From: Sasha Levin Date: Fri, 20 Jun 2025 13:15:05 +0000 (-0400) Subject: Fixes for 6.15 X-Git-Tag: v5.4.295~134 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2bd9ca62d26feed981e2316bb010489e56a3edcd;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.15 Signed-off-by: Sasha Levin --- diff --git a/queue-6.15/acpi-add-missing-prototype-for-non-config_suspend-co.patch b/queue-6.15/acpi-add-missing-prototype-for-non-config_suspend-co.patch new file mode 100644 index 0000000000..f7770987c6 --- /dev/null +++ b/queue-6.15/acpi-add-missing-prototype-for-non-config_suspend-co.patch @@ -0,0 +1,60 @@ +From 97cc33a3bc7c436f3221a1ec61ef16c8567891d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 13:36:55 -0500 +Subject: ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case + +From: Mario Limonciello + +[ Upstream commit e1bdbbc98279164d910d2de82a745f090a8b249f ] + +acpi_register_lps0_dev() and acpi_unregister_lps0_dev() may be used +in drivers that don't require CONFIG_SUSPEND or compile on !X86. + +Add prototypes for those cases. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202502191627.fRgoBwcZ-lkp@intel.com/ +Signed-off-by: Mario Limonciello +Link: https://patch.msgid.link/20250407183656.1503446-1-superm1@kernel.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/linux/acpi.h | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index 3f2e93ed97301..fc372bbaa5476 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -1125,13 +1125,13 @@ void acpi_os_set_prepare_extended_sleep(int (*func)(u8 sleep_state, + + acpi_status acpi_os_prepare_extended_sleep(u8 sleep_state, + u32 val_a, u32 val_b); +-#if defined(CONFIG_SUSPEND) && defined(CONFIG_X86) + struct acpi_s2idle_dev_ops { + struct list_head list_node; + void (*prepare)(void); + void (*check)(void); + void (*restore)(void); + }; ++#if defined(CONFIG_SUSPEND) && defined(CONFIG_X86) + int acpi_register_lps0_dev(struct acpi_s2idle_dev_ops *arg); + void acpi_unregister_lps0_dev(struct acpi_s2idle_dev_ops *arg); + int acpi_get_lps0_constraint(struct acpi_device *adev); +@@ -1140,6 +1140,13 @@ static inline int acpi_get_lps0_constraint(struct device *dev) + { + return ACPI_STATE_UNKNOWN; + } ++static inline int acpi_register_lps0_dev(struct acpi_s2idle_dev_ops *arg) ++{ ++ return -ENODEV; ++} ++static inline void acpi_unregister_lps0_dev(struct acpi_s2idle_dev_ops *arg) ++{ ++} + #endif /* CONFIG_SUSPEND && CONFIG_X86 */ + void arch_reserve_mem_area(acpi_physical_address addr, size_t size); + #else +-- +2.39.5 + diff --git a/queue-6.15/acpi-battery-negate-current-when-discharging.patch b/queue-6.15/acpi-battery-negate-current-when-discharging.patch new file mode 100644 index 0000000000..a780c67758 --- /dev/null +++ b/queue-6.15/acpi-battery-negate-current-when-discharging.patch @@ -0,0 +1,63 @@ +From 3a50836b09064cee88ee5b84ee8ccae232503187 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 12:41:45 +1000 +Subject: ACPI: battery: negate current when discharging + +From: Peter Marheine + +[ Upstream commit 234f71555019d308c6bc6f98c78c5551cb8cd56a ] + +The ACPI specification requires that battery rate is always positive, +but the kernel ABI for POWER_SUPPLY_PROP_CURRENT_NOW +(Documentation/ABI/testing/sysfs-class-power) specifies that it should +be negative when a battery is discharging. When reporting CURRENT_NOW, +massage the value to match the documented ABI. + +This only changes the sign of `current_now` and not `power_now` because +documentation doesn't describe any particular meaning for `power_now` so +leaving `power_now` unchanged is less likely to confuse userspace +unnecessarily, whereas becoming consistent with the documented ABI is +worth potentially confusing clients that read `current_now`. + +Signed-off-by: Peter Marheine +Link: https://patch.msgid.link/20250508024146.1436129-1-pmarheine@chromium.org +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 6760330a8af55..93bb1f7d90986 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -243,10 +243,23 @@ static int acpi_battery_get_property(struct power_supply *psy, + break; + case POWER_SUPPLY_PROP_CURRENT_NOW: + case POWER_SUPPLY_PROP_POWER_NOW: +- if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) ++ if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN) { + ret = -ENODEV; +- else +- val->intval = battery->rate_now * 1000; ++ break; ++ } ++ ++ val->intval = battery->rate_now * 1000; ++ /* ++ * When discharging, the current should be reported as a ++ * negative number as per the power supply class interface ++ * definition. ++ */ ++ if (psp == POWER_SUPPLY_PROP_CURRENT_NOW && ++ (battery->state & ACPI_BATTERY_STATE_DISCHARGING) && ++ acpi_battery_handle_discharging(battery) ++ == POWER_SUPPLY_STATUS_DISCHARGING) ++ val->intval = -val->intval; ++ + break; + case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN: + case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN: +-- +2.39.5 + diff --git a/queue-6.15/acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch b/queue-6.15/acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch new file mode 100644 index 0000000000..6aabf31de0 --- /dev/null +++ b/queue-6.15/acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch @@ -0,0 +1,43 @@ +From 43a16dfe26a5e282c6b68bdbe1246745dd239df3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 May 2025 20:51:11 +0200 +Subject: ACPI: bus: Bail out if acpi_kobj registration fails + +From: Armin Wolf + +[ Upstream commit 94a370fc8def6038dbc02199db9584b0b3690f1a ] + +The ACPI sysfs code will fail to initialize if acpi_kobj is NULL, +together with some ACPI drivers. + +Follow the other firmware subsystems and bail out if the kobject +cannot be registered. + +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20250518185111.3560-2-W_Armin@gmx.de +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/bus.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index 058910af82bca..c2ab2783303f2 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -1446,8 +1446,10 @@ static int __init acpi_init(void) + } + + acpi_kobj = kobject_create_and_add("acpi", firmware_kobj); +- if (!acpi_kobj) +- pr_debug("%s: kset create error\n", __func__); ++ if (!acpi_kobj) { ++ pr_err("Failed to register kobject\n"); ++ return -ENOMEM; ++ } + + init_prmt(); + acpi_init_pcc(); +-- +2.39.5 + diff --git a/queue-6.15/acpica-apply-pack-1-to-union-aml_resource.patch b/queue-6.15/acpica-apply-pack-1-to-union-aml_resource.patch new file mode 100644 index 0000000000..7bb0ddc1dc --- /dev/null +++ b/queue-6.15/acpica-apply-pack-1-to-union-aml_resource.patch @@ -0,0 +1,252 @@ +From 4f11d944974cc0c035ffbda7670ffbf861f3773f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 21:21:05 +0200 +Subject: ACPICA: Apply pack(1) to union aml_resource +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tamir Duberstein + +[ Upstream commit eedf3e3c2f2af55dca42b0ea81dffb808211d269 ] + +ACPICA commit 1c28da2242783579d59767617121035dafba18c3 + +This was originally done in NetBSD: +https://github.com/NetBSD/src/commit/b69d1ac3f7702f67edfe412e4392f77d09804910 +and is the correct alternative to the smattering of `memcpy`s I +previously contributed to this repository. + +This also sidesteps the newly strict checks added in UBSAN: +https://github.com/llvm/llvm-project/commit/792674400f6f04a074a3827349ed0e2ac10067f6 + +Before this change we see the following UBSAN stack trace in Fuchsia: + + #0 0x000021afcfdeca5e in acpi_rs_get_address_common(struct acpi_resource*, union aml_resource*) ../../third_party/acpica/source/components/resources/rsaddr.c:329 +0x6aca5e + #1.2 0x000021982bc4af3c in ubsan_get_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:41 +0x41f3c + #1.1 0x000021982bc4af3c in maybe_print_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:51 +0x41f3c + #1 0x000021982bc4af3c in ~scoped_report() compiler-rt/lib/ubsan/ubsan_diag.cpp:395 +0x41f3c + #2 0x000021982bc4bb6f in handletype_mismatch_impl() compiler-rt/lib/ubsan/ubsan_handlers.cpp:137 +0x42b6f + #3 0x000021982bc4b723 in __ubsan_handle_type_mismatch_v1 compiler-rt/lib/ubsan/ubsan_handlers.cpp:142 +0x42723 + #4 0x000021afcfdeca5e in acpi_rs_get_address_common(struct acpi_resource*, union aml_resource*) ../../third_party/acpica/source/components/resources/rsaddr.c:329 +0x6aca5e + #5 0x000021afcfdf2089 in acpi_rs_convert_aml_to_resource(struct acpi_resource*, union aml_resource*, struct acpi_rsconvert_info*) ../../third_party/acpica/source/components/resources/rsmisc.c:355 +0x6b2089 + #6 0x000021afcfded169 in acpi_rs_convert_aml_to_resources(u8*, u32, u32, u8, void**) ../../third_party/acpica/source/components/resources/rslist.c:137 +0x6ad169 + #7 0x000021afcfe2d24a in acpi_ut_walk_aml_resources(struct acpi_walk_state*, u8*, acpi_size, acpi_walk_aml_callback, void**) ../../third_party/acpica/source/components/utilities/utresrc.c:237 +0x6ed24a + #8 0x000021afcfde66b7 in acpi_rs_create_resource_list(union acpi_operand_object*, struct acpi_buffer*) ../../third_party/acpica/source/components/resources/rscreate.c:199 +0x6a66b7 + #9 0x000021afcfdf6979 in acpi_rs_get_method_data(acpi_handle, const char*, struct acpi_buffer*) ../../third_party/acpica/source/components/resources/rsutils.c:770 +0x6b6979 + #10 0x000021afcfdf708f in acpi_walk_resources(acpi_handle, char*, acpi_walk_resource_callback, void*) ../../third_party/acpica/source/components/resources/rsxface.c:731 +0x6b708f + #11 0x000021afcfa95dcf in acpi::acpi_impl::walk_resources(acpi::acpi_impl*, acpi_handle, const char*, acpi::Acpi::resources_callable) ../../src/devices/board/lib/acpi/acpi-impl.cc:41 +0x355dcf + #12 0x000021afcfaa8278 in acpi::device_builder::gather_resources(acpi::device_builder*, acpi::Acpi*, fidl::any_arena&, acpi::Manager*, acpi::device_builder::gather_resources_callback) ../../src/devices/board/lib/acpi/device-builder.cc:84 +0x368278 + #13 0x000021afcfbddb87 in acpi::Manager::configure_discovered_devices(acpi::Manager*) ../../src/devices/board/lib/acpi/manager.cc:75 +0x49db87 + #14 0x000021afcf99091d in publish_acpi_devices(acpi::Manager*, zx_device_t*, zx_device_t*) ../../src/devices/board/drivers/x86/acpi-nswalk.cc:95 +0x25091d + #15 0x000021afcf9c1d4e in x86::X86::do_init(x86::X86*) ../../src/devices/board/drivers/x86/x86.cc:60 +0x281d4e + #16 0x000021afcf9e33ad in λ(x86::X86::ddk_init::(anon class)*) ../../src/devices/board/drivers/x86/x86.cc:77 +0x2a33ad + #17 0x000021afcf9e313e in fit::internal::target<(lambda at../../src/devices/board/drivers/x86/x86.cc:76:19), false, false, std::__2::allocator, void>::invoke(void*) ../../sdk/lib/fit/include/lib/fit/internal/function.h:183 +0x2a313e + #18 0x000021afcfbab4c7 in fit::internal::function_base<16UL, false, void(), std::__2::allocator>::invoke(const fit::internal::function_base<16UL, false, void (), std::__2::allocator >*) ../../sdk/lib/fit/include/lib/fit/internal/function.h:522 +0x46b4c7 + #19 0x000021afcfbab342 in fit::function_impl<16UL, false, void(), std::__2::allocator>::operator()(const fit::function_impl<16UL, false, void (), std::__2::allocator >*) ../../sdk/lib/fit/include/lib/fit/function.h:315 +0x46b342 + #20 0x000021afcfcd98c3 in async::internal::retained_task::Handler(async_dispatcher_t*, async_task_t*, zx_status_t) ../../sdk/lib/async/task.cc:24 +0x5998c3 + #21 0x00002290f9924616 in λ(const driver_runtime::Dispatcher::post_task::(anon class)*, std::__2::unique_ptr >, zx_status_t) ../../src/devices/bin/driver_runtime/dispatcher.cc:789 +0x10a616 + #22 0x00002290f9924323 in fit::internal::target<(lambda at../../src/devices/bin/driver_runtime/dispatcher.cc:788:7), true, false, std::__2::allocator, void, std::__2::unique_ptr>, int>::invoke(void*, std::__2::unique_ptr >, int) ../../sdk/lib/fit/include/lib/fit/internal/function.h:128 +0x10a323 + #23 0x00002290f9904b76 in fit::internal::function_base<24UL, true, void(std::__2::unique_ptr>, int), std::__2::allocator>::invoke(const fit::internal::function_base<24UL, true, void (std::__2::unique_ptr >, int), std::__2::allocator >*, std::__2::unique_ptr >, int) ../../sdk/lib/fit/include/lib/fit/internal/function.h:522 +0xeab76 + #24 0x00002290f9904831 in fit::callback_impl<24UL, true, void(std::__2::unique_ptr>, int), std::__2::allocator>::operator()(fit::callback_impl<24UL, true, void (std::__2::unique_ptr >, int), std::__2::allocator >*, std::__2::unique_ptr >, int) ../../sdk/lib/fit/include/lib/fit/function.h:471 +0xea831 + #25 0x00002290f98d5adc in driver_runtime::callback_request::Call(driver_runtime::callback_request*, std::__2::unique_ptr >, zx_status_t) ../../src/devices/bin/driver_runtime/callback_request.h:74 +0xbbadc + #26 0x00002290f98e1e58 in driver_runtime::Dispatcher::dispatch_callback(driver_runtime::Dispatcher*, std::__2::unique_ptr >) ../../src/devices/bin/driver_runtime/dispatcher.cc:1248 +0xc7e58 + #27 0x00002290f98e4159 in driver_runtime::Dispatcher::dispatch_callbacks(driver_runtime::Dispatcher*, std::__2::unique_ptr >, fbl::ref_ptr) ../../src/devices/bin/driver_runtime/dispatcher.cc:1308 +0xca159 + #28 0x00002290f9918414 in λ(const driver_runtime::Dispatcher::create_with_adder::(anon class)*, std::__2::unique_ptr >, fbl::ref_ptr) ../../src/devices/bin/driver_runtime/dispatcher.cc:353 +0xfe414 + #29 0x00002290f991812d in fit::internal::target<(lambda at../../src/devices/bin/driver_runtime/dispatcher.cc:351:7), true, false, std::__2::allocator, void, std::__2::unique_ptr>, fbl::ref_ptr>::invoke(void*, std::__2::unique_ptr >, fbl::ref_ptr) ../../sdk/lib/fit/include/lib/fit/internal/function.h:128 +0xfe12d + #30 0x00002290f9906fc7 in fit::internal::function_base<8UL, true, void(std::__2::unique_ptr>, fbl::ref_ptr), std::__2::allocator>::invoke(const fit::internal::function_base<8UL, true, void (std::__2::unique_ptr >, fbl::ref_ptr), std::__2::allocator >*, std::__2::unique_ptr >, fbl::ref_ptr) ../../sdk/lib/fit/include/lib/fit/internal/function.h:522 +0xecfc7 + #31 0x00002290f9906c66 in fit::function_impl<8UL, true, void(std::__2::unique_ptr>, fbl::ref_ptr), std::__2::allocator>::operator()(const fit::function_impl<8UL, true, void (std::__2::unique_ptr >, fbl::ref_ptr), std::__2::allocator >*, std::__2::unique_ptr >, fbl::ref_ptr) ../../sdk/lib/fit/include/lib/fit/function.h:315 +0xecc66 + #32 0x00002290f98e73d9 in driver_runtime::Dispatcher::event_waiter::invoke_callback(driver_runtime::Dispatcher::event_waiter*, std::__2::unique_ptr >, fbl::ref_ptr) ../../src/devices/bin/driver_runtime/dispatcher.h:543 +0xcd3d9 + #33 0x00002290f98e700d in driver_runtime::Dispatcher::event_waiter::handle_event(std::__2::unique_ptr >, async_dispatcher_t*, async::wait_base*, zx_status_t, zx_packet_signal_t const*) ../../src/devices/bin/driver_runtime/dispatcher.cc:1442 +0xcd00d + #34 0x00002290f9918983 in async_loop_owned_event_handler::handle_event(async_loop_owned_event_handler*, async_dispatcher_t*, async::wait_base*, zx_status_t, zx_packet_signal_t const*) ../../src/devices/bin/driver_runtime/async_loop_owned_event_handler.h:59 +0xfe983 + #35 0x00002290f9918b9e in async::wait_method, &async_loop_owned_event_handler::handle_event>::call_handler(async_dispatcher_t*, async_wait_t*, zx_status_t, zx_packet_signal_t const*) ../../sdk/lib/async/include/lib/async/cpp/wait.h:201 +0xfeb9e + #36 0x00002290f99bf509 in async_loop_dispatch_wait(async_loop_t*, async_wait_t*, zx_status_t, zx_packet_signal_t const*) ../../sdk/lib/async-loop/loop.c:394 +0x1a5509 + #37 0x00002290f99b9958 in async_loop_run_once(async_loop_t*, zx_time_t) ../../sdk/lib/async-loop/loop.c:343 +0x19f958 + #38 0x00002290f99b9247 in async_loop_run(async_loop_t*, zx_time_t, _Bool) ../../sdk/lib/async-loop/loop.c:301 +0x19f247 + #39 0x00002290f99ba962 in async_loop_run_thread(void*) ../../sdk/lib/async-loop/loop.c:860 +0x1a0962 + #40 0x000041afd176ef30 in start_c11(void*) ../../zircon/third_party/ulib/musl/pthread/pthread_create.c:63 +0x84f30 + #41 0x000041afd18a448d in thread_trampoline(uintptr_t, uintptr_t) ../../zircon/system/ulib/runtime/thread.cc:100 +0x1ba48d + +Link: https://github.com/acpica/acpica/commit/1c28da22 +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/4664267.LvFx2qVVIh@rjwysocki.net +Signed-off-by: Tamir Duberstein +[ rjw: Pick up the tag from Tamir ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/amlresrc.h | 8 ++++---- + drivers/acpi/acpica/rsaddr.c | 13 ++++--------- + drivers/acpi/acpica/rscalc.c | 22 +++++----------------- + drivers/acpi/acpica/rslist.c | 12 +++--------- + drivers/acpi/acpica/utresrc.c | 14 +++++--------- + 5 files changed, 21 insertions(+), 48 deletions(-) + +diff --git a/drivers/acpi/acpica/amlresrc.h b/drivers/acpi/acpica/amlresrc.h +index 4e88f9fc2a289..b6588b7fa8986 100644 +--- a/drivers/acpi/acpica/amlresrc.h ++++ b/drivers/acpi/acpica/amlresrc.h +@@ -504,10 +504,6 @@ struct aml_resource_pin_group_config { + + #define AML_RESOURCE_PIN_GROUP_CONFIG_REVISION 1 /* ACPI 6.2 */ + +-/* restore default alignment */ +- +-#pragma pack() +- + /* Union of all resource descriptors, so we can allocate the worst case */ + + union aml_resource { +@@ -562,6 +558,10 @@ union aml_resource { + u8 byte_item; + }; + ++/* restore default alignment */ ++ ++#pragma pack() ++ + /* Interfaces used by both the disassembler and compiler */ + + void +diff --git a/drivers/acpi/acpica/rsaddr.c b/drivers/acpi/acpica/rsaddr.c +index 27384ee245f09..f92010e667cda 100644 +--- a/drivers/acpi/acpica/rsaddr.c ++++ b/drivers/acpi/acpica/rsaddr.c +@@ -272,18 +272,13 @@ u8 + acpi_rs_get_address_common(struct acpi_resource *resource, + union aml_resource *aml) + { +- struct aml_resource_address address; +- + ACPI_FUNCTION_ENTRY(); + +- /* Avoid undefined behavior: member access within misaligned address */ +- +- memcpy(&address, aml, sizeof(address)); +- + /* Validate the Resource Type */ + +- if ((address.resource_type > 2) && +- (address.resource_type < 0xC0) && (address.resource_type != 0x0A)) { ++ if ((aml->address.resource_type > 2) && ++ (aml->address.resource_type < 0xC0) && ++ (aml->address.resource_type != 0x0A)) { + return (FALSE); + } + +@@ -304,7 +299,7 @@ acpi_rs_get_address_common(struct acpi_resource *resource, + /* Generic resource type, just grab the type_specific byte */ + + resource->data.address.info.type_specific = +- address.specific_flags; ++ aml->address.specific_flags; + } + + return (TRUE); +diff --git a/drivers/acpi/acpica/rscalc.c b/drivers/acpi/acpica/rscalc.c +index 6e7a152d64595..242daf45e20ef 100644 +--- a/drivers/acpi/acpica/rscalc.c ++++ b/drivers/acpi/acpica/rscalc.c +@@ -608,18 +608,12 @@ acpi_rs_get_list_length(u8 *aml_buffer, + + case ACPI_RESOURCE_NAME_SERIAL_BUS:{ + +- /* Avoid undefined behavior: member access within misaligned address */ +- +- struct aml_resource_common_serialbus +- common_serial_bus; +- memcpy(&common_serial_bus, aml_resource, +- sizeof(common_serial_bus)); +- + minimum_aml_resource_length = + acpi_gbl_resource_aml_serial_bus_sizes +- [common_serial_bus.type]; ++ [aml_resource->common_serial_bus.type]; + extra_struct_bytes += +- common_serial_bus.resource_length - ++ aml_resource->common_serial_bus. ++ resource_length - + minimum_aml_resource_length; + break; + } +@@ -688,16 +682,10 @@ acpi_rs_get_list_length(u8 *aml_buffer, + */ + if (acpi_ut_get_resource_type(aml_buffer) == + ACPI_RESOURCE_NAME_SERIAL_BUS) { +- +- /* Avoid undefined behavior: member access within misaligned address */ +- +- struct aml_resource_common_serialbus common_serial_bus; +- memcpy(&common_serial_bus, aml_resource, +- sizeof(common_serial_bus)); +- + buffer_size = + acpi_gbl_resource_struct_serial_bus_sizes +- [common_serial_bus.type] + extra_struct_bytes; ++ [aml_resource->common_serial_bus.type] + ++ extra_struct_bytes; + } else { + buffer_size = + acpi_gbl_resource_struct_sizes[resource_index] + +diff --git a/drivers/acpi/acpica/rslist.c b/drivers/acpi/acpica/rslist.c +index 164c96e063c6e..e46efaa889cdd 100644 +--- a/drivers/acpi/acpica/rslist.c ++++ b/drivers/acpi/acpica/rslist.c +@@ -55,21 +55,15 @@ acpi_rs_convert_aml_to_resources(u8 * aml, + aml_resource = ACPI_CAST_PTR(union aml_resource, aml); + + if (acpi_ut_get_resource_type(aml) == ACPI_RESOURCE_NAME_SERIAL_BUS) { +- +- /* Avoid undefined behavior: member access within misaligned address */ +- +- struct aml_resource_common_serialbus common_serial_bus; +- memcpy(&common_serial_bus, aml_resource, +- sizeof(common_serial_bus)); +- +- if (common_serial_bus.type > AML_RESOURCE_MAX_SERIALBUSTYPE) { ++ if (aml_resource->common_serial_bus.type > ++ AML_RESOURCE_MAX_SERIALBUSTYPE) { + conversion_table = NULL; + } else { + /* This is an I2C, SPI, UART, or CSI2 serial_bus descriptor */ + + conversion_table = + acpi_gbl_convert_resource_serial_bus_dispatch +- [common_serial_bus.type]; ++ [aml_resource->common_serial_bus.type]; + } + } else { + conversion_table = +diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c +index cff7901f7866e..e1cc3d3487508 100644 +--- a/drivers/acpi/acpica/utresrc.c ++++ b/drivers/acpi/acpica/utresrc.c +@@ -361,20 +361,16 @@ acpi_ut_validate_resource(struct acpi_walk_state *walk_state, + aml_resource = ACPI_CAST_PTR(union aml_resource, aml); + if (resource_type == ACPI_RESOURCE_NAME_SERIAL_BUS) { + +- /* Avoid undefined behavior: member access within misaligned address */ +- +- struct aml_resource_common_serialbus common_serial_bus; +- memcpy(&common_serial_bus, aml_resource, +- sizeof(common_serial_bus)); +- + /* Validate the bus_type field */ + +- if ((common_serial_bus.type == 0) || +- (common_serial_bus.type > AML_RESOURCE_MAX_SERIALBUSTYPE)) { ++ if ((aml_resource->common_serial_bus.type == 0) || ++ (aml_resource->common_serial_bus.type > ++ AML_RESOURCE_MAX_SERIALBUSTYPE)) { + if (walk_state) { + ACPI_ERROR((AE_INFO, + "Invalid/unsupported SerialBus resource descriptor: BusType 0x%2.2X", +- common_serial_bus.type)); ++ aml_resource->common_serial_bus. ++ type)); + } + return (AE_AML_INVALID_RESOURCE_TYPE); + } +-- +2.39.5 + diff --git a/queue-6.15/acpica-avoid-sequence-overread-in-call-to-strncmp.patch b/queue-6.15/acpica-avoid-sequence-overread-in-call-to-strncmp.patch new file mode 100644 index 0000000000..d801f3f863 --- /dev/null +++ b/queue-6.15/acpica-avoid-sequence-overread-in-call-to-strncmp.patch @@ -0,0 +1,57 @@ +From 522336afd938bd2c6605554e4bf1d6d2bb20c543 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 21:30:27 +0200 +Subject: ACPICA: Avoid sequence overread in call to strncmp() + +From: Ahmed Salem + +[ Upstream commit 64b9dfd0776e9c38d733094859a09f13282ce6f8 ] + +ACPICA commit 8b83a8d88dfec59ea147fad35fc6deea8859c58c + +ap_get_table_length() checks if tables are valid by +calling ap_is_valid_header(). The latter then calls +ACPI_VALIDATE_RSDP_SIG(Table->Signature). + +ap_is_valid_header() accepts struct acpi_table_header as an argument, so +the signature size is always fixed to 4 bytes. + +The problem is when the string comparison is between ACPI-defined table +signature and ACPI_SIG_RSDP. Common ACPI table header specifies the +Signature field to be 4 bytes long[1], with the exception of the RSDP +structure whose signature is 8 bytes long "RSD PTR " (including the +trailing blank character)[2]. Calling strncmp(sig, rsdp_sig, 8) would +then result in a sequence overread[3] as sig would be smaller (4 bytes) +than the specified bound (8 bytes). + +As a workaround, pass the bound conditionally based on the size of the +signature being passed. + +Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#system-description-table-header [1] +Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#root-system-description-pointer-rsdp-structure [2] +Link: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wstringop-overread [3] +Link: https://github.com/acpica/acpica/commit/8b83a8d8 +Signed-off-by: Ahmed Salem +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/2248233.Mh6RI2rZIc@rjwysocki.net +Signed-off-by: Sasha Levin +--- + include/acpi/actypes.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index f7b3c4a4b7e7c..5b9f9a6125484 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -527,7 +527,7 @@ typedef u64 acpi_integer; + + /* Support for the special RSDP signature (8 characters) */ + +-#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, 8)) ++#define ACPI_VALIDATE_RSDP_SIG(a) (!strncmp (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, (sizeof(a) < 8) ? ACPI_NAMESEG_SIZE : 8)) + #define ACPI_MAKE_RSDP_SIG(dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8)) + + /* Support for OEMx signature (x can be any character) */ +-- +2.39.5 + diff --git a/queue-6.15/acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch b/queue-6.15/acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch new file mode 100644 index 0000000000..7250a780a9 --- /dev/null +++ b/queue-6.15/acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch @@ -0,0 +1,110 @@ +From d8c9882caa307a80a1ffc35b10eabf720d8c4eb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 21:05:24 +0100 +Subject: ACPICA: fix acpi operand cache leak in dswstate.c + +From: Seunghun Han + +[ Upstream commit 156fd20a41e776bbf334bd5e45c4f78dfc90ce1c ] + +ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 + +I found an ACPI cache leak in ACPI early termination and boot continuing case. + +When early termination occurs due to malicious ACPI table, Linux kernel +terminates ACPI function and continues to boot process. While kernel terminates +ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak. + +Boot log of ACPI operand cache leak is as follows: +>[ 0.585957] ACPI: Added _OSI(Module Device) +>[ 0.587218] ACPI: Added _OSI(Processor Device) +>[ 0.588530] ACPI: Added _OSI(3.0 _SCP Extensions) +>[ 0.589790] ACPI: Added _OSI(Processor Aggregator Device) +>[ 0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155) +>[ 0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88) +>[ 0.597858] ACPI: Unable to start the ACPI Interpreter +>[ 0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) +>[ 0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects +>[ 0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26 +>[ 0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 +>[ 0.609177] Call Trace: +>[ 0.610063] ? dump_stack+0x5c/0x81 +>[ 0.611118] ? kmem_cache_destroy+0x1aa/0x1c0 +>[ 0.612632] ? acpi_sleep_proc_init+0x27/0x27 +>[ 0.613906] ? acpi_os_delete_cache+0xa/0x10 +>[ 0.617986] ? acpi_ut_delete_caches+0x3f/0x7b +>[ 0.619293] ? acpi_terminate+0xa/0x14 +>[ 0.620394] ? acpi_init+0x2af/0x34f +>[ 0.621616] ? __class_create+0x4c/0x80 +>[ 0.623412] ? video_setup+0x7f/0x7f +>[ 0.624585] ? acpi_sleep_proc_init+0x27/0x27 +>[ 0.625861] ? do_one_initcall+0x4e/0x1a0 +>[ 0.627513] ? kernel_init_freeable+0x19e/0x21f +>[ 0.628972] ? rest_init+0x80/0x80 +>[ 0.630043] ? kernel_init+0xa/0x100 +>[ 0.631084] ? ret_from_fork+0x25/0x30 +>[ 0.633343] vgaarb: loaded +>[ 0.635036] EDAC MC: Ver: 3.0.0 +>[ 0.638601] PCI: Probing PCI hardware +>[ 0.639833] PCI host bridge to bus 0000:00 +>[ 0.641031] pci_bus 0000:00: root bus resource [io 0x0000-0xffff] +> ... Continue to boot and log is omitted ... + +I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_ +delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push() +function uses walk_state->operand_index for start position of the top, but +acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it. +Therefore, this causes acpi operand memory leak. + +This cache leak causes a security threat because an old kernel (<= 4.9) shows +memory locations of kernel functions in stack dump. Some malicious users +could use this information to neutralize kernel ASLR. + +I made a patch to fix ACPI operand cache leak. + +Link: https://github.com/acpica/acpica/commit/987a3b5c +Signed-off-by: Seunghun Han +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/4999480.31r3eYUQgx@rjwysocki.net +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/dsutils.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c +index fb9ed5e1da89d..2bdae8a25e084 100644 +--- a/drivers/acpi/acpica/dsutils.c ++++ b/drivers/acpi/acpica/dsutils.c +@@ -668,6 +668,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, + union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS]; + u32 arg_count = 0; + u32 index = walk_state->num_operands; ++ u32 prev_num_operands = walk_state->num_operands; ++ u32 new_num_operands; + u32 i; + + ACPI_FUNCTION_TRACE_PTR(ds_create_operands, first_arg); +@@ -696,6 +698,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, + + /* Create the interpreter arguments, in reverse order */ + ++ new_num_operands = index; + index--; + for (i = 0; i < arg_count; i++) { + arg = arguments[index]; +@@ -720,7 +723,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, + * pop everything off of the operand stack and delete those + * objects + */ +- acpi_ds_obj_stack_pop_and_delete(arg_count, walk_state); ++ walk_state->num_operands = i; ++ acpi_ds_obj_stack_pop_and_delete(new_num_operands, walk_state); ++ ++ /* Restore operand count */ ++ walk_state->num_operands = prev_num_operands; + + ACPI_EXCEPTION((AE_INFO, status, "While creating Arg %u", index)); + return_ACPI_STATUS(status); +-- +2.39.5 + diff --git a/queue-6.15/acpica-fix-acpi-parse-and-parseext-cache-leaks.patch b/queue-6.15/acpica-fix-acpi-parse-and-parseext-cache-leaks.patch new file mode 100644 index 0000000000..e0828e6adf --- /dev/null +++ b/queue-6.15/acpica-fix-acpi-parse-and-parseext-cache-leaks.patch @@ -0,0 +1,236 @@ +From d8acff1e6f769c2d07a7d97d15874ef0a9f00d5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 21:06:21 +0100 +Subject: ACPICA: fix acpi parse and parseext cache leaks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Seunghun Han + +[ Upstream commit bed18f0bdcd6737a938264a59d67923688696fc4 ] + +ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5 + +I'm Seunghun Han, and I work for National Security Research Institute of +South Korea. + +I have been doing a research on ACPI and found an ACPI cache leak in ACPI +early abort cases. + +Boot log of ACPI cache leak is as follows: +[ 0.352414] ACPI: Added _OSI(Module Device) +[ 0.353182] ACPI: Added _OSI(Processor Device) +[ 0.353182] ACPI: Added _OSI(3.0 _SCP Extensions) +[ 0.353182] ACPI: Added _OSI(Processor Aggregator Device) +[ 0.356028] ACPI: Unable to start the ACPI Interpreter +[ 0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) +[ 0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects +[ 0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W +4.12.0-rc4-next-20170608+ #10 +[ 0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS +virtual_box 12/01/2006 +[ 0.361873] Call Trace: +[ 0.362243] ? dump_stack+0x5c/0x81 +[ 0.362591] ? kmem_cache_destroy+0x1aa/0x1c0 +[ 0.362944] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.363296] ? acpi_os_delete_cache+0xa/0x10 +[ 0.363646] ? acpi_ut_delete_caches+0x6d/0x7b +[ 0.364000] ? acpi_terminate+0xa/0x14 +[ 0.364000] ? acpi_init+0x2af/0x34f +[ 0.364000] ? __class_create+0x4c/0x80 +[ 0.364000] ? video_setup+0x7f/0x7f +[ 0.364000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.364000] ? do_one_initcall+0x4e/0x1a0 +[ 0.364000] ? kernel_init_freeable+0x189/0x20a +[ 0.364000] ? rest_init+0xc0/0xc0 +[ 0.364000] ? kernel_init+0xa/0x100 +[ 0.364000] ? ret_from_fork+0x25/0x30 + +I analyzed this memory leak in detail. I found that “Acpi-State” cache and +“Acpi-Parse” cache were merged because the size of cache objects was same +slab cache size. + +I finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked +using SLAB_NEVER_MERGE flag in kmem_cache_create() function. + +Real ACPI cache leak point is as follows: +[ 0.360101] ACPI: Added _OSI(Module Device) +[ 0.360101] ACPI: Added _OSI(Processor Device) +[ 0.360101] ACPI: Added _OSI(3.0 _SCP Extensions) +[ 0.361043] ACPI: Added _OSI(Processor Aggregator Device) +[ 0.364016] ACPI: Unable to start the ACPI Interpreter +[ 0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) +[ 0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects +[ 0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W +4.12.0-rc4-next-20170608+ #8 +[ 0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS +virtual_box 12/01/2006 +[ 0.372000] Call Trace: +[ 0.372000] ? dump_stack+0x5c/0x81 +[ 0.372000] ? kmem_cache_destroy+0x1aa/0x1c0 +[ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.372000] ? acpi_os_delete_cache+0xa/0x10 +[ 0.372000] ? acpi_ut_delete_caches+0x56/0x7b +[ 0.372000] ? acpi_terminate+0xa/0x14 +[ 0.372000] ? acpi_init+0x2af/0x34f +[ 0.372000] ? __class_create+0x4c/0x80 +[ 0.372000] ? video_setup+0x7f/0x7f +[ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.372000] ? do_one_initcall+0x4e/0x1a0 +[ 0.372000] ? kernel_init_freeable+0x189/0x20a +[ 0.372000] ? rest_init+0xc0/0xc0 +[ 0.372000] ? kernel_init+0xa/0x100 +[ 0.372000] ? ret_from_fork+0x25/0x30 +[ 0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects +[ 0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W +4.12.0-rc4-next-20170608+ #8 +[ 0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS +virtual_box 12/01/2006 +[ 0.392000] Call Trace: +[ 0.392000] ? dump_stack+0x5c/0x81 +[ 0.392000] ? kmem_cache_destroy+0x1aa/0x1c0 +[ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.392000] ? acpi_os_delete_cache+0xa/0x10 +[ 0.392000] ? acpi_ut_delete_caches+0x6d/0x7b +[ 0.392000] ? acpi_terminate+0xa/0x14 +[ 0.392000] ? acpi_init+0x2af/0x34f +[ 0.392000] ? __class_create+0x4c/0x80 +[ 0.392000] ? video_setup+0x7f/0x7f +[ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 +[ 0.392000] ? do_one_initcall+0x4e/0x1a0 +[ 0.392000] ? kernel_init_freeable+0x189/0x20a +[ 0.392000] ? rest_init+0xc0/0xc0 +[ 0.392000] ? kernel_init+0xa/0x100 +[ 0.392000] ? ret_from_fork+0x25/0x30 + +When early abort is occurred due to invalid ACPI information, Linux kernel +terminates ACPI by calling acpi_terminate() function. The function calls +acpi_ut_delete_caches() function to delete local caches (acpi_gbl_namespace_ +cache, state_cache, operand_cache, ps_node_cache, ps_node_ext_cache). + +But the deletion codes in acpi_ut_delete_caches() function only delete +slab caches using kmem_cache_destroy() function, therefore the cache +objects should be flushed before acpi_ut_delete_caches() function. + +"Acpi-Parse" cache and "Acpi-ParseExt" cache are used in an AML parse +function, acpi_ps_parse_loop(). The function should complete all ops +using acpi_ps_complete_final_op() when an error occurs due to invalid +AML codes. +However, the current implementation of acpi_ps_complete_final_op() does not +complete all ops when it meets some errors and this cause cache leak. + +This cache leak has a security threat because an old kernel (<= 4.9) shows +memory locations of kernel functions in stack dump. Some malicious users +could use this information to neutralize kernel ASLR. + +To fix ACPI cache leak for enhancing security, I made a patch to complete all +ops unconditionally for acpi_ps_complete_final_op() function. + +I hope that this patch improves the security of Linux kernel. + +Thank you. + +Link: https://github.com/acpica/acpica/commit/8829e70e +Signed-off-by: Seunghun Han +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/2363774.ElGaqSPkdT@rjwysocki.net +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/psobject.c | 52 ++++++++++------------------------ + 1 file changed, 15 insertions(+), 37 deletions(-) + +diff --git a/drivers/acpi/acpica/psobject.c b/drivers/acpi/acpica/psobject.c +index 54471083ba545..0bce1baaa62b3 100644 +--- a/drivers/acpi/acpica/psobject.c ++++ b/drivers/acpi/acpica/psobject.c +@@ -636,7 +636,8 @@ acpi_status + acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, + union acpi_parse_object *op, acpi_status status) + { +- acpi_status status2; ++ acpi_status return_status = status; ++ u8 ascending = TRUE; + + ACPI_FUNCTION_TRACE_PTR(ps_complete_final_op, walk_state); + +@@ -650,7 +651,7 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, + op)); + do { + if (op) { +- if (walk_state->ascending_callback != NULL) { ++ if (ascending && walk_state->ascending_callback != NULL) { + walk_state->op = op; + walk_state->op_info = + acpi_ps_get_opcode_info(op->common. +@@ -672,49 +673,26 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, + } + + if (status == AE_CTRL_TERMINATE) { +- status = AE_OK; +- +- /* Clean up */ +- do { +- if (op) { +- status2 = +- acpi_ps_complete_this_op +- (walk_state, op); +- if (ACPI_FAILURE +- (status2)) { +- return_ACPI_STATUS +- (status2); +- } +- } +- +- acpi_ps_pop_scope(& +- (walk_state-> +- parser_state), +- &op, +- &walk_state-> +- arg_types, +- &walk_state-> +- arg_count); +- +- } while (op); +- +- return_ACPI_STATUS(status); ++ ascending = FALSE; ++ return_status = AE_CTRL_TERMINATE; + } + + else if (ACPI_FAILURE(status)) { + + /* First error is most important */ + +- (void) +- acpi_ps_complete_this_op(walk_state, +- op); +- return_ACPI_STATUS(status); ++ ascending = FALSE; ++ return_status = status; + } + } + +- status2 = acpi_ps_complete_this_op(walk_state, op); +- if (ACPI_FAILURE(status2)) { +- return_ACPI_STATUS(status2); ++ status = acpi_ps_complete_this_op(walk_state, op); ++ if (ACPI_FAILURE(status)) { ++ ascending = FALSE; ++ if (ACPI_SUCCESS(return_status) || ++ return_status == AE_CTRL_TERMINATE) { ++ return_status = status; ++ } + } + } + +@@ -724,5 +702,5 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state, + + } while (op); + +- return_ACPI_STATUS(status); ++ return_ACPI_STATUS(return_status); + } +-- +2.39.5 + diff --git a/queue-6.15/acpica-utilities-fix-overflow-check-in-vsnprintf.patch b/queue-6.15/acpica-utilities-fix-overflow-check-in-vsnprintf.patch new file mode 100644 index 0000000000..81797def36 --- /dev/null +++ b/queue-6.15/acpica-utilities-fix-overflow-check-in-vsnprintf.patch @@ -0,0 +1,46 @@ +From c850f31ce578812031efd993be29987c3c3031f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 21:21:52 +0200 +Subject: ACPICA: utilities: Fix overflow check in vsnprintf() + +From: gldrk + +[ Upstream commit 12b660251007e00a3e4d47ec62dbe3a7ace7023e ] + +ACPICA commit d9d59b7918514ae55063b93f3ec041b1a569bf49 + +The old version breaks sprintf on 64-bit systems for buffers +outside [0..UINT32_MAX]. + +Link: https://github.com/acpica/acpica/commit/d9d59b79 +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/4994935.GXAFRqVoOG@rjwysocki.net +Signed-off-by: gldrk +[ rjw: Added the tag from gldrk ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/utprint.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/acpica/utprint.c b/drivers/acpi/acpica/utprint.c +index 42b30b9f93128..7fad03c5252c3 100644 +--- a/drivers/acpi/acpica/utprint.c ++++ b/drivers/acpi/acpica/utprint.c +@@ -333,11 +333,8 @@ int vsnprintf(char *string, acpi_size size, const char *format, va_list args) + + pos = string; + +- if (size != ACPI_UINT32_MAX) { +- end = string + size; +- } else { +- end = ACPI_CAST_PTR(char, ACPI_UINT32_MAX); +- } ++ size = ACPI_MIN(size, ACPI_PTR_DIFF(ACPI_MAX_PTR, string)); ++ end = string + size; + + for (; *format; ++format) { + if (*format != '%') { +-- +2.39.5 + diff --git a/queue-6.15/alsa-hda-cs35l41-fix-swapped-l-r-audio-channels-for-.patch b/queue-6.15/alsa-hda-cs35l41-fix-swapped-l-r-audio-channels-for-.patch new file mode 100644 index 0000000000..f1167649c5 --- /dev/null +++ b/queue-6.15/alsa-hda-cs35l41-fix-swapped-l-r-audio-channels-for-.patch @@ -0,0 +1,47 @@ +From d834fefef47fd57086855e993ef28dfe281de5bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 17:28:33 +0100 +Subject: ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios + laptops + +From: Stefan Binding + +[ Upstream commit e43a93c41982e82c1b703dd7fa9c1d965260fbb3 ] + +Fixes audio channel assignment from ACPI using configuration table. + +Signed-off-by: Stefan Binding +Link: https://patch.msgid.link/20250515162848.405055-3-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l41_hda_property.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c +index 61d2314834e7b..d8249d997c2a0 100644 +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -31,6 +31,9 @@ struct cs35l41_config { + }; + + static const struct cs35l41_config cs35l41_config_table[] = { ++ { "10251826", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, ++ { "1025182C", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, ++ { "10251844", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, + { "10280B27", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, + { "10280B28", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, + { "10280BEB", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, +@@ -452,6 +455,9 @@ struct cs35l41_prop_model { + static const struct cs35l41_prop_model cs35l41_prop_model_table[] = { + { "CLSA0100", NULL, lenovo_legion_no_acpi }, + { "CLSA0101", NULL, lenovo_legion_no_acpi }, ++ { "CSC3551", "10251826", generic_dsd_config }, ++ { "CSC3551", "1025182C", generic_dsd_config }, ++ { "CSC3551", "10251844", generic_dsd_config }, + { "CSC3551", "10280B27", generic_dsd_config }, + { "CSC3551", "10280B28", generic_dsd_config }, + { "CSC3551", "10280BEB", generic_dsd_config }, +-- +2.39.5 + diff --git a/queue-6.15/alsa-hda-realtek-add-support-for-acer-helios-laptops.patch b/queue-6.15/alsa-hda-realtek-add-support-for-acer-helios-laptops.patch new file mode 100644 index 0000000000..86b8d58a3a --- /dev/null +++ b/queue-6.15/alsa-hda-realtek-add-support-for-acer-helios-laptops.patch @@ -0,0 +1,60 @@ +From 773e309e0dd64fbd8dbb646b67c66d61b0d43572 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 17:28:32 +0100 +Subject: ALSA: hda/realtek: Add support for Acer Helios Laptops using CS35L41 + HDA + +From: Stefan Binding + +[ Upstream commit d64cbb5ed9227566c068ac9300a85912234d10aa ] + +Laptops use 2 CS35L41 Amps with HDA, using External boost with I2C. +Similar to previous Acer laptops, these laptops also need the +ALC255_FIXUP_PREDATOR_SUBWOOFER quirk to function properly. + +Signed-off-by: Stefan Binding +Link: https://patch.msgid.link/20250515162848.405055-2-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 20ab1fb2195ff..cd0d7ba7320ef 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8029,6 +8029,7 @@ enum { + ALC283_FIXUP_DELL_HP_RESUME, + ALC294_FIXUP_ASUS_CS35L41_SPI_2, + ALC274_FIXUP_HP_AIO_BIND_DACS, ++ ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2, + }; + + /* A special fixup for Lenovo C940 and Yoga Duet 7; +@@ -9301,6 +9302,12 @@ static const struct hda_fixup alc269_fixups[] = { + { } + } + }, ++ [ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cs35l41_fixup_i2c_two, ++ .chained = true, ++ .chain_id = ALC255_FIXUP_PREDATOR_SUBWOOFER ++ }, + [ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -10456,6 +10463,9 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x1534, "Acer Predator PH315-54", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x159c, "Acer Nitro 5 AN515-58", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x169a, "Acer Swift SFG16", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED), ++ SND_PCI_QUIRK(0x1025, 0x1826, "Acer Helios ZPC", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x1025, 0x182c, "Acer Helios ZPD", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x1025, 0x1844, "Acer Helios ZPS", ALC287_FIXUP_PREDATOR_SPK_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x053c, "Dell Latitude E5430", ALC292_FIXUP_DELL_E7X), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), +-- +2.39.5 + diff --git a/queue-6.15/arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch b/queue-6.15/arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch new file mode 100644 index 0000000000..905697df87 --- /dev/null +++ b/queue-6.15/arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch @@ -0,0 +1,87 @@ +From f93c4e7cc37c5b6e1e3dcb9048b52c5080b2df6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Mar 2025 16:00:39 -0700 +Subject: ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY + +From: Sukrut Bellary + +[ Upstream commit 47fe74098f3dadba2f9cc1e507d813a4aa93f5f3 ] + +Don't put the l4ls clk domain to sleep in case of standby. +Since CM3 PM FW[1](ti-v4.1.y) doesn't wake-up/enable the l4ls clk domain +upon wake-up, CM3 PM FW fails to wake-up the MPU. + +[1] https://git.ti.com/cgit/processor-firmware/ti-amx3-cm3-pm-firmware/ + +Signed-off-by: Sukrut Bellary +Tested-by: Judith Mendez +Link: https://lore.kernel.org/r/20250318230042.3138542-2-sbellary@baylibre.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/clockdomain.h | 1 + + arch/arm/mach-omap2/clockdomains33xx_data.c | 2 +- + arch/arm/mach-omap2/cm33xx.c | 14 +++++++++++++- + 3 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-omap2/clockdomain.h b/arch/arm/mach-omap2/clockdomain.h +index c36fb27212615..86a2f9e5d0ef9 100644 +--- a/arch/arm/mach-omap2/clockdomain.h ++++ b/arch/arm/mach-omap2/clockdomain.h +@@ -48,6 +48,7 @@ + #define CLKDM_NO_AUTODEPS (1 << 4) + #define CLKDM_ACTIVE_WITH_MPU (1 << 5) + #define CLKDM_MISSING_IDLE_REPORTING (1 << 6) ++#define CLKDM_STANDBY_FORCE_WAKEUP BIT(7) + + #define CLKDM_CAN_HWSUP (CLKDM_CAN_ENABLE_AUTO | CLKDM_CAN_DISABLE_AUTO) + #define CLKDM_CAN_SWSUP (CLKDM_CAN_FORCE_SLEEP | CLKDM_CAN_FORCE_WAKEUP) +diff --git a/arch/arm/mach-omap2/clockdomains33xx_data.c b/arch/arm/mach-omap2/clockdomains33xx_data.c +index 87f4e927eb183..c05a3c07d4486 100644 +--- a/arch/arm/mach-omap2/clockdomains33xx_data.c ++++ b/arch/arm/mach-omap2/clockdomains33xx_data.c +@@ -19,7 +19,7 @@ static struct clockdomain l4ls_am33xx_clkdm = { + .pwrdm = { .name = "per_pwrdm" }, + .cm_inst = AM33XX_CM_PER_MOD, + .clkdm_offs = AM33XX_CM_PER_L4LS_CLKSTCTRL_OFFSET, +- .flags = CLKDM_CAN_SWSUP, ++ .flags = CLKDM_CAN_SWSUP | CLKDM_STANDBY_FORCE_WAKEUP, + }; + + static struct clockdomain l3s_am33xx_clkdm = { +diff --git a/arch/arm/mach-omap2/cm33xx.c b/arch/arm/mach-omap2/cm33xx.c +index acdf72a541c02..a4dd42abda89b 100644 +--- a/arch/arm/mach-omap2/cm33xx.c ++++ b/arch/arm/mach-omap2/cm33xx.c +@@ -20,6 +20,9 @@ + #include "cm-regbits-34xx.h" + #include "cm-regbits-33xx.h" + #include "prm33xx.h" ++#if IS_ENABLED(CONFIG_SUSPEND) ++#include ++#endif + + /* + * CLKCTRL_IDLEST_*: possible values for the CM_*_CLKCTRL.IDLEST bitfield: +@@ -328,8 +331,17 @@ static int am33xx_clkdm_clk_disable(struct clockdomain *clkdm) + { + bool hwsup = false; + ++#if IS_ENABLED(CONFIG_SUSPEND) ++ /* ++ * In case of standby, Don't put the l4ls clk domain to sleep. ++ * Since CM3 PM FW doesn't wake-up/enable the l4ls clk domain ++ * upon wake-up, CM3 PM FW fails to wake-up th MPU. ++ */ ++ if (pm_suspend_target_state == PM_SUSPEND_STANDBY && ++ (clkdm->flags & CLKDM_STANDBY_FORCE_WAKEUP)) ++ return 0; ++#endif + hwsup = am33xx_cm_is_clkdm_in_hwsup(clkdm->cm_inst, clkdm->clkdm_offs); +- + if (!hwsup && (clkdm->flags & CLKDM_CAN_FORCE_SLEEP)) + am33xx_clkdm_sleep(clkdm); + +-- +2.39.5 + diff --git a/queue-6.15/arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch b/queue-6.15/arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch new file mode 100644 index 0000000000..b9e2f3edbc --- /dev/null +++ b/queue-6.15/arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch @@ -0,0 +1,166 @@ +From 35779b793ca3675d56d0d659997b99b57803f5a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 14:29:47 +0800 +Subject: arm64/cpuinfo: only show one cpu's info in c_show() + +From: Ye Bin + +[ Upstream commit 7bb797757bf5720543f1c5115b40a8d646d5c1cc ] + +Currently, when ARM64 displays CPU information, every call to c_show() +assembles all CPU information. However, as the number of CPUs increases, +this can lead to insufficient buffer space due to excessive assembly in +a single call, causing repeated expansion and multiple calls to c_show(). + +To prevent this invalid c_show() call, only one CPU's information is +assembled each time c_show() is called. + +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20250421062947.4072855-1-yebin@huaweicloud.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/cpuinfo.c | 107 ++++++++++++++++++------------------ + 1 file changed, 53 insertions(+), 54 deletions(-) + +diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c +index 285d7d5383420..750864d0165bd 100644 +--- a/arch/arm64/kernel/cpuinfo.c ++++ b/arch/arm64/kernel/cpuinfo.c +@@ -209,80 +209,79 @@ static const char *const compat_hwcap2_str[] = { + + static int c_show(struct seq_file *m, void *v) + { +- int i, j; ++ int j; ++ int cpu = m->index; + bool compat = personality(current->personality) == PER_LINUX32; ++ struct cpuinfo_arm64 *cpuinfo = v; ++ u32 midr = cpuinfo->reg_midr; + +- for_each_online_cpu(i) { +- struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i); +- u32 midr = cpuinfo->reg_midr; +- +- /* +- * glibc reads /proc/cpuinfo to determine the number of +- * online processors, looking for lines beginning with +- * "processor". Give glibc what it expects. +- */ +- seq_printf(m, "processor\t: %d\n", i); +- if (compat) +- seq_printf(m, "model name\t: ARMv8 Processor rev %d (%s)\n", +- MIDR_REVISION(midr), COMPAT_ELF_PLATFORM); ++ /* ++ * glibc reads /proc/cpuinfo to determine the number of ++ * online processors, looking for lines beginning with ++ * "processor". Give glibc what it expects. ++ */ ++ seq_printf(m, "processor\t: %d\n", cpu); ++ if (compat) ++ seq_printf(m, "model name\t: ARMv8 Processor rev %d (%s)\n", ++ MIDR_REVISION(midr), COMPAT_ELF_PLATFORM); + +- seq_printf(m, "BogoMIPS\t: %lu.%02lu\n", +- loops_per_jiffy / (500000UL/HZ), +- loops_per_jiffy / (5000UL/HZ) % 100); ++ seq_printf(m, "BogoMIPS\t: %lu.%02lu\n", ++ loops_per_jiffy / (500000UL/HZ), ++ loops_per_jiffy / (5000UL/HZ) % 100); + +- /* +- * Dump out the common processor features in a single line. +- * Userspace should read the hwcaps with getauxval(AT_HWCAP) +- * rather than attempting to parse this, but there's a body of +- * software which does already (at least for 32-bit). +- */ +- seq_puts(m, "Features\t:"); +- if (compat) { ++ /* ++ * Dump out the common processor features in a single line. ++ * Userspace should read the hwcaps with getauxval(AT_HWCAP) ++ * rather than attempting to parse this, but there's a body of ++ * software which does already (at least for 32-bit). ++ */ ++ seq_puts(m, "Features\t:"); ++ if (compat) { + #ifdef CONFIG_COMPAT +- for (j = 0; j < ARRAY_SIZE(compat_hwcap_str); j++) { +- if (compat_elf_hwcap & (1 << j)) { +- /* +- * Warn once if any feature should not +- * have been present on arm64 platform. +- */ +- if (WARN_ON_ONCE(!compat_hwcap_str[j])) +- continue; +- +- seq_printf(m, " %s", compat_hwcap_str[j]); +- } ++ for (j = 0; j < ARRAY_SIZE(compat_hwcap_str); j++) { ++ if (compat_elf_hwcap & (1 << j)) { ++ /* ++ * Warn once if any feature should not ++ * have been present on arm64 platform. ++ */ ++ if (WARN_ON_ONCE(!compat_hwcap_str[j])) ++ continue; ++ ++ seq_printf(m, " %s", compat_hwcap_str[j]); + } ++ } + +- for (j = 0; j < ARRAY_SIZE(compat_hwcap2_str); j++) +- if (compat_elf_hwcap2 & (1 << j)) +- seq_printf(m, " %s", compat_hwcap2_str[j]); ++ for (j = 0; j < ARRAY_SIZE(compat_hwcap2_str); j++) ++ if (compat_elf_hwcap2 & (1 << j)) ++ seq_printf(m, " %s", compat_hwcap2_str[j]); + #endif /* CONFIG_COMPAT */ +- } else { +- for (j = 0; j < ARRAY_SIZE(hwcap_str); j++) +- if (cpu_have_feature(j)) +- seq_printf(m, " %s", hwcap_str[j]); +- } +- seq_puts(m, "\n"); +- +- seq_printf(m, "CPU implementer\t: 0x%02x\n", +- MIDR_IMPLEMENTOR(midr)); +- seq_printf(m, "CPU architecture: 8\n"); +- seq_printf(m, "CPU variant\t: 0x%x\n", MIDR_VARIANT(midr)); +- seq_printf(m, "CPU part\t: 0x%03x\n", MIDR_PARTNUM(midr)); +- seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr)); ++ } else { ++ for (j = 0; j < ARRAY_SIZE(hwcap_str); j++) ++ if (cpu_have_feature(j)) ++ seq_printf(m, " %s", hwcap_str[j]); + } ++ seq_puts(m, "\n"); ++ ++ seq_printf(m, "CPU implementer\t: 0x%02x\n", ++ MIDR_IMPLEMENTOR(midr)); ++ seq_puts(m, "CPU architecture: 8\n"); ++ seq_printf(m, "CPU variant\t: 0x%x\n", MIDR_VARIANT(midr)); ++ seq_printf(m, "CPU part\t: 0x%03x\n", MIDR_PARTNUM(midr)); ++ seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr)); + + return 0; + } + + static void *c_start(struct seq_file *m, loff_t *pos) + { +- return *pos < 1 ? (void *)1 : NULL; ++ *pos = cpumask_next(*pos - 1, cpu_online_mask); ++ return *pos < nr_cpu_ids ? &per_cpu(cpu_data, *pos) : NULL; + } + + static void *c_next(struct seq_file *m, void *v, loff_t *pos) + { + ++*pos; +- return NULL; ++ return c_start(m, pos); + } + + static void c_stop(struct seq_file *m, void *v) +-- +2.39.5 + diff --git a/queue-6.15/asoc-amd-yc-add-quirk-for-lenovo-yoga-pro-7-14asp9.patch b/queue-6.15/asoc-amd-yc-add-quirk-for-lenovo-yoga-pro-7-14asp9.patch new file mode 100644 index 0000000000..ec1ba1afab --- /dev/null +++ b/queue-6.15/asoc-amd-yc-add-quirk-for-lenovo-yoga-pro-7-14asp9.patch @@ -0,0 +1,51 @@ +From 3e85054b42377273b799b59c7d34a230a578e3e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 May 2025 01:27:41 +0300 +Subject: ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9 + +From: Talhah Peerbhai + +[ Upstream commit a28206060dc5848a1a2a15b7f6ac6223d869084d ] + +Similar to many other Lenovo models with AMD chips, the Lenovo +Yoga Pro 7 14ASP9 (product name 83HN) requires a specific quirk +to ensure internal mic detection. This patch adds a quirk fixing this. + +Signed-off-by: Talhah Peerbhai +Link: https://patch.msgid.link/20250515222741.144616-1-talhah.peerbhai@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index e632f16c91025..3d9da93d22ee8 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -311,6 +311,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "83AS"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "83HN"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +@@ -360,7 +367,7 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "M5402RA"), + } + }, +- { ++ { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), +-- +2.39.5 + diff --git a/queue-6.15/asoc-intel-sdw_utils-assign-initial-value-in-asoc_sd.patch b/queue-6.15/asoc-intel-sdw_utils-assign-initial-value-in-asoc_sd.patch new file mode 100644 index 0000000000..0da8771fc7 --- /dev/null +++ b/queue-6.15/asoc-intel-sdw_utils-assign-initial-value-in-asoc_sd.patch @@ -0,0 +1,41 @@ +From 1f0e36c5d4d0dd10d643526b7f69323612862e02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 May 2025 02:54:23 +0800 +Subject: ASoC: intel/sdw_utils: Assign initial value in + asoc_sdw_rt_amp_spk_rtd_init() + +From: I Hsin Cheng + +[ Upstream commit 5fb3878216aece471af030b33a9fbef3babd8617 ] + +Initialize "ret" with "-EINVAL" to handle cases where "strstr()" for +"codec_dai->component->name_prefix" doesn't find "-1" nor "-2". In that +case "name_prefix" is invalid because for current implementation it's +expected to have either "-1" or "-2" in it. (Maybe "-3", "-4" and so on +in the future.) + +Link: https://scan5.scan.coverity.com/#/project-view/36179/10063?selectedIssue=1627120 +Signed-off-by: I Hsin Cheng +Link: https://patch.msgid.link/20250505185423.680608-1-richard120310@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sdw_utils/soc_sdw_rt_amp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sdw_utils/soc_sdw_rt_amp.c b/sound/soc/sdw_utils/soc_sdw_rt_amp.c +index 0538c252ba69b..83c2368170cb5 100644 +--- a/sound/soc/sdw_utils/soc_sdw_rt_amp.c ++++ b/sound/soc/sdw_utils/soc_sdw_rt_amp.c +@@ -190,7 +190,7 @@ int asoc_sdw_rt_amp_spk_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc + const struct snd_soc_dapm_route *rt_amp_map; + char codec_name[CODEC_NAME_SIZE]; + struct snd_soc_dai *codec_dai; +- int ret; ++ int ret = -EINVAL; + int i; + + rt_amp_map = get_codec_name_and_route(dai, codec_name); +-- +2.39.5 + diff --git a/queue-6.15/asoc-simple-card-utils-fixup-dlc-xxx-handling-for-er.patch b/queue-6.15/asoc-simple-card-utils-fixup-dlc-xxx-handling-for-er.patch new file mode 100644 index 0000000000..077897e511 --- /dev/null +++ b/queue-6.15/asoc-simple-card-utils-fixup-dlc-xxx-handling-for-er.patch @@ -0,0 +1,112 @@ +From 17d9c5774ff412d198b79ba3958c1298f1d6b3a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 00:45:59 +0000 +Subject: ASoC: simple-card-utils: fixup dlc->xxx handling for error case + +From: Kuninori Morimoto + +[ Upstream commit 2b4ce994afca0690ab79b7860045e6883e8706db ] + +Current graph_util_parse_dai() has 2 issue for dlc->xxx handling. + +1) dlc->xxx might be filled if snd_soc_get_dai_via_args() (A) works. + In such case it will fill dlc->xxx first (B), and detect error + after that (C). We need to fill dlc->xxx in success case only. + +(A) dai = snd_soc_get_dai_via_args(&args); + if (dai) { + ret = -ENOMEM; + ^ dlc->of_node = ... +(B) dlc->dai_name = ... + v dlc->dai_args = ... +(C) if (!dlc->dai_args) + goto end; + ... + } + +2) graph_util_parse_dai() itself has 2 patterns (X)(Y) to fill dlc->xxx. + Both case, we need to call of_node_put(node) (Z) in error case, but we + are calling it only in (Y) case. + + int graph_util_parse_dai(...) + { + ... + dai = snd_soc_get_dai_via_args(&args); + if (dai) { + ... + ^ dlc->of_node = ... +(X) dlc->dai_name = ... + v dlc->dai_args = ... + ... + } + ... +(Y) ret = snd_soc_get_dlc(&args, dlc); + if (ret < 0) { +(Z) of_node_put(node); + ... + } + ... + } + +This patch fixup both case. Make it easy to understand, update +lavel "end" to "err", too. + +Signed-off-by: Kuninori Morimoto +Link: https://patch.msgid.link/87fribr2ns.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card-utils.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c +index 3ae2a212a2e38..355f7ec8943c2 100644 +--- a/sound/soc/generic/simple-card-utils.c ++++ b/sound/soc/generic/simple-card-utils.c +@@ -1119,12 +1119,16 @@ int graph_util_parse_dai(struct simple_util_priv *priv, struct device_node *ep, + args.np = ep; + dai = snd_soc_get_dai_via_args(&args); + if (dai) { ++ const char *dai_name = snd_soc_dai_name_get(dai); ++ const struct of_phandle_args *dai_args = snd_soc_copy_dai_args(dev, &args); ++ + ret = -ENOMEM; ++ if (!dai_args) ++ goto err; ++ + dlc->of_node = node; +- dlc->dai_name = snd_soc_dai_name_get(dai); +- dlc->dai_args = snd_soc_copy_dai_args(dev, &args); +- if (!dlc->dai_args) +- goto end; ++ dlc->dai_name = dai_name; ++ dlc->dai_args = dai_args; + + goto parse_dai_end; + } +@@ -1154,16 +1158,17 @@ int graph_util_parse_dai(struct simple_util_priv *priv, struct device_node *ep, + * if he unbinded CPU or Codec. + */ + ret = snd_soc_get_dlc(&args, dlc); +- if (ret < 0) { +- of_node_put(node); +- goto end; +- } ++ if (ret < 0) ++ goto err; + + parse_dai_end: + if (is_single_link) + *is_single_link = of_graph_get_endpoint_count(node) == 1; + ret = 0; +-end: ++err: ++ if (ret < 0) ++ of_node_put(node); ++ + return simple_ret(priv, ret); + } + EXPORT_SYMBOL_GPL(graph_util_parse_dai); +-- +2.39.5 + diff --git a/queue-6.15/asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch b/queue-6.15/asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch new file mode 100644 index 0000000000..2dd03f3629 --- /dev/null +++ b/queue-6.15/asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch @@ -0,0 +1,73 @@ +From 90a87dc7f4cd0ad4eb3c3ff3623bf46c0d59aefa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Apr 2025 09:15:05 +1000 +Subject: ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change + +From: Hector Martin + +[ Upstream commit f529c91be8a34ac12e7599bf87c65b6f4a2c9f5c ] + +The ISENSE/VSENSE blocks are only powered up when the amplifier +transitions from shutdown to active. This means that if those controls +are flipped on while the amplifier is already playing back audio, they +will have no effect. + +Fix this by forcing a power cycle around transitions in those controls. + +Reviewed-by: Neal Gompa +Signed-off-by: Hector Martin +Signed-off-by: James Calligeros +Link: https://patch.msgid.link/20250406-apple-codec-changes-v5-1-50a00ec850a3@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2770.c | 30 ++++++++++++++++++++++++++++-- + 1 file changed, 28 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c +index 7f219df8be704..8de7e94d4ba47 100644 +--- a/sound/soc/codecs/tas2770.c ++++ b/sound/soc/codecs/tas2770.c +@@ -156,11 +156,37 @@ static const struct snd_kcontrol_new isense_switch = + static const struct snd_kcontrol_new vsense_switch = + SOC_DAPM_SINGLE("Switch", TAS2770_PWR_CTRL, 2, 1, 1); + ++static int sense_event(struct snd_soc_dapm_widget *w, ++ struct snd_kcontrol *kcontrol, int event) ++{ ++ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); ++ struct tas2770_priv *tas2770 = snd_soc_component_get_drvdata(component); ++ ++ /* ++ * Powering up ISENSE/VSENSE requires a trip through the shutdown state. ++ * Do that here to ensure that our changes are applied properly, otherwise ++ * we might end up with non-functional IVSENSE if playback started earlier, ++ * which would break software speaker protection. ++ */ ++ switch (event) { ++ case SND_SOC_DAPM_PRE_REG: ++ return snd_soc_component_update_bits(component, TAS2770_PWR_CTRL, ++ TAS2770_PWR_CTRL_MASK, ++ TAS2770_PWR_CTRL_SHUTDOWN); ++ case SND_SOC_DAPM_POST_REG: ++ return tas2770_update_pwr_ctrl(tas2770); ++ default: ++ return 0; ++ } ++} ++ + static const struct snd_soc_dapm_widget tas2770_dapm_widgets[] = { + SND_SOC_DAPM_AIF_IN("ASI1", "ASI1 Playback", 0, SND_SOC_NOPM, 0, 0), + SND_SOC_DAPM_MUX("ASI1 Sel", SND_SOC_NOPM, 0, 0, &tas2770_asi1_mux), +- SND_SOC_DAPM_SWITCH("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch), +- SND_SOC_DAPM_SWITCH("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch), ++ SND_SOC_DAPM_SWITCH_E("ISENSE", TAS2770_PWR_CTRL, 3, 1, &isense_switch, ++ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), ++ SND_SOC_DAPM_SWITCH_E("VSENSE", TAS2770_PWR_CTRL, 2, 1, &vsense_switch, ++ sense_event, SND_SOC_DAPM_PRE_REG | SND_SOC_DAPM_POST_REG), + SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0, tas2770_dac_event, + SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), + SND_SOC_DAPM_OUTPUT("OUT"), +-- +2.39.5 + diff --git a/queue-6.15/asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch b/queue-6.15/asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch new file mode 100644 index 0000000000..82afdf4637 --- /dev/null +++ b/queue-6.15/asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch @@ -0,0 +1,36 @@ +From 8eb1884f981f55bca9c99d463ecae18d41643090 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 20:37:44 +0800 +Subject: ASoC: tegra210_ahub: Add check to of_device_get_match_data() + +From: Yuanjun Gong + +[ Upstream commit 04cb269c204398763a620d426cbee43064854000 ] + +In tegra_ahub_probe(), check the result of function +of_device_get_match_data(), return an error code in case it fails. + +Signed-off-by: Yuanjun Gong +Link: https://patch.msgid.link/20250513123744.3041724-1-ruc_gongyuanjun@163.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/tegra/tegra210_ahub.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c +index 99683f292b5d8..ae4965a9f7649 100644 +--- a/sound/soc/tegra/tegra210_ahub.c ++++ b/sound/soc/tegra/tegra210_ahub.c +@@ -1359,6 +1359,8 @@ static int tegra_ahub_probe(struct platform_device *pdev) + return -ENOMEM; + + ahub->soc_data = of_device_get_match_data(&pdev->dev); ++ if (!ahub->soc_data) ++ return -ENODEV; + + platform_set_drvdata(pdev, ahub); + +-- +2.39.5 + diff --git a/queue-6.15/bluetooth-btmrvl_sdio-fix-wakeup-source-leaks-on-dev.patch b/queue-6.15/bluetooth-btmrvl_sdio-fix-wakeup-source-leaks-on-dev.patch new file mode 100644 index 0000000000..2b0f3ca8e8 --- /dev/null +++ b/queue-6.15/bluetooth-btmrvl_sdio-fix-wakeup-source-leaks-on-dev.patch @@ -0,0 +1,37 @@ +From 6fc5ebc441fb89e187e37f25675e7f27c8bfc97f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Apr 2025 22:10:16 +0200 +Subject: Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind + +From: Krzysztof Kozlowski + +[ Upstream commit ba6535e8b494931471df9666addf0f1e5e6efa27 ] + +Device can be unbound or probe can fail, so driver must also release +memory for the wakeup source. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmrvl_sdio.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c +index 07cd308f7abf6..93932a0d8625a 100644 +--- a/drivers/bluetooth/btmrvl_sdio.c ++++ b/drivers/bluetooth/btmrvl_sdio.c +@@ -100,7 +100,9 @@ static int btmrvl_sdio_probe_of(struct device *dev, + } + + /* Configure wakeup (enabled by default) */ +- device_init_wakeup(dev, true); ++ ret = devm_device_init_wakeup(dev); ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to init wakeup\n"); + } + } + +-- +2.39.5 + diff --git a/queue-6.15/bluetooth-btmtksdio-fix-wakeup-source-leaks-on-devic.patch b/queue-6.15/bluetooth-btmtksdio-fix-wakeup-source-leaks-on-devic.patch new file mode 100644 index 0000000000..560234de90 --- /dev/null +++ b/queue-6.15/bluetooth-btmtksdio-fix-wakeup-source-leaks-on-devic.patch @@ -0,0 +1,35 @@ +From 271568c00c990bf727cccdedd10907bc04e5e11e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Apr 2025 22:10:17 +0200 +Subject: Bluetooth: btmtksdio: Fix wakeup source leaks on device unbind + +From: Krzysztof Kozlowski + +[ Upstream commit ee3e4209e66d44180a41d5ca7271361a2a28fccf ] + +Device can be unbound or probe can fail, so driver must also release +memory for the wakeup source. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtksdio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index 1d26207b2ba70..c16a3518b8ffa 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -1414,7 +1414,7 @@ static int btmtksdio_probe(struct sdio_func *func, + */ + pm_runtime_put_noidle(bdev->dev); + +- err = device_init_wakeup(bdev->dev, true); ++ err = devm_device_init_wakeup(bdev->dev); + if (err) + bt_dev_err(hdev, "failed to initialize device wakeup"); + +-- +2.39.5 + diff --git a/queue-6.15/bluetooth-btusb-add-new-vid-pid-13d3-3584-for-mt7922.patch b/queue-6.15/bluetooth-btusb-add-new-vid-pid-13d3-3584-for-mt7922.patch new file mode 100644 index 0000000000..7ea13e8bd7 --- /dev/null +++ b/queue-6.15/bluetooth-btusb-add-new-vid-pid-13d3-3584-for-mt7922.patch @@ -0,0 +1,97 @@ +From a81afa59f2d32e41bdabcaad67bded2963c7fcd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 14:13:54 +0800 +Subject: Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922 + +From: Liwei Sun + +[ Upstream commit 71d9d3522aec301e4a1c4eae4b5e0656fc4a7262 ] + +A new variant of MT7922 wireless device has been identified. +The device introduces itself as MEDIATEK MT7922, +so treat it as MediaTek device. +With this patch, btusb driver works as expected: +[ 3.151162] Bluetooth: Core ver 2.22 +[ 3.151185] Bluetooth: HCI device and connection manager initialized +[ 3.151189] Bluetooth: HCI socket layer initialized +[ 3.151191] Bluetooth: L2CAP socket layer initialized +[ 3.151194] Bluetooth: SCO socket layer initialized +[ 3.295718] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20241106163512 +[ 4.676634] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 +[ 4.676637] Bluetooth: BNEP filters: protocol multicast +[ 4.676640] Bluetooth: BNEP socket layer initialized +[ 5.560453] Bluetooth: hci0: Device setup in 2320660 usecs +[ 5.560457] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported. +[ 5.619197] Bluetooth: hci0: AOSP extensions version v1.00 +[ 5.619204] Bluetooth: hci0: AOSP quality report is supported +[ 5.619301] Bluetooth: MGMT ver 1.23 +[ 6.741247] Bluetooth: RFCOMM TTY layer initialized +[ 6.741258] Bluetooth: RFCOMM socket layer initialized +[ 6.741261] Bluetooth: RFCOMM ver 1.11 + +lspci output: +04:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter + +USB information: +T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3584 Rev= 1.00 +S: Manufacturer=MediaTek Inc. +S: Product=Wireless_Device +S: SerialNumber=000000000 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA +A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us +I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us + +Signed-off-by: Liwei Sun +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 256b451bbe065..df3380a8de85e 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -678,6 +678,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3584), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3605), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3607), .driver_info = BTUSB_MEDIATEK | +-- +2.39.5 + diff --git a/queue-6.15/bluetooth-btusb-add-new-vid-pid-13d3-3630-for-mt7925.patch b/queue-6.15/bluetooth-btusb-add-new-vid-pid-13d3-3630-for-mt7925.patch new file mode 100644 index 0000000000..0bc80ba6f3 --- /dev/null +++ b/queue-6.15/bluetooth-btusb-add-new-vid-pid-13d3-3630-for-mt7925.patch @@ -0,0 +1,77 @@ +From 84191779397bceac2b2cdb6f57d06012a46b5052 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Apr 2025 18:16:05 +0800 +Subject: Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925 + +From: Jiande Lu + +[ Upstream commit 5bd5c716f7ec3e25d8d3b8a7566e192a26f9c7ce ] + +Add VID 13d3 & PID 3630 for MediaTek MT7925 USB Bluetooth chip. + +The information in /sys/kernel/debug/usb/devices about the Bluetooth +device is listed as the below. + +T: Bus=07 Lev=01 Prnt=01 Port=10 Cnt=02 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3630 Rev= 1.00 +S: Manufacturer=MediaTek Inc. +S: Product=Wireless_Device +S: SerialNumber=000000000 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA +A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us +I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) +E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us + +Signed-off-by: Jiande Lu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index df3380a8de85e..c7c3cd0dcd49e 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -720,6 +720,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3628), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3630), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Additional Realtek 8723AE Bluetooth devices */ + { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, +-- +2.39.5 + diff --git a/queue-6.15/bluetooth-btusb-add-rtl8851be-device-0x0bda-0xb850.patch b/queue-6.15/bluetooth-btusb-add-rtl8851be-device-0x0bda-0xb850.patch new file mode 100644 index 0000000000..7b12202744 --- /dev/null +++ b/queue-6.15/bluetooth-btusb-add-rtl8851be-device-0x0bda-0xb850.patch @@ -0,0 +1,69 @@ +From 048a80308261f61f7a2e4ca43a2af6b37306cfbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 10:33:50 +0800 +Subject: Bluetooth: btusb: Add RTL8851BE device 0x0bda:0xb850 + +From: WangYuli + +[ Upstream commit c4dbb1bdada90168dd5fa2f7e4553cb0e1dad3c8 ] + +The information in /sys/kernel/debug/usb/devices about the Bluetooth +device is listed as the below: + +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0bda ProdID=b850 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms + +Co-developed-by: Hao Li +Signed-off-by: Hao Li +Signed-off-by: WangYuli +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index c7c3cd0dcd49e..ef9689f877691 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -513,6 +513,7 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + + /* Realtek 8851BE Bluetooth devices */ ++ { USB_DEVICE(0x0bda, 0xb850), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3600), .driver_info = BTUSB_REALTEK }, + + /* Realtek 8852AE Bluetooth devices */ +-- +2.39.5 + diff --git a/queue-6.15/bnxt_en-remove-unused-field-ref_count-in-struct-bnxt.patch b/queue-6.15/bnxt_en-remove-unused-field-ref_count-in-struct-bnxt.patch new file mode 100644 index 0000000000..b8e75905e3 --- /dev/null +++ b/queue-6.15/bnxt_en-remove-unused-field-ref_count-in-struct-bnxt.patch @@ -0,0 +1,62 @@ +From 2938a761a55798f6dfd373616a59b5112cd7f666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 10:24:47 -0700 +Subject: bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp + +From: Kalesh AP + +[ Upstream commit 5bccacb4cc32cb835fe2fe100a210332c494e81d ] + +The "ref_count" field in struct bnxt_ulp is unused after +commit a43c26fa2e6c ("RDMA/bnxt_re: Remove the sriov config callback"). +So we can just remove it now. + +Reviewed-by: Somnath Kotur +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Link: https://patch.msgid.link/20250417172448.1206107-4-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 5 ----- + drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h | 1 - + 2 files changed, 6 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +index 7564705d64783..84c4812414fd4 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +@@ -149,7 +149,6 @@ void bnxt_unregister_dev(struct bnxt_en_dev *edev) + struct net_device *dev = edev->net; + struct bnxt *bp = netdev_priv(dev); + struct bnxt_ulp *ulp; +- int i = 0; + + ulp = edev->ulp_tbl; + netdev_lock(dev); +@@ -165,10 +164,6 @@ void bnxt_unregister_dev(struct bnxt_en_dev *edev) + synchronize_rcu(); + ulp->max_async_event_id = 0; + ulp->async_events_bmap = NULL; +- while (atomic_read(&ulp->ref_count) != 0 && i < 10) { +- msleep(100); +- i++; +- } + mutex_unlock(&edev->en_dev_lock); + netdev_unlock(dev); + return; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h +index 7fa3b8d1ebd28..f6b5efb5e7753 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h +@@ -50,7 +50,6 @@ struct bnxt_ulp { + unsigned long *async_events_bmap; + u16 max_async_event_id; + u16 msix_requested; +- atomic_t ref_count; + }; + + struct bnxt_en_dev { +-- +2.39.5 + diff --git a/queue-6.15/bpf-check-rcu_read_lock_trace_held-in-bpf_map_lookup.patch b/queue-6.15/bpf-check-rcu_read_lock_trace_held-in-bpf_map_lookup.patch new file mode 100644 index 0000000000..35b546b655 --- /dev/null +++ b/queue-6.15/bpf-check-rcu_read_lock_trace_held-in-bpf_map_lookup.patch @@ -0,0 +1,43 @@ +From 5279fd12a4cbac25ea2db33c21a5e0234c857085 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 May 2025 14:25:34 +0800 +Subject: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() + +From: Hou Tao + +[ Upstream commit d4965578267e2e81f67c86e2608481e77e9c8569 ] + +bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf +program. When BPF JIT is disabled or under 32-bit host, +bpf_map_lookup_percpu_elem() will not be inlined. Using it in a +sleepable bpf program will trigger the warning in +bpf_map_lookup_percpu_elem(), because the bpf program only holds +rcu_read_lock_trace lock. Therefore, add the missed check. + +Reported-by: syzbot+dce5aae19ae4d6399986@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/bpf/000000000000176a130617420310@google.com/ +Signed-off-by: Hou Tao +Link: https://lore.kernel.org/r/20250526062534.1105938-1-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/helpers.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index e3a2662f4e336..a71aa4cb85fae 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -129,7 +129,8 @@ const struct bpf_func_proto bpf_map_peek_elem_proto = { + + BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu) + { +- WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held()); ++ WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() && ++ !rcu_read_lock_bh_held()); + return (unsigned long) map->ops->map_lookup_percpu_elem(map, key, cpu); + } + +-- +2.39.5 + diff --git a/queue-6.15/bpf-pass-the-same-orig_call-value-to-trampoline-func.patch b/queue-6.15/bpf-pass-the-same-orig_call-value-to-trampoline-func.patch new file mode 100644 index 0000000000..47c0edb853 --- /dev/null +++ b/queue-6.15/bpf-pass-the-same-orig_call-value-to-trampoline-func.patch @@ -0,0 +1,48 @@ +From 76b371a072341734c05e9d00a97d12dcf668c1ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 22:57:30 +0200 +Subject: bpf: Pass the same orig_call value to trampoline functions + +From: Ilya Leoshkevich + +[ Upstream commit 94bde253d3ae5d8a01cb958663b12daef1d06574 ] + +There is currently some confusion in the s390x JIT regarding whether +orig_call can be NULL and what that means. Originally the NULL value +was used to distinguish the struct_ops case, but this was superseded by +BPF_TRAMP_F_INDIRECT (see commit 0c970ed2f87c ("s390/bpf: Fix indirect +trampoline generation"). + +The remaining reason to have this check is that NULL can actually be +passed to the arch_bpf_trampoline_size() call - but not to the +respective arch_prepare_bpf_trampoline()! call - by +bpf_struct_ops_prepare_trampoline(). + +Remove this asymmetry by passing stub_func to both functions, so that +JITs may rely on orig_call never being NULL. + +Signed-off-by: Ilya Leoshkevich +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20250512221911.61314-2-iii@linux.ibm.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/bpf_struct_ops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c +index db13ee70d94d5..96113633e391a 100644 +--- a/kernel/bpf/bpf_struct_ops.c ++++ b/kernel/bpf/bpf_struct_ops.c +@@ -601,7 +601,7 @@ int bpf_struct_ops_prepare_trampoline(struct bpf_tramp_links *tlinks, + if (model->ret_size > 0) + flags |= BPF_TRAMP_F_RET_FENTRY_RET; + +- size = arch_bpf_trampoline_size(model, flags, tlinks, NULL); ++ size = arch_bpf_trampoline_size(model, flags, tlinks, stub_func); + if (size <= 0) + return size ? : -EFAULT; + +-- +2.39.5 + diff --git a/queue-6.15/bpf-sockmap-fix-data-lost-during-eagain-retries.patch b/queue-6.15/bpf-sockmap-fix-data-lost-during-eagain-retries.patch new file mode 100644 index 0000000000..78520f8e7a --- /dev/null +++ b/queue-6.15/bpf-sockmap-fix-data-lost-during-eagain-retries.patch @@ -0,0 +1,68 @@ +From 9b6c1e57c2308036b49bde1ee665a61813c1f9b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Apr 2025 22:21:20 +0800 +Subject: bpf, sockmap: Fix data lost during EAGAIN retries + +From: Jiayuan Chen + +[ Upstream commit 7683167196bd727ad5f3c3fc6a9ca70f54520a81 ] + +We call skb_bpf_redirect_clear() to clean _sk_redir before handling skb in +backlog, but when sk_psock_handle_skb() return EAGAIN due to sk_rcvbuf +limit, the redirect info in _sk_redir is not recovered. + +Fix skb redir loss during EAGAIN retries by restoring _sk_redir +information using skb_bpf_set_redir(). + +Before this patch: +''' +./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress +Setting up benchmark 'sockmap'... +create socket fd c1:13 p1:14 c2:15 p2:16 +Benchmark 'sockmap' started. +Send Speed 1343.172 MB/s, BPF Speed 1343.238 MB/s, Rcv Speed 65.271 MB/s +Send Speed 1352.022 MB/s, BPF Speed 1352.088 MB/s, Rcv Speed 0 MB/s +Send Speed 1354.105 MB/s, BPF Speed 1354.105 MB/s, Rcv Speed 0 MB/s +Send Speed 1355.018 MB/s, BPF Speed 1354.887 MB/s, Rcv Speed 0 MB/s +''' +Due to the high send rate, the RX processing path may frequently hit the +sk_rcvbuf limit. Once triggered, incorrect _sk_redir will cause the flow +to mistakenly enter the "!ingress" path, leading to send failures. +(The Rcv speed depends on tcp_rmem). + +After this patch: +''' +./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress +Setting up benchmark 'sockmap'... +create socket fd c1:13 p1:14 c2:15 p2:16 +Benchmark 'sockmap' started. +Send Speed 1347.236 MB/s, BPF Speed 1347.367 MB/s, Rcv Speed 65.402 MB/s +Send Speed 1353.320 MB/s, BPF Speed 1353.320 MB/s, Rcv Speed 65.536 MB/s +Send Speed 1353.186 MB/s, BPF Speed 1353.121 MB/s, Rcv Speed 65.536 MB/s +''' + +Signed-off-by: Jiayuan Chen +Link: https://lore.kernel.org/r/20250407142234.47591-2-jiayuan.chen@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 6d689918c2b39..34c51eb1a14fb 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -690,7 +690,8 @@ static void sk_psock_backlog(struct work_struct *work) + if (ret <= 0) { + if (ret == -EAGAIN) { + sk_psock_skb_state(psock, state, len, off); +- ++ /* Restore redir info we cleared before */ ++ skb_bpf_set_redir(skb, psock->sk, ingress); + /* Delay slightly to prioritize any + * other work that might be here. + */ +-- +2.39.5 + diff --git a/queue-6.15/bpf-use-proper-type-to-calculate-bpf_raw_tp_null_arg.patch b/queue-6.15/bpf-use-proper-type-to-calculate-bpf_raw_tp_null_arg.patch new file mode 100644 index 0000000000..92af1e7ef4 --- /dev/null +++ b/queue-6.15/bpf-use-proper-type-to-calculate-bpf_raw_tp_null_arg.patch @@ -0,0 +1,50 @@ +From 671cc909ab095c03832fcd1d16e255e744742a34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Apr 2025 15:49:43 +0800 +Subject: bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index + +From: Shung-Hsi Yu + +[ Upstream commit 53ebef53a657d7957d35dc2b953db64f1bb28065 ] + +The calculation of the index used to access the mask field in 'struct +bpf_raw_tp_null_args' is done with 'int' type, which could overflow when +the tracepoint being attached has more than 8 arguments. + +While none of the tracepoints mentioned in raw_tp_null_args[] currently +have more than 8 arguments, there do exist tracepoints that had more +than 8 arguments (e.g. iocost_iocg_forgive_debt), so use the correct +type for calculation and avoid Smatch static checker warning. + +Reported-by: Dan Carpenter +Signed-off-by: Shung-Hsi Yu +Signed-off-by: Andrii Nakryiko +Acked-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/bpf/20250418074946.35569-1-shung-hsi.yu@suse.com + +Closes: https://lore.kernel.org/r/843a3b94-d53d-42db-93d4-be10a4090146@stanley.mountain/ +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 16ba36f34dfab..656ee11aff676 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -6829,10 +6829,10 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, + /* Is this a func with potential NULL args? */ + if (strcmp(tname, raw_tp_null_args[i].func)) + continue; +- if (raw_tp_null_args[i].mask & (0x1 << (arg * 4))) ++ if (raw_tp_null_args[i].mask & (0x1ULL << (arg * 4))) + info->reg_type |= PTR_MAYBE_NULL; + /* Is the current arg IS_ERR? */ +- if (raw_tp_null_args[i].mask & (0x2 << (arg * 4))) ++ if (raw_tp_null_args[i].mask & (0x2ULL << (arg * 4))) + ptr_err_raw_tp = true; + break; + } +-- +2.39.5 + diff --git a/queue-6.15/bpftool-fix-cgroup-command-to-only-show-cgroup-bpf-p.patch b/queue-6.15/bpftool-fix-cgroup-command-to-only-show-cgroup-bpf-p.patch new file mode 100644 index 0000000000..3c1c0e304c --- /dev/null +++ b/queue-6.15/bpftool-fix-cgroup-command-to-only-show-cgroup-bpf-p.patch @@ -0,0 +1,112 @@ +From 98612cd87f05da410b1e564316afb8bf2a673387 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 May 2025 13:32:32 -0700 +Subject: bpftool: Fix cgroup command to only show cgroup bpf programs + +From: Martin KaFai Lau + +[ Upstream commit b69d4413aa1961930fbf9ffad8376d577378daf9 ] + +The netkit program is not a cgroup bpf program and should not be shown +in the output of the "bpftool cgroup show" command. + +However, if the netkit device happens to have ifindex 3, +the "bpftool cgroup show" command will output the netkit +bpf program as well: + +> ip -d link show dev nk1 +3: nk1@if2: ... + link/ether ... + netkit mode ... + +> bpftool net show +tc: +nk1(3) netkit/peer tw_ns_nk2phy prog_id 469447 + +> bpftool cgroup show /sys/fs/cgroup/... +ID AttachType AttachFlags Name +... ... ... +469447 netkit_peer tw_ns_nk2phy + +The reason is that the target_fd (which is the cgroup_fd here) and +the target_ifindex are in a union in the uapi/linux/bpf.h. The bpftool +iterates all values in "enum bpf_attach_type" which includes +non cgroup attach types like netkit. The cgroup_fd is usually 3 here, +so the bug is triggered when the netkit ifindex just happens +to be 3 as well. + +The bpftool's cgroup.c already has a list of cgroup-only attach type +defined in "cgroup_attach_types[]". This patch fixes it by iterating +over "cgroup_attach_types[]" instead of "__MAX_BPF_ATTACH_TYPE". + +Cc: Quentin Monnet +Reported-by: Takshak Chahande +Signed-off-by: Martin KaFai Lau +Acked-by: Daniel Borkmann +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/r/20250507203232.1420762-1-martin.lau@linux.dev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/cgroup.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c +index 3f1d6be512151..944ebe21a2169 100644 +--- a/tools/bpf/bpftool/cgroup.c ++++ b/tools/bpf/bpftool/cgroup.c +@@ -318,11 +318,11 @@ static int show_bpf_progs(int cgroup_fd, enum bpf_attach_type type, + + static int do_show(int argc, char **argv) + { +- enum bpf_attach_type type; + int has_attached_progs; + const char *path; + int cgroup_fd; + int ret = -1; ++ unsigned int i; + + query_flags = 0; + +@@ -370,14 +370,14 @@ static int do_show(int argc, char **argv) + "AttachFlags", "Name"); + + btf_vmlinux = libbpf_find_kernel_btf(); +- for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) { ++ for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++) { + /* + * Not all attach types may be supported, so it's expected, + * that some requests will fail. + * If we were able to get the show for at least one + * attach type, let's return 0. + */ +- if (show_bpf_progs(cgroup_fd, type, 0) == 0) ++ if (show_bpf_progs(cgroup_fd, cgroup_attach_types[i], 0) == 0) + ret = 0; + } + +@@ -400,9 +400,9 @@ static int do_show(int argc, char **argv) + static int do_show_tree_fn(const char *fpath, const struct stat *sb, + int typeflag, struct FTW *ftw) + { +- enum bpf_attach_type type; + int has_attached_progs; + int cgroup_fd; ++ unsigned int i; + + if (typeflag != FTW_D) + return 0; +@@ -434,8 +434,8 @@ static int do_show_tree_fn(const char *fpath, const struct stat *sb, + } + + btf_vmlinux = libbpf_find_kernel_btf(); +- for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) +- show_bpf_progs(cgroup_fd, type, ftw->level); ++ for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++) ++ show_bpf_progs(cgroup_fd, cgroup_attach_types[i], ftw->level); + + if (errno == EINVAL) + /* Last attach type does not support query. +-- +2.39.5 + diff --git a/queue-6.15/bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch b/queue-6.15/bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch new file mode 100644 index 0000000000..4985e40f01 --- /dev/null +++ b/queue-6.15/bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch @@ -0,0 +1,40 @@ +From 81a598701ef90b16f568029fe20c02fde87366c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 13:58:14 +0300 +Subject: bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value + +From: Laurentiu Tudor + +[ Upstream commit 23d060136841c58c2f9ee8c08ad945d1879ead4b ] + +In case the MC firmware runs in debug mode with extensive prints pushed +to the console, the current timeout of 500ms is not enough. +Increase the timeout value so that we don't have any chance of wrongly +assuming that the firmware is not responding when it's just taking more +time. + +Signed-off-by: Laurentiu Tudor +Signed-off-by: Ioana Ciornei +Link: https://lore.kernel.org/r/20250408105814.2837951-7-ioana.ciornei@nxp.com +Signed-off-by: Christophe Leroy +Signed-off-by: Sasha Levin +--- + drivers/bus/fsl-mc/mc-sys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/fsl-mc/mc-sys.c b/drivers/bus/fsl-mc/mc-sys.c +index f2052cd0a0517..b22c59d57c8f0 100644 +--- a/drivers/bus/fsl-mc/mc-sys.c ++++ b/drivers/bus/fsl-mc/mc-sys.c +@@ -19,7 +19,7 @@ + /* + * Timeout in milliseconds to wait for the completion of an MC command + */ +-#define MC_CMD_COMPLETION_TIMEOUT_MS 500 ++#define MC_CMD_COMPLETION_TIMEOUT_MS 15000 + + /* + * usleep_range() min and max values used to throttle down polling +-- +2.39.5 + diff --git a/queue-6.15/clk-qcom-gcc-set-force_mem_core_on-for-gcc_ufs_axi_c.patch b/queue-6.15/clk-qcom-gcc-set-force_mem_core_on-for-gcc_ufs_axi_c.patch new file mode 100644 index 0000000000..7f6f03c711 --- /dev/null +++ b/queue-6.15/clk-qcom-gcc-set-force_mem_core_on-for-gcc_ufs_axi_c.patch @@ -0,0 +1,58 @@ +From 25d355de3d7ee2633ff1db481d71ee2d581a85c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 14:30:40 +0530 +Subject: clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for + 8650/8750 + +From: Taniya Das + +[ Upstream commit da94a81ea6c6f1cd2f389c5631e33c145ac7b35b ] + +Update the force mem core bit for UFS AXI clock to force the core on +signal to remain active during halt state of the clk. If force mem +core bit of the clock is not set, the memories of the subsystem will +not retain the logic across power states. This is required for the MCQ +feature of the UFS driver. + +Signed-off-by: Taniya Das +Reviewed-by: Imran Shaik +Link: https://lore.kernel.org/r/20250414-gcc_ufs_mem_core-v1-1-67b5529b9b5d@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm8650.c | 2 ++ + drivers/clk/qcom/gcc-sm8750.c | 3 ++- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-sm8650.c b/drivers/clk/qcom/gcc-sm8650.c +index fa1672c4e7d81..24f98062b9dd5 100644 +--- a/drivers/clk/qcom/gcc-sm8650.c ++++ b/drivers/clk/qcom/gcc-sm8650.c +@@ -3817,7 +3817,9 @@ static int gcc_sm8650_probe(struct platform_device *pdev) + qcom_branch_set_clk_en(regmap, 0x32004); /* GCC_VIDEO_AHB_CLK */ + qcom_branch_set_clk_en(regmap, 0x32030); /* GCC_VIDEO_XO_CLK */ + ++ /* FORCE_MEM_CORE_ON for ufs phy ice core and gcc ufs phy axi clocks */ + qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_ice_core_clk, true); ++ qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_axi_clk, true); + + /* Clear GDSC_SLEEP_ENA_VOTE to stop votes being auto-removed in sleep. */ + regmap_write(regmap, 0x52150, 0x0); +diff --git a/drivers/clk/qcom/gcc-sm8750.c b/drivers/clk/qcom/gcc-sm8750.c +index b36d709760958..8092dd6b37b56 100644 +--- a/drivers/clk/qcom/gcc-sm8750.c ++++ b/drivers/clk/qcom/gcc-sm8750.c +@@ -3244,8 +3244,9 @@ static int gcc_sm8750_probe(struct platform_device *pdev) + regmap_update_bits(regmap, 0x52010, BIT(20), BIT(20)); + regmap_update_bits(regmap, 0x52010, BIT(21), BIT(21)); + +- /* FORCE_MEM_CORE_ON for ufs phy ice core clocks */ ++ /* FORCE_MEM_CORE_ON for ufs phy ice core and gcc ufs phy axi clocks */ + qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_ice_core_clk, true); ++ qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_axi_clk, true); + + return qcom_cc_really_probe(&pdev->dev, &gcc_sm8750_desc, regmap); + } +-- +2.39.5 + diff --git a/queue-6.15/clk-qcom-gcc-x1e80100-set-force-mem-core-for-ufs-clo.patch b/queue-6.15/clk-qcom-gcc-x1e80100-set-force-mem-core-for-ufs-clo.patch new file mode 100644 index 0000000000..ddaea4212d --- /dev/null +++ b/queue-6.15/clk-qcom-gcc-x1e80100-set-force-mem-core-for-ufs-clo.patch @@ -0,0 +1,42 @@ +From 7b95d29ff80e6ff838e0ed1fdc8331ed4570d167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 14:30:41 +0530 +Subject: clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks + +From: Taniya Das + +[ Upstream commit 201bf08ba9e26eeb0a96ba3fd5c026f531b31aed ] + +Update the force mem core bit for UFS ICE clock and UFS PHY AXI clock to +force the core on signal to remain active during halt state of the clk. +If force mem core bit of the clock is not set, the memories of the +subsystem will not retain the logic across power states. This is +required for the MCQ feature of UFS. + +Signed-off-by: Taniya Das +Reviewed-by: Imran Shaik +Link: https://lore.kernel.org/r/20250414-gcc_ufs_mem_core-v1-2-67b5529b9b5d@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-x1e80100.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-x1e80100.c b/drivers/clk/qcom/gcc-x1e80100.c +index 009f39139b644..3e44757e25d32 100644 +--- a/drivers/clk/qcom/gcc-x1e80100.c ++++ b/drivers/clk/qcom/gcc-x1e80100.c +@@ -6753,6 +6753,10 @@ static int gcc_x1e80100_probe(struct platform_device *pdev) + /* Clear GDSC_SLEEP_ENA_VOTE to stop votes being auto-removed in sleep. */ + regmap_write(regmap, 0x52224, 0x0); + ++ /* FORCE_MEM_CORE_ON for ufs phy ice core and gcc ufs phy axi clocks */ ++ qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_ice_core_clk, true); ++ qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_axi_clk, true); ++ + return qcom_cc_really_probe(&pdev->dev, &gcc_x1e80100_desc, regmap); + } + +-- +2.39.5 + diff --git a/queue-6.15/clk-rockchip-rk3036-mark-ddrphy-as-critical.patch b/queue-6.15/clk-rockchip-rk3036-mark-ddrphy-as-critical.patch new file mode 100644 index 0000000000..8eaedfecf7 --- /dev/null +++ b/queue-6.15/clk-rockchip-rk3036-mark-ddrphy-as-critical.patch @@ -0,0 +1,37 @@ +From c060648bfcdefc7fdf8d8b2b671114adb30a0601 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 22:25:31 +0200 +Subject: clk: rockchip: rk3036: mark ddrphy as critical + +From: Heiko Stuebner + +[ Upstream commit 596a977b34a722c00245801a5774aa79cec4e81d ] + +The ddrphy is supplied by the dpll, but due to the limited number of PLLs +on the rk3036, the dpll also is used for other periperhals, like the GPU. + +So it happened, when the Lima driver turned off the gpu clock, this in +turn also disabled the dpll and thus the ram. + +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20250503202532.992033-4-heiko@sntech.de +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3036.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c +index d341ce0708aac..e4af3a9286379 100644 +--- a/drivers/clk/rockchip/clk-rk3036.c ++++ b/drivers/clk/rockchip/clk-rk3036.c +@@ -431,6 +431,7 @@ static const char *const rk3036_critical_clocks[] __initconst = { + "hclk_peri", + "pclk_peri", + "pclk_ddrupctl", ++ "ddrphy", + }; + + static void __init rk3036_clk_init(struct device_node *np) +-- +2.39.5 + diff --git a/queue-6.15/clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch b/queue-6.15/clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch new file mode 100644 index 0000000000..8801e94122 --- /dev/null +++ b/queue-6.15/clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch @@ -0,0 +1,60 @@ +From c54dafb3dad07a42ab0ccbd11b757a00b4335960 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Mar 2025 14:36:24 -0300 +Subject: clocksource: Fix the CPUs' choice in the watchdog per CPU + verification + +From: Guilherme G. Piccoli + +[ Upstream commit 08d7becc1a6b8c936e25d827becabfe3bff72a36 ] + +Right now, if the clocksource watchdog detects a clocksource skew, it might +perform a per CPU check, for example in the TSC case on x86. In other +words: supposing TSC is detected as unstable by the clocksource watchdog +running at CPU1, as part of marking TSC unstable the kernel will also run a +check of TSC readings on some CPUs to be sure it is synced between them +all. + +But that check happens only on some CPUs, not all of them; this choice is +based on the parameter "verify_n_cpus" and in some random cpumask +calculation. So, the watchdog runs such per CPU checks on up to +"verify_n_cpus" random CPUs among all online CPUs, with the risk of +repeating CPUs (that aren't double checked) in the cpumask random +calculation. + +But if "verify_n_cpus" > num_online_cpus(), it should skip the random +calculation and just go ahead and check the clocksource sync between +all online CPUs, without the risk of skipping some CPUs due to +duplicity in the random cpumask calculation. + +Tests in a 4 CPU laptop with TSC skew detected led to some cases of the per +CPU verification skipping some CPU even with verify_n_cpus=8, due to the +duplicity on random cpumask generation. Skipping the randomization when the +number of online CPUs is smaller than verify_n_cpus, solves that. + +Suggested-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Guilherme G. Piccoli +Signed-off-by: Thomas Gleixner +Reviewed-by: Paul E. McKenney +Link: https://lore.kernel.org/all/20250323173857.372390-1-gpiccoli@igalia.com +Signed-off-by: Sasha Levin +--- + kernel/time/clocksource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index bb48498ebb5a8..6a8bc7da90626 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -310,7 +310,7 @@ static void clocksource_verify_choose_cpus(void) + { + int cpu, i, n = verify_n_cpus; + +- if (n < 0) { ++ if (n < 0 || n >= num_online_cpus()) { + /* Check all of the CPUs. */ + cpumask_copy(&cpus_chosen, cpu_online_mask); + cpumask_clear_cpu(smp_processor_id(), &cpus_chosen); +-- +2.39.5 + diff --git a/queue-6.15/cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch b/queue-6.15/cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch new file mode 100644 index 0000000000..fa09bda406 --- /dev/null +++ b/queue-6.15/cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch @@ -0,0 +1,89 @@ +From 6494db3ded2f916a4bd3c904da0c2782be657d22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 20:53:12 -0700 +Subject: cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs + +From: Mike Tipton + +[ Upstream commit 6c9bb86922728c7a4cceb99f131e00dd87514f20 ] + +Currently, all SCMI devices with performance domains attempt to register +a cpufreq driver, even if their performance domains aren't used to +control the CPUs. The cpufreq framework only supports registering a +single driver, so only the first device will succeed. And if that device +isn't used for the CPUs, then cpufreq will scale the wrong domains. + +To avoid this, return early from scmi_cpufreq_probe() if the probing +SCMI device isn't referenced by the CPU device phandles. + +This keeps the existing assumption that all CPUs are controlled by a +single SCMI device. + +Signed-off-by: Mike Tipton +Reviewed-by: Peng Fan +Reviewed-by: Cristian Marussi +Reviewed-by: Sudeep Holla +Tested-by: Cristian Marussi +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 36 +++++++++++++++++++++++++++++++++- + 1 file changed, 35 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 944e899eb1be1..ef078426bfd51 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -393,6 +393,40 @@ static struct cpufreq_driver scmi_cpufreq_driver = { + .set_boost = cpufreq_boost_set_sw, + }; + ++static bool scmi_dev_used_by_cpus(struct device *scmi_dev) ++{ ++ struct device_node *scmi_np = dev_of_node(scmi_dev); ++ struct device_node *cpu_np, *np; ++ struct device *cpu_dev; ++ int cpu, idx; ++ ++ if (!scmi_np) ++ return false; ++ ++ for_each_possible_cpu(cpu) { ++ cpu_dev = get_cpu_device(cpu); ++ if (!cpu_dev) ++ continue; ++ ++ cpu_np = dev_of_node(cpu_dev); ++ ++ np = of_parse_phandle(cpu_np, "clocks", 0); ++ of_node_put(np); ++ ++ if (np == scmi_np) ++ return true; ++ ++ idx = of_property_match_string(cpu_np, "power-domain-names", "perf"); ++ np = of_parse_phandle(cpu_np, "power-domains", idx); ++ of_node_put(np); ++ ++ if (np == scmi_np) ++ return true; ++ } ++ ++ return false; ++} ++ + static int scmi_cpufreq_probe(struct scmi_device *sdev) + { + int ret; +@@ -401,7 +435,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev) + + handle = sdev->handle; + +- if (!handle) ++ if (!handle || !scmi_dev_used_by_cpus(dev)) + return -ENODEV; + + scmi_cpufreq_driver.driver_data = sdev; +-- +2.39.5 + diff --git a/queue-6.15/dlm-use-shut_rdwr-for-sctp-shutdown.patch b/queue-6.15/dlm-use-shut_rdwr-for-sctp-shutdown.patch new file mode 100644 index 0000000000..40f54e6b96 --- /dev/null +++ b/queue-6.15/dlm-use-shut_rdwr-for-sctp-shutdown.patch @@ -0,0 +1,77 @@ +From 549f2e7c40c30897aa25ce3cf4cefa0cf7bad0e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Apr 2025 16:29:11 -0400 +Subject: dlm: use SHUT_RDWR for SCTP shutdown + +From: Alexander Aring + +[ Upstream commit 55612ddb62fc12437a7ff2f27b51a8981bc187a4 ] + +Currently SCTP shutdown() call gets stuck because there is no incoming +EOF indicator on its socket. On the peer side the EOF indicator as +recvmsg() returns 0 will be triggered as mechanism to flush the socket +queue on the receive side. In SCTP recvmsg() function sctp_recvmsg() we +can see that only if sk_shutdown has the bit RCV_SHUTDOWN set SCTP will +recvmsg() will return EOF. The RCV_SHUTDOWN bit will only be set when +shutdown with SHUT_RD is called. We use now SHUT_RDWR to also get a EOF +indicator from recvmsg() call on the shutdown() initiator. + +SCTP does not support half closed sockets and the semantic of SHUT_WR is +different here, it seems that calling SHUT_WR on sctp sockets keeps the +socket open to have the possibility to do some specific SCTP operations on +it that we don't do here. + +There exists still a difference in the limitations of TCP vs SCTP in +case if we are required to have a half closed socket functionality. This +was tried to archieve with DLM protocol changes in the past and +hopefully we really don't require half closed socket functionality. + +Signed-off-by: Alexander Aring +Tested-by: Heming zhao +Reviewed-by: Heming zhao +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lowcomms.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c +index 70abd4da17a63..90abcd07f8898 100644 +--- a/fs/dlm/lowcomms.c ++++ b/fs/dlm/lowcomms.c +@@ -160,6 +160,7 @@ struct dlm_proto_ops { + bool try_new_addr; + const char *name; + int proto; ++ int how; + + void (*sockopts)(struct socket *sock); + int (*bind)(struct socket *sock); +@@ -810,7 +811,7 @@ static void shutdown_connection(struct connection *con, bool and_other) + return; + } + +- ret = kernel_sock_shutdown(con->sock, SHUT_WR); ++ ret = kernel_sock_shutdown(con->sock, dlm_proto_ops->how); + up_read(&con->sock_lock); + if (ret) { + log_print("Connection %p failed to shutdown: %d will force close", +@@ -1858,6 +1859,7 @@ static int dlm_tcp_listen_bind(struct socket *sock) + static const struct dlm_proto_ops dlm_tcp_ops = { + .name = "TCP", + .proto = IPPROTO_TCP, ++ .how = SHUT_WR, + .sockopts = dlm_tcp_sockopts, + .bind = dlm_tcp_bind, + .listen_validate = dlm_tcp_listen_validate, +@@ -1896,6 +1898,7 @@ static void dlm_sctp_sockopts(struct socket *sock) + static const struct dlm_proto_ops dlm_sctp_ops = { + .name = "SCTP", + .proto = IPPROTO_SCTP, ++ .how = SHUT_RDWR, + .try_new_addr = true, + .sockopts = dlm_sctp_sockopts, + .bind = dlm_sctp_bind, +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-add-null-pointer-checks-in-dm_force_.patch b/queue-6.15/drm-amd-display-add-null-pointer-checks-in-dm_force_.patch new file mode 100644 index 0000000000..37a7ef26f5 --- /dev/null +++ b/queue-6.15/drm-amd-display-add-null-pointer-checks-in-dm_force_.patch @@ -0,0 +1,82 @@ +From bc1ac970a9986b27437417f8152b4c5035e88256 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Apr 2025 00:57:19 +0530 +Subject: drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() + +From: Srinivasan Shanmugam + +[ Upstream commit 3f397cd203f247879c2f1a061e90d4c8d23655de ] + +This commit updates the dm_force_atomic_commit function to replace the +usage of PTR_ERR_OR_ZERO with IS_ERR for checking error states after +retrieving the Connector (drm_atomic_get_connector_state), CRTC +(drm_atomic_get_crtc_state), and Plane (drm_atomic_get_plane_state) +states. + +The function utilized PTR_ERR_OR_ZERO for error checking. However, this +approach is inappropriate in this context because the respective +functions do not return NULL; they return pointers that encode errors. + +This change ensures that error pointers are properly checked using +IS_ERR before attempting to dereference. + +Cc: Harry Wentland +Cc: Nicholas Kazlauskas +Cc: Tom Chung +Cc: Roman Li +Cc: Alex Hung +Cc: Aurabindo Pillai +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 0fe8bd19ecd13..d6214fc3921de 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10510,16 +10510,20 @@ static int dm_force_atomic_commit(struct drm_connector *connector) + */ + conn_state = drm_atomic_get_connector_state(state, connector); + +- ret = PTR_ERR_OR_ZERO(conn_state); +- if (ret) ++ /* Check for error in getting connector state */ ++ if (IS_ERR(conn_state)) { ++ ret = PTR_ERR(conn_state); + goto out; ++ } + + /* Attach crtc to drm_atomic_state*/ + crtc_state = drm_atomic_get_crtc_state(state, &disconnected_acrtc->base); + +- ret = PTR_ERR_OR_ZERO(crtc_state); +- if (ret) ++ /* Check for error in getting crtc state */ ++ if (IS_ERR(crtc_state)) { ++ ret = PTR_ERR(crtc_state); + goto out; ++ } + + /* force a restore */ + crtc_state->mode_changed = true; +@@ -10527,9 +10531,11 @@ static int dm_force_atomic_commit(struct drm_connector *connector) + /* Attach plane to drm_atomic_state */ + plane_state = drm_atomic_get_plane_state(state, plane); + +- ret = PTR_ERR_OR_ZERO(plane_state); +- if (ret) ++ /* Check for error in getting plane state */ ++ if (IS_ERR(plane_state)) { ++ ret = PTR_ERR(plane_state); + goto out; ++ } + + /* Call commit internally with the state we just constructed */ + ret = drm_atomic_commit(state); +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-avoid-divide-by-zero-by-initializing.patch b/queue-6.15/drm-amd-display-avoid-divide-by-zero-by-initializing.patch new file mode 100644 index 0000000000..7f2d56fc0e --- /dev/null +++ b/queue-6.15/drm-amd-display-avoid-divide-by-zero-by-initializing.patch @@ -0,0 +1,44 @@ +From 4af05023af09e3c87d3c79d15ee7ba9dc088590b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2025 16:03:52 -0600 +Subject: drm/amd/display: Avoid divide by zero by initializing dummy pitch to + 1 + +From: Mario Limonciello + +[ Upstream commit 7e40f64896e8e3dca471e287672db5ace12ea0be ] + +[Why] +If the dummy values in `populate_dummy_dml_surface_cfg()` aren't updated +then they can lead to a divide by zero in downstream callers like +CalculateVMAndRowBytes() + +[How] +Initialize dummy value to a value to avoid divide by zero. + +Reviewed-by: Alex Hung +Signed-off-by: Mario Limonciello +Signed-off-by: Zaeem Mohamed +Tested-by: Mark Broadworth +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c +index ab6baf2698012..5de775fd8fcee 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c +@@ -896,7 +896,7 @@ static void populate_dummy_dml_surface_cfg(struct dml_surface_cfg_st *out, unsig + out->SurfaceWidthC[location] = in->timing.h_addressable; + out->SurfaceHeightC[location] = in->timing.v_addressable; + out->PitchY[location] = ((out->SurfaceWidthY[location] + 127) / 128) * 128; +- out->PitchC[location] = 0; ++ out->PitchC[location] = 1; + out->DCCEnable[location] = false; + out->DCCMetaPitchY[location] = 0; + out->DCCMetaPitchC[location] = 0; +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-correct-prefetch-calculation.patch b/queue-6.15/drm-amd-display-correct-prefetch-calculation.patch new file mode 100644 index 0000000000..1a99298a36 --- /dev/null +++ b/queue-6.15/drm-amd-display-correct-prefetch-calculation.patch @@ -0,0 +1,68 @@ +From 5648843d2697661e1bc63b64ca5d9ce48d90a675 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 10:41:48 +0800 +Subject: drm/amd/display: Correct prefetch calculation + +From: TungYu Lu + +[ Upstream commit 33bc89949b4366dff2dca30bc61ba1c0cbcd2ab2 ] + +[Why] +The minimum value of the dst_y_prefetch_equ was not correct +in prefetch calculation whice causes OPTC underflow. + +[How] +Add the min operation of dst_y_prefetch_equ in prefetch calculation +for legacy DML. + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: TungYu Lu +Signed-off-by: Zaeem Mohamed +Tested-by: Mark Broadworth +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c | 1 + + drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c | 1 + + drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +index f1fe49401bc0a..8d24763938ea6 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +@@ -1002,6 +1002,7 @@ static bool CalculatePrefetchSchedule( + + dst_y_prefetch_equ = VStartup - (Tsetup + dml_max(TWait + TCalc, *Tdmdl)) / LineTime + - (*DSTYAfterScaler + *DSTXAfterScaler / myPipe->HTotal); ++ dst_y_prefetch_equ = dml_min(dst_y_prefetch_equ, 63.75); // limit to the reg limit of U6.2 for DST_Y_PREFETCH + + Lsw_oto = dml_max(PrefetchSourceLinesY, PrefetchSourceLinesC); + Tsw_oto = Lsw_oto * LineTime; +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c b/drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c +index f567a9023682d..ed59c77bc6f60 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c +@@ -1105,6 +1105,7 @@ static bool CalculatePrefetchSchedule( + Tr0_oto_lines = dml_ceil(4.0 * Tr0_oto / LineTime, 1) / 4.0; + dst_y_prefetch_oto = Tvm_oto_lines + 2 * Tr0_oto_lines + Lsw_oto; + dst_y_prefetch_equ = VStartup - (*TSetup + dml_max(TWait + TCalc, *Tdmdl)) / LineTime - (*DSTYAfterScaler + *DSTXAfterScaler / myPipe->HTotal); ++ dst_y_prefetch_equ = dml_min(dst_y_prefetch_equ, 63.75); // limit to the reg limit of U6.2 for DST_Y_PREFETCH + dst_y_prefetch_equ = dml_floor(4.0 * (dst_y_prefetch_equ + 0.125), 1) / 4.0; + Tpre_rounded = dst_y_prefetch_equ * LineTime; + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c b/drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c +index 5865e8fa2d8e8..9f3938a50240f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c +@@ -1123,6 +1123,7 @@ static bool CalculatePrefetchSchedule( + Tr0_oto_lines = dml_ceil(4.0 * Tr0_oto / LineTime, 1) / 4.0; + dst_y_prefetch_oto = Tvm_oto_lines + 2 * Tr0_oto_lines + Lsw_oto; + dst_y_prefetch_equ = VStartup - (*TSetup + dml_max(TWait + TCalc, *Tdmdl)) / LineTime - (*DSTYAfterScaler + *DSTXAfterScaler / myPipe->HTotal); ++ dst_y_prefetch_equ = dml_min(dst_y_prefetch_equ, 63.75); // limit to the reg limit of U6.2 for DST_Y_PREFETCH + dst_y_prefetch_equ = dml_floor(4.0 * (dst_y_prefetch_equ + 0.125), 1) / 4.0; + Tpre_rounded = dst_y_prefetch_equ * LineTime; + +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-correct-ssc-enable-detection-for-dcn.patch b/queue-6.15/drm-amd-display-correct-ssc-enable-detection-for-dcn.patch new file mode 100644 index 0000000000..7453393c73 --- /dev/null +++ b/queue-6.15/drm-amd-display-correct-ssc-enable-detection-for-dcn.patch @@ -0,0 +1,103 @@ +From b13416d21b69d27f5d9b4aa5e364e92be0f3f783 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 14:14:05 -0400 +Subject: drm/amd/display: Correct SSC enable detection for DCN351 + +From: Kevin Gao + +[ Upstream commit d01a7306e1bec9c02268793f58144e3e42695bf0 ] + +[Why] +Due to very small clock register delta between DCN35 and DCN351, clock +spread is being checked on the wrong register for DCN351, causing the +display driver to believe that DPREFCLK downspread to be disabled when +in some stacks it is enabled. This causes the clock values for audio to +be incorrect. + +[How] +Both DCN351 and DCN35 use the same clk_mgr, so we modify the DCN35 +function that checks for SSC enable to read CLK6 instead of CLK5 when +using DCN351. This allows us to read for DPREFCLK downspread correctly +so the clock can properly compensate when setting values. + +Reviewed-by: Charlene Liu +Signed-off-by: Kevin Gao +Signed-off-by: Roman Li +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn351_clk_mgr.c | 1 + + .../gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 8 +++++++- + drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h | 3 ++- + 3 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn351_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn351_clk_mgr.c +index 6a6ae618650b6..4607eff07253c 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn351_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn351_clk_mgr.c +@@ -65,6 +65,7 @@ + #define mmCLK1_CLK5_ALLOW_DS 0x16EB1 + + #define mmCLK5_spll_field_8 0x1B04B ++#define mmCLK6_spll_field_8 0x1B24B + #define mmDENTIST_DISPCLK_CNTL 0x0124 + #define regDENTIST_DISPCLK_CNTL 0x0064 + #define regDENTIST_DISPCLK_CNTL_BASE_IDX 1 +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +index 142de8938d7c3..bb1ac12a2b095 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +@@ -90,6 +90,7 @@ + #define mmCLK1_CLK5_ALLOW_DS 0x16EB1 + + #define mmCLK5_spll_field_8 0x1B24B ++#define mmCLK6_spll_field_8 0x1B24B + #define mmDENTIST_DISPCLK_CNTL 0x0124 + #define regDENTIST_DISPCLK_CNTL 0x0064 + #define regDENTIST_DISPCLK_CNTL_BASE_IDX 1 +@@ -116,6 +117,7 @@ + #define DENTIST_DISPCLK_CNTL__DENTIST_DPPCLK_WDIVIDER_MASK 0x7F000000L + + #define CLK5_spll_field_8__spll_ssc_en_MASK 0x00002000L ++#define CLK6_spll_field_8__spll_ssc_en_MASK 0x00002000L + + #define SMU_VER_THRESHOLD 0x5D4A00 //93.74.0 + #undef FN +@@ -596,7 +598,11 @@ static bool dcn35_is_spll_ssc_enabled(struct clk_mgr *clk_mgr_base) + + uint32_t ssc_enable; + +- ssc_enable = REG_READ(CLK5_spll_field_8) & CLK5_spll_field_8__spll_ssc_en_MASK; ++ if (clk_mgr_base->ctx->dce_version == DCN_VERSION_3_51) { ++ ssc_enable = REG_READ(CLK6_spll_field_8) & CLK6_spll_field_8__spll_ssc_en_MASK; ++ } else { ++ ssc_enable = REG_READ(CLK5_spll_field_8) & CLK5_spll_field_8__spll_ssc_en_MASK; ++ } + + return ssc_enable != 0; + } +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h +index 221645c023b50..bac8febad69a5 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h +@@ -199,6 +199,7 @@ enum dentist_divider_range { + CLK_SR_DCN35(CLK1_CLK4_ALLOW_DS), \ + CLK_SR_DCN35(CLK1_CLK5_ALLOW_DS), \ + CLK_SR_DCN35(CLK5_spll_field_8), \ ++ CLK_SR_DCN35(CLK6_spll_field_8), \ + SR(DENTIST_DISPCLK_CNTL), \ + + #define CLK_COMMON_MASK_SH_LIST_DCN32(mask_sh) \ +@@ -307,7 +308,7 @@ struct clk_mgr_registers { + uint32_t CLK1_CLK4_ALLOW_DS; + uint32_t CLK1_CLK5_ALLOW_DS; + uint32_t CLK5_spll_field_8; +- ++ uint32_t CLK6_spll_field_8; + }; + + struct clk_mgr_shift { +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-dcn32-null-data-check.patch b/queue-6.15/drm-amd-display-dcn32-null-data-check.patch new file mode 100644 index 0000000000..3f7280af8a --- /dev/null +++ b/queue-6.15/drm-amd-display-dcn32-null-data-check.patch @@ -0,0 +1,497 @@ +From 1bc81c03694343a48b597bbb0e80a2cf9d5fc5a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Mar 2025 15:59:51 -0400 +Subject: drm/amd/display: DCN32 null data check + +From: Yihan Zhu + +[ Upstream commit c9646e5a7e01c3ede286ec5edd4fcb2e1e80261d ] + +[WHY & HOW] +Avoid null curve data structure used in the cm block for the potential issue. + +Reviewed-by: Charlene Liu +Signed-off-by: Yihan Zhu +Signed-off-by: Zaeem Mohamed +Tested-by: Mark Broadworth +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c | 380 +++++++++--------- + 1 file changed, 192 insertions(+), 188 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c +index a0e9e9f0441a4..b4cea2b8cb2a8 100644 +--- a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c ++++ b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c +@@ -370,275 +370,279 @@ void mpc32_program_shaper_luta_settings( + MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B, params->corner_points[1].red.custom_float_y); + + curve = params->arr_curve_points; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_0_1[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_2_3[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_4_5[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_6_7[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_8_9[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_10_11[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_12_13[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_14_15[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_16_17[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_18_19[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_20_21[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_22_23[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_24_25[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_26_27[mpcc_id], 0, ++ if (curve) { ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_0_1[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_28_29[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_30_31[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_32_33[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +-} +- +- +-void mpc32_program_shaper_lutb_settings( +- struct mpc *mpc, +- const struct pwl_params *params, +- uint32_t mpcc_id) +-{ +- const struct gamma_curve *curve; +- struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc); +- +- REG_SET_2(MPCC_MCM_SHAPER_RAMB_START_CNTL_B[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B, params->corner_points[0].blue.custom_float_x, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B, 0); +- REG_SET_2(MPCC_MCM_SHAPER_RAMB_START_CNTL_G[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B, params->corner_points[0].green.custom_float_x, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B, 0); +- REG_SET_2(MPCC_MCM_SHAPER_RAMB_START_CNTL_R[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B, params->corner_points[0].red.custom_float_x, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B, 0); +- +- REG_SET_2(MPCC_MCM_SHAPER_RAMB_END_CNTL_B[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B, params->corner_points[1].blue.custom_float_x, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B, params->corner_points[1].blue.custom_float_y); +- REG_SET_2(MPCC_MCM_SHAPER_RAMB_END_CNTL_G[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B, params->corner_points[1].green.custom_float_x, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B, params->corner_points[1].green.custom_float_y); +- REG_SET_2(MPCC_MCM_SHAPER_RAMB_END_CNTL_R[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B, params->corner_points[1].red.custom_float_x, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B, params->corner_points[1].red.custom_float_y); +- +- curve = params->arr_curve_points; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_0_1[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_2_3[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_2_3[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_4_5[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_4_5[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_6_7[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_6_7[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_8_9[mpcc_id], 0, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, +- MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_8_9[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_10_11[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_10_11[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_12_13[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_12_13[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_14_15[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_14_15[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_16_17[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_16_17[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_18_19[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_18_19[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_20_21[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_20_21[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_22_23[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_22_23[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_24_25[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_24_25[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_26_27[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_26_27[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_28_29[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_28_29[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_30_31[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_30_31[mpcc_id], 0, ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMA_REGION_32_33[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ } ++} ++ ++ ++void mpc32_program_shaper_lutb_settings( ++ struct mpc *mpc, ++ const struct pwl_params *params, ++ uint32_t mpcc_id) ++{ ++ const struct gamma_curve *curve; ++ struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc); ++ ++ REG_SET_2(MPCC_MCM_SHAPER_RAMB_START_CNTL_B[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B, params->corner_points[0].blue.custom_float_x, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B, 0); ++ REG_SET_2(MPCC_MCM_SHAPER_RAMB_START_CNTL_G[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B, params->corner_points[0].green.custom_float_x, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B, 0); ++ REG_SET_2(MPCC_MCM_SHAPER_RAMB_START_CNTL_R[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_B, params->corner_points[0].red.custom_float_x, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_START_SEGMENT_B, 0); + +- curve += 2; +- REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_32_33[mpcc_id], 0, ++ REG_SET_2(MPCC_MCM_SHAPER_RAMB_END_CNTL_B[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B, params->corner_points[1].blue.custom_float_x, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B, params->corner_points[1].blue.custom_float_y); ++ REG_SET_2(MPCC_MCM_SHAPER_RAMB_END_CNTL_G[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B, params->corner_points[1].green.custom_float_x, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B, params->corner_points[1].green.custom_float_y); ++ REG_SET_2(MPCC_MCM_SHAPER_RAMB_END_CNTL_R[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_B, params->corner_points[1].red.custom_float_x, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION_END_BASE_B, params->corner_points[1].red.custom_float_y); ++ ++ curve = params->arr_curve_points; ++ if (curve) { ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_0_1[mpcc_id], 0, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, + MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_2_3[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_4_5[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_6_7[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_8_9[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_10_11[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_12_13[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_14_15[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_16_17[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_18_19[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_20_21[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_22_23[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_24_25[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_26_27[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_28_29[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_30_31[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ ++ curve += 2; ++ REG_SET_4(MPCC_MCM_SHAPER_RAMB_REGION_32_33[mpcc_id], 0, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_LUT_OFFSET, curve[0].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION0_NUM_SEGMENTS, curve[0].segments_num, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_LUT_OFFSET, curve[1].offset, ++ MPCC_MCM_SHAPER_RAMA_EXP_REGION1_NUM_SEGMENTS, curve[1].segments_num); ++ } + } + + +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-disable-dpp-rcg-before-dpp-clk-enabl.patch b/queue-6.15/drm-amd-display-disable-dpp-rcg-before-dpp-clk-enabl.patch new file mode 100644 index 0000000000..e7a68e1b9e --- /dev/null +++ b/queue-6.15/drm-amd-display-disable-dpp-rcg-before-dpp-clk-enabl.patch @@ -0,0 +1,245 @@ +From e7f41c81ee943605db290c3fec1bcc29a545f95b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 21:29:17 -0400 +Subject: drm/amd/display: disable DPP RCG before DPP CLK enable + +From: Charlene Liu + +[ Upstream commit 1bcd679209420305a86833bc357d50021909edaf ] + +[why] +DPP CLK enable needs to disable DPPCLK RCG first. +The DPPCLK_en in dccg should always be enabled when the corresponding +pipe is enabled. + +Reviewed-by: Hansen Dsouza +Signed-off-by: Charlene Liu +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/dccg/dcn35/dcn35_dccg.c | 38 ++++++++++++------- + .../amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 21 ++++++---- + 2 files changed, 38 insertions(+), 21 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c b/drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c +index b363f5360818d..ad910065f463f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c +@@ -391,6 +391,7 @@ static void dccg35_set_dppclk_rcg(struct dccg *dccg, + + struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg); + ++ + if (!dccg->ctx->dc->debug.root_clock_optimization.bits.dpp && enable) + return; + +@@ -411,6 +412,8 @@ static void dccg35_set_dppclk_rcg(struct dccg *dccg, + BREAK_TO_DEBUGGER(); + break; + } ++ //DC_LOG_DEBUG("%s: inst(%d) DPPCLK rcg_disable: %d\n", __func__, inst, enable ? 0 : 1); ++ + } + + static void dccg35_set_dpstreamclk_rcg( +@@ -1112,30 +1115,24 @@ static void dcn35_set_dppclk_enable(struct dccg *dccg, + { + struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg); + ++ + switch (dpp_inst) { + case 0: + REG_UPDATE(DPPCLK_CTRL, DPPCLK0_EN, enable); +- if (dccg->ctx->dc->debug.root_clock_optimization.bits.dpp) +- REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK0_ROOT_GATE_DISABLE, enable); + break; + case 1: + REG_UPDATE(DPPCLK_CTRL, DPPCLK1_EN, enable); +- if (dccg->ctx->dc->debug.root_clock_optimization.bits.dpp) +- REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK1_ROOT_GATE_DISABLE, enable); + break; + case 2: + REG_UPDATE(DPPCLK_CTRL, DPPCLK2_EN, enable); +- if (dccg->ctx->dc->debug.root_clock_optimization.bits.dpp) +- REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK2_ROOT_GATE_DISABLE, enable); + break; + case 3: + REG_UPDATE(DPPCLK_CTRL, DPPCLK3_EN, enable); +- if (dccg->ctx->dc->debug.root_clock_optimization.bits.dpp) +- REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK3_ROOT_GATE_DISABLE, enable); + break; + default: + break; + } ++ //DC_LOG_DEBUG("%s: dpp_inst(%d) DPPCLK_EN = %d\n", __func__, dpp_inst, enable); + + } + +@@ -1163,14 +1160,18 @@ static void dccg35_update_dpp_dto(struct dccg *dccg, int dpp_inst, + ASSERT(false); + phase = 0xff; + } ++ dccg35_set_dppclk_rcg(dccg, dpp_inst, false); + + REG_SET_2(DPPCLK_DTO_PARAM[dpp_inst], 0, + DPPCLK0_DTO_PHASE, phase, + DPPCLK0_DTO_MODULO, modulo); + + dcn35_set_dppclk_enable(dccg, dpp_inst, true); +- } else ++ } else { + dcn35_set_dppclk_enable(dccg, dpp_inst, false); ++ /*we have this in hwss: disable_plane*/ ++ //dccg35_set_dppclk_rcg(dccg, dpp_inst, true); ++ } + dccg->pipe_dppclk_khz[dpp_inst] = req_dppclk; + } + +@@ -1182,6 +1183,7 @@ static void dccg35_set_dppclk_root_clock_gating(struct dccg *dccg, + if (!dccg->ctx->dc->debug.root_clock_optimization.bits.dpp) + return; + ++ + switch (dpp_inst) { + case 0: + REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK0_ROOT_GATE_DISABLE, enable); +@@ -1198,6 +1200,8 @@ static void dccg35_set_dppclk_root_clock_gating(struct dccg *dccg, + default: + break; + } ++ //DC_LOG_DEBUG("%s: dpp_inst(%d) rcg: %d\n", __func__, dpp_inst, enable); ++ + } + + static void dccg35_get_pixel_rate_div( +@@ -1521,28 +1525,30 @@ static void dccg35_set_physymclk_root_clock_gating( + switch (phy_inst) { + case 0: + REG_UPDATE(DCCG_GATE_DISABLE_CNTL2, +- PHYASYMCLK_ROOT_GATE_DISABLE, enable ? 1 : 0); ++ PHYASYMCLK_ROOT_GATE_DISABLE, enable ? 0 : 1); + break; + case 1: + REG_UPDATE(DCCG_GATE_DISABLE_CNTL2, +- PHYBSYMCLK_ROOT_GATE_DISABLE, enable ? 1 : 0); ++ PHYBSYMCLK_ROOT_GATE_DISABLE, enable ? 0 : 1); + break; + case 2: + REG_UPDATE(DCCG_GATE_DISABLE_CNTL2, +- PHYCSYMCLK_ROOT_GATE_DISABLE, enable ? 1 : 0); ++ PHYCSYMCLK_ROOT_GATE_DISABLE, enable ? 0 : 1); + break; + case 3: + REG_UPDATE(DCCG_GATE_DISABLE_CNTL2, +- PHYDSYMCLK_ROOT_GATE_DISABLE, enable ? 1 : 0); ++ PHYDSYMCLK_ROOT_GATE_DISABLE, enable ? 0 : 1); + break; + case 4: + REG_UPDATE(DCCG_GATE_DISABLE_CNTL2, +- PHYESYMCLK_ROOT_GATE_DISABLE, enable ? 1 : 0); ++ PHYESYMCLK_ROOT_GATE_DISABLE, enable ? 0 : 1); + break; + default: + BREAK_TO_DEBUGGER(); + return; + } ++ //DC_LOG_DEBUG("%s: dpp_inst(%d) PHYESYMCLK_ROOT_GATE_DISABLE:\n", __func__, phy_inst, enable ? 0 : 1); ++ + } + + static void dccg35_set_physymclk( +@@ -1643,6 +1649,8 @@ static void dccg35_dpp_root_clock_control( + return; + + if (clock_on) { ++ dccg35_set_dppclk_rcg(dccg, dpp_inst, false); ++ + /* turn off the DTO and leave phase/modulo at max */ + dcn35_set_dppclk_enable(dccg, dpp_inst, 1); + REG_SET_2(DPPCLK_DTO_PARAM[dpp_inst], 0, +@@ -1654,6 +1662,8 @@ static void dccg35_dpp_root_clock_control( + REG_SET_2(DPPCLK_DTO_PARAM[dpp_inst], 0, + DPPCLK0_DTO_PHASE, 0, + DPPCLK0_DTO_MODULO, 1); ++ /*we have this in hwss: disable_plane*/ ++ //dccg35_set_dppclk_rcg(dccg, dpp_inst, true); + } + + dccg->dpp_clock_gated[dpp_inst] = !clock_on; +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +index 922b8d71cf1aa..63077c1fad859 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +@@ -241,11 +241,6 @@ void dcn35_init_hw(struct dc *dc) + dc->res_pool->hubbub->funcs->allow_self_refresh_control(dc->res_pool->hubbub, + !dc->res_pool->hubbub->ctx->dc->debug.disable_stutter); + } +- if (res_pool->dccg->funcs->dccg_root_gate_disable_control) { +- for (i = 0; i < res_pool->pipe_count; i++) +- res_pool->dccg->funcs->dccg_root_gate_disable_control(res_pool->dccg, i, 0); +- } +- + for (i = 0; i < res_pool->audio_count; i++) { + struct audio *audio = res_pool->audios[i]; + +@@ -901,12 +896,18 @@ void dcn35_init_pipes(struct dc *dc, struct dc_state *context) + void dcn35_enable_plane(struct dc *dc, struct pipe_ctx *pipe_ctx, + struct dc_state *context) + { ++ struct dpp *dpp = pipe_ctx->plane_res.dpp; ++ struct dccg *dccg = dc->res_pool->dccg; ++ ++ + /* enable DCFCLK current DCHUB */ + pipe_ctx->plane_res.hubp->funcs->hubp_clk_cntl(pipe_ctx->plane_res.hubp, true); + + /* initialize HUBP on power up */ + pipe_ctx->plane_res.hubp->funcs->hubp_init(pipe_ctx->plane_res.hubp); +- ++ /*make sure DPPCLK is on*/ ++ dccg->funcs->dccg_root_gate_disable_control(dccg, dpp->inst, true); ++ dpp->funcs->dpp_dppclk_control(dpp, false, true); + /* make sure OPP_PIPE_CLOCK_EN = 1 */ + pipe_ctx->stream_res.opp->funcs->opp_pipe_clock_control( + pipe_ctx->stream_res.opp, +@@ -923,6 +924,7 @@ void dcn35_enable_plane(struct dc *dc, struct pipe_ctx *pipe_ctx, + // Program system aperture settings + pipe_ctx->plane_res.hubp->funcs->hubp_set_vm_system_aperture_settings(pipe_ctx->plane_res.hubp, &apt); + } ++ //DC_LOG_DEBUG("%s: dpp_inst(%d) =\n", __func__, dpp->inst); + + if (!pipe_ctx->top_pipe + && pipe_ctx->plane_state +@@ -938,6 +940,8 @@ void dcn35_plane_atomic_disable(struct dc *dc, struct pipe_ctx *pipe_ctx) + { + struct hubp *hubp = pipe_ctx->plane_res.hubp; + struct dpp *dpp = pipe_ctx->plane_res.dpp; ++ struct dccg *dccg = dc->res_pool->dccg; ++ + + dc->hwss.wait_for_mpcc_disconnect(dc, dc->res_pool, pipe_ctx); + +@@ -955,7 +959,8 @@ void dcn35_plane_atomic_disable(struct dc *dc, struct pipe_ctx *pipe_ctx) + hubp->funcs->hubp_clk_cntl(hubp, false); + + dpp->funcs->dpp_dppclk_control(dpp, false, false); +-/*to do, need to support both case*/ ++ dccg->funcs->dccg_root_gate_disable_control(dccg, dpp->inst, false); ++ + hubp->power_gated = true; + + hubp->funcs->hubp_reset(hubp); +@@ -967,6 +972,8 @@ void dcn35_plane_atomic_disable(struct dc *dc, struct pipe_ctx *pipe_ctx) + pipe_ctx->top_pipe = NULL; + pipe_ctx->bottom_pipe = NULL; + pipe_ctx->plane_state = NULL; ++ //DC_LOG_DEBUG("%s: dpp_inst(%d)=\n", __func__, dpp->inst); ++ + } + + void dcn35_disable_plane(struct dc *dc, struct dc_state *state, struct pipe_ctx *pipe_ctx) +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-disable-easf-narrow-filter-sharpenin.patch b/queue-6.15/drm-amd-display-disable-easf-narrow-filter-sharpenin.patch new file mode 100644 index 0000000000..5ef5a93270 --- /dev/null +++ b/queue-6.15/drm-amd-display-disable-easf-narrow-filter-sharpenin.patch @@ -0,0 +1,47 @@ +From 8b762b2efebc6a67fa2ac30508a72a76fd4eab8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 May 2025 15:59:47 -0400 +Subject: drm/amd/display: disable EASF narrow filter sharpening + +From: Samson Tam + +[ Upstream commit c8d7e0be8183f4375a5cf5c3efd0c678129ea4de ] + +[Why & How] +Default should be 1 to disable EASF narrow filter sharpening. + +Reviewed-by: Alvin Lee +Signed-off-by: Samson Tam +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c b/drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c +index 28348734d900c..124aaff890d21 100644 +--- a/drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c ++++ b/drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c +@@ -1297,7 +1297,7 @@ static void spl_set_easf_data(struct spl_scratch *spl_scratch, struct spl_out *s + if (enable_easf_v) { + dscl_prog_data->easf_v_en = true; + dscl_prog_data->easf_v_ring = 0; +- dscl_prog_data->easf_v_sharp_factor = 0; ++ dscl_prog_data->easf_v_sharp_factor = 1; + dscl_prog_data->easf_v_bf1_en = 1; // 1-bit, BF1 calculation enable, 0=disable, 1=enable + dscl_prog_data->easf_v_bf2_mode = 0xF; // 4-bit, BF2 calculation mode + /* 2-bit, BF3 chroma mode correction calculation mode */ +@@ -1461,7 +1461,7 @@ static void spl_set_easf_data(struct spl_scratch *spl_scratch, struct spl_out *s + if (enable_easf_h) { + dscl_prog_data->easf_h_en = true; + dscl_prog_data->easf_h_ring = 0; +- dscl_prog_data->easf_h_sharp_factor = 0; ++ dscl_prog_data->easf_h_sharp_factor = 1; + dscl_prog_data->easf_h_bf1_en = + 1; // 1-bit, BF1 calculation enable, 0=disable, 1=enable + dscl_prog_data->easf_h_bf2_mode = +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-do-not-consider-dsc-if-valid-config-.patch b/queue-6.15/drm-amd-display-do-not-consider-dsc-if-valid-config-.patch new file mode 100644 index 0000000000..b8432eb2a3 --- /dev/null +++ b/queue-6.15/drm-amd-display-do-not-consider-dsc-if-valid-config-.patch @@ -0,0 +1,64 @@ +From 60fcab4a6bd743c83cfd97d4e53c16e5f1626cc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 13:58:24 -0400 +Subject: drm/amd/display: Do Not Consider DSC if Valid Config Not Found + +From: Fangzhi Zuo + +[ Upstream commit 146a4429b5674b7520a96aea34233949731c6086 ] + +[why] +In the mode validation, mst dsc is considered for bw calculation after +common dsc config is determined. Currently it considered common dsc config +is found if max and min target bpp are non zero which is not accurate. Invalid +max and min target bpp values would not get max_kbps and min_kbps calculated, +leading to falsefully pass a mode that does not have valid dsc parameters +available. + +[how] +Use the return value of decide_dsc_bandwidth_range() to determine whether valid +dsc common config is found or not. Prune out modes that do not have valid common +dsc config determined. + +Reviewed-by: Wayne Lin +Signed-off-by: Fangzhi Zuo +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 5cdbc86ef8f5a..25e8befbcc479 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -1739,16 +1739,17 @@ static bool is_dsc_common_config_possible(struct dc_stream_state *stream, + struct dc_dsc_bw_range *bw_range) + { + struct dc_dsc_policy dsc_policy = {0}; ++ bool is_dsc_possible; + + dc_dsc_get_policy_for_timing(&stream->timing, 0, &dsc_policy, dc_link_get_highest_encoding_format(stream->link)); +- dc_dsc_compute_bandwidth_range(stream->sink->ctx->dc->res_pool->dscs[0], +- stream->sink->ctx->dc->debug.dsc_min_slice_height_override, +- dsc_policy.min_target_bpp * 16, +- dsc_policy.max_target_bpp * 16, +- &stream->sink->dsc_caps.dsc_dec_caps, +- &stream->timing, dc_link_get_highest_encoding_format(stream->link), bw_range); +- +- return bw_range->max_target_bpp_x16 && bw_range->min_target_bpp_x16; ++ is_dsc_possible = dc_dsc_compute_bandwidth_range(stream->sink->ctx->dc->res_pool->dscs[0], ++ stream->sink->ctx->dc->debug.dsc_min_slice_height_override, ++ dsc_policy.min_target_bpp * 16, ++ dsc_policy.max_target_bpp * 16, ++ &stream->sink->dsc_caps.dsc_dec_caps, ++ &stream->timing, dc_link_get_highest_encoding_format(stream->link), bw_range); ++ ++ return is_dsc_possible; + } + #endif + +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-fix-vertical-interrupt-definitions-f.patch b/queue-6.15/drm-amd-display-fix-vertical-interrupt-definitions-f.patch new file mode 100644 index 0000000000..3655bf22c1 --- /dev/null +++ b/queue-6.15/drm-amd-display-fix-vertical-interrupt-definitions-f.patch @@ -0,0 +1,270 @@ +From 2ae4be7255624df4c037124a638c3eede3a76825 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 13:54:44 -0400 +Subject: drm/amd/display: Fix Vertical Interrupt definitions for dcn32, dcn401 + +From: Dillon Varone + +[ Upstream commit e8cc149ed906a371a5962ff8065393bae28165c9 ] + +[WHY&HOW] +- VUPDATE_NO_LOCK should be used in place of VUPDATE always +- Add VERTICAL_INTERRUPT1 and VERTICAL_INTERRUPT2 definitions + +Reviewed-by: Aric Cyr +Signed-off-by: Dillon Varone +Signed-off-by: Fangzhi Zuo +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../display/dc/irq/dcn32/irq_service_dcn32.c | 61 ++++++++++++++----- + .../dc/irq/dcn401/irq_service_dcn401.c | 60 +++++++++++++----- + drivers/gpu/drm/amd/display/dc/irq_types.h | 9 +++ + 3 files changed, 101 insertions(+), 29 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/irq/dcn32/irq_service_dcn32.c b/drivers/gpu/drm/amd/display/dc/irq/dcn32/irq_service_dcn32.c +index f0ac0aeeac512..f839afacd5a5c 100644 +--- a/drivers/gpu/drm/amd/display/dc/irq/dcn32/irq_service_dcn32.c ++++ b/drivers/gpu/drm/amd/display/dc/irq/dcn32/irq_service_dcn32.c +@@ -191,6 +191,16 @@ static struct irq_source_info_funcs vline0_irq_info_funcs = { + .ack = NULL + }; + ++static struct irq_source_info_funcs vline1_irq_info_funcs = { ++ .set = NULL, ++ .ack = NULL ++}; ++ ++static struct irq_source_info_funcs vline2_irq_info_funcs = { ++ .set = NULL, ++ .ack = NULL ++}; ++ + #undef BASE_INNER + #define BASE_INNER(seg) DCN_BASE__INST0_SEG ## seg + +@@ -259,6 +269,13 @@ static struct irq_source_info_funcs vline0_irq_info_funcs = { + .funcs = &pflip_irq_info_funcs\ + } + ++#define vblank_int_entry(reg_num)\ ++ [DC_IRQ_SOURCE_VBLANK1 + reg_num] = {\ ++ IRQ_REG_ENTRY(OTG, reg_num,\ ++ OTG_GLOBAL_SYNC_STATUS, VSTARTUP_INT_EN,\ ++ OTG_GLOBAL_SYNC_STATUS, VSTARTUP_EVENT_CLEAR),\ ++ .funcs = &vblank_irq_info_funcs\ ++ } + /* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic + * of DCE's DC_IRQ_SOURCE_VUPDATEx. + */ +@@ -270,14 +287,6 @@ static struct irq_source_info_funcs vline0_irq_info_funcs = { + .funcs = &vupdate_no_lock_irq_info_funcs\ + } + +-#define vblank_int_entry(reg_num)\ +- [DC_IRQ_SOURCE_VBLANK1 + reg_num] = {\ +- IRQ_REG_ENTRY(OTG, reg_num,\ +- OTG_GLOBAL_SYNC_STATUS, VSTARTUP_INT_EN,\ +- OTG_GLOBAL_SYNC_STATUS, VSTARTUP_EVENT_CLEAR),\ +- .funcs = &vblank_irq_info_funcs\ +-} +- + #define vline0_int_entry(reg_num)\ + [DC_IRQ_SOURCE_DC1_VLINE0 + reg_num] = {\ + IRQ_REG_ENTRY(OTG, reg_num,\ +@@ -285,6 +294,20 @@ static struct irq_source_info_funcs vline0_irq_info_funcs = { + OTG_VERTICAL_INTERRUPT0_CONTROL, OTG_VERTICAL_INTERRUPT0_CLEAR),\ + .funcs = &vline0_irq_info_funcs\ + } ++#define vline1_int_entry(reg_num)\ ++ [DC_IRQ_SOURCE_DC1_VLINE1 + reg_num] = {\ ++ IRQ_REG_ENTRY(OTG, reg_num,\ ++ OTG_VERTICAL_INTERRUPT1_CONTROL, OTG_VERTICAL_INTERRUPT1_INT_ENABLE,\ ++ OTG_VERTICAL_INTERRUPT1_CONTROL, OTG_VERTICAL_INTERRUPT1_CLEAR),\ ++ .funcs = &vline1_irq_info_funcs\ ++ } ++#define vline2_int_entry(reg_num)\ ++ [DC_IRQ_SOURCE_DC1_VLINE2 + reg_num] = {\ ++ IRQ_REG_ENTRY(OTG, reg_num,\ ++ OTG_VERTICAL_INTERRUPT2_CONTROL, OTG_VERTICAL_INTERRUPT2_INT_ENABLE,\ ++ OTG_VERTICAL_INTERRUPT2_CONTROL, OTG_VERTICAL_INTERRUPT2_CLEAR),\ ++ .funcs = &vline2_irq_info_funcs\ ++ } + #define dmub_outbox_int_entry()\ + [DC_IRQ_SOURCE_DMCUB_OUTBOX] = {\ + IRQ_REG_ENTRY_DMUB(\ +@@ -387,21 +410,29 @@ irq_source_info_dcn32[DAL_IRQ_SOURCES_NUMBER] = { + dc_underflow_int_entry(6), + [DC_IRQ_SOURCE_DMCU_SCP] = dummy_irq_entry(), + [DC_IRQ_SOURCE_VBIOS_SW] = dummy_irq_entry(), +- vupdate_no_lock_int_entry(0), +- vupdate_no_lock_int_entry(1), +- vupdate_no_lock_int_entry(2), +- vupdate_no_lock_int_entry(3), + vblank_int_entry(0), + vblank_int_entry(1), + vblank_int_entry(2), + vblank_int_entry(3), ++ [DC_IRQ_SOURCE_DC5_VLINE1] = dummy_irq_entry(), ++ [DC_IRQ_SOURCE_DC6_VLINE1] = dummy_irq_entry(), ++ dmub_outbox_int_entry(), ++ vupdate_no_lock_int_entry(0), ++ vupdate_no_lock_int_entry(1), ++ vupdate_no_lock_int_entry(2), ++ vupdate_no_lock_int_entry(3), + vline0_int_entry(0), + vline0_int_entry(1), + vline0_int_entry(2), + vline0_int_entry(3), +- [DC_IRQ_SOURCE_DC5_VLINE1] = dummy_irq_entry(), +- [DC_IRQ_SOURCE_DC6_VLINE1] = dummy_irq_entry(), +- dmub_outbox_int_entry(), ++ vline1_int_entry(0), ++ vline1_int_entry(1), ++ vline1_int_entry(2), ++ vline1_int_entry(3), ++ vline2_int_entry(0), ++ vline2_int_entry(1), ++ vline2_int_entry(2), ++ vline2_int_entry(3) + }; + + static const struct irq_service_funcs irq_service_funcs_dcn32 = { +diff --git a/drivers/gpu/drm/amd/display/dc/irq/dcn401/irq_service_dcn401.c b/drivers/gpu/drm/amd/display/dc/irq/dcn401/irq_service_dcn401.c +index b43c9524b0de1..8499e505cf3ef 100644 +--- a/drivers/gpu/drm/amd/display/dc/irq/dcn401/irq_service_dcn401.c ++++ b/drivers/gpu/drm/amd/display/dc/irq/dcn401/irq_service_dcn401.c +@@ -171,6 +171,16 @@ static struct irq_source_info_funcs vline0_irq_info_funcs = { + .ack = NULL + }; + ++static struct irq_source_info_funcs vline1_irq_info_funcs = { ++ .set = NULL, ++ .ack = NULL ++}; ++ ++static struct irq_source_info_funcs vline2_irq_info_funcs = { ++ .set = NULL, ++ .ack = NULL ++}; ++ + #undef BASE_INNER + #define BASE_INNER(seg) DCN_BASE__INST0_SEG ## seg + +@@ -239,6 +249,13 @@ static struct irq_source_info_funcs vline0_irq_info_funcs = { + .funcs = &pflip_irq_info_funcs\ + } + ++#define vblank_int_entry(reg_num)\ ++ [DC_IRQ_SOURCE_VBLANK1 + reg_num] = {\ ++ IRQ_REG_ENTRY(OTG, reg_num,\ ++ OTG_GLOBAL_SYNC_STATUS, VSTARTUP_INT_EN,\ ++ OTG_GLOBAL_SYNC_STATUS, VSTARTUP_EVENT_CLEAR),\ ++ .funcs = &vblank_irq_info_funcs\ ++ } + /* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic + * of DCE's DC_IRQ_SOURCE_VUPDATEx. + */ +@@ -250,13 +267,6 @@ static struct irq_source_info_funcs vline0_irq_info_funcs = { + .funcs = &vupdate_no_lock_irq_info_funcs\ + } + +-#define vblank_int_entry(reg_num)\ +- [DC_IRQ_SOURCE_VBLANK1 + reg_num] = {\ +- IRQ_REG_ENTRY(OTG, reg_num,\ +- OTG_GLOBAL_SYNC_STATUS, VSTARTUP_INT_EN,\ +- OTG_GLOBAL_SYNC_STATUS, VSTARTUP_EVENT_CLEAR),\ +- .funcs = &vblank_irq_info_funcs\ +- } + #define vline0_int_entry(reg_num)\ + [DC_IRQ_SOURCE_DC1_VLINE0 + reg_num] = {\ + IRQ_REG_ENTRY(OTG, reg_num,\ +@@ -264,6 +274,20 @@ static struct irq_source_info_funcs vline0_irq_info_funcs = { + OTG_VERTICAL_INTERRUPT0_CONTROL, OTG_VERTICAL_INTERRUPT0_CLEAR),\ + .funcs = &vline0_irq_info_funcs\ + } ++#define vline1_int_entry(reg_num)\ ++ [DC_IRQ_SOURCE_DC1_VLINE1 + reg_num] = {\ ++ IRQ_REG_ENTRY(OTG, reg_num,\ ++ OTG_VERTICAL_INTERRUPT1_CONTROL, OTG_VERTICAL_INTERRUPT1_INT_ENABLE,\ ++ OTG_VERTICAL_INTERRUPT1_CONTROL, OTG_VERTICAL_INTERRUPT1_CLEAR),\ ++ .funcs = &vline1_irq_info_funcs\ ++ } ++#define vline2_int_entry(reg_num)\ ++ [DC_IRQ_SOURCE_DC1_VLINE2 + reg_num] = {\ ++ IRQ_REG_ENTRY(OTG, reg_num,\ ++ OTG_VERTICAL_INTERRUPT2_CONTROL, OTG_VERTICAL_INTERRUPT2_INT_ENABLE,\ ++ OTG_VERTICAL_INTERRUPT2_CONTROL, OTG_VERTICAL_INTERRUPT2_CLEAR),\ ++ .funcs = &vline2_irq_info_funcs\ ++ } + #define dmub_outbox_int_entry()\ + [DC_IRQ_SOURCE_DMCUB_OUTBOX] = {\ + IRQ_REG_ENTRY_DMUB(\ +@@ -364,21 +388,29 @@ irq_source_info_dcn401[DAL_IRQ_SOURCES_NUMBER] = { + dc_underflow_int_entry(6), + [DC_IRQ_SOURCE_DMCU_SCP] = dummy_irq_entry(), + [DC_IRQ_SOURCE_VBIOS_SW] = dummy_irq_entry(), +- vupdate_no_lock_int_entry(0), +- vupdate_no_lock_int_entry(1), +- vupdate_no_lock_int_entry(2), +- vupdate_no_lock_int_entry(3), + vblank_int_entry(0), + vblank_int_entry(1), + vblank_int_entry(2), + vblank_int_entry(3), ++ [DC_IRQ_SOURCE_DC5_VLINE1] = dummy_irq_entry(), ++ [DC_IRQ_SOURCE_DC6_VLINE1] = dummy_irq_entry(), ++ dmub_outbox_int_entry(), ++ vupdate_no_lock_int_entry(0), ++ vupdate_no_lock_int_entry(1), ++ vupdate_no_lock_int_entry(2), ++ vupdate_no_lock_int_entry(3), + vline0_int_entry(0), + vline0_int_entry(1), + vline0_int_entry(2), + vline0_int_entry(3), +- [DC_IRQ_SOURCE_DC5_VLINE1] = dummy_irq_entry(), +- [DC_IRQ_SOURCE_DC6_VLINE1] = dummy_irq_entry(), +- dmub_outbox_int_entry(), ++ vline1_int_entry(0), ++ vline1_int_entry(1), ++ vline1_int_entry(2), ++ vline1_int_entry(3), ++ vline2_int_entry(0), ++ vline2_int_entry(1), ++ vline2_int_entry(2), ++ vline2_int_entry(3), + }; + + static const struct irq_service_funcs irq_service_funcs_dcn401 = { +diff --git a/drivers/gpu/drm/amd/display/dc/irq_types.h b/drivers/gpu/drm/amd/display/dc/irq_types.h +index 110f656d43aee..eadab0a2afebe 100644 +--- a/drivers/gpu/drm/amd/display/dc/irq_types.h ++++ b/drivers/gpu/drm/amd/display/dc/irq_types.h +@@ -161,6 +161,13 @@ enum dc_irq_source { + DC_IRQ_SOURCE_DPCX_TX_PHYE, + DC_IRQ_SOURCE_DPCX_TX_PHYF, + ++ DC_IRQ_SOURCE_DC1_VLINE2, ++ DC_IRQ_SOURCE_DC2_VLINE2, ++ DC_IRQ_SOURCE_DC3_VLINE2, ++ DC_IRQ_SOURCE_DC4_VLINE2, ++ DC_IRQ_SOURCE_DC5_VLINE2, ++ DC_IRQ_SOURCE_DC6_VLINE2, ++ + DAL_IRQ_SOURCES_NUMBER + }; + +@@ -170,6 +177,8 @@ enum irq_type + IRQ_TYPE_VUPDATE = DC_IRQ_SOURCE_VUPDATE1, + IRQ_TYPE_VBLANK = DC_IRQ_SOURCE_VBLANK1, + IRQ_TYPE_VLINE0 = DC_IRQ_SOURCE_DC1_VLINE0, ++ IRQ_TYPE_VLINE1 = DC_IRQ_SOURCE_DC1_VLINE1, ++ IRQ_TYPE_VLINE2 = DC_IRQ_SOURCE_DC1_VLINE2, + IRQ_TYPE_DCUNDERFLOW = DC_IRQ_SOURCE_DC1UNDERFLOW, + }; + +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-fix-vupdate-offset-calculations-for-.patch b/queue-6.15/drm-amd-display-fix-vupdate-offset-calculations-for-.patch new file mode 100644 index 0000000000..661bef45fb --- /dev/null +++ b/queue-6.15/drm-amd-display-fix-vupdate-offset-calculations-for-.patch @@ -0,0 +1,104 @@ +From 1e53990a0c7ce42f975410b3c862b0e3eb100362 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 13:53:25 -0400 +Subject: drm/amd/display: Fix VUpdate offset calculations for dcn401 + +From: Dillon Varone + +[ Upstream commit fe45e2af4a22e569b35b7f45eb9f040f6fbef94f ] + +[WHY&HOW] +DCN401 uses a different structure to store the VStartup offset used to +calculate the VUpdate position, so adjust the calculations to use this +value. + +Reviewed-by: Aric Cyr +Signed-off-by: Dillon Varone +Signed-off-by: Fangzhi Zuo +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 44 +++++++++++++++++++ + .../amd/display/dc/hwss/dcn401/dcn401_hwseq.h | 1 + + .../amd/display/dc/hwss/dcn401/dcn401_init.c | 2 +- + 3 files changed, 46 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +index 3af6a3402b894..061553aebd883 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c +@@ -2646,3 +2646,47 @@ void dcn401_plane_atomic_power_down(struct dc *dc, + if (hws->funcs.dpp_root_clock_control) + hws->funcs.dpp_root_clock_control(hws, dpp->inst, false); + } ++ ++/* ++ * apply_front_porch_workaround ++ * ++ * This is a workaround for a bug that has existed since R5xx and has not been ++ * fixed keep Front porch at minimum 2 for Interlaced mode or 1 for progressive. ++ */ ++static void apply_front_porch_workaround( ++ struct dc_crtc_timing *timing) ++{ ++ if (timing->flags.INTERLACE == 1) { ++ if (timing->v_front_porch < 2) ++ timing->v_front_porch = 2; ++ } else { ++ if (timing->v_front_porch < 1) ++ timing->v_front_porch = 1; ++ } ++} ++ ++int dcn401_get_vupdate_offset_from_vsync(struct pipe_ctx *pipe_ctx) ++{ ++ const struct dc_crtc_timing *dc_crtc_timing = &pipe_ctx->stream->timing; ++ struct dc_crtc_timing patched_crtc_timing; ++ int vesa_sync_start; ++ int asic_blank_end; ++ int interlace_factor; ++ ++ patched_crtc_timing = *dc_crtc_timing; ++ apply_front_porch_workaround(&patched_crtc_timing); ++ ++ interlace_factor = patched_crtc_timing.flags.INTERLACE ? 2 : 1; ++ ++ vesa_sync_start = patched_crtc_timing.v_addressable + ++ patched_crtc_timing.v_border_bottom + ++ patched_crtc_timing.v_front_porch; ++ ++ asic_blank_end = (patched_crtc_timing.v_total - ++ vesa_sync_start - ++ patched_crtc_timing.v_border_top) ++ * interlace_factor; ++ ++ return asic_blank_end - ++ pipe_ctx->global_sync.dcn4x.vstartup_lines + 1; ++} +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.h b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.h +index 781cf0efccc6c..37c915568afcb 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.h ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.h +@@ -109,4 +109,5 @@ void dcn401_detect_pipe_changes( + void dcn401_plane_atomic_power_down(struct dc *dc, + struct dpp *dpp, + struct hubp *hubp); ++int dcn401_get_vupdate_offset_from_vsync(struct pipe_ctx *pipe_ctx); + #endif /* __DC_HWSS_DCN401_H__ */ +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_init.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_init.c +index fe7aceb2f5104..aa9573ce44fce 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_init.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_init.c +@@ -73,7 +73,7 @@ static const struct hw_sequencer_funcs dcn401_funcs = { + .init_sys_ctx = dcn20_init_sys_ctx, + .init_vm_ctx = dcn20_init_vm_ctx, + .set_flip_control_gsl = dcn20_set_flip_control_gsl, +- .get_vupdate_offset_from_vsync = dcn10_get_vupdate_offset_from_vsync, ++ .get_vupdate_offset_from_vsync = dcn401_get_vupdate_offset_from_vsync, + .calc_vupdate_position = dcn10_calc_vupdate_position, + .apply_idle_power_optimizations = dcn401_apply_idle_power_optimizations, + .does_plane_fit_in_mall = NULL, +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-fix-zero-value-for-apu-watermark_c.patch b/queue-6.15/drm-amd-display-fix-zero-value-for-apu-watermark_c.patch new file mode 100644 index 0000000000..b3b674dd02 --- /dev/null +++ b/queue-6.15/drm-amd-display-fix-zero-value-for-apu-watermark_c.patch @@ -0,0 +1,41 @@ +From 50f389705e085c7f7d0162b1b9c5cfe47358439b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 17:30:25 -0400 +Subject: drm/amd/display: fix zero value for APU watermark_c + +From: Charlene Liu + +[ Upstream commit d5a7fdc88a2d64242d959942cbd0e1499ebb9806 ] + +[why] +the guard of is_apu not in sync, caused no watermark_c output. + +Reviewed-by: Ovidiu Bunea +Signed-off-by: Charlene Liu +Signed-off-by: Aurabindo Pillai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c +index e89571874185e..525b7d04bf84c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c +@@ -663,7 +663,10 @@ static bool dml2_validate_and_build_resource(const struct dc *in_dc, struct dc_s + dml2_copy_clocks_to_dc_state(&out_clks, context); + dml2_extract_watermark_set(&context->bw_ctx.bw.dcn.watermarks.a, &dml2->v20.dml_core_ctx); + dml2_extract_watermark_set(&context->bw_ctx.bw.dcn.watermarks.b, &dml2->v20.dml_core_ctx); +- memcpy(&context->bw_ctx.bw.dcn.watermarks.c, &dml2->v20.g6_temp_read_watermark_set, sizeof(context->bw_ctx.bw.dcn.watermarks.c)); ++ if (context->streams[0]->sink->link->dc->caps.is_apu) ++ dml2_extract_watermark_set(&context->bw_ctx.bw.dcn.watermarks.c, &dml2->v20.dml_core_ctx); ++ else ++ memcpy(&context->bw_ctx.bw.dcn.watermarks.c, &dml2->v20.g6_temp_read_watermark_set, sizeof(context->bw_ctx.bw.dcn.watermarks.c)); + dml2_extract_watermark_set(&context->bw_ctx.bw.dcn.watermarks.d, &dml2->v20.dml_core_ctx); + dml2_extract_writeback_wm(context, &dml2->v20.dml_core_ctx); + //copy for deciding zstate use +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-restructure-dmi-quirks.patch b/queue-6.15/drm-amd-display-restructure-dmi-quirks.patch new file mode 100644 index 0000000000..3feab60a9a --- /dev/null +++ b/queue-6.15/drm-amd-display-restructure-dmi-quirks.patch @@ -0,0 +1,432 @@ +From 4d831208c06664125bd1b32b54662b43efd813d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 15:58:41 -0500 +Subject: drm/amd/display: Restructure DMI quirks + +From: Mario Limonciello + +[ Upstream commit de6485e3df24170d71706d6f2c55a496443c3803 ] + +[Why] +DMI quirks are relatively big code that makes amdgpu_dm 200 lines +larger. + +[How] +Move DMI quirks into a dedicated source file and make all quirks +variables for `struct amdgpu_display_manager`. + +Reviewed-by: Alex Hung +Signed-off-by: Mario Limonciello +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/Makefile | 1 + + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 152 +-------------- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 9 + + .../amd/display/amdgpu_dm/amdgpu_dm_quirks.c | 178 ++++++++++++++++++ + 4 files changed, 191 insertions(+), 149 deletions(-) + create mode 100644 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_quirks.c + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/Makefile b/drivers/gpu/drm/amd/display/amdgpu_dm/Makefile +index ab2a97e354da1..7329b8cc2576e 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/Makefile ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/Makefile +@@ -38,6 +38,7 @@ AMDGPUDM = \ + amdgpu_dm_pp_smu.o \ + amdgpu_dm_psr.o \ + amdgpu_dm_replay.o \ ++ amdgpu_dm_quirks.o \ + amdgpu_dm_wb.o + + ifdef CONFIG_DRM_AMD_DC_FP +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index d6214fc3921de..96118a0e1ffeb 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -80,7 +80,6 @@ + #include + #include + #include +-#include + #include + + #include +@@ -1631,153 +1630,6 @@ static bool dm_should_disable_stutter(struct pci_dev *pdev) + return false; + } + +-struct amdgpu_dm_quirks { +- bool aux_hpd_discon; +- bool support_edp0_on_dp1; +-}; +- +-static struct amdgpu_dm_quirks quirk_entries = { +- .aux_hpd_discon = false, +- .support_edp0_on_dp1 = false +-}; +- +-static int edp0_on_dp1_callback(const struct dmi_system_id *id) +-{ +- quirk_entries.support_edp0_on_dp1 = true; +- return 0; +-} +- +-static int aux_hpd_discon_callback(const struct dmi_system_id *id) +-{ +- quirk_entries.aux_hpd_discon = true; +- return 0; +-} +- +-static const struct dmi_system_id dmi_quirk_table[] = { +- { +- .callback = aux_hpd_discon_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3660"), +- }, +- }, +- { +- .callback = aux_hpd_discon_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3260"), +- }, +- }, +- { +- .callback = aux_hpd_discon_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3460"), +- }, +- }, +- { +- .callback = aux_hpd_discon_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Tower Plus 7010"), +- }, +- }, +- { +- .callback = aux_hpd_discon_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Tower 7010"), +- }, +- }, +- { +- .callback = aux_hpd_discon_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex SFF Plus 7010"), +- }, +- }, +- { +- .callback = aux_hpd_discon_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex SFF 7010"), +- }, +- }, +- { +- .callback = aux_hpd_discon_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Micro Plus 7010"), +- }, +- }, +- { +- .callback = aux_hpd_discon_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Micro 7010"), +- }, +- }, +- { +- .callback = edp0_on_dp1_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "HP"), +- DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite mt645 G8 Mobile Thin Client"), +- }, +- }, +- { +- .callback = edp0_on_dp1_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "HP"), +- DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 645 14 inch G11 Notebook PC"), +- }, +- }, +- { +- .callback = edp0_on_dp1_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "HP"), +- DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 665 16 inch G11 Notebook PC"), +- }, +- }, +- { +- .callback = edp0_on_dp1_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "HP"), +- DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook 445 14 inch G11 Notebook PC"), +- }, +- }, +- { +- .callback = edp0_on_dp1_callback, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "HP"), +- DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook 465 16 inch G11 Notebook PC"), +- }, +- }, +- {} +- /* TODO: refactor this from a fixed table to a dynamic option */ +-}; +- +-static void retrieve_dmi_info(struct amdgpu_display_manager *dm, struct dc_init_data *init_data) +-{ +- int dmi_id; +- struct drm_device *dev = dm->ddev; +- +- dm->aux_hpd_discon_quirk = false; +- init_data->flags.support_edp0_on_dp1 = false; +- +- dmi_id = dmi_check_system(dmi_quirk_table); +- +- if (!dmi_id) +- return; +- +- if (quirk_entries.aux_hpd_discon) { +- dm->aux_hpd_discon_quirk = true; +- drm_info(dev, "aux_hpd_discon_quirk attached\n"); +- } +- if (quirk_entries.support_edp0_on_dp1) { +- init_data->flags.support_edp0_on_dp1 = true; +- drm_info(dev, "support_edp0_on_dp1 attached\n"); +- } +-} + + void* + dm_allocate_gpu_mem( +@@ -2064,7 +1916,9 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + if (amdgpu_ip_version(adev, DCE_HWIP, 0) >= IP_VERSION(3, 0, 0)) + init_data.num_virtual_links = 1; + +- retrieve_dmi_info(&adev->dm, &init_data); ++ retrieve_dmi_info(&adev->dm); ++ if (adev->dm.edp0_on_dp1_quirk) ++ init_data.flags.support_edp0_on_dp1 = true; + + if (adev->dm.bb_from_dmub) + init_data.bb_from_dmub = adev->dm.bb_from_dmub; +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index 385faaca6e26a..9e8c659c53c49 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -613,6 +613,13 @@ struct amdgpu_display_manager { + */ + bool aux_hpd_discon_quirk; + ++ /** ++ * @edp0_on_dp1_quirk: ++ * ++ * quirk for platforms that put edp0 on DP1. ++ */ ++ bool edp0_on_dp1_quirk; ++ + /** + * @dpia_aux_lock: + * +@@ -1045,4 +1052,6 @@ void hdmi_cec_set_edid(struct amdgpu_dm_connector *aconnector); + void hdmi_cec_unset_edid(struct amdgpu_dm_connector *aconnector); + int amdgpu_dm_initialize_hdmi_connector(struct amdgpu_dm_connector *aconnector); + ++void retrieve_dmi_info(struct amdgpu_display_manager *dm); ++ + #endif /* __AMDGPU_DM_H__ */ +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_quirks.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_quirks.c +new file mode 100644 +index 0000000000000..1da07ebf9217c +--- /dev/null ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_quirks.c +@@ -0,0 +1,178 @@ ++// SPDX-License-Identifier: MIT ++/* ++ * Copyright 2025 Advanced Micro Devices, Inc. ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a ++ * copy of this software and associated documentation files (the "Software"), ++ * to deal in the Software without restriction, including without limitation ++ * the rights to use, copy, modify, merge, publish, distribute, sublicense, ++ * and/or sell copies of the Software, and to permit persons to whom the ++ * Software is furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL ++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR ++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR ++ * OTHER DEALINGS IN THE SOFTWARE. ++ * ++ * Authors: AMD ++ * ++ */ ++ ++#include ++ ++#include "amdgpu.h" ++#include "amdgpu_dm.h" ++ ++struct amdgpu_dm_quirks { ++ bool aux_hpd_discon; ++ bool support_edp0_on_dp1; ++}; ++ ++static struct amdgpu_dm_quirks quirk_entries = { ++ .aux_hpd_discon = false, ++ .support_edp0_on_dp1 = false ++}; ++ ++static int edp0_on_dp1_callback(const struct dmi_system_id *id) ++{ ++ quirk_entries.support_edp0_on_dp1 = true; ++ return 0; ++} ++ ++static int aux_hpd_discon_callback(const struct dmi_system_id *id) ++{ ++ quirk_entries.aux_hpd_discon = true; ++ return 0; ++} ++ ++static const struct dmi_system_id dmi_quirk_table[] = { ++ { ++ .callback = aux_hpd_discon_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3660"), ++ }, ++ }, ++ { ++ .callback = aux_hpd_discon_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3260"), ++ }, ++ }, ++ { ++ .callback = aux_hpd_discon_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3460"), ++ }, ++ }, ++ { ++ .callback = aux_hpd_discon_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Tower Plus 7010"), ++ }, ++ }, ++ { ++ .callback = aux_hpd_discon_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Tower 7010"), ++ }, ++ }, ++ { ++ .callback = aux_hpd_discon_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex SFF Plus 7010"), ++ }, ++ }, ++ { ++ .callback = aux_hpd_discon_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex SFF 7010"), ++ }, ++ }, ++ { ++ .callback = aux_hpd_discon_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Micro Plus 7010"), ++ }, ++ }, ++ { ++ .callback = aux_hpd_discon_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Micro 7010"), ++ }, ++ }, ++ { ++ .callback = edp0_on_dp1_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite mt645 G8 Mobile Thin Client"), ++ }, ++ }, ++ { ++ .callback = edp0_on_dp1_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 645 14 inch G11 Notebook PC"), ++ }, ++ }, ++ { ++ .callback = edp0_on_dp1_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 665 16 inch G11 Notebook PC"), ++ }, ++ }, ++ { ++ .callback = edp0_on_dp1_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook 445 14 inch G11 Notebook PC"), ++ }, ++ }, ++ { ++ .callback = edp0_on_dp1_callback, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook 465 16 inch G11 Notebook PC"), ++ }, ++ }, ++ {} ++ /* TODO: refactor this from a fixed table to a dynamic option */ ++}; ++ ++void retrieve_dmi_info(struct amdgpu_display_manager *dm) ++{ ++ struct drm_device *dev = dm->ddev; ++ int dmi_id; ++ ++ dm->aux_hpd_discon_quirk = false; ++ dm->edp0_on_dp1_quirk = false; ++ ++ dmi_id = dmi_check_system(dmi_quirk_table); ++ ++ if (!dmi_id) ++ return; ++ ++ if (quirk_entries.aux_hpd_discon) { ++ dm->aux_hpd_discon_quirk = true; ++ drm_info(dev, "aux_hpd_discon_quirk attached\n"); ++ } ++ if (quirk_entries.support_edp0_on_dp1) { ++ dm->edp0_on_dp1_quirk = true; ++ drm_info(dev, "support_edp0_on_dp1 attached\n"); ++ } ++} +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-skip-to-enable-dsc-if-it-has-been-of.patch b/queue-6.15/drm-amd-display-skip-to-enable-dsc-if-it-has-been-of.patch new file mode 100644 index 0000000000..92e3ea6ac8 --- /dev/null +++ b/queue-6.15/drm-amd-display-skip-to-enable-dsc-if-it-has-been-of.patch @@ -0,0 +1,59 @@ +From e2a4826dde29c120c0f3c231c54b248bc5960730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 17:16:57 +0800 +Subject: drm/amd/display: Skip to enable dsc if it has been off + +From: Paul Hsieh + +[ Upstream commit 8b8a602c985e99074fa1d5233cd224b7bcfb9df2 ] + +[Why] +It makes DSC enable when we commit the stream which need +keep power off.And then it will skip to disable DSC if +pipe reset at this situation as power has been off. It may +cause the DSC unexpected enable on the pipe with the +next new stream which doesn't support DSC. + +[HOW] +Check the DSC used on current pipe status when update stream. +Skip to enable if it has been off. The operation enable +DSC should happen when set power on. + +Reviewed-by: Wenjing Liu +Signed-off-by: Paul Hsieh +Signed-off-by: Aurabindo Pillai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c +index be26c925fdfa1..e68f21fd5f0fb 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c +@@ -84,6 +84,20 @@ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable) + struct dsc_config dsc_cfg; + struct dsc_optc_config dsc_optc_cfg = {0}; + enum optc_dsc_mode optc_dsc_mode; ++ struct dcn_dsc_state dsc_state = {0}; ++ ++ if (!dsc) { ++ DC_LOG_DSC("DSC is NULL for tg instance %d:", pipe_ctx->stream_res.tg->inst); ++ return; ++ } ++ ++ if (dsc->funcs->dsc_read_state) { ++ dsc->funcs->dsc_read_state(dsc, &dsc_state); ++ if (!dsc_state.dsc_fw_en) { ++ DC_LOG_DSC("DSC has been disabled for tg instance %d:", pipe_ctx->stream_res.tg->inst); ++ return; ++ } ++ } + + /* Enable DSC hw block */ + dsc_cfg.pic_width = (stream->timing.h_addressable + stream->timing.h_border_left + stream->timing.h_border_right) / opp_cnt; +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-display-update-ips-sequential_ono-requiremen.patch b/queue-6.15/drm-amd-display-update-ips-sequential_ono-requiremen.patch new file mode 100644 index 0000000000..70c1ae032e --- /dev/null +++ b/queue-6.15/drm-amd-display-update-ips-sequential_ono-requiremen.patch @@ -0,0 +1,68 @@ +From bbb8f4b569d4fc2ab87f40c1a4c82a6529a2faf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 11:00:08 -0400 +Subject: drm/amd/display: Update IPS sequential_ono requirement checks + +From: Ovidiu Bunea + +[ Upstream commit b4db797117ceba88ba405a080811369418104304 ] + +[why & how] +ASICs that require special RCG/PG programming are determined based +on hw_internal_rev. Update these checks to properly include all such +ASICs. + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Ovidiu Bunea +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dpp/dcn35/dcn35_dpp.c | 2 +- + drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 2 +- + drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn35/dcn35_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn35/dcn35_dpp.c +index 62b7012cda430..f7a373a3d70a5 100644 +--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn35/dcn35_dpp.c ++++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn35/dcn35_dpp.c +@@ -138,7 +138,7 @@ bool dpp35_construct( + dpp->base.funcs = &dcn35_dpp_funcs; + + // w/a for cursor memory stuck in LS by programming DISPCLK_R_GATE_DISABLE, limit w/a to some ASIC revs +- if (dpp->base.ctx->asic_id.hw_internal_rev <= 0x10) ++ if (dpp->base.ctx->asic_id.hw_internal_rev < 0x40) + dpp->dispclk_r_gate_disable = true; + return ret; + } +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +index ffd2b816cd02c..8948d44a7a80e 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +@@ -1903,7 +1903,7 @@ static bool dcn35_resource_construct( + dc->caps.max_disp_clock_khz_at_vmin = 650000; + + /* Sequential ONO is based on ASIC. */ +- if (dc->ctx->asic_id.hw_internal_rev > 0x10) ++ if (dc->ctx->asic_id.hw_internal_rev >= 0x40) + dc->caps.sequential_ono = true; + + /* Use pipe context based otg sync logic */ +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c +index b6468573dc33d..7f19689e976a1 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c +@@ -1876,7 +1876,7 @@ static bool dcn36_resource_construct( + dc->caps.max_disp_clock_khz_at_vmin = 650000; + + /* Sequential ONO is based on ASIC. */ +- if (dc->ctx->asic_id.hw_internal_rev > 0x10) ++ if (dc->ctx->asic_id.hw_internal_rev >= 0x40) + dc->caps.sequential_ono = true; + + /* Use pipe context based otg sync logic */ +-- +2.39.5 + diff --git a/queue-6.15/drm-amd-pm-reset-smu-v13.0.x-custom-settings.patch b/queue-6.15/drm-amd-pm-reset-smu-v13.0.x-custom-settings.patch new file mode 100644 index 0000000000..c3eb025ca4 --- /dev/null +++ b/queue-6.15/drm-amd-pm-reset-smu-v13.0.x-custom-settings.patch @@ -0,0 +1,118 @@ +From 89b32c872e1faa0336a5ce84d7e60d11be7524bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 10:15:46 +0530 +Subject: drm/amd/pm: Reset SMU v13.0.x custom settings + +From: Lijo Lazar + +[ Upstream commit 923406e74ec66364b829b7f8b6b67d46200567a6 ] + +On SMU v13.0.2 and SMU v13.0.6 variants user may choose custom min/max +clocks in manual perf mode. Those custom min/max values need to be +reset once user switches to auto or restores default settings. +Otherwise, they may get used inadvertently during the next operation. + +Signed-off-by: Lijo Lazar +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 1 + + drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 13 +++++++++++-- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 10 ++++++++++ + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 4 ++-- + 4 files changed, 24 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +index cd03caffe3173..21589c4583e6b 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h ++++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +@@ -310,6 +310,7 @@ int smu_v13_0_get_boot_freq_by_index(struct smu_context *smu, + uint32_t *value); + + void smu_v13_0_interrupt_work(struct smu_context *smu); ++void smu_v13_0_reset_custom_level(struct smu_context *smu); + bool smu_v13_0_12_is_dpm_running(struct smu_context *smu); + int smu_v13_0_12_get_max_metrics_size(void); + int smu_v13_0_12_setup_driver_pptable(struct smu_context *smu); +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +index 83163d7c7f001..5cb3b9bb60898 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +@@ -1270,6 +1270,7 @@ static int aldebaran_set_performance_level(struct smu_context *smu, + struct smu_13_0_dpm_table *gfx_table = + &dpm_context->dpm_tables.gfx_table; + struct smu_umd_pstate_table *pstate_table = &smu->pstate_table; ++ int r; + + /* Disable determinism if switching to another mode */ + if ((smu_dpm->dpm_level == AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM) && +@@ -1282,7 +1283,11 @@ static int aldebaran_set_performance_level(struct smu_context *smu, + + case AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM: + return 0; +- ++ case AMD_DPM_FORCED_LEVEL_AUTO: ++ r = smu_v13_0_set_performance_level(smu, level); ++ if (!r) ++ smu_v13_0_reset_custom_level(smu); ++ return r; + case AMD_DPM_FORCED_LEVEL_HIGH: + case AMD_DPM_FORCED_LEVEL_LOW: + case AMD_DPM_FORCED_LEVEL_PROFILE_STANDARD: +@@ -1423,7 +1428,11 @@ static int aldebaran_usr_edit_dpm_table(struct smu_context *smu, enum PP_OD_DPM_ + min_clk = dpm_context->dpm_tables.gfx_table.min; + max_clk = dpm_context->dpm_tables.gfx_table.max; + +- return aldebaran_set_soft_freq_limited_range(smu, SMU_GFXCLK, min_clk, max_clk, false); ++ ret = aldebaran_set_soft_freq_limited_range( ++ smu, SMU_GFXCLK, min_clk, max_clk, false); ++ if (ret) ++ return ret; ++ smu_v13_0_reset_custom_level(smu); + } + break; + case PP_OD_COMMIT_DPM_TABLE: +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +index ba5a9012dbd5e..075f381ad311b 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +@@ -2595,3 +2595,13 @@ int smu_v13_0_set_wbrf_exclusion_ranges(struct smu_context *smu, + + return ret; + } ++ ++void smu_v13_0_reset_custom_level(struct smu_context *smu) ++{ ++ struct smu_umd_pstate_table *pstate_table = &smu->pstate_table; ++ ++ pstate_table->uclk_pstate.custom.min = 0; ++ pstate_table->uclk_pstate.custom.max = 0; ++ pstate_table->gfxclk_pstate.custom.min = 0; ++ pstate_table->gfxclk_pstate.custom.max = 0; ++} +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +index c478b3be37af1..b8feabb019cf8 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +@@ -1927,7 +1927,7 @@ static int smu_v13_0_6_set_performance_level(struct smu_context *smu, + return ret; + pstate_table->uclk_pstate.curr.max = uclk_table->max; + } +- pstate_table->uclk_pstate.custom.max = 0; ++ smu_v13_0_reset_custom_level(smu); + + return 0; + case AMD_DPM_FORCED_LEVEL_MANUAL: +@@ -2140,7 +2140,7 @@ static int smu_v13_0_6_usr_edit_dpm_table(struct smu_context *smu, + smu, SMU_UCLK, min_clk, max_clk, false); + if (ret) + return ret; +- pstate_table->uclk_pstate.custom.max = 0; ++ smu_v13_0_reset_custom_level(smu); + } + break; + case PP_OD_COMMIT_DPM_TABLE: +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-add-basic-validation-for-ras-header.patch b/queue-6.15/drm-amdgpu-add-basic-validation-for-ras-header.patch new file mode 100644 index 0000000000..e838eb3d9b --- /dev/null +++ b/queue-6.15/drm-amdgpu-add-basic-validation-for-ras-header.patch @@ -0,0 +1,65 @@ +From 2a53eae79a389c327047acd7e14f93f595a8e183 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 13:28:38 +0530 +Subject: drm/amdgpu: Add basic validation for RAS header + +From: Lijo Lazar + +[ Upstream commit 5df0d6addb7e9b6f71f7162d1253762a5be9138e ] + +If RAS header read from EEPROM is corrupted, it could result in trying +to allocate huge memory for reading the records. Add some validation to +header fields. + +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 22 ++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +index 0ea7cfaf3587d..e979a6086178c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +@@ -1392,17 +1392,33 @@ int amdgpu_ras_eeprom_init(struct amdgpu_ras_eeprom_control *control) + + __decode_table_header_from_buf(hdr, buf); + +- if (hdr->version >= RAS_TABLE_VER_V2_1) { ++ switch (hdr->version) { ++ case RAS_TABLE_VER_V2_1: ++ case RAS_TABLE_VER_V3: + control->ras_num_recs = RAS_NUM_RECS_V2_1(hdr); + control->ras_record_offset = RAS_RECORD_START_V2_1; + control->ras_max_record_count = RAS_MAX_RECORD_COUNT_V2_1; +- } else { ++ break; ++ case RAS_TABLE_VER_V1: + control->ras_num_recs = RAS_NUM_RECS(hdr); + control->ras_record_offset = RAS_RECORD_START; + control->ras_max_record_count = RAS_MAX_RECORD_COUNT; ++ break; ++ default: ++ dev_err(adev->dev, ++ "RAS header invalid, unsupported version: %u", ++ hdr->version); ++ return -EINVAL; + } +- control->ras_fri = RAS_OFFSET_TO_INDEX(control, hdr->first_rec_offset); + ++ if (control->ras_num_recs > control->ras_max_record_count) { ++ dev_err(adev->dev, ++ "RAS header invalid, records in header: %u max allowed :%u", ++ control->ras_num_recs, control->ras_max_record_count); ++ return -EINVAL; ++ } ++ ++ control->ras_fri = RAS_OFFSET_TO_INDEX(control, hdr->first_rec_offset); + control->ras_num_mca_recs = 0; + control->ras_num_pa_recs = 0; + return 0; +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-add-indirect-l1_tlb_cntl-reg-programming-.patch b/queue-6.15/drm-amdgpu-add-indirect-l1_tlb_cntl-reg-programming-.patch new file mode 100644 index 0000000000..c6f9e0ecce --- /dev/null +++ b/queue-6.15/drm-amdgpu-add-indirect-l1_tlb_cntl-reg-programming-.patch @@ -0,0 +1,270 @@ +From 5a50c71a7f0ff7cc7b4fc52163db3a30a3ffe375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Mar 2025 11:38:42 -0400 +Subject: drm/amdgpu: Add indirect L1_TLB_CNTL reg programming for VFs + +From: Victor Skvortsov + +[ Upstream commit 0c6e39ce6da20104900b11bad64464a12fb47320 ] + +VFs on some IP versions are unable to access this register directly. + +This register must be programmed before PSP ring is setup, +so use PSP VF mailbox directly. PSP will broadcast the register +value to all VF assigned instances. + +Signed-off-by: Victor Skvortsov +Reviewed-by: Zhigang Luo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 10 ++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 12 +++- + drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h | 9 +-- + drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c | 63 ++++++++++++++++----- + drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 20 +++++++ + 5 files changed, 93 insertions(+), 21 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h +index 8d5acc415d386..dcf5e8e0b9e3e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h +@@ -107,6 +107,7 @@ enum psp_reg_prog_id { + PSP_REG_IH_RB_CNTL = 0, /* register IH_RB_CNTL */ + PSP_REG_IH_RB_CNTL_RING1 = 1, /* register IH_RB_CNTL_RING1 */ + PSP_REG_IH_RB_CNTL_RING2 = 2, /* register IH_RB_CNTL_RING2 */ ++ PSP_REG_MMHUB_L1_TLB_CNTL = 25, + PSP_REG_LAST + }; + +@@ -142,6 +143,8 @@ struct psp_funcs { + bool (*get_ras_capability)(struct psp_context *psp); + bool (*is_aux_sos_load_required)(struct psp_context *psp); + bool (*is_reload_needed)(struct psp_context *psp); ++ int (*reg_program_no_ring)(struct psp_context *psp, uint32_t val, ++ enum psp_reg_prog_id id); + }; + + struct ta_funcs { +@@ -475,6 +478,10 @@ struct amdgpu_psp_funcs { + #define psp_is_aux_sos_load_required(psp) \ + ((psp)->funcs->is_aux_sos_load_required ? (psp)->funcs->is_aux_sos_load_required((psp)) : 0) + ++#define psp_reg_program_no_ring(psp, val, id) \ ++ ((psp)->funcs->reg_program_no_ring ? \ ++ (psp)->funcs->reg_program_no_ring((psp), val, id) : -EINVAL) ++ + extern const struct amd_ip_funcs psp_ip_funcs; + + extern const struct amdgpu_ip_block_version psp_v3_1_ip_block; +@@ -569,5 +576,8 @@ bool amdgpu_psp_get_ras_capability(struct psp_context *psp); + int psp_config_sq_perfmon(struct psp_context *psp, uint32_t xcp_id, + bool core_override_enable, bool reg_override_enable, bool perfmon_override_enable); + bool amdgpu_psp_tos_reload_needed(struct amdgpu_device *adev); ++int amdgpu_psp_reg_program_no_ring(struct psp_context *psp, uint32_t val, ++ enum psp_reg_prog_id id); ++ + + #endif +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +index df03dba67ab89..b6ec6b7969f0c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +@@ -146,11 +146,13 @@ enum AMDGIM_FEATURE_FLAG { + + enum AMDGIM_REG_ACCESS_FLAG { + /* Use PSP to program IH_RB_CNTL */ +- AMDGIM_FEATURE_IH_REG_PSP_EN = (1 << 0), ++ AMDGIM_FEATURE_IH_REG_PSP_EN = (1 << 0), + /* Use RLC to program MMHUB regs */ +- AMDGIM_FEATURE_MMHUB_REG_RLC_EN = (1 << 1), ++ AMDGIM_FEATURE_MMHUB_REG_RLC_EN = (1 << 1), + /* Use RLC to program GC regs */ +- AMDGIM_FEATURE_GC_REG_RLC_EN = (1 << 2), ++ AMDGIM_FEATURE_GC_REG_RLC_EN = (1 << 2), ++ /* Use PSP to program L1_TLB_CNTL*/ ++ AMDGIM_FEATURE_L1_TLB_CNTL_PSP_EN = (1 << 3), + }; + + struct amdgim_pf2vf_info_v1 { +@@ -330,6 +332,10 @@ struct amdgpu_video_codec_info; + (amdgpu_sriov_vf((adev)) && \ + ((adev)->virt.reg_access & (AMDGIM_FEATURE_GC_REG_RLC_EN))) + ++#define amdgpu_sriov_reg_indirect_l1_tlb_cntl(adev) \ ++(amdgpu_sriov_vf((adev)) && \ ++ ((adev)->virt.reg_access & (AMDGIM_FEATURE_L1_TLB_CNTL_PSP_EN))) ++ + #define amdgpu_sriov_rlcg_error_report_enabled(adev) \ + (amdgpu_sriov_reg_indirect_mmhub(adev) || amdgpu_sriov_reg_indirect_gc(adev)) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h +index d6ac2652f0ac2..bea724981309c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h +@@ -109,10 +109,11 @@ union amd_sriov_msg_feature_flags { + + union amd_sriov_reg_access_flags { + struct { +- uint32_t vf_reg_access_ih : 1; +- uint32_t vf_reg_access_mmhub : 1; +- uint32_t vf_reg_access_gc : 1; +- uint32_t reserved : 29; ++ uint32_t vf_reg_access_ih : 1; ++ uint32_t vf_reg_access_mmhub : 1; ++ uint32_t vf_reg_access_gc : 1; ++ uint32_t vf_reg_access_l1_tlb_cntl : 1; ++ uint32_t reserved : 28; + } flags; + uint32_t all; + }; +diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c +index 84cde1239ee45..4a43c9ab95a2b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c ++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c +@@ -30,6 +30,7 @@ + #include "soc15_common.h" + #include "soc15.h" + #include "amdgpu_ras.h" ++#include "amdgpu_psp.h" + + #define regVM_L2_CNTL3_DEFAULT 0x80100007 + #define regVM_L2_CNTL4_DEFAULT 0x000000c1 +@@ -192,10 +193,8 @@ static void mmhub_v1_8_init_tlb_regs(struct amdgpu_device *adev) + uint32_t tmp, inst_mask; + int i; + +- /* Setup TLB control */ +- inst_mask = adev->aid_mask; +- for_each_inst(i, inst_mask) { +- tmp = RREG32_SOC15(MMHUB, i, regMC_VM_MX_L1_TLB_CNTL); ++ if (amdgpu_sriov_reg_indirect_l1_tlb_cntl(adev)) { ++ tmp = RREG32_SOC15(MMHUB, 0, regMC_VM_MX_L1_TLB_CNTL); + + tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ENABLE_L1_TLB, + 1); +@@ -209,7 +208,26 @@ static void mmhub_v1_8_init_tlb_regs(struct amdgpu_device *adev) + MTYPE, MTYPE_UC);/* XXX for emulation. */ + tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ATC_EN, 1); + +- WREG32_SOC15(MMHUB, i, regMC_VM_MX_L1_TLB_CNTL, tmp); ++ psp_reg_program_no_ring(&adev->psp, tmp, PSP_REG_MMHUB_L1_TLB_CNTL); ++ } else { ++ inst_mask = adev->aid_mask; ++ for_each_inst(i, inst_mask) { ++ tmp = RREG32_SOC15(MMHUB, i, regMC_VM_MX_L1_TLB_CNTL); ++ ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ENABLE_L1_TLB, ++ 1); ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ++ SYSTEM_ACCESS_MODE, 3); ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ++ ENABLE_ADVANCED_DRIVER_MODEL, 1); ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ++ SYSTEM_APERTURE_UNMAPPED_ACCESS, 0); ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ++ MTYPE, MTYPE_UC);/* XXX for emulation. */ ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ATC_EN, 1); ++ ++ WREG32_SOC15(MMHUB, i, regMC_VM_MX_L1_TLB_CNTL, tmp); ++ } + } + } + +@@ -454,6 +472,30 @@ static int mmhub_v1_8_gart_enable(struct amdgpu_device *adev) + return 0; + } + ++static void mmhub_v1_8_disable_l1_tlb(struct amdgpu_device *adev) ++{ ++ u32 tmp; ++ u32 i, inst_mask; ++ ++ if (amdgpu_sriov_reg_indirect_l1_tlb_cntl(adev)) { ++ tmp = RREG32_SOC15(MMHUB, 0, regMC_VM_MX_L1_TLB_CNTL); ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ENABLE_L1_TLB, 0); ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ++ ENABLE_ADVANCED_DRIVER_MODEL, 0); ++ psp_reg_program_no_ring(&adev->psp, tmp, PSP_REG_MMHUB_L1_TLB_CNTL); ++ } else { ++ inst_mask = adev->aid_mask; ++ for_each_inst(i, inst_mask) { ++ tmp = RREG32_SOC15(MMHUB, i, regMC_VM_MX_L1_TLB_CNTL); ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ENABLE_L1_TLB, ++ 0); ++ tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ++ ENABLE_ADVANCED_DRIVER_MODEL, 0); ++ WREG32_SOC15(MMHUB, i, regMC_VM_MX_L1_TLB_CNTL, tmp); ++ } ++ } ++} ++ + static void mmhub_v1_8_gart_disable(struct amdgpu_device *adev) + { + struct amdgpu_vmhub *hub; +@@ -467,15 +509,6 @@ static void mmhub_v1_8_gart_disable(struct amdgpu_device *adev) + for (i = 0; i < 16; i++) + WREG32_SOC15_OFFSET(MMHUB, j, regVM_CONTEXT0_CNTL, + i * hub->ctx_distance, 0); +- +- /* Setup TLB control */ +- tmp = RREG32_SOC15(MMHUB, j, regMC_VM_MX_L1_TLB_CNTL); +- tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ENABLE_L1_TLB, +- 0); +- tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, +- ENABLE_ADVANCED_DRIVER_MODEL, 0); +- WREG32_SOC15(MMHUB, j, regMC_VM_MX_L1_TLB_CNTL, tmp); +- + if (!amdgpu_sriov_vf(adev)) { + /* Setup L2 cache */ + tmp = RREG32_SOC15(MMHUB, j, regVM_L2_CNTL); +@@ -485,6 +518,8 @@ static void mmhub_v1_8_gart_disable(struct amdgpu_device *adev) + WREG32_SOC15(MMHUB, j, regVM_L2_CNTL3, 0); + } + } ++ ++ mmhub_v1_8_disable_l1_tlb(adev); + } + + /** +diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c +index afdf8ce3b4c59..f5f616ab20e70 100644 +--- a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c +@@ -858,6 +858,25 @@ static bool psp_v13_0_is_reload_needed(struct psp_context *psp) + return false; + } + ++static int psp_v13_0_reg_program_no_ring(struct psp_context *psp, uint32_t val, ++ enum psp_reg_prog_id id) ++{ ++ struct amdgpu_device *adev = psp->adev; ++ int ret = -EOPNOTSUPP; ++ ++ /* PSP will broadcast the value to all instances */ ++ if (amdgpu_sriov_vf(adev)) { ++ WREG32_SOC15(MP0, 0, regMP0_SMN_C2PMSG_101, GFX_CTRL_CMD_ID_GBR_IH_SET); ++ WREG32_SOC15(MP0, 0, regMP0_SMN_C2PMSG_102, id); ++ WREG32_SOC15(MP0, 0, regMP0_SMN_C2PMSG_103, val); ++ ++ ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, regMP0_SMN_C2PMSG_101), ++ 0x80000000, 0x80000000, false); ++ } ++ ++ return ret; ++} ++ + static const struct psp_funcs psp_v13_0_funcs = { + .init_microcode = psp_v13_0_init_microcode, + .wait_for_bootloader = psp_v13_0_wait_for_bootloader_steady_state, +@@ -884,6 +903,7 @@ static const struct psp_funcs psp_v13_0_funcs = { + .get_ras_capability = psp_v13_0_get_ras_capability, + .is_aux_sos_load_required = psp_v13_0_is_aux_sos_load_required, + .is_reload_needed = psp_v13_0_is_reload_needed, ++ .reg_program_no_ring = psp_v13_0_reg_program_no_ring, + }; + + void psp_v13_0_set_psp_funcs(struct psp_context *psp) +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-disallow-partition-query-during-reset.patch b/queue-6.15/drm-amdgpu-disallow-partition-query-during-reset.patch new file mode 100644 index 0000000000..74b6bd12e2 --- /dev/null +++ b/queue-6.15/drm-amdgpu-disallow-partition-query-during-reset.patch @@ -0,0 +1,71 @@ +From e468916bb873d165b70ac2be3764cbc9fe6cd67f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Apr 2025 12:23:44 +0530 +Subject: drm/amdgpu: Disallow partition query during reset + +From: Lijo Lazar + +[ Upstream commit 75f138db48c5c493f0ac198c2579d52fc6a4c4a0 ] + +Reject queries to get current partition modes during reset. Also, don't +accept sysfs interface requests to switch compute partition mode while +in reset. + +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Reviewed-by: Asad Kamal +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 10 ++++++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 4 ++++ + 2 files changed, 14 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index cf2df7790077d..1dc06e4ab4970 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -1351,6 +1351,10 @@ static ssize_t amdgpu_gfx_get_current_compute_partition(struct device *dev, + struct amdgpu_device *adev = drm_to_adev(ddev); + int mode; + ++ /* Only minimal precaution taken to reject requests while in reset.*/ ++ if (amdgpu_in_reset(adev)) ++ return -EPERM; ++ + mode = amdgpu_xcp_query_partition_mode(adev->xcp_mgr, + AMDGPU_XCP_FL_NONE); + +@@ -1394,8 +1398,14 @@ static ssize_t amdgpu_gfx_set_compute_partition(struct device *dev, + return -EINVAL; + } + ++ /* Don't allow a switch while under reset */ ++ if (!down_read_trylock(&adev->reset_domain->sem)) ++ return -EPERM; ++ + ret = amdgpu_xcp_switch_partition_mode(adev->xcp_mgr, mode); + ++ up_read(&adev->reset_domain->sem); ++ + if (ret) + return ret; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +index ecb74ccf1d908..6b0fbbb91e579 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +@@ -1230,6 +1230,10 @@ static ssize_t current_memory_partition_show( + struct amdgpu_device *adev = drm_to_adev(ddev); + enum amdgpu_memory_partition mode; + ++ /* Only minimal precaution taken to reject requests while in reset */ ++ if (amdgpu_in_reset(adev)) ++ return -EPERM; ++ + mode = adev->gmc.gmc_funcs->query_mem_partition_mode(adev); + if ((mode >= ARRAY_SIZE(nps_desc)) || + (BIT(mode) & AMDGPU_ALL_NPS_MASK) != BIT(mode)) +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-fix-api-status-offset-for-mes-queue-reset.patch b/queue-6.15/drm-amdgpu-fix-api-status-offset-for-mes-queue-reset.patch new file mode 100644 index 0000000000..bf446cb821 --- /dev/null +++ b/queue-6.15/drm-amdgpu-fix-api-status-offset-for-mes-queue-reset.patch @@ -0,0 +1,56 @@ +From ebac13dc8269c0bb64e6b088769a01b961df7646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Apr 2025 10:35:19 +0800 +Subject: drm/amdgpu: Fix API status offset for MES queue reset + +From: Jesse.Zhang + +[ Upstream commit ad7c088e31f026d71fe87fd09473fafb7d6ed006 ] + +The mes_v11_0_reset_hw_queue and mes_v12_0_reset_hw_queue functions were +using the wrong union type (MESAPI__REMOVE_QUEUE) when getting the offset +for api_status. Since these functions handle queue reset operations, they +should use MESAPI__RESET union instead. + +This fixes the polling of API status during hardware queue reset operations +in the MES for both v11 and v12 versions. + +Signed-off-by: Jesse Zhang +Reviewed-By: Shaoyun.liu +Reviewed-by: Prike Liang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 +- + drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +index ef9538fbbf537..480283da18454 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +@@ -480,7 +480,7 @@ static int mes_v11_0_reset_hw_queue(struct amdgpu_mes *mes, + + return mes_v11_0_submit_pkt_and_poll_completion(mes, + &mes_reset_queue_pkt, sizeof(mes_reset_queue_pkt), +- offsetof(union MESAPI__REMOVE_QUEUE, api_status)); ++ offsetof(union MESAPI__RESET, api_status)); + } + + static int mes_v11_0_map_legacy_queue(struct amdgpu_mes *mes, +diff --git a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +index e6ab617b9a404..624c6b4e452c8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +@@ -500,7 +500,7 @@ static int mes_v12_0_reset_hw_queue(struct amdgpu_mes *mes, + + return mes_v12_0_submit_pkt_and_poll_completion(mes, pipe, + &mes_reset_queue_pkt, sizeof(mes_reset_queue_pkt), +- offsetof(union MESAPI__REMOVE_QUEUE, api_status)); ++ offsetof(union MESAPI__RESET, api_status)); + } + + static int mes_v12_0_map_legacy_queue(struct amdgpu_mes *mes, +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-fix-mes-gfx-mask.patch b/queue-6.15/drm-amdgpu-fix-mes-gfx-mask.patch new file mode 100644 index 0000000000..16343ba7de --- /dev/null +++ b/queue-6.15/drm-amdgpu-fix-mes-gfx-mask.patch @@ -0,0 +1,131 @@ +From 90a7f2a4ff8524fbfec82f7e3c125142ece80f8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2024 15:29:49 +0530 +Subject: drm/amdgpu: fix MES GFX mask +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arvind Yadav + +[ Upstream commit 9d3afcb7b9f950b9b7c58ceeeb9e71f3476e69ed ] + +Current MES GFX mask prevents FW to enable oversubscription. This patch +does the following: +- Fixes the mask values and adds a description for the same +- Removes the central mask setup and makes it IP specific, as it would + be different when the number of pipes and queues are different. + +v2: squash in fix from Shashank + +Cc: Christian König +Cc: Alex Deucher +Acked-by: Christian König +Signed-off-by: Shashank Sharma +Signed-off-by: Arvind Yadav +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 3 --- + drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 2 +- + drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 15 +++++++++++++-- + drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 15 ++++++++++++--- + 4 files changed, 26 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c +index fb212f0a1136a..5590ad5e8cd76 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c +@@ -150,9 +150,6 @@ int amdgpu_mes_init(struct amdgpu_device *adev) + adev->mes.compute_hqd_mask[i] = 0xc; + } + +- for (i = 0; i < AMDGPU_MES_MAX_GFX_PIPES; i++) +- adev->mes.gfx_hqd_mask[i] = i ? 0 : 0xfffffffe; +- + for (i = 0; i < AMDGPU_MES_MAX_SDMA_PIPES; i++) { + if (i >= adev->sdma.num_instances) + break; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h +index da2c9a8cb3e01..52dd54a32fb47 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h +@@ -111,8 +111,8 @@ struct amdgpu_mes { + + uint32_t vmid_mask_gfxhub; + uint32_t vmid_mask_mmhub; +- uint32_t compute_hqd_mask[AMDGPU_MES_MAX_COMPUTE_PIPES]; + uint32_t gfx_hqd_mask[AMDGPU_MES_MAX_GFX_PIPES]; ++ uint32_t compute_hqd_mask[AMDGPU_MES_MAX_COMPUTE_PIPES]; + uint32_t sdma_hqd_mask[AMDGPU_MES_MAX_SDMA_PIPES]; + uint32_t aggregated_doorbells[AMDGPU_MES_PRIORITY_NUM_LEVELS]; + uint32_t sch_ctx_offs[AMDGPU_MAX_MES_PIPES]; +diff --git a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +index 480283da18454..821c9baf5baa6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +@@ -669,6 +669,18 @@ static int mes_v11_0_misc_op(struct amdgpu_mes *mes, + offsetof(union MESAPI__MISC, api_status)); + } + ++static void mes_v11_0_set_gfx_hqd_mask(union MESAPI_SET_HW_RESOURCES *pkt) ++{ ++ /* ++ * GFX pipe 0 queue 0 is being used by Kernel queue. ++ * Set GFX pipe 0 queue 1 for MES scheduling ++ * mask = 10b ++ * GFX pipe 1 can't be used for MES due to HW limitation. ++ */ ++ pkt->gfx_hqd_mask[0] = 0x2; ++ pkt->gfx_hqd_mask[1] = 0; ++} ++ + static int mes_v11_0_set_hw_resources(struct amdgpu_mes *mes) + { + int i; +@@ -693,8 +705,7 @@ static int mes_v11_0_set_hw_resources(struct amdgpu_mes *mes) + mes_set_hw_res_pkt.compute_hqd_mask[i] = + mes->compute_hqd_mask[i]; + +- for (i = 0; i < MAX_GFX_PIPES; i++) +- mes_set_hw_res_pkt.gfx_hqd_mask[i] = mes->gfx_hqd_mask[i]; ++ mes_v11_0_set_gfx_hqd_mask(&mes_set_hw_res_pkt); + + for (i = 0; i < MAX_SDMA_PIPES; i++) + mes_set_hw_res_pkt.sdma_hqd_mask[i] = mes->sdma_hqd_mask[i]; +diff --git a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +index 624c6b4e452c8..7984ebda5b8bf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +@@ -694,6 +694,17 @@ static int mes_v12_0_set_hw_resources_1(struct amdgpu_mes *mes, int pipe) + offsetof(union MESAPI_SET_HW_RESOURCES_1, api_status)); + } + ++static void mes_v12_0_set_gfx_hqd_mask(union MESAPI_SET_HW_RESOURCES *pkt) ++{ ++ /* ++ * GFX V12 has only one GFX pipe, but 8 queues in it. ++ * GFX pipe 0 queue 0 is being used by Kernel queue. ++ * Set GFX pipe 0 queue 1-7 for MES scheduling ++ * mask = 1111 1110b ++ */ ++ pkt->gfx_hqd_mask[0] = 0xFE; ++} ++ + static int mes_v12_0_set_hw_resources(struct amdgpu_mes *mes, int pipe) + { + int i; +@@ -716,9 +727,7 @@ static int mes_v12_0_set_hw_resources(struct amdgpu_mes *mes, int pipe) + mes_set_hw_res_pkt.compute_hqd_mask[i] = + mes->compute_hqd_mask[i]; + +- for (i = 0; i < MAX_GFX_PIPES; i++) +- mes_set_hw_res_pkt.gfx_hqd_mask[i] = +- mes->gfx_hqd_mask[i]; ++ mes_v12_0_set_gfx_hqd_mask(&mes_set_hw_res_pkt); + + for (i = 0; i < MAX_SDMA_PIPES; i++) + mes_set_hw_res_pkt.sdma_hqd_mask[i] = +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-gfx10-fix-csib-handling.patch b/queue-6.15/drm-amdgpu-gfx10-fix-csib-handling.patch new file mode 100644 index 0000000000..972dd76073 --- /dev/null +++ b/queue-6.15/drm-amdgpu-gfx10-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From 3c2fdaaec339b013494a55f2eb145c3da5e6d470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:58:03 -0400 +Subject: drm/amdgpu/gfx10: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit 683308af030cd9b8d3f1de5cbc1ee51788878feb ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index c68c2e2f4d61a..2144d124c9108 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -4322,8 +4322,6 @@ static void gfx_v10_0_get_csb_buffer(struct amdgpu_device *adev, + PACKET3_SET_CONTEXT_REG_START); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-gfx11-fix-csib-handling.patch b/queue-6.15/drm-amdgpu-gfx11-fix-csib-handling.patch new file mode 100644 index 0000000000..8732e9d97b --- /dev/null +++ b/queue-6.15/drm-amdgpu-gfx11-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From 71344c166102306714e3d0ad2b10ece7401ccbdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:58:19 -0400 +Subject: drm/amdgpu/gfx11: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit a9a8bccaa3ba64d509cf7df387cf0b5e1cd06499 ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index 2a5c2a1ae3c74..914c18f48e8e1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -859,8 +859,6 @@ static void gfx_v11_0_get_csb_buffer(struct amdgpu_device *adev, + PACKET3_SET_CONTEXT_REG_START); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-gfx6-fix-csib-handling.patch b/queue-6.15/drm-amdgpu-gfx6-fix-csib-handling.patch new file mode 100644 index 0000000000..ea4b2169c2 --- /dev/null +++ b/queue-6.15/drm-amdgpu-gfx6-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From b968d73f0e423423bcf959e292c8860a68ec5191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:56:02 -0400 +Subject: drm/amdgpu/gfx6: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit 8307ebc15c1ea98a8a0b7837af1faa6c01514577 ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +index 13fbee46417af..cee2cf47112c9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +@@ -2874,8 +2874,6 @@ static void gfx_v6_0_get_csb_buffer(struct amdgpu_device *adev, + buffer[count++] = cpu_to_le32(ext->reg_index - 0xa000); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-gfx7-fix-csib-handling.patch b/queue-6.15/drm-amdgpu-gfx7-fix-csib-handling.patch new file mode 100644 index 0000000000..9316fce5fb --- /dev/null +++ b/queue-6.15/drm-amdgpu-gfx7-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From 287100ae0ae890f6204432457672881cf1a8932c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:57:19 -0400 +Subject: drm/amdgpu/gfx7: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit be7652c23d833d1ab2c67b16e173b1a4e69d1ae6 ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +index 8181bd0e4f189..0deeee542623a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -3906,8 +3906,6 @@ static void gfx_v7_0_get_csb_buffer(struct amdgpu_device *adev, + buffer[count++] = cpu_to_le32(ext->reg_index - PACKET3_SET_CONTEXT_REG_START); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-gfx8-fix-csib-handling.patch b/queue-6.15/drm-amdgpu-gfx8-fix-csib-handling.patch new file mode 100644 index 0000000000..b3bdfcb6ac --- /dev/null +++ b/queue-6.15/drm-amdgpu-gfx8-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From eab94054e5f91e61a6b99087ad53974c6dc01f30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:57:34 -0400 +Subject: drm/amdgpu/gfx8: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit c8b8d7a4f1c5cdfbd61d75302fb3e3cdefb1a7ab ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index bfedd487efc53..fc73be4ab0685 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -1248,8 +1248,6 @@ static void gfx_v8_0_get_csb_buffer(struct amdgpu_device *adev, + PACKET3_SET_CONTEXT_REG_START); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-6.15/drm-amdgpu-gfx9-fix-csib-handling.patch b/queue-6.15/drm-amdgpu-gfx9-fix-csib-handling.patch new file mode 100644 index 0000000000..1c864d7e0a --- /dev/null +++ b/queue-6.15/drm-amdgpu-gfx9-fix-csib-handling.patch @@ -0,0 +1,35 @@ +From f476c4a05bc47f73bbd3c9742ebd1b374af5e4b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 11:57:49 -0400 +Subject: drm/amdgpu/gfx9: fix CSIB handling + +From: Alex Deucher + +[ Upstream commit a4a4c0ae6742ec7d6bf1548d2c6828de440814a0 ] + +We shouldn't return after the last section. +We need to update the rest of the CSIB. + +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index d7db4cb907ae5..d725e2e230a3d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -1649,8 +1649,6 @@ static void gfx_v9_0_get_csb_buffer(struct amdgpu_device *adev, + PACKET3_SET_CONTEXT_REG_START); + for (i = 0; i < ext->reg_count; i++) + buffer[count++] = cpu_to_le32(ext->extent[i]); +- } else { +- return; + } + } + } +-- +2.39.5 + diff --git a/queue-6.15/drm-amdkfd-drop-workaround-for-gc-v9.4.3-revid-0.patch b/queue-6.15/drm-amdkfd-drop-workaround-for-gc-v9.4.3-revid-0.patch new file mode 100644 index 0000000000..1ee3144fba --- /dev/null +++ b/queue-6.15/drm-amdkfd-drop-workaround-for-gc-v9.4.3-revid-0.patch @@ -0,0 +1,144 @@ +From 2768b1a11615d8300cc72e763284345379ee74d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Mar 2025 14:00:38 -0400 +Subject: drm/amdkfd: Drop workaround for GC v9.4.3 revID 0 + +From: Apurv Mishra + +[ Upstream commit daafa303d19f5522e4c24fbf5c1c981a16df2c2f ] + +Remove workaround code for the early engineering +samples GC v9.4.3 SOCs with revID 0 + +Reviewed-by: Amber Lin +Signed-off-by: Apurv Mishra +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +++++++- + drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 14 ++------------ + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 5 ----- + drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 4 ++-- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 +-- + 5 files changed, 12 insertions(+), 22 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index f8b3e04d71eda..95124a4a0a67c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2689,6 +2689,13 @@ static int amdgpu_device_ip_early_init(struct amdgpu_device *adev) + break; + } + ++ /* Check for IP version 9.4.3 with A0 hardware */ ++ if (amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 3) && ++ !amdgpu_device_get_rev_id(adev)) { ++ dev_err(adev->dev, "Unsupported A0 hardware\n"); ++ return -ENODEV; /* device unsupported - no device error */ ++ } ++ + if (amdgpu_has_atpx() && + (amdgpu_is_atpx_hybrid() || + amdgpu_has_atpx_dgpu_power_cntl()) && +@@ -2701,7 +2708,6 @@ static int amdgpu_device_ip_early_init(struct amdgpu_device *adev) + adev->has_pr3 = parent ? pci_pr3_present(parent) : false; + } + +- + adev->pm.pp_feature = amdgpu_pp_feature_mask; + if (amdgpu_sriov_vf(adev) || sched_policy == KFD_SCHED_POLICY_NO_HWS) + adev->pm.pp_feature &= ~PP_GFXOFF_MASK; +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +index 5effe8327d29f..53050176c244d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +@@ -1213,10 +1213,7 @@ static void gmc_v9_0_get_coherence_flags(struct amdgpu_device *adev, + if (uncached) { + mtype = MTYPE_UC; + } else if (ext_coherent) { +- if (gc_ip_version == IP_VERSION(9, 5, 0) || adev->rev_id) +- mtype = is_local ? MTYPE_CC : MTYPE_UC; +- else +- mtype = MTYPE_UC; ++ mtype = is_local ? MTYPE_CC : MTYPE_UC; + } else if (adev->flags & AMD_IS_APU) { + mtype = is_local ? mtype_local : MTYPE_NC; + } else { +@@ -1336,7 +1333,7 @@ static void gmc_v9_0_override_vm_pte_flags(struct amdgpu_device *adev, + mtype_local = MTYPE_CC; + + *flags = AMDGPU_PTE_MTYPE_VG10(*flags, mtype_local); +- } else if (adev->rev_id) { ++ } else { + /* MTYPE_UC case */ + *flags = AMDGPU_PTE_MTYPE_VG10(*flags, MTYPE_CC); + } +@@ -2411,13 +2408,6 @@ static int gmc_v9_0_hw_init(struct amdgpu_ip_block *ip_block) + adev->gmc.flush_tlb_needs_extra_type_2 = + amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 0) && + adev->gmc.xgmi.num_physical_nodes; +- /* +- * TODO: This workaround is badly documented and had a buggy +- * implementation. We should probably verify what we do here. +- */ +- adev->gmc.flush_tlb_needs_extra_type_0 = +- amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 3) && +- adev->rev_id == 0; + + /* The sequence of these two function calls matters.*/ + gmc_v9_0_init_golden_registers(adev); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +index b9c82be6ce134..bf0854bd55551 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +@@ -352,11 +352,6 @@ struct kfd_dev *kgd2kfd_probe(struct amdgpu_device *adev, bool vf) + f2g = &aldebaran_kfd2kgd; + break; + case IP_VERSION(9, 4, 3): +- gfx_target_version = adev->rev_id >= 1 ? 90402 +- : adev->flags & AMD_IS_APU ? 90400 +- : 90401; +- f2g = &gc_9_4_3_kfd2kgd; +- break; + case IP_VERSION(9, 4, 4): + gfx_target_version = 90402; + f2g = &gc_9_4_3_kfd2kgd; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +index 4afff7094cafc..a65c67cf56ff3 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c +@@ -402,7 +402,7 @@ static u32 kfd_get_vgpr_size_per_cu(u32 gfxv) + { + u32 vgpr_size = 0x40000; + +- if ((gfxv / 100 * 100) == 90400 || /* GFX_VERSION_AQUA_VANJARAM */ ++ if (gfxv == 90402 || /* GFX_VERSION_AQUA_VANJARAM */ + gfxv == 90010 || /* GFX_VERSION_ALDEBARAN */ + gfxv == 90008 || /* GFX_VERSION_ARCTURUS */ + gfxv == 90500) +@@ -462,7 +462,7 @@ void kfd_queue_ctx_save_restore_size(struct kfd_topology_device *dev) + + if (gfxv == 80002) /* GFX_VERSION_TONGA */ + props->eop_buffer_size = 0x8000; +- else if ((gfxv / 100 * 100) == 90400) /* GFX_VERSION_AQUA_VANJARAM */ ++ else if (gfxv == 90402) /* GFX_VERSION_AQUA_VANJARAM */ + props->eop_buffer_size = 4096; + else if (gfxv >= 80000) + props->eop_buffer_size = 4096; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 100717a98ec11..72be6e152e881 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -1245,8 +1245,7 @@ svm_range_get_pte_flags(struct kfd_node *node, + case IP_VERSION(9, 4, 4): + case IP_VERSION(9, 5, 0): + if (ext_coherent) +- mtype_local = (gc_ip_version < IP_VERSION(9, 5, 0) && !node->adev->rev_id) ? +- AMDGPU_VM_MTYPE_UC : AMDGPU_VM_MTYPE_CC; ++ mtype_local = AMDGPU_VM_MTYPE_CC; + else + mtype_local = amdgpu_mtype_local == 1 ? AMDGPU_VM_MTYPE_NC : + amdgpu_mtype_local == 2 ? AMDGPU_VM_MTYPE_CC : AMDGPU_VM_MTYPE_RW; +-- +2.39.5 + diff --git a/queue-6.15/drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch b/queue-6.15/drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch new file mode 100644 index 0000000000..0e444ae99f --- /dev/null +++ b/queue-6.15/drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch @@ -0,0 +1,39 @@ +From a7ba84d3e33ff0334eef58a49e219761ff84c46d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 15:54:19 -0400 +Subject: drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB + +From: Amber Lin + +[ Upstream commit ab9fcc6362e0699fc1150aa1d8503c40fce2c1e1 ] + +When submitting MQD to CP, set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB bit so +it'll allow SDMA preemption if there is a massive command buffer of +long-running SDMA commands. + +Signed-off-by: Amber Lin +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +index 80320a6c8854a..97933d2a38032 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +@@ -495,6 +495,10 @@ static void update_mqd_sdma(struct mqd_manager *mm, void *mqd, + m->sdma_engine_id = q->sdma_engine_id; + m->sdma_queue_id = q->sdma_queue_id; + m->sdmax_rlcx_dummy_reg = SDMA_RLC_DUMMY_DEFAULT; ++ /* Allow context switch so we don't cross-process starve with a massive ++ * command buffer of long-running SDMA commands ++ */ ++ m->sdmax_rlcx_ib_cntl |= SDMA0_GFX_IB_CNTL__SWITCH_INSIDE_IB_MASK; + + q->is_active = QUEUE_IS_ACTIVE(*q); + } +-- +2.39.5 + diff --git a/queue-6.15/drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch b/queue-6.15/drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch new file mode 100644 index 0000000000..707994ed8f --- /dev/null +++ b/queue-6.15/drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch @@ -0,0 +1,54 @@ +From 1555558c41150b1c6ed4e560343875a9b1d552f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 18:41:02 +0800 +Subject: drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of + calling disable_irq() + +From: Damon Ding + +[ Upstream commit efab13e7d13a641a22c7508cde6e1a5285161944 ] + +The IRQF_NO_AUTOEN can be used for the drivers that don't want +interrupts to be enabled automatically via devm_request_threaded_irq(). +Using this flag can provide be more robust compared to the way of +calling disable_irq() after devm_request_threaded_irq() without the +IRQF_NO_AUTOEN flag. + +Suggested-by: Douglas Anderson +Reviewed-by: Douglas Anderson +Signed-off-by: Damon Ding +Link: https://lore.kernel.org/r/20250310104114.2608063-2-damon.ding@rock-chips.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +index 5222b1e9f533d..f96952e9ff4ef 100644 +--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c ++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +@@ -1622,10 +1622,10 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + * that we can get the current state of the GPIO. + */ + dp->irq = gpiod_to_irq(dp->hpd_gpiod); +- irq_flags = IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING; ++ irq_flags = IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN; + } else { + dp->irq = platform_get_irq(pdev, 0); +- irq_flags = 0; ++ irq_flags = IRQF_NO_AUTOEN; + } + + if (dp->irq == -ENXIO) { +@@ -1641,7 +1641,6 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + dev_err(&pdev->dev, "failed to request irq\n"); + return ERR_PTR(ret); + } +- disable_irq(dp->irq); + + dp->aux.name = "DP-AUX"; + dp->aux.transfer = analogix_dpaux_transfer; +-- +2.39.5 + diff --git a/queue-6.15/drm-bridge-anx7625-change-the-gpiod_set_value-api.patch b/queue-6.15/drm-bridge-anx7625-change-the-gpiod_set_value-api.patch new file mode 100644 index 0000000000..23c230a4ba --- /dev/null +++ b/queue-6.15/drm-bridge-anx7625-change-the-gpiod_set_value-api.patch @@ -0,0 +1,63 @@ +From e76a471a6e56b3e5df1cb6e46aec706566597c13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 15:12:45 +0530 +Subject: drm/bridge: anx7625: change the gpiod_set_value API + +From: Ayushi Makhija + +[ Upstream commit 50935044e58e563cdcfd556d62f27bc8744dd64e ] + +Use gpiod_set_value_cansleep() instead of gpiod_set_value() +to fix the below call trace in the boot log: + +[ 5.690534] Call trace: +[ 5.690536] gpiod_set_value+0x40/0xa4 +[ 5.690540] anx7625_runtime_pm_resume+0xa0/0x324 [anx7625] +[ 5.690545] __rpm_callback+0x48/0x1d8 +[ 5.690549] rpm_callback+0x6c/0x78 + +Certain GPIO controllers require access via message-based buses +such as I2C or SPI, which may cause the GPIOs to enter a sleep +state. Therefore, use the gpiod_set_value_cansleep(). + +Signed-off-by: Ayushi Makhija +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250505094245.2660750-7-quic_amakhija@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 99ef3f27ae429..95d5a4e265788 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -1257,10 +1257,10 @@ static void anx7625_power_on(struct anx7625_data *ctx) + usleep_range(11000, 12000); + + /* Power on pin enable */ +- gpiod_set_value(ctx->pdata.gpio_p_on, 1); ++ gpiod_set_value_cansleep(ctx->pdata.gpio_p_on, 1); + usleep_range(10000, 11000); + /* Power reset pin enable */ +- gpiod_set_value(ctx->pdata.gpio_reset, 1); ++ gpiod_set_value_cansleep(ctx->pdata.gpio_reset, 1); + usleep_range(10000, 11000); + + DRM_DEV_DEBUG_DRIVER(dev, "power on !\n"); +@@ -1280,9 +1280,9 @@ static void anx7625_power_standby(struct anx7625_data *ctx) + return; + } + +- gpiod_set_value(ctx->pdata.gpio_reset, 0); ++ gpiod_set_value_cansleep(ctx->pdata.gpio_reset, 0); + usleep_range(1000, 1100); +- gpiod_set_value(ctx->pdata.gpio_p_on, 0); ++ gpiod_set_value_cansleep(ctx->pdata.gpio_p_on, 0); + usleep_range(1000, 1100); + + ret = regulator_bulk_disable(ARRAY_SIZE(ctx->pdata.supplies), +-- +2.39.5 + diff --git a/queue-6.15/drm-bridge-anx7625-enable-hpd-interrupts.patch b/queue-6.15/drm-bridge-anx7625-enable-hpd-interrupts.patch new file mode 100644 index 0000000000..dd33a7735b --- /dev/null +++ b/queue-6.15/drm-bridge-anx7625-enable-hpd-interrupts.patch @@ -0,0 +1,62 @@ +From bc1532e119e4a656804c6e18c0a69936d7172e0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 15:12:42 +0530 +Subject: drm/bridge: anx7625: enable HPD interrupts + +From: Ayushi Makhija + +[ Upstream commit ca8a78cdceb48ad3b753f836068611265840ef22 ] + +When the device enters the suspend state, it prevents +HPD interrupts from occurring. To address this, implement +.hpd_enable() and .hpd_disable() callbacks functions of +the drm_bridge. + +Signed-off-by: Ayushi Makhija +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250505094245.2660750-4-quic_amakhija@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 0b97b66de5774..99ef3f27ae429 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2474,6 +2474,22 @@ static const struct drm_edid *anx7625_bridge_edid_read(struct drm_bridge *bridge + return anx7625_edid_read(ctx); + } + ++static void anx7625_bridge_hpd_enable(struct drm_bridge *bridge) ++{ ++ struct anx7625_data *ctx = bridge_to_anx7625(bridge); ++ struct device *dev = ctx->dev; ++ ++ pm_runtime_get_sync(dev); ++} ++ ++static void anx7625_bridge_hpd_disable(struct drm_bridge *bridge) ++{ ++ struct anx7625_data *ctx = bridge_to_anx7625(bridge); ++ struct device *dev = ctx->dev; ++ ++ pm_runtime_put_sync(dev); ++} ++ + static const struct drm_bridge_funcs anx7625_bridge_funcs = { + .attach = anx7625_bridge_attach, + .detach = anx7625_bridge_detach, +@@ -2487,6 +2503,8 @@ static const struct drm_bridge_funcs anx7625_bridge_funcs = { + .atomic_reset = drm_atomic_helper_bridge_reset, + .detect = anx7625_bridge_detect, + .edid_read = anx7625_bridge_edid_read, ++ .hpd_enable = anx7625_bridge_hpd_enable, ++ .hpd_disable = anx7625_bridge_hpd_disable, + }; + + static int anx7625_register_i2c_dummy_clients(struct anx7625_data *ctx, +-- +2.39.5 + diff --git a/queue-6.15/drm-bridge-select-drm_kms_helper-for-aux_bridge.patch b/queue-6.15/drm-bridge-select-drm_kms_helper-for-aux_bridge.patch new file mode 100644 index 0000000000..6463075df3 --- /dev/null +++ b/queue-6.15/drm-bridge-select-drm_kms_helper-for-aux_bridge.patch @@ -0,0 +1,37 @@ +From c97f6560283b6603b36827b7083c8d99efbfdb7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 18:09:40 +0300 +Subject: drm/bridge: select DRM_KMS_HELPER for AUX_BRIDGE + +From: Dmitry Baryshkov + +[ Upstream commit b12fa5e76e1463fc5a196f2717040e4564e184b6 ] + +The aux bridge uses devm_drm_of_get_bridge() from the panel bridge (and +correctly selects DRM_PANEL_BRIDGE). However panel bridge is not a +separate module, it is compiled into the drm_kms_helper.o. Select +DRM_KMS_HELPER too to express this dependency. + +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250411-aux-select-kms-v1-1-c4276f905a56@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig +index 09a1be234f717..b9e0ca85226a6 100644 +--- a/drivers/gpu/drm/bridge/Kconfig ++++ b/drivers/gpu/drm/bridge/Kconfig +@@ -16,6 +16,7 @@ config DRM_AUX_BRIDGE + tristate + depends on DRM_BRIDGE && OF + select AUXILIARY_BUS ++ select DRM_KMS_HELPER + select DRM_PANEL_BRIDGE + help + Simple transparent bridge that is used by several non-DRM drivers to +-- +2.39.5 + diff --git a/queue-6.15/drm-dp-add-option-to-disable-zero-sized-address-only.patch b/queue-6.15/drm-dp-add-option-to-disable-zero-sized-address-only.patch new file mode 100644 index 0000000000..92b85d9509 --- /dev/null +++ b/queue-6.15/drm-dp-add-option-to-disable-zero-sized-address-only.patch @@ -0,0 +1,113 @@ +From 2562f49426d818f12cbf96a29871bbce7668b04f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Mar 2025 01:56:03 +1000 +Subject: drm/dp: add option to disable zero sized address only transactions. + +From: Dave Airlie + +[ Upstream commit f0ddbb1eed1898286d2bd99fd6ab64ca9700d267 ] + +Some older NVIDIA and some newer NVIDIA hardware/firmware seems to +have issues with address only transactions (firmware rejects them). + +Add an option to the core drm dp to avoid address only transactions, +This just puts the MOT flag removal on the last message of the transfer +and avoids the start of transfer transaction. + +This with the flag set in nouveau, allows eDP probing on GB203 device. + +Signed-off-by: Dave Airlie +Reviewed-by: Ben Skeggs +Reviewed-by: Timur Tabi +Tested-by: Timur Tabi +Signed-off-by: Dave Airlie +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_helper.c | 39 +++++++++++++++---------- + include/drm/display/drm_dp_helper.h | 5 ++++ + 2 files changed, 28 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_helper.c b/drivers/gpu/drm/display/drm_dp_helper.c +index dbce1c3f49691..753d7c3942a14 100644 +--- a/drivers/gpu/drm/display/drm_dp_helper.c ++++ b/drivers/gpu/drm/display/drm_dp_helper.c +@@ -2081,14 +2081,17 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, + + for (i = 0; i < num; i++) { + msg.address = msgs[i].addr; +- drm_dp_i2c_msg_set_request(&msg, &msgs[i]); +- /* Send a bare address packet to start the transaction. +- * Zero sized messages specify an address only (bare +- * address) transaction. +- */ +- msg.buffer = NULL; +- msg.size = 0; +- err = drm_dp_i2c_do_msg(aux, &msg); ++ ++ if (!aux->no_zero_sized) { ++ drm_dp_i2c_msg_set_request(&msg, &msgs[i]); ++ /* Send a bare address packet to start the transaction. ++ * Zero sized messages specify an address only (bare ++ * address) transaction. ++ */ ++ msg.buffer = NULL; ++ msg.size = 0; ++ err = drm_dp_i2c_do_msg(aux, &msg); ++ } + + /* + * Reset msg.request in case in case it got +@@ -2107,6 +2110,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, + msg.buffer = msgs[i].buf + j; + msg.size = min(transfer_size, msgs[i].len - j); + ++ if (j + msg.size == msgs[i].len && aux->no_zero_sized) ++ msg.request &= ~DP_AUX_I2C_MOT; + err = drm_dp_i2c_drain_msg(aux, &msg); + + /* +@@ -2124,15 +2129,17 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, + } + if (err >= 0) + err = num; +- /* Send a bare address packet to close out the transaction. +- * Zero sized messages specify an address only (bare +- * address) transaction. +- */ +- msg.request &= ~DP_AUX_I2C_MOT; +- msg.buffer = NULL; +- msg.size = 0; +- (void)drm_dp_i2c_do_msg(aux, &msg); + ++ if (!aux->no_zero_sized) { ++ /* Send a bare address packet to close out the transaction. ++ * Zero sized messages specify an address only (bare ++ * address) transaction. ++ */ ++ msg.request &= ~DP_AUX_I2C_MOT; ++ msg.buffer = NULL; ++ msg.size = 0; ++ (void)drm_dp_i2c_do_msg(aux, &msg); ++ } + return err; + } + +diff --git a/include/drm/display/drm_dp_helper.h b/include/drm/display/drm_dp_helper.h +index 5ae4241959f24..736dbfdd6321d 100644 +--- a/include/drm/display/drm_dp_helper.h ++++ b/include/drm/display/drm_dp_helper.h +@@ -518,6 +518,11 @@ struct drm_dp_aux { + * @powered_down: If true then the remote endpoint is powered down. + */ + bool powered_down; ++ ++ /** ++ * @no_zero_sized: If the hw can't use zero sized transfers (NVIDIA) ++ */ ++ bool no_zero_sized; + }; + + int drm_dp_dpcd_probe(struct drm_dp_aux *aux, unsigned int offset); +-- +2.39.5 + diff --git a/queue-6.15/drm-msm-a6xx-increase-hfi-response-timeout.patch b/queue-6.15/drm-msm-a6xx-increase-hfi-response-timeout.patch new file mode 100644 index 0000000000..1645b4c1e5 --- /dev/null +++ b/queue-6.15/drm-msm-a6xx-increase-hfi-response-timeout.patch @@ -0,0 +1,39 @@ +From b5ec6c89c3431cec6eba16092c2653227e12bfe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Apr 2025 20:21:31 +0530 +Subject: drm/msm/a6xx: Increase HFI response timeout + +From: Akhil P Oommen + +[ Upstream commit 5f02f5e78ec9688e29b6857813185b1181796abe ] + +When ACD feature is enabled, it triggers some internal calibrations +which result in a pretty long delay during the first HFI perf vote. +So, increase the HFI response timeout to match the downstream driver. + +Signed-off-by: Akhil P Oommen +Tested-by: Maya Matuszczyk +Tested-by: Anthony Ruhier +Patchwork: https://patchwork.freedesktop.org/patch/649344/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_hfi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_hfi.c b/drivers/gpu/drm/msm/adreno/a6xx_hfi.c +index 0989aee3dd2cf..628c19789e9d3 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_hfi.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_hfi.c +@@ -109,7 +109,7 @@ static int a6xx_hfi_wait_for_ack(struct a6xx_gmu *gmu, u32 id, u32 seqnum, + + /* Wait for a response */ + ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_GMU2HOST_INTR_INFO, val, +- val & A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ, 100, 5000); ++ val & A6XX_GMU_GMU2HOST_INTR_INFO_MSGQ, 100, 1000000); + + if (ret) { + DRM_DEV_ERROR(gmu->dev, +-- +2.39.5 + diff --git a/queue-6.15/drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch b/queue-6.15/drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch new file mode 100644 index 0000000000..64c4660886 --- /dev/null +++ b/queue-6.15/drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch @@ -0,0 +1,39 @@ +From bf81784c9724637f840672437e487667186e1b7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Mar 2025 08:24:53 +0200 +Subject: drm/msm/dpu: don't select single flush for active CTL blocks + +From: Dmitry Baryshkov + +[ Upstream commit e93eee524bb78f3ee4b78654d0083382f98b3d23 ] + +In case of ACTIVE CTLs, a single CTL is being used for flushing all INTF +blocks. Don't skip programming the CTL on those targets. + +Tested-by: Neil Armstrong # on SM8550-QRD +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/641585/ +Link: https://lore.kernel.org/r/20250307-dpu-active-ctl-v3-5-5d20655f10ca@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +index abd6600046cb3..8220a4012846b 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +@@ -372,7 +372,8 @@ static void dpu_encoder_phys_vid_underrun_irq(void *arg) + static bool dpu_encoder_phys_vid_needs_single_flush( + struct dpu_encoder_phys *phys_enc) + { +- return phys_enc->split_role != ENC_ROLE_SOLO; ++ return !(phys_enc->hw_ctl->caps->features & BIT(DPU_CTL_ACTIVE_CFG)) && ++ phys_enc->split_role != ENC_ROLE_SOLO; + } + + static void dpu_encoder_phys_vid_atomic_mode_set( +-- +2.39.5 + diff --git a/queue-6.15/drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch b/queue-6.15/drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch new file mode 100644 index 0000000000..6b2c131e5a --- /dev/null +++ b/queue-6.15/drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch @@ -0,0 +1,70 @@ +From 3acb7e2b9cdd1b35c8e490dd5cfe1c6d1eaefa86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 03:14:52 +0300 +Subject: drm/msm/hdmi: add runtime PM calls to DDC transfer function + +From: Dmitry Baryshkov + +[ Upstream commit 531b4e2c206e5f7dead04d9da84dfa693ac57481 ] + +We must be sure that the HDMI controller is powered on, while performing +the DDC transfer. Add corresponding runtime PM calls to +msm_hdmi_i2c_xfer(). + +Reviewed-by: Jessica Zhang +Signed-off-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/651727/ +Link: https://lore.kernel.org/r/20250505-fd-hdmi-hpd-v5-8-48541f76318c@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/hdmi/hdmi_i2c.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c b/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c +index 7aa500d24240f..ebefea4fb4085 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi_i2c.c +@@ -107,11 +107,15 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, + if (num == 0) + return num; + ++ ret = pm_runtime_resume_and_get(&hdmi->pdev->dev); ++ if (ret) ++ return ret; ++ + init_ddc(hdmi_i2c); + + ret = ddc_clear_irq(hdmi_i2c); + if (ret) +- return ret; ++ goto fail; + + for (i = 0; i < num; i++) { + struct i2c_msg *p = &msgs[i]; +@@ -169,7 +173,7 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, + hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS), + hdmi_read(hdmi, REG_HDMI_DDC_HW_STATUS), + hdmi_read(hdmi, REG_HDMI_DDC_INT_CTRL)); +- return ret; ++ goto fail; + } + + ddc_status = hdmi_read(hdmi, REG_HDMI_DDC_SW_STATUS); +@@ -202,7 +206,13 @@ static int msm_hdmi_i2c_xfer(struct i2c_adapter *i2c, + } + } + ++ pm_runtime_put(&hdmi->pdev->dev); ++ + return i; ++ ++fail: ++ pm_runtime_put(&hdmi->pdev->dev); ++ return ret; + } + + static u32 msm_hdmi_i2c_func(struct i2c_adapter *adapter) +-- +2.39.5 + diff --git a/queue-6.15/drm-nouveau-fix-hibernate-on-disabled-gpu.patch b/queue-6.15/drm-nouveau-fix-hibernate-on-disabled-gpu.patch new file mode 100644 index 0000000000..d07a3db4dd --- /dev/null +++ b/queue-6.15/drm-nouveau-fix-hibernate-on-disabled-gpu.patch @@ -0,0 +1,55 @@ +From 5db261c7deeacbf20a270d084b52f66775b3469e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Mar 2025 13:44:36 +0100 +Subject: drm/nouveau: fix hibernate on disabled GPU + +From: Christoph Rudorff + +[ Upstream commit 4c4d9b7b6c6e676eca22585139aba5f03de74b90 ] + +Hibernate bricks the machine if a discrete GPU was disabled via + +echo IGD > /sys/kernel/debug/vgaswitcheroo/switch + +The freeze and thaw handler lacks checking the GPU power state, +as suspend and resume do. + +This patch add the checks and fix this issue. + +Signed-off-by: Christoph Rudorff +Signed-off-by: Lyude Paul +Link: https://lore.kernel.org/r/20250325-nouveau-fix-hibernate-v2-1-2bd5c13fb953@rudorff.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_drm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index e154d08857c55..c69139701056d 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -1079,6 +1079,10 @@ nouveau_pmops_freeze(struct device *dev) + { + struct nouveau_drm *drm = dev_get_drvdata(dev); + ++ if (drm->dev->switch_power_state == DRM_SWITCH_POWER_OFF || ++ drm->dev->switch_power_state == DRM_SWITCH_POWER_DYNAMIC_OFF) ++ return 0; ++ + return nouveau_do_suspend(drm, false); + } + +@@ -1087,6 +1091,10 @@ nouveau_pmops_thaw(struct device *dev) + { + struct nouveau_drm *drm = dev_get_drvdata(dev); + ++ if (drm->dev->switch_power_state == DRM_SWITCH_POWER_OFF || ++ drm->dev->switch_power_state == DRM_SWITCH_POWER_DYNAMIC_OFF) ++ return 0; ++ + return nouveau_do_resume(drm, false); + } + +-- +2.39.5 + diff --git a/queue-6.15/drm-nouveau-gsp-fix-rm-shutdown-wait-condition.patch b/queue-6.15/drm-nouveau-gsp-fix-rm-shutdown-wait-condition.patch new file mode 100644 index 0000000000..ac3d03ad49 --- /dev/null +++ b/queue-6.15/drm-nouveau-gsp-fix-rm-shutdown-wait-condition.patch @@ -0,0 +1,44 @@ +From f628c6377daf01c3f16537c105ecdff70d123864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 03:12:51 +1000 +Subject: drm/nouveau/gsp: fix rm shutdown wait condition + +From: Ben Skeggs + +[ Upstream commit 7904bcdcf6b56602a049ed2b47282db63671fa99 ] + +Though the initial upstreamed GSP-RM version in nouveau was 535.113.01, +the code was developed against earlier versions. + +535.42.02 modified the mailbox value used by GSP-RM to signal shutdown +has completed, which was missed at the time. + +I'm not aware of any issues caused by this, but noticed the bug while +working on GB20x support. + +Signed-off-by: Ben Skeggs +Reviewed-by: Dave Airlie +Reviewed-by: Timur Tabi +Tested-by: Timur Tabi +Signed-off-by: Dave Airlie +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c +index db2602e880062..6a964b54f69c2 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c +@@ -2838,7 +2838,7 @@ r535_gsp_fini(struct nvkm_gsp *gsp, bool suspend) + return ret; + + nvkm_msec(gsp->subdev.device, 2000, +- if (nvkm_falcon_rd32(&gsp->falcon, 0x040) & 0x80000000) ++ if (nvkm_falcon_rd32(&gsp->falcon, 0x040) == 0x80000000) + break; + ); + +-- +2.39.5 + diff --git a/queue-6.15/drm-panel-orientation-quirks-add-zotac-gaming-zone.patch b/queue-6.15/drm-panel-orientation-quirks-add-zotac-gaming-zone.patch new file mode 100644 index 0000000000..1c2d6b7a22 --- /dev/null +++ b/queue-6.15/drm-panel-orientation-quirks-add-zotac-gaming-zone.patch @@ -0,0 +1,40 @@ +From f030d20a49ef4e1d9e14e9826b13b90b49cdde09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Mar 2025 14:16:44 -0700 +Subject: drm: panel-orientation-quirks: Add ZOTAC Gaming Zone + +From: Vicki Pfau + +[ Upstream commit 96c85e428ebaeacd2c640eba075479ab92072ccd ] + +Add a panel orientation quirk for the ZOTAC Gaming Zone handheld gaming device. + +Signed-off-by: Vicki Pfau +Reviewed-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20250313211643.860786-2-vi@endrift.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index c554ad8f246b6..7ac0fd5391fea 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -517,6 +517,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "LTH17"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* ZOTAC Gaming Zone */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ZOTAC"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "G0A1W"), ++ }, ++ .driver_data = (void *)&lcd1080x1920_leftside_up, + }, { /* One Mix 2S (generic strings, also match on bios date) */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), +-- +2.39.5 + diff --git a/queue-6.15/drm-panel-sharp-ls043t1le01-use-_multi-variants.patch b/queue-6.15/drm-panel-sharp-ls043t1le01-use-_multi-variants.patch new file mode 100644 index 0000000000..f1a502f74f --- /dev/null +++ b/queue-6.15/drm-panel-sharp-ls043t1le01-use-_multi-variants.patch @@ -0,0 +1,126 @@ +From de3259895ee185169487c486f4c72f14df7d3884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 23:29:19 -0400 +Subject: drm/panel/sharp-ls043t1le01: Use _multi variants + +From: Anusha Srivatsa + +[ Upstream commit 20e8219205145e1af3b98b6a0a3cc59568116a05 ] + +Move away from using deprecated API and use _multi variants +if available. Use mipi_dsi_msleep() and mipi_dsi_usleep_range() +instead of msleep() and usleep_range() respectively. + +Used Coccinelle to find the _multi variant APIs,replacing +mpi_dsi_msleep() where necessary and for returning +dsi_ctx.accum_err in these functions. mipi_dsi_dcs_write() +does not have a corresponding _multi() variant. Replacing it with +mipi_dsi_dcs_write_seq_multi() instead. This change is manual. + +The Coccinelle script is the same as the one in commit c8ba07caaecc +("drm/panel/synaptics-r63353: Use _multi variants") + +v2: Use mipi_dsi_write_buffer_multi() in place of +mipi_dsi_dcs_write(). (Dmitry) + +v3: add commit details where the same coccinelle script is +used and remove the actual script from commit log. +Use mipi_dsi_dcs_write_seq_multi() for mipi_dsi_dcs_write() (Doug) + +Cc: Maxime Ripard +Cc: Dmitry Baryshkov +Cc: Tejas Vipin +Cc: Doug Anderson +Signed-off-by: Anusha Srivatsa +Reviewed-by: Neil Armstrong +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20250326-b4-panel-ls043t1le01-v3-1-96c554c0ea2b@redhat.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + .../gpu/drm/panel/panel-sharp-ls043t1le01.c | 41 +++++++------------ + 1 file changed, 15 insertions(+), 26 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c +index 729cbb0d8403f..36abfa2e65e96 100644 +--- a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c ++++ b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c +@@ -36,60 +36,49 @@ static inline struct sharp_nt_panel *to_sharp_nt_panel(struct drm_panel *panel) + static int sharp_nt_panel_init(struct sharp_nt_panel *sharp_nt) + { + struct mipi_dsi_device *dsi = sharp_nt->dsi; +- int ret; ++ struct mipi_dsi_multi_context dsi_ctx = { .dsi = dsi }; + + dsi->mode_flags |= MIPI_DSI_MODE_LPM; + +- ret = mipi_dsi_dcs_exit_sleep_mode(dsi); +- if (ret < 0) +- return ret; ++ mipi_dsi_dcs_exit_sleep_mode_multi(&dsi_ctx); + +- msleep(120); ++ mipi_dsi_msleep(&dsi_ctx, 120); + + /* Novatek two-lane operation */ +- ret = mipi_dsi_dcs_write(dsi, 0xae, (u8[]){ 0x03 }, 1); +- if (ret < 0) +- return ret; ++ mipi_dsi_dcs_write_seq_multi(&dsi_ctx, 0xae, 0x03); + + /* Set both MCU and RGB I/F to 24bpp */ +- ret = mipi_dsi_dcs_set_pixel_format(dsi, MIPI_DCS_PIXEL_FMT_24BIT | +- (MIPI_DCS_PIXEL_FMT_24BIT << 4)); +- if (ret < 0) +- return ret; ++ mipi_dsi_dcs_set_pixel_format_multi(&dsi_ctx, ++ MIPI_DCS_PIXEL_FMT_24BIT | ++ (MIPI_DCS_PIXEL_FMT_24BIT << 4)); + +- return 0; ++ return dsi_ctx.accum_err; + } + + static int sharp_nt_panel_on(struct sharp_nt_panel *sharp_nt) + { + struct mipi_dsi_device *dsi = sharp_nt->dsi; +- int ret; ++ struct mipi_dsi_multi_context dsi_ctx = { .dsi = dsi }; + + dsi->mode_flags |= MIPI_DSI_MODE_LPM; + +- ret = mipi_dsi_dcs_set_display_on(dsi); +- if (ret < 0) +- return ret; ++ mipi_dsi_dcs_set_display_on_multi(&dsi_ctx); + +- return 0; ++ return dsi_ctx.accum_err; + } + + static int sharp_nt_panel_off(struct sharp_nt_panel *sharp_nt) + { + struct mipi_dsi_device *dsi = sharp_nt->dsi; +- int ret; ++ struct mipi_dsi_multi_context dsi_ctx = { .dsi = dsi }; + + dsi->mode_flags &= ~MIPI_DSI_MODE_LPM; + +- ret = mipi_dsi_dcs_set_display_off(dsi); +- if (ret < 0) +- return ret; ++ mipi_dsi_dcs_set_display_off_multi(&dsi_ctx); + +- ret = mipi_dsi_dcs_enter_sleep_mode(dsi); +- if (ret < 0) +- return ret; ++ mipi_dsi_dcs_enter_sleep_mode_multi(&dsi_ctx); + +- return 0; ++ return dsi_ctx.accum_err; + } + + static int sharp_nt_panel_unprepare(struct drm_panel *panel) +-- +2.39.5 + diff --git a/queue-6.15/drm-panel-simple-add-powertip-ph128800t004-zza01-pan.patch b/queue-6.15/drm-panel-simple-add-powertip-ph128800t004-zza01-pan.patch new file mode 100644 index 0000000000..49eae4d4b8 --- /dev/null +++ b/queue-6.15/drm-panel-simple-add-powertip-ph128800t004-zza01-pan.patch @@ -0,0 +1,73 @@ +From b95811f816315038817d616b9d7497dba77f1415 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 17:40:06 +0100 +Subject: drm/panel: simple: Add POWERTIP PH128800T004-ZZA01 panel entry + +From: Antonin Godard + +[ Upstream commit 6374a1005f20c1c2f7bbcc1bc735c2be4910a685 ] + +Add support for the POWERTIP PH128800T004-ZZA01 10.1" (1280x800) +LCD-TFT panel. Its panel description is very much like the POWERTIP +PH128800T006-ZHC01 configured below this one, only its timings are +different. + +Signed-off-by: Antonin Godard +Reviewed-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20250311-add-powertip-ph128800t004-v1-2-7f95e6984cea@bootlin.com +Signed-off-by: Louis Chauvet +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 29 ++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 3aaac96c0bfbf..53211b5eaa09b 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -3798,6 +3798,32 @@ static const struct panel_desc pda_91_00156_a0 = { + .bus_format = MEDIA_BUS_FMT_RGB888_1X24, + }; + ++static const struct drm_display_mode powertip_ph128800t004_zza01_mode = { ++ .clock = 71150, ++ .hdisplay = 1280, ++ .hsync_start = 1280 + 48, ++ .hsync_end = 1280 + 48 + 32, ++ .htotal = 1280 + 48 + 32 + 80, ++ .vdisplay = 800, ++ .vsync_start = 800 + 9, ++ .vsync_end = 800 + 9 + 8, ++ .vtotal = 800 + 9 + 8 + 6, ++ .flags = DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC, ++}; ++ ++static const struct panel_desc powertip_ph128800t004_zza01 = { ++ .modes = &powertip_ph128800t004_zza01_mode, ++ .num_modes = 1, ++ .bpc = 8, ++ .size = { ++ .width = 216, ++ .height = 135, ++ }, ++ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, ++ .bus_flags = DRM_BUS_FLAG_DE_HIGH, ++ .connector_type = DRM_MODE_CONNECTOR_LVDS, ++}; ++ + static const struct drm_display_mode powertip_ph128800t006_zhc01_mode = { + .clock = 66500, + .hdisplay = 1280, +@@ -5155,6 +5181,9 @@ static const struct of_device_id platform_of_match[] = { + }, { + .compatible = "pda,91-00156-a0", + .data = &pda_91_00156_a0, ++ }, { ++ .compatible = "powertip,ph128800t004-zza01", ++ .data = &powertip_ph128800t004_zza01, + }, { + .compatible = "powertip,ph128800t006-zhc01", + .data = &powertip_ph128800t006_zhc01, +-- +2.39.5 + diff --git a/queue-6.15/drm-panthor-don-t-update-mmu_int_mask-in-panthor_mmu.patch b/queue-6.15/drm-panthor-don-t-update-mmu_int_mask-in-panthor_mmu.patch new file mode 100644 index 0000000000..9ff0246491 --- /dev/null +++ b/queue-6.15/drm-panthor-don-t-update-mmu_int_mask-in-panthor_mmu.patch @@ -0,0 +1,44 @@ +From b5e95b917f4754d280bbc8ef8fb7e49c0172ca60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Apr 2025 10:09:33 +0200 +Subject: drm/panthor: Don't update MMU_INT_MASK in panthor_mmu_irq_handler() + +From: Boris Brezillon + +[ Upstream commit 6c4a3fa26799785c1873aacabcfd9b2d27e8dc97 ] + +Interrupts are automatically unmasked in +panthor_mmu_irq_threaded_handler() when the handler returns. Unmasking +prematurely might generate spurious interrupts if the IRQ line is +shared. + +Changes in v2: +- New patch + +Changes in v3: +- Add R-bs + +Reviewed-by: Liviu Dudau +Reviewed-by: Steven Price +Link: https://lore.kernel.org/r/20250404080933.2912674-6-boris.brezillon@collabora.com +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panthor/panthor_mmu.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c +index 7cca97d298ea1..cc838bfc82e00 100644 +--- a/drivers/gpu/drm/panthor/panthor_mmu.c ++++ b/drivers/gpu/drm/panthor/panthor_mmu.c +@@ -1714,7 +1714,6 @@ static void panthor_mmu_irq_handler(struct panthor_device *ptdev, u32 status) + * re-enabled. + */ + ptdev->mmu->irq.mask = new_int_mask; +- gpu_write(ptdev, MMU_INT_MASK, new_int_mask); + + if (ptdev->mmu->as.slots[as].vm) + ptdev->mmu->as.slots[as].vm->unhandled_fault = true; +-- +2.39.5 + diff --git a/queue-6.15/drm-rockchip-inno-hdmi-fix-video-timing-hsync-vsync-.patch b/queue-6.15/drm-rockchip-inno-hdmi-fix-video-timing-hsync-vsync-.patch new file mode 100644 index 0000000000..973922a939 --- /dev/null +++ b/queue-6.15/drm-rockchip-inno-hdmi-fix-video-timing-hsync-vsync-.patch @@ -0,0 +1,127 @@ +From 644405963048bd3bcf2d7785a872c76089025d3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 15:04:43 +0800 +Subject: drm/rockchip: inno-hdmi: Fix video timing HSYNC/VSYNC polarity + setting for rk3036 + +From: Andy Yan + +[ Upstream commit ad10b82c2bcac7f87ac6eaecfca33378b43425ee ] + +The HSYNC/VSYNC polarity of rk3036 HDMI are controlled by GRF. +Without the polarity configuration in GRF, it can be observed +from the HDMI protocol analyzer that the H/V front/back timing +output by RK3036 HDMI are currently not in line with the specifications. + +Signed-off-by: Andy Yan +Tested-by: Heiko Stuebner #rk3036-kylin +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20250422070455.432666-5-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/inno_hdmi.c | 36 +++++++++++++++++++++++++++- + 1 file changed, 35 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/inno_hdmi.c b/drivers/gpu/drm/rockchip/inno_hdmi.c +index 483ecfeaebb08..87dfd30001583 100644 +--- a/drivers/gpu/drm/rockchip/inno_hdmi.c ++++ b/drivers/gpu/drm/rockchip/inno_hdmi.c +@@ -10,10 +10,12 @@ + #include + #include + #include ++#include + #include + #include + #include + #include ++#include + + #include + #include +@@ -29,8 +31,19 @@ + + #include "inno_hdmi.h" + ++#define HIWORD_UPDATE(val, mask) ((val) | (mask) << 16) ++ + #define INNO_HDMI_MIN_TMDS_CLOCK 25000000U + ++#define RK3036_GRF_SOC_CON2 0x148 ++#define RK3036_HDMI_PHSYNC BIT(4) ++#define RK3036_HDMI_PVSYNC BIT(5) ++ ++enum inno_hdmi_dev_type { ++ RK3036_HDMI, ++ RK3128_HDMI, ++}; ++ + struct inno_hdmi_phy_config { + unsigned long pixelclock; + u8 pre_emphasis; +@@ -38,6 +51,7 @@ struct inno_hdmi_phy_config { + }; + + struct inno_hdmi_variant { ++ enum inno_hdmi_dev_type dev_type; + struct inno_hdmi_phy_config *phy_configs; + struct inno_hdmi_phy_config *default_phy_config; + }; +@@ -58,6 +72,7 @@ struct inno_hdmi { + struct clk *pclk; + struct clk *refclk; + void __iomem *regs; ++ struct regmap *grf; + + struct drm_connector connector; + struct rockchip_encoder encoder; +@@ -374,7 +389,15 @@ static int inno_hdmi_config_video_csc(struct inno_hdmi *hdmi) + static int inno_hdmi_config_video_timing(struct inno_hdmi *hdmi, + struct drm_display_mode *mode) + { +- int value; ++ int value, psync; ++ ++ if (hdmi->variant->dev_type == RK3036_HDMI) { ++ psync = mode->flags & DRM_MODE_FLAG_PHSYNC ? RK3036_HDMI_PHSYNC : 0; ++ value = HIWORD_UPDATE(psync, RK3036_HDMI_PHSYNC); ++ psync = mode->flags & DRM_MODE_FLAG_PVSYNC ? RK3036_HDMI_PVSYNC : 0; ++ value |= HIWORD_UPDATE(psync, RK3036_HDMI_PVSYNC); ++ regmap_write(hdmi->grf, RK3036_GRF_SOC_CON2, value); ++ } + + /* Set detail external video timing polarity and interlace mode */ + value = v_EXTERANL_VIDEO(1); +@@ -911,6 +934,15 @@ static int inno_hdmi_bind(struct device *dev, struct device *master, + goto err_disable_pclk; + } + ++ if (hdmi->variant->dev_type == RK3036_HDMI) { ++ hdmi->grf = syscon_regmap_lookup_by_phandle(dev->of_node, "rockchip,grf"); ++ if (IS_ERR(hdmi->grf)) { ++ ret = dev_err_probe(dev, PTR_ERR(hdmi->grf), ++ "Unable to get rockchip,grf\n"); ++ goto err_disable_clk; ++ } ++ } ++ + irq = platform_get_irq(pdev, 0); + if (irq < 0) { + ret = irq; +@@ -995,11 +1027,13 @@ static void inno_hdmi_remove(struct platform_device *pdev) + } + + static const struct inno_hdmi_variant rk3036_inno_hdmi_variant = { ++ .dev_type = RK3036_HDMI, + .phy_configs = rk3036_hdmi_phy_configs, + .default_phy_config = &rk3036_hdmi_phy_configs[1], + }; + + static const struct inno_hdmi_variant rk3128_inno_hdmi_variant = { ++ .dev_type = RK3128_HDMI, + .phy_configs = rk3128_hdmi_phy_configs, + .default_phy_config = &rk3128_hdmi_phy_configs[1], + }; +-- +2.39.5 + diff --git a/queue-6.15/drm-rockchip-vop2-make-overlay-layer-select-register.patch b/queue-6.15/drm-rockchip-vop2-make-overlay-layer-select-register.patch new file mode 100644 index 0000000000..c278c18f3b --- /dev/null +++ b/queue-6.15/drm-rockchip-vop2-make-overlay-layer-select-register.patch @@ -0,0 +1,55 @@ +From d833e3f17832b85be42d28caa2e50022f194c4c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Mar 2025 14:20:17 +0800 +Subject: drm/rockchip: vop2: Make overlay layer select register configuration + take effect by vsync + +From: Andy Yan + +[ Upstream commit c5996e4ab109c8bb5541453b20647eaaf9350f41 ] + +Because the layer/window enable/disable is take effect by vsync, if the +overlay configuration of these layers does not follow vsync and +takes effect immediately instead, when multiple layers are dynamically +enable/disable, inconsistent display contents may be seen on the screen. + +Signed-off-by: Andy Yan +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20250318062024.4555-1-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.h | 1 + + drivers/gpu/drm/rockchip/rockchip_vop2_reg.c | 5 ++++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h +index 680bedbb770e6..fc3ecb9fcd957 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h +@@ -710,6 +710,7 @@ enum dst_factor_mode { + + #define VOP2_COLOR_KEY_MASK BIT(31) + ++#define RK3568_OVL_CTRL__LAYERSEL_REGDONE_SEL GENMASK(31, 30) + #define RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD BIT(28) + #define RK3568_OVL_CTRL__YUV_MODE(vp) BIT(vp) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c +index 0a2840cbe8e22..32c4ed6857395 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c ++++ b/drivers/gpu/drm/rockchip/rockchip_vop2_reg.c +@@ -2070,7 +2070,10 @@ static void rk3568_vop2_setup_layer_mixer(struct vop2_video_port *vp) + struct rockchip_crtc_state *vcstate = to_rockchip_crtc_state(vp->crtc.state); + + ovl_ctrl = vop2_readl(vop2, RK3568_OVL_CTRL); +- ovl_ctrl |= RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD; ++ ovl_ctrl &= ~RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD; ++ ovl_ctrl &= ~RK3568_OVL_CTRL__LAYERSEL_REGDONE_SEL; ++ ovl_ctrl |= FIELD_PREP(RK3568_OVL_CTRL__LAYERSEL_REGDONE_SEL, vp->id); ++ + if (vcstate->yuv_overlay) + ovl_ctrl |= RK3568_OVL_CTRL__YUV_MODE(vp->id); + else +-- +2.39.5 + diff --git a/queue-6.15/drm-ttm-tests-fix-incorrect-assert-in-ttm_bo_unreser.patch b/queue-6.15/drm-ttm-tests-fix-incorrect-assert-in-ttm_bo_unreser.patch new file mode 100644 index 0000000000..8b1c9fbdd8 --- /dev/null +++ b/queue-6.15/drm-ttm-tests-fix-incorrect-assert-in-ttm_bo_unreser.patch @@ -0,0 +1,43 @@ +From 09b3d463c9cf525d55d293565f8dc3cd00bce485 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Mar 2025 16:14:24 +0000 +Subject: drm/ttm/tests: fix incorrect assert in ttm_bo_unreserve_bulk() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Qasim Ijaz + +[ Upstream commit 878516a9e62cd220379e511d43dcf58df3a6ca9f ] + +In the ttm_bo_unreserve_bulk() test function, resv is allocated using +kunit_kzalloc(), but the subsequent assertion mistakenly verifies the +ttm_dev pointer instead of the resv pointer. + +Fix the assertion to properly verify the resv pointer. + +Signed-off-by: Qasim Ijaz +Link: https://patchwork.freedesktop.org/patch/msgid/20250313161424.10688-1-qasdev00@gmail.com +Reviewed-by: Christian König +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c +index f8f20d2f61740..e08e5a138420e 100644 +--- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c ++++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c +@@ -340,7 +340,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test) + KUNIT_ASSERT_NOT_NULL(test, ttm_dev); + + resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL); +- KUNIT_ASSERT_NOT_NULL(test, ttm_dev); ++ KUNIT_ASSERT_NOT_NULL(test, resv); + + err = ttm_device_kunit_init(priv, ttm_dev, false, false); + KUNIT_ASSERT_EQ(test, err, 0); +-- +2.39.5 + diff --git a/queue-6.15/drm-xe-fix-cfi-violation-when-accessing-sysfs-files.patch b/queue-6.15/drm-xe-fix-cfi-violation-when-accessing-sysfs-files.patch new file mode 100644 index 0000000000..9ae62cea80 --- /dev/null +++ b/queue-6.15/drm-xe-fix-cfi-violation-when-accessing-sysfs-files.patch @@ -0,0 +1,497 @@ +From 87b3dd77c3df0f6b47bb4349c9240c4b8a39f1cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 17:18:52 +0000 +Subject: drm/xe: Fix CFI violation when accessing sysfs files + +From: Jeevaka Prabu Badrappan + +[ Upstream commit 4ea512714c42c69828b4a2647d206bf404043ad5 ] + +When an attribute group is created with sysfs_create_group() or +sysfs_create_files() the ->sysfs_ops() callback is set to +kobj_sysfs_ops, which sets the ->show() callback to kobj_attr_show(). +kobj_attr_show() uses container_of() to get the ->show() callback +from the attribute it was passed, meaning the ->show() callback needs +to be the same type as the ->show() callback in 'struct kobj_attribute'. + +However, cur_freq_show() has the type of the ->show() callback in +'struct device_attribute', which causes a CFI violation when opening the +'id' sysfs node under gtidle/freq/throttle. This happens to work because +the layout of 'struct kobj_attribute' and 'struct device_attribute' are +the same, so the container_of() cast happens to allow the ->show() +callback to still work. + +Changed the type of cur_freq_show() and few more functions to match the +->show() callback in 'struct kobj_attributes' to resolve the CFI +violation. + +CFI failure seen while accessing sysfs files under +/sys/class/drm/card0/device/tile0/gt*/gtidle/* +/sys/class/drm/card0/device/tile0/gt*/freq0/* +/sys/class/drm/card0/device/tile0/gt*/freq0/throttle/* + +[ 2599.618075] RIP: 0010:__cfi_cur_freq_show+0xd/0x10 [xe] +[ 2599.624452] Code: 44 c1 44 89 fa e8 03 95 39 f2 48 98 5b 41 5e 41 5f 5d c3 c9 +[ 2599.646638] RSP: 0018:ffffbe438ead7d10 EFLAGS: 00010286 +[ 2599.652823] RAX: ffff9f7d8b3845d8 RBX: ffff9f7dee8c95d8 RCX: 0000000000000000 +[ 2599.661246] RDX: ffff9f7e6f439000 RSI: ffffffffc13ada30 RDI: ffff9f7d975d4b00 +[ 2599.669669] RBP: ffffbe438ead7d18 R08: 0000000000001000 R09: ffff9f7e6f439000 +[ 2599.678092] R10: 00000000e07304a6 R11: ffffffffc1241ca0 R12: ffffffffb4836ea0 +[ 2599.688435] R13: ffff9f7e45fb1180 R14: ffff9f7d975d4b00 R15: ffff9f7e6f439000 +[ 2599.696860] FS: 000076b02b66cfc0(0000) GS:ffff9f80ef400000(0000) knlGS:00000 +[ 2599.706412] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 2599.713196] CR2: 00005f80d94641a9 CR3: 00000001e44ec006 CR4: 0000000100f72ef0 +[ 2599.721618] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 2599.730041] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400 +[ 2599.738464] PKRU: 55555554 +[ 2599.741655] Call Trace: +[ 2599.744541] +[ 2599.747017] ? __die_body+0x69/0xb0 +[ 2599.751151] ? die+0xa9/0xd0 +[ 2599.754548] ? do_trap+0x89/0x160 +[ 2599.758476] ? __cfi_cur_freq_show+0xd/0x10 [xe b37985c94829727668bd7c5b33c1] +[ 2599.768315] ? handle_invalid_op+0x69/0x90 +[ 2599.773167] ? __cfi_cur_freq_show+0xd/0x10 [xe b37985c94829727668bd7c5b33c1] +[ 2599.783010] ? exc_invalid_op+0x36/0x60 +[ 2599.787552] ? fred_hwexc+0x123/0x1a0 +[ 2599.791873] ? fred_entry_from_kernel+0x7b/0xd0 +[ 2599.797219] ? asm_fred_entrypoint_kernel+0x45/0x70 +[ 2599.802976] ? act_freq_show+0x70/0x70 [xe b37985c94829727668bd7c5b33c1d9998] +[ 2599.812301] ? __cfi_cur_freq_show+0xd/0x10 [xe b37985c94829727668bd7c5b33c1] +[ 2599.822137] ? __kmalloc_node_noprof+0x1f3/0x420 +[ 2599.827594] ? __kvmalloc_node_noprof+0xcb/0x180 +[ 2599.833045] ? kobj_attr_show+0x22/0x40 +[ 2599.837571] sysfs_kf_seq_show+0xa8/0x110 +[ 2599.842302] kernfs_seq_show+0x38/0x50 + +Signed-off-by: Jeevaka Prabu Badrappan +Reviewed-by: Rodrigo Vivi +Link: https://lore.kernel.org/r/20250422171852.85558-1-jeevaka.badrappan@intel.com +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_gt_freq.c | 82 ++++++++++++++------------ + drivers/gpu/drm/xe/xe_gt_idle.c | 28 +++++---- + drivers/gpu/drm/xe/xe_gt_throttle.c | 90 ++++++++++++++--------------- + 3 files changed, 107 insertions(+), 93 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_gt_freq.c b/drivers/gpu/drm/xe/xe_gt_freq.c +index 552ac92496a40..60d9354e7dbf4 100644 +--- a/drivers/gpu/drm/xe/xe_gt_freq.c ++++ b/drivers/gpu/drm/xe/xe_gt_freq.c +@@ -61,9 +61,10 @@ dev_to_xe(struct device *dev) + return gt_to_xe(kobj_to_gt(dev->kobj.parent)); + } + +-static ssize_t act_freq_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t act_freq_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buf) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + u32 freq; + +@@ -73,11 +74,12 @@ static ssize_t act_freq_show(struct device *dev, + + return sysfs_emit(buf, "%d\n", freq); + } +-static DEVICE_ATTR_RO(act_freq); ++static struct kobj_attribute attr_act_freq = __ATTR_RO(act_freq); + +-static ssize_t cur_freq_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t cur_freq_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buf) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + u32 freq; + ssize_t ret; +@@ -90,11 +92,12 @@ static ssize_t cur_freq_show(struct device *dev, + + return sysfs_emit(buf, "%d\n", freq); + } +-static DEVICE_ATTR_RO(cur_freq); ++static struct kobj_attribute attr_cur_freq = __ATTR_RO(cur_freq); + +-static ssize_t rp0_freq_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t rp0_freq_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buf) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + u32 freq; + +@@ -104,11 +107,12 @@ static ssize_t rp0_freq_show(struct device *dev, + + return sysfs_emit(buf, "%d\n", freq); + } +-static DEVICE_ATTR_RO(rp0_freq); ++static struct kobj_attribute attr_rp0_freq = __ATTR_RO(rp0_freq); + +-static ssize_t rpe_freq_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t rpe_freq_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buf) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + u32 freq; + +@@ -118,11 +122,12 @@ static ssize_t rpe_freq_show(struct device *dev, + + return sysfs_emit(buf, "%d\n", freq); + } +-static DEVICE_ATTR_RO(rpe_freq); ++static struct kobj_attribute attr_rpe_freq = __ATTR_RO(rpe_freq); + +-static ssize_t rpa_freq_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t rpa_freq_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buf) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + u32 freq; + +@@ -132,20 +137,22 @@ static ssize_t rpa_freq_show(struct device *dev, + + return sysfs_emit(buf, "%d\n", freq); + } +-static DEVICE_ATTR_RO(rpa_freq); ++static struct kobj_attribute attr_rpa_freq = __ATTR_RO(rpa_freq); + +-static ssize_t rpn_freq_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t rpn_freq_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buf) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + + return sysfs_emit(buf, "%d\n", xe_guc_pc_get_rpn_freq(pc)); + } +-static DEVICE_ATTR_RO(rpn_freq); ++static struct kobj_attribute attr_rpn_freq = __ATTR_RO(rpn_freq); + +-static ssize_t min_freq_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t min_freq_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buf) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + u32 freq; + ssize_t ret; +@@ -159,9 +166,10 @@ static ssize_t min_freq_show(struct device *dev, + return sysfs_emit(buf, "%d\n", freq); + } + +-static ssize_t min_freq_store(struct device *dev, struct device_attribute *attr, +- const char *buff, size_t count) ++static ssize_t min_freq_store(struct kobject *kobj, ++ struct kobj_attribute *attr, const char *buff, size_t count) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + u32 freq; + ssize_t ret; +@@ -178,11 +186,12 @@ static ssize_t min_freq_store(struct device *dev, struct device_attribute *attr, + + return count; + } +-static DEVICE_ATTR_RW(min_freq); ++static struct kobj_attribute attr_min_freq = __ATTR_RW(min_freq); + +-static ssize_t max_freq_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++static ssize_t max_freq_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buf) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + u32 freq; + ssize_t ret; +@@ -196,9 +205,10 @@ static ssize_t max_freq_show(struct device *dev, + return sysfs_emit(buf, "%d\n", freq); + } + +-static ssize_t max_freq_store(struct device *dev, struct device_attribute *attr, +- const char *buff, size_t count) ++static ssize_t max_freq_store(struct kobject *kobj, ++ struct kobj_attribute *attr, const char *buff, size_t count) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_guc_pc *pc = dev_to_pc(dev); + u32 freq; + ssize_t ret; +@@ -215,17 +225,17 @@ static ssize_t max_freq_store(struct device *dev, struct device_attribute *attr, + + return count; + } +-static DEVICE_ATTR_RW(max_freq); ++static struct kobj_attribute attr_max_freq = __ATTR_RW(max_freq); + + static const struct attribute *freq_attrs[] = { +- &dev_attr_act_freq.attr, +- &dev_attr_cur_freq.attr, +- &dev_attr_rp0_freq.attr, +- &dev_attr_rpa_freq.attr, +- &dev_attr_rpe_freq.attr, +- &dev_attr_rpn_freq.attr, +- &dev_attr_min_freq.attr, +- &dev_attr_max_freq.attr, ++ &attr_act_freq.attr, ++ &attr_cur_freq.attr, ++ &attr_rp0_freq.attr, ++ &attr_rpa_freq.attr, ++ &attr_rpe_freq.attr, ++ &attr_rpn_freq.attr, ++ &attr_min_freq.attr, ++ &attr_max_freq.attr, + NULL + }; + +diff --git a/drivers/gpu/drm/xe/xe_gt_idle.c b/drivers/gpu/drm/xe/xe_gt_idle.c +index fbbace7b0b12a..c11206410a4d4 100644 +--- a/drivers/gpu/drm/xe/xe_gt_idle.c ++++ b/drivers/gpu/drm/xe/xe_gt_idle.c +@@ -249,9 +249,10 @@ int xe_gt_idle_pg_print(struct xe_gt *gt, struct drm_printer *p) + return 0; + } + +-static ssize_t name_show(struct device *dev, +- struct device_attribute *attr, char *buff) ++static ssize_t name_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt_idle *gtidle = dev_to_gtidle(dev); + struct xe_guc_pc *pc = gtidle_to_pc(gtidle); + ssize_t ret; +@@ -262,11 +263,12 @@ static ssize_t name_show(struct device *dev, + + return ret; + } +-static DEVICE_ATTR_RO(name); ++static struct kobj_attribute name_attr = __ATTR_RO(name); + +-static ssize_t idle_status_show(struct device *dev, +- struct device_attribute *attr, char *buff) ++static ssize_t idle_status_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt_idle *gtidle = dev_to_gtidle(dev); + struct xe_guc_pc *pc = gtidle_to_pc(gtidle); + enum xe_gt_idle_state state; +@@ -277,6 +279,7 @@ static ssize_t idle_status_show(struct device *dev, + + return sysfs_emit(buff, "%s\n", gt_idle_state_to_string(state)); + } ++static struct kobj_attribute idle_status_attr = __ATTR_RO(idle_status); + + u64 xe_gt_idle_residency_msec(struct xe_gt_idle *gtidle) + { +@@ -291,10 +294,11 @@ u64 xe_gt_idle_residency_msec(struct xe_gt_idle *gtidle) + return residency; + } + +-static DEVICE_ATTR_RO(idle_status); +-static ssize_t idle_residency_ms_show(struct device *dev, +- struct device_attribute *attr, char *buff) ++ ++static ssize_t idle_residency_ms_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt_idle *gtidle = dev_to_gtidle(dev); + struct xe_guc_pc *pc = gtidle_to_pc(gtidle); + u64 residency; +@@ -305,12 +309,12 @@ static ssize_t idle_residency_ms_show(struct device *dev, + + return sysfs_emit(buff, "%llu\n", residency); + } +-static DEVICE_ATTR_RO(idle_residency_ms); ++static struct kobj_attribute idle_residency_attr = __ATTR_RO(idle_residency_ms); + + static const struct attribute *gt_idle_attrs[] = { +- &dev_attr_name.attr, +- &dev_attr_idle_status.attr, +- &dev_attr_idle_residency_ms.attr, ++ &name_attr.attr, ++ &idle_status_attr.attr, ++ &idle_residency_attr.attr, + NULL, + }; + +diff --git a/drivers/gpu/drm/xe/xe_gt_throttle.c b/drivers/gpu/drm/xe/xe_gt_throttle.c +index 8db78d616b6f2..aa962c783cdf7 100644 +--- a/drivers/gpu/drm/xe/xe_gt_throttle.c ++++ b/drivers/gpu/drm/xe/xe_gt_throttle.c +@@ -114,115 +114,115 @@ static u32 read_reason_vr_tdc(struct xe_gt *gt) + return tdc; + } + +-static ssize_t status_show(struct device *dev, +- struct device_attribute *attr, +- char *buff) ++static ssize_t status_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt *gt = dev_to_gt(dev); + bool status = !!read_status(gt); + + return sysfs_emit(buff, "%u\n", status); + } +-static DEVICE_ATTR_RO(status); ++static struct kobj_attribute attr_status = __ATTR_RO(status); + +-static ssize_t reason_pl1_show(struct device *dev, +- struct device_attribute *attr, +- char *buff) ++static ssize_t reason_pl1_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt *gt = dev_to_gt(dev); + bool pl1 = !!read_reason_pl1(gt); + + return sysfs_emit(buff, "%u\n", pl1); + } +-static DEVICE_ATTR_RO(reason_pl1); ++static struct kobj_attribute attr_reason_pl1 = __ATTR_RO(reason_pl1); + +-static ssize_t reason_pl2_show(struct device *dev, +- struct device_attribute *attr, +- char *buff) ++static ssize_t reason_pl2_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt *gt = dev_to_gt(dev); + bool pl2 = !!read_reason_pl2(gt); + + return sysfs_emit(buff, "%u\n", pl2); + } +-static DEVICE_ATTR_RO(reason_pl2); ++static struct kobj_attribute attr_reason_pl2 = __ATTR_RO(reason_pl2); + +-static ssize_t reason_pl4_show(struct device *dev, +- struct device_attribute *attr, +- char *buff) ++static ssize_t reason_pl4_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt *gt = dev_to_gt(dev); + bool pl4 = !!read_reason_pl4(gt); + + return sysfs_emit(buff, "%u\n", pl4); + } +-static DEVICE_ATTR_RO(reason_pl4); ++static struct kobj_attribute attr_reason_pl4 = __ATTR_RO(reason_pl4); + +-static ssize_t reason_thermal_show(struct device *dev, +- struct device_attribute *attr, +- char *buff) ++static ssize_t reason_thermal_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt *gt = dev_to_gt(dev); + bool thermal = !!read_reason_thermal(gt); + + return sysfs_emit(buff, "%u\n", thermal); + } +-static DEVICE_ATTR_RO(reason_thermal); ++static struct kobj_attribute attr_reason_thermal = __ATTR_RO(reason_thermal); + +-static ssize_t reason_prochot_show(struct device *dev, +- struct device_attribute *attr, +- char *buff) ++static ssize_t reason_prochot_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt *gt = dev_to_gt(dev); + bool prochot = !!read_reason_prochot(gt); + + return sysfs_emit(buff, "%u\n", prochot); + } +-static DEVICE_ATTR_RO(reason_prochot); ++static struct kobj_attribute attr_reason_prochot = __ATTR_RO(reason_prochot); + +-static ssize_t reason_ratl_show(struct device *dev, +- struct device_attribute *attr, +- char *buff) ++static ssize_t reason_ratl_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt *gt = dev_to_gt(dev); + bool ratl = !!read_reason_ratl(gt); + + return sysfs_emit(buff, "%u\n", ratl); + } +-static DEVICE_ATTR_RO(reason_ratl); ++static struct kobj_attribute attr_reason_ratl = __ATTR_RO(reason_ratl); + +-static ssize_t reason_vr_thermalert_show(struct device *dev, +- struct device_attribute *attr, +- char *buff) ++static ssize_t reason_vr_thermalert_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt *gt = dev_to_gt(dev); + bool thermalert = !!read_reason_vr_thermalert(gt); + + return sysfs_emit(buff, "%u\n", thermalert); + } +-static DEVICE_ATTR_RO(reason_vr_thermalert); ++static struct kobj_attribute attr_reason_vr_thermalert = __ATTR_RO(reason_vr_thermalert); + +-static ssize_t reason_vr_tdc_show(struct device *dev, +- struct device_attribute *attr, +- char *buff) ++static ssize_t reason_vr_tdc_show(struct kobject *kobj, ++ struct kobj_attribute *attr, char *buff) + { ++ struct device *dev = kobj_to_dev(kobj); + struct xe_gt *gt = dev_to_gt(dev); + bool tdc = !!read_reason_vr_tdc(gt); + + return sysfs_emit(buff, "%u\n", tdc); + } +-static DEVICE_ATTR_RO(reason_vr_tdc); ++static struct kobj_attribute attr_reason_vr_tdc = __ATTR_RO(reason_vr_tdc); + + static struct attribute *throttle_attrs[] = { +- &dev_attr_status.attr, +- &dev_attr_reason_pl1.attr, +- &dev_attr_reason_pl2.attr, +- &dev_attr_reason_pl4.attr, +- &dev_attr_reason_thermal.attr, +- &dev_attr_reason_prochot.attr, +- &dev_attr_reason_ratl.attr, +- &dev_attr_reason_vr_thermalert.attr, +- &dev_attr_reason_vr_tdc.attr, ++ &attr_status.attr, ++ &attr_reason_pl1.attr, ++ &attr_reason_pl2.attr, ++ &attr_reason_pl4.attr, ++ &attr_reason_thermal.attr, ++ &attr_reason_prochot.attr, ++ &attr_reason_ratl.attr, ++ &attr_reason_vr_thermalert.attr, ++ &attr_reason_vr_tdc.attr, + NULL + }; + +-- +2.39.5 + diff --git a/queue-6.15/drm-xe-uc-remove-static-from-loop-variable.patch b/queue-6.15/drm-xe-uc-remove-static-from-loop-variable.patch new file mode 100644 index 0000000000..9f4869052e --- /dev/null +++ b/queue-6.15/drm-xe-uc-remove-static-from-loop-variable.patch @@ -0,0 +1,37 @@ +From e7ddfa1b26a1cd7952ff1e8dc753b862c323e5a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Mar 2025 10:13:21 -0800 +Subject: drm/xe/uc: Remove static from loop variable + +From: Lucas De Marchi + +[ Upstream commit 75584c8213d341ddd5b7c72abf822e62f4b3ab27 ] + +The `entries` variable is used to loop through the array - it's supposed +to be const, but not static. + +Reviewed-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20250307-xe-per-gt-fw-v1-1-459574d76400@intel.com +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_uc_fw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_uc_fw.c b/drivers/gpu/drm/xe/xe_uc_fw.c +index fb0eda3d56829..b553079ae3d64 100644 +--- a/drivers/gpu/drm/xe/xe_uc_fw.c ++++ b/drivers/gpu/drm/xe/xe_uc_fw.c +@@ -222,8 +222,8 @@ uc_fw_auto_select(struct xe_device *xe, struct xe_uc_fw *uc_fw) + [XE_UC_FW_TYPE_HUC] = { entries_huc, ARRAY_SIZE(entries_huc) }, + [XE_UC_FW_TYPE_GSC] = { entries_gsc, ARRAY_SIZE(entries_gsc) }, + }; +- static const struct uc_fw_entry *entries; + enum xe_platform p = xe->info.platform; ++ const struct uc_fw_entry *entries; + u32 count; + int i; + +-- +2.39.5 + diff --git a/queue-6.15/drm-xe-use-copy_from_user-instead-of-__copy_from_use.patch b/queue-6.15/drm-xe-use-copy_from_user-instead-of-__copy_from_use.patch new file mode 100644 index 0000000000..5ea49240d9 --- /dev/null +++ b/queue-6.15/drm-xe-use-copy_from_user-instead-of-__copy_from_use.patch @@ -0,0 +1,172 @@ +From 39f432e0fbfb312af2f19b16453e3450f7b4d805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 May 2025 12:14:45 -0700 +Subject: drm/xe: Use copy_from_user() instead of __copy_from_user() + +From: Harish Chegondi + +[ Upstream commit aef87a5fdb5117eafb498ac4fc25e9f26f630f45 ] + +copy_from_user() has more checks and is more safer than +__copy_from_user() + +Suggested-by: Kees Cook +Signed-off-by: Harish Chegondi +Reviewed-by: Matthew Brost +Reviewed-by: Ashutosh Dixit +Signed-off-by: Ashutosh Dixit +Link: https://lore.kernel.org/r/acabf20aa8621c7bc8de09b1bffb8d14b5376484.1746126614.git.harish.chegondi@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_bo.c | 4 ++-- + drivers/gpu/drm/xe/xe_eu_stall.c | 4 ++-- + drivers/gpu/drm/xe/xe_exec.c | 4 ++-- + drivers/gpu/drm/xe/xe_exec_queue.c | 9 ++++----- + drivers/gpu/drm/xe/xe_oa.c | 6 +++--- + drivers/gpu/drm/xe/xe_vm.c | 6 +++--- + 6 files changed, 16 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c +index 5922302c3e00c..2c9d57cf8d533 100644 +--- a/drivers/gpu/drm/xe/xe_bo.c ++++ b/drivers/gpu/drm/xe/xe_bo.c +@@ -2408,7 +2408,7 @@ static int gem_create_user_ext_set_property(struct xe_device *xe, + int err; + u32 idx; + +- err = __copy_from_user(&ext, address, sizeof(ext)); ++ err = copy_from_user(&ext, address, sizeof(ext)); + if (XE_IOCTL_DBG(xe, err)) + return -EFAULT; + +@@ -2445,7 +2445,7 @@ static int gem_create_user_extensions(struct xe_device *xe, struct xe_bo *bo, + if (XE_IOCTL_DBG(xe, ext_number >= MAX_USER_EXTENSIONS)) + return -E2BIG; + +- err = __copy_from_user(&ext, address, sizeof(ext)); ++ err = copy_from_user(&ext, address, sizeof(ext)); + if (XE_IOCTL_DBG(xe, err)) + return -EFAULT; + +diff --git a/drivers/gpu/drm/xe/xe_eu_stall.c b/drivers/gpu/drm/xe/xe_eu_stall.c +index e2bb156c71fb0..96732613b4b7d 100644 +--- a/drivers/gpu/drm/xe/xe_eu_stall.c ++++ b/drivers/gpu/drm/xe/xe_eu_stall.c +@@ -283,7 +283,7 @@ static int xe_eu_stall_user_ext_set_property(struct xe_device *xe, u64 extension + int err; + u32 idx; + +- err = __copy_from_user(&ext, address, sizeof(ext)); ++ err = copy_from_user(&ext, address, sizeof(ext)); + if (XE_IOCTL_DBG(xe, err)) + return -EFAULT; + +@@ -313,7 +313,7 @@ static int xe_eu_stall_user_extensions(struct xe_device *xe, u64 extension, + if (XE_IOCTL_DBG(xe, ext_number >= MAX_USER_EXTENSIONS)) + return -E2BIG; + +- err = __copy_from_user(&ext, address, sizeof(ext)); ++ err = copy_from_user(&ext, address, sizeof(ext)); + if (XE_IOCTL_DBG(xe, err)) + return -EFAULT; + +diff --git a/drivers/gpu/drm/xe/xe_exec.c b/drivers/gpu/drm/xe/xe_exec.c +index b75adfc99fb7c..44364c042ad72 100644 +--- a/drivers/gpu/drm/xe/xe_exec.c ++++ b/drivers/gpu/drm/xe/xe_exec.c +@@ -176,8 +176,8 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file) + } + + if (xe_exec_queue_is_parallel(q)) { +- err = __copy_from_user(addresses, addresses_user, sizeof(u64) * +- q->width); ++ err = copy_from_user(addresses, addresses_user, sizeof(u64) * ++ q->width); + if (err) { + err = -EFAULT; + goto err_syncs; +diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c +index cd9b1c32f30f8..ce78cee5dec68 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue.c ++++ b/drivers/gpu/drm/xe/xe_exec_queue.c +@@ -479,7 +479,7 @@ static int exec_queue_user_ext_set_property(struct xe_device *xe, + int err; + u32 idx; + +- err = __copy_from_user(&ext, address, sizeof(ext)); ++ err = copy_from_user(&ext, address, sizeof(ext)); + if (XE_IOCTL_DBG(xe, err)) + return -EFAULT; + +@@ -518,7 +518,7 @@ static int exec_queue_user_extensions(struct xe_device *xe, struct xe_exec_queue + if (XE_IOCTL_DBG(xe, ext_number >= MAX_USER_EXTENSIONS)) + return -E2BIG; + +- err = __copy_from_user(&ext, address, sizeof(ext)); ++ err = copy_from_user(&ext, address, sizeof(ext)); + if (XE_IOCTL_DBG(xe, err)) + return -EFAULT; + +@@ -618,9 +618,8 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data, + if (XE_IOCTL_DBG(xe, !len || len > XE_HW_ENGINE_MAX_INSTANCE)) + return -EINVAL; + +- err = __copy_from_user(eci, user_eci, +- sizeof(struct drm_xe_engine_class_instance) * +- len); ++ err = copy_from_user(eci, user_eci, ++ sizeof(struct drm_xe_engine_class_instance) * len); + if (XE_IOCTL_DBG(xe, err)) + return -EFAULT; + +diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c +index 7ffc98f67e696..777ec6613abda 100644 +--- a/drivers/gpu/drm/xe/xe_oa.c ++++ b/drivers/gpu/drm/xe/xe_oa.c +@@ -1301,7 +1301,7 @@ static int xe_oa_user_ext_set_property(struct xe_oa *oa, enum xe_oa_user_extn_fr + int err; + u32 idx; + +- err = __copy_from_user(&ext, address, sizeof(ext)); ++ err = copy_from_user(&ext, address, sizeof(ext)); + if (XE_IOCTL_DBG(oa->xe, err)) + return -EFAULT; + +@@ -1338,7 +1338,7 @@ static int xe_oa_user_extensions(struct xe_oa *oa, enum xe_oa_user_extn_from fro + if (XE_IOCTL_DBG(oa->xe, ext_number >= MAX_USER_EXTENSIONS)) + return -E2BIG; + +- err = __copy_from_user(&ext, address, sizeof(ext)); ++ err = copy_from_user(&ext, address, sizeof(ext)); + if (XE_IOCTL_DBG(oa->xe, err)) + return -EFAULT; + +@@ -2280,7 +2280,7 @@ int xe_oa_add_config_ioctl(struct drm_device *dev, u64 data, struct drm_file *fi + return -EACCES; + } + +- err = __copy_from_user(¶m, u64_to_user_ptr(data), sizeof(param)); ++ err = copy_from_user(¶m, u64_to_user_ptr(data), sizeof(param)); + if (XE_IOCTL_DBG(oa->xe, err)) + return -EFAULT; + +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index 737172013a8f9..cc1ae8ba9bb75 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -3087,9 +3087,9 @@ static int vm_bind_ioctl_check_args(struct xe_device *xe, struct xe_vm *vm, + if (!*bind_ops) + return args->num_binds > 1 ? -ENOBUFS : -ENOMEM; + +- err = __copy_from_user(*bind_ops, bind_user, +- sizeof(struct drm_xe_vm_bind_op) * +- args->num_binds); ++ err = copy_from_user(*bind_ops, bind_user, ++ sizeof(struct drm_xe_vm_bind_op) * ++ args->num_binds); + if (XE_IOCTL_DBG(xe, err)) { + err = -EFAULT; + goto free_bind_ops; +-- +2.39.5 + diff --git a/queue-6.15/drm-xe-vf-fix-guc_info-debugfs-for-vfs.patch b/queue-6.15/drm-xe-vf-fix-guc_info-debugfs-for-vfs.patch new file mode 100644 index 0000000000..33928c1bf2 --- /dev/null +++ b/queue-6.15/drm-xe-vf-fix-guc_info-debugfs-for-vfs.patch @@ -0,0 +1,84 @@ +From 39aaf1d141ed01327251d249651e3429ed02e071 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 10:39:08 -0700 +Subject: drm/xe/vf: Fix guc_info debugfs for VFs + +From: Daniele Ceraolo Spurio + +[ Upstream commit dba7d17d50b4488c697e991d18a0e55669d9fa59 ] + +The guc_info debugfs attempts to read a bunch of registers that the VFs +doesn't have access to, so fix it by skipping the reads. + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4775 +Signed-off-by: Daniele Ceraolo Spurio +Cc: Michal Wajdeczko +Cc: Lukasz Laguna +Reviewed-by: Lukasz Laguna +Link: https://lore.kernel.org/r/20250423173908.1571412-1-daniele.ceraolospurio@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc.c | 44 +++++++++++++++++++------------------ + 1 file changed, 23 insertions(+), 21 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c +index bc5714a5b36b2..f082be4af4cff 100644 +--- a/drivers/gpu/drm/xe/xe_guc.c ++++ b/drivers/gpu/drm/xe/xe_guc.c +@@ -1508,30 +1508,32 @@ void xe_guc_print_info(struct xe_guc *guc, struct drm_printer *p) + + xe_uc_fw_print(&guc->fw, p); + +- fw_ref = xe_force_wake_get(gt_to_fw(gt), XE_FW_GT); +- if (!fw_ref) +- return; ++ if (!IS_SRIOV_VF(gt_to_xe(gt))) { ++ fw_ref = xe_force_wake_get(gt_to_fw(gt), XE_FW_GT); ++ if (!fw_ref) ++ return; ++ ++ status = xe_mmio_read32(>->mmio, GUC_STATUS); ++ ++ drm_printf(p, "\nGuC status 0x%08x:\n", status); ++ drm_printf(p, "\tBootrom status = 0x%x\n", ++ REG_FIELD_GET(GS_BOOTROM_MASK, status)); ++ drm_printf(p, "\tuKernel status = 0x%x\n", ++ REG_FIELD_GET(GS_UKERNEL_MASK, status)); ++ drm_printf(p, "\tMIA Core status = 0x%x\n", ++ REG_FIELD_GET(GS_MIA_MASK, status)); ++ drm_printf(p, "\tLog level = %d\n", ++ xe_guc_log_get_level(&guc->log)); ++ ++ drm_puts(p, "\nScratch registers:\n"); ++ for (i = 0; i < SOFT_SCRATCH_COUNT; i++) { ++ drm_printf(p, "\t%2d: \t0x%x\n", ++ i, xe_mmio_read32(>->mmio, SOFT_SCRATCH(i))); ++ } + +- status = xe_mmio_read32(>->mmio, GUC_STATUS); +- +- drm_printf(p, "\nGuC status 0x%08x:\n", status); +- drm_printf(p, "\tBootrom status = 0x%x\n", +- REG_FIELD_GET(GS_BOOTROM_MASK, status)); +- drm_printf(p, "\tuKernel status = 0x%x\n", +- REG_FIELD_GET(GS_UKERNEL_MASK, status)); +- drm_printf(p, "\tMIA Core status = 0x%x\n", +- REG_FIELD_GET(GS_MIA_MASK, status)); +- drm_printf(p, "\tLog level = %d\n", +- xe_guc_log_get_level(&guc->log)); +- +- drm_puts(p, "\nScratch registers:\n"); +- for (i = 0; i < SOFT_SCRATCH_COUNT; i++) { +- drm_printf(p, "\t%2d: \t0x%x\n", +- i, xe_mmio_read32(>->mmio, SOFT_SCRATCH(i))); ++ xe_force_wake_put(gt_to_fw(gt), fw_ref); + } + +- xe_force_wake_put(gt_to_fw(gt), fw_ref); +- + drm_puts(p, "\n"); + xe_guc_ct_print(&guc->ct, p, false); + +-- +2.39.5 + diff --git a/queue-6.15/edac-igen6-skip-absent-memory-controllers.patch b/queue-6.15/edac-igen6-skip-absent-memory-controllers.patch new file mode 100644 index 0000000000..94f06b7f6e --- /dev/null +++ b/queue-6.15/edac-igen6-skip-absent-memory-controllers.patch @@ -0,0 +1,159 @@ +From c9babac8ac8b47fafcea01068111252ca42641d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 21:24:53 +0800 +Subject: EDAC/igen6: Skip absent memory controllers + +From: Qiuxu Zhuo + +[ Upstream commit 20e190b1c1fd88b21cc5106c12cfe6def5ab849d ] + +Some BIOS versions may fuse off certain memory controllers and set the +registers of these absent memory controllers to ~0. The current igen6_edac +mistakenly enumerates these absent memory controllers and registers them +with the EDAC core. + +Skip the absent memory controllers to avoid mistakenly enumerating them. + +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/r/20250408132455.489046-2-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/igen6_edac.c | 78 +++++++++++++++++++++++++++++++-------- + 1 file changed, 62 insertions(+), 16 deletions(-) + +diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c +index 5807517ee32de..ec64bff8236f6 100644 +--- a/drivers/edac/igen6_edac.c ++++ b/drivers/edac/igen6_edac.c +@@ -127,6 +127,7 @@ + + static const struct res_config { + bool machine_check; ++ /* The number of present memory controllers. */ + int num_imc; + u32 imc_base; + u32 cmf_base; +@@ -1201,23 +1202,21 @@ static void igen6_check(struct mem_ctl_info *mci) + irq_work_queue(&ecclog_irq_work); + } + +-static int igen6_register_mci(int mc, u64 mchbar, struct pci_dev *pdev) ++/* Check whether the memory controller is absent. */ ++static bool igen6_imc_absent(void __iomem *window) ++{ ++ return readl(window + MAD_INTER_CHANNEL_OFFSET) == ~0; ++} ++ ++static int igen6_register_mci(int mc, void __iomem *window, struct pci_dev *pdev) + { + struct edac_mc_layer layers[2]; + struct mem_ctl_info *mci; + struct igen6_imc *imc; +- void __iomem *window; + int rc; + + edac_dbg(2, "\n"); + +- mchbar += mc * MCHBAR_SIZE; +- window = ioremap(mchbar, MCHBAR_SIZE); +- if (!window) { +- igen6_printk(KERN_ERR, "Failed to ioremap 0x%llx\n", mchbar); +- return -ENODEV; +- } +- + layers[0].type = EDAC_MC_LAYER_CHANNEL; + layers[0].size = NUM_CHANNELS; + layers[0].is_virt_csrow = false; +@@ -1283,7 +1282,6 @@ static int igen6_register_mci(int mc, u64 mchbar, struct pci_dev *pdev) + fail2: + edac_mc_free(mci); + fail: +- iounmap(window); + return rc; + } + +@@ -1309,6 +1307,56 @@ static void igen6_unregister_mcis(void) + } + } + ++static int igen6_register_mcis(struct pci_dev *pdev, u64 mchbar) ++{ ++ void __iomem *window; ++ int lmc, pmc, rc; ++ u64 base; ++ ++ for (lmc = 0, pmc = 0; pmc < NUM_IMC; pmc++) { ++ base = mchbar + pmc * MCHBAR_SIZE; ++ window = ioremap(base, MCHBAR_SIZE); ++ if (!window) { ++ igen6_printk(KERN_ERR, "Failed to ioremap 0x%llx for mc%d\n", base, pmc); ++ rc = -ENOMEM; ++ goto out_unregister_mcis; ++ } ++ ++ if (igen6_imc_absent(window)) { ++ iounmap(window); ++ edac_dbg(2, "Skip absent mc%d\n", pmc); ++ continue; ++ } ++ ++ rc = igen6_register_mci(lmc, window, pdev); ++ if (rc) ++ goto out_iounmap; ++ ++ /* Done, if all present MCs are detected and registered. */ ++ if (++lmc >= res_cfg->num_imc) ++ break; ++ } ++ ++ if (!lmc) { ++ igen6_printk(KERN_ERR, "No mc found.\n"); ++ return -ENODEV; ++ } ++ ++ if (lmc < res_cfg->num_imc) ++ igen6_printk(KERN_WARNING, "Expected %d mcs, but only %d detected.", ++ res_cfg->num_imc, lmc); ++ ++ return 0; ++ ++out_iounmap: ++ iounmap(window); ++ ++out_unregister_mcis: ++ igen6_unregister_mcis(); ++ ++ return rc; ++} ++ + static int igen6_mem_slice_setup(u64 mchbar) + { + struct igen6_imc *imc = &igen6_pvt->imc[0]; +@@ -1405,7 +1453,7 @@ static void opstate_set(const struct res_config *cfg, const struct pci_device_id + static int igen6_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + u64 mchbar; +- int i, rc; ++ int rc; + + edac_dbg(2, "\n"); + +@@ -1421,11 +1469,9 @@ static int igen6_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + opstate_set(res_cfg, ent); + +- for (i = 0; i < res_cfg->num_imc; i++) { +- rc = igen6_register_mci(i, mchbar, pdev); +- if (rc) +- goto fail2; +- } ++ rc = igen6_register_mcis(pdev, mchbar); ++ if (rc) ++ goto fail; + + if (res_cfg->num_imc > 1) { + rc = igen6_mem_slice_setup(mchbar); +-- +2.39.5 + diff --git a/queue-6.15/emulex-benet-correct-command-version-selection-in-be.patch b/queue-6.15/emulex-benet-correct-command-version-selection-in-be.patch new file mode 100644 index 0000000000..673d1b5d5a --- /dev/null +++ b/queue-6.15/emulex-benet-correct-command-version-selection-in-be.patch @@ -0,0 +1,39 @@ +From 86b4d155edab99feb909d059d9e544564816202b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 May 2025 07:17:19 -0700 +Subject: emulex/benet: correct command version selection in be_cmd_get_stats() + +From: Alok Tiwari + +[ Upstream commit edb888d29748cee674006a52e544925dacc7728e ] + +Logic here always sets hdr->version to 2 if it is not a BE3 or Lancer chip, +even if it is BE2. Use 'else if' to prevent multiple assignments, setting +version 0 for BE2, version 1 for BE3 and Lancer, and version 2 for others. +Fixes potential incorrect version setting when BE2_chip and +BE3_chip/lancer_chip checks could both be true. + +Signed-off-by: Alok Tiwari +Link: https://patch.msgid.link/20250519141731.691136-1-alok.a.tiwari@oracle.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c +index 51b8377edd1d0..a89aa4ac0a064 100644 +--- a/drivers/net/ethernet/emulex/benet/be_cmds.c ++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c +@@ -1609,7 +1609,7 @@ int be_cmd_get_stats(struct be_adapter *adapter, struct be_dma_mem *nonemb_cmd) + /* version 1 of the cmd is not supported only by BE2 */ + if (BE2_chip(adapter)) + hdr->version = 0; +- if (BE3_chip(adapter) || lancer_chip(adapter)) ++ else if (BE3_chip(adapter) || lancer_chip(adapter)) + hdr->version = 1; + else + hdr->version = 2; +-- +2.39.5 + diff --git a/queue-6.15/exfat-do-not-clear-volume-dirty-flag-during-sync.patch b/queue-6.15/exfat-do-not-clear-volume-dirty-flag-during-sync.patch new file mode 100644 index 0000000000..52457fe7a1 --- /dev/null +++ b/queue-6.15/exfat-do-not-clear-volume-dirty-flag-during-sync.patch @@ -0,0 +1,99 @@ +From 49be9ae259dfd83ec65464a48094159a27bd93ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 17:26:14 -0600 +Subject: exfat: do not clear volume dirty flag during sync + +From: Yuezhang Mo + +[ Upstream commit 46a557694b464881b3c2c4a0ba389a6436419a37 ] + +xfstests generic/482 tests the file system consistency after each +FUA operation. It fails when run on exfat. + +exFAT clears the volume dirty flag with a FUA operation during sync. +Since s_lock is not held when data is being written to a file, sync +can be executed at the same time. When data is being written to a +file, the FAT chain is updated first, and then the file size is +updated. If sync is executed between updating them, the length of the +FAT chain may be inconsistent with the file size. + +To avoid the situation where the file system is inconsistent but the +volume dirty flag is cleared, this commit moves the clearing of the +volume dirty flag from exfat_fs_sync() to exfat_put_super(), so that +the volume dirty flag is not cleared until unmounting. After the +move, there is no additional action during sync, so exfat_fs_sync() +can be deleted. + +Reviewed-by: Sungjong Seo +Signed-off-by: Yuezhang Mo +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/super.c | 30 +++++++----------------------- + 1 file changed, 7 insertions(+), 23 deletions(-) + +diff --git a/fs/exfat/super.c b/fs/exfat/super.c +index 8465033a6cf0c..7ed858937d45d 100644 +--- a/fs/exfat/super.c ++++ b/fs/exfat/super.c +@@ -36,31 +36,12 @@ static void exfat_put_super(struct super_block *sb) + struct exfat_sb_info *sbi = EXFAT_SB(sb); + + mutex_lock(&sbi->s_lock); ++ exfat_clear_volume_dirty(sb); + exfat_free_bitmap(sbi); + brelse(sbi->boot_bh); + mutex_unlock(&sbi->s_lock); + } + +-static int exfat_sync_fs(struct super_block *sb, int wait) +-{ +- struct exfat_sb_info *sbi = EXFAT_SB(sb); +- int err = 0; +- +- if (unlikely(exfat_forced_shutdown(sb))) +- return 0; +- +- if (!wait) +- return 0; +- +- /* If there are some dirty buffers in the bdev inode */ +- mutex_lock(&sbi->s_lock); +- sync_blockdev(sb->s_bdev); +- if (exfat_clear_volume_dirty(sb)) +- err = -EIO; +- mutex_unlock(&sbi->s_lock); +- return err; +-} +- + static int exfat_statfs(struct dentry *dentry, struct kstatfs *buf) + { + struct super_block *sb = dentry->d_sb; +@@ -219,7 +200,6 @@ static const struct super_operations exfat_sops = { + .write_inode = exfat_write_inode, + .evict_inode = exfat_evict_inode, + .put_super = exfat_put_super, +- .sync_fs = exfat_sync_fs, + .statfs = exfat_statfs, + .show_options = exfat_show_options, + .shutdown = exfat_shutdown, +@@ -751,10 +731,14 @@ static void exfat_free(struct fs_context *fc) + + static int exfat_reconfigure(struct fs_context *fc) + { ++ struct super_block *sb = fc->root->d_sb; + fc->sb_flags |= SB_NODIRATIME; + +- /* volume flag will be updated in exfat_sync_fs */ +- sync_filesystem(fc->root->d_sb); ++ sync_filesystem(sb); ++ mutex_lock(&EXFAT_SB(sb)->s_lock); ++ exfat_clear_volume_dirty(sb); ++ mutex_unlock(&EXFAT_SB(sb)->s_lock); ++ + return 0; + } + +-- +2.39.5 + diff --git a/queue-6.15/exfat-fix-double-free-in-delayed_free.patch b/queue-6.15/exfat-fix-double-free-in-delayed_free.patch new file mode 100644 index 0000000000..b1fcf80c1c --- /dev/null +++ b/queue-6.15/exfat-fix-double-free-in-delayed_free.patch @@ -0,0 +1,40 @@ +From 0d7b7b1760375d8ef551a041fa4514f24698a478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 13:50:39 +0900 +Subject: exfat: fix double free in delayed_free + +From: Namjae Jeon + +[ Upstream commit 1f3d9724e16d62c7d42c67d6613b8512f2887c22 ] + +The double free could happen in the following path. + +exfat_create_upcase_table() + exfat_create_upcase_table() : return error + exfat_free_upcase_table() : free ->vol_utbl + exfat_load_default_upcase_table : return error + exfat_kill_sb() + delayed_free() + exfat_free_upcase_table() <--------- double free +This patch set ->vol_util as NULL after freeing it. + +Reported-by: Jianzhou Zhao +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/nls.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c +index d47896a895965..1729bf42eb516 100644 +--- a/fs/exfat/nls.c ++++ b/fs/exfat/nls.c +@@ -801,4 +801,5 @@ int exfat_create_upcase_table(struct super_block *sb) + void exfat_free_upcase_table(struct exfat_sb_info *sbi) + { + kvfree(sbi->vol_utbl); ++ sbi->vol_utbl = NULL; + } +-- +2.39.5 + diff --git a/queue-6.15/ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch b/queue-6.15/ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch new file mode 100644 index 0000000000..ca7392e368 --- /dev/null +++ b/queue-6.15/ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch @@ -0,0 +1,108 @@ +From 7eb5ae3ff7579293221d1562481f19cd8f8580a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 16:52:49 +0800 +Subject: ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in + ext4_ext_remove_space() + +From: Zhang Yi + +[ Upstream commit 53ce42accd2002cc490fc86000ac532530507a74 ] + +When removing space, we should use EXT4_EX_NOCACHE because we don't +need to cache extents, and we should also use EXT4_EX_NOFAIL to prevent +metadata inconsistencies that may arise from memory allocation failures. +While ext4_ext_remove_space() already uses these two flags in most +places, they are missing in ext4_ext_search_right() and +read_extent_tree_block() calls. Unify the flags to ensure consistent +behavior throughout the extent removal process. + +Signed-off-by: Zhang Yi +Link: https://patch.msgid.link/20250423085257.122685-2-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index ad19b10ea11d3..81e010a6c797c 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -1530,7 +1530,7 @@ static int ext4_ext_search_left(struct inode *inode, + static int ext4_ext_search_right(struct inode *inode, + struct ext4_ext_path *path, + ext4_lblk_t *logical, ext4_fsblk_t *phys, +- struct ext4_extent *ret_ex) ++ struct ext4_extent *ret_ex, int flags) + { + struct buffer_head *bh = NULL; + struct ext4_extent_header *eh; +@@ -1604,7 +1604,8 @@ static int ext4_ext_search_right(struct inode *inode, + ix++; + while (++depth < path->p_depth) { + /* subtract from p_depth to get proper eh_depth */ +- bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0); ++ bh = read_extent_tree_block(inode, ix, path->p_depth - depth, ++ flags); + if (IS_ERR(bh)) + return PTR_ERR(bh); + eh = ext_block_hdr(bh); +@@ -1612,7 +1613,7 @@ static int ext4_ext_search_right(struct inode *inode, + put_bh(bh); + } + +- bh = read_extent_tree_block(inode, ix, path->p_depth - depth, 0); ++ bh = read_extent_tree_block(inode, ix, path->p_depth - depth, flags); + if (IS_ERR(bh)) + return PTR_ERR(bh); + eh = ext_block_hdr(bh); +@@ -2822,6 +2823,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start, + struct partial_cluster partial; + handle_t *handle; + int i = 0, err = 0; ++ int flags = EXT4_EX_NOCACHE | EXT4_EX_NOFAIL; + + partial.pclu = 0; + partial.lblk = 0; +@@ -2852,8 +2854,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start, + ext4_fsblk_t pblk; + + /* find extent for or closest extent to this block */ +- path = ext4_find_extent(inode, end, NULL, +- EXT4_EX_NOCACHE | EXT4_EX_NOFAIL); ++ path = ext4_find_extent(inode, end, NULL, flags); + if (IS_ERR(path)) { + ext4_journal_stop(handle); + return PTR_ERR(path); +@@ -2919,7 +2920,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start, + */ + lblk = ex_end + 1; + err = ext4_ext_search_right(inode, path, &lblk, &pblk, +- NULL); ++ NULL, flags); + if (err < 0) + goto out; + if (pblk) { +@@ -2995,8 +2996,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start, + i + 1, ext4_idx_pblock(path[i].p_idx)); + memset(path + i + 1, 0, sizeof(*path)); + bh = read_extent_tree_block(inode, path[i].p_idx, +- depth - i - 1, +- EXT4_EX_NOCACHE); ++ depth - i - 1, flags); + if (IS_ERR(bh)) { + /* should we reset i_size? */ + err = PTR_ERR(bh); +@@ -4315,7 +4315,8 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, + if (err) + goto out; + ar.lright = map->m_lblk; +- err = ext4_ext_search_right(inode, path, &ar.lright, &ar.pright, &ex2); ++ err = ext4_ext_search_right(inode, path, &ar.lright, &ar.pright, ++ &ex2, 0); + if (err < 0) + goto out; + +-- +2.39.5 + diff --git a/queue-6.15/ext4-prevent-stale-extent-cache-entries-caused-by-co.patch b/queue-6.15/ext4-prevent-stale-extent-cache-entries-caused-by-co.patch new file mode 100644 index 0000000000..a6fd505b1f --- /dev/null +++ b/queue-6.15/ext4-prevent-stale-extent-cache-entries-caused-by-co.patch @@ -0,0 +1,73 @@ +From 3e2847126c93608d933cb532865089b12b0b2bd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 16:52:53 +0800 +Subject: ext4: prevent stale extent cache entries caused by concurrent get + es_cache + +From: Zhang Yi + +[ Upstream commit f22a0ef2231a7d8374bb021eb86404d0e9de5a02 ] + +The EXT4_IOC_GET_ES_CACHE and EXT4_IOC_PRECACHE_EXTENTS currently +invokes ext4_ext_precache() to preload the extent cache without holding +the inode's i_rwsem. This can result in stale extent cache entries when +competing with operations such as ext4_collapse_range() which calls +ext4_ext_remove_space() or ext4_ext_shift_extents(). + +The problem arises when ext4_ext_remove_space() temporarily releases +i_data_sem due to insufficient journal credits. During this interval, a +concurrent EXT4_IOC_GET_ES_CACHE or EXT4_IOC_PRECACHE_EXTENTS may cache +extent entries that are about to be deleted. As a result, these cached +entries become stale and inconsistent with the actual extents. + +Loading the extents cache without holding the inode's i_rwsem or the +mapping's invalidate_lock is not permitted besides during the writeback. +Fix this by holding the i_rwsem during EXT4_IOC_GET_ES_CACHE and +EXT4_IOC_PRECACHE_EXTENTS. + +Signed-off-by: Zhang Yi +Link: https://patch.msgid.link/20250423085257.122685-6-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 2 ++ + fs/ext4/ioctl.c | 8 +++++++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 81e010a6c797c..828a78a9600a8 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -4996,7 +4996,9 @@ int ext4_get_es_cache(struct inode *inode, struct fiemap_extent_info *fieinfo, + } + + if (fieinfo->fi_flags & FIEMAP_FLAG_CACHE) { ++ inode_lock_shared(inode); + error = ext4_ext_precache(inode); ++ inode_unlock_shared(inode); + if (error) + return error; + fieinfo->fi_flags &= ~FIEMAP_FLAG_CACHE; +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index d17207386ead1..0e240013c84d2 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -1505,8 +1505,14 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + return 0; + } + case EXT4_IOC_PRECACHE_EXTENTS: +- return ext4_ext_precache(inode); ++ { ++ int ret; + ++ inode_lock_shared(inode); ++ ret = ext4_ext_precache(inode); ++ inode_unlock_shared(inode); ++ return ret; ++ } + case FS_IOC_SET_ENCRYPTION_POLICY: + if (!ext4_has_feature_encrypt(sb)) + return -EOPNOTSUPP; +-- +2.39.5 + diff --git a/queue-6.15/f2fs-fix-to-bail-out-in-get_new_segment.patch b/queue-6.15/f2fs-fix-to-bail-out-in-get_new_segment.patch new file mode 100644 index 0000000000..17e14660a7 --- /dev/null +++ b/queue-6.15/f2fs-fix-to-bail-out-in-get_new_segment.patch @@ -0,0 +1,69 @@ +From cb450c9dcc2ac2fc7b8316b139ddfbe283aa260f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 19:56:38 +0800 +Subject: f2fs: fix to bail out in get_new_segment() + +From: Chao Yu + +[ Upstream commit bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2 ] + +------------[ cut here ]------------ +WARNING: CPU: 3 PID: 579 at fs/f2fs/segment.c:2832 new_curseg+0x5e8/0x6dc +pc : new_curseg+0x5e8/0x6dc +Call trace: + new_curseg+0x5e8/0x6dc + f2fs_allocate_data_block+0xa54/0xe28 + do_write_page+0x6c/0x194 + f2fs_do_write_node_page+0x38/0x78 + __write_node_page+0x248/0x6d4 + f2fs_sync_node_pages+0x524/0x72c + f2fs_write_checkpoint+0x4bc/0x9b0 + __checkpoint_and_complete_reqs+0x80/0x244 + issue_checkpoint_thread+0x8c/0xec + kthread+0x114/0x1bc + ret_from_fork+0x10/0x20 + +get_new_segment() detects inconsistent status in between free_segmap +and free_secmap, let's record such error into super block, and bail +out get_new_segment() instead of continue using the segment. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 6 +++++- + include/linux/f2fs_fs.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 41ca73622c8d4..c5d29c58f3d3e 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -2836,7 +2836,11 @@ static int get_new_segment(struct f2fs_sb_info *sbi, + } + got_it: + /* set it as dirty segment in free segmap */ +- f2fs_bug_on(sbi, test_bit(segno, free_i->free_segmap)); ++ if (test_bit(segno, free_i->free_segmap)) { ++ ret = -EFSCORRUPTED; ++ f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_CORRUPTED_FREE_BITMAP); ++ goto out_unlock; ++ } + + /* no free section in conventional device or conventional zone */ + if (new_sec && pinning && +diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h +index c24f8bc01045d..5206d63b33860 100644 +--- a/include/linux/f2fs_fs.h ++++ b/include/linux/f2fs_fs.h +@@ -78,6 +78,7 @@ enum stop_cp_reason { + STOP_CP_REASON_UPDATE_INODE, + STOP_CP_REASON_FLUSH_FAIL, + STOP_CP_REASON_NO_SEGMENT, ++ STOP_CP_REASON_CORRUPTED_FREE_BITMAP, + STOP_CP_REASON_MAX, + }; + +-- +2.39.5 + diff --git a/queue-6.15/f2fs-fix-to-set-atomic-write-status-more-clear.patch b/queue-6.15/f2fs-fix-to-set-atomic-write-status-more-clear.patch new file mode 100644 index 0000000000..833548d849 --- /dev/null +++ b/queue-6.15/f2fs-fix-to-set-atomic-write-status-more-clear.patch @@ -0,0 +1,81 @@ +From 1e2f564b14bfc81cfc472546ff5f0921106233c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Mar 2025 13:56:06 +0800 +Subject: f2fs: fix to set atomic write status more clear + +From: Chao Yu + +[ Upstream commit db03c20c0850dc8d2bcabfa54b9438f7d666c863 ] + +1. After we start atomic write in a database file, before committing +all data, we'd better not set inode w/ vfs dirty status to avoid +redundant updates, instead, we only set inode w/ atomic dirty status. + +2. After we commit all data, before committing metadata, we need to +clear atomic dirty status, and set vfs dirty status to allow vfs flush +dirty inode. + +Cc: Daeho Jeong +Reported-by: Zhiguo Niu +Signed-off-by: Chao Yu +Reviewed-by: Daeho Jeong +Reviewed-by: Zhiguo Niu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/inode.c | 4 +++- + fs/f2fs/segment.c | 6 ++++++ + fs/f2fs/super.c | 4 +++- + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index 5c8634eaef7be..f5991e8751b9b 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -34,7 +34,9 @@ void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync) + if (f2fs_inode_dirtied(inode, sync)) + return; + +- if (f2fs_is_atomic_file(inode)) ++ /* only atomic file w/ FI_ATOMIC_COMMITTED can be set vfs dirty */ ++ if (f2fs_is_atomic_file(inode) && ++ !is_inode_flag_set(inode, FI_ATOMIC_COMMITTED)) + return; + + mark_inode_dirty_sync(inode); +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index c5d29c58f3d3e..876e97ec5f570 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -376,7 +376,13 @@ static int __f2fs_commit_atomic_write(struct inode *inode) + } else { + sbi->committed_atomic_block += fi->atomic_write_cnt; + set_inode_flag(inode, FI_ATOMIC_COMMITTED); ++ ++ /* ++ * inode may has no FI_ATOMIC_DIRTIED flag due to no write ++ * before commit. ++ */ + if (is_inode_flag_set(inode, FI_ATOMIC_DIRTIED)) { ++ /* clear atomic dirty status and set vfs dirty status */ + clear_inode_flag(inode, FI_ATOMIC_DIRTIED); + f2fs_mark_inode_dirty_sync(inode, true); + } +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index ee039bf02c148..bc510c91f3eba 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1531,7 +1531,9 @@ int f2fs_inode_dirtied(struct inode *inode, bool sync) + } + spin_unlock(&sbi->inode_lock[DIRTY_META]); + +- if (!ret && f2fs_is_atomic_file(inode)) ++ /* if atomic write is not committed, set inode w/ atomic dirty */ ++ if (!ret && f2fs_is_atomic_file(inode) && ++ !is_inode_flag_set(inode, FI_ATOMIC_COMMITTED)) + set_inode_flag(inode, FI_ATOMIC_DIRTIED); + + return ret; +-- +2.39.5 + diff --git a/queue-6.15/f2fs-use-vmalloc-instead-of-kvmalloc-in-.init_-de-co.patch b/queue-6.15/f2fs-use-vmalloc-instead-of-kvmalloc-in-.init_-de-co.patch new file mode 100644 index 0000000000..f7ca216672 --- /dev/null +++ b/queue-6.15/f2fs-use-vmalloc-instead-of-kvmalloc-in-.init_-de-co.patch @@ -0,0 +1,155 @@ +From 0ac47ba3e3ab5dd12cbdd4d9b6ba5df36e631668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 13:57:20 +0800 +Subject: f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx + +From: Chao Yu + +[ Upstream commit 70dd07c888451503c3e93b6821e10d1ea1ec9930 ] + +.init_{,de}compress_ctx uses kvmalloc() to alloc memory, it will try +to allocate physically continuous page first, it may cause more memory +allocation pressure, let's use vmalloc instead to mitigate it. + +[Test] +cd /data/local/tmp +touch file +f2fs_io setflags compression file +f2fs_io getflags file +for i in $(seq 1 10); do sync; echo 3 > /proc/sys/vm/drop_caches;\ +time f2fs_io write 512 0 4096 zero osync file; truncate -s 0 file;\ +done + +[Result] +Before After Delta +21.243 21.694 -2.12% + +For compression, we recommend to use ioctl to compress file data in +background for workaround. + +For decompression, only zstd will be affected. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 23 ++++++++++------------- + fs/f2fs/f2fs.h | 5 +++++ + 2 files changed, 15 insertions(+), 13 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 9b94810675c19..5a9b6d5f3ae0a 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -178,8 +178,7 @@ void f2fs_compress_ctx_add_page(struct compress_ctx *cc, struct folio *folio) + #ifdef CONFIG_F2FS_FS_LZO + static int lzo_init_compress_ctx(struct compress_ctx *cc) + { +- cc->private = f2fs_kvmalloc(F2FS_I_SB(cc->inode), +- LZO1X_MEM_COMPRESS, GFP_NOFS); ++ cc->private = f2fs_vmalloc(LZO1X_MEM_COMPRESS); + if (!cc->private) + return -ENOMEM; + +@@ -189,7 +188,7 @@ static int lzo_init_compress_ctx(struct compress_ctx *cc) + + static void lzo_destroy_compress_ctx(struct compress_ctx *cc) + { +- kvfree(cc->private); ++ vfree(cc->private); + cc->private = NULL; + } + +@@ -246,7 +245,7 @@ static int lz4_init_compress_ctx(struct compress_ctx *cc) + size = LZ4HC_MEM_COMPRESS; + #endif + +- cc->private = f2fs_kvmalloc(F2FS_I_SB(cc->inode), size, GFP_NOFS); ++ cc->private = f2fs_vmalloc(size); + if (!cc->private) + return -ENOMEM; + +@@ -261,7 +260,7 @@ static int lz4_init_compress_ctx(struct compress_ctx *cc) + + static void lz4_destroy_compress_ctx(struct compress_ctx *cc) + { +- kvfree(cc->private); ++ vfree(cc->private); + cc->private = NULL; + } + +@@ -342,8 +341,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc) + params = zstd_get_params(level, cc->rlen); + workspace_size = zstd_cstream_workspace_bound(¶ms.cParams); + +- workspace = f2fs_kvmalloc(F2FS_I_SB(cc->inode), +- workspace_size, GFP_NOFS); ++ workspace = f2fs_vmalloc(workspace_size); + if (!workspace) + return -ENOMEM; + +@@ -351,7 +349,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc) + if (!stream) { + f2fs_err_ratelimited(F2FS_I_SB(cc->inode), + "%s zstd_init_cstream failed", __func__); +- kvfree(workspace); ++ vfree(workspace); + return -EIO; + } + +@@ -364,7 +362,7 @@ static int zstd_init_compress_ctx(struct compress_ctx *cc) + + static void zstd_destroy_compress_ctx(struct compress_ctx *cc) + { +- kvfree(cc->private); ++ vfree(cc->private); + cc->private = NULL; + cc->private2 = NULL; + } +@@ -423,8 +421,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic) + + workspace_size = zstd_dstream_workspace_bound(max_window_size); + +- workspace = f2fs_kvmalloc(F2FS_I_SB(dic->inode), +- workspace_size, GFP_NOFS); ++ workspace = f2fs_vmalloc(workspace_size); + if (!workspace) + return -ENOMEM; + +@@ -432,7 +429,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic) + if (!stream) { + f2fs_err_ratelimited(F2FS_I_SB(dic->inode), + "%s zstd_init_dstream failed", __func__); +- kvfree(workspace); ++ vfree(workspace); + return -EIO; + } + +@@ -444,7 +441,7 @@ static int zstd_init_decompress_ctx(struct decompress_io_ctx *dic) + + static void zstd_destroy_decompress_ctx(struct decompress_io_ctx *dic) + { +- kvfree(dic->private); ++ vfree(dic->private); + dic->private = NULL; + dic->private2 = NULL; + } +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 4f34a7d9760a1..34e4ae2a5f5ba 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -3527,6 +3527,11 @@ static inline void *f2fs_kvzalloc(struct f2fs_sb_info *sbi, + return f2fs_kvmalloc(sbi, size, flags | __GFP_ZERO); + } + ++static inline void *f2fs_vmalloc(size_t size) ++{ ++ return vmalloc(size); ++} ++ + static inline int get_extra_isize(struct inode *inode) + { + return F2FS_I(inode)->i_extra_isize / sizeof(__le32); +-- +2.39.5 + diff --git a/queue-6.15/fbcon-make-sure-modelist-not-set-on-unregistered-con.patch b/queue-6.15/fbcon-make-sure-modelist-not-set-on-unregistered-con.patch new file mode 100644 index 0000000000..5a3efd1d50 --- /dev/null +++ b/queue-6.15/fbcon-make-sure-modelist-not-set-on-unregistered-con.patch @@ -0,0 +1,65 @@ +From da0811ac78579ca3b6bae7013c1f1cecb4cdd3ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 May 2025 13:06:47 -0700 +Subject: fbcon: Make sure modelist not set on unregistered console + +From: Kees Cook + +[ Upstream commit cedc1b63394a866bf8663a3e40f4546f1d28c8d8 ] + +It looks like attempting to write to the "store_modes" sysfs node will +run afoul of unregistered consoles: + +UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28 +index -1 is out of range for type 'fb_info *[32]' +... + fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122 + fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048 + fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673 + store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113 + dev_attr_store+0x55/0x80 drivers/base/core.c:2439 + +static struct fb_info *fbcon_registered_fb[FB_MAX]; +... +static signed char con2fb_map[MAX_NR_CONSOLES]; +... +static struct fb_info *fbcon_info_from_console(int console) +... + return fbcon_registered_fb[con2fb_map[console]]; + +If con2fb_map contains a -1 things go wrong here. Instead, return NULL, +as callers of fbcon_info_from_console() are trying to compare against +existing "info" pointers, so error handling should kick in correctly. + +Reported-by: syzbot+a7d4444e7b6e743572f7@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/679d0a8f.050a0220.163cdc.000c.GAE@google.com/ +Signed-off-by: Kees Cook +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbcon.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index ac3c99ed92d1a..2df48037688d1 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -117,9 +117,14 @@ static signed char con2fb_map_boot[MAX_NR_CONSOLES]; + + static struct fb_info *fbcon_info_from_console(int console) + { ++ signed char fb; + WARN_CONSOLE_UNLOCKED(); + +- return fbcon_registered_fb[con2fb_map[console]]; ++ fb = con2fb_map[console]; ++ if (fb < 0 || fb >= ARRAY_SIZE(fbcon_registered_fb)) ++ return NULL; ++ ++ return fbcon_registered_fb[fb]; + } + + static int logo_lines; +-- +2.39.5 + diff --git a/queue-6.15/fs-drop-assert-in-file_seek_cur_needs_f_lock.patch b/queue-6.15/fs-drop-assert-in-file_seek_cur_needs_f_lock.patch new file mode 100644 index 0000000000..0baead579f --- /dev/null +++ b/queue-6.15/fs-drop-assert-in-file_seek_cur_needs_f_lock.patch @@ -0,0 +1,47 @@ +From e776f2514792ac59fd19e87fbff2a5e2e264b9a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jun 2025 11:11:11 +0100 +Subject: fs: drop assert in file_seek_cur_needs_f_lock + +From: Luis Henriques + +[ Upstream commit dd2d6b7f6f519d078a866a36a625b0297d81c5bc ] + +The assert in function file_seek_cur_needs_f_lock() can be triggered very +easily because there are many users of vfs_llseek() (such as overlayfs) +that do their custom locking around llseek instead of relying on +fdget_pos(). Just drop the overzealous assertion. + +Fixes: da06e3c51794 ("fs: don't needlessly acquire f_lock") +Suggested-by: Jan Kara +Suggested-by: Mateusz Guzik +Signed-off-by: Luis Henriques +Link: https://lore.kernel.org/20250613101111.17716-1-luis@igalia.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/file.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/file.c b/fs/file.c +index 3a3146664cf37..b6db031545e65 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -1198,8 +1198,12 @@ bool file_seek_cur_needs_f_lock(struct file *file) + if (!(file->f_mode & FMODE_ATOMIC_POS) && !file->f_op->iterate_shared) + return false; + +- VFS_WARN_ON_ONCE((file_count(file) > 1) && +- !mutex_is_locked(&file->f_pos_lock)); ++ /* ++ * Note that we are not guaranteed to be called after fdget_pos() on ++ * this file obj, in which case the caller is expected to provide the ++ * appropriate locking. ++ */ ++ + return true; + } + +-- +2.39.5 + diff --git a/queue-6.15/fs-xattr.c-fix-simple_xattr_list.patch b/queue-6.15/fs-xattr.c-fix-simple_xattr_list.patch new file mode 100644 index 0000000000..6e91cd1e7e --- /dev/null +++ b/queue-6.15/fs-xattr.c-fix-simple_xattr_list.patch @@ -0,0 +1,44 @@ +From 3a9b998e13d14f2265d0060d8056c2688573f7c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jun 2025 12:51:16 -0400 +Subject: fs/xattr.c: fix simple_xattr_list() + +From: Stephen Smalley + +[ Upstream commit 800d0b9b6a8b1b354637b4194cc167ad1ce2bdd3 ] + +commit 8b0ba61df5a1 ("fs/xattr.c: fix simple_xattr_list to always +include security.* xattrs") failed to reset err after the call to +security_inode_listsecurity(), which returns the length of the +returned xattr name. This results in simple_xattr_list() incorrectly +returning this length even if a POSIX acl is also set on the inode. + +Reported-by: Collin Funk +Closes: https://lore.kernel.org/selinux/8734ceal7q.fsf@gmail.com/ +Reported-by: Paul Eggert +Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2369561 +Fixes: 8b0ba61df5a1 ("fs/xattr.c: fix simple_xattr_list to always include security.* xattrs") + +Signed-off-by: Stephen Smalley +Link: https://lore.kernel.org/20250605165116.2063-1-stephen.smalley.work@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/xattr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/xattr.c b/fs/xattr.c +index 8ec5b0204bfdc..600ae97969cf2 100644 +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -1479,6 +1479,7 @@ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, + buffer += err; + } + remaining_size -= err; ++ err = 0; + + read_lock(&xattrs->lock); + for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) { +-- +2.39.5 + diff --git a/queue-6.15/gpiolib-of-add-polarity-quirk-for-s5m8767.patch b/queue-6.15/gpiolib-of-add-polarity-quirk-for-s5m8767.patch new file mode 100644 index 0000000000..8d8c12d488 --- /dev/null +++ b/queue-6.15/gpiolib-of-add-polarity-quirk-for-s5m8767.patch @@ -0,0 +1,46 @@ +From 34f7b62eb7ac88d7f9f17eef656b0e4256a4f0f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Mar 2025 08:49:44 +0800 +Subject: gpiolib: of: Add polarity quirk for s5m8767 + +From: Peng Fan + +[ Upstream commit 4e310626eb4df52a31a142c1360fead0fcbd3793 ] + +This is prepare patch for switching s5m8767 regulator driver to +use GPIO descriptor. DTS for exynos5250 spring incorrectly specifies +"active low" polarity for the DVS and DS line. But per datasheet, +they are actually active high. So add polarity quirk for it. + +Signed-off-by: Peng Fan +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20250327004945.563765-1-peng.fan@oss.nxp.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-of.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index 65f6a7177b78e..17802d97492fa 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -224,6 +224,15 @@ static void of_gpio_try_fixup_polarity(const struct device_node *np, + */ + { "lantiq,pci-xway", "gpio-reset", false }, + #endif ++#if IS_ENABLED(CONFIG_REGULATOR_S5M8767) ++ /* ++ * According to S5M8767, the DVS and DS pin are ++ * active-high signals. However, exynos5250-spring.dts use ++ * active-low setting. ++ */ ++ { "samsung,s5m8767-pmic", "s5m8767,pmic-buck-dvs-gpios", true }, ++ { "samsung,s5m8767-pmic", "s5m8767,pmic-buck-ds-gpios", true }, ++#endif + #if IS_ENABLED(CONFIG_TOUCHSCREEN_TSC2005) + /* + * DTS for Nokia N900 incorrectly specified "active high" +-- +2.39.5 + diff --git a/queue-6.15/hid-asus-check-rog-ally-mcu-version-and-warn.patch b/queue-6.15/hid-asus-check-rog-ally-mcu-version-and-warn.patch new file mode 100644 index 0000000000..aa690cbd36 --- /dev/null +++ b/queue-6.15/hid-asus-check-rog-ally-mcu-version-and-warn.patch @@ -0,0 +1,182 @@ +From 6b9f3f4e0474e4a45227c0d485927446b79fd5de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Mar 2025 15:34:20 +1300 +Subject: hid-asus: check ROG Ally MCU version and warn +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luke D. Jones + +[ Upstream commit 00e005c952f74f50a3f86af96f56877be4685e14 ] + +ASUS have fixed suspend issues arising from a flag not being cleared in +the MCU FW in both the ROG Ally 1 and the ROG Ally X. + +Implement a check and a warning to encourage users to update the FW to +a minimum supported version. + +Signed-off-by: Luke D. Jones +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20250323023421.78012-2-luke@ljones.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-asus.c | 107 ++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 105 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index 46e3e42f9eb5f..599c836507ff8 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -52,6 +52,10 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad"); + #define FEATURE_KBD_LED_REPORT_ID1 0x5d + #define FEATURE_KBD_LED_REPORT_ID2 0x5e + ++#define ROG_ALLY_REPORT_SIZE 64 ++#define ROG_ALLY_X_MIN_MCU 313 ++#define ROG_ALLY_MIN_MCU 319 ++ + #define SUPPORT_KBD_BACKLIGHT BIT(0) + + #define MAX_TOUCH_MAJOR 8 +@@ -84,6 +88,7 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad"); + #define QUIRK_MEDION_E1239T BIT(10) + #define QUIRK_ROG_NKEY_KEYBOARD BIT(11) + #define QUIRK_ROG_CLAYMORE_II_KEYBOARD BIT(12) ++#define QUIRK_ROG_ALLY_XPAD BIT(13) + + #define I2C_KEYBOARD_QUIRKS (QUIRK_FIX_NOTEBOOK_REPORT | \ + QUIRK_NO_INIT_REPORTS | \ +@@ -534,9 +539,99 @@ static bool asus_kbd_wmi_led_control_present(struct hid_device *hdev) + return !!(value & ASUS_WMI_DSTS_PRESENCE_BIT); + } + ++/* ++ * We don't care about any other part of the string except the version section. ++ * Example strings: FGA80100.RC72LA.312_T01, FGA80100.RC71LS.318_T01 ++ * The bytes "5a 05 03 31 00 1a 13" and possibly more come before the version ++ * string, and there may be additional bytes after the version string such as ++ * "75 00 74 00 65 00" or a postfix such as "_T01" ++ */ ++static int mcu_parse_version_string(const u8 *response, size_t response_size) ++{ ++ const u8 *end = response + response_size; ++ const u8 *p = response; ++ int dots, err, version; ++ char buf[4]; ++ ++ dots = 0; ++ while (p < end && dots < 2) { ++ if (*p++ == '.') ++ dots++; ++ } ++ ++ if (dots != 2 || p >= end || (p + 3) >= end) ++ return -EINVAL; ++ ++ memcpy(buf, p, 3); ++ buf[3] = '\0'; ++ ++ err = kstrtoint(buf, 10, &version); ++ if (err || version < 0) ++ return -EINVAL; ++ ++ return version; ++} ++ ++static int mcu_request_version(struct hid_device *hdev) ++{ ++ u8 *response __free(kfree) = kzalloc(ROG_ALLY_REPORT_SIZE, GFP_KERNEL); ++ const u8 request[] = { 0x5a, 0x05, 0x03, 0x31, 0x00, 0x20 }; ++ int ret; ++ ++ if (!response) ++ return -ENOMEM; ++ ++ ret = asus_kbd_set_report(hdev, request, sizeof(request)); ++ if (ret < 0) ++ return ret; ++ ++ ret = hid_hw_raw_request(hdev, FEATURE_REPORT_ID, response, ++ ROG_ALLY_REPORT_SIZE, HID_FEATURE_REPORT, ++ HID_REQ_GET_REPORT); ++ if (ret < 0) ++ return ret; ++ ++ ret = mcu_parse_version_string(response, ROG_ALLY_REPORT_SIZE); ++ if (ret < 0) { ++ pr_err("Failed to parse MCU version: %d\n", ret); ++ print_hex_dump(KERN_ERR, "MCU: ", DUMP_PREFIX_NONE, ++ 16, 1, response, ROG_ALLY_REPORT_SIZE, false); ++ } ++ ++ return ret; ++} ++ ++static void validate_mcu_fw_version(struct hid_device *hdev, int idProduct) ++{ ++ int min_version, version; ++ ++ version = mcu_request_version(hdev); ++ if (version < 0) ++ return; ++ ++ switch (idProduct) { ++ case USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY: ++ min_version = ROG_ALLY_MIN_MCU; ++ break; ++ case USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X: ++ min_version = ROG_ALLY_X_MIN_MCU; ++ break; ++ default: ++ min_version = 0; ++ } ++ ++ if (version < min_version) { ++ hid_warn(hdev, ++ "The MCU firmware version must be %d or greater to avoid issues with suspend.\n", ++ min_version); ++ } ++} ++ + static int asus_kbd_register_leds(struct hid_device *hdev) + { + struct asus_drvdata *drvdata = hid_get_drvdata(hdev); ++ struct usb_interface *intf; ++ struct usb_device *udev; + unsigned char kbd_func; + int ret; + +@@ -560,6 +655,14 @@ static int asus_kbd_register_leds(struct hid_device *hdev) + if (ret < 0) + return ret; + } ++ ++ if (drvdata->quirks & QUIRK_ROG_ALLY_XPAD) { ++ intf = to_usb_interface(hdev->dev.parent); ++ udev = interface_to_usbdev(intf); ++ validate_mcu_fw_version(hdev, ++ le16_to_cpu(udev->descriptor.idProduct)); ++ } ++ + } else { + /* Initialize keyboard */ + ret = asus_kbd_init(hdev, FEATURE_KBD_REPORT_ID); +@@ -1280,10 +1383,10 @@ static const struct hid_device_id asus_devices[] = { + QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, + { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, + USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY), +- QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, ++ QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD}, + { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, + USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X), +- QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, ++ QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD }, + { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, + USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD), + QUIRK_ROG_CLAYMORE_II_KEYBOARD }, +-- +2.39.5 + diff --git a/queue-6.15/i2c-designware-invoke-runtime-suspend-on-quick-slave.patch b/queue-6.15/i2c-designware-invoke-runtime-suspend-on-quick-slave.patch new file mode 100644 index 0000000000..4ac1898952 --- /dev/null +++ b/queue-6.15/i2c-designware-invoke-runtime-suspend-on-quick-slave.patch @@ -0,0 +1,79 @@ +From 8d05760c2a60d611cbd964394c92251fad4e57d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Apr 2025 10:33:03 +0800 +Subject: i2c: designware: Invoke runtime suspend on quick slave + re-registration + +From: Tan En De + +[ Upstream commit 2fe2b969d911a09abcd6a47401a3c66c38a310e6 ] + +Replaced pm_runtime_put() with pm_runtime_put_sync_suspend() to ensure +the runtime suspend is invoked immediately when unregistering a slave. +This prevents a race condition where suspend was skipped when +unregistering and registering slave in quick succession. + +For example, consider the rapid sequence of +`delete_device -> new_device -> delete_device -> new_device`. +In this sequence, it is observed that the dw_i2c_plat_runtime_suspend() +might not be invoked after `delete_device` operation. + +This is because after `delete_device` operation, when the +pm_runtime_put() is about to trigger suspend, the following `new_device` +operation might race and cancel the suspend. + +If that happens, during the `new_device` operation, +dw_i2c_plat_runtime_resume() is skipped (since there was no suspend), which +means `i_dev->init()`, i.e. i2c_dw_init_slave(), is skipped. +Since i2c_dw_init_slave() is skipped, i2c_dw_configure_fifo_slave() is +skipped too, which leaves `DW_IC_INTR_MASK` unconfigured. If we inspect +the interrupt mask register using devmem, it will show as zero. + +Example shell script to reproduce the issue: +``` + #!/bin/sh + + SLAVE_LADDR=0x1010 + SLAVE_BUS=13 + NEW_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/new_device + DELETE_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/delete_device + + # Create initial device + echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE + sleep 2 + + # Rapid sequence of + # delete_device -> new_device -> delete_device -> new_device + echo $SLAVE_LADDR > $DELETE_DEVICE + echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE + echo $SLAVE_LADDR > $DELETE_DEVICE + echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE + + # Using devmem to inspect IC_INTR_MASK will show as zero +``` + +Signed-off-by: Tan En De +Acked-by: Jarkko Nikula +Link: https://lore.kernel.org/r/20250412023303.378600-1-ende.tan@starfivetech.com +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-slave.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c +index 5cd4a5f7a472e..b936a240db0a9 100644 +--- a/drivers/i2c/busses/i2c-designware-slave.c ++++ b/drivers/i2c/busses/i2c-designware-slave.c +@@ -96,7 +96,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave) + i2c_dw_disable(dev); + synchronize_irq(dev->irq); + dev->slave = NULL; +- pm_runtime_put(dev->dev); ++ pm_runtime_put_sync_suspend(dev->dev); + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.15/i2c-npcm-add-clock-toggle-recovery.patch b/queue-6.15/i2c-npcm-add-clock-toggle-recovery.patch new file mode 100644 index 0000000000..b86f3dabce --- /dev/null +++ b/queue-6.15/i2c-npcm-add-clock-toggle-recovery.patch @@ -0,0 +1,49 @@ +From d5d7b78ec2480b3fb96b3dbbb6cd4c86ea82104c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Mar 2025 19:32:50 +0000 +Subject: i2c: npcm: Add clock toggle recovery + +From: Tali Perry + +[ Upstream commit 38010591a0fc3203f1cee45b01ab358b72dd9ab2 ] + +During init of the bus, the module checks that the bus is idle. +If one of the lines are stuck try to recover them first before failing. +Sometimes SDA and SCL are low if improper reset occurs (e.g., reboot). + +Signed-off-by: Tali Perry +Signed-off-by: Mohammed Elbadry +Reviewed-by: Mukesh Kumar Savaliya +Link: https://lore.kernel.org/r/20250328193252.1570811-1-mohammed.0.elbadry@gmail.com +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-npcm7xx.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c +index de713b5747fe5..05a140ec2b64d 100644 +--- a/drivers/i2c/busses/i2c-npcm7xx.c ++++ b/drivers/i2c/busses/i2c-npcm7xx.c +@@ -2178,10 +2178,14 @@ static int npcm_i2c_init_module(struct npcm_i2c *bus, enum i2c_mode mode, + + /* Check HW is OK: SDA and SCL should be high at this point. */ + if ((npcm_i2c_get_SDA(&bus->adap) == 0) || (npcm_i2c_get_SCL(&bus->adap) == 0)) { +- dev_err(bus->dev, "I2C%d init fail: lines are low\n", bus->num); +- dev_err(bus->dev, "SDA=%d SCL=%d\n", npcm_i2c_get_SDA(&bus->adap), +- npcm_i2c_get_SCL(&bus->adap)); +- return -ENXIO; ++ dev_warn(bus->dev, " I2C%d SDA=%d SCL=%d, attempting to recover\n", bus->num, ++ npcm_i2c_get_SDA(&bus->adap), npcm_i2c_get_SCL(&bus->adap)); ++ if (npcm_i2c_recovery_tgclk(&bus->adap)) { ++ dev_err(bus->dev, "I2C%d init fail: SDA=%d SCL=%d\n", ++ bus->num, npcm_i2c_get_SDA(&bus->adap), ++ npcm_i2c_get_SCL(&bus->adap)); ++ return -ENXIO; ++ } + } + + npcm_i2c_int_enable(bus, true); +-- +2.39.5 + diff --git a/queue-6.15/i2c-pasemi-enable-the-unjam-machine.patch b/queue-6.15/i2c-pasemi-enable-the-unjam-machine.patch new file mode 100644 index 0000000000..a357f60d43 --- /dev/null +++ b/queue-6.15/i2c-pasemi-enable-the-unjam-machine.patch @@ -0,0 +1,43 @@ +From b5bc3eb96172c784933ccc73370ae95d260f0b61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Apr 2025 11:30:43 +0000 +Subject: i2c: pasemi: Enable the unjam machine + +From: Hector Martin + +[ Upstream commit 88fe3078b54c9efaea7d1adfcf295e37dfb0274f ] + +The I2C bus can get stuck under some conditions (desync between +controller and device). The pasemi controllers include an unjam feature +that is enabled on reset, but was being disabled by the driver. Keep it +enabled by explicitly setting the UJM bit in the CTL register. This +should help recover the bus from certain conditions, which would +otherwise remain stuck forever. + +Signed-off-by: Hector Martin +Reviewed-by: Neal Gompa +Reviewed-by: Alyssa Rosenzweig +Signed-off-by: Sven Peter +Link: https://lore.kernel.org/r/20250427-pasemi-fixes-v3-1-af28568296c0@svenpeter.dev +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-pasemi-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-pasemi-core.c b/drivers/i2c/busses/i2c-pasemi-core.c +index bd128ab2e2ebb..27ab09854c927 100644 +--- a/drivers/i2c/busses/i2c-pasemi-core.c ++++ b/drivers/i2c/busses/i2c-pasemi-core.c +@@ -71,7 +71,7 @@ static inline int reg_read(struct pasemi_smbus *smbus, int reg) + + static void pasemi_reset(struct pasemi_smbus *smbus) + { +- u32 val = (CTL_MTR | CTL_MRR | (smbus->clk_div & CTL_CLK_M)); ++ u32 val = (CTL_MTR | CTL_MRR | CTL_UJM | (smbus->clk_div & CTL_CLK_M)); + + if (smbus->hw_rev >= 6) + val |= CTL_EN; +-- +2.39.5 + diff --git a/queue-6.15/i2c-tegra-check-msg-length-in-smbus-block-read.patch b/queue-6.15/i2c-tegra-check-msg-length-in-smbus-block-read.patch new file mode 100644 index 0000000000..9ec4927394 --- /dev/null +++ b/queue-6.15/i2c-tegra-check-msg-length-in-smbus-block-read.patch @@ -0,0 +1,40 @@ +From df4cabad16e8ca95afabe770b72c63819c6d6a9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 11:03:20 +0530 +Subject: i2c: tegra: check msg length in SMBUS block read + +From: Akhil R + +[ Upstream commit a6e04f05ce0b070ab39d5775580e65c7d943da0b ] + +For SMBUS block read, do not continue to read if the message length +passed from the device is '0' or greater than the maximum allowed bytes. + +Signed-off-by: Akhil R +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20250424053320.19211-1-akhilrajeev@nvidia.com +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-tegra.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c +index 87976e99e6d00..049b4d154c233 100644 +--- a/drivers/i2c/busses/i2c-tegra.c ++++ b/drivers/i2c/busses/i2c-tegra.c +@@ -1395,6 +1395,11 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], + ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], MSG_END_CONTINUE); + if (ret) + break; ++ ++ /* Validate message length before proceeding */ ++ if (msgs[i].buf[0] == 0 || msgs[i].buf[0] > I2C_SMBUS_BLOCK_MAX) ++ break; ++ + /* Set the msg length from first byte */ + msgs[i].len += msgs[i].buf[0]; + dev_dbg(i2c_dev->dev, "reading %d bytes\n", msgs[i].len); +-- +2.39.5 + diff --git a/queue-6.15/i3c-mipi-i3c-hci-fix-handling-status-of-i3c_hci_irq_.patch b/queue-6.15/i3c-mipi-i3c-hci-fix-handling-status-of-i3c_hci_irq_.patch new file mode 100644 index 0000000000..2da62e95ae --- /dev/null +++ b/queue-6.15/i3c-mipi-i3c-hci-fix-handling-status-of-i3c_hci_irq_.patch @@ -0,0 +1,55 @@ +From 2ce9a426f01e98f7118971ae63d0d9c323022813 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 17:03:58 +0300 +Subject: i3c: mipi-i3c-hci: Fix handling status of i3c_hci_irq_handler() + +From: Jarkko Nikula + +[ Upstream commit 279c24021b838e76ca8441e9446e0ab45271153a ] + +Return IRQ_HANDLED from the i3c_hci_irq_handler() only if some +INTR_STATUS bit was set or if DMA/PIO handler handled it. + +Currently it returns IRQ_HANDLED in case INTR_STATUS is zero and IO +handler returns false. Which could be the case if interrupt comes from +other device or is spurious. + +Reviewed-by: Frank Li +Signed-off-by: Jarkko Nikula +Link: https://lore.kernel.org/r/20250409140401.299251-2-jarkko.nikula@linux.intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/mipi-i3c-hci/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/i3c/master/mipi-i3c-hci/core.c b/drivers/i3c/master/mipi-i3c-hci/core.c +index a71226d7ca593..5834bf8a3fd9e 100644 +--- a/drivers/i3c/master/mipi-i3c-hci/core.c ++++ b/drivers/i3c/master/mipi-i3c-hci/core.c +@@ -594,6 +594,7 @@ static irqreturn_t i3c_hci_irq_handler(int irq, void *dev_id) + + if (val) { + reg_write(INTR_STATUS, val); ++ result = IRQ_HANDLED; + } + + if (val & INTR_HC_RESET_CANCEL) { +@@ -605,12 +606,11 @@ static irqreturn_t i3c_hci_irq_handler(int irq, void *dev_id) + val &= ~INTR_HC_INTERNAL_ERR; + } + +- hci->io->irq_handler(hci); ++ if (hci->io->irq_handler(hci)) ++ result = IRQ_HANDLED; + + if (val) + dev_err(&hci->master.dev, "unexpected INTR_STATUS %#x\n", val); +- else +- result = IRQ_HANDLED; + + return result; + } +-- +2.39.5 + diff --git a/queue-6.15/i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch b/queue-6.15/i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch new file mode 100644 index 0000000000..3ccceab176 --- /dev/null +++ b/queue-6.15/i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch @@ -0,0 +1,48 @@ +From d0fbdc4d8ce8df031fb20a11d63d8db4f479a71b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 14:16:02 +0900 +Subject: i40e: fix MMIO write access to an invalid page in i40e_clear_hw + +From: Kyungwook Boo + +[ Upstream commit 015bac5daca978448f2671478c553ce1f300c21e ] + +When the device sends a specific input, an integer underflow can occur, leading +to MMIO write access to an invalid page. + +Prevent the integer underflow by changing the type of related variables. + +Signed-off-by: Kyungwook Boo +Link: https://lore.kernel.org/lkml/ffc91764-1142-4ba2-91b6-8c773f6f7095@gmail.com/T/ +Reviewed-by: Przemek Kitszel +Reviewed-by: Simon Horman +Reviewed-by: Aleksandr Loktionov +Tested-by: Rinitha S (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_common.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c +index 370b4bddee441..b11c35e307ca9 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -817,10 +817,11 @@ int i40e_pf_reset(struct i40e_hw *hw) + void i40e_clear_hw(struct i40e_hw *hw) + { + u32 num_queues, base_queue; +- u32 num_pf_int; +- u32 num_vf_int; ++ s32 num_pf_int; ++ s32 num_vf_int; + u32 num_vfs; +- u32 i, j; ++ s32 i; ++ u32 j; + u32 val; + u32 eol = 0x7ff; + +-- +2.39.5 + diff --git a/queue-6.15/ice-fix-check-for-existing-switch-rule.patch b/queue-6.15/ice-fix-check-for-existing-switch-rule.patch new file mode 100644 index 0000000000..3cd98f7a90 --- /dev/null +++ b/queue-6.15/ice-fix-check-for-existing-switch-rule.patch @@ -0,0 +1,56 @@ +From 6df784d0b1a17de12b998abf15a2354a11dce477 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2025 09:50:35 +0100 +Subject: ice: fix check for existing switch rule + +From: Mateusz Pacuszka + +[ Upstream commit a808691df39b52cd9db861b118e88e18b63e2299 ] + +In case the rule already exists and another VSI wants to subscribe to it +new VSI list is being created and both VSIs are moved to it. +Currently, the check for already existing VSI with the same rule is done +based on fdw_id.hw_vsi_id, which applies only to LOOKUP_RX flag. +Change it to vsi_handle. This is software VSI ID, but it can be applied +here, because vsi_map itself is also based on it. + +Additionally change return status in case the VSI already exists in the +VSI map to "Already exists". Such case should be handled by the caller. + +Signed-off-by: Mateusz Pacuszka +Reviewed-by: Przemek Kitszel +Reviewed-by: Michal Swiatkowski +Signed-off-by: Larysa Zaremba +Reviewed-by: Simon Horman +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_switch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c +index 4a91e0aaf0a5e..9d9a7edd3618a 100644 +--- a/drivers/net/ethernet/intel/ice/ice_switch.c ++++ b/drivers/net/ethernet/intel/ice/ice_switch.c +@@ -3146,7 +3146,7 @@ ice_add_update_vsi_list(struct ice_hw *hw, + u16 vsi_handle_arr[2]; + + /* A rule already exists with the new VSI being added */ +- if (cur_fltr->fwd_id.hw_vsi_id == new_fltr->fwd_id.hw_vsi_id) ++ if (cur_fltr->vsi_handle == new_fltr->vsi_handle) + return -EEXIST; + + vsi_handle_arr[0] = cur_fltr->vsi_handle; +@@ -5978,7 +5978,7 @@ ice_adv_add_update_vsi_list(struct ice_hw *hw, + + /* A rule already exists with the new VSI being added */ + if (test_bit(vsi_handle, m_entry->vsi_list_info->vsi_map)) +- return 0; ++ return -EEXIST; + + /* Update the previously created VSI list set with + * the new VSI ID passed in +-- +2.39.5 + diff --git a/queue-6.15/iommu-amd-allow-matching-acpi-hid-devices-without-ma.patch b/queue-6.15/iommu-amd-allow-matching-acpi-hid-devices-without-ma.patch new file mode 100644 index 0000000000..5f37dbcd5e --- /dev/null +++ b/queue-6.15/iommu-amd-allow-matching-acpi-hid-devices-without-ma.patch @@ -0,0 +1,114 @@ +From e5bd5c4d24710eb4d7754239cfc3409809cf4cf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 12:30:32 -0500 +Subject: iommu/amd: Allow matching ACPI HID devices without matching UIDs + +From: Mario Limonciello + +[ Upstream commit 51c33f333bbf7bdb6aa2a327e3a3e4bbb2591511 ] + +A BIOS upgrade has changed the IVRS DTE UID for a device that no +longer matches the UID in the SSDT. In this case there is only +one ACPI device on the system with that _HID but the _UID mismatch. + +IVRS: +``` + Subtable Type : F0 [Device Entry: ACPI HID Named Device] + Device ID : 0060 +Data Setting (decoded below) : 40 + INITPass : 0 + EIntPass : 0 + NMIPass : 0 + Reserved : 0 + System MGMT : 0 + LINT0 Pass : 1 + LINT1 Pass : 0 + ACPI HID : "MSFT0201" + ACPI CID : 0000000000000000 + UID Format : 02 + UID Length : 09 + UID : "\_SB.MHSP" +``` + +SSDT: +``` +Device (MHSP) +{ + Name (_ADR, Zero) // _ADR: Address + Name (_HID, "MSFT0201") // _HID: Hardware ID + Name (_UID, One) // _UID: Unique ID +``` + +To handle this case; while enumerating ACPI devices in +get_acpihid_device_id() count the number of matching ACPI devices with +a matching _HID. If there is exactly one _HID match then accept it even +if the UID doesn't match. Other operating systems allow this, but the +current IVRS spec leaves some ambiguity whether to allow or disallow it. +This should be clarified in future revisions of the spec. Output +'Firmware Bug' for this case to encourage it to be solved in the BIOS. + +Signed-off-by: Mario Limonciello +Reviewed-by: Vasant Hegde +Link: https://lore.kernel.org/r/20250512173129.1274275-1-superm1@kernel.org +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 33 ++++++++++++++++++++++++++++----- + 1 file changed, 28 insertions(+), 5 deletions(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index f34209b08b4c5..a05e0eb1729bf 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -241,7 +241,9 @@ static inline int get_acpihid_device_id(struct device *dev, + struct acpihid_map_entry **entry) + { + struct acpi_device *adev = ACPI_COMPANION(dev); +- struct acpihid_map_entry *p; ++ struct acpihid_map_entry *p, *p1 = NULL; ++ int hid_count = 0; ++ bool fw_bug; + + if (!adev) + return -ENODEV; +@@ -249,12 +251,33 @@ static inline int get_acpihid_device_id(struct device *dev, + list_for_each_entry(p, &acpihid_map, list) { + if (acpi_dev_hid_uid_match(adev, p->hid, + p->uid[0] ? p->uid : NULL)) { +- if (entry) +- *entry = p; +- return p->devid; ++ p1 = p; ++ fw_bug = false; ++ hid_count = 1; ++ break; ++ } ++ ++ /* ++ * Count HID matches w/o UID, raise FW_BUG but allow exactly one match ++ */ ++ if (acpi_dev_hid_match(adev, p->hid)) { ++ p1 = p; ++ hid_count++; ++ fw_bug = true; + } + } +- return -EINVAL; ++ ++ if (!p1) ++ return -EINVAL; ++ if (fw_bug) ++ dev_err_once(dev, FW_BUG "No ACPI device matched UID, but %d device%s matched HID.\n", ++ hid_count, hid_count > 1 ? "s" : ""); ++ if (hid_count > 1) ++ return -EINVAL; ++ if (entry) ++ *entry = p1; ++ ++ return p1->devid; + } + + static inline int get_device_sbdf_id(struct device *dev) +-- +2.39.5 + diff --git a/queue-6.15/iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch b/queue-6.15/iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch new file mode 100644 index 0000000000..7906ea07b0 --- /dev/null +++ b/queue-6.15/iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch @@ -0,0 +1,43 @@ +From ac90b68ac6d9547469624b4334ab3d8a1db92f48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 20:10:48 -0700 +Subject: iommu/amd: Ensure GA log notifier callbacks finish running before + module unload + +From: Sean Christopherson + +[ Upstream commit 94c721ea03c7078163f41dbaa101ac721ddac329 ] + +Synchronize RCU when unregistering KVM's GA log notifier to ensure all +in-flight interrupt handlers complete before KVM-the module is unloaded. + +Signed-off-by: Sean Christopherson +Link: https://lore.kernel.org/r/20250315031048.2374109-1-seanjc@google.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index a05e0eb1729bf..31f8d208dedb7 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1005,6 +1005,14 @@ int amd_iommu_register_ga_log_notifier(int (*notifier)(u32)) + { + iommu_ga_log_notifier = notifier; + ++ /* ++ * Ensure all in-flight IRQ handlers run to completion before returning ++ * to the caller, e.g. to ensure module code isn't unloaded while it's ++ * being executed in the IRQ handler. ++ */ ++ if (!notifier) ++ synchronize_rcu(); ++ + return 0; + } + EXPORT_SYMBOL(amd_iommu_register_ga_log_notifier); +-- +2.39.5 + diff --git a/queue-6.15/ipmi-ssif-fix-a-shutdown-race.patch b/queue-6.15/ipmi-ssif-fix-a-shutdown-race.patch new file mode 100644 index 0000000000..3e6277581b --- /dev/null +++ b/queue-6.15/ipmi-ssif-fix-a-shutdown-race.patch @@ -0,0 +1,51 @@ +From 3f41341f86af1256ebe9d72d27ec8d82bc3f32eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 14:44:26 -0500 +Subject: ipmi:ssif: Fix a shutdown race + +From: Corey Minyard + +[ Upstream commit 6bd0eb6d759b9a22c5509ea04e19c2e8407ba418 ] + +It was possible for the SSIF thread to stop and quit before the +kthread_stop() call because ssif->stopping was set before the +stop. So only exit the SSIF thread is kthread_should_stop() +returns true. + +There is no need to wake the thread, as the wait will be interrupted +by kthread_stop(). + +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_ssif.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 0b45b07dec22c..5bf038e620c75 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -481,8 +481,6 @@ static int ipmi_ssif_thread(void *data) + /* Wait for something to do */ + result = wait_for_completion_interruptible( + &ssif_info->wake_thread); +- if (ssif_info->stopping) +- break; + if (result == -ERESTARTSYS) + continue; + init_completion(&ssif_info->wake_thread); +@@ -1270,10 +1268,8 @@ static void shutdown_ssif(void *send_info) + ssif_info->stopping = true; + timer_delete_sync(&ssif_info->watch_timer); + timer_delete_sync(&ssif_info->retry_timer); +- if (ssif_info->thread) { +- complete(&ssif_info->wake_thread); ++ if (ssif_info->thread) + kthread_stop(ssif_info->thread); +- } + } + + static void ssif_remove(struct i2c_client *client) +-- +2.39.5 + diff --git a/queue-6.15/ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch b/queue-6.15/ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch new file mode 100644 index 0000000000..8d24b6f61d --- /dev/null +++ b/queue-6.15/ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch @@ -0,0 +1,44 @@ +From 87e05c2a55d41163774713ad6a8e71d5b2c320c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 11:27:24 +0200 +Subject: ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 1c0829788a6e6e165846b9bedd0b908ef16260b6 ] + +The statistics are incremented with raw_cpu_inc() assuming it always +happens with bottom half disabled. Without per-CPU locking in +local_bh_disable() on PREEMPT_RT this is no longer true. + +Use this_cpu_inc() on PREEMPT_RT for the increment to not worry about +preemption. + +Cc: David Ahern +Signed-off-by: Sebastian Andrzej Siewior +Link: https://patch.msgid.link/20250512092736.229935-4-bigeasy@linutronix.de +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 753704f75b2c6..5d7c7efea66cc 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -189,7 +189,11 @@ const __u8 ip_tos2prio[16] = { + EXPORT_SYMBOL(ip_tos2prio); + + static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat); ++#ifndef CONFIG_PREEMPT_RT + #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field) ++#else ++#define RT_CACHE_STAT_INC(field) this_cpu_inc(rt_cache_stat.field) ++#endif + + #ifdef CONFIG_PROC_FS + static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos) +-- +2.39.5 + diff --git a/queue-6.15/isofs-fix-y2038-and-y2156-issues-in-rock-ridge-tf-en.patch b/queue-6.15/isofs-fix-y2038-and-y2156-issues-in-rock-ridge-tf-en.patch new file mode 100644 index 0000000000..b3fe5e230b --- /dev/null +++ b/queue-6.15/isofs-fix-y2038-and-y2156-issues-in-rock-ridge-tf-en.patch @@ -0,0 +1,234 @@ +From d47781be3350ab1824ffb851cb71104f645ef9c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 16:50:21 +0200 +Subject: isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry + +From: Jonas 'Sortie' Termansen + +[ Upstream commit 5ea45f54c8d6ca2a95b7bd450ee9eb253310bfd3 ] + +This change implements the Rock Ridge TF entry LONG_FORM bit, which uses +the ISO 9660 17-byte date format (up to year 9999, with 10ms precision) +instead of the 7-byte date format (up to year 2155, with 1s precision). + +Previously the LONG_FORM bit was ignored; and isofs would entirely +misinterpret the date as the wrong format, resulting in garbage +timestamps on the filesystem. + +The Y2038 issue in iso_date() is fixed by returning a struct timespec64 +instead of an int. + +parse_rock_ridge_inode_internal() is fixed so it does proper bounds +checks of the TF entry timestamps. + +Signed-off-by: Jonas 'Sortie' Termansen +Signed-off-by: Jan Kara +Link: https://patch.msgid.link/20250411145022.2292255-1-sortie@maxsi.org +Signed-off-by: Sasha Levin +--- + fs/isofs/inode.c | 7 +++++-- + fs/isofs/isofs.h | 4 +++- + fs/isofs/rock.c | 40 ++++++++++++++++++++++----------------- + fs/isofs/rock.h | 6 +----- + fs/isofs/util.c | 49 +++++++++++++++++++++++++++++++----------------- + 5 files changed, 64 insertions(+), 42 deletions(-) + +diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c +index 47038e6608123..d5da9817df9b3 100644 +--- a/fs/isofs/inode.c ++++ b/fs/isofs/inode.c +@@ -1275,6 +1275,7 @@ static int isofs_read_inode(struct inode *inode, int relocated) + unsigned long offset; + struct iso_inode_info *ei = ISOFS_I(inode); + int ret = -EIO; ++ struct timespec64 ts; + + block = ei->i_iget5_block; + bh = sb_bread(inode->i_sb, block); +@@ -1387,8 +1388,10 @@ static int isofs_read_inode(struct inode *inode, int relocated) + inode->i_ino, de->flags[-high_sierra]); + } + #endif +- inode_set_mtime_to_ts(inode, +- inode_set_atime_to_ts(inode, inode_set_ctime(inode, iso_date(de->date, high_sierra), 0))); ++ ts = iso_date(de->date, high_sierra ? ISO_DATE_HIGH_SIERRA : 0); ++ inode_set_ctime_to_ts(inode, ts); ++ inode_set_atime_to_ts(inode, ts); ++ inode_set_mtime_to_ts(inode, ts); + + ei->i_first_extent = (isonum_733(de->extent) + + isonum_711(de->ext_attr_length)); +diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h +index 2d55207c9a990..5065558375333 100644 +--- a/fs/isofs/isofs.h ++++ b/fs/isofs/isofs.h +@@ -106,7 +106,9 @@ static inline unsigned int isonum_733(u8 *p) + /* Ignore bigendian datum due to broken mastering programs */ + return get_unaligned_le32(p); + } +-extern int iso_date(u8 *, int); ++#define ISO_DATE_HIGH_SIERRA (1 << 0) ++#define ISO_DATE_LONG_FORM (1 << 1) ++struct timespec64 iso_date(u8 *p, int flags); + + struct inode; /* To make gcc happy */ + +diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c +index dbf911126e610..576498245b9d7 100644 +--- a/fs/isofs/rock.c ++++ b/fs/isofs/rock.c +@@ -412,7 +412,12 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de, + } + } + break; +- case SIG('T', 'F'): ++ case SIG('T', 'F'): { ++ int flags, size, slen; ++ ++ flags = rr->u.TF.flags & TF_LONG_FORM ? ISO_DATE_LONG_FORM : 0; ++ size = rr->u.TF.flags & TF_LONG_FORM ? 17 : 7; ++ slen = rr->len - 5; + /* + * Some RRIP writers incorrectly place ctime in the + * TF_CREATE field. Try to handle this correctly for +@@ -420,27 +425,28 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de, + */ + /* Rock ridge never appears on a High Sierra disk */ + cnt = 0; +- if (rr->u.TF.flags & TF_CREATE) { +- inode_set_ctime(inode, +- iso_date(rr->u.TF.times[cnt++].time, 0), +- 0); ++ if ((rr->u.TF.flags & TF_CREATE) && size <= slen) { ++ inode_set_ctime_to_ts(inode, ++ iso_date(rr->u.TF.data + size * cnt++, flags)); ++ slen -= size; + } +- if (rr->u.TF.flags & TF_MODIFY) { +- inode_set_mtime(inode, +- iso_date(rr->u.TF.times[cnt++].time, 0), +- 0); ++ if ((rr->u.TF.flags & TF_MODIFY) && size <= slen) { ++ inode_set_mtime_to_ts(inode, ++ iso_date(rr->u.TF.data + size * cnt++, flags)); ++ slen -= size; + } +- if (rr->u.TF.flags & TF_ACCESS) { +- inode_set_atime(inode, +- iso_date(rr->u.TF.times[cnt++].time, 0), +- 0); ++ if ((rr->u.TF.flags & TF_ACCESS) && size <= slen) { ++ inode_set_atime_to_ts(inode, ++ iso_date(rr->u.TF.data + size * cnt++, flags)); ++ slen -= size; + } +- if (rr->u.TF.flags & TF_ATTRIBUTES) { +- inode_set_ctime(inode, +- iso_date(rr->u.TF.times[cnt++].time, 0), +- 0); ++ if ((rr->u.TF.flags & TF_ATTRIBUTES) && size <= slen) { ++ inode_set_ctime_to_ts(inode, ++ iso_date(rr->u.TF.data + size * cnt++, flags)); ++ slen -= size; + } + break; ++ } + case SIG('S', 'L'): + { + int slen; +diff --git a/fs/isofs/rock.h b/fs/isofs/rock.h +index 7755e587f7785..c0856fa9bb6a4 100644 +--- a/fs/isofs/rock.h ++++ b/fs/isofs/rock.h +@@ -65,13 +65,9 @@ struct RR_PL_s { + __u8 location[8]; + }; + +-struct stamp { +- __u8 time[7]; /* actually 6 unsigned, 1 signed */ +-} __attribute__ ((packed)); +- + struct RR_TF_s { + __u8 flags; +- struct stamp times[]; /* Variable number of these beasts */ ++ __u8 data[]; + } __attribute__ ((packed)); + + /* Linux-specific extension for transparent decompression */ +diff --git a/fs/isofs/util.c b/fs/isofs/util.c +index e88dba7216618..42f479da0b282 100644 +--- a/fs/isofs/util.c ++++ b/fs/isofs/util.c +@@ -16,29 +16,44 @@ + * to GMT. Thus we should always be correct. + */ + +-int iso_date(u8 *p, int flag) ++struct timespec64 iso_date(u8 *p, int flags) + { + int year, month, day, hour, minute, second, tz; +- int crtime; ++ struct timespec64 ts; ++ ++ if (flags & ISO_DATE_LONG_FORM) { ++ year = (p[0] - '0') * 1000 + ++ (p[1] - '0') * 100 + ++ (p[2] - '0') * 10 + ++ (p[3] - '0') - 1900; ++ month = ((p[4] - '0') * 10 + (p[5] - '0')); ++ day = ((p[6] - '0') * 10 + (p[7] - '0')); ++ hour = ((p[8] - '0') * 10 + (p[9] - '0')); ++ minute = ((p[10] - '0') * 10 + (p[11] - '0')); ++ second = ((p[12] - '0') * 10 + (p[13] - '0')); ++ ts.tv_nsec = ((p[14] - '0') * 10 + (p[15] - '0')) * 10000000; ++ tz = p[16]; ++ } else { ++ year = p[0]; ++ month = p[1]; ++ day = p[2]; ++ hour = p[3]; ++ minute = p[4]; ++ second = p[5]; ++ ts.tv_nsec = 0; ++ /* High sierra has no time zone */ ++ tz = flags & ISO_DATE_HIGH_SIERRA ? 0 : p[6]; ++ } + +- year = p[0]; +- month = p[1]; +- day = p[2]; +- hour = p[3]; +- minute = p[4]; +- second = p[5]; +- if (flag == 0) tz = p[6]; /* High sierra has no time zone */ +- else tz = 0; +- + if (year < 0) { +- crtime = 0; ++ ts.tv_sec = 0; + } else { +- crtime = mktime64(year+1900, month, day, hour, minute, second); ++ ts.tv_sec = mktime64(year+1900, month, day, hour, minute, second); + + /* sign extend */ + if (tz & 0x80) + tz |= (-1 << 8); +- ++ + /* + * The timezone offset is unreliable on some disks, + * so we make a sanity check. In no case is it ever +@@ -65,7 +80,7 @@ int iso_date(u8 *p, int flag) + * for pointing out the sign error. + */ + if (-52 <= tz && tz <= 52) +- crtime -= tz * 15 * 60; ++ ts.tv_sec -= tz * 15 * 60; + } +- return crtime; +-} ++ return ts; ++} +-- +2.39.5 + diff --git a/queue-6.15/ixgbe-fix-unreachable-retry-logic-in-combined-and-by.patch b/queue-6.15/ixgbe-fix-unreachable-retry-logic-in-combined-and-by.patch new file mode 100644 index 0000000000..926f7f2a41 --- /dev/null +++ b/queue-6.15/ixgbe-fix-unreachable-retry-logic-in-combined-and-by.patch @@ -0,0 +1,56 @@ +From 467154f8cdfbf7bd74e79e42caa52ddf13d7ee2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Mar 2025 13:12:00 +0300 +Subject: ixgbe: Fix unreachable retry logic in combined and byte I2C write + functions + +From: Rand Deeb + +[ Upstream commit cdcb3804eeda24d588348bbab6766cf14fddbeaa ] + +The current implementation of `ixgbe_write_i2c_combined_generic_int` and +`ixgbe_write_i2c_byte_generic_int` sets `max_retry` to `1`, which makes +the condition `retry < max_retry` always evaluate to `false`. This renders +the retry mechanism ineffective, as the debug message and retry logic are +never executed. + +This patch increases `max_retry` to `3` in both functions, aligning them +with the retry logic in `ixgbe_read_i2c_combined_generic_int`. This +ensures that the retry mechanism functions as intended, improving +robustness in case of I2C write failures. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Rand Deeb +Tested-by: Rinitha S (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c +index 0a03a8bb5f886..2d54828bdfbbc 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c +@@ -167,7 +167,7 @@ int ixgbe_write_i2c_combined_generic_int(struct ixgbe_hw *hw, u8 addr, + u16 reg, u16 val, bool lock) + { + u32 swfw_mask = hw->phy.phy_semaphore_mask; +- int max_retry = 1; ++ int max_retry = 3; + int retry = 0; + u8 reg_high; + u8 csum; +@@ -2285,7 +2285,7 @@ static int ixgbe_write_i2c_byte_generic_int(struct ixgbe_hw *hw, u8 byte_offset, + u8 dev_addr, u8 data, bool lock) + { + u32 swfw_mask = hw->phy.phy_semaphore_mask; +- u32 max_retry = 1; ++ u32 max_retry = 3; + u32 retry = 0; + int status; + +-- +2.39.5 + diff --git a/queue-6.15/jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch b/queue-6.15/jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch new file mode 100644 index 0000000000..d00d17d2a4 --- /dev/null +++ b/queue-6.15/jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch @@ -0,0 +1,85 @@ +From 13cd373c6e258aab31c18c45b41721f1e74c83bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 20:59:16 +0530 +Subject: jfs: fix array-index-out-of-bounds read in add_missing_indices + +From: Aditya Dutt + +[ Upstream commit 5dff41a86377563f7a2b968aae00d25b4ceb37c9 ] + +stbl is s8 but it must contain offsets into slot which can go from 0 to +127. + +Added a bound check for that error and return -EIO if the check fails. +Also make jfs_readdir return with error if add_missing_indices returns +with an error. + +Reported-by: syzbot+b974bd41515f770c608b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com./bug?extid=b974bd41515f770c608b +Signed-off-by: Aditya Dutt +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dtree.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c +index 93db6eec44655..ab11849cf9cc3 100644 +--- a/fs/jfs/jfs_dtree.c ++++ b/fs/jfs/jfs_dtree.c +@@ -2613,7 +2613,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot) + * fsck.jfs should really fix this, but it currently does not. + * Called from jfs_readdir when bad index is detected. + */ +-static void add_missing_indices(struct inode *inode, s64 bn) ++static int add_missing_indices(struct inode *inode, s64 bn) + { + struct ldtentry *d; + struct dt_lock *dtlck; +@@ -2622,7 +2622,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) + struct lv *lv; + struct metapage *mp; + dtpage_t *p; +- int rc; ++ int rc = 0; + s8 *stbl; + tid_t tid; + struct tlock *tlck; +@@ -2647,6 +2647,16 @@ static void add_missing_indices(struct inode *inode, s64 bn) + + stbl = DT_GETSTBL(p); + for (i = 0; i < p->header.nextindex; i++) { ++ if (stbl[i] < 0) { ++ jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld", ++ i, stbl[i], (long)inode->i_ino, (long long)bn); ++ rc = -EIO; ++ ++ DT_PUTPAGE(mp); ++ txAbort(tid, 0); ++ goto end; ++ } ++ + d = (struct ldtentry *) &p->slot[stbl[i]]; + index = le32_to_cpu(d->index); + if ((index < 2) || (index >= JFS_IP(inode)->next_index)) { +@@ -2664,6 +2674,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) + (void) txCommit(tid, 1, &inode, 0); + end: + txEnd(tid); ++ return rc; + } + + /* +@@ -3017,7 +3028,8 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) + } + + if (fix_page) { +- add_missing_indices(ip, bn); ++ if ((rc = add_missing_indices(ip, bn))) ++ goto out; + page_fixed = 1; + } + +-- +2.39.5 + diff --git a/queue-6.15/jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch b/queue-6.15/jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch new file mode 100644 index 0000000000..90049ec511 --- /dev/null +++ b/queue-6.15/jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch @@ -0,0 +1,119 @@ +From d0a9f4949184be43d88bb8b0c07f6a6844bc2447 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Mar 2025 16:02:00 +0800 +Subject: jfs: Fix null-ptr-deref in jfs_ioc_trim + +From: Dylan Wolff + +[ Upstream commit a4685408ff6c3e2af366ad9a7274f45ff3f394ee ] + +[ Syzkaller Report ] + +Oops: general protection fault, probably for non-canonical address +0xdffffc0000000087: 0000 [#1 +KASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f] +CPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tainted +6.13.0-rc6-gfbfd64d25c7a-dirty #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +Sched_ext: serialise (enabled+all), task: runnable_at=-30ms +RIP: 0010:jfs_ioc_trim+0x34b/0x8f0 +Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 +90 82 fe ff 4c 89 ff 31 f6 +RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206 +RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a +RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 +RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 +R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 +R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 +FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +? __die_body+0x61/0xb0 +? die_addr+0xb1/0xe0 +? exc_general_protection+0x333/0x510 +? asm_exc_general_protection+0x26/0x30 +? jfs_ioc_trim+0x34b/0x8f0 +jfs_ioctl+0x3c8/0x4f0 +? __pfx_jfs_ioctl+0x10/0x10 +? __pfx_jfs_ioctl+0x10/0x10 +__se_sys_ioctl+0x269/0x350 +? __pfx___se_sys_ioctl+0x10/0x10 +? do_syscall_64+0xfb/0x210 +do_syscall_64+0xee/0x210 +? syscall_exit_to_user_mode+0x1e0/0x330 +entry_SYSCALL_64_after_hwframe+0x77/0x7f +RIP: 0033:0x7fe51f4903ad +Code: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 +89 f7 48 89 d6 48 89 ca 4d +RSP: 002b:00007fe5202250c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +RAX: ffffffffffffffda RBX: 00007fe51f5cbf80 RCX: 00007fe51f4903ad +RDX: 0000000020000680 RSI: 00000000c0185879 RDI: 0000000000000005 +RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe520225640 +R13: 000000000000000e R14: 00007fe51f44fca0 R15: 00007fe52021d000 + +Modules linked in: +---[ end trace 0000000000000000 ]--- +RIP: 0010:jfs_ioc_trim+0x34b/0x8f0 +Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 +90 82 fe ff 4c 89 ff 31 f6 +RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206 +RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a +RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 +RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 +R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 +R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 +FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Kernel panic - not syncing: Fatal exception + +[ Analysis ] + +We believe that we have found a concurrency bug in the `fs/jfs` module +that results in a null pointer dereference. There is a closely related +issue which has been fixed: + +https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234 + +... but, unfortunately, the accepted patch appears to still be +susceptible to a null pointer dereference under some interleavings. + +To trigger the bug, we think that `JFS_SBI(ipbmap->i_sb)->bmap` is set +to NULL in `dbFreeBits` and then dereferenced in `jfs_ioc_trim`. This +bug manifests quite rarely under normal circumstances, but is +triggereable from a syz-program. + +Reported-and-tested-by: Dylan J. Wolff +Reported-and-tested-by: Jiacheng Xu +Signed-off-by: Dylan J. Wolff +Signed-off-by: Jiacheng Xu +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_discard.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/jfs/jfs_discard.c b/fs/jfs/jfs_discard.c +index 5f4b305030ad5..4b660296caf39 100644 +--- a/fs/jfs/jfs_discard.c ++++ b/fs/jfs/jfs_discard.c +@@ -86,7 +86,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) + down_read(&sb->s_umount); + bmp = JFS_SBI(ip->i_sb)->bmap; + +- if (minlen > bmp->db_agsize || ++ if (bmp == NULL || ++ minlen > bmp->db_agsize || + start >= bmp->db_mapsize || + range->len < sb->s_blocksize) { + up_read(&sb->s_umount); +-- +2.39.5 + diff --git a/queue-6.15/libbpf-add-identical-pointer-detection-to-btf_dedup_.patch b/queue-6.15/libbpf-add-identical-pointer-detection-to-btf_dedup_.patch new file mode 100644 index 0000000000..3f6db5b91f --- /dev/null +++ b/queue-6.15/libbpf-add-identical-pointer-detection-to-btf_dedup_.patch @@ -0,0 +1,71 @@ +From 6fcb52b84c501ceebcf7b021c5e837249de88433 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Apr 2025 17:10:42 +0100 +Subject: libbpf: Add identical pointer detection to btf_dedup_is_equiv() + +From: Alan Maguire + +[ Upstream commit 8e64c387c942229c551d0f23de4d9993d3a2acb6 ] + +Recently as a side-effect of + +commit ac053946f5c4 ("compiler.h: introduce TYPEOF_UNQUAL() macro") + +issues were observed in deduplication between modules and kernel BTF +such that a large number of kernel types were not deduplicated so +were found in module BTF (task_struct, bpf_prog etc). The root cause +appeared to be a failure to dedup struct types, specifically those +with members that were pointers with __percpu annotations. + +The issue in dedup is at the point that we are deduplicating structures, +we have not yet deduplicated reference types like pointers. If multiple +copies of a pointer point at the same (deduplicated) integer as in this +case, we do not see them as identical. Special handling already exists +to deal with structures and arrays, so add pointer handling here too. + +Reported-by: Alexei Starovoitov +Signed-off-by: Alan Maguire +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250429161042.2069678-1-alan.maguire@oracle.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c +index 8a7650e6480f9..39b18521d5472 100644 +--- a/tools/lib/bpf/btf.c ++++ b/tools/lib/bpf/btf.c +@@ -4390,6 +4390,19 @@ static bool btf_dedup_identical_structs(struct btf_dedup *d, __u32 id1, __u32 id + return true; + } + ++static bool btf_dedup_identical_ptrs(struct btf_dedup *d, __u32 id1, __u32 id2) ++{ ++ struct btf_type *t1, *t2; ++ ++ t1 = btf_type_by_id(d->btf, id1); ++ t2 = btf_type_by_id(d->btf, id2); ++ ++ if (!btf_is_ptr(t1) || !btf_is_ptr(t2)) ++ return false; ++ ++ return t1->type == t2->type; ++} ++ + /* + * Check equivalence of BTF type graph formed by candidate struct/union (we'll + * call it "candidate graph" in this description for brevity) to a type graph +@@ -4522,6 +4535,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id, + */ + if (btf_dedup_identical_structs(d, hypot_type_id, cand_id)) + return 1; ++ /* A similar case is again observed for PTRs. */ ++ if (btf_dedup_identical_ptrs(d, hypot_type_id, cand_id)) ++ return 1; + return 0; + } + +-- +2.39.5 + diff --git a/queue-6.15/libbpf-btf-fix-string-handling-to-support-multi-spli.patch b/queue-6.15/libbpf-btf-fix-string-handling-to-support-multi-spli.patch new file mode 100644 index 0000000000..ede8a20816 --- /dev/null +++ b/queue-6.15/libbpf-btf-fix-string-handling-to-support-multi-spli.patch @@ -0,0 +1,41 @@ +From 905d7837d5b003399eb19100a115e12cd067bc85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 May 2025 17:59:34 +0100 +Subject: libbpf/btf: Fix string handling to support multi-split BTF + +From: Alan Maguire + +[ Upstream commit 4e29128a9acec2a622734844bedee013e2901bdf ] + +libbpf handling of split BTF has been written largely with the +assumption that multiple splits are possible, i.e. split BTF on top of +split BTF on top of base BTF. One area where this does not quite work +is string handling in split BTF; the start string offset should be the +base BTF string section length + the base BTF string offset. This +worked in the past because for a single split BTF with base the start +string offset was always 0. + +Signed-off-by: Alan Maguire +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250519165935.261614-2-alan.maguire@oracle.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c +index 38bc6b14b0666..8a7650e6480f9 100644 +--- a/tools/lib/bpf/btf.c ++++ b/tools/lib/bpf/btf.c +@@ -996,7 +996,7 @@ static struct btf *btf_new_empty(struct btf *base_btf) + if (base_btf) { + btf->base_btf = base_btf; + btf->start_id = btf__type_cnt(base_btf); +- btf->start_str_off = base_btf->hdr->str_len; ++ btf->start_str_off = base_btf->hdr->str_len + base_btf->start_str_off; + btf->swapped_endian = base_btf->swapped_endian; + } + +-- +2.39.5 + diff --git a/queue-6.15/libbpf-check-bpf_map_skeleton-link-for-null.patch b/queue-6.15/libbpf-check-bpf_map_skeleton-link-for-null.patch new file mode 100644 index 0000000000..97c6eb3fdc --- /dev/null +++ b/queue-6.15/libbpf-check-bpf_map_skeleton-link-for-null.patch @@ -0,0 +1,45 @@ +From 4fe3ea21bc9f19057a6884447a49988b96ff5d6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 12:32:20 +0100 +Subject: libbpf: Check bpf_map_skeleton link for NULL + +From: Mykyta Yatsenko + +[ Upstream commit d0445d7dd3fd9b15af7564c38d7aa3cbc29778ee ] + +Avoid dereferencing bpf_map_skeleton's link field if it's NULL. +If BPF map skeleton is created with the size, that indicates containing +link field, but the field was not actually initialized with valid +bpf_link pointer, libbpf crashes. This may happen when using libbpf-rs +skeleton. +Skeleton loading may still progress, but user needs to attach struct_ops +map separately. + +Signed-off-by: Mykyta Yatsenko +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20250514113220.219095-1-mykyta.yatsenko5@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 147964bb64c8f..30cf210261032 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -14078,6 +14078,12 @@ int bpf_object__attach_skeleton(struct bpf_object_skeleton *s) + } + + link = map_skel->link; ++ if (!link) { ++ pr_warn("map '%s': BPF map skeleton link is uninitialized\n", ++ bpf_map__name(map)); ++ continue; ++ } ++ + if (*link) + continue; + +-- +2.39.5 + diff --git a/queue-6.15/make-cc-option-work-correctly-for-the-wno-xyzzy-patt.patch b/queue-6.15/make-cc-option-work-correctly-for-the-wno-xyzzy-patt.patch new file mode 100644 index 0000000000..35f65ab2c7 --- /dev/null +++ b/queue-6.15/make-cc-option-work-correctly-for-the-wno-xyzzy-patt.patch @@ -0,0 +1,68 @@ +From 4c66d7afc60328e94274b0ea61d0132fd516f40d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 May 2025 14:35:51 -0700 +Subject: Make 'cc-option' work correctly for the -Wno-xyzzy pattern +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +[ Upstream commit 550ccb178de2f379f5e1a1833dd6f4bdafef4b68 ] + +This is the follow-up to commit a79be02bba5c ("Fix mis-uses of +'cc-option' for warning disablement") where I mentioned that the best +fix would be to just make 'cc-option' a bit smarter, and work for all +compiler options, including the '-Wno-xyzzy' pattern that it used to +accept unknown options for. + +It turns out that fixing cc-option is pretty straightforward: just +rewrite any '-Wno-xyzzy' option pattern to use '-Wxyzzy' instead for +testing. + +That makes the whole artificial distinction between 'cc-option' and +'cc-disable-warning' go away, and we can happily forget about the odd +build rule that you have to treat compiler options that disable warnings +specially. + +The 'cc-disable-warning' helper remains as a backwards compatibility +syntax for now, but is implemented in terms of the new and improved +cc-option. + +Acked-by: Masahiro Yamada +Cc: Greg Kroah-Hartman +Cc: Arnd Bergmann +Cc: Stephen Rothwell +Cc: Thomas Weißschuh +Cc: Nathan Chancellor +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/Makefile.compiler | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/Makefile.compiler b/scripts/Makefile.compiler +index f4fcc1eaaeaee..65cfa72e376be 100644 +--- a/scripts/Makefile.compiler ++++ b/scripts/Makefile.compiler +@@ -43,7 +43,7 @@ as-instr = $(call try-run,\ + # __cc-option + # Usage: MY_CFLAGS += $(call __cc-option,$(CC),$(MY_CFLAGS),-march=winchip-c6,-march=i586) + __cc-option = $(call try-run,\ +- $(1) -Werror $(2) $(3) -c -x c /dev/null -o "$$TMP",$(3),$(4)) ++ $(1) -Werror $(2) $(3:-Wno-%=-W%) -c -x c /dev/null -o "$$TMP",$(3),$(4)) + + # cc-option + # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586) +@@ -57,7 +57,7 @@ cc-option-yn = $(if $(call cc-option,$1),y,n) + + # cc-disable-warning + # Usage: cflags-y += $(call cc-disable-warning,unused-but-set-variable) +-cc-disable-warning = $(if $(call cc-option,-W$(strip $1)),-Wno-$(strip $1)) ++cc-disable-warning = $(call cc-option,-Wno-$(strip $1)) + + # gcc-min-version + # Usage: cflags-$(call gcc-min-version, 70100) += -foo +-- +2.39.5 + diff --git a/queue-6.15/media-ccs-pll-better-validate-vt-pll-branch.patch b/queue-6.15/media-ccs-pll-better-validate-vt-pll-branch.patch new file mode 100644 index 0000000000..0d7fda121e --- /dev/null +++ b/queue-6.15/media-ccs-pll-better-validate-vt-pll-branch.patch @@ -0,0 +1,67 @@ +From 313878bfba35a0689369c554ab311edec6e4d6ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2025 14:27:58 +0200 +Subject: media: ccs-pll: Better validate VT PLL branch + +From: Sakari Ailus + +[ Upstream commit cd9cb0313a42ae029cd5af9293b0add984ed252e ] + +Check that the VT PLL dividers are actually found, don't trust they always +are even though they should be. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ccs-pll.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/ccs-pll.c b/drivers/media/i2c/ccs-pll.c +index d985686b0a36b..2051f1f292294 100644 +--- a/drivers/media/i2c/ccs-pll.c ++++ b/drivers/media/i2c/ccs-pll.c +@@ -442,7 +442,7 @@ static int ccs_pll_calculate_vt_tree(struct device *dev, + return -EINVAL; + } + +-static void ++static int + ccs_pll_calculate_vt(struct device *dev, const struct ccs_pll_limits *lim, + const struct ccs_pll_branch_limits_bk *op_lim_bk, + struct ccs_pll *pll, struct ccs_pll_branch_fr *pll_fr, +@@ -565,6 +565,8 @@ ccs_pll_calculate_vt(struct device *dev, const struct ccs_pll_limits *lim, + if (best_pix_div < SHRT_MAX >> 1) + break; + } ++ if (best_pix_div == SHRT_MAX >> 1) ++ return -EINVAL; + + pll->vt_bk.sys_clk_div = DIV_ROUND_UP(vt_div, best_pix_div); + pll->vt_bk.pix_clk_div = best_pix_div; +@@ -577,6 +579,8 @@ ccs_pll_calculate_vt(struct device *dev, const struct ccs_pll_limits *lim, + out_calc_pixel_rate: + pll->pixel_rate_pixel_array = + pll->vt_bk.pix_clk_freq_hz * pll->vt_lanes; ++ ++ return 0; + } + + /* +@@ -852,8 +856,10 @@ int ccs_pll_calculate(struct device *dev, const struct ccs_pll_limits *lim, + if (pll->flags & CCS_PLL_FLAG_DUAL_PLL) + break; + +- ccs_pll_calculate_vt(dev, lim, op_lim_bk, pll, op_pll_fr, +- op_pll_bk, cphy, phy_const); ++ rval = ccs_pll_calculate_vt(dev, lim, op_lim_bk, pll, op_pll_fr, ++ op_pll_bk, cphy, phy_const); ++ if (rval) ++ continue; + + rval = check_bk_bounds(dev, lim, pll, PLL_VT); + if (rval) +-- +2.39.5 + diff --git a/queue-6.15/media-cec-extron-da-hd-4k-plus-fix-wformat-truncatio.patch b/queue-6.15/media-cec-extron-da-hd-4k-plus-fix-wformat-truncatio.patch new file mode 100644 index 0000000000..d83e65266f --- /dev/null +++ b/queue-6.15/media-cec-extron-da-hd-4k-plus-fix-wformat-truncatio.patch @@ -0,0 +1,40 @@ +From bc0d73a802743cb1a614d814119049e2a53c5f4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 14:17:55 +0000 +Subject: media: cec: extron-da-hd-4k-plus: Fix Wformat-truncation + +From: Hans Verkuil + +[ Upstream commit 5edc9b560f60c40e658af0b8e98ae2dfadc438d8 ] + +Fix gcc8 warning: + +drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c:1014:44: warning: 'DCEC' directive output may be truncated writing 4 bytes into a region of size between 0 and 53 [-Wformat-truncation=] + +Resizing the 'buf' and 'cmd' arrays fixed the warning. + +Signed-off-by: Ricardo Ribalda +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c +index cfbfc4c1b2e67..41d019b01ec09 100644 +--- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c ++++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c +@@ -1002,8 +1002,8 @@ static int extron_cec_adap_transmit(struct cec_adapter *adap, u8 attempts, + u32 signal_free_time, struct cec_msg *msg) + { + struct extron_port *port = cec_get_drvdata(adap); +- char buf[CEC_MAX_MSG_SIZE * 3 + 1]; +- char cmd[CEC_MAX_MSG_SIZE * 3 + 13]; ++ char buf[(CEC_MAX_MSG_SIZE - 1) * 3 + 1]; ++ char cmd[sizeof(buf) + 14]; + unsigned int i; + + if (port->disconnected) +-- +2.39.5 + diff --git a/queue-6.15/media-i2c-imx334-enable-runtime-pm-before-sub-device.patch b/queue-6.15/media-i2c-imx334-enable-runtime-pm-before-sub-device.patch new file mode 100644 index 0000000000..f758a0c14c --- /dev/null +++ b/queue-6.15/media-i2c-imx334-enable-runtime-pm-before-sub-device.patch @@ -0,0 +1,55 @@ +From 6391e68b35095f983caca83fa6aa0053d6e5fa02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Mar 2025 11:13:29 +0530 +Subject: media: i2c: imx334: Enable runtime PM before sub-device registration + +From: Tarang Raval + +[ Upstream commit 01dfdf6a80c57151af0589af0db7adbbdd1361c7 ] + +Runtime PM is fully initialized before calling +v4l2_async_register_subdev_sensor(). Moving the runtime PM initialization +earlier prevents potential access to an uninitialized or powered-down +device. + +Signed-off-by: Tarang Raval +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx334.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c +index a544fc3df39c2..b51721c01e1d6 100644 +--- a/drivers/media/i2c/imx334.c ++++ b/drivers/media/i2c/imx334.c +@@ -1391,6 +1391,9 @@ static int imx334_probe(struct i2c_client *client) + goto error_handler_free; + } + ++ pm_runtime_set_active(imx334->dev); ++ pm_runtime_enable(imx334->dev); ++ + ret = v4l2_async_register_subdev_sensor(&imx334->sd); + if (ret < 0) { + dev_err(imx334->dev, +@@ -1398,13 +1401,13 @@ static int imx334_probe(struct i2c_client *client) + goto error_media_entity; + } + +- pm_runtime_set_active(imx334->dev); +- pm_runtime_enable(imx334->dev); + pm_runtime_idle(imx334->dev); + + return 0; + + error_media_entity: ++ pm_runtime_disable(imx334->dev); ++ pm_runtime_set_suspended(imx334->dev); + media_entity_cleanup(&imx334->sd.entity); + error_handler_free: + v4l2_ctrl_handler_free(imx334->sd.ctrl_handler); +-- +2.39.5 + diff --git a/queue-6.15/media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch b/queue-6.15/media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch new file mode 100644 index 0000000000..811206360e --- /dev/null +++ b/queue-6.15/media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch @@ -0,0 +1,46 @@ +From a338399207130713174a5dad0bc1b86caddd5ff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Mar 2025 11:13:28 +0530 +Subject: media: i2c: imx334: Fix runtime PM handling in remove function + +From: Tarang Raval + +[ Upstream commit b493cd3c03641f9bbaa9787e43ca92163cb50051 ] + +pm_runtime_suspended() only checks the current runtime PM status and does +not modify it, making it ineffective in this context. This could result in +improper power management if the device remains active when removed. + +This patch fixes the issue by introducing a check with +pm_runtime_status_suspended() to determine if the device is already +suspended. If it is not, it calls imx334_power_off() to power down the +device and then uses pm_runtime_set_suspended() to correctly update the +runtime PM status to suspended. + +Signed-off-by: Tarang Raval +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx334.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c +index b51721c01e1d6..63d812a41542f 100644 +--- a/drivers/media/i2c/imx334.c ++++ b/drivers/media/i2c/imx334.c +@@ -1435,7 +1435,10 @@ static void imx334_remove(struct i2c_client *client) + v4l2_ctrl_handler_free(sd->ctrl_handler); + + pm_runtime_disable(&client->dev); +- pm_runtime_suspended(&client->dev); ++ if (!pm_runtime_status_suspended(&client->dev)) { ++ imx334_power_off(&client->dev); ++ pm_runtime_set_suspended(&client->dev); ++ } + + mutex_destroy(&imx334->mutex); + } +-- +2.39.5 + diff --git a/queue-6.15/media-i2c-imx334-update-mode_3840x2160_regs-array.patch b/queue-6.15/media-i2c-imx334-update-mode_3840x2160_regs-array.patch new file mode 100644 index 0000000000..3856b9eaa2 --- /dev/null +++ b/queue-6.15/media-i2c-imx334-update-mode_3840x2160_regs-array.patch @@ -0,0 +1,42 @@ +From 13556cb1520830859ca47aca5b8998b38777d974 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Mar 2025 10:44:41 +0530 +Subject: media: i2c: imx334: update mode_3840x2160_regs array + +From: Shravan Chippa + +[ Upstream commit 35132d039c566b0e9d8e53f76f512b22607c2405 ] + +The 3840x2160 mode operates with the imx334 reset values. +If we switch to other modes and then return to the 3840x2160 mode, +it should function correctly. so updated the mode_3840x2160_regs +array with the imx334 reset values. + +Signed-off-by: Shravan Chippa +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx334.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c +index 63d812a41542f..b47cb3b8f3689 100644 +--- a/drivers/media/i2c/imx334.c ++++ b/drivers/media/i2c/imx334.c +@@ -352,6 +352,12 @@ static const struct imx334_reg mode_3840x2160_regs[] = { + {0x302d, 0x00}, + {0x302e, 0x00}, + {0x302f, 0x0f}, ++ {0x3074, 0xb0}, ++ {0x3075, 0x00}, ++ {0x308e, 0xb1}, ++ {0x308f, 0x00}, ++ {0x30d8, 0x20}, ++ {0x30d9, 0x12}, + {0x3076, 0x70}, + {0x3077, 0x08}, + {0x3090, 0x70}, +-- +2.39.5 + diff --git a/queue-6.15/media-imx-jpeg-check-decoding-is-ongoing-for-motion-.patch b/queue-6.15/media-imx-jpeg-check-decoding-is-ongoing-for-motion-.patch new file mode 100644 index 0000000000..2f9de230e4 --- /dev/null +++ b/queue-6.15/media-imx-jpeg-check-decoding-is-ongoing-for-motion-.patch @@ -0,0 +1,112 @@ +From 4c7d2dbc91f7eee2a0b08501d98eeb3c2c250aaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 16:12:56 +0800 +Subject: media: imx-jpeg: Check decoding is ongoing for motion-jpeg + +From: Ming Qian + +[ Upstream commit fd5b6cd730676940df63b0970bb1ba30bca1aac3 ] + +As the first frame in "repeat-mode" is the pattern, the pattern done +interrupt is ignored by the driver. With small resolution bitstreams, +the interrupts might fire too quickly and hardware combine two irqs to +once because irq handle have latency. Thus the driver might miss the +frame decode done interrupt from the first actual frame. + +In order to avoid the driver wait for the frame done interrupt that has +been combined to the pattern done interrupt and been ignored, driver +will check the curr_desc and slot_status registers to figure out if the +decoding of actual frame is finished or not. + +Firstly we check the curr_desc register, +- if it is still pointing to the pattern descriptor, the second actual +frame is not started, we can wait for its frame-done interrupt. +- if the curr_desc has pointed to the frame descriptor, then we check the +ongoing bit of slot_status register. +- if the ongoing bit is set to 1, the decoding of the actual frame is not +finished, we can wait for its frame-done interrupt. +- if the ongoing bit is set to 0, the decoding of the actual frame is +finished, we can't wait for the second interrupt, but mark it as done. + +But there is still a small problem, that the curr_desc and slot_status +registers are not synchronous. curr_desc is updated when the +next_descpt_ptr is loaded, but the ongoing bit of slot_status is set +after the 32 bytes descriptor is loaded, there will be a short time +interval in between, which may cause fake false. Consider read register +is quite slow compared with IP read 32byte from memory, read twice +slot_status can avoid this situation. + +Signed-off-by: Ming Qian +Reviewed-by: Frank Li +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h | 1 + + .../media/platform/nxp/imx-jpeg/mxc-jpeg.c | 31 ++++++++++++++++++- + 2 files changed, 31 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h +index d579c804b0479..adb93e977be91 100644 +--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h ++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h +@@ -89,6 +89,7 @@ + /* SLOT_STATUS fields for slots 0..3 */ + #define SLOT_STATUS_FRMDONE (0x1 << 3) + #define SLOT_STATUS_ENC_CONFIG_ERR (0x1 << 8) ++#define SLOT_STATUS_ONGOING (0x1 << 31) + + /* SLOT_IRQ_EN fields TBD */ + +diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +index 8a25ea8905ae0..dce5620d29e47 100644 +--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c ++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +@@ -884,6 +884,34 @@ static u32 mxc_jpeg_get_plane_size(struct mxc_jpeg_q_data *q_data, u32 plane_no) + return size; + } + ++static bool mxc_dec_is_ongoing(struct mxc_jpeg_ctx *ctx) ++{ ++ struct mxc_jpeg_dev *jpeg = ctx->mxc_jpeg; ++ u32 curr_desc; ++ u32 slot_status; ++ ++ curr_desc = readl(jpeg->base_reg + MXC_SLOT_OFFSET(ctx->slot, SLOT_CUR_DESCPT_PTR)); ++ if (curr_desc == jpeg->slot_data.cfg_desc_handle) ++ return true; ++ ++ slot_status = readl(jpeg->base_reg + MXC_SLOT_OFFSET(ctx->slot, SLOT_STATUS)); ++ if (slot_status & SLOT_STATUS_ONGOING) ++ return true; ++ ++ /* ++ * The curr_desc register is updated when next_descpt_ptr is loaded, ++ * the ongoing bit of slot_status is set when the 32 bytes descriptor is loaded. ++ * So there will be a short time interval in between, which may cause fake false. ++ * Consider read register is quite slow compared with IP read 32byte from memory, ++ * read twice slot_status can avoid this situation. ++ */ ++ slot_status = readl(jpeg->base_reg + MXC_SLOT_OFFSET(ctx->slot, SLOT_STATUS)); ++ if (slot_status & SLOT_STATUS_ONGOING) ++ return true; ++ ++ return false; ++} ++ + static irqreturn_t mxc_jpeg_dec_irq(int irq, void *priv) + { + struct mxc_jpeg_dev *jpeg = priv; +@@ -953,7 +981,8 @@ static irqreturn_t mxc_jpeg_dec_irq(int irq, void *priv) + mxc_jpeg_enc_mode_go(dev, reg, mxc_jpeg_is_extended_sequential(q_data->fmt)); + goto job_unlock; + } +- if (jpeg->mode == MXC_JPEG_DECODE && jpeg_src_buf->dht_needed) { ++ if (jpeg->mode == MXC_JPEG_DECODE && jpeg_src_buf->dht_needed && ++ mxc_dec_is_ongoing(ctx)) { + jpeg_src_buf->dht_needed = false; + dev_dbg(dev, "Decoder DHT cfg finished. Start decoding...\n"); + goto job_unlock; +-- +2.39.5 + diff --git a/queue-6.15/media-nuvoton-npcm-video-fix-stuck-due-to-no-video-s.patch b/queue-6.15/media-nuvoton-npcm-video-fix-stuck-due-to-no-video-s.patch new file mode 100644 index 0000000000..c9ae959617 --- /dev/null +++ b/queue-6.15/media-nuvoton-npcm-video-fix-stuck-due-to-no-video-s.patch @@ -0,0 +1,57 @@ +From 02022d9d0f5de58c661044c16cf08ede85bb1168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 13:48:39 +0800 +Subject: media: nuvoton: npcm-video: Fix stuck due to no video signal error + +From: Michael Chang + +[ Upstream commit 497f1fb94759fa0c638f15c12b1ab3e586bccfcb ] + +Fix the issue when start_frame and detect_resolution +functions are executed at the same time, which may cause driver +stops capturing due to status of no video signal error. + +Signed-off-by: Michael Chang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/nuvoton/npcm-video.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/platform/nuvoton/npcm-video.c b/drivers/media/platform/nuvoton/npcm-video.c +index 7a9d8928ae401..3022fdcf66ec7 100644 +--- a/drivers/media/platform/nuvoton/npcm-video.c ++++ b/drivers/media/platform/nuvoton/npcm-video.c +@@ -863,7 +863,6 @@ static void npcm_video_detect_resolution(struct npcm_video *video) + struct regmap *gfxi = video->gfx_regmap; + unsigned int dispst; + +- video->v4l2_input_status = V4L2_IN_ST_NO_SIGNAL; + det->width = npcm_video_hres(video); + det->height = npcm_video_vres(video); + +@@ -892,12 +891,16 @@ static void npcm_video_detect_resolution(struct npcm_video *video) + clear_bit(VIDEO_RES_CHANGING, &video->flags); + } + +- if (det->width && det->height) ++ if (det->width && det->height) { + video->v4l2_input_status = 0; +- +- dev_dbg(video->dev, "Got resolution[%dx%d] -> [%dx%d], status %d\n", +- act->width, act->height, det->width, det->height, +- video->v4l2_input_status); ++ dev_dbg(video->dev, "Got resolution[%dx%d] -> [%dx%d], status %d\n", ++ act->width, act->height, det->width, det->height, ++ video->v4l2_input_status); ++ } else { ++ video->v4l2_input_status = V4L2_IN_ST_NO_SIGNAL; ++ dev_err(video->dev, "Got invalid resolution[%dx%d]\n", det->width, ++ det->height); ++ } + } + + static int npcm_video_set_resolution(struct npcm_video *video, +-- +2.39.5 + diff --git a/queue-6.15/media-platform-exynos4-is-add-hardware-sync-wait-to-.patch b/queue-6.15/media-platform-exynos4-is-add-hardware-sync-wait-to-.patch new file mode 100644 index 0000000000..787c3fc02d --- /dev/null +++ b/queue-6.15/media-platform-exynos4-is-add-hardware-sync-wait-to-.patch @@ -0,0 +1,39 @@ +From 9e42f8641deee01efd36b64a3fe8fef55a7ce5ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 10:13:45 +0800 +Subject: media: platform: exynos4-is: Add hardware sync wait to + fimc_is_hw_change_mode() + +From: Wentao Liang + +[ Upstream commit bd9f6ce7d512fa21249415c16af801a4ed5d97b6 ] + +In fimc_is_hw_change_mode(), the function changes camera modes without +waiting for hardware completion, risking corrupted data or system hangs +if subsequent operations proceed before the hardware is ready. + +Add fimc_is_hw_wait_intmsr0_intmsd0() after mode configuration, ensuring +hardware state synchronization and stable interrupt handling. + +Signed-off-by: Wentao Liang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/samsung/exynos4-is/fimc-is-regs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/samsung/exynos4-is/fimc-is-regs.c b/drivers/media/platform/samsung/exynos4-is/fimc-is-regs.c +index 366e6393817d2..5f9c44e825a5f 100644 +--- a/drivers/media/platform/samsung/exynos4-is/fimc-is-regs.c ++++ b/drivers/media/platform/samsung/exynos4-is/fimc-is-regs.c +@@ -164,6 +164,7 @@ int fimc_is_hw_change_mode(struct fimc_is *is) + if (WARN_ON(is->config_index >= ARRAY_SIZE(cmd))) + return -EINVAL; + ++ fimc_is_hw_wait_intmsr0_intmsd0(is); + mcuctl_write(cmd[is->config_index], is, MCUCTL_REG_ISSR(0)); + mcuctl_write(is->sensor_index, is, MCUCTL_REG_ISSR(1)); + mcuctl_write(is->setfile.sub_index, is, MCUCTL_REG_ISSR(2)); +-- +2.39.5 + diff --git a/queue-6.15/media-qcom-venus-fix-uninitialized-variable-warning.patch b/queue-6.15/media-qcom-venus-fix-uninitialized-variable-warning.patch new file mode 100644 index 0000000000..75c60c423c --- /dev/null +++ b/queue-6.15/media-qcom-venus-fix-uninitialized-variable-warning.patch @@ -0,0 +1,44 @@ +From 4f5aa59a8dc9ff80b3ab155a36ed66d426461822 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2024 15:10:33 +0900 +Subject: media: qcom: venus: Fix uninitialized variable warning + +From: Nas Chung + +[ Upstream commit 8e172e38a623ce284baf2514f963b29e4d47c62e ] + +Avoid uninitialized variable when both V4L2_TYPE_IS_OUTPUT() and +V4L2_TYPE_IS_CAPTURE() return false. + +Signed-off-by: Nas Chung +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/vdec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c +index 9f82882b77bcc..39d0556d7237d 100644 +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -154,14 +154,14 @@ find_format_by_index(struct venus_inst *inst, unsigned int index, u32 type) + return NULL; + + for (i = 0; i < size; i++) { +- bool valid; ++ bool valid = false; + + if (fmt[i].type != type) + continue; + + if (V4L2_TYPE_IS_OUTPUT(type)) { + valid = venus_helper_check_codec(inst, fmt[i].pixfmt); +- } else if (V4L2_TYPE_IS_CAPTURE(type)) { ++ } else { + valid = venus_helper_check_format(inst, fmt[i].pixfmt); + + if (fmt[i].pixfmt == V4L2_PIX_FMT_QC10C && +-- +2.39.5 + diff --git a/queue-6.15/media-rcar-vin-fix-stride-setting-for-raw8-formats.patch b/queue-6.15/media-rcar-vin-fix-stride-setting-for-raw8-formats.patch new file mode 100644 index 0000000000..556ac51f83 --- /dev/null +++ b/queue-6.15/media-rcar-vin-fix-stride-setting-for-raw8-formats.patch @@ -0,0 +1,61 @@ +From 34e3eb87692d0cc1a57ed6aeaea65a52a8824e78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 20:33:02 +0200 +Subject: media: rcar-vin: Fix stride setting for RAW8 formats +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit e7376745ad5c8548e31d9ea58adfb5a847e017a4 ] + +Earlier versions of the datasheet where unclear about the stride setting +for RAW8 capture formats. Later datasheets clarifies that the stride +only process in this mode for non-image data. For image data the full +stride shall be used. Compare section "RAW: 8 Bits and Embedded 8-Bit +Non-Image Data, User Defined 8-bit Data" vs "RAW: 8 Bits". + +Remove the special case from pixel formats that carry image data and +treat it as any other image format. + +Signed-off-by: Niklas Söderlund +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20250402183302.140055-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../media/platform/renesas/rcar-vin/rcar-dma.c | 16 ---------------- + 1 file changed, 16 deletions(-) + +diff --git a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c +index e303c13e1351f..3af67c1b303d6 100644 +--- a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c ++++ b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c +@@ -679,22 +679,6 @@ void rvin_crop_scale_comp(struct rvin_dev *vin) + + fmt = rvin_format_from_pixel(vin, vin->format.pixelformat); + stride = vin->format.bytesperline / fmt->bpp; +- +- /* For RAW8 format bpp is 1, but the hardware process RAW8 +- * format in 2 pixel unit hence configure VNIS_REG as stride / 2. +- */ +- switch (vin->format.pixelformat) { +- case V4L2_PIX_FMT_SBGGR8: +- case V4L2_PIX_FMT_SGBRG8: +- case V4L2_PIX_FMT_SGRBG8: +- case V4L2_PIX_FMT_SRGGB8: +- case V4L2_PIX_FMT_GREY: +- stride /= 2; +- break; +- default: +- break; +- } +- + rvin_write(vin, stride, VNIS_REG); + } + +-- +2.39.5 + diff --git a/queue-6.15/media-renesas-vsp1-fix-media-bus-code-setup-on-rwpf-.patch b/queue-6.15/media-renesas-vsp1-fix-media-bus-code-setup-on-rwpf-.patch new file mode 100644 index 0000000000..76d01f302c --- /dev/null +++ b/queue-6.15/media-renesas-vsp1-fix-media-bus-code-setup-on-rwpf-.patch @@ -0,0 +1,55 @@ +From 4dfb53dd810198d1a2b730d66ce80c5f1b93ba56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 02:28:59 +0300 +Subject: media: renesas: vsp1: Fix media bus code setup on RWPF source pad + +From: Laurent Pinchart + +[ Upstream commit b6e57605eff6224df4debf188eb7a02dedb7686f ] + +The RWPF source pad media bus code can only be different from the sink +pad code when enabling color space conversion, which can only convert +between RGB and YUV. If the sink pad code is HSV, no conversion is +possible. Fix the pad set format handler to reflect this hardware +limitation. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Tomi Valkeinen +Link: https://lore.kernel.org/r/20250429232904.26413-5-laurent.pinchart+renesas@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/vsp1/vsp1_rwpf.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/renesas/vsp1/vsp1_rwpf.c b/drivers/media/platform/renesas/vsp1/vsp1_rwpf.c +index 9d38203e73d00..1b4bac7b7cfa1 100644 +--- a/drivers/media/platform/renesas/vsp1/vsp1_rwpf.c ++++ b/drivers/media/platform/renesas/vsp1/vsp1_rwpf.c +@@ -76,11 +76,20 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev, + format = v4l2_subdev_state_get_format(state, fmt->pad); + + if (fmt->pad == RWPF_PAD_SOURCE) { ++ const struct v4l2_mbus_framefmt *sink_format = ++ v4l2_subdev_state_get_format(state, RWPF_PAD_SINK); ++ + /* + * The RWPF performs format conversion but can't scale, only the +- * format code can be changed on the source pad. ++ * format code can be changed on the source pad when converting ++ * between RGB and YUV. + */ +- format->code = fmt->format.code; ++ if (sink_format->code != MEDIA_BUS_FMT_AHSV8888_1X32 && ++ fmt->format.code != MEDIA_BUS_FMT_AHSV8888_1X32) ++ format->code = fmt->format.code; ++ else ++ format->code = sink_format->code; ++ + fmt->format = *format; + goto done; + } +-- +2.39.5 + diff --git a/queue-6.15/media-rkvdec-initialize-the-m2m-context-before-the-c.patch b/queue-6.15/media-rkvdec-initialize-the-m2m-context-before-the-c.patch new file mode 100644 index 0000000000..5d5a97ee8d --- /dev/null +++ b/queue-6.15/media-rkvdec-initialize-the-m2m-context-before-the-c.patch @@ -0,0 +1,59 @@ +From fef85427faebafdfa576d5e0b24c9794394206dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 May 2025 15:55:48 -0400 +Subject: media: rkvdec: Initialize the m2m context before the controls + +From: Nicolas Dufresne + +[ Upstream commit d43d7db3c8a1868dcbc6cb8de90a3cdf309d6cbb ] + +Setting up the control handler calls into .s_ctrl ops. While validating +the controls the ops may need to access some of the context state, which +could lead to a crash if not properly initialized. + +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/rkvdec/rkvdec.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c +index a9bfd5305410c..65befffc35696 100644 +--- a/drivers/staging/media/rkvdec/rkvdec.c ++++ b/drivers/staging/media/rkvdec/rkvdec.c +@@ -825,24 +825,24 @@ static int rkvdec_open(struct file *filp) + rkvdec_reset_decoded_fmt(ctx); + v4l2_fh_init(&ctx->fh, video_devdata(filp)); + +- ret = rkvdec_init_ctrls(ctx); +- if (ret) +- goto err_free_ctx; +- + ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(rkvdec->m2m_dev, ctx, + rkvdec_queue_init); + if (IS_ERR(ctx->fh.m2m_ctx)) { + ret = PTR_ERR(ctx->fh.m2m_ctx); +- goto err_cleanup_ctrls; ++ goto err_free_ctx; + } + ++ ret = rkvdec_init_ctrls(ctx); ++ if (ret) ++ goto err_cleanup_m2m_ctx; ++ + filp->private_data = &ctx->fh; + v4l2_fh_add(&ctx->fh); + + return 0; + +-err_cleanup_ctrls: +- v4l2_ctrl_handler_free(&ctx->ctrl_hdl); ++err_cleanup_m2m_ctx: ++ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); + + err_free_ctx: + kfree(ctx); +-- +2.39.5 + diff --git a/queue-6.15/media-tc358743-ignore-video-while-hpd-is-low.patch b/queue-6.15/media-tc358743-ignore-video-while-hpd-is-low.patch new file mode 100644 index 0000000000..5fe32809de --- /dev/null +++ b/queue-6.15/media-tc358743-ignore-video-while-hpd-is-low.patch @@ -0,0 +1,43 @@ +From 38ba898301f35501a853f3504b4f3004bb47d954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 11:54:17 +0200 +Subject: media: tc358743: ignore video while HPD is low + +From: Hans Verkuil + +[ Upstream commit 6829c5b5d26b1be31880d74ec24cb32d2d75f1ae ] + +If the HPD is low (happens if there is no EDID or the +EDID is being updated), then return -ENOLINK in +tc358743_get_detected_timings() instead of detecting video. + +This avoids userspace thinking that it can start streaming when +the HPD is low. + +Signed-off-by: Hans Verkuil +Tested-by: Maxime Ripard +Link: https://lore.kernel.org/linux-media/20240628-stoic-bettong-of-fortitude-e25611@houat/ +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/tc358743.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 2d5f42f111583..dcef93e1a3bcd 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -313,6 +313,10 @@ static int tc358743_get_detected_timings(struct v4l2_subdev *sd, + + memset(timings, 0, sizeof(struct v4l2_dv_timings)); + ++ /* if HPD is low, ignore any video */ ++ if (!(i2c_rd8(sd, HPD_CTL) & MASK_HPD_OUT0)) ++ return -ENOLINK; ++ + if (no_signal(sd)) { + v4l2_dbg(1, debug, sd, "%s: no valid signal\n", __func__); + return -ENOLINK; +-- +2.39.5 + diff --git a/queue-6.15/media-ti-cal-fix-wrong-goto-on-error-path.patch b/queue-6.15/media-ti-cal-fix-wrong-goto-on-error-path.patch new file mode 100644 index 0000000000..4afeab7e9b --- /dev/null +++ b/queue-6.15/media-ti-cal-fix-wrong-goto-on-error-path.patch @@ -0,0 +1,47 @@ +From 4207553fcad4aa24d2d3947736bee61e68136ff6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 13:34:02 +0200 +Subject: media: ti: cal: Fix wrong goto on error path + +From: Tomi Valkeinen + +[ Upstream commit a5b18fd769b7dc2e77a9e6a390844cbf50626ae8 ] + +If pm_runtime_resume_and_get() fails, we should unprepare the context, +but currently we skip that as we goto to a later line. + +Reviewed-by: Kieran Bingham +Signed-off-by: Tomi Valkeinen +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti/cal/cal-video.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/ti/cal/cal-video.c b/drivers/media/platform/ti/cal/cal-video.c +index e29743ae61e27..c16754c136ca0 100644 +--- a/drivers/media/platform/ti/cal/cal-video.c ++++ b/drivers/media/platform/ti/cal/cal-video.c +@@ -758,7 +758,7 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count) + + ret = pm_runtime_resume_and_get(ctx->cal->dev); + if (ret < 0) +- goto error_pipeline; ++ goto error_unprepare; + + cal_ctx_set_dma_addr(ctx, addr); + cal_ctx_start(ctx); +@@ -775,8 +775,8 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count) + error_stop: + cal_ctx_stop(ctx); + pm_runtime_put_sync(ctx->cal->dev); ++error_unprepare: + cal_ctx_unprepare(ctx); +- + error_pipeline: + video_device_pipeline_stop(&ctx->vdev); + error_release_buffers: +-- +2.39.5 + diff --git a/queue-6.15/media-uapi-v4l-change-v4l2_type_is_capture-condition.patch b/queue-6.15/media-uapi-v4l-change-v4l2_type_is_capture-condition.patch new file mode 100644 index 0000000000..1e2ce208c7 --- /dev/null +++ b/queue-6.15/media-uapi-v4l-change-v4l2_type_is_capture-condition.patch @@ -0,0 +1,57 @@ +From 2159dd79eacf5ce5aa53dfc9fadef6fc622d9e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2024 15:10:32 +0900 +Subject: media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition + +From: Nas Chung + +[ Upstream commit ad2698efce37e910dcf3c3914263e6cb3e86f8cd ] + +Explicitly compare a buffer type only with valid buffer types, +to avoid matching a buffer type outside of the valid buffer type set. + +Signed-off-by: Nas Chung +Reviewed-by: Michael Tretter +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index b0e1f660c5f72..af86ece741e94 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -153,10 +153,18 @@ enum v4l2_buf_type { + V4L2_BUF_TYPE_SDR_OUTPUT = 12, + V4L2_BUF_TYPE_META_CAPTURE = 13, + V4L2_BUF_TYPE_META_OUTPUT = 14, ++ /* ++ * Note: V4L2_TYPE_IS_VALID and V4L2_TYPE_IS_OUTPUT must ++ * be updated if a new type is added. ++ */ + /* Deprecated, do not use */ + V4L2_BUF_TYPE_PRIVATE = 0x80, + }; + ++#define V4L2_TYPE_IS_VALID(type) \ ++ ((type) >= V4L2_BUF_TYPE_VIDEO_CAPTURE &&\ ++ (type) <= V4L2_BUF_TYPE_META_OUTPUT) ++ + #define V4L2_TYPE_IS_MULTIPLANAR(type) \ + ((type) == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE \ + || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) +@@ -170,7 +178,8 @@ enum v4l2_buf_type { + || (type) == V4L2_BUF_TYPE_SDR_OUTPUT \ + || (type) == V4L2_BUF_TYPE_META_OUTPUT) + +-#define V4L2_TYPE_IS_CAPTURE(type) (!V4L2_TYPE_IS_OUTPUT(type)) ++#define V4L2_TYPE_IS_CAPTURE(type) \ ++ (V4L2_TYPE_IS_VALID(type) && !V4L2_TYPE_IS_OUTPUT(type)) + + enum v4l2_tuner_type { + V4L2_TUNER_RADIO = 1, +-- +2.39.5 + diff --git a/queue-6.15/media-uapi-v4l-fix-v4l2_type_is_output-condition.patch b/queue-6.15/media-uapi-v4l-fix-v4l2_type_is_output-condition.patch new file mode 100644 index 0000000000..eb5a3b9d2d --- /dev/null +++ b/queue-6.15/media-uapi-v4l-fix-v4l2_type_is_output-condition.patch @@ -0,0 +1,35 @@ +From 58e5ee8123fa3b02be831439e61a149a0df1cca2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2024 15:10:34 +0900 +Subject: media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition + +From: Nas Chung + +[ Upstream commit f81f69a0e3da141bdd73a16b8676f4e542533d87 ] + +V4L2_TYPE_IS_OUTPUT() returns true for V4L2_BUF_TYPE_VIDEO_OVERLAY +which definitely belongs to CAPTURE. + +Signed-off-by: Nas Chung +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index c8cb2796130f8..b0e1f660c5f72 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -164,7 +164,6 @@ enum v4l2_buf_type { + #define V4L2_TYPE_IS_OUTPUT(type) \ + ((type) == V4L2_BUF_TYPE_VIDEO_OUTPUT \ + || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE \ +- || (type) == V4L2_BUF_TYPE_VIDEO_OVERLAY \ + || (type) == V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY \ + || (type) == V4L2_BUF_TYPE_VBI_OUTPUT \ + || (type) == V4L2_BUF_TYPE_SLICED_VBI_OUTPUT \ +-- +2.39.5 + diff --git a/queue-6.15/media-verisilicon-enable-wide-4k-in-av1-decoder.patch b/queue-6.15/media-verisilicon-enable-wide-4k-in-av1-decoder.patch new file mode 100644 index 0000000000..57f449abb7 --- /dev/null +++ b/queue-6.15/media-verisilicon-enable-wide-4k-in-av1-decoder.patch @@ -0,0 +1,92 @@ +From eba955be330ed6be5ed6873ea0ccae4a0f6fd1d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Apr 2025 15:07:41 -0400 +Subject: media: verisilicon: Enable wide 4K in AV1 decoder + +From: Nicolas Dufresne + +[ Upstream commit 311e40e877bd980bc665e6c8d3b15d96f0ec2aa8 ] + +Tested on RK3588, this decoder is capable of handling WUHD, so bump the +maximum width and height accordingly. + +Reviewed-by: Benjamin Gaignard +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/verisilicon/rockchip_vpu_hw.c | 20 +++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c +index 964122e7c3559..b64f0658f7f1e 100644 +--- a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c ++++ b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c +@@ -85,10 +85,10 @@ static const struct hantro_fmt rockchip_vpu981_postproc_fmts[] = { + .postprocessed = true, + .frmsize = { + .min_width = ROCKCHIP_VPU981_MIN_SIZE, +- .max_width = FMT_UHD_WIDTH, ++ .max_width = FMT_4K_WIDTH, + .step_width = MB_DIM, + .min_height = ROCKCHIP_VPU981_MIN_SIZE, +- .max_height = FMT_UHD_HEIGHT, ++ .max_height = FMT_4K_HEIGHT, + .step_height = MB_DIM, + }, + }, +@@ -99,10 +99,10 @@ static const struct hantro_fmt rockchip_vpu981_postproc_fmts[] = { + .postprocessed = true, + .frmsize = { + .min_width = ROCKCHIP_VPU981_MIN_SIZE, +- .max_width = FMT_UHD_WIDTH, ++ .max_width = FMT_4K_WIDTH, + .step_width = MB_DIM, + .min_height = ROCKCHIP_VPU981_MIN_SIZE, +- .max_height = FMT_UHD_HEIGHT, ++ .max_height = FMT_4K_HEIGHT, + .step_height = MB_DIM, + }, + }, +@@ -318,10 +318,10 @@ static const struct hantro_fmt rockchip_vpu981_dec_fmts[] = { + .match_depth = true, + .frmsize = { + .min_width = ROCKCHIP_VPU981_MIN_SIZE, +- .max_width = FMT_UHD_WIDTH, ++ .max_width = FMT_4K_WIDTH, + .step_width = MB_DIM, + .min_height = ROCKCHIP_VPU981_MIN_SIZE, +- .max_height = FMT_UHD_HEIGHT, ++ .max_height = FMT_4K_HEIGHT, + .step_height = MB_DIM, + }, + }, +@@ -331,10 +331,10 @@ static const struct hantro_fmt rockchip_vpu981_dec_fmts[] = { + .match_depth = true, + .frmsize = { + .min_width = ROCKCHIP_VPU981_MIN_SIZE, +- .max_width = FMT_UHD_WIDTH, ++ .max_width = FMT_4K_WIDTH, + .step_width = MB_DIM, + .min_height = ROCKCHIP_VPU981_MIN_SIZE, +- .max_height = FMT_UHD_HEIGHT, ++ .max_height = FMT_4K_HEIGHT, + .step_height = MB_DIM, + }, + }, +@@ -344,10 +344,10 @@ static const struct hantro_fmt rockchip_vpu981_dec_fmts[] = { + .max_depth = 2, + .frmsize = { + .min_width = ROCKCHIP_VPU981_MIN_SIZE, +- .max_width = FMT_UHD_WIDTH, ++ .max_width = FMT_4K_WIDTH, + .step_width = MB_DIM, + .min_height = ROCKCHIP_VPU981_MIN_SIZE, +- .max_height = FMT_UHD_HEIGHT, ++ .max_height = FMT_4K_HEIGHT, + .step_height = MB_DIM, + }, + }, +-- +2.39.5 + diff --git a/queue-6.15/mmc-add-quirk-to-disable-ddr50-tuning.patch b/queue-6.15/mmc-add-quirk-to-disable-ddr50-tuning.patch new file mode 100644 index 0000000000..982c92aea4 --- /dev/null +++ b/queue-6.15/mmc-add-quirk-to-disable-ddr50-tuning.patch @@ -0,0 +1,134 @@ +From f20a68ebf199f7169cd63e9498d2a2c395a6f281 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Mar 2025 17:13:37 -0500 +Subject: mmc: Add quirk to disable DDR50 tuning + +From: Erick Shepherd + +[ Upstream commit 9510b38dc0ba358c93cbf5ee7c28820afb85937b ] + +Adds the MMC_QUIRK_NO_UHS_DDR50_TUNING quirk and updates +mmc_execute_tuning() to return 0 if that quirk is set. This fixes an +issue on certain Swissbit SD cards that do not support DDR50 tuning +where tuning requests caused I/O errors to be thrown. + +Signed-off-by: Erick Shepherd +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250331221337.1414534-1-erick.shepherd@ni.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/card.h | 6 ++++++ + drivers/mmc/core/quirks.h | 10 ++++++++++ + drivers/mmc/core/sd.c | 32 ++++++++++++++++++++++++-------- + include/linux/mmc/card.h | 1 + + 4 files changed, 41 insertions(+), 8 deletions(-) + +diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h +index 3205feb1e8ff6..9cbdd240c3a7d 100644 +--- a/drivers/mmc/core/card.h ++++ b/drivers/mmc/core/card.h +@@ -89,6 +89,7 @@ struct mmc_fixup { + #define CID_MANFID_MICRON 0x13 + #define CID_MANFID_SAMSUNG 0x15 + #define CID_MANFID_APACER 0x27 ++#define CID_MANFID_SWISSBIT 0x5D + #define CID_MANFID_KINGSTON 0x70 + #define CID_MANFID_HYNIX 0x90 + #define CID_MANFID_KINGSTON_SD 0x9F +@@ -294,4 +295,9 @@ static inline int mmc_card_broken_sd_poweroff_notify(const struct mmc_card *c) + return c->quirks & MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY; + } + ++static inline int mmc_card_no_uhs_ddr50_tuning(const struct mmc_card *c) ++{ ++ return c->quirks & MMC_QUIRK_NO_UHS_DDR50_TUNING; ++} ++ + #endif +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index 89b512905be14..7f893bafaa607 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -34,6 +34,16 @@ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = { + MMC_QUIRK_BROKEN_SD_CACHE | MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY, + EXT_CSD_REV_ANY), + ++ /* ++ * Swissbit series S46-u cards throw I/O errors during tuning requests ++ * after the initial tuning request expectedly times out. This has ++ * only been observed on cards manufactured on 01/2019 that are using ++ * Bay Trail host controllers. ++ */ ++ _FIXUP_EXT("0016G", CID_MANFID_SWISSBIT, 0x5342, 2019, 1, ++ 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd, ++ MMC_QUIRK_NO_UHS_DDR50_TUNING, EXT_CSD_REV_ANY), ++ + END_FIXUP + }; + +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index 8eba697d3d867..6847b3fe8887a 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -617,6 +617,29 @@ static int sd_set_current_limit(struct mmc_card *card, u8 *status) + return 0; + } + ++/* ++ * Determine if the card should tune or not. ++ */ ++static bool mmc_sd_use_tuning(struct mmc_card *card) ++{ ++ /* ++ * SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and ++ * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104. ++ */ ++ if (mmc_host_is_spi(card->host)) ++ return false; ++ ++ switch (card->host->ios.timing) { ++ case MMC_TIMING_UHS_SDR50: ++ case MMC_TIMING_UHS_SDR104: ++ return true; ++ case MMC_TIMING_UHS_DDR50: ++ return !mmc_card_no_uhs_ddr50_tuning(card); ++ } ++ ++ return false; ++} ++ + /* + * UHS-I specific initialization procedure + */ +@@ -660,14 +683,7 @@ static int mmc_sd_init_uhs_card(struct mmc_card *card) + if (err) + goto out; + +- /* +- * SPI mode doesn't define CMD19 and tuning is only valid for SDR50 and +- * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104. +- */ +- if (!mmc_host_is_spi(card->host) && +- (card->host->ios.timing == MMC_TIMING_UHS_SDR50 || +- card->host->ios.timing == MMC_TIMING_UHS_DDR50 || +- card->host->ios.timing == MMC_TIMING_UHS_SDR104)) { ++ if (mmc_sd_use_tuning(card)) { + err = mmc_execute_tuning(card); + + /* +diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h +index 526fce5816575..ddcdf23d731c4 100644 +--- a/include/linux/mmc/card.h ++++ b/include/linux/mmc/card.h +@@ -329,6 +329,7 @@ struct mmc_card { + #define MMC_QUIRK_BROKEN_SD_CACHE (1<<15) /* Disable broken SD cache support */ + #define MMC_QUIRK_BROKEN_CACHE_FLUSH (1<<16) /* Don't flush cache until the write has occurred */ + #define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY (1<<17) /* Disable broken SD poweroff notify support */ ++#define MMC_QUIRK_NO_UHS_DDR50_TUNING (1<<18) /* Disable DDR50 tuning */ + + bool written_flag; /* Indicates eMMC has been written since power on */ + bool reenable_cmdq; /* Re-enable Command Queue */ +-- +2.39.5 + diff --git a/queue-6.15/mmc-sdhci-esdhc-imx-save-tuning-value-when-card-stay.patch b/queue-6.15/mmc-sdhci-esdhc-imx-save-tuning-value-when-card-stay.patch new file mode 100644 index 0000000000..7ee2c6df63 --- /dev/null +++ b/queue-6.15/mmc-sdhci-esdhc-imx-save-tuning-value-when-card-stay.patch @@ -0,0 +1,191 @@ +From b1e8736ca5f1695ca4957444cf4351b16ae83fc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Mar 2025 19:25:17 +0800 +Subject: mmc: sdhci-esdhc-imx: Save tuning value when card stays powered in + suspend + +From: Luke Wang + +[ Upstream commit c63d25cdc59ae2891b39ba2da950910291d9bcbf ] + +For SoCs like i.MX6UL(L/Z) and i.MX7D, USDHC powers off completely during +system power management (PM), causing the internal tuning status to be +lost. To address this, save the tuning value when system suspend and +restore it for any command issued after system resume when re-tuning is +held. + +A typical case involves SDIO WiFi devices with the MMC_PM_KEEP_POWER and +MMC_PM_WAKE_SDIO_IRQ flag, which retain power during system PM. To +conserve power, WiFi switches to 1-bit mode and restores 4-bit mode upon +resume. As per the specification, tuning commands are not supported in +1-bit mode. When sending CMD52 to restore 4-bit mode, re-tuning must be +held. However, CMD52 still requires a correct sample point to avoid CRC +errors, necessitating preservation of the previous tuning value. + +Signed-off-by: Luke Wang +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250328112517.2624806-1-ziniu.wang_1@nxp.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-esdhc-imx.c | 88 +++++++++++++++++++++++++++++- + 1 file changed, 86 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index ff78a7c6a04c9..7e8addaed697e 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -81,6 +81,8 @@ + #define ESDHC_TUNE_CTRL_STEP 1 + #define ESDHC_TUNE_CTRL_MIN 0 + #define ESDHC_TUNE_CTRL_MAX ((1 << 7) - 1) ++#define ESDHC_TUNE_CTRL_STATUS_TAP_SEL_PRE_MASK GENMASK(30, 24) ++#define ESDHC_TUNE_CTRL_STATUS_DLY_CELL_SET_PRE_MASK GENMASK(14, 8) + + /* strobe dll register */ + #define ESDHC_STROBE_DLL_CTRL 0x70 +@@ -235,6 +237,7 @@ struct esdhc_platform_data { + unsigned int tuning_step; /* The delay cell steps in tuning procedure */ + unsigned int tuning_start_tap; /* The start delay cell point in tuning procedure */ + unsigned int strobe_dll_delay_target; /* The delay cell for strobe pad (read clock) */ ++ unsigned int saved_tuning_delay_cell; /* save the value of tuning delay cell */ + }; + + struct esdhc_soc_data { +@@ -1057,7 +1060,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host) + { + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); +- u32 ctrl; ++ u32 ctrl, tuning_ctrl; + int ret; + + /* Reset the tuning circuit */ +@@ -1071,6 +1074,16 @@ static void esdhc_reset_tuning(struct sdhci_host *host) + writel(0, host->ioaddr + ESDHC_TUNE_CTRL_STATUS); + } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) { + writel(ctrl, host->ioaddr + ESDHC_MIX_CTRL); ++ /* ++ * enable the std tuning just in case it cleared in ++ * sdhc_esdhc_tuning_restore. ++ */ ++ tuning_ctrl = readl(host->ioaddr + ESDHC_TUNING_CTRL); ++ if (!(tuning_ctrl & ESDHC_STD_TUNING_EN)) { ++ tuning_ctrl |= ESDHC_STD_TUNING_EN; ++ writel(tuning_ctrl, host->ioaddr + ESDHC_TUNING_CTRL); ++ } ++ + ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS); + ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL; + ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE; +@@ -1149,7 +1162,8 @@ static void esdhc_prepare_tuning(struct sdhci_host *host, u32 val) + reg |= ESDHC_MIX_CTRL_EXE_TUNE | ESDHC_MIX_CTRL_SMPCLK_SEL | + ESDHC_MIX_CTRL_FBCLK_SEL; + writel(reg, host->ioaddr + ESDHC_MIX_CTRL); +- writel(val << 8, host->ioaddr + ESDHC_TUNE_CTRL_STATUS); ++ writel(FIELD_PREP(ESDHC_TUNE_CTRL_STATUS_DLY_CELL_SET_PRE_MASK, val), ++ host->ioaddr + ESDHC_TUNE_CTRL_STATUS); + dev_dbg(mmc_dev(host->mmc), + "tuning with delay 0x%x ESDHC_TUNE_CTRL_STATUS 0x%x\n", + val, readl(host->ioaddr + ESDHC_TUNE_CTRL_STATUS)); +@@ -1569,6 +1583,57 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) + } + } + ++static void sdhc_esdhc_tuning_save(struct sdhci_host *host) ++{ ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); ++ u32 reg; ++ ++ /* ++ * SD/eMMC do not need this tuning save because it will re-init ++ * after system resume back. ++ * Here save the tuning delay value for SDIO device since it may ++ * keep power during system PM. And for usdhc, only SDR50 and ++ * SDR104 mode for SDIO device need to do tuning, and need to ++ * save/restore. ++ */ ++ if (host->timing == MMC_TIMING_UHS_SDR50 || ++ host->timing == MMC_TIMING_UHS_SDR104) { ++ reg = readl(host->ioaddr + ESDHC_TUNE_CTRL_STATUS); ++ reg = FIELD_GET(ESDHC_TUNE_CTRL_STATUS_TAP_SEL_PRE_MASK, reg); ++ imx_data->boarddata.saved_tuning_delay_cell = reg; ++ } ++} ++ ++static void sdhc_esdhc_tuning_restore(struct sdhci_host *host) ++{ ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); ++ u32 reg; ++ ++ if (host->timing == MMC_TIMING_UHS_SDR50 || ++ host->timing == MMC_TIMING_UHS_SDR104) { ++ /* ++ * restore the tuning delay value actually is a ++ * manual tuning method, so clear the standard ++ * tuning enable bit here. Will set back this ++ * ESDHC_STD_TUNING_EN in esdhc_reset_tuning() ++ * when trigger re-tuning. ++ */ ++ reg = readl(host->ioaddr + ESDHC_TUNING_CTRL); ++ reg &= ~ESDHC_STD_TUNING_EN; ++ writel(reg, host->ioaddr + ESDHC_TUNING_CTRL); ++ ++ reg = readl(host->ioaddr + ESDHC_MIX_CTRL); ++ reg |= ESDHC_MIX_CTRL_SMPCLK_SEL | ESDHC_MIX_CTRL_FBCLK_SEL; ++ writel(reg, host->ioaddr + ESDHC_MIX_CTRL); ++ ++ writel(FIELD_PREP(ESDHC_TUNE_CTRL_STATUS_DLY_CELL_SET_PRE_MASK, ++ imx_data->boarddata.saved_tuning_delay_cell), ++ host->ioaddr + ESDHC_TUNE_CTRL_STATUS); ++ } ++} ++ + static void esdhc_cqe_enable(struct mmc_host *mmc) + { + struct sdhci_host *host = mmc_priv(mmc); +@@ -1900,6 +1965,15 @@ static int sdhci_esdhc_suspend(struct device *dev) + if (host->tuning_mode != SDHCI_TUNING_MODE_3) + mmc_retune_needed(host->mmc); + ++ /* ++ * For the device need to keep power during system PM, need ++ * to save the tuning delay value just in case the usdhc ++ * lost power during system PM. ++ */ ++ if (mmc_card_keep_power(host->mmc) && mmc_card_wake_sdio_irq(host->mmc) && ++ esdhc_is_usdhc(imx_data)) ++ sdhc_esdhc_tuning_save(host); ++ + ret = sdhci_suspend_host(host); + if (ret) + return ret; +@@ -1916,6 +1990,8 @@ static int sdhci_esdhc_suspend(struct device *dev) + static int sdhci_esdhc_resume(struct device *dev) + { + struct sdhci_host *host = dev_get_drvdata(dev); ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); + int ret; + + ret = pinctrl_pm_select_default_state(dev); +@@ -1929,6 +2005,14 @@ static int sdhci_esdhc_resume(struct device *dev) + if (ret) + return ret; + ++ /* ++ * restore the saved tuning delay value for the device which keep ++ * power during system PM. ++ */ ++ if (mmc_card_keep_power(host->mmc) && mmc_card_wake_sdio_irq(host->mmc) && ++ esdhc_is_usdhc(imx_data)) ++ sdhc_esdhc_tuning_restore(host); ++ + if (host->mmc->caps2 & MMC_CAP2_CQE) + ret = cqhci_resume(host->mmc); + +-- +2.39.5 + diff --git a/queue-6.15/net-atlantic-generate-software-timestamp-just-before.patch b/queue-6.15/net-atlantic-generate-software-timestamp-just-before.patch new file mode 100644 index 0000000000..a10ff3e8a1 --- /dev/null +++ b/queue-6.15/net-atlantic-generate-software-timestamp-just-before.patch @@ -0,0 +1,49 @@ +From d2e34200a612e8d085b84aabfb7eba0930061d41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 May 2025 21:48:10 +0800 +Subject: net: atlantic: generate software timestamp just before the doorbell + +From: Jason Xing + +[ Upstream commit 285ad7477559b6b5ceed10ba7ecfed9d17c0e7c6 ] + +Make sure the call of skb_tx_timestamp is as close as possible to the +doorbell. + +Signed-off-by: Jason Xing +Link: https://patch.msgid.link/20250510134812.48199-2-kerneljasonxing@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_main.c | 1 - + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 ++ + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +index c1d1673c5749d..b565189e59139 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +@@ -123,7 +123,6 @@ static netdev_tx_t aq_ndev_start_xmit(struct sk_buff *skb, struct net_device *nd + } + #endif + +- skb_tx_timestamp(skb); + return aq_nic_xmit(aq_nic, skb); + } + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index bf3aa46887a1c..e71cd10e4e1f1 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -898,6 +898,8 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb) + + frags = aq_nic_map_skb(self, skb, ring); + ++ skb_tx_timestamp(skb); ++ + if (likely(frags)) { + err = self->aq_hw_ops->hw_ring_tx_xmit(self->aq_hw, + ring, frags); +-- +2.39.5 + diff --git a/queue-6.15/net-bridge-mcast-re-implement-br_multicast_-enable-d.patch b/queue-6.15/net-bridge-mcast-re-implement-br_multicast_-enable-d.patch new file mode 100644 index 0000000000..d001d87aea --- /dev/null +++ b/queue-6.15/net-bridge-mcast-re-implement-br_multicast_-enable-d.patch @@ -0,0 +1,173 @@ +From 6f5d9bc90e4c8fa616ef96dc3abfb172389357fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 15:43:12 +0200 +Subject: net: bridge: mcast: re-implement br_multicast_{enable, disable}_port + functions + +From: Yong Wang + +[ Upstream commit 4b30ae9adb047dd0a7982975ec3933c529537026 ] + +When a bridge port STP state is changed from BLOCKING/DISABLED to +FORWARDING, the port's igmp query timer will NOT re-arm itself if the +bridge has been configured as per-VLAN multicast snooping. + +Solve this by choosing the correct multicast context(s) to enable/disable +port multicast based on whether per-VLAN multicast snooping is enabled or +not, i.e. using per-{port, VLAN} context in case of per-VLAN multicast +snooping by re-implementing br_multicast_enable_port() and +br_multicast_disable_port() functions. + +Before the patch, the IGMP query does not happen in the last step of the +following test sequence, i.e. no growth for tx counter: + # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1 + # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0 + # ip link add name swp1 up master br1 type dummy + # bridge link set dev swp1 state 0 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # sleep 1 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # bridge link set dev swp1 state 3 + # sleep 2 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + +After the patch, the IGMP query happens in the last step of the test: + # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1 + # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0 + # ip link add name swp1 up master br1 type dummy + # bridge link set dev swp1 state 0 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # sleep 1 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # bridge link set dev swp1 state 3 + # sleep 2 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +3 + +Signed-off-by: Yong Wang +Reviewed-by: Andy Roulin +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_multicast.c | 77 +++++++++++++++++++++++++++++++++++---- + 1 file changed, 69 insertions(+), 8 deletions(-) + +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 35e1fd4ec82ea..7e0b2362b9ee5 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -2105,12 +2105,17 @@ static void __br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx) + } + } + +-void br_multicast_enable_port(struct net_bridge_port *port) ++static void br_multicast_enable_port_ctx(struct net_bridge_mcast_port *pmctx) + { +- struct net_bridge *br = port->br; ++ struct net_bridge *br = pmctx->port->br; + + spin_lock_bh(&br->multicast_lock); +- __br_multicast_enable_port_ctx(&port->multicast_ctx); ++ if (br_multicast_port_ctx_is_vlan(pmctx) && ++ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) { ++ spin_unlock_bh(&br->multicast_lock); ++ return; ++ } ++ __br_multicast_enable_port_ctx(pmctx); + spin_unlock_bh(&br->multicast_lock); + } + +@@ -2137,11 +2142,67 @@ static void __br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx) + br_multicast_rport_del_notify(pmctx, del); + } + ++static void br_multicast_disable_port_ctx(struct net_bridge_mcast_port *pmctx) ++{ ++ struct net_bridge *br = pmctx->port->br; ++ ++ spin_lock_bh(&br->multicast_lock); ++ if (br_multicast_port_ctx_is_vlan(pmctx) && ++ !(pmctx->vlan->priv_flags & BR_VLFLAG_MCAST_ENABLED)) { ++ spin_unlock_bh(&br->multicast_lock); ++ return; ++ } ++ ++ __br_multicast_disable_port_ctx(pmctx); ++ spin_unlock_bh(&br->multicast_lock); ++} ++ ++static void br_multicast_toggle_port(struct net_bridge_port *port, bool on) ++{ ++#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING) ++ if (br_opt_get(port->br, BROPT_MCAST_VLAN_SNOOPING_ENABLED)) { ++ struct net_bridge_vlan_group *vg; ++ struct net_bridge_vlan *vlan; ++ ++ rcu_read_lock(); ++ vg = nbp_vlan_group_rcu(port); ++ if (!vg) { ++ rcu_read_unlock(); ++ return; ++ } ++ ++ /* iterate each vlan, toggle vlan multicast context */ ++ list_for_each_entry_rcu(vlan, &vg->vlan_list, vlist) { ++ struct net_bridge_mcast_port *pmctx = ++ &vlan->port_mcast_ctx; ++ u8 state = br_vlan_get_state(vlan); ++ /* enable vlan multicast context when state is ++ * LEARNING or FORWARDING ++ */ ++ if (on && br_vlan_state_allowed(state, true)) ++ br_multicast_enable_port_ctx(pmctx); ++ else ++ br_multicast_disable_port_ctx(pmctx); ++ } ++ rcu_read_unlock(); ++ return; ++ } ++#endif ++ /* toggle port multicast context when vlan snooping is disabled */ ++ if (on) ++ br_multicast_enable_port_ctx(&port->multicast_ctx); ++ else ++ br_multicast_disable_port_ctx(&port->multicast_ctx); ++} ++ ++void br_multicast_enable_port(struct net_bridge_port *port) ++{ ++ br_multicast_toggle_port(port, true); ++} ++ + void br_multicast_disable_port(struct net_bridge_port *port) + { +- spin_lock_bh(&port->br->multicast_lock); +- __br_multicast_disable_port_ctx(&port->multicast_ctx); +- spin_unlock_bh(&port->br->multicast_lock); ++ br_multicast_toggle_port(port, false); + } + + static int __grp_src_delete_marked(struct net_bridge_port_group *pg) +@@ -4330,9 +4391,9 @@ int br_multicast_toggle_vlan_snooping(struct net_bridge *br, bool on, + __br_multicast_open(&br->multicast_ctx); + list_for_each_entry(p, &br->port_list, list) { + if (on) +- br_multicast_disable_port(p); ++ br_multicast_disable_port_ctx(&p->multicast_ctx); + else +- br_multicast_enable_port(p); ++ br_multicast_enable_port_ctx(&p->multicast_ctx); + } + + list_for_each_entry(vlan, &vg->vlan_list, vlist) +-- +2.39.5 + diff --git a/queue-6.15/net-bridge-mcast-update-multicast-contex-when-vlan-s.patch b/queue-6.15/net-bridge-mcast-update-multicast-contex-when-vlan-s.patch new file mode 100644 index 0000000000..ddf71a5fd8 --- /dev/null +++ b/queue-6.15/net-bridge-mcast-update-multicast-contex-when-vlan-s.patch @@ -0,0 +1,165 @@ +From 7975b4349448264a8dae1a7c540231a02d6f321d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 15:43:13 +0200 +Subject: net: bridge: mcast: update multicast contex when vlan state is + changed + +From: Yong Wang + +[ Upstream commit 6c131043eaf1be2a6cc2d228f92ceb626fbcc0f3 ] + +When the vlan STP state is changed, which could be manipulated by +"bridge vlan" commands, similar to port STP state, this also impacts +multicast behaviors such as igmp query. In the scenario of per-VLAN +snooping, there's a need to update the corresponding multicast context +to re-arm the port query timer when vlan state becomes "forwarding" etc. + +Update br_vlan_set_state() function to enable vlan multicast context +in such scenario. + +Before the patch, the IGMP query does not happen in the last step of the +following test sequence, i.e. no growth for tx counter: + # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1 + # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0 + # ip link add name swp1 up master br1 type dummy + # sleep 1 + # bridge vlan set vid 1 dev swp1 state 4 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # sleep 1 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # bridge vlan set vid 1 dev swp1 state 3 + # sleep 2 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + +After the patch, the IGMP query happens in the last step of the test: + # ip link add name br1 up type bridge vlan_filtering 1 mcast_snooping 1 mcast_vlan_snooping 1 mcast_querier 1 mcast_stats_enabled 1 + # bridge vlan global set vid 1 dev br1 mcast_snooping 1 mcast_querier 1 mcast_query_interval 100 mcast_startup_query_count 0 + # ip link add name swp1 up master br1 type dummy + # sleep 1 + # bridge vlan set vid 1 dev swp1 state 4 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # sleep 1 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +1 + # bridge vlan set vid 1 dev swp1 state 3 + # sleep 2 + # ip -j -p stats show dev swp1 group xstats_slave subgroup bridge suite mcast | jq '.[]["multicast"]["igmp_queries"]["tx_v2"]' +3 + +Signed-off-by: Yong Wang +Reviewed-by: Andy Roulin +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_mst.c | 4 ++-- + net/bridge/br_multicast.c | 26 ++++++++++++++++++++++++++ + net/bridge/br_private.h | 11 ++++++++++- + 3 files changed, 38 insertions(+), 3 deletions(-) + +diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c +index 1820f09ff59ce..3f24b4ee49c27 100644 +--- a/net/bridge/br_mst.c ++++ b/net/bridge/br_mst.c +@@ -80,10 +80,10 @@ static void br_mst_vlan_set_state(struct net_bridge_vlan_group *vg, + if (br_vlan_get_state(v) == state) + return; + +- br_vlan_set_state(v, state); +- + if (v->vid == vg->pvid) + br_vlan_set_pvid_state(vg, state); ++ ++ br_vlan_set_state(v, state); + } + + int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state, +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index dcbf058de1e3b..35e1fd4ec82ea 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -4211,6 +4211,32 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx) + #endif + } + ++void br_multicast_update_vlan_mcast_ctx(struct net_bridge_vlan *v, u8 state) ++{ ++#if IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING) ++ struct net_bridge *br; ++ ++ if (!br_vlan_should_use(v)) ++ return; ++ ++ if (br_vlan_is_master(v)) ++ return; ++ ++ br = v->port->br; ++ ++ if (!br_opt_get(br, BROPT_MCAST_VLAN_SNOOPING_ENABLED)) ++ return; ++ ++ if (br_vlan_state_allowed(state, true)) ++ br_multicast_enable_port_ctx(&v->port_mcast_ctx); ++ ++ /* Multicast is not disabled for the vlan when it goes in ++ * blocking state because the timers will expire and stop by ++ * themselves without sending more queries. ++ */ ++#endif ++} ++ + void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan, bool on) + { + struct net_bridge *br; +diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h +index 4715a8d6dc326..c41d315b09d32 100644 +--- a/net/bridge/br_private.h ++++ b/net/bridge/br_private.h +@@ -1052,6 +1052,7 @@ void br_multicast_port_ctx_init(struct net_bridge_port *port, + struct net_bridge_vlan *vlan, + struct net_bridge_mcast_port *pmctx); + void br_multicast_port_ctx_deinit(struct net_bridge_mcast_port *pmctx); ++void br_multicast_update_vlan_mcast_ctx(struct net_bridge_vlan *v, u8 state); + void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan, bool on); + int br_multicast_toggle_vlan_snooping(struct net_bridge *br, bool on, + struct netlink_ext_ack *extack); +@@ -1502,6 +1503,11 @@ static inline void br_multicast_port_ctx_deinit(struct net_bridge_mcast_port *pm + { + } + ++static inline void br_multicast_update_vlan_mcast_ctx(struct net_bridge_vlan *v, ++ u8 state) ++{ ++} ++ + static inline void br_multicast_toggle_one_vlan(struct net_bridge_vlan *vlan, + bool on) + { +@@ -1862,7 +1868,9 @@ bool br_vlan_global_opts_can_enter_range(const struct net_bridge_vlan *v_curr, + bool br_vlan_global_opts_fill(struct sk_buff *skb, u16 vid, u16 vid_range, + const struct net_bridge_vlan *v_opts); + +-/* vlan state manipulation helpers using *_ONCE to annotate lock-free access */ ++/* vlan state manipulation helpers using *_ONCE to annotate lock-free access, ++ * while br_vlan_set_state() may access data protected by multicast_lock. ++ */ + static inline u8 br_vlan_get_state(const struct net_bridge_vlan *v) + { + return READ_ONCE(v->state); +@@ -1871,6 +1879,7 @@ static inline u8 br_vlan_get_state(const struct net_bridge_vlan *v) + static inline void br_vlan_set_state(struct net_bridge_vlan *v, u8 state) + { + WRITE_ONCE(v->state, state); ++ br_multicast_update_vlan_mcast_ctx(v, state); + } + + static inline u8 br_vlan_get_pvid_state(const struct net_bridge_vlan_group *vg) +-- +2.39.5 + diff --git a/queue-6.15/net-dlink-add-synchronization-for-stats-update.patch b/queue-6.15/net-dlink-add-synchronization-for-stats-update.patch new file mode 100644 index 0000000000..95ed125b61 --- /dev/null +++ b/queue-6.15/net-dlink-add-synchronization-for-stats-update.patch @@ -0,0 +1,102 @@ +From a56cf715d40a8cb8a39f2bd83f8f7a9fc577ad94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 16:53:31 +0900 +Subject: net: dlink: add synchronization for stats update + +From: Moon Yeounsu + +[ Upstream commit 12889ce926e9a9baf6b83d809ba316af539b89e2 ] + +This patch synchronizes code that accesses from both user-space +and IRQ contexts. The `get_stats()` function can be called from both +context. + +`dev->stats.tx_errors` and `dev->stats.collisions` are also updated +in the `tx_errors()` function. Therefore, these fields must also be +protected by synchronized. + +There is no code that accessses `dev->stats.tx_errors` between the +previous and updated lines, so the updating point can be moved. + +Signed-off-by: Moon Yeounsu +Link: https://patch.msgid.link/20250515075333.48290-1-yyyynoom@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dlink/dl2k.c | 14 +++++++++++++- + drivers/net/ethernet/dlink/dl2k.h | 2 ++ + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c +index 232e839a9d071..038a0400c1f95 100644 +--- a/drivers/net/ethernet/dlink/dl2k.c ++++ b/drivers/net/ethernet/dlink/dl2k.c +@@ -146,6 +146,8 @@ rio_probe1 (struct pci_dev *pdev, const struct pci_device_id *ent) + np->ioaddr = ioaddr; + np->chip_id = chip_idx; + np->pdev = pdev; ++ ++ spin_lock_init(&np->stats_lock); + spin_lock_init (&np->tx_lock); + spin_lock_init (&np->rx_lock); + +@@ -865,7 +867,6 @@ tx_error (struct net_device *dev, int tx_status) + frame_id = (tx_status & 0xffff0000); + printk (KERN_ERR "%s: Transmit error, TxStatus %4.4x, FrameId %d.\n", + dev->name, tx_status, frame_id); +- dev->stats.tx_errors++; + /* Ttransmit Underrun */ + if (tx_status & 0x10) { + dev->stats.tx_fifo_errors++; +@@ -902,9 +903,15 @@ tx_error (struct net_device *dev, int tx_status) + rio_set_led_mode(dev); + /* Let TxStartThresh stay default value */ + } ++ ++ spin_lock(&np->stats_lock); + /* Maximum Collisions */ + if (tx_status & 0x08) + dev->stats.collisions++; ++ ++ dev->stats.tx_errors++; ++ spin_unlock(&np->stats_lock); ++ + /* Restart the Tx */ + dw32(MACCtrl, dr16(MACCtrl) | TxEnable); + } +@@ -1073,7 +1080,9 @@ get_stats (struct net_device *dev) + int i; + #endif + unsigned int stat_reg; ++ unsigned long flags; + ++ spin_lock_irqsave(&np->stats_lock, flags); + /* All statistics registers need to be acknowledged, + else statistic overflow could cause problems */ + +@@ -1123,6 +1132,9 @@ get_stats (struct net_device *dev) + dr16(TCPCheckSumErrors); + dr16(UDPCheckSumErrors); + dr16(IPCheckSumErrors); ++ ++ spin_unlock_irqrestore(&np->stats_lock, flags); ++ + return &dev->stats; + } + +diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h +index 0e33e2eaae960..56aff2f0bdbfa 100644 +--- a/drivers/net/ethernet/dlink/dl2k.h ++++ b/drivers/net/ethernet/dlink/dl2k.h +@@ -372,6 +372,8 @@ struct netdev_private { + struct pci_dev *pdev; + void __iomem *ioaddr; + void __iomem *eeprom_addr; ++ // To ensure synchronization when stats are updated. ++ spinlock_t stats_lock; + spinlock_t tx_lock; + spinlock_t rx_lock; + unsigned int rx_buf_sz; /* Based on MTU+slack. */ +-- +2.39.5 + diff --git a/queue-6.15/net-ethernet-cortina-use-toe-tso-on-all-tcp.patch b/queue-6.15/net-ethernet-cortina-use-toe-tso-on-all-tcp.patch new file mode 100644 index 0000000000..8a45c67ee5 --- /dev/null +++ b/queue-6.15/net-ethernet-cortina-use-toe-tso-on-all-tcp.patch @@ -0,0 +1,132 @@ +From eb09171e9ae55c1bf4c37bcbcc404f17acf1d705 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 11:26:58 +0200 +Subject: net: ethernet: cortina: Use TOE/TSO on all TCP + +From: Linus Walleij + +[ Upstream commit 6a07e3af4973402fa199a80036c10060b922c92c ] + +It is desireable to push the hardware accelerator to also +process non-segmented TCP frames: we pass the skb->len +to the "TOE/TSO" offloader and it will handle them. + +Without this quirk the driver becomes unstable and lock +up and and crash. + +I do not know exactly why, but it is probably due to the +TOE (TCP offload engine) feature that is coupled with the +segmentation feature - it is not possible to turn one +part off and not the other, either both TOE and TSO are +active, or neither of them. + +Not having the TOE part active seems detrimental, as if +that hardware feature is not really supposed to be turned +off. + +The datasheet says: + + "Based on packet parsing and TCP connection/NAT table + lookup results, the NetEngine puts the packets + belonging to the same TCP connection to the same queue + for the software to process. The NetEngine puts + incoming packets to the buffer or series of buffers + for a jumbo packet. With this hardware acceleration, + IP/TCP header parsing, checksum validation and + connection lookup are offloaded from the software + processing." + +After numerous tests with the hardware locking up after +something between minutes and hours depending on load +using iperf3 I have concluded this is necessary to stabilize +the hardware. + +Signed-off-by: Linus Walleij +Link: https://patch.msgid.link/20250408-gemini-ethernet-tso-always-v1-1-e669f932359c@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cortina/gemini.c | 37 +++++++++++++++++++++------ + 1 file changed, 29 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index 517a15904fb08..6a2004bbe87f9 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -1144,6 +1144,7 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, + struct gmac_txdesc *txd; + skb_frag_t *skb_frag; + dma_addr_t mapping; ++ bool tcp = false; + void *buffer; + u16 mss; + int ret; +@@ -1151,6 +1152,13 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, + word1 = skb->len; + word3 = SOF_BIT; + ++ /* Determine if we are doing TCP */ ++ if (skb->protocol == htons(ETH_P_IP)) ++ tcp = (ip_hdr(skb)->protocol == IPPROTO_TCP); ++ else ++ /* IPv6 */ ++ tcp = (ipv6_hdr(skb)->nexthdr == IPPROTO_TCP); ++ + mss = skb_shinfo(skb)->gso_size; + if (mss) { + /* This means we are dealing with TCP and skb->len is the +@@ -1163,8 +1171,26 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, + mss, skb->len); + word1 |= TSS_MTU_ENABLE_BIT; + word3 |= mss; ++ } else if (tcp) { ++ /* Even if we are not using TSO, use the hardware offloader ++ * for transferring the TCP frame: this hardware has partial ++ * TCP awareness (called TOE - TCP Offload Engine) and will ++ * according to the datasheet put packets belonging to the ++ * same TCP connection in the same queue for the TOE/TSO ++ * engine to process. The engine will deal with chopping ++ * up frames that exceed ETH_DATA_LEN which the ++ * checksumming engine cannot handle (see below) into ++ * manageable chunks. It flawlessly deals with quite big ++ * frames and frames containing custom DSA EtherTypes. ++ */ ++ mss = netdev->mtu + skb_tcp_all_headers(skb); ++ mss = min(mss, skb->len); ++ netdev_dbg(netdev, "TOE/TSO len %04x mtu %04x mss %04x\n", ++ skb->len, netdev->mtu, mss); ++ word1 |= TSS_MTU_ENABLE_BIT; ++ word3 |= mss; + } else if (skb->len >= ETH_FRAME_LEN) { +- /* Hardware offloaded checksumming isn't working on frames ++ /* Hardware offloaded checksumming isn't working on non-TCP frames + * bigger than 1514 bytes. A hypothesis about this is that the + * checksum buffer is only 1518 bytes, so when the frames get + * bigger they get truncated, or the last few bytes get +@@ -1181,21 +1207,16 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, + } + + if (skb->ip_summed == CHECKSUM_PARTIAL) { +- int tcp = 0; +- + /* We do not switch off the checksumming on non TCP/UDP + * frames: as is shown from tests, the checksumming engine + * is smart enough to see that a frame is not actually TCP + * or UDP and then just pass it through without any changes + * to the frame. + */ +- if (skb->protocol == htons(ETH_P_IP)) { ++ if (skb->protocol == htons(ETH_P_IP)) + word1 |= TSS_IP_CHKSUM_BIT; +- tcp = ip_hdr(skb)->protocol == IPPROTO_TCP; +- } else { /* IPv6 */ ++ else + word1 |= TSS_IPV6_ENABLE_BIT; +- tcp = ipv6_hdr(skb)->nexthdr == IPPROTO_TCP; +- } + + word1 |= tcp ? TSS_TCP_CHKSUM_BIT : TSS_UDP_CHKSUM_BIT; + } +-- +2.39.5 + diff --git a/queue-6.15/net-ethernet-ti-am65-cpsw-handle-eprobe_defer.patch b/queue-6.15/net-ethernet-ti-am65-cpsw-handle-eprobe_defer.patch new file mode 100644 index 0000000000..a5227fbefc --- /dev/null +++ b/queue-6.15/net-ethernet-ti-am65-cpsw-handle-eprobe_defer.patch @@ -0,0 +1,81 @@ +From 3c1f8fccf9d16e1f8039050205db7b15ce28fc4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 10:43:36 +0200 +Subject: net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER + +From: Michael Walle + +[ Upstream commit 09737cb80b8686ffca4ed1805fee745d5c85604d ] + +of_get_mac_address() might fetch the MAC address from NVMEM and that +driver might not have been loaded. In that case, -EPROBE_DEFER is +returned. Right now, this will trigger an immediate fallback to +am65_cpsw_am654_get_efuse_macid() possibly resulting in a random MAC +address although the MAC address is stored in the referenced NVMEM. + +Fix it by handling the -EPROBE_DEFER return code correctly. This also +means that the creation of the MDIO device has to be moved to a later +stage as -EPROBE_DEFER must not be returned after child devices are +created. + +Signed-off-by: Michael Walle +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250414084336.4017237-3-mwalle@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 30665ffe78cf9..4cec05e0e3d9b 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2679,7 +2679,9 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common) + goto of_node_put; + + ret = of_get_mac_address(port_np, port->slave.mac_addr); +- if (ret) { ++ if (ret == -EPROBE_DEFER) { ++ goto of_node_put; ++ } else if (ret) { + am65_cpsw_am654_get_efuse_macid(port_np, + port->port_id, + port->slave.mac_addr); +@@ -3561,6 +3563,16 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev) + return ret; + } + ++ am65_cpsw_nuss_get_ver(common); ++ ++ ret = am65_cpsw_nuss_init_host_p(common); ++ if (ret) ++ goto err_pm_clear; ++ ++ ret = am65_cpsw_nuss_init_slave_ports(common); ++ if (ret) ++ goto err_pm_clear; ++ + node = of_get_child_by_name(dev->of_node, "mdio"); + if (!node) { + dev_warn(dev, "MDIO node not found\n"); +@@ -3577,16 +3589,6 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev) + } + of_node_put(node); + +- am65_cpsw_nuss_get_ver(common); +- +- ret = am65_cpsw_nuss_init_host_p(common); +- if (ret) +- goto err_of_clear; +- +- ret = am65_cpsw_nuss_init_slave_ports(common); +- if (ret) +- goto err_of_clear; +- + /* init common data */ + ale_params.dev = dev; + ale_params.ale_ageout = AM65_CPSW_ALE_AGEOUT_DEFAULT; +-- +2.39.5 + diff --git a/queue-6.15/net-lan743x-modify-the-eeprom-and-otp-size-for-pci1x.patch b/queue-6.15/net-lan743x-modify-the-eeprom-and-otp-size-for-pci1x.patch new file mode 100644 index 0000000000..462012e774 --- /dev/null +++ b/queue-6.15/net-lan743x-modify-the-eeprom-and-otp-size-for-pci1x.patch @@ -0,0 +1,89 @@ +From 2764f5e06b3a7283b1dcaafb45467618ac39f529 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 May 2025 23:03:26 +0530 +Subject: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices + +From: Rengarajan S + +[ Upstream commit 3b9935586a9b54d2da27901b830d3cf46ad66a1e ] + +Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb +and 64 Kb respectively. Adjust max size definitions and return correct +EEPROM length based on device. Also prevent out-of-bound read/write. + +Signed-off-by: Rengarajan S +Link: https://patch.msgid.link/20250523173326.18509-1-rengarajan.s@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/microchip/lan743x_ethtool.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan743x_ethtool.c b/drivers/net/ethernet/microchip/lan743x_ethtool.c +index 1459acfb1e618..64a3b953cc175 100644 +--- a/drivers/net/ethernet/microchip/lan743x_ethtool.c ++++ b/drivers/net/ethernet/microchip/lan743x_ethtool.c +@@ -18,6 +18,8 @@ + #define EEPROM_MAC_OFFSET (0x01) + #define MAX_EEPROM_SIZE (512) + #define MAX_OTP_SIZE (1024) ++#define MAX_HS_OTP_SIZE (8 * 1024) ++#define MAX_HS_EEPROM_SIZE (64 * 1024) + #define OTP_INDICATOR_1 (0xF3) + #define OTP_INDICATOR_2 (0xF7) + +@@ -272,6 +274,9 @@ static int lan743x_hs_otp_read(struct lan743x_adapter *adapter, u32 offset, + int ret; + int i; + ++ if (offset + length > MAX_HS_OTP_SIZE) ++ return -EINVAL; ++ + ret = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT); + if (ret < 0) + return ret; +@@ -320,6 +325,9 @@ static int lan743x_hs_otp_write(struct lan743x_adapter *adapter, u32 offset, + int ret; + int i; + ++ if (offset + length > MAX_HS_OTP_SIZE) ++ return -EINVAL; ++ + ret = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT); + if (ret < 0) + return ret; +@@ -497,6 +505,9 @@ static int lan743x_hs_eeprom_read(struct lan743x_adapter *adapter, + u32 val; + int i; + ++ if (offset + length > MAX_HS_EEPROM_SIZE) ++ return -EINVAL; ++ + retval = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT); + if (retval < 0) + return retval; +@@ -539,6 +550,9 @@ static int lan743x_hs_eeprom_write(struct lan743x_adapter *adapter, + u32 val; + int i; + ++ if (offset + length > MAX_HS_EEPROM_SIZE) ++ return -EINVAL; ++ + retval = lan743x_hs_syslock_acquire(adapter, LOCK_TIMEOUT_MAX_CNT); + if (retval < 0) + return retval; +@@ -604,9 +618,9 @@ static int lan743x_ethtool_get_eeprom_len(struct net_device *netdev) + struct lan743x_adapter *adapter = netdev_priv(netdev); + + if (adapter->flags & LAN743X_ADAPTER_FLAG_OTP) +- return MAX_OTP_SIZE; ++ return adapter->is_pci11x1x ? MAX_HS_OTP_SIZE : MAX_OTP_SIZE; + +- return MAX_EEPROM_SIZE; ++ return adapter->is_pci11x1x ? MAX_HS_EEPROM_SIZE : MAX_EEPROM_SIZE; + } + + static int lan743x_ethtool_get_eeprom(struct net_device *netdev, +-- +2.39.5 + diff --git a/queue-6.15/net-macb-check-return-value-of-dma_set_mask_and_cohe.patch b/queue-6.15/net-macb-check-return-value-of-dma_set_mask_and_cohe.patch new file mode 100644 index 0000000000..08f3c60092 --- /dev/null +++ b/queue-6.15/net-macb-check-return-value-of-dma_set_mask_and_cohe.patch @@ -0,0 +1,42 @@ +From 996a8b27f4cc203728732c35e2d2ea11cdb5c674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 May 2025 21:20:31 -0600 +Subject: net: macb: Check return value of dma_set_mask_and_coherent() + +From: Sergio Perez Gonzalez + +[ Upstream commit 3920a758800762917177a6b5ab39707d8e376fe6 ] + +Issue flagged by coverity. Add a safety check for the return value +of dma_set_mask_and_coherent, go to a safe exit if it returns error. + +Link: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1643754 +Signed-off-by: Sergio Perez Gonzalez +Reviewed-by: Claudiu Beznea +Link: https://patch.msgid.link/20250526032034.84900-1-sperezglz@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index e1e8bd2ec155b..d1f1ae5ea161c 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -5283,7 +5283,11 @@ static int macb_probe(struct platform_device *pdev) + + #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT + if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) { +- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44)); ++ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44)); ++ if (err) { ++ dev_err(&pdev->dev, "failed to set DMA mask\n"); ++ goto err_out_free_netdev; ++ } + bp->hw_dma_cap |= HW_DMA_CAP_64B; + } + #endif +-- +2.39.5 + diff --git a/queue-6.15/net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch b/queue-6.15/net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch new file mode 100644 index 0000000000..45c7e28d4e --- /dev/null +++ b/queue-6.15/net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch @@ -0,0 +1,37 @@ +From 5463d3e27e783b6f6e8f21cf18c95d3f0022e9a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 May 2025 17:34:42 +0800 +Subject: net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info + +From: Jason Xing + +[ Upstream commit b86bcfee30576b752302c55693fff97242b35dfd ] + +As mlx4 has implemented skb_tx_timestamp() in mlx4_en_xmit(), the +SOFTWARE flag is surely needed when users are trying to get timestamp +information. + +Signed-off-by: Jason Xing +Reviewed-by: Tariq Toukan +Link: https://patch.msgid.link/20250510093442.79711-1-kerneljasonxing@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +index cd17a3f4faf83..a68cd3f0304c6 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +@@ -1897,6 +1897,7 @@ static int mlx4_en_get_ts_info(struct net_device *dev, + if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS) { + info->so_timestamping |= + SOF_TIMESTAMPING_TX_HARDWARE | ++ SOF_TIMESTAMPING_TX_SOFTWARE | + SOF_TIMESTAMPING_RX_HARDWARE | + SOF_TIMESTAMPING_RAW_HARDWARE; + +-- +2.39.5 + diff --git a/queue-6.15/net-mlx5-hws-fix-counting-of-rules-in-the-matcher.patch b/queue-6.15/net-mlx5-hws-fix-counting-of-rules-in-the-matcher.patch new file mode 100644 index 0000000000..8caeaa1eb3 --- /dev/null +++ b/queue-6.15/net-mlx5-hws-fix-counting-of-rules-in-the-matcher.patch @@ -0,0 +1,97 @@ +From 16bcfd92c63f0380ef6b9ba0a20e2c80da5a5f31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 May 2025 22:38:07 +0300 +Subject: net/mlx5: HWS, fix counting of rules in the matcher + +From: Yevgeny Kliteynik + +[ Upstream commit 4c56b5cbc323a10ebb6595500fb78fd8a4762efd ] + +Currently the counter that counts number of rules in a matcher is +increased only when rule insertion is completed. In a multi-threaded +usecase this can lead to a scenario that many rules can be in process +of insertion in the same matcher, while none of them has completed +the insertion and the rule counter is not updated. This results in +a rule insertion failure for many of them at first attempt, which +leads to all of them requiring rehash and requiring locking of all +the queue locks. + +This patch fixes the case by increasing the rule counter in the +beginning of insertion process and decreasing in case of any failure. + +Signed-off-by: Vlad Dogaru +Signed-off-by: Yevgeny Kliteynik +Reviewed-by: Mark Bloch +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/1746992290-568936-8-git-send-email-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c +index 32de8bfc7644f..3f8f4306d90b3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c +@@ -329,16 +329,12 @@ static void hws_bwc_rule_list_add(struct mlx5hws_bwc_rule *bwc_rule, u16 idx) + { + struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; + +- atomic_inc(&bwc_matcher->num_of_rules); + bwc_rule->bwc_queue_idx = idx; + list_add(&bwc_rule->list_node, &bwc_matcher->rules[idx]); + } + + static void hws_bwc_rule_list_remove(struct mlx5hws_bwc_rule *bwc_rule) + { +- struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; +- +- atomic_dec(&bwc_matcher->num_of_rules); + list_del_init(&bwc_rule->list_node); + } + +@@ -391,6 +387,7 @@ int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule) + mutex_lock(queue_lock); + + ret = hws_bwc_rule_destroy_hws_sync(bwc_rule, &attr); ++ atomic_dec(&bwc_matcher->num_of_rules); + hws_bwc_rule_list_remove(bwc_rule); + + mutex_unlock(queue_lock); +@@ -860,7 +857,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, + } + + /* check if number of rules require rehash */ +- num_of_rules = atomic_read(&bwc_matcher->num_of_rules); ++ num_of_rules = atomic_inc_return(&bwc_matcher->num_of_rules); + + if (unlikely(hws_bwc_matcher_rehash_size_needed(bwc_matcher, num_of_rules))) { + mutex_unlock(queue_lock); +@@ -874,6 +871,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, + bwc_matcher->size_log - MLX5HWS_BWC_MATCHER_SIZE_LOG_STEP, + bwc_matcher->size_log, + ret); ++ atomic_dec(&bwc_matcher->num_of_rules); + return ret; + } + +@@ -906,6 +904,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, + + if (ret) { + mlx5hws_err(ctx, "BWC rule insertion: rehash failed (%d)\n", ret); ++ atomic_dec(&bwc_matcher->num_of_rules); + return ret; + } + +@@ -921,6 +920,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, + if (unlikely(ret)) { + mutex_unlock(queue_lock); + mlx5hws_err(ctx, "BWC rule insertion failed (%d)\n", ret); ++ atomic_dec(&bwc_matcher->num_of_rules); + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.15/net-mlx5-hws-fix-ip-version-decision.patch b/queue-6.15/net-mlx5-hws-fix-ip-version-decision.patch new file mode 100644 index 0000000000..427f1207be --- /dev/null +++ b/queue-6.15/net-mlx5-hws-fix-ip-version-decision.patch @@ -0,0 +1,134 @@ +From 59db371933e5c12ff954d9a2f2f9795c76814128 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 12:25:38 +0300 +Subject: net/mlx5: HWS, Fix IP version decision + +From: Vlad Dogaru + +[ Upstream commit 5f2f8d8b6800e4fc760c2eccec9b2bd2cacf80cf ] + +Unify the check for IP version when creating a definer. A given matcher +is deemed to match on IPv6 if any of the higher order (>31) bits of +source or destination address mask are set. + +A single packet cannot mix IP versions between source and destination +addresses, so it makes no sense that they would be decided on +independently. + +Signed-off-by: Vlad Dogaru +Reviewed-by: Yevgeny Kliteynik +Signed-off-by: Mark Bloch +Link: https://patch.msgid.link/20250422092540.182091-2-mbloch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/steering/hws/definer.c | 38 ++++++++----------- + 1 file changed, 16 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c +index 293459458cc5f..7dc6d8cd744e1 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c +@@ -509,9 +509,9 @@ static int + hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, + u32 *match_param) + { +- bool is_s_ipv6, is_d_ipv6, smac_set, dmac_set; + struct mlx5hws_definer_fc *fc = cd->fc; + struct mlx5hws_definer_fc *curr_fc; ++ bool is_ipv6, smac_set, dmac_set; + u32 *s_ipv6, *d_ipv6; + + if (HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type, 0x2) || +@@ -573,10 +573,10 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, + outer_headers.dst_ipv4_dst_ipv6.ipv6_layout); + + /* Assume IPv6 is used if ipv6 bits are set */ +- is_s_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2]; +- is_d_ipv6 = d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; ++ is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || ++ d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; + +- if (is_s_ipv6) { ++ if (is_ipv6) { + /* Handle IPv6 source address */ + HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_O, + outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96, +@@ -590,13 +590,6 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, + HWS_SET_HDR(fc, match_param, IPV6_SRC_31_0_O, + outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, + ipv6_src_outer.ipv6_address_31_0); +- } else { +- /* Handle IPv4 source address */ +- HWS_SET_HDR(fc, match_param, IPV4_SRC_O, +- outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, +- ipv4_src_dest_outer.source_address); +- } +- if (is_d_ipv6) { + /* Handle IPv6 destination address */ + HWS_SET_HDR(fc, match_param, IPV6_DST_127_96_O, + outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96, +@@ -611,6 +604,10 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, + outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, + ipv6_dst_outer.ipv6_address_31_0); + } else { ++ /* Handle IPv4 source address */ ++ HWS_SET_HDR(fc, match_param, IPV4_SRC_O, ++ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, ++ ipv4_src_dest_outer.source_address); + /* Handle IPv4 destination address */ + HWS_SET_HDR(fc, match_param, IPV4_DST_O, + outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, +@@ -668,9 +665,9 @@ static int + hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, + u32 *match_param) + { +- bool is_s_ipv6, is_d_ipv6, smac_set, dmac_set; + struct mlx5hws_definer_fc *fc = cd->fc; + struct mlx5hws_definer_fc *curr_fc; ++ bool is_ipv6, smac_set, dmac_set; + u32 *s_ipv6, *d_ipv6; + + if (HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type, 0x2) || +@@ -731,10 +728,10 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, + inner_headers.dst_ipv4_dst_ipv6.ipv6_layout); + + /* Assume IPv6 is used if ipv6 bits are set */ +- is_s_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2]; +- is_d_ipv6 = d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; ++ is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || ++ d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; + +- if (is_s_ipv6) { ++ if (is_ipv6) { + /* Handle IPv6 source address */ + HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_I, + inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96, +@@ -748,13 +745,6 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, + HWS_SET_HDR(fc, match_param, IPV6_SRC_31_0_I, + inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, + ipv6_src_inner.ipv6_address_31_0); +- } else { +- /* Handle IPv4 source address */ +- HWS_SET_HDR(fc, match_param, IPV4_SRC_I, +- inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, +- ipv4_src_dest_inner.source_address); +- } +- if (is_d_ipv6) { + /* Handle IPv6 destination address */ + HWS_SET_HDR(fc, match_param, IPV6_DST_127_96_I, + inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96, +@@ -769,6 +759,10 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, + inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, + ipv6_dst_inner.ipv6_address_31_0); + } else { ++ /* Handle IPv4 source address */ ++ HWS_SET_HDR(fc, match_param, IPV4_SRC_I, ++ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, ++ ipv4_src_dest_inner.source_address); + /* Handle IPv4 destination address */ + HWS_SET_HDR(fc, match_param, IPV4_DST_I, + inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, +-- +2.39.5 + diff --git a/queue-6.15/net-mlx5-hws-harden-ip-version-definer-checks.patch b/queue-6.15/net-mlx5-hws-harden-ip-version-definer-checks.patch new file mode 100644 index 0000000000..706eb11821 --- /dev/null +++ b/queue-6.15/net-mlx5-hws-harden-ip-version-definer-checks.patch @@ -0,0 +1,125 @@ +From bd3006b46c745e02bee27ddf47d2b102d6a5ea8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 12:25:39 +0300 +Subject: net/mlx5: HWS, Harden IP version definer checks + +From: Vlad Dogaru + +[ Upstream commit 6991a975e416154576b0f5f06256aec13e23b0a7 ] + +Replicate some sanity checks that firmware does, since hardware steering +does not go through firmware. + +When creating a definer, disallow matching on IP addresses without also +matching on IP version. The latter can be satisfied by matching either +on the version field in the IP header, or on the ethertype field. + +Also refuse to match IPv4 IHL alongside IPv6. + +Signed-off-by: Vlad Dogaru +Reviewed-by: Yevgeny Kliteynik +Signed-off-by: Mark Bloch +Link: https://patch.msgid.link/20250422092540.182091-3-mbloch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/steering/hws/definer.c | 44 ++++++++++++++++++- + 1 file changed, 42 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c +index 7dc6d8cd744e1..ecda35597111e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c +@@ -509,9 +509,9 @@ static int + hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, + u32 *match_param) + { ++ bool is_ipv6, smac_set, dmac_set, ip_addr_set, ip_ver_set; + struct mlx5hws_definer_fc *fc = cd->fc; + struct mlx5hws_definer_fc *curr_fc; +- bool is_ipv6, smac_set, dmac_set; + u32 *s_ipv6, *d_ipv6; + + if (HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type, 0x2) || +@@ -521,6 +521,20 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, + return -EINVAL; + } + ++ ip_addr_set = HWS_IS_FLD_SET_SZ(match_param, ++ outer_headers.src_ipv4_src_ipv6, ++ 0x80) || ++ HWS_IS_FLD_SET_SZ(match_param, ++ outer_headers.dst_ipv4_dst_ipv6, 0x80); ++ ip_ver_set = HWS_IS_FLD_SET(match_param, outer_headers.ip_version) || ++ HWS_IS_FLD_SET(match_param, outer_headers.ethertype); ++ ++ if (ip_addr_set && !ip_ver_set) { ++ mlx5hws_err(cd->ctx, ++ "Unsupported match on IP address without version or ethertype\n"); ++ return -EINVAL; ++ } ++ + /* L2 Check ethertype */ + HWS_SET_HDR(fc, match_param, ETH_TYPE_O, + outer_headers.ethertype, +@@ -576,6 +590,12 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, + is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || + d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; + ++ /* IHL is an IPv4-specific field. */ ++ if (is_ipv6 && HWS_IS_FLD_SET(match_param, outer_headers.ipv4_ihl)) { ++ mlx5hws_err(cd->ctx, "Unsupported match on IPv6 address and IPv4 IHL\n"); ++ return -EINVAL; ++ } ++ + if (is_ipv6) { + /* Handle IPv6 source address */ + HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_O, +@@ -665,9 +685,9 @@ static int + hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, + u32 *match_param) + { ++ bool is_ipv6, smac_set, dmac_set, ip_addr_set, ip_ver_set; + struct mlx5hws_definer_fc *fc = cd->fc; + struct mlx5hws_definer_fc *curr_fc; +- bool is_ipv6, smac_set, dmac_set; + u32 *s_ipv6, *d_ipv6; + + if (HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type, 0x2) || +@@ -677,6 +697,20 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, + return -EINVAL; + } + ++ ip_addr_set = HWS_IS_FLD_SET_SZ(match_param, ++ inner_headers.src_ipv4_src_ipv6, ++ 0x80) || ++ HWS_IS_FLD_SET_SZ(match_param, ++ inner_headers.dst_ipv4_dst_ipv6, 0x80); ++ ip_ver_set = HWS_IS_FLD_SET(match_param, inner_headers.ip_version) || ++ HWS_IS_FLD_SET(match_param, inner_headers.ethertype); ++ ++ if (ip_addr_set && !ip_ver_set) { ++ mlx5hws_err(cd->ctx, ++ "Unsupported match on IP address without version or ethertype\n"); ++ return -EINVAL; ++ } ++ + /* L2 Check ethertype */ + HWS_SET_HDR(fc, match_param, ETH_TYPE_I, + inner_headers.ethertype, +@@ -731,6 +765,12 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, + is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || + d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; + ++ /* IHL is an IPv4-specific field. */ ++ if (is_ipv6 && HWS_IS_FLD_SET(match_param, inner_headers.ipv4_ihl)) { ++ mlx5hws_err(cd->ctx, "Unsupported match on IPv6 address and IPv4 IHL\n"); ++ return -EINVAL; ++ } ++ + if (is_ipv6) { + /* Handle IPv6 source address */ + HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_I, +-- +2.39.5 + diff --git a/queue-6.15/net-page_pool-don-t-recycle-into-cache-on-preempt_rt.patch b/queue-6.15/net-page_pool-don-t-recycle-into-cache-on-preempt_rt.patch new file mode 100644 index 0000000000..a5a434d9a0 --- /dev/null +++ b/queue-6.15/net-page_pool-don-t-recycle-into-cache-on-preempt_rt.patch @@ -0,0 +1,42 @@ +From 561c02d79a18b47e2eb0528e0cfca22e73fab668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 11:27:22 +0200 +Subject: net: page_pool: Don't recycle into cache on PREEMPT_RT + +From: Sebastian Andrzej Siewior + +[ Upstream commit 32471b2f481dea8624f27669d36ffd131d24b732 ] + +With preemptible softirq and no per-CPU locking in local_bh_disable() on +PREEMPT_RT the consumer can be preempted while a skb is returned. + +Avoid the race by disabling the recycle into the cache on PREEMPT_RT. + +Cc: Jesper Dangaard Brouer +Cc: Ilias Apalodimas +Signed-off-by: Sebastian Andrzej Siewior +Link: https://patch.msgid.link/20250512092736.229935-2-bigeasy@linutronix.de +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/page_pool.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/core/page_pool.c b/net/core/page_pool.c +index 2d9c51f480fb5..3eabe78c93f4c 100644 +--- a/net/core/page_pool.c ++++ b/net/core/page_pool.c +@@ -836,6 +836,10 @@ static bool page_pool_napi_local(const struct page_pool *pool) + const struct napi_struct *napi; + u32 cpuid; + ++ /* On PREEMPT_RT the softirq can be preempted by the consumer */ ++ if (IS_ENABLED(CONFIG_PREEMPT_RT)) ++ return false; ++ + if (unlikely(!in_softirq())) + return false; + +-- +2.39.5 + diff --git a/queue-6.15/net-phy-marvell-88q2xxx-enable-temperature-measureme.patch b/queue-6.15/net-phy-marvell-88q2xxx-enable-temperature-measureme.patch new file mode 100644 index 0000000000..1c1a51f49c --- /dev/null +++ b/queue-6.15/net-phy-marvell-88q2xxx-enable-temperature-measureme.patch @@ -0,0 +1,178 @@ +From e25cd22cc08bba8ee1a6aca7e1dfb697f73ba862 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 14:03:42 +0200 +Subject: net: phy: marvell-88q2xxx: Enable temperature measurement in probe + again + +From: Dimitri Fedrau + +[ Upstream commit 10465365f3b094ba9a9795f212d13dee594bcfe7 ] + +Enabling of the temperature sensor was moved from mv88q2xxx_hwmon_probe to +mv88q222x_config_init with the consequence that the sensor is only +usable when the PHY is configured. Enable the sensor in +mv88q2xxx_hwmon_probe as well to fix this. + +Signed-off-by: Dimitri Fedrau +Link: https://patch.msgid.link/20250512-marvell-88q2xxx-hwmon-enable-at-probe-v4-1-9256a5c8f603@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/marvell-88q2xxx.c | 103 +++++++++++++++++------------- + 1 file changed, 57 insertions(+), 46 deletions(-) + +diff --git a/drivers/net/phy/marvell-88q2xxx.c b/drivers/net/phy/marvell-88q2xxx.c +index 23e1f0521f549..65f31d3c34810 100644 +--- a/drivers/net/phy/marvell-88q2xxx.c ++++ b/drivers/net/phy/marvell-88q2xxx.c +@@ -119,7 +119,6 @@ + #define MV88Q2XXX_LED_INDEX_GPIO 1 + + struct mv88q2xxx_priv { +- bool enable_temp; + bool enable_led0; + }; + +@@ -482,49 +481,6 @@ static int mv88q2xxx_config_aneg(struct phy_device *phydev) + return phydev->drv->soft_reset(phydev); + } + +-static int mv88q2xxx_config_init(struct phy_device *phydev) +-{ +- struct mv88q2xxx_priv *priv = phydev->priv; +- int ret; +- +- /* The 88Q2XXX PHYs do have the extended ability register available, but +- * register MDIO_PMA_EXTABLE where they should signalize it does not +- * work according to specification. Therefore, we force it here. +- */ +- phydev->pma_extable = MDIO_PMA_EXTABLE_BT1; +- +- /* Configure interrupt with default settings, output is driven low for +- * active interrupt and high for inactive. +- */ +- if (phy_interrupt_is_valid(phydev)) { +- ret = phy_set_bits_mmd(phydev, MDIO_MMD_PCS, +- MDIO_MMD_PCS_MV_GPIO_INT_CTRL, +- MDIO_MMD_PCS_MV_GPIO_INT_CTRL_TRI_DIS); +- if (ret < 0) +- return ret; +- } +- +- /* Enable LED function and disable TX disable feature on LED/TX_ENABLE */ +- if (priv->enable_led0) { +- ret = phy_clear_bits_mmd(phydev, MDIO_MMD_PCS, +- MDIO_MMD_PCS_MV_RESET_CTRL, +- MDIO_MMD_PCS_MV_RESET_CTRL_TX_DISABLE); +- if (ret < 0) +- return ret; +- } +- +- /* Enable temperature sense */ +- if (priv->enable_temp) { +- ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, +- MDIO_MMD_PCS_MV_TEMP_SENSOR2, +- MDIO_MMD_PCS_MV_TEMP_SENSOR2_DIS_MASK, 0); +- if (ret < 0) +- return ret; +- } +- +- return 0; +-} +- + static int mv88q2xxx_get_sqi(struct phy_device *phydev) + { + int ret; +@@ -667,6 +623,12 @@ static int mv88q2xxx_resume(struct phy_device *phydev) + } + + #if IS_ENABLED(CONFIG_HWMON) ++static int mv88q2xxx_enable_temp_sense(struct phy_device *phydev) ++{ ++ return phy_modify_mmd(phydev, MDIO_MMD_PCS, MDIO_MMD_PCS_MV_TEMP_SENSOR2, ++ MDIO_MMD_PCS_MV_TEMP_SENSOR2_DIS_MASK, 0); ++} ++ + static const struct hwmon_channel_info * const mv88q2xxx_hwmon_info[] = { + HWMON_CHANNEL_INFO(temp, HWMON_T_INPUT | HWMON_T_MAX | HWMON_T_ALARM), + NULL +@@ -762,11 +724,13 @@ static const struct hwmon_chip_info mv88q2xxx_hwmon_chip_info = { + + static int mv88q2xxx_hwmon_probe(struct phy_device *phydev) + { +- struct mv88q2xxx_priv *priv = phydev->priv; + struct device *dev = &phydev->mdio.dev; + struct device *hwmon; ++ int ret; + +- priv->enable_temp = true; ++ ret = mv88q2xxx_enable_temp_sense(phydev); ++ if (ret < 0) ++ return ret; + + hwmon = devm_hwmon_device_register_with_info(dev, NULL, phydev, + &mv88q2xxx_hwmon_chip_info, +@@ -776,6 +740,11 @@ static int mv88q2xxx_hwmon_probe(struct phy_device *phydev) + } + + #else ++static int mv88q2xxx_enable_temp_sense(struct phy_device *phydev) ++{ ++ return 0; ++} ++ + static int mv88q2xxx_hwmon_probe(struct phy_device *phydev) + { + return 0; +@@ -853,6 +822,48 @@ static int mv88q222x_probe(struct phy_device *phydev) + return mv88q2xxx_hwmon_probe(phydev); + } + ++static int mv88q2xxx_config_init(struct phy_device *phydev) ++{ ++ struct mv88q2xxx_priv *priv = phydev->priv; ++ int ret; ++ ++ /* The 88Q2XXX PHYs do have the extended ability register available, but ++ * register MDIO_PMA_EXTABLE where they should signalize it does not ++ * work according to specification. Therefore, we force it here. ++ */ ++ phydev->pma_extable = MDIO_PMA_EXTABLE_BT1; ++ ++ /* Configure interrupt with default settings, output is driven low for ++ * active interrupt and high for inactive. ++ */ ++ if (phy_interrupt_is_valid(phydev)) { ++ ret = phy_set_bits_mmd(phydev, MDIO_MMD_PCS, ++ MDIO_MMD_PCS_MV_GPIO_INT_CTRL, ++ MDIO_MMD_PCS_MV_GPIO_INT_CTRL_TRI_DIS); ++ if (ret < 0) ++ return ret; ++ } ++ ++ /* Enable LED function and disable TX disable feature on LED/TX_ENABLE */ ++ if (priv->enable_led0) { ++ ret = phy_clear_bits_mmd(phydev, MDIO_MMD_PCS, ++ MDIO_MMD_PCS_MV_RESET_CTRL, ++ MDIO_MMD_PCS_MV_RESET_CTRL_TX_DISABLE); ++ if (ret < 0) ++ return ret; ++ } ++ ++ /* Enable temperature sense again. There might have been a hard reset ++ * of the PHY and in this case the register content is restored to ++ * defaults and we need to enable it again. ++ */ ++ ret = mv88q2xxx_enable_temp_sense(phydev); ++ if (ret < 0) ++ return ret; ++ ++ return 0; ++} ++ + static int mv88q2110_config_init(struct phy_device *phydev) + { + int ret; +-- +2.39.5 + diff --git a/queue-6.15/net-phy-mediatek-do-not-require-syscon-compatible-fo.patch b/queue-6.15/net-phy-mediatek-do-not-require-syscon-compatible-fo.patch new file mode 100644 index 0000000000..9485cb580d --- /dev/null +++ b/queue-6.15/net-phy-mediatek-do-not-require-syscon-compatible-fo.patch @@ -0,0 +1,62 @@ +From 3734bc159ed877cc4738e8042276f2168d25b55f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 May 2025 19:49:32 +0200 +Subject: net: phy: mediatek: do not require syscon compatible for pio property + +From: Frank Wunderlich + +[ Upstream commit 15d7b3dfafa98270eade6c77d2336790dde0a40d ] + +Current implementation requires syscon compatible for pio property +which is used for driving the switch leds on mt7988. + +Replace syscon_regmap_lookup_by_phandle with of_parse_phandle and +device_node_to_regmap to get the regmap already assigned by pinctrl +driver. + +Signed-off-by: Frank Wunderlich +Link: https://patch.msgid.link/20250510174933.154589-1-linux@fw-web.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mediatek/mtk-ge-soc.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/mediatek/mtk-ge-soc.c b/drivers/net/phy/mediatek/mtk-ge-soc.c +index 175cf5239bba8..21975ef946d5b 100644 +--- a/drivers/net/phy/mediatek/mtk-ge-soc.c ++++ b/drivers/net/phy/mediatek/mtk-ge-soc.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + + #include "../phylib.h" + #include "mtk.h" +@@ -1319,6 +1320,7 @@ static int mt7988_phy_probe_shared(struct phy_device *phydev) + { + struct device_node *np = dev_of_node(&phydev->mdio.bus->dev); + struct mtk_socphy_shared *shared = phy_package_get_priv(phydev); ++ struct device_node *pio_np; + struct regmap *regmap; + u32 reg; + int ret; +@@ -1336,7 +1338,13 @@ static int mt7988_phy_probe_shared(struct phy_device *phydev) + * The 4 bits in TPBANK0 are kept as package shared data and are used to + * set LED polarity for each of the LED0. + */ +- regmap = syscon_regmap_lookup_by_phandle(np, "mediatek,pio"); ++ pio_np = of_parse_phandle(np, "mediatek,pio", 0); ++ if (!pio_np) ++ return -ENODEV; ++ ++ regmap = device_node_to_regmap(pio_np); ++ of_node_put(pio_np); ++ + if (IS_ERR(regmap)) + return PTR_ERR(regmap); + +-- +2.39.5 + diff --git a/queue-6.15/net-stmmac-generate-software-timestamp-just-before-t.patch b/queue-6.15/net-stmmac-generate-software-timestamp-just-before-t.patch new file mode 100644 index 0000000000..4444beb797 --- /dev/null +++ b/queue-6.15/net-stmmac-generate-software-timestamp-just-before-t.patch @@ -0,0 +1,67 @@ +From 6ce7c9798cc1600af0d698b37d8467a81f374ede Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 May 2025 21:48:12 +0800 +Subject: net: stmmac: generate software timestamp just before the doorbell + +From: Jason Xing + +[ Upstream commit 33d4cc81fcd930fdbcca7ac9e8959225cbec0a5e ] + +Make sure the call of skb_tx_timestamp is as close as possbile to the +doorbell. + +The patch also adjusts the order of setting SKBTX_IN_PROGRESS and +generate software timestamp so that without SOF_TIMESTAMPING_OPT_TX_SWHW +being set the software and hardware timestamps will not appear in the +error queue of socket nearly at the same time (Please see __skb_tstamp_tx()). + +Signed-off-by: Jason Xing +Link: https://patch.msgid.link/20250510134812.48199-4-kerneljasonxing@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 3a049a158ea11..1d716cee0cb10 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -4493,8 +4493,6 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) + if (priv->sarc_type) + stmmac_set_desc_sarc(priv, first, priv->sarc_type); + +- skb_tx_timestamp(skb); +- + if (unlikely((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && + priv->hwts_tx_en)) { + /* declare that device is doing timestamping */ +@@ -4527,6 +4525,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) + } + + netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len); ++ skb_tx_timestamp(skb); + + stmmac_flush_tx_descriptors(priv, queue); + stmmac_tx_timer_arm(priv, queue); +@@ -4770,8 +4769,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + if (priv->sarc_type) + stmmac_set_desc_sarc(priv, first, priv->sarc_type); + +- skb_tx_timestamp(skb); +- + /* Ready to fill the first descriptor and set the OWN bit w/o any + * problems because all the descriptors are actually ready to be + * passed to the DMA engine. +@@ -4818,7 +4815,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len); + + stmmac_enable_dma_transmission(priv, priv->ioaddr, queue); +- ++ skb_tx_timestamp(skb); + stmmac_flush_tx_descriptors(priv, queue); + stmmac_tx_timer_arm(priv, queue); + +-- +2.39.5 + diff --git a/queue-6.15/net-vertexcom-mse102x-return-code-for-mse102x_rx_pkt.patch b/queue-6.15/net-vertexcom-mse102x-return-code-for-mse102x_rx_pkt.patch new file mode 100644 index 0000000000..dedff79bea --- /dev/null +++ b/queue-6.15/net-vertexcom-mse102x-return-code-for-mse102x_rx_pkt.patch @@ -0,0 +1,92 @@ +From d1339da1bc3dfb85a51b829dd1b9957ac1ab8a97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 May 2025 14:04:34 +0200 +Subject: net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi + +From: Stefan Wahren + +[ Upstream commit 4ecf56f4b66011b583644bf9a62188d05dfcd78c ] + +The MSE102x doesn't provide any interrupt register, so the only way +to handle the level interrupt is to fetch the whole packet from +the MSE102x internal buffer via SPI. So in cases the interrupt +handler fails to do this, it should return IRQ_NONE. This allows +the core to disable the interrupt in case the issue persists +and prevent an interrupt storm. + +Signed-off-by: Stefan Wahren +Link: https://patch.msgid.link/20250509120435.43646-6-wahrenst@gmx.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/vertexcom/mse102x.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/vertexcom/mse102x.c b/drivers/net/ethernet/vertexcom/mse102x.c +index e4d993f313740..545177e84c0eb 100644 +--- a/drivers/net/ethernet/vertexcom/mse102x.c ++++ b/drivers/net/ethernet/vertexcom/mse102x.c +@@ -306,7 +306,7 @@ static void mse102x_dump_packet(const char *msg, int len, const char *data) + data, len, true); + } + +-static void mse102x_rx_pkt_spi(struct mse102x_net *mse) ++static irqreturn_t mse102x_rx_pkt_spi(struct mse102x_net *mse) + { + struct sk_buff *skb; + unsigned int rxalign; +@@ -327,7 +327,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) + mse102x_tx_cmd_spi(mse, CMD_CTR); + ret = mse102x_rx_cmd_spi(mse, (u8 *)&rx); + if (ret) +- return; ++ return IRQ_NONE; + + cmd_resp = be16_to_cpu(rx); + if ((cmd_resp & CMD_MASK) != CMD_RTS) { +@@ -360,7 +360,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) + rxalign = ALIGN(rxlen + DET_SOF_LEN + DET_DFT_LEN, 4); + skb = netdev_alloc_skb_ip_align(mse->ndev, rxalign); + if (!skb) +- return; ++ return IRQ_NONE; + + /* 2 bytes Start of frame (before ethernet header) + * 2 bytes Data frame tail (after ethernet frame) +@@ -370,7 +370,7 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) + if (mse102x_rx_frame_spi(mse, rxpkt, rxlen, drop)) { + mse->ndev->stats.rx_errors++; + dev_kfree_skb(skb); +- return; ++ return IRQ_HANDLED; + } + + if (netif_msg_pktdata(mse)) +@@ -381,6 +381,8 @@ static void mse102x_rx_pkt_spi(struct mse102x_net *mse) + + mse->ndev->stats.rx_packets++; + mse->ndev->stats.rx_bytes += rxlen; ++ ++ return IRQ_HANDLED; + } + + static int mse102x_tx_pkt_spi(struct mse102x_net *mse, struct sk_buff *txb, +@@ -512,12 +514,13 @@ static irqreturn_t mse102x_irq(int irq, void *_mse) + { + struct mse102x_net *mse = _mse; + struct mse102x_net_spi *mses = to_mse102x_spi(mse); ++ irqreturn_t ret; + + mutex_lock(&mses->lock); +- mse102x_rx_pkt_spi(mse); ++ ret = mse102x_rx_pkt_spi(mse); + mutex_unlock(&mses->lock); + +- return IRQ_HANDLED; ++ return ret; + } + + static int mse102x_net_open(struct net_device *ndev) +-- +2.39.5 + diff --git a/queue-6.15/netdevsim-mark-napi-id-on-skb-in-nsim_rcv.patch b/queue-6.15/netdevsim-mark-napi-id-on-skb-in-nsim_rcv.patch new file mode 100644 index 0000000000..c26069f818 --- /dev/null +++ b/queue-6.15/netdevsim-mark-napi-id-on-skb-in-nsim_rcv.patch @@ -0,0 +1,47 @@ +From d8aa31f32251c93e3e5ed4281f30e4337e22bbd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 00:27:31 +0000 +Subject: netdevsim: Mark NAPI ID on skb in nsim_rcv + +From: Joe Damato + +[ Upstream commit f71c549b26a33fd62f1e9c7deeba738bfc73fbfc ] + +Previously, nsim_rcv was not marking the NAPI ID on the skb, leading to +applications seeing a napi ID of 0 when using SO_INCOMING_NAPI_ID. + +To add to the userland confusion, netlink appears to correctly report +the NAPI IDs for netdevsim queues but the resulting file descriptor from +a call to accept() was reporting a NAPI ID of 0. + +Signed-off-by: Joe Damato +Link: https://patch.msgid.link/20250424002746.16891-2-jdamato@fastly.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/netdev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c +index 31a06e71be25b..b2a3518015372 100644 +--- a/drivers/net/netdevsim/netdev.c ++++ b/drivers/net/netdevsim/netdev.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + #include "netdevsim.h" + +@@ -357,6 +358,7 @@ static int nsim_rcv(struct nsim_rq *rq, int budget) + break; + + skb = skb_dequeue(&rq->skb_queue); ++ skb_mark_napi_id(skb, &rq->napi); + netif_receive_skb(skb); + } + +-- +2.39.5 + diff --git a/queue-6.15/netfilter-nft_set_pipapo-clamp-maximum-map-bucket-si.patch b/queue-6.15/netfilter-nft_set_pipapo-clamp-maximum-map-bucket-si.patch new file mode 100644 index 0000000000..ad1502e0c8 --- /dev/null +++ b/queue-6.15/netfilter-nft_set_pipapo-clamp-maximum-map-bucket-si.patch @@ -0,0 +1,50 @@ +From 41ee7a5363a0d998e1db050de32a299757164bdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 21:52:44 +0200 +Subject: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX + +From: Pablo Neira Ayuso + +[ Upstream commit b85e3367a5716ed3662a4fe266525190d2af76df ] + +Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() +when resizing hashtable because __GFP_NOWARN is unset. + +Similar to: + + b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INT_MAX") + +Reviewed-by: Stefano Brivio +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_pipapo.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c +index 0529e4ef75207..c5855069bdaba 100644 +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -663,6 +663,9 @@ static int pipapo_realloc_mt(struct nft_pipapo_field *f, + check_add_overflow(rules, extra, &rules_alloc)) + return -EOVERFLOW; + ++ if (rules_alloc > (INT_MAX / sizeof(*new_mt))) ++ return -ENOMEM; ++ + new_mt = kvmalloc_array(rules_alloc, sizeof(*new_mt), GFP_KERNEL_ACCOUNT); + if (!new_mt) + return -ENOMEM; +@@ -1499,6 +1502,9 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) + src->groups * NFT_PIPAPO_BUCKETS(src->bb)); + + if (src->rules > 0) { ++ if (src->rules_alloc > (INT_MAX / sizeof(*src->mt))) ++ goto out_mt; ++ + dst->mt = kvmalloc_array(src->rules_alloc, + sizeof(*src->mt), + GFP_KERNEL_ACCOUNT); +-- +2.39.5 + diff --git a/queue-6.15/nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch b/queue-6.15/nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch new file mode 100644 index 0000000000..a00de1aac0 --- /dev/null +++ b/queue-6.15/nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch @@ -0,0 +1,85 @@ +From ad2d7ae36a2eb02a7ab8d4c1fbad489548fecca0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Mar 2025 14:54:22 +0100 +Subject: nios2: force update_mmu_cache on spurious tlb-permission--related + pagefaults + +From: Simon Schuster + +[ Upstream commit 2d8a3179ea035f9341b6a73e5ba4029fc67e983d ] + +NIOS2 uses a software-managed TLB for virtual address translation. To +flush a cache line, the original mapping is replaced by one to physical +address 0x0 with no permissions (rwx mapped to 0) set. This can lead to +TLB-permission--related traps when such a nominally flushed entry is +encountered as a mapping for an otherwise valid virtual address within a +process (e.g. due to an MMU-PID-namespace rollover that previously +flushed the complete TLB including entries of existing, running +processes). + +The default ptep_set_access_flags implementation from mm/pgtable-generic.c +only forces a TLB-update when the page-table entry has changed within the +page table: + + /* + * [...] We return whether the PTE actually changed, which in turn + * instructs the caller to do things like update__mmu_cache. [...] + */ + int ptep_set_access_flags(struct vm_area_struct *vma, + unsigned long address, pte_t *ptep, + pte_t entry, int dirty) + { + int changed = !pte_same(*ptep, entry); + if (changed) { + set_pte_at(vma->vm_mm, address, ptep, entry); + flush_tlb_fix_spurious_fault(vma, address); + } + return changed; + } + +However, no cross-referencing with the TLB-state occurs, so the +flushing-induced pseudo entries that are responsible for the pagefault +in the first place are never pre-empted from TLB on this code path. + +This commit fixes this behaviour by always requesting a TLB-update in +this part of the pagefault handling, fixing spurious page-faults on the +way. The handling is a straightforward port of the logic from the MIPS +architecture via an arch-specific ptep_set_access_flags function ported +from arch/mips/include/asm/pgtable.h. + +Signed-off-by: Simon Schuster +Signed-off-by: Andreas Oetken +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/nios2/include/asm/pgtable.h | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/nios2/include/asm/pgtable.h b/arch/nios2/include/asm/pgtable.h +index eab87c6beacb5..e5d64c84aadf7 100644 +--- a/arch/nios2/include/asm/pgtable.h ++++ b/arch/nios2/include/asm/pgtable.h +@@ -291,4 +291,20 @@ void update_mmu_cache_range(struct vm_fault *vmf, struct vm_area_struct *vma, + #define update_mmu_cache(vma, addr, ptep) \ + update_mmu_cache_range(NULL, vma, addr, ptep, 1) + ++static inline int pte_same(pte_t pte_a, pte_t pte_b); ++ ++#define __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS ++static inline int ptep_set_access_flags(struct vm_area_struct *vma, ++ unsigned long address, pte_t *ptep, ++ pte_t entry, int dirty) ++{ ++ if (!pte_same(*ptep, entry)) ++ set_ptes(vma->vm_mm, address, ptep, entry, 1); ++ /* ++ * update_mmu_cache will unconditionally execute, handling both ++ * the case that the PTE changed and the spurious fault case. ++ */ ++ return true; ++} ++ + #endif /* _ASM_NIOS2_PGTABLE_H */ +-- +2.39.5 + diff --git a/queue-6.15/octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch b/queue-6.15/octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch new file mode 100644 index 0000000000..a391622a04 --- /dev/null +++ b/queue-6.15/octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch @@ -0,0 +1,47 @@ +From 0c3131632ab350dfdc495261ec7f4a79e5531e1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 11:26:02 +0800 +Subject: octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() + +From: Wentao Liang + +[ Upstream commit 9c056ec6dd1654b1420dafbbe2a69718850e6ff2 ] + +The cn10k_free_matchall_ipolicer() calls the cn10k_map_unmap_rq_policer() +for each queue in a for loop without checking for any errors. + +Check the return value of the cn10k_map_unmap_rq_policer() function during +each loop, and report a warning if the function fails. + +Signed-off-by: Wentao Liang +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250408032602.2909-1-vulab@iscas.ac.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c +index c3b6e0f60a799..7f6a435ac6806 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c +@@ -357,9 +357,12 @@ int cn10k_free_matchall_ipolicer(struct otx2_nic *pfvf) + mutex_lock(&pfvf->mbox.lock); + + /* Remove RQ's policer mapping */ +- for (qidx = 0; qidx < hw->rx_queues; qidx++) +- cn10k_map_unmap_rq_policer(pfvf, qidx, +- hw->matchall_ipolicer, false); ++ for (qidx = 0; qidx < hw->rx_queues; qidx++) { ++ rc = cn10k_map_unmap_rq_policer(pfvf, qidx, hw->matchall_ipolicer, false); ++ if (rc) ++ dev_warn(pfvf->dev, "Failed to unmap RQ %d's policer (error %d).", ++ qidx, rc); ++ } + + rc = cn10k_free_leaf_profile(pfvf, hw->matchall_ipolicer); + +-- +2.39.5 + diff --git a/queue-6.15/openvswitch-stricter-validation-for-the-userspace-ac.patch b/queue-6.15/openvswitch-stricter-validation-for-the-userspace-ac.patch new file mode 100644 index 0000000000..e2e2b12304 --- /dev/null +++ b/queue-6.15/openvswitch-stricter-validation-for-the-userspace-ac.patch @@ -0,0 +1,45 @@ +From 4c578798c09b3d4e1155135530bef737a03011d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 10:08:24 +0200 +Subject: openvswitch: Stricter validation for the userspace action + +From: Eelco Chaudron + +[ Upstream commit 88906f55954131ed2d3974e044b7fb48129b86ae ] + +This change enhances the robustness of validate_userspace() by ensuring +that all Netlink attributes are fully contained within the parent +attribute. The previous use of nla_parse_nested_deprecated() could +silently skip trailing or malformed attributes, as it stops parsing at +the first invalid entry. + +By switching to nla_parse_deprecated_strict(), we make sure only fully +validated attributes are copied for later use. + +Signed-off-by: Eelco Chaudron +Reviewed-by: Simon Horman +Acked-by: Ilya Maximets +Link: https://patch.msgid.link/67eb414e2d250e8408bb8afeb982deca2ff2b10b.1747037304.git.echaudro@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/openvswitch/flow_netlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index 518be23e48ea9..ad64bb9ab5e25 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -3049,7 +3049,8 @@ static int validate_userspace(const struct nlattr *attr) + struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1]; + int error; + +- error = nla_parse_nested_deprecated(a, OVS_USERSPACE_ATTR_MAX, attr, ++ error = nla_parse_deprecated_strict(a, OVS_USERSPACE_ATTR_MAX, ++ nla_data(attr), nla_len(attr), + userspace_policy, NULL); + if (error) + return error; +-- +2.39.5 + diff --git a/queue-6.15/ovl-fix-debug-print-in-case-of-mkdir-error.patch b/queue-6.15/ovl-fix-debug-print-in-case-of-mkdir-error.patch new file mode 100644 index 0000000000..1a50aa3729 --- /dev/null +++ b/queue-6.15/ovl-fix-debug-print-in-case-of-mkdir-error.patch @@ -0,0 +1,43 @@ +From 8125718644494f9d6577fc87d698b9c89f8d6b74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jun 2025 09:22:45 +0200 +Subject: ovl: fix debug print in case of mkdir error + +From: Amir Goldstein + +[ Upstream commit 527c88d8390d6c0358dea4d71696795c05328925 ] + +We want to print the name in case of mkdir failure and now we will +get a cryptic (efault) as name. + +Fixes: c54b386969a5 ("VFS: Change vfs_mkdir() to return the dentry.") +Signed-off-by: Amir Goldstein +Link: https://lore.kernel.org/20250612072245.2825938-1-amir73il@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/overlayfs/overlayfs.h | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index aef942a758cea..c69c34e11c74d 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -246,9 +246,11 @@ static inline struct dentry *ovl_do_mkdir(struct ovl_fs *ofs, + struct dentry *dentry, + umode_t mode) + { +- dentry = vfs_mkdir(ovl_upper_mnt_idmap(ofs), dir, dentry, mode); +- pr_debug("mkdir(%pd2, 0%o) = %i\n", dentry, mode, PTR_ERR_OR_ZERO(dentry)); +- return dentry; ++ struct dentry *ret; ++ ++ ret = vfs_mkdir(ovl_upper_mnt_idmap(ofs), dir, dentry, mode); ++ pr_debug("mkdir(%pd2, 0%o) = %i\n", dentry, mode, PTR_ERR_OR_ZERO(ret)); ++ return ret; + } + + static inline int ovl_do_mknod(struct ovl_fs *ofs, +-- +2.39.5 + diff --git a/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch b/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch new file mode 100644 index 0000000000..fdc29982e9 --- /dev/null +++ b/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch @@ -0,0 +1,41 @@ +From 51cac65db3eeaad795864de8e9b33bcc4c2f35af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:18:38 +0200 +Subject: pinctrl: armada-37xx: propagate error from + armada_37xx_pmx_set_by_name() + +From: Gabor Juhos + +[ Upstream commit 4229c28323db141eda69cb99427be75d3edba071 ] + +The regmap_update_bits() function can fail, so propagate its error +up to the stack instead of silently ignoring that. + +Signed-off-by: Imre Kaloz +Reviewed-by: Andrew Lunn +Signed-off-by: Gabor Juhos +Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-7-07e9ac1ab737@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 79f9c08e5039c..072bdd0d153ed 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -358,9 +358,7 @@ static int armada_37xx_pmx_set_by_name(struct pinctrl_dev *pctldev, + + val = grp->val[func]; + +- regmap_update_bits(info->regmap, reg, mask, val); +- +- return 0; ++ return regmap_update_bits(info->regmap, reg, mask, val); + } + + static int armada_37xx_pmx_set(struct pinctrl_dev *pctldev, +-- +2.39.5 + diff --git a/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-15232 b/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-15232 new file mode 100644 index 0000000000..ad59fa1bb7 --- /dev/null +++ b/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-15232 @@ -0,0 +1,45 @@ +From 3357b62d622fc46e22fc3bd27082092b698a8d8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:18:37 +0200 +Subject: pinctrl: armada-37xx: propagate error from + armada_37xx_gpio_get_direction() + +From: Gabor Juhos + +[ Upstream commit 6481c0a83367b0672951ccc876fbae7ee37b594b ] + +The regmap_read() function can fail, so propagate its error up to +the stack instead of silently ignoring that. + +Signed-off-by: Imre Kaloz +Reviewed-by: Andrew Lunn +Signed-off-by: Gabor Juhos +Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-6-07e9ac1ab737@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 072bdd0d153ed..4ac514cfd8884 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -400,10 +400,13 @@ static int armada_37xx_gpio_get_direction(struct gpio_chip *chip, + struct armada_37xx_pinctrl *info = gpiochip_get_data(chip); + unsigned int reg = OUTPUT_EN; + unsigned int val, mask; ++ int ret; + + armada_37xx_update_reg(®, &offset); + mask = BIT(offset); +- regmap_read(info->regmap, reg, &val); ++ ret = regmap_read(info->regmap, reg, &val); ++ if (ret) ++ return ret; + + if (val & mask) + return GPIO_LINE_DIRECTION_OUT; +-- +2.39.5 + diff --git a/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-26805 b/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-26805 new file mode 100644 index 0000000000..529005adff --- /dev/null +++ b/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-26805 @@ -0,0 +1,52 @@ +From e0e23b58062a4c7005ac5c3d62fb20c3d80c3746 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:18:36 +0200 +Subject: pinctrl: armada-37xx: propagate error from + armada_37xx_pmx_gpio_set_direction() + +From: Gabor Juhos + +[ Upstream commit bfa0ff804ffa8b1246ade8be08de98c9eb19d16f ] + +The armada_37xx_gpio_direction_{in,out}put() functions can fail, so +propagate their error values back to the stack instead of silently +ignoring those. + +Signed-off-by: Imre Kaloz +Reviewed-by: Andrew Lunn +Signed-off-by: Gabor Juhos +Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-5-07e9ac1ab737@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 4ac514cfd8884..15f257a856098 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -472,16 +472,17 @@ static int armada_37xx_pmx_gpio_set_direction(struct pinctrl_dev *pctldev, + { + struct armada_37xx_pinctrl *info = pinctrl_dev_get_drvdata(pctldev); + struct gpio_chip *chip = range->gc; ++ int ret; + + dev_dbg(info->dev, "gpio_direction for pin %u as %s-%d to %s\n", + offset, range->name, offset, input ? "input" : "output"); + + if (input) +- armada_37xx_gpio_direction_input(chip, offset); ++ ret = armada_37xx_gpio_direction_input(chip, offset); + else +- armada_37xx_gpio_direction_output(chip, offset, 0); ++ ret = armada_37xx_gpio_direction_output(chip, offset, 0); + +- return 0; ++ return ret; + } + + static int armada_37xx_gpio_request_enable(struct pinctrl_dev *pctldev, +-- +2.39.5 + diff --git a/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-3121 b/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-3121 new file mode 100644 index 0000000000..a31ffb994a --- /dev/null +++ b/queue-6.15/pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-3121 @@ -0,0 +1,45 @@ +From b0216c4577974b852ed204974baf7c5af001e163 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 May 2025 21:18:35 +0200 +Subject: pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() + +From: Gabor Juhos + +[ Upstream commit 57273ff8bb16f3842c2597b5bbcd49e7fa12edf7 ] + +The regmap_read() function can fail, so propagate its error up to +the stack instead of silently ignoring that. + +Signed-off-by: Imre Kaloz +Reviewed-by: Andrew Lunn +Signed-off-by: Gabor Juhos +Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-4-07e9ac1ab737@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +index 15f257a856098..5c0177b4e4a37 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -443,11 +443,14 @@ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset) + struct armada_37xx_pinctrl *info = gpiochip_get_data(chip); + unsigned int reg = INPUT_VAL; + unsigned int val, mask; ++ int ret; + + armada_37xx_update_reg(®, &offset); + mask = BIT(offset); + +- regmap_read(info->regmap, reg, &val); ++ ret = regmap_read(info->regmap, reg, &val); ++ if (ret) ++ return ret; + + return (val & mask) != 0; + } +-- +2.39.5 + diff --git a/queue-6.15/pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch b/queue-6.15/pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch new file mode 100644 index 0000000000..4c96dbeaa8 --- /dev/null +++ b/queue-6.15/pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch @@ -0,0 +1,47 @@ +From c564be32bb311ed8bd6f4adb37a789f3f5e33ef9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 16:17:45 +0100 +Subject: pinctrl: mcp23s08: Reset all pins to input at probe + +From: Mike Looijmans + +[ Upstream commit 3ede3f8b4b4b399b0ca41e44959f80d5cf84fc98 ] + +At startup, the driver just assumes that all registers have their +default values. But after a soft reset, the chip will just be in the +state it was, and some pins may have been configured as outputs. Any +modification of the output register will cause these pins to be driven +low, which leads to unexpected/unwanted effects. To prevent this from +happening, set the chip's IO configuration register to a known safe +mode (all inputs) before toggling any other bits. + +Signed-off-by: Mike Looijmans +Link: https://lore.kernel.org/20250314151803.28903-1-mike.looijmans@topic.nl +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-mcp23s08.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c +index 4d1f41488017e..c2f4b16f42d20 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c +@@ -636,6 +636,14 @@ int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev, + + mcp->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); + ++ /* ++ * Reset the chip - we don't really know what state it's in, so reset ++ * all pins to input first to prevent surprises. ++ */ ++ ret = mcp_write(mcp, MCP_IODIR, mcp->chip.ngpio == 16 ? 0xFFFF : 0xFF); ++ if (ret < 0) ++ return ret; ++ + /* verify MCP_IOCON.SEQOP = 0, so sequential reads work, + * and MCP_IOCON.HAEN = 1, so we work with all chips. + */ +-- +2.39.5 + diff --git a/queue-6.15/platform-msi-add-msi_remove_device_irq_domain-in-pla.patch b/queue-6.15/platform-msi-add-msi_remove_device_irq_domain-in-pla.patch new file mode 100644 index 0000000000..6ad11ee914 --- /dev/null +++ b/queue-6.15/platform-msi-add-msi_remove_device_irq_domain-in-pla.patch @@ -0,0 +1,48 @@ +From d2c9730c80e5987f6fa6e72610e35d6f7204e6eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 14:30:55 -0400 +Subject: platform-msi: Add msi_remove_device_irq_domain() in + platform_device_msi_free_irqs_all() + +From: Frank Li + +[ Upstream commit 9a958e1fd40d6fae8c66385687a00ebd9575a7d2 ] + +platform_device_msi_init_and_alloc_irqs() performs two tasks: allocating +the MSI domain for a platform device, and allocate a number of MSIs in that +domain. + +platform_device_msi_free_irqs_all() only frees the MSIs, and leaves the MSI +domain alive. + +Given that platform_device_msi_init_and_alloc_irqs() is the sole tool a +platform device has to allocate platform MSIs, it makes sense for +platform_device_msi_free_irqs_all() to teardown the MSI domain at the same +time as the MSIs. + +This avoids warnings and unexpected behaviours when a driver repeatedly +allocates and frees MSIs. + +Signed-off-by: Frank Li +Signed-off-by: Thomas Gleixner +Acked-by: Marc Zyngier +Link: https://lore.kernel.org/all/20250414-ep-msi-v18-1-f69b49917464@nxp.com +Signed-off-by: Sasha Levin +--- + drivers/base/platform-msi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/platform-msi.c b/drivers/base/platform-msi.c +index 0e60dd650b5e0..70db08f3ac6fa 100644 +--- a/drivers/base/platform-msi.c ++++ b/drivers/base/platform-msi.c +@@ -95,5 +95,6 @@ EXPORT_SYMBOL_GPL(platform_device_msi_init_and_alloc_irqs); + void platform_device_msi_free_irqs_all(struct device *dev) + { + msi_domain_free_irqs_all(dev, MSI_DEFAULT_DOMAIN); ++ msi_remove_device_irq_domain(dev, MSI_DEFAULT_DOMAIN); + } + EXPORT_SYMBOL_GPL(platform_device_msi_free_irqs_all); +-- +2.39.5 + diff --git a/queue-6.15/platform-x86-amd-pmc-clear-metrics-table-at-start-of.patch b/queue-6.15/platform-x86-amd-pmc-clear-metrics-table-at-start-of.patch new file mode 100644 index 0000000000..e79b171b5d --- /dev/null +++ b/queue-6.15/platform-x86-amd-pmc-clear-metrics-table-at-start-of.patch @@ -0,0 +1,49 @@ +From 581e3afd72c9c5fe4dedb1cca8bb3a0fbd7d3e9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jun 2025 08:24:08 -0500 +Subject: platform/x86/amd: pmc: Clear metrics table at start of cycle +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit 4dbd11796f3a8eb95647507befc41995458a4023 ] + +The area of memory that contains the metrics table may contain garbage +when the cycle starts. This normally doesn't matter because the cycle +itself will populate it with valid data, however commit 9f5595d5f03fd +("platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep +cycles") started to use it during the check() phase. Depending upon +what garbage is in the table it's possible that the system will wait +2.5 seconds for even the first cycle, which will be visible to a user. + +To prevent this from happening explicitly clear the table when logging +is started. + +Fixes: 9f5595d5f03fd ("platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles") +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20250603132412.3555302-1-superm1@kernel.org +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c +index 0329fafe14ebc..f45525bbd1549 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -157,6 +157,8 @@ static int amd_pmc_setup_smu_logging(struct amd_pmc_dev *dev) + return -ENOMEM; + } + ++ memset_io(dev->smu_virt_addr, 0, sizeof(struct smu_metrics)); ++ + /* Start the logging */ + amd_pmc_send_cmd(dev, 0, NULL, SMU_MSG_LOG_RESET, false); + amd_pmc_send_cmd(dev, 0, NULL, SMU_MSG_LOG_START, false); +-- +2.39.5 + diff --git a/queue-6.15/platform-x86-amd-pmf-prevent-amd_pmf_tee_deinit-from.patch b/queue-6.15/platform-x86-amd-pmf-prevent-amd_pmf_tee_deinit-from.patch new file mode 100644 index 0000000000..d60cbfe616 --- /dev/null +++ b/queue-6.15/platform-x86-amd-pmf-prevent-amd_pmf_tee_deinit-from.patch @@ -0,0 +1,74 @@ +From 94e19eac7957250fb3388e3a70fc99a8ee534bee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 May 2025 19:34:56 -0500 +Subject: platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running + twice +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit 93103d56650d7a38ed37ba4041578310f82776ae ] + +If any of the tee init fails, pass up the errors and clear the tee_ctx +pointer. This will prevent cleaning up multiple times. + +Fixes: ac052d8c08f9d ("platform/x86/amd/pmf: Add PMF TEE interface") +Suggested-by: Dan Carpenter +Link: https://lore.kernel.org/r/20250512211154.2510397-3-superm1@kernel.org +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20250522003457.1516679-3-superm1@kernel.org +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/tee-if.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c +index 027e992b71472..76efce48a45ce 100644 +--- a/drivers/platform/x86/amd/pmf/tee-if.c ++++ b/drivers/platform/x86/amd/pmf/tee-if.c +@@ -420,12 +420,12 @@ static int amd_pmf_ta_open_session(struct tee_context *ctx, u32 *id, const uuid_ + rc = tee_client_open_session(ctx, &sess_arg, NULL); + if (rc < 0 || sess_arg.ret != 0) { + pr_err("Failed to open TEE session err:%#x, rc:%d\n", sess_arg.ret, rc); +- return rc; ++ return rc ?: -EINVAL; + } + + *id = sess_arg.session; + +- return rc; ++ return 0; + } + + static int amd_pmf_register_input_device(struct amd_pmf_dev *dev) +@@ -460,7 +460,9 @@ static int amd_pmf_tee_init(struct amd_pmf_dev *dev, const uuid_t *uuid) + dev->tee_ctx = tee_client_open_context(NULL, amd_pmf_amdtee_ta_match, NULL, NULL); + if (IS_ERR(dev->tee_ctx)) { + dev_err(dev->dev, "Failed to open TEE context\n"); +- return PTR_ERR(dev->tee_ctx); ++ ret = PTR_ERR(dev->tee_ctx); ++ dev->tee_ctx = NULL; ++ return ret; + } + + ret = amd_pmf_ta_open_session(dev->tee_ctx, &dev->session_id, uuid); +@@ -500,9 +502,12 @@ static int amd_pmf_tee_init(struct amd_pmf_dev *dev, const uuid_t *uuid) + + static void amd_pmf_tee_deinit(struct amd_pmf_dev *dev) + { ++ if (!dev->tee_ctx) ++ return; + tee_shm_free(dev->fw_shm_pool); + tee_client_close_session(dev->tee_ctx, dev->session_id); + tee_client_close_context(dev->tee_ctx); ++ dev->tee_ctx = NULL; + } + + int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) +-- +2.39.5 + diff --git a/queue-6.15/platform-x86-amd-pmf-use-device-managed-allocations.patch b/queue-6.15/platform-x86-amd-pmf-use-device-managed-allocations.patch new file mode 100644 index 0000000000..f801f2fb07 --- /dev/null +++ b/queue-6.15/platform-x86-amd-pmf-use-device-managed-allocations.patch @@ -0,0 +1,188 @@ +From a3d3a8090be4a446493ab30c6a4ea3016ab7efe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 May 2025 19:34:55 -0500 +Subject: platform/x86/amd: pmf: Use device managed allocations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit d9db3a941270d92bbd1a6a6b54a10324484f2f2d ] + +If setting up smart PC fails for any reason then this can lead to +a double free when unloading amd-pmf. This is because dev->buf was +freed but never set to NULL and is again freed in amd_pmf_remove(). + +To avoid subtle allocation bugs in failures leading to a double free +change all allocations into device managed allocations. + +Fixes: 5b1122fc4995f ("platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()") +Link: https://lore.kernel.org/r/20250512211154.2510397-2-superm1@kernel.org +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20250522003457.1516679-2-superm1@kernel.org +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/core.c | 3 +- + drivers/platform/x86/amd/pmf/tee-if.c | 56 ++++++++++----------------- + 2 files changed, 22 insertions(+), 37 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c +index 96821101ec773..395c011e837f1 100644 +--- a/drivers/platform/x86/amd/pmf/core.c ++++ b/drivers/platform/x86/amd/pmf/core.c +@@ -280,7 +280,7 @@ int amd_pmf_set_dram_addr(struct amd_pmf_dev *dev, bool alloc_buffer) + dev_err(dev->dev, "Invalid CPU id: 0x%x", dev->cpu_id); + } + +- dev->buf = kzalloc(dev->mtable_size, GFP_KERNEL); ++ dev->buf = devm_kzalloc(dev->dev, dev->mtable_size, GFP_KERNEL); + if (!dev->buf) + return -ENOMEM; + } +@@ -493,7 +493,6 @@ static void amd_pmf_remove(struct platform_device *pdev) + mutex_destroy(&dev->lock); + mutex_destroy(&dev->update_mutex); + mutex_destroy(&dev->cb_mutex); +- kfree(dev->buf); + } + + static const struct attribute_group *amd_pmf_driver_groups[] = { +diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c +index d3bd12ad036ae..027e992b71472 100644 +--- a/drivers/platform/x86/amd/pmf/tee-if.c ++++ b/drivers/platform/x86/amd/pmf/tee-if.c +@@ -358,30 +358,28 @@ static ssize_t amd_pmf_get_pb_data(struct file *filp, const char __user *buf, + return -EINVAL; + + /* re-alloc to the new buffer length of the policy binary */ +- new_policy_buf = memdup_user(buf, length); +- if (IS_ERR(new_policy_buf)) +- return PTR_ERR(new_policy_buf); ++ new_policy_buf = devm_kzalloc(dev->dev, length, GFP_KERNEL); ++ if (!new_policy_buf) ++ return -ENOMEM; ++ ++ if (copy_from_user(new_policy_buf, buf, length)) { ++ devm_kfree(dev->dev, new_policy_buf); ++ return -EFAULT; ++ } + +- kfree(dev->policy_buf); ++ devm_kfree(dev->dev, dev->policy_buf); + dev->policy_buf = new_policy_buf; + dev->policy_sz = length; + +- if (!amd_pmf_pb_valid(dev)) { +- ret = -EINVAL; +- goto cleanup; +- } ++ if (!amd_pmf_pb_valid(dev)) ++ return -EINVAL; + + amd_pmf_hex_dump_pb(dev); + ret = amd_pmf_start_policy_engine(dev); + if (ret < 0) +- goto cleanup; ++ return ret; + + return length; +- +-cleanup: +- kfree(dev->policy_buf); +- dev->policy_buf = NULL; +- return ret; + } + + static const struct file_operations pb_fops = { +@@ -532,13 +530,13 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) + dev->policy_base = devm_ioremap_resource(dev->dev, dev->res); + if (IS_ERR(dev->policy_base)) { + ret = PTR_ERR(dev->policy_base); +- goto err_free_dram_buf; ++ goto err_cancel_work; + } + +- dev->policy_buf = kzalloc(dev->policy_sz, GFP_KERNEL); ++ dev->policy_buf = devm_kzalloc(dev->dev, dev->policy_sz, GFP_KERNEL); + if (!dev->policy_buf) { + ret = -ENOMEM; +- goto err_free_dram_buf; ++ goto err_cancel_work; + } + + memcpy_fromio(dev->policy_buf, dev->policy_base, dev->policy_sz); +@@ -546,21 +544,21 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) + if (!amd_pmf_pb_valid(dev)) { + dev_info(dev->dev, "No Smart PC policy present\n"); + ret = -EINVAL; +- goto err_free_policy; ++ goto err_cancel_work; + } + + amd_pmf_hex_dump_pb(dev); + +- dev->prev_data = kzalloc(sizeof(*dev->prev_data), GFP_KERNEL); ++ dev->prev_data = devm_kzalloc(dev->dev, sizeof(*dev->prev_data), GFP_KERNEL); + if (!dev->prev_data) { + ret = -ENOMEM; +- goto err_free_policy; ++ goto err_cancel_work; + } + + for (i = 0; i < ARRAY_SIZE(amd_pmf_ta_uuid); i++) { + ret = amd_pmf_tee_init(dev, &amd_pmf_ta_uuid[i]); + if (ret) +- goto err_free_prev_data; ++ goto err_cancel_work; + + ret = amd_pmf_start_policy_engine(dev); + switch (ret) { +@@ -575,7 +573,7 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) + default: + ret = -EINVAL; + amd_pmf_tee_deinit(dev); +- goto err_free_prev_data; ++ goto err_cancel_work; + } + + if (status) +@@ -584,7 +582,7 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) + + if (!status && !pb_side_load) { + ret = -EINVAL; +- goto err_free_prev_data; ++ goto err_cancel_work; + } + + if (pb_side_load) +@@ -600,12 +598,6 @@ int amd_pmf_init_smart_pc(struct amd_pmf_dev *dev) + if (pb_side_load && dev->esbin) + amd_pmf_remove_pb(dev); + amd_pmf_tee_deinit(dev); +-err_free_prev_data: +- kfree(dev->prev_data); +-err_free_policy: +- kfree(dev->policy_buf); +-err_free_dram_buf: +- kfree(dev->buf); + err_cancel_work: + cancel_delayed_work_sync(&dev->pb_work); + +@@ -621,11 +613,5 @@ void amd_pmf_deinit_smart_pc(struct amd_pmf_dev *dev) + amd_pmf_remove_pb(dev); + + cancel_delayed_work_sync(&dev->pb_work); +- kfree(dev->prev_data); +- dev->prev_data = NULL; +- kfree(dev->policy_buf); +- dev->policy_buf = NULL; +- kfree(dev->buf); +- dev->buf = NULL; + amd_pmf_tee_deinit(dev); + } +-- +2.39.5 + diff --git a/queue-6.15/platform-x86-dell_rbu-fix-list-usage.patch b/queue-6.15/platform-x86-dell_rbu-fix-list-usage.patch new file mode 100644 index 0000000000..57dab236d5 --- /dev/null +++ b/queue-6.15/platform-x86-dell_rbu-fix-list-usage.patch @@ -0,0 +1,54 @@ +From ed207f86aebadb8fff8dc614931f330103a6b701 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jun 2025 13:46:56 -0500 +Subject: platform/x86: dell_rbu: Fix list usage +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stuart Hayes + +[ Upstream commit 61ce04601e0d8265ec6d2ffa6df5a7e1bce64854 ] + +Pass the correct list head to list_for_each_entry*() when looping through +the packet list. + +Without this patch, reading the packet data via sysfs will show the data +incorrectly (because it starts at the wrong packet), and clearing the +packet list will result in a NULL pointer dereference. + +Fixes: d19f359fbdc6 ("platform/x86: dell_rbu: don't open code list_for_each_entry*()") +Signed-off-by: Stuart Hayes +Link: https://lore.kernel.org/r/20250609184659.7210-3-stuart.w.hayes@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/dell/dell_rbu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c +index e30ca325938cb..e2afe51b66ee8 100644 +--- a/drivers/platform/x86/dell/dell_rbu.c ++++ b/drivers/platform/x86/dell/dell_rbu.c +@@ -292,7 +292,7 @@ static int packet_read_list(char *data, size_t * pread_length) + remaining_bytes = *pread_length; + bytes_read = rbu_data.packet_read_count; + +- list_for_each_entry(newpacket, (&packet_data_head.list)->next, list) { ++ list_for_each_entry(newpacket, &packet_data_head.list, list) { + bytes_copied = do_packet_read(pdest, newpacket, + remaining_bytes, bytes_read, &temp_count); + remaining_bytes -= bytes_copied; +@@ -315,7 +315,7 @@ static void packet_empty_list(void) + { + struct packet_data *newpacket, *tmp; + +- list_for_each_entry_safe(newpacket, tmp, (&packet_data_head.list)->next, list) { ++ list_for_each_entry_safe(newpacket, tmp, &packet_data_head.list, list) { + list_del(&newpacket->list); + + /* +-- +2.39.5 + diff --git a/queue-6.15/platform-x86-dell_rbu-stop-overwriting-data-buffer.patch b/queue-6.15/platform-x86-dell_rbu-stop-overwriting-data-buffer.patch new file mode 100644 index 0000000000..593b32e743 --- /dev/null +++ b/queue-6.15/platform-x86-dell_rbu-stop-overwriting-data-buffer.patch @@ -0,0 +1,55 @@ +From e22437cf45cf8138a41f676d6e78a185c382e83e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jun 2025 13:46:58 -0500 +Subject: platform/x86: dell_rbu: Stop overwriting data buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stuart Hayes + +[ Upstream commit f4b0fa38d5fefe9aed6ed831f3bd3538c168ee19 ] + +The dell_rbu driver will use memset() to clear the data held by each +packet when it is no longer needed (when the driver is unloaded, the +packet size is changed, etc). + +The amount of memory that is cleared (before this patch) is the normal +packet size. However, the last packet in the list may be smaller. + +Fix this to only clear the memory actually used by each packet, to prevent +it from writing past the end of data buffer. + +Because the packet data buffers are allocated with __get_free_pages() (in +page-sized increments), this bug could only result in a buffer being +overwritten when a packet size larger than one page is used. The only user +of the dell_rbu module should be the Dell BIOS update program, which uses +a packet size of 4096, so no issues should be seen without the patch, it +just blocks the possiblity. + +Fixes: 6c54c28e69f2 ("[PATCH] dell_rbu: new Dell BIOS update driver") +Signed-off-by: Stuart Hayes +Link: https://lore.kernel.org/r/20250609184659.7210-5-stuart.w.hayes@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/dell/dell_rbu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/dell/dell_rbu.c b/drivers/platform/x86/dell/dell_rbu.c +index e2afe51b66ee8..8dea70b7f8c15 100644 +--- a/drivers/platform/x86/dell/dell_rbu.c ++++ b/drivers/platform/x86/dell/dell_rbu.c +@@ -322,7 +322,7 @@ static void packet_empty_list(void) + * zero out the RBU packet memory before freeing + * to make sure there are no stale RBU packets left in memory + */ +- memset(newpacket->data, 0, rbu_data.packetsize); ++ memset(newpacket->data, 0, newpacket->length); + set_memory_wb((unsigned long)newpacket->data, + 1 << newpacket->ordernum); + free_pages((unsigned long) newpacket->data, +-- +2.39.5 + diff --git a/queue-6.15/pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch b/queue-6.15/pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch new file mode 100644 index 0000000000..3e724a5351 --- /dev/null +++ b/queue-6.15/pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch @@ -0,0 +1,61 @@ +From 3469155dcd15b7c39267c86a7b19072307f20e8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 12:11:25 +0530 +Subject: PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() + +From: Charan Teja Kalla + +[ Upstream commit 40d3b40dce375d6f1c1dbf08d79eed3aed6c691d ] + +pm_runtime_put_autosuspend() schedules a hrtimer to expire +at "dev->power.timer_expires". If the hrtimer's callback, +pm_suspend_timer_fn(), observes that the current time equals +"dev->power.timer_expires", it unexpectedly bails out instead of +proceeding with runtime suspend. + +pm_suspend_timer_fn(): + + if (expires > 0 && expires < ktime_get_mono_fast_ns()) { + dev->power.timer_expires = 0; + rpm_suspend(..) + } + +Additionally, as ->timer_expires is not cleared, all the future auto +suspend requests will not schedule hrtimer to perform auto suspend. + +rpm_suspend(): + + if ((rpmflags & RPM_AUTO) &&...) { + if (!(dev->power.timer_expires && ...) { <-- this will fail. + hrtimer_start_range_ns(&dev->power.suspend_timer,...); + } + } + +Fix this by as well checking if current time reaches the set expiration. + +Co-developed-by: Patrick Daly +Signed-off-by: Patrick Daly +Signed-off-by: Charan Teja Kalla +Link: https://patch.msgid.link/20250515064125.1211561-1-quic_charante@quicinc.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/runtime.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index 205a4f8828b0a..c55a7c70bc1a8 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1011,7 +1011,7 @@ static enum hrtimer_restart pm_suspend_timer_fn(struct hrtimer *timer) + * If 'expires' is after the current time, we've been called + * too early. + */ +- if (expires > 0 && expires < ktime_get_mono_fast_ns()) { ++ if (expires > 0 && expires <= ktime_get_mono_fast_ns()) { + dev->power.timer_expires = 0; + rpm_suspend(dev, dev->power.timer_autosuspends ? + (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC); +-- +2.39.5 + diff --git a/queue-6.15/pmdomain-core-reset-genpd-states-to-avoid-freeing-in.patch b/queue-6.15/pmdomain-core-reset-genpd-states-to-avoid-freeing-in.patch new file mode 100644 index 0000000000..0d6927e4a5 --- /dev/null +++ b/queue-6.15/pmdomain-core-reset-genpd-states-to-avoid-freeing-in.patch @@ -0,0 +1,41 @@ +From cf66fba93f152535794c03dba146bbe05b9e09d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 14:06:13 +0200 +Subject: pmdomain: core: Reset genpd->states to avoid freeing invalid data + +From: Ulf Hansson + +[ Upstream commit 99012014c902cd9ad85fd288d8a107f33a69855e ] + +If genpd_alloc_data() allocates data for the default power-states for the +genpd, let's make sure to also reset the pointer in the error path. This +makes sure a genpd provider driver doesn't end up trying to free the data +again, but using an invalid pointer. + +Signed-off-by: Ulf Hansson +Reviewed-by: Dhruva Gole +Link: https://lore.kernel.org/r/20250402120613.1116711-1-ulf.hansson@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/pmdomain/core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pmdomain/core.c b/drivers/pmdomain/core.c +index d6c1ddb807b20..7a3bad106e175 100644 +--- a/drivers/pmdomain/core.c ++++ b/drivers/pmdomain/core.c +@@ -2229,8 +2229,10 @@ static int genpd_alloc_data(struct generic_pm_domain *genpd) + return 0; + put: + put_device(&genpd->dev); +- if (genpd->free_states == genpd_free_default_power_state) ++ if (genpd->free_states == genpd_free_default_power_state) { + kfree(genpd->states); ++ genpd->states = NULL; ++ } + free: + if (genpd_is_cpu_domain(genpd)) + free_cpumask_var(genpd->cpus); +-- +2.39.5 + diff --git a/queue-6.15/power-supply-bq27xxx-retrieve-again-when-busy.patch b/queue-6.15/power-supply-bq27xxx-retrieve-again-when-busy.patch new file mode 100644 index 0000000000..c6d99f28d5 --- /dev/null +++ b/queue-6.15/power-supply-bq27xxx-retrieve-again-when-busy.patch @@ -0,0 +1,90 @@ +From 3d9ef80fa2cd13f9798079a1d53756218cccbd92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 11:40:47 +0800 +Subject: power: supply: bq27xxx: Retrieve again when busy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jerry Lv + +[ Upstream commit f16d9fb6cf03fdbdefa41a8b32ba1e57afb7ae3d ] + +Multiple applications may access the battery gauge at the same time, so +the gauge may be busy and EBUSY will be returned. The driver will set a +flag to record the EBUSY state, and this flag will be kept until the next +periodic update. When this flag is set, bq27xxx_battery_get_property() +will just return ENODEV until the flag is updated. + +Even if the gauge was busy during the last accessing attempt, returning +ENODEV is not ideal, and can cause confusion in the applications layer. + +Instead, retry accessing the I2C to update the flag is as expected, for +the gauge typically recovers from busy state within a few milliseconds. +If still failed to access the gauge, the real error code would be returned +instead of ENODEV (as suggested by Pali Rohár). + +Reviewed-by: Pali Rohár +Signed-off-by: Jerry Lv +Link: https://lore.kernel.org/r/20250415-foo-fix-v2-1-5b45a395e4cc@axis.com +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq27xxx_battery.c | 2 +- + drivers/power/supply/bq27xxx_battery_i2c.c | 13 ++++++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c +index 2f31d750a4c1e..93dcebbe11417 100644 +--- a/drivers/power/supply/bq27xxx_battery.c ++++ b/drivers/power/supply/bq27xxx_battery.c +@@ -2131,7 +2131,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy, + mutex_unlock(&di->lock); + + if (psp != POWER_SUPPLY_PROP_PRESENT && di->cache.flags < 0) +- return -ENODEV; ++ return di->cache.flags; + + switch (psp) { + case POWER_SUPPLY_PROP_STATUS: +diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c +index ba0d22d904295..868e95f0887e1 100644 +--- a/drivers/power/supply/bq27xxx_battery_i2c.c ++++ b/drivers/power/supply/bq27xxx_battery_i2c.c +@@ -6,6 +6,7 @@ + * Andrew F. Davis + */ + ++#include + #include + #include + #include +@@ -31,6 +32,7 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg, + struct i2c_msg msg[2]; + u8 data[2]; + int ret; ++ int retry = 0; + + if (!client->adapter) + return -ENODEV; +@@ -47,7 +49,16 @@ static int bq27xxx_battery_i2c_read(struct bq27xxx_device_info *di, u8 reg, + else + msg[1].len = 2; + +- ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); ++ do { ++ ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); ++ if (ret == -EBUSY && ++retry < 3) { ++ /* sleep 10 milliseconds when busy */ ++ usleep_range(10000, 11000); ++ continue; ++ } ++ break; ++ } while (1); ++ + if (ret < 0) + return ret; + +-- +2.39.5 + diff --git a/queue-6.15/power-supply-collie-fix-wakeup-source-leaks-on-devic.patch b/queue-6.15/power-supply-collie-fix-wakeup-source-leaks-on-devic.patch new file mode 100644 index 0000000000..ef70466a3d --- /dev/null +++ b/queue-6.15/power-supply-collie-fix-wakeup-source-leaks-on-devic.patch @@ -0,0 +1,35 @@ +From b971e7d545171657e49d1e90abc17a202f49eda0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Apr 2025 22:27:29 +0200 +Subject: power: supply: collie: Fix wakeup source leaks on device unbind + +From: Krzysztof Kozlowski + +[ Upstream commit c73d19f89cb03c43abbbfa3b9caa1b8fc719764c ] + +Device can be unbound, so driver must also release memory for the wakeup +source. + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20250406202730.55096-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/collie_battery.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/collie_battery.c b/drivers/power/supply/collie_battery.c +index 68390bd1004f0..3daf7befc0bf6 100644 +--- a/drivers/power/supply/collie_battery.c ++++ b/drivers/power/supply/collie_battery.c +@@ -440,6 +440,7 @@ static int collie_bat_probe(struct ucb1x00_dev *dev) + + static void collie_bat_remove(struct ucb1x00_dev *dev) + { ++ device_init_wakeup(&ucb->dev, 0); + free_irq(gpiod_to_irq(collie_bat_main.gpio_full), &collie_bat_main); + power_supply_unregister(collie_bat_bu.psy); + power_supply_unregister(collie_bat_main.psy); +-- +2.39.5 + diff --git a/queue-6.15/power-supply-gpio-charger-fix-wakeup-source-leaks-on.patch b/queue-6.15/power-supply-gpio-charger-fix-wakeup-source-leaks-on.patch new file mode 100644 index 0000000000..9a9d78455a --- /dev/null +++ b/queue-6.15/power-supply-gpio-charger-fix-wakeup-source-leaks-on.patch @@ -0,0 +1,38 @@ +From 25e5246afee37727d0c187517018abfe00d3a11e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Apr 2025 22:27:30 +0200 +Subject: power: supply: gpio-charger: Fix wakeup source leaks on device unbind + +From: Krzysztof Kozlowski + +[ Upstream commit 51212ce95354c5b51e8c3054bf80eeeed80003b6 ] + +Device can be unbound, so driver must also release memory for the wakeup +source. + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20250406202730.55096-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/gpio-charger.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/gpio-charger.c b/drivers/power/supply/gpio-charger.c +index 1dfd5b0cb30d8..1b2da9b5fb654 100644 +--- a/drivers/power/supply/gpio-charger.c ++++ b/drivers/power/supply/gpio-charger.c +@@ -366,7 +366,9 @@ static int gpio_charger_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, gpio_charger); + +- device_init_wakeup(dev, 1); ++ ret = devm_device_init_wakeup(dev); ++ if (ret) ++ return dev_err_probe(dev, ret, "Failed to init wakeup\n"); + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.15/power-supply-max17040-adjust-thermal-channel-scaling.patch b/queue-6.15/power-supply-max17040-adjust-thermal-channel-scaling.patch new file mode 100644 index 0000000000..6b28a2a43b --- /dev/null +++ b/queue-6.15/power-supply-max17040-adjust-thermal-channel-scaling.patch @@ -0,0 +1,39 @@ +From 4ac3843ab586f8e0350ad293372718d4b25dd696 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 09:02:39 +0300 +Subject: power: supply: max17040: adjust thermal channel scaling + +From: Svyatoslav Ryhel + +[ Upstream commit d055f51731744243b244aafb1720f793a5b61f7b ] + +IIO thermal channel is in millidegree while power supply framework expects +decidegree values. Adjust scaling to get correct readings. + +Signed-off-by: Svyatoslav Ryhel +Link: https://lore.kernel.org/r/20250430060239.12085-2-clamor95@gmail.com +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/max17040_battery.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/max17040_battery.c b/drivers/power/supply/max17040_battery.c +index 51310f6e4803b..c1640bc6accd2 100644 +--- a/drivers/power/supply/max17040_battery.c ++++ b/drivers/power/supply/max17040_battery.c +@@ -410,8 +410,9 @@ static int max17040_get_property(struct power_supply *psy, + if (!chip->channel_temp) + return -ENODATA; + +- iio_read_channel_processed_scale(chip->channel_temp, +- &val->intval, 10); ++ iio_read_channel_processed(chip->channel_temp, &val->intval); ++ val->intval /= 100; /* Convert from milli- to deci-degree */ ++ + break; + default: + return -EINVAL; +-- +2.39.5 + diff --git a/queue-6.15/powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch b/queue-6.15/powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch new file mode 100644 index 0000000000..879b87f5b0 --- /dev/null +++ b/queue-6.15/powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch @@ -0,0 +1,67 @@ +From 4b51e88be2c58af3d9341f6689287711af73aeda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 02:29:28 -0400 +Subject: powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH + recovery + +From: Narayana Murty N + +[ Upstream commit 33bc69cf6655cf60829a803a45275f11a74899e5 ] + +VFIO EEH recovery for PCI passthrough devices fails on PowerNV and pseries +platforms due to missing host-side PE bridge reconfiguration. In the +current implementation, eeh_pe_configure() only performs RTAS or OPAL-based +bridge reconfiguration for native host devices, but skips it entirely for +PEs managed through VFIO in guest passthrough scenarios. + +This leads to incomplete EEH recovery when a PCI error affects a +passthrough device assigned to a QEMU/KVM guest. Although VFIO triggers the +EEH recovery flow through VFIO_EEH_PE_ENABLE ioctl, the platform-specific +bridge reconfiguration step is silently bypassed. As a result, the PE's +config space is not fully restored, causing subsequent config space access +failures or EEH freeze-on-access errors inside the guest. + +This patch fixes the issue by ensuring that eeh_pe_configure() always +invokes the platform's configure_bridge() callback (e.g., +pseries_eeh_phb_configure_bridge) even for VFIO-managed PEs. This ensures +that RTAS or OPAL calls to reconfigure the PE bridge are correctly issued +on the host side, restoring the PE's configuration space after an EEH +event. + +This fix is essential for reliable EEH recovery in QEMU/KVM guests using +VFIO PCI passthrough on PowerNV and pseries systems. + +Tested with: +- QEMU/KVM guest using VFIO passthrough (IBM Power9,(lpar)Power11 host) +- Injected EEH errors with pseries EEH errinjct tool on host, recovery + verified on qemu guest. +- Verified successful config space access and CAP_EXP DevCtl restoration + after recovery + +Fixes: 212d16cdca2d ("powerpc/eeh: EEH support for VFIO PCI device") +Signed-off-by: Narayana Murty N +Reviewed-by: Vaibhav Jain +Reviewed-by: Ganesh Goudar +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20250508062928.146043-1-nnmlinux@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/eeh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index 83fe99861eb17..ca7f7bb2b4786 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -1509,6 +1509,8 @@ int eeh_pe_configure(struct eeh_pe *pe) + /* Invalid PE ? */ + if (!pe) + return -ENODEV; ++ else ++ ret = eeh_ops->configure_bridge(pe); + + return ret; + } +-- +2.39.5 + diff --git a/queue-6.15/powerpc-vdso-fix-build-of-vdso32-with-pcrel.patch b/queue-6.15/powerpc-vdso-fix-build-of-vdso32-with-pcrel.patch new file mode 100644 index 0000000000..e273337791 --- /dev/null +++ b/queue-6.15/powerpc-vdso-fix-build-of-vdso32-with-pcrel.patch @@ -0,0 +1,71 @@ +From fce5ba105c2f974acbebdd814fd1c34ccd6a1abb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 May 2025 20:14:55 +0200 +Subject: powerpc/vdso: Fix build of VDSO32 with pcrel + +From: Christophe Leroy + +[ Upstream commit b93755f408325170edb2156c6a894ed1cae5f4f6 ] + +Building vdso32 on power10 with pcrel leads to following errors: + + VDSO32A arch/powerpc/kernel/vdso/gettimeofday-32.o + arch/powerpc/kernel/vdso/gettimeofday.S: Assembler messages: + arch/powerpc/kernel/vdso/gettimeofday.S:40: Error: syntax error; found `@', expected `,' + arch/powerpc/kernel/vdso/gettimeofday.S:71: Info: macro invoked from here + arch/powerpc/kernel/vdso/gettimeofday.S:40: Error: junk at end of line: `@notoc' + arch/powerpc/kernel/vdso/gettimeofday.S:71: Info: macro invoked from here + ... + make[2]: *** [arch/powerpc/kernel/vdso/Makefile:85: arch/powerpc/kernel/vdso/gettimeofday-32.o] Error 1 + make[1]: *** [arch/powerpc/Makefile:388: vdso_prepare] Error 2 + +Once the above is fixed, the following happens: + + VDSO32C arch/powerpc/kernel/vdso/vgettimeofday-32.o + cc1: error: '-mpcrel' requires '-mcmodel=medium' + make[2]: *** [arch/powerpc/kernel/vdso/Makefile:89: arch/powerpc/kernel/vdso/vgettimeofday-32.o] Error 1 + make[1]: *** [arch/powerpc/Makefile:388: vdso_prepare] Error 2 + make: *** [Makefile:251: __sub-make] Error 2 + +Make sure pcrel version of CFUNC() macro is used only for powerpc64 +builds and remove -mpcrel for powerpc32 builds. + +Fixes: 7e3a68be42e1 ("powerpc/64: vmlinux support building with PCREL addresing") +Signed-off-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/1fa3453f07d42a50a70114da9905bf7b73304fca.1747073669.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/ppc_asm.h | 2 +- + arch/powerpc/kernel/vdso/Makefile | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h +index 02897f4b0dbf8..b891910fce8a6 100644 +--- a/arch/powerpc/include/asm/ppc_asm.h ++++ b/arch/powerpc/include/asm/ppc_asm.h +@@ -183,7 +183,7 @@ + /* + * Used to name C functions called from asm + */ +-#ifdef CONFIG_PPC_KERNEL_PCREL ++#if defined(__powerpc64__) && defined(CONFIG_PPC_KERNEL_PCREL) + #define CFUNC(name) name@notoc + #else + #define CFUNC(name) name +diff --git a/arch/powerpc/kernel/vdso/Makefile b/arch/powerpc/kernel/vdso/Makefile +index e8824f9333261..8834dfe9d7279 100644 +--- a/arch/powerpc/kernel/vdso/Makefile ++++ b/arch/powerpc/kernel/vdso/Makefile +@@ -53,7 +53,7 @@ ldflags-$(CONFIG_LD_ORPHAN_WARN) += -Wl,--orphan-handling=$(CONFIG_LD_ORPHAN_WAR + ldflags-y += $(filter-out $(CC_AUTO_VAR_INIT_ZERO_ENABLER) $(CC_FLAGS_FTRACE) -Wa$(comma)%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS)) + + CC32FLAGS := -m32 +-CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc ++CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc -mpcrel + ifdef CONFIG_CC_IS_CLANG + # This flag is supported by clang for 64-bit but not 32-bit so it will cause + # an unused command line flag warning for this file. +-- +2.39.5 + diff --git a/queue-6.15/rdma-hns-initialize-db-in-update_srq_db.patch b/queue-6.15/rdma-hns-initialize-db-in-update_srq_db.patch new file mode 100644 index 0000000000..eec63064f1 --- /dev/null +++ b/queue-6.15/rdma-hns-initialize-db-in-update_srq_db.patch @@ -0,0 +1,73 @@ +From 1d84328f4610a83d5a3d7a36627a6a84f6bc9b60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 18:54:53 +0800 +Subject: RDMA/hns: initialize db in update_srq_db() + +From: Chen Linxuan + +[ Upstream commit ffe1cee21f8b533ae27c3a31bfa56b8c1b27fa6e ] + +On x86_64 with gcc version 13.3.0, I compile +drivers/infiniband/hw/hns/hns_roce_hw_v2.c with: + + make defconfig + ./scripts/kconfig/merge_config.sh .config <( + echo CONFIG_COMPILE_TEST=y + echo CONFIG_HNS3=m + echo CONFIG_INFINIBAND=m + echo CONFIG_INFINIBAND_HNS_HIP08=m + ) + make KCFLAGS="-fno-inline-small-functions -fno-inline-functions-called-once" \ + drivers/infiniband/hw/hns/hns_roce_hw_v2.o + +Then I get a compile error: + + CALL scripts/checksyscalls.sh + DESCEND objtool + INSTALL libsubcmd_headers + CC [M] drivers/infiniband/hw/hns/hns_roce_hw_v2.o + In file included from drivers/infiniband/hw/hns/hns_roce_hw_v2.c:47: + drivers/infiniband/hw/hns/hns_roce_hw_v2.c: In function 'update_srq_db': + drivers/infiniband/hw/hns/hns_roce_common.h:74:17: error: 'db' is used uninitialized [-Werror=uninitialized] + 74 | *((__le32 *)_ptr + (field_h) / 32) &= \ + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/infiniband/hw/hns/hns_roce_common.h:90:17: note: in expansion of macro '_hr_reg_clear' + 90 | _hr_reg_clear(ptr, field_type, field_h, field_l); \ + | ^~~~~~~~~~~~~ + drivers/infiniband/hw/hns/hns_roce_common.h:95:39: note: in expansion of macro '_hr_reg_write' + 95 | #define hr_reg_write(ptr, field, val) _hr_reg_write(ptr, field, val) + | ^~~~~~~~~~~~~ + drivers/infiniband/hw/hns/hns_roce_hw_v2.c:948:9: note: in expansion of macro 'hr_reg_write' + 948 | hr_reg_write(&db, DB_TAG, srq->srqn); + | ^~~~~~~~~~~~ + drivers/infiniband/hw/hns/hns_roce_hw_v2.c:946:31: note: 'db' declared here + 946 | struct hns_roce_v2_db db; + | ^~ + cc1: all warnings being treated as errors + +Signed-off-by: Chen Linxuan +Co-developed-by: Winston Wen +Signed-off-by: Winston Wen +Link: https://patch.msgid.link/FF922C77946229B6+20250411105459.90782-5-chenlinxuan@uniontech.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 59352d1b62099..bbf6e1983704c 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -942,7 +942,7 @@ static void fill_wqe_idx(struct hns_roce_srq *srq, unsigned int wqe_idx) + static void update_srq_db(struct hns_roce_srq *srq) + { + struct hns_roce_dev *hr_dev = to_hr_dev(srq->ibsrq.device); +- struct hns_roce_v2_db db; ++ struct hns_roce_v2_db db = {}; + + hr_reg_write(&db, DB_TAG, srq->srqn); + hr_reg_write(&db, DB_CMD, HNS_ROCE_V2_SRQ_DB); +-- +2.39.5 + diff --git a/queue-6.15/revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch b/queue-6.15/revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch new file mode 100644 index 0000000000..73aec5dde6 --- /dev/null +++ b/queue-6.15/revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch @@ -0,0 +1,112 @@ +From 4cbdfc45220ae4ba437e9f53addb2f4d160bebf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 11:06:34 +0200 +Subject: Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect + devices first" + +From: Alexander Sverdlin + +[ Upstream commit 36305857b1ead8f6ca033a913162ebc09bee0b43 ] + +This reverts commit 4700a00755fb5a4bb5109128297d6fd2d1272ee6. + +It breaks target-module@2b300050 ("ti,sysc-omap2") probe on AM62x in a case +when minimally-configured system tries to network-boot: + +[ 6.888776] probe of 2b300050.target-module returned 517 after 258 usecs +[ 17.129637] probe of 2b300050.target-module returned 517 after 708 usecs +[ 17.137397] platform 2b300050.target-module: deferred probe pending: (reason unknown) +[ 26.878471] Waiting up to 100 more seconds for network. + +There are minimal configurations possible when the deferred device is not +being probed any more (because everything else has been successfully +probed) and deferral lists are not processed any more. + +Stable mmc enumeration can be achieved by filling /aliases node properly +(4700a00755fb commit's rationale). + +After revert: + +[ 9.006816] IP-Config: Complete: +[ 9.010058] device=lan0, ... + +Tested-by: Andreas Kemnade # GTA04, Panda, BT200 +Reviewed-by: Tony Lindgren +Signed-off-by: Alexander Sverdlin +Link: https://lore.kernel.org/r/20250401090643.2776793-1-alexander.sverdlin@siemens.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 49 ------------------------------------------- + 1 file changed, 49 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index f67b927ae4caa..e5c02e950f2c1 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -677,51 +677,6 @@ static int sysc_parse_and_check_child_range(struct sysc *ddata) + return 0; + } + +-/* Interconnect instances to probe before l4_per instances */ +-static struct resource early_bus_ranges[] = { +- /* am3/4 l4_wkup */ +- { .start = 0x44c00000, .end = 0x44c00000 + 0x300000, }, +- /* omap4/5 and dra7 l4_cfg */ +- { .start = 0x4a000000, .end = 0x4a000000 + 0x300000, }, +- /* omap4 l4_wkup */ +- { .start = 0x4a300000, .end = 0x4a300000 + 0x30000, }, +- /* omap5 and dra7 l4_wkup without dra7 dcan segment */ +- { .start = 0x4ae00000, .end = 0x4ae00000 + 0x30000, }, +-}; +- +-static atomic_t sysc_defer = ATOMIC_INIT(10); +- +-/** +- * sysc_defer_non_critical - defer non_critical interconnect probing +- * @ddata: device driver data +- * +- * We want to probe l4_cfg and l4_wkup interconnect instances before any +- * l4_per instances as l4_per instances depend on resources on l4_cfg and +- * l4_wkup interconnects. +- */ +-static int sysc_defer_non_critical(struct sysc *ddata) +-{ +- struct resource *res; +- int i; +- +- if (!atomic_read(&sysc_defer)) +- return 0; +- +- for (i = 0; i < ARRAY_SIZE(early_bus_ranges); i++) { +- res = &early_bus_ranges[i]; +- if (ddata->module_pa >= res->start && +- ddata->module_pa <= res->end) { +- atomic_set(&sysc_defer, 0); +- +- return 0; +- } +- } +- +- atomic_dec_if_positive(&sysc_defer); +- +- return -EPROBE_DEFER; +-} +- + static struct device_node *stdout_path; + + static void sysc_init_stdout_path(struct sysc *ddata) +@@ -947,10 +902,6 @@ static int sysc_map_and_check_registers(struct sysc *ddata) + if (error) + return error; + +- error = sysc_defer_non_critical(ddata); +- if (error) +- return error; +- + sysc_check_children(ddata); + + if (!of_property_present(np, "reg")) +-- +2.39.5 + diff --git a/queue-6.15/revert-mac80211-dynamically-set-codel-parameters-per.patch b/queue-6.15/revert-mac80211-dynamically-set-codel-parameters-per.patch new file mode 100644 index 0000000000..9f0fdb220d --- /dev/null +++ b/queue-6.15/revert-mac80211-dynamically-set-codel-parameters-per.patch @@ -0,0 +1,258 @@ +From bf1600dbc5c08481b5371cb5db1d6dda8dc448e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Apr 2025 20:39:28 +0200 +Subject: Revert "mac80211: Dynamically set CoDel parameters per station" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 4876376988081d636a4c4e5f03a5556386b49087 ] + +This reverts commit 484a54c2e597dbc4ace79c1687022282905afba0. The CoDel +parameter change essentially disables CoDel on slow stations, with some +questionable assumptions, as Dave pointed out in [0]. Quoting from +there: + + But here are my pithy comments as to why this part of mac80211 is so + wrong... + + static void sta_update_codel_params(struct sta_info *sta, u32 thr) + { + - if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) { + + 1) sta->local->num_sta is the number of associated, rather than + active, stations. "Active" stations in the last 50ms or so, might have + been a better thing to use, but as most people have far more than that + associated, we end up with really lousy codel parameters, all the + time. Mistake numero uno! + + 2) The STA_SLOW_THRESHOLD was completely arbitrary in 2016. + + - sta->cparams.target = MS2TIME(50); + + This, by itself, was probably not too bad. 30ms might have been + better, at the time, when we were battling powersave etc, but 20ms was + enough, really, to cover most scenarios, even where we had low rate + 2Ghz multicast to cope with. Even then, codel has a hard time finding + any sane drop rate at all, with a target this high. + + - sta->cparams.interval = MS2TIME(300); + + But this was horrible, a total mistake, that is leading to codel being + completely ineffective in almost any scenario on clients or APS. + 100ms, even 80ms, here, would be vastly better than this insanity. I'm + seeing 5+seconds of delay accumulated in a bunch of otherwise happily + fq-ing APs.... + + 100ms of observed jitter during a flow is enough. Certainly (in 2016) + there were interactions with powersave that I did not understand, and + still don't, but if you are transmitting in the first place, powersave + shouldn't be a problemmmm..... + + - sta->cparams.ecn = false; + + At the time we were pretty nervous about ecn, I'm kind of sanguine + about it now, and reliably indicating ecn seems better than turning it + off for any reason. + + [...] + + In production, on p2p wireless, I've had 8ms and 80ms for target and + interval for years now, and it works great. + +I think Dave's arguments above are basically sound on the face of it, +and various experimentation with tighter CoDel parameters in the OpenWrt +community have show promising results[1]. So I don't think there's any +reason to keep this parameter fiddling; hence this revert. + +[0] https://lore.kernel.org/linux-wireless/CAA93jw6NJ2cmLmMauz0xAgC2MGbBq6n0ZiZzAdkK0u4b+O2yXg@mail.gmail.com/ +[1] https://forum.openwrt.org/t/reducing-multiplexing-latencies-still-further-in-wifi/133605/130 + +Suggested-By: Dave Taht +In-memory-of: Dave Taht +Signed-off-by: Toke Høiland-Jørgensen +Link: https://patch.msgid.link/20250403183930.197716-1-toke@toke.dk +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/net/mac80211.h | 16 ---------------- + net/mac80211/debugfs_sta.c | 6 ------ + net/mac80211/rate.c | 2 -- + net/mac80211/sta_info.c | 28 ---------------------------- + net/mac80211/sta_info.h | 11 ----------- + net/mac80211/tx.c | 9 +-------- + 6 files changed, 1 insertion(+), 71 deletions(-) + +diff --git a/include/net/mac80211.h b/include/net/mac80211.h +index c498f685d01f3..5349df5961571 100644 +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -5346,22 +5346,6 @@ void ieee80211_get_tx_rates(struct ieee80211_vif *vif, + struct ieee80211_tx_rate *dest, + int max_rates); + +-/** +- * ieee80211_sta_set_expected_throughput - set the expected tpt for a station +- * +- * Call this function to notify mac80211 about a change in expected throughput +- * to a station. A driver for a device that does rate control in firmware can +- * call this function when the expected throughput estimate towards a station +- * changes. The information is used to tune the CoDel AQM applied to traffic +- * going towards that station (which can otherwise be too aggressive and cause +- * slow stations to starve). +- * +- * @pubsta: the station to set throughput for. +- * @thr: the current expected throughput in kbps. +- */ +-void ieee80211_sta_set_expected_throughput(struct ieee80211_sta *pubsta, +- u32 thr); +- + /** + * ieee80211_tx_rate_update - transmit rate update callback + * +diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c +index a8948f4d983e5..49061bd4151bc 100644 +--- a/net/mac80211/debugfs_sta.c ++++ b/net/mac80211/debugfs_sta.c +@@ -150,12 +150,6 @@ static ssize_t sta_aqm_read(struct file *file, char __user *userbuf, + spin_lock_bh(&local->fq.lock); + rcu_read_lock(); + +- p += scnprintf(p, +- bufsz + buf - p, +- "target %uus interval %uus ecn %s\n", +- codel_time_to_us(sta->cparams.target), +- codel_time_to_us(sta->cparams.interval), +- sta->cparams.ecn ? "yes" : "no"); + p += scnprintf(p, + bufsz + buf - p, + "tid ac backlog-bytes backlog-packets new-flows drops marks overlimit collisions tx-bytes tx-packets flags\n"); +diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c +index 0d056db9f81e6..6a19327800541 100644 +--- a/net/mac80211/rate.c ++++ b/net/mac80211/rate.c +@@ -990,8 +990,6 @@ int rate_control_set_rates(struct ieee80211_hw *hw, + if (sta->uploaded) + drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta); + +- ieee80211_sta_set_expected_throughput(pubsta, sta_get_expected_throughput(sta)); +- + return 0; + } + EXPORT_SYMBOL(rate_control_set_rates); +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 248e1f63bf739..84b18be1f0b16 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -18,7 +18,6 @@ + #include + #include + +-#include + #include + #include "ieee80211_i.h" + #include "driver-ops.h" +@@ -701,12 +700,6 @@ __sta_info_alloc(struct ieee80211_sub_if_data *sdata, + } + } + +- sta->cparams.ce_threshold = CODEL_DISABLED_THRESHOLD; +- sta->cparams.target = MS2TIME(20); +- sta->cparams.interval = MS2TIME(100); +- sta->cparams.ecn = true; +- sta->cparams.ce_threshold_selector = 0; +- sta->cparams.ce_threshold_mask = 0; + + sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr); + +@@ -2905,27 +2898,6 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta) + return sta->deflink.status_stats.last_ack; + } + +-static void sta_update_codel_params(struct sta_info *sta, u32 thr) +-{ +- if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) { +- sta->cparams.target = MS2TIME(50); +- sta->cparams.interval = MS2TIME(300); +- sta->cparams.ecn = false; +- } else { +- sta->cparams.target = MS2TIME(20); +- sta->cparams.interval = MS2TIME(100); +- sta->cparams.ecn = true; +- } +-} +- +-void ieee80211_sta_set_expected_throughput(struct ieee80211_sta *pubsta, +- u32 thr) +-{ +- struct sta_info *sta = container_of(pubsta, struct sta_info, sta); +- +- sta_update_codel_params(sta, thr); +-} +- + int ieee80211_sta_allocate_link(struct sta_info *sta, unsigned int link_id) + { + struct ieee80211_sub_if_data *sdata = sta->sdata; +diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h +index 07b7ec39a52f9..7a95d8d34fca8 100644 +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -466,14 +466,6 @@ struct ieee80211_fragment_cache { + unsigned int next; + }; + +-/* +- * The bandwidth threshold below which the per-station CoDel parameters will be +- * scaled to be more lenient (to prevent starvation of slow stations). This +- * value will be scaled by the number of active stations when it is being +- * applied. +- */ +-#define STA_SLOW_THRESHOLD 6000 /* 6 Mbps */ +- + /** + * struct link_sta_info - Link STA information + * All link specific sta info are stored here for reference. This can be +@@ -626,7 +618,6 @@ struct link_sta_info { + * @sta: station information we share with the driver + * @sta_state: duplicates information about station state (for debug) + * @rcu_head: RCU head used for freeing this station struct +- * @cparams: CoDel parameters for this station. + * @reserved_tid: reserved TID (if any, otherwise IEEE80211_TID_UNRESERVED) + * @amsdu_mesh_control: track the mesh A-MSDU format used by the peer: + * +@@ -717,8 +708,6 @@ struct sta_info { + struct dentry *debugfs_dir; + #endif + +- struct codel_params cparams; +- + u8 reserved_tid; + s8 amsdu_mesh_control; + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index d6af02a524af3..695db38ccfb41 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -1402,16 +1402,9 @@ static struct sk_buff *fq_tin_dequeue_func(struct fq *fq, + + local = container_of(fq, struct ieee80211_local, fq); + txqi = container_of(tin, struct txq_info, tin); ++ cparams = &local->cparams; + cstats = &txqi->cstats; + +- if (txqi->txq.sta) { +- struct sta_info *sta = container_of(txqi->txq.sta, +- struct sta_info, sta); +- cparams = &sta->cparams; +- } else { +- cparams = &local->cparams; +- } +- + if (flow == &tin->default_flow) + cvars = &txqi->def_cvars; + else +-- +2.39.5 + diff --git a/queue-6.15/rtla-define-__nr_sched_setattr-for-loongarch.patch b/queue-6.15/rtla-define-__nr_sched_setattr-for-loongarch.patch new file mode 100644 index 0000000000..06695bb16a --- /dev/null +++ b/queue-6.15/rtla-define-__nr_sched_setattr-for-loongarch.patch @@ -0,0 +1,41 @@ +From 142634a11722ad8d5281457eeaa071c5d14b2428 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Apr 2025 15:49:17 +0800 +Subject: rtla: Define __NR_sched_setattr for LoongArch + +From: Tiezhu Yang + +[ Upstream commit 6a38c51a2557d4d50748818a858d507c250f3bee ] + +When executing "make -C tools/tracing/rtla" on LoongArch, there exists +the following error: + + src/utils.c:237:24: error: '__NR_sched_setattr' undeclared + +Just define __NR_sched_setattr for LoongArch if not exist. + +Link: https://lore.kernel.org/20250422074917.25771-1-yangtiezhu@loongson.cn +Reported-by: Haiyong Sun +Signed-off-by: Tiezhu Yang +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + tools/tracing/rtla/src/utils.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/tracing/rtla/src/utils.c b/tools/tracing/rtla/src/utils.c +index 4995d35cf3ec6..d6ab15dcb4907 100644 +--- a/tools/tracing/rtla/src/utils.c ++++ b/tools/tracing/rtla/src/utils.c +@@ -227,6 +227,8 @@ long parse_ns_duration(char *val) + # define __NR_sched_setattr 355 + # elif __s390x__ + # define __NR_sched_setattr 345 ++# elif __loongarch__ ++# define __NR_sched_setattr 274 + # endif + #endif + +-- +2.39.5 + diff --git a/queue-6.15/scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch b/queue-6.15/scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch new file mode 100644 index 0000000000..865d302609 --- /dev/null +++ b/queue-6.15/scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch @@ -0,0 +1,40 @@ +From ef2d175b3d18ef2783594df9d0659b0a70c3955e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Apr 2025 12:47:59 -0700 +Subject: scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 + commands + +From: Justin Tee + +[ Upstream commit 05ae6c9c7315d844fbc15afe393f5ba5e5771126 ] + +In lpfc_check_sli_ndlp(), the get_job_els_rsp64_did remote_id assignment +does not apply for GEN_REQUEST64 commands as it only has meaning for a +ELS_REQUEST64 command. So, if (iocb->ndlp == ndlp) is false, we could +erroneously return the wrong value. Fix by replacing the fallthrough +statement with a break statement before the remote_id check. + +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20250425194806.3585-2-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index c2ec4db672869..c256c3edd6639 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -5055,7 +5055,7 @@ lpfc_check_sli_ndlp(struct lpfc_hba *phba, + case CMD_GEN_REQUEST64_CR: + if (iocb->ndlp == ndlp) + return 1; +- fallthrough; ++ break; + case CMD_ELS_REQUEST64_CR: + if (remote_id == ndlp->nlp_DID) + return 1; +-- +2.39.5 + diff --git a/queue-6.15/scsi-lpfc-use-memcpy-for-bios-version.patch b/queue-6.15/scsi-lpfc-use-memcpy-for-bios-version.patch new file mode 100644 index 0000000000..c99b8f8a4d --- /dev/null +++ b/queue-6.15/scsi-lpfc-use-memcpy-for-bios-version.patch @@ -0,0 +1,47 @@ +From 801d13786f5cb61dd5da5d3e8b88e128238110db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 13:34:22 +0200 +Subject: scsi: lpfc: Use memcpy() for BIOS version + +From: Daniel Wagner + +[ Upstream commit ae82eaf4aeea060bb736c3e20c0568b67c701d7d ] + +The strlcat() with FORTIFY support is triggering a panic because it +thinks the target buffer will overflow although the correct target +buffer size is passed in. + +Anyway, instead of memset() with 0 followed by a strlcat(), just use +memcpy() and ensure that the resulting buffer is NULL terminated. + +BIOSVersion is only used for the lpfc_printf_log() which expects a +properly terminated string. + +Signed-off-by: Daniel Wagner +Link: https://lore.kernel.org/r/20250409-fix-lpfc-bios-str-v1-1-05dac9e51e13@kernel.org +Reviewed-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 6574f9e744766..a335d34070d3c 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -6003,9 +6003,9 @@ lpfc_sli4_get_ctl_attr(struct lpfc_hba *phba) + phba->sli4_hba.flash_id = bf_get(lpfc_cntl_attr_flash_id, cntl_attr); + phba->sli4_hba.asic_rev = bf_get(lpfc_cntl_attr_asic_rev, cntl_attr); + +- memset(phba->BIOSVersion, 0, sizeof(phba->BIOSVersion)); +- strlcat(phba->BIOSVersion, (char *)cntl_attr->bios_ver_str, ++ memcpy(phba->BIOSVersion, cntl_attr->bios_ver_str, + sizeof(phba->BIOSVersion)); ++ phba->BIOSVersion[sizeof(phba->BIOSVersion) - 1] = '\0'; + + lpfc_printf_log(phba, KERN_INFO, LOG_SLI, + "3086 lnk_type:%d, lnk_numb:%d, bios_ver:%s, " +-- +2.39.5 + diff --git a/queue-6.15/scsi-smartpqi-add-new-pci-ids.patch b/queue-6.15/scsi-smartpqi-add-new-pci-ids.patch new file mode 100644 index 0000000000..26b8af9bcd --- /dev/null +++ b/queue-6.15/scsi-smartpqi-add-new-pci-ids.patch @@ -0,0 +1,223 @@ +From 348e4c45d2698493f9673407980f44313ab76fe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 13:32:26 -0500 +Subject: scsi: smartpqi: Add new PCI IDs + +From: David Strahan + +[ Upstream commit 01b8bdddcfab035cf70fd9981cb20593564cd15d ] + +Add in support for more PCI devices. + +All PCI ID entries in Hex. + +Add PCI IDs for Ramaxel controllers: + VID / DID / SVID / SDID + ---- ---- ---- ---- + Ramaxel SmartHBA RX8238-16i 9005 028f 1018 8238 + Ramaxel SSSRAID card 9005 028f 1f3f 0610 + +Add PCI ID for Alibaba controller: + VID / DID / SVID / SDID + ---- ---- ---- ---- + HBA AS1340 9005 028f 1ded 3301 + +Add PCI IDs for Inspur controller: + VID / DID / SVID / SDID + ---- ---- ---- ---- + RT0800M6E2i 9005 028f 1bd4 00a3 + +Add PCI IDs for Delta controllers: + VID / DID / SVID / SDID + ---- ---- ---- ---- +ThinkSystem 4450-8i SAS/SATA/NVMe PCIe Gen4 9005 028f 1d49 0222 +24Gb HBA +ThinkSystem 4450-16i SAS/SATA/NVMe PCIe Gen4 9005 028f 1d49 0223 +24Gb HBA +ThinkSystem 4450-8e SAS/SATA PCIe Gen4 9005 028f 1d49 0224 +24Gb HBA +ThinkSystem RAID 4450-16e PCIe Gen4 24Gb 9005 028f 1d49 0225 +Adapter HBA +ThinkSystem RAID 5450-16i PCIe Gen4 24Gb Adapter 9005 028f 1d49 0521 +ThinkSystem RAID 9450-8i 4GB Flash PCIe Gen4 9005 028f 1d49 0624 +24Gb Adapter +ThinkSystem RAID 9450-16i 4GB Flash PCIe Gen4 9005 028f 1d49 0625 +24Gb Adapter +ThinkSystem RAID 9450-16i 4GB Flash PCIe Gen4 9005 028f 1d49 0626 +24Gb Adapter +ThinkSystem RAID 9450-32i 8GB Flash PCIe Gen4 9005 028f 1d49 0627 +24Gb Adapter +ThinkSystem RAID 9450-16e 4GB Flash PCIe Gen4 9005 028f 1d49 0628 +24Gb Adapter + +Add PCI ID for Cloudnine Controller: + VID / DID / SVID / SDID + ---- ---- ---- ---- + SmartHBA P6600-24i 9005 028f 1f51 100b + +Add PCI IDs for Hurraydata Controllers: + VID / DID / SVID / SDID + ---- ---- ---- ---- + HRDT TrustHBA H4100-8i 9005 028f 207d 4044 + HRDT TrustHBA H4100-8e 9005 028f 207d 4054 + HRDT TrustHBA H4100-16i 9005 028f 207d 4084 + HRDT TrustHBA H4100-16e 9005 028f 207d 4094 + HRDT TrustRAID D3152s-8i 9005 028f 207d 4140 + HRDT TrustRAID D3154s-8i 9005 028f 207d 4240 + +Reviewed-by: Scott Benesh +Reviewed-by: Scott Teel +Reviewed-by: Mike McGowen +Signed-off-by: David Strahan +Signed-off-by: Don Brace +Link: https://lore.kernel.org/r/20250423183229.538572-3-don.brace@microchip.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 84 +++++++++++++++++++++++++++ + 1 file changed, 84 insertions(+) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 6c9dec7e3128f..66c9d1a2c94de 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -9709,6 +9709,10 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1bd4, 0x0089) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1bd4, 0x00a3) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1ff9, 0x00a1) +@@ -10045,6 +10049,30 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_ADAPTEC2, 0x14f0) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x207d, 0x4044) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x207d, 0x4054) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x207d, 0x4084) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x207d, 0x4094) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x207d, 0x4140) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x207d, 0x4240) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_ADVANTECH, 0x8312) +@@ -10261,6 +10289,14 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1cc4, 0x0201) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1018, 0x8238) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1f3f, 0x0610) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_LENOVO, 0x0220) +@@ -10269,10 +10305,30 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_LENOVO, 0x0221) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0222) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0223) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0224) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0225) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_LENOVO, 0x0520) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0521) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_LENOVO, 0x0522) +@@ -10293,6 +10349,26 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_LENOVO, 0x0623) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0624) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0625) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0626) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0627) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ PCI_VENDOR_ID_LENOVO, 0x0628) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1014, 0x0718) +@@ -10321,6 +10397,10 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1137, 0x0300) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1ded, 0x3301) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1ff9, 0x0045) +@@ -10469,6 +10549,10 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1f51, 0x100a) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1f51, 0x100b) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1f51, 0x100e) +-- +2.39.5 + diff --git a/queue-6.15/sctp-do-not-wake-readers-in-__sctp_write_space.patch b/queue-6.15/sctp-do-not-wake-readers-in-__sctp_write_space.patch new file mode 100644 index 0000000000..82918afd03 --- /dev/null +++ b/queue-6.15/sctp-do-not-wake-readers-in-__sctp_write_space.patch @@ -0,0 +1,42 @@ +From 2f0c92460456ec4d7f9353eacd8c64506888147a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 May 2025 10:17:28 +0200 +Subject: sctp: Do not wake readers in __sctp_write_space() + +From: Petr Malat + +[ Upstream commit af295892a7abbf05a3c2ba7abc4d81bb448623d6 ] + +Function __sctp_write_space() doesn't set poll key, which leads to +ep_poll_callback() waking up all waiters, not only these waiting +for the socket being writable. Set the key properly using +wake_up_interruptible_poll(), which is preferred over the sync +variant, as writers are not woken up before at least half of the +queue is available. Also, TCP does the same. + +Signed-off-by: Petr Malat +Acked-by: Xin Long +Link: https://patch.msgid.link/20250516081727.1361451-1-oss@malat.biz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/socket.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 53725ee7ba06d..b301d64d9d80f 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -9100,7 +9100,8 @@ static void __sctp_write_space(struct sctp_association *asoc) + wq = rcu_dereference(sk->sk_wq); + if (wq) { + if (waitqueue_active(&wq->wait)) +- wake_up_interruptible(&wq->wait); ++ wake_up_interruptible_poll(&wq->wait, EPOLLOUT | ++ EPOLLWRNORM | EPOLLWRBAND); + + /* Note that we try to include the Async I/O support + * here by modeling from the current TCP/UDP code. +-- +2.39.5 + diff --git a/queue-6.15/series b/queue-6.15/series index ef63ee30f4..819cae6fcf 100644 --- a/queue-6.15/series +++ b/queue-6.15/series @@ -203,3 +203,245 @@ iio-adc-ti-ads1298-kconfig-add-kfifo-dependency-to-fix-module-build.patch iio-adc-ad7606_spi-fix-reg-write-value-mask.patch iio-adc-ad7173-fix-compiling-without-gpiolib.patch iio-adc-ad7606-fix-raw-read-for-18-bit-chips.patch +acpica-fix-acpi-operand-cache-leak-in-dswstate.c.patch +asoc-amd-yc-add-quirk-for-lenovo-yoga-pro-7-14asp9.patch +clocksource-fix-the-cpus-choice-in-the-watchdog-per-.patch +power-supply-gpio-charger-fix-wakeup-source-leaks-on.patch +tools-nolibc-use-intmax-definitions-from-compiler.patch +power-supply-collie-fix-wakeup-source-leaks-on-devic.patch +mmc-add-quirk-to-disable-ddr50-tuning.patch +acpica-avoid-sequence-overread-in-call-to-strncmp.patch +mmc-sdhci-esdhc-imx-save-tuning-value-when-card-stay.patch +edac-igen6-skip-absent-memory-controllers.patch +asoc-tas2770-power-cycle-amp-on-isense-vsense-change.patch +asoc-intel-sdw_utils-assign-initial-value-in-asoc_sd.patch +acpi-bus-bail-out-if-acpi_kobj-registration-fails.patch +alsa-hda-realtek-add-support-for-acer-helios-laptops.patch +acpi-add-missing-prototype-for-non-config_suspend-co.patch +acpica-fix-acpi-parse-and-parseext-cache-leaks.patch +acpica-apply-pack-1-to-union-aml_resource.patch +alsa-hda-cs35l41-fix-swapped-l-r-audio-channels-for-.patch +power-supply-bq27xxx-retrieve-again-when-busy.patch +asoc-simple-card-utils-fixup-dlc-xxx-handling-for-er.patch +pmdomain-core-reset-genpd-states-to-avoid-freeing-in.patch +acpica-utilities-fix-overflow-check-in-vsnprintf.patch +platform-msi-add-msi_remove_device_irq_domain-in-pla.patch +asoc-tegra210_ahub-add-check-to-of_device_get_match_.patch +make-cc-option-work-correctly-for-the-wno-xyzzy-patt.patch +gpiolib-of-add-polarity-quirk-for-s5m8767.patch +pm-runtime-fix-denying-of-auto-suspend-in-pm_suspend.patch +tools-nolibc-use-pselect6_time64-if-available.patch +power-supply-max17040-adjust-thermal-channel-scaling.patch +acpi-battery-negate-current-when-discharging.patch +drm-amd-display-disable-dpp-rcg-before-dpp-clk-enabl.patch +drm-bridge-select-drm_kms_helper-for-aux_bridge.patch +drm-amdgpu-gfx6-fix-csib-handling.patch +media-imx-jpeg-check-decoding-is-ongoing-for-motion-.patch +drm-rockchip-inno-hdmi-fix-video-timing-hsync-vsync-.patch +drm-dp-add-option-to-disable-zero-sized-address-only.patch +sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch +drm-amdgpu-fix-api-status-offset-for-mes-queue-reset.patch +drm-amd-display-dcn32-null-data-check.patch +drm-xe-fix-cfi-violation-when-accessing-sysfs-files.patch +drm-bridge-analogix_dp-add-irq-flag-irqf_no_autoen-i.patch +workqueue-fix-race-condition-in-wq-stats-incrementat.patch +drm-panel-sharp-ls043t1le01-use-_multi-variants.patch +exfat-fix-double-free-in-delayed_free.patch +drm-bridge-anx7625-enable-hpd-interrupts.patch +arm64-cpuinfo-only-show-one-cpu-s-info-in-c_show.patch +drm-panthor-don-t-update-mmu_int_mask-in-panthor_mmu.patch +drm-bridge-anx7625-change-the-gpiod_set_value-api.patch +exfat-do-not-clear-volume-dirty-flag-during-sync.patch +drm-amdkfd-drop-workaround-for-gc-v9.4.3-revid-0.patch +drm-amdgpu-gfx11-fix-csib-handling.patch +media-nuvoton-npcm-video-fix-stuck-due-to-no-video-s.patch +drm-nouveau-fix-hibernate-on-disabled-gpu.patch +media-i2c-imx334-enable-runtime-pm-before-sub-device.patch +drm-amd-display-avoid-divide-by-zero-by-initializing.patch +drm-nouveau-gsp-fix-rm-shutdown-wait-condition.patch +drm-msm-hdmi-add-runtime-pm-calls-to-ddc-transfer-fu.patch +media-uapi-v4l-fix-v4l2_type_is_output-condition.patch +drm-amd-display-add-null-pointer-checks-in-dm_force_.patch +media-verisilicon-enable-wide-4k-in-av1-decoder.patch +drm-amd-display-skip-to-enable-dsc-if-it-has-been-of.patch +drm-amdgpu-add-basic-validation-for-ras-header.patch +dlm-use-shut_rdwr-for-sctp-shutdown.patch +drm-msm-a6xx-increase-hfi-response-timeout.patch +drm-amd-display-do-not-consider-dsc-if-valid-config-.patch +media-i2c-imx334-fix-runtime-pm-handling-in-remove-f.patch +drm-amdgpu-gfx10-fix-csib-handling.patch +drm-panel-orientation-quirks-add-zotac-gaming-zone.patch +media-ccs-pll-better-validate-vt-pll-branch.patch +media-uapi-v4l-change-v4l2_type_is_capture-condition.patch +drm-amd-display-fix-zero-value-for-apu-watermark_c.patch +drm-ttm-tests-fix-incorrect-assert-in-ttm_bo_unreser.patch +drm-amdgpu-gfx7-fix-csib-handling.patch +drm-xe-use-copy_from_user-instead-of-__copy_from_use.patch +ext4-ext4-unify-ext4_ex_nocache-nofail-flags-in-ext4.patch +jfs-fix-array-index-out-of-bounds-read-in-add_missin.patch +media-ti-cal-fix-wrong-goto-on-error-path.patch +drm-xe-vf-fix-guc_info-debugfs-for-vfs.patch +drm-amd-display-update-ips-sequential_ono-requiremen.patch +drm-amd-display-correct-ssc-enable-detection-for-dcn.patch +drm-amd-display-fix-vertical-interrupt-definitions-f.patch +media-cec-extron-da-hd-4k-plus-fix-wformat-truncatio.patch +media-rkvdec-initialize-the-m2m-context-before-the-c.patch +drm-amdgpu-fix-mes-gfx-mask.patch +drm-amdgpu-disallow-partition-query-during-reset.patch +sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch +ext4-prevent-stale-extent-cache-entries-caused-by-co.patch +drm-amdgpu-gfx8-fix-csib-handling.patch +drm-amd-display-disable-easf-narrow-filter-sharpenin.patch +drm-amdgpu-gfx9-fix-csib-handling.patch +drm-amd-display-fix-vupdate-offset-calculations-for-.patch +jfs-fix-null-ptr-deref-in-jfs_ioc_trim.patch +drm-amd-pm-reset-smu-v13.0.x-custom-settings.patch +drm-amd-display-correct-prefetch-calculation.patch +drm-amd-display-restructure-dmi-quirks.patch +media-renesas-vsp1-fix-media-bus-code-setup-on-rwpf-.patch +drm-msm-dpu-don-t-select-single-flush-for-active-ctl.patch +drm-amdkfd-set-sdma_rlcx_ib_cntl-switch_inside_ib.patch +media-tc358743-ignore-video-while-hpd-is-low.patch +media-platform-exynos4-is-add-hardware-sync-wait-to-.patch +media-i2c-imx334-update-mode_3840x2160_regs-array.patch +nios2-force-update_mmu_cache-on-spurious-tlb-permiss.patch +media-rcar-vin-fix-stride-setting-for-raw8-formats.patch +drm-rockchip-vop2-make-overlay-layer-select-register.patch +drm-amdgpu-add-indirect-l1_tlb_cntl-reg-programming-.patch +drm-xe-uc-remove-static-from-loop-variable.patch +media-qcom-venus-fix-uninitialized-variable-warning.patch +drm-panel-simple-add-powertip-ph128800t004-zza01-pan.patch +net-macb-check-return-value-of-dma_set_mask_and_cohe.patch +net-lan743x-modify-the-eeprom-and-otp-size-for-pci1x.patch +tipc-use-kfree_sensitive-for-aead-cleanup.patch +f2fs-use-vmalloc-instead-of-kvmalloc-in-.init_-de-co.patch +bpf-check-rcu_read_lock_trace_held-in-bpf_map_lookup.patch +bluetooth-btusb-add-new-vid-pid-13d3-3584-for-mt7922.patch +i2c-designware-invoke-runtime-suspend-on-quick-slave.patch +wifi-mt76-mt7996-drop-fragments-with-multicast-or-br.patch +emulex-benet-correct-command-version-selection-in-be.patch +bluetooth-btusb-add-new-vid-pid-13d3-3630-for-mt7925.patch +bluetooth-btusb-add-rtl8851be-device-0x0bda-0xb850.patch +bluetooth-btmrvl_sdio-fix-wakeup-source-leaks-on-dev.patch +bluetooth-btmtksdio-fix-wakeup-source-leaks-on-devic.patch +wifi-mt76-mt7996-fix-uninitialized-symbol-warning.patch +wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch +wifi-mt76-mt7921-add-160-mhz-ap-for-mt7922-device.patch +wifi-mt76-mt7925-introduce-thermal-protection.patch +wifi-mac80211-validate-scan_flag_ap-in-scan-request-.patch +sctp-do-not-wake-readers-in-__sctp_write_space.patch +libbpf-btf-fix-string-handling-to-support-multi-spli.patch +cpufreq-scmi-skip-scmi-devices-that-aren-t-used-by-t.patch +i2c-tegra-check-msg-length-in-smbus-block-read.patch +i2c-pasemi-enable-the-unjam-machine.patch +i2c-npcm-add-clock-toggle-recovery.patch +clk-qcom-gcc-x1e80100-set-force-mem-core-for-ufs-clo.patch +clk-qcom-gcc-set-force_mem_core_on-for-gcc_ufs_axi_c.patch +net-dlink-add-synchronization-for-stats-update.patch +net-phy-mediatek-do-not-require-syscon-compatible-fo.patch +wifi-ath12k-fix-macro-definition-hal_rx_msdu_pkt_len.patch +wifi-ath12k-fix-a-possible-dead-lock-caused-by-ab-ba.patch +wifi-ath11k-fix-qmi-memory-reuse-logic.patch +iommu-amd-allow-matching-acpi-hid-devices-without-ma.patch +wifi-rtw89-leave-idle-mode-when-setting-wep-encrypti.patch +tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch +tcp-remove-zero-tcp-ts-samples-for-autotuning.patch +tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch +tcp-add-receive-queue-awareness-in-tcp_rcv_space_adj.patch +x86-sgx-prevent-attempts-to-reclaim-poisoned-pages.patch +ipv4-route-use-this_cpu_inc-for-stats-on-preempt_rt.patch +net-page_pool-don-t-recycle-into-cache-on-preempt_rt.patch +xfrm-validate-assignment-of-maximal-possible-seq-num.patch +net-phy-marvell-88q2xxx-enable-temperature-measureme.patch +openvswitch-stricter-validation-for-the-userspace-ac.patch +net-atlantic-generate-software-timestamp-just-before.patch +pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch +pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-15232 +bpf-pass-the-same-orig_call-value-to-trampoline-func.patch +net-stmmac-generate-software-timestamp-just-before-t.patch +pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-26805 +libbpf-check-bpf_map_skeleton-link-for-null.patch +pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch-3121 +net-mlx5-hws-fix-counting-of-rules-in-the-matcher.patch +net-mlx4-add-sof_timestamping_tx_software-flag-when-.patch +net-vertexcom-mse102x-return-code-for-mse102x_rx_pkt.patch +wifi-rtw88-rtw8822bu-vid-pid-for-buffalo-wi-u2-866dm.patch +wifi-iwlwifi-mld-call-thermal-exit-without-wiphy-loc.patch +wireless-purelifi-plfxlc-fix-memory-leak-in-plfxlc_u.patch +wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch +bpftool-fix-cgroup-command-to-only-show-cgroup-bpf-p.patch +clk-rockchip-rk3036-mark-ddrphy-as-critical.patch +hid-asus-check-rog-ally-mcu-version-and-warn.patch +ipmi-ssif-fix-a-shutdown-race.patch +rtla-define-__nr_sched_setattr-for-loongarch.patch +wifi-iwlwifi-mvm-fix-beacon-cck-flag.patch +wifi-iwlwifi-dvm-pair-transport-op-mode-enter-leave.patch +wifi-iwlwifi-mld-check-for-null-before-referencing-a.patch +f2fs-fix-to-bail-out-in-get_new_segment.patch +tracing-only-return-an-adjusted-address-if-it-matche.patch +netfilter-nft_set_pipapo-clamp-maximum-map-bucket-si.patch +libbpf-add-identical-pointer-detection-to-btf_dedup_.patch +scsi-lpfc-fix-lpfc_check_sli_ndlp-handling-for-gen_r.patch +scsi-smartpqi-add-new-pci-ids.patch +iommu-amd-ensure-ga-log-notifier-callbacks-finish-ru.patch +wifi-iwlwifi-pcie-make-sure-to-lock-rxq-read.patch +wifi-rtw89-8922a-fix-tx-fail-with-wrong-vco-setting.patch +wifi-mac80211_hwsim-prevent-tsf-from-setting-if-beac.patch +netdevsim-mark-napi-id-on-skb-in-nsim_rcv.patch +net-mlx5-hws-fix-ip-version-decision.patch +bpf-use-proper-type-to-calculate-bpf_raw_tp_null_arg.patch +wifi-mac80211-vlan-traffic-in-multicast-path.patch +revert-mac80211-dynamically-set-codel-parameters-per.patch +wifi-iwlwifi-add-missing-module_firmware-for-qu-c0-j.patch +net-bridge-mcast-update-multicast-contex-when-vlan-s.patch +net-bridge-mcast-re-implement-br_multicast_-enable-d.patch +vxlan-do-not-treat-dst-cache-initialization-errors-a.patch +bnxt_en-remove-unused-field-ref_count-in-struct-bnxt.patch +vxlan-add-rcu-read-side-critical-sections-in-the-tx-.patch +wifi-ath12k-correctly-handle-mcast-packets-for-clien.patch +wifi-ath12k-using-msdu-end-descriptor-to-check-for-r.patch +net-ethernet-ti-am65-cpsw-handle-eprobe_defer.patch +software-node-correct-a-oob-check-in-software_node_g.patch +wifi-ath12k-make-assoc-link-associate-first.patch +isofs-fix-y2038-and-y2156-issues-in-rock-ridge-tf-en.patch +pinctrl-mcp23s08-reset-all-pins-to-input-at-probe.patch +wifi-ath12k-fix-failed-to-set-mhi-state-error-during.patch +scsi-lpfc-use-memcpy-for-bios-version.patch +sock-correct-error-checking-condition-for-assign-rel.patch +i40e-fix-mmio-write-access-to-an-invalid-page-in-i40.patch +ixgbe-fix-unreachable-retry-logic-in-combined-and-by.patch +rdma-hns-initialize-db-in-update_srq_db.patch +ice-fix-check-for-existing-switch-rule.patch +usbnet-asix-ax88772-leave-the-carrier-control-to-phy.patch +f2fs-fix-to-set-atomic-write-status-more-clear.patch +bpf-sockmap-fix-data-lost-during-eagain-retries.patch +net-ethernet-cortina-use-toe-tso-on-all-tcp.patch +octeontx2-pf-add-error-log-forcn10k_map_unmap_rq_pol.patch +wifi-rtw88-set-ampdu-factor-to-hardware-for-rtl8814a.patch +wifi-ath12k-fix-incorrect-rates-sent-to-firmware.patch +wifi-ath12k-fix-the-enabling-of-reo-queue-lookup-tab.patch +wifi-ath12k-fix-memory-leak-due-to-multiple-rx_stats.patch +wifi-ath11k-determine-pm-policy-based-on-machine-mod.patch +wifi-ath12k-fix-link-valid-field-initialization-in-t.patch +wifi-ath12k-fix-incorrect-ce-addresses.patch +wifi-ath12k-pass-correct-values-of-center-freq1-and-.patch +net-mlx5-hws-harden-ip-version-definer-checks.patch +fbcon-make-sure-modelist-not-set-on-unregistered-con.patch +wifi-iwlwifi-mld-work-around-clang-loop-unrolling-bu.patch +watchdog-da9052_wdt-respect-twdmin.patch +watchdog-stm32-fix-wakeup-source-leaks-on-device-unb.patch +i3c-mipi-i3c-hci-fix-handling-status-of-i3c_hci_irq_.patch +bus-fsl-mc-increase-mc_cmd_completion_timeout_ms-val.patch +arm-omap2-fix-l4ls-clk-domain-handling-in-standby.patch +tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch +revert-bus-ti-sysc-probe-for-l4_wkup-and-l4_cfg-inte.patch +fs-xattr.c-fix-simple_xattr_list.patch +platform-x86-amd-pmc-clear-metrics-table-at-start-of.patch +platform-x86-amd-pmf-use-device-managed-allocations.patch +platform-x86-amd-pmf-prevent-amd_pmf_tee_deinit-from.patch +platform-x86-dell_rbu-fix-list-usage.patch +platform-x86-dell_rbu-stop-overwriting-data-buffer.patch +ovl-fix-debug-print-in-case-of-mkdir-error.patch +powerpc-vdso-fix-build-of-vdso32-with-pcrel.patch +powerpc-eeh-fix-missing-pe-bridge-reconfiguration-du.patch +fs-drop-assert-in-file_seek_cur_needs_f_lock.patch diff --git a/queue-6.15/sock-correct-error-checking-condition-for-assign-rel.patch b/queue-6.15/sock-correct-error-checking-condition-for-assign-rel.patch new file mode 100644 index 0000000000..6813846b8d --- /dev/null +++ b/queue-6.15/sock-correct-error-checking-condition-for-assign-rel.patch @@ -0,0 +1,49 @@ +From 2b4e0408bc7cab9f097226e93767418be2392220 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 09:01:27 +0800 +Subject: sock: Correct error checking condition for + (assign|release)_proto_idx() + +From: Zijun Hu + +[ Upstream commit faeefc173be40512341b102cf1568aa0b6571acd ] + +(assign|release)_proto_idx() wrongly check find_first_zero_bit() failure +by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously. + +Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)' + +Signed-off-by: Zijun Hu +Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20250410-fix_net-v2-1-d69e7c5739a4@quicinc.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 5034d0fbd4a42..3e8c548cb1f87 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -4004,7 +4004,7 @@ static int assign_proto_idx(struct proto *prot) + { + prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR); + +- if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) { ++ if (unlikely(prot->inuse_idx == PROTO_INUSE_NR)) { + pr_err("PROTO_INUSE_NR exhausted\n"); + return -ENOSPC; + } +@@ -4015,7 +4015,7 @@ static int assign_proto_idx(struct proto *prot) + + static void release_proto_idx(struct proto *prot) + { +- if (prot->inuse_idx != PROTO_INUSE_NR - 1) ++ if (prot->inuse_idx != PROTO_INUSE_NR) + clear_bit(prot->inuse_idx, proto_inuse_idx); + } + #else +-- +2.39.5 + diff --git a/queue-6.15/software-node-correct-a-oob-check-in-software_node_g.patch b/queue-6.15/software-node-correct-a-oob-check-in-software_node_g.patch new file mode 100644 index 0000000000..678fc529f7 --- /dev/null +++ b/queue-6.15/software-node-correct-a-oob-check-in-software_node_g.patch @@ -0,0 +1,42 @@ +From 754acbe956e421a17530efb1e98adbc2a28a1c12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Apr 2025 19:36:52 +0800 +Subject: software node: Correct a OOB check in + software_node_get_reference_args() + +From: Zijun Hu + +[ Upstream commit 31e4e12e0e9609850cefd4b2e1adf782f56337d6 ] + +software_node_get_reference_args() wants to get @index-th element, so +the property value requires at least '(index + 1) * sizeof(*ref)' bytes +but that can not be guaranteed by current OOB check, and may cause OOB +for malformed property. + +Fix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'. + +Reviewed-by: Sakari Ailus +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20250414-fix_swnode-v2-1-9c9e6ae11eab@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/swnode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c +index 5c78fa6ae7725..deda7f35a0598 100644 +--- a/drivers/base/swnode.c ++++ b/drivers/base/swnode.c +@@ -529,7 +529,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode, + if (prop->is_inline) + return -EINVAL; + +- if (index * sizeof(*ref) >= prop->length) ++ if ((index + 1) * sizeof(*ref) > prop->length) + return -ENOENT; + + ref_array = prop->pointer; +-- +2.39.5 + diff --git a/queue-6.15/sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch b/queue-6.15/sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch new file mode 100644 index 0000000000..785440526c --- /dev/null +++ b/queue-6.15/sunrpc-fix-race-in-cache-cleanup-causing-stale-nextc.patch @@ -0,0 +1,81 @@ +From 6f01539104324b3cde7fcbf077ededf5cdc9be22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Mar 2025 14:48:36 +0800 +Subject: sunrpc: fix race in cache cleanup causing stale nextcheck time + +From: Long Li + +[ Upstream commit 2298abcbe11e9b553d03c0f1d084da786f7eff88 ] + +When cache cleanup runs concurrently with cache entry removal, a race +condition can occur that leads to incorrect nextcheck times. This can +delay cache cleanup for the cache_detail by up to 1800 seconds: + +1. cache_clean() sets nextcheck to current time plus 1800 seconds +2. While scanning a non-empty bucket, concurrent cache entry removal can + empty that bucket +3. cache_clean() finds no cache entries in the now-empty bucket to update + the nextcheck time +4. This maybe delays the next scan of the cache_detail by up to 1800 + seconds even when it should be scanned earlier based on remaining + entries + +Fix this by moving the hash_lock acquisition earlier in cache_clean(). +This ensures bucket emptiness checks and nextcheck updates happen +atomically, preventing the race between cleanup and entry removal. + +Signed-off-by: Long Li +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/cache.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index bbaa77d7bbc81..131090f31e6a8 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -464,24 +464,21 @@ static int cache_clean(void) + } + } + ++ spin_lock(¤t_detail->hash_lock); ++ + /* find a non-empty bucket in the table */ +- while (current_detail && +- current_index < current_detail->hash_size && ++ while (current_index < current_detail->hash_size && + hlist_empty(¤t_detail->hash_table[current_index])) + current_index++; + + /* find a cleanable entry in the bucket and clean it, or set to next bucket */ +- +- if (current_detail && current_index < current_detail->hash_size) { ++ if (current_index < current_detail->hash_size) { + struct cache_head *ch = NULL; + struct cache_detail *d; + struct hlist_head *head; + struct hlist_node *tmp; + +- spin_lock(¤t_detail->hash_lock); +- + /* Ok, now to clean this strand */ +- + head = ¤t_detail->hash_table[current_index]; + hlist_for_each_entry_safe(ch, tmp, head, cache_list) { + if (current_detail->nextcheck > ch->expiry_time) +@@ -502,8 +499,10 @@ static int cache_clean(void) + spin_unlock(&cache_list_lock); + if (ch) + sunrpc_end_cache_remove_entry(ch, d); +- } else ++ } else { ++ spin_unlock(¤t_detail->hash_lock); + spin_unlock(&cache_list_lock); ++ } + + return rv; + } +-- +2.39.5 + diff --git a/queue-6.15/sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch b/queue-6.15/sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch new file mode 100644 index 0000000000..c8d6a5f4c7 --- /dev/null +++ b/queue-6.15/sunrpc-update-nextcheck-time-when-adding-new-cache-e.patch @@ -0,0 +1,52 @@ +From 422a351e84facedeacd04bfa00752873338a2670 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Mar 2025 14:48:35 +0800 +Subject: sunrpc: update nextcheck time when adding new cache entries + +From: Long Li + +[ Upstream commit 5ca00634c8bbb2979c73465588f486b9632f5ed5 ] + +The cache_detail structure uses a "nextcheck" field to control hash table +scanning intervals. When a table scan begins, nextcheck is set to current +time plus 1800 seconds. During scanning, if cache_detail is not empty and +a cache entry's expiry time is earlier than the current nextcheck, the +nextcheck is updated to that expiry time. + +This mechanism ensures that: +1) Empty cache_details are scanned every 1800 seconds to avoid unnecessary + scans +2) Non-empty cache_details are scanned based on the earliest expiry time + found + +However, when adding a new cache entry to an empty cache_detail, the +nextcheck time was not being updated, remaining at 1800 seconds. This +could delay cache cleanup for up to 1800 seconds, potentially blocking +threads(such as nfsd) that are waiting for cache cleanup. + +Fix this by updating the nextcheck time whenever a new cache entry is +added. + +Signed-off-by: Long Li +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/cache.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index 7ce5e28a6c031..bbaa77d7bbc81 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -135,6 +135,8 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail, + + hlist_add_head_rcu(&new->cache_list, head); + detail->entries++; ++ if (detail->nextcheck > new->expiry_time) ++ detail->nextcheck = new->expiry_time + 1; + cache_get(new); + spin_unlock(&detail->hash_lock); + +-- +2.39.5 + diff --git a/queue-6.15/tcp-add-receive-queue-awareness-in-tcp_rcv_space_adj.patch b/queue-6.15/tcp-add-receive-queue-awareness-in-tcp_rcv_space_adj.patch new file mode 100644 index 0000000000..fb040f79e0 --- /dev/null +++ b/queue-6.15/tcp-add-receive-queue-awareness-in-tcp_rcv_space_adj.patch @@ -0,0 +1,68 @@ +From 4476dad29ce9385a393b48d479a43e295b9b6462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 19:39:12 +0000 +Subject: tcp: add receive queue awareness in tcp_rcv_space_adjust() + +From: Eric Dumazet + +[ Upstream commit ea33537d82921e71f852ea2ed985acc562125efe ] + +If the application can not drain fast enough a TCP socket queue, +tcp_rcv_space_adjust() can overestimate tp->rcvq_space.space. + +Then sk->sk_rcvbuf can grow and hit tcp_rmem[2] for no good reason. + +Fix this by taking into acount the number of available bytes. + +Keeping sk->sk_rcvbuf at the right size allows better cache efficiency. + +Signed-off-by: Eric Dumazet +Reviewed-by: Wei Wang +Link: https://patch.msgid.link/20250513193919.1089692-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/tcp.h | 2 +- + net/ipv4/tcp_input.c | 6 ++++-- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/include/linux/tcp.h b/include/linux/tcp.h +index 1669d95bb0f9a..5c7c5038d47b5 100644 +--- a/include/linux/tcp.h ++++ b/include/linux/tcp.h +@@ -340,7 +340,7 @@ struct tcp_sock { + } rcv_rtt_est; + /* Receiver queue space */ + struct { +- u32 space; ++ int space; + u32 seq; + u64 time; + } rcvq_space; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index ed5f0ffab60dc..49adcbd73074d 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -748,8 +748,7 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk, + void tcp_rcv_space_adjust(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); +- u32 copied; +- int time; ++ int time, inq, copied; + + trace_tcp_rcv_space_adjust(sk); + +@@ -760,6 +759,9 @@ void tcp_rcv_space_adjust(struct sock *sk) + + /* Number of bytes copied to user in last RTT */ + copied = tp->copied_seq - tp->rcvq_space.seq; ++ /* Number of bytes in receive queue. */ ++ inq = tp->rcv_nxt - tp->copied_seq; ++ copied -= inq; + if (copied <= tp->rcvq_space.space) + goto new_measure; + +-- +2.39.5 + diff --git a/queue-6.15/tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch b/queue-6.15/tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch new file mode 100644 index 0000000000..122aa4f4c5 --- /dev/null +++ b/queue-6.15/tcp-always-seek-for-minimal-rtt-in-tcp_rcv_rtt_updat.patch @@ -0,0 +1,71 @@ +From 0c68dd3455e2901404e9070b807f5d2cbd391f17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 19:39:15 +0000 +Subject: tcp: always seek for minimal rtt in tcp_rcv_rtt_update() + +From: Eric Dumazet + +[ Upstream commit b879dcb1aeeca278eacaac0b1e2425b1c7599f9f ] + +tcp_rcv_rtt_update() goal is to maintain an estimation of the RTT +in tp->rcv_rtt_est.rtt_us, used by tcp_rcv_space_adjust() + +When TCP TS are enabled, tcp_rcv_rtt_update() is using +EWMA to smooth the samples. + +Change this to immediately latch the incoming value if it +is lower than tp->rcv_rtt_est.rtt_us, so that tcp_rcv_space_adjust() +does not overshoot tp->rcvq_space.space and sk->sk_rcvbuf. + +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20250513193919.1089692-8-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 22 ++++++++-------------- + 1 file changed, 8 insertions(+), 14 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index a35018e2d0ba2..45177758faeaa 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -664,10 +664,12 @@ EXPORT_IPV6_MOD(tcp_initialize_rcv_mss); + */ + static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep) + { +- u32 new_sample = tp->rcv_rtt_est.rtt_us; +- long m = sample; ++ u32 new_sample, old_sample = tp->rcv_rtt_est.rtt_us; ++ long m = sample << 3; + +- if (new_sample != 0) { ++ if (old_sample == 0 || m < old_sample) { ++ new_sample = m; ++ } else { + /* If we sample in larger samples in the non-timestamp + * case, we could grossly overestimate the RTT especially + * with chatty applications or bulk transfer apps which +@@ -678,17 +680,9 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep) + * else with timestamps disabled convergence takes too + * long. + */ +- if (!win_dep) { +- m -= (new_sample >> 3); +- new_sample += m; +- } else { +- m <<= 3; +- if (m < new_sample) +- new_sample = m; +- } +- } else { +- /* No previous measure. */ +- new_sample = m << 3; ++ if (win_dep) ++ return; ++ new_sample = old_sample - (old_sample >> 3) + sample; + } + + tp->rcv_rtt_est.rtt_us = new_sample; +-- +2.39.5 + diff --git a/queue-6.15/tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch b/queue-6.15/tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch new file mode 100644 index 0000000000..9034ebb134 --- /dev/null +++ b/queue-6.15/tcp-fix-initial-tp-rcvq_space.space-value-for-passiv.patch @@ -0,0 +1,52 @@ +From 4a7c1fffac9547b83c3e9c0d35146cbaca723075 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 19:39:14 +0000 +Subject: tcp: fix initial tp->rcvq_space.space value for passive TS enabled + flows + +From: Eric Dumazet + +[ Upstream commit cd171461b90a2d2cf230943df60d580174633718 ] + +tcp_rcv_state_process() must tweak tp->advmss for TS enabled flows +before the call to tcp_init_transfer() / tcp_init_buffer_space(). + +Otherwise tp->rcvq_space.space is off by 120 bytes +(TCP_INIT_CWND * TCPOLEN_TSTAMP_ALIGNED). + +Signed-off-by: Eric Dumazet +Reviewed-by: Wei Wang +Link: https://patch.msgid.link/20250513193919.1089692-7-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 4dfdde48ab503..ed5f0ffab60dc 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -6867,6 +6867,9 @@ tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) + if (!tp->srtt_us) + tcp_synack_rtt_meas(sk, req); + ++ if (tp->rx_opt.tstamp_ok) ++ tp->advmss -= TCPOLEN_TSTAMP_ALIGNED; ++ + if (req) { + tcp_rcv_synrecv_state_fastopen(sk); + } else { +@@ -6892,9 +6895,6 @@ tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) + tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale; + tcp_init_wl(tp, TCP_SKB_CB(skb)->seq); + +- if (tp->rx_opt.tstamp_ok) +- tp->advmss -= TCPOLEN_TSTAMP_ALIGNED; +- + if (!inet_csk(sk)->icsk_ca_ops->cong_control) + tcp_update_pacing_rate(sk); + +-- +2.39.5 + diff --git a/queue-6.15/tcp-remove-zero-tcp-ts-samples-for-autotuning.patch b/queue-6.15/tcp-remove-zero-tcp-ts-samples-for-autotuning.patch new file mode 100644 index 0000000000..5c9a49a2fa --- /dev/null +++ b/queue-6.15/tcp-remove-zero-tcp-ts-samples-for-autotuning.patch @@ -0,0 +1,93 @@ +From b7aecb67971d01d5e828f7f4c179904fb5bbafaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 19:39:13 +0000 +Subject: tcp: remove zero TCP TS samples for autotuning + +From: Eric Dumazet + +[ Upstream commit d59fc95be9d0fd05ed3ccc11b4a2f832bdf2ee03 ] + +For TCP flows using ms RFC 7323 timestamp granularity +tcp_rcv_rtt_update() can be fed with 1 ms samples, breaking +TCP autotuning for data center flows with sub ms RTT. + +Instead, rely on the window based samples, fed by tcp_rcv_rtt_measure() + +tcp_rcvbuf_grow() for a 10 second TCP_STREAM sesssion now looks saner. +We can see rcvbuf is kept at a reasonable value. + + 222.234976: tcp:tcp_rcvbuf_grow: time=348 rtt_us=330 copied=110592 inq=0 space=40960 ooo=0 scaling_ratio=230 rcvbuf=131072 ... + 222.235276: tcp:tcp_rcvbuf_grow: time=300 rtt_us=288 copied=126976 inq=0 space=110592 ooo=0 scaling_ratio=230 rcvbuf=246187 ... + 222.235569: tcp:tcp_rcvbuf_grow: time=294 rtt_us=288 copied=184320 inq=0 space=126976 ooo=0 scaling_ratio=230 rcvbuf=282659 ... + 222.235833: tcp:tcp_rcvbuf_grow: time=264 rtt_us=244 copied=373760 inq=0 space=184320 ooo=0 scaling_ratio=230 rcvbuf=410312 ... + 222.236142: tcp:tcp_rcvbuf_grow: time=308 rtt_us=219 copied=424960 inq=20480 space=373760 ooo=0 scaling_ratio=230 rcvbuf=832022 ... + 222.236378: tcp:tcp_rcvbuf_grow: time=236 rtt_us=219 copied=692224 inq=49152 space=404480 ooo=0 scaling_ratio=230 rcvbuf=900407 ... + 222.236602: tcp:tcp_rcvbuf_grow: time=225 rtt_us=219 copied=730112 inq=49152 space=643072 ooo=0 scaling_ratio=230 rcvbuf=1431534 ... + 222.237050: tcp:tcp_rcvbuf_grow: time=229 rtt_us=219 copied=1160192 inq=49152 space=680960 ooo=0 scaling_ratio=230 rcvbuf=1515876 ... + 222.237618: tcp:tcp_rcvbuf_grow: time=305 rtt_us=218 copied=2228224 inq=49152 space=1111040 ooo=0 scaling_ratio=230 rcvbuf=2473271 ... + 222.238591: tcp:tcp_rcvbuf_grow: time=224 rtt_us=218 copied=3063808 inq=360448 space=2179072 ooo=0 scaling_ratio=230 rcvbuf=4850803 ... + 222.240647: tcp:tcp_rcvbuf_grow: time=260 rtt_us=218 copied=2752512 inq=0 space=2703360 ooo=0 scaling_ratio=230 rcvbuf=6017914 ... + 222.243535: tcp:tcp_rcvbuf_grow: time=224 rtt_us=218 copied=2834432 inq=49152 space=2752512 ooo=0 scaling_ratio=230 rcvbuf=6127331 ... + 222.245108: tcp:tcp_rcvbuf_grow: time=240 rtt_us=218 copied=2883584 inq=49152 space=2785280 ooo=0 scaling_ratio=230 rcvbuf=6200275 ... + 222.245333: tcp:tcp_rcvbuf_grow: time=224 rtt_us=218 copied=2859008 inq=0 space=2834432 ooo=0 scaling_ratio=230 rcvbuf=6309692 ... + 222.301021: tcp:tcp_rcvbuf_grow: time=222 rtt_us=218 copied=2883584 inq=0 space=2859008 ooo=0 scaling_ratio=230 rcvbuf=6364400 ... + 222.989242: tcp:tcp_rcvbuf_grow: time=225 rtt_us=218 copied=2899968 inq=0 space=2883584 ooo=0 scaling_ratio=230 rcvbuf=6419108 ... + 224.139553: tcp:tcp_rcvbuf_grow: time=224 rtt_us=218 copied=3014656 inq=65536 space=2899968 ooo=0 scaling_ratio=230 rcvbuf=6455580 ... + 224.584608: tcp:tcp_rcvbuf_grow: time=232 rtt_us=218 copied=3014656 inq=49152 space=2949120 ooo=0 scaling_ratio=230 rcvbuf=6564997 ... + 230.145560: tcp:tcp_rcvbuf_grow: time=223 rtt_us=218 copied=2981888 inq=0 space=2965504 ooo=0 scaling_ratio=230 rcvbuf=6601469 ... + +Signed-off-by: Eric Dumazet +Reviewed-by: Wei Wang +Link: https://patch.msgid.link/20250513193919.1089692-6-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 45177758faeaa..4dfdde48ab503 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -706,7 +706,7 @@ static inline void tcp_rcv_rtt_measure(struct tcp_sock *tp) + tp->rcv_rtt_est.time = tp->tcp_mstamp; + } + +-static s32 tcp_rtt_tsopt_us(const struct tcp_sock *tp) ++static s32 tcp_rtt_tsopt_us(const struct tcp_sock *tp, u32 min_delta) + { + u32 delta, delta_us; + +@@ -716,7 +716,7 @@ static s32 tcp_rtt_tsopt_us(const struct tcp_sock *tp) + + if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) { + if (!delta) +- delta = 1; ++ delta = min_delta; + delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ); + return delta_us; + } +@@ -734,9 +734,9 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk, + + if (TCP_SKB_CB(skb)->end_seq - + TCP_SKB_CB(skb)->seq >= inet_csk(sk)->icsk_ack.rcv_mss) { +- s32 delta = tcp_rtt_tsopt_us(tp); ++ s32 delta = tcp_rtt_tsopt_us(tp, 0); + +- if (delta >= 0) ++ if (delta > 0) + tcp_rcv_rtt_update(tp, delta, 0); + } + } +@@ -3220,7 +3220,7 @@ static bool tcp_ack_update_rtt(struct sock *sk, const int flag, + */ + if (seq_rtt_us < 0 && tp->rx_opt.saw_tstamp && + tp->rx_opt.rcv_tsecr && flag & FLAG_ACKED) +- seq_rtt_us = ca_rtt_us = tcp_rtt_tsopt_us(tp); ++ seq_rtt_us = ca_rtt_us = tcp_rtt_tsopt_us(tp, 1); + + rs->rtt_us = ca_rtt_us; /* RTT of last (S)ACKed packet (or -1) */ + if (seq_rtt_us < 0) +-- +2.39.5 + diff --git a/queue-6.15/tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch b/queue-6.15/tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch new file mode 100644 index 0000000000..026060c33e --- /dev/null +++ b/queue-6.15/tee-prevent-size-calculation-wraparound-on-32-bit-ke.patch @@ -0,0 +1,87 @@ +From f0a46d735b243b57f7bbfc8148d2be6b727b8703 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Apr 2025 15:06:43 +0200 +Subject: tee: Prevent size calculation wraparound on 32-bit kernels + +From: Jann Horn + +[ Upstream commit 39bb67edcc582b3b386a9ec983da67fa8a10ec03 ] + +The current code around TEE_IOCTL_PARAM_SIZE() is a bit wrong on +32-bit kernels: Multiplying a user-provided 32-bit value with the +size of a structure can wrap around on such platforms. + +Fix it by using saturating arithmetic for the size calculation. + +This has no security consequences because, in all users of +TEE_IOCTL_PARAM_SIZE(), the subsequent kcalloc() implicitly checks +for wrapping. + +Signed-off-by: Jann Horn +Signed-off-by: Jens Wiklander +Tested-by: Rouven Czerwinski +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_core.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c +index d113679b1e2d7..acc7998758ad8 100644 +--- a/drivers/tee/tee_core.c ++++ b/drivers/tee/tee_core.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -19,7 +20,7 @@ + + #define TEE_NUM_DEVICES 32 + +-#define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x)) ++#define TEE_IOCTL_PARAM_SIZE(x) (size_mul(sizeof(struct tee_param), (x))) + + #define TEE_UUID_NS_NAME_SIZE 128 + +@@ -487,7 +488,7 @@ static int tee_ioctl_open_session(struct tee_context *ctx, + if (copy_from_user(&arg, uarg, sizeof(arg))) + return -EFAULT; + +- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) ++ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len) + return -EINVAL; + + if (arg.num_params) { +@@ -565,7 +566,7 @@ static int tee_ioctl_invoke(struct tee_context *ctx, + if (copy_from_user(&arg, uarg, sizeof(arg))) + return -EFAULT; + +- if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) ++ if (size_add(sizeof(arg), TEE_IOCTL_PARAM_SIZE(arg.num_params)) != buf.buf_len) + return -EINVAL; + + if (arg.num_params) { +@@ -699,7 +700,7 @@ static int tee_ioctl_supp_recv(struct tee_context *ctx, + if (get_user(num_params, &uarg->num_params)) + return -EFAULT; + +- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len) ++ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) != buf.buf_len) + return -EINVAL; + + params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); +@@ -798,7 +799,7 @@ static int tee_ioctl_supp_send(struct tee_context *ctx, + get_user(num_params, &uarg->num_params)) + return -EFAULT; + +- if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len) ++ if (size_add(sizeof(*uarg), TEE_IOCTL_PARAM_SIZE(num_params)) > buf.buf_len) + return -EINVAL; + + params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); +-- +2.39.5 + diff --git a/queue-6.15/tipc-use-kfree_sensitive-for-aead-cleanup.patch b/queue-6.15/tipc-use-kfree_sensitive-for-aead-cleanup.patch new file mode 100644 index 0000000000..dcef3c1470 --- /dev/null +++ b/queue-6.15/tipc-use-kfree_sensitive-for-aead-cleanup.patch @@ -0,0 +1,45 @@ +From 162e461998362c364d70f597ec9a27d5f56ef356 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 May 2025 11:47:17 +0000 +Subject: tipc: use kfree_sensitive() for aead cleanup + +From: Zilin Guan + +[ Upstream commit c8ef20fe7274c5766a317f9193b70bed717b6b3d ] + +The tipc_aead_free() function currently uses kfree() to release the aead +structure. However, this structure contains sensitive information, such +as key's SALT value, which should be securely erased from memory to +prevent potential leakage. + +To enhance security, replace kfree() with kfree_sensitive() when freeing +the aead structure. This change ensures that sensitive data is explicitly +cleared before memory deallocation, aligning with the approach used in +tipc_aead_init() and adhering to best practices for handling confidential +information. + +Signed-off-by: Zilin Guan +Reviewed-by: Tung Nguyen +Link: https://patch.msgid.link/20250523114717.4021518-1-zilin@seu.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tipc/crypto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c +index 79f91b6ca8c84..ea5bb131ebd06 100644 +--- a/net/tipc/crypto.c ++++ b/net/tipc/crypto.c +@@ -425,7 +425,7 @@ static void tipc_aead_free(struct rcu_head *rp) + } + free_percpu(aead->tfm_entry); + kfree_sensitive(aead->key); +- kfree(aead); ++ kfree_sensitive(aead); + } + + static int tipc_aead_users(struct tipc_aead __rcu *aead) +-- +2.39.5 + diff --git a/queue-6.15/tools-nolibc-use-intmax-definitions-from-compiler.patch b/queue-6.15/tools-nolibc-use-intmax-definitions-from-compiler.patch new file mode 100644 index 0000000000..9c52a473a4 --- /dev/null +++ b/queue-6.15/tools-nolibc-use-intmax-definitions-from-compiler.patch @@ -0,0 +1,46 @@ +From 8960fa8611adb352b79fcfc9188ed5d494311fea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 11:00:39 +0200 +Subject: tools/nolibc: use intmax definitions from compiler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit e5407c0820ea5fa7117b85ed32b724af73156d63 ] + +The printf format checking in the compiler uses the intmax types from +the compiler, not libc. This can lead to compiler errors. + +Instead use the types already provided by the compiler. + +Example issue with clang 19 for arm64: + +nolibc-test.c:30:2: error: format specifies type 'uintmax_t' (aka 'unsigned long') but the argument has type 'uintmax_t' (aka 'unsigned long long') [-Werror,-Wformat] + +Signed-off-by: Thomas Weißschuh +Acked-by: Willy Tarreau +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/stdint.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/include/nolibc/stdint.h b/tools/include/nolibc/stdint.h +index cd79ddd6170e0..b052ad6303c38 100644 +--- a/tools/include/nolibc/stdint.h ++++ b/tools/include/nolibc/stdint.h +@@ -39,8 +39,8 @@ typedef size_t uint_fast32_t; + typedef int64_t int_fast64_t; + typedef uint64_t uint_fast64_t; + +-typedef int64_t intmax_t; +-typedef uint64_t uintmax_t; ++typedef __INTMAX_TYPE__ intmax_t; ++typedef __UINTMAX_TYPE__ uintmax_t; + + /* limits of integral types */ + +-- +2.39.5 + diff --git a/queue-6.15/tools-nolibc-use-pselect6_time64-if-available.patch b/queue-6.15/tools-nolibc-use-pselect6_time64-if-available.patch new file mode 100644 index 0000000000..ae9562f9cf --- /dev/null +++ b/queue-6.15/tools-nolibc-use-pselect6_time64-if-available.patch @@ -0,0 +1,45 @@ +From 363033c7641dee857a543cbd3670782fd2c3bf0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 11:00:40 +0200 +Subject: tools/nolibc: use pselect6_time64 if available +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 248ddc80b145515286bfb75d08034ad4c0fdb08e ] + +riscv32 does not have any of the older select systemcalls. +Use pselect6_time64 instead. +poll() is also used to implement sleep(). + +Signed-off-by: Thomas Weißschuh +Acked-by: Willy Tarreau +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/sys.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/tools/include/nolibc/sys.h b/tools/include/nolibc/sys.h +index 08c1c074bec89..a5decdba40223 100644 +--- a/tools/include/nolibc/sys.h ++++ b/tools/include/nolibc/sys.h +@@ -1023,6 +1023,14 @@ int sys_select(int nfds, fd_set *rfds, fd_set *wfds, fd_set *efds, struct timeva + t.tv_nsec = timeout->tv_usec * 1000; + } + return my_syscall6(__NR_pselect6, nfds, rfds, wfds, efds, timeout ? &t : NULL, NULL); ++#elif defined(__NR_pselect6_time64) ++ struct __kernel_timespec t; ++ ++ if (timeout) { ++ t.tv_sec = timeout->tv_sec; ++ t.tv_nsec = timeout->tv_usec * 1000; ++ } ++ return my_syscall6(__NR_pselect6_time64, nfds, rfds, wfds, efds, timeout ? &t : NULL, NULL); + #else + return __nolibc_enosys(__func__, nfds, rfds, wfds, efds, timeout); + #endif +-- +2.39.5 + diff --git a/queue-6.15/tracing-only-return-an-adjusted-address-if-it-matche.patch b/queue-6.15/tracing-only-return-an-adjusted-address-if-it-matche.patch new file mode 100644 index 0000000000..691d286958 --- /dev/null +++ b/queue-6.15/tracing-only-return-an-adjusted-address-if-it-matche.patch @@ -0,0 +1,55 @@ +From da3fa6955d1deb8c34ed7b0f77b10410e5caef34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 May 2025 10:23:00 -0400 +Subject: tracing: Only return an adjusted address if it matches the kernel + address + +From: Steven Rostedt + +[ Upstream commit 00d872dd541cdf22230510201a1baf58f0147db9 ] + +The trace_adjust_address() will take a given address and examine the +persistent ring buffer to see if the address matches a module that is +listed there. If it does not, it will just adjust the value to the core +kernel delta. But if the address was for something that was not part of +the core kernel text or data it should not be adjusted. + +Check the result of the adjustment and only return the adjustment if it +lands in the current kernel text or data. If not, return the original +address. + +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Link: https://lore.kernel.org/20250506102300.0ba2f9e0@gandalf.local.home +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 766cb3cd254e0..14e1e1ed55058 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -6032,6 +6032,7 @@ unsigned long trace_adjust_address(struct trace_array *tr, unsigned long addr) + struct trace_module_delta *module_delta; + struct trace_scratch *tscratch; + struct trace_mod_entry *entry; ++ unsigned long raddr; + int idx = 0, nr_entries; + + /* If we don't have last boot delta, return the address */ +@@ -6045,7 +6046,9 @@ unsigned long trace_adjust_address(struct trace_array *tr, unsigned long addr) + module_delta = READ_ONCE(tr->module_delta); + if (!module_delta || !tscratch->nr_entries || + tscratch->entries[0].mod_addr > addr) { +- return addr + tr->text_delta; ++ raddr = addr + tr->text_delta; ++ return __is_kernel(raddr) || is_kernel_core_data(raddr) || ++ is_kernel_rodata(raddr) ? raddr : addr; + } + + /* Note that entries must be sorted. */ +-- +2.39.5 + diff --git a/queue-6.15/usbnet-asix-ax88772-leave-the-carrier-control-to-phy.patch b/queue-6.15/usbnet-asix-ax88772-leave-the-carrier-control-to-phy.patch new file mode 100644 index 0000000000..95c1df3d6c --- /dev/null +++ b/queue-6.15/usbnet-asix-ax88772-leave-the-carrier-control-to-phy.patch @@ -0,0 +1,156 @@ +From 69032adec60550a02d5842460df9d45dd9ca4f05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 13:59:41 +0200 +Subject: usbnet: asix AX88772: leave the carrier control to phylink +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Hałasa + +[ Upstream commit 4145f00227ee80f21ab274e9cd9c09758e9bcf3d ] + +ASIX AX88772B based USB 10/100 Ethernet adapter doesn't come +up ("carrier off"), despite the built-in 100BASE-FX PHY positive link +indication. The internal PHY is configured (using EEPROM) in fixed +100 Mbps full duplex mode. + +The primary problem appears to be using carrier_netif_{on,off}() while, +at the same time, delegating carrier management to phylink. Use only the +latter and remove "manual control" in the asix driver. + +I don't have any other AX88772 board here, but the problem doesn't seem +specific to a particular board or settings - it's probably +timing-dependent. + +Remove unused asix_adjust_link() as well. + +Signed-off-by: Krzysztof Hałasa +Tested-by: Oleksij Rempel +Link: https://patch.msgid.link/m3plhmdfte.fsf_-_@t19.piap.pl +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/asix.h | 1 - + drivers/net/usb/asix_common.c | 22 ---------------------- + drivers/net/usb/asix_devices.c | 17 ++++------------- + 3 files changed, 4 insertions(+), 36 deletions(-) + +diff --git a/drivers/net/usb/asix.h b/drivers/net/usb/asix.h +index 74162190bccc1..8531b804021aa 100644 +--- a/drivers/net/usb/asix.h ++++ b/drivers/net/usb/asix.h +@@ -224,7 +224,6 @@ int asix_write_rx_ctl(struct usbnet *dev, u16 mode, int in_pm); + + u16 asix_read_medium_status(struct usbnet *dev, int in_pm); + int asix_write_medium_mode(struct usbnet *dev, u16 mode, int in_pm); +-void asix_adjust_link(struct net_device *netdev); + + int asix_write_gpio(struct usbnet *dev, u16 value, int sleep, int in_pm); + +diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c +index 72ffc89b477ad..7fd763917ae2c 100644 +--- a/drivers/net/usb/asix_common.c ++++ b/drivers/net/usb/asix_common.c +@@ -414,28 +414,6 @@ int asix_write_medium_mode(struct usbnet *dev, u16 mode, int in_pm) + return ret; + } + +-/* set MAC link settings according to information from phylib */ +-void asix_adjust_link(struct net_device *netdev) +-{ +- struct phy_device *phydev = netdev->phydev; +- struct usbnet *dev = netdev_priv(netdev); +- u16 mode = 0; +- +- if (phydev->link) { +- mode = AX88772_MEDIUM_DEFAULT; +- +- if (phydev->duplex == DUPLEX_HALF) +- mode &= ~AX_MEDIUM_FD; +- +- if (phydev->speed != SPEED_100) +- mode &= ~AX_MEDIUM_PS; +- } +- +- asix_write_medium_mode(dev, mode, 0); +- phy_print_status(phydev); +- usbnet_link_change(dev, phydev->link, 0); +-} +- + int asix_write_gpio(struct usbnet *dev, u16 value, int sleep, int in_pm) + { + int ret; +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index da24941a6e444..9b0318fb50b55 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -752,7 +752,6 @@ static void ax88772_mac_link_down(struct phylink_config *config, + struct usbnet *dev = netdev_priv(to_net_dev(config->dev)); + + asix_write_medium_mode(dev, 0, 0); +- usbnet_link_change(dev, false, false); + } + + static void ax88772_mac_link_up(struct phylink_config *config, +@@ -783,7 +782,6 @@ static void ax88772_mac_link_up(struct phylink_config *config, + m |= AX_MEDIUM_RFC; + + asix_write_medium_mode(dev, m, 0); +- usbnet_link_change(dev, true, false); + } + + static const struct phylink_mac_ops ax88772_phylink_mac_ops = { +@@ -1350,10 +1348,9 @@ static const struct driver_info ax88772_info = { + .description = "ASIX AX88772 USB 2.0 Ethernet", + .bind = ax88772_bind, + .unbind = ax88772_unbind, +- .status = asix_status, + .reset = ax88772_reset, + .stop = ax88772_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | FLAG_MULTI_PACKET, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET, + .rx_fixup = asix_rx_fixup_common, + .tx_fixup = asix_tx_fixup, + }; +@@ -1362,11 +1359,9 @@ static const struct driver_info ax88772b_info = { + .description = "ASIX AX88772B USB 2.0 Ethernet", + .bind = ax88772_bind, + .unbind = ax88772_unbind, +- .status = asix_status, + .reset = ax88772_reset, + .stop = ax88772_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | +- FLAG_MULTI_PACKET, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET, + .rx_fixup = asix_rx_fixup_common, + .tx_fixup = asix_tx_fixup, + .data = FLAG_EEPROM_MAC, +@@ -1376,11 +1371,9 @@ static const struct driver_info lxausb_t1l_info = { + .description = "Linux Automation GmbH USB 10Base-T1L", + .bind = ax88772_bind, + .unbind = ax88772_unbind, +- .status = asix_status, + .reset = ax88772_reset, + .stop = ax88772_stop, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | +- FLAG_MULTI_PACKET, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET, + .rx_fixup = asix_rx_fixup_common, + .tx_fixup = asix_tx_fixup, + .data = FLAG_EEPROM_MAC, +@@ -1412,10 +1405,8 @@ static const struct driver_info hg20f9_info = { + .description = "HG20F9 USB 2.0 Ethernet", + .bind = ax88772_bind, + .unbind = ax88772_unbind, +- .status = asix_status, + .reset = ax88772_reset, +- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | +- FLAG_MULTI_PACKET, ++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_MULTI_PACKET, + .rx_fixup = asix_rx_fixup_common, + .tx_fixup = asix_tx_fixup, + .data = FLAG_EEPROM_MAC, +-- +2.39.5 + diff --git a/queue-6.15/vxlan-add-rcu-read-side-critical-sections-in-the-tx-.patch b/queue-6.15/vxlan-add-rcu-read-side-critical-sections-in-the-tx-.patch new file mode 100644 index 0000000000..bb49ab19a0 --- /dev/null +++ b/queue-6.15/vxlan-add-rcu-read-side-critical-sections-in-the-tx-.patch @@ -0,0 +1,94 @@ +From 646a53b8ad204e2ea97d5373c7526680b371ddbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 15:11:29 +0300 +Subject: vxlan: Add RCU read-side critical sections in the Tx path + +From: Ido Schimmel + +[ Upstream commit 804b09be09f8af4eda5346a72361459ba21fcf1b ] + +The Tx path does not run from an RCU read-side critical section which +makes the current lockless accesses to FDB entries invalid. As far as I +am aware, this has not been a problem in practice, but traces will be +generated once we transition the FDB lookup to rhashtable_lookup(). + +Add rcu_read_{lock,unlock}() around the handling of FDB entries in the +Tx path. Remove the RCU read-side critical section from vxlan_xmit_nh() +as now the function is always called from an RCU read-side critical +section. + +Reviewed-by: Petr Machata +Signed-off-by: Ido Schimmel +Link: https://patch.msgid.link/20250415121143.345227-2-idosch@nvidia.com +Reviewed-by: Nikolay Aleksandrov +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan/vxlan_core.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c +index e83197fac1e0f..edbf1088c7d74 100644 +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -1916,12 +1916,15 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) + goto out; + } + ++ rcu_read_lock(); + f = vxlan_find_mac(vxlan, n->ha, vni); + if (f && vxlan_addr_any(&(first_remote_rcu(f)->remote_ip))) { + /* bridge-local neighbor */ + neigh_release(n); ++ rcu_read_unlock(); + goto out; + } ++ rcu_read_unlock(); + + reply = arp_create(ARPOP_REPLY, ETH_P_ARP, sip, dev, tip, sha, + n->ha, sha); +@@ -2648,14 +2651,10 @@ static void vxlan_xmit_nh(struct sk_buff *skb, struct net_device *dev, + memset(&nh_rdst, 0, sizeof(struct vxlan_rdst)); + hash = skb_get_hash(skb); + +- rcu_read_lock(); + nh = rcu_dereference(f->nh); +- if (!nh) { +- rcu_read_unlock(); ++ if (!nh) + goto drop; +- } + do_xmit = vxlan_fdb_nh_path_select(nh, hash, &nh_rdst); +- rcu_read_unlock(); + + if (likely(do_xmit)) + vxlan_xmit_one(skb, dev, vni, &nh_rdst, did_rsc); +@@ -2782,6 +2781,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) + } + + eth = eth_hdr(skb); ++ rcu_read_lock(); + f = vxlan_find_mac(vxlan, eth->h_dest, vni); + did_rsc = false; + +@@ -2804,7 +2804,7 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) + vxlan_vnifilter_count(vxlan, vni, NULL, + VXLAN_VNI_STATS_TX_DROPS, 0); + kfree_skb_reason(skb, SKB_DROP_REASON_NO_TX_TARGET); +- return NETDEV_TX_OK; ++ goto out; + } + } + +@@ -2829,6 +2829,8 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) + kfree_skb_reason(skb, SKB_DROP_REASON_NO_TX_TARGET); + } + ++out: ++ rcu_read_unlock(); + return NETDEV_TX_OK; + } + +-- +2.39.5 + diff --git a/queue-6.15/vxlan-do-not-treat-dst-cache-initialization-errors-a.patch b/queue-6.15/vxlan-do-not-treat-dst-cache-initialization-errors-a.patch new file mode 100644 index 0000000000..664995ea68 --- /dev/null +++ b/queue-6.15/vxlan-do-not-treat-dst-cache-initialization-errors-a.patch @@ -0,0 +1,75 @@ +From ec12fe5eea842b29bb3a79eeaef95b733a31b97b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 15:11:41 +0300 +Subject: vxlan: Do not treat dst cache initialization errors as fatal + +From: Ido Schimmel + +[ Upstream commit 20c76dadc783759fd3819d289c72be590660cc8b ] + +FDB entries are allocated in an atomic context as they can be added from +the data path when learning is enabled. + +After converting the FDB hash table to rhashtable, the insertion rate +will be much higher (*) which will entail a much higher rate of per-CPU +allocations via dst_cache_init(). + +When adding a large number of entries (e.g., 256k) in a batch, a small +percentage (< 0.02%) of these per-CPU allocations will fail [1]. This +does not happen with the current code since the insertion rate is low +enough to give the per-CPU allocator a chance to asynchronously create +new chunks of per-CPU memory. + +Given that: + +a. Only a small percentage of these per-CPU allocations fail. + +b. The scenario where this happens might not be the most realistic one. + +c. The driver can work correctly without dst caches. The dst_cache_*() +APIs first check that the dst cache was properly initialized. + +d. The dst caches are not always used (e.g., 'tos inherit'). + +It seems reasonable to not treat these allocation failures as fatal. + +Therefore, do not bail when dst_cache_init() fails and suppress warnings +by specifying '__GFP_NOWARN'. + +[1] percpu: allocation failed, size=40 align=8 atomic=1, atomic alloc failed, no space left + +(*) 97% reduction in average latency of vxlan_fdb_update() when adding +256k entries in a batch. + +Reviewed-by: Petr Machata +Signed-off-by: Ido Schimmel +Link: https://patch.msgid.link/20250415121143.345227-14-idosch@nvidia.com +Reviewed-by: Nikolay Aleksandrov +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan/vxlan_core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c +index 9ccc3f09f71b8..e83197fac1e0f 100644 +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -610,10 +610,10 @@ static int vxlan_fdb_append(struct vxlan_fdb *f, + if (rd == NULL) + return -ENOMEM; + +- if (dst_cache_init(&rd->dst_cache, GFP_ATOMIC)) { +- kfree(rd); +- return -ENOMEM; +- } ++ /* The driver can work correctly without a dst cache, so do not treat ++ * dst cache initialization errors as fatal. ++ */ ++ dst_cache_init(&rd->dst_cache, GFP_ATOMIC | __GFP_NOWARN); + + rd->remote_ip = *ip; + rd->remote_port = port; +-- +2.39.5 + diff --git a/queue-6.15/watchdog-da9052_wdt-respect-twdmin.patch b/queue-6.15/watchdog-da9052_wdt-respect-twdmin.patch new file mode 100644 index 0000000000..ab84ab7a1e --- /dev/null +++ b/queue-6.15/watchdog-da9052_wdt-respect-twdmin.patch @@ -0,0 +1,39 @@ +From e53be6d7c1399c0ccb75319b9df5e7534300aebe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 09:29:51 +0100 +Subject: watchdog: da9052_wdt: respect TWDMIN + +From: Marcus Folkesson + +[ Upstream commit 325f510fcd9cda5a44bcb662b74ba4e3dabaca10 ] + +We have to wait at least the minimium time for the watchdog window +(TWDMIN) before writings to the wdt register after the +watchdog is activated. +Otherwise the chip will assert TWD_ERROR and power down to reset mode. + +Signed-off-by: Marcus Folkesson +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20250326-da9052-fixes-v3-4-a38a560fef0e@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/da9052_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/da9052_wdt.c b/drivers/watchdog/da9052_wdt.c +index 77039f2f0be54..bc0946233ced0 100644 +--- a/drivers/watchdog/da9052_wdt.c ++++ b/drivers/watchdog/da9052_wdt.c +@@ -168,6 +168,7 @@ static int da9052_wdt_probe(struct platform_device *pdev) + da9052_wdt = &driver_data->wdt; + + da9052_wdt->timeout = DA9052_DEF_TIMEOUT; ++ da9052_wdt->min_hw_heartbeat_ms = DA9052_TWDMIN; + da9052_wdt->info = &da9052_wdt_info; + da9052_wdt->ops = &da9052_wdt_ops; + da9052_wdt->parent = dev; +-- +2.39.5 + diff --git a/queue-6.15/watchdog-stm32-fix-wakeup-source-leaks-on-device-unb.patch b/queue-6.15/watchdog-stm32-fix-wakeup-source-leaks-on-device-unb.patch new file mode 100644 index 0000000000..04a9521c93 --- /dev/null +++ b/queue-6.15/watchdog-stm32-fix-wakeup-source-leaks-on-device-unb.patch @@ -0,0 +1,38 @@ +From 5a890b9bc61a18439622dc996304f7938705a312 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Apr 2025 22:35:30 +0200 +Subject: watchdog: stm32: Fix wakeup source leaks on device unbind + +From: Krzysztof Kozlowski + +[ Upstream commit b6f8a417e17f1929bb8e7e6ba9f4677f1f3ce364 ] + +Device can be unbound or probe can fail, so driver must also release +memory for the wakeup source. + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20250406203531.61322-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/stm32_iwdg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/stm32_iwdg.c b/drivers/watchdog/stm32_iwdg.c +index 8ad06b54c5adc..b356a272ff9a0 100644 +--- a/drivers/watchdog/stm32_iwdg.c ++++ b/drivers/watchdog/stm32_iwdg.c +@@ -291,7 +291,7 @@ static int stm32_iwdg_irq_init(struct platform_device *pdev, + return 0; + + if (of_property_read_bool(np, "wakeup-source")) { +- ret = device_init_wakeup(dev, true); ++ ret = devm_device_init_wakeup(dev); + if (ret) + return ret; + +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath11k-determine-pm-policy-based-on-machine-mod.patch b/queue-6.15/wifi-ath11k-determine-pm-policy-based-on-machine-mod.patch new file mode 100644 index 0000000000..4b025c36c7 --- /dev/null +++ b/queue-6.15/wifi-ath11k-determine-pm-policy-based-on-machine-mod.patch @@ -0,0 +1,140 @@ +From ce386c2a74055f3036011304a4b3406e4f2a299e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Mar 2025 13:32:24 +0800 +Subject: wifi: ath11k: determine PM policy based on machine model + +From: Baochen Qiang + +[ Upstream commit ce8669a27016354dfa8bf3c954255cb9f3583bae ] + +To handle the Lenovo unexpected wakeup issue [1], previously we revert +commit 166a490f59ac ("wifi: ath11k: support hibernation"). So currently +WLAN target is put into WoWLAN mode during suspend. This is a temporary +solution as it does not work on machines where WLAN power is cut off. + +The thought here is that we do WoWLAN suspend on Lenovo machines while +do non-WoWLAN suspend (which is done in the reverted commit) on other +machines. This requires us to identify Lenovo machines from others. +For that purpose, read board vendor and product name from DMI interface, +match it against all known affected machines. If there is a match, choose +WoWLAN suspend mode, else choose non-WoWLAN mode. Save the mode in ab +for later reference. + +[1] https://bugzilla.kernel.org/show_bug.cgi?id=219196 + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 + +Tested-by: Muhammad Usama Anjum +Tested-by: Takashi Iwai +Signed-off-by: Baochen Qiang +Link: https://patch.msgid.link/20250328-ath11k-bring-hibernation-back-v3-1-23405ae23431@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/core.c | 55 ++++++++++++++++++++++++++ + drivers/net/wireless/ath/ath11k/core.h | 7 ++++ + 2 files changed, 62 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index 22eb1b0377ffe..0281ce6fb7177 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -907,6 +907,52 @@ static const struct ath11k_hw_params ath11k_hw_params[] = { + }, + }; + ++static const struct dmi_system_id ath11k_pm_quirk_table[] = { ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21J4"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21K4"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21K6"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21K8"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21KA"), ++ }, ++ }, ++ { ++ .driver_data = (void *)ATH11K_PM_WOW, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21F9"), ++ }, ++ }, ++ {} ++}; ++ + static inline struct ath11k_pdev *ath11k_core_get_single_pdev(struct ath11k_base *ab) + { + WARN_ON(!ab->hw_params.single_pdev_only); +@@ -2334,8 +2380,17 @@ EXPORT_SYMBOL(ath11k_core_pre_init); + + int ath11k_core_init(struct ath11k_base *ab) + { ++ const struct dmi_system_id *dmi_id; + int ret; + ++ dmi_id = dmi_first_match(ath11k_pm_quirk_table); ++ if (dmi_id) ++ ab->pm_policy = (kernel_ulong_t)dmi_id->driver_data; ++ else ++ ab->pm_policy = ATH11K_PM_DEFAULT; ++ ++ ath11k_dbg(ab, ATH11K_DBG_BOOT, "pm policy %u\n", ab->pm_policy); ++ + ret = ath11k_core_soc_create(ab); + if (ret) { + ath11k_err(ab, "failed to create soc core: %d\n", ret); +diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h +index 529aca4f40621..81a8fe7bed448 100644 +--- a/drivers/net/wireless/ath/ath11k/core.h ++++ b/drivers/net/wireless/ath/ath11k/core.h +@@ -894,6 +894,11 @@ struct ath11k_msi_config { + u16 hw_rev; + }; + ++enum ath11k_pm_policy { ++ ATH11K_PM_DEFAULT, ++ ATH11K_PM_WOW, ++}; ++ + /* Master structure to hold the hw data which may be used in core module */ + struct ath11k_base { + enum ath11k_hw_rev hw_rev; +@@ -1060,6 +1065,8 @@ struct ath11k_base { + } testmode; + #endif + ++ enum ath11k_pm_policy pm_policy; ++ + /* must be last */ + u8 drv_priv[] __aligned(sizeof(void *)); + }; +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath11k-fix-qmi-memory-reuse-logic.patch b/queue-6.15/wifi-ath11k-fix-qmi-memory-reuse-logic.patch new file mode 100644 index 0000000000..792a7165e5 --- /dev/null +++ b/queue-6.15/wifi-ath11k-fix-qmi-memory-reuse-logic.patch @@ -0,0 +1,70 @@ +From 10001186986b68c55d9f5f5926e5c5b67a723cca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Apr 2025 13:02:41 +0500 +Subject: wifi: ath11k: Fix QMI memory reuse logic + +From: Muhammad Usama Anjum + +[ Upstream commit cd2e7bae92bd7e65063ab8d04721d2b711ba4cbe ] + +Firmware requests 2 segments at first. The first segment is of 6799360 +whose allocation fails due to dma remapping not available. The success +is returned to firmware. Then firmware asks for 22 smaller segments +instead of 2 big ones. Those get allocated successfully. At suspend/ +hibernation time, these segments aren't freed as they will be reused +by firmware after resuming. + +After resuming, the firmware asks for the 2 segments again with the +first segment of 6799360 size. Since chunk->vaddr is not NULL, the +type and size are compared with the previous type and size to know if +it can be reused or not. Unfortunately, it is detected that it cannot +be reused and this first smaller segment is freed. Then we continue to +allocate 6799360 size memory which fails and ath11k_qmi_free_target_mem_chunk() +is called which frees the second smaller segment as well. Later success +is returned to firmware which asks for 22 smaller segments again. But +as we had freed 2 segments already, we'll allocate the first 2 new +smaller segments again and reuse the remaining 20. Hence 20 small +segments are being reused instead of 22. + +Add skip logic when vaddr is set, but size/type don't match. Use the +same skip and success logic as used when dma_alloc_coherent() fails. +By skipping, the possibility of resume failure due to kernel failing to +allocate memory for QMI can be avoided. + + kernel: ath11k_pci 0000:03:00.0: failed to allocate dma memory for qmi (524288 B type 1) + ath11k_pci 0000:03:00.0: failed to allocate qmi target memory: -22 + +Tested-on: WCN6855 WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.6 + +Signed-off-by: Muhammad Usama Anjum +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20250428080242.466901-1-usama.anjum@collabora.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/qmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c +index 4f8b08ed1bbc6..83a48a77c53ee 100644 +--- a/drivers/net/wireless/ath/ath11k/qmi.c ++++ b/drivers/net/wireless/ath/ath11k/qmi.c +@@ -1993,6 +1993,15 @@ static int ath11k_qmi_alloc_target_mem_chunk(struct ath11k_base *ab) + chunk->prev_size == chunk->size) + continue; + ++ if (ab->qmi.mem_seg_count <= ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT) { ++ ath11k_dbg(ab, ATH11K_DBG_QMI, ++ "size/type mismatch (current %d %u) (prev %d %u), try later with small size\n", ++ chunk->size, chunk->type, ++ chunk->prev_size, chunk->prev_type); ++ ab->qmi.target_mem_delayed = true; ++ return 0; ++ } ++ + /* cannot reuse the existing chunk */ + dma_free_coherent(ab->dev, chunk->prev_size, + chunk->vaddr, chunk->paddr); +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-correctly-handle-mcast-packets-for-clien.patch b/queue-6.15/wifi-ath12k-correctly-handle-mcast-packets-for-clien.patch new file mode 100644 index 0000000000..312915f2dd --- /dev/null +++ b/queue-6.15/wifi-ath12k-correctly-handle-mcast-packets-for-clien.patch @@ -0,0 +1,92 @@ +From 3ef373acd1a6296bf0e1515189066ace2bc5fe70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 11:45:23 +0530 +Subject: wifi: ath12k: correctly handle mcast packets for clients + +From: Sarika Sharma + +[ Upstream commit 4541b0c8c3c1b85564971d497224e57cf8076a02 ] + +Currently, RX is_mcbc bit is set for packets sent from client as +destination address (DA) is multicast/broadcast address, but packets +are actually unicast as receiver address (RA) is not multicast address. +Hence, packets are not handled properly due to this is_mcbc bit. + +Therefore, reset the is_mcbc bit if interface type is AP. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Sarika Sharma +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250411061523.859387-3-quic_sarishar@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_rx.c | 5 +++++ + drivers/net/wireless/ath/ath12k/peer.c | 5 ++++- + drivers/net/wireless/ath/ath12k/peer.h | 3 ++- + 3 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index 7fadd366ec13d..8b1b038d67667 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -2259,6 +2259,11 @@ static void ath12k_dp_rx_h_mpdu(struct ath12k *ar, + spin_lock_bh(&ar->ab->base_lock); + peer = ath12k_dp_rx_h_find_peer(ar->ab, msdu, rx_info); + if (peer) { ++ /* resetting mcbc bit because mcbc packets are unicast ++ * packets only for AP as STA sends unicast packets. ++ */ ++ rxcb->is_mcbc = rxcb->is_mcbc && !peer->ucast_ra_only; ++ + if (rxcb->is_mcbc) + enctype = peer->sec_type_grp; + else +diff --git a/drivers/net/wireless/ath/ath12k/peer.c b/drivers/net/wireless/ath/ath12k/peer.c +index 792cca8a3fb1b..ec7236bbccc0f 100644 +--- a/drivers/net/wireless/ath/ath12k/peer.c ++++ b/drivers/net/wireless/ath/ath12k/peer.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: BSD-3-Clause-Clear + /* + * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved. +- * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2021-2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #include "core.h" +@@ -383,6 +383,9 @@ int ath12k_peer_create(struct ath12k *ar, struct ath12k_link_vif *arvif, + arvif->ast_idx = peer->hw_peer_id; + } + ++ if (vif->type == NL80211_IFTYPE_AP) ++ peer->ucast_ra_only = true; ++ + if (sta) { + ahsta = ath12k_sta_to_ahsta(sta); + arsta = wiphy_dereference(ath12k_ar_to_hw(ar)->wiphy, +diff --git a/drivers/net/wireless/ath/ath12k/peer.h b/drivers/net/wireless/ath/ath12k/peer.h +index 5870ee11a8c7e..f3a5e054d2b55 100644 +--- a/drivers/net/wireless/ath/ath12k/peer.h ++++ b/drivers/net/wireless/ath/ath12k/peer.h +@@ -1,7 +1,7 @@ + /* SPDX-License-Identifier: BSD-3-Clause-Clear */ + /* + * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved. +- * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #ifndef ATH12K_PEER_H +@@ -62,6 +62,7 @@ struct ath12k_peer { + + /* for reference to ath12k_link_sta */ + u8 link_id; ++ bool ucast_ra_only; + }; + + struct ath12k_ml_peer { +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-fix-a-possible-dead-lock-caused-by-ab-ba.patch b/queue-6.15/wifi-ath12k-fix-a-possible-dead-lock-caused-by-ab-ba.patch new file mode 100644 index 0000000000..5f5e3afef0 --- /dev/null +++ b/queue-6.15/wifi-ath12k-fix-a-possible-dead-lock-caused-by-ab-ba.patch @@ -0,0 +1,56 @@ +From 32bc5072bb970ce4a7ccf56851c7122cd9065ad6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Apr 2025 10:55:34 +0800 +Subject: wifi: ath12k: fix a possible dead lock caused by ab->base_lock + +From: Baochen Qiang + +[ Upstream commit ef115c265a21e3c11deee7f73bd1061775a7bf20 ] + +spin_lock/spin_unlock are used in ath12k_reg_chan_list_event +to acquire/release ab->base_lock. For now this is safe because +that function is only called in soft IRQ context. + +But ath12k_reg_chan_list_event() will be called from process +context in an upcoming patch, and this can result in a deadlock +if ab->base_lock is acquired in process context and then soft +IRQ occurs on the same CPU and tries to acquire that lock. + +Fix it by using spin_lock_bh and spin_unlock_bh instead. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Signed-off-by: Baochen Qiang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250418-ath12k-6g-lp-vlp-v1-1-c869c86cad60@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index fe50c3d3cb820..22f21ecc8f235 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -6019,7 +6019,7 @@ static int ath12k_reg_chan_list_event(struct ath12k_base *ab, struct sk_buff *sk + goto fallback; + } + +- spin_lock(&ab->base_lock); ++ spin_lock_bh(&ab->base_lock); + if (test_bit(ATH12K_FLAG_REGISTERED, &ab->dev_flags)) { + /* Once mac is registered, ar is valid and all CC events from + * fw is considered to be received due to user requests +@@ -6043,7 +6043,7 @@ static int ath12k_reg_chan_list_event(struct ath12k_base *ab, struct sk_buff *sk + ab->default_regd[pdev_idx] = regd; + } + ab->dfs_region = reg_info->dfs_region; +- spin_unlock(&ab->base_lock); ++ spin_unlock_bh(&ab->base_lock); + + goto mem_free; + +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-fix-failed-to-set-mhi-state-error-during.patch b/queue-6.15/wifi-ath12k-fix-failed-to-set-mhi-state-error-during.patch new file mode 100644 index 0000000000..4c239e3f0f --- /dev/null +++ b/queue-6.15/wifi-ath12k-fix-failed-to-set-mhi-state-error-during.patch @@ -0,0 +1,61 @@ +From 4a10da4c93dfaeecfb4057b16664b177b489c81f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 11:36:31 +0530 +Subject: wifi: ath12k: fix failed to set mhi state error during reboot with + hardware grouping + +From: Aditya Kumar Singh + +[ Upstream commit dce7aec6b1f74b0a46b901ab8de1f7bd0515f733 ] + +With hardware grouping, during reboot, whenever a device is removed, it +powers down itself and all its partner devices in the same group. Now this +is done by all devices and hence there is multiple power down for devices +and hence the following error messages can be seen: + +ath12k_pci 0002:01:00.0: failed to set mhi state POWER_OFF(3) in current mhi state (0x0) +ath12k_pci 0002:01:00.0: failed to set mhi state: POWER_OFF(3) +ath12k_pci 0002:01:00.0: failed to set mhi state DEINIT(1) in current mhi state (0x0) +ath12k_pci 0002:01:00.0: failed to set mhi state: DEINIT(1) +ath12k_pci 0003:01:00.0: failed to set mhi state POWER_OFF(3) in current mhi state (0x0) +ath12k_pci 0003:01:00.0: failed to set mhi state: POWER_OFF(3) +ath12k_pci 0003:01:00.0: failed to set mhi state DEINIT(1) in current mhi state (0x0) +ath12k_pci 0003:01:00.0: failed to set mhi state: DEINIT(1) +ath12k_pci 0004:01:00.0: failed to set mhi state POWER_OFF(3) in current mhi state (0x0) +ath12k_pci 0004:01:00.0: failed to set mhi state: POWER_OFF(3) + +To prevent this, check if the ATH12K_PCI_FLAG_INIT_DONE flag is already +set before powering down. If it is set, it indicates that another partner +device has already performed the power down, and this device can skip this +step. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Signed-off-by: Aditya Kumar Singh +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250408-fix_reboot_issues_with_hw_grouping-v4-3-95e7bf048595@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c +index 2e7d302ace679..9289910887217 100644 +--- a/drivers/net/wireless/ath/ath12k/pci.c ++++ b/drivers/net/wireless/ath/ath12k/pci.c +@@ -1491,6 +1491,9 @@ void ath12k_pci_power_down(struct ath12k_base *ab, bool is_suspend) + { + struct ath12k_pci *ab_pci = ath12k_pci_priv(ab); + ++ if (!test_bit(ATH12K_PCI_FLAG_INIT_DONE, &ab_pci->flags)) ++ return; ++ + /* restore aspm in case firmware bootup fails */ + ath12k_pci_aspm_restore(ab_pci); + +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-fix-incorrect-ce-addresses.patch b/queue-6.15/wifi-ath12k-fix-incorrect-ce-addresses.patch new file mode 100644 index 0000000000..1d92ae664a --- /dev/null +++ b/queue-6.15/wifi-ath12k-fix-incorrect-ce-addresses.patch @@ -0,0 +1,57 @@ +From 0eba798a5156b1360510dd201274ded530b3b469 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Mar 2025 16:22:39 +0530 +Subject: wifi: ath12k: fix incorrect CE addresses + +From: Balamurugan S + +[ Upstream commit 60031d9c3589c7983fd1deb4a4c0bebf0929890e ] + +In the current ath12k implementation, the CE addresses +CE_HOST_IE_ADDRESS and CE_HOST_IE_2_ADDRESS are incorrect. These +values were inherited from ath11k, but ath12k does not currently use +them. + +However, the Ath12k AHB support relies on these addresses. Therefore, +correct the CE addresses for ath12k. + +Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.3.1-00130-QCAHKSWPL_SILICONZ-1 +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00210-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Balamurugan S +Reviewed-by: Vasanthakumar Thiagarajan +Signed-off-by: Raj Kumar Bhagat +Link: https://patch.msgid.link/20250321-ath12k-ahb-v12-2-bb389ed76ae5@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/ce.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/ce.h b/drivers/net/wireless/ath/ath12k/ce.h +index 1a14b9fb86b88..f85188af5de2f 100644 +--- a/drivers/net/wireless/ath/ath12k/ce.h ++++ b/drivers/net/wireless/ath/ath12k/ce.h +@@ -1,7 +1,7 @@ + /* SPDX-License-Identifier: BSD-3-Clause-Clear */ + /* + * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved. +- * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2021-2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #ifndef ATH12K_CE_H +@@ -39,8 +39,8 @@ + #define PIPEDIR_INOUT_H2H 4 /* bidirectional, host to host */ + + /* CE address/mask */ +-#define CE_HOST_IE_ADDRESS 0x00A1803C +-#define CE_HOST_IE_2_ADDRESS 0x00A18040 ++#define CE_HOST_IE_ADDRESS 0x75804C ++#define CE_HOST_IE_2_ADDRESS 0x758050 + #define CE_HOST_IE_3_ADDRESS CE_HOST_IE_ADDRESS + + #define CE_HOST_IE_3_SHIFT 0xC +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-fix-incorrect-rates-sent-to-firmware.patch b/queue-6.15/wifi-ath12k-fix-incorrect-rates-sent-to-firmware.patch new file mode 100644 index 0000000000..d60bb59c59 --- /dev/null +++ b/queue-6.15/wifi-ath12k-fix-incorrect-rates-sent-to-firmware.patch @@ -0,0 +1,68 @@ +From cd967c728b6194f3f145b9e99f644a2fa672f84b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Mar 2025 16:54:26 +0530 +Subject: wifi: ath12k: Fix incorrect rates sent to firmware + +From: Pradeep Kumar Chitrapu + +[ Upstream commit cb1790249361ba9396b06b1af2500147e6e42e5e ] + +Before firmware assert, if there is a station interface in the device +which is not associated with an AP, the basic rates are set to zero. +Following this, during firmware recovery, when basic rates are zero, +ath12k driver is sending invalid rate codes, which are negative values, +to firmware. This results in firmware assert. + +Fix this by checking if rate codes are valid, before sending them +to the firmware. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Pradeep Kumar Chitrapu +Signed-off-by: Roopni Devanathan +Reviewed-by: Vasanthakumar Thiagarajan +Reviewed-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250320112426.1956961-1-quic_rdevanat@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index eac4214c48c39..922901bab3e39 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -3451,7 +3451,10 @@ static void ath12k_recalculate_mgmt_rate(struct ath12k *ar, + } + + sband = hw->wiphy->bands[def->chan->band]; +- basic_rate_idx = ffs(bss_conf->basic_rates) - 1; ++ if (bss_conf->basic_rates) ++ basic_rate_idx = __ffs(bss_conf->basic_rates); ++ else ++ basic_rate_idx = 0; + bitrate = sband->bitrates[basic_rate_idx].bitrate; + + hw_rate_code = ath12k_mac_get_rate_hw_value(bitrate); +@@ -4015,10 +4018,14 @@ static void ath12k_mac_bss_info_changed(struct ath12k *ar, + band = def.chan->band; + mcast_rate = info->mcast_rate[band]; + +- if (mcast_rate > 0) ++ if (mcast_rate > 0) { + rateidx = mcast_rate - 1; +- else +- rateidx = ffs(info->basic_rates) - 1; ++ } else { ++ if (info->basic_rates) ++ rateidx = __ffs(info->basic_rates); ++ else ++ rateidx = 0; ++ } + + if (ar->pdev->cap.supported_bands & WMI_HOST_WLAN_5GHZ_CAP) + rateidx += ATH12K_MAC_FIRST_OFDM_RATE_IDX; +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-fix-link-valid-field-initialization-in-t.patch b/queue-6.15/wifi-ath12k-fix-link-valid-field-initialization-in-t.patch new file mode 100644 index 0000000000..a793f6288d --- /dev/null +++ b/queue-6.15/wifi-ath12k-fix-link-valid-field-initialization-in-t.patch @@ -0,0 +1,44 @@ +From 1b0d21ceb3ad2968f5a2dbfd917445b6be58b443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Mar 2025 11:55:09 +0530 +Subject: wifi: ath12k: fix link valid field initialization in the monitor Rx + +From: Hari Chandrakanthan + +[ Upstream commit 2826139f9295821fe2b049318a1cc057ec003131 ] + +Currently, the link_valid field is not initialized in the monitor Rx path. +This can result in random values for the link_valid and link_id leads to +undefined behaviour in mac80211. Therefore, initialize the link_valid +field in the monitor Rx path. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Signed-off-by: Hari Chandrakanthan +Tested-by: Nicolas Escande +Reviewed-by: Vasanthakumar Thiagarajan +Signed-off-by: Karthikeyan Periyasamy +Link: https://patch.msgid.link/20250324062518.2752822-2-quic_periyasa@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_mon.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c +index 600d97169f241..826c9723a7a68 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_mon.c ++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c +@@ -2097,6 +2097,8 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct + bool is_mcbc = rxcb->is_mcbc; + bool is_eapol_tkip = rxcb->is_eapol; + ++ status->link_valid = 0; ++ + if ((status->encoding == RX_ENC_HE) && !(status->flag & RX_FLAG_RADIOTAP_HE) && + !(status->flag & RX_FLAG_SKIP_MONITOR)) { + he = skb_push(msdu, sizeof(known)); +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-fix-macro-definition-hal_rx_msdu_pkt_len.patch b/queue-6.15/wifi-ath12k-fix-macro-definition-hal_rx_msdu_pkt_len.patch new file mode 100644 index 0000000000..b8da9e30f2 --- /dev/null +++ b/queue-6.15/wifi-ath12k-fix-macro-definition-hal_rx_msdu_pkt_len.patch @@ -0,0 +1,44 @@ +From 542d4aa1b800a773177b9d737ccd3e9aa4b1679c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 10:34:39 +0800 +Subject: wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET + +From: Kang Yang + +[ Upstream commit a69bbf89d751ba2d6da21d773c4e29c91c5e53c4 ] + +Currently, HAL_RX_MSDU_PKT_LENGTH_GET uses u32_get_bits to obtain the +MSDU length from the MSDU description. + +This is not right. Because all halphy descriptions are little endian. + +So use le32_get_bits for HAL_RX_MSDU_PKT_LENGTH_GET. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Kang Yang +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250421023444.1778-9-kang.yang@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/hal_desc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/hal_desc.h b/drivers/net/wireless/ath/ath12k/hal_desc.h +index 63d279fab3224..f8a51aa0217a8 100644 +--- a/drivers/net/wireless/ath/ath12k/hal_desc.h ++++ b/drivers/net/wireless/ath/ath12k/hal_desc.h +@@ -707,7 +707,7 @@ enum hal_rx_msdu_desc_reo_dest_ind { + #define RX_MSDU_DESC_INFO0_DECAP_FORMAT GENMASK(30, 29) + + #define HAL_RX_MSDU_PKT_LENGTH_GET(val) \ +- (u32_get_bits((val), RX_MSDU_DESC_INFO0_MSDU_LENGTH)) ++ (le32_get_bits((val), RX_MSDU_DESC_INFO0_MSDU_LENGTH)) + + struct rx_msdu_desc { + __le32 info0; +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-fix-memory-leak-due-to-multiple-rx_stats.patch b/queue-6.15/wifi-ath12k-fix-memory-leak-due-to-multiple-rx_stats.patch new file mode 100644 index 0000000000..4c4b4cce71 --- /dev/null +++ b/queue-6.15/wifi-ath12k-fix-memory-leak-due-to-multiple-rx_stats.patch @@ -0,0 +1,59 @@ +From 2a0a5923efc820a630cd1b2bd647c6083a3dfb88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Mar 2025 14:35:38 -0700 +Subject: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation + +From: Sidhanta Sahu + +[ Upstream commit c426497fa2055c8005196922e7d29c41d7e0948a ] + +rx_stats for each arsta is allocated when adding a station. +arsta->rx_stats will be freed when a station is removed. + +Redundant allocations are occurring when the same station is added +multiple times. This causes ath12k_mac_station_add() to be called +multiple times, and rx_stats is allocated each time. As a result there +is memory leaks. + +Prevent multiple allocations of rx_stats when ath12k_mac_station_add() +is called repeatedly by checking if rx_stats is already allocated +before allocating again. Allocate arsta->rx_stats if arsta->rx_stats +is NULL respectively. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Signed-off-by: Sidhanta Sahu +Signed-off-by: Muna Sinada +Reviewed-by: Mahendran P +Link: https://patch.msgid.link/20250326213538.2214194-1-muna.sinada@oss.qualcomm.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index 922901bab3e39..d1d3c9f34372d 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -5560,10 +5560,13 @@ static int ath12k_mac_station_add(struct ath12k *ar, + ar->max_num_stations); + goto exit; + } +- arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL); ++ + if (!arsta->rx_stats) { +- ret = -ENOMEM; +- goto dec_num_station; ++ arsta->rx_stats = kzalloc(sizeof(*arsta->rx_stats), GFP_KERNEL); ++ if (!arsta->rx_stats) { ++ ret = -ENOMEM; ++ goto dec_num_station; ++ } + } + + peer_param.vdev_id = arvif->vdev_id; +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-fix-the-enabling-of-reo-queue-lookup-tab.patch b/queue-6.15/wifi-ath12k-fix-the-enabling-of-reo-queue-lookup-tab.patch new file mode 100644 index 0000000000..8e22a3dcaf --- /dev/null +++ b/queue-6.15/wifi-ath12k-fix-the-enabling-of-reo-queue-lookup-tab.patch @@ -0,0 +1,308 @@ +From 320dd96df9142119c2538c497f56eadb4fe31fe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 20:55:27 +0530 +Subject: wifi: ath12k: Fix the enabling of REO queue lookup table feature + +From: Sriram R + +[ Upstream commit 0bbcd42b15fa730f393a01bc818802d9f0b04197 ] + +Instead of storing the REO queue address inside peer entries, REO +hardware module prefers them to be stored in SRAM which could be +directly accessed by REO using peer_ID/TID based lookup table +mechanism. + +Fix the enabling of the REO queue lookup table(LUT) feature by +configuring the LUT address information in the REO hardware register +and setting the host service flags. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Sriram R +Signed-off-by: Nithyanantham Paramasivam +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250402152529.1649402-2-quic_nithp@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp.c | 77 +++++++++++++++++-------- + drivers/net/wireless/ath/ath12k/dp.h | 5 +- + drivers/net/wireless/ath/ath12k/dp_rx.c | 10 +++- + drivers/net/wireless/ath/ath12k/hal.h | 6 ++ + drivers/net/wireless/ath/ath12k/hw.c | 2 + + drivers/net/wireless/ath/ath12k/hw.h | 3 + + drivers/net/wireless/ath/ath12k/wmi.c | 8 ++- + drivers/net/wireless/ath/ath12k/wmi.h | 1 + + 8 files changed, 83 insertions(+), 29 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c +index 50c36e6ea1027..34e1bd2934ce3 100644 +--- a/drivers/net/wireless/ath/ath12k/dp.c ++++ b/drivers/net/wireless/ath/ath12k/dp.c +@@ -1261,22 +1261,24 @@ static void ath12k_dp_reoq_lut_cleanup(struct ath12k_base *ab) + if (!ab->hw_params->reoq_lut_support) + return; + +- if (dp->reoq_lut.vaddr) { ++ if (dp->reoq_lut.vaddr_unaligned) { + ath12k_hif_write32(ab, + HAL_SEQ_WCSS_UMAC_REO_REG + + HAL_REO1_QDESC_LUT_BASE0(ab), 0); +- dma_free_coherent(ab->dev, DP_REOQ_LUT_SIZE, +- dp->reoq_lut.vaddr, dp->reoq_lut.paddr); +- dp->reoq_lut.vaddr = NULL; ++ dma_free_coherent(ab->dev, dp->reoq_lut.size, ++ dp->reoq_lut.vaddr_unaligned, ++ dp->reoq_lut.paddr_unaligned); ++ dp->reoq_lut.vaddr_unaligned = NULL; + } + +- if (dp->ml_reoq_lut.vaddr) { ++ if (dp->ml_reoq_lut.vaddr_unaligned) { + ath12k_hif_write32(ab, + HAL_SEQ_WCSS_UMAC_REO_REG + + HAL_REO1_QDESC_LUT_BASE1(ab), 0); +- dma_free_coherent(ab->dev, DP_REOQ_LUT_SIZE, +- dp->ml_reoq_lut.vaddr, dp->ml_reoq_lut.paddr); +- dp->ml_reoq_lut.vaddr = NULL; ++ dma_free_coherent(ab->dev, dp->ml_reoq_lut.size, ++ dp->ml_reoq_lut.vaddr_unaligned, ++ dp->ml_reoq_lut.paddr_unaligned); ++ dp->ml_reoq_lut.vaddr_unaligned = NULL; + } + } + +@@ -1608,39 +1610,66 @@ static int ath12k_dp_cc_init(struct ath12k_base *ab) + return ret; + } + ++static int ath12k_dp_alloc_reoq_lut(struct ath12k_base *ab, ++ struct ath12k_reo_q_addr_lut *lut) ++{ ++ lut->size = DP_REOQ_LUT_SIZE + HAL_REO_QLUT_ADDR_ALIGN - 1; ++ lut->vaddr_unaligned = dma_alloc_coherent(ab->dev, lut->size, ++ &lut->paddr_unaligned, ++ GFP_KERNEL | __GFP_ZERO); ++ if (!lut->vaddr_unaligned) ++ return -ENOMEM; ++ ++ lut->vaddr = PTR_ALIGN(lut->vaddr_unaligned, HAL_REO_QLUT_ADDR_ALIGN); ++ lut->paddr = lut->paddr_unaligned + ++ ((unsigned long)lut->vaddr - (unsigned long)lut->vaddr_unaligned); ++ return 0; ++} ++ + static int ath12k_dp_reoq_lut_setup(struct ath12k_base *ab) + { + struct ath12k_dp *dp = &ab->dp; ++ u32 val; ++ int ret; + + if (!ab->hw_params->reoq_lut_support) + return 0; + +- dp->reoq_lut.vaddr = dma_alloc_coherent(ab->dev, +- DP_REOQ_LUT_SIZE, +- &dp->reoq_lut.paddr, +- GFP_KERNEL | __GFP_ZERO); +- if (!dp->reoq_lut.vaddr) { ++ ret = ath12k_dp_alloc_reoq_lut(ab, &dp->reoq_lut); ++ if (ret) { + ath12k_warn(ab, "failed to allocate memory for reoq table"); +- return -ENOMEM; ++ return ret; + } + +- dp->ml_reoq_lut.vaddr = dma_alloc_coherent(ab->dev, +- DP_REOQ_LUT_SIZE, +- &dp->ml_reoq_lut.paddr, +- GFP_KERNEL | __GFP_ZERO); +- if (!dp->ml_reoq_lut.vaddr) { ++ ret = ath12k_dp_alloc_reoq_lut(ab, &dp->ml_reoq_lut); ++ if (ret) { + ath12k_warn(ab, "failed to allocate memory for ML reoq table"); +- dma_free_coherent(ab->dev, DP_REOQ_LUT_SIZE, +- dp->reoq_lut.vaddr, dp->reoq_lut.paddr); +- dp->reoq_lut.vaddr = NULL; +- return -ENOMEM; ++ dma_free_coherent(ab->dev, dp->reoq_lut.size, ++ dp->reoq_lut.vaddr_unaligned, ++ dp->reoq_lut.paddr_unaligned); ++ dp->reoq_lut.vaddr_unaligned = NULL; ++ return ret; + } + ++ /* Bits in the register have address [39:8] LUT base address to be ++ * allocated such that LSBs are assumed to be zero. Also, current ++ * design supports paddr upto 4 GB max hence it fits in 32 bit register only ++ */ ++ + ath12k_hif_write32(ab, HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO1_QDESC_LUT_BASE0(ab), +- dp->reoq_lut.paddr); ++ dp->reoq_lut.paddr >> 8); ++ + ath12k_hif_write32(ab, HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO1_QDESC_LUT_BASE1(ab), + dp->ml_reoq_lut.paddr >> 8); + ++ val = ath12k_hif_read32(ab, HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO1_QDESC_ADDR(ab)); ++ ++ ath12k_hif_write32(ab, HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO1_QDESC_ADDR(ab), ++ val | HAL_REO_QDESC_ADDR_READ_LUT_ENABLE); ++ ++ ath12k_hif_write32(ab, HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO1_QDESC_MAX_PEERID(ab), ++ HAL_REO_QDESC_MAX_PEERID); ++ + return 0; + } + +diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h +index 427a87b63dec3..e8dbba0c3bb7d 100644 +--- a/drivers/net/wireless/ath/ath12k/dp.h ++++ b/drivers/net/wireless/ath/ath12k/dp.h +@@ -311,8 +311,11 @@ struct ath12k_reo_queue_ref { + } __packed; + + struct ath12k_reo_q_addr_lut { +- dma_addr_t paddr; ++ u32 *vaddr_unaligned; + u32 *vaddr; ++ dma_addr_t paddr_unaligned; ++ dma_addr_t paddr; ++ u32 size; + }; + + struct ath12k_dp { +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index 8b1b038d67667..cc5a23a46ea15 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -3255,8 +3255,14 @@ static int ath12k_dp_rx_h_defrag_reo_reinject(struct ath12k *ar, + reo_ent_ring->rx_mpdu_info.peer_meta_data = + reo_dest_ring->rx_mpdu_info.peer_meta_data; + +- reo_ent_ring->queue_addr_lo = cpu_to_le32(lower_32_bits(rx_tid->paddr)); +- queue_addr_hi = upper_32_bits(rx_tid->paddr); ++ if (ab->hw_params->reoq_lut_support) { ++ reo_ent_ring->queue_addr_lo = reo_dest_ring->rx_mpdu_info.peer_meta_data; ++ queue_addr_hi = 0; ++ } else { ++ reo_ent_ring->queue_addr_lo = cpu_to_le32(lower_32_bits(rx_tid->paddr)); ++ queue_addr_hi = upper_32_bits(rx_tid->paddr); ++ } ++ + reo_ent_ring->info0 = le32_encode_bits(queue_addr_hi, + HAL_REO_ENTR_RING_INFO0_QUEUE_ADDR_HI) | + le32_encode_bits(dst_ind, +diff --git a/drivers/net/wireless/ath/ath12k/hal.h b/drivers/net/wireless/ath/ath12k/hal.h +index c8205672cd3dd..cb8530dfdd911 100644 +--- a/drivers/net/wireless/ath/ath12k/hal.h ++++ b/drivers/net/wireless/ath/ath12k/hal.h +@@ -21,6 +21,7 @@ struct ath12k_base; + #define HAL_MAX_AVAIL_BLK_RES 3 + + #define HAL_RING_BASE_ALIGN 8 ++#define HAL_REO_QLUT_ADDR_ALIGN 256 + + #define HAL_WBM_IDLE_SCATTER_BUF_SIZE_MAX 32704 + /* TODO: Check with hw team on the supported scatter buf size */ +@@ -39,6 +40,7 @@ struct ath12k_base; + #define HAL_OFFSET_FROM_HP_TO_TP 4 + + #define HAL_SHADOW_REG(x) (HAL_SHADOW_BASE_ADDR + (4 * (x))) ++#define HAL_REO_QDESC_MAX_PEERID 8191 + + /* WCSS Relative address */ + #define HAL_SEQ_WCSS_UMAC_OFFSET 0x00a00000 +@@ -139,6 +141,8 @@ struct ath12k_base; + #define HAL_REO1_DEST_RING_CTRL_IX_1 0x00000008 + #define HAL_REO1_DEST_RING_CTRL_IX_2 0x0000000c + #define HAL_REO1_DEST_RING_CTRL_IX_3 0x00000010 ++#define HAL_REO1_QDESC_ADDR(ab) ((ab)->hw_params->regs->hal_reo1_qdesc_addr) ++#define HAL_REO1_QDESC_MAX_PEERID(ab) ((ab)->hw_params->regs->hal_reo1_qdesc_max_peerid) + #define HAL_REO1_SW_COOKIE_CFG0(ab) ((ab)->hw_params->regs->hal_reo1_sw_cookie_cfg0) + #define HAL_REO1_SW_COOKIE_CFG1(ab) ((ab)->hw_params->regs->hal_reo1_sw_cookie_cfg1) + #define HAL_REO1_QDESC_LUT_BASE0(ab) ((ab)->hw_params->regs->hal_reo1_qdesc_lut_base0) +@@ -326,6 +330,8 @@ struct ath12k_base; + #define HAL_REO1_SW_COOKIE_CFG_ALIGN BIT(18) + #define HAL_REO1_SW_COOKIE_CFG_ENABLE BIT(19) + #define HAL_REO1_SW_COOKIE_CFG_GLOBAL_ENABLE BIT(20) ++#define HAL_REO_QDESC_ADDR_READ_LUT_ENABLE BIT(7) ++#define HAL_REO_QDESC_ADDR_READ_CLEAR_QDESC_ARRAY BIT(6) + + /* CE ring bit field mask and shift */ + #define HAL_CE_DST_R0_DEST_CTRL_MAX_LEN GENMASK(15, 0) +diff --git a/drivers/net/wireless/ath/ath12k/hw.c b/drivers/net/wireless/ath/ath12k/hw.c +index 1bfb11bae7add..a5fa3b6a831ae 100644 +--- a/drivers/net/wireless/ath/ath12k/hw.c ++++ b/drivers/net/wireless/ath/ath12k/hw.c +@@ -748,6 +748,8 @@ static const struct ath12k_hw_regs qcn9274_v2_regs = { + .hal_reo1_sw_cookie_cfg1 = 0x00000070, + .hal_reo1_qdesc_lut_base0 = 0x00000074, + .hal_reo1_qdesc_lut_base1 = 0x00000078, ++ .hal_reo1_qdesc_addr = 0x0000007c, ++ .hal_reo1_qdesc_max_peerid = 0x00000088, + .hal_reo1_ring_base_lsb = 0x00000500, + .hal_reo1_ring_base_msb = 0x00000504, + .hal_reo1_ring_id = 0x00000508, +diff --git a/drivers/net/wireless/ath/ath12k/hw.h b/drivers/net/wireless/ath/ath12k/hw.h +index 862b11325a902..e1ad03daebcd4 100644 +--- a/drivers/net/wireless/ath/ath12k/hw.h ++++ b/drivers/net/wireless/ath/ath12k/hw.h +@@ -299,6 +299,9 @@ struct ath12k_hw_regs { + + u32 hal_tcl_status_ring_base_lsb; + ++ u32 hal_reo1_qdesc_addr; ++ u32 hal_reo1_qdesc_max_peerid; ++ + u32 hal_wbm_idle_ring_base_lsb; + u32 hal_wbm_idle_ring_misc_addr; + u32 hal_wbm_r0_idle_list_cntl_addr; +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 22f21ecc8f235..56b2feb4ffe05 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -3665,7 +3665,8 @@ ath12k_fill_band_to_mac_param(struct ath12k_base *soc, + } + + static void +-ath12k_wmi_copy_resource_config(struct ath12k_wmi_resource_config_params *wmi_cfg, ++ath12k_wmi_copy_resource_config(struct ath12k_base *ab, ++ struct ath12k_wmi_resource_config_params *wmi_cfg, + struct ath12k_wmi_resource_config_arg *tg_cfg) + { + wmi_cfg->num_vdevs = cpu_to_le32(tg_cfg->num_vdevs); +@@ -3732,6 +3733,9 @@ ath12k_wmi_copy_resource_config(struct ath12k_wmi_resource_config_params *wmi_cf + WMI_RSRC_CFG_FLAGS2_RX_PEER_METADATA_VERSION); + wmi_cfg->host_service_flags = cpu_to_le32(tg_cfg->is_reg_cc_ext_event_supported << + WMI_RSRC_CFG_HOST_SVC_FLAG_REG_CC_EXT_SUPPORT_BIT); ++ if (ab->hw_params->reoq_lut_support) ++ wmi_cfg->host_service_flags |= ++ cpu_to_le32(1 << WMI_RSRC_CFG_HOST_SVC_FLAG_REO_QREF_SUPPORT_BIT); + wmi_cfg->ema_max_vap_cnt = cpu_to_le32(tg_cfg->ema_max_vap_cnt); + wmi_cfg->ema_max_profile_period = cpu_to_le32(tg_cfg->ema_max_profile_period); + wmi_cfg->flags2 |= cpu_to_le32(WMI_RSRC_CFG_FLAGS2_CALC_NEXT_DTIM_COUNT_SET); +@@ -3772,7 +3776,7 @@ static int ath12k_init_cmd_send(struct ath12k_wmi_pdev *wmi, + ptr = skb->data + sizeof(*cmd); + cfg = ptr; + +- ath12k_wmi_copy_resource_config(cfg, &arg->res_cfg); ++ ath12k_wmi_copy_resource_config(ab, cfg, &arg->res_cfg); + + cfg->tlv_header = ath12k_wmi_tlv_cmd_hdr(WMI_TAG_RESOURCE_CONFIG, + sizeof(*cfg)); +diff --git a/drivers/net/wireless/ath/ath12k/wmi.h b/drivers/net/wireless/ath/ath12k/wmi.h +index be4ac91dd34f5..bd7312f3cf24a 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.h ++++ b/drivers/net/wireless/ath/ath12k/wmi.h +@@ -2461,6 +2461,7 @@ struct wmi_init_cmd { + } __packed; + + #define WMI_RSRC_CFG_HOST_SVC_FLAG_REG_CC_EXT_SUPPORT_BIT 4 ++#define WMI_RSRC_CFG_HOST_SVC_FLAG_REO_QREF_SUPPORT_BIT 12 + #define WMI_RSRC_CFG_FLAGS2_RX_PEER_METADATA_VERSION GENMASK(5, 4) + #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5) + #define WMI_RSRC_CFG_FLAGS2_CALC_NEXT_DTIM_COUNT_SET BIT(9) +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-make-assoc-link-associate-first.patch b/queue-6.15/wifi-ath12k-make-assoc-link-associate-first.patch new file mode 100644 index 0000000000..2f31995b01 --- /dev/null +++ b/queue-6.15/wifi-ath12k-make-assoc-link-associate-first.patch @@ -0,0 +1,81 @@ +From 10861bd217fda28e12201b66d10c99bfe5a8c949 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 10:26:38 +0800 +Subject: wifi: ath12k: make assoc link associate first + +From: Baochen Qiang + +[ Upstream commit ead6d41116b81098061c878d9bfc0b1a6c629090 ] + +In MLO scenario WCN7850 firmware requests the assoc link to associate +before any other links. However currently in +ath12k_mac_op_vif_cfg_changed() we are doing association in an ascending +order of link id. If the assoc link does not get assigned the smallest +id, a non-assoc link gets associated first and firmware crashes. + +Change to do association for the assoc link first. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00209-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Baochen Qiang +Link: https://patch.msgid.link/20250409-ath12k-wcn7850-mlo-support-v2-5-3801132ca2c3@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 31 +++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index 331bcf5e6c4cc..eac4214c48c39 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -3703,6 +3703,8 @@ static void ath12k_mac_op_vif_cfg_changed(struct ieee80211_hw *hw, + unsigned long links = ahvif->links_map; + struct ieee80211_bss_conf *info; + struct ath12k_link_vif *arvif; ++ struct ieee80211_sta *sta; ++ struct ath12k_sta *ahsta; + struct ath12k *ar; + u8 link_id; + +@@ -3715,6 +3717,35 @@ static void ath12k_mac_op_vif_cfg_changed(struct ieee80211_hw *hw, + } + + if (changed & BSS_CHANGED_ASSOC) { ++ if (vif->cfg.assoc) { ++ /* only in station mode we can get here, so it's safe ++ * to use ap_addr ++ */ ++ rcu_read_lock(); ++ sta = ieee80211_find_sta(vif, vif->cfg.ap_addr); ++ if (!sta) { ++ rcu_read_unlock(); ++ WARN_ONCE(1, "failed to find sta with addr %pM\n", ++ vif->cfg.ap_addr); ++ return; ++ } ++ ++ ahsta = ath12k_sta_to_ahsta(sta); ++ arvif = wiphy_dereference(hw->wiphy, ++ ahvif->link[ahsta->assoc_link_id]); ++ rcu_read_unlock(); ++ ++ ar = arvif->ar; ++ /* there is no reason for which an assoc link's ++ * bss info does not exist ++ */ ++ info = ath12k_mac_get_link_bss_conf(arvif); ++ ath12k_bss_assoc(ar, arvif, info); ++ ++ /* exclude assoc link as it is done above */ ++ links &= ~BIT(ahsta->assoc_link_id); ++ } ++ + for_each_set_bit(link_id, &links, IEEE80211_MLD_MAX_NUM_LINKS) { + arvif = wiphy_dereference(hw->wiphy, ahvif->link[link_id]); + if (!arvif || !arvif->ar) +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-pass-correct-values-of-center-freq1-and-.patch b/queue-6.15/wifi-ath12k-pass-correct-values-of-center-freq1-and-.patch new file mode 100644 index 0000000000..0366761cbe --- /dev/null +++ b/queue-6.15/wifi-ath12k-pass-correct-values-of-center-freq1-and-.patch @@ -0,0 +1,63 @@ +From 4062863a8dae5c781d843e9d83b1b18f90820d0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Mar 2025 15:23:14 +0530 +Subject: wifi: ath12k: Pass correct values of center freq1 and center freq2 + for 160 MHz + +From: Suraj P Kizhakkethil + +[ Upstream commit b1b01e46a3db5ad44d1e4691ba37c1e0832cd5cf ] + +Currently, for 160 MHz bandwidth, center frequency1 and +center frequency2 are not passed correctly to the firmware. +Set center frequency1 as the center frequency +of the primary 80 MHz channel segment and center frequency2 as +the center frequency of the 160 MHz channel and pass the values +to the firmware. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Suraj P Kizhakkethil +Reviewed-by: Aditya Kumar Singh +Link: https://patch.msgid.link/20250304095315.3050325-2-quic_surapk@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 56b2feb4ffe05..a44fc9106634b 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -1037,14 +1037,24 @@ int ath12k_wmi_vdev_down(struct ath12k *ar, u8 vdev_id) + static void ath12k_wmi_put_wmi_channel(struct ath12k_wmi_channel_params *chan, + struct wmi_vdev_start_req_arg *arg) + { ++ u32 center_freq1 = arg->band_center_freq1; ++ + memset(chan, 0, sizeof(*chan)); + + chan->mhz = cpu_to_le32(arg->freq); +- chan->band_center_freq1 = cpu_to_le32(arg->band_center_freq1); +- if (arg->mode == MODE_11AC_VHT80_80) ++ chan->band_center_freq1 = cpu_to_le32(center_freq1); ++ if (arg->mode == MODE_11BE_EHT160) { ++ if (arg->freq > center_freq1) ++ chan->band_center_freq1 = cpu_to_le32(center_freq1 + 40); ++ else ++ chan->band_center_freq1 = cpu_to_le32(center_freq1 - 40); ++ ++ chan->band_center_freq2 = cpu_to_le32(center_freq1); ++ } else if (arg->mode == MODE_11BE_EHT80_80) { + chan->band_center_freq2 = cpu_to_le32(arg->band_center_freq2); +- else ++ } else { + chan->band_center_freq2 = 0; ++ } + + chan->info |= le32_encode_bits(arg->mode, WMI_CHAN_INFO_MODE); + if (arg->passive) +-- +2.39.5 + diff --git a/queue-6.15/wifi-ath12k-using-msdu-end-descriptor-to-check-for-r.patch b/queue-6.15/wifi-ath12k-using-msdu-end-descriptor-to-check-for-r.patch new file mode 100644 index 0000000000..56ac936b7c --- /dev/null +++ b/queue-6.15/wifi-ath12k-using-msdu-end-descriptor-to-check-for-r.patch @@ -0,0 +1,58 @@ +From 6431b6aafb3ad55b637454bf05175ea9d1d18da4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Apr 2025 11:45:22 +0530 +Subject: wifi: ath12k: using msdu end descriptor to check for rx multicast + packets + +From: Sarika Sharma + +[ Upstream commit cb7433cc5cd4d07175dbc41f5a19966e9fae48be ] + +Currently, the RX multicast broadcast packet check is performed using +bit 15 from the info6 field of the MPDU start descriptor. This check +can also be done using bit 9 from the info5 field of the MSDU end +descriptor. However, in some scenarios multicast bit is not set when +fetched from MPDU start descriptor. +Therefore, checking the RX multicast broadcast packet from the MSDU +end descriptor is more reliable as it is per MSDU. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Sarika Sharma +Reviewed-by: Vasanthakumar Thiagarajan +Link: https://patch.msgid.link/20250411061523.859387-2-quic_sarishar@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/hal.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c +index 49b4c5648aed3..faf74b5459410 100644 +--- a/drivers/net/wireless/ath/ath12k/hal.c ++++ b/drivers/net/wireless/ath/ath12k/hal.c +@@ -449,8 +449,8 @@ static u8 *ath12k_hw_qcn9274_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc) + + static bool ath12k_hw_qcn9274_rx_desc_is_da_mcbc(struct hal_rx_desc *desc) + { +- return __le32_to_cpu(desc->u.qcn9274.mpdu_start.info6) & +- RX_MPDU_START_INFO6_MCAST_BCAST; ++ return __le16_to_cpu(desc->u.qcn9274.msdu_end.info5) & ++ RX_MSDU_END_INFO5_DA_IS_MCBC; + } + + static void ath12k_hw_qcn9274_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc, +@@ -902,8 +902,8 @@ static u8 *ath12k_hw_qcn9274_compact_rx_desc_mpdu_start_addr2(struct hal_rx_desc + + static bool ath12k_hw_qcn9274_compact_rx_desc_is_da_mcbc(struct hal_rx_desc *desc) + { +- return __le32_to_cpu(desc->u.qcn9274_compact.mpdu_start.info6) & +- RX_MPDU_START_INFO6_MCAST_BCAST; ++ return __le16_to_cpu(desc->u.qcn9274_compact.msdu_end.info5) & ++ RX_MSDU_END_INFO5_DA_IS_MCBC; + } + + static void ath12k_hw_qcn9274_compact_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc, +-- +2.39.5 + diff --git a/queue-6.15/wifi-iwlwifi-add-missing-module_firmware-for-qu-c0-j.patch b/queue-6.15/wifi-iwlwifi-add-missing-module_firmware-for-qu-c0-j.patch new file mode 100644 index 0000000000..1288b62729 --- /dev/null +++ b/queue-6.15/wifi-iwlwifi-add-missing-module_firmware-for-qu-c0-j.patch @@ -0,0 +1,46 @@ +From 15d734dffb9a4c547b3b4f66d2c0117ffc68ee67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 20:02:27 +0200 +Subject: wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Víctor Gonzalo + +[ Upstream commit 2b801487ac3be7bec561ae62d1a6c4d6f5283f8c ] + +The module metadata for the firmware file iwlwifi-Qu-c0-jf-b0-* is missing. + +Signed-off-by: Víctor Gonzalo +Link: https://patch.msgid.link/20240313180227.2224780-1-victor.gonzalo@anddroptable.net +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c +index 130b9a8aa7ebe..67ee3b6e6d85c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c +@@ -44,6 +44,8 @@ + IWL_QU_C_HR_B_FW_PRE "-" __stringify(api) ".ucode" + #define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \ + IWL_QU_B_JF_B_FW_PRE "-" __stringify(api) ".ucode" ++#define IWL_QU_C_JF_B_MODULE_FIRMWARE(api) \ ++ IWL_QU_C_JF_B_FW_PRE "-" __stringify(api) ".ucode" + #define IWL_CC_A_MODULE_FIRMWARE(api) \ + IWL_CC_A_FW_PRE "-" __stringify(api) ".ucode" + +@@ -422,6 +424,7 @@ const struct iwl_cfg iwl_cfg_quz_a0_hr_b0 = { + MODULE_FIRMWARE(IWL_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_QU_C_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); ++MODULE_FIRMWARE(IWL_QU_C_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_QUZ_A_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_QUZ_A_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_CC_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); +-- +2.39.5 + diff --git a/queue-6.15/wifi-iwlwifi-dvm-pair-transport-op-mode-enter-leave.patch b/queue-6.15/wifi-iwlwifi-dvm-pair-transport-op-mode-enter-leave.patch new file mode 100644 index 0000000000..4d9a4a7216 --- /dev/null +++ b/queue-6.15/wifi-iwlwifi-dvm-pair-transport-op-mode-enter-leave.patch @@ -0,0 +1,53 @@ +From 33b9c223944180d7ef3aee98fa61f75f1c44df1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 May 2025 13:26:30 +0300 +Subject: wifi: iwlwifi: dvm: pair transport op-mode enter/leave + +From: Johannes Berg + +[ Upstream commit 6b340a694cee9e7a24b2be827c738b5b6cb13c84 ] + +If there's a failure and the op-mode didn't actually fully +initialize, it should leave the transport again. Fix that. + +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20250504132447.714c3517548b.I49557e7ba8c03be2b558cc9fb5efa2a9fbab890e@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/dvm/main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c +index a27a72cc017a3..a7f9e244c0975 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c +@@ -1382,14 +1382,14 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, + + err = iwl_trans_start_hw(priv->trans); + if (err) +- goto out_free_hw; ++ goto out_leave_trans; + + /* Read the EEPROM */ + err = iwl_read_eeprom(priv->trans, &priv->eeprom_blob, + &priv->eeprom_blob_size); + if (err) { + IWL_ERR(priv, "Unable to init EEPROM\n"); +- goto out_free_hw; ++ goto out_leave_trans; + } + + /* Reset chip to save power until we load uCode during "up". */ +@@ -1508,6 +1508,8 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, + kfree(priv->eeprom_blob); + out_free_eeprom: + kfree(priv->nvm_data); ++out_leave_trans: ++ iwl_trans_op_mode_leave(priv->trans); + out_free_hw: + ieee80211_free_hw(priv->hw); + out: +-- +2.39.5 + diff --git a/queue-6.15/wifi-iwlwifi-mld-call-thermal-exit-without-wiphy-loc.patch b/queue-6.15/wifi-iwlwifi-mld-call-thermal-exit-without-wiphy-loc.patch new file mode 100644 index 0000000000..4c219effc3 --- /dev/null +++ b/queue-6.15/wifi-iwlwifi-mld-call-thermal-exit-without-wiphy-loc.patch @@ -0,0 +1,74 @@ +From 549f98f7de75b226b7af4daff1185f91d832ce59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 May 2025 22:40:58 +0300 +Subject: wifi: iwlwifi: mld: call thermal exit without wiphy lock held + +From: Benjamin Berg + +[ Upstream commit 83128399f3b4926ab73ce8e5081ce6595e9230e9 ] + +The driver must not hold the wiphy mutex when unregistering the thermal +devices. Do not hold the lock for the call to iwl_mld_thermal_exit and +only do a lock/unlock to cancel the ct_kill_exit_wk work. + +The problem is that iwl_mld_tzone_get_temp needs to take the wiphy lock +while the thermal code is holding its own locks already. When +unregistering the device, the reverse would happen as the driver was +calling thermal_cooling_device_unregister with the wiphy mutex already +held. + +It is not likely to trigger this deadlock as it can only happen if the +thermal code is polling the temperature while the driver is being +unloaded. However, lockdep reported it so fix it. + +Signed-off-by: Benjamin Berg +Reviewed-by: Johannes Berg +Link: https://patch.msgid.link/20250506194102.3407967-12-miriam.rachel.korenblit@intel.com +Signed-off-by: Miri Korenblit +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mld/mld.c | 3 ++- + drivers/net/wireless/intel/iwlwifi/mld/thermal.c | 4 ++++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mld.c b/drivers/net/wireless/intel/iwlwifi/mld/mld.c +index 7a098942dc802..21f65442638dd 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/mld.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/mld.c +@@ -475,8 +475,9 @@ iwl_op_mode_mld_stop(struct iwl_op_mode *op_mode) + iwl_mld_ptp_remove(mld); + iwl_mld_leds_exit(mld); + +- wiphy_lock(mld->wiphy); + iwl_mld_thermal_exit(mld); ++ ++ wiphy_lock(mld->wiphy); + iwl_mld_low_latency_stop(mld); + iwl_mld_deinit_time_sync(mld); + wiphy_unlock(mld->wiphy); +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/thermal.c b/drivers/net/wireless/intel/iwlwifi/mld/thermal.c +index 1909953a9be98..670ac43528006 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/thermal.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/thermal.c +@@ -419,6 +419,8 @@ static void iwl_mld_cooling_device_unregister(struct iwl_mld *mld) + + void iwl_mld_thermal_initialize(struct iwl_mld *mld) + { ++ lockdep_assert_not_held(&mld->wiphy->mtx); ++ + wiphy_delayed_work_init(&mld->ct_kill_exit_wk, iwl_mld_exit_ctkill); + + #ifdef CONFIG_THERMAL +@@ -429,7 +431,9 @@ void iwl_mld_thermal_initialize(struct iwl_mld *mld) + + void iwl_mld_thermal_exit(struct iwl_mld *mld) + { ++ wiphy_lock(mld->wiphy); + wiphy_delayed_work_cancel(mld->wiphy, &mld->ct_kill_exit_wk); ++ wiphy_unlock(mld->wiphy); + + #ifdef CONFIG_THERMAL + iwl_mld_cooling_device_unregister(mld); +-- +2.39.5 + diff --git a/queue-6.15/wifi-iwlwifi-mld-check-for-null-before-referencing-a.patch b/queue-6.15/wifi-iwlwifi-mld-check-for-null-before-referencing-a.patch new file mode 100644 index 0000000000..baec697207 --- /dev/null +++ b/queue-6.15/wifi-iwlwifi-mld-check-for-null-before-referencing-a.patch @@ -0,0 +1,38 @@ +From ab49b732c69638a6473468181f89a1a6c0d785c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 15:23:16 +0300 +Subject: wifi: iwlwifi: mld: check for NULL before referencing a pointer + +From: Miri Korenblit + +[ Upstream commit f9151f16e140b9c43f076579146679408af6f442 ] + +Errors can happen, and it is better not to risk with a NULL pointer +dereference. +Make sure that the links-to-remove pointers are not NULL before +dereferencing it. + +Signed-off-by: Miri Korenblit +Reviewed-by: Johannes Berg +Link: https://patch.msgid.link/20250430151952.408652d45cda.I1bb72836dab17895a2e39910e4493d667db0fa80@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c +index 68d97d3b8f026..2d5233dc3e242 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c +@@ -2460,7 +2460,7 @@ iwl_mld_change_vif_links(struct ieee80211_hw *hw, + added |= BIT(0); + + for (int i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) { +- if (removed & BIT(i)) ++ if (removed & BIT(i) && !WARN_ON(!old[i])) + iwl_mld_remove_link(mld, old[i]); + } + +-- +2.39.5 + diff --git a/queue-6.15/wifi-iwlwifi-mld-work-around-clang-loop-unrolling-bu.patch b/queue-6.15/wifi-iwlwifi-mld-work-around-clang-loop-unrolling-bu.patch new file mode 100644 index 0000000000..7103d44f95 --- /dev/null +++ b/queue-6.15/wifi-iwlwifi-mld-work-around-clang-loop-unrolling-bu.patch @@ -0,0 +1,57 @@ +From d5a6ee3f66373643a43f8144ebbd351324cc9c7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 13:41:57 -0700 +Subject: wifi: iwlwifi: mld: Work around Clang loop unrolling bug + +From: Kees Cook + +[ Upstream commit 368556dd234dc4a506a35a0c99c0eee2ab475c77 ] + +The nested loop in iwl_mld_send_proto_offload() confuses Clang into +thinking there could be a final loop iteration past the end of the +"nsc" array (which is only 4 entries). The FORTIFY checking in memcmp() +(via ipv6_addr_cmp()) notices this (due to the available bytes in the +out-of-bounds position of &nsc[4] being 0), and errors out, failing +the build. For some reason (likely due to architectural loop unrolling +configurations), this is only exposed on ARM builds currently. Due to +Clang's lack of inline tracking[1], the warning is not very helpful: + +include/linux/fortify-string.h:719:4: error: call to '__read_overflow' declared with 'error' attribute: detected read beyond size of object (1st parameter) + 719 | __read_overflow(); + | ^ +1 error generated. + +But this was tracked down to iwl_mld_send_proto_offload()'s +ipv6_addr_cmp() call. + +An upstream Clang bug has been filed[2] to track this. For now fix the +build by explicitly bounding the inner loop by "n_nsc", which is what +"c" is already limited to. + +Reported-by: Nathan Chancellor +Closes: https://github.com/ClangBuiltLinux/linux/issues/2076 +Link: https://github.com/llvm/llvm-project/pull/73552 [1] +Link: https://github.com/llvm/llvm-project/issues/136603 [2] +Link: https://lore.kernel.org/r/20250421204153.work.935-kees@kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mld/d3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mld/d3.c b/drivers/net/wireless/intel/iwlwifi/mld/d3.c +index ee99298eebf59..7ce01ad3608e1 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mld/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mld/d3.c +@@ -1757,7 +1757,7 @@ iwl_mld_send_proto_offload(struct iwl_mld *mld, + + addrconf_addr_solict_mult(&wowlan_data->target_ipv6_addrs[i], + &solicited_addr); +- for (j = 0; j < c; j++) ++ for (j = 0; j < n_nsc && j < c; j++) + if (ipv6_addr_cmp(&nsc[j].dest_ipv6_addr, + &solicited_addr) == 0) + break; +-- +2.39.5 + diff --git a/queue-6.15/wifi-iwlwifi-mvm-fix-beacon-cck-flag.patch b/queue-6.15/wifi-iwlwifi-mvm-fix-beacon-cck-flag.patch new file mode 100644 index 0000000000..9e588ab572 --- /dev/null +++ b/queue-6.15/wifi-iwlwifi-mvm-fix-beacon-cck-flag.patch @@ -0,0 +1,45 @@ +From 1cb60209f12f6ad71057dbd234aa99429b5a88b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 21:56:47 +0300 +Subject: wifi: iwlwifi: mvm: fix beacon CCK flag + +From: Johannes Berg + +[ Upstream commit 8d7f08922a8cb621aa5d00bdce6a7afe57af1665 ] + +The beacon CCK flag should be set for any CCK rate, not +just for 1 Mbps. Fix that. + +Signed-off-by: Johannes Berg +Reviewed-by: Ilan Peer +Link: https://patch.msgid.link/20250505215513.fe18b7d92d7d.I7bb40a92cea102677b695beb1e2a62a5ea72678b@changeid +Signed-off-by: Miri Korenblit +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +index bec18d197f310..83f1ed94ccab9 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause + /* +- * Copyright (C) 2012-2014, 2018-2024 Intel Corporation ++ * Copyright (C) 2012-2014, 2018-2025 Intel Corporation + * Copyright (C) 2013-2014 Intel Mobile Communications GmbH + * Copyright (C) 2015-2017 Intel Deutschland GmbH + */ +@@ -941,7 +941,7 @@ u16 iwl_mvm_mac_ctxt_get_beacon_flags(const struct iwl_fw *fw, u8 rate_idx) + u16 flags = iwl_mvm_mac80211_idx_to_hwrate(fw, rate_idx); + bool is_new_rate = iwl_fw_lookup_cmd_ver(fw, BEACON_TEMPLATE_CMD, 0) > 10; + +- if (rate_idx <= IWL_FIRST_CCK_RATE) ++ if (rate_idx <= IWL_LAST_CCK_RATE) + flags |= is_new_rate ? IWL_MAC_BEACON_CCK + : IWL_MAC_BEACON_CCK_V1; + +-- +2.39.5 + diff --git a/queue-6.15/wifi-iwlwifi-pcie-make-sure-to-lock-rxq-read.patch b/queue-6.15/wifi-iwlwifi-pcie-make-sure-to-lock-rxq-read.patch new file mode 100644 index 0000000000..90553c0ffe --- /dev/null +++ b/queue-6.15/wifi-iwlwifi-pcie-make-sure-to-lock-rxq-read.patch @@ -0,0 +1,58 @@ +From 04fbebf79e8d87a4a94919fc13b5378852071ef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 15:38:30 +0300 +Subject: wifi: iwlwifi: pcie: make sure to lock rxq->read + +From: Miri Korenblit + +[ Upstream commit 1cc2c48c4af81bed5ddbe9f2c9d6e20fa163acf9 ] + +rxq->read is accessed without the rxq->lock in a few places, +Make sure to have the lock there. + +Signed-off-by: Miri Korenblit +Reviewed-by: Emmanuel Grumbach +Tested-by: Emmanuel Grumbach +Link: https://patch.msgid.link/20250424153620.73725f207aaa.I1a3e4b6c5fd370e029fdacfcdc9ee335788afa98@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 102a6123bba0e..4cc7a2e5746d2 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -2942,6 +2942,8 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file, + for (i = 0; i < trans->num_rx_queues && pos < bufsz; i++) { + struct iwl_rxq *rxq = &trans_pcie->rxq[i]; + ++ spin_lock_bh(&rxq->lock); ++ + pos += scnprintf(buf + pos, bufsz - pos, "queue#: %2d\n", + i); + pos += scnprintf(buf + pos, bufsz - pos, "\tread: %u\n", +@@ -2962,6 +2964,7 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file, + pos += scnprintf(buf + pos, bufsz - pos, + "\tclosed_rb_num: Not Allocated\n"); + } ++ spin_unlock_bh(&rxq->lock); + } + ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos); + kfree(buf); +@@ -3662,8 +3665,11 @@ iwl_trans_pcie_dump_data(struct iwl_trans *trans, u32 dump_mask, + /* Dump RBs is supported only for pre-9000 devices (1 queue) */ + struct iwl_rxq *rxq = &trans_pcie->rxq[0]; + /* RBs */ ++ spin_lock_bh(&rxq->lock); + num_rbs = iwl_get_closed_rb_stts(trans, rxq); + num_rbs = (num_rbs - rxq->read) & RX_QUEUE_MASK; ++ spin_unlock_bh(&rxq->lock); ++ + len += num_rbs * (sizeof(*data) + + sizeof(struct iwl_fw_error_dump_rb) + + (PAGE_SIZE << trans_pcie->rx_page_order)); +-- +2.39.5 + diff --git a/queue-6.15/wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch b/queue-6.15/wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch new file mode 100644 index 0000000000..4b95f259af --- /dev/null +++ b/queue-6.15/wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch @@ -0,0 +1,67 @@ +From 7e318090e7f41fd305d827d221dccd3285db2781 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Apr 2025 21:10:42 +0200 +Subject: wifi: mac80211: do not offer a mesh path if forwarding is disabled + +From: Benjamin Berg + +[ Upstream commit cf1b684a06170d253b47d6a5287821de976435bd ] + +When processing a PREQ the code would always check whether we have a +mesh path locally and reply accordingly. However, when forwarding is +disabled then we should not reply with this information as we will not +forward data packets down that path. + +Move the check for dot11MeshForwarding up in the function and skip the +mesh path lookup in that case. In the else block, set forward to false +so that the rest of the function becomes a no-op and the +dot11MeshForwarding check does not need to be duplicated. + +This explains an effect observed in the Freifunk community where mesh +forwarding is disabled. In that case a mesh with three STAs and only bad +links in between them, individual STAs would occionally have indirect +mpath entries. This should not have happened. + +Signed-off-by: Benjamin Berg +Reviewed-by: Rouven Czerwinski +Link: https://patch.msgid.link/20250430191042.3287004-1-benjamin@sipsolutions.net +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mesh_hwmp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c +index c94a9c7ca960e..91444301a84a4 100644 +--- a/net/mac80211/mesh_hwmp.c ++++ b/net/mac80211/mesh_hwmp.c +@@ -636,7 +636,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, + mesh_path_add_gate(mpath); + } + rcu_read_unlock(); +- } else { ++ } else if (ifmsh->mshcfg.dot11MeshForwarding) { + rcu_read_lock(); + mpath = mesh_path_lookup(sdata, target_addr); + if (mpath) { +@@ -654,6 +654,8 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, + } + } + rcu_read_unlock(); ++ } else { ++ forward = false; + } + + if (reply) { +@@ -671,7 +673,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, + } + } + +- if (forward && ifmsh->mshcfg.dot11MeshForwarding) { ++ if (forward) { + u32 preq_id; + u8 hopcount; + +-- +2.39.5 + diff --git a/queue-6.15/wifi-mac80211-validate-scan_flag_ap-in-scan-request-.patch b/queue-6.15/wifi-mac80211-validate-scan_flag_ap-in-scan-request-.patch new file mode 100644 index 0000000000..5dfa1c95bd --- /dev/null +++ b/queue-6.15/wifi-mac80211-validate-scan_flag_ap-in-scan-request-.patch @@ -0,0 +1,45 @@ +From 5cc73c89d8d290aa8a8c2518176bb4dd8eed1252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 May 2025 16:02:07 +0530 +Subject: wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO + +From: Aditya Kumar Singh + +[ Upstream commit 78a7a126dc5b8e3c5a3d4da9f513e0236d2dc1a3 ] + +When an AP interface is already beaconing, a subsequent scan is not allowed +unless the user space explicitly sets the flag NL80211_SCAN_FLAG_AP in the +scan request. If this flag is not set, the scan request will be returned +with the error code -EOPNOTSUPP. However, this restriction currently +applies only to non-ML interfaces. For ML interfaces, scans are allowed +without this flag being explicitly set by the user space which is wrong. +This is because the beaconing check currently uses only the deflink, which +does not get set during MLO. + +Hence to fix this, during MLO, use the existing helper +ieee80211_num_beaconing_links() to know if any of the link is beaconing. + +Signed-off-by: Aditya Kumar Singh +Link: https://patch.msgid.link/20250516-bug_fix_mlo_scan-v2-1-12e59d9110ac@oss.qualcomm.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 9f683f838431d..acfde525fad2f 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2904,7 +2904,7 @@ static int ieee80211_scan(struct wiphy *wiphy, + * the frames sent while scanning on other channel will be + * lost) + */ +- if (sdata->deflink.u.ap.beacon && ++ if (ieee80211_num_beaconing_links(sdata) && + (!(wiphy->features & NL80211_FEATURE_AP_SCAN) || + !(req->flags & NL80211_SCAN_FLAG_AP))) + return -EOPNOTSUPP; +-- +2.39.5 + diff --git a/queue-6.15/wifi-mac80211-vlan-traffic-in-multicast-path.patch b/queue-6.15/wifi-mac80211-vlan-traffic-in-multicast-path.patch new file mode 100644 index 0000000000..f550893e44 --- /dev/null +++ b/queue-6.15/wifi-mac80211-vlan-traffic-in-multicast-path.patch @@ -0,0 +1,45 @@ +From ad191792c504631de0a7feb220ed2fe549a609d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Mar 2025 14:31:25 -0700 +Subject: wifi: mac80211: VLAN traffic in multicast path + +From: Muna Sinada + +[ Upstream commit 1a4a6a22552ca9d723f28a1fe35eab1b9b3d8b33 ] + +Currently for MLO, sending out multicast frames on each link is handled by +mac80211 only when IEEE80211_HW_MLO_MCAST_MULTI_LINK_TX flag is not set. + +Dynamic VLAN multicast traffic utilizes software encryption. +Due to this, mac80211 should handle transmitting multicast frames on +all links for multicast VLAN traffic. + +Signed-off-by: Muna Sinada +Link: https://patch.msgid.link/20250325213125.1509362-4-muna.sinada@oss.qualcomm.com +[remove unnecessary parentheses] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/tx.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 20179db88c4a6..d6af02a524af3 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -4526,8 +4526,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb, + IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, + NULL); + } else if (ieee80211_vif_is_mld(&sdata->vif) && +- sdata->vif.type == NL80211_IFTYPE_AP && +- !ieee80211_hw_check(&sdata->local->hw, MLO_MCAST_MULTI_LINK_TX)) { ++ ((sdata->vif.type == NL80211_IFTYPE_AP && ++ !ieee80211_hw_check(&sdata->local->hw, MLO_MCAST_MULTI_LINK_TX)) || ++ (sdata->vif.type == NL80211_IFTYPE_AP_VLAN && ++ !sdata->wdev.use_4addr))) { + ieee80211_mlo_multicast_tx(dev, skb); + } else { + normal: +-- +2.39.5 + diff --git a/queue-6.15/wifi-mac80211_hwsim-prevent-tsf-from-setting-if-beac.patch b/queue-6.15/wifi-mac80211_hwsim-prevent-tsf-from-setting-if-beac.patch new file mode 100644 index 0000000000..a7f20a4163 --- /dev/null +++ b/queue-6.15/wifi-mac80211_hwsim-prevent-tsf-from-setting-if-beac.patch @@ -0,0 +1,42 @@ +From a4b63d44473a6e4984595ce00ab045ffd6ad0fab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Apr 2025 22:15:53 +0800 +Subject: wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled + +From: Edward Adam Davis + +[ Upstream commit c575f5374be7a5c4be4acb9fe6be3a4669d94674 ] + +Setting tsf is meaningless if beacon is disabled, so check that beacon +is enabled before setting tsf. + +Reported-by: syzbot+064815c6cd721082a52a@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=064815c6cd721082a52a +Tested-by: syzbot+064815c6cd721082a52a@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Link: https://patch.msgid.link/tencent_3609AC2EFAAED68CA5A7E3C6D212D1C67806@qq.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/virtual/mac80211_hwsim.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c +index cf3e976471c61..6ca5d9d0fe532 100644 +--- a/drivers/net/wireless/virtual/mac80211_hwsim.c ++++ b/drivers/net/wireless/virtual/mac80211_hwsim.c +@@ -1229,6 +1229,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw, + /* MLD not supported here */ + u32 bcn_int = data->link_data[0].beacon_int; + u64 delta = abs(tsf - now); ++ struct ieee80211_bss_conf *conf; ++ ++ conf = link_conf_dereference_protected(vif, data->link_data[0].link_id); ++ if (conf && !conf->enable_beacon) ++ return; + + /* adjust after beaconing with new timestamp at old TBTT */ + if (tsf > now) { +-- +2.39.5 + diff --git a/queue-6.15/wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch b/queue-6.15/wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch new file mode 100644 index 0000000000..be9839bc89 --- /dev/null +++ b/queue-6.15/wifi-mt76-mt76x2-add-support-for-liteon-wn4516r-wn45.patch @@ -0,0 +1,86 @@ +From d72157d62991e56ff1cce13f4ff4a3bb4b0427d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Apr 2025 16:39:14 +0200 +Subject: wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R + +From: Henk Vergonet + +[ Upstream commit 3c0e4f606d8693795a2c965d6f4987b1bfc31097 ] + +Adds support for: + - LiteOn WN4516R + - LiteOn WN4519R + Both use: + - A nonstandard USB connector + - Mediatek chipset MT7600U + - ASIC revision: 76320044 + +Disabled VHT support on ASIC revision 76320044: + + This fixes the 5G connectibity issue on LiteOn WN4519R module + see https://github.com/openwrt/mt76/issues/971 + + And may also fix the 5G issues on the XBox One Wireless Adapter + see https://github.com/openwrt/mt76/issues/200 + + I have looked at the FCC info related to the MT7632U chip as mentioned in here: + https://github.com/openwrt/mt76/issues/459 + These confirm the chipset does not support 'ac' mode and hence VHT should be turned of. + +Signed-off-by: Henk Vergonet +Acked-by: Lorenzo Bianconi +Link: https://patch.msgid.link/20250418143914.31384-1-henk.vergonet@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 2 ++ + .../net/wireless/mediatek/mt76/mt76x2/usb_init.c | 13 ++++++++++++- + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c +index 84ef80ab4afbf..96cecc576a986 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c +@@ -17,6 +17,8 @@ static const struct usb_device_id mt76x2u_device_table[] = { + { USB_DEVICE(0x057c, 0x8503) }, /* Avm FRITZ!WLAN AC860 */ + { USB_DEVICE(0x7392, 0xb711) }, /* Edimax EW 7722 UAC */ + { USB_DEVICE(0x0e8d, 0x7632) }, /* HC-M7662BU1 */ ++ { USB_DEVICE(0x0471, 0x2126) }, /* LiteOn WN4516R module, nonstandard USB connector */ ++ { USB_DEVICE(0x0471, 0x7600) }, /* LiteOn WN4519R module, nonstandard USB connector */ + { USB_DEVICE(0x2c4e, 0x0103) }, /* Mercury UD13 */ + { USB_DEVICE(0x0846, 0x9014) }, /* Netgear WNDA3100v3 */ + { USB_DEVICE(0x0846, 0x9053) }, /* Netgear A6210 */ +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c +index 33a14365ec9b9..3b55628115115 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c +@@ -191,6 +191,7 @@ int mt76x2u_register_device(struct mt76x02_dev *dev) + { + struct ieee80211_hw *hw = mt76_hw(dev); + struct mt76_usb *usb = &dev->mt76.usb; ++ bool vht; + int err; + + INIT_DELAYED_WORK(&dev->cal_work, mt76x2u_phy_calibrate); +@@ -217,7 +218,17 @@ int mt76x2u_register_device(struct mt76x02_dev *dev) + + /* check hw sg support in order to enable AMSDU */ + hw->max_tx_fragments = dev->mt76.usb.sg_en ? MT_TX_SG_MAX_SIZE : 1; +- err = mt76_register_device(&dev->mt76, true, mt76x02_rates, ++ switch (dev->mt76.rev) { ++ case 0x76320044: ++ /* these ASIC revisions do not support VHT */ ++ vht = false; ++ break; ++ default: ++ vht = true; ++ break; ++ } ++ ++ err = mt76_register_device(&dev->mt76, vht, mt76x02_rates, + ARRAY_SIZE(mt76x02_rates)); + if (err) + goto fail; +-- +2.39.5 + diff --git a/queue-6.15/wifi-mt76-mt7921-add-160-mhz-ap-for-mt7922-device.patch b/queue-6.15/wifi-mt76-mt7921-add-160-mhz-ap-for-mt7922-device.patch new file mode 100644 index 0000000000..41eae2ed1b --- /dev/null +++ b/queue-6.15/wifi-mt76-mt7921-add-160-mhz-ap-for-mt7922-device.patch @@ -0,0 +1,38 @@ +From 82d753de2fa727672d368f227673adebd8179b44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 May 2025 19:53:09 -0500 +Subject: wifi: mt76: mt7921: add 160 MHz AP for mt7922 device + +From: Samuel Williams + +[ Upstream commit 7011faebe543f8f094fdb3281d0ec9e1eab81309 ] + +This allows mt7922 in hostapd mode to transmit up to 1.4 Gbps. + +Signed-off-by: Samuel Williams +Link: https://patch.msgid.link/20250511005316.1118961-1-sam8641@gmail.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index 826c48a2ee696..1fffa43379b2b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -83,6 +83,11 @@ mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band, + he_cap_elem->phy_cap_info[9] |= + IEEE80211_HE_PHY_CAP9_TX_1024_QAM_LESS_THAN_242_TONE_RU | + IEEE80211_HE_PHY_CAP9_RX_1024_QAM_LESS_THAN_242_TONE_RU; ++ ++ if (is_mt7922(phy->mt76->dev)) { ++ he_cap_elem->phy_cap_info[0] |= ++ IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G; ++ } + break; + case NL80211_IFTYPE_STATION: + he_cap_elem->mac_cap_info[1] |= +-- +2.39.5 + diff --git a/queue-6.15/wifi-mt76-mt7925-introduce-thermal-protection.patch b/queue-6.15/wifi-mt76-mt7925-introduce-thermal-protection.patch new file mode 100644 index 0000000000..677fdaef5e --- /dev/null +++ b/queue-6.15/wifi-mt76-mt7925-introduce-thermal-protection.patch @@ -0,0 +1,93 @@ +From 50cfa425301ccb7c7544cd32778565e2da7a454f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 May 2025 16:21:17 +0800 +Subject: wifi: mt76: mt7925: introduce thermal protection + +From: Leon Yen + +[ Upstream commit 1d81e893b422a6f0ae70f8648867c2e73edfb413 ] + +Add thermal protection to prevent the chip from possible overheating +due to prolonged high traffic and adverse operating conditions. + +Signed-off-by: Leon Yen +Signed-off-by: Ming Yen Hsieh +Link: https://patch.msgid.link/20250509082117.453819-1-mingyen.hsieh@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7925/init.c | 6 ++++++ + .../net/wireless/mediatek/mt76/mt7925/mcu.c | 20 ++++++++++++++++++- + .../net/wireless/mediatek/mt76/mt7925/mcu.h | 1 + + 3 files changed, 26 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/init.c b/drivers/net/wireless/mediatek/mt76/mt7925/init.c +index 79639be0d29ac..2a83ff59a968c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/init.c +@@ -322,6 +322,12 @@ static void mt7925_init_work(struct work_struct *work) + return; + } + ++ ret = mt7925_mcu_set_thermal_protect(dev); ++ if (ret) { ++ dev_err(dev->mt76.dev, "thermal protection enable failed\n"); ++ return; ++ } ++ + /* we support chip reset now */ + dev->hw_init_done = true; + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +index dea5b9bcb3fdf..7d96b88cff803 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +@@ -974,6 +974,23 @@ int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable) + } + EXPORT_SYMBOL_GPL(mt7925_mcu_set_deep_sleep); + ++int mt7925_mcu_set_thermal_protect(struct mt792x_dev *dev) ++{ ++ char cmd[64]; ++ int ret = 0; ++ ++ snprintf(cmd, sizeof(cmd), "ThermalProtGband %d %d %d %d %d %d %d %d %d %d", ++ 0, 100, 90, 80, 30, 1, 1, 115, 105, 5); ++ ret = mt7925_mcu_chip_config(dev, cmd); ++ ++ snprintf(cmd, sizeof(cmd), "ThermalProtAband %d %d %d %d %d %d %d %d %d %d", ++ 1, 100, 90, 80, 30, 1, 1, 115, 105, 5); ++ ret |= mt7925_mcu_chip_config(dev, cmd); ++ ++ return ret; ++} ++EXPORT_SYMBOL_GPL(mt7925_mcu_set_thermal_protect); ++ + int mt7925_run_firmware(struct mt792x_dev *dev) + { + int err; +@@ -3306,7 +3323,8 @@ int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb, + else + uni_txd->option = MCU_CMD_UNI_EXT_ACK; + +- if (cmd == MCU_UNI_CMD(HIF_CTRL)) ++ if (cmd == MCU_UNI_CMD(HIF_CTRL) || ++ cmd == MCU_UNI_CMD(CHIP_CONFIG)) + uni_txd->option &= ~MCU_CMD_ACK; + + goto exit; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h +index 8ac43feb26d64..a855a45135028 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h +@@ -637,6 +637,7 @@ int mt7925_mcu_add_bss_info(struct mt792x_phy *phy, + int mt7925_mcu_set_timing(struct mt792x_phy *phy, + struct ieee80211_bss_conf *link_conf); + int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable); ++int mt7925_mcu_set_thermal_protect(struct mt792x_dev *dev); + int mt7925_mcu_set_channel_domain(struct mt76_phy *phy); + int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable); + int mt7925_mcu_set_chctx(struct mt76_phy *phy, struct mt76_vif_link *mvif, +-- +2.39.5 + diff --git a/queue-6.15/wifi-mt76-mt7996-drop-fragments-with-multicast-or-br.patch b/queue-6.15/wifi-mt76-mt7996-drop-fragments-with-multicast-or-br.patch new file mode 100644 index 0000000000..21c0fa69d4 --- /dev/null +++ b/queue-6.15/wifi-mt76-mt7996-drop-fragments-with-multicast-or-br.patch @@ -0,0 +1,44 @@ +From 76e9ade8496e2641d126b44088d230af3b4f1071 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 11:29:47 +0800 +Subject: wifi: mt76: mt7996: drop fragments with multicast or broadcast RA + +From: Benjamin Lin + +[ Upstream commit 80fda1cd7b0a1edd0849dc71403a070d0922118d ] + +IEEE 802.11 fragmentation can only be applied to unicast frames. +Therefore, drop fragments with multicast or broadcast RA. This patch +addresses vulnerabilities such as CVE-2020-26145. + +Signed-off-by: Benjamin Lin +Signed-off-by: Shayne Chen +Link: https://patch.msgid.link/20250515032952.1653494-4-shayne.chen@mediatek.com +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index d89c06f47997f..2108361543a0c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -647,6 +647,14 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q, + status->last_amsdu = amsdu_info == MT_RXD4_LAST_AMSDU_FRAME; + } + ++ /* IEEE 802.11 fragmentation can only be applied to unicast frames. ++ * Hence, drop fragments with multicast/broadcast RA. ++ * This check fixes vulnerabilities, like CVE-2020-26145. ++ */ ++ if ((ieee80211_has_morefrags(fc) || seq_ctrl & IEEE80211_SCTL_FRAG) && ++ FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) != MT_RXD3_NORMAL_U2M) ++ return -EINVAL; ++ + hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad; + if (hdr_trans && ieee80211_has_morefrags(fc)) { + if (mt7996_reverse_frag0_hdr_trans(skb, hdr_gap)) +-- +2.39.5 + diff --git a/queue-6.15/wifi-mt76-mt7996-fix-uninitialized-symbol-warning.patch b/queue-6.15/wifi-mt76-mt7996-fix-uninitialized-symbol-warning.patch new file mode 100644 index 0000000000..96746723d8 --- /dev/null +++ b/queue-6.15/wifi-mt76-mt7996-fix-uninitialized-symbol-warning.patch @@ -0,0 +1,51 @@ +From c356e04175bd6aed2c27e54d09bb8e31cebaaf62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Apr 2025 11:15:28 +0800 +Subject: wifi: mt76: mt7996: fix uninitialized symbol warning + +From: sunliming + +[ Upstream commit 187de25110c8ac8d52e24f8c596ebdcbcd55bbbf ] + +Fix below smatch warnings: +drivers/net/wireless/mediatek/mt76/mt7996/main.c:952 mt7996_mac_sta_add_links() +error: uninitialized symbol 'err'. +drivers/net/wireless/mediatek/mt76/mt7996/main.c:1133 mt7996_set_rts_threshold() +error: uninitialized symbol 'ret'. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202504101051.1ya4Z4va-lkp@intel.com/ +Signed-off-by: sunliming +Link: https://patch.msgid.link/20250419031528.2073892-1-sunliming@linux.dev +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +index a3295b22523a6..b11dd3dd5c46f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c +@@ -991,7 +991,7 @@ mt7996_mac_sta_add_links(struct mt7996_dev *dev, struct ieee80211_vif *vif, + { + struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv; + unsigned int link_id; +- int err; ++ int err = 0; + + for_each_set_bit(link_id, &new_links, IEEE80211_MLD_MAX_NUM_LINKS) { + struct ieee80211_bss_conf *link_conf; +@@ -1254,7 +1254,7 @@ static void mt7996_tx(struct ieee80211_hw *hw, + static int mt7996_set_rts_threshold(struct ieee80211_hw *hw, u32 val) + { + struct mt7996_dev *dev = mt7996_hw_dev(hw); +- int i, ret; ++ int i, ret = 0; + + mutex_lock(&dev->mt76.mutex); + +-- +2.39.5 + diff --git a/queue-6.15/wifi-rtw88-rtw8822bu-vid-pid-for-buffalo-wi-u2-866dm.patch b/queue-6.15/wifi-rtw88-rtw8822bu-vid-pid-for-buffalo-wi-u2-866dm.patch new file mode 100644 index 0000000000..911fd8237e --- /dev/null +++ b/queue-6.15/wifi-rtw88-rtw8822bu-vid-pid-for-buffalo-wi-u2-866dm.patch @@ -0,0 +1,37 @@ +From f5c5c03ac1b1deb283c8478fcd526e870797036b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 May 2025 09:32:27 +0900 +Subject: wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM + +From: Yuuki NAGAO + +[ Upstream commit b7f0cc647e52296a3d4dd727b6479dcd6d7e364e ] + +Add VID/PID 0411/03d1 for recently released +BUFFALO WI-U2-866DM USB WiFi adapter. + +Signed-off-by: Yuuki NAGAO +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250503003227.6673-1-wf.yn386@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8822bu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822bu.c b/drivers/net/wireless/realtek/rtw88/rtw8822bu.c +index 572d1f31832ee..ab50b3c405626 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822bu.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822bu.c +@@ -77,6 +77,8 @@ static const struct usb_device_id rtw_8822bu_id_table[] = { + .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* Mercusys MA30N */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3322, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* D-Link DWA-T185 rev. A1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x0411, 0x03d1, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* BUFFALO WI-U2-866DM */ + {}, + }; + MODULE_DEVICE_TABLE(usb, rtw_8822bu_id_table); +-- +2.39.5 + diff --git a/queue-6.15/wifi-rtw88-set-ampdu-factor-to-hardware-for-rtl8814a.patch b/queue-6.15/wifi-rtw88-set-ampdu-factor-to-hardware-for-rtl8814a.patch new file mode 100644 index 0000000000..a6ad60b35b --- /dev/null +++ b/queue-6.15/wifi-rtw88-set-ampdu-factor-to-hardware-for-rtl8814a.patch @@ -0,0 +1,222 @@ +From be0c669a2558ee21eb6ed6e7dca4e7325fd6891f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Apr 2025 18:31:12 +0300 +Subject: wifi: rtw88: Set AMPDU factor to hardware for RTL8814A + +From: Bitterblue Smith + +[ Upstream commit 0d2a88690e583168effb03c64fd217a323b2c444 ] + +Tell the chip the maximum AMPDU size supported by the AP. This greatly +improves the TX speed of RTL8814AU in the 2.4 GHz band. Before: ~90 +Mbps. After: ~300 Mbps. + +Signed-off-by: Bitterblue Smith +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/4edc2a63-81b3-431c-9a37-5a7d899a6cc2@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/mac80211.c | 2 ++ + drivers/net/wireless/realtek/rtw88/main.c | 32 +++++++++++++++++++ + drivers/net/wireless/realtek/rtw88/main.h | 3 ++ + drivers/net/wireless/realtek/rtw88/rtw8703b.c | 1 + + drivers/net/wireless/realtek/rtw88/rtw8723d.c | 1 + + drivers/net/wireless/realtek/rtw88/rtw8812a.c | 1 + + drivers/net/wireless/realtek/rtw88/rtw8814a.c | 11 +++++++ + drivers/net/wireless/realtek/rtw88/rtw8821a.c | 1 + + drivers/net/wireless/realtek/rtw88/rtw8821c.c | 1 + + drivers/net/wireless/realtek/rtw88/rtw8822b.c | 1 + + drivers/net/wireless/realtek/rtw88/rtw8822c.c | 1 + + 11 files changed, 55 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c +index 026fbf4ad9cce..77f9fbe1870c6 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c +@@ -396,6 +396,8 @@ static void rtw_ops_bss_info_changed(struct ieee80211_hw *hw, + if (rtw_bf_support) + rtw_bf_assoc(rtwdev, vif, conf); + ++ rtw_set_ampdu_factor(rtwdev, vif, conf); ++ + rtw_fw_beacon_filter_config(rtwdev, true, vif); + } else { + rtw_leave_lps(rtwdev); +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 959f56a3cc1ab..bc2c1a5a30b37 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -2447,6 +2447,38 @@ void rtw_core_enable_beacon(struct rtw_dev *rtwdev, bool enable) + } + } + ++void rtw_set_ampdu_factor(struct rtw_dev *rtwdev, struct ieee80211_vif *vif, ++ struct ieee80211_bss_conf *bss_conf) ++{ ++ const struct rtw_chip_ops *ops = rtwdev->chip->ops; ++ struct ieee80211_sta *sta; ++ u8 factor = 0xff; ++ ++ if (!ops->set_ampdu_factor) ++ return; ++ ++ rcu_read_lock(); ++ ++ sta = ieee80211_find_sta(vif, bss_conf->bssid); ++ if (!sta) { ++ rcu_read_unlock(); ++ rtw_warn(rtwdev, "%s: failed to find station %pM\n", ++ __func__, bss_conf->bssid); ++ return; ++ } ++ ++ if (sta->deflink.vht_cap.vht_supported) ++ factor = u32_get_bits(sta->deflink.vht_cap.cap, ++ IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK); ++ else if (sta->deflink.ht_cap.ht_supported) ++ factor = sta->deflink.ht_cap.ampdu_factor; ++ ++ rcu_read_unlock(); ++ ++ if (factor != 0xff) ++ ops->set_ampdu_factor(rtwdev, factor); ++} ++ + MODULE_AUTHOR("Realtek Corporation"); + MODULE_DESCRIPTION("Realtek 802.11ac wireless core module"); + MODULE_LICENSE("Dual BSD/GPL"); +diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h +index 02343e059fd97..f410c554da58a 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.h ++++ b/drivers/net/wireless/realtek/rtw88/main.h +@@ -878,6 +878,7 @@ struct rtw_chip_ops { + u32 antenna_rx); + void (*cfg_ldo25)(struct rtw_dev *rtwdev, bool enable); + void (*efuse_grant)(struct rtw_dev *rtwdev, bool enable); ++ void (*set_ampdu_factor)(struct rtw_dev *rtwdev, u8 factor); + void (*false_alarm_statistics)(struct rtw_dev *rtwdev); + void (*phy_calibration)(struct rtw_dev *rtwdev); + void (*dpk_track)(struct rtw_dev *rtwdev); +@@ -2272,4 +2273,6 @@ void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel, + void rtw_core_port_switch(struct rtw_dev *rtwdev, struct ieee80211_vif *vif); + bool rtw_core_check_sta_active(struct rtw_dev *rtwdev); + void rtw_core_enable_beacon(struct rtw_dev *rtwdev, bool enable); ++void rtw_set_ampdu_factor(struct rtw_dev *rtwdev, struct ieee80211_vif *vif, ++ struct ieee80211_bss_conf *bss_conf); + #endif +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8703b.c b/drivers/net/wireless/realtek/rtw88/rtw8703b.c +index 1d232adbdd7e3..5e59cfe4dfdf5 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c +@@ -1904,6 +1904,7 @@ static const struct rtw_chip_ops rtw8703b_ops = { + .set_antenna = NULL, + .cfg_ldo25 = rtw8723x_cfg_ldo25, + .efuse_grant = rtw8723x_efuse_grant, ++ .set_ampdu_factor = NULL, + .false_alarm_statistics = rtw8723x_false_alarm_statistics, + .phy_calibration = rtw8703b_phy_calibration, + .dpk_track = NULL, +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8723d.c b/drivers/net/wireless/realtek/rtw88/rtw8723d.c +index 87715bd54860a..31876e708f9ef 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c +@@ -1404,6 +1404,7 @@ static const struct rtw_chip_ops rtw8723d_ops = { + .set_antenna = NULL, + .cfg_ldo25 = rtw8723x_cfg_ldo25, + .efuse_grant = rtw8723x_efuse_grant, ++ .set_ampdu_factor = NULL, + .false_alarm_statistics = rtw8723x_false_alarm_statistics, + .phy_calibration = rtw8723d_phy_calibration, + .cck_pd_set = rtw8723d_phy_cck_pd_set, +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8812a.c b/drivers/net/wireless/realtek/rtw88/rtw8812a.c +index f9ba2aa2928a4..adbfb37105d05 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8812a.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a.c +@@ -925,6 +925,7 @@ static const struct rtw_chip_ops rtw8812a_ops = { + .set_tx_power_index = rtw88xxa_set_tx_power_index, + .cfg_ldo25 = rtw8812a_cfg_ldo25, + .efuse_grant = rtw88xxa_efuse_grant, ++ .set_ampdu_factor = NULL, + .false_alarm_statistics = rtw88xxa_false_alarm_statistics, + .phy_calibration = rtw8812a_phy_calibration, + .cck_pd_set = rtw88xxa_phy_cck_pd_set, +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8814a.c b/drivers/net/wireless/realtek/rtw88/rtw8814a.c +index cfd35d40d46e2..ce8d4e4c6c57b 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8814a.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8814a.c +@@ -1332,6 +1332,16 @@ static void rtw8814a_cfg_ldo25(struct rtw_dev *rtwdev, bool enable) + { + } + ++/* Without this RTL8814A sends too many frames and (some?) 11n AP ++ * can't handle it, resulting in low TX speed. Other chips seem fine. ++ */ ++static void rtw8814a_set_ampdu_factor(struct rtw_dev *rtwdev, u8 factor) ++{ ++ factor = min_t(u8, factor, IEEE80211_VHT_MAX_AMPDU_256K); ++ ++ rtw_write32(rtwdev, REG_AMPDU_MAX_LENGTH, (8192 << factor) - 1); ++} ++ + static void rtw8814a_false_alarm_statistics(struct rtw_dev *rtwdev) + { + struct rtw_dm_info *dm_info = &rtwdev->dm_info; +@@ -2051,6 +2061,7 @@ static const struct rtw_chip_ops rtw8814a_ops = { + .set_antenna = NULL, + .cfg_ldo25 = rtw8814a_cfg_ldo25, + .efuse_grant = rtw8814a_efuse_grant, ++ .set_ampdu_factor = rtw8814a_set_ampdu_factor, + .false_alarm_statistics = rtw8814a_false_alarm_statistics, + .phy_calibration = rtw8814a_phy_calibration, + .cck_pd_set = rtw8814a_phy_cck_pd_set, +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821a.c b/drivers/net/wireless/realtek/rtw88/rtw8821a.c +index f68239b073191..4d81fb29c9fcd 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8821a.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8821a.c +@@ -871,6 +871,7 @@ static const struct rtw_chip_ops rtw8821a_ops = { + .set_tx_power_index = rtw88xxa_set_tx_power_index, + .cfg_ldo25 = rtw8821a_cfg_ldo25, + .efuse_grant = rtw88xxa_efuse_grant, ++ .set_ampdu_factor = NULL, + .false_alarm_statistics = rtw88xxa_false_alarm_statistics, + .phy_calibration = rtw8821a_phy_calibration, + .cck_pd_set = rtw88xxa_phy_cck_pd_set, +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821c.c b/drivers/net/wireless/realtek/rtw88/rtw8821c.c +index 0ade7f11cbd2e..f68b0041dcc06 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c +@@ -1668,6 +1668,7 @@ static const struct rtw_chip_ops rtw8821c_ops = { + .set_antenna = NULL, + .set_tx_power_index = rtw8821c_set_tx_power_index, + .cfg_ldo25 = rtw8821c_cfg_ldo25, ++ .set_ampdu_factor = NULL, + .false_alarm_statistics = rtw8821c_false_alarm_statistics, + .phy_calibration = rtw8821c_phy_calibration, + .cck_pd_set = rtw8821c_phy_cck_pd_set, +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +index b4934da88e33a..0da212e27d55b 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +@@ -2158,6 +2158,7 @@ static const struct rtw_chip_ops rtw8822b_ops = { + .set_tx_power_index = rtw8822b_set_tx_power_index, + .set_antenna = rtw8822b_set_antenna, + .cfg_ldo25 = rtw8822b_cfg_ldo25, ++ .set_ampdu_factor = NULL, + .false_alarm_statistics = rtw8822b_false_alarm_statistics, + .phy_calibration = rtw8822b_phy_calibration, + .pwr_track = rtw8822b_pwr_track, +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.c b/drivers/net/wireless/realtek/rtw88/rtw8822c.c +index 8937a7b656edb..a7dc79773f624 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c +@@ -4969,6 +4969,7 @@ static const struct rtw_chip_ops rtw8822c_ops = { + .set_tx_power_index = rtw8822c_set_tx_power_index, + .set_antenna = rtw8822c_set_antenna, + .cfg_ldo25 = rtw8822c_cfg_ldo25, ++ .set_ampdu_factor = NULL, + .false_alarm_statistics = rtw8822c_false_alarm_statistics, + .dpk_track = rtw8822c_dpk_track, + .phy_calibration = rtw8822c_phy_calibration, +-- +2.39.5 + diff --git a/queue-6.15/wifi-rtw89-8922a-fix-tx-fail-with-wrong-vco-setting.patch b/queue-6.15/wifi-rtw89-8922a-fix-tx-fail-with-wrong-vco-setting.patch new file mode 100644 index 0000000000..3147c95220 --- /dev/null +++ b/queue-6.15/wifi-rtw89-8922a-fix-tx-fail-with-wrong-vco-setting.patch @@ -0,0 +1,40 @@ +From 3602cce1be2532ecc0c963b5b109a5b322f95e42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Apr 2025 16:12:39 +0800 +Subject: wifi: rtw89: 8922a: fix TX fail with wrong VCO setting + +From: Kuan-Chung Chen + +[ Upstream commit 20aac091a15dc7229ef1a268253fe36bb6b2be39 ] + +An incorrect Voltage Controlled Oscillator (VCO) setting +may cause Synthesizer (SYN) unlock, which may lead to a +failure in the TX authentication request. + +Signed-off-by: Kuan-Chung Chen +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250416081241.36138-3-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c +index c4c93f836a2f5..1659ea64ade11 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c +@@ -77,11 +77,6 @@ void rtw8922a_ctl_band_ch_bw(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy, + RR_CFGCH_BAND0 | RR_CFGCH_CH); + rf_reg[path][i] |= u32_encode_bits(central_ch, RR_CFGCH_CH); + +- if (band == RTW89_BAND_2G) +- rtw89_write_rf(rtwdev, path, RR_SMD, RR_VCO2, 0x0); +- else +- rtw89_write_rf(rtwdev, path, RR_SMD, RR_VCO2, 0x1); +- + switch (band) { + case RTW89_BAND_2G: + default: +-- +2.39.5 + diff --git a/queue-6.15/wifi-rtw89-leave-idle-mode-when-setting-wep-encrypti.patch b/queue-6.15/wifi-rtw89-leave-idle-mode-when-setting-wep-encrypti.patch new file mode 100644 index 0000000000..751698c8ac --- /dev/null +++ b/queue-6.15/wifi-rtw89-leave-idle-mode-when-setting-wep-encrypti.patch @@ -0,0 +1,49 @@ +From 801a7428d603de3216ee9732030b97b8127a448e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 May 2025 11:12:03 +0800 +Subject: wifi: rtw89: leave idle mode when setting WEP encryption for AP mode + +From: Dian-Syuan Yang + +[ Upstream commit d105652b33245162867ac769bea336976e67efb8 ] + +Due to mac80211 triggering the hardware to enter idle mode, it fails +to install WEP key causing connected station can't ping successfully. +Currently, it forces the hardware to leave idle mode before driver +adding WEP keys. + +Signed-off-by: Dian-Syuan Yang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250507031203.8256-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/cam.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw89/cam.c b/drivers/net/wireless/realtek/rtw89/cam.c +index eca3d767ff603..bc6f799e291e8 100644 +--- a/drivers/net/wireless/realtek/rtw89/cam.c ++++ b/drivers/net/wireless/realtek/rtw89/cam.c +@@ -6,6 +6,7 @@ + #include "debug.h" + #include "fw.h" + #include "mac.h" ++#include "ps.h" + + static struct sk_buff * + rtw89_cam_get_sec_key_cmd(struct rtw89_dev *rtwdev, +@@ -471,9 +472,11 @@ int rtw89_cam_sec_key_add(struct rtw89_dev *rtwdev, + + switch (key->cipher) { + case WLAN_CIPHER_SUITE_WEP40: ++ rtw89_leave_ips_by_hwflags(rtwdev); + hw_key_type = RTW89_SEC_KEY_TYPE_WEP40; + break; + case WLAN_CIPHER_SUITE_WEP104: ++ rtw89_leave_ips_by_hwflags(rtwdev); + hw_key_type = RTW89_SEC_KEY_TYPE_WEP104; + break; + case WLAN_CIPHER_SUITE_TKIP: +-- +2.39.5 + diff --git a/queue-6.15/wireless-purelifi-plfxlc-fix-memory-leak-in-plfxlc_u.patch b/queue-6.15/wireless-purelifi-plfxlc-fix-memory-leak-in-plfxlc_u.patch new file mode 100644 index 0000000000..cda10d64a2 --- /dev/null +++ b/queue-6.15/wireless-purelifi-plfxlc-fix-memory-leak-in-plfxlc_u.patch @@ -0,0 +1,39 @@ +From 021ea94757a259e4669acdb3e44c6259451ed9aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Apr 2025 10:57:45 +0100 +Subject: wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn() + +From: Salah Triki + +[ Upstream commit 63a9a727d373fa5b8ce509eef50dbc45e0f745b9 ] + +Add usb_free_urb() in the error path to prevent memory leak. + +Signed-off-by: Salah Triki +Link: https://patch.msgid.link/aA3_maPlEJzO7wrL@pc +[fix subject] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/purelifi/plfxlc/usb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/purelifi/plfxlc/usb.c b/drivers/net/wireless/purelifi/plfxlc/usb.c +index 10d2e2124ff81..c2a1234b59db6 100644 +--- a/drivers/net/wireless/purelifi/plfxlc/usb.c ++++ b/drivers/net/wireless/purelifi/plfxlc/usb.c +@@ -503,8 +503,10 @@ int plfxlc_usb_wreq_async(struct plfxlc_usb *usb, const u8 *buffer, + (void *)buffer, buffer_len, complete_fn, context); + + r = usb_submit_urb(urb, GFP_ATOMIC); +- if (r) ++ if (r) { ++ usb_free_urb(urb); + dev_err(&udev->dev, "Async write submit failed (%d)\n", r); ++ } + + return r; + } +-- +2.39.5 + diff --git a/queue-6.15/workqueue-fix-race-condition-in-wq-stats-incrementat.patch b/queue-6.15/workqueue-fix-race-condition-in-wq-stats-incrementat.patch new file mode 100644 index 0000000000..660459c0a4 --- /dev/null +++ b/queue-6.15/workqueue-fix-race-condition-in-wq-stats-incrementat.patch @@ -0,0 +1,45 @@ +From 1a0d211fedf4daa76cf2acd01398dbcf62a9491e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Apr 2025 00:17:42 +0800 +Subject: workqueue: Fix race condition in wq->stats incrementation + +From: Jiayuan Chen + +[ Upstream commit 70e1683ca3a6474360af1d3a020a9a98c8492cc0 ] + +Fixed a race condition in incrementing wq->stats[PWQ_STAT_COMPLETED] by +moving the operation under pool->lock. + +Reported-by: syzbot+01affb1491750534256d@syzkaller.appspotmail.com +Signed-off-by: Jiayuan Chen +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/workqueue.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index cf62032827375..1ea62b8c76b32 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -3241,7 +3241,7 @@ __acquires(&pool->lock) + * point will only record its address. + */ + trace_workqueue_execute_end(work, worker->current_func); +- pwq->stats[PWQ_STAT_COMPLETED]++; ++ + lock_map_release(&lockdep_map); + if (!bh_draining) + lock_map_release(pwq->wq->lockdep_map); +@@ -3272,6 +3272,8 @@ __acquires(&pool->lock) + + raw_spin_lock_irq(&pool->lock); + ++ pwq->stats[PWQ_STAT_COMPLETED]++; ++ + /* + * In addition to %WQ_CPU_INTENSIVE, @worker may also have been marked + * CPU intensive by wq_worker_tick() if @work hogged CPU longer than +-- +2.39.5 + diff --git a/queue-6.15/x86-sgx-prevent-attempts-to-reclaim-poisoned-pages.patch b/queue-6.15/x86-sgx-prevent-attempts-to-reclaim-poisoned-pages.patch new file mode 100644 index 0000000000..52e86f6afa --- /dev/null +++ b/queue-6.15/x86-sgx-prevent-attempts-to-reclaim-poisoned-pages.patch @@ -0,0 +1,87 @@ +From 8d84c4fe9bb1e14dc4b993c558042b780389f26c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 May 2025 01:04:29 +0200 +Subject: x86/sgx: Prevent attempts to reclaim poisoned pages + +From: Andrew Zaborowski + +[ Upstream commit ed16618c380c32c68c06186d0ccbb0d5e0586e59 ] + +TL;DR: SGX page reclaim touches the page to copy its contents to +secondary storage. SGX instructions do not gracefully handle machine +checks. Despite this, the existing SGX code will try to reclaim pages +that it _knows_ are poisoned. Avoid even trying to reclaim poisoned pages. + +The longer story: + +Pages used by an enclave only get epc_page->poison set in +arch_memory_failure() but they currently stay on sgx_active_page_list until +sgx_encl_release(), with the SGX_EPC_PAGE_RECLAIMER_TRACKED flag untouched. + +epc_page->poison is not checked in the reclaimer logic meaning that, if other +conditions are met, an attempt will be made to reclaim an EPC page that was +poisoned. This is bad because 1. we don't want that page to end up added +to another enclave and 2. it is likely to cause one core to shut down +and the kernel to panic. + +Specifically, reclaiming uses microcode operations including "EWB" which +accesses the EPC page contents to encrypt and write them out to non-SGX +memory. Those operations cannot handle MCEs in their accesses other than +by putting the executing core into a special shutdown state (affecting +both threads with HT.) The kernel will subsequently panic on the +remaining cores seeing the core didn't enter MCE handler(s) in time. + +Call sgx_unmark_page_reclaimable() to remove the affected EPC page from +sgx_active_page_list on memory error to stop it being considered for +reclaiming. + +Testing epc_page->poison in sgx_reclaim_pages() would also work but I assume +it's better to add code in the less likely paths. + +The affected EPC page is not added to &node->sgx_poison_page_list until +later in sgx_encl_release()->sgx_free_epc_page() when it is EREMOVEd. +Membership on other lists doesn't change to avoid changing any of the +lists' semantics except for sgx_active_page_list. There's a "TBD" comment +in arch_memory_failure() about pre-emptive actions, the goal here is not +to address everything that it may imply. + +This also doesn't completely close the time window when a memory error +notification will be fatal (for a not previously poisoned EPC page) -- +the MCE can happen after sgx_reclaim_pages() has selected its candidates +or even *inside* a microcode operation (actually easy to trigger due to +the amount of time spent in them.) + +The spinlock in sgx_unmark_page_reclaimable() is safe because +memory_failure() runs in process context and no spinlocks are held, +explicitly noted in a mm/memory-failure.c comment. + +Signed-off-by: Andrew Zaborowski +Signed-off-by: Ingo Molnar +Acked-by: Dave Hansen +Cc: H. Peter Anvin +Cc: Linus Torvalds +Cc: Tony Luck +Cc: balrogg@gmail.com +Cc: linux-sgx@vger.kernel.org +Link: https://lore.kernel.org/r/20250508230429.456271-1-andrew.zaborowski@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/sgx/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c +index 8ce352fc72ac3..7c199773705a7 100644 +--- a/arch/x86/kernel/cpu/sgx/main.c ++++ b/arch/x86/kernel/cpu/sgx/main.c +@@ -719,6 +719,8 @@ int arch_memory_failure(unsigned long pfn, int flags) + goto out; + } + ++ sgx_unmark_page_reclaimable(page); ++ + /* + * TBD: Add additional plumbing to enable pre-emptive + * action for asynchronous poison notification. Until +-- +2.39.5 + diff --git a/queue-6.15/xfrm-validate-assignment-of-maximal-possible-seq-num.patch b/queue-6.15/xfrm-validate-assignment-of-maximal-possible-seq-num.patch new file mode 100644 index 0000000000..ed2cb0ebcf --- /dev/null +++ b/queue-6.15/xfrm-validate-assignment-of-maximal-possible-seq-num.patch @@ -0,0 +1,104 @@ +From fdfb2770d6d96a9de3933683db25d2f9bf48e642 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 May 2025 13:56:22 +0300 +Subject: xfrm: validate assignment of maximal possible SEQ number + +From: Leon Romanovsky + +[ Upstream commit e86212b6b13a20c5ad404c5597933f57fd0f1519 ] + +Users can set any seq/seq_hi/oseq/oseq_hi values. The XFRM core code +doesn't prevent from them to set even 0xFFFFFFFF, however this value +will cause for traffic drop. + +Is is happening because SEQ numbers here mean that packet with such +number was processed and next number should be sent on the wire. In this +case, the next number will be 0, and it means overflow which causes to +(expected) packet drops. + +While it can be considered as misconfiguration and handled by XFRM +datapath in the same manner as any other SEQ number, let's add +validation to easy for packet offloads implementations which need to +configure HW with next SEQ to send and not with current SEQ like it is +done in core code. + +Signed-off-by: Leon Romanovsky +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_user.c | 52 +++++++++++++++++++++++++++++++++++--------- + 1 file changed, 42 insertions(+), 10 deletions(-) + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 784a2d124749f..614b58cb26ab7 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -178,11 +178,27 @@ static inline int verify_replay(struct xfrm_usersa_info *p, + "Replay seq and seq_hi should be 0 for output SA"); + return -EINVAL; + } +- if (rs->oseq_hi && !(p->flags & XFRM_STATE_ESN)) { +- NL_SET_ERR_MSG( +- extack, +- "Replay oseq_hi should be 0 in non-ESN mode for output SA"); +- return -EINVAL; ++ ++ if (!(p->flags & XFRM_STATE_ESN)) { ++ if (rs->oseq_hi) { ++ NL_SET_ERR_MSG( ++ extack, ++ "Replay oseq_hi should be 0 in non-ESN mode for output SA"); ++ return -EINVAL; ++ } ++ if (rs->oseq == U32_MAX) { ++ NL_SET_ERR_MSG( ++ extack, ++ "Replay oseq should be less than 0xFFFFFFFF in non-ESN mode for output SA"); ++ return -EINVAL; ++ } ++ } else { ++ if (rs->oseq == U32_MAX && rs->oseq_hi == U32_MAX) { ++ NL_SET_ERR_MSG( ++ extack, ++ "Replay oseq and oseq_hi should be less than 0xFFFFFFFF for output SA"); ++ return -EINVAL; ++ } + } + if (rs->bmp_len) { + NL_SET_ERR_MSG(extack, "Replay bmp_len should 0 for output SA"); +@@ -196,11 +212,27 @@ static inline int verify_replay(struct xfrm_usersa_info *p, + "Replay oseq and oseq_hi should be 0 for input SA"); + return -EINVAL; + } +- if (rs->seq_hi && !(p->flags & XFRM_STATE_ESN)) { +- NL_SET_ERR_MSG( +- extack, +- "Replay seq_hi should be 0 in non-ESN mode for input SA"); +- return -EINVAL; ++ if (!(p->flags & XFRM_STATE_ESN)) { ++ if (rs->seq_hi) { ++ NL_SET_ERR_MSG( ++ extack, ++ "Replay seq_hi should be 0 in non-ESN mode for input SA"); ++ return -EINVAL; ++ } ++ ++ if (rs->seq == U32_MAX) { ++ NL_SET_ERR_MSG( ++ extack, ++ "Replay seq should be less than 0xFFFFFFFF in non-ESN mode for input SA"); ++ return -EINVAL; ++ } ++ } else { ++ if (rs->seq == U32_MAX && rs->seq_hi == U32_MAX) { ++ NL_SET_ERR_MSG( ++ extack, ++ "Replay seq and seq_hi should be less than 0xFFFFFFFF for input SA"); ++ return -EINVAL; ++ } + } + } + +-- +2.39.5 +