : "=r" (sum), "=r" (saddr), "=r" (daddr), "=r" (len), +-- +2.43.0 + diff --git a/queue-6.6/parisc-fix-csum_ipv6_magic-on-64-bit-systems.patch b/queue-6.6/parisc-fix-csum_ipv6_magic-on-64-bit-systems.patch new file mode 100644 index 00000000000..2a5dcec17bf --- /dev/null +++ b/queue-6.6/parisc-fix-csum_ipv6_magic-on-64-bit-systems.patch @@ -0,0 +1,55 @@ +From 21b1d28f2d4e3119f463044872a0df48afb80c73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 15:46:31 -0800 +Subject: parisc: Fix csum_ipv6_magic on 64-bit systems + +From: Guenter Roeck + +[ Upstream commit 4b75b12d70506e31fc02356bbca60f8d5ca012d0 ] + +hppa 64-bit systems calculates the IPv6 checksum using 64-bit add +operations. The last add folds protocol and length fields into the 64-bit +result. While unlikely, this operation can overflow. The overflow can be +triggered with a code sequence such as the following. + + /* try to trigger massive overflows */ + memset(tmp_buf, 0xff, sizeof(struct in6_addr)); + csum_result = csum_ipv6_magic((struct in6_addr *)tmp_buf, + (struct in6_addr *)tmp_buf, + 0xffff, 0xff, 0xffffffff); + +Fix the problem by adding any overflows from the final add operation into +the calculated checksum. Fortunately, we can do this without additional +cost by replacing the add operation used to fold the checksum into 32 bit +with "add,dc" to add in the missing carry. + +Cc: Palmer Dabbelt +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Reviewed-by: Charlie Jenkins +Tested-by: Guenter Roeck +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/checksum.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h +index e619e67440db9..c949aa20fa162 100644 +--- a/arch/parisc/include/asm/checksum.h ++++ b/arch/parisc/include/asm/checksum.h +@@ -137,8 +137,8 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr, + " add,dc %3, %0, %0\n" /* fold in proto+len | carry bit */ + " extrd,u %0, 31, 32, %4\n"/* copy upper half down */ + " depdi 0, 31, 32, %0\n"/* clear upper half */ +-" add %4, %0, %0\n" /* fold into 32-bits */ +-" addc 0, %0, %0\n" /* add carry */ ++" add,dc %4, %0, %0\n" /* fold into 32-bits, plus carry */ ++" addc 0, %0, %0\n" /* add final carry */ + + #else + +-- +2.43.0 + diff --git a/queue-6.6/parisc-fix-ip_fast_csum.patch b/queue-6.6/parisc-fix-ip_fast_csum.patch new file mode 100644 index 00000000000..e0afb6c80a6 --- /dev/null +++ b/queue-6.6/parisc-fix-ip_fast_csum.patch @@ -0,0 +1,66 @@ +From 9a1d6e2d70fa75f386e79e8ff8adeee36cc316e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 09:55:26 -0800 +Subject: parisc: Fix ip_fast_csum + +From: Guenter Roeck + +[ Upstream commit a2abae8f0b638c31bb9799d9dd847306e0d005bd ] + +IP checksum unit tests report the following error when run on hppa/hppa64. + + # test_ip_fast_csum: ASSERTION FAILED at lib/checksum_kunit.c:463 + Expected ( u64)csum_result == ( u64)expected, but + ( u64)csum_result == 33754 (0x83da) + ( u64)expected == 10946 (0x2ac2) + not ok 4 test_ip_fast_csum + +0x83da is the expected result if the IP header length is 20 bytes. 0x2ac2 +is the expected result if the IP header length is 24 bytes. The test fails +with an IP header length of 24 bytes. It appears that ip_fast_csum() +always returns the checksum for a 20-byte header, no matter how long +the header actually is. + +Code analysis shows a suspicious assembler sequence in ip_fast_csum(). + + " addc %0, %3, %0\n" + "1: ldws,ma 4(%1), %3\n" + " addib,< 0, %2, 1b\n" <--- + +While my understanding of HPPA assembler is limited, it does not seem +to make much sense to subtract 0 from a register and to expect the result +to ever be negative. Subtracting 1 from the length parameter makes more +sense. On top of that, the operation should be repeated if and only if +the result is still > 0, so change the suspicious instruction to + " addib,> -1, %2, 1b\n" + +The IP checksum unit test passes after this change. + +Cc: Palmer Dabbelt +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Tested-by: Charlie Jenkins +Reviewed-by: Charlie Jenkins +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/checksum.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h +index 3c43baca7b397..f705e5dd10742 100644 +--- a/arch/parisc/include/asm/checksum.h ++++ b/arch/parisc/include/asm/checksum.h +@@ -40,7 +40,7 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl) + " addc %0, %5, %0\n" + " addc %0, %3, %0\n" + "1: ldws,ma 4(%1), %3\n" +-" addib,< 0, %2, 1b\n" ++" addib,> -1, %2, 1b\n" + " addc %0, %3, %0\n" + "\n" + " extru %0, 31, 16, %4\n" +-- +2.43.0 + diff --git a/queue-6.6/parisc-strip-upper-32-bit-of-sum-in-csum_ipv6_magic-.patch b/queue-6.6/parisc-strip-upper-32-bit-of-sum-in-csum_ipv6_magic-.patch new file mode 100644 index 00000000000..2989f651e31 --- /dev/null +++ b/queue-6.6/parisc-strip-upper-32-bit-of-sum-in-csum_ipv6_magic-.patch @@ -0,0 +1,55 @@ +From a8666db7d1707eede8e78b05a980ef218ec0f759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 12:33:51 -0800 +Subject: parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit + builds + +From: Guenter Roeck + +[ Upstream commit 0568b6f0d863643db2edcc7be31165740c89fa82 ] + +IPv6 checksum tests with unaligned addresses on 64-bit builds result +in unexpected failures. + +Expected expected == csum_result, but + expected == 46591 (0xb5ff) + csum_result == 46381 (0xb52d) +with alignment offset 1 + +Oddly enough, the problem disappeared after adding test code into +the beginning of csum_ipv6_magic(). + +As it turns out, the 'sum' parameter of csum_ipv6_magic() is declared as +__wsum, which is a 32-bit variable. However, it is treated as 64-bit +variable in the 64-bit assembler code. Tests showed that the upper 32 bit +of the register used to pass the variable are _not_ cleared when entering +the function. This can result in checksum calculation errors. + +Clearing the upper 32 bit of 'sum' as first operation in the assembler +code fixes the problem. + +Acked-by: Helge Deller +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/checksum.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h +index c949aa20fa162..2aceebcd695c8 100644 +--- a/arch/parisc/include/asm/checksum.h ++++ b/arch/parisc/include/asm/checksum.h +@@ -126,6 +126,7 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr, + ** Try to keep 4 registers with "live" values ahead of the ALU. + */ + ++" depdi 0, 31, 32, %0\n"/* clear upper half of incoming checksum */ + " ldd,ma 8(%1), %4\n" /* get 1st saddr word */ + " ldd,ma 8(%2), %5\n" /* get 1st daddr word */ + " add %4, %0, %0\n" +-- +2.43.0 + diff --git a/queue-6.6/parisc-unaligned-rewrite-64-bit-inline-assembly-of-e.patch b/queue-6.6/parisc-unaligned-rewrite-64-bit-inline-assembly-of-e.patch new file mode 100644 index 00000000000..d0aed6c61d1 --- /dev/null +++ b/queue-6.6/parisc-unaligned-rewrite-64-bit-inline-assembly-of-e.patch @@ -0,0 +1,88 @@ +From a9fa8c0855111f8c65c2b8f5c6ff6f7aa753c925 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 14:26:55 +0100 +Subject: parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd() + +From: Guenter Roeck + +[ Upstream commit e5db6a74571a8baf87a116ea39aab946283362ff ] + +Convert to use real temp variables instead of clobbering processor +registers. This aligns the 64-bit inline assembly code with the 32-bit +assembly code which was rewritten with commit 427c1073a2a1 +("parisc/unaligned: Rewrite 32-bit inline assembly of emulate_ldd()"). + +While at it, fix comment in 32-bit rewrite code. Temporary variables are +now used for both 32-bit and 64-bit code, so move their declarations +to the function header. + +No functional change intended. + +Signed-off-by: Guenter Roeck +Cc: stable@vger.kernel.org # v6.0+ +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/unaligned.c | 27 ++++++++++++--------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/arch/parisc/kernel/unaligned.c b/arch/parisc/kernel/unaligned.c +index c520e551a1652..a8e75e5b884a7 100644 +--- a/arch/parisc/kernel/unaligned.c ++++ b/arch/parisc/kernel/unaligned.c +@@ -169,6 +169,7 @@ static int emulate_ldw(struct pt_regs *regs, int toreg, int flop) + static int emulate_ldd(struct pt_regs *regs, int toreg, int flop) + { + unsigned long saddr = regs->ior; ++ unsigned long shift, temp1; + __u64 val = 0; + ASM_EXCEPTIONTABLE_VAR(ret); + +@@ -180,25 +181,22 @@ static int emulate_ldd(struct pt_regs *regs, int toreg, int flop) + + #ifdef CONFIG_64BIT + __asm__ __volatile__ ( +-" depd,z %3,60,3,%%r19\n" /* r19=(ofs&7)*8 */ +-" mtsp %4, %%sr1\n" +-" depd %%r0,63,3,%3\n" +-"1: ldd 0(%%sr1,%3),%0\n" +-"2: ldd 8(%%sr1,%3),%%r20\n" +-" subi 64,%%r19,%%r19\n" +-" mtsar %%r19\n" +-" shrpd %0,%%r20,%%sar,%0\n" ++" depd,z %2,60,3,%3\n" /* shift=(ofs&7)*8 */ ++" mtsp %5, %%sr1\n" ++" depd %%r0,63,3,%2\n" ++"1: ldd 0(%%sr1,%2),%0\n" ++"2: ldd 8(%%sr1,%2),%4\n" ++" subi 64,%3,%3\n" ++" mtsar %3\n" ++" shrpd %0,%4,%%sar,%0\n" + "3: \n" + ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 3b, "%1") + ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 3b, "%1") +- : "=r" (val), "+r" (ret) +- : "0" (val), "r" (saddr), "r" (regs->isr) +- : "r19", "r20" ); ++ : "+r" (val), "+r" (ret), "+r" (saddr), "=&r" (shift), "=&r" (temp1) ++ : "r" (regs->isr) ); + #else +- { +- unsigned long shift, temp1; + __asm__ __volatile__ ( +-" zdep %2,29,2,%3\n" /* r19=(ofs&3)*8 */ ++" zdep %2,29,2,%3\n" /* shift=(ofs&3)*8 */ + " mtsp %5, %%sr1\n" + " dep %%r0,31,2,%2\n" + "1: ldw 0(%%sr1,%2),%0\n" +@@ -214,7 +212,6 @@ static int emulate_ldd(struct pt_regs *regs, int toreg, int flop) + ASM_EXCEPTIONTABLE_ENTRY_EFAULT(3b, 4b, "%1") + : "+r" (val), "+r" (ret), "+r" (saddr), "=&r" (shift), "=&r" (temp1) + : "r" (regs->isr) ); +- } + #endif + + DPRINTF("val = 0x%llx\n", val); +-- +2.43.0 + diff --git a/queue-6.6/pci-aer-block-runtime-suspend-when-handling-errors.patch b/queue-6.6/pci-aer-block-runtime-suspend-when-handling-errors.patch new file mode 100644 index 00000000000..1ccceba8824 --- /dev/null +++ b/queue-6.6/pci-aer-block-runtime-suspend-when-handling-errors.patch @@ -0,0 +1,99 @@ +From 00df0856591ba46d947345650cd261baa32ca506 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 13:01:35 +0100 +Subject: PCI/AER: Block runtime suspend when handling errors + +From: Stanislaw Gruszka + +[ Upstream commit 002bf2fbc00e5c4b95fb167287e2ae7d1973281e ] + +PM runtime can be done simultaneously with AER error handling. Avoid that +by using pm_runtime_get_sync() before and pm_runtime_put() after reset in +pcie_do_recovery() for all recovering devices. + +pm_runtime_get_sync() will increase dev->power.usage_count counter to +prevent any possible future request to runtime suspend a device. It will +also resume a device, if it was previously in D3hot state. + +I tested with igc device by doing simultaneous aer_inject and rpm +suspend/resume via /sys/bus/pci/devices/PCI_ID/power/control and can +reproduce: + + igc 0000:02:00.0: not ready 65535ms after bus reset; giving up + pcieport 0000:00:1c.2: AER: Root Port link has been reset (-25) + pcieport 0000:00:1c.2: AER: subordinate device reset failed + pcieport 0000:00:1c.2: AER: device recovery failed + igc 0000:02:00.0: Unable to change power state from D3hot to D0, device inaccessible + +The problem disappears when this patch is applied. + +Link: https://lore.kernel.org/r/20240212120135.146068-1-stanislaw.gruszka@linux.intel.com +Signed-off-by: Stanislaw Gruszka +Signed-off-by: Bjorn Helgaas +Reviewed-by: Kuppuswamy Sathyanarayanan +Acked-by: Rafael J. Wysocki +Cc: +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/err.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c +index 59c90d04a609a..705893b5f7b09 100644 +--- a/drivers/pci/pcie/err.c ++++ b/drivers/pci/pcie/err.c +@@ -13,6 +13,7 @@ + #define dev_fmt(fmt) "AER: " fmt + + #include ++#include + #include + #include + #include +@@ -85,6 +86,18 @@ static int report_error_detected(struct pci_dev *dev, + return 0; + } + ++static int pci_pm_runtime_get_sync(struct pci_dev *pdev, void *data) ++{ ++ pm_runtime_get_sync(&pdev->dev); ++ return 0; ++} ++ ++static int pci_pm_runtime_put(struct pci_dev *pdev, void *data) ++{ ++ pm_runtime_put(&pdev->dev); ++ return 0; ++} ++ + static int report_frozen_detected(struct pci_dev *dev, void *data) + { + return report_error_detected(dev, pci_channel_io_frozen, data); +@@ -207,6 +220,8 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev, + else + bridge = pci_upstream_bridge(dev); + ++ pci_walk_bridge(bridge, pci_pm_runtime_get_sync, NULL); ++ + pci_dbg(bridge, "broadcast error_detected message\n"); + if (state == pci_channel_io_frozen) { + pci_walk_bridge(bridge, report_frozen_detected, &status); +@@ -251,10 +266,15 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev, + pcie_clear_device_status(dev); + pci_aer_clear_nonfatal_status(dev); + } ++ ++ pci_walk_bridge(bridge, pci_pm_runtime_put, NULL); ++ + pci_info(bridge, "device recovery successful\n"); + return status; + + failed: ++ pci_walk_bridge(bridge, pci_pm_runtime_put, NULL); ++ + pci_uevent_ers(bridge, PCI_ERS_RESULT_DISCONNECT); + + /* TODO: Should kernel panic here? */ +-- +2.43.0 + diff --git a/queue-6.6/pci-dpc-quirk-pio-log-size-for-intel-raptor-lake-roo.patch b/queue-6.6/pci-dpc-quirk-pio-log-size-for-intel-raptor-lake-roo.patch new file mode 100644 index 00000000000..dde25594c02 --- /dev/null +++ b/queue-6.6/pci-dpc-quirk-pio-log-size-for-intel-raptor-lake-roo.patch @@ -0,0 +1,55 @@ +From ce149a692146df0a8d33554b3b421dde77b92236 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 12:30:56 +0100 +Subject: PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports + +From: Paul Menzel + +[ Upstream commit 627c6db20703b5d18d928464f411d0d4ec327508 ] + +Commit 5459c0b70467 ("PCI/DPC: Quirk PIO log size for certain Intel Root +Ports") and commit 3b8803494a06 ("PCI/DPC: Quirk PIO log size for Intel Ice +Lake Root Ports") add quirks for Ice, Tiger and Alder Lake Root Ports. +System firmware for Raptor Lake still has the bug, so Linux logs the +warning below on several Raptor Lake systems like Dell Precision 3581 with +Intel Raptor Lake processor (0W18NX) system firmware/BIOS version 1.10.1. + + pci 0000:00:07.0: [8086:a76e] type 01 class 0x060400 + pci 0000:00:07.0: DPC: RP PIO log size 0 is invalid + pci 0000:00:07.1: [8086:a73f] type 01 class 0x060400 + pci 0000:00:07.1: DPC: RP PIO log size 0 is invalid + +Apply the quirk for Raptor Lake Root Ports as well. + +This also enables the DPC driver to dump the RP PIO Log registers when DPC +is triggered. + +Link: https://lore.kernel.org/r/20240305113057.56468-1-pmenzel@molgen.mpg.de +Reported-by: Niels van Aert +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218560 +Signed-off-by: Paul Menzel +Signed-off-by: Bjorn Helgaas +Cc: +Cc: Mika Westerberg +Cc: Niels van Aert +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 1739fd54a3106..b3976dcb71f10 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -6219,6 +6219,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2b, dpc_log_size); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2d, dpc_log_size); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2f, dpc_log_size); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a31, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0xa73f, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0xa76e, dpc_log_size); + #endif + + /* +-- +2.43.0 + diff --git a/queue-6.6/pci-dwc-endpoint-fix-advertised-resizable-bar-size.patch b/queue-6.6/pci-dwc-endpoint-fix-advertised-resizable-bar-size.patch new file mode 100644 index 00000000000..67f41c12902 --- /dev/null +++ b/queue-6.6/pci-dwc-endpoint-fix-advertised-resizable-bar-size.patch @@ -0,0 +1,75 @@ +From e817188fa5edc103d75fab42e53e661fa8906b7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 12:15:20 +0100 +Subject: PCI: dwc: endpoint: Fix advertised resizable BAR size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Cassel + +[ Upstream commit 72e34b8593e08a0ee759b7a038e0b178418ea6f8 ] + +The commit message in commit fc9a77040b04 ("PCI: designware-ep: Configure +Resizable BAR cap to advertise the smallest size") claims that it modifies +the Resizable BAR capability to only advertise support for 1 MB size BARs. + +However, the commit writes all zeroes to PCI_REBAR_CAP (the register which +contains the possible BAR sizes that a BAR be resized to). + +According to the spec, it is illegal to not have a bit set in +PCI_REBAR_CAP, and 1 MB is the smallest size allowed. + +Set bit 4 in PCI_REBAR_CAP, so that we actually advertise support for a +1 MB BAR size. + +Before: + Capabilities: [2e8 v1] Physical Resizable BAR + BAR 0: current size: 1MB + BAR 1: current size: 1MB + BAR 2: current size: 1MB + BAR 3: current size: 1MB + BAR 4: current size: 1MB + BAR 5: current size: 1MB +After: + Capabilities: [2e8 v1] Physical Resizable BAR + BAR 0: current size: 1MB, supported: 1MB + BAR 1: current size: 1MB, supported: 1MB + BAR 2: current size: 1MB, supported: 1MB + BAR 3: current size: 1MB, supported: 1MB + BAR 4: current size: 1MB, supported: 1MB + BAR 5: current size: 1MB, supported: 1MB + +Fixes: fc9a77040b04 ("PCI: designware-ep: Configure Resizable BAR cap to advertise the smallest size") +Link: https://lore.kernel.org/linux-pci/20240307111520.3303774-1-cassel@kernel.org +Signed-off-by: Niklas Cassel +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Manivannan Sadhasivam +Cc: # 5.2 +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware-ep.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c +index 9d1f259fe3573..ad6516a3ae6ea 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-ep.c ++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c +@@ -671,8 +671,13 @@ int dw_pcie_ep_init_complete(struct dw_pcie_ep *ep) + nbars = (reg & PCI_REBAR_CTRL_NBAR_MASK) >> + PCI_REBAR_CTRL_NBAR_SHIFT; + ++ /* ++ * PCIe r6.0, sec 7.8.6.2 require us to support at least one ++ * size in the range from 1 MB to 512 GB. Advertise support ++ * for 1 MB BAR size only. ++ */ + for (i = 0; i < nbars; i++, offset += PCI_REBAR_CTRL) +- dw_pcie_writel_dbi(pci, offset + PCI_REBAR_CAP, 0x0); ++ dw_pcie_writel_dbi(pci, offset + PCI_REBAR_CAP, BIT(4)); + } + + /* +-- +2.43.0 + diff --git a/queue-6.6/pci-hv-fix-ring-buffer-size-calculation.patch b/queue-6.6/pci-hv-fix-ring-buffer-size-calculation.patch new file mode 100644 index 00000000000..beb1a7d638e --- /dev/null +++ b/queue-6.6/pci-hv-fix-ring-buffer-size-calculation.patch @@ -0,0 +1,65 @@ +From 07fa679bc27efa7873d02b1023bf7dc3dffd8a39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 12:22:40 -0800 +Subject: PCI: hv: Fix ring buffer size calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Kelley + +[ Upstream commit b5ff74c1ef50fe08e384026875fec660fadfaedd ] + +For a physical PCI device that is passed through to a Hyper-V guest VM, +current code specifies the VMBus ring buffer size as 4 pages. But this +is an inappropriate dependency, since the amount of ring buffer space +needed is unrelated to PAGE_SIZE. For example, on x86 the ring buffer +size ends up as 16 Kbytes, while on ARM64 with 64 Kbyte pages, the ring +size bloats to 256 Kbytes. The ring buffer for PCI pass-thru devices +is used for only a few messages during device setup and removal, so any +space above a few Kbytes is wasted. + +Fix this by declaring the ring buffer size to be a fixed 16 Kbytes. +Furthermore, use the VMBUS_RING_SIZE() macro so that the ring buffer +header is properly accounted for, and so the size is rounded up to a +page boundary, using the page size for which the kernel is built. While +w/64 Kbyte pages this results in a 64 Kbyte ring buffer header plus a +64 Kbyte ring buffer, that's the smallest possible with that page size. +It's still 128 Kbytes better than the current code. + +Link: https://lore.kernel.org/linux-pci/20240216202240.251818-1-mhklinux@outlook.com +Signed-off-by: Michael Kelley +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Kuppuswamy Sathyanarayanan +Reviewed-by: Ilpo Jarvinen +Reviewed-by: Long Li +Cc: # 5.15.x +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-hyperv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c +index bed3cefdaf198..5ab1a035c4969 100644 +--- a/drivers/pci/controller/pci-hyperv.c ++++ b/drivers/pci/controller/pci-hyperv.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -465,7 +466,7 @@ struct pci_eject_response { + u32 status; + } __packed; + +-static int pci_ring_size = (4 * PAGE_SIZE); ++static int pci_ring_size = VMBUS_RING_SIZE(SZ_16K); + + /* + * Driver specific state. +-- +2.43.0 + diff --git a/queue-6.6/pci-pm-drain-runtime-idle-callbacks-before-driver-re.patch b/queue-6.6/pci-pm-drain-runtime-idle-callbacks-before-driver-re.patch new file mode 100644 index 00000000000..3aebb43f707 --- /dev/null +++ b/queue-6.6/pci-pm-drain-runtime-idle-callbacks-before-driver-re.patch @@ -0,0 +1,76 @@ +From ee3d78cf81e20003e2fd92e2e31b5301ca65b180 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 11:45:38 +0100 +Subject: PCI/PM: Drain runtime-idle callbacks before driver removal + +From: Rafael J. Wysocki + +[ Upstream commit 9d5286d4e7f68beab450deddbb6a32edd5ecf4bf ] + +A race condition between the .runtime_idle() callback and the .remove() +callback in the rtsx_pcr PCI driver leads to a kernel crash due to an +unhandled page fault [1]. + +The problem is that rtsx_pci_runtime_idle() is not expected to be running +after pm_runtime_get_sync() has been called, but the latter doesn't really +guarantee that. It only guarantees that the suspend and resume callbacks +will not be running when it returns. + +However, if a .runtime_idle() callback is already running when +pm_runtime_get_sync() is called, the latter will notice that the runtime PM +status of the device is RPM_ACTIVE and it will return right away without +waiting for the former to complete. In fact, it cannot wait for +.runtime_idle() to complete because it may be called from that callback (it +arguably does not make much sense to do that, but it is not strictly +prohibited). + +Thus in general, whoever is providing a .runtime_idle() callback needs +to protect it from running in parallel with whatever code runs after +pm_runtime_get_sync(). [Note that .runtime_idle() will not start after +pm_runtime_get_sync() has returned, but it may continue running then if it +has started earlier.] + +One way to address that race condition is to call pm_runtime_barrier() +after pm_runtime_get_sync() (not before it, because a nonzero value of the +runtime PM usage counter is necessary to prevent runtime PM callbacks from +being invoked) to wait for the .runtime_idle() callback to complete should +it be running at that point. A suitable place for doing that is in +pci_device_remove() which calls pm_runtime_get_sync() before removing the +driver, so it may as well call pm_runtime_barrier() subsequently, which +will prevent the race in question from occurring, not just in the rtsx_pcr +driver, but in any PCI drivers providing .runtime_idle() callbacks. + +Link: https://lore.kernel.org/lkml/20240229062201.49500-1-kai.heng.feng@canonical.com/ # [1] +Link: https://lore.kernel.org/r/5761426.DvuYhMxLoT@kreacher +Reported-by: Kai-Heng Feng +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Bjorn Helgaas +Tested-by: Ricky Wu +Acked-by: Kai-Heng Feng +Cc: +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 51ec9e7e784f0..9c59bf03d6579 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -473,6 +473,13 @@ static void pci_device_remove(struct device *dev) + + if (drv->remove) { + pm_runtime_get_sync(dev); ++ /* ++ * If the driver provides a .runtime_idle() callback and it has ++ * started to run already, it may continue to run in parallel ++ * with the code below, so wait until all of the runtime PM ++ * activity has completed. ++ */ ++ pm_runtime_barrier(dev); + drv->remove(pci_dev); + pm_runtime_put_noidle(dev); + } +-- +2.43.0 + diff --git a/queue-6.6/pci-qcom-enable-bdf-to-sid-translation-properly.patch b/queue-6.6/pci-qcom-enable-bdf-to-sid-translation-properly.patch new file mode 100644 index 00000000000..ff4b43ee5af --- /dev/null +++ b/queue-6.6/pci-qcom-enable-bdf-to-sid-translation-properly.patch @@ -0,0 +1,98 @@ +From 802f090cf933fc6cf627b2bd49b533b5f923b6ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 16:35:15 +0530 +Subject: PCI: qcom: Enable BDF to SID translation properly +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Manivannan Sadhasivam + +[ Upstream commit bf79e33cdd89db498e00a6131e937259de5f2705 ] + +Qcom SoCs making use of ARM SMMU require BDF to SID translation table in +the driver to properly map the SID for the PCIe devices based on their BDF +identifier. This is currently achieved with the help of +qcom_pcie_config_sid_1_9_0() function for SoCs supporting the 1_9_0 config. + +But With newer Qcom SoCs starting from SM8450, BDF to SID translation is +set to bypass mode by default in hardware. Due to this, the translation +table that is set in the qcom_pcie_config_sid_1_9_0() is essentially +unused and the default SID is used for all endpoints in SoCs starting from +SM8450. + +This is a security concern and also warrants swapping the DeviceID in DT +while using the GIC ITS to handle MSIs from endpoints. The swapping is +currently done like below in DT when using GIC ITS: + + /* + * MSIs for BDF (1:0.0) only works with Device ID 0x5980. + * Hence, the IDs are swapped. + */ + msi-map = <0x0 &gic_its 0x5981 0x1>, + <0x100 &gic_its 0x5980 0x1>; + +Here, swapping of the DeviceIDs ensure that the endpoint with BDF (1:0.0) +gets the DeviceID 0x5980 which is associated with the default SID as per +the iommu mapping in DT. So MSIs were delivered with IDs swapped so far. +But this also means the Root Port (0:0.0) won't receive any MSIs (for PME, +AER etc...) + +So let's fix these issues by clearing the BDF to SID bypass mode for all +SoCs making use of the 1_9_0 config. This allows the PCIe devices to use +the correct SID, thus avoiding the DeviceID swapping hack in DT and also +achieving the isolation between devices. + +Fixes: 4c9398822106 ("PCI: qcom: Add support for configuring BDF to SID mapping for SM8250") +Link: https://lore.kernel.org/linux-pci/20240307-pci-bdf-sid-fix-v1-1-9423a7e2d63c@linaro.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Krzysztof Wilczyński +Cc: stable@vger.kernel.org # 5.11 +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c +index 64420ecc24d1c..d3ca6d3493130 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom.c ++++ b/drivers/pci/controller/dwc/pcie-qcom.c +@@ -53,6 +53,7 @@ + #define PARF_SLV_ADDR_SPACE_SIZE 0x358 + #define PARF_DEVICE_TYPE 0x1000 + #define PARF_BDF_TO_SID_TABLE_N 0x2000 ++#define PARF_BDF_TO_SID_CFG 0x2c00 + + /* ELBI registers */ + #define ELBI_SYS_CTRL 0x04 +@@ -120,6 +121,9 @@ + /* PARF_DEVICE_TYPE register fields */ + #define DEVICE_TYPE_RC 0x4 + ++/* PARF_BDF_TO_SID_CFG fields */ ++#define BDF_TO_SID_BYPASS BIT(0) ++ + /* ELBI_SYS_CTRL register fields */ + #define ELBI_SYS_CTRL_LT_ENABLE BIT(0) + +@@ -985,11 +989,17 @@ static int qcom_pcie_config_sid_1_9_0(struct qcom_pcie *pcie) + u8 qcom_pcie_crc8_table[CRC8_TABLE_SIZE]; + int i, nr_map, size = 0; + u32 smmu_sid_base; ++ u32 val; + + of_get_property(dev->of_node, "iommu-map", &size); + if (!size) + return 0; + ++ /* Enable BDF to SID translation by disabling bypass mode (default) */ ++ val = readl(pcie->parf + PARF_BDF_TO_SID_CFG); ++ val &= ~BDF_TO_SID_BYPASS; ++ writel(val, pcie->parf + PARF_BDF_TO_SID_CFG); ++ + map = kzalloc(size, GFP_KERNEL); + if (!map) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/pci_iounmap-fix-mmio-mapping-leak.patch b/queue-6.6/pci_iounmap-fix-mmio-mapping-leak.patch new file mode 100644 index 00000000000..9e06c2797ee --- /dev/null +++ b/queue-6.6/pci_iounmap-fix-mmio-mapping-leak.patch @@ -0,0 +1,44 @@ +From 1ce8d714e54205dd3f0a41dfa4a4754b04feacf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 10:00:20 +0100 +Subject: pci_iounmap(): Fix MMIO mapping leak + +From: Philipp Stanner + +[ Upstream commit 7626913652cc786c238e2dd7d8740b17d41b2637 ] + +The #ifdef ARCH_HAS_GENERIC_IOPORT_MAP accidentally also guards iounmap(), +which means MMIO mappings are leaked. + +Move the guard so we call iounmap() for MMIO mappings. + +Fixes: 316e8d79a095 ("pci_iounmap'2: Electric Boogaloo: try to make sense of it all") +Link: https://lore.kernel.org/r/20240131090023.12331-2-pstanner@redhat.com +Reported-by: Danilo Krummrich +Suggested-by: Arnd Bergmann +Signed-off-by: Philipp Stanner +Signed-off-by: Bjorn Helgaas +Reviewed-by: Arnd Bergmann +Cc: # v5.15+ +Signed-off-by: Sasha Levin +--- + lib/pci_iomap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/pci_iomap.c b/lib/pci_iomap.c +index ce39ce9f3526e..2829ddb0e316b 100644 +--- a/lib/pci_iomap.c ++++ b/lib/pci_iomap.c +@@ -170,8 +170,8 @@ void pci_iounmap(struct pci_dev *dev, void __iomem *p) + + if (addr >= start && addr < start + IO_SPACE_LIMIT) + return; +- iounmap(p); + #endif ++ iounmap(p); + } + EXPORT_SYMBOL(pci_iounmap); + +-- +2.43.0 + diff --git a/queue-6.6/phy-tegra-xusb-add-api-to-retrieve-the-port-number-o.patch b/queue-6.6/phy-tegra-xusb-add-api-to-retrieve-the-port-number-o.patch new file mode 100644 index 00000000000..b3001590068 --- /dev/null +++ b/queue-6.6/phy-tegra-xusb-add-api-to-retrieve-the-port-number-o.patch @@ -0,0 +1,68 @@ +From 8018c7b6eced990a104de54d5134e384e345bca6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 11:03:27 +0800 +Subject: phy: tegra: xusb: Add API to retrieve the port number of phy + +From: Wayne Chang + +[ Upstream commit d843f031d9e90462253015bc0bd9e3852d206bf2 ] + +This patch introduces a new API, tegra_xusb_padctl_get_port_number, +to the Tegra XUSB Pad Controller driver. This API is used to identify +the USB port that is associated with a given PHY. + +The function takes a PHY pointer for either a USB2 PHY or USB3 PHY as input +and returns the corresponding port number. If the PHY pointer is invalid, +it returns -ENODEV. + +Cc: stable@vger.kernel.org +Signed-off-by: Wayne Chang +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Link: https://lore.kernel.org/r/20240307030328.1487748-2-waynec@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 13 +++++++++++++ + include/linux/phy/tegra/xusb.h | 1 + + 2 files changed, 14 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index 142ebe0247cc0..983a6e6173bd2 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -1531,6 +1531,19 @@ int tegra_xusb_padctl_get_usb3_companion(struct tegra_xusb_padctl *padctl, + } + EXPORT_SYMBOL_GPL(tegra_xusb_padctl_get_usb3_companion); + ++int tegra_xusb_padctl_get_port_number(struct phy *phy) ++{ ++ struct tegra_xusb_lane *lane; ++ ++ if (!phy) ++ return -ENODEV; ++ ++ lane = phy_get_drvdata(phy); ++ ++ return lane->index; ++} ++EXPORT_SYMBOL_GPL(tegra_xusb_padctl_get_port_number); ++ + MODULE_AUTHOR("Thierry Reding "); + MODULE_DESCRIPTION("Tegra XUSB Pad Controller driver"); + MODULE_LICENSE("GPL v2"); +diff --git a/include/linux/phy/tegra/xusb.h b/include/linux/phy/tegra/xusb.h +index 70998e6dd6fdc..6ca51e0080ec0 100644 +--- a/include/linux/phy/tegra/xusb.h ++++ b/include/linux/phy/tegra/xusb.h +@@ -26,6 +26,7 @@ void tegra_phy_xusb_utmi_pad_power_down(struct phy *phy); + int tegra_phy_xusb_utmi_port_reset(struct phy *phy); + int tegra_xusb_padctl_get_usb3_companion(struct tegra_xusb_padctl *padctl, + unsigned int port); ++int tegra_xusb_padctl_get_port_number(struct phy *phy); + int tegra_xusb_padctl_enable_phy_sleepwalk(struct tegra_xusb_padctl *padctl, struct phy *phy, + enum usb_device_speed speed); + int tegra_xusb_padctl_disable_phy_sleepwalk(struct tegra_xusb_padctl *padctl, struct phy *phy); +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-intel-tpmi-change-vsec-offset-to-u64.patch b/queue-6.6/platform-x86-intel-tpmi-change-vsec-offset-to-u64.patch new file mode 100644 index 00000000000..7c4c2d0bdfa --- /dev/null +++ b/queue-6.6/platform-x86-intel-tpmi-change-vsec-offset-to-u64.patch @@ -0,0 +1,70 @@ +From 9a57abeaab253e1490f2a44297b5ebb91175eafe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 11:46:44 -0800 +Subject: platform/x86/intel/tpmi: Change vsec offset to u64 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivas Pandruvada + +[ Upstream commit 57221a07ff37ff356f9265acd228bc3c8744c8fc ] + +The vsec offset can be 64 bit long depending on the PFS start. So change +type to u64. Also use 64 bit formatting for seq_printf. + +Fixes: 47731fd2865f ("platform/x86/intel: Intel TPMI enumeration driver") +Signed-off-by: Srinivas Pandruvada +Cc: stable@vger.kernel.org # v6.3+ +Link: https://lore.kernel.org/r/20240305194644.2077867-1-srinivas.pandruvada@linux.intel.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/tpmi.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/x86/intel/tpmi.c b/drivers/platform/x86/intel/tpmi.c +index 0a95736d97e4d..6676eae144f31 100644 +--- a/drivers/platform/x86/intel/tpmi.c ++++ b/drivers/platform/x86/intel/tpmi.c +@@ -96,7 +96,7 @@ struct intel_tpmi_pfs_entry { + */ + struct intel_tpmi_pm_feature { + struct intel_tpmi_pfs_entry pfs_header; +- unsigned int vsec_offset; ++ u64 vsec_offset; + struct intel_vsec_device *vsec_dev; + }; + +@@ -359,7 +359,7 @@ static int tpmi_pfs_dbg_show(struct seq_file *s, void *unused) + disabled = disabled ? 'Y' : 'N'; + locked = locked ? 'Y' : 'N'; + } +- seq_printf(s, "0x%02x\t\t0x%02x\t\t0x%04x\t\t0x%04x\t\t0x%02x\t\t0x%08x\t%c\t%c\n", ++ seq_printf(s, "0x%02x\t\t0x%02x\t\t0x%04x\t\t0x%04x\t\t0x%02x\t\t0x%016llx\t%c\t%c\n", + pfs->pfs_header.tpmi_id, pfs->pfs_header.num_entries, + pfs->pfs_header.entry_size, pfs->pfs_header.cap_offset, + pfs->pfs_header.attribute, pfs->vsec_offset, locked, disabled); +@@ -377,7 +377,8 @@ static int tpmi_mem_dump_show(struct seq_file *s, void *unused) + struct intel_tpmi_pm_feature *pfs = s->private; + int count, ret = 0; + void __iomem *mem; +- u32 off, size; ++ u32 size; ++ u64 off; + u8 *buffer; + + size = TPMI_GET_SINGLE_ENTRY_SIZE(pfs); +@@ -393,7 +394,7 @@ static int tpmi_mem_dump_show(struct seq_file *s, void *unused) + mutex_lock(&tpmi_dev_lock); + + for (count = 0; count < pfs->pfs_header.num_entries; ++count) { +- seq_printf(s, "TPMI Instance:%d offset:0x%x\n", count, off); ++ seq_printf(s, "TPMI Instance:%d offset:0x%llx\n", count, off); + + mem = ioremap(off, size); + if (!mem) { +-- +2.43.0 + diff --git a/queue-6.6/pm-sleep-wakeirq-fix-wake-irq-warning-in-system-susp.patch b/queue-6.6/pm-sleep-wakeirq-fix-wake-irq-warning-in-system-susp.patch new file mode 100644 index 00000000000..ff2418fb853 --- /dev/null +++ b/queue-6.6/pm-sleep-wakeirq-fix-wake-irq-warning-in-system-susp.patch @@ -0,0 +1,59 @@ +From 9b405cd199a6f44e00f6306fa991c5fdb97af318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 17:26:57 +0800 +Subject: PM: sleep: wakeirq: fix wake irq warning in system suspend + +From: Qingliang Li + +[ Upstream commit e7a7681c859643f3f2476b2a28a494877fd89442 ] + +When driver uses pm_runtime_force_suspend() as the system suspend callback +function and registers the wake irq with reverse enable ordering, the wake +irq will be re-enabled when entering system suspend, triggering an +'Unbalanced enable for IRQ xxx' warning. In this scenario, the call +sequence during system suspend is as follows: + suspend_devices_and_enter() + -> dpm_suspend_start() + -> dpm_run_callback() + -> pm_runtime_force_suspend() + -> dev_pm_enable_wake_irq_check() + -> dev_pm_enable_wake_irq_complete() + + -> suspend_enter() + -> dpm_suspend_noirq() + -> device_wakeup_arm_wake_irqs() + -> dev_pm_arm_wake_irq() + +To fix this issue, complete the setting of WAKE_IRQ_DEDICATED_ENABLED flag +in dev_pm_enable_wake_irq_complete() to avoid redundant irq enablement. + +Fixes: 8527beb12087 ("PM: sleep: wakeirq: fix wake irq arming") +Reviewed-by: Dhruva Gole +Signed-off-by: Qingliang Li +Reviewed-by: Johan Hovold +Cc: 5.16+ # 5.16+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/wakeirq.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c +index 42171f766dcba..5a5a9e978e85f 100644 +--- a/drivers/base/power/wakeirq.c ++++ b/drivers/base/power/wakeirq.c +@@ -313,8 +313,10 @@ void dev_pm_enable_wake_irq_complete(struct device *dev) + return; + + if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED && +- wirq->status & WAKE_IRQ_DEDICATED_REVERSE) ++ wirq->status & WAKE_IRQ_DEDICATED_REVERSE) { + enable_irq(wirq->irq); ++ wirq->status |= WAKE_IRQ_DEDICATED_ENABLED; ++ } + } + + /** +-- +2.43.0 + diff --git a/queue-6.6/pm-suspend-set-mem_sleep_current-during-kernel-comma.patch b/queue-6.6/pm-suspend-set-mem_sleep_current-during-kernel-comma.patch new file mode 100644 index 00000000000..af6273aa011 --- /dev/null +++ b/queue-6.6/pm-suspend-set-mem_sleep_current-during-kernel-comma.patch @@ -0,0 +1,42 @@ +From adbfaa3d2a21d335fd608a74a45e63ca4e9b84a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 12:14:59 +0530 +Subject: PM: suspend: Set mem_sleep_current during kernel command line setup + +From: Maulik Shah + +[ Upstream commit 9bc4ffd32ef8943f5c5a42c9637cfd04771d021b ] + +psci_init_system_suspend() invokes suspend_set_ops() very early during +bootup even before kernel command line for mem_sleep_default is setup. +This leads to kernel command line mem_sleep_default=s2idle not working +as mem_sleep_current gets changed to deep via suspend_set_ops() and never +changes back to s2idle. + +Set mem_sleep_current along with mem_sleep_default during kernel command +line setup as default suspend mode. + +Fixes: faf7ec4a92c0 ("drivers: firmware: psci: add system suspend support") +CC: stable@vger.kernel.org # 5.4+ +Signed-off-by: Maulik Shah +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/suspend.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c +index fa3bf161d13f7..a718067deecee 100644 +--- a/kernel/power/suspend.c ++++ b/kernel/power/suspend.c +@@ -192,6 +192,7 @@ static int __init mem_sleep_default_setup(char *str) + if (mem_sleep_labels[state] && + !strcmp(str, mem_sleep_labels[state])) { + mem_sleep_default = state; ++ mem_sleep_current = state; + break; + } + +-- +2.43.0 + diff --git a/queue-6.6/powercap-intel_rapl-fix-a-null-pointer-dereference.patch b/queue-6.6/powercap-intel_rapl-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..ca71de387b2 --- /dev/null +++ b/queue-6.6/powercap-intel_rapl-fix-a-null-pointer-dereference.patch @@ -0,0 +1,49 @@ +From 98b4a69cb92cce7f6ad669642cc889c2e775ecfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 19:37:08 +0800 +Subject: powercap: intel_rapl: Fix a NULL pointer dereference + +From: Zhang Rui + +[ Upstream commit 2d1f5006ff95770da502f8cee2a224a1ff83866e ] + +A NULL pointer dereference is triggered when probing the MMIO RAPL +driver on platforms with CPU ID not listed in intel_rapl_common CPU +model list. + +This is because the intel_rapl_common module still probes on such +platforms even if 'defaults_msr' is not set after commit 1488ac990ac8 +("powercap: intel_rapl: Allow probing without CPUID match"). Thus the +MMIO RAPL rp->priv->defaults is NULL when registering to RAPL framework. + +Fix the problem by adding sanity check to ensure rp->priv->rapl_defaults +is always valid. + +Fixes: 1488ac990ac8 ("powercap: intel_rapl: Allow probing without CPUID match") +Signed-off-by: Zhang Rui +Cc: 6.5+ # 6.5+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/intel_rapl_common.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c +index 2feed036c1cd4..1a739afd47d96 100644 +--- a/drivers/powercap/intel_rapl_common.c ++++ b/drivers/powercap/intel_rapl_common.c +@@ -759,6 +759,11 @@ static int rapl_config(struct rapl_package *rp) + default: + return -EINVAL; + } ++ ++ /* defaults_msr can be NULL on unsupported platforms */ ++ if (!rp->priv->defaults || !rp->priv->rpi) ++ return -ENODEV; ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.6/powercap-intel_rapl-fix-locking-in-tpmi-rapl.patch b/queue-6.6/powercap-intel_rapl-fix-locking-in-tpmi-rapl.patch new file mode 100644 index 00000000000..3ce52865e38 --- /dev/null +++ b/queue-6.6/powercap-intel_rapl-fix-locking-in-tpmi-rapl.patch @@ -0,0 +1,196 @@ +From 916d44315e20c68c94599bc469bbc09ead30a55d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 19:37:09 +0800 +Subject: powercap: intel_rapl: Fix locking in TPMI RAPL + +From: Zhang Rui + +[ Upstream commit 1aa09b9379a7a644cd2f75ae0bac82b8783df600 ] + +The RAPL framework uses CPU hotplug locking to protect the rapl_packages +list and rp->lead_cpu to guarantee that + + 1. the RAPL package device is not unprobed and freed + 2. the cached rp->lead_cpu is always valid + +for operations like powercap sysfs accesses. + +Current RAPL APIs assume being called from CPU hotplug callbacks which +hold the CPU hotplug lock, but TPMI RAPL driver invokes the APIs in the +driver's .probe() function without acquiring the CPU hotplug lock. + +Fix the problem by providing both locked and lockless versions of RAPL +APIs. + +Fixes: 9eef7f9da928 ("powercap: intel_rapl: Introduce RAPL TPMI interface driver") +Signed-off-by: Zhang Rui +Cc: 6.5+ # 6.5+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/intel_rapl_common.c | 29 +++++++++++++++++-- + drivers/powercap/intel_rapl_msr.c | 8 ++--- + .../int340x_thermal/processor_thermal_rapl.c | 8 ++--- + include/linux/intel_rapl.h | 6 ++++ + 4 files changed, 40 insertions(+), 11 deletions(-) + +diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c +index 1a739afd47d96..9d3e102f1a76b 100644 +--- a/drivers/powercap/intel_rapl_common.c ++++ b/drivers/powercap/intel_rapl_common.c +@@ -5,6 +5,7 @@ + */ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include + #include + #include + #include +@@ -1504,7 +1505,7 @@ static int rapl_detect_domains(struct rapl_package *rp) + } + + /* called from CPU hotplug notifier, hotplug lock held */ +-void rapl_remove_package(struct rapl_package *rp) ++void rapl_remove_package_cpuslocked(struct rapl_package *rp) + { + struct rapl_domain *rd, *rd_package = NULL; + +@@ -1533,10 +1534,18 @@ void rapl_remove_package(struct rapl_package *rp) + list_del(&rp->plist); + kfree(rp); + } ++EXPORT_SYMBOL_GPL(rapl_remove_package_cpuslocked); ++ ++void rapl_remove_package(struct rapl_package *rp) ++{ ++ guard(cpus_read_lock)(); ++ rapl_remove_package_cpuslocked(rp); ++} + EXPORT_SYMBOL_GPL(rapl_remove_package); + + /* caller to ensure CPU hotplug lock is held */ +-struct rapl_package *rapl_find_package_domain(int id, struct rapl_if_priv *priv, bool id_is_cpu) ++struct rapl_package *rapl_find_package_domain_cpuslocked(int id, struct rapl_if_priv *priv, ++ bool id_is_cpu) + { + struct rapl_package *rp; + int uid; +@@ -1554,10 +1563,17 @@ struct rapl_package *rapl_find_package_domain(int id, struct rapl_if_priv *priv, + + return NULL; + } ++EXPORT_SYMBOL_GPL(rapl_find_package_domain_cpuslocked); ++ ++struct rapl_package *rapl_find_package_domain(int id, struct rapl_if_priv *priv, bool id_is_cpu) ++{ ++ guard(cpus_read_lock)(); ++ return rapl_find_package_domain_cpuslocked(id, priv, id_is_cpu); ++} + EXPORT_SYMBOL_GPL(rapl_find_package_domain); + + /* called from CPU hotplug notifier, hotplug lock held */ +-struct rapl_package *rapl_add_package(int id, struct rapl_if_priv *priv, bool id_is_cpu) ++struct rapl_package *rapl_add_package_cpuslocked(int id, struct rapl_if_priv *priv, bool id_is_cpu) + { + struct rapl_package *rp; + int ret; +@@ -1603,6 +1619,13 @@ struct rapl_package *rapl_add_package(int id, struct rapl_if_priv *priv, bool id + kfree(rp); + return ERR_PTR(ret); + } ++EXPORT_SYMBOL_GPL(rapl_add_package_cpuslocked); ++ ++struct rapl_package *rapl_add_package(int id, struct rapl_if_priv *priv, bool id_is_cpu) ++{ ++ guard(cpus_read_lock)(); ++ return rapl_add_package_cpuslocked(id, priv, id_is_cpu); ++} + EXPORT_SYMBOL_GPL(rapl_add_package); + + static void power_limit_state_save(void) +diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c +index 250bd41a588c7..b4b6930cacb0b 100644 +--- a/drivers/powercap/intel_rapl_msr.c ++++ b/drivers/powercap/intel_rapl_msr.c +@@ -73,9 +73,9 @@ static int rapl_cpu_online(unsigned int cpu) + { + struct rapl_package *rp; + +- rp = rapl_find_package_domain(cpu, rapl_msr_priv, true); ++ rp = rapl_find_package_domain_cpuslocked(cpu, rapl_msr_priv, true); + if (!rp) { +- rp = rapl_add_package(cpu, rapl_msr_priv, true); ++ rp = rapl_add_package_cpuslocked(cpu, rapl_msr_priv, true); + if (IS_ERR(rp)) + return PTR_ERR(rp); + } +@@ -88,14 +88,14 @@ static int rapl_cpu_down_prep(unsigned int cpu) + struct rapl_package *rp; + int lead_cpu; + +- rp = rapl_find_package_domain(cpu, rapl_msr_priv, true); ++ rp = rapl_find_package_domain_cpuslocked(cpu, rapl_msr_priv, true); + if (!rp) + return 0; + + cpumask_clear_cpu(cpu, &rp->cpumask); + lead_cpu = cpumask_first(&rp->cpumask); + if (lead_cpu >= nr_cpu_ids) +- rapl_remove_package(rp); ++ rapl_remove_package_cpuslocked(rp); + else if (rp->lead_cpu == cpu) + rp->lead_cpu = lead_cpu; + return 0; +diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.c +index 2f00fc3bf274a..e964a9375722a 100644 +--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.c ++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.c +@@ -27,9 +27,9 @@ static int rapl_mmio_cpu_online(unsigned int cpu) + if (topology_physical_package_id(cpu)) + return 0; + +- rp = rapl_find_package_domain(cpu, &rapl_mmio_priv, true); ++ rp = rapl_find_package_domain_cpuslocked(cpu, &rapl_mmio_priv, true); + if (!rp) { +- rp = rapl_add_package(cpu, &rapl_mmio_priv, true); ++ rp = rapl_add_package_cpuslocked(cpu, &rapl_mmio_priv, true); + if (IS_ERR(rp)) + return PTR_ERR(rp); + } +@@ -42,14 +42,14 @@ static int rapl_mmio_cpu_down_prep(unsigned int cpu) + struct rapl_package *rp; + int lead_cpu; + +- rp = rapl_find_package_domain(cpu, &rapl_mmio_priv, true); ++ rp = rapl_find_package_domain_cpuslocked(cpu, &rapl_mmio_priv, true); + if (!rp) + return 0; + + cpumask_clear_cpu(cpu, &rp->cpumask); + lead_cpu = cpumask_first(&rp->cpumask); + if (lead_cpu >= nr_cpu_ids) +- rapl_remove_package(rp); ++ rapl_remove_package_cpuslocked(rp); + else if (rp->lead_cpu == cpu) + rp->lead_cpu = lead_cpu; + return 0; +diff --git a/include/linux/intel_rapl.h b/include/linux/intel_rapl.h +index 33f21bd85dbf2..f3196f82fd8a1 100644 +--- a/include/linux/intel_rapl.h ++++ b/include/linux/intel_rapl.h +@@ -178,6 +178,12 @@ struct rapl_package { + struct rapl_if_priv *priv; + }; + ++struct rapl_package *rapl_find_package_domain_cpuslocked(int id, struct rapl_if_priv *priv, ++ bool id_is_cpu); ++struct rapl_package *rapl_add_package_cpuslocked(int id, struct rapl_if_priv *priv, ++ bool id_is_cpu); ++void rapl_remove_package_cpuslocked(struct rapl_package *rp); ++ + struct rapl_package *rapl_find_package_domain(int id, struct rapl_if_priv *priv, bool id_is_cpu); + struct rapl_package *rapl_add_package(int id, struct rapl_if_priv *priv, bool id_is_cpu); + void rapl_remove_package(struct rapl_package *rp); +-- +2.43.0 + diff --git a/queue-6.6/powercap-intel_rapl_tpmi-fix-a-register-bug.patch b/queue-6.6/powercap-intel_rapl_tpmi-fix-a-register-bug.patch new file mode 100644 index 00000000000..6c66c537ebc --- /dev/null +++ b/queue-6.6/powercap-intel_rapl_tpmi-fix-a-register-bug.patch @@ -0,0 +1,38 @@ +From c0f1f8868e96123fde2b1b7a4b86e46acf7e3a90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 19:37:10 +0800 +Subject: powercap: intel_rapl_tpmi: Fix a register bug + +From: Zhang Rui + +[ Upstream commit faa9130ce716b286d786d59032bacfd9052c2094 ] + +Add the missing Domain Info register. This also fixes the bogus +definition of the Interrupt register. + +Neither of these two registers was used previously. + +Fixes: 9eef7f9da928 ("powercap: intel_rapl: Introduce RAPL TPMI interface driver") +Signed-off-by: Zhang Rui +Cc: 6.5+ # 6.5+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/intel_rapl_tpmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/powercap/intel_rapl_tpmi.c b/drivers/powercap/intel_rapl_tpmi.c +index 891c90fefd8b7..f1c734ac3c349 100644 +--- a/drivers/powercap/intel_rapl_tpmi.c ++++ b/drivers/powercap/intel_rapl_tpmi.c +@@ -40,6 +40,7 @@ enum tpmi_rapl_register { + TPMI_RAPL_REG_ENERGY_STATUS, + TPMI_RAPL_REG_PERF_STATUS, + TPMI_RAPL_REG_POWER_INFO, ++ TPMI_RAPL_REG_DOMAIN_INFO, + TPMI_RAPL_REG_INTERRUPT, + TPMI_RAPL_REG_MAX = 15, + }; +-- +2.43.0 + diff --git a/queue-6.6/powercap-intel_rapl_tpmi-fix-system-domain-probing.patch b/queue-6.6/powercap-intel_rapl_tpmi-fix-system-domain-probing.patch new file mode 100644 index 00000000000..e8588868c91 --- /dev/null +++ b/queue-6.6/powercap-intel_rapl_tpmi-fix-system-domain-probing.patch @@ -0,0 +1,67 @@ +From a81f201c4136e7372e4620e1d44cd565ea3f9aef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 19:37:11 +0800 +Subject: powercap: intel_rapl_tpmi: Fix System Domain probing + +From: Zhang Rui + +[ Upstream commit 903eb9fb85e32810f376a2858aad77c9298f9488 ] + +Only domain root packages can enumerate System (Psys) domain. +Whether a package is domain root or not is described in the Bit 0 of the +Domain Info register. + +Add support for Domain Info register and fix the System domain probing +accordingly. + +Fixes: 9eef7f9da928 ("powercap: intel_rapl: Introduce RAPL TPMI interface driver") +Signed-off-by: Zhang Rui +Cc: 6.5+ # 6.5+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/intel_rapl_tpmi.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/powercap/intel_rapl_tpmi.c b/drivers/powercap/intel_rapl_tpmi.c +index f1c734ac3c349..f6b7f085977ce 100644 +--- a/drivers/powercap/intel_rapl_tpmi.c ++++ b/drivers/powercap/intel_rapl_tpmi.c +@@ -131,6 +131,12 @@ static void trp_release(struct tpmi_rapl_package *trp) + mutex_unlock(&tpmi_rapl_lock); + } + ++/* ++ * Bit 0 of TPMI_RAPL_REG_DOMAIN_INFO indicates if the current package is a domain ++ * root or not. Only domain root packages can enumerate System (Psys) Domain. ++ */ ++#define TPMI_RAPL_DOMAIN_ROOT BIT(0) ++ + static int parse_one_domain(struct tpmi_rapl_package *trp, u32 offset) + { + u8 tpmi_domain_version; +@@ -140,6 +146,7 @@ static int parse_one_domain(struct tpmi_rapl_package *trp, u32 offset) + enum rapl_domain_reg_id reg_id; + int tpmi_domain_size, tpmi_domain_flags; + u64 tpmi_domain_header = readq(trp->base + offset); ++ u64 tpmi_domain_info; + + /* Domain Parent bits are ignored for now */ + tpmi_domain_version = tpmi_domain_header & 0xff; +@@ -170,6 +177,13 @@ static int parse_one_domain(struct tpmi_rapl_package *trp, u32 offset) + domain_type = RAPL_DOMAIN_PACKAGE; + break; + case TPMI_RAPL_DOMAIN_SYSTEM: ++ if (!(tpmi_domain_flags & BIT(TPMI_RAPL_REG_DOMAIN_INFO))) { ++ pr_warn(FW_BUG "System domain must support Domain Info register\n"); ++ return -ENODEV; ++ } ++ tpmi_domain_info = readq(trp->base + offset + TPMI_RAPL_REG_DOMAIN_INFO); ++ if (!(tpmi_domain_info & TPMI_RAPL_DOMAIN_ROOT)) ++ return 0; + domain_type = RAPL_DOMAIN_PLATFORM; + break; + case TPMI_RAPL_DOMAIN_MEMORY: +-- +2.43.0 + diff --git a/queue-6.6/powerpc-fsl-fix-mfpmr-build-errors-with-newer-binuti.patch b/queue-6.6/powerpc-fsl-fix-mfpmr-build-errors-with-newer-binuti.patch new file mode 100644 index 00000000000..26bff4c2305 --- /dev/null +++ b/queue-6.6/powerpc-fsl-fix-mfpmr-build-errors-with-newer-binuti.patch @@ -0,0 +1,61 @@ +From 96eb7dda715664ec7069f1eaaec34d58aae75431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 23:25:19 +1100 +Subject: powerpc/fsl: Fix mfpmr build errors with newer binutils + +From: Michael Ellerman + +[ Upstream commit 5f491356b7149564ab22323ccce79c8d595bfd0c ] + +Binutils 2.38 complains about the use of mfpmr when building +ppc6xx_defconfig: + + CC arch/powerpc/kernel/pmc.o + {standard input}: Assembler messages: + {standard input}:45: Error: unrecognized opcode: `mfpmr' + {standard input}:56: Error: unrecognized opcode: `mtpmr' + +This is because by default the kernel is built with -mcpu=powerpc, and +the mt/mfpmr instructions are not defined. + +It can be avoided by enabling CONFIG_E300C3_CPU, but just adding that to +the defconfig will leave open the possibility of randconfig failures. + +So add machine directives around the mt/mfpmr instructions to tell +binutils how to assemble them. + +Cc: stable@vger.kernel.org +Reported-by: Jan-Benedict Glaw +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240229122521.762431-3-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/reg_fsl_emb.h | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/reg_fsl_emb.h b/arch/powerpc/include/asm/reg_fsl_emb.h +index a21f529c43d96..8359c06d92d9f 100644 +--- a/arch/powerpc/include/asm/reg_fsl_emb.h ++++ b/arch/powerpc/include/asm/reg_fsl_emb.h +@@ -12,9 +12,16 @@ + #ifndef __ASSEMBLY__ + /* Performance Monitor Registers */ + #define mfpmr(rn) ({unsigned int rval; \ +- asm volatile("mfpmr %0," __stringify(rn) \ ++ asm volatile(".machine push; " \ ++ ".machine e300; " \ ++ "mfpmr %0," __stringify(rn) ";" \ ++ ".machine pop; " \ + : "=r" (rval)); rval;}) +-#define mtpmr(rn, v) asm volatile("mtpmr " __stringify(rn) ",%0" : : "r" (v)) ++#define mtpmr(rn, v) asm volatile(".machine push; " \ ++ ".machine e300; " \ ++ "mtpmr " __stringify(rn) ",%0; " \ ++ ".machine pop; " \ ++ : : "r" (v)) + #endif /* __ASSEMBLY__ */ + + /* Freescale Book E Performance Monitor APU Registers */ +-- +2.43.0 + diff --git a/queue-6.6/powerpc-smp-adjust-nr_cpu_ids-to-cover-all-threads-o.patch b/queue-6.6/powerpc-smp-adjust-nr_cpu_ids-to-cover-all-threads-o.patch new file mode 100644 index 00000000000..2ba777eef81 --- /dev/null +++ b/queue-6.6/powerpc-smp-adjust-nr_cpu_ids-to-cover-all-threads-o.patch @@ -0,0 +1,41 @@ +From 6362d18b8f633df2f4ec5f6b42432dd8ab1f855d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 00:14:04 +1100 +Subject: powerpc/smp: Adjust nr_cpu_ids to cover all threads of a core + +From: Michael Ellerman + +[ Upstream commit 5580e96dad5a439d561d9648ffcbccb739c2a120 ] + +If nr_cpu_ids is too low to include at least all the threads of a single +core adjust nr_cpu_ids upwards. This avoids triggering odd bugs in code +that assumes all threads of a core are available. + +Cc: stable@vger.kernel.org +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231229120107.2281153-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 0b5878c3125b1..58e80076bed5c 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -375,6 +375,12 @@ static int __init early_init_dt_scan_cpus(unsigned long node, + if (IS_ENABLED(CONFIG_PPC64)) + boot_cpu_hwid = be32_to_cpu(intserv[found_thread]); + ++ if (nr_cpu_ids % nthreads != 0) { ++ set_nr_cpu_ids(ALIGN(nr_cpu_ids, nthreads)); ++ pr_warn("nr_cpu_ids was not a multiple of threads_per_core, adjusted to %d\n", ++ nr_cpu_ids); ++ } ++ + /* + * PAPR defines "logical" PVR values for cpus that + * meet various levels of the architecture: +-- +2.43.0 + diff --git a/queue-6.6/powerpc-smp-increase-nr_cpu_ids-to-include-the-boot-.patch b/queue-6.6/powerpc-smp-increase-nr_cpu_ids-to-include-the-boot-.patch new file mode 100644 index 00000000000..d4d4603785a --- /dev/null +++ b/queue-6.6/powerpc-smp-increase-nr_cpu_ids-to-include-the-boot-.patch @@ -0,0 +1,41 @@ +From c23eed5169fc5da7d30461c4c6cf679ce5d9bc6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 00:14:04 +1100 +Subject: powerpc/smp: Increase nr_cpu_ids to include the boot CPU + +From: Michael Ellerman + +[ Upstream commit 777f81f0a9c780a6443bcf2c7785f0cc2e87c1ef ] + +If nr_cpu_ids is too low to include the boot CPU adjust nr_cpu_ids +upward. Otherwise the kernel will BUG when trying to allocate a paca +for the boot CPU and fail to boot. + +Cc: stable@vger.kernel.org +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231229120107.2281153-2-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 58e80076bed5c..77364729a1b61 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -381,6 +381,12 @@ static int __init early_init_dt_scan_cpus(unsigned long node, + nr_cpu_ids); + } + ++ if (boot_cpuid >= nr_cpu_ids) { ++ set_nr_cpu_ids(min(CONFIG_NR_CPUS, ALIGN(boot_cpuid + 1, nthreads))); ++ pr_warn("Boot CPU %d >= nr_cpu_ids, adjusted nr_cpu_ids to %d\n", ++ boot_cpuid, nr_cpu_ids); ++ } ++ + /* + * PAPR defines "logical" PVR values for cpus that + * meet various levels of the architecture: +-- +2.43.0 + diff --git a/queue-6.6/powerpc-xor_vmx-add-mhard-float-to-cflags.patch b/queue-6.6/powerpc-xor_vmx-add-mhard-float-to-cflags.patch new file mode 100644 index 00000000000..ea15d52084f --- /dev/null +++ b/queue-6.6/powerpc-xor_vmx-add-mhard-float-to-cflags.patch @@ -0,0 +1,48 @@ +From 034c22f2446a2836f7ca44c39c94a54ea28ee0fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Jan 2024 11:07:43 -0700 +Subject: powerpc: xor_vmx: Add '-mhard-float' to CFLAGS + +From: Nathan Chancellor + +[ Upstream commit 35f20786c481d5ced9283ff42de5c69b65e5ed13 ] + +arch/powerpc/lib/xor_vmx.o is built with '-msoft-float' (from the main +powerpc Makefile) and '-maltivec' (from its CFLAGS), which causes an +error when building with clang after a recent change in main: + + error: option '-msoft-float' cannot be specified with '-maltivec' + make[6]: *** [scripts/Makefile.build:243: arch/powerpc/lib/xor_vmx.o] Error 1 + +Explicitly add '-mhard-float' before '-maltivec' in xor_vmx.o's CFLAGS +to override the previous inclusion of '-msoft-float' (as the last option +wins), which matches how other areas of the kernel use '-maltivec', such +as AMDGPU. + +Cc: stable@vger.kernel.org +Closes: https://github.com/ClangBuiltLinux/linux/issues/1986 +Link: https://github.com/llvm/llvm-project/commit/4792f912b232141ecba4cbae538873be3c28556c +Signed-off-by: Nathan Chancellor +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240127-ppc-xor_vmx-drop-msoft-float-v1-1-f24140e81376@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/lib/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile +index 6eac63e79a899..0ab65eeb93ee3 100644 +--- a/arch/powerpc/lib/Makefile ++++ b/arch/powerpc/lib/Makefile +@@ -76,7 +76,7 @@ obj-$(CONFIG_PPC_LIB_RHEAP) += rheap.o + obj-$(CONFIG_FTR_FIXUP_SELFTEST) += feature-fixups-test.o + + obj-$(CONFIG_ALTIVEC) += xor_vmx.o xor_vmx_glue.o +-CFLAGS_xor_vmx.o += -maltivec $(call cc-option,-mabi=altivec) ++CFLAGS_xor_vmx.o += -mhard-float -maltivec $(call cc-option,-mabi=altivec) + # Enable + CFLAGS_xor_vmx.o += -isystem $(shell $(CC) -print-file-name=include) + +-- +2.43.0 + diff --git a/queue-6.6/remoteproc-virtio-fix-wdg-cannot-recovery-remote-pro.patch b/queue-6.6/remoteproc-virtio-fix-wdg-cannot-recovery-remote-pro.patch new file mode 100644 index 00000000000..b66f5722777 --- /dev/null +++ b/queue-6.6/remoteproc-virtio-fix-wdg-cannot-recovery-remote-pro.patch @@ -0,0 +1,63 @@ +From 0f30513037a2ab9564e0f43e04a8f92a40ce51ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Dec 2023 13:36:59 +0800 +Subject: remoteproc: virtio: Fix wdg cannot recovery remote processor + +From: Joakim Zhang + +[ Upstream commit b327c72753d6a78de37aed6c35756f2ef62897ee ] + +Recovery remote processor failed when wdg irq received: +[ 0.842574] remoteproc remoteproc0: crash detected in cix-dsp-rproc: type watchdog +[ 0.842750] remoteproc remoteproc0: handling crash #1 in cix-dsp-rproc +[ 0.842824] remoteproc remoteproc0: recovering cix-dsp-rproc +[ 0.843342] remoteproc remoteproc0: stopped remote processor cix-dsp-rproc +[ 0.847901] rproc-virtio rproc-virtio.0.auto: Failed to associate buffer +[ 0.847979] remoteproc remoteproc0: failed to probe subdevices for cix-dsp-rproc: -16 + +The reason is that dma coherent mem would not be released when +recovering the remote processor, due to rproc_virtio_remove() +would not be called, where the mem released. It will fail when +it try to allocate and associate buffer again. + +Releasing reserved memory from rproc_virtio_dev_release(), instead of +rproc_virtio_remove(). + +Fixes: 1d7b61c06dc3 ("remoteproc: virtio: Create platform device for the remoteproc_virtio") +Signed-off-by: Joakim Zhang +Acked-by: Arnaud Pouliquen +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20231217053659.3245745-1-joakim.zhang@cixtech.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/remoteproc_virtio.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/remoteproc/remoteproc_virtio.c b/drivers/remoteproc/remoteproc_virtio.c +index 83d76915a6ad6..25b66b113b695 100644 +--- a/drivers/remoteproc/remoteproc_virtio.c ++++ b/drivers/remoteproc/remoteproc_virtio.c +@@ -351,6 +351,9 @@ static void rproc_virtio_dev_release(struct device *dev) + + kfree(vdev); + ++ of_reserved_mem_device_release(&rvdev->pdev->dev); ++ dma_release_coherent_memory(&rvdev->pdev->dev); ++ + put_device(&rvdev->pdev->dev); + } + +@@ -584,9 +587,6 @@ static void rproc_virtio_remove(struct platform_device *pdev) + rproc_remove_subdev(rproc, &rvdev->subdev); + rproc_remove_rvdev(rvdev); + +- of_reserved_mem_device_release(&pdev->dev); +- dma_release_coherent_memory(&pdev->dev); +- + put_device(&rproc->dev); + } + +-- +2.43.0 + diff --git a/queue-6.6/revert-block-mq-deadline-use-correct-way-to-throttli.patch b/queue-6.6/revert-block-mq-deadline-use-correct-way-to-throttli.patch new file mode 100644 index 00000000000..c7e64aeb6e3 --- /dev/null +++ b/queue-6.6/revert-block-mq-deadline-use-correct-way-to-throttli.patch @@ -0,0 +1,48 @@ +From 5a779abcda49fcd13bd471baf7ef4709c7388f71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 14:42:18 -0700 +Subject: Revert "block/mq-deadline: use correct way to throttling write + requests" + +From: Bart Van Assche + +[ Upstream commit 256aab46e31683d76d45ccbedc287b4d3f3e322b ] + +The code "max(1U, 3 * (1U << shift) / 4)" comes from the Kyber I/O +scheduler. The Kyber I/O scheduler maintains one internal queue per hwq +and hence derives its async_depth from the number of hwq tags. Using +this approach for the mq-deadline scheduler is wrong since the +mq-deadline scheduler maintains one internal queue for all hwqs +combined. Hence this revert. + +Cc: stable@vger.kernel.org +Cc: Damien Le Moal +Cc: Harshit Mogalapalli +Cc: Zhiguo Niu +Fixes: d47f9717e5cf ("block/mq-deadline: use correct way to throttling write requests") +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20240313214218.1736147-1-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/mq-deadline.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index f958e79277b8b..02a916ba62ee7 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -646,9 +646,8 @@ static void dd_depth_updated(struct blk_mq_hw_ctx *hctx) + struct request_queue *q = hctx->queue; + struct deadline_data *dd = q->elevator->elevator_data; + struct blk_mq_tags *tags = hctx->sched_tags; +- unsigned int shift = tags->bitmap_tags.sb.shift; + +- dd->async_depth = max(1U, 3 * (1U << shift) / 4); ++ dd->async_depth = max(1UL, 3 * q->nr_requests / 4); + + sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, dd->async_depth); + } +-- +2.43.0 + diff --git a/queue-6.6/ring-buffer-do-not-set-shortest_full-when-full-targe.patch b/queue-6.6/ring-buffer-do-not-set-shortest_full-when-full-targe.patch new file mode 100644 index 00000000000..bdf68108730 --- /dev/null +++ b/queue-6.6/ring-buffer-do-not-set-shortest_full-when-full-targe.patch @@ -0,0 +1,54 @@ +From e63fdacdcee8f13457fffb632e56ba2c3014f999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 11:56:41 -0400 +Subject: ring-buffer: Do not set shortest_full when full target is hit + +From: Steven Rostedt (Google) + +[ Upstream commit 761d9473e27f0c8782895013a3e7b52a37c8bcfc ] + +The rb_watermark_hit() checks if the amount of data in the ring buffer is +above the percentage level passed in by the "full" variable. If it is, it +returns true. + +But it also sets the "shortest_full" field of the cpu_buffer that informs +writers that it needs to call the irq_work if the amount of data on the +ring buffer is above the requested amount. + +The rb_watermark_hit() always sets the shortest_full even if the amount in +the ring buffer is what it wants. As it is not going to wait, because it +has what it wants, there's no reason to set shortest_full. + +Link: https://lore.kernel.org/linux-trace-kernel/20240312115641.6aa8ba08@gandalf.local.home + +Cc: stable@vger.kernel.org +Cc: Mathieu Desnoyers +Fixes: 42fb0a1e84ff5 ("tracing/ring-buffer: Have polling block on watermark") +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index ed3577d269efe..a3315d569e2bf 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -970,9 +970,10 @@ static bool rb_watermark_hit(struct trace_buffer *buffer, int cpu, int full) + pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; + ret = !pagebusy && full_hit(buffer, cpu, full); + +- if (!cpu_buffer->shortest_full || +- cpu_buffer->shortest_full > full) +- cpu_buffer->shortest_full = full; ++ if (!ret && (!cpu_buffer->shortest_full || ++ cpu_buffer->shortest_full > full)) { ++ cpu_buffer->shortest_full = full; ++ } + raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); + } + return ret; +-- +2.43.0 + diff --git a/queue-6.6/ring-buffer-fix-full_waiters_pending-in-poll.patch b/queue-6.6/ring-buffer-fix-full_waiters_pending-in-poll.patch new file mode 100644 index 00000000000..cebe01cc2ce --- /dev/null +++ b/queue-6.6/ring-buffer-fix-full_waiters_pending-in-poll.patch @@ -0,0 +1,138 @@ +From cda92181ef7e257c1cbaa196723dae5414aa59fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 09:19:20 -0400 +Subject: ring-buffer: Fix full_waiters_pending in poll + +From: Steven Rostedt (Google) + +[ Upstream commit 8145f1c35fa648da662078efab299c4467b85ad5 ] + +If a reader of the ring buffer is doing a poll, and waiting for the ring +buffer to hit a specific watermark, there could be a case where it gets +into an infinite ping-pong loop. + +The poll code has: + + rbwork->full_waiters_pending = true; + if (!cpu_buffer->shortest_full || + cpu_buffer->shortest_full > full) + cpu_buffer->shortest_full = full; + +The writer will see full_waiters_pending and check if the ring buffer is +filled over the percentage of the shortest_full value. If it is, it calls +an irq_work to wake up all the waiters. + +But the code could get into a circular loop: + + CPU 0 CPU 1 + ----- ----- + [ Poll ] + [ shortest_full = 0 ] + rbwork->full_waiters_pending = true; + if (rbwork->full_waiters_pending && + [ buffer percent ] > shortest_full) { + rbwork->wakeup_full = true; + [ queue_irqwork ] + + cpu_buffer->shortest_full = full; + + [ IRQ work ] + if (rbwork->wakeup_full) { + cpu_buffer->shortest_full = 0; + wakeup poll waiters; + [woken] + if ([ buffer percent ] > full) + break; + rbwork->full_waiters_pending = true; + if (rbwork->full_waiters_pending && + [ buffer percent ] > shortest_full) { + rbwork->wakeup_full = true; + [ queue_irqwork ] + + cpu_buffer->shortest_full = full; + + [ IRQ work ] + if (rbwork->wakeup_full) { + cpu_buffer->shortest_full = 0; + wakeup poll waiters; + [woken] + + [ Wash, rinse, repeat! ] + +In the poll, the shortest_full needs to be set before the +full_pending_waiters, as once that is set, the writer will compare the +current shortest_full (which is incorrect) to decide to call the irq_work, +which will reset the shortest_full (expecting the readers to update it). + +Also move the setting of full_waiters_pending after the check if the ring +buffer has the required percentage filled. There's no reason to tell the +writer to wake up waiters if there are no waiters. + +Link: https://lore.kernel.org/linux-trace-kernel/20240312131952.630922155@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Fixes: 42fb0a1e84ff5 ("tracing/ring-buffer: Have polling block on watermark") +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index a8ad5141d7ba3..b4979f6a449d7 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -1112,16 +1112,32 @@ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, + poll_wait(filp, &rbwork->full_waiters, poll_table); + + raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); +- rbwork->full_waiters_pending = true; + if (!cpu_buffer->shortest_full || + cpu_buffer->shortest_full > full) + cpu_buffer->shortest_full = full; + raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); +- } else { +- poll_wait(filp, &rbwork->waiters, poll_table); +- rbwork->waiters_pending = true; ++ if (full_hit(buffer, cpu, full)) ++ return EPOLLIN | EPOLLRDNORM; ++ /* ++ * Only allow full_waiters_pending update to be seen after ++ * the shortest_full is set. If the writer sees the ++ * full_waiters_pending flag set, it will compare the ++ * amount in the ring buffer to shortest_full. If the amount ++ * in the ring buffer is greater than the shortest_full ++ * percent, it will call the irq_work handler to wake up ++ * this list. The irq_handler will reset shortest_full ++ * back to zero. That's done under the reader_lock, but ++ * the below smp_mb() makes sure that the update to ++ * full_waiters_pending doesn't leak up into the above. ++ */ ++ smp_mb(); ++ rbwork->full_waiters_pending = true; ++ return 0; + } + ++ poll_wait(filp, &rbwork->waiters, poll_table); ++ rbwork->waiters_pending = true; ++ + /* + * There's a tight race between setting the waiters_pending and + * checking if the ring buffer is empty. Once the waiters_pending bit +@@ -1137,9 +1153,6 @@ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, + */ + smp_mb(); + +- if (full) +- return full_hit(buffer, cpu, full) ? EPOLLIN | EPOLLRDNORM : 0; +- + if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) || + (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu))) + return EPOLLIN | EPOLLRDNORM; +-- +2.43.0 + diff --git a/queue-6.6/ring-buffer-fix-resetting-of-shortest_full.patch b/queue-6.6/ring-buffer-fix-resetting-of-shortest_full.patch new file mode 100644 index 00000000000..ed409168abd --- /dev/null +++ b/queue-6.6/ring-buffer-fix-resetting-of-shortest_full.patch @@ -0,0 +1,117 @@ +From 13ccb78814f820f30ab944d62d85f65b422bbd44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 15:24:04 -0500 +Subject: ring-buffer: Fix resetting of shortest_full + +From: Steven Rostedt (Google) + +[ Upstream commit 68282dd930ea38b068ce2c109d12405f40df3f93 ] + +The "shortest_full" variable is used to keep track of the waiter that is +waiting for the smallest amount on the ring buffer before being woken up. +When a tasks waits on the ring buffer, it passes in a "full" value that is +a percentage. 0 means wake up on any data. 1-100 means wake up from 1% to +100% full buffer. + +As all waiters are on the same wait queue, the wake up happens for the +waiter with the smallest percentage. + +The problem is that the smallest_full on the cpu_buffer that stores the +smallest amount doesn't get reset when all the waiters are woken up. It +does get reset when the ring buffer is reset (echo > /sys/kernel/tracing/trace). + +This means that tasks may be woken up more often then when they want to +be. Instead, have the shortest_full field get reset just before waking up +all the tasks. If the tasks wait again, they will update the shortest_full +before sleeping. + +Also add locking around setting of shortest_full in the poll logic, and +change "work" to "rbwork" to match the variable name for rb_irq_work +structures that are used in other places. + +Link: https://lore.kernel.org/linux-trace-kernel/20240308202431.948914369@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: linke li +Cc: Rabin Vincent +Fixes: 2c2b0a78b3739 ("ring-buffer: Add percentage of ring buffer full to wake up reader") +Signed-off-by: Steven Rostedt (Google) +Stable-dep-of: 8145f1c35fa6 ("ring-buffer: Fix full_waiters_pending in poll") +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 30 +++++++++++++++++++++++------- + 1 file changed, 23 insertions(+), 7 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index a3315d569e2bf..a8ad5141d7ba3 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -902,8 +902,19 @@ static void rb_wake_up_waiters(struct irq_work *work) + + wake_up_all(&rbwork->waiters); + if (rbwork->full_waiters_pending || rbwork->wakeup_full) { ++ /* Only cpu_buffer sets the above flags */ ++ struct ring_buffer_per_cpu *cpu_buffer = ++ container_of(rbwork, struct ring_buffer_per_cpu, irq_work); ++ ++ /* Called from interrupt context */ ++ raw_spin_lock(&cpu_buffer->reader_lock); + rbwork->wakeup_full = false; + rbwork->full_waiters_pending = false; ++ ++ /* Waking up all waiters, they will reset the shortest full */ ++ cpu_buffer->shortest_full = 0; ++ raw_spin_unlock(&cpu_buffer->reader_lock); ++ + wake_up_all(&rbwork->full_waiters); + } + } +@@ -1082,28 +1093,33 @@ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, + struct file *filp, poll_table *poll_table, int full) + { + struct ring_buffer_per_cpu *cpu_buffer; +- struct rb_irq_work *work; ++ struct rb_irq_work *rbwork; + + if (cpu == RING_BUFFER_ALL_CPUS) { +- work = &buffer->irq_work; ++ rbwork = &buffer->irq_work; + full = 0; + } else { + if (!cpumask_test_cpu(cpu, buffer->cpumask)) + return EPOLLERR; + + cpu_buffer = buffer->buffers[cpu]; +- work = &cpu_buffer->irq_work; ++ rbwork = &cpu_buffer->irq_work; + } + + if (full) { +- poll_wait(filp, &work->full_waiters, poll_table); +- work->full_waiters_pending = true; ++ unsigned long flags; ++ ++ poll_wait(filp, &rbwork->full_waiters, poll_table); ++ ++ raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); ++ rbwork->full_waiters_pending = true; + if (!cpu_buffer->shortest_full || + cpu_buffer->shortest_full > full) + cpu_buffer->shortest_full = full; ++ raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); + } else { +- poll_wait(filp, &work->waiters, poll_table); +- work->waiters_pending = true; ++ poll_wait(filp, &rbwork->waiters, poll_table); ++ rbwork->waiters_pending = true; + } + + /* +-- +2.43.0 + diff --git a/queue-6.6/ring-buffer-fix-waking-up-ring-buffer-readers.patch b/queue-6.6/ring-buffer-fix-waking-up-ring-buffer-readers.patch new file mode 100644 index 00000000000..1deca33f876 --- /dev/null +++ b/queue-6.6/ring-buffer-fix-waking-up-ring-buffer-readers.patch @@ -0,0 +1,253 @@ +From d31bee2fe3c6a4bf5a41abdb7a3ac49a25c33c29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 15:24:03 -0500 +Subject: ring-buffer: Fix waking up ring buffer readers + +From: Steven Rostedt (Google) + +[ Upstream commit b3594573681b53316ec0365332681a30463edfd6 ] + +A task can wait on a ring buffer for when it fills up to a specific +watermark. The writer will check the minimum watermark that waiters are +waiting for and if the ring buffer is past that, it will wake up all the +waiters. + +The waiters are in a wait loop, and will first check if a signal is +pending and then check if the ring buffer is at the desired level where it +should break out of the loop. + +If a file that uses a ring buffer closes, and there's threads waiting on +the ring buffer, it needs to wake up those threads. To do this, a +"wait_index" was used. + +Before entering the wait loop, the waiter will read the wait_index. On +wakeup, it will check if the wait_index is different than when it entered +the loop, and will exit the loop if it is. The waker will only need to +update the wait_index before waking up the waiters. + +This had a couple of bugs. One trivial one and one broken by design. + +The trivial bug was that the waiter checked the wait_index after the +schedule() call. It had to be checked between the prepare_to_wait() and +the schedule() which it was not. + +The main bug is that the first check to set the default wait_index will +always be outside the prepare_to_wait() and the schedule(). That's because +the ring_buffer_wait() doesn't have enough context to know if it should +break out of the loop. + +The loop itself is not needed, because all the callers to the +ring_buffer_wait() also has their own loop, as the callers have a better +sense of what the context is to decide whether to break out of the loop +or not. + +Just have the ring_buffer_wait() block once, and if it gets woken up, exit +the function and let the callers decide what to do next. + +Link: https://lore.kernel.org/all/CAHk-=whs5MdtNjzFkTyaUy=vHi=qwWgPi0JgTe6OYUYMNSRZfg@mail.gmail.com/ +Link: https://lore.kernel.org/linux-trace-kernel/20240308202431.792933613@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: linke li +Cc: Rabin Vincent +Fixes: e30f53aad2202 ("tracing: Do not busy wait in buffer splice") +Signed-off-by: Steven Rostedt (Google) +Stable-dep-of: 761d9473e27f ("ring-buffer: Do not set shortest_full when full target is hit") +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 139 ++++++++++++++++++------------------- + 1 file changed, 68 insertions(+), 71 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 1ac6637895a44..ed3577d269efe 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -412,7 +412,6 @@ struct rb_irq_work { + struct irq_work work; + wait_queue_head_t waiters; + wait_queue_head_t full_waiters; +- long wait_index; + bool waiters_pending; + bool full_waiters_pending; + bool wakeup_full; +@@ -945,14 +944,40 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu) + rbwork = &cpu_buffer->irq_work; + } + +- rbwork->wait_index++; +- /* make sure the waiters see the new index */ +- smp_wmb(); +- + /* This can be called in any context */ + irq_work_queue(&rbwork->work); + } + ++static bool rb_watermark_hit(struct trace_buffer *buffer, int cpu, int full) ++{ ++ struct ring_buffer_per_cpu *cpu_buffer; ++ bool ret = false; ++ ++ /* Reads of all CPUs always waits for any data */ ++ if (cpu == RING_BUFFER_ALL_CPUS) ++ return !ring_buffer_empty(buffer); ++ ++ cpu_buffer = buffer->buffers[cpu]; ++ ++ if (!ring_buffer_empty_cpu(buffer, cpu)) { ++ unsigned long flags; ++ bool pagebusy; ++ ++ if (!full) ++ return true; ++ ++ raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); ++ pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; ++ ret = !pagebusy && full_hit(buffer, cpu, full); ++ ++ if (!cpu_buffer->shortest_full || ++ cpu_buffer->shortest_full > full) ++ cpu_buffer->shortest_full = full; ++ raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); ++ } ++ return ret; ++} ++ + /** + * ring_buffer_wait - wait for input to the ring buffer + * @buffer: buffer to wait on +@@ -968,7 +993,6 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + struct ring_buffer_per_cpu *cpu_buffer; + DEFINE_WAIT(wait); + struct rb_irq_work *work; +- long wait_index; + int ret = 0; + + /* +@@ -987,81 +1011,54 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + work = &cpu_buffer->irq_work; + } + +- wait_index = READ_ONCE(work->wait_index); +- +- while (true) { +- if (full) +- prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE); +- else +- prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE); +- +- /* +- * The events can happen in critical sections where +- * checking a work queue can cause deadlocks. +- * After adding a task to the queue, this flag is set +- * only to notify events to try to wake up the queue +- * using irq_work. +- * +- * We don't clear it even if the buffer is no longer +- * empty. The flag only causes the next event to run +- * irq_work to do the work queue wake up. The worse +- * that can happen if we race with !trace_empty() is that +- * an event will cause an irq_work to try to wake up +- * an empty queue. +- * +- * There's no reason to protect this flag either, as +- * the work queue and irq_work logic will do the necessary +- * synchronization for the wake ups. The only thing +- * that is necessary is that the wake up happens after +- * a task has been queued. It's OK for spurious wake ups. +- */ +- if (full) +- work->full_waiters_pending = true; +- else +- work->waiters_pending = true; +- +- if (signal_pending(current)) { +- ret = -EINTR; +- break; +- } +- +- if (cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) +- break; +- +- if (cpu != RING_BUFFER_ALL_CPUS && +- !ring_buffer_empty_cpu(buffer, cpu)) { +- unsigned long flags; +- bool pagebusy; +- bool done; +- +- if (!full) +- break; +- +- raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); +- pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; +- done = !pagebusy && full_hit(buffer, cpu, full); ++ if (full) ++ prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE); ++ else ++ prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE); + +- if (!cpu_buffer->shortest_full || +- cpu_buffer->shortest_full > full) +- cpu_buffer->shortest_full = full; +- raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); +- if (done) +- break; +- } ++ /* ++ * The events can happen in critical sections where ++ * checking a work queue can cause deadlocks. ++ * After adding a task to the queue, this flag is set ++ * only to notify events to try to wake up the queue ++ * using irq_work. ++ * ++ * We don't clear it even if the buffer is no longer ++ * empty. The flag only causes the next event to run ++ * irq_work to do the work queue wake up. The worse ++ * that can happen if we race with !trace_empty() is that ++ * an event will cause an irq_work to try to wake up ++ * an empty queue. ++ * ++ * There's no reason to protect this flag either, as ++ * the work queue and irq_work logic will do the necessary ++ * synchronization for the wake ups. The only thing ++ * that is necessary is that the wake up happens after ++ * a task has been queued. It's OK for spurious wake ups. ++ */ ++ if (full) ++ work->full_waiters_pending = true; ++ else ++ work->waiters_pending = true; + +- schedule(); ++ if (rb_watermark_hit(buffer, cpu, full)) ++ goto out; + +- /* Make sure to see the new wait index */ +- smp_rmb(); +- if (wait_index != work->wait_index) +- break; ++ if (signal_pending(current)) { ++ ret = -EINTR; ++ goto out; + } + ++ schedule(); ++ out: + if (full) + finish_wait(&work->full_waiters, &wait); + else + finish_wait(&work->waiters, &wait); + ++ if (!ret && !rb_watermark_hit(buffer, cpu, full) && signal_pending(current)) ++ ret = -EINTR; ++ + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.6/ring-buffer-use-wait_event_interruptible-in-ring_buf.patch b/queue-6.6/ring-buffer-use-wait_event_interruptible-in-ring_buf.patch new file mode 100644 index 00000000000..c28d603e583 --- /dev/null +++ b/queue-6.6/ring-buffer-use-wait_event_interruptible-in-ring_buf.patch @@ -0,0 +1,203 @@ +From 8228f784c3e48e2088c6ea5323f5c8cbe53e9c11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 08:15:07 -0400 +Subject: ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() + +From: Steven Rostedt (Google) + +[ Upstream commit 7af9ded0c2caac0a95f33df5cb04706b0f502588 ] + +Convert ring_buffer_wait() over to wait_event_interruptible(). The default +condition is to execute the wait loop inside __wait_event() just once. + +This does not change the ring_buffer_wait() prototype yet, but +restructures the code so that it can take a "cond" and "data" parameter +and will call wait_event_interruptible() with a helper function as the +condition. + +The helper function (rb_wait_cond) takes the cond function and data +parameters. It will first check if the buffer hit the watermark defined by +the "full" parameter and then call the passed in condition parameter. If +either are true, it returns true. + +If rb_wait_cond() does not return true, it will set the appropriate +"waiters_pending" flag and returns false. + +Link: https://lore.kernel.org/linux-trace-kernel/CAHk-=wgsNgewHFxZAJiAQznwPMqEtQmi1waeS2O1v6L4c_Um5A@mail.gmail.com/ +Link: https://lore.kernel.org/linux-trace-kernel/20240312121703.399598519@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: linke li +Cc: Rabin Vincent +Fixes: f3ddb74ad0790 ("tracing: Wake up ring buffer waiters on closing of the file") +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + include/linux/ring_buffer.h | 1 + + kernel/trace/ring_buffer.c | 116 +++++++++++++++++++++--------------- + 2 files changed, 69 insertions(+), 48 deletions(-) + +diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h +index 782e14f62201f..ded528d23f855 100644 +--- a/include/linux/ring_buffer.h ++++ b/include/linux/ring_buffer.h +@@ -98,6 +98,7 @@ __ring_buffer_alloc(unsigned long size, unsigned flags, struct lock_class_key *k + __ring_buffer_alloc((size), (flags), &__key); \ + }) + ++typedef bool (*ring_buffer_cond_fn)(void *data); + int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full); + __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, + struct file *filp, poll_table *poll_table, int full); +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index b4979f6a449d7..3fedd051f12c0 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -990,43 +990,15 @@ static bool rb_watermark_hit(struct trace_buffer *buffer, int cpu, int full) + return ret; + } + +-/** +- * ring_buffer_wait - wait for input to the ring buffer +- * @buffer: buffer to wait on +- * @cpu: the cpu buffer to wait on +- * @full: wait until the percentage of pages are available, if @cpu != RING_BUFFER_ALL_CPUS +- * +- * If @cpu == RING_BUFFER_ALL_CPUS then the task will wake up as soon +- * as data is added to any of the @buffer's cpu buffers. Otherwise +- * it will wait for data to be added to a specific cpu buffer. +- */ +-int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) ++static inline bool ++rb_wait_cond(struct rb_irq_work *rbwork, struct trace_buffer *buffer, ++ int cpu, int full, ring_buffer_cond_fn cond, void *data) + { +- struct ring_buffer_per_cpu *cpu_buffer; +- DEFINE_WAIT(wait); +- struct rb_irq_work *work; +- int ret = 0; +- +- /* +- * Depending on what the caller is waiting for, either any +- * data in any cpu buffer, or a specific buffer, put the +- * caller on the appropriate wait queue. +- */ +- if (cpu == RING_BUFFER_ALL_CPUS) { +- work = &buffer->irq_work; +- /* Full only makes sense on per cpu reads */ +- full = 0; +- } else { +- if (!cpumask_test_cpu(cpu, buffer->cpumask)) +- return -ENODEV; +- cpu_buffer = buffer->buffers[cpu]; +- work = &cpu_buffer->irq_work; +- } ++ if (rb_watermark_hit(buffer, cpu, full)) ++ return true; + +- if (full) +- prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE); +- else +- prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE); ++ if (cond(data)) ++ return true; + + /* + * The events can happen in critical sections where +@@ -1049,27 +1021,75 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + * a task has been queued. It's OK for spurious wake ups. + */ + if (full) +- work->full_waiters_pending = true; ++ rbwork->full_waiters_pending = true; + else +- work->waiters_pending = true; ++ rbwork->waiters_pending = true; + +- if (rb_watermark_hit(buffer, cpu, full)) +- goto out; ++ return false; ++} + +- if (signal_pending(current)) { +- ret = -EINTR; +- goto out; ++/* ++ * The default wait condition for ring_buffer_wait() is to just to exit the ++ * wait loop the first time it is woken up. ++ */ ++static bool rb_wait_once(void *data) ++{ ++ long *once = data; ++ ++ /* wait_event() actually calls this twice before scheduling*/ ++ if (*once > 1) ++ return true; ++ ++ (*once)++; ++ return false; ++} ++ ++/** ++ * ring_buffer_wait - wait for input to the ring buffer ++ * @buffer: buffer to wait on ++ * @cpu: the cpu buffer to wait on ++ * @full: wait until the percentage of pages are available, if @cpu != RING_BUFFER_ALL_CPUS ++ * ++ * If @cpu == RING_BUFFER_ALL_CPUS then the task will wake up as soon ++ * as data is added to any of the @buffer's cpu buffers. Otherwise ++ * it will wait for data to be added to a specific cpu buffer. ++ */ ++int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) ++{ ++ struct ring_buffer_per_cpu *cpu_buffer; ++ struct wait_queue_head *waitq; ++ ring_buffer_cond_fn cond; ++ struct rb_irq_work *rbwork; ++ void *data; ++ long once = 0; ++ int ret = 0; ++ ++ cond = rb_wait_once; ++ data = &once; ++ ++ /* ++ * Depending on what the caller is waiting for, either any ++ * data in any cpu buffer, or a specific buffer, put the ++ * caller on the appropriate wait queue. ++ */ ++ if (cpu == RING_BUFFER_ALL_CPUS) { ++ rbwork = &buffer->irq_work; ++ /* Full only makes sense on per cpu reads */ ++ full = 0; ++ } else { ++ if (!cpumask_test_cpu(cpu, buffer->cpumask)) ++ return -ENODEV; ++ cpu_buffer = buffer->buffers[cpu]; ++ rbwork = &cpu_buffer->irq_work; + } + +- schedule(); +- out: + if (full) +- finish_wait(&work->full_waiters, &wait); ++ waitq = &rbwork->full_waiters; + else +- finish_wait(&work->waiters, &wait); ++ waitq = &rbwork->waiters; + +- if (!ret && !rb_watermark_hit(buffer, cpu, full) && signal_pending(current)) +- ret = -EINTR; ++ ret = wait_event_interruptible((*waitq), ++ rb_wait_cond(rbwork, buffer, cpu, full, cond, data)); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/s390-zcrypt-fix-reference-counting-on-zcrypt-card-ob.patch b/queue-6.6/s390-zcrypt-fix-reference-counting-on-zcrypt-card-ob.patch new file mode 100644 index 00000000000..394e0ee0f73 --- /dev/null +++ b/queue-6.6/s390-zcrypt-fix-reference-counting-on-zcrypt-card-ob.patch @@ -0,0 +1,124 @@ +From d2ff60ef0d281da1a1803d4f4301fbaf86d2ae79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 15:20:09 +0100 +Subject: s390/zcrypt: fix reference counting on zcrypt card objects + +From: Harald Freudenberger + +[ Upstream commit 50ed48c80fecbe17218afed4f8bed005c802976c ] + +Tests with hot-plugging crytpo cards on KVM guests with debug +kernel build revealed an use after free for the load field of +the struct zcrypt_card. The reason was an incorrect reference +handling of the zcrypt card object which could lead to a free +of the zcrypt card object while it was still in use. + +This is an example of the slab message: + + kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b + kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43 + kernel: kmalloc_trace+0x3f2/0x470 + kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt] + kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4] + kernel: ap_device_probe+0x15c/0x290 + kernel: really_probe+0xd2/0x468 + kernel: driver_probe_device+0x40/0xf0 + kernel: __device_attach_driver+0xc0/0x140 + kernel: bus_for_each_drv+0x8c/0xd0 + kernel: __device_attach+0x114/0x198 + kernel: bus_probe_device+0xb4/0xc8 + kernel: device_add+0x4d2/0x6e0 + kernel: ap_scan_adapter+0x3d0/0x7c0 + kernel: ap_scan_bus+0x5a/0x3b0 + kernel: ap_scan_bus_wq_callback+0x40/0x60 + kernel: process_one_work+0x26e/0x620 + kernel: worker_thread+0x21c/0x440 + kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43 + kernel: kfree+0x37e/0x418 + kernel: zcrypt_card_put+0x54/0x80 [zcrypt] + kernel: ap_device_remove+0x4c/0xe0 + kernel: device_release_driver_internal+0x1c4/0x270 + kernel: bus_remove_device+0x100/0x188 + kernel: device_del+0x164/0x3c0 + kernel: device_unregister+0x30/0x90 + kernel: ap_scan_adapter+0xc8/0x7c0 + kernel: ap_scan_bus+0x5a/0x3b0 + kernel: ap_scan_bus_wq_callback+0x40/0x60 + kernel: process_one_work+0x26e/0x620 + kernel: worker_thread+0x21c/0x440 + kernel: kthread+0x150/0x168 + kernel: __ret_from_fork+0x3c/0x58 + kernel: ret_from_fork+0xa/0x30 + kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff) + kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88 + kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........ + kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk. + kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........ + kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ + kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2 + kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux) + kernel: Call Trace: + kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120 + kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140 + kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8 + kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8 + kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0 + kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8 + kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8 + kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590 + kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0 + kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0 + kernel: [<00000000c9b919dc>] ext4_htree_fill_tree+0x134/0x400 + kernel: [<00000000c9b4b3d0>] ext4_dx_readdir+0x160/0x2f0 + kernel: [<00000000c9b4bedc>] ext4_readdir+0x5f4/0x760 + kernel: [<00000000c9a7efc4>] iterate_dir+0xb4/0x280 + kernel: [<00000000c9a7f1ea>] __do_sys_getdents64+0x5a/0x120 + kernel: [<00000000ca5d6946>] __do_syscall+0x256/0x310 + kernel: [<00000000ca5eea10>] system_call+0x70/0x98 + kernel: INFO: lockdep is turned off. + kernel: FIX kmalloc-96: Restoring Poison 0x00000000885a7512-0x00000000885a7513=0x6b + kernel: FIX kmalloc-96: Marking all objects used + +The fix is simple: Before use of the queue not only the queue object +but also the card object needs to increase it's reference count +with a call to zcrypt_card_get(). Similar after use of the queue +not only the queue but also the card object's reference count is +decreased with zcrypt_card_put(). + +Signed-off-by: Harald Freudenberger +Reviewed-by: Holger Dengler +Cc: stable@vger.kernel.org +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/zcrypt_api.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c +index ce04caa7913fb..357889cc03f0a 100644 +--- a/drivers/s390/crypto/zcrypt_api.c ++++ b/drivers/s390/crypto/zcrypt_api.c +@@ -579,6 +579,7 @@ static inline struct zcrypt_queue *zcrypt_pick_queue(struct zcrypt_card *zc, + { + if (!zq || !try_module_get(zq->queue->ap_dev.device.driver->owner)) + return NULL; ++ zcrypt_card_get(zc); + zcrypt_queue_get(zq); + get_device(&zq->queue->ap_dev.device); + atomic_add(weight, &zc->load); +@@ -598,6 +599,7 @@ static inline void zcrypt_drop_queue(struct zcrypt_card *zc, + atomic_sub(weight, &zq->load); + put_device(&zq->queue->ap_dev.device); + zcrypt_queue_put(zq); ++ zcrypt_card_put(zc); + module_put(mod); + } + +-- +2.43.0 + diff --git a/queue-6.6/sched-simplify-tg_set_cfs_bandwidth.patch b/queue-6.6/sched-simplify-tg_set_cfs_bandwidth.patch new file mode 100644 index 00000000000..5edfd1e0195 --- /dev/null +++ b/queue-6.6/sched-simplify-tg_set_cfs_bandwidth.patch @@ -0,0 +1,111 @@ +From 0f90de86c0d6c0cef3e5b92cc6ac384b3028bacb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 20:45:16 +0200 +Subject: sched: Simplify tg_set_cfs_bandwidth() + +From: Peter Zijlstra + +[ Upstream commit 6fb45460615358157a6d3c990e74f9c1395247e2 ] + +Use guards to reduce gotos and simplify control flow. + +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Stable-dep-of: 1aa09b9379a7 ("powercap: intel_rapl: Fix locking in TPMI RAPL") +Signed-off-by: Sasha Levin +--- + include/linux/cpu.h | 2 ++ + kernel/sched/core.c | 38 +++++++++++++++++++------------------- + 2 files changed, 21 insertions(+), 19 deletions(-) + +diff --git a/include/linux/cpu.h b/include/linux/cpu.h +index 59dd421a8e35d..e990c180282e7 100644 +--- a/include/linux/cpu.h ++++ b/include/linux/cpu.h +@@ -157,6 +157,8 @@ static inline int remove_cpu(unsigned int cpu) { return -EPERM; } + static inline void smp_shutdown_nonboot_cpus(unsigned int primary_cpu) { } + #endif /* !CONFIG_HOTPLUG_CPU */ + ++DEFINE_LOCK_GUARD_0(cpus_read_lock, cpus_read_lock(), cpus_read_unlock()) ++ + #ifdef CONFIG_PM_SLEEP_SMP + extern int freeze_secondary_cpus(int primary); + extern void thaw_secondary_cpus(void); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index a854b71836dd5..1f91e2c12731e 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -10868,11 +10868,12 @@ static int tg_set_cfs_bandwidth(struct task_group *tg, u64 period, u64 quota, + * Prevent race between setting of cfs_rq->runtime_enabled and + * unthrottle_offline_cfs_rqs(). + */ +- cpus_read_lock(); +- mutex_lock(&cfs_constraints_mutex); ++ guard(cpus_read_lock)(); ++ guard(mutex)(&cfs_constraints_mutex); ++ + ret = __cfs_schedulable(tg, period, quota); + if (ret) +- goto out_unlock; ++ return ret; + + runtime_enabled = quota != RUNTIME_INF; + runtime_was_enabled = cfs_b->quota != RUNTIME_INF; +@@ -10882,39 +10883,38 @@ static int tg_set_cfs_bandwidth(struct task_group *tg, u64 period, u64 quota, + */ + if (runtime_enabled && !runtime_was_enabled) + cfs_bandwidth_usage_inc(); +- raw_spin_lock_irq(&cfs_b->lock); +- cfs_b->period = ns_to_ktime(period); +- cfs_b->quota = quota; +- cfs_b->burst = burst; + +- __refill_cfs_bandwidth_runtime(cfs_b); ++ scoped_guard (raw_spinlock_irq, &cfs_b->lock) { ++ cfs_b->period = ns_to_ktime(period); ++ cfs_b->quota = quota; ++ cfs_b->burst = burst; + +- /* Restart the period timer (if active) to handle new period expiry: */ +- if (runtime_enabled) +- start_cfs_bandwidth(cfs_b); ++ __refill_cfs_bandwidth_runtime(cfs_b); + +- raw_spin_unlock_irq(&cfs_b->lock); ++ /* ++ * Restart the period timer (if active) to handle new ++ * period expiry: ++ */ ++ if (runtime_enabled) ++ start_cfs_bandwidth(cfs_b); ++ } + + for_each_online_cpu(i) { + struct cfs_rq *cfs_rq = tg->cfs_rq[i]; + struct rq *rq = cfs_rq->rq; +- struct rq_flags rf; + +- rq_lock_irq(rq, &rf); ++ guard(rq_lock_irq)(rq); + cfs_rq->runtime_enabled = runtime_enabled; + cfs_rq->runtime_remaining = 0; + + if (cfs_rq->throttled) + unthrottle_cfs_rq(cfs_rq); +- rq_unlock_irq(rq, &rf); + } ++ + if (runtime_was_enabled && !runtime_enabled) + cfs_bandwidth_usage_dec(); +-out_unlock: +- mutex_unlock(&cfs_constraints_mutex); +- cpus_read_unlock(); + +- return ret; ++ return 0; + } + + static int tg_set_cfs_quota(struct task_group *tg, long cfs_quota_us) +-- +2.43.0 + diff --git a/queue-6.6/selftests-mqueue-set-timeout-to-180-seconds.patch b/queue-6.6/selftests-mqueue-set-timeout-to-180-seconds.patch new file mode 100644 index 00000000000..33798535759 --- /dev/null +++ b/queue-6.6/selftests-mqueue-set-timeout-to-180-seconds.patch @@ -0,0 +1,35 @@ +From 87a10ef256a3fff53c15dc7ab01d65eb1cc5672e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 16:08:02 -0800 +Subject: selftests/mqueue: Set timeout to 180 seconds + +From: SeongJae Park + +[ Upstream commit 85506aca2eb4ea41223c91c5fe25125953c19b13 ] + +While mq_perf_tests runs with the default kselftest timeout limit, which +is 45 seconds, the test takes about 60 seconds to complete on i3.metal +AWS instances. Hence, the test always times out. Increase the timeout +to 180 seconds. + +Fixes: 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test") +Cc: # 5.4.x +Signed-off-by: SeongJae Park +Reviewed-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/mqueue/setting | 1 + + 1 file changed, 1 insertion(+) + create mode 100644 tools/testing/selftests/mqueue/setting + +diff --git a/tools/testing/selftests/mqueue/setting b/tools/testing/selftests/mqueue/setting +new file mode 100644 +index 0000000000000..a953c96aa16e1 +--- /dev/null ++++ b/tools/testing/selftests/mqueue/setting +@@ -0,0 +1 @@ ++timeout=180 +-- +2.43.0 + diff --git a/queue-6.6/serial-core-only-stop-transmit-when-hw-fifo-is-empty.patch b/queue-6.6/serial-core-only-stop-transmit-when-hw-fifo-is-empty.patch new file mode 100644 index 00000000000..348a8eedf7f --- /dev/null +++ b/queue-6.6/serial-core-only-stop-transmit-when-hw-fifo-is-empty.patch @@ -0,0 +1,46 @@ +From 1b150f23e95e4968ea90fd9c54e45fa724f51982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Mar 2024 16:08:07 +0100 +Subject: serial: core: only stop transmit when HW fifo is empty + +From: Jonas Gorski + +[ Upstream commit 7bfb915a597a301abb892f620fe5c283a9fdbd77 ] + +If the circular buffer is empty, it just means we fit all characters to +send into the HW fifo, but not that the hardware finished transmitting +them. + +So if we immediately call stop_tx() after that, this may abort any +pending characters in the HW fifo, and cause dropped characters on the +console. + +Fix this by only stopping tx when the tx HW fifo is actually empty. + +Fixes: 8275b48b2780 ("tty: serial: introduce transmit helpers") +Cc: stable@vger.kernel.org +Signed-off-by: Jonas Gorski +Link: https://lore.kernel.org/r/20240303150807.68117-1-jonas.gorski@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/serial_core.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 27a26092493ad..a7d5fa892be26 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -786,7 +786,8 @@ enum UART_TX_FLAGS { + if (pending < WAKEUP_CHARS) { \ + uart_write_wakeup(__port); \ + \ +- if (!((flags) & UART_TX_NOSTOP) && pending == 0) \ ++ if (!((flags) & UART_TX_NOSTOP) && pending == 0 && \ ++ __port->ops->tx_empty(__port)) \ + __port->ops->stop_tx(__port); \ + } \ + \ +-- +2.43.0 + diff --git a/queue-6.6/serial-lock-console-when-calling-into-driver-before-.patch b/queue-6.6/serial-lock-console-when-calling-into-driver-before-.patch new file mode 100644 index 00000000000..a732d9623a3 --- /dev/null +++ b/queue-6.6/serial-lock-console-when-calling-into-driver-before-.patch @@ -0,0 +1,187 @@ +From 1310e064d8b6f749818460d0160a55c4795b0fdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 13:43:49 -0800 +Subject: serial: Lock console when calling into driver before registration + +From: Peter Collingbourne + +[ Upstream commit 801410b26a0e8b8a16f7915b2b55c9528b69ca87 ] + +During the handoff from earlycon to the real console driver, we have +two separate drivers operating on the same device concurrently. In the +case of the 8250 driver these concurrent accesses cause problems due +to the driver's use of banked registers, controlled by LCR.DLAB. It is +possible for the setup(), config_port(), pm() and set_mctrl() callbacks +to set DLAB, which can cause the earlycon code that intends to access +TX to instead access DLL, leading to missed output and corruption on +the serial line due to unintended modifications to the baud rate. + +In particular, for setup() we have: + +univ8250_console_setup() +-> serial8250_console_setup() +-> uart_set_options() +-> serial8250_set_termios() +-> serial8250_do_set_termios() +-> serial8250_do_set_divisor() + +For config_port() we have: + +serial8250_config_port() +-> autoconfig() + +For pm() we have: + +serial8250_pm() +-> serial8250_do_pm() +-> serial8250_set_sleep() + +For set_mctrl() we have (for some devices): + +serial8250_set_mctrl() +-> omap8250_set_mctrl() +-> __omap8250_set_mctrl() + +To avoid such problems, let's make it so that the console is locked +during pre-registration calls to these callbacks, which will prevent +the earlycon driver from running concurrently. + +Remove the partial solution to this problem in the 8250 driver +that locked the console only during autoconfig_irq(), as this would +result in a deadlock with the new approach. The console continues +to be locked during autoconfig_irq() because it can only be called +through uart_configure_port(). + +Although this patch introduces more locking than strictly necessary +(and in particular it also locks during the call to rs485_config() +which is not affected by this issue as far as I can tell), it follows +the principle that it is the responsibility of the generic console +code to manage the earlycon handoff by ensuring that earlycon and real +console driver code cannot run concurrently, and not the individual +drivers. + +Signed-off-by: Peter Collingbourne +Reviewed-by: John Ogness +Link: https://linux-review.googlesource.com/id/I7cf8124dcebf8618e6b2ee543fa5b25532de55d8 +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240304214350.501253-1-pcc@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_port.c | 6 ------ + drivers/tty/serial/serial_core.c | 12 ++++++++++++ + kernel/printk/printk.c | 21 ++++++++++++++++++--- + 3 files changed, 30 insertions(+), 9 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 141627370aabc..a17803da83f8c 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1337,9 +1337,6 @@ static void autoconfig_irq(struct uart_8250_port *up) + inb_p(ICP); + } + +- if (uart_console(port)) +- console_lock(); +- + /* forget possible initially masked and pending IRQ */ + probe_irq_off(probe_irq_on()); + save_mcr = serial8250_in_MCR(up); +@@ -1379,9 +1376,6 @@ static void autoconfig_irq(struct uart_8250_port *up) + if (port->flags & UPF_FOURPORT) + outb_p(save_ICP, ICP); + +- if (uart_console(port)) +- console_unlock(); +- + port->irq = (irq > 0) ? irq : 0; + } + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 083ea4de48f9a..4c81210ad9b3a 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2602,7 +2602,12 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, + port->type = PORT_UNKNOWN; + flags |= UART_CONFIG_TYPE; + } ++ /* Synchronize with possible boot console. */ ++ if (uart_console(port)) ++ console_lock(); + port->ops->config_port(port, flags); ++ if (uart_console(port)) ++ console_unlock(); + } + + if (port->type != PORT_UNKNOWN) { +@@ -2610,6 +2615,10 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, + + uart_report_port(drv, port); + ++ /* Synchronize with possible boot console. */ ++ if (uart_console(port)) ++ console_lock(); ++ + /* Power up port for set_mctrl() */ + uart_change_pm(state, UART_PM_STATE_ON); + +@@ -2626,6 +2635,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, + + uart_rs485_config(port); + ++ if (uart_console(port)) ++ console_unlock(); ++ + /* + * If this driver supports console, and it hasn't been + * successfully registered yet, try to re-register it. +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index b67fbae1299fa..c358c04d05162 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -3284,6 +3284,21 @@ static int __init keep_bootcon_setup(char *str) + + early_param("keep_bootcon", keep_bootcon_setup); + ++static int console_call_setup(struct console *newcon, char *options) ++{ ++ int err; ++ ++ if (!newcon->setup) ++ return 0; ++ ++ /* Synchronize with possible boot console. */ ++ console_lock(); ++ err = newcon->setup(newcon, options); ++ console_unlock(); ++ ++ return err; ++} ++ + /* + * This is called by register_console() to try to match + * the newly registered console with any of the ones selected +@@ -3319,8 +3334,8 @@ static int try_enable_preferred_console(struct console *newcon, + if (_braille_register_console(newcon, c)) + return 0; + +- if (newcon->setup && +- (err = newcon->setup(newcon, c->options)) != 0) ++ err = console_call_setup(newcon, c->options); ++ if (err) + return err; + } + newcon->flags |= CON_ENABLED; +@@ -3346,7 +3361,7 @@ static void try_enable_default_console(struct console *newcon) + if (newcon->index < 0) + newcon->index = 0; + +- if (newcon->setup && newcon->setup(newcon, NULL) != 0) ++ if (console_call_setup(newcon, NULL) != 0) + return; + + newcon->flags |= CON_ENABLED; +-- +2.43.0 + diff --git a/queue-6.6/serial-max310x-fix-null-pointer-dereference-in-i2c-i.patch b/queue-6.6/serial-max310x-fix-null-pointer-dereference-in-i2c-i.patch new file mode 100644 index 00000000000..73a804e86be --- /dev/null +++ b/queue-6.6/serial-max310x-fix-null-pointer-dereference-in-i2c-i.patch @@ -0,0 +1,62 @@ +From 470d380f7d5953daedbb1b723102c021c0d0ac3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 10:21:57 -0500 +Subject: serial: max310x: fix NULL pointer dereference in I2C instantiation + +From: Hugo Villeneuve + +[ Upstream commit 0d27056c24efd3d63a03f3edfbcfc4827086b110 ] + +When trying to instantiate a max14830 device from userspace: + + echo max14830 0x60 > /sys/bus/i2c/devices/i2c-2/new_device + +we get the following error: + + Unable to handle kernel NULL pointer dereference at virtual address... + ... + Call trace: + max310x_i2c_probe+0x48/0x170 [max310x] + i2c_device_probe+0x150/0x2a0 + ... + +Add check for validity of devtype to prevent the error, and abort probe +with a meaningful error message. + +Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support") +Cc: stable@vger.kernel.org +Reviewed-by: Andy Shevchenko +Signed-off-by: Hugo Villeneuve +Link: https://lore.kernel.org/r/20240118152213.2644269-2-hugo@hugovil.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 4814aa310dcc5..e339abff926d3 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1635,13 +1635,16 @@ static unsigned short max310x_i2c_slave_addr(unsigned short addr, + + static int max310x_i2c_probe(struct i2c_client *client) + { +- const struct max310x_devtype *devtype = +- device_get_match_data(&client->dev); ++ const struct max310x_devtype *devtype; + struct i2c_client *port_client; + struct regmap *regmaps[4]; + unsigned int i; + u8 port_addr; + ++ devtype = device_get_match_data(&client->dev); ++ if (!devtype) ++ return dev_err_probe(&client->dev, -ENODEV, "Failed to match device\n"); ++ + if (client->addr < devtype->slave_addr.min || + client->addr > devtype->slave_addr.max) + return dev_err_probe(&client->dev, -EINVAL, +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 4c91e0eb1a9..a29dff2300d 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1,2 +1,193 @@ kvm-x86-advertise-cpuid.-eax-7-ecx-2-edx-to-userspace.patch kvm-x86-use-a-switch-statement-and-macros-in-__feature_translate.patch +drm-vmwgfx-unmap-the-surface-before-resetting-it-on-.patch +wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_cfg802.patch +wifi-brcmfmac-avoid-invalid-list-operation-when-vend.patch +media-staging-ipu3-imgu-set-fields-before-media_enti.patch +arm64-dts-qcom-sc7280-add-additional-msi-interrupts.patch +remoteproc-virtio-fix-wdg-cannot-recovery-remote-pro.patch +clk-qcom-gcc-sdm845-add-soft-dependency-on-rpmhpd.patch +smack-set-smack64transmute-only-for-dirs-in-smack_in.patch +smack-handle-smack64transmute-in-smack_inode_setsecu.patch +arm-dts-marvell-fix-maxium-maxim-typo-in-brownstone-.patch +drm-vmwgfx-fix-possible-null-pointer-derefence-with-.patch +serial-max310x-fix-null-pointer-dereference-in-i2c-i.patch +drm-vmwgfx-fix-the-lifetime-of-the-bo-cursor-memory.patch +pci_iounmap-fix-mmio-mapping-leak.patch +media-xc4000-fix-atomicity-violation-in-xc4000_get_f.patch +media-mc-add-local-pad-to-pipeline-regardless-of-the.patch +media-mc-fix-flags-handling-when-creating-pad-links.patch +media-nxp-imx8-isi-check-whether-crossbar-pad-is-non.patch +media-mc-add-num_links-flag-to-media_pad.patch +media-mc-rename-pad-variable-to-clarify-intent.patch +media-mc-expand-must_connect-flag-to-always-require-.patch +media-nxp-imx8-isi-mark-all-crossbar-sink-pads-as-mu.patch +kvm-always-flush-async-pf-workqueue-when-vcpu-is-bei.patch +arm64-dts-qcom-sm8550-qrd-correct-wcd9385-tx-port-ma.patch +arm64-dts-qcom-sm8550-mtp-correct-wcd9385-tx-port-ma.patch +cpufreq-amd-pstate-fix-min_perf-assignment-in-amd_ps.patch +thermal-intel-fix-intel_tcc_get_temp-to-support-nega.patch +powercap-intel_rapl-fix-a-null-pointer-dereference.patch +sched-simplify-tg_set_cfs_bandwidth.patch +powercap-intel_rapl-fix-locking-in-tpmi-rapl.patch +powercap-intel_rapl_tpmi-fix-a-register-bug.patch +powercap-intel_rapl_tpmi-fix-system-domain-probing.patch +powerpc-smp-adjust-nr_cpu_ids-to-cover-all-threads-o.patch +powerpc-smp-increase-nr_cpu_ids-to-include-the-boot-.patch +sparc64-nmi-watchdog-fix-return-value-of-__setup-han.patch +sparc-vdso-fix-return-value-of-__setup-handler.patch +crypto-qat-resolve-race-condition-during-aer-recover.patch +selftests-mqueue-set-timeout-to-180-seconds.patch +ext4-correct-best-extent-lstart-adjustment-logic.patch +block-clear-zone-limits-for-a-non-zoned-stacked-queu.patch +kasan-test-avoid-gcc-warning-for-intentional-overflo.patch +bounds-support-non-power-of-two-config_nr_cpus.patch +fat-fix-uninitialized-field-in-nostale-filehandles.patch +fuse-fix-vm_mayshare-and-direct_io_allow_mmap.patch +ubifs-set-page-uptodate-in-the-correct-place.patch +ubi-check-for-too-small-leb-size-in-vtbl-code.patch +ubi-correct-the-calculation-of-fastmap-size.patch +mtd-rawnand-meson-fix-scrambling-mode-value-in-comma.patch +md-md-bitmap-fix-incorrect-usage-for-sb_index.patch +x86-nmi-fix-the-inverse-in-nmi-handler-check.patch +parisc-unaligned-rewrite-64-bit-inline-assembly-of-e.patch +parisc-avoid-clobbering-the-c-b-bits-in-the-psw-with.patch +parisc-fix-ip_fast_csum.patch +parisc-fix-csum_ipv6_magic-on-32-bit-systems.patch +parisc-fix-csum_ipv6_magic-on-64-bit-systems.patch +parisc-strip-upper-32-bit-of-sum-in-csum_ipv6_magic-.patch +md-raid5-fix-atomicity-violation-in-raid5_cache_coun.patch +iio-adc-rockchip_saradc-fix-bitmask-for-channels-on-.patch +iio-adc-rockchip_saradc-use-mask-for-write_enable-bi.patch +docs-restore-smart-quotes-for-quotes.patch +cpufreq-limit-resolving-a-frequency-to-policy-min-ma.patch +pm-suspend-set-mem_sleep_current-during-kernel-comma.patch +vfio-pds-always-clear-the-save-restore-fds-on-reset.patch +clk-qcom-gcc-ipq5018-fix-terminating-of-frequency-ta.patch +clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch +clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch +clk-qcom-gcc-ipq9574-fix-terminating-of-frequency-ta.patch +clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch +clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch +usb-xhci-add-error-handling-in-xhci_map_urb_for_dma.patch +powerpc-fsl-fix-mfpmr-build-errors-with-newer-binuti.patch +usb-serial-ftdi_sio-add-support-for-gmc-z216c-adapte.patch +usb-serial-add-device-id-for-verifone-adapter.patch +usb-serial-cp210x-add-id-for-mgp-instruments-pds100.patch +usb-serial-option-add-meig-smart-slm320-product.patch +kvm-x86-xen-inject-vcpu-upcall-vector-when-local-api.patch +usb-serial-cp210x-add-pid-vid-for-tdk-nc0110013m-and.patch +pm-sleep-wakeirq-fix-wake-irq-warning-in-system-susp.patch +mmc-tmio-avoid-concurrent-runs-of-mmc_request_done.patch +fuse-replace-remaining-make_bad_inode-with-fuse_make.patch +fuse-fix-root-lookup-with-nonzero-generation.patch +fuse-don-t-unhash-root.patch +usb-typec-ucsi-clean-up-ucsi_cable_prop-macros.patch +usb-dwc3-am62-fix-module-unload-reload-behavior.patch +usb-dwc3-am62-disable-wakeup-at-remove.patch +serial-core-only-stop-transmit-when-hw-fifo-is-empty.patch +serial-lock-console-when-calling-into-driver-before-.patch +btrfs-qgroup-always-free-reserved-space-for-extent-r.patch +btrfs-fix-off-by-one-chunk-length-calculation-at-con.patch +wifi-rtw88-add-missing-vid-pids-for-8811cu-and-8821c.patch +pci-pm-drain-runtime-idle-callbacks-before-driver-re.patch +pci-dpc-quirk-pio-log-size-for-intel-raptor-lake-roo.patch +acpi-cppc-use-access_width-over-bit_width-for-system.patch +dm-raid-fix-lockdep-waring-in-pers-hot_add_disk.patch +powerpc-xor_vmx-add-mhard-float-to-cflags.patch +block-fix-page-refcounts-for-unaligned-buffers-in-__.patch +mac802154-fix-llsec-key-resources-release-in-mac8021.patch +mm-swap-fix-race-between-free_swap_and_cache-and-swa.patch +mmc-core-fix-switch-on-gp3-partition.patch +bluetooth-btnxpuart-fix-btnxpuart_close.patch +leds-trigger-netdev-fix-kernel-panic-on-interface-re.patch +drm-etnaviv-restore-some-id-values.patch +landlock-warn-once-if-a-landlock-action-is-requested.patch +hwmon-amc6821-add-of_match-table.patch +ext4-fix-corruption-during-on-line-resize.patch +nvmem-meson-efuse-fix-function-pointer-type-mismatch.patch +slimbus-core-remove-usage-of-the-deprecated-ida_simp.patch +phy-tegra-xusb-add-api-to-retrieve-the-port-number-o.patch +usb-gadget-tegra-xudc-fix-usb3-phy-retrieval-logic.patch +speakup-fix-8bit-characters-from-direct-synth.patch +pci-aer-block-runtime-suspend-when-handling-errors.patch +io_uring-net-correctly-handle-multishot-recvmsg-retr.patch +io_uring-fix-mshot-io-wq-checks.patch +sparc32-fix-parport-build-with-sparc32.patch +nfs-fix-uaf-in-direct-writes.patch +nfs-read-unlock-folio-on-nfs_page_create_from_folio-.patch +kbuild-move-wenum-compare-conditional-enum-conversio.patch +pci-qcom-enable-bdf-to-sid-translation-properly.patch +pci-dwc-endpoint-fix-advertised-resizable-bar-size.patch +pci-hv-fix-ring-buffer-size-calculation.patch +smb-client-stop-revalidating-reparse-points-unnecess.patch +cifs-prevent-updating-file-size-from-server-if-we-ha.patch +cifs-allow-changing-password-during-remount.patch +thermal-drivers-mediatek-fix-control-buffer-enableme.patch +vfio-pci-disable-auto-enable-of-exclusive-intx-irq.patch +vfio-pci-lock-external-intx-masking-ops.patch +vfio-platform-disable-virqfds-on-cleanup.patch +tpm-tpm_tis-avoid-warning-splat-at-shutdown.patch +server-convert-to-new-timestamp-accessors.patch +ksmbd-replace-generic_fillattr-with-vfs_getattr.patch +ksmbd-retrieve-number-of-blocks-using-vfs_getattr-in.patch +platform-x86-intel-tpmi-change-vsec-offset-to-u64.patch +io_uring-clean-rings-on-no_mmap-alloc-fail.patch +ring-buffer-fix-waking-up-ring-buffer-readers.patch +ring-buffer-do-not-set-shortest_full-when-full-targe.patch +ring-buffer-fix-resetting-of-shortest_full.patch +ring-buffer-fix-full_waiters_pending-in-poll.patch +ring-buffer-use-wait_event_interruptible-in-ring_buf.patch +dlm-fix-user-space-lkb-refcounting.patch +soc-fsl-qbman-always-disable-interrupts-when-taking-.patch +soc-fsl-qbman-use-raw-spinlock-for-cgr_lock.patch +s390-zcrypt-fix-reference-counting-on-zcrypt-card-ob.patch +drm-probe-helper-warn-about-negative-.get_modes.patch +drm-panel-do-not-return-negative-error-codes-from-dr.patch +drm-exynos-do-not-return-negative-values-from-.get_m.patch +drm-imx-ipuv3-do-not-return-negative-values-from-.ge.patch +drm-vc4-hdmi-do-not-return-negative-values-from-.get.patch +memtest-use-read-write-_once-in-memory-scanning.patch +revert-block-mq-deadline-use-correct-way-to-throttli.patch +f2fs-mark-inode-dirty-for-fi_atomic_committed-flag.patch +f2fs-truncate-page-cache-before-clearing-flags-when-.patch +nilfs2-fix-failure-to-detect-dat-corruption-in-btree.patch +nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch +cifs-add-xid-to-query-server-interface-call.patch +cifs-make-sure-server-interfaces-are-requested-only-.patch +cifs-do-not-let-cifs_chan_update_iface-deallocate-ch.patch +cifs-delete-unnecessary-null-checks-in-cifs_chan_upd.patch +cifs-make-cifs_chan_update_iface-a-void-function.patch +cifs-reduce-warning-log-level-for-server-not-adverti.patch +cifs-open_cached_dir-add-file_read_ea-to-desired-acc.patch +mtd-rawnand-fix-and-simplify-again-the-continuous-re.patch +mtd-rawnand-constrain-even-more-when-continuous-read.patch +cpufreq-dt-always-allocate-zeroed-cpumask.patch +x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch +net-esp-fix-bad-handling-of-pages-from-page_pool.patch +nfsd-fix-nfsd_clid_class-use-of-__string_len-macro.patch +drm-i915-add-missing-to-__assign_str-macros-in-trace.patch +net-hns3-tracing-fix-hclgevf-trace-event-strings.patch +cxl-trace-properly-initialize-cxl_poison-region-name.patch +virtio-reenable-config-if-freezing-device-failed.patch +loongarch-change-__my_cpu_offset-definition-to-avoid.patch +loongarch-define-the-__io_aw-hook-as-mmiowb.patch +loongarch-crypto-clean-up-useless-assignment-operati.patch +wireguard-netlink-check-for-dangling-peer-via-is_dea.patch +wireguard-netlink-access-device-through-ctx-instead-.patch +wireguard-selftests-set-riscv_isa_fallback-on-riscv-.patch +ahci-asm1064-correct-count-of-reported-ports.patch +ahci-asm1064-asm1166-don-t-limit-reported-ports.patch +drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch +drm-amd-display-return-the-correct-hdcp-error-code.patch +drm-amd-display-fix-noise-issue-on-hdmi-av-mute.patch +dm-snapshot-fix-lockup-in-dm_exception_table_exit.patch +x86-pm-work-around-false-positive-kmemleak-report-in.patch +wifi-brcmfmac-add-per-vendor-feature-detection-callb.patch +wifi-brcmfmac-cfg80211-use-wsec-to-set-sae-password.patch +wifi-brcmfmac-demote-vendor-specific-attach-detach-m.patch +drm-ttm-make-sure-the-mapped-tt-pages-are-decrypted-.patch +drm-bridge-add-edid_read-hook-and-drm_bridge_edid_re.patch +drm-bridge-lt8912b-use-drm_bridge_edid_read.patch +drm-bridge-lt8912b-clear-the-edid-property-on-failur.patch +drm-bridge-lt8912b-do-not-return-negative-values-fro.patch diff --git a/queue-6.6/server-convert-to-new-timestamp-accessors.patch b/queue-6.6/server-convert-to-new-timestamp-accessors.patch new file mode 100644 index 00000000000..af77979efc3 --- /dev/null +++ b/queue-6.6/server-convert-to-new-timestamp-accessors.patch @@ -0,0 +1,51 @@ +From 75dbc9d53c8479f1e070e712d250a35ef8361f83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 14:52:54 -0400 +Subject: server: convert to new timestamp accessors + +From: Jeff Layton + +[ Upstream commit 769cfc919e35c70a5110b0843fb330746363acb8 ] + +Convert to using the new inode timestamp accessor functions. + +Signed-off-by: Jeff Layton +Link: https://lore.kernel.org/r/20231004185347.80880-67-jlayton@kernel.org +Signed-off-by: Christian Brauner +Stable-dep-of: 5614c8c487f6 ("ksmbd: replace generic_fillattr with vfs_getattr") +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index e8c03445271d0..0c97d3c860726 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -4857,9 +4857,9 @@ static void find_file_posix_info(struct smb2_query_info_rsp *rsp, + + file_info = (struct smb311_posix_qinfo *)rsp->Buffer; + file_info->CreationTime = cpu_to_le64(fp->create_time); +- time = ksmbd_UnixTimeToNT(inode->i_atime); ++ time = ksmbd_UnixTimeToNT(inode_get_atime(inode)); + file_info->LastAccessTime = cpu_to_le64(time); +- time = ksmbd_UnixTimeToNT(inode->i_mtime); ++ time = ksmbd_UnixTimeToNT(inode_get_mtime(inode)); + file_info->LastWriteTime = cpu_to_le64(time); + time = ksmbd_UnixTimeToNT(inode_get_ctime(inode)); + file_info->ChangeTime = cpu_to_le64(time); +@@ -5466,9 +5466,9 @@ int smb2_close(struct ksmbd_work *work) + rsp->EndOfFile = cpu_to_le64(inode->i_size); + rsp->Attributes = fp->f_ci->m_fattr; + rsp->CreationTime = cpu_to_le64(fp->create_time); +- time = ksmbd_UnixTimeToNT(inode->i_atime); ++ time = ksmbd_UnixTimeToNT(inode_get_atime(inode)); + rsp->LastAccessTime = cpu_to_le64(time); +- time = ksmbd_UnixTimeToNT(inode->i_mtime); ++ time = ksmbd_UnixTimeToNT(inode_get_mtime(inode)); + rsp->LastWriteTime = cpu_to_le64(time); + time = ksmbd_UnixTimeToNT(inode_get_ctime(inode)); + rsp->ChangeTime = cpu_to_le64(time); +-- +2.43.0 + diff --git a/queue-6.6/slimbus-core-remove-usage-of-the-deprecated-ida_simp.patch b/queue-6.6/slimbus-core-remove-usage-of-the-deprecated-ida_simp.patch new file mode 100644 index 00000000000..f23baeb3538 --- /dev/null +++ b/queue-6.6/slimbus-core-remove-usage-of-the-deprecated-ida_simp.patch @@ -0,0 +1,45 @@ +From 911c8de7bd29299bdf4b14238fbc6591dac628bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Feb 2024 11:41:37 +0000 +Subject: slimbus: core: Remove usage of the deprecated ida_simple_xx() API + +From: Christophe JAILLET + +[ Upstream commit 89ffa4cccec54467446f141a79b9e36893079fb8 ] + +ida_alloc() and ida_free() should be preferred to the deprecated +ida_simple_get() and ida_simple_remove(). + +Note that the upper limit of ida_simple_get() is exclusive, but the one of +ida_alloc_range() is inclusive. So change this change allows one more +device. Previously address 0xFE was never used. + +Fixes: 46a2bb5a7f7e ("slimbus: core: Add slim controllers support") +Cc: Stable@vger.kernel.org +Signed-off-by: Christophe JAILLET +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20240224114137.85781-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c +index d43873bb5fe6d..01cbd46219810 100644 +--- a/drivers/slimbus/core.c ++++ b/drivers/slimbus/core.c +@@ -436,8 +436,8 @@ static int slim_device_alloc_laddr(struct slim_device *sbdev, + if (ret < 0) + goto err; + } else if (report_present) { +- ret = ida_simple_get(&ctrl->laddr_ida, +- 0, SLIM_LA_MANAGER - 1, GFP_KERNEL); ++ ret = ida_alloc_max(&ctrl->laddr_ida, ++ SLIM_LA_MANAGER - 1, GFP_KERNEL); + if (ret < 0) + goto err; + +-- +2.43.0 + diff --git a/queue-6.6/smack-handle-smack64transmute-in-smack_inode_setsecu.patch b/queue-6.6/smack-handle-smack64transmute-in-smack_inode_setsecu.patch new file mode 100644 index 00000000000..b73a80e1a4c --- /dev/null +++ b/queue-6.6/smack-handle-smack64transmute-in-smack_inode_setsecu.patch @@ -0,0 +1,44 @@ +From 91a6e18259606aef9daffd7cd8f7eac7d7d83c5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 10:01:22 +0100 +Subject: smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() + +From: Roberto Sassu + +[ Upstream commit ac02f007d64eb2769d0bde742aac4d7a5fc6e8a5 ] + +If the SMACK64TRANSMUTE xattr is provided, and the inode is a directory, +update the in-memory inode flags by setting SMK_INODE_TRANSMUTE. + +Cc: stable@vger.kernel.org +Fixes: 5c6d1125f8db ("Smack: Transmute labels on specified directories") # v2.6.38.x +Signed-off-by: Roberto Sassu +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +--- + security/smack/smack_lsm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 0fe3ccec62a52..e1e297deb02e6 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2854,6 +2854,15 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name, + if (value == NULL || size > SMK_LONGLABEL || size == 0) + return -EINVAL; + ++ if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) { ++ if (!S_ISDIR(inode->i_mode) || size != TRANS_TRUE_SIZE || ++ strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) ++ return -EINVAL; ++ ++ nsp->smk_flags |= SMK_INODE_TRANSMUTE; ++ return 0; ++ } ++ + skp = smk_import_entry(value, size); + if (IS_ERR(skp)) + return PTR_ERR(skp); +-- +2.43.0 + diff --git a/queue-6.6/smack-set-smack64transmute-only-for-dirs-in-smack_in.patch b/queue-6.6/smack-set-smack64transmute-only-for-dirs-in-smack_in.patch new file mode 100644 index 00000000000..39c7af2f8e1 --- /dev/null +++ b/queue-6.6/smack-set-smack64transmute-only-for-dirs-in-smack_in.patch @@ -0,0 +1,38 @@ +From 685f506d342840be573e12e357654f2935fe2ad2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 10:01:21 +0100 +Subject: smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() + +From: Roberto Sassu + +[ Upstream commit 9c82169208dde516510aaba6bbd8b13976690c5d ] + +Since the SMACK64TRANSMUTE xattr makes sense only for directories, enforce +this restriction in smack_inode_setxattr(). + +Cc: stable@vger.kernel.org +Fixes: 5c6d1125f8db ("Smack: Transmute labels on specified directories") # v2.6.38.x +Signed-off-by: Roberto Sassu +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +--- + security/smack/smack_lsm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 1f1ea8529421f..0fe3ccec62a52 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -1312,7 +1312,8 @@ static int smack_inode_setxattr(struct mnt_idmap *idmap, + check_star = 1; + } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { + check_priv = 1; +- if (size != TRANS_TRUE_SIZE || ++ if (!S_ISDIR(d_backing_inode(dentry)->i_mode) || ++ size != TRANS_TRUE_SIZE || + strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) + rc = -EINVAL; + } else +-- +2.43.0 + diff --git a/queue-6.6/smb-client-stop-revalidating-reparse-points-unnecess.patch b/queue-6.6/smb-client-stop-revalidating-reparse-points-unnecess.patch new file mode 100644 index 00000000000..e46b31b9b3e --- /dev/null +++ b/queue-6.6/smb-client-stop-revalidating-reparse-points-unnecess.patch @@ -0,0 +1,274 @@ +From ffa41e42f04b9cfa1eef46b7bd89b33f5386d1ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jan 2024 20:05:17 -0300 +Subject: smb: client: stop revalidating reparse points unnecessarily + +From: Paulo Alcantara + +[ Upstream commit 6d039984c15d1ea1ca080176df6dfab443e44585 ] + +Query dir responses don't provide enough information on reparse points +such as major/minor numbers and symlink targets other than reparse +tags, however we don't need to unconditionally revalidate them only +because they are reparse points. Instead, revalidate them only when +their ctime or reparse tag has changed. + +For instance, Windows Server updates ctime of reparse points when +their data have changed. + +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Stable-dep-of: e4b61f3b1c67 ("cifs: prevent updating file size from server if we have a read/write lease") +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsglob.h | 1 + + fs/smb/client/inode.c | 4 +- + fs/smb/client/readdir.c | 133 ++++++++++++++++----------------------- + 3 files changed, 57 insertions(+), 81 deletions(-) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index 462554917e5a1..57bf6b406c590 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -1562,6 +1562,7 @@ struct cifsInodeInfo { + spinlock_t deferred_lock; /* protection on deferred list */ + bool lease_granted; /* Flag to indicate whether lease or oplock is granted. */ + char *symlink_target; ++ __u32 reparse_tag; + }; + + static inline struct cifsInodeInfo * +diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c +index eb54e48937771..471abc99bbf02 100644 +--- a/fs/smb/client/inode.c ++++ b/fs/smb/client/inode.c +@@ -182,6 +182,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr) + inode->i_mode = fattr->cf_mode; + + cifs_i->cifsAttrs = fattr->cf_cifsattrs; ++ cifs_i->reparse_tag = fattr->cf_cifstag; + + if (fattr->cf_flags & CIFS_FATTR_NEED_REVAL) + cifs_i->time = 0; +@@ -209,7 +210,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr) + inode->i_blocks = (512 - 1 + fattr->cf_bytes) >> 9; + } + +- if (S_ISLNK(fattr->cf_mode)) { ++ if (S_ISLNK(fattr->cf_mode) && fattr->cf_symlink_target) { + kfree(cifs_i->symlink_target); + cifs_i->symlink_target = fattr->cf_symlink_target; + fattr->cf_symlink_target = NULL; +@@ -1103,6 +1104,7 @@ static int reparse_info_to_fattr(struct cifs_open_info_data *data, + + cifs_open_info_to_fattr(fattr, data, sb); + out: ++ fattr->cf_cifstag = data->reparse.tag; + free_rsp_buf(rsp_buftype, rsp_iov.iov_base); + return rc; + } +diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c +index e23cd216bffbe..520c490e844b5 100644 +--- a/fs/smb/client/readdir.c ++++ b/fs/smb/client/readdir.c +@@ -55,6 +55,23 @@ static inline void dump_cifs_file_struct(struct file *file, char *label) + } + #endif /* DEBUG2 */ + ++/* ++ * Match a reparse point inode if reparse tag and ctime haven't changed. ++ * ++ * Windows Server updates ctime of reparse points when their data have changed. ++ * The server doesn't allow changing reparse tags from existing reparse points, ++ * though it's worth checking. ++ */ ++static inline bool reparse_inode_match(struct inode *inode, ++ struct cifs_fattr *fattr) ++{ ++ struct timespec64 ctime = inode_get_ctime(inode); ++ ++ return (CIFS_I(inode)->cifsAttrs & ATTR_REPARSE) && ++ CIFS_I(inode)->reparse_tag == fattr->cf_cifstag && ++ timespec64_equal(&ctime, &fattr->cf_ctime); ++} ++ + /* + * Attempt to preload the dcache with the results from the FIND_FIRST/NEXT + * +@@ -71,6 +88,7 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name, + struct super_block *sb = parent->d_sb; + struct cifs_sb_info *cifs_sb = CIFS_SB(sb); + DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); ++ int rc; + + cifs_dbg(FYI, "%s: for %s\n", __func__, name->name); + +@@ -82,9 +100,11 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name, + * We'll end up doing an on the wire call either way and + * this spares us an invalidation. + */ +- if (fattr->cf_flags & CIFS_FATTR_NEED_REVAL) +- return; + retry: ++ if ((fattr->cf_cifsattrs & ATTR_REPARSE) || ++ (fattr->cf_flags & CIFS_FATTR_NEED_REVAL)) ++ return; ++ + dentry = d_alloc_parallel(parent, name, &wq); + } + if (IS_ERR(dentry)) +@@ -104,12 +124,34 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name, + if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) + fattr->cf_uniqueid = CIFS_I(inode)->uniqueid; + +- /* update inode in place +- * if both i_ino and i_mode didn't change */ +- if (CIFS_I(inode)->uniqueid == fattr->cf_uniqueid && +- cifs_fattr_to_inode(inode, fattr) == 0) { +- dput(dentry); +- return; ++ /* ++ * Update inode in place if both i_ino and i_mode didn't ++ * change. ++ */ ++ if (CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) { ++ /* ++ * Query dir responses don't provide enough ++ * information about reparse points other than ++ * their reparse tags. Save an invalidation by ++ * not clobbering the existing mode, size and ++ * symlink target (if any) when reparse tag and ++ * ctime haven't changed. ++ */ ++ rc = 0; ++ if (fattr->cf_cifsattrs & ATTR_REPARSE) { ++ if (likely(reparse_inode_match(inode, fattr))) { ++ fattr->cf_mode = inode->i_mode; ++ fattr->cf_eof = CIFS_I(inode)->server_eof; ++ fattr->cf_symlink_target = NULL; ++ } else { ++ CIFS_I(inode)->time = 0; ++ rc = -ESTALE; ++ } ++ } ++ if (!rc && !cifs_fattr_to_inode(inode, fattr)) { ++ dput(dentry); ++ return; ++ } + } + } + d_invalidate(dentry); +@@ -127,29 +169,6 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name, + dput(dentry); + } + +-static bool reparse_file_needs_reval(const struct cifs_fattr *fattr) +-{ +- if (!(fattr->cf_cifsattrs & ATTR_REPARSE)) +- return false; +- /* +- * The DFS tags should be only intepreted by server side as per +- * MS-FSCC 2.1.2.1, but let's include them anyway. +- * +- * Besides, if cf_cifstag is unset (0), then we still need it to be +- * revalidated to know exactly what reparse point it is. +- */ +- switch (fattr->cf_cifstag) { +- case IO_REPARSE_TAG_DFS: +- case IO_REPARSE_TAG_DFSR: +- case IO_REPARSE_TAG_SYMLINK: +- case IO_REPARSE_TAG_NFS: +- case IO_REPARSE_TAG_MOUNT_POINT: +- case 0: +- return true; +- } +- return false; +-} +- + static void + cifs_fill_common_info(struct cifs_fattr *fattr, struct cifs_sb_info *cifs_sb) + { +@@ -181,14 +200,6 @@ cifs_fill_common_info(struct cifs_fattr *fattr, struct cifs_sb_info *cifs_sb) + } + + out_reparse: +- /* +- * We need to revalidate it further to make a decision about whether it +- * is a symbolic link, DFS referral or a reparse point with a direct +- * access like junctions, deduplicated files, NFS symlinks. +- */ +- if (reparse_file_needs_reval(fattr)) +- fattr->cf_flags |= CIFS_FATTR_NEED_REVAL; +- + /* non-unix readdir doesn't provide nlink */ + fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK; + +@@ -269,9 +280,6 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, + fattr->cf_dtype = DT_REG; + } + +- if (reparse_file_needs_reval(fattr)) +- fattr->cf_flags |= CIFS_FATTR_NEED_REVAL; +- + sid_to_id(cifs_sb, &parsed.owner, fattr, SIDOWNER); + sid_to_id(cifs_sb, &parsed.group, fattr, SIDGROUP); + } +@@ -333,38 +341,6 @@ cifs_std_info_to_fattr(struct cifs_fattr *fattr, FIND_FILE_STANDARD_INFO *info, + cifs_fill_common_info(fattr, cifs_sb); + } + +-/* BB eventually need to add the following helper function to +- resolve NT_STATUS_STOPPED_ON_SYMLINK return code when +- we try to do FindFirst on (NTFS) directory symlinks */ +-/* +-int get_symlink_reparse_path(char *full_path, struct cifs_sb_info *cifs_sb, +- unsigned int xid) +-{ +- __u16 fid; +- int len; +- int oplock = 0; +- int rc; +- struct cifs_tcon *ptcon = cifs_sb_tcon(cifs_sb); +- char *tmpbuffer; +- +- rc = CIFSSMBOpen(xid, ptcon, full_path, FILE_OPEN, GENERIC_READ, +- OPEN_REPARSE_POINT, &fid, &oplock, NULL, +- cifs_sb->local_nls, +- cifs_remap(cifs_sb); +- if (!rc) { +- tmpbuffer = kmalloc(maxpath); +- rc = CIFSSMBQueryReparseLinkInfo(xid, ptcon, full_path, +- tmpbuffer, +- maxpath -1, +- fid, +- cifs_sb->local_nls); +- if (CIFSSMBClose(xid, ptcon, fid)) { +- cifs_dbg(FYI, "Error closing temporary reparsepoint open\n"); +- } +- } +-} +- */ +- + static int + _initiate_cifs_search(const unsigned int xid, struct file *file, + const char *full_path) +@@ -433,13 +409,10 @@ _initiate_cifs_search(const unsigned int xid, struct file *file, + &cifsFile->fid, search_flags, + &cifsFile->srch_inf); + +- if (rc == 0) ++ if (rc == 0) { + cifsFile->invalidHandle = false; +- /* BB add following call to handle readdir on new NTFS symlink errors +- else if STATUS_STOPPED_ON_SYMLINK +- call get_symlink_reparse_path and retry with new path */ +- else if ((rc == -EOPNOTSUPP) && +- (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) { ++ } else if ((rc == -EOPNOTSUPP) && ++ (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) { + cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM; + goto ffirst_retry; + } +-- +2.43.0 + diff --git a/queue-6.6/soc-fsl-qbman-always-disable-interrupts-when-taking-.patch b/queue-6.6/soc-fsl-qbman-always-disable-interrupts-when-taking-.patch new file mode 100644 index 00000000000..149859edf1e --- /dev/null +++ b/queue-6.6/soc-fsl-qbman-always-disable-interrupts-when-taking-.patch @@ -0,0 +1,73 @@ +From 535cdb083242fdcd70db03b9e9f05c01659d168f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 12:38:29 -0400 +Subject: soc: fsl: qbman: Always disable interrupts when taking cgr_lock + +From: Sean Anderson + +[ Upstream commit 584c2a9184a33a40fceee838f856de3cffa19be3 ] + +smp_call_function_single disables IRQs when executing the callback. To +prevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere. +This is already done by qman_update_cgr and qman_delete_cgr; fix the +other lockers. + +Fixes: 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()") +CC: stable@vger.kernel.org +Signed-off-by: Sean Anderson +Reviewed-by: Camelia Groza +Tested-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qbman/qman.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index 739e4eee6b75c..1bf1f1ea67f00 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -1456,11 +1456,11 @@ static void qm_congestion_task(struct work_struct *work) + union qm_mc_result *mcr; + struct qman_cgr *cgr; + +- spin_lock(&p->cgr_lock); ++ spin_lock_irq(&p->cgr_lock); + qm_mc_start(&p->p); + qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION); + if (!qm_mc_result_timeout(&p->p, &mcr)) { +- spin_unlock(&p->cgr_lock); ++ spin_unlock_irq(&p->cgr_lock); + dev_crit(p->config->dev, "QUERYCONGESTION timeout\n"); + qman_p_irqsource_add(p, QM_PIRQ_CSCI); + return; +@@ -1476,7 +1476,7 @@ static void qm_congestion_task(struct work_struct *work) + list_for_each_entry(cgr, &p->cgr_cbs, node) + if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid)) + cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid)); +- spin_unlock(&p->cgr_lock); ++ spin_unlock_irq(&p->cgr_lock); + qman_p_irqsource_add(p, QM_PIRQ_CSCI); + } + +@@ -2440,7 +2440,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, + preempt_enable(); + + cgr->chan = p->config->channel; +- spin_lock(&p->cgr_lock); ++ spin_lock_irq(&p->cgr_lock); + + if (opts) { + struct qm_mcc_initcgr local_opts = *opts; +@@ -2477,7 +2477,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, + qman_cgrs_get(&p->cgrs[1], cgr->cgrid)) + cgr->cb(p, cgr, 1); + out: +- spin_unlock(&p->cgr_lock); ++ spin_unlock_irq(&p->cgr_lock); + put_affine_portal(); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/soc-fsl-qbman-use-raw-spinlock-for-cgr_lock.patch b/queue-6.6/soc-fsl-qbman-use-raw-spinlock-for-cgr_lock.patch new file mode 100644 index 00000000000..f3fe88abd29 --- /dev/null +++ b/queue-6.6/soc-fsl-qbman-use-raw-spinlock-for-cgr_lock.patch @@ -0,0 +1,132 @@ +From 3bf8f61c1cb0bcf5c4c0b531ce6675c99554a905 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 12:38:30 -0400 +Subject: soc: fsl: qbman: Use raw spinlock for cgr_lock + +From: Sean Anderson + +[ Upstream commit fbec4e7fed89b579f2483041fabf9650fb0dd6bc ] + +smp_call_function always runs its callback in hard IRQ context, even on +PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock +for cgr_lock to ensure we aren't waiting on a sleeping task. + +Although this bug has existed for a while, it was not apparent until +commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change") +which invokes smp_call_function_single via qman_update_cgr_safe every +time a link goes up or down. + +Fixes: 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()") +CC: stable@vger.kernel.org +Reported-by: Vladimir Oltean +Closes: https://lore.kernel.org/all/20230323153935.nofnjucqjqnz34ej@skbuf/ +Reported-by: Steffen Trumtrar +Closes: https://lore.kernel.org/linux-arm-kernel/87wmsyvclu.fsf@pengutronix.de/ +Signed-off-by: Sean Anderson +Reviewed-by: Camelia Groza +Tested-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qbman/qman.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index 1bf1f1ea67f00..7e9074519ad22 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -991,7 +991,7 @@ struct qman_portal { + /* linked-list of CSCN handlers. */ + struct list_head cgr_cbs; + /* list lock */ +- spinlock_t cgr_lock; ++ raw_spinlock_t cgr_lock; + struct work_struct congestion_work; + struct work_struct mr_work; + char irqname[MAX_IRQNAME]; +@@ -1281,7 +1281,7 @@ static int qman_create_portal(struct qman_portal *portal, + /* if the given mask is NULL, assume all CGRs can be seen */ + qman_cgrs_fill(&portal->cgrs[0]); + INIT_LIST_HEAD(&portal->cgr_cbs); +- spin_lock_init(&portal->cgr_lock); ++ raw_spin_lock_init(&portal->cgr_lock); + INIT_WORK(&portal->congestion_work, qm_congestion_task); + INIT_WORK(&portal->mr_work, qm_mr_process_task); + portal->bits = 0; +@@ -1456,11 +1456,14 @@ static void qm_congestion_task(struct work_struct *work) + union qm_mc_result *mcr; + struct qman_cgr *cgr; + +- spin_lock_irq(&p->cgr_lock); ++ /* ++ * FIXME: QM_MCR_TIMEOUT is 10ms, which is too long for a raw spinlock! ++ */ ++ raw_spin_lock_irq(&p->cgr_lock); + qm_mc_start(&p->p); + qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION); + if (!qm_mc_result_timeout(&p->p, &mcr)) { +- spin_unlock_irq(&p->cgr_lock); ++ raw_spin_unlock_irq(&p->cgr_lock); + dev_crit(p->config->dev, "QUERYCONGESTION timeout\n"); + qman_p_irqsource_add(p, QM_PIRQ_CSCI); + return; +@@ -1476,7 +1479,7 @@ static void qm_congestion_task(struct work_struct *work) + list_for_each_entry(cgr, &p->cgr_cbs, node) + if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid)) + cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid)); +- spin_unlock_irq(&p->cgr_lock); ++ raw_spin_unlock_irq(&p->cgr_lock); + qman_p_irqsource_add(p, QM_PIRQ_CSCI); + } + +@@ -2440,7 +2443,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, + preempt_enable(); + + cgr->chan = p->config->channel; +- spin_lock_irq(&p->cgr_lock); ++ raw_spin_lock_irq(&p->cgr_lock); + + if (opts) { + struct qm_mcc_initcgr local_opts = *opts; +@@ -2477,7 +2480,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, + qman_cgrs_get(&p->cgrs[1], cgr->cgrid)) + cgr->cb(p, cgr, 1); + out: +- spin_unlock_irq(&p->cgr_lock); ++ raw_spin_unlock_irq(&p->cgr_lock); + put_affine_portal(); + return ret; + } +@@ -2512,7 +2515,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) + return -EINVAL; + + memset(&local_opts, 0, sizeof(struct qm_mcc_initcgr)); +- spin_lock_irqsave(&p->cgr_lock, irqflags); ++ raw_spin_lock_irqsave(&p->cgr_lock, irqflags); + list_del(&cgr->node); + /* + * If there are no other CGR objects for this CGRID in the list, +@@ -2537,7 +2540,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) + /* add back to the list */ + list_add(&cgr->node, &p->cgr_cbs); + release_lock: +- spin_unlock_irqrestore(&p->cgr_lock, irqflags); ++ raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags); + put_affine_portal(); + return ret; + } +@@ -2577,9 +2580,9 @@ static int qman_update_cgr(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts) + if (!p) + return -EINVAL; + +- spin_lock_irqsave(&p->cgr_lock, irqflags); ++ raw_spin_lock_irqsave(&p->cgr_lock, irqflags); + ret = qm_modify_cgr(cgr, 0, opts); +- spin_unlock_irqrestore(&p->cgr_lock, irqflags); ++ raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags); + put_affine_portal(); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/sparc-vdso-fix-return-value-of-__setup-handler.patch b/queue-6.6/sparc-vdso-fix-return-value-of-__setup-handler.patch new file mode 100644 index 00000000000..9e6ecef54ca --- /dev/null +++ b/queue-6.6/sparc-vdso-fix-return-value-of-__setup-handler.patch @@ -0,0 +1,57 @@ +From 1fd0a7c1146182121a5be9c34d76d5b73fb3c337 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 21:28:08 -0800 +Subject: sparc: vDSO: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit 5378f00c935bebb846b1fdb0e79cb76c137c56b5 ] + +__setup() handlers should return 1 to obsolete_checksetup() in +init/main.c to indicate that the boot option has been handled. +A return of 0 causes the boot option/value to be listed as an Unknown +kernel parameter and added to init's (limited) argument or environment +strings. Also, error return codes don't mean anything to +obsolete_checksetup() -- only non-zero (usually 1) or zero. +So return 1 from vdso_setup(). + +Fixes: 9a08862a5d2e ("vDSO for sparc") +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Cc: "David S. Miller" +Cc: sparclinux@vger.kernel.org +Cc: Dan Carpenter +Cc: Nick Alcock +Cc: Sam Ravnborg +Cc: Andrew Morton +Cc: stable@vger.kernel.org +Cc: Arnd Bergmann +Cc: Andreas Larsson +Signed-off-by: Andreas Larsson +Link: https://lore.kernel.org/r/20240211052808.22635-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/sparc/vdso/vma.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/vdso/vma.c b/arch/sparc/vdso/vma.c +index 136c78f28f8ba..1bbf4335de454 100644 +--- a/arch/sparc/vdso/vma.c ++++ b/arch/sparc/vdso/vma.c +@@ -449,9 +449,8 @@ static __init int vdso_setup(char *s) + unsigned long val; + + err = kstrtoul(s, 10, &val); +- if (err) +- return err; +- vdso_enabled = val; +- return 0; ++ if (!err) ++ vdso_enabled = val; ++ return 1; + } + __setup("vdso=", vdso_setup); +-- +2.43.0 + diff --git a/queue-6.6/sparc32-fix-parport-build-with-sparc32.patch b/queue-6.6/sparc32-fix-parport-build-with-sparc32.patch new file mode 100644 index 00000000000..12ec23d0c88 --- /dev/null +++ b/queue-6.6/sparc32-fix-parport-build-with-sparc32.patch @@ -0,0 +1,572 @@ +From 3780cc5fa5589ef6fd68fd4c4be369d5ad475ba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Feb 2024 18:42:27 +0100 +Subject: sparc32: Fix parport build with sparc32 + +From: Sam Ravnborg + +[ Upstream commit 91d3ff922c346d6d8cb8de5ff8d504fe0ca9e17e ] + +include/asm/parport.h is sparc64 specific. +Rename it to parport_64.h and use the generic version for sparc32. + +This fixed all{mod,yes}config build errors like: + +parport_pc.c:(.text):undefined-reference-to-ebus_dma_enable +parport_pc.c:(.text):undefined-reference-to-ebus_dma_irq_enable +parport_pc.c:(.text):undefined-reference-to-ebus_dma_register + +The errors occur as the sparc32 build references sparc64 symbols. + +Signed-off-by: Sam Ravnborg +Cc: "David S. Miller" +Cc: Andreas Larsson +Cc: Randy Dunlap +Cc: Maciej W. Rozycki +Closes: https://lore.kernel.org/r/20230406160548.25721-1-rdunlap@infradead.org/ +Fixes: 66bcd06099bb ("parport_pc: Also enable driver for PCI systems") +Cc: stable@vger.kernel.org # v5.18+ +Tested-by: Randy Dunlap # build-tested +Reviewed-by: Andreas Larsson +Signed-off-by: Andreas Larsson +Link: https://lore.kernel.org/r/20240224-sam-fix-sparc32-all-builds-v2-6-1f186603c5c4@ravnborg.org +Signed-off-by: Sasha Levin +--- + arch/sparc/include/asm/parport.h | 259 +--------------------------- + arch/sparc/include/asm/parport_64.h | 256 +++++++++++++++++++++++++++ + 2 files changed, 263 insertions(+), 252 deletions(-) + create mode 100644 arch/sparc/include/asm/parport_64.h + +diff --git a/arch/sparc/include/asm/parport.h b/arch/sparc/include/asm/parport.h +index 0a7ffcfd59cda..e2eed8f97665f 100644 +--- a/arch/sparc/include/asm/parport.h ++++ b/arch/sparc/include/asm/parport.h +@@ -1,256 +1,11 @@ + /* SPDX-License-Identifier: GPL-2.0 */ +-/* parport.h: sparc64 specific parport initialization and dma. +- * +- * Copyright (C) 1999 Eddie C. Dost (ecd@skynet.be) +- */ ++#ifndef ___ASM_SPARC_PARPORT_H ++#define ___ASM_SPARC_PARPORT_H + +-#ifndef _ASM_SPARC64_PARPORT_H +-#define _ASM_SPARC64_PARPORT_H 1 +- +-#include +-#include +- +-#include +-#include +-#include +- +-#define PARPORT_PC_MAX_PORTS PARPORT_MAX +- +-/* +- * While sparc64 doesn't have an ISA DMA API, we provide something that looks +- * close enough to make parport_pc happy +- */ +-#define HAS_DMA +- +-#ifdef CONFIG_PARPORT_PC_FIFO +-static DEFINE_SPINLOCK(dma_spin_lock); +- +-#define claim_dma_lock() \ +-({ unsigned long flags; \ +- spin_lock_irqsave(&dma_spin_lock, flags); \ +- flags; \ +-}) +- +-#define release_dma_lock(__flags) \ +- spin_unlock_irqrestore(&dma_spin_lock, __flags); ++#if defined(__sparc__) && defined(__arch64__) ++#include ++#else ++#include ++#endif + #endif + +-static struct sparc_ebus_info { +- struct ebus_dma_info info; +- unsigned int addr; +- unsigned int count; +- int lock; +- +- struct parport *port; +-} sparc_ebus_dmas[PARPORT_PC_MAX_PORTS]; +- +-static DECLARE_BITMAP(dma_slot_map, PARPORT_PC_MAX_PORTS); +- +-static inline int request_dma(unsigned int dmanr, const char *device_id) +-{ +- if (dmanr >= PARPORT_PC_MAX_PORTS) +- return -EINVAL; +- if (xchg(&sparc_ebus_dmas[dmanr].lock, 1) != 0) +- return -EBUSY; +- return 0; +-} +- +-static inline void free_dma(unsigned int dmanr) +-{ +- if (dmanr >= PARPORT_PC_MAX_PORTS) { +- printk(KERN_WARNING "Trying to free DMA%d\n", dmanr); +- return; +- } +- if (xchg(&sparc_ebus_dmas[dmanr].lock, 0) == 0) { +- printk(KERN_WARNING "Trying to free free DMA%d\n", dmanr); +- return; +- } +-} +- +-static inline void enable_dma(unsigned int dmanr) +-{ +- ebus_dma_enable(&sparc_ebus_dmas[dmanr].info, 1); +- +- if (ebus_dma_request(&sparc_ebus_dmas[dmanr].info, +- sparc_ebus_dmas[dmanr].addr, +- sparc_ebus_dmas[dmanr].count)) +- BUG(); +-} +- +-static inline void disable_dma(unsigned int dmanr) +-{ +- ebus_dma_enable(&sparc_ebus_dmas[dmanr].info, 0); +-} +- +-static inline void clear_dma_ff(unsigned int dmanr) +-{ +- /* nothing */ +-} +- +-static inline void set_dma_mode(unsigned int dmanr, char mode) +-{ +- ebus_dma_prepare(&sparc_ebus_dmas[dmanr].info, (mode != DMA_MODE_WRITE)); +-} +- +-static inline void set_dma_addr(unsigned int dmanr, unsigned int addr) +-{ +- sparc_ebus_dmas[dmanr].addr = addr; +-} +- +-static inline void set_dma_count(unsigned int dmanr, unsigned int count) +-{ +- sparc_ebus_dmas[dmanr].count = count; +-} +- +-static inline unsigned int get_dma_residue(unsigned int dmanr) +-{ +- return ebus_dma_residue(&sparc_ebus_dmas[dmanr].info); +-} +- +-static int ecpp_probe(struct platform_device *op) +-{ +- unsigned long base = op->resource[0].start; +- unsigned long config = op->resource[1].start; +- unsigned long d_base = op->resource[2].start; +- unsigned long d_len; +- struct device_node *parent; +- struct parport *p; +- int slot, err; +- +- parent = op->dev.of_node->parent; +- if (of_node_name_eq(parent, "dma")) { +- p = parport_pc_probe_port(base, base + 0x400, +- op->archdata.irqs[0], PARPORT_DMA_NOFIFO, +- op->dev.parent->parent, 0); +- if (!p) +- return -ENOMEM; +- dev_set_drvdata(&op->dev, p); +- return 0; +- } +- +- for (slot = 0; slot < PARPORT_PC_MAX_PORTS; slot++) { +- if (!test_and_set_bit(slot, dma_slot_map)) +- break; +- } +- err = -ENODEV; +- if (slot >= PARPORT_PC_MAX_PORTS) +- goto out_err; +- +- spin_lock_init(&sparc_ebus_dmas[slot].info.lock); +- +- d_len = (op->resource[2].end - d_base) + 1UL; +- sparc_ebus_dmas[slot].info.regs = +- of_ioremap(&op->resource[2], 0, d_len, "ECPP DMA"); +- +- if (!sparc_ebus_dmas[slot].info.regs) +- goto out_clear_map; +- +- sparc_ebus_dmas[slot].info.flags = 0; +- sparc_ebus_dmas[slot].info.callback = NULL; +- sparc_ebus_dmas[slot].info.client_cookie = NULL; +- sparc_ebus_dmas[slot].info.irq = 0xdeadbeef; +- strcpy(sparc_ebus_dmas[slot].info.name, "parport"); +- if (ebus_dma_register(&sparc_ebus_dmas[slot].info)) +- goto out_unmap_regs; +- +- ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 1); +- +- /* Configure IRQ to Push Pull, Level Low */ +- /* Enable ECP, set bit 2 of the CTR first */ +- outb(0x04, base + 0x02); +- ns87303_modify(config, PCR, +- PCR_EPP_ENABLE | +- PCR_IRQ_ODRAIN, +- PCR_ECP_ENABLE | +- PCR_ECP_CLK_ENA | +- PCR_IRQ_POLAR); +- +- /* CTR bit 5 controls direction of port */ +- ns87303_modify(config, PTR, +- 0, PTR_LPT_REG_DIR); +- +- p = parport_pc_probe_port(base, base + 0x400, +- op->archdata.irqs[0], +- slot, +- op->dev.parent, +- 0); +- err = -ENOMEM; +- if (!p) +- goto out_disable_irq; +- +- dev_set_drvdata(&op->dev, p); +- +- return 0; +- +-out_disable_irq: +- ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 0); +- ebus_dma_unregister(&sparc_ebus_dmas[slot].info); +- +-out_unmap_regs: +- of_iounmap(&op->resource[2], sparc_ebus_dmas[slot].info.regs, d_len); +- +-out_clear_map: +- clear_bit(slot, dma_slot_map); +- +-out_err: +- return err; +-} +- +-static int ecpp_remove(struct platform_device *op) +-{ +- struct parport *p = dev_get_drvdata(&op->dev); +- int slot = p->dma; +- +- parport_pc_unregister_port(p); +- +- if (slot != PARPORT_DMA_NOFIFO) { +- unsigned long d_base = op->resource[2].start; +- unsigned long d_len; +- +- d_len = (op->resource[2].end - d_base) + 1UL; +- +- ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 0); +- ebus_dma_unregister(&sparc_ebus_dmas[slot].info); +- of_iounmap(&op->resource[2], +- sparc_ebus_dmas[slot].info.regs, +- d_len); +- clear_bit(slot, dma_slot_map); +- } +- +- return 0; +-} +- +-static const struct of_device_id ecpp_match[] = { +- { +- .name = "ecpp", +- }, +- { +- .name = "parallel", +- .compatible = "ecpp", +- }, +- { +- .name = "parallel", +- .compatible = "ns87317-ecpp", +- }, +- { +- .name = "parallel", +- .compatible = "pnpALI,1533,3", +- }, +- {}, +-}; +- +-static struct platform_driver ecpp_driver = { +- .driver = { +- .name = "ecpp", +- .of_match_table = ecpp_match, +- }, +- .probe = ecpp_probe, +- .remove = ecpp_remove, +-}; +- +-static int parport_pc_find_nonpci_ports(int autoirq, int autodma) +-{ +- return platform_driver_register(&ecpp_driver); +-} +- +-#endif /* !(_ASM_SPARC64_PARPORT_H */ +diff --git a/arch/sparc/include/asm/parport_64.h b/arch/sparc/include/asm/parport_64.h +new file mode 100644 +index 0000000000000..0a7ffcfd59cda +--- /dev/null ++++ b/arch/sparc/include/asm/parport_64.h +@@ -0,0 +1,256 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++/* parport.h: sparc64 specific parport initialization and dma. ++ * ++ * Copyright (C) 1999 Eddie C. Dost (ecd@skynet.be) ++ */ ++ ++#ifndef _ASM_SPARC64_PARPORT_H ++#define _ASM_SPARC64_PARPORT_H 1 ++ ++#include ++#include ++ ++#include ++#include ++#include ++ ++#define PARPORT_PC_MAX_PORTS PARPORT_MAX ++ ++/* ++ * While sparc64 doesn't have an ISA DMA API, we provide something that looks ++ * close enough to make parport_pc happy ++ */ ++#define HAS_DMA ++ ++#ifdef CONFIG_PARPORT_PC_FIFO ++static DEFINE_SPINLOCK(dma_spin_lock); ++ ++#define claim_dma_lock() \ ++({ unsigned long flags; \ ++ spin_lock_irqsave(&dma_spin_lock, flags); \ ++ flags; \ ++}) ++ ++#define release_dma_lock(__flags) \ ++ spin_unlock_irqrestore(&dma_spin_lock, __flags); ++#endif ++ ++static struct sparc_ebus_info { ++ struct ebus_dma_info info; ++ unsigned int addr; ++ unsigned int count; ++ int lock; ++ ++ struct parport *port; ++} sparc_ebus_dmas[PARPORT_PC_MAX_PORTS]; ++ ++static DECLARE_BITMAP(dma_slot_map, PARPORT_PC_MAX_PORTS); ++ ++static inline int request_dma(unsigned int dmanr, const char *device_id) ++{ ++ if (dmanr >= PARPORT_PC_MAX_PORTS) ++ return -EINVAL; ++ if (xchg(&sparc_ebus_dmas[dmanr].lock, 1) != 0) ++ return -EBUSY; ++ return 0; ++} ++ ++static inline void free_dma(unsigned int dmanr) ++{ ++ if (dmanr >= PARPORT_PC_MAX_PORTS) { ++ printk(KERN_WARNING "Trying to free DMA%d\n", dmanr); ++ return; ++ } ++ if (xchg(&sparc_ebus_dmas[dmanr].lock, 0) == 0) { ++ printk(KERN_WARNING "Trying to free free DMA%d\n", dmanr); ++ return; ++ } ++} ++ ++static inline void enable_dma(unsigned int dmanr) ++{ ++ ebus_dma_enable(&sparc_ebus_dmas[dmanr].info, 1); ++ ++ if (ebus_dma_request(&sparc_ebus_dmas[dmanr].info, ++ sparc_ebus_dmas[dmanr].addr, ++ sparc_ebus_dmas[dmanr].count)) ++ BUG(); ++} ++ ++static inline void disable_dma(unsigned int dmanr) ++{ ++ ebus_dma_enable(&sparc_ebus_dmas[dmanr].info, 0); ++} ++ ++static inline void clear_dma_ff(unsigned int dmanr) ++{ ++ /* nothing */ ++} ++ ++static inline void set_dma_mode(unsigned int dmanr, char mode) ++{ ++ ebus_dma_prepare(&sparc_ebus_dmas[dmanr].info, (mode != DMA_MODE_WRITE)); ++} ++ ++static inline void set_dma_addr(unsigned int dmanr, unsigned int addr) ++{ ++ sparc_ebus_dmas[dmanr].addr = addr; ++} ++ ++static inline void set_dma_count(unsigned int dmanr, unsigned int count) ++{ ++ sparc_ebus_dmas[dmanr].count = count; ++} ++ ++static inline unsigned int get_dma_residue(unsigned int dmanr) ++{ ++ return ebus_dma_residue(&sparc_ebus_dmas[dmanr].info); ++} ++ ++static int ecpp_probe(struct platform_device *op) ++{ ++ unsigned long base = op->resource[0].start; ++ unsigned long config = op->resource[1].start; ++ unsigned long d_base = op->resource[2].start; ++ unsigned long d_len; ++ struct device_node *parent; ++ struct parport *p; ++ int slot, err; ++ ++ parent = op->dev.of_node->parent; ++ if (of_node_name_eq(parent, "dma")) { ++ p = parport_pc_probe_port(base, base + 0x400, ++ op->archdata.irqs[0], PARPORT_DMA_NOFIFO, ++ op->dev.parent->parent, 0); ++ if (!p) ++ return -ENOMEM; ++ dev_set_drvdata(&op->dev, p); ++ return 0; ++ } ++ ++ for (slot = 0; slot < PARPORT_PC_MAX_PORTS; slot++) { ++ if (!test_and_set_bit(slot, dma_slot_map)) ++ break; ++ } ++ err = -ENODEV; ++ if (slot >= PARPORT_PC_MAX_PORTS) ++ goto out_err; ++ ++ spin_lock_init(&sparc_ebus_dmas[slot].info.lock); ++ ++ d_len = (op->resource[2].end - d_base) + 1UL; ++ sparc_ebus_dmas[slot].info.regs = ++ of_ioremap(&op->resource[2], 0, d_len, "ECPP DMA"); ++ ++ if (!sparc_ebus_dmas[slot].info.regs) ++ goto out_clear_map; ++ ++ sparc_ebus_dmas[slot].info.flags = 0; ++ sparc_ebus_dmas[slot].info.callback = NULL; ++ sparc_ebus_dmas[slot].info.client_cookie = NULL; ++ sparc_ebus_dmas[slot].info.irq = 0xdeadbeef; ++ strcpy(sparc_ebus_dmas[slot].info.name, "parport"); ++ if (ebus_dma_register(&sparc_ebus_dmas[slot].info)) ++ goto out_unmap_regs; ++ ++ ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 1); ++ ++ /* Configure IRQ to Push Pull, Level Low */ ++ /* Enable ECP, set bit 2 of the CTR first */ ++ outb(0x04, base + 0x02); ++ ns87303_modify(config, PCR, ++ PCR_EPP_ENABLE | ++ PCR_IRQ_ODRAIN, ++ PCR_ECP_ENABLE | ++ PCR_ECP_CLK_ENA | ++ PCR_IRQ_POLAR); ++ ++ /* CTR bit 5 controls direction of port */ ++ ns87303_modify(config, PTR, ++ 0, PTR_LPT_REG_DIR); ++ ++ p = parport_pc_probe_port(base, base + 0x400, ++ op->archdata.irqs[0], ++ slot, ++ op->dev.parent, ++ 0); ++ err = -ENOMEM; ++ if (!p) ++ goto out_disable_irq; ++ ++ dev_set_drvdata(&op->dev, p); ++ ++ return 0; ++ ++out_disable_irq: ++ ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 0); ++ ebus_dma_unregister(&sparc_ebus_dmas[slot].info); ++ ++out_unmap_regs: ++ of_iounmap(&op->resource[2], sparc_ebus_dmas[slot].info.regs, d_len); ++ ++out_clear_map: ++ clear_bit(slot, dma_slot_map); ++ ++out_err: ++ return err; ++} ++ ++static int ecpp_remove(struct platform_device *op) ++{ ++ struct parport *p = dev_get_drvdata(&op->dev); ++ int slot = p->dma; ++ ++ parport_pc_unregister_port(p); ++ ++ if (slot != PARPORT_DMA_NOFIFO) { ++ unsigned long d_base = op->resource[2].start; ++ unsigned long d_len; ++ ++ d_len = (op->resource[2].end - d_base) + 1UL; ++ ++ ebus_dma_irq_enable(&sparc_ebus_dmas[slot].info, 0); ++ ebus_dma_unregister(&sparc_ebus_dmas[slot].info); ++ of_iounmap(&op->resource[2], ++ sparc_ebus_dmas[slot].info.regs, ++ d_len); ++ clear_bit(slot, dma_slot_map); ++ } ++ ++ return 0; ++} ++ ++static const struct of_device_id ecpp_match[] = { ++ { ++ .name = "ecpp", ++ }, ++ { ++ .name = "parallel", ++ .compatible = "ecpp", ++ }, ++ { ++ .name = "parallel", ++ .compatible = "ns87317-ecpp", ++ }, ++ { ++ .name = "parallel", ++ .compatible = "pnpALI,1533,3", ++ }, ++ {}, ++}; ++ ++static struct platform_driver ecpp_driver = { ++ .driver = { ++ .name = "ecpp", ++ .of_match_table = ecpp_match, ++ }, ++ .probe = ecpp_probe, ++ .remove = ecpp_remove, ++}; ++ ++static int parport_pc_find_nonpci_ports(int autoirq, int autodma) ++{ ++ return platform_driver_register(&ecpp_driver); ++} ++ ++#endif /* !(_ASM_SPARC64_PARPORT_H */ +-- +2.43.0 + diff --git a/queue-6.6/sparc64-nmi-watchdog-fix-return-value-of-__setup-han.patch b/queue-6.6/sparc64-nmi-watchdog-fix-return-value-of-__setup-han.patch new file mode 100644 index 00000000000..cf3cdaf5c20 --- /dev/null +++ b/queue-6.6/sparc64-nmi-watchdog-fix-return-value-of-__setup-han.patch @@ -0,0 +1,51 @@ +From 3b4dc3c664cdfa6e9738e7e8868197a82bec8d1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 21:28:02 -0800 +Subject: sparc64: NMI watchdog: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit 3ed7c61e49d65dacb96db798c0ab6fcd55a1f20f ] + +__setup() handlers should return 1 to obsolete_checksetup() in +init/main.c to indicate that the boot option has been handled. +A return of 0 causes the boot option/value to be listed as an Unknown +kernel parameter and added to init's (limited) argument or environment +strings. Also, error return codes don't mean anything to +obsolete_checksetup() -- only non-zero (usually 1) or zero. +So return 1 from setup_nmi_watchdog(). + +Fixes: e5553a6d0442 ("sparc64: Implement NMI watchdog on capable cpus.") +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Cc: "David S. Miller" +Cc: sparclinux@vger.kernel.org +Cc: Sam Ravnborg +Cc: Andrew Morton +Cc: stable@vger.kernel.org +Cc: Arnd Bergmann +Cc: Andreas Larsson +Signed-off-by: Andreas Larsson +Link: https://lore.kernel.org/r/20240211052802.22612-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/nmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c +index 17cdfdbf1f3b7..149adc0947530 100644 +--- a/arch/sparc/kernel/nmi.c ++++ b/arch/sparc/kernel/nmi.c +@@ -279,7 +279,7 @@ static int __init setup_nmi_watchdog(char *str) + if (!strncmp(str, "panic", 5)) + panic_on_timeout = 1; + +- return 0; ++ return 1; + } + __setup("nmi_watchdog=", setup_nmi_watchdog); + +-- +2.43.0 + diff --git a/queue-6.6/speakup-fix-8bit-characters-from-direct-synth.patch b/queue-6.6/speakup-fix-8bit-characters-from-direct-synth.patch new file mode 100644 index 00000000000..a64f515f13d --- /dev/null +++ b/queue-6.6/speakup-fix-8bit-characters-from-direct-synth.patch @@ -0,0 +1,49 @@ +From bf6b2b071a3e862729de5cf171febbbd6a343e61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Feb 2024 16:57:36 +0100 +Subject: speakup: Fix 8bit characters from direct synth + +From: Samuel Thibault + +[ Upstream commit b6c8dafc9d86eb77e502bb018ec4105e8d2fbf78 ] + +When userland echoes 8bit characters to /dev/synth with e.g. + +echo -e '\xe9' > /dev/synth + +synth_write would get characters beyond 0x7f, and thus negative when +char is signed. When given to synth_buffer_add which takes a u16, this +would sign-extend and produce a U+ffxy character rather than U+xy. +Users thus get garbled text instead of accents in their output. + +Let's fix this by making sure that we read unsigned characters. + +Signed-off-by: Samuel Thibault +Fixes: 89fc2ae80bb1 ("speakup: extend synth buffer to 16bit unicode characters") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240204155736.2oh4ot7tiaa2wpbh@begin +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/accessibility/speakup/synth.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/accessibility/speakup/synth.c b/drivers/accessibility/speakup/synth.c +index eea2a2fa4f015..45f9061031338 100644 +--- a/drivers/accessibility/speakup/synth.c ++++ b/drivers/accessibility/speakup/synth.c +@@ -208,8 +208,10 @@ void spk_do_flush(void) + wake_up_process(speakup_task); + } + +-void synth_write(const char *buf, size_t count) ++void synth_write(const char *_buf, size_t count) + { ++ const unsigned char *buf = (const unsigned char *) _buf; ++ + while (count--) + synth_buffer_add(*buf++); + synth_start(); +-- +2.43.0 + diff --git a/queue-6.6/thermal-drivers-mediatek-fix-control-buffer-enableme.patch b/queue-6.6/thermal-drivers-mediatek-fix-control-buffer-enableme.patch new file mode 100644 index 00000000000..5c8970240d9 --- /dev/null +++ b/queue-6.6/thermal-drivers-mediatek-fix-control-buffer-enableme.patch @@ -0,0 +1,48 @@ +From 2ecc682d55ec6aff1bea06ad414232d8d606b4bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Sep 2023 13:20:18 +0200 +Subject: thermal/drivers/mediatek: Fix control buffer enablement on MT7896 + +From: Frank Wunderlich + +[ Upstream commit 371ed6263e2403068b359f0c07188548c2d70827 ] + +Reading thermal sensor on mt7986 devices returns invalid temperature: + +bpi-r3 ~ # cat /sys/class/thermal/thermal_zone0/temp + -274000 + +Fix this by adding missing members in mtk_thermal_data struct which were +used in mtk_thermal_turn_on_buffer after commit 33140e668b10. + +Cc: stable@vger.kernel.org +Fixes: 33140e668b10 ("thermal/drivers/mediatek: Control buffer enablement tweaks") +Signed-off-by: Frank Wunderlich +Reviewed-by: Markus Schneider-Pargmann +Reviewed-by: Daniel Golle +Tested-by: Daniel Golle +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20230907112018.52811-1-linux@fw-web.de +Signed-off-by: Sasha Levin +--- + drivers/thermal/mediatek/auxadc_thermal.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/thermal/mediatek/auxadc_thermal.c b/drivers/thermal/mediatek/auxadc_thermal.c +index 8b0edb2048443..9ee2e7283435a 100644 +--- a/drivers/thermal/mediatek/auxadc_thermal.c ++++ b/drivers/thermal/mediatek/auxadc_thermal.c +@@ -690,6 +690,9 @@ static const struct mtk_thermal_data mt7986_thermal_data = { + .adcpnp = mt7986_adcpnp, + .sensor_mux_values = mt7986_mux_values, + .version = MTK_THERMAL_V3, ++ .apmixed_buffer_ctl_reg = APMIXED_SYS_TS_CON1, ++ .apmixed_buffer_ctl_mask = GENMASK(31, 6) | BIT(3), ++ .apmixed_buffer_ctl_set = BIT(0), + }; + + static bool mtk_thermal_temp_is_valid(int temp) +-- +2.43.0 + diff --git a/queue-6.6/thermal-intel-fix-intel_tcc_get_temp-to-support-nega.patch b/queue-6.6/thermal-intel-fix-intel_tcc_get_temp-to-support-nega.patch new file mode 100644 index 00000000000..81bc2f03dcc --- /dev/null +++ b/queue-6.6/thermal-intel-fix-intel_tcc_get_temp-to-support-nega.patch @@ -0,0 +1,126 @@ +From fe94e559aec9b19ae8b4c56333c2538e73a4991f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 09:54:09 +0800 +Subject: thermal/intel: Fix intel_tcc_get_temp() to support negative CPU + temperature + +From: Zhang Rui + +[ Upstream commit 7251b9e8a007ddd834aa81f8c7ea338884629fec ] + +CPU temperature can be negative in some cases. Thus the negative CPU +temperature should not be considered as a failure. + +Fix intel_tcc_get_temp() and its users to support negative CPU +temperature. + +Fixes: a3c1f066e1c5 ("thermal/intel: Introduce Intel TCC library") +Signed-off-by: Zhang Rui +Reviewed-by: Stanislaw Gruszka +Cc: 6.3+ # 6.3+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + .../intel/int340x_thermal/processor_thermal_device.c | 8 ++++---- + drivers/thermal/intel/intel_tcc.c | 12 ++++++------ + drivers/thermal/intel/x86_pkg_temp_thermal.c | 8 ++++---- + include/linux/intel_tcc.h | 2 +- + 4 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c +index 3ca0a2f5937f2..cdf88cadfc4f1 100644 +--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c ++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c +@@ -113,14 +113,14 @@ static int proc_thermal_get_zone_temp(struct thermal_zone_device *zone, + int *temp) + { + int cpu; +- int curr_temp; ++ int curr_temp, ret; + + *temp = 0; + + for_each_online_cpu(cpu) { +- curr_temp = intel_tcc_get_temp(cpu, false); +- if (curr_temp < 0) +- return curr_temp; ++ ret = intel_tcc_get_temp(cpu, &curr_temp, false); ++ if (ret < 0) ++ return ret; + if (!*temp || curr_temp > *temp) + *temp = curr_temp; + } +diff --git a/drivers/thermal/intel/intel_tcc.c b/drivers/thermal/intel/intel_tcc.c +index 2e5c741c41ca0..5e8b7f34b3951 100644 +--- a/drivers/thermal/intel/intel_tcc.c ++++ b/drivers/thermal/intel/intel_tcc.c +@@ -103,18 +103,19 @@ EXPORT_SYMBOL_NS_GPL(intel_tcc_set_offset, INTEL_TCC); + /** + * intel_tcc_get_temp() - returns the current temperature + * @cpu: cpu that the MSR should be run on, nagative value means any cpu. ++ * @temp: pointer to the memory for saving cpu temperature. + * @pkg: true: Package Thermal Sensor. false: Core Thermal Sensor. + * + * Get the current temperature returned by the CPU core/package level + * thermal sensor, in degrees C. + * +- * Return: Temperature in degrees C on success, negative error code otherwise. ++ * Return: 0 on success, negative error code otherwise. + */ +-int intel_tcc_get_temp(int cpu, bool pkg) ++int intel_tcc_get_temp(int cpu, int *temp, bool pkg) + { + u32 low, high; + u32 msr = pkg ? MSR_IA32_PACKAGE_THERM_STATUS : MSR_IA32_THERM_STATUS; +- int tjmax, temp, err; ++ int tjmax, err; + + tjmax = intel_tcc_get_tjmax(cpu); + if (tjmax < 0) +@@ -131,9 +132,8 @@ int intel_tcc_get_temp(int cpu, bool pkg) + if (!(low & BIT(31))) + return -ENODATA; + +- temp = tjmax - ((low >> 16) & 0x7f); ++ *temp = tjmax - ((low >> 16) & 0x7f); + +- /* Do not allow negative CPU temperature */ +- return temp >= 0 ? temp : -ENODATA; ++ return 0; + } + EXPORT_SYMBOL_NS_GPL(intel_tcc_get_temp, INTEL_TCC); +diff --git a/drivers/thermal/intel/x86_pkg_temp_thermal.c b/drivers/thermal/intel/x86_pkg_temp_thermal.c +index 11a7f8108bbbf..61c3d450ee605 100644 +--- a/drivers/thermal/intel/x86_pkg_temp_thermal.c ++++ b/drivers/thermal/intel/x86_pkg_temp_thermal.c +@@ -108,11 +108,11 @@ static struct zone_device *pkg_temp_thermal_get_dev(unsigned int cpu) + static int sys_get_curr_temp(struct thermal_zone_device *tzd, int *temp) + { + struct zone_device *zonedev = thermal_zone_device_priv(tzd); +- int val; ++ int val, ret; + +- val = intel_tcc_get_temp(zonedev->cpu, true); +- if (val < 0) +- return val; ++ ret = intel_tcc_get_temp(zonedev->cpu, &val, true); ++ if (ret < 0) ++ return ret; + + *temp = val * 1000; + pr_debug("sys_get_curr_temp %d\n", *temp); +diff --git a/include/linux/intel_tcc.h b/include/linux/intel_tcc.h +index f422612c28d6b..8ff8eabb4a987 100644 +--- a/include/linux/intel_tcc.h ++++ b/include/linux/intel_tcc.h +@@ -13,6 +13,6 @@ + int intel_tcc_get_tjmax(int cpu); + int intel_tcc_get_offset(int cpu); + int intel_tcc_set_offset(int cpu, int offset); +-int intel_tcc_get_temp(int cpu, bool pkg); ++int intel_tcc_get_temp(int cpu, int *temp, bool pkg); + + #endif /* __INTEL_TCC_H__ */ +-- +2.43.0 + diff --git a/queue-6.6/tpm-tpm_tis-avoid-warning-splat-at-shutdown.patch b/queue-6.6/tpm-tpm_tis-avoid-warning-splat-at-shutdown.patch new file mode 100644 index 00000000000..d020006ee88 --- /dev/null +++ b/queue-6.6/tpm-tpm_tis-avoid-warning-splat-at-shutdown.patch @@ -0,0 +1,50 @@ +From ab34ccd495f14c64d108f23c103bc59882ff5875 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 12:36:45 +0100 +Subject: tpm,tpm_tis: Avoid warning splat at shutdown + +From: Lino Sanfilippo + +[ Upstream commit b7ab4bbd0188f3985b821fa09456b11105a8dedf ] + +If interrupts are not activated the work struct 'free_irq_work' is not +initialized. This results in a warning splat at module shutdown. + +Fix this by always initializing the work regardless of whether interrupts +are activated or not. + +cc: stable@vger.kernel.org +Fixes: 481c2d14627d ("tpm,tpm_tis: Disable interrupts after 1000 unhandled IRQs") +Reported-by: Jarkko Sakkinen +Closes: https://lore.kernel.org/all/CX32RFOMJUQ0.3R4YCL9MDCB96@kernel.org/ +Signed-off-by: Lino Sanfilippo +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 1b350412d8a6b..64c875657687d 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -919,8 +919,6 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + int rc; + u32 int_status; + +- INIT_WORK(&priv->free_irq_work, tpm_tis_free_irq_func); +- + rc = devm_request_threaded_irq(chip->dev.parent, irq, NULL, + tis_int_handler, IRQF_ONESHOT | flags, + dev_name(&chip->dev), chip); +@@ -1132,6 +1130,7 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + priv->phy_ops = phy_ops; + priv->locality_count = 0; + mutex_init(&priv->locality_count_mutex); ++ INIT_WORK(&priv->free_irq_work, tpm_tis_free_irq_func); + + dev_set_drvdata(&chip->dev, priv); + +-- +2.43.0 + diff --git a/queue-6.6/ubi-check-for-too-small-leb-size-in-vtbl-code.patch b/queue-6.6/ubi-check-for-too-small-leb-size-in-vtbl-code.patch new file mode 100644 index 00000000000..a6d9545755c --- /dev/null +++ b/queue-6.6/ubi-check-for-too-small-leb-size-in-vtbl-code.patch @@ -0,0 +1,45 @@ +From ae42121b0cffa26a09c4402d42710324e762c36c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 07:37:02 +0100 +Subject: ubi: Check for too small LEB size in VTBL code + +From: Richard Weinberger + +[ Upstream commit 68a24aba7c593eafa8fd00f2f76407b9b32b47a9 ] + +If the LEB size is smaller than a volume table record we cannot +have volumes. +In this case abort attaching. + +Cc: Chenyuan Yang +Cc: stable@vger.kernel.org +Fixes: 801c135ce73d ("UBI: Unsorted Block Images") +Reported-by: Chenyuan Yang +Closes: https://lore.kernel.org/linux-mtd/1433EB7A-FC89-47D6-8F47-23BE41B263B3@illinois.edu/ +Signed-off-by: Richard Weinberger +Reviewed-by: Zhihao Cheng +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/vtbl.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c +index f700f0e4f2ec4..6e5489e233dd2 100644 +--- a/drivers/mtd/ubi/vtbl.c ++++ b/drivers/mtd/ubi/vtbl.c +@@ -791,6 +791,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai) + * The number of supported volumes is limited by the eraseblock size + * and by the UBI_MAX_VOLUMES constant. + */ ++ ++ if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) { ++ ubi_err(ubi, "LEB size too small for a volume record"); ++ return -EINVAL; ++ } ++ + ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE; + if (ubi->vtbl_slots > UBI_MAX_VOLUMES) + ubi->vtbl_slots = UBI_MAX_VOLUMES; +-- +2.43.0 + diff --git a/queue-6.6/ubi-correct-the-calculation-of-fastmap-size.patch b/queue-6.6/ubi-correct-the-calculation-of-fastmap-size.patch new file mode 100644 index 00000000000..0f99bee6566 --- /dev/null +++ b/queue-6.6/ubi-correct-the-calculation-of-fastmap-size.patch @@ -0,0 +1,43 @@ +From ae970e8876d4480bea9feab2ff5bef66afe850f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 10:49:03 +0800 +Subject: ubi: correct the calculation of fastmap size + +From: Zhang Yi + +[ Upstream commit 7f174ae4f39e8475adcc09d26c5a43394689ad6c ] + +Now that the calculation of fastmap size in ubi_calc_fm_size() is +incorrect since it miss each user volume's ubi_fm_eba structure and the +Internal UBI volume info. Let's correct the calculation. + +Cc: stable@vger.kernel.org +Signed-off-by: Zhang Yi +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/fastmap.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c +index 28c8151a0725d..2cdc29483aee0 100644 +--- a/drivers/mtd/ubi/fastmap.c ++++ b/drivers/mtd/ubi/fastmap.c +@@ -85,9 +85,10 @@ size_t ubi_calc_fm_size(struct ubi_device *ubi) + sizeof(struct ubi_fm_scan_pool) + + sizeof(struct ubi_fm_scan_pool) + + (ubi->peb_count * sizeof(struct ubi_fm_ec)) + +- (sizeof(struct ubi_fm_eba) + +- (ubi->peb_count * sizeof(__be32))) + +- sizeof(struct ubi_fm_volhdr) * UBI_MAX_VOLUMES; ++ ((sizeof(struct ubi_fm_eba) + ++ sizeof(struct ubi_fm_volhdr)) * ++ (UBI_MAX_VOLUMES + UBI_INT_VOL_COUNT)) + ++ (ubi->peb_count * sizeof(__be32)); + return roundup(size, ubi->leb_size); + } + +-- +2.43.0 + diff --git a/queue-6.6/ubifs-set-page-uptodate-in-the-correct-place.patch b/queue-6.6/ubifs-set-page-uptodate-in-the-correct-place.patch new file mode 100644 index 00000000000..64625933f36 --- /dev/null +++ b/queue-6.6/ubifs-set-page-uptodate-in-the-correct-place.patch @@ -0,0 +1,74 @@ +From 715a0dc96253c5096fa7ab769e2b44d39bbad10f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 17:52:44 +0000 +Subject: ubifs: Set page uptodate in the correct place + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 723012cab779eee8228376754e22c6594229bf8f ] + +Page cache reads are lockless, so setting the freshly allocated page +uptodate before we've overwritten it with the data it's supposed to have +in it will allow a simultaneous reader to see old data. Move the call +to SetPageUptodate into ubifs_write_end(), which is after we copied the +new data into the page. + +Fixes: 1e51764a3c2a ("UBIFS: add new flash file system") +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/file.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c +index e5382f0b25878..781206d0ec845 100644 +--- a/fs/ubifs/file.c ++++ b/fs/ubifs/file.c +@@ -261,9 +261,6 @@ static int write_begin_slow(struct address_space *mapping, + return err; + } + } +- +- SetPageUptodate(page); +- ClearPageError(page); + } + + if (PagePrivate(page)) +@@ -462,9 +459,6 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping, + return err; + } + } +- +- SetPageUptodate(page); +- ClearPageError(page); + } + + err = allocate_budget(c, page, ui, appending); +@@ -474,10 +468,8 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping, + * If we skipped reading the page because we were going to + * write all of it, then it is not up to date. + */ +- if (skipped_read) { ++ if (skipped_read) + ClearPageChecked(page); +- ClearPageUptodate(page); +- } + /* + * Budgeting failed which means it would have to force + * write-back but didn't, because we set the @fast flag in the +@@ -568,6 +560,9 @@ static int ubifs_write_end(struct file *file, struct address_space *mapping, + goto out; + } + ++ if (len == PAGE_SIZE) ++ SetPageUptodate(page); ++ + if (!PagePrivate(page)) { + attach_page_private(page, (void *)1); + atomic_long_inc(&c->dirty_pg_cnt); +-- +2.43.0 + diff --git a/queue-6.6/usb-dwc3-am62-disable-wakeup-at-remove.patch b/queue-6.6/usb-dwc3-am62-disable-wakeup-at-remove.patch new file mode 100644 index 00000000000..f4deba6e2e6 --- /dev/null +++ b/queue-6.6/usb-dwc3-am62-disable-wakeup-at-remove.patch @@ -0,0 +1,40 @@ +From 14a8c33d64828897382b42c1dcf8c7337ce7d444 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 11:23:49 +0200 +Subject: usb: dwc3-am62: Disable wakeup at remove + +From: Roger Quadros + +[ Upstream commit 4ead695e6b3cac06543d7bc7241ab75aee4ea6a6 ] + +Disable wakeup at remove. +Fixes the below warnings on module unload and reload. + +> dwc3-am62 f900000.dwc3-usb: couldn't enable device as a wakeup source: -17 +> dwc3-am62 f910000.dwc3-usb: couldn't enable device as a wakeup source: -17 + +Fixes: 4e3972b589da ("usb: dwc3-am62: Enable as a wakeup source by default") +Cc: stable@vger.kernel.org # v6.4+ +Signed-off-by: Roger Quadros +Link: https://lore.kernel.org/r/20240227-for-v6-9-am62-usb-errata-3-0-v4-2-0ada8ddb0767@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-am62.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/dwc3/dwc3-am62.c b/drivers/usb/dwc3/dwc3-am62.c +index f85603b7f7c5e..ea6e29091c0c9 100644 +--- a/drivers/usb/dwc3/dwc3-am62.c ++++ b/drivers/usb/dwc3/dwc3-am62.c +@@ -274,6 +274,7 @@ static void dwc3_ti_remove(struct platform_device *pdev) + u32 reg; + + pm_runtime_get_sync(dev); ++ device_init_wakeup(dev, false); + of_platform_depopulate(dev); + + /* Clear mode valid bit */ +-- +2.43.0 + diff --git a/queue-6.6/usb-dwc3-am62-fix-module-unload-reload-behavior.patch b/queue-6.6/usb-dwc3-am62-fix-module-unload-reload-behavior.patch new file mode 100644 index 00000000000..023f611c234 --- /dev/null +++ b/queue-6.6/usb-dwc3-am62-fix-module-unload-reload-behavior.patch @@ -0,0 +1,78 @@ +From afdbda3b50bb20b563495f924bffa68b70751e50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 11:23:48 +0200 +Subject: usb: dwc3-am62: fix module unload/reload behavior + +From: Roger Quadros + +[ Upstream commit 6661befe41009c210efa2c1bcd16a5cc4cff8a06 ] + +As runtime PM is enabled, the module can be runtime +suspended when .remove() is called. + +Do a pm_runtime_get_sync() to make sure module is active +before doing any register operations. + +Doing a pm_runtime_put_sync() should disable the refclk +so no need to disable it again. + +Fixes the below warning at module removel. + +[ 39.705310] ------------[ cut here ]------------ +[ 39.710004] clk:162:3 already disabled +[ 39.713941] WARNING: CPU: 0 PID: 921 at drivers/clk/clk.c:1090 clk_core_disable+0xb0/0xb8 + +We called of_platform_populate() in .probe() so call the +cleanup function of_platform_depopulate() in .remove(). +Get rid of the now unnnecessary dwc3_ti_remove_core(). +Without this, module re-load doesn't work properly. + +Fixes: e8784c0aec03 ("drivers: usb: dwc3: Add AM62 USB wrapper driver") +Cc: stable@vger.kernel.org # v5.19+ +Signed-off-by: Roger Quadros +Link: https://lore.kernel.org/r/20240227-for-v6-9-am62-usb-errata-3-0-v4-1-0ada8ddb0767@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-am62.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-am62.c b/drivers/usb/dwc3/dwc3-am62.c +index 90a587bc29b74..f85603b7f7c5e 100644 +--- a/drivers/usb/dwc3/dwc3-am62.c ++++ b/drivers/usb/dwc3/dwc3-am62.c +@@ -267,21 +267,14 @@ static int dwc3_ti_probe(struct platform_device *pdev) + return ret; + } + +-static int dwc3_ti_remove_core(struct device *dev, void *c) +-{ +- struct platform_device *pdev = to_platform_device(dev); +- +- platform_device_unregister(pdev); +- return 0; +-} +- + static void dwc3_ti_remove(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct dwc3_am62 *am62 = platform_get_drvdata(pdev); + u32 reg; + +- device_for_each_child(dev, NULL, dwc3_ti_remove_core); ++ pm_runtime_get_sync(dev); ++ of_platform_depopulate(dev); + + /* Clear mode valid bit */ + reg = dwc3_ti_readl(am62, USBSS_MODE_CONTROL); +@@ -289,7 +282,6 @@ static void dwc3_ti_remove(struct platform_device *pdev) + dwc3_ti_writel(am62, USBSS_MODE_CONTROL, reg); + + pm_runtime_put_sync(dev); +- clk_disable_unprepare(am62->usb2_refclk); + pm_runtime_disable(dev); + pm_runtime_set_suspended(dev); + } +-- +2.43.0 + diff --git a/queue-6.6/usb-gadget-tegra-xudc-fix-usb3-phy-retrieval-logic.patch b/queue-6.6/usb-gadget-tegra-xudc-fix-usb3-phy-retrieval-logic.patch new file mode 100644 index 00000000000..e7004774df0 --- /dev/null +++ b/queue-6.6/usb-gadget-tegra-xudc-fix-usb3-phy-retrieval-logic.patch @@ -0,0 +1,112 @@ +From f2a88cd954c8e12526dcdc3b3cc7acb68c8e5157 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 11:03:28 +0800 +Subject: usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic + +From: Wayne Chang + +[ Upstream commit 84fa943d93c31ee978355e6c6c69592dae3c9f59 ] + +This commit resolves an issue in the tegra-xudc USB gadget driver that +incorrectly fetched USB3 PHY instances. The problem stemmed from the +assumption of a one-to-one correspondence between USB2 and USB3 PHY +names and their association with physical USB ports in the device tree. + +Previously, the driver associated USB3 PHY names directly with the USB3 +instance number, leading to mismatches when mapping the physical USB +ports. For instance, if using USB3-1 PHY, the driver expect the +corresponding PHY name as 'usb3-1'. However, the physical USB ports in +the device tree were designated as USB2-0 and USB3-0 as we only have +one device controller, causing a misalignment. + +This commit rectifies the issue by adjusting the PHY naming logic. +Now, the driver correctly correlates the USB2 and USB3 PHY instances, +allowing the USB2-0 and USB3-1 PHYs to form a physical USB port pair +while accurately reflecting their configuration in the device tree by +naming them USB2-0 and USB3-0, respectively. + +The change ensures that the PHY and PHY names align appropriately, +resolving the mismatch between physical USB ports and their associated +names in the device tree. + +Fixes: b4e19931c98a ("usb: gadget: tegra-xudc: Support multiple device modes") +Cc: stable@vger.kernel.org +Signed-off-by: Wayne Chang +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Link: https://lore.kernel.org/r/20240307030328.1487748-3-waynec@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/tegra-xudc.c | 39 ++++++++++++++++++----------- + 1 file changed, 25 insertions(+), 14 deletions(-) + +diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c +index cb85168fd00c2..7aa46d426f31b 100644 +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -3491,8 +3491,8 @@ static void tegra_xudc_device_params_init(struct tegra_xudc *xudc) + + static int tegra_xudc_phy_get(struct tegra_xudc *xudc) + { +- int err = 0, usb3; +- unsigned int i; ++ int err = 0, usb3_companion_port; ++ unsigned int i, j; + + xudc->utmi_phy = devm_kcalloc(xudc->dev, xudc->soc->num_phys, + sizeof(*xudc->utmi_phy), GFP_KERNEL); +@@ -3520,7 +3520,7 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc) + if (IS_ERR(xudc->utmi_phy[i])) { + err = PTR_ERR(xudc->utmi_phy[i]); + dev_err_probe(xudc->dev, err, +- "failed to get usb2-%d PHY\n", i); ++ "failed to get PHY for phy-name usb2-%d\n", i); + goto clean_up; + } else if (xudc->utmi_phy[i]) { + /* Get usb-phy, if utmi phy is available */ +@@ -3539,19 +3539,30 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc) + } + + /* Get USB3 phy */ +- usb3 = tegra_xusb_padctl_get_usb3_companion(xudc->padctl, i); +- if (usb3 < 0) ++ usb3_companion_port = tegra_xusb_padctl_get_usb3_companion(xudc->padctl, i); ++ if (usb3_companion_port < 0) + continue; + +- snprintf(phy_name, sizeof(phy_name), "usb3-%d", usb3); +- xudc->usb3_phy[i] = devm_phy_optional_get(xudc->dev, phy_name); +- if (IS_ERR(xudc->usb3_phy[i])) { +- err = PTR_ERR(xudc->usb3_phy[i]); +- dev_err_probe(xudc->dev, err, +- "failed to get usb3-%d PHY\n", usb3); +- goto clean_up; +- } else if (xudc->usb3_phy[i]) +- dev_dbg(xudc->dev, "usb3-%d PHY registered", usb3); ++ for (j = 0; j < xudc->soc->num_phys; j++) { ++ snprintf(phy_name, sizeof(phy_name), "usb3-%d", j); ++ xudc->usb3_phy[i] = devm_phy_optional_get(xudc->dev, phy_name); ++ if (IS_ERR(xudc->usb3_phy[i])) { ++ err = PTR_ERR(xudc->usb3_phy[i]); ++ dev_err_probe(xudc->dev, err, ++ "failed to get PHY for phy-name usb3-%d\n", j); ++ goto clean_up; ++ } else if (xudc->usb3_phy[i]) { ++ int usb2_port = ++ tegra_xusb_padctl_get_port_number(xudc->utmi_phy[i]); ++ int usb3_port = ++ tegra_xusb_padctl_get_port_number(xudc->usb3_phy[i]); ++ if (usb3_port == usb3_companion_port) { ++ dev_dbg(xudc->dev, "USB2 port %d is paired with USB3 port %d for device mode port %d\n", ++ usb2_port, usb3_port, i); ++ break; ++ } ++ } ++ } + } + + return err; +-- +2.43.0 + diff --git a/queue-6.6/usb-serial-add-device-id-for-verifone-adapter.patch b/queue-6.6/usb-serial-add-device-id-for-verifone-adapter.patch new file mode 100644 index 00000000000..3ec22955ea9 --- /dev/null +++ b/queue-6.6/usb-serial-add-device-id-for-verifone-adapter.patch @@ -0,0 +1,94 @@ +From 62fe3425881273ee41a954fe2f82d9074654960b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 21:53:29 +0000 +Subject: USB: serial: add device ID for VeriFone adapter + +From: Cameron Williams + +[ Upstream commit cda704809797a8a86284f9df3eef5e62ec8a3175 ] + +Add device ID for a (probably fake) CP2102 UART device. + +lsusb -v output: + +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 1.10 + bDeviceClass 0 [unknown] + bDeviceSubClass 0 [unknown] + bDeviceProtocol 0 + bMaxPacketSize0 64 + idVendor 0x11ca VeriFone Inc + idProduct 0x0212 Verifone USB to Printer + bcdDevice 1.00 + iManufacturer 1 Silicon Labs + iProduct 2 Verifone USB to Printer + iSerial 3 0001 + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 0x0020 + bNumInterfaces 1 + bConfigurationValue 1 + iConfiguration 0 + bmAttributes 0x80 + (Bus Powered) + MaxPower 100mA + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 0 [unknown] + bInterfaceProtocol 0 + iInterface 2 Verifone USB to Printer + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 0 +Device Status: 0x0000 + (Bus Powered) + +Signed-off-by: Cameron Williams +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 923e0ed85444b..d339d81f6e8cf 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -177,6 +177,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */ + { USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */ + { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */ ++ { USB_DEVICE(0x11CA, 0x0212) }, /* Verifone USB to Printer (UART, CP2102) */ + { USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */ + { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ + { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ +-- +2.43.0 + diff --git a/queue-6.6/usb-serial-cp210x-add-id-for-mgp-instruments-pds100.patch b/queue-6.6/usb-serial-cp210x-add-id-for-mgp-instruments-pds100.patch new file mode 100644 index 00000000000..8f4b56c85eb --- /dev/null +++ b/queue-6.6/usb-serial-cp210x-add-id-for-mgp-instruments-pds100.patch @@ -0,0 +1,44 @@ +From 96f51253b16fca90a353c2890883a2cd5d2aba80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 11:47:29 +0100 +Subject: USB: serial: cp210x: add ID for MGP Instruments PDS100 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian Häggström + +[ Upstream commit a0d9d868491a362d421521499d98308c8e3a0398 ] + +The radiation meter has the text MGP Instruments PDS-100G or PDS-100GN +produced by Mirion Technologies. Tested by forcing the driver +association with + + echo 10c4 863c > /sys/bus/usb-serial/drivers/cp210x/new_id + +and then setting the serial port in 115200 8N1 mode. The device +announces ID_USB_VENDOR_ENC=Silicon\x20Labs and ID_USB_MODEL_ENC=PDS100 + +Signed-off-by: Christian Häggström +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index d339d81f6e8cf..2169b6549a260 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -144,6 +144,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ + { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ ++ { USB_DEVICE(0x10C4, 0x863C) }, /* MGP Instruments PDS100 */ + { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ + { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ + { USB_DEVICE(0x10C4, 0x87ED) }, /* IMST USB-Stick for Smart Meter */ +-- +2.43.0 + diff --git a/queue-6.6/usb-serial-cp210x-add-pid-vid-for-tdk-nc0110013m-and.patch b/queue-6.6/usb-serial-cp210x-add-pid-vid-for-tdk-nc0110013m-and.patch new file mode 100644 index 00000000000..4ddf978e114 --- /dev/null +++ b/queue-6.6/usb-serial-cp210x-add-pid-vid-for-tdk-nc0110013m-and.patch @@ -0,0 +1,36 @@ +From 423c81228d6ecbf8374ce77af63be45ce4a49983 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 08:46:14 +0900 +Subject: USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M + +From: Toru Katagiri + +[ Upstream commit b1a8da9ff1395c4879b4bd41e55733d944f3d613 ] + +TDK NC0110013M and MM0110113M have custom USB IDs for CP210x, +so we need to add them to the driver. + +Signed-off-by: Toru Katagiri +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/cp210x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 2169b6549a260..21fd26609252b 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -56,6 +56,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */ + { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */ + { USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */ ++ { USB_DEVICE(0x04BF, 0x1301) }, /* TDK Corporation NC0110013M - Network Controller */ ++ { USB_DEVICE(0x04BF, 0x1303) }, /* TDK Corporation MM0110113M - i3 Micro Module */ + { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */ + { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ + { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ +-- +2.43.0 + diff --git a/queue-6.6/usb-serial-ftdi_sio-add-support-for-gmc-z216c-adapte.patch b/queue-6.6/usb-serial-ftdi_sio-add-support-for-gmc-z216c-adapte.patch new file mode 100644 index 00000000000..872f5458bf7 --- /dev/null +++ b/queue-6.6/usb-serial-ftdi_sio-add-support-for-gmc-z216c-adapte.patch @@ -0,0 +1,53 @@ +From 92cf218eee379194e9e9f08be3ebc35ac4204861 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 15:42:46 +0100 +Subject: USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB + +From: Daniel Vogelbacher + +[ Upstream commit 3fb7bc4f3a98c48981318b87cf553c5f115fd5ca ] + +The GMC IR-USB adapter cable utilizes a FTDI FT232R chip. + +Add VID/PID for this adapter so it can be used as serial device via +ftdi_sio. + +Signed-off-by: Daniel Vogelbacher +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 13a56783830df..22d01a0f10fbc 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1077,6 +1077,8 @@ static const struct usb_device_id id_table_combined[] = { + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ /* GMC devices */ ++ { USB_DEVICE(GMC_VID, GMC_Z216C_PID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 21a2b5a25fc09..5ee60ba2a73cd 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1606,3 +1606,9 @@ + #define UBLOX_VID 0x1546 + #define UBLOX_C099F9P_ZED_PID 0x0502 + #define UBLOX_C099F9P_ODIN_PID 0x0503 ++ ++/* ++ * GMC devices ++ */ ++#define GMC_VID 0x1cd7 ++#define GMC_Z216C_PID 0x0217 /* GMC Z216C Adapter IR-USB */ +-- +2.43.0 + diff --git a/queue-6.6/usb-serial-option-add-meig-smart-slm320-product.patch b/queue-6.6/usb-serial-option-add-meig-smart-slm320-product.patch new file mode 100644 index 00000000000..bfe63d3a462 --- /dev/null +++ b/queue-6.6/usb-serial-option-add-meig-smart-slm320-product.patch @@ -0,0 +1,85 @@ +From 2244674eb1b89cbbb14094b42ed9a1d545d73af6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 18:49:17 +0100 +Subject: USB: serial: option: add MeiG Smart SLM320 product +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Aurélien Jacobs + +[ Upstream commit 46809c51565b83881aede6cdf3b0d25254966a41 ] + +Update the USB serial option driver to support MeiG Smart SLM320. + +ID 2dee:4d41 UNISOC UNISOC-8910 + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2dee ProdID=4d41 Rev=00.00 +S: Manufacturer=UNISOC +S: Product=UNISOC-8910 +C: #Ifs= 8 Cfg#= 1 Atr=e0 MxPwr=400mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Tested successfully a PPP LTE connection using If#= 0. +Not sure of the purpose of every other serial interfaces. + +Signed-off-by: Aurélien Jacobs +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 2ae124c49d448..55a65d941ccbf 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -613,6 +613,11 @@ static void option_instat_callback(struct urb *urb); + /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ + #define LUAT_PRODUCT_AIR720U 0x4e00 + ++/* MeiG Smart Technology products */ ++#define MEIGSMART_VENDOR_ID 0x2dee ++/* MeiG Smart SLM320 based on UNISOC UIS8910 */ ++#define MEIGSMART_PRODUCT_SLM320 0x4d41 ++ + /* Device flags */ + + /* Highest interface number which can be used with NCTRL() and RSVD() */ +@@ -2282,6 +2287,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +-- +2.43.0 + diff --git a/queue-6.6/usb-typec-ucsi-clean-up-ucsi_cable_prop-macros.patch b/queue-6.6/usb-typec-ucsi-clean-up-ucsi_cable_prop-macros.patch new file mode 100644 index 00000000000..6cdea2f3c97 --- /dev/null +++ b/queue-6.6/usb-typec-ucsi-clean-up-ucsi_cable_prop-macros.patch @@ -0,0 +1,47 @@ +From 90118e60908a149d0b9585c3773b124d10e81f78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 02:58:01 +0000 +Subject: usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros + +From: Jameson Thies + +[ Upstream commit 4d0a5a9915793377c0fe1a8d78de6bcd92cea963 ] + +Clean up UCSI_CABLE_PROP macros by fixing a bitmask shifting error for +plug type and updating the modal support macro for consistent naming. + +Fixes: 3cf657f07918 ("usb: typec: ucsi: Remove all bit-fields") +Cc: stable@vger.kernel.org +Reviewed-by: Benson Leung +Reviewed-by: Prashant Malani +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Jameson Thies +Link: https://lore.kernel.org/r/20240305025804.1290919-2-jthies@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h +index 474315a72c770..13ec976b1c747 100644 +--- a/drivers/usb/typec/ucsi/ucsi.h ++++ b/drivers/usb/typec/ucsi/ucsi.h +@@ -221,12 +221,12 @@ struct ucsi_cable_property { + #define UCSI_CABLE_PROP_FLAG_VBUS_IN_CABLE BIT(0) + #define UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE BIT(1) + #define UCSI_CABLE_PROP_FLAG_DIRECTIONALITY BIT(2) +-#define UCSI_CABLE_PROP_FLAG_PLUG_TYPE(_f_) ((_f_) & GENMASK(3, 0)) ++#define UCSI_CABLE_PROP_FLAG_PLUG_TYPE(_f_) (((_f_) & GENMASK(4, 3)) >> 3) + #define UCSI_CABLE_PROPERTY_PLUG_TYPE_A 0 + #define UCSI_CABLE_PROPERTY_PLUG_TYPE_B 1 + #define UCSI_CABLE_PROPERTY_PLUG_TYPE_C 2 + #define UCSI_CABLE_PROPERTY_PLUG_OTHER 3 +-#define UCSI_CABLE_PROP_MODE_SUPPORT BIT(5) ++#define UCSI_CABLE_PROP_FLAG_MODE_SUPPORT BIT(5) + u8 latency; + } __packed; + +-- +2.43.0 + diff --git a/queue-6.6/usb-xhci-add-error-handling-in-xhci_map_urb_for_dma.patch b/queue-6.6/usb-xhci-add-error-handling-in-xhci_map_urb_for_dma.patch new file mode 100644 index 00000000000..38e32517db3 --- /dev/null +++ b/queue-6.6/usb-xhci-add-error-handling-in-xhci_map_urb_for_dma.patch @@ -0,0 +1,43 @@ +From 84392dd94d528f42ed47ba2f63b5694d8b5e67f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 16:14:38 +0200 +Subject: usb: xhci: Add error handling in xhci_map_urb_for_dma + +From: Prashanth K + +[ Upstream commit be95cc6d71dfd0cba66e3621c65413321b398052 ] + +Currently xhci_map_urb_for_dma() creates a temporary buffer and copies +the SG list to the new linear buffer. But if the kzalloc_node() fails, +then the following sg_pcopy_to_buffer() can lead to crash since it +tries to memcpy to NULL pointer. + +So return -ENOMEM if kzalloc returns null pointer. + +Cc: stable@vger.kernel.org # 5.11 +Fixes: 2017a1e58472 ("usb: xhci: Use temporary buffer to consolidate SG") +Signed-off-by: Prashanth K +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20240229141438.619372-10-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 132b76fa7ca60..c4c733d724bd8 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1178,6 +1178,8 @@ static int xhci_map_temp_buffer(struct usb_hcd *hcd, struct urb *urb) + + temp = kzalloc_node(buf_len, GFP_ATOMIC, + dev_to_node(hcd->self.sysdev)); ++ if (!temp) ++ return -ENOMEM; + + if (usb_urb_dir_out(urb)) + sg_pcopy_to_buffer(urb->sg, urb->num_sgs, +-- +2.43.0 + diff --git a/queue-6.6/vfio-pci-disable-auto-enable-of-exclusive-intx-irq.patch b/queue-6.6/vfio-pci-disable-auto-enable-of-exclusive-intx-irq.patch new file mode 100644 index 00000000000..230018cfef7 --- /dev/null +++ b/queue-6.6/vfio-pci-disable-auto-enable-of-exclusive-intx-irq.patch @@ -0,0 +1,71 @@ +From 46961324e85389313fdc6800718c10c5a86df029 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 16:05:22 -0700 +Subject: vfio/pci: Disable auto-enable of exclusive INTx IRQ + +From: Alex Williamson + +[ Upstream commit fe9a7082684eb059b925c535682e68c34d487d43 ] + +Currently for devices requiring masking at the irqchip for INTx, ie. +devices without DisINTx support, the IRQ is enabled in request_irq() +and subsequently disabled as necessary to align with the masked status +flag. This presents a window where the interrupt could fire between +these events, resulting in the IRQ incrementing the disable depth twice. +This would be unrecoverable for a user since the masked flag prevents +nested enables through vfio. + +Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx +is never auto-enabled, then unmask as required. + +Cc: +Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver") +Reviewed-by: Kevin Tian +Reviewed-by: Eric Auger +Link: https://lore.kernel.org/r/20240308230557.805580-2-alex.williamson@redhat.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci_intrs.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c +index cbb4bcbfbf83d..3dbeeb5bfadce 100644 +--- a/drivers/vfio/pci/vfio_pci_intrs.c ++++ b/drivers/vfio/pci/vfio_pci_intrs.c +@@ -296,8 +296,15 @@ static int vfio_intx_set_signal(struct vfio_pci_core_device *vdev, int fd) + + ctx->trigger = trigger; + ++ /* ++ * Devices without DisINTx support require an exclusive interrupt, ++ * IRQ masking is performed at the IRQ chip. The masked status is ++ * protected by vdev->irqlock. Setup the IRQ without auto-enable and ++ * unmask as necessary below under lock. DisINTx is unmodified by ++ * the IRQ configuration and may therefore use auto-enable. ++ */ + if (!vdev->pci_2_3) +- irqflags = 0; ++ irqflags = IRQF_NO_AUTOEN; + + ret = request_irq(pdev->irq, vfio_intx_handler, + irqflags, ctx->name, vdev); +@@ -308,13 +315,9 @@ static int vfio_intx_set_signal(struct vfio_pci_core_device *vdev, int fd) + return ret; + } + +- /* +- * INTx disable will stick across the new irq setup, +- * disable_irq won't. +- */ + spin_lock_irqsave(&vdev->irqlock, flags); +- if (!vdev->pci_2_3 && ctx->masked) +- disable_irq_nosync(pdev->irq); ++ if (!vdev->pci_2_3 && !ctx->masked) ++ enable_irq(pdev->irq); + spin_unlock_irqrestore(&vdev->irqlock, flags); + + return 0; +-- +2.43.0 + diff --git a/queue-6.6/vfio-pci-lock-external-intx-masking-ops.patch b/queue-6.6/vfio-pci-lock-external-intx-masking-ops.patch new file mode 100644 index 00000000000..84d559b6483 --- /dev/null +++ b/queue-6.6/vfio-pci-lock-external-intx-masking-ops.patch @@ -0,0 +1,128 @@ +From 2446028d29ad9beb14d022195209ef22e6770d3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 16:05:23 -0700 +Subject: vfio/pci: Lock external INTx masking ops + +From: Alex Williamson + +[ Upstream commit 810cd4bb53456d0503cc4e7934e063835152c1b7 ] + +Mask operations through config space changes to DisINTx may race INTx +configuration changes via ioctl. Create wrappers that add locking for +paths outside of the core interrupt code. + +In particular, irq_type is updated holding igate, therefore testing +is_intx() requires holding igate. For example clearing DisINTx from +config space can otherwise race changes of the interrupt configuration. + +This aligns interfaces which may trigger the INTx eventfd into two +camps, one side serialized by igate and the other only enabled while +INTx is configured. A subsequent patch introduces synchronization for +the latter flows. + +Cc: +Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver") +Reported-by: Reinette Chatre +Reviewed-by: Kevin Tian +Reviewed-by: Reinette Chatre +Reviewed-by: Eric Auger +Link: https://lore.kernel.org/r/20240308230557.805580-3-alex.williamson@redhat.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci_intrs.c | 34 +++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c +index 3dbeeb5bfadce..6fccbeb4b94f5 100644 +--- a/drivers/vfio/pci/vfio_pci_intrs.c ++++ b/drivers/vfio/pci/vfio_pci_intrs.c +@@ -99,13 +99,15 @@ static void vfio_send_intx_eventfd(void *opaque, void *unused) + } + + /* Returns true if the INTx vfio_pci_irq_ctx.masked value is changed. */ +-bool vfio_pci_intx_mask(struct vfio_pci_core_device *vdev) ++static bool __vfio_pci_intx_mask(struct vfio_pci_core_device *vdev) + { + struct pci_dev *pdev = vdev->pdev; + struct vfio_pci_irq_ctx *ctx; + unsigned long flags; + bool masked_changed = false; + ++ lockdep_assert_held(&vdev->igate); ++ + spin_lock_irqsave(&vdev->irqlock, flags); + + /* +@@ -143,6 +145,17 @@ bool vfio_pci_intx_mask(struct vfio_pci_core_device *vdev) + return masked_changed; + } + ++bool vfio_pci_intx_mask(struct vfio_pci_core_device *vdev) ++{ ++ bool mask_changed; ++ ++ mutex_lock(&vdev->igate); ++ mask_changed = __vfio_pci_intx_mask(vdev); ++ mutex_unlock(&vdev->igate); ++ ++ return mask_changed; ++} ++ + /* + * If this is triggered by an eventfd, we can't call eventfd_signal + * or else we'll deadlock on the eventfd wait queue. Return >0 when +@@ -194,12 +207,21 @@ static int vfio_pci_intx_unmask_handler(void *opaque, void *unused) + return ret; + } + +-void vfio_pci_intx_unmask(struct vfio_pci_core_device *vdev) ++static void __vfio_pci_intx_unmask(struct vfio_pci_core_device *vdev) + { ++ lockdep_assert_held(&vdev->igate); ++ + if (vfio_pci_intx_unmask_handler(vdev, NULL) > 0) + vfio_send_intx_eventfd(vdev, NULL); + } + ++void vfio_pci_intx_unmask(struct vfio_pci_core_device *vdev) ++{ ++ mutex_lock(&vdev->igate); ++ __vfio_pci_intx_unmask(vdev); ++ mutex_unlock(&vdev->igate); ++} ++ + static irqreturn_t vfio_intx_handler(int irq, void *dev_id) + { + struct vfio_pci_core_device *vdev = dev_id; +@@ -563,11 +585,11 @@ static int vfio_pci_set_intx_unmask(struct vfio_pci_core_device *vdev, + return -EINVAL; + + if (flags & VFIO_IRQ_SET_DATA_NONE) { +- vfio_pci_intx_unmask(vdev); ++ __vfio_pci_intx_unmask(vdev); + } else if (flags & VFIO_IRQ_SET_DATA_BOOL) { + uint8_t unmask = *(uint8_t *)data; + if (unmask) +- vfio_pci_intx_unmask(vdev); ++ __vfio_pci_intx_unmask(vdev); + } else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) { + struct vfio_pci_irq_ctx *ctx = vfio_irq_ctx_get(vdev, 0); + int32_t fd = *(int32_t *)data; +@@ -594,11 +616,11 @@ static int vfio_pci_set_intx_mask(struct vfio_pci_core_device *vdev, + return -EINVAL; + + if (flags & VFIO_IRQ_SET_DATA_NONE) { +- vfio_pci_intx_mask(vdev); ++ __vfio_pci_intx_mask(vdev); + } else if (flags & VFIO_IRQ_SET_DATA_BOOL) { + uint8_t mask = *(uint8_t *)data; + if (mask) +- vfio_pci_intx_mask(vdev); ++ __vfio_pci_intx_mask(vdev); + } else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) { + return -ENOTTY; /* XXX implement me */ + } +-- +2.43.0 + diff --git a/queue-6.6/vfio-pds-always-clear-the-save-restore-fds-on-reset.patch b/queue-6.6/vfio-pds-always-clear-the-save-restore-fds-on-reset.patch new file mode 100644 index 00000000000..9243cf286bd --- /dev/null +++ b/queue-6.6/vfio-pds-always-clear-the-save-restore-fds-on-reset.patch @@ -0,0 +1,48 @@ +From cebbfc5a019e40ba85459b4a5f5f62a06d3c517f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 16:32:04 -0800 +Subject: vfio/pds: Always clear the save/restore FDs on reset + +From: Brett Creeley + +[ Upstream commit 8512ed256334f6637fc0699ce794792c357544ec ] + +After reset the VFIO device state will always be put in +VFIO_DEVICE_STATE_RUNNING, but the save/restore files will only be +cleared if the previous state was VFIO_DEVICE_STATE_ERROR. This +can/will cause the restore/save files to be leaked if/when the +migration state machine transitions through the states that +re-allocates these files. Fix this by always clearing the +restore/save files for resets. + +Fixes: 7dabb1bcd177 ("vfio/pds: Add support for firmware recovery") +Cc: stable@vger.kernel.org +Signed-off-by: Brett Creeley +Reviewed-by: Shannon Nelson +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20240228003205.47311-2-brett.creeley@amd.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/pds/vfio_dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/pds/vfio_dev.c b/drivers/vfio/pci/pds/vfio_dev.c +index 4c351c59d05a9..a286ebcc71126 100644 +--- a/drivers/vfio/pci/pds/vfio_dev.c ++++ b/drivers/vfio/pci/pds/vfio_dev.c +@@ -32,9 +32,9 @@ void pds_vfio_state_mutex_unlock(struct pds_vfio_pci_device *pds_vfio) + mutex_lock(&pds_vfio->reset_mutex); + if (pds_vfio->deferred_reset) { + pds_vfio->deferred_reset = false; ++ pds_vfio_put_restore_file(pds_vfio); ++ pds_vfio_put_save_file(pds_vfio); + if (pds_vfio->state == VFIO_DEVICE_STATE_ERROR) { +- pds_vfio_put_restore_file(pds_vfio); +- pds_vfio_put_save_file(pds_vfio); + pds_vfio_dirty_disable(pds_vfio, false); + } + pds_vfio->state = pds_vfio->deferred_reset_state; +-- +2.43.0 + diff --git a/queue-6.6/vfio-platform-disable-virqfds-on-cleanup.patch b/queue-6.6/vfio-platform-disable-virqfds-on-cleanup.patch new file mode 100644 index 00000000000..ef0e5f404d5 --- /dev/null +++ b/queue-6.6/vfio-platform-disable-virqfds-on-cleanup.patch @@ -0,0 +1,44 @@ +From 3f238926b2bc620d458f5bfd53a04584be212991 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 16:05:26 -0700 +Subject: vfio/platform: Disable virqfds on cleanup + +From: Alex Williamson + +[ Upstream commit fcdc0d3d40bc26c105acf8467f7d9018970944ae ] + +irqfds for mask and unmask that are not specifically disabled by the +user are leaked. Remove any irqfds during cleanup + +Cc: Eric Auger +Cc: +Fixes: a7fa7c77cf15 ("vfio/platform: implement IRQ masking/unmasking via an eventfd") +Reviewed-by: Kevin Tian +Reviewed-by: Eric Auger +Link: https://lore.kernel.org/r/20240308230557.805580-6-alex.williamson@redhat.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/platform/vfio_platform_irq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/vfio/platform/vfio_platform_irq.c b/drivers/vfio/platform/vfio_platform_irq.c +index 665197caed89e..d36c4cd0fbda3 100644 +--- a/drivers/vfio/platform/vfio_platform_irq.c ++++ b/drivers/vfio/platform/vfio_platform_irq.c +@@ -321,8 +321,11 @@ void vfio_platform_irq_cleanup(struct vfio_platform_device *vdev) + { + int i; + +- for (i = 0; i < vdev->num_irqs; i++) ++ for (i = 0; i < vdev->num_irqs; i++) { ++ vfio_virqfd_disable(&vdev->irqs[i].mask); ++ vfio_virqfd_disable(&vdev->irqs[i].unmask); + vfio_set_trigger(vdev, i, -1, NULL); ++ } + + vdev->num_irqs = 0; + kfree(vdev->irqs); +-- +2.43.0 + diff --git a/queue-6.6/virtio-reenable-config-if-freezing-device-failed.patch b/queue-6.6/virtio-reenable-config-if-freezing-device-failed.patch new file mode 100644 index 00000000000..fd86e6f7faf --- /dev/null +++ b/queue-6.6/virtio-reenable-config-if-freezing-device-failed.patch @@ -0,0 +1,60 @@ +From 16e1a2fdc49b655af748263beb7253266a3dbd02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 14:54:25 +0100 +Subject: virtio: reenable config if freezing device failed + +From: David Hildenbrand + +[ Upstream commit 310227f42882c52356b523e2f4e11690eebcd2ab ] + +Currently, we don't reenable the config if freezing the device failed. + +For example, virtio-mem currently doesn't support suspend+resume, and +trying to freeze the device will always fail. Afterwards, the device +will no longer respond to resize requests, because it won't get notified +about config changes. + +Let's fix this by re-enabling the config if freezing fails. + +Fixes: 22b7050a024d ("virtio: defer config changed notifications") +Cc: +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: Xuan Zhuo +Signed-off-by: David Hildenbrand +Message-Id: <20240213135425.795001-1-david@redhat.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c +index 3893dc29eb263..71dee622b771b 100644 +--- a/drivers/virtio/virtio.c ++++ b/drivers/virtio/virtio.c +@@ -489,13 +489,19 @@ EXPORT_SYMBOL_GPL(unregister_virtio_device); + int virtio_device_freeze(struct virtio_device *dev) + { + struct virtio_driver *drv = drv_to_virtio(dev->dev.driver); ++ int ret; + + virtio_config_disable(dev); + + dev->failed = dev->config->get_status(dev) & VIRTIO_CONFIG_S_FAILED; + +- if (drv && drv->freeze) +- return drv->freeze(dev); ++ if (drv && drv->freeze) { ++ ret = drv->freeze(dev); ++ if (ret) { ++ virtio_config_enable(dev); ++ return ret; ++ } ++ } + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.6/wifi-brcmfmac-add-per-vendor-feature-detection-callb.patch b/queue-6.6/wifi-brcmfmac-add-per-vendor-feature-detection-callb.patch new file mode 100644 index 00000000000..fb65e2531f4 --- /dev/null +++ b/queue-6.6/wifi-brcmfmac-add-per-vendor-feature-detection-callb.patch @@ -0,0 +1,110 @@ +From 2c23c9467212ea3bc8ead44d0ed10b70b2cdeeb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 10:57:02 +0100 +Subject: wifi: brcmfmac: add per-vendor feature detection callback + +From: Arend van Spriel + +[ Upstream commit 14e1391b71027948cdbacdbea4bf8858c2068eb7 ] + +Adding a .feat_attach() callback allowing per-vendor overrides +of the driver feature flags. In this patch the callback is only +provided by BCA vendor to disable SAE feature as it has not been +confirmed yet. BCA chips generally do not have the in-driver +supplicant (idsup) feature so they rely on NL80211_CMD_EXTERNAL_AUTH +to trigger user-space authentication. + +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240103095704.135651-3-arend.vanspriel@broadcom.com +Stable-dep-of: 85da8f71aaa7 ("wifi: brcmfmac: Demote vendor-specific attach/detach messages to info") +Signed-off-by: Sasha Levin +--- + .../wireless/broadcom/brcm80211/brcmfmac/bca/core.c | 8 ++++++++ + .../wireless/broadcom/brcm80211/brcmfmac/feature.c | 3 +++ + .../net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h | 12 ++++++++++++ + 3 files changed, 23 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c +index ac3a36fa3640c..a5d9ac5e67638 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + + #include "vops.h" + +@@ -21,7 +22,14 @@ static void brcmf_bca_detach(struct brcmf_pub *drvr) + pr_err("%s: executing\n", __func__); + } + ++static void brcmf_bca_feat_attach(struct brcmf_if *ifp) ++{ ++ /* SAE support not confirmed so disabling for now */ ++ ifp->drvr->feat_flags &= ~BIT(BRCMF_FEAT_SAE); ++} ++ + const struct brcmf_fwvid_ops brcmf_bca_ops = { + .attach = brcmf_bca_attach, + .detach = brcmf_bca_detach, ++ .feat_attach = brcmf_bca_feat_attach, + }; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c +index 6d10c9efbe93d..909a34a1ab503 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c +@@ -13,6 +13,7 @@ + #include "debug.h" + #include "fwil.h" + #include "fwil_types.h" ++#include "fwvid.h" + #include "feature.h" + #include "common.h" + +@@ -339,6 +340,8 @@ void brcmf_feat_attach(struct brcmf_pub *drvr) + brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_FWSUP, "sup_wpa"); + brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_SCAN_V2, "scan_ver"); + ++ brcmf_fwvid_feat_attach(ifp); ++ + if (drvr->settings->feature_disable) { + brcmf_dbg(INFO, "Features: 0x%02x, disable: 0x%02x\n", + ifp->drvr->feat_flags, +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h +index 43df58bb70ad3..17fbdbb76f51b 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h +@@ -8,10 +8,12 @@ + #include "firmware.h" + + struct brcmf_pub; ++struct brcmf_if; + + struct brcmf_fwvid_ops { + int (*attach)(struct brcmf_pub *drvr); + void (*detach)(struct brcmf_pub *drvr); ++ void (*feat_attach)(struct brcmf_if *ifp); + }; + + /* exported functions */ +@@ -44,4 +46,14 @@ static inline void brcmf_fwvid_detach(struct brcmf_pub *drvr) + brcmf_fwvid_detach_ops(drvr); + } + ++static inline void brcmf_fwvid_feat_attach(struct brcmf_if *ifp) ++{ ++ const struct brcmf_fwvid_ops *vops = ifp->drvr->vops; ++ ++ if (!vops->feat_attach) ++ return; ++ ++ vops->feat_attach(ifp); ++} ++ + #endif /* FWVID_H_ */ +-- +2.43.0 + diff --git a/queue-6.6/wifi-brcmfmac-avoid-invalid-list-operation-when-vend.patch b/queue-6.6/wifi-brcmfmac-avoid-invalid-list-operation-when-vend.patch new file mode 100644 index 00000000000..529f61901c8 --- /dev/null +++ b/queue-6.6/wifi-brcmfmac-avoid-invalid-list-operation-when-vend.patch @@ -0,0 +1,44 @@ +From 0fbb887910c3f7a552d30a70e2c2c9e0be6ff113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jan 2024 11:38:34 +0100 +Subject: wifi: brcmfmac: avoid invalid list operation when vendor attach fails + +From: Arend van Spriel + +[ Upstream commit b822015a1f57268f5b2ff656736dc4004e7097da ] + +When the brcmf_fwvid_attach() fails the driver instance is not added +to the vendor list. Hence we should not try to delete it from that +list when the brcmf_fwvid_detach() function is called in cleanup path. + +Cc: stable@vger.kernel.org # 6.2.x +Fixes: d6a5c562214f ("wifi: brcmfmac: add support for vendor-specific firmware api") +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240106103835.269149-3-arend.vanspriel@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c +index 86eafdb405419..f610818c2b059 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c +@@ -187,9 +187,10 @@ void brcmf_fwvid_detach_ops(struct brcmf_pub *drvr) + + mutex_lock(&fwvid_list_lock); + +- drvr->vops = NULL; +- list_del(&drvr->bus_if->list); +- ++ if (drvr->vops) { ++ drvr->vops = NULL; ++ list_del(&drvr->bus_if->list); ++ } + mutex_unlock(&fwvid_list_lock); + } + +-- +2.43.0 + diff --git a/queue-6.6/wifi-brcmfmac-cfg80211-use-wsec-to-set-sae-password.patch b/queue-6.6/wifi-brcmfmac-cfg80211-use-wsec-to-set-sae-password.patch new file mode 100644 index 00000000000..7200b5c92b0 --- /dev/null +++ b/queue-6.6/wifi-brcmfmac-cfg80211-use-wsec-to-set-sae-password.patch @@ -0,0 +1,306 @@ +From 7b0e8459f379a04e989b82c2523f8f42cdfdaac3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 10:57:04 +0100 +Subject: wifi: brcmfmac: cfg80211: Use WSEC to set SAE password + +From: Hector Martin + +[ Upstream commit 9f7861c56b51b84d30114e7fea9d744a9d5ba9b7 ] + +Using the WSEC command instead of sae_password seems to be the supported +mechanism on newer firmware, and also how the brcmdhd driver does it. + +The existing firmware mechanism intended for (some) Cypress chips has +been separated from the new firmware mechanism using the multi-vendor +framework. Depending on the device it will select the appropriate +firmware mechanism. + +This makes WPA3 work with iwd, or with wpa_supplicant pending a support +patchset [2]. + +[1] https://rachelbythebay.com/w/2023/11/06/wpa3/ +[2] http://lists.infradead.org/pipermail/hostap/2023-July/041653.html + +Signed-off-by: Hector Martin +Reviewed-by: Neal Gompa +[arend.vanspriel@broadcom.com: use multi-vendor framework] +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240103095704.135651-5-arend.vanspriel@broadcom.com +Stable-dep-of: 85da8f71aaa7 ("wifi: brcmfmac: Demote vendor-specific attach/detach messages to info") +Signed-off-by: Sasha Levin +--- + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 56 ++++++++----------- + .../broadcom/brcm80211/brcmfmac/cfg80211.h | 2 + + .../broadcom/brcm80211/brcmfmac/cyw/core.c | 28 ++++++++++ + .../broadcom/brcm80211/brcmfmac/fwil.c | 1 + + .../broadcom/brcm80211/brcmfmac/fwil_types.h | 2 +- + .../broadcom/brcm80211/brcmfmac/fwvid.h | 13 +++++ + .../broadcom/brcm80211/brcmfmac/wcc/core.c | 9 +++ + 7 files changed, 76 insertions(+), 35 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index 567e3a0675d88..c230bc8900a5c 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -32,6 +32,7 @@ + #include "vendor.h" + #include "bus.h" + #include "common.h" ++#include "fwvid.h" + + #define BRCMF_SCAN_IE_LEN_MAX 2048 + +@@ -1686,52 +1687,39 @@ static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e) + return reason; + } + +-static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len) ++int brcmf_set_wsec(struct brcmf_if *ifp, const u8 *key, u16 key_len, u16 flags) + { + struct brcmf_pub *drvr = ifp->drvr; + struct brcmf_wsec_pmk_le pmk; + int err; + ++ if (key_len > sizeof(pmk.key)) { ++ bphy_err(drvr, "key must be less than %zu bytes\n", ++ sizeof(pmk.key)); ++ return -EINVAL; ++ } ++ + memset(&pmk, 0, sizeof(pmk)); + +- /* pass pmk directly */ +- pmk.key_len = cpu_to_le16(pmk_len); +- pmk.flags = cpu_to_le16(0); +- memcpy(pmk.key, pmk_data, pmk_len); ++ /* pass key material directly */ ++ pmk.key_len = cpu_to_le16(key_len); ++ pmk.flags = cpu_to_le16(flags); ++ memcpy(pmk.key, key, key_len); + +- /* store psk in firmware */ ++ /* store key material in firmware */ + err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK, + &pmk, sizeof(pmk)); + if (err < 0) + bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n", +- pmk_len); ++ key_len); + + return err; + } ++BRCMF_EXPORT_SYMBOL_GPL(brcmf_set_wsec); + +-static int brcmf_set_sae_password(struct brcmf_if *ifp, const u8 *pwd_data, +- u16 pwd_len) ++static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len) + { +- struct brcmf_pub *drvr = ifp->drvr; +- struct brcmf_wsec_sae_pwd_le sae_pwd; +- int err; +- +- if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) { +- bphy_err(drvr, "sae_password must be less than %d\n", +- BRCMF_WSEC_MAX_SAE_PASSWORD_LEN); +- return -EINVAL; +- } +- +- sae_pwd.key_len = cpu_to_le16(pwd_len); +- memcpy(sae_pwd.key, pwd_data, pwd_len); +- +- err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd, +- sizeof(sae_pwd)); +- if (err < 0) +- bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n", +- pwd_len); +- +- return err; ++ return brcmf_set_wsec(ifp, pmk_data, pmk_len, 0); + } + + static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason, +@@ -2502,8 +2490,7 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev, + bphy_err(drvr, "failed to clean up user-space RSNE\n"); + goto done; + } +- err = brcmf_set_sae_password(ifp, sme->crypto.sae_pwd, +- sme->crypto.sae_pwd_len); ++ err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto); + if (!err && sme->crypto.psk) + err = brcmf_set_pmk(ifp, sme->crypto.psk, + BRCMF_WSEC_MAX_PSK_LEN); +@@ -5257,8 +5244,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev, + if (crypto->sae_pwd) { + brcmf_dbg(INFO, "using SAE offload\n"); + profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_SAE); +- err = brcmf_set_sae_password(ifp, crypto->sae_pwd, +- crypto->sae_pwd_len); ++ err = brcmf_fwvid_set_sae_password(ifp, crypto); + if (err < 0) + goto exit; + } +@@ -5365,10 +5351,12 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev, + msleep(400); + + if (profile->use_fwauth != BIT(BRCMF_PROFILE_FWAUTH_NONE)) { ++ struct cfg80211_crypto_settings crypto = {}; ++ + if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_PSK)) + brcmf_set_pmk(ifp, NULL, 0); + if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_SAE)) +- brcmf_set_sae_password(ifp, NULL, 0); ++ brcmf_fwvid_set_sae_password(ifp, &crypto); + profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE); + } + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h +index 0e1fa3f0dea2c..dc3a6a537507d 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h +@@ -468,4 +468,6 @@ void brcmf_set_mpc(struct brcmf_if *ndev, int mpc); + void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg); + void brcmf_cfg80211_free_netdev(struct net_device *ndev); + ++int brcmf_set_wsec(struct brcmf_if *ifp, const u8 *key, u16 key_len, u16 flags); ++ + #endif /* BRCMFMAC_CFG80211_H */ +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c +index b75652ba9359f..24670497f1a40 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + + #include "vops.h" + +@@ -21,7 +22,34 @@ static void brcmf_cyw_detach(struct brcmf_pub *drvr) + pr_err("%s: executing\n", __func__); + } + ++static int brcmf_cyw_set_sae_pwd(struct brcmf_if *ifp, ++ struct cfg80211_crypto_settings *crypto) ++{ ++ struct brcmf_pub *drvr = ifp->drvr; ++ struct brcmf_wsec_sae_pwd_le sae_pwd; ++ u16 pwd_len = crypto->sae_pwd_len; ++ int err; ++ ++ if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) { ++ bphy_err(drvr, "sae_password must be less than %d\n", ++ BRCMF_WSEC_MAX_SAE_PASSWORD_LEN); ++ return -EINVAL; ++ } ++ ++ sae_pwd.key_len = cpu_to_le16(pwd_len); ++ memcpy(sae_pwd.key, crypto->sae_pwd, pwd_len); ++ ++ err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd, ++ sizeof(sae_pwd)); ++ if (err < 0) ++ bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n", ++ pwd_len); ++ ++ return err; ++} ++ + const struct brcmf_fwvid_ops brcmf_cyw_ops = { + .attach = brcmf_cyw_attach, + .detach = brcmf_cyw_detach, ++ .set_sae_password = brcmf_cyw_set_sae_pwd, + }; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c +index 72fe8bce6eaf5..a9514d72f770b 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c +@@ -239,6 +239,7 @@ brcmf_fil_iovar_data_set(struct brcmf_if *ifp, const char *name, const void *dat + mutex_unlock(&drvr->proto_block); + return err; + } ++BRCMF_EXPORT_SYMBOL_GPL(brcmf_fil_iovar_data_set); + + s32 + brcmf_fil_iovar_data_get(struct brcmf_if *ifp, const char *name, void *data, +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +index 611d1a6aabb9e..b68c46caabe86 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +@@ -584,7 +584,7 @@ struct brcmf_wsec_key_le { + struct brcmf_wsec_pmk_le { + __le16 key_len; + __le16 flags; +- u8 key[2 * BRCMF_WSEC_MAX_PSK_LEN + 1]; ++ u8 key[BRCMF_WSEC_MAX_SAE_PASSWORD_LEN]; + }; + + /** +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h +index 17fbdbb76f51b..d9fc76b46db96 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h +@@ -6,6 +6,7 @@ + #define FWVID_H_ + + #include "firmware.h" ++#include "cfg80211.h" + + struct brcmf_pub; + struct brcmf_if; +@@ -14,6 +15,7 @@ struct brcmf_fwvid_ops { + int (*attach)(struct brcmf_pub *drvr); + void (*detach)(struct brcmf_pub *drvr); + void (*feat_attach)(struct brcmf_if *ifp); ++ int (*set_sae_password)(struct brcmf_if *ifp, struct cfg80211_crypto_settings *crypto); + }; + + /* exported functions */ +@@ -56,4 +58,15 @@ static inline void brcmf_fwvid_feat_attach(struct brcmf_if *ifp) + vops->feat_attach(ifp); + } + ++static inline int brcmf_fwvid_set_sae_password(struct brcmf_if *ifp, ++ struct cfg80211_crypto_settings *crypto) ++{ ++ const struct brcmf_fwvid_ops *vops = ifp->drvr->vops; ++ ++ if (!vops || !vops->set_sae_password) ++ return -EOPNOTSUPP; ++ ++ return vops->set_sae_password(ifp, crypto); ++} ++ + #endif /* FWVID_H_ */ +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c +index 5573a47766ad5..2d8f80bd73829 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + + #include "vops.h" + +@@ -21,7 +22,15 @@ static void brcmf_wcc_detach(struct brcmf_pub *drvr) + pr_debug("%s: executing\n", __func__); + } + ++static int brcmf_wcc_set_sae_pwd(struct brcmf_if *ifp, ++ struct cfg80211_crypto_settings *crypto) ++{ ++ return brcmf_set_wsec(ifp, crypto->sae_pwd, crypto->sae_pwd_len, ++ BRCMF_WSEC_PASSPHRASE); ++} ++ + const struct brcmf_fwvid_ops brcmf_wcc_ops = { + .attach = brcmf_wcc_attach, + .detach = brcmf_wcc_detach, ++ .set_sae_password = brcmf_wcc_set_sae_pwd, + }; +-- +2.43.0 + diff --git a/queue-6.6/wifi-brcmfmac-demote-vendor-specific-attach-detach-m.patch b/queue-6.6/wifi-brcmfmac-demote-vendor-specific-attach-detach-m.patch new file mode 100644 index 00000000000..38598726c5b --- /dev/null +++ b/queue-6.6/wifi-brcmfmac-demote-vendor-specific-attach-detach-m.patch @@ -0,0 +1,204 @@ +From cb1c4b4dbeb0679cc4caac9e8e12efc37c11fab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jan 2024 11:38:33 +0100 +Subject: wifi: brcmfmac: Demote vendor-specific attach/detach messages to info + +From: Hector Martin + +[ Upstream commit 85da8f71aaa7b83ea7ef0e89182e0cd47e16d465 ] + +People are getting spooked by brcmfmac errors on their boot console. +There's no reason for these messages to be errors. + +Cc: stable@vger.kernel.org # 6.2.x +Fixes: d6a5c562214f ("wifi: brcmfmac: add support for vendor-specific firmware api") +Signed-off-by: Hector Martin +[arend.vanspriel@broadcom.com: remove attach/detach vendor callbacks] +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240106103835.269149-2-arend.vanspriel@broadcom.com +Signed-off-by: Sasha Levin +--- + .../broadcom/brcm80211/brcmfmac/bca/core.c | 13 ---------- + .../broadcom/brcm80211/brcmfmac/cyw/core.c | 13 ---------- + .../broadcom/brcm80211/brcmfmac/fwvid.c | 7 +++-- + .../broadcom/brcm80211/brcmfmac/fwvid.h | 26 ++----------------- + .../broadcom/brcm80211/brcmfmac/wcc/core.c | 15 +---------- + 5 files changed, 6 insertions(+), 68 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c +index a5d9ac5e67638..a963c242975ac 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c +@@ -11,17 +11,6 @@ + + #include "vops.h" + +-static int brcmf_bca_attach(struct brcmf_pub *drvr) +-{ +- pr_err("%s: executing\n", __func__); +- return 0; +-} +- +-static void brcmf_bca_detach(struct brcmf_pub *drvr) +-{ +- pr_err("%s: executing\n", __func__); +-} +- + static void brcmf_bca_feat_attach(struct brcmf_if *ifp) + { + /* SAE support not confirmed so disabling for now */ +@@ -29,7 +18,5 @@ static void brcmf_bca_feat_attach(struct brcmf_if *ifp) + } + + const struct brcmf_fwvid_ops brcmf_bca_ops = { +- .attach = brcmf_bca_attach, +- .detach = brcmf_bca_detach, + .feat_attach = brcmf_bca_feat_attach, + }; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c +index 24670497f1a40..bec5748310b9c 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c +@@ -11,17 +11,6 @@ + + #include "vops.h" + +-static int brcmf_cyw_attach(struct brcmf_pub *drvr) +-{ +- pr_err("%s: executing\n", __func__); +- return 0; +-} +- +-static void brcmf_cyw_detach(struct brcmf_pub *drvr) +-{ +- pr_err("%s: executing\n", __func__); +-} +- + static int brcmf_cyw_set_sae_pwd(struct brcmf_if *ifp, + struct cfg80211_crypto_settings *crypto) + { +@@ -49,7 +38,5 @@ static int brcmf_cyw_set_sae_pwd(struct brcmf_if *ifp, + } + + const struct brcmf_fwvid_ops brcmf_cyw_ops = { +- .attach = brcmf_cyw_attach, +- .detach = brcmf_cyw_detach, + .set_sae_password = brcmf_cyw_set_sae_pwd, + }; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c +index f610818c2b059..b427782554b59 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c +@@ -89,8 +89,7 @@ int brcmf_fwvid_register_vendor(enum brcmf_fwvendor fwvid, struct module *vmod, + if (fwvid >= BRCMF_FWVENDOR_NUM) + return -ERANGE; + +- if (WARN_ON(!vmod) || WARN_ON(!vops) || +- WARN_ON(!vops->attach) || WARN_ON(!vops->detach)) ++ if (WARN_ON(!vmod) || WARN_ON(!vops)) + return -EINVAL; + + if (WARN_ON(fwvid_list[fwvid].vmod)) +@@ -150,7 +149,7 @@ static inline int brcmf_fwvid_request_module(enum brcmf_fwvendor fwvid) + } + #endif + +-int brcmf_fwvid_attach_ops(struct brcmf_pub *drvr) ++int brcmf_fwvid_attach(struct brcmf_pub *drvr) + { + enum brcmf_fwvendor fwvid = drvr->bus_if->fwvid; + int ret; +@@ -175,7 +174,7 @@ int brcmf_fwvid_attach_ops(struct brcmf_pub *drvr) + return ret; + } + +-void brcmf_fwvid_detach_ops(struct brcmf_pub *drvr) ++void brcmf_fwvid_detach(struct brcmf_pub *drvr) + { + enum brcmf_fwvendor fwvid = drvr->bus_if->fwvid; + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h +index d9fc76b46db96..dac22534d0334 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h +@@ -12,8 +12,6 @@ struct brcmf_pub; + struct brcmf_if; + + struct brcmf_fwvid_ops { +- int (*attach)(struct brcmf_pub *drvr); +- void (*detach)(struct brcmf_pub *drvr); + void (*feat_attach)(struct brcmf_if *ifp); + int (*set_sae_password)(struct brcmf_if *ifp, struct cfg80211_crypto_settings *crypto); + }; +@@ -24,30 +22,10 @@ int brcmf_fwvid_register_vendor(enum brcmf_fwvendor fwvid, struct module *mod, + int brcmf_fwvid_unregister_vendor(enum brcmf_fwvendor fwvid, struct module *mod); + + /* core driver functions */ +-int brcmf_fwvid_attach_ops(struct brcmf_pub *drvr); +-void brcmf_fwvid_detach_ops(struct brcmf_pub *drvr); ++int brcmf_fwvid_attach(struct brcmf_pub *drvr); ++void brcmf_fwvid_detach(struct brcmf_pub *drvr); + const char *brcmf_fwvid_vendor_name(struct brcmf_pub *drvr); + +-static inline int brcmf_fwvid_attach(struct brcmf_pub *drvr) +-{ +- int ret; +- +- ret = brcmf_fwvid_attach_ops(drvr); +- if (ret) +- return ret; +- +- return drvr->vops->attach(drvr); +-} +- +-static inline void brcmf_fwvid_detach(struct brcmf_pub *drvr) +-{ +- if (!drvr->vops) +- return; +- +- drvr->vops->detach(drvr); +- brcmf_fwvid_detach_ops(drvr); +-} +- + static inline void brcmf_fwvid_feat_attach(struct brcmf_if *ifp) + { + const struct brcmf_fwvid_ops *vops = ifp->drvr->vops; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c +index 2d8f80bd73829..fd593b93ad404 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c +@@ -7,21 +7,10 @@ + #include + #include + #include +-#include ++#include + + #include "vops.h" + +-static int brcmf_wcc_attach(struct brcmf_pub *drvr) +-{ +- pr_debug("%s: executing\n", __func__); +- return 0; +-} +- +-static void brcmf_wcc_detach(struct brcmf_pub *drvr) +-{ +- pr_debug("%s: executing\n", __func__); +-} +- + static int brcmf_wcc_set_sae_pwd(struct brcmf_if *ifp, + struct cfg80211_crypto_settings *crypto) + { +@@ -30,7 +19,5 @@ static int brcmf_wcc_set_sae_pwd(struct brcmf_if *ifp, + } + + const struct brcmf_fwvid_ops brcmf_wcc_ops = { +- .attach = brcmf_wcc_attach, +- .detach = brcmf_wcc_detach, + .set_sae_password = brcmf_wcc_set_sae_pwd, + }; +-- +2.43.0 + diff --git a/queue-6.6/wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_cfg802.patch b/queue-6.6/wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_cfg802.patch new file mode 100644 index 00000000000..5dbb0524bd6 --- /dev/null +++ b/queue-6.6/wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_cfg802.patch @@ -0,0 +1,77 @@ +From 4a970244f2ac549942d54aad0fa73838797c7824 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 08:25:04 +0100 +Subject: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach + +From: Zheng Wang + +[ Upstream commit 0f7352557a35ab7888bc7831411ec8a3cbe20d78 ] + +This is the candidate patch of CVE-2023-47233 : +https://nvd.nist.gov/vuln/detail/CVE-2023-47233 + +In brcm80211 driver,it starts with the following invoking chain +to start init a timeout worker: + +->brcmf_usb_probe + ->brcmf_usb_probe_cb + ->brcmf_attach + ->brcmf_bus_started + ->brcmf_cfg80211_attach + ->wl_init_priv + ->brcmf_init_escan + ->INIT_WORK(&cfg->escan_timeout_work, + brcmf_cfg80211_escan_timeout_worker); + +If we disconnect the USB by hotplug, it will call +brcmf_usb_disconnect to make cleanup. The invoking chain is : + +brcmf_usb_disconnect + ->brcmf_usb_disconnect_cb + ->brcmf_detach + ->brcmf_cfg80211_detach + ->kfree(cfg); + +While the timeout woker may still be running. This will cause +a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. + +Fix it by deleting the timer and canceling the worker in +brcmf_cfg80211_detach. + +Fixes: e756af5b30b0 ("brcmfmac: add e-scan support.") +Signed-off-by: Zheng Wang +Cc: stable@vger.kernel.org +[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free] +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240107072504.392713-1-arend.vanspriel@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index df9c26593dbe1..567e3a0675d88 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -1179,8 +1179,7 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg, + scan_request = cfg->scan_request; + cfg->scan_request = NULL; + +- if (timer_pending(&cfg->escan_timeout)) +- del_timer_sync(&cfg->escan_timeout); ++ timer_delete_sync(&cfg->escan_timeout); + + if (fw_abort) { + /* Do a scan abort to stop the driver's scan engine */ +@@ -8441,6 +8440,7 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg) + brcmf_btcoex_detach(cfg); + wiphy_unregister(cfg->wiphy); + wl_deinit_priv(cfg); ++ cancel_work_sync(&cfg->escan_timeout_work); + brcmf_free_wiphy(cfg->wiphy); + kfree(cfg); + } +-- +2.43.0 + diff --git a/queue-6.6/wifi-rtw88-add-missing-vid-pids-for-8811cu-and-8821c.patch b/queue-6.6/wifi-rtw88-add-missing-vid-pids-for-8811cu-and-8821c.patch new file mode 100644 index 00000000000..147151fb24e --- /dev/null +++ b/queue-6.6/wifi-rtw88-add-missing-vid-pids-for-8811cu-and-8821c.patch @@ -0,0 +1,88 @@ +From 86c8dc2fc3ef08903250ed206084f99d3286badb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 02:34:40 +0000 +Subject: wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU + +From: Nick Morrow + +[ Upstream commit b8a62478f3b143592d1241de1a7f5f8629ad0f49 ] + +Add VID/PIDs that are known to be missing for this driver. + +Removed /* 8811CU */ and /* 8821CU */ as they are redundant +since the file is specific to those chips. + +Removed /* TOTOLINK A650UA v3 */ as the manufacturer. It has a REALTEK +VID so it may not be specific to this adapter. + +Verified and tested. + +Cc: stable@vger.kernel.org +Signed-off-by: Nick Morrow +Signed-off-by: Larry Finger +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://msgid.link/4ume7mjw63u7.XlMUvUuacW2ErhOCdqlLkw2@1EHFQ.trk.elasticemail.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/realtek/rtw88/rtw8821cu.c | 40 ++++++++++++------- + 1 file changed, 26 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +index 7a5cbdc31ef79..e2c7d9f876836 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c +@@ -9,24 +9,36 @@ + #include "usb.h" + + static const struct usb_device_id rtw_8821cu_id_table[] = { +- { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xb82b, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */ ++ { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x2006, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x8731, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x8811, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, + { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xb820, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */ +- { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc821, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */ ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xb82b, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc80c, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc811, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, + { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc820, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */ ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc821, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, + { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc82a, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */ ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, + { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc82b, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8821CU */ +- { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc811, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8811CU */ +- { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x8811, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* 8811CU */ +- { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x2006, 0xff, 0xff, 0xff), +- .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* TOTOLINK A650UA v3 */ ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xc82c, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x331d, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* D-Link */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xc811, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */ + {}, + }; + MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table); +-- +2.43.0 + diff --git a/queue-6.6/wireguard-netlink-access-device-through-ctx-instead-.patch b/queue-6.6/wireguard-netlink-access-device-through-ctx-instead-.patch new file mode 100644 index 00000000000..2d35f655c0c --- /dev/null +++ b/queue-6.6/wireguard-netlink-access-device-through-ctx-instead-.patch @@ -0,0 +1,44 @@ +From 6397c65f53b7e0730b403ee3e689717f909eb959 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 16:49:10 -0600 +Subject: wireguard: netlink: access device through ctx instead of peer + +From: Jason A. Donenfeld + +[ Upstream commit 71cbd32e3db82ea4a74e3ef9aeeaa6971969c86f ] + +The previous commit fixed a bug that led to a NULL peer->device being +dereferenced. It's actually easier and faster performance-wise to +instead get the device from ctx->wg. This semantically makes more sense +too, since ctx->wg->peer_allowedips.seq is compared with +ctx->allowedips_seq, basing them both in ctx. This also acts as a +defence in depth provision against freed peers. + +Cc: stable@vger.kernel.org +Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Jiri Pirko +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/netlink.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c +index 12d80306ff3bc..a6661c9500d40 100644 +--- a/drivers/net/wireguard/netlink.c ++++ b/drivers/net/wireguard/netlink.c +@@ -164,8 +164,8 @@ get_peer(struct wg_peer *peer, struct sk_buff *skb, struct dump_ctx *ctx) + if (!allowedips_node) + goto no_allowedips; + if (!ctx->allowedips_seq) +- ctx->allowedips_seq = peer->device->peer_allowedips.seq; +- else if (ctx->allowedips_seq != peer->device->peer_allowedips.seq) ++ ctx->allowedips_seq = ctx->wg->peer_allowedips.seq; ++ else if (ctx->allowedips_seq != ctx->wg->peer_allowedips.seq) + goto no_allowedips; + + allowedips_nest = nla_nest_start(skb, WGPEER_A_ALLOWEDIPS); +-- +2.43.0 + diff --git a/queue-6.6/wireguard-netlink-check-for-dangling-peer-via-is_dea.patch b/queue-6.6/wireguard-netlink-check-for-dangling-peer-via-is_dea.patch new file mode 100644 index 00000000000..2db8d9c4959 --- /dev/null +++ b/queue-6.6/wireguard-netlink-check-for-dangling-peer-via-is_dea.patch @@ -0,0 +1,90 @@ +From 54f5e69c716530b09a24c8c888619459b478c8ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 16:49:09 -0600 +Subject: wireguard: netlink: check for dangling peer via is_dead instead of + empty list + +From: Jason A. Donenfeld + +[ Upstream commit 55b6c738673871c9b0edae05d0c97995c1ff08c4 ] + +If all peers are removed via wg_peer_remove_all(), rather than setting +peer_list to empty, the peer is added to a temporary list with a head on +the stack of wg_peer_remove_all(). If a netlink dump is resumed and the +cursored peer is one that has been removed via wg_peer_remove_all(), it +will iterate from that peer and then attempt to dump freed peers. + +Fix this by instead checking peer->is_dead, which was explictly created +for this purpose. Also move up the device_update_lock lockdep assertion, +since reading is_dead relies on that. + +It can be reproduced by a small script like: + + echo "Setting config..." + ip link add dev wg0 type wireguard + wg setconf wg0 /big-config + ( + while true; do + echo "Showing config..." + wg showconf wg0 > /dev/null + done + ) & + sleep 4 + wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n") + +Resulting in: + + BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20 + Read of size 8 at addr ffff88811956ec70 by task wg/59 + CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5 + Call Trace: + + dump_stack_lvl+0x47/0x70 + print_address_description.constprop.0+0x2c/0x380 + print_report+0xab/0x250 + kasan_report+0xba/0xf0 + __lock_acquire+0x182a/0x1b20 + lock_acquire+0x191/0x4b0 + down_read+0x80/0x440 + get_peer+0x140/0xcb0 + wg_get_device_dump+0x471/0x1130 + +Cc: stable@vger.kernel.org +Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") +Reported-by: Lillian Berry +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Jiri Pirko +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/netlink.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c +index dc09b75a32485..12d80306ff3bc 100644 +--- a/drivers/net/wireguard/netlink.c ++++ b/drivers/net/wireguard/netlink.c +@@ -255,17 +255,17 @@ static int wg_get_device_dump(struct sk_buff *skb, struct netlink_callback *cb) + if (!peers_nest) + goto out; + ret = 0; +- /* If the last cursor was removed via list_del_init in peer_remove, then ++ lockdep_assert_held(&wg->device_update_lock); ++ /* If the last cursor was removed in peer_remove or peer_remove_all, then + * we just treat this the same as there being no more peers left. The + * reason is that seq_nr should indicate to userspace that this isn't a + * coherent dump anyway, so they'll try again. + */ + if (list_empty(&wg->peer_list) || +- (ctx->next_peer && list_empty(&ctx->next_peer->peer_list))) { ++ (ctx->next_peer && ctx->next_peer->is_dead)) { + nla_nest_cancel(skb, peers_nest); + goto out; + } +- lockdep_assert_held(&wg->device_update_lock); + peer = list_prepare_entry(ctx->next_peer, &wg->peer_list, peer_list); + list_for_each_entry_continue(peer, &wg->peer_list, peer_list) { + if (get_peer(peer, skb, ctx)) { +-- +2.43.0 + diff --git a/queue-6.6/wireguard-selftests-set-riscv_isa_fallback-on-riscv-.patch b/queue-6.6/wireguard-selftests-set-riscv_isa_fallback-on-riscv-.patch new file mode 100644 index 00000000000..bc7e52a08ad --- /dev/null +++ b/queue-6.6/wireguard-selftests-set-riscv_isa_fallback-on-riscv-.patch @@ -0,0 +1,51 @@ +From 2ba82fc028b48334a90fc85402d0df39ad3ea7db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 16:49:11 -0600 +Subject: wireguard: selftests: set RISCV_ISA_FALLBACK on riscv{32,64} + +From: Jason A. Donenfeld + +[ Upstream commit e995f5dd9a9cef818af32ec60fc38d68614afd12 ] + +This option is needed to continue booting with QEMU. Recent changes that +made this optional meant that it gets unset in the test harness, and so +WireGuard CI has been broken. Fix this by simply setting this option. + +Cc: stable@vger.kernel.org +Fixes: 496ea826d1e1 ("RISC-V: provide Kconfig & commandline options to control parsing "riscv,isa"") +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Jiri Pirko +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/wireguard/qemu/arch/riscv32.config | 1 + + tools/testing/selftests/wireguard/qemu/arch/riscv64.config | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/wireguard/qemu/arch/riscv32.config b/tools/testing/selftests/wireguard/qemu/arch/riscv32.config +index 2fc36efb166dc..a7f8e8a956259 100644 +--- a/tools/testing/selftests/wireguard/qemu/arch/riscv32.config ++++ b/tools/testing/selftests/wireguard/qemu/arch/riscv32.config +@@ -3,6 +3,7 @@ CONFIG_ARCH_RV32I=y + CONFIG_MMU=y + CONFIG_FPU=y + CONFIG_SOC_VIRT=y ++CONFIG_RISCV_ISA_FALLBACK=y + CONFIG_SERIAL_8250=y + CONFIG_SERIAL_8250_CONSOLE=y + CONFIG_SERIAL_OF_PLATFORM=y +diff --git a/tools/testing/selftests/wireguard/qemu/arch/riscv64.config b/tools/testing/selftests/wireguard/qemu/arch/riscv64.config +index dc266f3b19155..daeb3e5e09658 100644 +--- a/tools/testing/selftests/wireguard/qemu/arch/riscv64.config ++++ b/tools/testing/selftests/wireguard/qemu/arch/riscv64.config +@@ -2,6 +2,7 @@ CONFIG_ARCH_RV64I=y + CONFIG_MMU=y + CONFIG_FPU=y + CONFIG_SOC_VIRT=y ++CONFIG_RISCV_ISA_FALLBACK=y + CONFIG_SERIAL_8250=y + CONFIG_SERIAL_8250_CONSOLE=y + CONFIG_SERIAL_OF_PLATFORM=y +-- +2.43.0 + diff --git a/queue-6.6/x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch b/queue-6.6/x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch new file mode 100644 index 00000000000..ac71230ebb9 --- /dev/null +++ b/queue-6.6/x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch @@ -0,0 +1,44 @@ +From 17d8e71f123880418ddadb2e0d6211313d13a6b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 22:42:27 +0100 +Subject: x86/CPU/AMD: Update the Zenbleed microcode revisions + +From: Borislav Petkov (AMD) + +[ Upstream commit 5c84b051bd4e777cf37aaff983277e58c99618d5 ] + +Update them to the correct revision numbers. + +Fixes: 522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix") +Signed-off-by: Borislav Petkov (AMD) +Cc: +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/amd.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index bb3efc825bf4f..031bca974fbf3 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -1006,11 +1006,11 @@ static bool cpu_has_zenbleed_microcode(void) + u32 good_rev = 0; + + switch (boot_cpu_data.x86_model) { +- case 0x30 ... 0x3f: good_rev = 0x0830107a; break; +- case 0x60 ... 0x67: good_rev = 0x0860010b; break; +- case 0x68 ... 0x6f: good_rev = 0x08608105; break; +- case 0x70 ... 0x7f: good_rev = 0x08701032; break; +- case 0xa0 ... 0xaf: good_rev = 0x08a00008; break; ++ case 0x30 ... 0x3f: good_rev = 0x0830107b; break; ++ case 0x60 ... 0x67: good_rev = 0x0860010c; break; ++ case 0x68 ... 0x6f: good_rev = 0x08608107; break; ++ case 0x70 ... 0x7f: good_rev = 0x08701033; break; ++ case 0xa0 ... 0xaf: good_rev = 0x08a00009; break; + + default: + return false; +-- +2.43.0 + diff --git a/queue-6.6/x86-nmi-fix-the-inverse-in-nmi-handler-check.patch b/queue-6.6/x86-nmi-fix-the-inverse-in-nmi-handler-check.patch new file mode 100644 index 00000000000..21cc7841a7e --- /dev/null +++ b/queue-6.6/x86-nmi-fix-the-inverse-in-nmi-handler-check.patch @@ -0,0 +1,58 @@ +From e9cbf4bb0c5fe3d9245b6467774c3a316d635b6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 08:52:35 -0800 +Subject: x86/nmi: Fix the inverse "in NMI handler" check + +From: Breno Leitao + +[ Upstream commit d54e56f31a34fa38fcb5e91df609f9633419a79a ] + +Commit 344da544f177 ("x86/nmi: Print reasons why backtrace NMIs are +ignored") creates a super nice framework to diagnose NMIs. + +Every time nmi_exc() is called, it increments a per_cpu counter +(nsp->idt_nmi_seq). At its exit, it also increments the same counter. By +reading this counter it can be seen how many times that function was called +(dividing by 2), and, if the function is still being executed, by checking +the idt_nmi_seq's least significant bit. + +On the check side (nmi_backtrace_stall_check()), that variable is queried +to check if the NMI is still being executed, but, there is a mistake in the +bitwise operation. That code wants to check if the least significant bit of +the idt_nmi_seq is set or not, but does the opposite, and checks for all +the other bits, which will always be true after the first exc_nmi() +executed successfully. + +This appends the misleading string to the dump "(CPU currently in NMI +handler function)" + +Fix it by checking the least significant bit, and if it is set, append the +string. + +Fixes: 344da544f177 ("x86/nmi: Print reasons why backtrace NMIs are ignored") +Signed-off-by: Breno Leitao +Signed-off-by: Thomas Gleixner +Reviewed-by: Paul E. McKenney +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240207165237.1048837-1-leitao@debian.org +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/nmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c +index 07e045399348e..87aee638e1a5d 100644 +--- a/arch/x86/kernel/nmi.c ++++ b/arch/x86/kernel/nmi.c +@@ -629,7 +629,7 @@ void nmi_backtrace_stall_check(const struct cpumask *btp) + msgp = nmi_check_stall_msg[idx]; + if (nsp->idt_ignored_snap != READ_ONCE(nsp->idt_ignored) && (idx & 0x1)) + modp = ", but OK because ignore_nmis was set"; +- if (nmi_seq & ~0x1) ++ if (nmi_seq & 0x1) + msghp = " (CPU currently in NMI handler function)"; + else if (nsp->idt_nmi_seq_snap + 1 == nmi_seq) + msghp = " (CPU exited one NMI handler function)"; +-- +2.43.0 + diff --git a/queue-6.6/x86-pm-work-around-false-positive-kmemleak-report-in.patch b/queue-6.6/x86-pm-work-around-false-positive-kmemleak-report-in.patch new file mode 100644 index 00000000000..ec448bec3ff --- /dev/null +++ b/queue-6.6/x86-pm-work-around-false-positive-kmemleak-report-in.patch @@ -0,0 +1,102 @@ +From 2f1099aec494aedc71d82a0eacb92563e3905fbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 14:26:56 +0000 +Subject: x86/pm: Work around false positive kmemleak report in + msr_build_context() + +From: Anton Altaparmakov + +[ Upstream commit e3f269ed0accbb22aa8f25d2daffa23c3fccd407 ] + +Since: + + 7ee18d677989 ("x86/power: Make restore_processor_context() sane") + +kmemleak reports this issue: + + unreferenced object 0xf68241e0 (size 32): + comm "swapper/0", pid 1, jiffies 4294668610 (age 68.432s) + hex dump (first 32 bytes): + 00 cc cc cc 29 10 01 c0 00 00 00 00 00 00 00 00 ....)........... + 00 42 82 f6 cc cc cc cc cc cc cc cc cc cc cc cc .B.............. + backtrace: + [<461c1d50>] __kmem_cache_alloc_node+0x106/0x260 + [] __kmalloc+0x54/0x160 + [] msr_build_context.constprop.0+0x35/0x100 + [<46635aff>] pm_check_save_msr+0x63/0x80 + [<6b6bb938>] do_one_initcall+0x41/0x1f0 + [<3f3add60>] kernel_init_freeable+0x199/0x1e8 + [<3b538fde>] kernel_init+0x1a/0x110 + [<938ae2b2>] ret_from_fork+0x1c/0x28 + +Which is a false positive. + +Reproducer: + + - Run rsync of whole kernel tree (multiple times if needed). + - start a kmemleak scan + - Note this is just an example: a lot of our internal tests hit these. + +The root cause is similar to the fix in: + + b0b592cf0836 x86/pm: Fix false positive kmemleak report in msr_build_context() + +ie. the alignment within the packed struct saved_context +which has everything unaligned as there is only "u16 gs;" at start of +struct where in the past there were four u16 there thus aligning +everything afterwards. The issue is with the fact that Kmemleak only +searches for pointers that are aligned (see how pointers are scanned in +kmemleak.c) so when the struct members are not aligned it doesn't see +them. + +Testing: + +We run a lot of tests with our CI, and after applying this fix we do not +see any kmemleak issues any more whilst without it we see hundreds of +the above report. From a single, simple test run consisting of 416 individual test +cases on kernel 5.10 x86 with kmemleak enabled we got 20 failures due to this, +which is quite a lot. With this fix applied we get zero kmemleak related failures. + +Fixes: 7ee18d677989 ("x86/power: Make restore_processor_context() sane") +Signed-off-by: Anton Altaparmakov +Signed-off-by: Ingo Molnar +Acked-by: "Rafael J. Wysocki" +Cc: stable@vger.kernel.org +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20240314142656.17699-1-anton@tuxera.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/suspend_32.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h +index a800abb1a9925..d8416b3bf832e 100644 +--- a/arch/x86/include/asm/suspend_32.h ++++ b/arch/x86/include/asm/suspend_32.h +@@ -12,11 +12,6 @@ + + /* image of the saved processor state */ + struct saved_context { +- /* +- * On x86_32, all segment registers except gs are saved at kernel +- * entry in pt_regs. +- */ +- u16 gs; + unsigned long cr0, cr2, cr3, cr4; + u64 misc_enable; + struct saved_msrs saved_msrs; +@@ -27,6 +22,11 @@ struct saved_context { + unsigned long tr; + unsigned long safety; + unsigned long return_address; ++ /* ++ * On x86_32, all segment registers except gs are saved at kernel ++ * entry in pt_regs. ++ */ ++ u16 gs; + bool misc_enable_saved; + } __attribute__((packed)); + +-- +2.43.0 +