From: Sasha Levin Date: Wed, 10 Apr 2024 15:57:03 +0000 (-0400) Subject: Fixes for 6.8 X-Git-Tag: v4.19.312~59 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=335f7cc05e3ff0e2ea8b9886675dee7303fe974a;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.8 Signed-off-by: Sasha Levin --- diff --git a/queue-6.8/accel-habanalabs-increase-hl_max_str-to-64-bytes-to-.patch b/queue-6.8/accel-habanalabs-increase-hl_max_str-to-64-bytes-to-.patch new file mode 100644 index 00000000000..100c3ca78df --- /dev/null +++ b/queue-6.8/accel-habanalabs-increase-hl_max_str-to-64-bytes-to-.patch @@ -0,0 +1,39 @@ +From cf14799ccd9b047fdcacf82ddfedb2a9a64ef5d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 10:03:29 +0200 +Subject: accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Koby Elbaz + +[ Upstream commit 8c075401f2dbda43600c61f780a165abde77877a ] + +Fix a warning of a buffer overflow: +‘snprintf’ output between 38 and 47 bytes into a destination of size 32 + +Signed-off-by: Koby Elbaz +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/accel/habanalabs/common/habanalabs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/accel/habanalabs/common/habanalabs.h b/drivers/accel/habanalabs/common/habanalabs.h +index 2a900c9941fee..41c7aac2ffcf9 100644 +--- a/drivers/accel/habanalabs/common/habanalabs.h ++++ b/drivers/accel/habanalabs/common/habanalabs.h +@@ -2547,7 +2547,7 @@ struct hl_state_dump_specs { + * DEVICES + */ + +-#define HL_STR_MAX 32 ++#define HL_STR_MAX 64 + + #define HL_DEV_STS_MAX (HL_DEVICE_STATUS_LAST + 1) + +-- +2.43.0 + diff --git a/queue-6.8/acpi-resource-add-irq-override-quirk-for-asus-expert.patch b/queue-6.8/acpi-resource-add-irq-override-quirk-for-asus-expert.patch new file mode 100644 index 00000000000..25f7c5d1e54 --- /dev/null +++ b/queue-6.8/acpi-resource-add-irq-override-quirk-for-asus-expert.patch @@ -0,0 +1,44 @@ +From 9b98d6a199ecef6de6ea5924d9bed58a91e6ba41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 01:08:07 +0100 +Subject: ACPI: resource: Add IRQ override quirk for ASUS ExpertBook B2502FBA + +From: Sviatoslav Harasymchuk + +[ Upstream commit 0793e511c4c66c38dd26add86f7236bcdc70c3b5 ] + +In order to fix the keyboard on ASUS ExpertBook B2502FBA, add an IRQ override +quirk for it in analogy with how it was done for other members of this machine +family. + +Link: https://lore.kernel.org/linux-acpi/20230411183144.6932-1-pmenzel@molgen.mpg.de +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217323 +Signed-off-by: Sviatoslav Harasymchuk +[ rjw: Subject and changelog rewrite, fix broken white space ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index c843feb02e980..b5193049d7b1b 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -489,6 +489,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { + DMI_MATCH(DMI_BOARD_NAME, "B2502CBA"), + }, + }, ++ { ++ /* Asus ExpertBook B2502FBA */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "B2502FBA"), ++ }, ++ }, + { + /* Asus Vivobook E1504GA */ + .matches = { +-- +2.43.0 + diff --git a/queue-6.8/acpi-x86-add-dell0501-handling-to-acpi_quirk_skip_se.patch b/queue-6.8/acpi-x86-add-dell0501-handling-to-acpi_quirk_skip_se.patch new file mode 100644 index 00000000000..40f95f2a6ef --- /dev/null +++ b/queue-6.8/acpi-x86-add-dell0501-handling-to-acpi_quirk_skip_se.patch @@ -0,0 +1,75 @@ +From 877522169dbf76d5aec093fee58ecf835169dd0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Feb 2024 16:15:33 +0100 +Subject: ACPI: x86: Add DELL0501 handling to + acpi_quirk_skip_serdev_enumeration() + +From: Hans de Goede + +[ Upstream commit 99b572e6136eab69a8c91d72cf8595b256e304b5 ] + +Some recent(ish) Dell AIO devices have a backlight controller board +connected to an UART. + +This UART has a DELL0501 HID with CID set to PNP0501 so that the UART is +still handled by 8250_pnp.c. Unfortunately there is no separate ACPI device +with an UartSerialBusV2() resource to model the backlight-controller. +This causes the kernel to create a /dev/ttyS0 char-device for the UART +instead of creating an in kernel serdev-controller + serdev-device pair +for a kernel backlight driver. + +Use the existing acpi_quirk_skip_serdev_enumeration() mechanism to work +around this by returning skip=true for tty-ctrl parents with a HID +of DELL0501. + +Like other cases where the UartSerialBusV2() resource is missing or broken +this will only create the serdev-controller device and the serdev-device +itself will need to be instantiated by platform code. + +Unfortunately in this case there is no device for the platform-code +instantiating the serdev-device to bind to. So also create +a platform_device for this. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/utils.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index 8829a907eee02..90c3d2eab9e99 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -484,8 +484,28 @@ static int acpi_dmi_skip_serdev_enumeration(struct device *controller_parent, bo + + int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip) + { ++ struct acpi_device *adev = ACPI_COMPANION(controller_parent); ++ + *skip = false; + ++ /* ++ * The DELL0501 ACPI HID represents an UART (CID is set to PNP0501) with ++ * a backlight-controller attached. There is no separate ACPI device with ++ * an UartSerialBusV2() resource to model the backlight-controller. ++ * Set skip to true so that the tty core creates a serdev ctrl device. ++ * The backlight driver will manually create the serdev client device. ++ */ ++ if (acpi_dev_hid_match(adev, "DELL0501")) { ++ *skip = true; ++ /* ++ * Create a platform dev for dell-uart-backlight to bind to. ++ * This is a static device, so no need to store the result. ++ */ ++ platform_device_register_simple("dell-uart-backlight", PLATFORM_DEVID_NONE, ++ NULL, 0); ++ return 0; ++ } ++ + return acpi_dmi_skip_serdev_enumeration(controller_parent, skip); + } + EXPORT_SYMBOL_GPL(acpi_quirk_skip_serdev_enumeration); +-- +2.43.0 + diff --git a/queue-6.8/acpi-x86-move-acpi_quirk_skip_serdev_enumeration-out.patch b/queue-6.8/acpi-x86-move-acpi_quirk_skip_serdev_enumeration-out.patch new file mode 100644 index 00000000000..cd0c0c0d792 --- /dev/null +++ b/queue-6.8/acpi-x86-move-acpi_quirk_skip_serdev_enumeration-out.patch @@ -0,0 +1,129 @@ +From ebaa3eff893d690f5a0db0002f3108f26de30598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Feb 2024 16:15:32 +0100 +Subject: ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of + CONFIG_X86_ANDROID_TABLETS + +From: Hans de Goede + +[ Upstream commit 7c86e17455de1a442ec906d3449148b5e9a218a4 ] + +Some recent(ish) Dell AIO devices have a backlight controller board +connected to an UART. + +This UART has a DELL0501 HID with CID set to PNP0501 so that the UART is +still handled by 8250_pnp.c. Unfortunately there is no separate ACPI device +with an UartSerialBusV2() resource to model the backlight-controller. + +The next patch in this series will use acpi_quirk_skip_serdev_enumeration() +to still create a serdev for this for a backlight driver to bind to +instead of creating a /dev/ttyS0. + +This new acpi_quirk_skip_serdev_enumeration() use is not limited to Android +X86 tablets, so move it out of the ifdef CONFIG_X86_ANDROID_TABLETS block. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/utils.c | 18 ++++++++++++++---- + include/acpi/acpi_bus.h | 14 +++++++------- + 2 files changed, 21 insertions(+), 11 deletions(-) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index bc65ebfcdf767..8829a907eee02 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -428,7 +428,7 @@ bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev) + } + EXPORT_SYMBOL_GPL(acpi_quirk_skip_i2c_client_enumeration); + +-int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip) ++static int acpi_dmi_skip_serdev_enumeration(struct device *controller_parent, bool *skip) + { + struct acpi_device *adev = ACPI_COMPANION(controller_parent); + const struct dmi_system_id *dmi_id; +@@ -436,8 +436,6 @@ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *s + u64 uid; + int ret; + +- *skip = false; +- + ret = acpi_dev_uid_to_integer(adev, &uid); + if (ret) + return 0; +@@ -463,7 +461,6 @@ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *s + + return 0; + } +-EXPORT_SYMBOL_GPL(acpi_quirk_skip_serdev_enumeration); + + bool acpi_quirk_skip_gpio_event_handlers(void) + { +@@ -478,8 +475,21 @@ bool acpi_quirk_skip_gpio_event_handlers(void) + return (quirks & ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS); + } + EXPORT_SYMBOL_GPL(acpi_quirk_skip_gpio_event_handlers); ++#else ++static int acpi_dmi_skip_serdev_enumeration(struct device *controller_parent, bool *skip) ++{ ++ return 0; ++} + #endif + ++int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip) ++{ ++ *skip = false; ++ ++ return acpi_dmi_skip_serdev_enumeration(controller_parent, skip); ++} ++EXPORT_SYMBOL_GPL(acpi_quirk_skip_serdev_enumeration); ++ + /* Lists of PMIC ACPI HIDs with an (often better) native charger driver */ + static const struct { + const char *hid; +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index e4d24d3f9abb5..446225aada50d 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -749,6 +749,7 @@ bool acpi_device_override_status(struct acpi_device *adev, unsigned long long *s + bool acpi_quirk_skip_acpi_ac_and_battery(void); + int acpi_install_cmos_rtc_space_handler(acpi_handle handle); + void acpi_remove_cmos_rtc_space_handler(acpi_handle handle); ++int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip); + #else + static inline bool acpi_device_override_status(struct acpi_device *adev, + unsigned long long *status) +@@ -766,23 +767,22 @@ static inline int acpi_install_cmos_rtc_space_handler(acpi_handle handle) + static inline void acpi_remove_cmos_rtc_space_handler(acpi_handle handle) + { + } ++static inline int ++acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip) ++{ ++ *skip = false; ++ return 0; ++} + #endif + + #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS) + bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev); +-int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip); + bool acpi_quirk_skip_gpio_event_handlers(void); + #else + static inline bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev) + { + return false; + } +-static inline int +-acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip) +-{ +- *skip = false; +- return 0; +-} + static inline bool acpi_quirk_skip_gpio_event_handlers(void) + { + return false; +-- +2.43.0 + diff --git a/queue-6.8/alsa-firewire-lib-handle-quirk-to-calculate-payload-.patch b/queue-6.8/alsa-firewire-lib-handle-quirk-to-calculate-payload-.patch new file mode 100644 index 00000000000..45a5920e9be --- /dev/null +++ b/queue-6.8/alsa-firewire-lib-handle-quirk-to-calculate-payload-.patch @@ -0,0 +1,72 @@ +From 9956669c6470a2aa2edc9aceffeb69f2abc1010b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Feb 2024 16:41:27 +0900 +Subject: ALSA: firewire-lib: handle quirk to calculate payload quadlets as + data block counter + +From: Takashi Sakamoto + +[ Upstream commit 4a486439d2ca85752c46711f373b6ddc107bb35d ] + +Miglia Harmony Audio (OXFW970) has a quirk to put the number of +accumulated quadlets in CIP payload into the dbc field of CIP header. + +This commit handles the quirk in the packet processing layer. + +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20240218074128.95210-4-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/amdtp-stream.c | 12 ++++++++---- + sound/firewire/amdtp-stream.h | 4 ++++ + 2 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c +index 7be17bca257f0..c9f153f85ae6b 100644 +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -773,10 +773,14 @@ static int check_cip_header(struct amdtp_stream *s, const __be32 *buf, + } else { + unsigned int dbc_interval; + +- if (*data_blocks > 0 && s->ctx_data.tx.dbc_interval > 0) +- dbc_interval = s->ctx_data.tx.dbc_interval; +- else +- dbc_interval = *data_blocks; ++ if (!(s->flags & CIP_DBC_IS_PAYLOAD_QUADLETS)) { ++ if (*data_blocks > 0 && s->ctx_data.tx.dbc_interval > 0) ++ dbc_interval = s->ctx_data.tx.dbc_interval; ++ else ++ dbc_interval = *data_blocks; ++ } else { ++ dbc_interval = payload_length / sizeof(__be32); ++ } + + lost = dbc != ((*data_block_counter + dbc_interval) & 0xff); + } +diff --git a/sound/firewire/amdtp-stream.h b/sound/firewire/amdtp-stream.h +index b7ff44751ab93..a1ed2e80f91a7 100644 +--- a/sound/firewire/amdtp-stream.h ++++ b/sound/firewire/amdtp-stream.h +@@ -37,6 +37,9 @@ + * the value of current SYT_INTERVAL; e.g. initial value is not zero. + * @CIP_UNAWARE_SYT: For outgoing packet, the value in SYT field of CIP is 0xffff. + * For incoming packet, the value in SYT field of CIP is not handled. ++ * @CIP_DBC_IS_PAYLOAD_QUADLETS: Available for incoming packet, and only effective with ++ * CIP_DBC_IS_END_EVENT flag. The value of dbc field is the number of accumulated quadlets ++ * in CIP payload, instead of the number of accumulated data blocks. + */ + enum cip_flags { + CIP_NONBLOCKING = 0x00, +@@ -51,6 +54,7 @@ enum cip_flags { + CIP_NO_HEADER = 0x100, + CIP_UNALIGHED_DBC = 0x200, + CIP_UNAWARE_SYT = 0x400, ++ CIP_DBC_IS_PAYLOAD_QUADLETS = 0x800, + }; + + /** +-- +2.43.0 + diff --git a/queue-6.8/alsa-hda-realtek-add-quirk-for-lenovo-yoga-9-14imh9.patch b/queue-6.8/alsa-hda-realtek-add-quirk-for-lenovo-yoga-9-14imh9.patch new file mode 100644 index 00000000000..47a5e00c821 --- /dev/null +++ b/queue-6.8/alsa-hda-realtek-add-quirk-for-lenovo-yoga-9-14imh9.patch @@ -0,0 +1,59 @@ +From d566e98306906bdce6a508d065c87a6932117608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 01:19:56 -0700 +Subject: ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9 + +From: Jichi Zhang + +[ Upstream commit 9b714a59b719b1ba9382c092f0f7aa4bbe94eba1 ] + +The speakers on the Lenovo Yoga 9 14IMH9 are similar to previous generations +such as the 14IAP7, and the bass speakers can be fixed using similar methods +with one caveat: 14IMH9 uses CS35L41 amplifiers which need to be activated +separately. + +Signed-off-by: Jichi Zhang +Message-ID: <20240315081954.45470-3-i@jichi.ca> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index f4a02bf1abb11..39d8931fb7b21 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7521,6 +7521,7 @@ enum { + ALC287_FIXUP_LEGION_16ITHG6, + ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK, + ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN, ++ ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN, + ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS, + ALC236_FIXUP_DELL_DUAL_CODECS, + ALC287_FIXUP_CS35L41_I2C_2_THINKPAD_ACPI, +@@ -9650,6 +9651,12 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK, + }, ++ [ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc287_fixup_yoga9_14iap7_bass_spk_pin, ++ .chained = true, ++ .chain_id = ALC287_FIXUP_CS35L41_I2C_2, ++ }, + [ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc295_fixup_dell_inspiron_top_speakers, +@@ -10384,6 +10391,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x38c3, "Y980 DUAL", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x38cb, "Y790 YG DUAL", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x38cd, "Y790 VECO DUAL", ALC287_FIXUP_TAS2781_I2C), ++ SND_PCI_QUIRK(0x17aa, 0x38d2, "Lenovo Yoga 9 14IMH9", ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN), ++ SND_PCI_QUIRK(0x17aa, 0x38d7, "Lenovo Yoga 9 14IMH9", ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), +-- +2.43.0 + diff --git a/queue-6.8/alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch b/queue-6.8/alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch new file mode 100644 index 00000000000..98b6e10d2bf --- /dev/null +++ b/queue-6.8/alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch @@ -0,0 +1,55 @@ +From 53399cf9c2eb7a0a60dd4558b3261d06065c8ff2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 15:27:26 -0600 +Subject: ALSA: hda/realtek: Add quirks for some Clevo laptops + +From: Tim Crawford + +[ Upstream commit 33affa7fb46c0c07f6c49d4ddac9dd436715064c ] + +Add audio quirks to fix speaker output and headset detection on some new +Clevo models: + +- L240TU (ALC245) +- PE60SNE-G (ALC1220) +- V350SNEQ (ALC245) + +Co-authored-by: Jeremy Soller +Signed-off-by: Tim Crawford +Message-ID: <20240319212726.62888-1-tcrawford@system76.com> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 39d8931fb7b21..8c2467ed127ee 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2646,6 +2646,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x66a2, "Clevo PE60RNE", ALC1220_FIXUP_CLEVO_PB51ED_PINS), ++ SND_PCI_QUIRK(0x1558, 0x66a6, "Clevo PE60SN[CDE]-[GS]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), +@@ -10214,12 +10215,14 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x152d, 0x1082, "Quanta NL3", ALC269_FIXUP_LIFEBOOK), ++ SND_PCI_QUIRK(0x1558, 0x0353, "Clevo V35[05]SN[CDE]Q", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x1323, "Clevo N130ZU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x1325, "Clevo N15[01][CW]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x1401, "Clevo L140[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x1403, "Clevo N140CU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x1404, "Clevo N150CU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x14a1, "Clevo L141MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x2624, "Clevo L240TU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x4018, "Clevo NV40M[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x4019, "Clevo NV40MZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x4020, "Clevo NV40MB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +-- +2.43.0 + diff --git a/queue-6.8/arm-dts-rockchip-fix-rk322x-hdmi-ports-node.patch b/queue-6.8/arm-dts-rockchip-fix-rk322x-hdmi-ports-node.patch new file mode 100644 index 00000000000..891f6a42ab6 --- /dev/null +++ b/queue-6.8/arm-dts-rockchip-fix-rk322x-hdmi-ports-node.patch @@ -0,0 +1,53 @@ +From abb18ef227c49610bb797854775d0c2b28e18631 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 22:16:55 +0100 +Subject: ARM: dts: rockchip: fix rk322x hdmi ports node + +From: Johan Jonker + +[ Upstream commit 15a5ed03000cf61daf87d14628085cb1bc8ae72c ] + +Fix rk322x hdmi ports node so that it matches the +rockchip,dw-hdmi.yaml binding. + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/9b84adf0-9312-47fd-becc-cadd06941f70@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rockchip/rk322x.dtsi | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/rockchip/rk322x.dtsi b/arch/arm/boot/dts/rockchip/rk322x.dtsi +index 831561fc18146..96421355c2746 100644 +--- a/arch/arm/boot/dts/rockchip/rk322x.dtsi ++++ b/arch/arm/boot/dts/rockchip/rk322x.dtsi +@@ -736,14 +736,20 @@ hdmi: hdmi@200a0000 { + status = "disabled"; + + ports { +- hdmi_in: port { +- #address-cells = <1>; +- #size-cells = <0>; +- hdmi_in_vop: endpoint@0 { +- reg = <0>; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ hdmi_in: port@0 { ++ reg = <0>; ++ ++ hdmi_in_vop: endpoint { + remote-endpoint = <&vop_out_hdmi>; + }; + }; ++ ++ hdmi_out: port@1 { ++ reg = <1>; ++ }; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.8/arm-dts-rockchip-fix-rk3288-hdmi-ports-node.patch b/queue-6.8/arm-dts-rockchip-fix-rk3288-hdmi-ports-node.patch new file mode 100644 index 00000000000..3659267fa34 --- /dev/null +++ b/queue-6.8/arm-dts-rockchip-fix-rk3288-hdmi-ports-node.patch @@ -0,0 +1,70 @@ +From a2965b7b59c876a5bca432ffd07deb38319f8522 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 22:16:41 +0100 +Subject: ARM: dts: rockchip: fix rk3288 hdmi ports node + +From: Johan Jonker + +[ Upstream commit 585e4dc07100a6465b3da8d24e46188064c1c925 ] + +Fix rk3288 hdmi ports node so that it matches the +rockchip,dw-hdmi.yaml binding with some reordering +to align with the (new) documentation about +property ordering. + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/cc3a9b4f-076d-4660-b464-615003b6a066@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rockchip/rk3288.dtsi | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/rockchip/rk3288.dtsi b/arch/arm/boot/dts/rockchip/rk3288.dtsi +index ead343dc3df10..3f1d640afafae 100644 +--- a/arch/arm/boot/dts/rockchip/rk3288.dtsi ++++ b/arch/arm/boot/dts/rockchip/rk3288.dtsi +@@ -1240,27 +1240,37 @@ hdmi: hdmi@ff980000 { + compatible = "rockchip,rk3288-dw-hdmi"; + reg = <0x0 0xff980000 0x0 0x20000>; + reg-io-width = <4>; +- #sound-dai-cells = <0>; +- rockchip,grf = <&grf>; + interrupts = ; + clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>, <&cru SCLK_HDMI_CEC>; + clock-names = "iahb", "isfr", "cec"; + power-domains = <&power RK3288_PD_VIO>; ++ rockchip,grf = <&grf>; ++ #sound-dai-cells = <0>; + status = "disabled"; + + ports { +- hdmi_in: port { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ hdmi_in: port@0 { ++ reg = <0>; + #address-cells = <1>; + #size-cells = <0>; ++ + hdmi_in_vopb: endpoint@0 { + reg = <0>; + remote-endpoint = <&vopb_out_hdmi>; + }; ++ + hdmi_in_vopl: endpoint@1 { + reg = <1>; + remote-endpoint = <&vopl_out_hdmi>; + }; + }; ++ ++ hdmi_out: port@1 { ++ reg = <1>; ++ }; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-qcom-add-support-for-xiaomi-redmi-note-9s.patch b/queue-6.8/arm64-dts-qcom-add-support-for-xiaomi-redmi-note-9s.patch new file mode 100644 index 00000000000..a2ded3f5910 --- /dev/null +++ b/queue-6.8/arm64-dts-qcom-add-support-for-xiaomi-redmi-note-9s.patch @@ -0,0 +1,61 @@ +From 52fba89bd13ca076baf3518faa452ec04f3017fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 17:57:48 +0100 +Subject: arm64: dts: qcom: Add support for Xiaomi Redmi Note 9S + +From: Joe Mason + +[ Upstream commit 6016fb7c91f72f4afbb4017e13cd91954d0f1a9b ] + +Add a device tree for the Xiaomi Redmi Note 9S (curtana) phone, based on +sm7125-xiaomi-common.dtsi. + +Reviewed-by: Konrad Dybcio +Signed-off-by: Joe Mason +Signed-off-by: David Wronek +Link: https://lore.kernel.org/r/20240121-sm7125-upstream-v4-8-f7d1212c8ebb@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/Makefile | 1 + + .../boot/dts/qcom/sm7125-xiaomi-curtana.dts | 16 ++++++++++++++++ + 2 files changed, 17 insertions(+) + create mode 100644 arch/arm64/boot/dts/qcom/sm7125-xiaomi-curtana.dts + +diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile +index 39889d5f8e123..2e6984bbbb836 100644 +--- a/arch/arm64/boot/dts/qcom/Makefile ++++ b/arch/arm64/boot/dts/qcom/Makefile +@@ -210,6 +210,7 @@ dtb-$(CONFIG_ARCH_QCOM) += sm6125-sony-xperia-seine-pdx201.dtb + dtb-$(CONFIG_ARCH_QCOM) += sm6125-xiaomi-laurel-sprout.dtb + dtb-$(CONFIG_ARCH_QCOM) += sm6350-sony-xperia-lena-pdx213.dtb + dtb-$(CONFIG_ARCH_QCOM) += sm6375-sony-xperia-murray-pdx225.dtb ++dtb-$(CONFIG_ARCH_QCOM) += sm7125-xiaomi-curtana.dtb + dtb-$(CONFIG_ARCH_QCOM) += sm7125-xiaomi-joyeuse.dtb + dtb-$(CONFIG_ARCH_QCOM) += sm7225-fairphone-fp4.dtb + dtb-$(CONFIG_ARCH_QCOM) += sm8150-hdk.dtb +diff --git a/arch/arm64/boot/dts/qcom/sm7125-xiaomi-curtana.dts b/arch/arm64/boot/dts/qcom/sm7125-xiaomi-curtana.dts +new file mode 100644 +index 0000000000000..12f517a8492c3 +--- /dev/null ++++ b/arch/arm64/boot/dts/qcom/sm7125-xiaomi-curtana.dts +@@ -0,0 +1,16 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Copyright (c) 2023, Joe Mason ++ */ ++ ++/dts-v1/; ++ ++#include "sm7125-xiaomi-common.dtsi" ++ ++/ { ++ model = "Xiaomi Redmi Note 9S"; ++ compatible = "xiaomi,curtana", "qcom,sm7125"; ++ ++ /* required for bootloader to select correct board */ ++ qcom,board-id = <0x20022 1>; ++}; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-qcom-qcm6490-idp-add-definition-for-three-.patch b/queue-6.8/arm64-dts-qcom-qcm6490-idp-add-definition-for-three-.patch new file mode 100644 index 00000000000..df26779666e --- /dev/null +++ b/queue-6.8/arm64-dts-qcom-qcm6490-idp-add-definition-for-three-.patch @@ -0,0 +1,70 @@ +From edec2d475cca592a7c892eaa6baa656905d28c40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 10:56:52 +0800 +Subject: arm64: dts: qcom: qcm6490-idp: Add definition for three LEDs + +From: Hui Liu + +[ Upstream commit 8385383cc2c2f7039ecc57864043112cdc7026c7 ] + +Add definition for three LEDs to make sure they can +be enabled base on QCOM LPG LED driver. + +Signed-off-by: Hui Liu +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240126-lpg-v6-1-f879cecbce69@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 28 ++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/qcm6490-idp.dts b/arch/arm64/boot/dts/qcom/qcm6490-idp.dts +index 74f5a43d53db9..d58d4f5dc3173 100644 +--- a/arch/arm64/boot/dts/qcom/qcm6490-idp.dts ++++ b/arch/arm64/boot/dts/qcom/qcm6490-idp.dts +@@ -5,6 +5,7 @@ + + /dts-v1/; + ++#include + #include + #include "sc7280.dtsi" + #include "pm7325.dtsi" +@@ -415,6 +416,33 @@ vreg_bob_3p296: bob { + }; + }; + ++&pm8350c_pwm { ++ status = "okay"; ++ ++ multi-led { ++ color = ; ++ function = LED_FUNCTION_STATUS; ++ ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ led@1 { ++ reg = <1>; ++ color = ; ++ }; ++ ++ led@2 { ++ reg = <2>; ++ color = ; ++ }; ++ ++ led@3 { ++ reg = <3>; ++ color = ; ++ }; ++ }; ++}; ++ + &qupv3_id_0 { + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-qcom-qcs6490-rb3gen2-declare-gcc-clocks-pr.patch b/queue-6.8/arm64-dts-qcom-qcs6490-rb3gen2-declare-gcc-clocks-pr.patch new file mode 100644 index 00000000000..62e11974ee9 --- /dev/null +++ b/queue-6.8/arm64-dts-qcom-qcs6490-rb3gen2-declare-gcc-clocks-pr.patch @@ -0,0 +1,59 @@ +From 7eda2e758e812ad24b266b552ef6caf363b93835 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 15:21:48 -0800 +Subject: arm64: dts: qcom: qcs6490-rb3gen2: Declare GCC clocks protected + +From: Bjorn Andersson + +[ Upstream commit 7c6bef576a8891abce08d448165b53328032aa5f ] + +The SC7280 GCC binding describes clocks which, due to the difference in +security model, are not accessible on the RB3gen2 - in the same way seen +on QCM6490. + +Mark these clocks as protected, to allow the board to boot. In contrast +to the present QCM6490 boards GCC_EDP_CLKREF_EN is left out, as this +does not need to be "protected" and is used on the RB3Gen2 board. + +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Luca Weiss +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20240209-qcm6490-gcc-protected-clocks-v2-1-11cd5fc13bd0@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts b/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts +index ae1632182d7c1..ac4579119d3ba 100644 +--- a/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts ++++ b/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts +@@ -413,6 +413,23 @@ vreg_bob_3p296: bob { + }; + }; + ++&gcc { ++ protected-clocks = , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; ++}; ++ + &qupv3_id_0 { + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-qcom-qrb2210-rb1-disable-cluster-power-dom.patch b/queue-6.8/arm64-dts-qcom-qrb2210-rb1-disable-cluster-power-dom.patch new file mode 100644 index 00000000000..c95e4a37b99 --- /dev/null +++ b/queue-6.8/arm64-dts-qcom-qrb2210-rb1-disable-cluster-power-dom.patch @@ -0,0 +1,60 @@ +From eada660d63e97d5a2444a20fd1fdcb62c46d72fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 18:48:08 +0200 +Subject: arm64: dts: qcom: qrb2210-rb1: disable cluster power domains + +From: Dmitry Baryshkov + +[ Upstream commit 7f492d48f08207e4ee23edc926b11de9f720aa61 ] + +If cluster domain idle state is enabled on the RB1, the board becomes +significantly less responsive. Under certain circumstances (if some of +the devices are disabled in kernel config) the board can even lock up. + +It seems this is caused by the MPM not updating wakeup timer during CPU +idle (in the same way the RPMh updates it when cluster idle state is +entered). + +Disable cluster domain idle for the RB1 board until MPM driver is fixed +to cooperate with the CPU idle states. + +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240130-rb1-suspend-cluster-v2-1-5bc1109b0869@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts b/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts +index 64b2ab2862793..6e9dd0312adc5 100644 +--- a/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts ++++ b/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts +@@ -177,6 +177,24 @@ vph_pwr: regulator-vph-pwr { + }; + }; + ++&CPU_PD0 { ++ /delete-property/ power-domains; ++}; ++ ++&CPU_PD1 { ++ /delete-property/ power-domains; ++}; ++ ++&CPU_PD2 { ++ /delete-property/ power-domains; ++}; ++ ++&CPU_PD3 { ++ /delete-property/ power-domains; ++}; ++ ++/delete-node/ &CLUSTER_PD; ++ + &gpi_dma0 { + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-fix-rk3328-hdmi-ports-node.patch b/queue-6.8/arm64-dts-rockchip-fix-rk3328-hdmi-ports-node.patch new file mode 100644 index 00000000000..35ab5f049c6 --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-fix-rk3328-hdmi-ports-node.patch @@ -0,0 +1,49 @@ +From 266c767fbd5d47942c0942aa7fbe10c4354f1118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 22:17:08 +0100 +Subject: arm64: dts: rockchip: fix rk3328 hdmi ports node + +From: Johan Jonker + +[ Upstream commit 1d00ba4700d1e0f88ae70d028d2e17e39078fa1c ] + +Fix rk3328 hdmi ports node so that it matches the +rockchip,dw-hdmi.yaml binding. + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/e5dea3b7-bf84-4474-9530-cc2da3c41104@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 7b4c15c4a9c31..b6f045069ee2f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -744,11 +744,20 @@ hdmi: hdmi@ff3c0000 { + status = "disabled"; + + ports { +- hdmi_in: port { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ hdmi_in: port@0 { ++ reg = <0>; ++ + hdmi_in_vop: endpoint { + remote-endpoint = <&vop_out_hdmi>; + }; + }; ++ ++ hdmi_out: port@1 { ++ reg = <1>; ++ }; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-rockchip-fix-rk3399-hdmi-ports-node.patch b/queue-6.8/arm64-dts-rockchip-fix-rk3399-hdmi-ports-node.patch new file mode 100644 index 00000000000..e3c5cf068ca --- /dev/null +++ b/queue-6.8/arm64-dts-rockchip-fix-rk3399-hdmi-ports-node.patch @@ -0,0 +1,65 @@ +From d3da03e6f2420c462afa926810aed21d8d7c8ea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 22:17:31 +0100 +Subject: arm64: dts: rockchip: fix rk3399 hdmi ports node + +From: Johan Jonker + +[ Upstream commit f051b6ace7ffcc48d6d1017191f167c0a85799f6 ] + +Fix rk3399 hdmi ports node so that it matches the +rockchip,dw-hdmi.yaml binding. + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/a6ab6f75-3b80-40b1-bd30-3113e14becdd@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index 6e12c5a920cab..fe818a2700aa7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -1956,6 +1956,7 @@ simple-audio-card,codec { + hdmi: hdmi@ff940000 { + compatible = "rockchip,rk3399-dw-hdmi"; + reg = <0x0 0xff940000 0x0 0x20000>; ++ reg-io-width = <4>; + interrupts = ; + clocks = <&cru PCLK_HDMI_CTRL>, + <&cru SCLK_HDMI_SFR>, +@@ -1964,13 +1965,16 @@ hdmi: hdmi@ff940000 { + <&cru PLL_VPLL>; + clock-names = "iahb", "isfr", "cec", "grf", "ref"; + power-domains = <&power RK3399_PD_HDCP>; +- reg-io-width = <4>; + rockchip,grf = <&grf>; + #sound-dai-cells = <0>; + status = "disabled"; + + ports { +- hdmi_in: port { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ hdmi_in: port@0 { ++ reg = <0>; + #address-cells = <1>; + #size-cells = <0>; + +@@ -1983,6 +1987,10 @@ hdmi_in_vopl: endpoint@1 { + remote-endpoint = <&vopl_out_hdmi>; + }; + }; ++ ++ hdmi_out: port@1 { ++ reg = <1>; ++ }; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.8/arm64-dts-ti-makefile-add-hdmi-audio-check-for-am62a.patch b/queue-6.8/arm64-dts-ti-makefile-add-hdmi-audio-check-for-am62a.patch new file mode 100644 index 00000000000..f265c1eb124 --- /dev/null +++ b/queue-6.8/arm64-dts-ti-makefile-add-hdmi-audio-check-for-am62a.patch @@ -0,0 +1,46 @@ +From 528ef85399f6c553fa8f458f9736a7f59d3baddf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 18:24:52 +0530 +Subject: arm64: dts: ti: Makefile: Add HDMI audio check for AM62A7-SK + +From: Aradhya Bhatia + +[ Upstream commit cff6dd01a68fe9a8aaab724ef4e21f37eff609e9 ] + +HDMI audio can be enabled over AM62A-SK using the same DT overlay that +is used for AM625 / AM62-LP SK-EVMs. + +Add the sk.dtb + hdmi-audio.dtbo combination for AM62A7-SK as well, to +check for overlay applicability during DTBS compile tests. + +Signed-off-by: Aradhya Bhatia +Link: https://lore.kernel.org/r/20240201125452.1920623-4-a-bhatia1@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/ti/Makefile b/arch/arm64/boot/dts/ti/Makefile +index 08ce34d21d5d0..c738d5bfa6bae 100644 +--- a/arch/arm64/boot/dts/ti/Makefile ++++ b/arch/arm64/boot/dts/ti/Makefile +@@ -102,6 +102,7 @@ k3-am62a7-sk-csi2-ov5640-dtbs := k3-am62a7-sk.dtb \ + k3-am62x-sk-csi2-ov5640.dtbo + k3-am62a7-sk-csi2-tevi-ov5640-dtbs := k3-am62a7-sk.dtb \ + k3-am62x-sk-csi2-tevi-ov5640.dtbo ++k3-am62a7-sk-hdmi-audio-dtbs := k3-am62a7-sk.dtb k3-am62x-sk-hdmi-audio.dtbo + k3-am642-tqma64xxl-mbax4xxl-sdcard-dtbs := \ + k3-am642-tqma64xxl-mbax4xxl.dtb k3-am64-tqma64xxl-mbax4xxl-sdcard.dtbo + k3-am642-tqma64xxl-mbax4xxl-wlan-dtbs := \ +@@ -119,6 +120,7 @@ dtb- += k3-am625-beagleplay-csi2-ov5640.dtb \ + k3-am62-lp-sk-hdmi-audio.dtb \ + k3-am62a7-sk-csi2-imx219.dtb \ + k3-am62a7-sk-csi2-ov5640.dtb \ ++ k3-am62a7-sk-hdmi-audio.dtb \ + k3-am642-tqma64xxl-mbax4xxl-sdcard.dtb \ + k3-am642-tqma64xxl-mbax4xxl-wlan.dtb \ + k3-j721e-evm-pcie0-ep.dtb \ +-- +2.43.0 + diff --git a/queue-6.8/asoc-amd-yc-fix-non-functional-mic-on-asus-m7600re.patch b/queue-6.8/asoc-amd-yc-fix-non-functional-mic-on-asus-m7600re.patch new file mode 100644 index 00000000000..0902ed17a25 --- /dev/null +++ b/queue-6.8/asoc-amd-yc-fix-non-functional-mic-on-asus-m7600re.patch @@ -0,0 +1,42 @@ +From 45921f4be36a0b6d1a29de93353de6c53a1078b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 17:35:40 -0500 +Subject: ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE + +From: M Cooley + +[ Upstream commit db185362fca554b201e2c62beb15a02bb39a064b ] + +The ASUS M7600RE (Vivobook Pro 16X OLED) needs a quirks-table entry for the +internal microphone to function properly. + +Signed-off-by: Mitch Cooley + +Link: https://msgid.link/r/CALijGznExWW4fujNWwMzmn_K=wo96sGzV_2VkT7NjvEUdkg7Gw@mail.gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 1d1452c29ed02..69c68d8e7a6b5 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -311,6 +311,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "E1504FA"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "M7600RE"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.8/asoc-intel-avs-populate-board-selection-with-new-i2s.patch b/queue-6.8/asoc-intel-avs-populate-board-selection-with-new-i2s.patch new file mode 100644 index 00000000000..cbec0cd307f --- /dev/null +++ b/queue-6.8/asoc-intel-avs-populate-board-selection-with-new-i2s.patch @@ -0,0 +1,132 @@ +From e99c9edacf22ab34de723ef6db71e0a4a9156bc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 12:50:35 +0100 +Subject: ASoC: Intel: avs: Populate board selection with new I2S entries +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cezary Rojewski + +[ Upstream commit 5b417fe0cded0b5917683398e6519aae8045cd40 ] + +Update board selection with tables specifying supported I2S +configurations. DMIC/HDAudio board selection require no update as +dmic/hdaudio machine boards are generic and not tied to any specific +codec. + +Reviewed-by: Amadeusz Sławiński +Signed-off-by: Cezary Rojewski +Link: https://msgid.link/r/20240220115035.770402-11-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/board_selection.c | 85 +++++++++++++++++++++++++++ + 1 file changed, 85 insertions(+) + +diff --git a/sound/soc/intel/avs/board_selection.c b/sound/soc/intel/avs/board_selection.c +index 8e91eece992db..8360ce557401c 100644 +--- a/sound/soc/intel/avs/board_selection.c ++++ b/sound/soc/intel/avs/board_selection.c +@@ -236,6 +236,82 @@ static struct snd_soc_acpi_mach avs_gml_i2s_machines[] = { + {}, + }; + ++static struct snd_soc_acpi_mach avs_cnl_i2s_machines[] = { ++ { ++ .id = "INT34C2", ++ .drv_name = "avs_rt274", ++ .mach_params = { ++ .i2s_link_mask = AVS_SSP(0), ++ }, ++ .tplg_filename = "rt274-tplg.bin", ++ }, ++ { ++ .id = "10EC5682", ++ .drv_name = "avs_rt5682", ++ .mach_params = { ++ .i2s_link_mask = AVS_SSP(1), ++ }, ++ .tplg_filename = "rt5682-tplg.bin", ++ }, ++ {}, ++}; ++ ++static struct snd_soc_acpi_mach avs_icl_i2s_machines[] = { ++ { ++ .id = "INT343A", ++ .drv_name = "avs_rt298", ++ .mach_params = { ++ .i2s_link_mask = AVS_SSP(0), ++ }, ++ .tplg_filename = "rt298-tplg.bin", ++ }, ++ { ++ .id = "INT34C2", ++ .drv_name = "avs_rt274", ++ .mach_params = { ++ .i2s_link_mask = AVS_SSP(0), ++ }, ++ .tplg_filename = "rt274-tplg.bin", ++ }, ++ {}, ++}; ++ ++static struct snd_soc_acpi_mach avs_tgl_i2s_machines[] = { ++ { ++ .id = "INT34C2", ++ .drv_name = "avs_rt274", ++ .mach_params = { ++ .i2s_link_mask = AVS_SSP(0), ++ }, ++ .tplg_filename = "rt274-tplg.bin", ++ }, ++ { ++ .id = "10EC0298", ++ .drv_name = "avs_rt298", ++ .mach_params = { ++ .i2s_link_mask = AVS_SSP(0), ++ }, ++ .tplg_filename = "rt298-tplg.bin", ++ }, ++ { ++ .id = "10EC1308", ++ .drv_name = "avs_rt1308", ++ .mach_params = { ++ .i2s_link_mask = AVS_SSP(1), ++ }, ++ .tplg_filename = "rt1308-tplg.bin", ++ }, ++ { ++ .id = "ESSX8336", ++ .drv_name = "avs_es8336", ++ .mach_params = { ++ .i2s_link_mask = AVS_SSP(0), ++ }, ++ .tplg_filename = "es8336-tplg.bin", ++ }, ++ {}, ++}; ++ + static struct snd_soc_acpi_mach avs_test_i2s_machines[] = { + { + .drv_name = "avs_i2s_test", +@@ -296,6 +372,15 @@ static const struct avs_acpi_boards i2s_boards[] = { + AVS_MACH_ENTRY(HDA_KBL_LP, avs_kbl_i2s_machines), + AVS_MACH_ENTRY(HDA_APL, avs_apl_i2s_machines), + AVS_MACH_ENTRY(HDA_GML, avs_gml_i2s_machines), ++ AVS_MACH_ENTRY(HDA_CNL_LP, avs_cnl_i2s_machines), ++ AVS_MACH_ENTRY(HDA_CNL_H, avs_cnl_i2s_machines), ++ AVS_MACH_ENTRY(HDA_CML_LP, avs_cnl_i2s_machines), ++ AVS_MACH_ENTRY(HDA_ICL_LP, avs_icl_i2s_machines), ++ AVS_MACH_ENTRY(HDA_TGL_LP, avs_tgl_i2s_machines), ++ AVS_MACH_ENTRY(HDA_EHL_0, avs_tgl_i2s_machines), ++ AVS_MACH_ENTRY(HDA_ADL_P, avs_tgl_i2s_machines), ++ AVS_MACH_ENTRY(HDA_RPL_P_0, avs_tgl_i2s_machines), ++ AVS_MACH_ENTRY(HDA_RPL_M, avs_tgl_i2s_machines), + {}, + }; + +-- +2.43.0 + diff --git a/queue-6.8/asoc-intel-common-dmi-remap-for-rebranded-intel-nuc-.patch b/queue-6.8/asoc-intel-common-dmi-remap-for-rebranded-intel-nuc-.patch new file mode 100644 index 00000000000..36767840475 --- /dev/null +++ b/queue-6.8/asoc-intel-common-dmi-remap-for-rebranded-intel-nuc-.patch @@ -0,0 +1,73 @@ +From d14fb3c3bb33b804331cc22f2ca15c60ecc2e38f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 10:55:40 -0600 +Subject: ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) + laptops +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: mosomate + +[ Upstream commit c13e03126a5be90781084437689724254c8226e1 ] + +Added DMI quirk to handle the rebranded variants of Intel NUC M15 +(LAPRC710) laptops. The DMI matching is based on motherboard +attributes. + +Link: https://github.com/thesofproject/linux/issues/4218 +Signed-off-by: Máté Mosonyi +Reviewed-by: Bard Liao +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20240208165545.93811-20-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/soundwire/dmi-quirks.c | 8 ++++++++ + sound/soc/intel/boards/sof_sdw.c | 11 +++++++++++ + 2 files changed, 19 insertions(+) + +diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c +index 9ebdd0cd0b1cf..91ab97a456fa9 100644 +--- a/drivers/soundwire/dmi-quirks.c ++++ b/drivers/soundwire/dmi-quirks.c +@@ -130,6 +130,14 @@ static const struct dmi_system_id adr_remap_quirk_table[] = { + }, + .driver_data = (void *)intel_rooks_county, + }, ++ { ++ /* quirk used for NUC15 LAPRC710 skew */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "LAPRC710"), ++ }, ++ .driver_data = (void *)intel_rooks_county, ++ }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 300391fbc2fc2..cf14bd3053fc9 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -236,6 +236,17 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + SOF_SDW_PCH_DMIC | + RT711_JD2_100K), + }, ++ { ++ /* NUC15 LAPRC710 skews */ ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "LAPRC710"), ++ }, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_SDW_PCH_DMIC | ++ RT711_JD2_100K), ++ }, + /* TigerLake-SDCA devices */ + { + .callback = sof_sdw_quirk_cb, +-- +2.43.0 + diff --git a/queue-6.8/asoc-intel-sof_rt5682-dmi-quirk-cleanup-for-mtl-boar.patch b/queue-6.8/asoc-intel-sof_rt5682-dmi-quirk-cleanup-for-mtl-boar.patch new file mode 100644 index 00000000000..f003343f154 --- /dev/null +++ b/queue-6.8/asoc-intel-sof_rt5682-dmi-quirk-cleanup-for-mtl-boar.patch @@ -0,0 +1,76 @@ +From e2e08480c4449052092a5dab210d1713a873b06d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 10:55:27 -0600 +Subject: ASoC: Intel: sof_rt5682: dmi quirk cleanup for mtl boards + +From: Brent Lu + +[ Upstream commit 7a2a8730d51f95b263a1e8b888598dc6395220dc ] + +Some dmi quirks are duplicated since codec and amplifier type are +removed from board quirk. Remove redundant quirks. + +Reviewed-by: Bard Liao +Signed-off-by: Brent Lu +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20240208165545.93811-7-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_rt5682.c | 40 ----------------------------- + 1 file changed, 40 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c +index cd50f26d1edbe..02705034e5713 100644 +--- a/sound/soc/intel/boards/sof_rt5682.c ++++ b/sound/soc/intel/boards/sof_rt5682.c +@@ -154,46 +154,6 @@ static const struct dmi_system_id sof_rt5682_quirk_table[] = { + SOF_RT5682_SSP_AMP(2) | + SOF_RT5682_NUM_HDMIDEV(4)), + }, +- { +- .callback = sof_rt5682_quirk_cb, +- .matches = { +- DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Rex"), +- DMI_MATCH(DMI_OEM_STRING, "AUDIO-MAX98360_ALC5682I_I2S"), +- }, +- .driver_data = (void *)(SOF_RT5682_MCLK_EN | +- SOF_RT5682_SSP_CODEC(2) | +- SOF_RT5682_SSP_AMP(0) | +- SOF_RT5682_NUM_HDMIDEV(3) | +- SOF_BT_OFFLOAD_SSP(1) | +- SOF_SSP_BT_OFFLOAD_PRESENT +- ), +- }, +- { +- .callback = sof_rt5682_quirk_cb, +- .matches = { +- DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Rex"), +- DMI_MATCH(DMI_OEM_STRING, "AUDIO-MAX98360_ALC5682I_DISCRETE_I2S_BT"), +- }, +- .driver_data = (void *)(SOF_RT5682_MCLK_EN | +- SOF_RT5682_SSP_CODEC(2) | +- SOF_RT5682_SSP_AMP(0) | +- SOF_RT5682_NUM_HDMIDEV(3) | +- SOF_BT_OFFLOAD_SSP(1) | +- SOF_SSP_BT_OFFLOAD_PRESENT +- ), +- }, +- { +- .callback = sof_rt5682_quirk_cb, +- .matches = { +- DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Rex"), +- DMI_MATCH(DMI_OEM_STRING, "AUDIO-ALC1019_ALC5682I_I2S"), +- }, +- .driver_data = (void *)(SOF_RT5682_MCLK_EN | +- SOF_RT5682_SSP_CODEC(2) | +- SOF_RT5682_SSP_AMP(0) | +- SOF_RT5682_NUM_HDMIDEV(3) +- ), +- }, + { + .callback = sof_rt5682_quirk_cb, + .matches = { +-- +2.43.0 + diff --git a/queue-6.8/asoc-soc-core.c-skip-dummy-codec-when-adding-platfor.patch b/queue-6.8/asoc-soc-core.c-skip-dummy-codec-when-adding-platfor.patch new file mode 100644 index 00000000000..771cc7d4f7c --- /dev/null +++ b/queue-6.8/asoc-soc-core.c-skip-dummy-codec-when-adding-platfor.patch @@ -0,0 +1,42 @@ +From ed319ec7bd1ea680ae0ce3750cbb697549fd19c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 15:56:06 +0900 +Subject: ASoC: soc-core.c: Skip dummy codec when adding platforms + +From: Chancel Liu + +[ Upstream commit 23fb6bc2696119391ec3a92ccaffe50e567c515e ] + +When pcm_runtime is adding platform components it will scan all +registered components. In case of DPCM FE/BE some DAI links will +configure dummy platform. However both dummy codec and dummy platform +are using "snd-soc-dummy" as component->name. Dummy codec should be +skipped when adding platforms otherwise there'll be overflow and UBSAN +complains. + +Reported-by: Zhipeng Wang +Signed-off-by: Chancel Liu +Link: https://msgid.link/r/20240305065606.3778642-1-chancel.liu@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 516350533e73f..8b5b583a2bad0 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -1218,6 +1218,9 @@ static int snd_soc_add_pcm_runtime(struct snd_soc_card *card, + if (!snd_soc_is_matching_component(platform, component)) + continue; + ++ if (snd_soc_component_is_dummy(component) && component->num_dai) ++ continue; ++ + snd_soc_rtd_add_component(rtd, component); + } + } +-- +2.43.0 + diff --git a/queue-6.8/asoc-sof-amd-optimize-quirk-for-valve-galileo.patch b/queue-6.8/asoc-sof-amd-optimize-quirk-for-valve-galileo.patch new file mode 100644 index 00000000000..b04475d6aca --- /dev/null +++ b/queue-6.8/asoc-sof-amd-optimize-quirk-for-valve-galileo.patch @@ -0,0 +1,46 @@ +From 9bb5b416c4f8b658f82dc45eb0a0eaad60c337c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 05:07:24 +0200 +Subject: ASoC: SOF: amd: Optimize quirk for Valve Galileo + +From: Cristian Ciocaltea + +[ Upstream commit a13f0c3c0e8fb3e61fbfd99c6b350cf9be0c4660 ] + +Valve's Steam Deck OLED is uniquely identified by vendor and product +name (Galileo) DMI fields. + +Simplify the quirk by removing the unnecessary match on product family. + +Additionally, fix the related comment as it points to the old product +variant. + +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Emil Velikov +Link: https://msgid.link/r/20231219030728.2431640-7-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/acp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c +index 2c242ef9f23c1..1b6f5724c82b0 100644 +--- a/sound/soc/sof/amd/acp.c ++++ b/sound/soc/sof/amd/acp.c +@@ -31,11 +31,10 @@ static struct acp_quirk_entry quirk_valve_galileo = { + + const struct dmi_system_id acp_sof_quirk_table[] = { + { +- /* Valve Jupiter device */ ++ /* Steam Deck OLED device */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Valve"), + DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"), +- DMI_MATCH(DMI_PRODUCT_FAMILY, "Sephiroth"), + }, + .driver_data = &quirk_valve_galileo, + }, +-- +2.43.0 + diff --git a/queue-6.8/batman-adv-improve-exception-handling-in-batadv_thro.patch b/queue-6.8/batman-adv-improve-exception-handling-in-batadv_thro.patch new file mode 100644 index 00000000000..611b82ba566 --- /dev/null +++ b/queue-6.8/batman-adv-improve-exception-handling-in-batadv_thro.patch @@ -0,0 +1,71 @@ +From c86f2e47765ebbd6cf332b5174fa855d9967a405 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jan 2024 07:52:21 +0100 +Subject: batman-adv: Improve exception handling in batadv_throw_uevent() + +From: Markus Elfring + +[ Upstream commit 5593e9abf1cf2bf096366d8c7fd933bc69d561ce ] + +The kfree() function was called in up to three cases by +the batadv_throw_uevent() function during error handling +even if the passed variable contained a null pointer. +This issue was detected by using the Coccinelle software. + +* Thus adjust jump targets. + +* Reorder kfree() calls at the end. + +Signed-off-by: Markus Elfring +Acked-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/main.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c +index 5fc754b0b3f7f..75119f1ffcccf 100644 +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -691,29 +691,31 @@ int batadv_throw_uevent(struct batadv_priv *bat_priv, enum batadv_uev_type type, + "%s%s", BATADV_UEV_TYPE_VAR, + batadv_uev_type_str[type]); + if (!uevent_env[0]) +- goto out; ++ goto report_error; + + uevent_env[1] = kasprintf(GFP_ATOMIC, + "%s%s", BATADV_UEV_ACTION_VAR, + batadv_uev_action_str[action]); + if (!uevent_env[1]) +- goto out; ++ goto free_first_env; + + /* If the event is DEL, ignore the data field */ + if (action != BATADV_UEV_DEL) { + uevent_env[2] = kasprintf(GFP_ATOMIC, + "%s%s", BATADV_UEV_DATA_VAR, data); + if (!uevent_env[2]) +- goto out; ++ goto free_second_env; + } + + ret = kobject_uevent_env(bat_kobj, KOBJ_CHANGE, uevent_env); +-out: +- kfree(uevent_env[0]); +- kfree(uevent_env[1]); + kfree(uevent_env[2]); ++free_second_env: ++ kfree(uevent_env[1]); ++free_first_env: ++ kfree(uevent_env[0]); + + if (ret) ++report_error: + batadv_dbg(BATADV_DBG_BATMAN, bat_priv, + "Impossible to send uevent for (%s,%s,%s) event (err: %d)\n", + batadv_uev_type_str[type], +-- +2.43.0 + diff --git a/queue-6.8/batman-adv-return-directly-after-a-failed-batadv_dat.patch b/queue-6.8/batman-adv-return-directly-after-a-failed-batadv_dat.patch new file mode 100644 index 00000000000..9c2340c464e --- /dev/null +++ b/queue-6.8/batman-adv-return-directly-after-a-failed-batadv_dat.patch @@ -0,0 +1,55 @@ +From 8253cc06e0c3fdbcc5857da6f3ea00b390d35457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jan 2024 07:27:45 +0100 +Subject: batman-adv: Return directly after a failed + batadv_dat_select_candidates() in batadv_dat_forward_data() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Markus Elfring + +[ Upstream commit ffc15626c861f811f9778914be004fcf43810a91 ] + +The kfree() function was called in one case by +the batadv_dat_forward_data() function during error handling +even if the passed variable contained a null pointer. +This issue was detected by using the Coccinelle software. + +* Thus return directly after a batadv_dat_select_candidates() call failed + at the beginning. + +* Delete the label “out” which became unnecessary with this refactoring. + +Signed-off-by: Markus Elfring +Acked-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/distributed-arp-table.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c +index 28a939d560906..4c7e855343245 100644 +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -684,7 +684,7 @@ static bool batadv_dat_forward_data(struct batadv_priv *bat_priv, + + cand = batadv_dat_select_candidates(bat_priv, ip, vid); + if (!cand) +- goto out; ++ return ret; + + batadv_dbg(BATADV_DBG_DAT, bat_priv, "DHT_SEND for %pI4\n", &ip); + +@@ -728,7 +728,6 @@ static bool batadv_dat_forward_data(struct batadv_priv *bat_priv, + batadv_orig_node_put(cand[i].orig_node); + } + +-out: + kfree(cand); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.8/block-prevent-division-by-zero-in-blk_rq_stat_sum.patch b/queue-6.8/block-prevent-division-by-zero-in-blk_rq_stat_sum.patch new file mode 100644 index 00000000000..e13c9342df5 --- /dev/null +++ b/queue-6.8/block-prevent-division-by-zero-in-blk_rq_stat_sum.patch @@ -0,0 +1,40 @@ +From 06c0345a5dbdc0181c0c00c008c983f4d3173be4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 16:45:09 +0300 +Subject: block: prevent division by zero in blk_rq_stat_sum() + +From: Roman Smirnov + +[ Upstream commit 93f52fbeaf4b676b21acfe42a5152620e6770d02 ] + +The expression dst->nr_samples + src->nr_samples may +have zero value on overflow. It is necessary to add +a check to avoid division by zero. + +Found by Linux Verification Center (linuxtesting.org) with Svace. + +Signed-off-by: Roman Smirnov +Reviewed-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/20240305134509.23108-1-r.smirnov@omp.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-stat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blk-stat.c b/block/blk-stat.c +index 7ff76ae6c76a9..e42c263e53fb9 100644 +--- a/block/blk-stat.c ++++ b/block/blk-stat.c +@@ -27,7 +27,7 @@ void blk_rq_stat_init(struct blk_rq_stat *stat) + /* src is a per-cpu stat, mean isn't initialized */ + void blk_rq_stat_sum(struct blk_rq_stat *dst, struct blk_rq_stat *src) + { +- if (!src->nr_samples) ++ if (dst->nr_samples + src->nr_samples <= dst->nr_samples) + return; + + dst->min = min(dst->min, src->min); +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-add-new-quirk-for-broken-read-key-length-o.patch b/queue-6.8/bluetooth-add-new-quirk-for-broken-read-key-length-o.patch new file mode 100644 index 00000000000..d2f26cb1dd6 --- /dev/null +++ b/queue-6.8/bluetooth-add-new-quirk-for-broken-read-key-length-o.patch @@ -0,0 +1,86 @@ +From 706aface76b3d7cef9716ad65f1f987d5da90140 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 22:43:26 -0300 +Subject: Bluetooth: Add new quirk for broken read key length on ATS2851 + +From: Vinicius Peixoto + +[ Upstream commit 48201a3b3f398be6a01f78a14b18bd5d31c47458 ] + +The ATS2851 controller erroneously reports support for the "Read +Encryption Key Length" HCI command. This makes it unable to connect +to any devices, since this command is issued by the kernel during the +connection process in response to an "Encryption Change" HCI event. + +Add a new quirk (HCI_QUIRK_BROKEN_ENC_KEY_SIZE) to hint that the command +is unsupported, preventing it from interrupting the connection process. + +This is the error log from btmon before this patch: + +> HCI Event: Encryption Change (0x08) plen 4 + Status: Success (0x00) + Handle: 2048 Address: ... + Encryption: Enabled with E0 (0x01) +< HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2 + Handle: 2048 Address: ... +> HCI Event: Command Status (0x0f) plen 4 + Read Encryption Key Size (0x05|0x0008) ncmd 1 + Status: Unknown HCI Command (0x01) + +Signed-off-by: Vinicius Peixoto +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + include/net/bluetooth/hci.h | 8 ++++++++ + net/bluetooth/hci_event.c | 3 ++- + 3 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 6cb87d47ad7d5..f684108dc2f1c 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -4483,6 +4483,7 @@ static int btusb_probe(struct usb_interface *intf, + set_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks); + set_bit(HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT, &hdev->quirks); + set_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &hdev->quirks); ++ set_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks); + } + + if (!reset) +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index 03e68a8e229f5..35c5f75a3a5ee 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -339,6 +339,14 @@ enum { + * during the hdev->setup vendor callback. + */ + HCI_QUIRK_BROKEN_LE_CODED, ++ ++ /* ++ * When this quirk is set, the HCI_OP_READ_ENC_KEY_SIZE command is ++ * skipped during an HCI_EV_ENCRYPT_CHANGE event. This is required ++ * for Actions Semiconductor ATS2851 based controllers, which erroneously ++ * claim to support it. ++ */ ++ HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, + }; + + /* HCI device flags */ +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 3b63513f57ba8..3992e18f0babb 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3679,7 +3679,8 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data, + * controller really supports it. If it doesn't, assume + * the default size (16). + */ +- if (!(hdev->commands[20] & 0x10)) { ++ if (!(hdev->commands[20] & 0x10) || ++ test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks)) { + conn->enc_key_size = HCI_LINK_KEY_SIZE; + goto notify; + } +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-btintel-fix-null-ptr-deref-in-btintel_read.patch b/queue-6.8/bluetooth-btintel-fix-null-ptr-deref-in-btintel_read.patch new file mode 100644 index 00000000000..cbc9af3ff7a --- /dev/null +++ b/queue-6.8/bluetooth-btintel-fix-null-ptr-deref-in-btintel_read.patch @@ -0,0 +1,36 @@ +From 5e7e8ad42892f43c935a6d96034b024d3ade2d1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 12:40:34 +0800 +Subject: Bluetooth: btintel: Fix null ptr deref in btintel_read_version + +From: Edward Adam Davis + +[ Upstream commit b79e040910101b020931ba0c9a6b77e81ab7f645 ] + +If hci_cmd_sync_complete() is triggered and skb is NULL, then +hdev->req_skb is NULL, which will cause this issue. + +Reported-and-tested-by: syzbot+830d9e3fa61968246abd@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btintel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c +index cdc5c08824a0a..e5b043d962073 100644 +--- a/drivers/bluetooth/btintel.c ++++ b/drivers/bluetooth/btintel.c +@@ -435,7 +435,7 @@ int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) + struct sk_buff *skb; + + skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); +- if (IS_ERR(skb)) { ++ if (IS_ERR_OR_NULL(skb)) { + bt_dev_err(hdev, "Reading Intel version information failed (%ld)", + PTR_ERR(skb)); + return PTR_ERR(skb); +-- +2.43.0 + diff --git a/queue-6.8/bluetooth-btmtk-add-module_firmware-for-mt7922.patch b/queue-6.8/bluetooth-btmtk-add-module_firmware-for-mt7922.patch new file mode 100644 index 00000000000..d0155e9ce33 --- /dev/null +++ b/queue-6.8/bluetooth-btmtk-add-module_firmware-for-mt7922.patch @@ -0,0 +1,54 @@ +From ce0ac910269d25d5dc517b457198bfebd26a94be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 11:29:14 +0100 +Subject: Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922 + +From: Takashi Iwai + +[ Upstream commit 3e465a07cdf444140f16bc57025c23fcafdde997 ] + +Since dracut refers to the module info for defining the required +firmware files and btmtk driver doesn't provide the firmware info for +MT7922, the generate initrd misses the firmware, resulting in the +broken Bluetooth. + +This patch simply adds the MODULE_FIRMWARE() for the missing entry +for covering that. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1214133 +Signed-off-by: Takashi Iwai +Reviewed-by: Paul Menzel +Reviewed-by: Matthias Brugger +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtk.c | 1 + + drivers/bluetooth/btmtk.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c +index 285418dbb43f5..ac8ebccd35075 100644 +--- a/drivers/bluetooth/btmtk.c ++++ b/drivers/bluetooth/btmtk.c +@@ -422,5 +422,6 @@ MODULE_LICENSE("GPL"); + MODULE_FIRMWARE(FIRMWARE_MT7622); + MODULE_FIRMWARE(FIRMWARE_MT7663); + MODULE_FIRMWARE(FIRMWARE_MT7668); ++MODULE_FIRMWARE(FIRMWARE_MT7922); + MODULE_FIRMWARE(FIRMWARE_MT7961); + MODULE_FIRMWARE(FIRMWARE_MT7925); +diff --git a/drivers/bluetooth/btmtk.h b/drivers/bluetooth/btmtk.h +index 56f5502baadf9..cbcdb99a22e6d 100644 +--- a/drivers/bluetooth/btmtk.h ++++ b/drivers/bluetooth/btmtk.h +@@ -4,6 +4,7 @@ + #define FIRMWARE_MT7622 "mediatek/mt7622pr2h.bin" + #define FIRMWARE_MT7663 "mediatek/mt7663pr2h.bin" + #define FIRMWARE_MT7668 "mediatek/mt7668pr2h.bin" ++#define FIRMWARE_MT7922 "mediatek/BT_RAM_CODE_MT7922_1_1_hdr.bin" + #define FIRMWARE_MT7961 "mediatek/BT_RAM_CODE_MT7961_1_2_hdr.bin" + #define FIRMWARE_MT7925 "mediatek/mt7925/BT_RAM_CODE_MT7925_1_1_hdr.bin" + +-- +2.43.0 + diff --git a/queue-6.8/bnx2x-fix-firmware-version-string-character-counts.patch b/queue-6.8/bnx2x-fix-firmware-version-string-character-counts.patch new file mode 100644 index 00000000000..af74cdfff17 --- /dev/null +++ b/queue-6.8/bnx2x-fix-firmware-version-string-character-counts.patch @@ -0,0 +1,137 @@ +From 46d7af03c63741932721221865f79f6a2105f5a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 20:10:48 -0800 +Subject: bnx2x: Fix firmware version string character counts + +From: Kees Cook + +[ Upstream commit 5642c82b9463c3263c086efb002516244bd4c668 ] + +A potential string truncation was reported in bnx2x_fill_fw_str(), +when a long bp->fw_ver and a long phy_fw_ver might coexist, but seems +unlikely with real-world hardware. + +Use scnprintf() to indicate the intent that truncations are tolerated. + +While reading this code, I found a collection of various buffer size +counting issues. None looked like they might lead to a buffer overflow +with current code (the small buffers are 20 bytes and might only ever +consume 10 bytes twice with a trailing %NUL). However, early truncation +(due to a %NUL in the middle of the string) might be happening under +likely rare conditions. Regardless fix the formatters and related +functions: + +- Switch from a separate strscpy() to just adding an additional "%s" to + the format string that immediately follows it in bnx2x_fill_fw_str(). +- Use sizeof() universally instead of using unbound defines. +- Fix bnx2x_7101_format_ver() and bnx2x_null_format_ver() to report the + number of characters written, not including the trailing %NUL (as + already done with the other firmware formatting functions). +- Require space for at least 1 byte in bnx2x_get_ext_phy_fw_version() + for the trailing %NUL. +- Correct the needed buffer size in bnx2x_3_seq_format_ver(). + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202401260858.jZN6vD1k-lkp@intel.com/ +Cc: Ariel Elior +Cc: Sudarsana Kalluru +Cc: Manish Chopra +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20240126041044.work.220-kees@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 9 +++++---- + .../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 2 +- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 14 +++++++------- + 3 files changed, 13 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index e9c1e1bb55806..528441b28c4ef 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -147,10 +147,11 @@ void bnx2x_fill_fw_str(struct bnx2x *bp, char *buf, size_t buf_len) + + phy_fw_ver[0] = '\0'; + bnx2x_get_ext_phy_fw_version(&bp->link_params, +- phy_fw_ver, PHY_FW_VER_LEN); +- strscpy(buf, bp->fw_ver, buf_len); +- snprintf(buf + strlen(bp->fw_ver), 32 - strlen(bp->fw_ver), +- "bc %d.%d.%d%s%s", ++ phy_fw_ver, sizeof(phy_fw_ver)); ++ /* This may become truncated. */ ++ scnprintf(buf, buf_len, ++ "%sbc %d.%d.%d%s%s", ++ bp->fw_ver, + (bp->common.bc_ver & 0xff0000) >> 16, + (bp->common.bc_ver & 0xff00) >> 8, + (bp->common.bc_ver & 0xff), +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c +index 81d232e6d05fe..0bc7690cdee16 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c +@@ -1132,7 +1132,7 @@ static void bnx2x_get_drvinfo(struct net_device *dev, + } + + memset(version, 0, sizeof(version)); +- bnx2x_fill_fw_str(bp, version, ETHTOOL_FWVERS_LEN); ++ bnx2x_fill_fw_str(bp, version, sizeof(version)); + strlcat(info->fw_version, version, sizeof(info->fw_version)); + + strscpy(info->bus_info, pci_name(bp->pdev), sizeof(info->bus_info)); +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c +index 02808513ffe45..ea310057fe3af 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c +@@ -6163,8 +6163,8 @@ static void bnx2x_link_int_ack(struct link_params *params, + + static int bnx2x_null_format_ver(u32 spirom_ver, u8 *str, u16 *len) + { +- str[0] = '\0'; +- (*len)--; ++ if (*len) ++ str[0] = '\0'; + return 0; + } + +@@ -6173,7 +6173,7 @@ static int bnx2x_format_ver(u32 num, u8 *str, u16 *len) + u16 ret; + + if (*len < 10) { +- /* Need more than 10chars for this format */ ++ /* Need more than 10 chars for this format */ + bnx2x_null_format_ver(num, str, len); + return -EINVAL; + } +@@ -6188,8 +6188,8 @@ static int bnx2x_3_seq_format_ver(u32 num, u8 *str, u16 *len) + { + u16 ret; + +- if (*len < 10) { +- /* Need more than 10chars for this format */ ++ if (*len < 9) { ++ /* Need more than 9 chars for this format */ + bnx2x_null_format_ver(num, str, len); + return -EINVAL; + } +@@ -6208,7 +6208,7 @@ int bnx2x_get_ext_phy_fw_version(struct link_params *params, u8 *version, + int status = 0; + u8 *ver_p = version; + u16 remain_len = len; +- if (version == NULL || params == NULL) ++ if (version == NULL || params == NULL || len == 0) + return -EINVAL; + bp = params->bp; + +@@ -11546,7 +11546,7 @@ static int bnx2x_7101_format_ver(u32 spirom_ver, u8 *str, u16 *len) + str[2] = (spirom_ver & 0xFF0000) >> 16; + str[3] = (spirom_ver & 0xFF000000) >> 24; + str[4] = '\0'; +- *len -= 5; ++ *len -= 4; + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.8/btrfs-export-handle-invalid-inode-or-root-reference-.patch b/queue-6.8/btrfs-export-handle-invalid-inode-or-root-reference-.patch new file mode 100644 index 00000000000..5a67a6ca7cb --- /dev/null +++ b/queue-6.8/btrfs-export-handle-invalid-inode-or-root-reference-.patch @@ -0,0 +1,48 @@ +From cc0ecb289a8131d5cae8aa65f2c5deb5b5ad1328 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 21:19:18 +0100 +Subject: btrfs: export: handle invalid inode or root reference in + btrfs_get_parent() + +From: David Sterba + +[ Upstream commit 26b66d1d366a375745755ca7365f67110bbf6bd5 ] + +The get_parent handler looks up a parent of a given dentry, this can be +either a subvolume or a directory. The search is set up with offset -1 +but it's never expected to find such item, as it would break allowed +range of inode number or a root id. This means it's a corruption (ext4 +also returns this error code). + +Reviewed-by: Josef Bacik +Reviewed-by: Anand Jain +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/export.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c +index 63d4cc338b81a..1ac00ee7959b7 100644 +--- a/fs/btrfs/export.c ++++ b/fs/btrfs/export.c +@@ -174,8 +174,15 @@ struct dentry *btrfs_get_parent(struct dentry *child) + ret = btrfs_search_slot(NULL, root, &key, path, 0, 0); + if (ret < 0) + goto fail; ++ if (ret == 0) { ++ /* ++ * Key with offset of -1 found, there would have to exist an ++ * inode with such number or a root with such id. ++ */ ++ ret = -EUCLEAN; ++ goto fail; ++ } + +- BUG_ON(ret == 0); /* Key with offset of -1 found */ + if (path->slots[0] == 0) { + ret = -ENOENT; + goto fail; +-- +2.43.0 + diff --git a/queue-6.8/btrfs-handle-chunk-tree-lookup-error-in-btrfs_reloca.patch b/queue-6.8/btrfs-handle-chunk-tree-lookup-error-in-btrfs_reloca.patch new file mode 100644 index 00000000000..4bda4168fcb --- /dev/null +++ b/queue-6.8/btrfs-handle-chunk-tree-lookup-error-in-btrfs_reloca.patch @@ -0,0 +1,56 @@ +From e612da729abae3c34162f4a62067dfecb45aeb58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 23:42:29 +0100 +Subject: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() + +From: David Sterba + +[ Upstream commit 7411055db5ce64f836aaffd422396af0075fdc99 ] + +The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, +as it could be caused only by two impossible conditions: + +- at first the search key is set up to look for a chunk tree item, with + offset -1, this is an inexact search and the key->offset will contain + the correct offset upon a successful search, a valid chunk tree item + cannot have an offset -1 + +- after first successful search, the found_key corresponds to a chunk + item, the offset is decremented by 1 before the next loop, it's + impossible to find a chunk item there due to alignment and size + constraints + +Reviewed-by: Josef Bacik +Reviewed-by: Anand Jain +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 5ccbb5f998175..f3890f7c78076 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -3440,7 +3440,17 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info) + mutex_unlock(&fs_info->reclaim_bgs_lock); + goto error; + } +- BUG_ON(ret == 0); /* Corruption */ ++ if (ret == 0) { ++ /* ++ * On the first search we would find chunk tree with ++ * offset -1, which is not possible. On subsequent ++ * loops this would find an existing item on an invalid ++ * offset (one less than the previous one, wrong ++ * alignment and size). ++ */ ++ ret = -EUCLEAN; ++ goto error; ++ } + + ret = btrfs_previous_item(chunk_root, path, key.objectid, + key.type); +-- +2.43.0 + diff --git a/queue-6.8/btrfs-send-handle-path-ref-underflow-in-header-itera.patch b/queue-6.8/btrfs-send-handle-path-ref-underflow-in-header-itera.patch new file mode 100644 index 00000000000..64d59fddc23 --- /dev/null +++ b/queue-6.8/btrfs-send-handle-path-ref-underflow-in-header-itera.patch @@ -0,0 +1,43 @@ +From 86d194c9ed026f0293956eff0b01cd9357577f07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 22:47:13 +0100 +Subject: btrfs: send: handle path ref underflow in header iterate_inode_ref() + +From: David Sterba + +[ Upstream commit 3c6ee34c6f9cd12802326da26631232a61743501 ] + +Change BUG_ON to proper error handling if building the path buffer +fails. The pointers are not printed so we don't accidentally leak kernel +addresses. + +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/send.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index e9516509b2761..e8187669153dd 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -1070,7 +1070,15 @@ static int iterate_inode_ref(struct btrfs_root *root, struct btrfs_path *path, + ret = PTR_ERR(start); + goto out; + } +- BUG_ON(start < p->buf); ++ if (unlikely(start < p->buf)) { ++ btrfs_err(root->fs_info, ++ "send: path ref buffer underflow for key (%llu %u %llu)", ++ found_key->objectid, ++ found_key->type, ++ found_key->offset); ++ ret = -EINVAL; ++ goto out; ++ } + } + p->start = start; + } else { +-- +2.43.0 + diff --git a/queue-6.8/bus-mhi-host-add-mhi_pm_sys_err_fail-state.patch b/queue-6.8/bus-mhi-host-add-mhi_pm_sys_err_fail-state.patch new file mode 100644 index 00000000000..9ad37f16444 --- /dev/null +++ b/queue-6.8/bus-mhi-host-add-mhi_pm_sys_err_fail-state.patch @@ -0,0 +1,157 @@ +From 2cb2dff9bb37ca7b303b03357391f09a77af7d9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jan 2024 11:08:00 -0700 +Subject: bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state + +From: Jeffrey Hugo + +[ Upstream commit bce3f770684cc1d91ff9edab431b71ac991faf29 ] + +When processing a SYSERR, if the device does not respond to the MHI_RESET +from the host, the host will be stuck in a difficult to recover state. +The host will remain in MHI_PM_SYS_ERR_PROCESS and not clean up the host +channels. Clients will not be notified of the SYSERR via the destruction +of their channel devices, which means clients may think that the device is +still up. Subsequent SYSERR events such as a device fatal error will not +be processed as the state machine cannot transition from PROCESS back to +DETECT. The only way to recover from this is to unload the mhi module +(wipe the state machine state) or for the mhi controller to initiate +SHUTDOWN. + +This issue was discovered by stress testing soc_reset events on AIC100 +via the sysfs node. + +soc_reset is processed entirely in hardware. When the register write +hits the endpoint hardware, it causes the soc to reset without firmware +involvement. In stress testing, there is a rare race where soc_reset N +will cause the soc to reset and PBL to signal SYSERR (fatal error). If +soc_reset N+1 is triggered before PBL can process the MHI_RESET from the +host, then the soc will reset again, and re-run PBL from the beginning. +This will cause PBL to lose all state. PBL will be waiting for the host +to respond to the new syserr, but host will be stuck expecting the +previous MHI_RESET to be processed. + +Additionally, the AMSS EE firmware (QSM) was hacked to synthetically +reproduce the issue by simulating a FW hang after the QSM issued a +SYSERR. In this case, soc_reset would not recover the device. + +For this failure case, to recover the device, we need a state similar to +PROCESS, but can transition to DETECT. There is not a viable existing +state to use. POR has the needed transitions, but assumes the device is +in a good state and could allow the host to attempt to use the device. +Allowing PROCESS to transition to DETECT invites the possibility of +parallel SYSERR processing which could get the host and device out of +sync. + +Thus, invent a new state - MHI_PM_SYS_ERR_FAIL + +This essentially a holding state. It allows us to clean up the host +elements that are based on the old state of the device (channels), but +does not allow us to directly advance back to an operational state. It +does allow the detection and processing of another SYSERR which may +recover the device, or allows the controller to do a clean shutdown. + +Signed-off-by: Jeffrey Hugo +Reviewed-by: Carl Vanderlip +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240112180800.536733-1-quic_jhugo@quicinc.com +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/bus/mhi/host/init.c | 1 + + drivers/bus/mhi/host/internal.h | 9 ++++++--- + drivers/bus/mhi/host/pm.c | 20 +++++++++++++++++--- + 3 files changed, 24 insertions(+), 6 deletions(-) + +diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c +index 65ceac1837f9a..8e5ec1a409b80 100644 +--- a/drivers/bus/mhi/host/init.c ++++ b/drivers/bus/mhi/host/init.c +@@ -62,6 +62,7 @@ static const char * const mhi_pm_state_str[] = { + [MHI_PM_STATE_FW_DL_ERR] = "Firmware Download Error", + [MHI_PM_STATE_SYS_ERR_DETECT] = "SYS ERROR Detect", + [MHI_PM_STATE_SYS_ERR_PROCESS] = "SYS ERROR Process", ++ [MHI_PM_STATE_SYS_ERR_FAIL] = "SYS ERROR Failure", + [MHI_PM_STATE_SHUTDOWN_PROCESS] = "SHUTDOWN Process", + [MHI_PM_STATE_LD_ERR_FATAL_DETECT] = "Linkdown or Error Fatal Detect", + }; +diff --git a/drivers/bus/mhi/host/internal.h b/drivers/bus/mhi/host/internal.h +index 30ac415a3000f..4b6deea17bcd2 100644 +--- a/drivers/bus/mhi/host/internal.h ++++ b/drivers/bus/mhi/host/internal.h +@@ -88,6 +88,7 @@ enum mhi_pm_state { + MHI_PM_STATE_FW_DL_ERR, + MHI_PM_STATE_SYS_ERR_DETECT, + MHI_PM_STATE_SYS_ERR_PROCESS, ++ MHI_PM_STATE_SYS_ERR_FAIL, + MHI_PM_STATE_SHUTDOWN_PROCESS, + MHI_PM_STATE_LD_ERR_FATAL_DETECT, + MHI_PM_STATE_MAX +@@ -104,14 +105,16 @@ enum mhi_pm_state { + #define MHI_PM_FW_DL_ERR BIT(7) + #define MHI_PM_SYS_ERR_DETECT BIT(8) + #define MHI_PM_SYS_ERR_PROCESS BIT(9) +-#define MHI_PM_SHUTDOWN_PROCESS BIT(10) ++#define MHI_PM_SYS_ERR_FAIL BIT(10) ++#define MHI_PM_SHUTDOWN_PROCESS BIT(11) + /* link not accessible */ +-#define MHI_PM_LD_ERR_FATAL_DETECT BIT(11) ++#define MHI_PM_LD_ERR_FATAL_DETECT BIT(12) + + #define MHI_REG_ACCESS_VALID(pm_state) ((pm_state & (MHI_PM_POR | MHI_PM_M0 | \ + MHI_PM_M2 | MHI_PM_M3_ENTER | MHI_PM_M3_EXIT | \ + MHI_PM_SYS_ERR_DETECT | MHI_PM_SYS_ERR_PROCESS | \ +- MHI_PM_SHUTDOWN_PROCESS | MHI_PM_FW_DL_ERR))) ++ MHI_PM_SYS_ERR_FAIL | MHI_PM_SHUTDOWN_PROCESS | \ ++ MHI_PM_FW_DL_ERR))) + #define MHI_PM_IN_ERROR_STATE(pm_state) (pm_state >= MHI_PM_FW_DL_ERR) + #define MHI_PM_IN_FATAL_STATE(pm_state) (pm_state == MHI_PM_LD_ERR_FATAL_DETECT) + #define MHI_DB_ACCESS_VALID(mhi_cntrl) (mhi_cntrl->pm_state & mhi_cntrl->db_access) +diff --git a/drivers/bus/mhi/host/pm.c b/drivers/bus/mhi/host/pm.c +index a2f2feef14768..d0d033ce9984b 100644 +--- a/drivers/bus/mhi/host/pm.c ++++ b/drivers/bus/mhi/host/pm.c +@@ -36,7 +36,10 @@ + * M0 <--> M0 + * M0 -> FW_DL_ERR + * M0 -> M3_ENTER -> M3 -> M3_EXIT --> M0 +- * L1: SYS_ERR_DETECT -> SYS_ERR_PROCESS --> POR ++ * L1: SYS_ERR_DETECT -> SYS_ERR_PROCESS ++ * SYS_ERR_PROCESS -> SYS_ERR_FAIL ++ * SYS_ERR_FAIL -> SYS_ERR_DETECT ++ * SYS_ERR_PROCESS --> POR + * L2: SHUTDOWN_PROCESS -> LD_ERR_FATAL_DETECT + * SHUTDOWN_PROCESS -> DISABLE + * L3: LD_ERR_FATAL_DETECT <--> LD_ERR_FATAL_DETECT +@@ -93,7 +96,12 @@ static const struct mhi_pm_transitions dev_state_transitions[] = { + }, + { + MHI_PM_SYS_ERR_PROCESS, +- MHI_PM_POR | MHI_PM_SHUTDOWN_PROCESS | ++ MHI_PM_POR | MHI_PM_SYS_ERR_FAIL | MHI_PM_SHUTDOWN_PROCESS | ++ MHI_PM_LD_ERR_FATAL_DETECT ++ }, ++ { ++ MHI_PM_SYS_ERR_FAIL, ++ MHI_PM_SYS_ERR_DETECT | MHI_PM_SHUTDOWN_PROCESS | + MHI_PM_LD_ERR_FATAL_DETECT + }, + /* L2 States */ +@@ -629,7 +637,13 @@ static void mhi_pm_sys_error_transition(struct mhi_controller *mhi_cntrl) + !in_reset, timeout); + if (!ret || in_reset) { + dev_err(dev, "Device failed to exit MHI Reset state\n"); +- goto exit_sys_error_transition; ++ write_lock_irq(&mhi_cntrl->pm_lock); ++ cur_state = mhi_tryset_pm_state(mhi_cntrl, ++ MHI_PM_SYS_ERR_FAIL); ++ write_unlock_irq(&mhi_cntrl->pm_lock); ++ /* Shutdown may have occurred, otherwise cleanup now */ ++ if (cur_state != MHI_PM_SYS_ERR_FAIL) ++ goto exit_sys_error_transition; + } + + /* +-- +2.43.0 + diff --git a/queue-6.8/cpufreq-don-t-unregister-cpufreq-cooling-on-cpu-hotp.patch b/queue-6.8/cpufreq-don-t-unregister-cpufreq-cooling-on-cpu-hotp.patch new file mode 100644 index 00000000000..53257b9e540 --- /dev/null +++ b/queue-6.8/cpufreq-don-t-unregister-cpufreq-cooling-on-cpu-hotp.patch @@ -0,0 +1,94 @@ +From eee289fa5e07e0be94dfad2b17de823945329f4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 13:42:07 +0530 +Subject: cpufreq: Don't unregister cpufreq cooling on CPU hotplug + +From: Viresh Kumar + +[ Upstream commit c4d61a529db788d2e52654f5b02c8d1de4952c5b ] + +Offlining a CPU and bringing it back online is a common operation and it +happens frequently during system suspend/resume, where the non-boot CPUs +are hotplugged out during suspend and brought back at resume. + +The cpufreq core already tries to make this path as fast as possible as +the changes are only temporary in nature and full cleanup of resources +isn't required in this case. For example the drivers can implement +online()/offline() callbacks to avoid a lot of tear down of resources. + +On similar lines, there is no need to unregister the cpufreq cooling +device during suspend / resume, but only while the policy is getting +removed. + +Moreover, unregistering the cpufreq cooling device is resulting in an +unwanted outcome, where the system suspend is eventually aborted in the +process. Currently, during system suspend the cpufreq core unregisters +the cooling device, which in turn removes a kobject using device_del() +and that generates a notification to the userspace via uevent broadcast. +This causes system suspend to abort in some setups. + +This was also earlier reported (indirectly) by Roman [1]. Maybe there is +another way around to fixing that problem properly, but this change +makes sense anyways. + +Move the registering and unregistering of the cooling device to policy +creation and removal times onlyy. + +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218521 +Reported-by: Manaf Meethalavalappu Pallikunhi +Reported-by: Roman Stratiienko +Link: https://patchwork.kernel.org/project/linux-pm/patch/20220710164026.541466-1-r.stratiienko@gmail.com/ [1] +Tested-by: Manaf Meethalavalappu Pallikunhi +Signed-off-by: Viresh Kumar +Reviewed-by: Dhruva Gole +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 7d570b44777ac..3c2c955fbbbd6 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1576,7 +1576,8 @@ static int cpufreq_online(unsigned int cpu) + if (cpufreq_driver->ready) + cpufreq_driver->ready(policy); + +- if (cpufreq_thermal_control_enabled(cpufreq_driver)) ++ /* Register cpufreq cooling only for a new policy */ ++ if (new_policy && cpufreq_thermal_control_enabled(cpufreq_driver)) + policy->cdev = of_cpufreq_cooling_register(policy); + + pr_debug("initialization complete\n"); +@@ -1660,11 +1661,6 @@ static void __cpufreq_offline(unsigned int cpu, struct cpufreq_policy *policy) + else + policy->last_policy = policy->policy; + +- if (cpufreq_thermal_control_enabled(cpufreq_driver)) { +- cpufreq_cooling_unregister(policy->cdev); +- policy->cdev = NULL; +- } +- + if (has_target()) + cpufreq_exit_governor(policy); + +@@ -1725,6 +1721,15 @@ static void cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif) + return; + } + ++ /* ++ * Unregister cpufreq cooling once all the CPUs of the policy are ++ * removed. ++ */ ++ if (cpufreq_thermal_control_enabled(cpufreq_driver)) { ++ cpufreq_cooling_unregister(policy->cdev); ++ policy->cdev = NULL; ++ } ++ + /* We did light-weight exit earlier, do full tear down now */ + if (cpufreq_driver->offline) + cpufreq_driver->exit(policy); +-- +2.43.0 + diff --git a/queue-6.8/cpuidle-avoid-potential-overflow-in-integer-multipli.patch b/queue-6.8/cpuidle-avoid-potential-overflow-in-integer-multipli.patch new file mode 100644 index 00000000000..9ae3fc8c5c0 --- /dev/null +++ b/queue-6.8/cpuidle-avoid-potential-overflow-in-integer-multipli.patch @@ -0,0 +1,57 @@ +From dcbddb346a78526ad4ea2b8add060fe0e96d41f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 11:14:42 +0800 +Subject: cpuidle: Avoid potential overflow in integer multiplication + +From: C Cheng + +[ Upstream commit 88390dd788db485912ee7f9a8d3d56fc5265d52f ] + +In detail: + +In C language, when you perform a multiplication operation, if +both operands are of int type, the multiplication operation is +performed on the int type, and then the result is converted to +the target type. This means that if the product of int type +multiplication exceeds the range that int type can represent, +an overflow will occur even if you store the result in a +variable of int64_t type. + +For a multiplication of two int values, it is better to use +mul_u32_u32() rather than s->exit_latency_ns = s->exit_latency * +NSEC_PER_USEC to avoid potential overflow happenning. + +Signed-off-by: C Cheng +Signed-off-by: Bo Ye +Reviewed-by: AngeloGioacchino Del Regno +[ rjw: New subject ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/driver.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c +index d9cda7f6ccb98..cf5873cc45dc8 100644 +--- a/drivers/cpuidle/driver.c ++++ b/drivers/cpuidle/driver.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #include "cpuidle.h" + +@@ -187,7 +188,7 @@ static void __cpuidle_driver_init(struct cpuidle_driver *drv) + s->target_residency = div_u64(s->target_residency_ns, NSEC_PER_USEC); + + if (s->exit_latency > 0) +- s->exit_latency_ns = s->exit_latency * NSEC_PER_USEC; ++ s->exit_latency_ns = mul_u32_u32(s->exit_latency, NSEC_PER_USEC); + else if (s->exit_latency_ns < 0) + s->exit_latency_ns = 0; + else +-- +2.43.0 + diff --git a/queue-6.8/crypto-iaa-fix-async_disable-descriptor-leak.patch b/queue-6.8/crypto-iaa-fix-async_disable-descriptor-leak.patch new file mode 100644 index 00000000000..1dbc3ee1c4f --- /dev/null +++ b/queue-6.8/crypto-iaa-fix-async_disable-descriptor-leak.patch @@ -0,0 +1,46 @@ +From b643687b667c10bddb74fd66dd1b462eba10e634 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Feb 2024 14:11:33 -0600 +Subject: crypto: iaa - Fix async_disable descriptor leak + +From: Tom Zanussi + +[ Upstream commit 262534ddc88dfea7474ed18adfecf856e4fbe054 ] + +The disable_async paths of iaa_compress/decompress() don't free idxd +descriptors in the async_disable case. Currently this only happens in +the testcases where req->dst is set to null. Add a test to free them +in those paths. + +Signed-off-by: Tom Zanussi +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/intel/iaa/iaa_crypto_main.c b/drivers/crypto/intel/iaa/iaa_crypto_main.c +index aa65c1791ce76..64a2e87a55b3c 100644 +--- a/drivers/crypto/intel/iaa/iaa_crypto_main.c ++++ b/drivers/crypto/intel/iaa/iaa_crypto_main.c +@@ -1328,7 +1328,7 @@ static int iaa_compress(struct crypto_tfm *tfm, struct acomp_req *req, + + *compression_crc = idxd_desc->iax_completion->crc; + +- if (!ctx->async_mode) ++ if (!ctx->async_mode || disable_async) + idxd_free_desc(wq, idxd_desc); + out: + return ret; +@@ -1574,7 +1574,7 @@ static int iaa_decompress(struct crypto_tfm *tfm, struct acomp_req *req, + + *dlen = req->dlen; + +- if (!ctx->async_mode) ++ if (!ctx->async_mode || disable_async) + idxd_free_desc(wq, idxd_desc); + + /* Update stats */ +-- +2.43.0 + diff --git a/queue-6.8/dma-direct-leak-pages-on-dma_set_decrypted-failure.patch b/queue-6.8/dma-direct-leak-pages-on-dma_set_decrypted-failure.patch new file mode 100644 index 00000000000..be632565dda --- /dev/null +++ b/queue-6.8/dma-direct-leak-pages-on-dma_set_decrypted-failure.patch @@ -0,0 +1,67 @@ +From da4edbcb9820cd7855593cd89f8d4f6e96b0858f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 16:17:21 -0800 +Subject: dma-direct: Leak pages on dma_set_decrypted() failure + +From: Rick Edgecombe + +[ Upstream commit b9fa16949d18e06bdf728a560f5c8af56d2bdcaf ] + +On TDX it is possible for the untrusted host to cause +set_memory_encrypted() or set_memory_decrypted() to fail such that an +error is returned and the resulting memory is shared. Callers need to +take care to handle these errors to avoid returning decrypted (shared) +memory to the page allocator, which could lead to functional or security +issues. + +DMA could free decrypted/shared pages if dma_set_decrypted() fails. This +should be a rare case. Just leak the pages in this case instead of +freeing them. + +Signed-off-by: Rick Edgecombe +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 98b2e192fd696..4d543b1e9d577 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -286,7 +286,7 @@ void *dma_direct_alloc(struct device *dev, size_t size, + } else { + ret = page_address(page); + if (dma_set_decrypted(dev, ret, size)) +- goto out_free_pages; ++ goto out_leak_pages; + } + + memset(ret, 0, size); +@@ -307,6 +307,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, + out_free_pages: + __dma_direct_free_pages(dev, page, size); + return NULL; ++out_leak_pages: ++ return NULL; + } + + void dma_direct_free(struct device *dev, size_t size, +@@ -367,12 +369,11 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, + + ret = page_address(page); + if (dma_set_decrypted(dev, ret, size)) +- goto out_free_pages; ++ goto out_leak_pages; + memset(ret, 0, size); + *dma_handle = phys_to_dma_direct(dev, page_to_phys(page)); + return page; +-out_free_pages: +- __dma_direct_free_pages(dev, page, size); ++out_leak_pages: + return NULL; + } + +-- +2.43.0 + diff --git a/queue-6.8/drivers-nvme-add-quirks-for-device-126f-2262.patch b/queue-6.8/drivers-nvme-add-quirks-for-device-126f-2262.patch new file mode 100644 index 00000000000..c4b5198b450 --- /dev/null +++ b/queue-6.8/drivers-nvme-add-quirks-for-device-126f-2262.patch @@ -0,0 +1,52 @@ +From eae9f7b58b0fe6e802821a314c5cde05b63b4600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Mar 2024 03:27:49 +0800 +Subject: drivers/nvme: Add quirks for device 126f:2262 + +From: Jiawei Fu (iBug) + +[ Upstream commit e89086c43f0500bc7c4ce225495b73b8ce234c1f ] + +This commit adds NVME_QUIRK_NO_DEEPEST_PS and NVME_QUIRK_BOGUS_NID for +device [126f:2262], which appears to be a generic VID:PID pair used for +many SSDs based on the Silicon Motion SM2262/SM2262EN controller. + +Two of my SSDs with this VID:PID pair exhibit the same behavior: + + * They frequently have trouble exiting the deepest power state (5), + resulting in the entire disk unresponsive. + Verified by setting nvme_core.default_ps_max_latency_us=10000 and + observing them behaving normally. + * They produce all-zero nguid and eui64 with `nvme id-ns` command. + +The offending products are: + + * HP SSD EX950 1TB + * HIKVISION C2000Pro 2TB + +Signed-off-by: Jiawei Fu +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index e6267a6aa3801..8e0bb9692685d 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3363,6 +3363,9 @@ static const struct pci_device_id nvme_id_table[] = { + NVME_QUIRK_BOGUS_NID, }, + { PCI_VDEVICE(REDHAT, 0x0010), /* Qemu emulated controller */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, ++ { PCI_DEVICE(0x126f, 0x2262), /* Silicon Motion generic */ ++ .driver_data = NVME_QUIRK_NO_DEEPEST_PS | ++ NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x126f, 0x2263), /* Silicon Motion unidentified */ + .driver_data = NVME_QUIRK_NO_NS_DESC_LIST | + NVME_QUIRK_BOGUS_NID, }, +-- +2.43.0 + diff --git a/queue-6.8/drivers-perf-hisi-enable-hisilicon-erratum-162700402.patch b/queue-6.8/drivers-perf-hisi-enable-hisilicon-erratum-162700402.patch new file mode 100644 index 00000000000..16d0d34cd68 --- /dev/null +++ b/queue-6.8/drivers-perf-hisi-enable-hisilicon-erratum-162700402.patch @@ -0,0 +1,89 @@ +From c4efc8ce27a8db0b812c94d063c482251fd3d605 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 20:52:31 +0800 +Subject: drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for + HIP09 + +From: Junhao He + +[ Upstream commit e10b6976f6b9afdf3564f88c851e42d139bb19c0 ] + +HiSilicon UC PMU v2 suffers the erratum 162700402 that the PMU counter +cannot be set due to the lack of clock under power saving mode. This will +lead to error or inaccurate counts. The clock can be enabled by the PMU +global enabling control. + +This patch tries to fix this by set the UC PMU enable before set event +period to turn on the clock, and then restore the UC PMU configuration. +The counter register can hold its value without a clock. + +Signed-off-by: Junhao He +Reviewed-by: Yicong Yang +Link: https://lore.kernel.org/r/20240227125231.53127-1-hejunhao3@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 42 ++++++++++++++++++++- + 1 file changed, 41 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c +index 636fb79647c8c..481dcc9e8fbf8 100644 +--- a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c ++++ b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c +@@ -287,12 +287,52 @@ static u64 hisi_uc_pmu_read_counter(struct hisi_pmu *uc_pmu, + return readq(uc_pmu->base + HISI_UC_CNTR_REGn(hwc->idx)); + } + +-static void hisi_uc_pmu_write_counter(struct hisi_pmu *uc_pmu, ++static bool hisi_uc_pmu_get_glb_en_state(struct hisi_pmu *uc_pmu) ++{ ++ u32 val; ++ ++ val = readl(uc_pmu->base + HISI_UC_EVENT_CTRL_REG); ++ return !!FIELD_GET(HISI_UC_EVENT_GLB_EN, val); ++} ++ ++static void hisi_uc_pmu_write_counter_normal(struct hisi_pmu *uc_pmu, + struct hw_perf_event *hwc, u64 val) + { + writeq(val, uc_pmu->base + HISI_UC_CNTR_REGn(hwc->idx)); + } + ++static void hisi_uc_pmu_write_counter_quirk_v2(struct hisi_pmu *uc_pmu, ++ struct hw_perf_event *hwc, u64 val) ++{ ++ hisi_uc_pmu_start_counters(uc_pmu); ++ hisi_uc_pmu_write_counter_normal(uc_pmu, hwc, val); ++ hisi_uc_pmu_stop_counters(uc_pmu); ++} ++ ++static void hisi_uc_pmu_write_counter(struct hisi_pmu *uc_pmu, ++ struct hw_perf_event *hwc, u64 val) ++{ ++ bool enable = hisi_uc_pmu_get_glb_en_state(uc_pmu); ++ bool erratum = uc_pmu->identifier == HISI_PMU_V2; ++ ++ /* ++ * HiSilicon UC PMU v2 suffers the erratum 162700402 that the ++ * PMU counter cannot be set due to the lack of clock under power ++ * saving mode. This will lead to error or inaccurate counts. ++ * The clock can be enabled by the PMU global enabling control. ++ * The irq handler and pmu_start() will call the function to set ++ * period. If the function under irq context, the PMU has been ++ * enabled therefore we set counter directly. Other situations ++ * the PMU is disabled, we need to enable it to turn on the ++ * counter clock to set period, and then restore PMU enable ++ * status, the counter can hold its value without a clock. ++ */ ++ if (enable || !erratum) ++ hisi_uc_pmu_write_counter_normal(uc_pmu, hwc, val); ++ else ++ hisi_uc_pmu_write_counter_quirk_v2(uc_pmu, hwc, val); ++} ++ + static void hisi_uc_pmu_enable_counter_int(struct hisi_pmu *uc_pmu, + struct hw_perf_event *hwc) + { +-- +2.43.0 + diff --git a/queue-6.8/drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in.patch b/queue-6.8/drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in.patch new file mode 100644 index 00000000000..97219a1fde9 --- /dev/null +++ b/queue-6.8/drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in.patch @@ -0,0 +1,93 @@ +From e8288ef80c0ad498e190ee529884317787e5b701 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 17:08:16 +0530 +Subject: drm/amd/amdgpu: Fix potential ioremap() memory leaks in + amdgpu_device_init() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit eb4f139888f636614dab3bcce97ff61cefc4b3a7 ] + +This ensures that the memory mapped by ioremap for adev->rmmio, is +properly handled in amdgpu_device_init(). If the function exits early +due to an error, the memory is unmapped. If the function completes +successfully, the memory remains mapped. + +Reported by smatch: +drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4337 amdgpu_device_init() warn: 'adev->rmmio' from ioremap() not released on lines: 4035,4045,4051,4058,4068,4337 + +Cc: Christian König +Cc: Alex Deucher +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index d0afb9ba3789c..1eff446321bd6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4025,8 +4025,10 @@ int amdgpu_device_init(struct amdgpu_device *adev, + * early on during init and before calling to RREG32. + */ + adev->reset_domain = amdgpu_reset_create_reset_domain(SINGLE_DEVICE, "amdgpu-reset-dev"); +- if (!adev->reset_domain) +- return -ENOMEM; ++ if (!adev->reset_domain) { ++ r = -ENOMEM; ++ goto unmap_memory; ++ } + + /* detect hw virtualization here */ + amdgpu_detect_virtualization(adev); +@@ -4036,20 +4038,20 @@ int amdgpu_device_init(struct amdgpu_device *adev, + r = amdgpu_device_get_job_timeout_settings(adev); + if (r) { + dev_err(adev->dev, "invalid lockup_timeout parameter syntax\n"); +- return r; ++ goto unmap_memory; + } + + /* early init functions */ + r = amdgpu_device_ip_early_init(adev); + if (r) +- return r; ++ goto unmap_memory; + + amdgpu_device_set_mcbp(adev); + + /* Get rid of things like offb */ + r = drm_aperture_remove_conflicting_pci_framebuffers(adev->pdev, &amdgpu_kms_driver); + if (r) +- return r; ++ goto unmap_memory; + + /* Enable TMZ based on IP_VERSION */ + amdgpu_gmc_tmz_set(adev); +@@ -4059,7 +4061,7 @@ int amdgpu_device_init(struct amdgpu_device *adev, + if (adev->gmc.xgmi.supported) { + r = adev->gfxhub.funcs->get_xgmi_info(adev); + if (r) +- return r; ++ goto unmap_memory; + } + + /* enable PCIE atomic ops */ +@@ -4328,6 +4330,8 @@ int amdgpu_device_init(struct amdgpu_device *adev, + failed: + amdgpu_vf_error_trans_all(adev); + ++unmap_memory: ++ iounmap(adev->rmmio); + return r; + } + +-- +2.43.0 + diff --git a/queue-6.8/drm-amd-display-disable-idle-reallow-as-part-of-comm.patch b/queue-6.8/drm-amd-display-disable-idle-reallow-as-part-of-comm.patch new file mode 100644 index 00000000000..1ead6fbab24 --- /dev/null +++ b/queue-6.8/drm-amd-display-disable-idle-reallow-as-part-of-comm.patch @@ -0,0 +1,79 @@ +From b777ac2df61e292ab4119f27e1cf73e68e31e9b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 10:51:49 -0500 +Subject: drm/amd/display: Disable idle reallow as part of command/gpint + execution + +From: Nicholas Kazlauskas + +[ Upstream commit 6226a5aa77370329e01ee8abe50a95e60618ce97 ] + +[Why] +Workaroud for a race condition where DMCUB is in the process of +committing to IPS1 during the handshake causing us to miss the +transition into IPS2 and touch the INBOX1 RPTR causing a HW hang. + +[How] +Disable the reallow to ensure that we have enough of a gap between entry +and exit and we're not seeing back-to-back wake_and_executes. + +Reviewed-by: Ovidiu Bunea +Acked-by: Hamza Mahfooz +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dc.h | 1 + + drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 4 ++-- + .../gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 1 + + 3 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h +index f1342314f7f43..fc60fa5814fbe 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc.h ++++ b/drivers/gpu/drm/amd/display/dc/dc.h +@@ -987,6 +987,7 @@ struct dc_debug_options { + bool psp_disabled_wa; + unsigned int ips2_eval_delay_us; + unsigned int ips2_entry_delay_us; ++ bool disable_dmub_reallow_idle; + bool disable_timeout; + bool disable_extblankadj; + unsigned int static_screen_wait_frames; +diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +index 363d522603a21..9084b320849a6 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c ++++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +@@ -1364,7 +1364,7 @@ bool dc_wake_and_execute_dmub_cmd_list(const struct dc_context *ctx, unsigned in + else + result = dm_execute_dmub_cmd(ctx, cmd, wait_type); + +- if (result && reallow_idle) ++ if (result && reallow_idle && !ctx->dc->debug.disable_dmub_reallow_idle) + dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, true); + + return result; +@@ -1413,7 +1413,7 @@ bool dc_wake_and_execute_gpint(const struct dc_context *ctx, enum dmub_gpint_com + + result = dc_dmub_execute_gpint(ctx, command_code, param, response, wait_type); + +- if (result && reallow_idle) ++ if (result && reallow_idle && !ctx->dc->debug.disable_dmub_reallow_idle) + dc_dmub_srv_apply_idle_power_optimizations(ctx->dc, true); + + return result; +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +index 04d230aa8861f..78c315541f031 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +@@ -782,6 +782,7 @@ static const struct dc_debug_options debug_defaults_drv = { + .psp_disabled_wa = true, + .ips2_eval_delay_us = 2000, + .ips2_entry_delay_us = 800, ++ .disable_dmub_reallow_idle = true, + .static_screen_wait_frames = 2, + }; + +-- +2.43.0 + diff --git a/queue-6.8/drm-amd-display-fix-nanosec-stat-overflow.patch b/queue-6.8/drm-amd-display-fix-nanosec-stat-overflow.patch new file mode 100644 index 00000000000..e714c831dc6 --- /dev/null +++ b/queue-6.8/drm-amd-display-fix-nanosec-stat-overflow.patch @@ -0,0 +1,45 @@ +From d2b9df484ac4cb1fc5e83707763dc669047919aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2019 11:53:52 -0400 +Subject: drm/amd/display: Fix nanosec stat overflow + +From: Aric Cyr + +[ Upstream commit 14d68acfd04b39f34eea7bea65dda652e6db5bf6 ] + +[Why] +Nanosec stats can overflow on long running systems potentially causing +statistic logging issues. + +[How] +Use 64bit types for nanosec stats to ensure no overflow. + +Reviewed-by: Rodrigo Siqueira +Tested-by: Daniel Wheeler +Signed-off-by: Aric Cyr +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/modules/inc/mod_stats.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/modules/inc/mod_stats.h b/drivers/gpu/drm/amd/display/modules/inc/mod_stats.h +index 5960dd760e91c..8ce6c22e5d041 100644 +--- a/drivers/gpu/drm/amd/display/modules/inc/mod_stats.h ++++ b/drivers/gpu/drm/amd/display/modules/inc/mod_stats.h +@@ -57,10 +57,10 @@ void mod_stats_update_event(struct mod_stats *mod_stats, + unsigned int length); + + void mod_stats_update_flip(struct mod_stats *mod_stats, +- unsigned long timestamp_in_ns); ++ unsigned long long timestamp_in_ns); + + void mod_stats_update_vupdate(struct mod_stats *mod_stats, +- unsigned long timestamp_in_ns); ++ unsigned long long timestamp_in_ns); + + void mod_stats_update_freesync(struct mod_stats *mod_stats, + unsigned int v_total_min, +-- +2.43.0 + diff --git a/queue-6.8/drm-amd-display-increased-min_dcfclk_mhz-and-min_fcl.patch b/queue-6.8/drm-amd-display-increased-min_dcfclk_mhz-and-min_fcl.patch new file mode 100644 index 00000000000..4753617ecb8 --- /dev/null +++ b/queue-6.8/drm-amd-display-increased-min_dcfclk_mhz-and-min_fcl.patch @@ -0,0 +1,46 @@ +From e0e410db0c791d8722264866500755c2bd36cd48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 11:00:00 -0500 +Subject: drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz + +From: Sohaib Nadeem + +[ Upstream commit d46fb0068c54d3dc95ae8298299c4d9edb0fb7c1 ] + +[why] +Originally, PMFW said min FCLK is 300Mhz, but min DCFCLK can be increased +to 400Mhz because min FCLK is now 600Mhz so FCLK >= 1.5 * DCFCLK hardware +requirement will still be satisfied. Increasing min DCFCLK addresses +underflow issues (underflow occurs when phantom pipe is turned on for some +Sub-Viewport configs). + +[how] +Increasing DCFCLK by raising the min_dcfclk_mhz + +Reviewed-by: Chaitanya Dhere +Reviewed-by: Alvin Lee +Acked-by: Tom Chung +Signed-off-by: Sohaib Nadeem +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +index a0a65e0991041..ba76dd4a2ce29 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +@@ -2760,7 +2760,7 @@ static int build_synthetic_soc_states(bool disable_dc_mode_overwrite, struct clk + struct _vcs_dpi_voltage_scaling_st entry = {0}; + struct clk_limit_table_entry max_clk_data = {0}; + +- unsigned int min_dcfclk_mhz = 199, min_fclk_mhz = 299; ++ unsigned int min_dcfclk_mhz = 399, min_fclk_mhz = 599; + + static const unsigned int num_dcfclk_stas = 5; + unsigned int dcfclk_sta_targets[DC__VOLTAGE_STATES] = {199, 615, 906, 1324, 1564}; +-- +2.43.0 + diff --git a/queue-6.8/drm-amdgpu-init-zone-device-and-drm-client-after-mod.patch b/queue-6.8/drm-amdgpu-init-zone-device-and-drm-client-after-mod.patch new file mode 100644 index 00000000000..3f40471a229 --- /dev/null +++ b/queue-6.8/drm-amdgpu-init-zone-device-and-drm-client-after-mod.patch @@ -0,0 +1,65 @@ +From 7e9f604a76fc0a9616429b217b1bc372e2932dba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 15:56:00 -0600 +Subject: drm/amdgpu: Init zone device and drm client after mode-1 reset on + reload + +From: Ahmad Rehman + +[ Upstream commit f679fd6057fbf5ab34aaee28d58b7f81af0cbf48 ] + +In passthrough environment, when amdgpu is reloaded after unload, mode-1 +is triggered after initializing the necessary IPs, That init does not +include KFD, and KFD init waits until the reset is completed. KFD init +is called in the reset handler, but in this case, the zone device and +drm client is not initialized, causing app to create kernel panic. + +v2: Removing the init KFD condition from amdgpu_amdkfd_drm_client_create. +As the previous version has the potential of creating DRM client twice. + +v3: v2 patch results in SDMA engine hung as DRM open causes VM clear to SDMA +before SDMA init. Adding the condition to in drm client creation, on top of v1, +to guard against drm client creation call multiple times. + +Signed-off-by: Ahmad Rehman +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 ++++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +index 41db030ddc4ee..131983ed43465 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +@@ -146,7 +146,7 @@ int amdgpu_amdkfd_drm_client_create(struct amdgpu_device *adev) + { + int ret; + +- if (!adev->kfd.init_complete) ++ if (!adev->kfd.init_complete || adev->kfd.client.dev) + return 0; + + ret = drm_client_init(&adev->ddev, &adev->kfd.client, "kfd", +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 586f4d03039df..64b1bb2404242 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -2451,8 +2451,11 @@ static void amdgpu_drv_delayed_reset_work_handler(struct work_struct *work) + } + for (i = 0; i < mgpu_info.num_dgpu; i++) { + adev = mgpu_info.gpu_ins[i].adev; +- if (!adev->kfd.init_complete) ++ if (!adev->kfd.init_complete) { ++ kgd2kfd_init_zone_device(adev); + amdgpu_amdkfd_device_init(adev); ++ amdgpu_amdkfd_drm_client_create(adev); ++ } + amdgpu_ttm_set_buffer_funcs_status(adev, true); + } + } +-- +2.43.0 + diff --git a/queue-6.8/drm-amdgpu-skip-do-pci-error-slot-reset-during-ras-r.patch b/queue-6.8/drm-amdgpu-skip-do-pci-error-slot-reset-during-ras-r.patch new file mode 100644 index 00000000000..134a7cc0d0a --- /dev/null +++ b/queue-6.8/drm-amdgpu-skip-do-pci-error-slot-reset-during-ras-r.patch @@ -0,0 +1,98 @@ +From 14d176eb96bb46d45988b6187bf58eabd712c606 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 16:13:50 +0800 +Subject: drm/amdgpu: Skip do PCI error slot reset during RAS recovery + +From: Stanley.Yang + +[ Upstream commit 601429cca96b4af3be44172c3b64e4228515dbe1 ] + +Why: + The PCI error slot reset maybe triggered after inject ue to UMC multi times, this + caused system hang. + [ 557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume + [ 557.373718] [drm] PCIE GART of 512M enabled. + [ 557.373722] [drm] PTB located at 0x0000031FED700000 + [ 557.373788] [drm] VRAM is lost due to GPU reset! + [ 557.373789] [drm] PSP is resuming... + [ 557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset + [ 557.547067] [drm] PCI error: detected callback, state(1)!! + [ 557.547069] [drm] No support for XGMI hive yet... + [ 557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter + [ 557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations + [ 557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered + [ 557.610492] [drm] PCI error: slot reset callback!! + ... + [ 560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded! + [ 560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded! + [ 560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI + [ 560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G OE 5.15.0-91-generic #101-Ubuntu + [ 560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023 + [ 560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu] + [ 560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] + [ 560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff <48> 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00 + [ 560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202 + [ 560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0 + [ 560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010 + [ 560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08 + [ 560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000 + [ 560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000 + [ 560.803889] FS: 0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000 + [ 560.812973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [ 560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0 + [ 560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + [ 560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 + [ 560.843444] PKRU: 55555554 + [ 560.846480] Call Trace: + [ 560.849225] + [ 560.851580] ? show_trace_log_lvl+0x1d6/0x2ea + [ 560.856488] ? show_trace_log_lvl+0x1d6/0x2ea + [ 560.861379] ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] + [ 560.867778] ? show_regs.part.0+0x23/0x29 + [ 560.872293] ? __die_body.cold+0x8/0xd + [ 560.876502] ? die_addr+0x3e/0x60 + [ 560.880238] ? exc_general_protection+0x1c5/0x410 + [ 560.885532] ? asm_exc_general_protection+0x27/0x30 + [ 560.891025] ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] + [ 560.898323] amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] + [ 560.904520] process_one_work+0x228/0x3d0 +How: + In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected + all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure. + +Signed-off-by: Stanley.Yang +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 1fbaf7b81d69a..d0afb9ba3789c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -6109,6 +6109,20 @@ pci_ers_result_t amdgpu_pci_slot_reset(struct pci_dev *pdev) + struct amdgpu_reset_context reset_context; + u32 memsize; + struct list_head device_list; ++ struct amdgpu_hive_info *hive; ++ int hive_ras_recovery = 0; ++ struct amdgpu_ras *ras; ++ ++ /* PCI error slot reset should be skipped During RAS recovery */ ++ hive = amdgpu_get_xgmi_hive(adev); ++ if (hive) { ++ hive_ras_recovery = atomic_read(&hive->ras_recovery); ++ amdgpu_put_xgmi_hive(hive); ++ } ++ ras = amdgpu_ras_get_context(adev); ++ if ((amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 3)) && ++ ras && (atomic_read(&ras->in_recovery) || hive_ras_recovery)) ++ return PCI_ERS_RESULT_RECOVERED; + + DRM_INFO("PCI error: slot reset callback!!\n"); + +-- +2.43.0 + diff --git a/queue-6.8/drm-check-output-polling-initialized-before-disablin.patch b/queue-6.8/drm-check-output-polling-initialized-before-disablin.patch new file mode 100644 index 00000000000..e37f7ac92d9 --- /dev/null +++ b/queue-6.8/drm-check-output-polling-initialized-before-disablin.patch @@ -0,0 +1,186 @@ +From 426bbbb2106f7089050d758e9d68058d3e8c3681 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 22:43:28 -0800 +Subject: drm: Check output polling initialized before disabling + +From: Shradha Gupta + +[ Upstream commit 5abffb66d12bcac84bf7b66389c571b8bb6e82bd ] + +In drm_kms_helper_poll_disable() check if output polling +support is initialized before disabling polling. If not flag +this as a warning. +Additionally in drm_mode_config_helper_suspend() and +drm_mode_config_helper_resume() calls, that re the callers of these +functions, avoid invoking them if polling is not initialized. +For drivers like hyperv-drm, that do not initialize connector +polling, if suspend is called without this check, it leads to +suspend failure with following stack +[ 770.719392] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. +[ 770.720592] printk: Suspending console(s) (use no_console_suspend to debug) +[ 770.948823] ------------[ cut here ]------------ +[ 770.948824] WARNING: CPU: 1 PID: 17197 at kernel/workqueue.c:3162 __flush_work.isra.0+0x212/0x230 +[ 770.948831] Modules linked in: rfkill nft_counter xt_conntrack xt_owner udf nft_compat crc_itu_t nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink vfat fat mlx5_ib ib_uverbs ib_core mlx5_core intel_rapl_msr intel_rapl_common kvm_amd ccp mlxfw kvm psample hyperv_drm tls drm_shmem_helper drm_kms_helper irqbypass pcspkr syscopyarea sysfillrect sysimgblt hv_balloon hv_utils joydev drm fuse xfs libcrc32c pci_hyperv pci_hyperv_intf sr_mod sd_mod cdrom t10_pi sg hv_storvsc scsi_transport_fc hv_netvsc serio_raw hyperv_keyboard hid_hyperv crct10dif_pclmul crc32_pclmul crc32c_intel hv_vmbus ghash_clmulni_intel dm_mirror dm_region_hash dm_log dm_mod +[ 770.948863] CPU: 1 PID: 17197 Comm: systemd-sleep Not tainted 5.14.0-362.2.1.el9_3.x86_64 #1 +[ 770.948865] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 +[ 770.948866] RIP: 0010:__flush_work.isra.0+0x212/0x230 +[ 770.948869] Code: 8b 4d 00 4c 8b 45 08 89 ca 48 c1 e9 04 83 e2 08 83 e1 0f 83 ca 02 89 c8 48 0f ba 6d 00 03 e9 25 ff ff ff 0f 0b e9 4e ff ff ff <0f> 0b 45 31 ed e9 44 ff ff ff e8 8f 89 b2 00 66 66 2e 0f 1f 84 00 +[ 770.948870] RSP: 0018:ffffaf4ac213fb10 EFLAGS: 00010246 +[ 770.948871] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8c992857 +[ 770.948872] RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff9aad82b00330 +[ 770.948873] RBP: ffff9aad82b00330 R08: 0000000000000000 R09: ffff9aad87ee3d10 +[ 770.948874] R10: 0000000000000200 R11: 0000000000000000 R12: ffff9aad82b00330 +[ 770.948874] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 +[ 770.948875] FS: 00007ff1b2f6bb40(0000) GS:ffff9aaf37d00000(0000) knlGS:0000000000000000 +[ 770.948878] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 770.948878] CR2: 0000555f345cb666 CR3: 00000001462dc005 CR4: 0000000000370ee0 +[ 770.948879] Call Trace: +[ 770.948880] +[ 770.948881] ? show_trace_log_lvl+0x1c4/0x2df +[ 770.948884] ? show_trace_log_lvl+0x1c4/0x2df +[ 770.948886] ? __cancel_work_timer+0x103/0x190 +[ 770.948887] ? __flush_work.isra.0+0x212/0x230 +[ 770.948889] ? __warn+0x81/0x110 +[ 770.948891] ? __flush_work.isra.0+0x212/0x230 +[ 770.948892] ? report_bug+0x10a/0x140 +[ 770.948895] ? handle_bug+0x3c/0x70 +[ 770.948898] ? exc_invalid_op+0x14/0x70 +[ 770.948899] ? asm_exc_invalid_op+0x16/0x20 +[ 770.948903] ? __flush_work.isra.0+0x212/0x230 +[ 770.948905] __cancel_work_timer+0x103/0x190 +[ 770.948907] ? _raw_spin_unlock_irqrestore+0xa/0x30 +[ 770.948910] drm_kms_helper_poll_disable+0x1e/0x40 [drm_kms_helper] +[ 770.948923] drm_mode_config_helper_suspend+0x1c/0x80 [drm_kms_helper] +[ 770.948933] ? __pfx_vmbus_suspend+0x10/0x10 [hv_vmbus] +[ 770.948942] hyperv_vmbus_suspend+0x17/0x40 [hyperv_drm] +[ 770.948944] ? __pfx_vmbus_suspend+0x10/0x10 [hv_vmbus] +[ 770.948951] dpm_run_callback+0x4c/0x140 +[ 770.948954] __device_suspend_noirq+0x74/0x220 +[ 770.948956] dpm_noirq_suspend_devices+0x148/0x2a0 +[ 770.948958] dpm_suspend_end+0x54/0xe0 +[ 770.948960] create_image+0x14/0x290 +[ 770.948963] hibernation_snapshot+0xd6/0x200 +[ 770.948964] hibernate.cold+0x8b/0x1fb +[ 770.948967] state_store+0xcd/0xd0 +[ 770.948969] kernfs_fop_write_iter+0x124/0x1b0 +[ 770.948973] new_sync_write+0xff/0x190 +[ 770.948976] vfs_write+0x1ef/0x280 +[ 770.948978] ksys_write+0x5f/0xe0 +[ 770.948979] do_syscall_64+0x5c/0x90 +[ 770.948981] ? syscall_exit_work+0x103/0x130 +[ 770.948983] ? syscall_exit_to_user_mode+0x12/0x30 +[ 770.948985] ? do_syscall_64+0x69/0x90 +[ 770.948986] ? do_syscall_64+0x69/0x90 +[ 770.948987] ? do_user_addr_fault+0x1d6/0x6a0 +[ 770.948989] ? do_syscall_64+0x69/0x90 +[ 770.948990] ? exc_page_fault+0x62/0x150 +[ 770.948992] entry_SYSCALL_64_after_hwframe+0x72/0xdc +[ 770.948995] RIP: 0033:0x7ff1b293eba7 +[ 770.949010] Code: 0b 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 +[ 770.949011] RSP: 002b:00007ffde3912128 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +[ 770.949012] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007ff1b293eba7 +[ 770.949013] RDX: 0000000000000005 RSI: 00007ffde3912210 RDI: 0000000000000004 +[ 770.949014] RBP: 00007ffde3912210 R08: 000055d7dd4c9510 R09: 00007ff1b29b14e0 +[ 770.949014] R10: 00007ff1b29b13e0 R11: 0000000000000246 R12: 0000000000000005 +[ 770.949015] R13: 000055d7dd4c53e0 R14: 0000000000000005 R15: 00007ff1b29f69e0 +[ 770.949016] +[ 770.949017] ---[ end trace e6fa0618bfa2f31d ]--- + +Built-on: Rhel9, Ubuntu22 +Signed-off-by: Shradha Gupta +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/1706856208-9617-1-git-send-email-shradhagupta@linux.microsoft.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_modeset_helper.c | 19 ++++++++++++++++--- + drivers/gpu/drm/drm_probe_helper.c | 13 +++++++++++-- + 2 files changed, 27 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/drm_modeset_helper.c b/drivers/gpu/drm/drm_modeset_helper.c +index f858dfedf2cfc..2c582020cb423 100644 +--- a/drivers/gpu/drm/drm_modeset_helper.c ++++ b/drivers/gpu/drm/drm_modeset_helper.c +@@ -193,13 +193,22 @@ int drm_mode_config_helper_suspend(struct drm_device *dev) + + if (!dev) + return 0; ++ /* ++ * Don't disable polling if it was never initialized ++ */ ++ if (dev->mode_config.poll_enabled) ++ drm_kms_helper_poll_disable(dev); + +- drm_kms_helper_poll_disable(dev); + drm_fb_helper_set_suspend_unlocked(dev->fb_helper, 1); + state = drm_atomic_helper_suspend(dev); + if (IS_ERR(state)) { + drm_fb_helper_set_suspend_unlocked(dev->fb_helper, 0); +- drm_kms_helper_poll_enable(dev); ++ /* ++ * Don't enable polling if it was never initialized ++ */ ++ if (dev->mode_config.poll_enabled) ++ drm_kms_helper_poll_enable(dev); ++ + return PTR_ERR(state); + } + +@@ -239,7 +248,11 @@ int drm_mode_config_helper_resume(struct drm_device *dev) + dev->mode_config.suspend_state = NULL; + + drm_fb_helper_set_suspend_unlocked(dev->fb_helper, 0); +- drm_kms_helper_poll_enable(dev); ++ /* ++ * Don't enable polling if it is not initialized ++ */ ++ if (dev->mode_config.poll_enabled) ++ drm_kms_helper_poll_enable(dev); + + return ret; + } +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index 744cde9db246b..fce6465bf4faa 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -293,14 +293,17 @@ static void reschedule_output_poll_work(struct drm_device *dev) + * Drivers can call this helper from their device resume implementation. It is + * not an error to call this even when output polling isn't enabled. + * ++ * If device polling was never initialized before, this call will trigger a ++ * warning and return. ++ * + * Note that calls to enable and disable polling must be strictly ordered, which + * is automatically the case when they're only call from suspend/resume + * callbacks. + */ + void drm_kms_helper_poll_enable(struct drm_device *dev) + { +- if (!dev->mode_config.poll_enabled || !drm_kms_helper_poll || +- dev->mode_config.poll_running) ++ if (drm_WARN_ON_ONCE(dev, !dev->mode_config.poll_enabled) || ++ !drm_kms_helper_poll || dev->mode_config.poll_running) + return; + + if (drm_kms_helper_enable_hpd(dev) || +@@ -880,12 +883,18 @@ EXPORT_SYMBOL(drm_kms_helper_is_poll_worker); + * not an error to call this even when output polling isn't enabled or already + * disabled. Polling is re-enabled by calling drm_kms_helper_poll_enable(). + * ++ * If however, the polling was never initialized, this call will trigger a ++ * warning and return ++ * + * Note that calls to enable and disable polling must be strictly ordered, which + * is automatically the case when they're only call from suspend/resume + * callbacks. + */ + void drm_kms_helper_poll_disable(struct drm_device *dev) + { ++ if (drm_WARN_ON(dev, !dev->mode_config.poll_enabled)) ++ return; ++ + if (dev->mode_config.poll_running) + drm_kms_helper_disable_hpd(dev); + +-- +2.43.0 + diff --git a/queue-6.8/drm-ci-uprev-mesa-version-fix-kdl-commit-fetch.patch b/queue-6.8/drm-ci-uprev-mesa-version-fix-kdl-commit-fetch.patch new file mode 100644 index 00000000000..3df520e8948 --- /dev/null +++ b/queue-6.8/drm-ci-uprev-mesa-version-fix-kdl-commit-fetch.patch @@ -0,0 +1,107 @@ +From 65489f6e41be28f56c886d16fa359b4c8c387f03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Dec 2023 09:04:34 +0530 +Subject: drm/ci: uprev mesa version: fix kdl commit fetch + +From: Vignesh Raman + +[ Upstream commit d315a68e94a76310c349add3f9c914cefda0a87f ] + +build-kdl.sh was doing a `clone --depth 1` of the default branch, +then checking out a commit that might not be the latest of that +branch, resulting in container build error. + +https://gitlab.freedesktop.org/mesa/mesa/-/commit/5efa4d56 fixes +kdl commit fetch issue. Uprev mesa in drm-ci to fix this. + +This commit updates the kernel tag and adds .never-post-merge-rules +due to the mesa uprev. It also fixes an issue where the virtio-gpu +pipeline was not getting created with the mesa uprev. + +Reviewed-by: David Heidelberg +Acked-by: Helen Koike +Reviewed-by: Dmitry Baryshkov +Tested-by: Abhinav Kumar +Signed-off-by: Vignesh Raman +Signed-off-by: Helen Koike +Link: https://patchwork.freedesktop.org/patch/msgid/20231222033434.1537761-1-vignesh.raman@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ci/gitlab-ci.yml | 14 ++++++++++++-- + drivers/gpu/drm/ci/test.yml | 1 + + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/ci/gitlab-ci.yml b/drivers/gpu/drm/ci/gitlab-ci.yml +index dac92cc2777cc..084e3ff8e3f42 100644 +--- a/drivers/gpu/drm/ci/gitlab-ci.yml ++++ b/drivers/gpu/drm/ci/gitlab-ci.yml +@@ -1,6 +1,6 @@ + variables: + DRM_CI_PROJECT_PATH: &drm-ci-project-path mesa/mesa +- DRM_CI_COMMIT_SHA: &drm-ci-commit-sha edfbf74df1d4d6ce54ffe24566108be0e1a98c3d ++ DRM_CI_COMMIT_SHA: &drm-ci-commit-sha 9d162de9a05155e1c4041857a5848842749164cf + + UPSTREAM_REPO: git://anongit.freedesktop.org/drm/drm + TARGET_BRANCH: drm-next +@@ -25,7 +25,9 @@ variables: + # per-job artifact storage on MinIO + JOB_ARTIFACTS_BASE: ${PIPELINE_ARTIFACTS_BASE}/${CI_JOB_ID} + # default kernel for rootfs before injecting the current kernel tree +- KERNEL_IMAGE_BASE: https://${S3_HOST}/mesa-lava/gfx-ci/linux/v6.4.12-for-mesa-ci-f6b4ad45f48d ++ KERNEL_REPO: "gfx-ci/linux" ++ KERNEL_TAG: "v6.6.4-for-mesa-ci-e4f4c500f7fb" ++ KERNEL_IMAGE_BASE: https://${S3_HOST}/mesa-lava/${KERNEL_REPO}/${KERNEL_TAG} + LAVA_TAGS: subset-1-gfx + LAVA_JOB_PRIORITY: 30 + +@@ -133,6 +135,11 @@ stages: + - if: &is-pre-merge-for-marge '$GITLAB_USER_LOGIN == "marge-bot" && $CI_PIPELINE_SOURCE == "merge_request_event"' + when: on_success + ++.never-post-merge-rules: ++ rules: ++ - if: *is-post-merge ++ when: never ++ + # Rule to filter for only scheduled pipelines. + .scheduled_pipeline-rules: + rules: +@@ -150,6 +157,7 @@ stages: + .build-rules: + rules: + - !reference [.no_scheduled_pipelines-rules, rules] ++ - !reference [.never-post-merge-rules, rules] + # Run automatically once all dependency jobs have passed + - when: on_success + +@@ -157,6 +165,7 @@ stages: + .container+build-rules: + rules: + - !reference [.no_scheduled_pipelines-rules, rules] ++ - !reference [.never-post-merge-rules, rules] + - when: manual + + .ci-deqp-artifacts: +@@ -175,6 +184,7 @@ stages: + .container-rules: + rules: + - !reference [.no_scheduled_pipelines-rules, rules] ++ - !reference [.never-post-merge-rules, rules] + # Run pipeline by default in the main project if any CI pipeline + # configuration files were changed, to ensure docker images are up to date + - if: *is-post-merge +diff --git a/drivers/gpu/drm/ci/test.yml b/drivers/gpu/drm/ci/test.yml +index 5e1c727640c40..9faf76e55a56a 100644 +--- a/drivers/gpu/drm/ci/test.yml ++++ b/drivers/gpu/drm/ci/test.yml +@@ -327,6 +327,7 @@ virtio_gpu:none: + GPU_VERSION: none + extends: + - .test-gl ++ - .test-rules + tags: + - kvm + script: +-- +2.43.0 + diff --git a/queue-6.8/drm-panel-orientation-quirks-add-quirk-for-gpd-win-m.patch b/queue-6.8/drm-panel-orientation-quirks-add-quirk-for-gpd-win-m.patch new file mode 100644 index 00000000000..7d8d8ce812e --- /dev/null +++ b/queue-6.8/drm-panel-orientation-quirks-add-quirk-for-gpd-win-m.patch @@ -0,0 +1,52 @@ +From 67734db6537310b4181ec889c6788c00cd1696e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 22:01:50 -0500 +Subject: drm: panel-orientation-quirks: Add quirk for GPD Win Mini + +From: Samuel Dionne-Riel + +[ Upstream commit 2f862fdc0fd802e728b6ca96bc78ec3f01bf161e ] + +This adds a DMI orientation quirk for the GPD Win Mini panel. + +Signed-off-by: Samuel Dionne-Riel +Signed-off-by: Linus Walleij +Link: https://patchwork.freedesktop.org/patch/msgid/20231222030149.3740815-2-samuel@dionne-riel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 3d92f66e550c3..aa93129c3397e 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -117,6 +117,12 @@ static const struct drm_dmi_panel_orientation_data lcd1080x1920_leftside_up = { + .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data lcd1080x1920_rightside_up = { ++ .width = 1080, ++ .height = 1920, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data lcd1200x1920_rightside_up = { + .width = 1200, + .height = 1920, +@@ -279,6 +285,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1618-03") + }, + .driver_data = (void *)&lcd720x1280_rightside_up, ++ }, { /* GPD Win Mini */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1617-01") ++ }, ++ .driver_data = (void *)&lcd1080x1920_rightside_up, + }, { /* I.T.Works TW891 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."), +-- +2.43.0 + diff --git a/queue-6.8/drm-panel-simple-add-boe-bp082wx1-100-8.2-panel.patch b/queue-6.8/drm-panel-simple-add-boe-bp082wx1-100-8.2-panel.patch new file mode 100644 index 00000000000..bf862856d5f --- /dev/null +++ b/queue-6.8/drm-panel-simple-add-boe-bp082wx1-100-8.2-panel.patch @@ -0,0 +1,64 @@ +From e907bcc8f193cb154835887faeab70be962690f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 13:16:59 +0200 +Subject: drm/panel: simple: Add BOE BP082WX1-100 8.2" panel + +From: Tony Lindgren + +[ Upstream commit dc90214ff58be575fdceb549f901506cdef5d093 ] + +The BOE BP082WX1-100 is a 8.2" panel similar to the 10.1" panel +BP101WX1-100. Both panels use the same timings. + +Acked-by: Conor Dooley +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20240211111703.7567-2-tony@atomide.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240211111703.7567-2-tony@atomide.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index d493ee735c734..72fdab8adb088 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1367,6 +1367,23 @@ static const struct drm_display_mode boe_bp101wx1_100_mode = { + .vtotal = 800 + 6 + 8 + 2, + }; + ++static const struct panel_desc boe_bp082wx1_100 = { ++ .modes = &boe_bp101wx1_100_mode, ++ .num_modes = 1, ++ .bpc = 8, ++ .size = { ++ .width = 177, ++ .height = 110, ++ }, ++ .delay = { ++ .enable = 50, ++ .disable = 50, ++ }, ++ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA, ++ .bus_flags = DRM_BUS_FLAG_DE_HIGH, ++ .connector_type = DRM_MODE_CONNECTOR_LVDS, ++}; ++ + static const struct panel_desc boe_bp101wx1_100 = { + .modes = &boe_bp101wx1_100_mode, + .num_modes = 1, +@@ -4345,6 +4362,9 @@ static const struct of_device_id platform_of_match[] = { + }, { + .compatible = "bananapi,s070wv20-ct16", + .data = &bananapi_s070wv20_ct16, ++ }, { ++ .compatible = "boe,bp082wx1-100", ++ .data = &boe_bp082wx1_100, + }, { + .compatible = "boe,bp101wx1-100", + .data = &boe_bp101wx1_100, +-- +2.43.0 + diff --git a/queue-6.8/drm-ttm-return-enospc-from-ttm_bo_mem_space-v3.patch b/queue-6.8/drm-ttm-return-enospc-from-ttm_bo_mem_space-v3.patch new file mode 100644 index 00000000000..f788d5c3190 --- /dev/null +++ b/queue-6.8/drm-ttm-return-enospc-from-ttm_bo_mem_space-v3.patch @@ -0,0 +1,64 @@ +From 148a71ff2bcaa40142c21b22a5c25b075607a959 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 16:40:40 +0100 +Subject: drm/ttm: return ENOSPC from ttm_bo_mem_space v3 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 28e5126718c7b306b8c29d2ae8f48417e9303aa1 ] + +Only convert it to ENOMEM in ttm_bo_validate. + +This allows ttm_bo_validate to distinguish between an out of memory +situation and just out of space in a placement domain. + +v2: improve commit message +v3: fix kerneldoc typos + +Signed-off-by: Christian König +Reviewed-by: Zack Rusin +Reviewed-by: Thomas Hellström +Link: https://patchwork.freedesktop.org/patch/msgid/20240112125158.2748-3-christian.koenig@amd.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_bo.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index edf10618fe2b2..f95b0406ca995 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -770,7 +770,7 @@ static int ttm_bo_mem_force_space(struct ttm_buffer_object *bo, + * This function may sleep while waiting for space to become available. + * Returns: + * -EBUSY: No space available (only if no_wait == 1). +- * -ENOMEM: Could not allocate memory for the buffer object, either due to ++ * -ENOSPC: Could not allocate space for the buffer object, either due to + * fragmentation or concurrent allocators. + * -ERESTARTSYS: An interruptible sleep was interrupted by a signal. + */ +@@ -830,7 +830,7 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo, + goto error; + } + +- ret = -ENOMEM; ++ ret = -ENOSPC; + if (!type_found) { + pr_err(TTM_PFX "No compatible memory type found\n"); + ret = -EINVAL; +@@ -916,6 +916,9 @@ int ttm_bo_validate(struct ttm_buffer_object *bo, + return -EINVAL; + + ret = ttm_bo_move_buffer(bo, placement, ctx); ++ /* For backward compatibility with userspace */ ++ if (ret == -ENOSPC) ++ return -ENOMEM; + if (ret) + return ret; + +-- +2.43.0 + diff --git a/queue-6.8/drm-vc4-don-t-check-if-plane-state-fb-state-fb.patch b/queue-6.8/drm-vc4-don-t-check-if-plane-state-fb-state-fb.patch new file mode 100644 index 00000000000..6fc023beead --- /dev/null +++ b/queue-6.8/drm-vc4-don-t-check-if-plane-state-fb-state-fb.patch @@ -0,0 +1,105 @@ +From 0e467ae09b614673a3f2d40a308a166d98fb1241 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 14:58:36 -0300 +Subject: drm/vc4: don't check if plane->state->fb == state->fb +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit 5ee0d47dcf33efd8950b347dcf4d20bab12a3fa9 ] + +Currently, when using non-blocking commits, we can see the following +kernel warning: + +[ 110.908514] ------------[ cut here ]------------ +[ 110.908529] refcount_t: underflow; use-after-free. +[ 110.908620] WARNING: CPU: 0 PID: 1866 at lib/refcount.c:87 refcount_dec_not_one+0xb8/0xc0 +[ 110.908664] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp vc4 brcmfmac hci_uart btbcm brcmutil bluetooth snd_soc_hdmi_codec cfg80211 cec drm_display_helper drm_dma_helper drm_kms_helper snd_soc_core snd_compress snd_pcm_dmaengine fb_sys_fops sysimgblt syscopyarea sysfillrect raspberrypi_hwmon ecdh_generic ecc rfkill libaes i2c_bcm2835 binfmt_misc joydev snd_bcm2835(C) bcm2835_codec(C) bcm2835_isp(C) v4l2_mem2mem videobuf2_dma_contig snd_pcm bcm2835_v4l2(C) raspberrypi_gpiomem bcm2835_mmal_vchiq(C) videobuf2_v4l2 snd_timer videobuf2_vmalloc videobuf2_memops videobuf2_common snd videodev vc_sm_cma(C) mc hid_logitech_dj uio_pdrv_genirq uio i2c_dev drm fuse dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 +[ 110.909086] CPU: 0 PID: 1866 Comm: kodi.bin Tainted: G C 6.1.66-v8+ #32 +[ 110.909104] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) +[ 110.909114] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 110.909132] pc : refcount_dec_not_one+0xb8/0xc0 +[ 110.909152] lr : refcount_dec_not_one+0xb4/0xc0 +[ 110.909170] sp : ffffffc00913b9c0 +[ 110.909177] x29: ffffffc00913b9c0 x28: 000000556969bbb0 x27: 000000556990df60 +[ 110.909205] x26: 0000000000000002 x25: 0000000000000004 x24: ffffff8004448480 +[ 110.909230] x23: ffffff800570b500 x22: ffffff802e03a7bc x21: ffffffecfca68c78 +[ 110.909257] x20: ffffff8002b42000 x19: ffffff802e03a600 x18: 0000000000000000 +[ 110.909283] x17: 0000000000000011 x16: ffffffffffffffff x15: 0000000000000004 +[ 110.909308] x14: 0000000000000fff x13: ffffffed577e47e0 x12: 0000000000000003 +[ 110.909333] x11: 0000000000000000 x10: 0000000000000027 x9 : c912d0d083728c00 +[ 110.909359] x8 : c912d0d083728c00 x7 : 65646e75203a745f x6 : 746e756f63666572 +[ 110.909384] x5 : ffffffed579f62ee x4 : ffffffed579eb01e x3 : 0000000000000000 +[ 110.909409] x2 : 0000000000000000 x1 : ffffffc00913b750 x0 : 0000000000000001 +[ 110.909434] Call trace: +[ 110.909441] refcount_dec_not_one+0xb8/0xc0 +[ 110.909461] vc4_bo_dec_usecnt+0x4c/0x1b0 [vc4] +[ 110.909903] vc4_cleanup_fb+0x44/0x50 [vc4] +[ 110.910315] drm_atomic_helper_cleanup_planes+0x88/0xa4 [drm_kms_helper] +[ 110.910669] vc4_atomic_commit_tail+0x390/0x9dc [vc4] +[ 110.911079] commit_tail+0xb0/0x164 [drm_kms_helper] +[ 110.911397] drm_atomic_helper_commit+0x1d0/0x1f0 [drm_kms_helper] +[ 110.911716] drm_atomic_commit+0xb0/0xdc [drm] +[ 110.912569] drm_mode_atomic_ioctl+0x348/0x4b8 [drm] +[ 110.913330] drm_ioctl_kernel+0xec/0x15c [drm] +[ 110.914091] drm_ioctl+0x24c/0x3b0 [drm] +[ 110.914850] __arm64_sys_ioctl+0x9c/0xd4 +[ 110.914873] invoke_syscall+0x4c/0x114 +[ 110.914897] el0_svc_common+0xd0/0x118 +[ 110.914917] do_el0_svc+0x38/0xd0 +[ 110.914936] el0_svc+0x30/0x8c +[ 110.914958] el0t_64_sync_handler+0x84/0xf0 +[ 110.914979] el0t_64_sync+0x18c/0x190 +[ 110.914996] ---[ end trace 0000000000000000 ]--- + +This happens because, although `prepare_fb` and `cleanup_fb` are +perfectly balanced, we cannot guarantee consistency in the check +plane->state->fb == state->fb. This means that sometimes we can increase +the refcount in `prepare_fb` and don't decrease it in `cleanup_fb`. The +opposite can also be true. + +In fact, the struct drm_plane .state shouldn't be accessed directly +but instead, the `drm_atomic_get_new_plane_state()` helper function should +be used. So, we could stick to this check, but using +`drm_atomic_get_new_plane_state()`. But actually, this check is not really +needed. We can increase and decrease the refcount symmetrically without +problems. + +This is going to make the code more simple and consistent. + +Signed-off-by: Maíra Canal +Acked-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240105175908.242000-1-mcanal@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_plane.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 00e713faecd5a..5948e34f7f813 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -1505,9 +1505,6 @@ static int vc4_prepare_fb(struct drm_plane *plane, + + drm_gem_plane_helper_prepare_fb(plane, state); + +- if (plane->state->fb == state->fb) +- return 0; +- + return vc4_bo_inc_usecnt(bo); + } + +@@ -1516,7 +1513,7 @@ static void vc4_cleanup_fb(struct drm_plane *plane, + { + struct vc4_bo *bo; + +- if (plane->state->fb == state->fb || !state->fb) ++ if (!state->fb) + return; + + bo = to_vc4_bo(&drm_fb_dma_get_gem_obj(state->fb, 0)->base); +-- +2.43.0 + diff --git a/queue-6.8/dump_stack-do-not-get-cpu_sync-for-panic-cpu.patch b/queue-6.8/dump_stack-do-not-get-cpu_sync-for-panic-cpu.patch new file mode 100644 index 00000000000..515e604f92c --- /dev/null +++ b/queue-6.8/dump_stack-do-not-get-cpu_sync-for-panic-cpu.patch @@ -0,0 +1,93 @@ +From ffdb28902359d97bbf24eaa25d7b1585a0f91142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 14:47:03 +0106 +Subject: dump_stack: Do not get cpu_sync for panic CPU + +From: John Ogness + +[ Upstream commit 7412dc6d55eed6b76180e40ac3601412ebde29bd ] + +dump_stack() is called in panic(). If for some reason another CPU +is holding the printk_cpu_sync and is unable to release it, the +panic CPU will be unable to continue and print the stacktrace. + +Since non-panic CPUs are not allowed to store new printk messages +anyway, there is no need to synchronize the stacktrace output in +a panic situation. + +For the panic CPU, do not get the printk_cpu_sync because it is +not needed and avoids a potential deadlock scenario in panic(). + +Link: https://lore.kernel.org/lkml/ZcIGKU8sxti38Kok@alley +Signed-off-by: John Ogness +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/20240207134103.1357162-15-john.ogness@linutronix.de +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + include/linux/printk.h | 2 ++ + kernel/printk/internal.h | 1 - + lib/dump_stack.c | 16 +++++++++++++--- + 3 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/include/linux/printk.h b/include/linux/printk.h +index 8ef499ab3c1ed..955e31860095e 100644 +--- a/include/linux/printk.h ++++ b/include/linux/printk.h +@@ -273,6 +273,8 @@ static inline void printk_trigger_flush(void) + } + #endif + ++bool this_cpu_in_panic(void); ++ + #ifdef CONFIG_SMP + extern int __printk_cpu_sync_try_get(void); + extern void __printk_cpu_sync_wait(void); +diff --git a/kernel/printk/internal.h b/kernel/printk/internal.h +index ac2d9750e5f81..6c2afee5ef620 100644 +--- a/kernel/printk/internal.h ++++ b/kernel/printk/internal.h +@@ -130,7 +130,6 @@ struct printk_message { + }; + + bool other_cpu_in_panic(void); +-bool this_cpu_in_panic(void); + bool printk_get_next_message(struct printk_message *pmsg, u64 seq, + bool is_extended, bool may_supress); + +diff --git a/lib/dump_stack.c b/lib/dump_stack.c +index 83471e81501a7..222c6d6c8281a 100644 +--- a/lib/dump_stack.c ++++ b/lib/dump_stack.c +@@ -96,15 +96,25 @@ static void __dump_stack(const char *log_lvl) + */ + asmlinkage __visible void dump_stack_lvl(const char *log_lvl) + { ++ bool in_panic = this_cpu_in_panic(); + unsigned long flags; + + /* + * Permit this cpu to perform nested stack dumps while serialising +- * against other CPUs ++ * against other CPUs, unless this CPU is in panic. ++ * ++ * When in panic, non-panic CPUs are not permitted to store new ++ * printk messages so there is no need to synchronize the output. ++ * This avoids potential deadlock in panic() if another CPU is ++ * holding and unable to release the printk_cpu_sync. + */ +- printk_cpu_sync_get_irqsave(flags); ++ if (!in_panic) ++ printk_cpu_sync_get_irqsave(flags); ++ + __dump_stack(log_lvl); +- printk_cpu_sync_put_irqrestore(flags); ++ ++ if (!in_panic) ++ printk_cpu_sync_put_irqrestore(flags); + } + EXPORT_SYMBOL(dump_stack_lvl); + +-- +2.43.0 + diff --git a/queue-6.8/ext4-add-a-hint-for-block-bitmap-corrupt-state-in-mb.patch b/queue-6.8/ext4-add-a-hint-for-block-bitmap-corrupt-state-in-mb.patch new file mode 100644 index 00000000000..c13c25c729f --- /dev/null +++ b/queue-6.8/ext4-add-a-hint-for-block-bitmap-corrupt-state-in-mb.patch @@ -0,0 +1,44 @@ +From 510da82c2040906537db1fb7a7bd9215be81fbf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 14:11:54 +0800 +Subject: ext4: add a hint for block bitmap corrupt state in mb_groups + +From: Zhang Yi + +[ Upstream commit 68ee261fb15457ecb17e3683cb4e6a4792ca5b71 ] + +If one group is marked as block bitmap corrupted, its free blocks cannot +be used and its free count is also deducted from the global +sbi->s_freeclusters_counter. User might be confused about the absent +free space because we can't query the information about corrupted block +groups except unreliable error messages in syslog. So add a hint to show +block bitmap corrupted groups in mb_groups. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240119061154.1525781-1-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 70836e25418ab..cf407425d0f30 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -3059,7 +3059,10 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v) + for (i = 0; i <= 13; i++) + seq_printf(seq, " %-5u", i <= blocksize_bits + 1 ? + sg.info.bb_counters[i] : 0); +- seq_puts(seq, " ]\n"); ++ seq_puts(seq, " ]"); ++ if (EXT4_MB_GRP_BBITMAP_CORRUPT(&sg.info)) ++ seq_puts(seq, " Block bitmap corrupted!"); ++ seq_puts(seq, "\n"); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.8/ext4-forbid-commit-inconsistent-quota-data-when-erro.patch b/queue-6.8/ext4-forbid-commit-inconsistent-quota-data-when-erro.patch new file mode 100644 index 00000000000..d706612d627 --- /dev/null +++ b/queue-6.8/ext4-forbid-commit-inconsistent-quota-data-when-erro.patch @@ -0,0 +1,70 @@ +From 671376cc826fe7d12bc92e1d7d96671c0dbbf985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 14:29:08 +0800 +Subject: ext4: forbid commit inconsistent quota data when errors=remount-ro + +From: Ye Bin + +[ Upstream commit d8b945fa475f13d787df00c26a6dc45a3e2e1d1d ] + +There's issue as follows When do IO fault injection test: +Quota error (device dm-3): find_block_dqentry: Quota for id 101 referenced but not present +Quota error (device dm-3): qtree_read_dquot: Can't read quota structure for id 101 +Quota error (device dm-3): do_check_range: Getting block 2021161007 out of range 1-186 +Quota error (device dm-3): qtree_read_dquot: Can't read quota structure for id 661 + +Now, ext4_write_dquot()/ext4_acquire_dquot()/ext4_release_dquot() may commit +inconsistent quota data even if process failed. This may lead to filesystem +corruption. +To ensure filesystem consistent when errors=remount-ro there is need to call +ext4_handle_error() to abort journal. + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240119062908.3598806-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 32bd83adf0bb8..4866657c6d41f 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -6864,6 +6864,10 @@ static int ext4_write_dquot(struct dquot *dquot) + if (IS_ERR(handle)) + return PTR_ERR(handle); + ret = dquot_commit(dquot); ++ if (ret < 0) ++ ext4_error_err(dquot->dq_sb, -ret, ++ "Failed to commit dquot type %d", ++ dquot->dq_id.type); + err = ext4_journal_stop(handle); + if (!ret) + ret = err; +@@ -6880,6 +6884,10 @@ static int ext4_acquire_dquot(struct dquot *dquot) + if (IS_ERR(handle)) + return PTR_ERR(handle); + ret = dquot_acquire(dquot); ++ if (ret < 0) ++ ext4_error_err(dquot->dq_sb, -ret, ++ "Failed to acquire dquot type %d", ++ dquot->dq_id.type); + err = ext4_journal_stop(handle); + if (!ret) + ret = err; +@@ -6899,6 +6907,10 @@ static int ext4_release_dquot(struct dquot *dquot) + return PTR_ERR(handle); + } + ret = dquot_release(dquot); ++ if (ret < 0) ++ ext4_error_err(dquot->dq_sb, -ret, ++ "Failed to release dquot type %d", ++ dquot->dq_id.type); + err = ext4_journal_stop(handle); + if (!ret) + ret = err; +-- +2.43.0 + diff --git a/queue-6.8/fbdev-viafb-fix-typo-in-hw_bitblt_1-and-hw_bitblt_2.patch b/queue-6.8/fbdev-viafb-fix-typo-in-hw_bitblt_1-and-hw_bitblt_2.patch new file mode 100644 index 00000000000..b75ff095cea --- /dev/null +++ b/queue-6.8/fbdev-viafb-fix-typo-in-hw_bitblt_1-and-hw_bitblt_2.patch @@ -0,0 +1,47 @@ +From 26766025ff4e94b546ac3c0e2cea87c5c8d4d53d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 14:35:43 +0300 +Subject: fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 + +From: Aleksandr Burakov + +[ Upstream commit bc87bb342f106a0402186bcb588fcbe945dced4b ] + +There are some actions with value 'tmp' but 'dst_addr' is checked instead. +It is obvious that a copy-paste error was made here and the value +of variable 'tmp' should be checked here. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Aleksandr Burakov +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/via/accel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/via/accel.c b/drivers/video/fbdev/via/accel.c +index 0a1bc7a4d7853..1e04026f08091 100644 +--- a/drivers/video/fbdev/via/accel.c ++++ b/drivers/video/fbdev/via/accel.c +@@ -115,7 +115,7 @@ static int hw_bitblt_1(void __iomem *engine, u8 op, u32 width, u32 height, + + if (op != VIA_BITBLT_FILL) { + tmp = src_mem ? 0 : src_addr; +- if (dst_addr & 0xE0000007) { ++ if (tmp & 0xE0000007) { + printk(KERN_WARNING "hw_bitblt_1: Unsupported source " + "address %X\n", tmp); + return -EINVAL; +@@ -260,7 +260,7 @@ static int hw_bitblt_2(void __iomem *engine, u8 op, u32 width, u32 height, + writel(tmp, engine + 0x18); + + tmp = src_mem ? 0 : src_addr; +- if (dst_addr & 0xE0000007) { ++ if (tmp & 0xE0000007) { + printk(KERN_WARNING "hw_bitblt_2: Unsupported source " + "address %X\n", tmp); + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.8/fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch b/queue-6.8/fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch new file mode 100644 index 00000000000..09d236e55b7 --- /dev/null +++ b/queue-6.8/fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch @@ -0,0 +1,51 @@ +From 9ac9450a6f66f4209e0db0a14169897e465ccc64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 11:13:44 +0300 +Subject: fbmon: prevent division by zero in fb_videomode_from_videomode() + +From: Roman Smirnov + +[ Upstream commit c2d953276b8b27459baed1277a4fdd5dd9bd4126 ] + +The expression htotal * vtotal can have a zero value on +overflow. It is necessary to prevent division by zero like in +fb_var_to_videomode(). + +Found by Linux Verification Center (linuxtesting.org) with Svace. + +Signed-off-by: Roman Smirnov +Reviewed-by: Sergey Shtylyov +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbmon.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c +index 79e5bfbdd34c2..0a26399dbc899 100644 +--- a/drivers/video/fbdev/core/fbmon.c ++++ b/drivers/video/fbdev/core/fbmon.c +@@ -1311,7 +1311,7 @@ int fb_get_mode(int flags, u32 val, struct fb_var_screeninfo *var, struct fb_inf + int fb_videomode_from_videomode(const struct videomode *vm, + struct fb_videomode *fbmode) + { +- unsigned int htotal, vtotal; ++ unsigned int htotal, vtotal, total; + + fbmode->xres = vm->hactive; + fbmode->left_margin = vm->hback_porch; +@@ -1344,8 +1344,9 @@ int fb_videomode_from_videomode(const struct videomode *vm, + vtotal = vm->vactive + vm->vfront_porch + vm->vback_porch + + vm->vsync_len; + /* prevent division by zero */ +- if (htotal && vtotal) { +- fbmode->refresh = vm->pixelclock / (htotal * vtotal); ++ total = htotal * vtotal; ++ if (total) { ++ fbmode->refresh = vm->pixelclock / total; + /* a mode must have htotal and vtotal != 0 or it is invalid */ + } else { + fbmode->refresh = 0; +-- +2.43.0 + diff --git a/queue-6.8/firmware-tegra-bpmp-return-directly-after-a-failed-k.patch b/queue-6.8/firmware-tegra-bpmp-return-directly-after-a-failed-k.patch new file mode 100644 index 00000000000..2e60ec4a38a --- /dev/null +++ b/queue-6.8/firmware-tegra-bpmp-return-directly-after-a-failed-k.patch @@ -0,0 +1,44 @@ +From 401f68fda0d8dd118ff782637a5f163b59c32700 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Dec 2023 20:03:56 +0100 +Subject: firmware: tegra: bpmp: Return directly after a failed kzalloc() in + get_filename() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Markus Elfring + +[ Upstream commit 1315848f1f8a0100cb6f8a7187bc320c5d98947f ] + +The kfree() function was called in one case by +the get_filename() function during error handling +even if the passed variable contained a null pointer. +This issue was detected by using the Coccinelle software. + +Thus return directly after a call of the function “kzalloc” failed +at the beginning. + +Signed-off-by: Markus Elfring +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/firmware/tegra/bpmp-debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/tegra/bpmp-debugfs.c b/drivers/firmware/tegra/bpmp-debugfs.c +index bbcdd9fed3fb6..4221fed70ad48 100644 +--- a/drivers/firmware/tegra/bpmp-debugfs.c ++++ b/drivers/firmware/tegra/bpmp-debugfs.c +@@ -77,7 +77,7 @@ static const char *get_filename(struct tegra_bpmp *bpmp, + + root_path_buf = kzalloc(root_path_buf_len, GFP_KERNEL); + if (!root_path_buf) +- goto out; ++ return NULL; + + root_path = dentry_path(bpmp->debugfs_mirror, root_path_buf, + root_path_buf_len); +-- +2.43.0 + diff --git a/queue-6.8/hid-input-avoid-polling-stylus-battery-on-chromebook.patch b/queue-6.8/hid-input-avoid-polling-stylus-battery-on-chromebook.patch new file mode 100644 index 00000000000..0095fa23c2c --- /dev/null +++ b/queue-6.8/hid-input-avoid-polling-stylus-battery-on-chromebook.patch @@ -0,0 +1,52 @@ +From a138852b3588e06ef154ca8644c09d14436fe958 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 15:16:12 -0800 +Subject: HID: input: avoid polling stylus battery on Chromebook Pompom + +From: Dmitry Torokhov + +[ Upstream commit 9a5b1521e2d0d7ace70c6e5eed073babcec91409 ] + +Internal touchscreen on Trogdor Pompom (AKA Dynabook Chromebook C1) +supports USI stylus. Unfortunately the HID descriptor for the stylus +interface does not contain "Stylus" physical collection, which makes +the kernel to try and pull battery information, resulting in errors. + +Apply HID_BATTERY_QUIRK_AVOID_QUERY to the device. + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-input.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 828a5c022c640..175b6680087e0 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -430,6 +430,7 @@ + #define I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V1 0x2BED + #define I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V2 0x2BEE + #define I2C_DEVICE_ID_HP_ENVY_X360_15_EU0556NG 0x2D02 ++#define I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM 0x2F81 + + #define USB_VENDOR_ID_ELECOM 0x056e + #define USB_DEVICE_ID_ELECOM_BM084 0x0061 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index c8b20d44b1472..e03d300d2bac4 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -411,6 +411,8 @@ static const struct hid_device_id hid_battery_quirks[] = { + HID_BATTERY_QUIRK_IGNORE }, + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15_EU0556NG), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM), ++ HID_BATTERY_QUIRK_AVOID_QUERY }, + {} + }; + +-- +2.43.0 + diff --git a/queue-6.8/i2c-designware-fix-rx-fifo-depth-define-on-wangxun-1.patch b/queue-6.8/i2c-designware-fix-rx-fifo-depth-define-on-wangxun-1.patch new file mode 100644 index 00000000000..fc35e945cda --- /dev/null +++ b/queue-6.8/i2c-designware-fix-rx-fifo-depth-define-on-wangxun-1.patch @@ -0,0 +1,41 @@ +From f1cc7ba4906ac66ed70105267018775474293b5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 14:48:46 +0200 +Subject: i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC + +From: Jarkko Nikula + +[ Upstream commit c94612a72ac87b0337a0d85b9263266776ed4190 ] + +I believe RX FIFO depth define 0 is incorrect on Wangxun 10Gb NIC. It +must be at least 1 since code is able to read received data from the +DW_IC_DATA_CMD register. + +For now this define is irrelevant since the txgbe_i2c_dw_xfer_quirk() +doesn't use the rx_fifo_depth member variable of struct dw_i2c_dev but +is needed when converting code into generic polling mode implementation. + +Signed-off-by: Jarkko Nikula +Tested-by: Jiawen Wu +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-core.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h +index a7f6f3eafad7d..ae835000fd32a 100644 +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -318,7 +318,7 @@ struct dw_i2c_dev { + #define AMD_UCSI_INTR_EN 0xd + + #define TXGBE_TX_FIFO_DEPTH 4 +-#define TXGBE_RX_FIFO_DEPTH 0 ++#define TXGBE_RX_FIFO_DEPTH 1 + + struct i2c_dw_semaphore_callbacks { + int (*probe)(struct dw_i2c_dev *dev); +-- +2.43.0 + diff --git a/queue-6.8/ice-use-relative-vsi-index-for-vfs-instead-of-pf-vsi.patch b/queue-6.8/ice-use-relative-vsi-index-for-vfs-instead-of-pf-vsi.patch new file mode 100644 index 00000000000..9d692eb5978 --- /dev/null +++ b/queue-6.8/ice-use-relative-vsi-index-for-vfs-instead-of-pf-vsi.patch @@ -0,0 +1,104 @@ +From 2b15cdc9bdb1dfc2cc0fca5d8662e7699cac8e02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 14:06:37 -0800 +Subject: ice: use relative VSI index for VFs instead of PF VSI number + +From: Jacob Keller + +[ Upstream commit 11fbb1bfb5bc8c98b2d7db9da332b5e568f4aaab ] + +When initializing over virtchnl, the PF is required to pass a VSI ID to the +VF as part of its capabilities exchange. The VF driver reports this value +back to the PF in a variety of commands. The PF driver validates that this +value matches the value it sent to the VF. + +Some hardware families such as the E700 series could use this value when +reading RSS registers or communicating directly with firmware over the +Admin Queue. + +However, E800 series hardware does not support any of these interfaces and +the VF's only use for this value is to report it back to the PF. Thus, +there is no requirement that this value be an actual VSI ID value of any +kind. + +The PF driver already does not trust that the VF sends it a real VSI ID. +The VSI structure is always looked up from the VF structure. The PF does +validate that the VSI ID provided matches a VSI associated with the VF, but +otherwise does not use the VSI ID for any purpose. + +Instead of reporting the VSI number relative to the PF space, report a +fixed value of 1. When communicating with the VF over virtchnl, validate +that the VSI number is returned appropriately. + +This avoids leaking information about the firmware of the PF state. +Currently the ice driver only supplies a VF with a single VSI. However, it +appears that virtchnl has some support for allowing multiple VSIs. I did +not attempt to implement this. However, space is left open to allow further +relative indexes if additional VSIs are provided in future feature +development. For this reason, keep the ice_vc_isvalid_vsi_id function in +place to allow extending it for multiple VSIs in the future. + +This change will also simplify handling of live migration in a future +series. Since we no longer will provide a real VSI number to the VF, there +will be no need to keep track of this number when migrating to a new host. + +Signed-off-by: Jacob Keller +Reviewed-by: Przemek Kitszel +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 9 ++------- + drivers/net/ethernet/intel/ice/ice_virtchnl.h | 9 +++++++++ + 2 files changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c +index 6f2328a049bf1..7b550d7d96b68 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c +@@ -499,7 +499,7 @@ static int ice_vc_get_vf_res_msg(struct ice_vf *vf, u8 *msg) + vfres->rss_lut_size = ICE_LUT_VSI_SIZE; + vfres->max_mtu = ice_vc_get_max_frame_size(vf); + +- vfres->vsi_res[0].vsi_id = vf->lan_vsi_num; ++ vfres->vsi_res[0].vsi_id = ICE_VF_VSI_ID; + vfres->vsi_res[0].vsi_type = VIRTCHNL_VSI_SRIOV; + vfres->vsi_res[0].num_queue_pairs = vsi->num_txq; + ether_addr_copy(vfres->vsi_res[0].default_mac_addr, +@@ -545,12 +545,7 @@ static void ice_vc_reset_vf_msg(struct ice_vf *vf) + */ + bool ice_vc_isvalid_vsi_id(struct ice_vf *vf, u16 vsi_id) + { +- struct ice_pf *pf = vf->pf; +- struct ice_vsi *vsi; +- +- vsi = ice_find_vsi(pf, vsi_id); +- +- return (vsi && (vsi->vf == vf)); ++ return vsi_id == ICE_VF_VSI_ID; + } + + /** +diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.h b/drivers/net/ethernet/intel/ice/ice_virtchnl.h +index 60dfbe05980aa..3a41158691532 100644 +--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.h ++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.h +@@ -19,6 +19,15 @@ + #define ICE_MAX_MACADDR_PER_VF 18 + #define ICE_FLEX_DESC_RXDID_MAX_NUM 64 + ++/* VFs only get a single VSI. For ice hardware, the VF does not need to know ++ * its VSI index. However, the virtchnl interface requires a VSI number, ++ * mainly due to legacy hardware. ++ * ++ * Since the VF doesn't need this information, report a static value to the VF ++ * instead of leaking any information about the PF or hardware setup. ++ */ ++#define ICE_VF_VSI_ID 1 ++ + struct ice_virtchnl_ops { + int (*get_ver_msg)(struct ice_vf *vf, u8 *msg); + int (*get_vf_res_msg)(struct ice_vf *vf, u8 *msg); +-- +2.43.0 + diff --git a/queue-6.8/input-allocate-keycode-for-display-refresh-rate-togg.patch b/queue-6.8/input-allocate-keycode-for-display-refresh-rate-togg.patch new file mode 100644 index 00000000000..83480c40cf1 --- /dev/null +++ b/queue-6.8/input-allocate-keycode-for-display-refresh-rate-togg.patch @@ -0,0 +1,43 @@ +From 6689f74a723a24c56151941db5491e6e87f01141 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Mar 2024 12:31:41 +0100 +Subject: Input: allocate keycode for Display refresh rate toggle +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gergo Koteles + +[ Upstream commit cfeb98b95fff25c442f78a6f616c627bc48a26b7 ] + +Newer Lenovo Yogas and Legions with 60Hz/90Hz displays send a wmi event +when Fn + R is pressed. This is intended for use to switch between the +two refresh rates. + +Allocate a new KEY_REFRESH_RATE_TOGGLE keycode for it. + +Signed-off-by: Gergo Koteles +Acked-by: Dmitry Torokhov +Link: https://lore.kernel.org/r/15a5d08c84cf4d7b820de34ebbcf8ae2502fb3ca.1710065750.git.soyer@irl.hu +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + include/uapi/linux/input-event-codes.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h +index 022a520e31fc2..03edf2ccdf6c8 100644 +--- a/include/uapi/linux/input-event-codes.h ++++ b/include/uapi/linux/input-event-codes.h +@@ -602,6 +602,7 @@ + + #define KEY_ALS_TOGGLE 0x230 /* Ambient light sensor */ + #define KEY_ROTATE_LOCK_TOGGLE 0x231 /* Display rotation lock */ ++#define KEY_REFRESH_RATE_TOGGLE 0x232 /* Display refresh rate toggle */ + + #define KEY_BUTTONCONFIG 0x240 /* AL Button Configuration */ + #define KEY_TASKMANAGER 0x241 /* AL Task/Project Manager */ +-- +2.43.0 + diff --git a/queue-6.8/input-imagis-use-field_get-where-applicable.patch b/queue-6.8/input-imagis-use-field_get-where-applicable.patch new file mode 100644 index 00000000000..b40bc68a8e8 --- /dev/null +++ b/queue-6.8/input-imagis-use-field_get-where-applicable.patch @@ -0,0 +1,87 @@ +From fe1327351171501d8e5527afcafa2044ef2cafac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Mar 2024 21:18:05 -0800 +Subject: Input: imagis - use FIELD_GET where applicable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duje Mihanović + +[ Upstream commit c0ca3dbd03d66c6b9e044f48720e6ab5cef37ae5 ] + +Instead of manually extracting certain bits from registers with binary +ANDs and shifts, the FIELD_GET macro can be used. With this in mind, the +*_SHIFT macros can be dropped. + +Signed-off-by: Duje Mihanović +Link: https://lore.kernel.org/r/20240306-b4-imagis-keys-v3-1-2c429afa8420@skole.hr +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/imagis.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/drivers/input/touchscreen/imagis.c b/drivers/input/touchscreen/imagis.c +index e67fd30110278..55ecebe981445 100644 +--- a/drivers/input/touchscreen/imagis.c ++++ b/drivers/input/touchscreen/imagis.c +@@ -1,5 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + ++#include + #include + #include + #include +@@ -23,12 +24,9 @@ + #define IST3038C_I2C_RETRY_COUNT 3 + #define IST3038C_MAX_FINGER_NUM 10 + #define IST3038C_X_MASK GENMASK(23, 12) +-#define IST3038C_X_SHIFT 12 + #define IST3038C_Y_MASK GENMASK(11, 0) + #define IST3038C_AREA_MASK GENMASK(27, 24) +-#define IST3038C_AREA_SHIFT 24 + #define IST3038C_FINGER_COUNT_MASK GENMASK(15, 12) +-#define IST3038C_FINGER_COUNT_SHIFT 12 + #define IST3038C_FINGER_STATUS_MASK GENMASK(9, 0) + + struct imagis_ts { +@@ -92,8 +90,7 @@ static irqreturn_t imagis_interrupt(int irq, void *dev_id) + goto out; + } + +- finger_count = (intr_message & IST3038C_FINGER_COUNT_MASK) >> +- IST3038C_FINGER_COUNT_SHIFT; ++ finger_count = FIELD_GET(IST3038C_FINGER_COUNT_MASK, intr_message); + if (finger_count > IST3038C_MAX_FINGER_NUM) { + dev_err(&ts->client->dev, + "finger count %d is more than maximum supported\n", +@@ -101,7 +98,7 @@ static irqreturn_t imagis_interrupt(int irq, void *dev_id) + goto out; + } + +- finger_pressed = intr_message & IST3038C_FINGER_STATUS_MASK; ++ finger_pressed = FIELD_GET(IST3038C_FINGER_STATUS_MASK, intr_message); + + for (i = 0; i < finger_count; i++) { + error = imagis_i2c_read_reg(ts, +@@ -118,12 +115,11 @@ static irqreturn_t imagis_interrupt(int irq, void *dev_id) + input_mt_report_slot_state(ts->input_dev, MT_TOOL_FINGER, + finger_pressed & BIT(i)); + touchscreen_report_pos(ts->input_dev, &ts->prop, +- (finger_status & IST3038C_X_MASK) >> +- IST3038C_X_SHIFT, +- finger_status & IST3038C_Y_MASK, 1); ++ FIELD_GET(IST3038C_X_MASK, finger_status), ++ FIELD_GET(IST3038C_Y_MASK, finger_status), ++ true); + input_report_abs(ts->input_dev, ABS_MT_TOUCH_MAJOR, +- (finger_status & IST3038C_AREA_MASK) >> +- IST3038C_AREA_SHIFT); ++ FIELD_GET(IST3038C_AREA_MASK, finger_status)); + } + + input_mt_sync_frame(ts->input_dev); +-- +2.43.0 + diff --git a/queue-6.8/input-synaptics-rmi4-fail-probing-if-memory-allocati.patch b/queue-6.8/input-synaptics-rmi4-fail-probing-if-memory-allocati.patch new file mode 100644 index 00000000000..eb384794be2 --- /dev/null +++ b/queue-6.8/input-synaptics-rmi4-fail-probing-if-memory-allocati.patch @@ -0,0 +1,42 @@ +From f605c698a9d7385c512b6945f179f9c594e17a10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 11:37:59 -0800 +Subject: Input: synaptics-rmi4 - fail probing if memory allocation for "phys" + fails + +From: Kunwu Chan + +[ Upstream commit bc4996184d56cfaf56d3811ac2680c8a0e2af56e ] + +While input core can work with input->phys set to NULL userspace might +depend on it, so better fail probing if allocation fails. The system must +be in a pretty bad shape for it to happen anyway. + +Signed-off-by: Kunwu Chan +Link: https://lore.kernel.org/r/20240117073124.143636-1-chentao@kylinos.cn +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/rmi4/rmi_driver.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c +index 42eaebb3bf5cc..ef9ea295f9e03 100644 +--- a/drivers/input/rmi4/rmi_driver.c ++++ b/drivers/input/rmi4/rmi_driver.c +@@ -1196,7 +1196,11 @@ static int rmi_driver_probe(struct device *dev) + } + rmi_driver_set_input_params(rmi_dev, data->input); + data->input->phys = devm_kasprintf(dev, GFP_KERNEL, +- "%s/input0", dev_name(dev)); ++ "%s/input0", dev_name(dev)); ++ if (!data->input->phys) { ++ retval = -ENOMEM; ++ goto err; ++ } + } + + retval = rmi_init_functions(data); +-- +2.43.0 + diff --git a/queue-6.8/input-touchscreen-imagis-correct-the-maximum-touch-a.patch b/queue-6.8/input-touchscreen-imagis-correct-the-maximum-touch-a.patch new file mode 100644 index 00000000000..a91a0d64d93 --- /dev/null +++ b/queue-6.8/input-touchscreen-imagis-correct-the-maximum-touch-a.patch @@ -0,0 +1,37 @@ +From b10b3d37ad0e11970fa416ad5a741dbb558d821c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 17:41:00 +0100 +Subject: input/touchscreen: imagis: Correct the maximum touch area value + +From: Markuss Broks + +[ Upstream commit 54a62ed17a705ef1ac80ebca2b62136b19243e19 ] + +As specified in downstream IST3038B driver and proved by testing, +the correct maximum reported value of touch area is 16. + +Signed-off-by: Markuss Broks +Signed-off-by: Karel Balej +Link: https://lore.kernel.org/r/20240301164659.13240-2-karelb@gimli.ms.mff.cuni.cz +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/imagis.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/imagis.c b/drivers/input/touchscreen/imagis.c +index 07111ca244556..e67fd30110278 100644 +--- a/drivers/input/touchscreen/imagis.c ++++ b/drivers/input/touchscreen/imagis.c +@@ -210,7 +210,7 @@ static int imagis_init_input_dev(struct imagis_ts *ts) + + input_set_capability(input_dev, EV_ABS, ABS_MT_POSITION_X); + input_set_capability(input_dev, EV_ABS, ABS_MT_POSITION_Y); +- input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR, 0, 255, 0, 0); ++ input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR, 0, 16, 0, 0); + + touchscreen_parse_properties(input_dev, true, &ts->prop); + if (!ts->prop.max_x || !ts->prop.max_y) { +-- +2.43.0 + diff --git a/queue-6.8/input-xpad-add-support-for-snakebyte-gamepads.patch b/queue-6.8/input-xpad-add-support-for-snakebyte-gamepads.patch new file mode 100644 index 00000000000..545cfa91223 --- /dev/null +++ b/queue-6.8/input-xpad-add-support-for-snakebyte-gamepads.patch @@ -0,0 +1,44 @@ +From ee82f223a455b4d54594eae753829a8cdb4e4321 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 11:56:19 -0700 +Subject: Input: xpad - add support for Snakebyte GAMEPADs + +From: Matt Scialabba + +[ Upstream commit 81c32343d04f8ca974681d5fb5d939d2e1f58851 ] + +Add Snakebyte GAMEPAD BASE X and Snakebyte GAMEPAD RGB X to the list +of supported devices. + +Signed-off-by: Matt Scialabba +Link: https://lore.kernel.org/r/efbfb428-06b0-48f9-8701-db291c2a9d65@app.fastmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 14c828adebf78..1fad51b51b0e1 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -366,6 +366,8 @@ static const struct xpad_device { + { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, + { 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 }, ++ { 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE }, ++ { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, + { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, + { 0x2dc8, 0x3106, "8BitDo Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, +@@ -507,6 +509,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA controllers */ + XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */ + XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */ ++ XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */ + XPAD_XBOX360_VENDOR(0x2c22), /* Qanba Controllers */ + XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller */ + XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller for Xbox */ +-- +2.43.0 + diff --git a/queue-6.8/io_uring-clear-opcode-specific-data-for-an-early-fai.patch b/queue-6.8/io_uring-clear-opcode-specific-data-for-an-early-fai.patch new file mode 100644 index 00000000000..cfc14dcd16f --- /dev/null +++ b/queue-6.8/io_uring-clear-opcode-specific-data-for-an-early-fai.patch @@ -0,0 +1,105 @@ +From e3a5b19cea96214dc3e3638d05441b11d4716902 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Mar 2024 09:51:40 -0600 +Subject: io_uring: clear opcode specific data for an early failure + +From: Jens Axboe + +[ Upstream commit e21e1c45e1fe2e31732f40256b49c04e76a17cee ] + +If failure happens before the opcode prep handler is called, ensure that +we clear the opcode specific area of the request, which holds data +specific to that request type. This prevents errors where opcode +handlers either don't get to clear per-request private data since prep +isn't even called. + +Reported-and-tested-by: syzbot+f8e9a371388aa62ecab4@syzkaller.appspotmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index 572effd0af532..0f52ea80103ef 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -2143,6 +2143,13 @@ static void io_init_req_drain(struct io_kiocb *req) + } + } + ++static __cold int io_init_fail_req(struct io_kiocb *req, int err) ++{ ++ /* ensure per-opcode data is cleared if we fail before prep */ ++ memset(&req->cmd.data, 0, sizeof(req->cmd.data)); ++ return err; ++} ++ + static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, + const struct io_uring_sqe *sqe) + __must_hold(&ctx->uring_lock) +@@ -2163,29 +2170,29 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, + + if (unlikely(opcode >= IORING_OP_LAST)) { + req->opcode = 0; +- return -EINVAL; ++ return io_init_fail_req(req, -EINVAL); + } + def = &io_issue_defs[opcode]; + if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) { + /* enforce forwards compatibility on users */ + if (sqe_flags & ~SQE_VALID_FLAGS) +- return -EINVAL; ++ return io_init_fail_req(req, -EINVAL); + if (sqe_flags & IOSQE_BUFFER_SELECT) { + if (!def->buffer_select) +- return -EOPNOTSUPP; ++ return io_init_fail_req(req, -EOPNOTSUPP); + req->buf_index = READ_ONCE(sqe->buf_group); + } + if (sqe_flags & IOSQE_CQE_SKIP_SUCCESS) + ctx->drain_disabled = true; + if (sqe_flags & IOSQE_IO_DRAIN) { + if (ctx->drain_disabled) +- return -EOPNOTSUPP; ++ return io_init_fail_req(req, -EOPNOTSUPP); + io_init_req_drain(req); + } + } + if (unlikely(ctx->restricted || ctx->drain_active || ctx->drain_next)) { + if (ctx->restricted && !io_check_restriction(ctx, req, sqe_flags)) +- return -EACCES; ++ return io_init_fail_req(req, -EACCES); + /* knock it to the slow queue path, will be drained there */ + if (ctx->drain_active) + req->flags |= REQ_F_FORCE_ASYNC; +@@ -2198,9 +2205,9 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, + } + + if (!def->ioprio && sqe->ioprio) +- return -EINVAL; ++ return io_init_fail_req(req, -EINVAL); + if (!def->iopoll && (ctx->flags & IORING_SETUP_IOPOLL)) +- return -EINVAL; ++ return io_init_fail_req(req, -EINVAL); + + if (def->needs_file) { + struct io_submit_state *state = &ctx->submit_state; +@@ -2224,12 +2231,12 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, + + req->creds = xa_load(&ctx->personalities, personality); + if (!req->creds) +- return -EINVAL; ++ return io_init_fail_req(req, -EINVAL); + get_cred(req->creds); + ret = security_uring_override_creds(req->creds); + if (ret) { + put_cred(req->creds); +- return ret; ++ return io_init_fail_req(req, ret); + } + req->flags |= REQ_F_CREDS; + } +-- +2.43.0 + diff --git a/queue-6.8/iommu-arm-smmu-v3-hold-arm_smmu_asid_lock-during-all.patch b/queue-6.8/iommu-arm-smmu-v3-hold-arm_smmu_asid_lock-during-all.patch new file mode 100644 index 00000000000..c221ac0dda6 --- /dev/null +++ b/queue-6.8/iommu-arm-smmu-v3-hold-arm_smmu_asid_lock-during-all.patch @@ -0,0 +1,132 @@ +From 12392232511538aa602f1b3a79e986e6597daf5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 13:07:16 -0400 +Subject: iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev + +From: Jason Gunthorpe + +[ Upstream commit 9f7c68911579bc15c57d227d021ccd253da2b635 ] + +The BTM support wants to be able to change the ASID of any smmu_domain. +When it goes to do this it holds the arm_smmu_asid_lock and iterates over +the target domain's devices list. + +During attach of a S1 domain we must ensure that the devices list and +CD are in sync, otherwise we could miss CD updates or a parallel CD update +could push an out of date CD. + +This is pretty complicated, and almost works today because +arm_smmu_detach_dev() removes the master from the linked list before +working on the CD entries, preventing parallel update of the CD. + +However, it does have an issue where the CD can remain programed while the +domain appears to be unattached. arm_smmu_share_asid() will then not clear +any CD entriess and install its own CD entry with the same ASID +concurrently. This creates a small race window where the IOMMU can see two +ASIDs pointing to different translations. + + CPU0 CPU1 +arm_smmu_attach_dev() + arm_smmu_detach_dev() + spin_lock_irqsave(&smmu_domain->devices_lock, flags); + list_del(&master->domain_head); + spin_unlock_irqrestore(&smmu_domain->devices_lock, flags); + + arm_smmu_mmu_notifier_get() + arm_smmu_alloc_shared_cd() + arm_smmu_share_asid(): + // Does nothing due to list_del above + arm_smmu_update_ctx_desc_devices() + arm_smmu_tlb_inv_asid() + arm_smmu_write_ctx_desc() + ** Now the ASID is in two CDs + with different translation + + arm_smmu_write_ctx_desc(master, IOMMU_NO_PASID, NULL); + +Solve this by wrapping most of the attach flow in the +arm_smmu_asid_lock. This locks more than strictly needed to prepare for +the next patch which will reorganize the order of the linked list, STE and +CD changes. + +Move arm_smmu_detach_dev() till after we have initialized the domain so +the lock can be held for less time. + +Reviewed-by: Michael Shavit +Reviewed-by: Nicolin Chen +Reviewed-by: Mostafa Saleh +Tested-by: Shameer Kolothum +Tested-by: Nicolin Chen +Tested-by: Moritz Fischer +Signed-off-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/5-v6-96275f25c39d+2d4-smmuv3_newapi_p1_jgg@nvidia.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 22 ++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 0ffb1cf17e0b2..f3f2e47b6d488 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -2398,8 +2398,6 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev) + return -EBUSY; + } + +- arm_smmu_detach_dev(master); +- + mutex_lock(&smmu_domain->init_mutex); + + if (!smmu_domain->smmu) { +@@ -2414,6 +2412,16 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev) + if (ret) + return ret; + ++ /* ++ * Prevent arm_smmu_share_asid() from trying to change the ASID ++ * of either the old or new domain while we are working on it. ++ * This allows the STE and the smmu_domain->devices list to ++ * be inconsistent during this routine. ++ */ ++ mutex_lock(&arm_smmu_asid_lock); ++ ++ arm_smmu_detach_dev(master); ++ + master->domain = smmu_domain; + + /* +@@ -2439,13 +2447,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev) + } + } + +- /* +- * Prevent SVA from concurrently modifying the CD or writing to +- * the CD entry +- */ +- mutex_lock(&arm_smmu_asid_lock); + ret = arm_smmu_write_ctx_desc(master, IOMMU_NO_PASID, &smmu_domain->cd); +- mutex_unlock(&arm_smmu_asid_lock); + if (ret) { + master->domain = NULL; + goto out_list_del; +@@ -2455,13 +2457,15 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev) + arm_smmu_install_ste_for_dev(master); + + arm_smmu_enable_ats(master); +- return 0; ++ goto out_unlock; + + out_list_del: + spin_lock_irqsave(&smmu_domain->devices_lock, flags); + list_del(&master->domain_head); + spin_unlock_irqrestore(&smmu_domain->devices_lock, flags); + ++out_unlock: ++ mutex_unlock(&arm_smmu_asid_lock); + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.8/ionic-set-adminq-irq-affinity.patch b/queue-6.8/ionic-set-adminq-irq-affinity.patch new file mode 100644 index 00000000000..52aec72f0a5 --- /dev/null +++ b/queue-6.8/ionic-set-adminq-irq-affinity.patch @@ -0,0 +1,43 @@ +From c7b85fdd753bad4cd3401de5647825fced52f436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 09:59:01 -0800 +Subject: ionic: set adminq irq affinity + +From: Shannon Nelson + +[ Upstream commit c699f35d658f3c21b69ed24e64b2ea26381e941d ] + +We claim to have the AdminQ on our irq0 and thus cpu id 0, +but we need to be sure we set the affinity hint to try to +keep it there. + +Signed-off-by: Shannon Nelson +Reviewed-by: Brett Creeley +Reviewed-by: Jacob Keller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index fcb44ceeb6aa5..44d30115ded13 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -3391,9 +3391,12 @@ static int ionic_lif_adminq_init(struct ionic_lif *lif) + + napi_enable(&qcq->napi); + +- if (qcq->flags & IONIC_QCQ_F_INTR) ++ if (qcq->flags & IONIC_QCQ_F_INTR) { ++ irq_set_affinity_hint(qcq->intr.vector, ++ &qcq->intr.affinity_mask); + ionic_intr_mask(idev->intr_ctrl, qcq->intr.index, + IONIC_INTR_MASK_CLEAR); ++ } + + qcq->flags |= IONIC_QCQ_F_INITED; + +-- +2.43.0 + diff --git a/queue-6.8/isofs-handle-cds-with-bad-root-inode-but-good-joliet.patch b/queue-6.8/isofs-handle-cds-with-bad-root-inode-but-good-joliet.patch new file mode 100644 index 00000000000..0f3661fd98f --- /dev/null +++ b/queue-6.8/isofs-handle-cds-with-bad-root-inode-but-good-joliet.patch @@ -0,0 +1,60 @@ +From 8e692df9e609e2859f0f6b105ddda7fa658e492b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 19:21:32 -0700 +Subject: isofs: handle CDs with bad root inode but good Joliet root directory + +From: Alex Henrie + +[ Upstream commit 4243bf80c79211a8ca2795401add9c4a3b1d37ca ] + +I have a CD copy of the original Tom Clancy's Ghost Recon game from +2001. The disc mounts without error on Windows, but on Linux mounting +fails with the message "isofs_fill_super: get root inode failed". The +error originates in isofs_read_inode, which returns -EIO because de_len +is 0. The superblock on this disc appears to be intentionally corrupt as +a form of copy protection. + +When the root inode is unusable, instead of giving up immediately, try +to continue with the Joliet file table. This fixes the Ghost Recon CD +and probably other copy-protected CDs too. + +Signed-off-by: Alex Henrie +Signed-off-by: Jan Kara +Message-Id: <20240208022134.451490-1-alexhenrie24@gmail.com> +Signed-off-by: Sasha Levin +--- + fs/isofs/inode.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c +index 3e4d53e26f947..379c9edc907cf 100644 +--- a/fs/isofs/inode.c ++++ b/fs/isofs/inode.c +@@ -908,8 +908,22 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent) + * we then decide whether to use the Joliet descriptor. + */ + inode = isofs_iget(s, sbi->s_firstdatazone, 0); +- if (IS_ERR(inode)) +- goto out_no_root; ++ ++ /* ++ * Fix for broken CDs with a corrupt root inode but a correct Joliet ++ * root directory. ++ */ ++ if (IS_ERR(inode)) { ++ if (joliet_level && sbi->s_firstdatazone != first_data_zone) { ++ printk(KERN_NOTICE ++ "ISOFS: root inode is unusable. " ++ "Disabling Rock Ridge and switching to Joliet."); ++ sbi->s_rock = 0; ++ inode = NULL; ++ } else { ++ goto out_no_root; ++ } ++ } + + /* + * Fix for broken CDs with Rock Ridge and empty ISO root directory but +-- +2.43.0 + diff --git a/queue-6.8/julia-lawall-reported-this-null-pointer-dereference-.patch b/queue-6.8/julia-lawall-reported-this-null-pointer-dereference-.patch new file mode 100644 index 00000000000..73d764e250f --- /dev/null +++ b/queue-6.8/julia-lawall-reported-this-null-pointer-dereference-.patch @@ -0,0 +1,32 @@ +From 7b33a38d79703dfc20b61b58de0e3a2d79bdf598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 15:57:53 -0500 +Subject: Julia Lawall reported this null pointer dereference, this should fix + it. + +From: Mike Marshall + +[ Upstream commit 9bf93dcfc453fae192fe5d7874b89699e8f800ac ] + +Signed-off-by: Mike Marshall +Signed-off-by: Sasha Levin +--- + fs/orangefs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c +index 5254256a224d7..4ca8ed410c3cf 100644 +--- a/fs/orangefs/super.c ++++ b/fs/orangefs/super.c +@@ -527,7 +527,7 @@ struct dentry *orangefs_mount(struct file_system_type *fst, + sb->s_fs_info = kzalloc(sizeof(struct orangefs_sb_info_s), GFP_KERNEL); + if (!ORANGEFS_SB(sb)) { + d = ERR_PTR(-ENOMEM); +- goto free_sb_and_op; ++ goto free_op; + } + + ret = orangefs_fill_sb(sb, +-- +2.43.0 + diff --git a/queue-6.8/kernfs-rcu-protect-kernfs_nodes-and-avoid-kernfs_idr.patch b/queue-6.8/kernfs-rcu-protect-kernfs_nodes-and-avoid-kernfs_idr.patch new file mode 100644 index 00000000000..55868418dde --- /dev/null +++ b/queue-6.8/kernfs-rcu-protect-kernfs_nodes-and-avoid-kernfs_idr.patch @@ -0,0 +1,200 @@ +From 8051496261c8fef0fbc63d14c4640e1cd5d8ceaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 11:48:04 -1000 +Subject: kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in + kernfs_find_and_get_node_by_id() + +From: Tejun Heo + +[ Upstream commit 4207b556e62f0a8915afc5da4c5d5ad915a253a5 ] + +The BPF helper bpf_cgroup_from_id() calls kernfs_find_and_get_node_by_id() +which acquires kernfs_idr_lock, which is an non-raw non-IRQ-safe lock. This +can lead to deadlocks as bpf_cgroup_from_id() can be called from any BPF +programs including e.g. the ones that attach to functions which are holding +the scheduler rq lock. + +Consider the following BPF program: + + SEC("fentry/__set_cpus_allowed_ptr_locked") + int BPF_PROG(__set_cpus_allowed_ptr_locked, struct task_struct *p, + struct affinity_context *affn_ctx, struct rq *rq, struct rq_flags *rf) + { + struct cgroup *cgrp = bpf_cgroup_from_id(p->cgroups->dfl_cgrp->kn->id); + + if (cgrp) { + bpf_printk("%d[%s] in %s", p->pid, p->comm, cgrp->kn->name); + bpf_cgroup_release(cgrp); + } + return 0; + } + +__set_cpus_allowed_ptr_locked() is called with rq lock held and the above +BPF program calls bpf_cgroup_from_id() within leading to the following +lockdep warning: + + ===================================================== + WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected + 6.7.0-rc3-work-00053-g07124366a1d7-dirty #147 Not tainted + ----------------------------------------------------- + repro/1620 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: + ffffffff833b3688 (kernfs_idr_lock){+.+.}-{2:2}, at: kernfs_find_and_get_node_by_id+0x1e/0x70 + + and this task is already holding: + ffff888237ced698 (&rq->__lock){-.-.}-{2:2}, at: task_rq_lock+0x4e/0xf0 + which would create a new lock dependency: + (&rq->__lock){-.-.}-{2:2} -> (kernfs_idr_lock){+.+.}-{2:2} + ... + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(kernfs_idr_lock); + local_irq_disable(); + lock(&rq->__lock); + lock(kernfs_idr_lock); + + lock(&rq->__lock); + + *** DEADLOCK *** + ... + Call Trace: + dump_stack_lvl+0x55/0x70 + dump_stack+0x10/0x20 + __lock_acquire+0x781/0x2a40 + lock_acquire+0xbf/0x1f0 + _raw_spin_lock+0x2f/0x40 + kernfs_find_and_get_node_by_id+0x1e/0x70 + cgroup_get_from_id+0x21/0x240 + bpf_cgroup_from_id+0xe/0x20 + bpf_prog_98652316e9337a5a___set_cpus_allowed_ptr_locked+0x96/0x11a + bpf_trampoline_6442545632+0x4f/0x1000 + __set_cpus_allowed_ptr_locked+0x5/0x5a0 + sched_setaffinity+0x1b3/0x290 + __x64_sys_sched_setaffinity+0x4f/0x60 + do_syscall_64+0x40/0xe0 + entry_SYSCALL_64_after_hwframe+0x46/0x4e + +Let's fix it by protecting kernfs_node and kernfs_root with RCU and making +kernfs_find_and_get_node_by_id() acquire rcu_read_lock() instead of +kernfs_idr_lock. + +This adds an rcu_head to kernfs_node making it larger by 16 bytes on 64bit. +Combined with the preceding rearrange patch, the net increase is 8 bytes. + +Signed-off-by: Tejun Heo +Cc: Andrea Righi +Cc: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240109214828.252092-4-tj@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/kernfs/dir.c | 31 ++++++++++++++++++++----------- + fs/kernfs/kernfs-internal.h | 2 ++ + include/linux/kernfs.h | 2 ++ + 3 files changed, 24 insertions(+), 11 deletions(-) + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index bce1d7ac95caa..458519e416fe7 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -529,6 +529,20 @@ void kernfs_get(struct kernfs_node *kn) + } + EXPORT_SYMBOL_GPL(kernfs_get); + ++static void kernfs_free_rcu(struct rcu_head *rcu) ++{ ++ struct kernfs_node *kn = container_of(rcu, struct kernfs_node, rcu); ++ ++ kfree_const(kn->name); ++ ++ if (kn->iattr) { ++ simple_xattrs_free(&kn->iattr->xattrs, NULL); ++ kmem_cache_free(kernfs_iattrs_cache, kn->iattr); ++ } ++ ++ kmem_cache_free(kernfs_node_cache, kn); ++} ++ + /** + * kernfs_put - put a reference count on a kernfs_node + * @kn: the target kernfs_node +@@ -557,16 +571,11 @@ void kernfs_put(struct kernfs_node *kn) + if (kernfs_type(kn) == KERNFS_LINK) + kernfs_put(kn->symlink.target_kn); + +- kfree_const(kn->name); +- +- if (kn->iattr) { +- simple_xattrs_free(&kn->iattr->xattrs, NULL); +- kmem_cache_free(kernfs_iattrs_cache, kn->iattr); +- } + spin_lock(&kernfs_idr_lock); + idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); + spin_unlock(&kernfs_idr_lock); +- kmem_cache_free(kernfs_node_cache, kn); ++ ++ call_rcu(&kn->rcu, kernfs_free_rcu); + + kn = parent; + if (kn) { +@@ -575,7 +584,7 @@ void kernfs_put(struct kernfs_node *kn) + } else { + /* just released the root kn, free @root too */ + idr_destroy(&root->ino_idr); +- kfree(root); ++ kfree_rcu(root, rcu); + } + } + EXPORT_SYMBOL_GPL(kernfs_put); +@@ -715,7 +724,7 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, + ino_t ino = kernfs_id_ino(id); + u32 gen = kernfs_id_gen(id); + +- spin_lock(&kernfs_idr_lock); ++ rcu_read_lock(); + + kn = idr_find(&root->ino_idr, (u32)ino); + if (!kn) +@@ -739,10 +748,10 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, + if (unlikely(!__kernfs_active(kn) || !atomic_inc_not_zero(&kn->count))) + goto err_unlock; + +- spin_unlock(&kernfs_idr_lock); ++ rcu_read_unlock(); + return kn; + err_unlock: +- spin_unlock(&kernfs_idr_lock); ++ rcu_read_unlock(); + return NULL; + } + +diff --git a/fs/kernfs/kernfs-internal.h b/fs/kernfs/kernfs-internal.h +index 237f2764b9412..b42ee6547cdc1 100644 +--- a/fs/kernfs/kernfs-internal.h ++++ b/fs/kernfs/kernfs-internal.h +@@ -49,6 +49,8 @@ struct kernfs_root { + struct rw_semaphore kernfs_rwsem; + struct rw_semaphore kernfs_iattr_rwsem; + struct rw_semaphore kernfs_supers_rwsem; ++ ++ struct rcu_head rcu; + }; + + /* +1 to avoid triggering overflow warning when negating it */ +diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h +index 99aaa050ccb76..e857a150babc6 100644 +--- a/include/linux/kernfs.h ++++ b/include/linux/kernfs.h +@@ -223,6 +223,8 @@ struct kernfs_node { + unsigned short flags; + umode_t mode; + struct kernfs_iattrs *iattr; ++ ++ struct rcu_head rcu; + }; + + /* +-- +2.43.0 + diff --git a/queue-6.8/ktest-force-buildonly-1-for-make_warnings_file-test-.patch b/queue-6.8/ktest-force-buildonly-1-for-make_warnings_file-test-.patch new file mode 100644 index 00000000000..7287e1de579 --- /dev/null +++ b/queue-6.8/ktest-force-buildonly-1-for-make_warnings_file-test-.patch @@ -0,0 +1,41 @@ +From 4937fa89308f32c9883309ce0d0326c90b871eed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 12:28:08 -0300 +Subject: ktest: force $buildonly = 1 for 'make_warnings_file' test type + +From: Ricardo B. Marliere + +[ Upstream commit 07283c1873a4d0eaa0e822536881bfdaea853910 ] + +The test type "make_warnings_file" should have no mandatory configuration +parameters other than the ones required by the "build" test type, because +its purpose is to create a file with build warnings that may or may not be +used by other subsequent tests. Currently, the only way to use it as a +stand-alone test is by setting POWER_CYCLE, CONSOLE, SSH_USER, +BUILD_TARGET, TARGET_IMAGE, REBOOT_TYPE and GRUB_MENU. + +Link: https://lkml.kernel.org/r/20240315-ktest-v2-1-c5c20a75f6a3@marliere.net + +Cc: John Hawley +Signed-off-by: Ricardo B. Marliere +Signed-off-by: Steven Rostedt +Signed-off-by: Sasha Levin +--- + tools/testing/ktest/ktest.pl | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index 829f5bdfd2e43..24451f8f42910 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -843,6 +843,7 @@ sub set_value { + if ($lvalue =~ /^(TEST|BISECT|CONFIG_BISECT)_TYPE(\[.*\])?$/ && + $prvalue !~ /^(config_|)bisect$/ && + $prvalue !~ /^build$/ && ++ $prvalue !~ /^make_warnings_file$/ && + $buildonly) { + + # Note if a test is something other than build, then we +-- +2.43.0 + diff --git a/queue-6.8/libperf-evlist-avoid-out-of-bounds-access.patch b/queue-6.8/libperf-evlist-avoid-out-of-bounds-access.patch new file mode 100644 index 00000000000..265c0f52391 --- /dev/null +++ b/queue-6.8/libperf-evlist-avoid-out-of-bounds-access.patch @@ -0,0 +1,126 @@ +From 50e843a43413c4d728a4103e1310f79e51cfa923 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 23:07:57 -0800 +Subject: libperf evlist: Avoid out-of-bounds access + +From: Ian Rogers + +[ Upstream commit 1947b92464c3268381604bbe2ac977a3fd78192f ] + +Parallel testing appears to show a race between allocating and setting +evsel ids. As there is a bounds check on the xyarray it yields a segv +like: + +``` +AddressSanitizer:DEADLYSIGNAL + +================================================================= + +==484408==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 + +==484408==The signal is caused by a WRITE memory access. + +==484408==Hint: address points to the zero page. + + #0 0x55cef5d4eff4 in perf_evlist__id_hash tools/lib/perf/evlist.c:256 + #1 0x55cef5d4f132 in perf_evlist__id_add tools/lib/perf/evlist.c:274 + #2 0x55cef5d4f545 in perf_evlist__id_add_fd tools/lib/perf/evlist.c:315 + #3 0x55cef5a1923f in store_evsel_ids util/evsel.c:3130 + #4 0x55cef5a19400 in evsel__store_ids util/evsel.c:3147 + #5 0x55cef5888204 in __run_perf_stat tools/perf/builtin-stat.c:832 + #6 0x55cef5888c06 in run_perf_stat tools/perf/builtin-stat.c:960 + #7 0x55cef58932db in cmd_stat tools/perf/builtin-stat.c:2878 +... +``` + +Avoid this crash by early exiting the perf_evlist__id_add_fd and +perf_evlist__id_add is the access is out-of-bounds. + +Signed-off-by: Ian Rogers +Cc: Yang Jihong +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240229070757.796244-1-irogers@google.com +Signed-off-by: Sasha Levin +--- + tools/lib/perf/evlist.c | 18 ++++++++++++------ + tools/lib/perf/include/internal/evlist.h | 4 ++-- + 2 files changed, 14 insertions(+), 8 deletions(-) + +diff --git a/tools/lib/perf/evlist.c b/tools/lib/perf/evlist.c +index 058e3ff10f9b2..c6d67fc9e57ef 100644 +--- a/tools/lib/perf/evlist.c ++++ b/tools/lib/perf/evlist.c +@@ -248,10 +248,10 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist) + + static void perf_evlist__id_hash(struct perf_evlist *evlist, + struct perf_evsel *evsel, +- int cpu, int thread, u64 id) ++ int cpu_map_idx, int thread, u64 id) + { + int hash; +- struct perf_sample_id *sid = SID(evsel, cpu, thread); ++ struct perf_sample_id *sid = SID(evsel, cpu_map_idx, thread); + + sid->id = id; + sid->evsel = evsel; +@@ -269,21 +269,27 @@ void perf_evlist__reset_id_hash(struct perf_evlist *evlist) + + void perf_evlist__id_add(struct perf_evlist *evlist, + struct perf_evsel *evsel, +- int cpu, int thread, u64 id) ++ int cpu_map_idx, int thread, u64 id) + { +- perf_evlist__id_hash(evlist, evsel, cpu, thread, id); ++ if (!SID(evsel, cpu_map_idx, thread)) ++ return; ++ ++ perf_evlist__id_hash(evlist, evsel, cpu_map_idx, thread, id); + evsel->id[evsel->ids++] = id; + } + + int perf_evlist__id_add_fd(struct perf_evlist *evlist, + struct perf_evsel *evsel, +- int cpu, int thread, int fd) ++ int cpu_map_idx, int thread, int fd) + { + u64 read_data[4] = { 0, }; + int id_idx = 1; /* The first entry is the counter value */ + u64 id; + int ret; + ++ if (!SID(evsel, cpu_map_idx, thread)) ++ return -1; ++ + ret = ioctl(fd, PERF_EVENT_IOC_ID, &id); + if (!ret) + goto add; +@@ -312,7 +318,7 @@ int perf_evlist__id_add_fd(struct perf_evlist *evlist, + id = read_data[id_idx]; + + add: +- perf_evlist__id_add(evlist, evsel, cpu, thread, id); ++ perf_evlist__id_add(evlist, evsel, cpu_map_idx, thread, id); + return 0; + } + +diff --git a/tools/lib/perf/include/internal/evlist.h b/tools/lib/perf/include/internal/evlist.h +index d86ffe8ed483e..f43bdb9b6227c 100644 +--- a/tools/lib/perf/include/internal/evlist.h ++++ b/tools/lib/perf/include/internal/evlist.h +@@ -126,11 +126,11 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist); + + void perf_evlist__id_add(struct perf_evlist *evlist, + struct perf_evsel *evsel, +- int cpu, int thread, u64 id); ++ int cpu_map_idx, int thread, u64 id); + + int perf_evlist__id_add_fd(struct perf_evlist *evlist, + struct perf_evsel *evsel, +- int cpu, int thread, int fd); ++ int cpu_map_idx, int thread, int fd); + + void perf_evlist__reset_id_hash(struct perf_evlist *evlist); + +-- +2.43.0 + diff --git a/queue-6.8/media-sta2x11-fix-irq-handler-cast.patch b/queue-6.8/media-sta2x11-fix-irq-handler-cast.patch new file mode 100644 index 00000000000..2e41e486aaa --- /dev/null +++ b/queue-6.8/media-sta2x11-fix-irq-handler-cast.patch @@ -0,0 +1,62 @@ +From 95103483bd988fe61d87b47b1027716f0f303a3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 10:54:47 +0100 +Subject: media: sta2x11: fix irq handler cast + +From: Arnd Bergmann + +[ Upstream commit 3de49ae81c3a0f83a554ecbce4c08e019f30168e ] + +clang-16 warns about casting incompatible function pointers: + +drivers/media/pci/sta2x11/sta2x11_vip.c:1057:6: error: cast from 'irqreturn_t (*)(int, struct sta2x11_vip *)' (aka 'enum irqreturn (*)(int, struct sta2x11_vip *)') to 'irq_handler_t' (aka 'enum irqreturn (*)(int, void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict] + +Change the prototype of the irq handler to the regular version with a +local variable to adjust the argument type. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +[hverkuil: update argument documentation] +Signed-off-by: Sasha Levin +--- + drivers/media/pci/sta2x11/sta2x11_vip.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/pci/sta2x11/sta2x11_vip.c b/drivers/media/pci/sta2x11/sta2x11_vip.c +index e4cf9d63e926d..364ce9e570182 100644 +--- a/drivers/media/pci/sta2x11/sta2x11_vip.c ++++ b/drivers/media/pci/sta2x11/sta2x11_vip.c +@@ -757,7 +757,7 @@ static const struct video_device video_dev_template = { + /** + * vip_irq - interrupt routine + * @irq: Number of interrupt ( not used, correct number is assumed ) +- * @vip: local data structure containing all information ++ * @data: local data structure containing all information + * + * check for both frame interrupts set ( top and bottom ). + * check FIFO overflow, but limit number of log messages after open. +@@ -767,8 +767,9 @@ static const struct video_device video_dev_template = { + * + * IRQ_HANDLED, interrupt done. + */ +-static irqreturn_t vip_irq(int irq, struct sta2x11_vip *vip) ++static irqreturn_t vip_irq(int irq, void *data) + { ++ struct sta2x11_vip *vip = data; + unsigned int status; + + status = reg_read(vip, DVP_ITS); +@@ -1053,9 +1054,7 @@ static int sta2x11_vip_init_one(struct pci_dev *pdev, + + spin_lock_init(&vip->slock); + +- ret = request_irq(pdev->irq, +- (irq_handler_t) vip_irq, +- IRQF_SHARED, KBUILD_MODNAME, vip); ++ ret = request_irq(pdev->irq, vip_irq, IRQF_SHARED, KBUILD_MODNAME, vip); + if (ret) { + dev_err(&pdev->dev, "request_irq failed\n"); + ret = -ENODEV; +-- +2.43.0 + diff --git a/queue-6.8/modpost-fix-null-pointer-dereference.patch b/queue-6.8/modpost-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..bb4cebca9d5 --- /dev/null +++ b/queue-6.8/modpost-fix-null-pointer-dereference.patch @@ -0,0 +1,46 @@ +From da560e97a94a217794269bf19731d6a2c9340d5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 15:13:21 +0100 +Subject: modpost: fix null pointer dereference + +From: Max Kellermann + +[ Upstream commit 23dfd914d2bfc4c9938b0084dffd7105de231d98 ] + +If the find_fromsym() call fails and returns NULL, the warn() call +will dereference this NULL pointer and cause the program to crash. + +This happened when I tried to build with "test_user_copy" module. +With this fix, it prints lots of warnings like this: + + WARNING: modpost: lib/test_user_copy: section mismatch in reference: (unknown)+0x4 (section: .text.fixup) -> (unknown) (section: .init.text) + +masahiroy@kernel.org: + The issue is reproduced with ARCH=arm allnoconfig + CONFIG_MODULES=y + + CONFIG_RUNTIME_TESTING_MENU=y + CONFIG_TEST_USER_COPY=m + +Signed-off-by: Max Kellermann +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 6568f8177e392..ce686ebf5591f 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1053,7 +1053,9 @@ static void default_mismatch_handler(const char *modname, struct elf_info *elf, + sec_mismatch_count++; + + warn("%s: section mismatch in reference: %s+0x%x (section: %s) -> %s (section: %s)\n", +- modname, fromsym, (unsigned int)(faddr - from->st_value), fromsec, tosym, tosec); ++ modname, fromsym, ++ (unsigned int)(faddr - (from ? from->st_value : 0)), ++ fromsec, tosym, tosec); + + if (mismatch->mismatch == EXTABLE_TO_NON_TEXT) { + if (match(tosec, mismatch->bad_tosec)) +-- +2.43.0 + diff --git a/queue-6.8/net-add-netdev_lockdep_set_classes-to-virtual-driver.patch b/queue-6.8/net-add-netdev_lockdep_set_classes-to-virtual-driver.patch new file mode 100644 index 00000000000..fef726fa039 --- /dev/null +++ b/queue-6.8/net-add-netdev_lockdep_set_classes-to-virtual-driver.patch @@ -0,0 +1,307 @@ +From e3d811acf749c682903c0c9f4db45dffc964b1c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 14:07:00 +0000 +Subject: net: add netdev_lockdep_set_classes() to virtual drivers + +From: Eric Dumazet + +[ Upstream commit 0bef512012b1cd8820f0c9ec80e5f8ceb43fdd59 ] + +Based on a syzbot report, it appears many virtual +drivers do not yet use netdev_lockdep_set_classes(), +triggerring lockdep false positives. + +WARNING: possible recursive locking detected +6.8.0-rc4-next-20240212-syzkaller #0 Not tainted + +syz-executor.0/19016 is trying to acquire lock: + ffff8880162cb298 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] + ffff8880162cb298 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4452 [inline] + ffff8880162cb298 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x1c4/0x5f0 net/sched/sch_generic.c:340 + +but task is already holding lock: + ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] + ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4452 [inline] + ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x1c4/0x5f0 net/sched/sch_generic.c:340 + +other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + lock(_xmit_ETHER#2); + lock(_xmit_ETHER#2); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + +9 locks held by syz-executor.0/19016: + #0: ffffffff8f385208 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] + #0: ffffffff8f385208 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x82c/0x1040 net/core/rtnetlink.c:6603 + #1: ffffc90000a08c00 ((&in_dev->mr_ifc_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x600 kernel/time/timer.c:1697 + #2: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] + #2: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] + #2: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x45f/0x1360 net/ipv4/ip_output.c:228 + #3: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] + #3: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline] + #3: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4284 + #4: ffff8880416e3258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline] + #4: ffff8880416e3258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline] + #4: ffff8880416e3258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3771 [inline] + #4: ffff8880416e3258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x1262/0x3b10 net/core/dev.c:4325 + #5: ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] + #5: ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: __netif_tx_lock include/linux/netdevice.h:4452 [inline] + #5: ffff8880223db4d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x1c4/0x5f0 net/sched/sch_generic.c:340 + #6: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] + #6: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] + #6: ffffffff8e131520 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x45f/0x1360 net/ipv4/ip_output.c:228 + #7: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] + #7: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:802 [inline] + #7: ffffffff8e131580 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x2c4/0x3b10 net/core/dev.c:4284 + #8: ffff888014d9d258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: spin_trylock include/linux/spinlock.h:361 [inline] + #8: ffff888014d9d258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: qdisc_run_begin include/net/sch_generic.h:195 [inline] + #8: ffff888014d9d258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_xmit_skb net/core/dev.c:3771 [inline] + #8: ffff888014d9d258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x1262/0x3b10 net/core/dev.c:4325 + +stack backtrace: +CPU: 1 PID: 19016 Comm: syz-executor.0 Not tainted 6.8.0-rc4-next-20240212-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 + check_deadlock kernel/locking/lockdep.c:3062 [inline] + validate_chain+0x15c1/0x58e0 kernel/locking/lockdep.c:3856 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754 + __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] + _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 + spin_lock include/linux/spinlock.h:351 [inline] + __netif_tx_lock include/linux/netdevice.h:4452 [inline] + sch_direct_xmit+0x1c4/0x5f0 net/sched/sch_generic.c:340 + __dev_xmit_skb net/core/dev.c:3784 [inline] + __dev_queue_xmit+0x1912/0x3b10 net/core/dev.c:4325 + neigh_output include/net/neighbour.h:542 [inline] + ip_finish_output2+0xe66/0x1360 net/ipv4/ip_output.c:235 + iptunnel_xmit+0x540/0x9b0 net/ipv4/ip_tunnel_core.c:82 + ip_tunnel_xmit+0x20ee/0x2960 net/ipv4/ip_tunnel.c:831 + erspan_xmit+0x9de/0x1460 net/ipv4/ip_gre.c:720 + __netdev_start_xmit include/linux/netdevice.h:4989 [inline] + netdev_start_xmit include/linux/netdevice.h:5003 [inline] + xmit_one net/core/dev.c:3555 [inline] + dev_hard_start_xmit+0x242/0x770 net/core/dev.c:3571 + sch_direct_xmit+0x2b6/0x5f0 net/sched/sch_generic.c:342 + __dev_xmit_skb net/core/dev.c:3784 [inline] + __dev_queue_xmit+0x1912/0x3b10 net/core/dev.c:4325 + neigh_output include/net/neighbour.h:542 [inline] + ip_finish_output2+0xe66/0x1360 net/ipv4/ip_output.c:235 + igmpv3_send_cr net/ipv4/igmp.c:723 [inline] + igmp_ifc_timer_expire+0xb71/0xd90 net/ipv4/igmp.c:813 + call_timer_fn+0x17e/0x600 kernel/time/timer.c:1700 + expire_timers kernel/time/timer.c:1751 [inline] + __run_timers+0x621/0x830 kernel/time/timer.c:2038 + run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2051 + __do_softirq+0x2bc/0x943 kernel/softirq.c:554 + invoke_softirq kernel/softirq.c:428 [inline] + __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633 + irq_exit_rcu+0x9/0x30 kernel/softirq.c:645 + instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1076 [inline] + sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1076 + + + asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 + RIP: 0010:resched_offsets_ok kernel/sched/core.c:10127 [inline] + RIP: 0010:__might_resched+0x16f/0x780 kernel/sched/core.c:10142 +Code: 00 4c 89 e8 48 c1 e8 03 48 ba 00 00 00 00 00 fc ff df 48 89 44 24 38 0f b6 04 10 84 c0 0f 85 87 04 00 00 41 8b 45 00 c1 e0 08 <01> d8 44 39 e0 0f 85 d6 00 00 00 44 89 64 24 1c 48 8d bc 24 a0 00 +RSP: 0018:ffffc9000ee069e0 EFLAGS: 00000246 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880296a9e00 +RDX: dffffc0000000000 RSI: ffff8880296a9e00 RDI: ffffffff8bfe8fa0 +RBP: ffffc9000ee06b00 R08: ffffffff82326877 R09: 1ffff11002b5ad1b +R10: dffffc0000000000 R11: ffffed1002b5ad1c R12: 0000000000000000 +R13: ffff8880296aa23c R14: 000000000000062a R15: 1ffff92001dc0d44 + down_write+0x19/0x50 kernel/locking/rwsem.c:1578 + kernfs_activate fs/kernfs/dir.c:1403 [inline] + kernfs_add_one+0x4af/0x8b0 fs/kernfs/dir.c:819 + __kernfs_create_file+0x22e/0x2e0 fs/kernfs/file.c:1056 + sysfs_add_file_mode_ns+0x24a/0x310 fs/sysfs/file.c:307 + create_files fs/sysfs/group.c:64 [inline] + internal_create_group+0x4f4/0xf20 fs/sysfs/group.c:152 + internal_create_groups fs/sysfs/group.c:192 [inline] + sysfs_create_groups+0x56/0x120 fs/sysfs/group.c:218 + create_dir lib/kobject.c:78 [inline] + kobject_add_internal+0x472/0x8d0 lib/kobject.c:240 + kobject_add_varg lib/kobject.c:374 [inline] + kobject_init_and_add+0x124/0x190 lib/kobject.c:457 + netdev_queue_add_kobject net/core/net-sysfs.c:1706 [inline] + netdev_queue_update_kobjects+0x1f3/0x480 net/core/net-sysfs.c:1758 + register_queue_kobjects net/core/net-sysfs.c:1819 [inline] + netdev_register_kobject+0x265/0x310 net/core/net-sysfs.c:2059 + register_netdevice+0x1191/0x19c0 net/core/dev.c:10298 + bond_newlink+0x3b/0x90 drivers/net/bonding/bond_netlink.c:576 + rtnl_newlink_create net/core/rtnetlink.c:3506 [inline] + __rtnl_newlink net/core/rtnetlink.c:3726 [inline] + rtnl_newlink+0x158f/0x20a0 net/core/rtnetlink.c:3739 + rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6606 + netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 + netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] + netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 + netlink_sendmsg+0xa3c/0xd70 net/netlink/af_netlink.c:1908 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x221/0x270 net/socket.c:745 + __sys_sendto+0x3a4/0x4f0 net/socket.c:2191 + __do_sys_sendto net/socket.c:2203 [inline] + __se_sys_sendto net/socket.c:2199 [inline] + __x64_sys_sendto+0xde/0x100 net/socket.c:2199 + do_syscall_64+0xfb/0x240 + entry_SYSCALL_64_after_hwframe+0x6d/0x75 +RIP: 0033:0x7fc3fa87fa9c + +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240212140700.2795436-4-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dummy.c | 1 + + drivers/net/geneve.c | 1 + + drivers/net/loopback.c | 1 + + drivers/net/veth.c | 1 + + drivers/net/vxlan/vxlan_core.c | 1 + + net/ipv4/ip_tunnel.c | 1 + + net/ipv6/ip6_gre.c | 2 ++ + net/ipv6/ip6_tunnel.c | 1 + + net/ipv6/ip6_vti.c | 1 + + net/ipv6/sit.c | 1 + + 10 files changed, 11 insertions(+) + +diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c +index 768454aa36d6c..946bba0701a4f 100644 +--- a/drivers/net/dummy.c ++++ b/drivers/net/dummy.c +@@ -71,6 +71,7 @@ static int dummy_dev_init(struct net_device *dev) + if (!dev->lstats) + return -ENOMEM; + ++ netdev_lockdep_set_classes(dev); + return 0; + } + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index c4ed36c718974..097a8db0d1d99 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -349,6 +349,7 @@ static int geneve_init(struct net_device *dev) + gro_cells_destroy(&geneve->gro_cells); + return err; + } ++ netdev_lockdep_set_classes(dev); + return 0; + } + +diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c +index f6d53e63ef4ec..f6eab66c26608 100644 +--- a/drivers/net/loopback.c ++++ b/drivers/net/loopback.c +@@ -144,6 +144,7 @@ static int loopback_dev_init(struct net_device *dev) + dev->lstats = netdev_alloc_pcpu_stats(struct pcpu_lstats); + if (!dev->lstats) + return -ENOMEM; ++ netdev_lockdep_set_classes(dev); + return 0; + } + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index f0b2c4d5fe43a..5146aa6989acc 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -1483,6 +1483,7 @@ static void veth_free_queues(struct net_device *dev) + + static int veth_dev_init(struct net_device *dev) + { ++ netdev_lockdep_set_classes(dev); + return veth_alloc_queues(dev); + } + +diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c +index 16106e088c630..0bedb804824ba 100644 +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2855,6 +2855,7 @@ static int vxlan_init(struct net_device *dev) + if (err) + goto err_gro_cells_destroy; + ++ netdev_lockdep_set_classes(dev); + return 0; + + err_gro_cells_destroy: +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 7af36e4f1647d..55039191b8d2b 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -1298,6 +1298,7 @@ int ip_tunnel_init(struct net_device *dev) + + if (tunnel->collect_md) + netif_keep_dst(dev); ++ netdev_lockdep_set_classes(dev); + return 0; + } + EXPORT_SYMBOL_GPL(ip_tunnel_init); +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 26c3287beb29c..289b83347d9d5 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1514,6 +1514,7 @@ static int ip6gre_tunnel_init_common(struct net_device *dev) + ip6gre_tnl_init_features(dev); + + netdev_hold(dev, &tunnel->dev_tracker, GFP_KERNEL); ++ netdev_lockdep_set_classes(dev); + return 0; + + cleanup_dst_cache_init: +@@ -1906,6 +1907,7 @@ static int ip6erspan_tap_init(struct net_device *dev) + ip6erspan_tnl_link_config(tunnel, 1); + + netdev_hold(dev, &tunnel->dev_tracker, GFP_KERNEL); ++ netdev_lockdep_set_classes(dev); + return 0; + + cleanup_dst_cache_init: +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 9bbabf750a21e..70478027a7af7 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1898,6 +1898,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev) + dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len; + + netdev_hold(dev, &t->dev_tracker, GFP_KERNEL); ++ netdev_lockdep_set_classes(dev); + return 0; + + destroy_dst: +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index e550240c85e1c..1163ca6ea4af1 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -935,6 +935,7 @@ static inline int vti6_dev_init_gen(struct net_device *dev) + if (!dev->tstats) + return -ENOMEM; + netdev_hold(dev, &t->dev_tracker, GFP_KERNEL); ++ netdev_lockdep_set_classes(dev); + return 0; + } + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 5e9f625b76e36..fbad6e1c970e4 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1460,6 +1460,7 @@ static int ipip6_tunnel_init(struct net_device *dev) + return err; + } + netdev_hold(dev, &tunnel->dev_tracker, GFP_KERNEL); ++ netdev_lockdep_set_classes(dev); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.8/net-dsa-qca8k-put-mdio-controller-of-node-if-unavail.patch b/queue-6.8/net-dsa-qca8k-put-mdio-controller-of-node-if-unavail.patch new file mode 100644 index 00000000000..0d2f2f1aae1 --- /dev/null +++ b/queue-6.8/net-dsa-qca8k-put-mdio-controller-of-node-if-unavail.patch @@ -0,0 +1,54 @@ +From 430fce46ea5d4757a243456a6e2c34d17803089d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 18:36:25 +0200 +Subject: net: dsa: qca8k: put MDIO controller OF node if unavailable + +From: Vladimir Oltean + +[ Upstream commit 08932323ccf7f8c4c85db9cb12a791ed81264f66 ] + +It was pointed out during the review [1] of commit e66bf63a7f67 ("net: +dsa: qca8k: skip MDIO bus creation if its OF node has status = +"disabled"") that we now leak a reference to the "mdio" OF node if it is +disabled. + +This is only a concern when using dynamic OF as far as I can tell (like +probing on an overlay), since OF nodes are never freed in the regular +case. Additionally, I'm unaware of any actual device trees (in +production or elsewhere) which have status = "disabled" for the MDIO OF +node. So handling this as a simple enhancement. + +[1] https://lore.kernel.org/netdev/CAJq09z4--Ug+3FAmp=EimQ8HTQYOWOuVon-PUMGB5a1N=RPv4g@mail.gmail.com/ + +Suggested-by: Luiz Angelo Daros de Luca +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca/qca8k-8xxx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c +index 7a864329cb726..95d78b3181d1c 100644 +--- a/drivers/net/dsa/qca/qca8k-8xxx.c ++++ b/drivers/net/dsa/qca/qca8k-8xxx.c +@@ -954,7 +954,7 @@ qca8k_mdio_register(struct qca8k_priv *priv) + + mdio = of_get_child_by_name(dev->of_node, "mdio"); + if (mdio && !of_device_is_available(mdio)) +- goto out; ++ goto out_put_node; + + bus = devm_mdiobus_alloc(dev); + if (!bus) { +@@ -988,7 +988,6 @@ qca8k_mdio_register(struct qca8k_priv *priv) + + out_put_node: + of_node_put(mdio); +-out: + return err; + } + +-- +2.43.0 + diff --git a/queue-6.8/net-pcs-xpcs-return-einval-in-the-internal-methods.patch b/queue-6.8/net-pcs-xpcs-return-einval-in-the-internal-methods.patch new file mode 100644 index 00000000000..99752ff7bfb --- /dev/null +++ b/queue-6.8/net-pcs-xpcs-return-einval-in-the-internal-methods.patch @@ -0,0 +1,51 @@ +From b17e271ab7deee2a7db1e34dd3eea075e5713562 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 20:58:22 +0300 +Subject: net: pcs: xpcs: Return EINVAL in the internal methods + +From: Serge Semin + +[ Upstream commit f5151005d379d9ce42e327fd3b2d2aaef61cda81 ] + +In particular the xpcs_soft_reset() and xpcs_do_config() functions +currently return -1 if invalid auto-negotiation mode is specified. That +value might be then passed to the generic kernel subsystems which require +a standard kernel errno value. Even though the erroneous conditions are +very specific (memory corruption or buggy driver implementation) using a +hard-coded -1 literal doesn't seem correct anyway especially when it comes +to passing it higher to the network subsystem or printing to the system +log. Convert the hard-coded error values to -EINVAL then. + +Signed-off-by: Serge Semin +Tested-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/pcs/pcs-xpcs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c +index 31f0beba638a2..03d6a6aef77cd 100644 +--- a/drivers/net/pcs/pcs-xpcs.c ++++ b/drivers/net/pcs/pcs-xpcs.c +@@ -293,7 +293,7 @@ static int xpcs_soft_reset(struct dw_xpcs *xpcs, + dev = MDIO_MMD_VEND2; + break; + default: +- return -1; ++ return -EINVAL; + } + + ret = xpcs_write(xpcs, dev, MDIO_CTRL1, MDIO_CTRL1_RESET); +@@ -891,7 +891,7 @@ int xpcs_do_config(struct dw_xpcs *xpcs, phy_interface_t interface, + return ret; + break; + default: +- return -1; ++ return -EINVAL; + } + + if (compat->pma_config) { +-- +2.43.0 + diff --git a/queue-6.8/net-phy-phy_device-prevent-nullptr-exceptions-on-isr.patch b/queue-6.8/net-phy-phy_device-prevent-nullptr-exceptions-on-isr.patch new file mode 100644 index 00000000000..dd7e6f36f38 --- /dev/null +++ b/queue-6.8/net-phy-phy_device-prevent-nullptr-exceptions-on-isr.patch @@ -0,0 +1,63 @@ +From 93fde8419b76df790ced8810c70ca9a5ac025497 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 14:55:04 +0100 +Subject: net: phy: phy_device: Prevent nullptr exceptions on ISR + +From: Andre Werner + +[ Upstream commit 61c81872815f46006982bb80460c0c80a949b35b ] + +If phydev->irq is set unconditionally, check +for valid interrupt handler or fall back to polling mode to prevent +nullptr exceptions in interrupt service routine. + +Signed-off-by: Andre Werner +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20240129135734.18975-2-andre.werner@systec-electronic.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_device.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 6125418ca93f3..8efa2a136faa9 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -1413,6 +1413,11 @@ int phy_sfp_probe(struct phy_device *phydev, + } + EXPORT_SYMBOL(phy_sfp_probe); + ++static bool phy_drv_supports_irq(struct phy_driver *phydrv) ++{ ++ return phydrv->config_intr && phydrv->handle_interrupt; ++} ++ + /** + * phy_attach_direct - attach a network device to a given PHY device pointer + * @dev: network device to attach +@@ -1527,6 +1532,9 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, + if (phydev->dev_flags & PHY_F_NO_IRQ) + phydev->irq = PHY_POLL; + ++ if (!phy_drv_supports_irq(phydev->drv) && phy_interrupt_is_valid(phydev)) ++ phydev->irq = PHY_POLL; ++ + /* Port is set to PORT_TP by default and the actual PHY driver will set + * it to different value depending on the PHY configuration. If we have + * the generic PHY driver we can't figure it out, thus set the old +@@ -2992,11 +3000,6 @@ s32 phy_get_internal_delay(struct phy_device *phydev, struct device *dev, + } + EXPORT_SYMBOL(phy_get_internal_delay); + +-static bool phy_drv_supports_irq(struct phy_driver *phydrv) +-{ +- return phydrv->config_intr && phydrv->handle_interrupt; +-} +- + static int phy_led_set_brightness(struct led_classdev *led_cdev, + enum led_brightness value) + { +-- +2.43.0 + diff --git a/queue-6.8/net-skbuff-add-overflow-debug-check-to-pull-push-hel.patch b/queue-6.8/net-skbuff-add-overflow-debug-check-to-pull-push-hel.patch new file mode 100644 index 00000000000..c212cd2eb8d --- /dev/null +++ b/queue-6.8/net-skbuff-add-overflow-debug-check-to-pull-push-hel.patch @@ -0,0 +1,87 @@ +From ef13a9f8d56090e3bdee96e50e97e871fb26f6b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 12:36:57 +0100 +Subject: net: skbuff: add overflow debug check to pull/push helpers + +From: Florian Westphal + +[ Upstream commit 219eee9c0d16f1b754a8b85275854ab17df0850a ] + +syzbot managed to trigger following splat: +BUG: KASAN: use-after-free in __skb_flow_dissect+0x4a3b/0x5e50 +Read of size 1 at addr ffff888208a4000e by task a.out/2313 +[..] + __skb_flow_dissect+0x4a3b/0x5e50 + __skb_get_hash+0xb4/0x400 + ip_tunnel_xmit+0x77e/0x26f0 + ipip_tunnel_xmit+0x298/0x410 + .. + +Analysis shows that the skb has a valid ->head, but bogus ->data +pointer. + +skb->data gets its bogus value via the neigh layer, which does: + +1556 __skb_pull(skb, skb_network_offset(skb)); + +... and the skb was already dodgy at this point: + +skb_network_offset(skb) returns a negative value due to an +earlier overflow of skb->network_header (u16). __skb_pull thus +"adjusts" skb->data by a huge offset, pointing outside skb->head +area. + +Allow debug builds to splat when we try to pull/push more than +INT_MAX bytes. + +After this, the syzkaller reproducer yields a more precise splat +before the flow dissector attempts to read off skb->data memory: + +WARNING: CPU: 5 PID: 2313 at include/linux/skbuff.h:2653 neigh_connected_output+0x28e/0x400 + ip_finish_output2+0xb25/0xed0 + iptunnel_xmit+0x4ff/0x870 + ipgre_xmit+0x78e/0xbb0 + +Signed-off-by: Florian Westphal +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240216113700.23013-1-fw@strlen.de +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + include/linux/skbuff.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 227f4514476b1..741115aeca2f1 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2637,6 +2637,8 @@ static inline void skb_put_u8(struct sk_buff *skb, u8 val) + void *skb_push(struct sk_buff *skb, unsigned int len); + static inline void *__skb_push(struct sk_buff *skb, unsigned int len) + { ++ DEBUG_NET_WARN_ON_ONCE(len > INT_MAX); ++ + skb->data -= len; + skb->len += len; + return skb->data; +@@ -2645,6 +2647,8 @@ static inline void *__skb_push(struct sk_buff *skb, unsigned int len) + void *skb_pull(struct sk_buff *skb, unsigned int len); + static inline void *__skb_pull(struct sk_buff *skb, unsigned int len) + { ++ DEBUG_NET_WARN_ON_ONCE(len > INT_MAX); ++ + skb->len -= len; + if (unlikely(skb->len < skb->data_len)) { + #if defined(CONFIG_DEBUG_NET) +@@ -2669,6 +2673,8 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta); + static inline enum skb_drop_reason + pskb_may_pull_reason(struct sk_buff *skb, unsigned int len) + { ++ DEBUG_NET_WARN_ON_ONCE(len > INT_MAX); ++ + if (likely(len <= skb_headlen(skb))) + return SKB_NOT_DROPPED_YET; + +-- +2.43.0 + diff --git a/queue-6.8/net-smc-reduce-rtnl-pressure-in-smc_pnet_create_pnet.patch b/queue-6.8/net-smc-reduce-rtnl-pressure-in-smc_pnet_create_pnet.patch new file mode 100644 index 00000000000..b332611ffee --- /dev/null +++ b/queue-6.8/net-smc-reduce-rtnl-pressure-in-smc_pnet_create_pnet.patch @@ -0,0 +1,96 @@ +From 3c2681396652decff4615b9f455b9f40f19da675 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Mar 2024 10:07:44 +0000 +Subject: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() + +From: Eric Dumazet + +[ Upstream commit 00af2aa93b76b1bade471ad0d0525d4d29ca5cc0 ] + +Many syzbot reports show extreme rtnl pressure, and many of them hint +that smc acquires rtnl in netns creation for no good reason [1] + +This patch returns early from smc_pnet_net_init() +if there is no netdevice yet. + +I am not even sure why smc_pnet_create_pnetids_list() even exists, +because smc_pnet_netdev_event() is also calling +smc_pnet_add_base_pnetid() when handling NETDEV_UP event. + +[1] extract of typical syzbot reports + +2 locks held by syz-executor.3/12252: + #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 +2 locks held by syz-executor.4/12253: + #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 +2 locks held by syz-executor.1/12257: + #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 +2 locks held by syz-executor.2/12261: + #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 +2 locks held by syz-executor.0/12265: + #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 +2 locks held by syz-executor.3/12268: + #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 +2 locks held by syz-executor.4/12271: + #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 +2 locks held by syz-executor.1/12274: + #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 +2 locks held by syz-executor.2/12280: + #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] + #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 + +Signed-off-by: Eric Dumazet +Cc: Wenjia Zhang +Cc: Jan Karcher +Cc: "D. Wythe" +Cc: Tony Lu +Cc: Wen Gu +Reviewed-by: Wenjia Zhang +Link: https://lore.kernel.org/r/20240302100744.3868021-1-edumazet@google.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/smc/smc_pnet.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c +index 9f2c58c5a86b7..2adb92b8c4699 100644 +--- a/net/smc/smc_pnet.c ++++ b/net/smc/smc_pnet.c +@@ -806,6 +806,16 @@ static void smc_pnet_create_pnetids_list(struct net *net) + u8 ndev_pnetid[SMC_MAX_PNETID_LEN]; + struct net_device *dev; + ++ /* Newly created netns do not have devices. ++ * Do not even acquire rtnl. ++ */ ++ if (list_empty(&net->dev_base_head)) ++ return; ++ ++ /* Note: This might not be needed, because smc_pnet_netdev_event() ++ * is also calling smc_pnet_add_base_pnetid() when handling ++ * NETDEV_UP event. ++ */ + rtnl_lock(); + for_each_netdev(net, dev) + smc_pnet_add_base_pnetid(net, dev, ndev_pnetid); +-- +2.43.0 + diff --git a/queue-6.8/net-stmmac-dwmac-starfive-add-support-for-jh7100-soc.patch b/queue-6.8/net-stmmac-dwmac-starfive-add-support-for-jh7100-soc.patch new file mode 100644 index 00000000000..1788c0a30c5 --- /dev/null +++ b/queue-6.8/net-stmmac-dwmac-starfive-add-support-for-jh7100-soc.patch @@ -0,0 +1,122 @@ +From d30a85a4d0a89278a10bf2417beace44bc3ee709 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 21:21:26 +0200 +Subject: net: stmmac: dwmac-starfive: Add support for JH7100 SoC + +From: Cristian Ciocaltea + +[ Upstream commit 8d4597b871210429bda0f5c3a8816b7d9b6daf7e ] + +Add a missing quirk to enable support for the StarFive JH7100 SoC. + +Additionally, for greater flexibility in operation, allow using the +rgmii-rxid and rgmii-txid phy modes. + +Co-developed-by: Emil Renner Berthing +Signed-off-by: Emil Renner Berthing +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Jacob Keller +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/Kconfig | 6 ++-- + .../ethernet/stmicro/stmmac/dwmac-starfive.c | 32 ++++++++++++++++--- + 2 files changed, 31 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig +index 85dcda51df052..4ec61f1ee71a2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig ++++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig +@@ -165,9 +165,9 @@ config DWMAC_STARFIVE + help + Support for ethernet controllers on StarFive RISC-V SoCs + +- This selects the StarFive platform specific glue layer support for +- the stmmac device driver. This driver is used for StarFive JH7110 +- ethernet controller. ++ This selects the StarFive platform specific glue layer support ++ for the stmmac device driver. This driver is used for the ++ StarFive JH7100 and JH7110 ethernet controllers. + + config DWMAC_STI + tristate "STi GMAC support" +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c +index 5d630affb4d15..4e1076faee0cd 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-starfive.c +@@ -15,13 +15,20 @@ + + #include "stmmac_platform.h" + +-#define STARFIVE_DWMAC_PHY_INFT_RGMII 0x1 +-#define STARFIVE_DWMAC_PHY_INFT_RMII 0x4 +-#define STARFIVE_DWMAC_PHY_INFT_FIELD 0x7U ++#define STARFIVE_DWMAC_PHY_INFT_RGMII 0x1 ++#define STARFIVE_DWMAC_PHY_INFT_RMII 0x4 ++#define STARFIVE_DWMAC_PHY_INFT_FIELD 0x7U ++ ++#define JH7100_SYSMAIN_REGISTER49_DLYCHAIN 0xc8 ++ ++struct starfive_dwmac_data { ++ unsigned int gtxclk_dlychain; ++}; + + struct starfive_dwmac { + struct device *dev; + struct clk *clk_tx; ++ const struct starfive_dwmac_data *data; + }; + + static void starfive_dwmac_fix_mac_speed(void *priv, unsigned int speed, unsigned int mode) +@@ -67,6 +74,8 @@ static int starfive_dwmac_set_mode(struct plat_stmmacenet_data *plat_dat) + + case PHY_INTERFACE_MODE_RGMII: + case PHY_INTERFACE_MODE_RGMII_ID: ++ case PHY_INTERFACE_MODE_RGMII_RXID: ++ case PHY_INTERFACE_MODE_RGMII_TXID: + mode = STARFIVE_DWMAC_PHY_INFT_RGMII; + break; + +@@ -89,6 +98,14 @@ static int starfive_dwmac_set_mode(struct plat_stmmacenet_data *plat_dat) + if (err) + return dev_err_probe(dwmac->dev, err, "error setting phy mode\n"); + ++ if (dwmac->data) { ++ err = regmap_write(regmap, JH7100_SYSMAIN_REGISTER49_DLYCHAIN, ++ dwmac->data->gtxclk_dlychain); ++ if (err) ++ return dev_err_probe(dwmac->dev, err, ++ "error selecting gtxclk delay chain\n"); ++ } ++ + return 0; + } + +@@ -114,6 +131,8 @@ static int starfive_dwmac_probe(struct platform_device *pdev) + if (!dwmac) + return -ENOMEM; + ++ dwmac->data = device_get_match_data(&pdev->dev); ++ + dwmac->clk_tx = devm_clk_get_enabled(&pdev->dev, "tx"); + if (IS_ERR(dwmac->clk_tx)) + return dev_err_probe(&pdev->dev, PTR_ERR(dwmac->clk_tx), +@@ -144,8 +163,13 @@ static int starfive_dwmac_probe(struct platform_device *pdev) + return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); + } + ++static const struct starfive_dwmac_data jh7100_data = { ++ .gtxclk_dlychain = 4, ++}; ++ + static const struct of_device_id starfive_dwmac_match[] = { +- { .compatible = "starfive,jh7110-dwmac" }, ++ { .compatible = "starfive,jh7100-dwmac", .data = &jh7100_data }, ++ { .compatible = "starfive,jh7110-dwmac" }, + { /* sentinel */ } + }; + MODULE_DEVICE_TABLE(of, starfive_dwmac_match); +-- +2.43.0 + diff --git a/queue-6.8/netdev-let-netlink-core-handle-emsgsize-errors.patch b/queue-6.8/netdev-let-netlink-core-handle-emsgsize-errors.patch new file mode 100644 index 00000000000..c905fb6b441 --- /dev/null +++ b/queue-6.8/netdev-let-netlink-core-handle-emsgsize-errors.patch @@ -0,0 +1,87 @@ +From f776e28a960ff183e2d35cf461c32a33bcbeb0c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Mar 2024 21:24:07 -0800 +Subject: netdev: let netlink core handle -EMSGSIZE errors + +From: Jakub Kicinski + +[ Upstream commit 0b11b1c5c320555483e8a94c44549db24c289987 ] + +Previous change added -EMSGSIZE handling to af_netlink, we don't +have to hide these errors any longer. + +Theoretically the error handling changes from: + if (err == -EMSGSIZE) +to + if (err == -EMSGSIZE && skb->len) + +everywhere, but in practice it doesn't matter. +All messages fit into NLMSG_GOODSIZE, so overflow of an empty +skb cannot happen. + +Reviewed-by: Eric Dumazet +Signed-off-by: Jakub Kicinski +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/netdev-genl.c | 15 +++------------ + net/core/page_pool_user.c | 2 -- + 2 files changed, 3 insertions(+), 14 deletions(-) + +diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c +index fd98936da3aec..918b109e0cf40 100644 +--- a/net/core/netdev-genl.c ++++ b/net/core/netdev-genl.c +@@ -152,10 +152,7 @@ int netdev_nl_dev_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb) + } + rtnl_unlock(); + +- if (err != -EMSGSIZE) +- return err; +- +- return skb->len; ++ return err; + } + + static int +@@ -287,10 +284,7 @@ int netdev_nl_napi_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb) + } + rtnl_unlock(); + +- if (err != -EMSGSIZE) +- return err; +- +- return skb->len; ++ return err; + } + + static int +@@ -463,10 +457,7 @@ int netdev_nl_queue_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb) + } + rtnl_unlock(); + +- if (err != -EMSGSIZE) +- return err; +- +- return skb->len; ++ return err; + } + + static int netdev_genl_netdevice_event(struct notifier_block *nb, +diff --git a/net/core/page_pool_user.c b/net/core/page_pool_user.c +index 278294aca66ab..3a3277ba167b1 100644 +--- a/net/core/page_pool_user.c ++++ b/net/core/page_pool_user.c +@@ -103,8 +103,6 @@ netdev_nl_page_pool_get_dump(struct sk_buff *skb, struct netlink_callback *cb, + mutex_unlock(&page_pools_lock); + rtnl_unlock(); + +- if (skb->len && err == -EMSGSIZE) +- return skb->len; + return err; + } + +-- +2.43.0 + diff --git a/queue-6.8/overflow-allow-non-type-arg-to-type_max-and-type_min.patch b/queue-6.8/overflow-allow-non-type-arg-to-type_max-and-type_min.patch new file mode 100644 index 00000000000..566792c9a3a --- /dev/null +++ b/queue-6.8/overflow-allow-non-type-arg-to-type_max-and-type_min.patch @@ -0,0 +1,61 @@ +From cb8cb1b2a51bb26b9106c8b077f83feeb12f8cdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 22:22:26 -0800 +Subject: overflow: Allow non-type arg to type_max() and type_min() + +From: Kees Cook + +[ Upstream commit bd1ebf2467f9c5d157bec7b025e83f8ffdae1318 ] + +A common use of type_max() is to find the max for the type of a +variable. Using the pattern type_max(typeof(var)) is needlessly +verbose. Instead, since typeof(type) == type we can just explicitly +call typeof() on the argument to type_max() and type_min(). Add +wrappers for readability. + +We can do some replacements right away: + +$ git grep '\btype_\(min\|max\)(typeof' | wc -l +11 + +Link: https://lore.kernel.org/r/20240301062221.work.840-kees@kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + include/linux/overflow.h | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/include/linux/overflow.h b/include/linux/overflow.h +index 7b5cf4a5cd191..51af56522915e 100644 +--- a/include/linux/overflow.h ++++ b/include/linux/overflow.h +@@ -31,8 +31,10 @@ + * credit to Christian Biere. + */ + #define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type))) +-#define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T))) +-#define type_min(T) ((T)((T)-type_max(T)-(T)1)) ++#define __type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T))) ++#define type_max(t) __type_max(typeof(t)) ++#define __type_min(T) ((T)((T)-type_max(T)-(T)1)) ++#define type_min(t) __type_min(typeof(t)) + + /* + * Avoids triggering -Wtype-limits compilation warning, +@@ -130,10 +132,10 @@ static inline bool __must_check __must_check_overflow(bool overflow) + + #define __overflows_type_constexpr(x, T) ( \ + is_unsigned_type(typeof(x)) ? \ +- (x) > type_max(typeof(T)) : \ ++ (x) > type_max(T) : \ + is_unsigned_type(typeof(T)) ? \ +- (x) < 0 || (x) > type_max(typeof(T)) : \ +- (x) < type_min(typeof(T)) || (x) > type_max(typeof(T))) ++ (x) < 0 || (x) > type_max(T) : \ ++ (x) < type_min(T) || (x) > type_max(T)) + + #define __overflows_type(x, T) ({ \ + typeof(T) v = 0; \ +-- +2.43.0 + diff --git a/queue-6.8/panic-flush-kernel-log-buffer-at-the-end.patch b/queue-6.8/panic-flush-kernel-log-buffer-at-the-end.patch new file mode 100644 index 00000000000..5316d767dc7 --- /dev/null +++ b/queue-6.8/panic-flush-kernel-log-buffer-at-the-end.patch @@ -0,0 +1,50 @@ +From 99e72425ba799e59856786bc8b6c64600c0753c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 14:47:02 +0106 +Subject: panic: Flush kernel log buffer at the end + +From: John Ogness + +[ Upstream commit d988d9a9b9d180bfd5c1d353b3b176cb90d6861b ] + +If the kernel crashes in a context where printk() calls always +defer printing (such as in NMI or inside a printk_safe section) +then the final panic messages will be deferred to irq_work. But +if irq_work is not available, the messages will not get printed +unless explicitly flushed. The result is that the final +"end Kernel panic" banner does not get printed. + +Add one final flush after the last printk() call to make sure +the final panic messages make it out as well. + +Signed-off-by: John Ogness +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/20240207134103.1357162-14-john.ogness@linutronix.de +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + kernel/panic.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/kernel/panic.c b/kernel/panic.c +index 2807639aab51d..f22d8f33ea147 100644 +--- a/kernel/panic.c ++++ b/kernel/panic.c +@@ -446,6 +446,14 @@ void panic(const char *fmt, ...) + + /* Do not scroll important messages printed above */ + suppress_printk = 1; ++ ++ /* ++ * The final messages may not have been printed if in a context that ++ * defers printing (such as NMI) and irq_work is not available. ++ * Explicitly flush the kernel log buffer one last time. ++ */ ++ console_flush_on_panic(CONSOLE_FLUSH_PENDING); ++ + local_irq_enable(); + for (i = 0; ; i += PANIC_TIMER_STEP) { + touch_softlockup_watchdog(); +-- +2.43.0 + diff --git a/queue-6.8/pci-disable-d3cold-on-asus-b1400-pci-nvme-bridge.patch b/queue-6.8/pci-disable-d3cold-on-asus-b1400-pci-nvme-bridge.patch new file mode 100644 index 00000000000..888be781202 --- /dev/null +++ b/queue-6.8/pci-disable-d3cold-on-asus-b1400-pci-nvme-bridge.patch @@ -0,0 +1,99 @@ +From 64dd002c1eed73a5b7f351e6459a0e5b6a9b0898 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 08:53:15 +0100 +Subject: PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge + +From: Daniel Drake + +[ Upstream commit cdea98bf1faef23166262825ce44648be6ebff42 ] + +The Asus B1400 with original shipped firmware versions and VMD disabled +cannot resume from suspend: the NVMe device becomes unresponsive and +inaccessible. + +This appears to be an untested D3cold transition by the vendor; Intel +socwatch shows that Windows leaves the NVMe device and parent bridge in D0 +during suspend, even though these firmware versions have StorageD3Enable=1. + +The NVMe device and parent PCI bridge both share the same "PXP" ACPI power +resource, which gets turned off as both devices are put into D3cold during +suspend. The _OFF() method calls DL23() which sets a L23E bit at offset +0xe2 into the PCI configuration space for this root port. This is the +specific write that the _ON() routine is unable to recover from. This +register is not documented in the public chipset datasheet. + +Disallow D3cold on the PCI bridge to enable successful suspend/resume. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215742 +Link: https://lore.kernel.org/r/20240228075316.7404-1-drake@endlessos.org +Signed-off-by: Daniel Drake +Signed-off-by: Bjorn Helgaas +Acked-by: Jian-Hong Pan +Acked-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + arch/x86/pci/fixup.c | 48 ++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 48 insertions(+) + +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index f347c20247d30..b33afb240601b 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -907,6 +907,54 @@ static void chromeos_fixup_apl_pci_l1ss_capability(struct pci_dev *dev) + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x5ad6, chromeos_save_apl_pci_l1ss_capability); + DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, 0x5ad6, chromeos_fixup_apl_pci_l1ss_capability); + ++/* ++ * Disable D3cold on Asus B1400 PCI-NVMe bridge ++ * ++ * On this platform with VMD off, the NVMe device cannot successfully power ++ * back on from D3cold. This appears to be an untested transition by the ++ * vendor: Windows leaves the NVMe and parent bridge in D0 during suspend. ++ * ++ * We disable D3cold on the parent bridge for simplicity, and the fact that ++ * both parent bridge and NVMe device share the same power resource. ++ * ++ * This is only needed on BIOS versions before 308; the newer versions flip ++ * StorageD3Enable from 1 to 0. ++ */ ++static const struct dmi_system_id asus_nvme_broken_d3cold_table[] = { ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BIOS_VERSION, "B1400CEAE.304"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BIOS_VERSION, "B1400CEAE.305"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BIOS_VERSION, "B1400CEAE.306"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BIOS_VERSION, "B1400CEAE.307"), ++ }, ++ }, ++ {} ++}; ++ ++static void asus_disable_nvme_d3cold(struct pci_dev *pdev) ++{ ++ if (dmi_check_system(asus_nvme_broken_d3cold_table) > 0) ++ pci_d3cold_disable(pdev); ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x9a09, asus_disable_nvme_d3cold); ++ + #ifdef CONFIG_SUSPEND + /* + * Root Ports on some AMD SoCs advertise PME_Support for D3hot and D3cold, but +-- +2.43.0 + diff --git a/queue-6.8/perf-x86-amd-lbr-discard-erroneous-branch-entries.patch b/queue-6.8/perf-x86-amd-lbr-discard-erroneous-branch-entries.patch new file mode 100644 index 00000000000..51230678ef0 --- /dev/null +++ b/queue-6.8/perf-x86-amd-lbr-discard-erroneous-branch-entries.patch @@ -0,0 +1,49 @@ +From 42e0501037d90654302fe74c07b413b78760dfeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 16:36:25 +0530 +Subject: perf/x86/amd/lbr: Discard erroneous branch entries + +From: Sandipan Das + +[ Upstream commit 29297ffffb0bf388778bd4b581a43cee6929ae65 ] + +The Revision Guide for AMD Family 19h Model 10-1Fh processors declares +Erratum 1452 which states that non-branch entries may erroneously be +recorded in the Last Branch Record (LBR) stack with the valid and +spec bits set. + +Such entries can be recognized by inspecting bit 61 of the corresponding +LastBranchStackToIp register. This bit is currently reserved but if found +to be set, the associated branch entry should be discarded. + +Signed-off-by: Sandipan Das +Signed-off-by: Ingo Molnar +Cc: Peter Zijlstra +Link: https://bugzilla.kernel.org/attachment.cgi?id=305518 +Link: https://lore.kernel.org/r/3ad2aa305f7396d41a40e3f054f740d464b16b7f.1706526029.git.sandipan.das@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/lbr.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/events/amd/lbr.c b/arch/x86/events/amd/lbr.c +index eb31f850841a8..4a1e600314d5d 100644 +--- a/arch/x86/events/amd/lbr.c ++++ b/arch/x86/events/amd/lbr.c +@@ -173,9 +173,11 @@ void amd_pmu_lbr_read(void) + + /* + * Check if a branch has been logged; if valid = 0, spec = 0 +- * then no branch was recorded ++ * then no branch was recorded; if reserved = 1 then an ++ * erroneous branch was recorded (see Erratum 1452) + */ +- if (!entry.to.split.valid && !entry.to.split.spec) ++ if ((!entry.to.split.valid && !entry.to.split.spec) || ++ entry.to.split.reserved) + continue; + + perf_clear_branch_entry_bitfields(br + out); +-- +2.43.0 + diff --git a/queue-6.8/pinctrl-renesas-checker-limit-cfg-reg-enum-checks-to.patch b/queue-6.8/pinctrl-renesas-checker-limit-cfg-reg-enum-checks-to.patch new file mode 100644 index 00000000000..18db55ca2da --- /dev/null +++ b/queue-6.8/pinctrl-renesas-checker-limit-cfg-reg-enum-checks-to.patch @@ -0,0 +1,49 @@ +From 291cd019b479231d55337d065918747abbddd544 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 14:43:38 +0100 +Subject: pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs + +From: Geert Uytterhoeven + +[ Upstream commit 3803584a4e9b65bb5b013f862f55c5055aa86c25 ] + +If the number of provided enum IDs in a variable width config register +description does not match the expected number, the checker uses the +expected number for validating the individual enum IDs. + +However, this may cause out-of-bounds accesses on the array holding the +enum IDs, leading to bogus enum_id conflict warnings. Worse, if the bug +is an incorrect bit field description (e.g. accidentally using "12" +instead of "-12" for a reserved field), thousands of warnings may be +printed, overflowing the kernel log buffer. + +Fix this by limiting the enum ID check to the number of provided enum +IDs. + +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/c7385f44f2faebb8856bcbb4e908d846fc1531fb.1705930809.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/core.c b/drivers/pinctrl/renesas/core.c +index d1e92bbed33ad..757bbc549b0e2 100644 +--- a/drivers/pinctrl/renesas/core.c ++++ b/drivers/pinctrl/renesas/core.c +@@ -909,9 +909,11 @@ static void __init sh_pfc_check_cfg_reg(const char *drvname, + sh_pfc_err("reg 0x%x: var_field_width declares %u instead of %u bits\n", + cfg_reg->reg, rw, cfg_reg->reg_width); + +- if (n != cfg_reg->nr_enum_ids) ++ if (n != cfg_reg->nr_enum_ids) { + sh_pfc_err("reg 0x%x: enum_ids[] has %u instead of %u values\n", + cfg_reg->reg, cfg_reg->nr_enum_ids, n); ++ n = cfg_reg->nr_enum_ids; ++ } + + check_enum_ids: + sh_pfc_check_reg_enums(drvname, cfg_reg->reg, cfg_reg->enum_ids, n); +-- +2.43.0 + diff --git a/queue-6.8/platform-x86-acer-wmi-add-predator_v4-module-paramet.patch b/queue-6.8/platform-x86-acer-wmi-add-predator_v4-module-paramet.patch new file mode 100644 index 00000000000..060ff4e47ee --- /dev/null +++ b/queue-6.8/platform-x86-acer-wmi-add-predator_v4-module-paramet.patch @@ -0,0 +1,68 @@ +From e13ccae15c35d8c51ad575ae812d3505fd6c7500 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 17:04:16 +0900 +Subject: platform/x86: acer-wmi: Add predator_v4 module parameter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: SungHwan Jung + +[ Upstream commit f9124f2a454a6f1edb4eae9f0646b1a61fd74dba ] + +This parameter allows predator laptop users to test and use features +(mode button, platform profile, fan speed monitoring) without +adding model names to acer_quirks and compiling kernel. + +Signed-off-by: SungHwan Jung +Link: https://lore.kernel.org/r/20240220080416.6395-1-onenowy@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 771b0ce34c8f9..ee2e164f86b9c 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -276,6 +276,7 @@ static bool has_type_aa; + static u16 commun_func_bitmap; + static u8 commun_fn_key_number; + static bool cycle_gaming_thermal_profile = true; ++static bool predator_v4; + + module_param(mailled, int, 0444); + module_param(brightness, int, 0444); +@@ -284,6 +285,7 @@ module_param(force_series, int, 0444); + module_param(force_caps, int, 0444); + module_param(ec_raw_mode, bool, 0444); + module_param(cycle_gaming_thermal_profile, bool, 0644); ++module_param(predator_v4, bool, 0444); + MODULE_PARM_DESC(mailled, "Set initial state of Mail LED"); + MODULE_PARM_DESC(brightness, "Set initial LCD backlight brightness"); + MODULE_PARM_DESC(threeg, "Set initial state of 3G hardware"); +@@ -292,6 +294,8 @@ MODULE_PARM_DESC(force_caps, "Force the capability bitmask to this value"); + MODULE_PARM_DESC(ec_raw_mode, "Enable EC raw mode"); + MODULE_PARM_DESC(cycle_gaming_thermal_profile, + "Set thermal mode key in cycle mode. Disabling it sets the mode key in turbo toggle mode"); ++MODULE_PARM_DESC(predator_v4, ++ "Enable features for predator laptops that use predator sense v4"); + + struct acer_data { + int mailled; +@@ -734,7 +738,9 @@ enum acer_predator_v4_thermal_profile_wmi { + /* Find which quirks are needed for a particular vendor/ model pair */ + static void __init find_quirks(void) + { +- if (!force_series) { ++ if (predator_v4) { ++ quirks = &quirk_acer_predator_v4; ++ } else if (!force_series) { + dmi_check_system(acer_quirks); + dmi_check_system(non_acer_quirks); + } else if (force_series == 2490) { +-- +2.43.0 + diff --git a/queue-6.8/platform-x86-acer-wmi-add-support-for-acer-ph16-71.patch b/queue-6.8/platform-x86-acer-wmi-add-support-for-acer-ph16-71.patch new file mode 100644 index 00000000000..f55449ed7e1 --- /dev/null +++ b/queue-6.8/platform-x86-acer-wmi-add-support-for-acer-ph16-71.patch @@ -0,0 +1,47 @@ +From d5d70671ede4fdb8c639c272c165a45c9e312f96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 14:52:31 +0900 +Subject: platform/x86: acer-wmi: Add support for Acer PH16-71 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: SungHwan Jung + +[ Upstream commit 20a36ec343d4c5abc2378a45ab5e7ea1ca85020a ] + +Add Acer Predator PH16-71 to Acer_quirks with predator_v4 +to support mode button and fan speed sensor. + +Signed-off-by: SungHwan Jung +Link: https://lore.kernel.org/r/20240220055231.6451-1-onenowy@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 88b826e88ebd7..771b0ce34c8f9 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -584,6 +584,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = { + }, + .driver_data = &quirk_acer_predator_v4, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "Acer Predator PH16-71", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Predator PH16-71"), ++ }, ++ .driver_data = &quirk_acer_predator_v4, ++ }, + { + .callback = set_force_caps, + .ident = "Acer Aspire Switch 10E SW3-016", +-- +2.43.0 + diff --git a/queue-6.8/platform-x86-touchscreen_dmi-add-an-extra-entry-for-.patch b/queue-6.8/platform-x86-touchscreen_dmi-add-an-extra-entry-for-.patch new file mode 100644 index 00000000000..360467a3a75 --- /dev/null +++ b/queue-6.8/platform-x86-touchscreen_dmi-add-an-extra-entry-for-.patch @@ -0,0 +1,45 @@ +From ee49ebeab417e62668334e0de6ce278555efcac9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 22:40:17 +0000 +Subject: platform/x86: touchscreen_dmi: Add an extra entry for a variant of + the Chuwi Vi8 tablet +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alban Boyé + +[ Upstream commit 1266e2efb7512dbf20eac820ca2ed34de6b1c3e7 ] + +Signed-off-by: Alban Boyé +Link: https://lore.kernel.org/r/20240227223919.11587-1-alban.boye@protonmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index 975cf24ae359a..c6a10ec2c83f6 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -1217,6 +1217,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_BIOS_VERSION, "CHUWI.D86JLBNR"), + }, + }, ++ { ++ /* Chuwi Vi8 dual-boot (CWI506) */ ++ .driver_data = (void *)&chuwi_vi8_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "i86"), ++ DMI_MATCH(DMI_BIOS_VERSION, "CHUWI2.D86JHBNR02"), ++ }, ++ }, + { + /* Chuwi Vi8 Plus (CWI519) */ + .driver_data = (void *)&chuwi_vi8_plus_data, +-- +2.43.0 + diff --git a/queue-6.8/pmdomain-imx8mp-blk-ctrl-imx8mp_blk-add-fdcc-clock-t.patch b/queue-6.8/pmdomain-imx8mp-blk-ctrl-imx8mp_blk-add-fdcc-clock-t.patch new file mode 100644 index 00000000000..66441add953 --- /dev/null +++ b/queue-6.8/pmdomain-imx8mp-blk-ctrl-imx8mp_blk-add-fdcc-clock-t.patch @@ -0,0 +1,69 @@ +From a4fc63e6a6bac4b91661876f10eb971c0b0856ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Feb 2024 10:52:44 -0600 +Subject: pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix + domain + +From: Adam Ford + +[ Upstream commit 697624ee8ad557ab5417f985d2c804241a7ad30d ] + +According to i.MX8MP RM and HDMI ADD, the fdcc clock is part of +hdmi rx verification IP that should not enable for HDMI TX. +But actually if the clock is disabled before HDMI/LCDIF probe, +LCDIF will not get pixel clock from HDMI PHY and print the error +logs: + +[CRTC:39:crtc-2] vblank wait timed out +WARNING: CPU: 2 PID: 9 at drivers/gpu/drm/drm_atomic_helper.c:1634 drm_atomic_helper_wait_for_vblanks.part.0+0x23c/0x260 + +Add fdcc clock to LCDIF and HDMI TX power domains to fix the issue. + +Signed-off-by: Adam Ford +Reviewed-by: Jacky Bai +Signed-off-by: Sandor Yu +Link: https://lore.kernel.org/r/20240203165307.7806-5-aford173@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/pmdomain/imx/imx8mp-blk-ctrl.c b/drivers/pmdomain/imx/imx8mp-blk-ctrl.c +index e3203eb6a0229..a56f7f92d0915 100644 +--- a/drivers/pmdomain/imx/imx8mp-blk-ctrl.c ++++ b/drivers/pmdomain/imx/imx8mp-blk-ctrl.c +@@ -55,7 +55,7 @@ struct imx8mp_blk_ctrl_domain_data { + const char *gpc_name; + }; + +-#define DOMAIN_MAX_CLKS 2 ++#define DOMAIN_MAX_CLKS 3 + #define DOMAIN_MAX_PATHS 3 + + struct imx8mp_blk_ctrl_domain { +@@ -457,8 +457,8 @@ static const struct imx8mp_blk_ctrl_domain_data imx8mp_hdmi_domain_data[] = { + }, + [IMX8MP_HDMIBLK_PD_LCDIF] = { + .name = "hdmiblk-lcdif", +- .clk_names = (const char *[]){ "axi", "apb" }, +- .num_clks = 2, ++ .clk_names = (const char *[]){ "axi", "apb", "fdcc" }, ++ .num_clks = 3, + .gpc_name = "lcdif", + .path_names = (const char *[]){"lcdif-hdmi"}, + .num_paths = 1, +@@ -483,8 +483,8 @@ static const struct imx8mp_blk_ctrl_domain_data imx8mp_hdmi_domain_data[] = { + }, + [IMX8MP_HDMIBLK_PD_HDMI_TX] = { + .name = "hdmiblk-hdmi-tx", +- .clk_names = (const char *[]){ "apb", "ref_266m" }, +- .num_clks = 2, ++ .clk_names = (const char *[]){ "apb", "ref_266m", "fdcc" }, ++ .num_clks = 3, + .gpc_name = "hdmi-tx", + }, + [IMX8MP_HDMIBLK_PD_HDMI_TX_PHY] = { +-- +2.43.0 + diff --git a/queue-6.8/pmdomain-ti-add-a-null-pointer-check-to-the-omap_prm.patch b/queue-6.8/pmdomain-ti-add-a-null-pointer-check-to-the-omap_prm.patch new file mode 100644 index 00000000000..ecf77659217 --- /dev/null +++ b/queue-6.8/pmdomain-ti-add-a-null-pointer-check-to-the-omap_prm.patch @@ -0,0 +1,37 @@ +From fac5973593808ab59c79cfd629b21b6be5c6073f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 13:42:57 +0800 +Subject: pmdomain: ti: Add a null pointer check to the omap_prm_domain_init + +From: Kunwu Chan + +[ Upstream commit 5d7f58ee08434a33340f75ac7ac5071eea9673b3 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Signed-off-by: Kunwu Chan +Link: https://lore.kernel.org/r/20240118054257.200814-1-chentao@kylinos.cn +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/pmdomain/ti/omap_prm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pmdomain/ti/omap_prm.c b/drivers/pmdomain/ti/omap_prm.c +index c2feae3a634ca..b8ceb3c2b81c2 100644 +--- a/drivers/pmdomain/ti/omap_prm.c ++++ b/drivers/pmdomain/ti/omap_prm.c +@@ -695,6 +695,8 @@ static int omap_prm_domain_init(struct device *dev, struct omap_prm *prm) + data = prm->data; + name = devm_kasprintf(dev, GFP_KERNEL, "prm_%s", + data->name); ++ if (!name) ++ return -ENOMEM; + + prmd->dev = dev; + prmd->prm = prm; +-- +2.43.0 + diff --git a/queue-6.8/printk-for-suppress_panic_printk-check-for-other-cpu.patch b/queue-6.8/printk-for-suppress_panic_printk-check-for-other-cpu.patch new file mode 100644 index 00000000000..bebdf4f84e5 --- /dev/null +++ b/queue-6.8/printk-for-suppress_panic_printk-check-for-other-cpu.patch @@ -0,0 +1,44 @@ +From 71ae9b330f906cb7e8c43e1fd0c7136e54bc0034 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 14:46:55 +0106 +Subject: printk: For @suppress_panic_printk check for other CPU in panic + +From: John Ogness + +[ Upstream commit 0ab7cdd00491b532591ef065be706301de7e448f ] + +Currently @suppress_panic_printk is checked along with +non-matching @panic_cpu and current CPU. This works +because @suppress_panic_printk is only set when +panic_in_progress() is true. + +Rather than relying on the @suppress_panic_printk semantics, +use the concise helper function other_cpu_in_progress(). The +helper function exists to avoid open coding such tests. + +Signed-off-by: John Ogness +Reviewed-by: Petr Mladek +Link: https://lore.kernel.org/r/20240207134103.1357162-7-john.ogness@linutronix.de +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + kernel/printk/printk.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 7a835b277e98d..e1b992652ab25 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -2328,8 +2328,7 @@ asmlinkage int vprintk_emit(int facility, int level, + if (unlikely(suppress_printk)) + return 0; + +- if (unlikely(suppress_panic_printk) && +- atomic_read(&panic_cpu) != raw_smp_processor_id()) ++ if (unlikely(suppress_panic_printk) && other_cpu_in_panic()) + return 0; + + if (level == LOGLEVEL_SCHED) { +-- +2.43.0 + diff --git a/queue-6.8/pstore-zone-add-a-null-pointer-check-to-the-psz_kmsg.patch b/queue-6.8/pstore-zone-add-a-null-pointer-check-to-the-psz_kmsg.patch new file mode 100644 index 00000000000..607903cd60b --- /dev/null +++ b/queue-6.8/pstore-zone-add-a-null-pointer-check-to-the-psz_kmsg.patch @@ -0,0 +1,37 @@ +From 3c98ece1115c285ae2bc523b31284a4ee6d69ae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 18:02:06 +0800 +Subject: pstore/zone: Add a null pointer check to the psz_kmsg_read + +From: Kunwu Chan + +[ Upstream commit 98bc7e26e14fbb26a6abf97603d59532475e97f8 ] + +kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Signed-off-by: Kunwu Chan +Link: https://lore.kernel.org/r/20240118100206.213928-1-chentao@kylinos.cn +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/zone.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/pstore/zone.c b/fs/pstore/zone.c +index 2770746bb7aa1..abca117725c81 100644 +--- a/fs/pstore/zone.c ++++ b/fs/pstore/zone.c +@@ -973,6 +973,8 @@ static ssize_t psz_kmsg_read(struct pstore_zone *zone, + char *buf = kasprintf(GFP_KERNEL, "%s: Total %d times\n", + kmsg_dump_reason_str(record->reason), + record->count); ++ if (!buf) ++ return -ENOMEM; + hlen = strlen(buf); + record->buf = krealloc(buf, hlen + size, GFP_KERNEL); + if (!record->buf) { +-- +2.43.0 + diff --git a/queue-6.8/rcu-nocb-fix-warn_on_once-in-the-rcu_nocb_bypass_loc.patch b/queue-6.8/rcu-nocb-fix-warn_on_once-in-the-rcu_nocb_bypass_loc.patch new file mode 100644 index 00000000000..40b0b417930 --- /dev/null +++ b/queue-6.8/rcu-nocb-fix-warn_on_once-in-the-rcu_nocb_bypass_loc.patch @@ -0,0 +1,64 @@ +From 9aa0bc914bab8715b7b1dc81a5ec49f81c9cb736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 16:11:28 +0800 +Subject: rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock() + +From: Zqiang + +[ Upstream commit dda98810b552fc6bf650f4270edeebdc2f28bd3f ] + +For the kernels built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and +CONFIG_RCU_LAZY=y, the following scenarios will trigger WARN_ON_ONCE() +in the rcu_nocb_bypass_lock() and rcu_nocb_wait_contended() functions: + + CPU2 CPU11 +kthread +rcu_nocb_cb_kthread ksys_write +rcu_do_batch vfs_write +rcu_torture_timer_cb proc_sys_write +__kmem_cache_free proc_sys_call_handler +kmemleak_free drop_caches_sysctl_handler +delete_object_full drop_slab +__delete_object shrink_slab +put_object lazy_rcu_shrink_scan +call_rcu rcu_nocb_flush_bypass +__call_rcu_commn rcu_nocb_bypass_lock + raw_spin_trylock(&rdp->nocb_bypass_lock) fail + atomic_inc(&rdp->nocb_lock_contended); +rcu_nocb_wait_contended WARN_ON_ONCE(smp_processor_id() != rdp->cpu); + WARN_ON_ONCE(atomic_read(&rdp->nocb_lock_contended)) | + |_ _ _ _ _ _ _ _ _ _same rdp and rdp->cpu != 11_ _ _ _ _ _ _ _ _ __| + +Reproduce this bug with "echo 3 > /proc/sys/vm/drop_caches". + +This commit therefore uses rcu_nocb_try_flush_bypass() instead of +rcu_nocb_flush_bypass() in lazy_rcu_shrink_scan(). If the nocb_bypass +queue is being flushed, then rcu_nocb_try_flush_bypass will return +directly. + +Signed-off-by: Zqiang +Reviewed-by: Joel Fernandes (Google) +Reviewed-by: Frederic Weisbecker +Reviewed-by: Paul E. McKenney +Signed-off-by: Boqun Feng +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_nocb.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/rcu/tree_nocb.h b/kernel/rcu/tree_nocb.h +index 4efbf7333d4e1..d430b4656f59e 100644 +--- a/kernel/rcu/tree_nocb.h ++++ b/kernel/rcu/tree_nocb.h +@@ -1383,7 +1383,7 @@ lazy_rcu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + rcu_nocb_unlock_irqrestore(rdp, flags); + continue; + } +- WARN_ON_ONCE(!rcu_nocb_flush_bypass(rdp, NULL, jiffies, false)); ++ rcu_nocb_try_flush_bypass(rdp, jiffies); + rcu_nocb_unlock_irqrestore(rdp, flags); + wake_nocb_gp(rdp, false); + sc->nr_to_scan -= _count; +-- +2.43.0 + diff --git a/queue-6.8/rcu-tasks-repair-rcu-tasks-trace-quiescence-check.patch b/queue-6.8/rcu-tasks-repair-rcu-tasks-trace-quiescence-check.patch new file mode 100644 index 00000000000..315c3cfc32a --- /dev/null +++ b/queue-6.8/rcu-tasks-repair-rcu-tasks-trace-quiescence-check.patch @@ -0,0 +1,46 @@ +From 62dc8ef4bed26b35fe6b4ed05367fe8ae36a63e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 09:33:29 -0800 +Subject: rcu-tasks: Repair RCU Tasks Trace quiescence check + +From: Paul E. McKenney + +[ Upstream commit 2eb52fa8900e642b3b5054c4bf9776089d2a935f ] + +The context-switch-time check for RCU Tasks Trace quiescence expects +current->trc_reader_special.b.need_qs to be zero, and if so, updates +it to TRC_NEED_QS_CHECKED. This is backwards, because if this value +is zero, there is no RCU Tasks Trace grace period in flight, an thus +no need for a quiescent state. Instead, when a grace period starts, +this field is set to TRC_NEED_QS. + +This commit therefore changes the check from zero to TRC_NEED_QS. + +Reported-by: Steven Rostedt +Signed-off-by: Paul E. McKenney +Tested-by: Steven Rostedt (Google) +Signed-off-by: Boqun Feng +Signed-off-by: Sasha Levin +--- + include/linux/rcupdate.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h +index 9d69e4bd6f0a8..17d7ed5f3ae6e 100644 +--- a/include/linux/rcupdate.h ++++ b/include/linux/rcupdate.h +@@ -184,9 +184,9 @@ void rcu_tasks_trace_qs_blkd(struct task_struct *t); + do { \ + int ___rttq_nesting = READ_ONCE((t)->trc_reader_nesting); \ + \ +- if (likely(!READ_ONCE((t)->trc_reader_special.b.need_qs)) && \ ++ if (unlikely(READ_ONCE((t)->trc_reader_special.b.need_qs) == TRC_NEED_QS) && \ + likely(!___rttq_nesting)) { \ +- rcu_trc_cmpxchg_need_qs((t), 0, TRC_NEED_QS_CHECKED); \ ++ rcu_trc_cmpxchg_need_qs((t), TRC_NEED_QS, TRC_NEED_QS_CHECKED); \ + } else if (___rttq_nesting && ___rttq_nesting != INT_MIN && \ + !READ_ONCE((t)->trc_reader_special.b.blocked)) { \ + rcu_tasks_trace_qs_blkd(t); \ +-- +2.43.0 + diff --git a/queue-6.8/rdma-cm-add-timeout-to-cm_destroy_id-wait.patch b/queue-6.8/rdma-cm-add-timeout-to-cm_destroy_id-wait.patch new file mode 100644 index 00000000000..b425879e67b --- /dev/null +++ b/queue-6.8/rdma-cm-add-timeout-to-cm_destroy_id-wait.patch @@ -0,0 +1,102 @@ +From 71adc4b0ca414fddd7a83c47b370a48e1a3e7897 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 22:33:23 -0800 +Subject: RDMA/cm: add timeout to cm_destroy_id wait + +From: Manjunath Patil + +[ Upstream commit 96d9cbe2f2ff7abde021bac75eafaceabe9a51fa ] + +Add timeout to cm_destroy_id, so that userspace can trigger any data +collection that would help in analyzing the cause of delay in destroying +the cm_id. + +New noinline function helps dtrace/ebpf programs to hook on to it. +Existing functionality isn't changed except triggering a probe-able new +function at every timeout interval. + +We have seen cases where CM messages stuck with MAD layer (either due to +software bug or faulty HCA), leading to cm_id getting stuck in the +following call stack. This patch helps in resolving such issues faster. + +kernel: ... INFO: task XXXX:56778 blocked for more than 120 seconds. +... + Call Trace: + __schedule+0x2bc/0x895 + schedule+0x36/0x7c + schedule_timeout+0x1f6/0x31f + ? __slab_free+0x19c/0x2ba + wait_for_completion+0x12b/0x18a + ? wake_up_q+0x80/0x73 + cm_destroy_id+0x345/0x610 [ib_cm] + ib_destroy_cm_id+0x10/0x20 [ib_cm] + rdma_destroy_id+0xa8/0x300 [rdma_cm] + ucma_destroy_id+0x13e/0x190 [rdma_ucm] + ucma_write+0xe0/0x160 [rdma_ucm] + __vfs_write+0x3a/0x16d + vfs_write+0xb2/0x1a1 + ? syscall_trace_enter+0x1ce/0x2b8 + SyS_write+0x5c/0xd3 + do_syscall_64+0x79/0x1b9 + entry_SYSCALL_64_after_hwframe+0x16d/0x0 + +Signed-off-by: Manjunath Patil +Link: https://lore.kernel.org/r/20240309063323.458102-1-manjunath.b.patil@oracle.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index ff58058aeadca..bf0df6ee4f785 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -34,6 +34,7 @@ MODULE_AUTHOR("Sean Hefty"); + MODULE_DESCRIPTION("InfiniBand CM"); + MODULE_LICENSE("Dual BSD/GPL"); + ++#define CM_DESTROY_ID_WAIT_TIMEOUT 10000 /* msecs */ + static const char * const ibcm_rej_reason_strs[] = { + [IB_CM_REJ_NO_QP] = "no QP", + [IB_CM_REJ_NO_EEC] = "no EEC", +@@ -1025,10 +1026,20 @@ static void cm_reset_to_idle(struct cm_id_private *cm_id_priv) + } + } + ++static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id) ++{ ++ struct cm_id_private *cm_id_priv; ++ ++ cm_id_priv = container_of(cm_id, struct cm_id_private, id); ++ pr_err("%s: cm_id=%p timed out. state=%d refcnt=%d\n", __func__, ++ cm_id, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++} ++ + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) + { + struct cm_id_private *cm_id_priv; + struct cm_work *work; ++ int ret; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); + spin_lock_irq(&cm_id_priv->lock); +@@ -1135,7 +1146,14 @@ static void cm_destroy_id(struct ib_cm_id *cm_id, int err) + + xa_erase(&cm.local_id_table, cm_local_id(cm_id->local_id)); + cm_deref_id(cm_id_priv); +- wait_for_completion(&cm_id_priv->comp); ++ do { ++ ret = wait_for_completion_timeout(&cm_id_priv->comp, ++ msecs_to_jiffies( ++ CM_DESTROY_ID_WAIT_TIMEOUT)); ++ if (!ret) /* timeout happened */ ++ cm_destroy_id_wait_timeout(cm_id); ++ } while (!ret); ++ + while ((work = cm_dequeue_work(cm_id_priv)) != NULL) + cm_free_work(work); + +-- +2.43.0 + diff --git a/queue-6.8/revert-acpi-pm-block-asus-b1400ceae-from-suspend-to-.patch b/queue-6.8/revert-acpi-pm-block-asus-b1400ceae-from-suspend-to-.patch new file mode 100644 index 00000000000..4ac9a3fcf59 --- /dev/null +++ b/queue-6.8/revert-acpi-pm-block-asus-b1400ceae-from-suspend-to-.patch @@ -0,0 +1,58 @@ +From 49abe6773d77a7cf627337022445439a37830493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 08:53:16 +0100 +Subject: Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by + default" + +From: Daniel Drake + +[ Upstream commit cb98555fcd8eee98c30165537c7e394f3a66e809 ] + +This reverts commit d52848620de00cde4a3a5df908e231b8c8868250, which was +originally put in place to work around a s2idle failure on this platform +where the NVMe device was inaccessible upon resume. + +After extended testing, we found that the firmware's implementation of S3 +is buggy and intermittently fails to wake up the system. We need to revert +to s2idle mode. + +The NVMe issue has now been solved more precisely in the commit titled +"PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge" + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215742 +Link: https://lore.kernel.org/r/20240228075316.7404-2-drake@endlessos.org +Signed-off-by: Daniel Drake +Signed-off-by: Bjorn Helgaas +Acked-by: Jian-Hong Pan +Acked-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/sleep.c | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 808484d112097..728acfeb774d8 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -385,18 +385,6 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), + }, + }, +- /* +- * ASUS B1400CEAE hangs on resume from suspend (see +- * https://bugzilla.kernel.org/show_bug.cgi?id=215742). +- */ +- { +- .callback = init_default_s3, +- .ident = "ASUS B1400CEAE", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK B1400CEAE"), +- }, +- }, + {}, + }; + +-- +2.43.0 + diff --git a/queue-6.8/ring-buffer-use-read_once-to-read-cpu_buffer-commit_.patch b/queue-6.8/ring-buffer-use-read_once-to-read-cpu_buffer-commit_.patch new file mode 100644 index 00000000000..b6557478673 --- /dev/null +++ b/queue-6.8/ring-buffer-use-read_once-to-read-cpu_buffer-commit_.patch @@ -0,0 +1,42 @@ +From bf67ad798f6a7fd84178bbddd41476647569b13d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Mar 2024 12:42:21 +0800 +Subject: ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in + concurrent environment + +From: linke li + +[ Upstream commit f1e30cb6369251c03f63c564006f96a54197dcc4 ] + +In function ring_buffer_iter_empty(), cpu_buffer->commit_page is read +while other threads may change it. It may cause the time_stamp that read +in the next line come from a different page. Use READ_ONCE() to avoid +having to reason about compiler optimizations now and in future. + +Link: https://lore.kernel.org/linux-trace-kernel/tencent_DFF7D3561A0686B5E8FC079150A02505180A@qq.com + +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Signed-off-by: linke li +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 43060a7ae15e7..2ad234366d21c 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -4395,7 +4395,7 @@ int ring_buffer_iter_empty(struct ring_buffer_iter *iter) + cpu_buffer = iter->cpu_buffer; + reader = cpu_buffer->reader_page; + head_page = cpu_buffer->head_page; +- commit_page = cpu_buffer->commit_page; ++ commit_page = READ_ONCE(cpu_buffer->commit_page); + commit_ts = commit_page->page->time_stamp; + + /* +-- +2.43.0 + diff --git a/queue-6.8/scsi-lpfc-fix-possible-memory-leak-in-lpfc_rcv_padis.patch b/queue-6.8/scsi-lpfc-fix-possible-memory-leak-in-lpfc_rcv_padis.patch new file mode 100644 index 00000000000..da56be098cd --- /dev/null +++ b/queue-6.8/scsi-lpfc-fix-possible-memory-leak-in-lpfc_rcv_padis.patch @@ -0,0 +1,45 @@ +From 66aa89818866286bdde02313dd91460080b7f1e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 10:50:57 -0800 +Subject: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() + +From: Justin Tee + +[ Upstream commit 2ae917d4bcab80ab304b774d492e2fcd6c52c06b ] + +The call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an +unsuccessful status. In such cases, the elsiocb is not issued, the +completion is not called, and thus the elsiocb resource is leaked. + +Check return value after calling lpfc_sli4_resume_rpi() and conditionally +release the elsiocb resource. + +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20240131185112.149731-3-justintee8345@gmail.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nportdisc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index d9074929fbab8..b147304b01fa1 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -748,8 +748,10 @@ lpfc_rcv_padisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + /* Save the ELS cmd */ + elsiocb->drvrTimeout = cmd; + +- lpfc_sli4_resume_rpi(ndlp, +- lpfc_mbx_cmpl_resume_rpi, elsiocb); ++ if (lpfc_sli4_resume_rpi(ndlp, ++ lpfc_mbx_cmpl_resume_rpi, ++ elsiocb)) ++ kfree(elsiocb); + goto out; + } + } +-- +2.43.0 + diff --git a/queue-6.8/scsi-ufs-qcom-avoid-re-init-quirk-when-gears-match.patch b/queue-6.8/scsi-ufs-qcom-avoid-re-init-quirk-when-gears-match.patch new file mode 100644 index 00000000000..ad35a83de9b --- /dev/null +++ b/queue-6.8/scsi-ufs-qcom-avoid-re-init-quirk-when-gears-match.patch @@ -0,0 +1,56 @@ +From 9b5da146eb938010b9efcbd24719e62a9e374e2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 14:28:57 -0500 +Subject: scsi: ufs: qcom: Avoid re-init quirk when gears match + +From: Eric Chanudet + +[ Upstream commit 10a39667a117daf0c1baaebcbe589715ee79178b ] + +On sa8775p-ride, probing the HBA will go through the +UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH path although the power info is +the same during the second init. + +The REINIT quirk only applies starting with controller v4. For these, +ufs_qcom_get_hs_gear() reads the highest supported gear when setting the +host_params. After the negotiation, if the host and device are on the same +gear, it is the highest gear supported between the two. Skip REINIT to save +some time. + +Signed-off-by: Eric Chanudet +Link: https://lore.kernel.org/r/20240123192854.1724905-4-echanude@redhat.com +Reviewed-by: Manivannan Sadhasivam +Tested-by: Andrew Halaney # sa8775p-ride +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-qcom.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c +index 3d43c7ac7a3f8..f532e2c004a25 100644 +--- a/drivers/ufs/host/ufs-qcom.c ++++ b/drivers/ufs/host/ufs-qcom.c +@@ -738,8 +738,17 @@ static int ufs_qcom_pwr_change_notify(struct ufs_hba *hba, + * the second init can program the optimal PHY settings. This allows one to start + * the first init with either the minimum or the maximum support gear. + */ +- if (hba->ufshcd_state == UFSHCD_STATE_RESET) +- host->phy_gear = dev_req_params->gear_tx; ++ if (hba->ufshcd_state == UFSHCD_STATE_RESET) { ++ /* ++ * Skip REINIT if the negotiated gear matches with the ++ * initial phy_gear. Otherwise, update the phy_gear to ++ * program the optimal gear setting during REINIT. ++ */ ++ if (host->phy_gear == dev_req_params->gear_tx) ++ hba->quirks &= ~UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH; ++ else ++ host->phy_gear = dev_req_params->gear_tx; ++ } + + /* enable the device ref clock before changing to HS mode */ + if (!ufshcd_is_hs_mode(&hba->pwr_info) && +-- +2.43.0 + diff --git a/queue-6.8/serial-8250_of-drop-quirk-fot-npcm-from-8250_port.patch b/queue-6.8/serial-8250_of-drop-quirk-fot-npcm-from-8250_port.patch new file mode 100644 index 00000000000..e2a485a3474 --- /dev/null +++ b/queue-6.8/serial-8250_of-drop-quirk-fot-npcm-from-8250_port.patch @@ -0,0 +1,158 @@ +From 342f7cedb757dd05f1d8bcdebddd821d2013a048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 16:50:08 +0200 +Subject: serial: 8250_of: Drop quirk fot NPCM from 8250_port +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit cd0eb354d441488feed6685adbeb1acd45db1b8d ] + +We are not supposed to spread quirks in 8250_port module especially +when we have a separate driver for the hardware in question. + +Move quirk from generic module to the driver that uses it. + +Signed-off-by: Andy Shevchenko +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240215145029.581389-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_of.c | 44 +++++++++++++++++++++++++++-- + drivers/tty/serial/8250/8250_port.c | 24 ---------------- + 2 files changed, 42 insertions(+), 26 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c +index 34f17a9785e79..9dcc17e332690 100644 +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -4,7 +4,10 @@ + * + * Copyright (C) 2006 Arnd Bergmann , IBM Corp. + */ ++ ++#include + #include ++#include + #include + #include + #include +@@ -25,6 +28,36 @@ struct of_serial_info { + int line; + }; + ++/* Nuvoton NPCM timeout register */ ++#define UART_NPCM_TOR 7 ++#define UART_NPCM_TOIE BIT(7) /* Timeout Interrupt Enable */ ++ ++static int npcm_startup(struct uart_port *port) ++{ ++ /* ++ * Nuvoton calls the scratch register 'UART_TOR' (timeout ++ * register). Enable it, and set TIOC (timeout interrupt ++ * comparator) to be 0x20 for correct operation. ++ */ ++ serial_port_out(port, UART_NPCM_TOR, UART_NPCM_TOIE | 0x20); ++ ++ return serial8250_do_startup(port); ++} ++ ++/* Nuvoton NPCM UARTs have a custom divisor calculation */ ++static unsigned int npcm_get_divisor(struct uart_port *port, unsigned int baud, ++ unsigned int *frac) ++{ ++ return DIV_ROUND_CLOSEST(port->uartclk, 16 * baud + 2) - 2; ++} ++ ++static int npcm_setup(struct uart_port *port) ++{ ++ port->get_divisor = npcm_get_divisor; ++ port->startup = npcm_startup; ++ return 0; ++} ++ + /* + * Fill a struct uart_port for a given device node + */ +@@ -164,10 +197,17 @@ static int of_platform_serial_setup(struct platform_device *ofdev, + switch (type) { + case PORT_RT2880: + ret = rt288x_setup(port); +- if (ret) +- goto err_pmruntime; ++ break; ++ case PORT_NPCM: ++ ret = npcm_setup(port); ++ break; ++ default: ++ /* Nothing to do */ ++ ret = 0; + break; + } ++ if (ret) ++ goto err_pmruntime; + + if (IS_REACHABLE(CONFIG_SERIAL_8250_FSL) && + (of_device_is_compatible(np, "fsl,ns16550") || +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 1d65055dde276..c0c34e410c581 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -38,10 +38,6 @@ + + #include "8250.h" + +-/* Nuvoton NPCM timeout register */ +-#define UART_NPCM_TOR 7 +-#define UART_NPCM_TOIE BIT(7) /* Timeout Interrupt Enable */ +- + /* + * Debugging. + */ +@@ -2229,15 +2225,6 @@ int serial8250_do_startup(struct uart_port *port) + UART_DA830_PWREMU_MGMT_FREE); + } + +- if (port->type == PORT_NPCM) { +- /* +- * Nuvoton calls the scratch register 'UART_TOR' (timeout +- * register). Enable it, and set TIOC (timeout interrupt +- * comparator) to be 0x20 for correct operation. +- */ +- serial_port_out(port, UART_NPCM_TOR, UART_NPCM_TOIE | 0x20); +- } +- + #ifdef CONFIG_SERIAL_8250_RSA + /* + * If this is an RSA port, see if we can kick it up to the +@@ -2539,15 +2526,6 @@ static void serial8250_shutdown(struct uart_port *port) + serial8250_do_shutdown(port); + } + +-/* Nuvoton NPCM UARTs have a custom divisor calculation */ +-static unsigned int npcm_get_divisor(struct uart_8250_port *up, +- unsigned int baud) +-{ +- struct uart_port *port = &up->port; +- +- return DIV_ROUND_CLOSEST(port->uartclk, 16 * baud + 2) - 2; +-} +- + static unsigned int serial8250_do_get_divisor(struct uart_port *port, + unsigned int baud, + unsigned int *frac) +@@ -2592,8 +2570,6 @@ static unsigned int serial8250_do_get_divisor(struct uart_port *port, + quot = 0x8001; + else if (magic_multiplier && baud >= port->uartclk / 12) + quot = 0x8002; +- else if (up->port.type == PORT_NPCM) +- quot = npcm_get_divisor(up, baud); + else + quot = uart_get_divisor(port, baud); + +-- +2.43.0 + diff --git a/queue-6.8/series b/queue-6.8/series new file mode 100644 index 00000000000..1ebce849a92 --- /dev/null +++ b/queue-6.8/series @@ -0,0 +1,133 @@ +wifi-ath9k-fix-lna-selection-in-ath_ant_try_scan.patch +wifi-rtw89-fix-null-pointer-access-when-abort-scan.patch +bnx2x-fix-firmware-version-string-character-counts.patch +batman-adv-return-directly-after-a-failed-batadv_dat.patch +batman-adv-improve-exception-handling-in-batadv_thro.patch +arm64-dts-qcom-add-support-for-xiaomi-redmi-note-9s.patch +net-stmmac-dwmac-starfive-add-support-for-jh7100-soc.patch +net-phy-phy_device-prevent-nullptr-exceptions-on-isr.patch +wifi-rtw89-pci-validate-rx-tag-for-rxq-and-rpq.patch +wifi-rtw89-pci-enlarge-rx-dma-buffer-to-consider-siz.patch +vmci-fix-memcpy-run-time-warning-in-dg_dispatch_as_h.patch +wifi-iwlwifi-pcie-add-the-pci-device-id-for-new-hard.patch +arm64-dts-qcom-qcm6490-idp-add-definition-for-three-.patch +net-dsa-qca8k-put-mdio-controller-of-node-if-unavail.patch +arm64-dts-ti-makefile-add-hdmi-audio-check-for-am62a.patch +arm64-dts-qcom-qrb2210-rb1-disable-cluster-power-dom.patch +printk-for-suppress_panic_printk-check-for-other-cpu.patch +panic-flush-kernel-log-buffer-at-the-end.patch +dump_stack-do-not-get-cpu_sync-for-panic-cpu.patch +wifi-iwlwifi-pcie-add-new-pci-device-id-and-cnvi.patch +cpuidle-avoid-potential-overflow-in-integer-multipli.patch +arm-dts-rockchip-fix-rk3288-hdmi-ports-node.patch +arm-dts-rockchip-fix-rk322x-hdmi-ports-node.patch +arm64-dts-rockchip-fix-rk3328-hdmi-ports-node.patch +arm64-dts-rockchip-fix-rk3399-hdmi-ports-node.patch +net-add-netdev_lockdep_set_classes-to-virtual-driver.patch +arm64-dts-qcom-qcs6490-rb3gen2-declare-gcc-clocks-pr.patch +pmdomain-ti-add-a-null-pointer-check-to-the-omap_prm.patch +pmdomain-imx8mp-blk-ctrl-imx8mp_blk-add-fdcc-clock-t.patch +acpi-resource-add-irq-override-quirk-for-asus-expert.patch +ionic-set-adminq-irq-affinity.patch +net-skbuff-add-overflow-debug-check-to-pull-push-hel.patch +firmware-tegra-bpmp-return-directly-after-a-failed-k.patch +wifi-brcmfmac-add-dmi-nvram-filename-quirk-for-acepc.patch +wifi-mt76-mt7915-add-locking-for-accessing-mapped-re.patch +wifi-mt76-mt7996-disable-amsdu-for-non-data-frames.patch +wifi-mt76-mt7996-add-locking-for-accessing-mapped-re.patch +acpi-x86-move-acpi_quirk_skip_serdev_enumeration-out.patch +acpi-x86-add-dell0501-handling-to-acpi_quirk_skip_se.patch +pstore-zone-add-a-null-pointer-check-to-the-psz_kmsg.patch +tools-power-x86_energy_perf_policy-fix-file-leak-in-.patch +net-pcs-xpcs-return-einval-in-the-internal-methods.patch +dma-direct-leak-pages-on-dma_set_decrypted-failure.patch +wifi-ath11k-decrease-mhi-channel-buffer-length-to-8k.patch +iommu-arm-smmu-v3-hold-arm_smmu_asid_lock-during-all.patch +cpufreq-don-t-unregister-cpufreq-cooling-on-cpu-hotp.patch +overflow-allow-non-type-arg-to-type_max-and-type_min.patch +wifi-iwlwifi-add-missing-module_firmware-for-.pnvm.patch +wifi-cfg80211-check-a-msdu-format-more-carefully.patch +btrfs-handle-chunk-tree-lookup-error-in-btrfs_reloca.patch +btrfs-export-handle-invalid-inode-or-root-reference-.patch +btrfs-send-handle-path-ref-underflow-in-header-itera.patch +ice-use-relative-vsi-index-for-vfs-instead-of-pf-vsi.patch +net-smc-reduce-rtnl-pressure-in-smc_pnet_create_pnet.patch +netdev-let-netlink-core-handle-emsgsize-errors.patch +bluetooth-btintel-fix-null-ptr-deref-in-btintel_read.patch +bluetooth-btmtk-add-module_firmware-for-mt7922.patch +bluetooth-add-new-quirk-for-broken-read-key-length-o.patch +drm-vc4-don-t-check-if-plane-state-fb-state-fb.patch +drm-ci-uprev-mesa-version-fix-kdl-commit-fetch.patch +drm-amdgpu-skip-do-pci-error-slot-reset-during-ras-r.patch +input-synaptics-rmi4-fail-probing-if-memory-allocati.patch +drm-panel-orientation-quirks-add-quirk-for-gpd-win-m.patch +asoc-sof-amd-optimize-quirk-for-valve-galileo.patch +drm-ttm-return-enospc-from-ttm_bo_mem_space-v3.patch +scsi-ufs-qcom-avoid-re-init-quirk-when-gears-match.patch +drm-amd-display-increased-min_dcfclk_mhz-and-min_fcl.patch +pinctrl-renesas-checker-limit-cfg-reg-enum-checks-to.patch +sysv-don-t-call-sb_bread-with-pointers_lock-held.patch +scsi-lpfc-fix-possible-memory-leak-in-lpfc_rcv_padis.patch +drm-amd-display-disable-idle-reallow-as-part-of-comm.patch +isofs-handle-cds-with-bad-root-inode-but-good-joliet.patch +asoc-intel-sof_rt5682-dmi-quirk-cleanup-for-mtl-boar.patch +asoc-intel-common-dmi-remap-for-rebranded-intel-nuc-.patch +rcu-nocb-fix-warn_on_once-in-the-rcu_nocb_bypass_loc.patch +rcu-tasks-repair-rcu-tasks-trace-quiescence-check.patch +julia-lawall-reported-this-null-pointer-dereference-.patch +media-sta2x11-fix-irq-handler-cast.patch +alsa-firewire-lib-handle-quirk-to-calculate-payload-.patch +drm-panel-simple-add-boe-bp082wx1-100-8.2-panel.patch +x86-vdso-fix-rethunk-patching-for-vdso-image-32-64-..patch +asoc-intel-avs-populate-board-selection-with-new-i2s.patch +ext4-add-a-hint-for-block-bitmap-corrupt-state-in-mb.patch +ext4-forbid-commit-inconsistent-quota-data-when-erro.patch +drm-amd-display-fix-nanosec-stat-overflow.patch +accel-habanalabs-increase-hl_max_str-to-64-bytes-to-.patch +i2c-designware-fix-rx-fifo-depth-define-on-wangxun-1.patch +hid-input-avoid-polling-stylus-battery-on-chromebook.patch +drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in.patch +drm-check-output-polling-initialized-before-disablin.patch +sunrpc-increase-size-of-rpc_wait_queue.qlen-from-uns.patch +pci-disable-d3cold-on-asus-b1400-pci-nvme-bridge.patch +revert-acpi-pm-block-asus-b1400ceae-from-suspend-to-.patch +libperf-evlist-avoid-out-of-bounds-access.patch +crypto-iaa-fix-async_disable-descriptor-leak.patch +input-touchscreen-imagis-correct-the-maximum-touch-a.patch +drivers-perf-hisi-enable-hisilicon-erratum-162700402.patch +block-prevent-division-by-zero-in-blk_rq_stat_sum.patch +rdma-cm-add-timeout-to-cm_destroy_id-wait.patch +input-imagis-use-field_get-where-applicable.patch +smb-client-reuse-file-lease-key-in-compound-operatio.patch +input-allocate-keycode-for-display-refresh-rate-togg.patch +platform-x86-acer-wmi-add-support-for-acer-ph16-71.patch +platform-x86-acer-wmi-add-predator_v4-module-paramet.patch +platform-x86-touchscreen_dmi-add-an-extra-entry-for-.patch +perf-x86-amd-lbr-discard-erroneous-branch-entries.patch +alsa-hda-realtek-add-quirk-for-lenovo-yoga-9-14imh9.patch +ktest-force-buildonly-1-for-make_warnings_file-test-.patch +input-xpad-add-support-for-snakebyte-gamepads.patch +ring-buffer-use-read_once-to-read-cpu_buffer-commit_.patch +tools-iio-replace-seekdir-in-iio_generic_buffer.patch +bus-mhi-host-add-mhi_pm_sys_err_fail-state.patch +kernfs-rcu-protect-kernfs_nodes-and-avoid-kernfs_idr.patch +usb-typec-ucsi-add-qcm6490-pmic-glink-as-needing-pdo.patch +thunderbolt-calculate-displayport-tunnel-bandwidth-a.patch +usb-gadget-uvc-refactor-the-check-for-a-valid-buffer.patch +usb-gadget-uvc-mark-incomplete-frames-with-uvc_strea.patch +usb-typec-ucsi-limit-read-size-on-v1.2.patch +serial-8250_of-drop-quirk-fot-npcm-from-8250_port.patch +thunderbolt-keep-the-domain-powered-when-usb4-port-i.patch +usb-typec-tcpci-add-generic-tcpci-fallback-compatibl.patch +usb-sl811-hcd-only-defined-function-checkdone-if-qui.patch +asoc-amd-yc-fix-non-functional-mic-on-asus-m7600re.patch +thermal-of-assume-polling-delay-passive-0-when-absen.patch +asoc-soc-core.c-skip-dummy-codec-when-adding-platfor.patch +x86-xen-attempt-to-inflate-the-memory-balloon-on-pvh.patch +fbdev-viafb-fix-typo-in-hw_bitblt_1-and-hw_bitblt_2.patch +io_uring-clear-opcode-specific-data-for-an-early-fai.patch +modpost-fix-null-pointer-dereference.patch +drivers-nvme-add-quirks-for-device-126f-2262.patch +fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch +alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch +drm-amdgpu-init-zone-device-and-drm-client-after-mod.patch diff --git a/queue-6.8/smb-client-reuse-file-lease-key-in-compound-operatio.patch b/queue-6.8/smb-client-reuse-file-lease-key-in-compound-operatio.patch new file mode 100644 index 00000000000..a9321932195 --- /dev/null +++ b/queue-6.8/smb-client-reuse-file-lease-key-in-compound-operatio.patch @@ -0,0 +1,380 @@ +From 023302dc27b26e743a30097b0bbbe7b139ac1b50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 22:43:51 -0500 +Subject: smb: client: reuse file lease key in compound operations + +From: Meetakshi Setiya + +[ Upstream commit 2c7d399e551ccfd87bcae4ef5573097f3313d779 ] + +Currently, when a rename, unlink or set path size compound operation +is requested on a file that has a lot of dirty pages to be written +to the server, we do not send the lease key for these requests. As a +result, the server can assume that this request is from a new client, and +send a lease break notification to the same client, on the same +connection. As a response to the lease break, the client can consume +several credits to write the dirty pages to the server. Depending on the +server's credit grant implementation, the server can stop granting more +credits to this connection, and this can cause a deadlock (which can only +be resolved when the lease timer on the server expires). +One of the problems here is that the client is sending no lease key, +even if it has a lease for the file. This patch fixes the problem by +reusing the existing lease key on the file for rename, unlink and set path +size compound operations so that the client does not break its own lease. + +A very trivial example could be a set of commands by a client that +maintains open handle (for write) to a file and then tries to copy the +contents of that file to another one, eg., + +tail -f /dev/null > myfile & +mv myfile myfile2 + +Presently, the network capture on the client shows that the move (or +rename) would trigger a lease break on the same client, for the same file. +With the lease key reused, the lease break request-response overhead is +eliminated, thereby reducing the roundtrips performed for this set of +operations. + +The patch fixes the bug described above and also provides perf benefit. + +Signed-off-by: Meetakshi Setiya +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsglob.h | 5 ++-- + fs/smb/client/cifsproto.h | 6 +++-- + fs/smb/client/cifssmb.c | 4 ++-- + fs/smb/client/inode.c | 10 ++++---- + fs/smb/client/smb2inode.c | 48 ++++++++++++++++++++++++--------------- + fs/smb/client/smb2proto.h | 6 +++-- + 6 files changed, 48 insertions(+), 31 deletions(-) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index 844afda090d05..0870a74a53bf1 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -374,7 +374,8 @@ struct smb_version_operations { + struct cifs_open_info_data *data); + /* set size by path */ + int (*set_path_size)(const unsigned int, struct cifs_tcon *, +- const char *, __u64, struct cifs_sb_info *, bool); ++ const char *, __u64, struct cifs_sb_info *, bool, ++ struct dentry *); + /* set size by file handle */ + int (*set_file_size)(const unsigned int, struct cifs_tcon *, + struct cifsFileInfo *, __u64, bool); +@@ -404,7 +405,7 @@ struct smb_version_operations { + struct cifs_sb_info *); + /* unlink file */ + int (*unlink)(const unsigned int, struct cifs_tcon *, const char *, +- struct cifs_sb_info *); ++ struct cifs_sb_info *, struct dentry *); + /* open, rename and delete file */ + int (*rename_pending_delete)(const char *, struct dentry *, + const unsigned int); +diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h +index 996ca413dd8bd..e9b38b279a6c5 100644 +--- a/fs/smb/client/cifsproto.h ++++ b/fs/smb/client/cifsproto.h +@@ -404,7 +404,8 @@ extern int CIFSSMBSetFileDisposition(const unsigned int xid, + __u32 pid_of_opener); + extern int CIFSSMBSetEOF(const unsigned int xid, struct cifs_tcon *tcon, + const char *file_name, __u64 size, +- struct cifs_sb_info *cifs_sb, bool set_allocation); ++ struct cifs_sb_info *cifs_sb, bool set_allocation, ++ struct dentry *dentry); + extern int CIFSSMBSetFileSize(const unsigned int xid, struct cifs_tcon *tcon, + struct cifsFileInfo *cfile, __u64 size, + bool set_allocation); +@@ -440,7 +441,8 @@ extern int CIFSPOSIXDelFile(const unsigned int xid, struct cifs_tcon *tcon, + const struct nls_table *nls_codepage, + int remap_special_chars); + extern int CIFSSMBDelFile(const unsigned int xid, struct cifs_tcon *tcon, +- const char *name, struct cifs_sb_info *cifs_sb); ++ const char *name, struct cifs_sb_info *cifs_sb, ++ struct dentry *dentry); + int CIFSSMBRename(const unsigned int xid, struct cifs_tcon *tcon, + struct dentry *source_dentry, + const char *from_name, const char *to_name, +diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c +index 01e89070df5ab..301189ee1335b 100644 +--- a/fs/smb/client/cifssmb.c ++++ b/fs/smb/client/cifssmb.c +@@ -738,7 +738,7 @@ CIFSPOSIXDelFile(const unsigned int xid, struct cifs_tcon *tcon, + + int + CIFSSMBDelFile(const unsigned int xid, struct cifs_tcon *tcon, const char *name, +- struct cifs_sb_info *cifs_sb) ++ struct cifs_sb_info *cifs_sb, struct dentry *dentry) + { + DELETE_FILE_REQ *pSMB = NULL; + DELETE_FILE_RSP *pSMBr = NULL; +@@ -4993,7 +4993,7 @@ CIFSSMBQFSPosixInfo(const unsigned int xid, struct cifs_tcon *tcon, + int + CIFSSMBSetEOF(const unsigned int xid, struct cifs_tcon *tcon, + const char *file_name, __u64 size, struct cifs_sb_info *cifs_sb, +- bool set_allocation) ++ bool set_allocation, struct dentry *dentry) + { + struct smb_com_transaction2_spi_req *pSMB = NULL; + struct smb_com_transaction2_spi_rsp *pSMBr = NULL; +diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c +index 4c3dec384f922..0aba29d2c5a2e 100644 +--- a/fs/smb/client/inode.c ++++ b/fs/smb/client/inode.c +@@ -1849,7 +1849,7 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry) + goto psx_del_no_retry; + } + +- rc = server->ops->unlink(xid, tcon, full_path, cifs_sb); ++ rc = server->ops->unlink(xid, tcon, full_path, cifs_sb, dentry); + + psx_del_no_retry: + if (!rc) { +@@ -2800,7 +2800,7 @@ void cifs_setsize(struct inode *inode, loff_t offset) + + static int + cifs_set_file_size(struct inode *inode, struct iattr *attrs, +- unsigned int xid, const char *full_path) ++ unsigned int xid, const char *full_path, struct dentry *dentry) + { + int rc; + struct cifsFileInfo *open_file; +@@ -2851,7 +2851,7 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs, + */ + if (server->ops->set_path_size) + rc = server->ops->set_path_size(xid, tcon, full_path, +- attrs->ia_size, cifs_sb, false); ++ attrs->ia_size, cifs_sb, false, dentry); + else + rc = -ENOSYS; + cifs_dbg(FYI, "SetEOF by path (setattrs) rc = %d\n", rc); +@@ -2941,7 +2941,7 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) + rc = 0; + + if (attrs->ia_valid & ATTR_SIZE) { +- rc = cifs_set_file_size(inode, attrs, xid, full_path); ++ rc = cifs_set_file_size(inode, attrs, xid, full_path, direntry); + if (rc != 0) + goto out; + } +@@ -3108,7 +3108,7 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) + } + + if (attrs->ia_valid & ATTR_SIZE) { +- rc = cifs_set_file_size(inode, attrs, xid, full_path); ++ rc = cifs_set_file_size(inode, attrs, xid, full_path, direntry); + if (rc != 0) + goto cifs_setattr_exit; + } +diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c +index 05818cd6d932e..69f3442c5b963 100644 +--- a/fs/smb/client/smb2inode.c ++++ b/fs/smb/client/smb2inode.c +@@ -98,7 +98,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + __u32 desired_access, __u32 create_disposition, + __u32 create_options, umode_t mode, struct kvec *in_iov, + int *cmds, int num_cmds, struct cifsFileInfo *cfile, +- struct kvec *out_iov, int *out_buftype) ++ struct kvec *out_iov, int *out_buftype, struct dentry *dentry) + { + + struct reparse_data_buffer *rbuf; +@@ -115,6 +115,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + int resp_buftype[MAX_COMPOUND]; + struct smb2_query_info_rsp *qi_rsp = NULL; + struct cifs_open_info_data *idata; ++ struct inode *inode = NULL; + int flags = 0; + __u8 delete_pending[8] = {1, 0, 0, 0, 0, 0, 0, 0}; + unsigned int size[2]; +@@ -152,6 +153,15 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, + goto finished; + } + ++ /* if there is an existing lease, reuse it */ ++ if (dentry) { ++ inode = d_inode(dentry); ++ if (CIFS_I(inode)->lease_granted && server->ops->get_lease_key) { ++ oplock = SMB2_OPLOCK_LEVEL_LEASE; ++ server->ops->get_lease_key(inode, &fid); ++ } ++ } ++ + vars->oparms = (struct cifs_open_parms) { + .tcon = tcon, + .path = full_path, +@@ -747,7 +757,7 @@ int smb2_query_path_info(const unsigned int xid, + rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, + FILE_READ_ATTRIBUTES, FILE_OPEN, + create_options, ACL_NO_MODE, in_iov, +- cmds, 1, cfile, out_iov, out_buftype); ++ cmds, 1, cfile, out_iov, out_buftype, NULL); + hdr = out_iov[0].iov_base; + /* + * If first iov is unset, then SMB session was dropped or we've got a +@@ -779,7 +789,7 @@ int smb2_query_path_info(const unsigned int xid, + rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, + FILE_READ_ATTRIBUTES, FILE_OPEN, + create_options, ACL_NO_MODE, in_iov, +- cmds, num_cmds, cfile, NULL, NULL); ++ cmds, num_cmds, cfile, NULL, NULL, NULL); + break; + case -EREMOTE: + break; +@@ -811,7 +821,7 @@ smb2_mkdir(const unsigned int xid, struct inode *parent_inode, umode_t mode, + FILE_WRITE_ATTRIBUTES, FILE_CREATE, + CREATE_NOT_FILE, mode, + NULL, &(int){SMB2_OP_MKDIR}, 1, +- NULL, NULL, NULL); ++ NULL, NULL, NULL, NULL); + } + + void +@@ -836,7 +846,7 @@ smb2_mkdir_setinfo(struct inode *inode, const char *name, + FILE_WRITE_ATTRIBUTES, FILE_CREATE, + CREATE_NOT_FILE, ACL_NO_MODE, &in_iov, + &(int){SMB2_OP_SET_INFO}, 1, +- cfile, NULL, NULL); ++ cfile, NULL, NULL, NULL); + if (tmprc == 0) + cifs_i->cifsAttrs = dosattrs; + } +@@ -850,25 +860,26 @@ smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, const char *name, + DELETE, FILE_OPEN, CREATE_NOT_FILE, + ACL_NO_MODE, NULL, + &(int){SMB2_OP_RMDIR}, 1, +- NULL, NULL, NULL); ++ NULL, NULL, NULL, NULL); + } + + int + smb2_unlink(const unsigned int xid, struct cifs_tcon *tcon, const char *name, +- struct cifs_sb_info *cifs_sb) ++ struct cifs_sb_info *cifs_sb, struct dentry *dentry) + { + return smb2_compound_op(xid, tcon, cifs_sb, name, DELETE, FILE_OPEN, + CREATE_DELETE_ON_CLOSE | OPEN_REPARSE_POINT, + ACL_NO_MODE, NULL, + &(int){SMB2_OP_DELETE}, 1, +- NULL, NULL, NULL); ++ NULL, NULL, NULL, dentry); + } + + static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, + const char *from_name, const char *to_name, + struct cifs_sb_info *cifs_sb, + __u32 create_options, __u32 access, +- int command, struct cifsFileInfo *cfile) ++ int command, struct cifsFileInfo *cfile, ++ struct dentry *dentry) + { + struct kvec in_iov; + __le16 *smb2_to_name = NULL; +@@ -883,7 +894,7 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, + in_iov.iov_len = 2 * UniStrnlen((wchar_t *)smb2_to_name, PATH_MAX); + rc = smb2_compound_op(xid, tcon, cifs_sb, from_name, access, + FILE_OPEN, create_options, ACL_NO_MODE, +- &in_iov, &command, 1, cfile, NULL, NULL); ++ &in_iov, &command, 1, cfile, NULL, NULL, dentry); + smb2_rename_path: + kfree(smb2_to_name); + return rc; +@@ -902,7 +913,7 @@ int smb2_rename_path(const unsigned int xid, + cifs_get_writable_path(tcon, from_name, FIND_WR_WITH_DELETE, &cfile); + + return smb2_set_path_attr(xid, tcon, from_name, to_name, cifs_sb, +- co, DELETE, SMB2_OP_RENAME, cfile); ++ co, DELETE, SMB2_OP_RENAME, cfile, source_dentry); + } + + int smb2_create_hardlink(const unsigned int xid, +@@ -915,13 +926,14 @@ int smb2_create_hardlink(const unsigned int xid, + + return smb2_set_path_attr(xid, tcon, from_name, to_name, + cifs_sb, co, FILE_READ_ATTRIBUTES, +- SMB2_OP_HARDLINK, NULL); ++ SMB2_OP_HARDLINK, NULL, NULL); + } + + int + smb2_set_path_size(const unsigned int xid, struct cifs_tcon *tcon, + const char *full_path, __u64 size, +- struct cifs_sb_info *cifs_sb, bool set_alloc) ++ struct cifs_sb_info *cifs_sb, bool set_alloc, ++ struct dentry *dentry) + { + struct cifsFileInfo *cfile; + struct kvec in_iov; +@@ -934,7 +946,7 @@ smb2_set_path_size(const unsigned int xid, struct cifs_tcon *tcon, + FILE_WRITE_DATA, FILE_OPEN, + 0, ACL_NO_MODE, &in_iov, + &(int){SMB2_OP_SET_EOF}, 1, +- cfile, NULL, NULL); ++ cfile, NULL, NULL, dentry); + } + + int +@@ -963,7 +975,7 @@ smb2_set_file_info(struct inode *inode, const char *full_path, + FILE_WRITE_ATTRIBUTES, FILE_OPEN, + 0, ACL_NO_MODE, &in_iov, + &(int){SMB2_OP_SET_INFO}, 1, +- cfile, NULL, NULL); ++ cfile, NULL, NULL, NULL); + cifs_put_tlink(tlink); + return rc; + } +@@ -998,7 +1010,7 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data, + cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); + rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, + da, cd, co, ACL_NO_MODE, in_iov, +- cmds, 2, cfile, NULL, NULL); ++ cmds, 2, cfile, NULL, NULL, NULL); + if (!rc) { + rc = smb311_posix_get_inode_info(&new, full_path, + data, sb, xid); +@@ -1008,7 +1020,7 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data, + cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile); + rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, + da, cd, co, ACL_NO_MODE, in_iov, +- cmds, 2, cfile, NULL, NULL); ++ cmds, 2, cfile, NULL, NULL, NULL); + if (!rc) { + rc = cifs_get_inode_info(&new, full_path, + data, sb, xid, NULL); +@@ -1036,7 +1048,7 @@ int smb2_query_reparse_point(const unsigned int xid, + FILE_READ_ATTRIBUTES, FILE_OPEN, + OPEN_REPARSE_POINT, ACL_NO_MODE, &in_iov, + &(int){SMB2_OP_GET_REPARSE}, 1, +- cfile, NULL, NULL); ++ cfile, NULL, NULL, NULL); + if (rc) + goto out; + +diff --git a/fs/smb/client/smb2proto.h b/fs/smb/client/smb2proto.h +index b3069911e9dd8..221143788a1c0 100644 +--- a/fs/smb/client/smb2proto.h ++++ b/fs/smb/client/smb2proto.h +@@ -75,7 +75,8 @@ int smb2_query_path_info(const unsigned int xid, + struct cifs_open_info_data *data); + extern int smb2_set_path_size(const unsigned int xid, struct cifs_tcon *tcon, + const char *full_path, __u64 size, +- struct cifs_sb_info *cifs_sb, bool set_alloc); ++ struct cifs_sb_info *cifs_sb, bool set_alloc, ++ struct dentry *dentry); + extern int smb2_set_file_info(struct inode *inode, const char *full_path, + FILE_BASIC_INFO *buf, const unsigned int xid); + extern int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, +@@ -91,7 +92,8 @@ extern void smb2_mkdir_setinfo(struct inode *inode, const char *full_path, + extern int smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, + const char *name, struct cifs_sb_info *cifs_sb); + extern int smb2_unlink(const unsigned int xid, struct cifs_tcon *tcon, +- const char *name, struct cifs_sb_info *cifs_sb); ++ const char *name, struct cifs_sb_info *cifs_sb, ++ struct dentry *dentry); + int smb2_rename_path(const unsigned int xid, + struct cifs_tcon *tcon, + struct dentry *source_dentry, +-- +2.43.0 + diff --git a/queue-6.8/sunrpc-increase-size-of-rpc_wait_queue.qlen-from-uns.patch b/queue-6.8/sunrpc-increase-size-of-rpc_wait_queue.qlen-from-uns.patch new file mode 100644 index 00000000000..0c7bf8069cb --- /dev/null +++ b/queue-6.8/sunrpc-increase-size-of-rpc_wait_queue.qlen-from-uns.patch @@ -0,0 +1,87 @@ +From 4b4cfeefb2227540e2d5f5bce7aa2a4d89701e84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 11:38:25 -0800 +Subject: SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to + unsigned int + +From: Dai Ngo + +[ Upstream commit 2c35f43b5a4b9cdfaa6fdd946f5a212615dac8eb ] + +When the NFS client is under extreme load the rpc_wait_queue.qlen counter +can be overflowed. Here is an instant of the backlog queue overflow in a +real world environment shown by drgn helper: + +rpc_task_stats(rpc_clnt): +------------------------- +rpc_clnt: 0xffff92b65d2bae00 +rpc_xprt: 0xffff9275db64f000 + Queue: sending[64887] pending[524] backlog[30441] binding[0] +XMIT task: 0xffff925c6b1d8e98 + WRITE: 750654 + __dta_call_status_580: 65463 + __dta_call_transmit_status_579: 1 + call_reserveresult: 685189 + nfs_client_init_is_complete: 1 + COMMIT: 584 + call_reserveresult: 573 + __dta_call_status_580: 11 + ACCESS: 1 + __dta_call_status_580: 1 + GETATTR: 10 + __dta_call_status_580: 4 + call_reserveresult: 6 +751249 tasks for server 111.222.333.444 +Total tasks: 751249 + +count_rpc_wait_queues(xprt): +---------------------------- +**** rpc_xprt: 0xffff9275db64f000 num_reqs: 65511 +wait_queue: xprt_binding[0] cnt: 0 +wait_queue: xprt_binding[1] cnt: 0 +wait_queue: xprt_binding[2] cnt: 0 +wait_queue: xprt_binding[3] cnt: 0 +rpc_wait_queue[xprt_binding].qlen: 0 maxpriority: 0 +wait_queue: xprt_sending[0] cnt: 0 +wait_queue: xprt_sending[1] cnt: 64887 +wait_queue: xprt_sending[2] cnt: 0 +wait_queue: xprt_sending[3] cnt: 0 +rpc_wait_queue[xprt_sending].qlen: 64887 maxpriority: 3 +wait_queue: xprt_pending[0] cnt: 524 +wait_queue: xprt_pending[1] cnt: 0 +wait_queue: xprt_pending[2] cnt: 0 +wait_queue: xprt_pending[3] cnt: 0 +rpc_wait_queue[xprt_pending].qlen: 524 maxpriority: 0 +wait_queue: xprt_backlog[0] cnt: 0 +wait_queue: xprt_backlog[1] cnt: 685801 +wait_queue: xprt_backlog[2] cnt: 0 +wait_queue: xprt_backlog[3] cnt: 0 +rpc_wait_queue[xprt_backlog].qlen: 30441 maxpriority: 3 [task cnt mismatch] + +There is no effect on operations when this overflow occurs. However +it causes confusion when trying to diagnose the performance problem. + +Signed-off-by: Dai Ngo +Reviewed-by: Jeff Layton +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/sched.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h +index 2d61987b35456..0c77ba488bbae 100644 +--- a/include/linux/sunrpc/sched.h ++++ b/include/linux/sunrpc/sched.h +@@ -197,7 +197,7 @@ struct rpc_wait_queue { + unsigned char maxpriority; /* maximum priority (0 if queue is not a priority queue) */ + unsigned char priority; /* current priority */ + unsigned char nr; /* # tasks remaining for cookie */ +- unsigned short qlen; /* total # tasks waiting in queue */ ++ unsigned int qlen; /* total # tasks waiting in queue */ + struct rpc_timer timer_list; + #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) || IS_ENABLED(CONFIG_TRACEPOINTS) + const char * name; +-- +2.43.0 + diff --git a/queue-6.8/sysv-don-t-call-sb_bread-with-pointers_lock-held.patch b/queue-6.8/sysv-don-t-call-sb_bread-with-pointers_lock-held.patch new file mode 100644 index 00000000000..9c6f52a8d43 --- /dev/null +++ b/queue-6.8/sysv-don-t-call-sb_bread-with-pointers_lock-held.patch @@ -0,0 +1,94 @@ +From cc654bac7372327bd75399d7806b5ee7287f4b2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 21:04:50 +0900 +Subject: sysv: don't call sb_bread() with pointers_lock held + +From: Tetsuo Handa + +[ Upstream commit f123dc86388cb669c3d6322702dc441abc35c31e ] + +syzbot is reporting sleep in atomic context in SysV filesystem [1], for +sb_bread() is called with rw_spinlock held. + +A "write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock" bug +and a "sb_bread() with write_lock(&pointers_lock)" bug were introduced by +"Replace BKL for chain locking with sysvfs-private rwlock" in Linux 2.5.12. + +Then, "[PATCH] err1-40: sysvfs locking fix" in Linux 2.6.8 fixed the +former bug by moving pointers_lock lock to the callers, but instead +introduced a "sb_bread() with read_lock(&pointers_lock)" bug (which made +this problem easier to hit). + +Al Viro suggested that why not to do like get_branch()/get_block()/ +find_shared() in Minix filesystem does. And doing like that is almost a +revert of "[PATCH] err1-40: sysvfs locking fix" except that get_branch() + from with find_shared() is called without write_lock(&pointers_lock). + +Reported-by: syzbot +Link: https://syzkaller.appspot.com/bug?extid=69b40dc5fd40f32c199f +Suggested-by: Al Viro +Signed-off-by: Tetsuo Handa +Link: https://lore.kernel.org/r/0d195f93-a22a-49a2-0020-103534d6f7f6@I-love.SAKURA.ne.jp +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/sysv/itree.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c +index 410ab2a44d2f6..19bcb51a22036 100644 +--- a/fs/sysv/itree.c ++++ b/fs/sysv/itree.c +@@ -83,9 +83,6 @@ static inline sysv_zone_t *block_end(struct buffer_head *bh) + return (sysv_zone_t*)((char*)bh->b_data + bh->b_size); + } + +-/* +- * Requires read_lock(&pointers_lock) or write_lock(&pointers_lock) +- */ + static Indirect *get_branch(struct inode *inode, + int depth, + int offsets[], +@@ -105,15 +102,18 @@ static Indirect *get_branch(struct inode *inode, + bh = sb_bread(sb, block); + if (!bh) + goto failure; ++ read_lock(&pointers_lock); + if (!verify_chain(chain, p)) + goto changed; + add_chain(++p, bh, (sysv_zone_t*)bh->b_data + *++offsets); ++ read_unlock(&pointers_lock); + if (!p->key) + goto no_block; + } + return NULL; + + changed: ++ read_unlock(&pointers_lock); + brelse(bh); + *err = -EAGAIN; + goto no_block; +@@ -219,9 +219,7 @@ static int get_block(struct inode *inode, sector_t iblock, struct buffer_head *b + goto out; + + reread: +- read_lock(&pointers_lock); + partial = get_branch(inode, depth, offsets, chain, &err); +- read_unlock(&pointers_lock); + + /* Simplest case - block found, no allocation needed */ + if (!partial) { +@@ -291,9 +289,9 @@ static Indirect *find_shared(struct inode *inode, + *top = 0; + for (k = depth; k > 1 && !offsets[k-1]; k--) + ; ++ partial = get_branch(inode, k, offsets, chain, &err); + + write_lock(&pointers_lock); +- partial = get_branch(inode, k, offsets, chain, &err); + if (!partial) + partial = chain + k-1; + /* +-- +2.43.0 + diff --git a/queue-6.8/thermal-of-assume-polling-delay-passive-0-when-absen.patch b/queue-6.8/thermal-of-assume-polling-delay-passive-0-when-absen.patch new file mode 100644 index 00000000000..23907f4aaf4 --- /dev/null +++ b/queue-6.8/thermal-of-assume-polling-delay-passive-0-when-absen.patch @@ -0,0 +1,56 @@ +From 9f23779736c74ff3dbdcccf12b30b50a83ef2a12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 13:11:16 +0100 +Subject: thermal/of: Assume polling-delay(-passive) 0 when absent + +From: Konrad Dybcio + +[ Upstream commit 488164006a281986d95abbc4b26e340c19c4c85b ] + +Currently, thermal zones associated with providers that have interrupts +for signaling hot/critical trips are required to set a polling-delay +of 0 to indicate no polling. This feels a bit backwards. + +Change the code such that "no polling delay" also means "no polling". + +Suggested-by: Bjorn Andersson +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Bjorn Andersson +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20240125-topic-thermal-v1-2-3c9d4dced138@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal_of.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c +index 4d6c22e0ed85b..61bbd42aa2cb4 100644 +--- a/drivers/thermal/thermal_of.c ++++ b/drivers/thermal/thermal_of.c +@@ -225,14 +225,18 @@ static int thermal_of_monitor_init(struct device_node *np, int *delay, int *pdel + int ret; + + ret = of_property_read_u32(np, "polling-delay-passive", pdelay); +- if (ret < 0) { +- pr_err("%pOFn: missing polling-delay-passive property\n", np); ++ if (ret == -EINVAL) { ++ *pdelay = 0; ++ } else if (ret < 0) { ++ pr_err("%pOFn: Couldn't get polling-delay-passive: %d\n", np, ret); + return ret; + } + + ret = of_property_read_u32(np, "polling-delay", delay); +- if (ret < 0) { +- pr_err("%pOFn: missing polling-delay property\n", np); ++ if (ret == -EINVAL) { ++ *delay = 0; ++ } else if (ret < 0) { ++ pr_err("%pOFn: Couldn't get polling-delay: %d\n", np, ret); + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.8/thunderbolt-calculate-displayport-tunnel-bandwidth-a.patch b/queue-6.8/thunderbolt-calculate-displayport-tunnel-bandwidth-a.patch new file mode 100644 index 00000000000..09833471e83 --- /dev/null +++ b/queue-6.8/thunderbolt-calculate-displayport-tunnel-bandwidth-a.patch @@ -0,0 +1,55 @@ +From 2c1fb148d887501f7ed62c55c164d571a44a33c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 15:56:42 +0200 +Subject: thunderbolt: Calculate DisplayPort tunnel bandwidth after DPRX + capabilities read + +From: Gil Fine + +[ Upstream commit ccd845021147dc8257a05ed8f5a7f9c61a9101e3 ] + +According to USB4 Connection Manager guide, after DisplayPort tunnel was +setup, the DPRX capabilities read is performed by the DPTX. According to +VESA spec, this shall be completed within 5 seconds after the DisplayPort +tunnel was setup. Hence, if the bit: DPRX Capabilities Read Done, was +not set to '1' by this time, we timeout and fail calculating DisplayPort +tunnel consumed bandwidth. + +Signed-off-by: Gil Fine +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/tunnel.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c +index 6fffb2c82d3d1..4f09216b70f90 100644 +--- a/drivers/thunderbolt/tunnel.c ++++ b/drivers/thunderbolt/tunnel.c +@@ -1196,17 +1196,13 @@ static int tb_dp_consumed_bandwidth(struct tb_tunnel *tunnel, int *consumed_up, + /* + * Then see if the DPRX negotiation is ready and if yes + * return that bandwidth (it may be smaller than the +- * reduced one). Otherwise return the remote (possibly +- * reduced) caps. ++ * reduced one). According to VESA spec, the DPRX ++ * negotiation shall compete in 5 seconds after tunnel ++ * established. We give it 100ms extra just in case. + */ +- ret = tb_dp_wait_dprx(tunnel, 150); +- if (ret) { +- if (ret == -ETIMEDOUT) +- ret = tb_dp_read_cap(tunnel, DP_REMOTE_CAP, +- &rate, &lanes); +- if (ret) +- return ret; +- } ++ ret = tb_dp_wait_dprx(tunnel, 5100); ++ if (ret) ++ return ret; + ret = tb_dp_read_cap(tunnel, DP_COMMON_CAP, &rate, &lanes); + if (ret) + return ret; +-- +2.43.0 + diff --git a/queue-6.8/thunderbolt-keep-the-domain-powered-when-usb4-port-i.patch b/queue-6.8/thunderbolt-keep-the-domain-powered-when-usb4-port-i.patch new file mode 100644 index 00000000000..db08a6f55c5 --- /dev/null +++ b/queue-6.8/thunderbolt-keep-the-domain-powered-when-usb4-port-i.patch @@ -0,0 +1,167 @@ +From 7b38cc3e1fac59216f092309acb81ff68c4cc044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 15:55:55 +0200 +Subject: thunderbolt: Keep the domain powered when USB4 port is in redrive + mode + +From: Mika Westerberg + +[ Upstream commit a75e0684efe567ae5f6a8e91a8360c4c1773cf3a ] + +If a DiplayPort cable is directly connected to the host routers USB4 +port, there is no tunnel involved but the port is in "redrive" mode +meaning that it is re-driving the DisplayPort signals from its +DisplayPort source. In this case we need to keep the domain powered on +otherwise once the domain enters D3cold the connected monitor blanks +too. + +Since this happens only on Intel Barlow Ridge add a quirk that takes +runtime PM reference if we detect that the USB4 port entered redrive +mode (and release it once it exits the mode). + +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/quirks.c | 14 +++++++++++ + drivers/thunderbolt/tb.c | 49 +++++++++++++++++++++++++++++++++++- + drivers/thunderbolt/tb.h | 4 +++ + 3 files changed, 66 insertions(+), 1 deletion(-) + +diff --git a/drivers/thunderbolt/quirks.c b/drivers/thunderbolt/quirks.c +index e6bfa63b40aee..e81de9c30eac9 100644 +--- a/drivers/thunderbolt/quirks.c ++++ b/drivers/thunderbolt/quirks.c +@@ -43,6 +43,12 @@ static void quirk_usb3_maximum_bandwidth(struct tb_switch *sw) + } + } + ++static void quirk_block_rpm_in_redrive(struct tb_switch *sw) ++{ ++ sw->quirks |= QUIRK_KEEP_POWER_IN_DP_REDRIVE; ++ tb_sw_dbg(sw, "preventing runtime PM in DP redrive mode\n"); ++} ++ + struct tb_quirk { + u16 hw_vendor_id; + u16 hw_device_id; +@@ -86,6 +92,14 @@ static const struct tb_quirk tb_quirks[] = { + quirk_usb3_maximum_bandwidth }, + { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE, 0x0000, 0x0000, + quirk_usb3_maximum_bandwidth }, ++ /* ++ * Block Runtime PM in DP redrive mode for Intel Barlow Ridge host ++ * controllers. ++ */ ++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI, 0x0000, 0x0000, ++ quirk_block_rpm_in_redrive }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI, 0x0000, 0x0000, ++ quirk_block_rpm_in_redrive }, + /* + * CLx is not supported on AMD USB4 Yellow Carp and Pink Sardine platforms. + */ +diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c +index 846d2813bb1a5..e6681f153c69d 100644 +--- a/drivers/thunderbolt/tb.c ++++ b/drivers/thunderbolt/tb.c +@@ -1887,6 +1887,49 @@ static void tb_tunnel_dp(struct tb *tb) + ; + } + ++static void tb_enter_redrive(struct tb_port *port) ++{ ++ struct tb_switch *sw = port->sw; ++ ++ if (!(sw->quirks & QUIRK_KEEP_POWER_IN_DP_REDRIVE)) ++ return; ++ ++ /* ++ * If we get hot-unplug for the DP IN port of the host router ++ * and the DP resource is not available anymore it means there ++ * is a monitor connected directly to the Type-C port and we are ++ * in "redrive" mode. For this to work we cannot enter RTD3 so ++ * we bump up the runtime PM reference count here. ++ */ ++ if (!tb_port_is_dpin(port)) ++ return; ++ if (tb_route(sw)) ++ return; ++ if (!tb_switch_query_dp_resource(sw, port)) { ++ port->redrive = true; ++ pm_runtime_get(&sw->dev); ++ tb_port_dbg(port, "enter redrive mode, keeping powered\n"); ++ } ++} ++ ++static void tb_exit_redrive(struct tb_port *port) ++{ ++ struct tb_switch *sw = port->sw; ++ ++ if (!(sw->quirks & QUIRK_KEEP_POWER_IN_DP_REDRIVE)) ++ return; ++ ++ if (!tb_port_is_dpin(port)) ++ return; ++ if (tb_route(sw)) ++ return; ++ if (port->redrive && tb_switch_query_dp_resource(sw, port)) { ++ port->redrive = false; ++ pm_runtime_put(&sw->dev); ++ tb_port_dbg(port, "exit redrive mode\n"); ++ } ++} ++ + static void tb_dp_resource_unavailable(struct tb *tb, struct tb_port *port) + { + struct tb_port *in, *out; +@@ -1903,7 +1946,10 @@ static void tb_dp_resource_unavailable(struct tb *tb, struct tb_port *port) + } + + tunnel = tb_find_tunnel(tb, TB_TUNNEL_DP, in, out); +- tb_deactivate_and_free_tunnel(tunnel); ++ if (tunnel) ++ tb_deactivate_and_free_tunnel(tunnel); ++ else ++ tb_enter_redrive(port); + list_del_init(&port->list); + + /* +@@ -1930,6 +1976,7 @@ static void tb_dp_resource_available(struct tb *tb, struct tb_port *port) + tb_port_dbg(port, "DP %s resource available after hotplug\n", + tb_port_is_dpin(port) ? "IN" : "OUT"); + list_add_tail(&port->list, &tcm->dp_resources); ++ tb_exit_redrive(port); + + /* Look for suitable DP IN <-> DP OUT pairs now */ + tb_tunnel_dp(tb); +diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h +index 997c5a5369052..e4d4effb94447 100644 +--- a/drivers/thunderbolt/tb.h ++++ b/drivers/thunderbolt/tb.h +@@ -23,6 +23,8 @@ + #define QUIRK_FORCE_POWER_LINK_CONTROLLER BIT(0) + /* Disable CLx if not supported */ + #define QUIRK_NO_CLX BIT(1) ++/* Need to keep power on while USB4 port is in redrive mode */ ++#define QUIRK_KEEP_POWER_IN_DP_REDRIVE BIT(2) + + /** + * struct tb_nvm - Structure holding NVM information +@@ -258,6 +260,7 @@ struct tb_bandwidth_group { + * @group_list: The adapter is linked to the group's list of ports through this + * @max_bw: Maximum possible bandwidth through this adapter if set to + * non-zero. ++ * @redrive: For DP IN, if true the adapter is in redrive mode. + * + * In USB4 terminology this structure represents an adapter (protocol or + * lane adapter). +@@ -286,6 +289,7 @@ struct tb_port { + struct tb_bandwidth_group *group; + struct list_head group_list; + unsigned int max_bw; ++ bool redrive; + }; + + /** +-- +2.43.0 + diff --git a/queue-6.8/tools-iio-replace-seekdir-in-iio_generic_buffer.patch b/queue-6.8/tools-iio-replace-seekdir-in-iio_generic_buffer.patch new file mode 100644 index 00000000000..1e8b4c2813c --- /dev/null +++ b/queue-6.8/tools-iio-replace-seekdir-in-iio_generic_buffer.patch @@ -0,0 +1,45 @@ +From f35cb5eb490325ca6fe8bbf474341472dedfbe55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 12:32:20 +0200 +Subject: tools: iio: replace seekdir() in iio_generic_buffer + +From: Petre Rodan + +[ Upstream commit 4e6500bfa053dc133021f9c144261b77b0ba7dc8 ] + +Replace seekdir() with rewinddir() in order to fix a localized glibc bug. + +One of the glibc patches that stable Gentoo is using causes an improper +directory stream positioning bug on 32bit arm. That in turn ends up as a +floating point exception in iio_generic_buffer. + +The attached patch provides a fix by using an equivalent function which +should not cause trouble for other distros and is easier to reason about +in general as it obviously always goes back to to the start. + +https://sourceware.org/bugzilla/show_bug.cgi?id=31212 + +Signed-off-by: Petre Rodan +Link: https://lore.kernel.org/r/20240108103224.3986-1-petre.rodan@subdimension.ro +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + tools/iio/iio_utils.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/iio/iio_utils.c b/tools/iio/iio_utils.c +index 6a00a6eecaef0..c5c5082cb24e5 100644 +--- a/tools/iio/iio_utils.c ++++ b/tools/iio/iio_utils.c +@@ -376,7 +376,7 @@ int build_channel_array(const char *device_dir, int buffer_idx, + goto error_close_dir; + } + +- seekdir(dp, 0); ++ rewinddir(dp); + while (ent = readdir(dp), ent) { + if (strcmp(ent->d_name + strlen(ent->d_name) - strlen("_en"), + "_en") == 0) { +-- +2.43.0 + diff --git a/queue-6.8/tools-power-x86_energy_perf_policy-fix-file-leak-in-.patch b/queue-6.8/tools-power-x86_energy_perf_policy-fix-file-leak-in-.patch new file mode 100644 index 00000000000..a06c8a8f17b --- /dev/null +++ b/queue-6.8/tools-power-x86_energy_perf_policy-fix-file-leak-in-.patch @@ -0,0 +1,35 @@ +From 3222b9715511bce1b1770470d2174f7f18acba55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 16:19:56 -0800 +Subject: tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() + +From: Samasth Norway Ananda + +[ Upstream commit f85450f134f0b4ca7e042dc3dc89155656a2299d ] + +In function get_pkg_num() if fopen_or_die() succeeds it returns a file +pointer to be used. But fclose() is never called before returning from +the function. + +Signed-off-by: Samasth Norway Ananda +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +index 5fd9e594079cf..ebda9c366b2ba 100644 +--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c ++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +@@ -1241,6 +1241,7 @@ unsigned int get_pkg_num(int cpu) + retval = fscanf(fp, "%d\n", &pkg); + if (retval != 1) + errx(1, "%s: failed to parse", pathname); ++ fclose(fp); + return pkg; + } + +-- +2.43.0 + diff --git a/queue-6.8/usb-gadget-uvc-mark-incomplete-frames-with-uvc_strea.patch b/queue-6.8/usb-gadget-uvc-mark-incomplete-frames-with-uvc_strea.patch new file mode 100644 index 00000000000..05d484120fb --- /dev/null +++ b/queue-6.8/usb-gadget-uvc-mark-incomplete-frames-with-uvc_strea.patch @@ -0,0 +1,39 @@ +From 5338c9b55a9d3a38edad8bec1864a055b30dba6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 00:37:55 +0100 +Subject: usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR + +From: Michael Grzeschik + +[ Upstream commit 2a3b7af120477d0571b815ccb8600cafd5ebf02f ] + +If an frame was transmitted incomplete to the host, we set the +UVC_STREAM_ERR bit in the header for the last request that is going +to be queued. This way the host will know that it should drop the +frame instead of trying to display the corrupted content. + +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20240214-uvc-error-tag-v1-2-37659a3877fe@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index dbdd9033c1268..53e4cd81ea446 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -35,6 +35,9 @@ uvc_video_encode_header(struct uvc_video *video, struct uvc_buffer *buf, + + data[1] = UVC_STREAM_EOH | video->fid; + ++ if (video->queue.flags & UVC_QUEUE_DROP_INCOMPLETE) ++ data[1] |= UVC_STREAM_ERR; ++ + if (video->queue.buf_used == 0 && ts.tv_sec) { + /* dwClockFrequency is 48 MHz */ + u32 pts = ((u64)ts.tv_sec * USEC_PER_SEC + ts.tv_nsec / NSEC_PER_USEC) * 48; +-- +2.43.0 + diff --git a/queue-6.8/usb-gadget-uvc-refactor-the-check-for-a-valid-buffer.patch b/queue-6.8/usb-gadget-uvc-refactor-the-check-for-a-valid-buffer.patch new file mode 100644 index 00000000000..032de695bfd --- /dev/null +++ b/queue-6.8/usb-gadget-uvc-refactor-the-check-for-a-valid-buffer.patch @@ -0,0 +1,49 @@ +From 78bda636d615863327acd47b6c3747da513d79c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 00:28:01 +0100 +Subject: usb: gadget: uvc: refactor the check for a valid buffer in the pump + worker + +From: Michael Grzeschik + +[ Upstream commit 5e7ea65daf13a95a6cc63d1377e4c500e4e1340f ] + +By toggling the condition check for a valid buffer, the else path +can be completely avoided. + +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20240214-uvc-gadget-cleanup-v1-2-de6d78780459@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index dd3241fc6939d..dbdd9033c1268 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -594,10 +594,7 @@ static void uvcg_video_pump(struct work_struct *work) + */ + spin_lock_irqsave(&queue->irqlock, flags); + buf = uvcg_queue_head(queue); +- +- if (buf != NULL) { +- video->encode(req, video, buf); +- } else { ++ if (!buf) { + /* + * Either the queue has been disconnected or no video buffer + * available for bulk transfer. Either way, stop processing +@@ -607,6 +604,8 @@ static void uvcg_video_pump(struct work_struct *work) + break; + } + ++ video->encode(req, video, buf); ++ + spin_unlock_irqrestore(&queue->irqlock, flags); + + spin_lock_irqsave(&video->req_lock, flags); +-- +2.43.0 + diff --git a/queue-6.8/usb-sl811-hcd-only-defined-function-checkdone-if-qui.patch b/queue-6.8/usb-sl811-hcd-only-defined-function-checkdone-if-qui.patch new file mode 100644 index 00000000000..4e02dd61389 --- /dev/null +++ b/queue-6.8/usb-sl811-hcd-only-defined-function-checkdone-if-qui.patch @@ -0,0 +1,47 @@ +From 7d694f2e194149a8ab4f21f1dd0492a701c48b7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 11:13:51 +0000 +Subject: usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined + +From: Colin Ian King + +[ Upstream commit 12f371e2b6cb4b79c788f1f073992e115f4ca918 ] + +Function checkdone is only required if QUIRK2 is defined, so add +appropriate #if / #endif around the function. + +Cleans up clang scan build warning: +drivers/usb/host/sl811-hcd.c:588:18: warning: unused function +'checkdone' [-Wunused-function] + +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20240307111351.1982382-1-colin.i.king@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/sl811-hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c +index 0956495bba575..2b871540bb500 100644 +--- a/drivers/usb/host/sl811-hcd.c ++++ b/drivers/usb/host/sl811-hcd.c +@@ -585,6 +585,7 @@ done(struct sl811 *sl811, struct sl811h_ep *ep, u8 bank) + finish_request(sl811, ep, urb, urbstat); + } + ++#ifdef QUIRK2 + static inline u8 checkdone(struct sl811 *sl811) + { + u8 ctl; +@@ -616,6 +617,7 @@ static inline u8 checkdone(struct sl811 *sl811) + #endif + return irqstat; + } ++#endif + + static irqreturn_t sl811h_irq(struct usb_hcd *hcd) + { +-- +2.43.0 + diff --git a/queue-6.8/usb-typec-tcpci-add-generic-tcpci-fallback-compatibl.patch b/queue-6.8/usb-typec-tcpci-add-generic-tcpci-fallback-compatibl.patch new file mode 100644 index 00000000000..467eaaeb1f4 --- /dev/null +++ b/queue-6.8/usb-typec-tcpci-add-generic-tcpci-fallback-compatibl.patch @@ -0,0 +1,36 @@ +From 358761707169d90b8257c20ebddcd299be3780ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 22:09:01 +0100 +Subject: usb: typec: tcpci: add generic tcpci fallback compatible + +From: Marco Felsch + +[ Upstream commit 8774ea7a553e2aec323170d49365b59af0a2b7e0 ] + +The driver already support the tcpci binding for the i2c_device_id so +add the support for the of_device_id too. + +Signed-off-by: Marco Felsch +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20240222210903.208901-3-m.felsch@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/tcpm/tcpci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c +index 0ee3e6e29bb17..7118551827f6a 100644 +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -889,6 +889,7 @@ MODULE_DEVICE_TABLE(i2c, tcpci_id); + #ifdef CONFIG_OF + static const struct of_device_id tcpci_of_match[] = { + { .compatible = "nxp,ptn5110", }, ++ { .compatible = "tcpci", }, + {}, + }; + MODULE_DEVICE_TABLE(of, tcpci_of_match); +-- +2.43.0 + diff --git a/queue-6.8/usb-typec-ucsi-add-qcm6490-pmic-glink-as-needing-pdo.patch b/queue-6.8/usb-typec-ucsi-add-qcm6490-pmic-glink-as-needing-pdo.patch new file mode 100644 index 00000000000..89f0083505a --- /dev/null +++ b/queue-6.8/usb-typec-ucsi-add-qcm6490-pmic-glink-as-needing-pdo.patch @@ -0,0 +1,37 @@ +From 0c42c8af484cc1fa0dcae6b5855c84177a4d9a11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 10:52:33 +0100 +Subject: usb: typec: ucsi: Add qcm6490-pmic-glink as needing PDOS quirk + +From: Luca Weiss + +[ Upstream commit 88bae831f3810e02c9c951233c7ee662aa13dc2c ] + +The QCM6490 Linux Android firmware needs this workaround as well. Add it +to the list. + +Acked-by: Heikki Krogerus +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20240208-fp5-pmic-glink-v2-2-4837d4abd5a4@fairphone.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi_glink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/typec/ucsi/ucsi_glink.c b/drivers/usb/typec/ucsi/ucsi_glink.c +index 5d098e71f1bb7..ce08eb33e5bec 100644 +--- a/drivers/usb/typec/ucsi/ucsi_glink.c ++++ b/drivers/usb/typec/ucsi/ucsi_glink.c +@@ -312,6 +312,7 @@ static void pmic_glink_ucsi_destroy(void *data) + } + + static const struct of_device_id pmic_glink_ucsi_of_quirks[] = { ++ { .compatible = "qcom,qcm6490-pmic-glink", .data = (void *)UCSI_NO_PARTNER_PDOS, }, + { .compatible = "qcom,sc8180x-pmic-glink", .data = (void *)UCSI_NO_PARTNER_PDOS, }, + { .compatible = "qcom,sc8280xp-pmic-glink", .data = (void *)UCSI_NO_PARTNER_PDOS, }, + { .compatible = "qcom,sm8350-pmic-glink", .data = (void *)UCSI_NO_PARTNER_PDOS, }, +-- +2.43.0 + diff --git a/queue-6.8/usb-typec-ucsi-limit-read-size-on-v1.2.patch b/queue-6.8/usb-typec-ucsi-limit-read-size-on-v1.2.patch new file mode 100644 index 00000000000..be7e3209a8e --- /dev/null +++ b/queue-6.8/usb-typec-ucsi-limit-read-size-on-v1.2.patch @@ -0,0 +1,109 @@ +From 2c385038ee64a37b1f621991c95e09911ff45716 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 14:37:30 -0800 +Subject: usb: typec: ucsi: Limit read size on v1.2 + +From: Abhishek Pandit-Subedi + +[ Upstream commit b3db266fb031fba88c423d4bb8983a73a3db6527 ] + +Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was +increased from 16 to 256. In order to avoid overflowing reads for older +systems, add a mechanism to use the read UCSI version to truncate read +sizes on UCSI v1.2. + +Tested-by: Neil Armstrong +Reviewed-by: Prashant Malani +Reviewed-by: Heikki Krogerus +Signed-off-by: Abhishek Pandit-Subedi +Link: https://lore.kernel.org/r/20240209143723.v5.1.Iacf5570a66b82b73ef03daa6557e2fc0db10266a@changeid +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 26 ++++++++++++++++++++++++-- + drivers/usb/typec/ucsi/ucsi.h | 11 +++++++++++ + 2 files changed, 35 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 0bfe5e906e543..cd415565b60a1 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -36,6 +36,19 @@ + */ + #define UCSI_SWAP_TIMEOUT_MS 5000 + ++static int ucsi_read_message_in(struct ucsi *ucsi, void *buf, ++ size_t buf_size) ++{ ++ /* ++ * Below UCSI 2.0, MESSAGE_IN was limited to 16 bytes. Truncate the ++ * reads here. ++ */ ++ if (ucsi->version <= UCSI_VERSION_1_2) ++ buf_size = clamp(buf_size, 0, 16); ++ ++ return ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, buf, buf_size); ++} ++ + static int ucsi_acknowledge_command(struct ucsi *ucsi) + { + u64 ctrl; +@@ -72,7 +85,7 @@ static int ucsi_read_error(struct ucsi *ucsi) + if (ret < 0) + return ret; + +- ret = ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, &error, sizeof(error)); ++ ret = ucsi_read_message_in(ucsi, &error, sizeof(error)); + if (ret) + return ret; + +@@ -174,7 +187,7 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command, + length = ret; + + if (data) { +- ret = ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, data, size); ++ ret = ucsi_read_message_in(ucsi, data, size); + if (ret) + goto out; + } +@@ -1596,6 +1609,15 @@ int ucsi_register(struct ucsi *ucsi) + if (!ucsi->version) + return -ENODEV; + ++ /* ++ * Version format is JJ.M.N (JJ = Major version, M = Minor version, ++ * N = sub-minor version). ++ */ ++ dev_dbg(ucsi->dev, "Registered UCSI interface with version %x.%x.%x", ++ UCSI_BCD_GET_MAJOR(ucsi->version), ++ UCSI_BCD_GET_MINOR(ucsi->version), ++ UCSI_BCD_GET_SUBMINOR(ucsi->version)); ++ + queue_delayed_work(system_long_wq, &ucsi->work, 0); + + ucsi_debugfs_register(ucsi); +diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h +index 4550f3e8cfe9c..ede9876488564 100644 +--- a/drivers/usb/typec/ucsi/ucsi.h ++++ b/drivers/usb/typec/ucsi/ucsi.h +@@ -23,6 +23,17 @@ struct dentry; + #define UCSI_CONTROL 8 + #define UCSI_MESSAGE_IN 16 + #define UCSI_MESSAGE_OUT 32 ++#define UCSIv2_MESSAGE_OUT 272 ++ ++/* UCSI versions */ ++#define UCSI_VERSION_1_2 0x0120 ++#define UCSI_VERSION_2_0 0x0200 ++#define UCSI_VERSION_2_1 0x0210 ++#define UCSI_VERSION_3_0 0x0300 ++ ++#define UCSI_BCD_GET_MAJOR(_v_) (((_v_) >> 8) & 0xFF) ++#define UCSI_BCD_GET_MINOR(_v_) (((_v_) >> 4) & 0x0F) ++#define UCSI_BCD_GET_SUBMINOR(_v_) ((_v_) & 0x0F) + + /* Command Status and Connector Change Indication (CCI) bits */ + #define UCSI_CCI_CONNECTOR(_c_) (((_c_) & GENMASK(7, 1)) >> 1) +-- +2.43.0 + diff --git a/queue-6.8/vmci-fix-memcpy-run-time-warning-in-dg_dispatch_as_h.patch b/queue-6.8/vmci-fix-memcpy-run-time-warning-in-dg_dispatch_as_h.patch new file mode 100644 index 00000000000..6839fdf5418 --- /dev/null +++ b/queue-6.8/vmci-fix-memcpy-run-time-warning-in-dg_dispatch_as_h.patch @@ -0,0 +1,80 @@ +From 7279cf06725cf61c6e27be5556c315258b08dcbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 08:40:00 -0800 +Subject: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() + +From: Harshit Mogalapalli + +[ Upstream commit 19b070fefd0d024af3daa7329cbc0d00de5302ec ] + +Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. + +memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg" +at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24) + +WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237 +dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237 + +Some code commentry, based on my understanding: + +544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size) +/// This is 24 + payload_size + +memcpy(&dg_info->msg, dg, dg_size); + Destination = dg_info->msg ---> this is a 24 byte + structure(struct vmci_datagram) + Source = dg --> this is a 24 byte structure (struct vmci_datagram) + Size = dg_size = 24 + payload_size + +{payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32. + + 35 struct delayed_datagram_info { + 36 struct datagram_entry *entry; + 37 struct work_struct work; + 38 bool in_dg_host_queue; + 39 /* msg and msg_payload must be together. */ + 40 struct vmci_datagram msg; + 41 u8 msg_payload[]; + 42 }; + +So those extra bytes of payload are copied into msg_payload[], a run time +warning is seen while fuzzing with Syzkaller. + +One possible way to fix the warning is to split the memcpy() into +two parts -- one -- direct assignment of msg and second taking care of payload. + +Gustavo quoted: +"Under FORTIFY_SOURCE we should not copy data across multiple members +in a structure." + +Reported-by: syzkaller +Suggested-by: Vegard Nossum +Suggested-by: Gustavo A. R. Silva +Signed-off-by: Harshit Mogalapalli +Reviewed-by: Gustavo A. R. Silva +Reviewed-by: Kees Cook +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240105164001.2129796-2-harshit.m.mogalapalli@oracle.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + drivers/misc/vmw_vmci/vmci_datagram.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/vmw_vmci/vmci_datagram.c b/drivers/misc/vmw_vmci/vmci_datagram.c +index f50d22882476f..d1d8224c8800c 100644 +--- a/drivers/misc/vmw_vmci/vmci_datagram.c ++++ b/drivers/misc/vmw_vmci/vmci_datagram.c +@@ -234,7 +234,8 @@ static int dg_dispatch_as_host(u32 context_id, struct vmci_datagram *dg) + + dg_info->in_dg_host_queue = true; + dg_info->entry = dst_entry; +- memcpy(&dg_info->msg, dg, dg_size); ++ dg_info->msg = *dg; ++ memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size); + + INIT_WORK(&dg_info->work, dg_delayed_dispatch); + schedule_work(&dg_info->work); +-- +2.43.0 + diff --git a/queue-6.8/wifi-ath11k-decrease-mhi-channel-buffer-length-to-8k.patch b/queue-6.8/wifi-ath11k-decrease-mhi-channel-buffer-length-to-8k.patch new file mode 100644 index 00000000000..c0237a481f1 --- /dev/null +++ b/queue-6.8/wifi-ath11k-decrease-mhi-channel-buffer-length-to-8k.patch @@ -0,0 +1,92 @@ +From c5dfa9d8eb57dfb1c823107fb339d792d1e75fdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 13:31:11 +0800 +Subject: wifi: ath11k: decrease MHI channel buffer length to 8KB + +From: Baochen Qiang + +[ Upstream commit 1cca1bddf9ef080503c15378cecf4877f7510015 ] + +Currently buf_len field of ath11k_mhi_config_qca6390 is assigned +with 0, making MHI use a default size, 64KB, to allocate channel +buffers. This is likely to fail in some scenarios where system +memory is highly fragmented and memory compaction or reclaim is +not allowed. + +There is a fail report which is caused by it: +kworker/u32:45: page allocation failure: order:4, mode:0x40c00(GFP_NOIO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 +CPU: 0 PID: 19318 Comm: kworker/u32:45 Not tainted 6.8.0-rc3-1.gae4495f-default #1 openSUSE Tumbleweed (unreleased) 493b6d5b382c603654d7a81fc3c144d59a1dfceb +Workqueue: events_unbound async_run_entry_fn +Call Trace: + + dump_stack_lvl+0x47/0x60 + warn_alloc+0x13a/0x1b0 + ? srso_alias_return_thunk+0x5/0xfbef5 + ? __alloc_pages_direct_compact+0xab/0x210 + __alloc_pages_slowpath.constprop.0+0xd3e/0xda0 + __alloc_pages+0x32d/0x350 + ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] + __kmalloc_large_node+0x72/0x110 + __kmalloc+0x37c/0x480 + ? mhi_map_single_no_bb+0x77/0xf0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] + ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] + mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] + __mhi_prepare_for_transfer+0x44/0x80 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] + ? __pfx_____mhi_prepare_for_transfer+0x10/0x10 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] + device_for_each_child+0x5c/0xa0 + ? __pfx_pci_pm_resume+0x10/0x10 + ath11k_core_resume+0x65/0x100 [ath11k a5094e22d7223135c40d93c8f5321cf09fd85e4e] + ? srso_alias_return_thunk+0x5/0xfbef5 + ath11k_pci_pm_resume+0x32/0x60 [ath11k_pci 830b7bfc3ea80ebef32e563cafe2cb55e9cc73ec] + ? srso_alias_return_thunk+0x5/0xfbef5 + dpm_run_callback+0x8c/0x1e0 + device_resume+0x104/0x340 + ? __pfx_dpm_watchdog_handler+0x10/0x10 + async_resume+0x1d/0x30 + async_run_entry_fn+0x32/0x120 + process_one_work+0x168/0x330 + worker_thread+0x2f5/0x410 + ? __pfx_worker_thread+0x10/0x10 + kthread+0xe8/0x120 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x34/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + + +Actually those buffers are used only by QMI target -> host communication. +And for WCN6855 and QCA6390, the largest packet size for that is less +than 6KB. So change buf_len field to 8KB, which results in order 1 +allocation if page size is 4KB. In this way, we can at least save some +memory, and as well as decrease the possibility of allocation failure +in those scenarios. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 + +Reported-by: Vlastimil Babka +Closes: https://lore.kernel.org/ath11k/96481a45-3547-4d23-ad34-3a8f1d90c1cd@suse.cz/ +Signed-off-by: Baochen Qiang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240223053111.29170-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mhi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mhi.c b/drivers/net/wireless/ath/ath11k/mhi.c +index 6835c14b82cc9..337590236485f 100644 +--- a/drivers/net/wireless/ath/ath11k/mhi.c ++++ b/drivers/net/wireless/ath/ath11k/mhi.c +@@ -106,7 +106,7 @@ static struct mhi_controller_config ath11k_mhi_config_qca6390 = { + .max_channels = 128, + .timeout_ms = 2000, + .use_bounce_buf = false, +- .buf_len = 0, ++ .buf_len = 8192, + .num_channels = ARRAY_SIZE(ath11k_mhi_channels_qca6390), + .ch_cfg = ath11k_mhi_channels_qca6390, + .num_events = ARRAY_SIZE(ath11k_mhi_events_qca6390), +-- +2.43.0 + diff --git a/queue-6.8/wifi-ath9k-fix-lna-selection-in-ath_ant_try_scan.patch b/queue-6.8/wifi-ath9k-fix-lna-selection-in-ath_ant_try_scan.patch new file mode 100644 index 00000000000..01c0289f780 --- /dev/null +++ b/queue-6.8/wifi-ath9k-fix-lna-selection-in-ath_ant_try_scan.patch @@ -0,0 +1,43 @@ +From 3011b53519376b3a47b9a837b4295f03a25bf7fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Dec 2023 13:29:03 +0200 +Subject: wifi: ath9k: fix LNA selection in ath_ant_try_scan() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Antipov + +[ Upstream commit d6b27eb997ef9a2aa51633b3111bc4a04748e6d3 ] + +In 'ath_ant_try_scan()', (most likely) the 2nd LNA's signal +strength should be used in comparison against RSSI when +selecting first LNA as the main one. Compile tested only. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Dmitry Antipov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231211172502.25202-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/antenna.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/antenna.c b/drivers/net/wireless/ath/ath9k/antenna.c +index 988222cea9dfe..acc84e6711b0e 100644 +--- a/drivers/net/wireless/ath/ath9k/antenna.c ++++ b/drivers/net/wireless/ath/ath9k/antenna.c +@@ -643,7 +643,7 @@ static void ath_ant_try_scan(struct ath_ant_comb *antcomb, + conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1; + conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2; + } else if (antcomb->rssi_sub > +- antcomb->rssi_lna1) { ++ antcomb->rssi_lna2) { + /* set to A-B */ + conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1; + conf->alt_lna_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2; +-- +2.43.0 + diff --git a/queue-6.8/wifi-brcmfmac-add-dmi-nvram-filename-quirk-for-acepc.patch b/queue-6.8/wifi-brcmfmac-add-dmi-nvram-filename-quirk-for-acepc.patch new file mode 100644 index 00000000000..c06a78d9c82 --- /dev/null +++ b/queue-6.8/wifi-brcmfmac-add-dmi-nvram-filename-quirk-for-acepc.patch @@ -0,0 +1,50 @@ +From e5fbf728bef46c5522459da25470a8f27dee87a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 22:36:49 +0100 +Subject: wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro + +From: Hans de Goede + +[ Upstream commit 32167707aa5e7ae4b160c18be79d85a7b4fdfcfb ] + +The ACEPC W5 Pro HDMI stick contains quite generic names in the sys_vendor +and product_name DMI strings, without this patch brcmfmac will try to load: +"brcmfmac43455-sdio.$(DEFAULT_STRING)-$(DEFAULT_STRING).txt" as nvram file +which is both too generic and messy with the $ symbols in the name. + +The ACEPC W5 Pro uses the same Ampak AP6255 module as the ACEPC T8 +and the nvram for the T8 is already in linux-firmware, so point the new +DMI nvram filename quirk to the T8 nvram file. + +Signed-off-by: Hans de Goede +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240216213649.251718-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +index 86ff174936a9a..c3a602197662b 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +@@ -82,6 +82,15 @@ static const struct dmi_system_id dmi_platform_data[] = { + }, + .driver_data = (void *)&acepc_t8_data, + }, ++ { ++ /* ACEPC W5 Pro Cherry Trail Z8350 HDMI stick, same wifi as the T8 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "T3 MRD"), ++ DMI_MATCH(DMI_CHASSIS_TYPE, "3"), ++ DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."), ++ }, ++ .driver_data = (void *)&acepc_t8_data, ++ }, + { + /* Chuwi Hi8 Pro with D2D3_Hi8Pro.233 BIOS */ + .matches = { +-- +2.43.0 + diff --git a/queue-6.8/wifi-cfg80211-check-a-msdu-format-more-carefully.patch b/queue-6.8/wifi-cfg80211-check-a-msdu-format-more-carefully.patch new file mode 100644 index 00000000000..e59a06c9b1c --- /dev/null +++ b/queue-6.8/wifi-cfg80211-check-a-msdu-format-more-carefully.patch @@ -0,0 +1,91 @@ +From 30198bcfdfc6260770382508b26aa86b174d1b15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 20:34:06 +0100 +Subject: wifi: cfg80211: check A-MSDU format more carefully + +From: Johannes Berg + +[ Upstream commit 9ad7974856926129f190ffbe3beea78460b3b7cc ] + +If it looks like there's another subframe in the A-MSDU +but the header isn't fully there, we can end up reading +data out of bounds, only to discard later. Make this a +bit more careful and check if the subframe header can +even be present. + +Reported-by: syzbot+d050d437fe47d479d210@syzkaller.appspotmail.com +Link: https://msgid.link/20240226203405.a731e2c95e38.I82ce7d8c0cc8970ce29d0a39fdc07f1ffc425be4@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index d1ce3bee27973..b9d15f369378b 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -791,15 +791,19 @@ ieee80211_amsdu_subframe_length(void *field, u8 mesh_flags, u8 hdr_type) + + bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr) + { +- int offset = 0, remaining, subframe_len, padding; ++ int offset = 0, subframe_len, padding; + + for (offset = 0; offset < skb->len; offset += subframe_len + padding) { ++ int remaining = skb->len - offset; + struct { + __be16 len; + u8 mesh_flags; + } hdr; + u16 len; + ++ if (sizeof(hdr) > remaining) ++ return false; ++ + if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0) + return false; + +@@ -807,7 +811,6 @@ bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr) + mesh_hdr); + subframe_len = sizeof(struct ethhdr) + len; + padding = (4 - subframe_len) & 0x3; +- remaining = skb->len - offset; + + if (subframe_len > remaining) + return false; +@@ -825,7 +828,7 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, + { + unsigned int hlen = ALIGN(extra_headroom, 4); + struct sk_buff *frame = NULL; +- int offset = 0, remaining; ++ int offset = 0; + struct { + struct ethhdr eth; + uint8_t flags; +@@ -839,10 +842,14 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, + copy_len = sizeof(hdr); + + while (!last) { ++ int remaining = skb->len - offset; + unsigned int subframe_len; + int len, mesh_len = 0; + u8 padding; + ++ if (copy_len > remaining) ++ goto purge; ++ + skb_copy_bits(skb, offset, &hdr, copy_len); + if (iftype == NL80211_IFTYPE_MESH_POINT) + mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags); +@@ -852,7 +859,6 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list, + padding = (4 - subframe_len) & 0x3; + + /* the last MSDU has no padding */ +- remaining = skb->len - offset; + if (subframe_len > remaining) + goto purge; + /* mitigate A-MSDU aggregation injection attacks */ +-- +2.43.0 + diff --git a/queue-6.8/wifi-iwlwifi-add-missing-module_firmware-for-.pnvm.patch b/queue-6.8/wifi-iwlwifi-add-missing-module_firmware-for-.pnvm.patch new file mode 100644 index 00000000000..b727ec9cef1 --- /dev/null +++ b/queue-6.8/wifi-iwlwifi-add-missing-module_firmware-for-.pnvm.patch @@ -0,0 +1,59 @@ +From 9de0bdf896816a57e203b6cfe798909d7da8d8e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 17:38:37 +0100 +Subject: wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm + +From: Takashi Iwai + +[ Upstream commit 4223675d2b5912060a85e48fd8fee51207e00957 ] + +A few models require *.pnvm files while we don't declare them via +MODULE_FIRMWARE(). This resulted in the breakage of WiFi on the +system that relies on the information from modinfo (e.g. openSUSE +installer image). + +This patch adds those missing MODULE_FIRMWARE() entries for *.pnvm +files. + +type=feature +ticket=none + +Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1207553 +Signed-off-by: Takashi Iwai +Link: https://msgid.link/20240228163837.4320-1-tiwai@suse.de +[move to appropriate files] +Signed-off-by: Miri Korenblit +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/cfg/ax210.c | 6 ++++++ + drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 2 ++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/ax210.c b/drivers/net/wireless/intel/iwlwifi/cfg/ax210.c +index 134635c70ce85..73cbb120a49b4 100644 +--- a/drivers/net/wireless/intel/iwlwifi/cfg/ax210.c ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/ax210.c +@@ -299,3 +299,9 @@ MODULE_FIRMWARE(IWL_MA_B_HR_B_FW_MODULE_FIRMWARE(IWL_AX210_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_MA_B_GF_A_FW_MODULE_FIRMWARE(IWL_AX210_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_MA_B_GF4_A_FW_MODULE_FIRMWARE(IWL_AX210_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_MA_B_MR_A_FW_MODULE_FIRMWARE(IWL_AX210_UCODE_API_MAX)); ++ ++MODULE_FIRMWARE("iwlwifi-so-a0-gf-a0.pnvm"); ++MODULE_FIRMWARE("iwlwifi-so-a0-gf4-a0.pnvm"); ++MODULE_FIRMWARE("iwlwifi-ty-a0-gf-a0.pnvm"); ++MODULE_FIRMWARE("iwlwifi-ma-b0-gf-a0.pnvm"); ++MODULE_FIRMWARE("iwlwifi-ma-b0-gf4-a0.pnvm"); +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/bz.c b/drivers/net/wireless/intel/iwlwifi/cfg/bz.c +index 82da957adcf6e..1b6249561cd58 100644 +--- a/drivers/net/wireless/intel/iwlwifi/cfg/bz.c ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/bz.c +@@ -179,3 +179,5 @@ MODULE_FIRMWARE(IWL_BZ_A_FM_C_MODULE_FIRMWARE(IWL_BZ_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_BZ_A_FM4_B_MODULE_FIRMWARE(IWL_BZ_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_GL_B_FM_B_MODULE_FIRMWARE(IWL_BZ_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_GL_C_FM_C_MODULE_FIRMWARE(IWL_BZ_UCODE_API_MAX)); ++ ++MODULE_FIRMWARE("iwlwifi-gl-c0-fm-c0.pnvm"); +-- +2.43.0 + diff --git a/queue-6.8/wifi-iwlwifi-pcie-add-new-pci-device-id-and-cnvi.patch b/queue-6.8/wifi-iwlwifi-pcie-add-new-pci-device-id-and-cnvi.patch new file mode 100644 index 00000000000..72bf4983d25 --- /dev/null +++ b/queue-6.8/wifi-iwlwifi-pcie-add-new-pci-device-id-and-cnvi.patch @@ -0,0 +1,187 @@ +From bef95a33ce0781f55e4bb59351a888f7f1341223 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 18:02:08 +0200 +Subject: wifi: iwlwifi: pcie: Add new PCI device id and CNVI + +From: Mukesh Sisodiya + +[ Upstream commit 5f4e0994996fa08d57711b5b247a0cb3085ec66a ] + +Add the support for a new PCIE device-id 0x272E and a new CNVI +type. + +Signed-off-by: Mukesh Sisodiya +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240206175739.506db9b4a664.Ia2e3a77b880c449ac0e8d20b8cea25e6f07f1b81@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/cfg/sc.c | 38 +++++++++++++++++-- + .../net/wireless/intel/iwlwifi/iwl-config.h | 8 +++- + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 15 +++++++- + 3 files changed, 55 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/sc.c b/drivers/net/wireless/intel/iwlwifi/cfg/sc.c +index 80eb9b4995389..156c428547497 100644 +--- a/drivers/net/wireless/intel/iwlwifi/cfg/sc.c ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/sc.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause + /* + * Copyright (C) 2015-2017 Intel Deutschland GmbH +- * Copyright (C) 2018-2023 Intel Corporation ++ * Copyright (C) 2018-2024 Intel Corporation + */ + #include + #include +@@ -33,6 +33,10 @@ + #define IWL_SC_A_GF_A_FW_PRE "iwlwifi-sc-a0-gf-a0" + #define IWL_SC_A_GF4_A_FW_PRE "iwlwifi-sc-a0-gf4-a0" + #define IWL_SC_A_WH_A_FW_PRE "iwlwifi-sc-a0-wh-a0" ++#define IWL_SC2_A_FM_C_FW_PRE "iwlwifi-sc2-a0-fm-c0" ++#define IWL_SC2_A_WH_A_FW_PRE "iwlwifi-sc2-a0-wh-a0" ++#define IWL_SC2F_A_FM_C_FW_PRE "iwlwifi-sc2f-a0-fm-c0" ++#define IWL_SC2F_A_WH_A_FW_PRE "iwlwifi-sc2f-a0-wh-a0" + + #define IWL_SC_A_FM_B_FW_MODULE_FIRMWARE(api) \ + IWL_SC_A_FM_B_FW_PRE "-" __stringify(api) ".ucode" +@@ -48,6 +52,14 @@ + IWL_SC_A_GF4_A_FW_PRE "-" __stringify(api) ".ucode" + #define IWL_SC_A_WH_A_FW_MODULE_FIRMWARE(api) \ + IWL_SC_A_WH_A_FW_PRE "-" __stringify(api) ".ucode" ++#define IWL_SC2_A_FM_C_FW_MODULE_FIRMWARE(api) \ ++ IWL_SC2_A_FM_C_FW_PRE "-" __stringify(api) ".ucode" ++#define IWL_SC2_A_WH_A_FW_MODULE_FIRMWARE(api) \ ++ IWL_SC2_A_WH_A_FW_PRE "-" __stringify(api) ".ucode" ++#define IWL_SC2F_A_FM_C_FW_MODULE_FIRMWARE(api) \ ++ IWL_SC2F_A_FM_C_FW_PRE "-" __stringify(api) ".ucode" ++#define IWL_SC2F_A_WH_A_FW_MODULE_FIRMWARE(api) \ ++ IWL_SC2F_A_WH_A_FW_PRE "-" __stringify(api) ".ucode" + + static const struct iwl_base_params iwl_sc_base_params = { + .eeprom_size = OTP_LOW_IMAGE_SIZE_32K, +@@ -124,6 +136,9 @@ static const struct iwl_base_params iwl_sc_base_params = { + + #define IWL_DEVICE_SC \ + IWL_DEVICE_BZ_COMMON, \ ++ .uhb_supported = true, \ ++ .features = IWL_TX_CSUM_NETIF_FLAGS | NETIF_F_RXCSUM, \ ++ .num_rbds = IWL_NUM_RBDS_SC_EHT, \ + .ht_params = &iwl_22000_ht_params + + /* +@@ -149,10 +164,21 @@ const char iwl_sc_name[] = "Intel(R) TBD Sc device"; + + const struct iwl_cfg iwl_cfg_sc = { + .fw_name_mac = "sc", +- .uhb_supported = true, + IWL_DEVICE_SC, +- .features = IWL_TX_CSUM_NETIF_FLAGS | NETIF_F_RXCSUM, +- .num_rbds = IWL_NUM_RBDS_SC_EHT, ++}; ++ ++const char iwl_sc2_name[] = "Intel(R) TBD Sc2 device"; ++ ++const struct iwl_cfg iwl_cfg_sc2 = { ++ .fw_name_mac = "sc2", ++ IWL_DEVICE_SC, ++}; ++ ++const char iwl_sc2f_name[] = "Intel(R) TBD Sc2f device"; ++ ++const struct iwl_cfg iwl_cfg_sc2f = { ++ .fw_name_mac = "sc2f", ++ IWL_DEVICE_SC, + }; + + MODULE_FIRMWARE(IWL_SC_A_FM_B_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX)); +@@ -162,3 +188,7 @@ MODULE_FIRMWARE(IWL_SC_A_HR_B_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_SC_A_GF_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_SC_A_GF4_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_SC_A_WH_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX)); ++MODULE_FIRMWARE(IWL_SC2_A_FM_C_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX)); ++MODULE_FIRMWARE(IWL_SC2_A_WH_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX)); ++MODULE_FIRMWARE(IWL_SC2F_A_FM_C_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX)); ++MODULE_FIRMWARE(IWL_SC2F_A_WH_A_FW_MODULE_FIRMWARE(IWL_SC_UCODE_API_MAX)); +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +index ae6f1cd4d6605..e99d691362a86 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +@@ -2,7 +2,7 @@ + /* + * Copyright (C) 2005-2014, 2018-2021 Intel Corporation + * Copyright (C) 2016-2017 Intel Deutschland GmbH +- * Copyright (C) 2018-2023 Intel Corporation ++ * Copyright (C) 2018-2024 Intel Corporation + */ + #ifndef __IWL_CONFIG_H__ + #define __IWL_CONFIG_H__ +@@ -418,6 +418,8 @@ struct iwl_cfg { + #define IWL_CFG_MAC_TYPE_BZ 0x46 + #define IWL_CFG_MAC_TYPE_GL 0x47 + #define IWL_CFG_MAC_TYPE_SC 0x48 ++#define IWL_CFG_MAC_TYPE_SC2 0x49 ++#define IWL_CFG_MAC_TYPE_SC2F 0x4A + + #define IWL_CFG_RF_TYPE_TH 0x105 + #define IWL_CFG_RF_TYPE_TH1 0x108 +@@ -527,6 +529,8 @@ extern const char iwl_ax231_name[]; + extern const char iwl_ax411_name[]; + extern const char iwl_bz_name[]; + extern const char iwl_sc_name[]; ++extern const char iwl_sc2_name[]; ++extern const char iwl_sc2f_name[]; + #if IS_ENABLED(CONFIG_IWLDVM) + extern const struct iwl_cfg iwl5300_agn_cfg; + extern const struct iwl_cfg iwl5100_agn_cfg; +@@ -632,6 +636,8 @@ extern const struct iwl_cfg iwl_cfg_bz; + extern const struct iwl_cfg iwl_cfg_gl; + + extern const struct iwl_cfg iwl_cfg_sc; ++extern const struct iwl_cfg iwl_cfg_sc2; ++extern const struct iwl_cfg iwl_cfg_sc2f; + #endif /* CONFIG_IWLMVM */ + + #endif /* __IWL_CONFIG_H__ */ +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 271be64ce19ae..ba3db601ab878 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause + /* +- * Copyright (C) 2005-2014, 2018-2023 Intel Corporation ++ * Copyright (C) 2005-2014, 2018-2024 Intel Corporation + * Copyright (C) 2013-2015 Intel Mobile Communications GmbH + * Copyright (C) 2016-2017 Intel Deutschland GmbH + */ +@@ -509,6 +509,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + + /* Sc devices */ + {IWL_PCI_DEVICE(0xE440, PCI_ANY_ID, iwl_sc_trans_cfg)}, ++ {IWL_PCI_DEVICE(0xE340, PCI_ANY_ID, iwl_sc_trans_cfg)}, ++ {IWL_PCI_DEVICE(0xD340, PCI_ANY_ID, iwl_sc_trans_cfg)}, ++ {IWL_PCI_DEVICE(0x6E70, PCI_ANY_ID, iwl_sc_trans_cfg)}, + #endif /* CONFIG_IWLMVM */ + + {0} +@@ -1116,6 +1119,16 @@ static const struct iwl_dev_info iwl_dev_info_table[] = { + IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, + IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, + iwl_cfg_sc, iwl_sc_name), ++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_MAC_TYPE_SC2, IWL_CFG_ANY, ++ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, ++ iwl_cfg_sc2, iwl_sc2_name), ++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_MAC_TYPE_SC2F, IWL_CFG_ANY, ++ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, ++ iwl_cfg_sc2f, iwl_sc2f_name), + #endif /* CONFIG_IWLMVM */ + }; + +-- +2.43.0 + diff --git a/queue-6.8/wifi-iwlwifi-pcie-add-the-pci-device-id-for-new-hard.patch b/queue-6.8/wifi-iwlwifi-pcie-add-the-pci-device-id-for-new-hard.patch new file mode 100644 index 00000000000..e1ad1bde308 --- /dev/null +++ b/queue-6.8/wifi-iwlwifi-pcie-add-the-pci-device-id-for-new-hard.patch @@ -0,0 +1,36 @@ +From 3efda4c11386ec4dd7f9975c934687715b8973d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 21:22:00 +0200 +Subject: wifi: iwlwifi: pcie: Add the PCI device id for new hardware + +From: Mukesh Sisodiya + +[ Upstream commit 6770eee75148ba10c0c051885379714773e00b48 ] + +Add the support for a new PCI device id. + +Signed-off-by: Mukesh Sisodiya +Reviewed-by: Gregory Greenman +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240129211905.fde32107e0a3.I597cff4f340e4bed12b7568a0ad504bd4b2c1cf8@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 2c9b98c8184b5..271be64ce19ae 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -502,6 +502,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + + /* Bz devices */ + {IWL_PCI_DEVICE(0x2727, PCI_ANY_ID, iwl_bz_trans_cfg)}, ++ {IWL_PCI_DEVICE(0x272D, PCI_ANY_ID, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0x272b, PCI_ANY_ID, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0xA840, PCI_ANY_ID, iwl_bz_trans_cfg)}, + {IWL_PCI_DEVICE(0x7740, PCI_ANY_ID, iwl_bz_trans_cfg)}, +-- +2.43.0 + diff --git a/queue-6.8/wifi-mt76-mt7915-add-locking-for-accessing-mapped-re.patch b/queue-6.8/wifi-mt76-mt7915-add-locking-for-accessing-mapped-re.patch new file mode 100644 index 00000000000..ebd0603f5d4 --- /dev/null +++ b/queue-6.8/wifi-mt76-mt7915-add-locking-for-accessing-mapped-re.patch @@ -0,0 +1,127 @@ +From 9a7496ae72905d00d7580b5043713ae775e1e694 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Aug 2023 17:28:30 +0800 +Subject: wifi: mt76: mt7915: add locking for accessing mapped registers + +From: Shayne Chen + +[ Upstream commit 0937f95ab07af6e663ae932d592f630d9eb591da ] + +Sicne the mapping is global, mapped register access needs to be protected +against concurrent access, otherwise a race condition might cause the reads +or writes to go towards the wrong register + +Signed-off-by: Shayne Chen +Signed-off-by: Peter Chiu +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7915/mmio.c | 45 ++++++++++++++++--- + .../wireless/mediatek/mt76/mt7915/mt7915.h | 1 + + 2 files changed, 41 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +index 3039f53e22454..dceb505987b19 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +@@ -490,6 +490,11 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr) + return dev->reg.map[i].maps + ofs; + } + ++ return 0; ++} ++ ++static u32 __mt7915_reg_remap_addr(struct mt7915_dev *dev, u32 addr) ++{ + if ((addr >= MT_INFRA_BASE && addr < MT_WFSYS0_PHY_START) || + (addr >= MT_WFSYS0_PHY_START && addr < MT_WFSYS1_PHY_START) || + (addr >= MT_WFSYS1_PHY_START && addr <= MT_WFSYS1_PHY_END)) +@@ -514,15 +519,30 @@ void mt7915_memcpy_fromio(struct mt7915_dev *dev, void *buf, u32 offset, + { + u32 addr = __mt7915_reg_addr(dev, offset); + +- memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len); ++ if (addr) { ++ memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len); ++ return; ++ } ++ ++ spin_lock_bh(&dev->reg_lock); ++ memcpy_fromio(buf, dev->mt76.mmio.regs + ++ __mt7915_reg_remap_addr(dev, offset), len); ++ spin_unlock_bh(&dev->reg_lock); + } + + static u32 mt7915_rr(struct mt76_dev *mdev, u32 offset) + { + struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76); +- u32 addr = __mt7915_reg_addr(dev, offset); ++ u32 addr = __mt7915_reg_addr(dev, offset), val; + +- return dev->bus_ops->rr(mdev, addr); ++ if (addr) ++ return dev->bus_ops->rr(mdev, addr); ++ ++ spin_lock_bh(&dev->reg_lock); ++ val = dev->bus_ops->rr(mdev, __mt7915_reg_remap_addr(dev, offset)); ++ spin_unlock_bh(&dev->reg_lock); ++ ++ return val; + } + + static void mt7915_wr(struct mt76_dev *mdev, u32 offset, u32 val) +@@ -530,7 +550,14 @@ static void mt7915_wr(struct mt76_dev *mdev, u32 offset, u32 val) + struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76); + u32 addr = __mt7915_reg_addr(dev, offset); + +- dev->bus_ops->wr(mdev, addr, val); ++ if (addr) { ++ dev->bus_ops->wr(mdev, addr, val); ++ return; ++ } ++ ++ spin_lock_bh(&dev->reg_lock); ++ dev->bus_ops->wr(mdev, __mt7915_reg_remap_addr(dev, offset), val); ++ spin_unlock_bh(&dev->reg_lock); + } + + static u32 mt7915_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val) +@@ -538,7 +565,14 @@ static u32 mt7915_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val) + struct mt7915_dev *dev = container_of(mdev, struct mt7915_dev, mt76); + u32 addr = __mt7915_reg_addr(dev, offset); + +- return dev->bus_ops->rmw(mdev, addr, mask, val); ++ if (addr) ++ return dev->bus_ops->rmw(mdev, addr, mask, val); ++ ++ spin_lock_bh(&dev->reg_lock); ++ val = dev->bus_ops->rmw(mdev, __mt7915_reg_remap_addr(dev, offset), mask, val); ++ spin_unlock_bh(&dev->reg_lock); ++ ++ return val; + } + + #ifdef CONFIG_NET_MEDIATEK_SOC_WED +@@ -707,6 +741,7 @@ static int mt7915_mmio_init(struct mt76_dev *mdev, + + dev = container_of(mdev, struct mt7915_dev, mt76); + mt76_mmio_init(&dev->mt76, mem_base); ++ spin_lock_init(&dev->reg_lock); + + switch (device_id) { + case 0x7915: +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +index 4727d9c7b11de..6e79bc65f5a51 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +@@ -287,6 +287,7 @@ struct mt7915_dev { + + struct list_head sta_rc_list; + struct list_head twt_list; ++ spinlock_t reg_lock; + + u32 hw_pattern; + +-- +2.43.0 + diff --git a/queue-6.8/wifi-mt76-mt7996-add-locking-for-accessing-mapped-re.patch b/queue-6.8/wifi-mt76-mt7996-add-locking-for-accessing-mapped-re.patch new file mode 100644 index 00000000000..80b1b23c2d6 --- /dev/null +++ b/queue-6.8/wifi-mt76-mt7996-add-locking-for-accessing-mapped-re.patch @@ -0,0 +1,169 @@ +From dfc0f43c69ba4ecc8c37179309bdb3f0c1ae41e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 17:09:21 +0800 +Subject: wifi: mt76: mt7996: add locking for accessing mapped registers + +From: Shayne Chen + +[ Upstream commit 3687854d3e7e7fd760d939dd9e5a3520d5ab60fe ] + +A race condition was observed when accessing mapped registers, so add +locking to protect against concurrent access. + +Signed-off-by: Shayne Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7996/mmio.c | 64 ++++++++++++------- + .../wireless/mediatek/mt76/mt7996/mt7996.h | 3 +- + 2 files changed, 43 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +index 9f2abfa273c9b..efd4a767eb37d 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +@@ -140,7 +140,6 @@ static u32 mt7996_reg_map_l1(struct mt7996_dev *dev, u32 addr) + u32 offset = FIELD_GET(MT_HIF_REMAP_L1_OFFSET, addr); + u32 base = FIELD_GET(MT_HIF_REMAP_L1_BASE, addr); + +- dev->reg_l1_backup = dev->bus_ops->rr(&dev->mt76, MT_HIF_REMAP_L1); + dev->bus_ops->rmw(&dev->mt76, MT_HIF_REMAP_L1, + MT_HIF_REMAP_L1_MASK, + FIELD_PREP(MT_HIF_REMAP_L1_MASK, base)); +@@ -155,7 +154,6 @@ static u32 mt7996_reg_map_l2(struct mt7996_dev *dev, u32 addr) + u32 offset = FIELD_GET(MT_HIF_REMAP_L2_OFFSET, addr); + u32 base = FIELD_GET(MT_HIF_REMAP_L2_BASE, addr); + +- dev->reg_l2_backup = dev->bus_ops->rr(&dev->mt76, MT_HIF_REMAP_L2); + dev->bus_ops->rmw(&dev->mt76, MT_HIF_REMAP_L2, + MT_HIF_REMAP_L2_MASK, + FIELD_PREP(MT_HIF_REMAP_L2_MASK, base)); +@@ -165,26 +163,10 @@ static u32 mt7996_reg_map_l2(struct mt7996_dev *dev, u32 addr) + return MT_HIF_REMAP_BASE_L2 + offset; + } + +-static void mt7996_reg_remap_restore(struct mt7996_dev *dev) +-{ +- /* remap to ori status */ +- if (unlikely(dev->reg_l1_backup)) { +- dev->bus_ops->wr(&dev->mt76, MT_HIF_REMAP_L1, dev->reg_l1_backup); +- dev->reg_l1_backup = 0; +- } +- +- if (dev->reg_l2_backup) { +- dev->bus_ops->wr(&dev->mt76, MT_HIF_REMAP_L2, dev->reg_l2_backup); +- dev->reg_l2_backup = 0; +- } +-} +- + static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr) + { + int i; + +- mt7996_reg_remap_restore(dev); +- + if (addr < 0x100000) + return addr; + +@@ -201,6 +183,11 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr) + return dev->reg.map[i].mapped + ofs; + } + ++ return 0; ++} ++ ++static u32 __mt7996_reg_remap_addr(struct mt7996_dev *dev, u32 addr) ++{ + if ((addr >= MT_INFRA_BASE && addr < MT_WFSYS0_PHY_START) || + (addr >= MT_WFSYS0_PHY_START && addr < MT_WFSYS1_PHY_START) || + (addr >= MT_WFSYS1_PHY_START && addr <= MT_WFSYS1_PHY_END)) +@@ -225,28 +212,60 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset, + { + u32 addr = __mt7996_reg_addr(dev, offset); + +- memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len); ++ if (addr) { ++ memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len); ++ return; ++ } ++ ++ spin_lock_bh(&dev->reg_lock); ++ memcpy_fromio(buf, dev->mt76.mmio.regs + ++ __mt7996_reg_remap_addr(dev, offset), len); ++ spin_unlock_bh(&dev->reg_lock); + } + + static u32 mt7996_rr(struct mt76_dev *mdev, u32 offset) + { + struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); ++ u32 addr = __mt7996_reg_addr(dev, offset), val; ++ ++ if (addr) ++ return dev->bus_ops->rr(mdev, addr); + +- return dev->bus_ops->rr(mdev, __mt7996_reg_addr(dev, offset)); ++ spin_lock_bh(&dev->reg_lock); ++ val = dev->bus_ops->rr(mdev, __mt7996_reg_remap_addr(dev, offset)); ++ spin_unlock_bh(&dev->reg_lock); ++ ++ return val; + } + + static void mt7996_wr(struct mt76_dev *mdev, u32 offset, u32 val) + { + struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); ++ u32 addr = __mt7996_reg_addr(dev, offset); + +- dev->bus_ops->wr(mdev, __mt7996_reg_addr(dev, offset), val); ++ if (addr) { ++ dev->bus_ops->wr(mdev, addr, val); ++ return; ++ } ++ ++ spin_lock_bh(&dev->reg_lock); ++ dev->bus_ops->wr(mdev, __mt7996_reg_remap_addr(dev, offset), val); ++ spin_unlock_bh(&dev->reg_lock); + } + + static u32 mt7996_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val) + { + struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76); ++ u32 addr = __mt7996_reg_addr(dev, offset); ++ ++ if (addr) ++ return dev->bus_ops->rmw(mdev, addr, mask, val); ++ ++ spin_lock_bh(&dev->reg_lock); ++ val = dev->bus_ops->rmw(mdev, __mt7996_reg_remap_addr(dev, offset), mask, val); ++ spin_unlock_bh(&dev->reg_lock); + +- return dev->bus_ops->rmw(mdev, __mt7996_reg_addr(dev, offset), mask, val); ++ return val; + } + + #ifdef CONFIG_NET_MEDIATEK_SOC_WED +@@ -421,6 +440,7 @@ static int mt7996_mmio_init(struct mt76_dev *mdev, + + dev = container_of(mdev, struct mt7996_dev, mt76); + mt76_mmio_init(&dev->mt76, mem_base); ++ spin_lock_init(&dev->reg_lock); + + switch (device_id) { + case 0x7990: +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +index 8154ad37827f0..36d1f247d55aa 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +@@ -325,8 +325,7 @@ struct mt7996_dev { + u8 n_agrt; + } twt; + +- u32 reg_l1_backup; +- u32 reg_l2_backup; ++ spinlock_t reg_lock; + + u8 wtbl_size_group; + }; +-- +2.43.0 + diff --git a/queue-6.8/wifi-mt76-mt7996-disable-amsdu-for-non-data-frames.patch b/queue-6.8/wifi-mt76-mt7996-disable-amsdu-for-non-data-frames.patch new file mode 100644 index 00000000000..1c4d741af72 --- /dev/null +++ b/queue-6.8/wifi-mt76-mt7996-disable-amsdu-for-non-data-frames.patch @@ -0,0 +1,45 @@ +From d7618300f9f0a3c3f105b3e9f84e1e1c65ef6968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 17:09:14 +0800 +Subject: wifi: mt76: mt7996: disable AMSDU for non-data frames + +From: Peter Chiu + +[ Upstream commit 5d5edc09197cd8c705b42a73cdf8ba03db53c033 ] + +Disable AMSDU for non-data frames to prevent TX token leak issues. + +Signed-off-by: Peter Chiu +Signed-off-by: Shayne Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +index 63d34844c1223..0384fb059ddfc 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +@@ -732,6 +732,9 @@ mt7996_mac_write_txwi_8023(struct mt7996_dev *dev, __le32 *txwi, + FIELD_PREP(MT_TXD2_SUB_TYPE, fc_stype); + + txwi[2] |= cpu_to_le32(val); ++ ++ if (wcid->amsdu) ++ txwi[3] |= cpu_to_le32(MT_TXD3_HW_AMSDU); + } + + static void +@@ -862,8 +865,6 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, + val |= MT_TXD3_PROTECT_FRAME; + if (info->flags & IEEE80211_TX_CTL_NO_ACK) + val |= MT_TXD3_NO_ACK; +- if (wcid->amsdu) +- val |= MT_TXD3_HW_AMSDU; + + txwi[3] = cpu_to_le32(val); + txwi[4] = 0; +-- +2.43.0 + diff --git a/queue-6.8/wifi-rtw89-fix-null-pointer-access-when-abort-scan.patch b/queue-6.8/wifi-rtw89-fix-null-pointer-access-when-abort-scan.patch new file mode 100644 index 00000000000..46ebbc71339 --- /dev/null +++ b/queue-6.8/wifi-rtw89-fix-null-pointer-access-when-abort-scan.patch @@ -0,0 +1,46 @@ +From dbcd94105d9b5586d08b680497508977fde29567 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 16:14:58 +0800 +Subject: wifi: rtw89: fix null pointer access when abort scan + +From: Po-Hao Huang + +[ Upstream commit 7e11a2966f51695c0af0b1f976a32d64dee243b2 ] + +During cancel scan we might use vif that weren't scanning. +Fix this by using the actual scanning vif. + +Signed-off-by: Po-Hao Huang +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240119081501.25223-6-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/mac80211.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c +index 93889d2fface1..956a06c8cdaab 100644 +--- a/drivers/net/wireless/realtek/rtw89/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw89/mac80211.c +@@ -441,7 +441,7 @@ static void rtw89_ops_bss_info_changed(struct ieee80211_hw *hw, + * when disconnected by peer + */ + if (rtwdev->scanning) +- rtw89_hw_scan_abort(rtwdev, vif); ++ rtw89_hw_scan_abort(rtwdev, rtwdev->scan_info.scanning_vif); + } + } + +@@ -990,7 +990,7 @@ static int rtw89_ops_remain_on_channel(struct ieee80211_hw *hw, + } + + if (rtwdev->scanning) +- rtw89_hw_scan_abort(rtwdev, vif); ++ rtw89_hw_scan_abort(rtwdev, rtwdev->scan_info.scanning_vif); + + if (type == IEEE80211_ROC_TYPE_MGMT_TX) + roc->state = RTW89_ROC_MGMT; +-- +2.43.0 + diff --git a/queue-6.8/wifi-rtw89-pci-enlarge-rx-dma-buffer-to-consider-siz.patch b/queue-6.8/wifi-rtw89-pci-enlarge-rx-dma-buffer-to-consider-siz.patch new file mode 100644 index 00000000000..474ddb58ec1 --- /dev/null +++ b/queue-6.8/wifi-rtw89-pci-enlarge-rx-dma-buffer-to-consider-siz.patch @@ -0,0 +1,40 @@ +From d9b3f2c2dee1262484a34de7df45d9a8048967a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 15:18:26 +0800 +Subject: wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX + descriptor + +From: Ping-Ke Shih + +[ Upstream commit c108b4a50dd7650941d4f4ec5c161655a73711db ] + +Hardware puts RX descriptor and packet in RX DMA buffer, so it could be +over one buffer size if packet size is 11454, and then it will be split +into two segments. WiFi 7 chips use larger size of RX descriptor, so +enlarge DMA buffer size according to RX descriptor to have better +performance and simple flow. + +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240121071826.10159-5-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.h b/drivers/net/wireless/realtek/rtw89/pci.h +index 83a36358504f4..772a84bd8db6b 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.h ++++ b/drivers/net/wireless/realtek/rtw89/pci.h +@@ -996,7 +996,7 @@ + #define RTW89_PCI_TXWD_NUM_MAX 512 + #define RTW89_PCI_TXWD_PAGE_SIZE 128 + #define RTW89_PCI_ADDRINFO_MAX 4 +-#define RTW89_PCI_RX_BUF_SIZE 11460 ++#define RTW89_PCI_RX_BUF_SIZE (11454 + 40) /* +40 for rtw89_rxdesc_long_v2 */ + + #define RTW89_PCI_POLL_BDRAM_RST_CNT 100 + #define RTW89_PCI_MULTITAG 8 +-- +2.43.0 + diff --git a/queue-6.8/wifi-rtw89-pci-validate-rx-tag-for-rxq-and-rpq.patch b/queue-6.8/wifi-rtw89-pci-validate-rx-tag-for-rxq-and-rpq.patch new file mode 100644 index 00000000000..8fc5f5ae3f1 --- /dev/null +++ b/queue-6.8/wifi-rtw89-pci-validate-rx-tag-for-rxq-and-rpq.patch @@ -0,0 +1,241 @@ +From b80150535f407f14024099ba23aa267fab8b8f95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 15:18:25 +0800 +Subject: wifi: rtw89: pci: validate RX tag for RXQ and RPQ + +From: Ping-Ke Shih + +[ Upstream commit 0bc7d1d4e63cf31ff1b4396b0e2f0e3c76828d26 ] + +PCI RX ring is a kind of read/write index ring, and DMA and ring index are +asynchronous, so suddenly driver gets newer index ahead before DMA. To +resolve this rare situation, we use a RX tag as helpers to make sure DMA +is done. + +The RX tag is a 13-bit value, and range is from 1 ~ 0x1FFF, but 0 isn't +used so should be skipped. + +Only enable this validation to coming WiFi 7 chips, because existing +chips use different design and don't really meet this situation. + +Add missed rx_ring_eq_is_full for 8851BE by the way. + +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240121071826.10159-4-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 60 +++++++++++++++++-- + drivers/net/wireless/realtek/rtw89/pci.h | 4 +- + .../net/wireless/realtek/rtw89/rtw8851be.c | 2 + + .../net/wireless/realtek/rtw89/rtw8852ae.c | 1 + + .../net/wireless/realtek/rtw89/rtw8852be.c | 1 + + .../net/wireless/realtek/rtw89/rtw8852ce.c | 1 + + .../net/wireless/realtek/rtw89/rtw8922ae.c | 1 + + 7 files changed, 63 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index 769f1ce62ebcc..cb03474f81552 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -155,8 +155,8 @@ static void rtw89_pci_sync_skb_for_device(struct rtw89_dev *rtwdev, + DMA_FROM_DEVICE); + } + +-static int rtw89_pci_rxbd_info_update(struct rtw89_dev *rtwdev, +- struct sk_buff *skb) ++static void rtw89_pci_rxbd_info_update(struct rtw89_dev *rtwdev, ++ struct sk_buff *skb) + { + struct rtw89_pci_rxbd_info *rxbd_info; + struct rtw89_pci_rx_info *rx_info = RTW89_PCI_RX_SKB_CB(skb); +@@ -166,10 +166,58 @@ static int rtw89_pci_rxbd_info_update(struct rtw89_dev *rtwdev, + rx_info->ls = le32_get_bits(rxbd_info->dword, RTW89_PCI_RXBD_LS); + rx_info->len = le32_get_bits(rxbd_info->dword, RTW89_PCI_RXBD_WRITE_SIZE); + rx_info->tag = le32_get_bits(rxbd_info->dword, RTW89_PCI_RXBD_TAG); ++} ++ ++static int rtw89_pci_validate_rx_tag(struct rtw89_dev *rtwdev, ++ struct rtw89_pci_rx_ring *rx_ring, ++ struct sk_buff *skb) ++{ ++ struct rtw89_pci_rx_info *rx_info = RTW89_PCI_RX_SKB_CB(skb); ++ const struct rtw89_pci_info *info = rtwdev->pci_info; ++ u32 target_rx_tag; ++ ++ if (!info->check_rx_tag) ++ return 0; ++ ++ /* valid range is 1 ~ 0x1FFF */ ++ if (rx_ring->target_rx_tag == 0) ++ target_rx_tag = 1; ++ else ++ target_rx_tag = rx_ring->target_rx_tag; ++ ++ if (rx_info->tag != target_rx_tag) { ++ rtw89_debug(rtwdev, RTW89_DBG_UNEXP, "mismatch RX tag 0x%x 0x%x\n", ++ rx_info->tag, target_rx_tag); ++ return -EAGAIN; ++ } + + return 0; + } + ++static ++int rtw89_pci_sync_skb_for_device_and_validate_rx_info(struct rtw89_dev *rtwdev, ++ struct rtw89_pci_rx_ring *rx_ring, ++ struct sk_buff *skb) ++{ ++ struct rtw89_pci_rx_info *rx_info = RTW89_PCI_RX_SKB_CB(skb); ++ int rx_tag_retry = 100; ++ int ret; ++ ++ do { ++ rtw89_pci_sync_skb_for_cpu(rtwdev, skb); ++ rtw89_pci_rxbd_info_update(rtwdev, skb); ++ ++ ret = rtw89_pci_validate_rx_tag(rtwdev, rx_ring, skb); ++ if (ret != -EAGAIN) ++ break; ++ } while (rx_tag_retry--); ++ ++ /* update target rx_tag for next RX */ ++ rx_ring->target_rx_tag = rx_info->tag + 1; ++ ++ return ret; ++} ++ + static void rtw89_pci_ctrl_txdma_ch_pcie(struct rtw89_dev *rtwdev, bool enable) + { + const struct rtw89_pci_info *info = rtwdev->pci_info; +@@ -259,9 +307,8 @@ static u32 rtw89_pci_rxbd_deliver_skbs(struct rtw89_dev *rtwdev, + + skb_idx = rtw89_pci_get_rx_skb_idx(rtwdev, bd_ring); + skb = rx_ring->buf[skb_idx]; +- rtw89_pci_sync_skb_for_cpu(rtwdev, skb); + +- ret = rtw89_pci_rxbd_info_update(rtwdev, skb); ++ ret = rtw89_pci_sync_skb_for_device_and_validate_rx_info(rtwdev, rx_ring, skb); + if (ret) { + rtw89_err(rtwdev, "failed to update %d RXBD info: %d\n", + bd_ring->wp, ret); +@@ -549,9 +596,8 @@ static u32 rtw89_pci_release_tx_skbs(struct rtw89_dev *rtwdev, + + skb_idx = rtw89_pci_get_rx_skb_idx(rtwdev, bd_ring); + skb = rx_ring->buf[skb_idx]; +- rtw89_pci_sync_skb_for_cpu(rtwdev, skb); + +- ret = rtw89_pci_rxbd_info_update(rtwdev, skb); ++ ret = rtw89_pci_sync_skb_for_device_and_validate_rx_info(rtwdev, rx_ring, skb); + if (ret) { + rtw89_err(rtwdev, "failed to update %d RXBD info: %d\n", + bd_ring->wp, ret); +@@ -1550,6 +1596,7 @@ static void rtw89_pci_reset_trx_rings(struct rtw89_dev *rtwdev) + bd_ring->rp = 0; + rx_ring->diliver_skb = NULL; + rx_ring->diliver_desc.ready = false; ++ rx_ring->target_rx_tag = 0; + + rtw89_write16(rtwdev, addr_num, bd_ring->len); + rtw89_write32(rtwdev, addr_desa_l, bd_ring->dma); +@@ -3148,6 +3195,7 @@ static int rtw89_pci_alloc_rx_ring(struct rtw89_dev *rtwdev, + rx_ring->buf_sz = buf_sz; + rx_ring->diliver_skb = NULL; + rx_ring->diliver_desc.ready = false; ++ rx_ring->target_rx_tag = 0; + + for (i = 0; i < len; i++) { + skb = dev_alloc_skb(buf_sz); +diff --git a/drivers/net/wireless/realtek/rtw89/pci.h b/drivers/net/wireless/realtek/rtw89/pci.h +index ca5de77fee90a..83a36358504f4 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.h ++++ b/drivers/net/wireless/realtek/rtw89/pci.h +@@ -1234,6 +1234,7 @@ struct rtw89_pci_info { + enum mac_ax_pcie_func_ctrl io_rcy_en; + enum mac_ax_io_rcy_tmr io_rcy_tmr; + bool rx_ring_eq_is_full; ++ bool check_rx_tag; + + u32 init_cfg_reg; + u32 txhci_en_bit; +@@ -1276,7 +1277,7 @@ struct rtw89_pci_tx_data { + + struct rtw89_pci_rx_info { + dma_addr_t dma; +- u32 fs:1, ls:1, tag:11, len:14; ++ u32 fs:1, ls:1, tag:13, len:14; + }; + + #define RTW89_PCI_TXBD_OPTION_LS BIT(14) +@@ -1405,6 +1406,7 @@ struct rtw89_pci_rx_ring { + u32 buf_sz; + struct sk_buff *diliver_skb; + struct rtw89_rx_desc_info diliver_desc; ++ u32 target_rx_tag:13; + }; + + struct rtw89_pci_isrs { +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851be.c b/drivers/net/wireless/realtek/rtw89/rtw8851be.c +index ade69bd30fc86..ca1374a717272 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8851be.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8851be.c +@@ -25,6 +25,8 @@ static const struct rtw89_pci_info rtw8851b_pci_info = { + .autok_en = MAC_AX_PCIE_DISABLE, + .io_rcy_en = MAC_AX_PCIE_DISABLE, + .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_6MS, ++ .rx_ring_eq_is_full = false, ++ .check_rx_tag = false, + + .init_cfg_reg = R_AX_PCIE_INIT_CFG1, + .txhci_en_bit = B_AX_TXHCI_EN, +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852ae.c b/drivers/net/wireless/realtek/rtw89/rtw8852ae.c +index f1e890bde0499..7c6ffedb77e27 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852ae.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852ae.c +@@ -26,6 +26,7 @@ static const struct rtw89_pci_info rtw8852a_pci_info = { + .io_rcy_en = MAC_AX_PCIE_DISABLE, + .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_6MS, + .rx_ring_eq_is_full = false, ++ .check_rx_tag = false, + + .init_cfg_reg = R_AX_PCIE_INIT_CFG1, + .txhci_en_bit = B_AX_TXHCI_EN, +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852be.c b/drivers/net/wireless/realtek/rtw89/rtw8852be.c +index 920b20bbcfb73..ed71364e6437b 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852be.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852be.c +@@ -26,6 +26,7 @@ static const struct rtw89_pci_info rtw8852b_pci_info = { + .io_rcy_en = MAC_AX_PCIE_DISABLE, + .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_6MS, + .rx_ring_eq_is_full = false, ++ .check_rx_tag = false, + + .init_cfg_reg = R_AX_PCIE_INIT_CFG1, + .txhci_en_bit = B_AX_TXHCI_EN, +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852ce.c b/drivers/net/wireless/realtek/rtw89/rtw8852ce.c +index 4592de3dbd942..583ea673a4f54 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852ce.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852ce.c +@@ -35,6 +35,7 @@ static const struct rtw89_pci_info rtw8852c_pci_info = { + .io_rcy_en = MAC_AX_PCIE_ENABLE, + .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_6MS, + .rx_ring_eq_is_full = false, ++ .check_rx_tag = false, + + .init_cfg_reg = R_AX_HAXI_INIT_CFG1, + .txhci_en_bit = B_AX_TXHCI_EN_V1, +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922ae.c b/drivers/net/wireless/realtek/rtw89/rtw8922ae.c +index 7b3d98d2c402c..9f46fb1661055 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8922ae.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8922ae.c +@@ -26,6 +26,7 @@ static const struct rtw89_pci_info rtw8922a_pci_info = { + .io_rcy_en = MAC_AX_PCIE_ENABLE, + .io_rcy_tmr = MAC_AX_IO_RCY_ANA_TMR_DEF, + .rx_ring_eq_is_full = true, ++ .check_rx_tag = true, + + .init_cfg_reg = R_BE_HAXI_INIT_CFG1, + .txhci_en_bit = B_BE_TXDMA_EN, +-- +2.43.0 + diff --git a/queue-6.8/x86-vdso-fix-rethunk-patching-for-vdso-image-32-64-..patch b/queue-6.8/x86-vdso-fix-rethunk-patching-for-vdso-image-32-64-..patch new file mode 100644 index 00000000000..0de8c4d8d46 --- /dev/null +++ b/queue-6.8/x86-vdso-fix-rethunk-patching-for-vdso-image-32-64-..patch @@ -0,0 +1,105 @@ +From 454f1055b2e80e8f94177e88d6178ba68682f669 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 21:57:18 -0800 +Subject: x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o + +From: Josh Poimboeuf + +[ Upstream commit b388e57d4628eb22782bdad4cd5b83ca87a1b7c9 ] + +For CONFIG_RETHUNK kernels, objtool annotates all the function return +sites so they can be patched during boot. By design, after +apply_returns() is called, all tail-calls to the compiler-generated +default return thunk (__x86_return_thunk) should be patched out and +replaced with whatever's needed for any mitigations (or lack thereof). + +The commit + + 4461438a8405 ("x86/retpoline: Ensure default return thunk isn't used at runtime") + +adds a runtime check and a WARN_ONCE() if the default return thunk ever +gets executed after alternatives have been applied. This warning is +a sanity check to make sure objtool and apply_returns() are doing their +job. + +As Nathan reported, that check found something: + + Unpatched return thunk in use. This should not happen! + WARNING: CPU: 0 PID: 1 at arch/x86/kernel/cpu/bugs.c:2856 __warn_thunk+0x27/0x40 + RIP: 0010:__warn_thunk+0x27/0x40 + Call Trace: + + ? show_regs + ? __warn + ? __warn_thunk + ? report_bug + ? console_unlock + ? handle_bug + ? exc_invalid_op + ? asm_exc_invalid_op + ? ia32_binfmt_init + ? __warn_thunk + warn_thunk_thunk + do_one_initcall + kernel_init_freeable + ? __pfx_kernel_init + kernel_init + ret_from_fork + ? __pfx_kernel_init + ret_from_fork_asm + + +Boris debugged to find that the unpatched return site was in +init_vdso_image_64(), and its translation unit wasn't being analyzed by +objtool, so it never got annotated. So it got ignored by +apply_returns(). + +This is only a minor issue, as this function is only called during boot. +Still, objtool needs full visibility to the kernel. Fix it by enabling +objtool on vdso-image-{32,64}.o. + +Note this problem can only be seen with !CONFIG_X86_KERNEL_IBT, as that +requires objtool to run individually on all translation units rather on +vmlinux.o. + + [ bp: Massage commit message. ] + +Reported-by: Nathan Chancellor +Signed-off-by: Josh Poimboeuf +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20240215032049.GA3944823@dev-arch.thelio-3990X +Signed-off-by: Sasha Levin +--- + arch/x86/entry/vdso/Makefile | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile +index b1b8dd1608f7e..4ee59121b9053 100644 +--- a/arch/x86/entry/vdso/Makefile ++++ b/arch/x86/entry/vdso/Makefile +@@ -34,8 +34,12 @@ obj-y += vma.o extable.o + KASAN_SANITIZE_vma.o := y + UBSAN_SANITIZE_vma.o := y + KCSAN_SANITIZE_vma.o := y +-OBJECT_FILES_NON_STANDARD_vma.o := n +-OBJECT_FILES_NON_STANDARD_extable.o := n ++ ++OBJECT_FILES_NON_STANDARD_extable.o := n ++OBJECT_FILES_NON_STANDARD_vdso-image-32.o := n ++OBJECT_FILES_NON_STANDARD_vdso-image-64.o := n ++OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n ++OBJECT_FILES_NON_STANDARD_vma.o := n + + # vDSO images to build + vdso_img-$(VDSO64-y) += 64 +@@ -43,7 +47,6 @@ vdso_img-$(VDSOX32-y) += x32 + vdso_img-$(VDSO32-y) += 32 + + obj-$(VDSO32-y) += vdso32-setup.o +-OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n + + vobjs := $(foreach F,$(vobjs-y),$(obj)/$F) + vobjs32 := $(foreach F,$(vobjs32-y),$(obj)/$F) +-- +2.43.0 + diff --git a/queue-6.8/x86-xen-attempt-to-inflate-the-memory-balloon-on-pvh.patch b/queue-6.8/x86-xen-attempt-to-inflate-the-memory-balloon-on-pvh.patch new file mode 100644 index 00000000000..130206b07cb --- /dev/null +++ b/queue-6.8/x86-xen-attempt-to-inflate-the-memory-balloon-on-pvh.patch @@ -0,0 +1,325 @@ +From 5ca1ca7a3da598fdac527288c572f6a2ec78170a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 18:43:41 +0100 +Subject: x86/xen: attempt to inflate the memory balloon on PVH +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Roger Pau Monne + +[ Upstream commit 38620fc4e8934f1801c7811ef39a041914ac4c1d ] + +When running as PVH or HVM Linux will use holes in the memory map as scratch +space to map grants, foreign domain pages and possibly miscellaneous other +stuff. However the usage of such memory map holes for Xen purposes can be +problematic. The request of holesby Xen happen quite early in the kernel boot +process (grant table setup already uses scratch map space), and it's possible +that by then not all devices have reclaimed their MMIO space. It's not +unlikely for chunks of Xen scratch map space to end up using PCI bridge MMIO +window memory, which (as expected) causes quite a lot of issues in the system. + +At least for PVH dom0 we have the possibility of using regions marked as +UNUSABLE in the e820 memory map. Either if the region is UNUSABLE in the +native memory map, or it has been converted into UNUSABLE in order to hide RAM +regions from dom0, the second stage translation page-tables can populate those +areas without issues. + +PV already has this kind of logic, where the balloon driver is inflated at +boot. Re-use the current logic in order to also inflate it when running as +PVH. onvert UNUSABLE regions up to the ratio specified in EXTRA_MEM_RATIO to +RAM, while reserving them using xen_add_extra_mem() (which is also moved so +it's no longer tied to CONFIG_PV). + +[jgross: fixed build for CONFIG_PVH without CONFIG_XEN_PVH] + +Signed-off-by: Roger Pau Monné +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240220174341.56131-1-roger.pau@citrix.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/xen/hypervisor.h | 5 ++ + arch/x86/platform/pvh/enlighten.c | 3 ++ + arch/x86/xen/enlighten.c | 32 +++++++++++++ + arch/x86/xen/enlighten_pvh.c | 68 +++++++++++++++++++++++++++ + arch/x86/xen/setup.c | 44 ----------------- + arch/x86/xen/xen-ops.h | 14 ++++++ + drivers/xen/balloon.c | 2 - + 7 files changed, 122 insertions(+), 46 deletions(-) + +diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h +index a9088250770f2..64fbd2dbc5b76 100644 +--- a/arch/x86/include/asm/xen/hypervisor.h ++++ b/arch/x86/include/asm/xen/hypervisor.h +@@ -62,6 +62,11 @@ void xen_arch_unregister_cpu(int num); + #ifdef CONFIG_PVH + void __init xen_pvh_init(struct boot_params *boot_params); + void __init mem_map_via_hcall(struct boot_params *boot_params_p); ++#ifdef CONFIG_XEN_PVH ++void __init xen_reserve_extra_memory(struct boot_params *bootp); ++#else ++static inline void xen_reserve_extra_memory(struct boot_params *bootp) { } ++#endif + #endif + + /* Lazy mode for batching updates / context switch */ +diff --git a/arch/x86/platform/pvh/enlighten.c b/arch/x86/platform/pvh/enlighten.c +index 00a92cb2c8147..a12117f3d4de7 100644 +--- a/arch/x86/platform/pvh/enlighten.c ++++ b/arch/x86/platform/pvh/enlighten.c +@@ -74,6 +74,9 @@ static void __init init_pvh_bootparams(bool xen_guest) + } else + xen_raw_printk("Warning: Can fit ISA range into e820\n"); + ++ if (xen_guest) ++ xen_reserve_extra_memory(&pvh_bootparams); ++ + pvh_bootparams.hdr.cmd_line_ptr = + pvh_start_info.cmdline_paddr; + +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index 3c61bb98c10e2..a01ca255b0c64 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -350,3 +351,34 @@ void xen_arch_unregister_cpu(int num) + } + EXPORT_SYMBOL(xen_arch_unregister_cpu); + #endif ++ ++/* Amount of extra memory space we add to the e820 ranges */ ++struct xen_memory_region xen_extra_mem[XEN_EXTRA_MEM_MAX_REGIONS] __initdata; ++ ++void __init xen_add_extra_mem(unsigned long start_pfn, unsigned long n_pfns) ++{ ++ unsigned int i; ++ ++ /* ++ * No need to check for zero size, should happen rarely and will only ++ * write a new entry regarded to be unused due to zero size. ++ */ ++ for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) { ++ /* Add new region. */ ++ if (xen_extra_mem[i].n_pfns == 0) { ++ xen_extra_mem[i].start_pfn = start_pfn; ++ xen_extra_mem[i].n_pfns = n_pfns; ++ break; ++ } ++ /* Append to existing region. */ ++ if (xen_extra_mem[i].start_pfn + xen_extra_mem[i].n_pfns == ++ start_pfn) { ++ xen_extra_mem[i].n_pfns += n_pfns; ++ break; ++ } ++ } ++ if (i == XEN_EXTRA_MEM_MAX_REGIONS) ++ printk(KERN_WARNING "Warning: not enough extra memory regions\n"); ++ ++ memblock_reserve(PFN_PHYS(start_pfn), PFN_PHYS(n_pfns)); ++} +diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c +index ada3868c02c23..c28f073c1df52 100644 +--- a/arch/x86/xen/enlighten_pvh.c ++++ b/arch/x86/xen/enlighten_pvh.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + #include + #include ++#include + + #include + +@@ -72,3 +73,70 @@ void __init mem_map_via_hcall(struct boot_params *boot_params_p) + } + boot_params_p->e820_entries = memmap.nr_entries; + } ++ ++/* ++ * Reserve e820 UNUSABLE regions to inflate the memory balloon. ++ * ++ * On PVH dom0 the host memory map is used, RAM regions available to dom0 are ++ * located as the same place as in the native memory map, but since dom0 gets ++ * less memory than the total amount of host RAM the ranges that can't be ++ * populated are converted from RAM -> UNUSABLE. Use such regions (up to the ++ * ratio signaled in EXTRA_MEM_RATIO) in order to inflate the balloon driver at ++ * boot. Doing so prevents the guest (even if just temporary) from using holes ++ * in the memory map in order to map grants or foreign addresses, and ++ * hopefully limits the risk of a clash with a device MMIO region. Ideally the ++ * hypervisor should notify us which memory ranges are suitable for creating ++ * foreign mappings, but that's not yet implemented. ++ */ ++void __init xen_reserve_extra_memory(struct boot_params *bootp) ++{ ++ unsigned int i, ram_pages = 0, extra_pages; ++ ++ for (i = 0; i < bootp->e820_entries; i++) { ++ struct boot_e820_entry *e = &bootp->e820_table[i]; ++ ++ if (e->type != E820_TYPE_RAM) ++ continue; ++ ram_pages += PFN_DOWN(e->addr + e->size) - PFN_UP(e->addr); ++ } ++ ++ /* Max amount of extra memory. */ ++ extra_pages = EXTRA_MEM_RATIO * ram_pages; ++ ++ /* ++ * Convert UNUSABLE ranges to RAM and reserve them for foreign mapping ++ * purposes. ++ */ ++ for (i = 0; i < bootp->e820_entries && extra_pages; i++) { ++ struct boot_e820_entry *e = &bootp->e820_table[i]; ++ unsigned long pages; ++ ++ if (e->type != E820_TYPE_UNUSABLE) ++ continue; ++ ++ pages = min(extra_pages, ++ PFN_DOWN(e->addr + e->size) - PFN_UP(e->addr)); ++ ++ if (pages != (PFN_DOWN(e->addr + e->size) - PFN_UP(e->addr))) { ++ struct boot_e820_entry *next; ++ ++ if (bootp->e820_entries == ++ ARRAY_SIZE(bootp->e820_table)) ++ /* No space left to split - skip region. */ ++ continue; ++ ++ /* Split entry. */ ++ next = e + 1; ++ memmove(next, e, ++ (bootp->e820_entries - i) * sizeof(*e)); ++ bootp->e820_entries++; ++ next->addr = PAGE_ALIGN(e->addr) + PFN_PHYS(pages); ++ e->size = next->addr - e->addr; ++ next->size -= e->size; ++ } ++ e->type = E820_TYPE_RAM; ++ extra_pages -= pages; ++ ++ xen_add_extra_mem(PFN_UP(e->addr), pages); ++ } ++} +diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c +index b3e37961065a2..380591028cb8f 100644 +--- a/arch/x86/xen/setup.c ++++ b/arch/x86/xen/setup.c +@@ -38,9 +38,6 @@ + + #define GB(x) ((uint64_t)(x) * 1024 * 1024 * 1024) + +-/* Amount of extra memory space we add to the e820 ranges */ +-struct xen_memory_region xen_extra_mem[XEN_EXTRA_MEM_MAX_REGIONS] __initdata; +- + /* Number of pages released from the initial allocation. */ + unsigned long xen_released_pages; + +@@ -64,18 +61,6 @@ static struct { + } xen_remap_buf __initdata __aligned(PAGE_SIZE); + static unsigned long xen_remap_mfn __initdata = INVALID_P2M_ENTRY; + +-/* +- * The maximum amount of extra memory compared to the base size. The +- * main scaling factor is the size of struct page. At extreme ratios +- * of base:extra, all the base memory can be filled with page +- * structures for the extra memory, leaving no space for anything +- * else. +- * +- * 10x seems like a reasonable balance between scaling flexibility and +- * leaving a practically usable system. +- */ +-#define EXTRA_MEM_RATIO (10) +- + static bool xen_512gb_limit __initdata = IS_ENABLED(CONFIG_XEN_512GB); + + static void __init xen_parse_512gb(void) +@@ -96,35 +81,6 @@ static void __init xen_parse_512gb(void) + xen_512gb_limit = val; + } + +-static void __init xen_add_extra_mem(unsigned long start_pfn, +- unsigned long n_pfns) +-{ +- int i; +- +- /* +- * No need to check for zero size, should happen rarely and will only +- * write a new entry regarded to be unused due to zero size. +- */ +- for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) { +- /* Add new region. */ +- if (xen_extra_mem[i].n_pfns == 0) { +- xen_extra_mem[i].start_pfn = start_pfn; +- xen_extra_mem[i].n_pfns = n_pfns; +- break; +- } +- /* Append to existing region. */ +- if (xen_extra_mem[i].start_pfn + xen_extra_mem[i].n_pfns == +- start_pfn) { +- xen_extra_mem[i].n_pfns += n_pfns; +- break; +- } +- } +- if (i == XEN_EXTRA_MEM_MAX_REGIONS) +- printk(KERN_WARNING "Warning: not enough extra memory regions\n"); +- +- memblock_reserve(PFN_PHYS(start_pfn), PFN_PHYS(n_pfns)); +-} +- + static void __init xen_del_extra_mem(unsigned long start_pfn, + unsigned long n_pfns) + { +diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h +index a87ab36889e76..79cf93f2c92f1 100644 +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -163,4 +163,18 @@ void xen_hvm_post_suspend(int suspend_cancelled); + static inline void xen_hvm_post_suspend(int suspend_cancelled) {} + #endif + ++/* ++ * The maximum amount of extra memory compared to the base size. The ++ * main scaling factor is the size of struct page. At extreme ratios ++ * of base:extra, all the base memory can be filled with page ++ * structures for the extra memory, leaving no space for anything ++ * else. ++ * ++ * 10x seems like a reasonable balance between scaling flexibility and ++ * leaving a practically usable system. ++ */ ++#define EXTRA_MEM_RATIO (10) ++ ++void xen_add_extra_mem(unsigned long start_pfn, unsigned long n_pfns); ++ + #endif /* XEN_OPS_H */ +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index 976c6cdf9ee67..aaf2514fcfa46 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -672,7 +672,6 @@ EXPORT_SYMBOL(xen_free_ballooned_pages); + + static void __init balloon_add_regions(void) + { +-#if defined(CONFIG_XEN_PV) + unsigned long start_pfn, pages; + unsigned long pfn, extra_pfn_end; + unsigned int i; +@@ -696,7 +695,6 @@ static void __init balloon_add_regions(void) + + balloon_stats.total_pages += extra_pfn_end - start_pfn; + } +-#endif + } + + static int __init balloon_init(void) +-- +2.43.0 +