From: Sasha Levin Date: Fri, 23 Feb 2024 17:44:25 +0000 (-0500) Subject: Fixes for 6.6 X-Git-Tag: v4.19.308~90 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3d965d2dc8e6b55bca872bb40385b7bdf8937721;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/accel-ivpu-40xx-stop-passing-sku-boot-parameters-to-.patch b/queue-6.6/accel-ivpu-40xx-stop-passing-sku-boot-parameters-to-.patch new file mode 100644 index 00000000000..64b4b1025c2 --- /dev/null +++ b/queue-6.6/accel-ivpu-40xx-stop-passing-sku-boot-parameters-to-.patch @@ -0,0 +1,46 @@ +From f6f59cf766bfcf974bed72b073db5b86988209e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 13:28:03 +0100 +Subject: accel/ivpu/40xx: Stop passing SKU boot parameters to FW + +From: Krystian Pradzynski + +[ Upstream commit 553099da45397914a995dce6307d6c26523c2567 ] + +This parameter was never used by the 40xx FW. + +Signed-off-by: Krystian Pradzynski +Signed-off-by: Jacek Lawrynowicz +Reviewed-by: Jeffrey Hugo +Link: https://patchwork.freedesktop.org/patch/msgid/20240126122804.2169129-7-jacek.lawrynowicz@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/accel/ivpu/ivpu_hw_40xx.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/accel/ivpu/ivpu_hw_40xx.c b/drivers/accel/ivpu/ivpu_hw_40xx.c +index 65c6a82bb13f6..ae6be0d5aaccf 100644 +--- a/drivers/accel/ivpu/ivpu_hw_40xx.c ++++ b/drivers/accel/ivpu/ivpu_hw_40xx.c +@@ -697,7 +697,6 @@ static int ivpu_hw_40xx_info_init(struct ivpu_device *vdev) + { + struct ivpu_hw_info *hw = vdev->hw; + u32 tile_disable; +- u32 tile_enable; + u32 fuse; + + fuse = REGB_RD32(VPU_40XX_BUTTRESS_TILE_FUSE); +@@ -718,10 +717,6 @@ static int ivpu_hw_40xx_info_init(struct ivpu_device *vdev) + else + ivpu_dbg(vdev, MISC, "Fuse: All %d tiles enabled\n", TILE_MAX_NUM); + +- tile_enable = (~tile_disable) & TILE_MAX_MASK; +- +- hw->sku = REG_SET_FLD_NUM(SKU, HW_ID, LNL_HW_ID, hw->sku); +- hw->sku = REG_SET_FLD_NUM(SKU, TILE, tile_enable, hw->sku); + hw->tile_fuse = tile_disable; + hw->pll.profiling_freq = PLL_PROFILING_FREQ_DEFAULT; + +-- +2.43.0 + diff --git a/queue-6.6/accel-ivpu-disable-d3hot_delay-on-all-npu-generation.patch b/queue-6.6/accel-ivpu-disable-d3hot_delay-on-all-npu-generation.patch new file mode 100644 index 00000000000..6eadf81b005 --- /dev/null +++ b/queue-6.6/accel-ivpu-disable-d3hot_delay-on-all-npu-generation.patch @@ -0,0 +1,39 @@ +From 822a8327076fb3d5affedfd0ce75ac5b339d4697 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 13:28:00 +0100 +Subject: accel/ivpu: Disable d3hot_delay on all NPU generations + +From: Jacek Lawrynowicz + +[ Upstream commit a7f31091ddf457352e3dd7ac183fdbd26b4dcd04 ] + +NPU does not require this delay regardless of the generation. +All generations are integrated into the SOC. + +Signed-off-by: Jacek Lawrynowicz +Reviewed-by: Jeffrey Hugo +Link: https://patchwork.freedesktop.org/patch/msgid/20240126122804.2169129-4-jacek.lawrynowicz@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/accel/ivpu/ivpu_drv.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c +index 7e9359611d69c..8fb70e3c7b9ca 100644 +--- a/drivers/accel/ivpu/ivpu_drv.c ++++ b/drivers/accel/ivpu/ivpu_drv.c +@@ -467,9 +467,8 @@ static int ivpu_pci_init(struct ivpu_device *vdev) + /* Clear any pending errors */ + pcie_capability_clear_word(pdev, PCI_EXP_DEVSTA, 0x3f); + +- /* VPU 37XX does not require 10m D3hot delay */ +- if (ivpu_hw_gen(vdev) == IVPU_HW_37XX) +- pdev->d3hot_delay = 0; ++ /* NPU does not require 10m D3hot delay */ ++ pdev->d3hot_delay = 0; + + ret = pcim_enable_device(pdev); + if (ret) { +-- +2.43.0 + diff --git a/queue-6.6/accel-ivpu-force-snooping-for-mmu-writes.patch b/queue-6.6/accel-ivpu-force-snooping-for-mmu-writes.patch new file mode 100644 index 00000000000..c6175967be5 --- /dev/null +++ b/queue-6.6/accel-ivpu-force-snooping-for-mmu-writes.patch @@ -0,0 +1,77 @@ +From f0a22e4d5181838e93076abf50196fce998a3111 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 13:27:58 +0100 +Subject: accel/ivpu: Force snooping for MMU writes + +From: Wachowski, Karol + +[ Upstream commit c9da9a1f17bf4fa96b115950fd389c917b583c1c ] + +Set AW_SNOOP_OVERRIDE bit in VPU_37/40XX_HOST_IF_TCU_PTW_OVERRIDES +to force snooping for MMU write accesses (setting event queue events). + +MMU event queue buffer is the only buffer written by MMU and +mapped as write-back which break cache coherency. Force write +transactions to be snooped solving the problem. + +Signed-off-by: Wachowski, Karol +Signed-off-by: Jacek Lawrynowicz +Reviewed-by: Jeffrey Hugo +Link: https://patchwork.freedesktop.org/patch/msgid/20240126122804.2169129-2-jacek.lawrynowicz@linux.intel.com +Signed-off-by: Sasha Levin +--- + drivers/accel/ivpu/ivpu_hw_37xx.c | 2 +- + drivers/accel/ivpu/ivpu_hw_40xx.c | 2 +- + drivers/accel/ivpu/ivpu_mmu.c | 3 --- + 3 files changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/accel/ivpu/ivpu_hw_37xx.c b/drivers/accel/ivpu/ivpu_hw_37xx.c +index ddf03498fd4c1..c0de7c0c991f5 100644 +--- a/drivers/accel/ivpu/ivpu_hw_37xx.c ++++ b/drivers/accel/ivpu/ivpu_hw_37xx.c +@@ -562,7 +562,7 @@ static void ivpu_boot_no_snoop_enable(struct ivpu_device *vdev) + u32 val = REGV_RD32(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES); + + val = REG_SET_FLD(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, NOSNOOP_OVERRIDE_EN, val); +- val = REG_SET_FLD(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, AW_NOSNOOP_OVERRIDE, val); ++ val = REG_CLR_FLD(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, AW_NOSNOOP_OVERRIDE, val); + val = REG_SET_FLD(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, AR_NOSNOOP_OVERRIDE, val); + + REGV_WR32(VPU_37XX_HOST_IF_TCU_PTW_OVERRIDES, val); +diff --git a/drivers/accel/ivpu/ivpu_hw_40xx.c b/drivers/accel/ivpu/ivpu_hw_40xx.c +index 03600a7a5aca8..65c6a82bb13f6 100644 +--- a/drivers/accel/ivpu/ivpu_hw_40xx.c ++++ b/drivers/accel/ivpu/ivpu_hw_40xx.c +@@ -523,7 +523,7 @@ static void ivpu_boot_no_snoop_enable(struct ivpu_device *vdev) + u32 val = REGV_RD32(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES); + + val = REG_SET_FLD(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, SNOOP_OVERRIDE_EN, val); +- val = REG_CLR_FLD(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, AW_SNOOP_OVERRIDE, val); ++ val = REG_SET_FLD(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, AW_SNOOP_OVERRIDE, val); + val = REG_CLR_FLD(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, AR_SNOOP_OVERRIDE, val); + + REGV_WR32(VPU_40XX_HOST_IF_TCU_PTW_OVERRIDES, val); +diff --git a/drivers/accel/ivpu/ivpu_mmu.c b/drivers/accel/ivpu/ivpu_mmu.c +index baefaf7bb3cbb..d04a28e052485 100644 +--- a/drivers/accel/ivpu/ivpu_mmu.c ++++ b/drivers/accel/ivpu/ivpu_mmu.c +@@ -491,7 +491,6 @@ static int ivpu_mmu_reset(struct ivpu_device *vdev) + mmu->cmdq.cons = 0; + + memset(mmu->evtq.base, 0, IVPU_MMU_EVTQ_SIZE); +- clflush_cache_range(mmu->evtq.base, IVPU_MMU_EVTQ_SIZE); + mmu->evtq.prod = 0; + mmu->evtq.cons = 0; + +@@ -805,8 +804,6 @@ static u32 *ivpu_mmu_get_event(struct ivpu_device *vdev) + if (!CIRC_CNT(IVPU_MMU_Q_IDX(evtq->prod), IVPU_MMU_Q_IDX(evtq->cons), IVPU_MMU_Q_COUNT)) + return NULL; + +- clflush_cache_range(evt, IVPU_MMU_EVTQ_CMD_SIZE); +- + evtq->cons = (evtq->cons + 1) & IVPU_MMU_Q_WRAP_MASK; + REGV_WR32(VPU_37XX_HOST_MMU_EVTQ_CONS_SEC, evtq->cons); + +-- +2.43.0 + diff --git a/queue-6.6/ahci-add-43-bit-dma-address-quirk-for-asmedia-asm106.patch b/queue-6.6/ahci-add-43-bit-dma-address-quirk-for-asmedia-asm106.patch new file mode 100644 index 00000000000..a848db3e247 --- /dev/null +++ b/queue-6.6/ahci-add-43-bit-dma-address-quirk-for-asmedia-asm106.patch @@ -0,0 +1,159 @@ +From 290fed8ea2331546099727175dc0d8a6bd723508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 17:04:01 +0200 +Subject: ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers + +From: Lennert Buytenhek + +[ Upstream commit 20730e9b277873deeb6637339edcba64468f3da3 ] + +With one of the on-board ASM1061 AHCI controllers (1b21:0612) on an +ASUSTeK Pro WS WRX80E-SAGE SE WIFI mainboard, a controller hang was +observed that was immediately preceded by the following kernel +messages: + +ahci 0000:28:00.0: Using 64-bit DMA addresses +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00000 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00300 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00380 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00400 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00680 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00700 flags=0x0000] + +The first message is produced by code in drivers/iommu/dma-iommu.c +which is accompanied by the following comment that seems to apply: + + /* + * Try to use all the 32-bit PCI addresses first. The original SAC vs. + * DAC reasoning loses relevance with PCIe, but enough hardware and + * firmware bugs are still lurking out there that it's safest not to + * venture into the 64-bit space until necessary. + * + * If your device goes wrong after seeing the notice then likely either + * its driver is not setting DMA masks accurately, the hardware has + * some inherent bug in handling >32-bit addresses, or not all the + * expected address bits are wired up between the device and the IOMMU. + */ + +Asking the ASM1061 on a discrete PCIe card to DMA from I/O virtual +address 0xffffffff00000000 produces the following I/O page faults: + +vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000000 flags=0x0010] +vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000500 flags=0x0010] + +Note that the upper 21 bits of the logged DMA address are zero. (When +asking a different PCIe device in the same PCIe slot to DMA to the +same I/O virtual address, we do see all the upper 32 bits of the DMA +address as 1, so this is not an issue with the chipset or IOMMU +configuration on the test system.) + +Also, hacking libahci to always set the upper 21 bits of all DMA +addresses to 1 produces no discernible effect on the behavior of the +ASM1061, and mkfs/mount/scrub/etc work as without this hack. + +This all strongly suggests that the ASM1061 has a 43 bit DMA address +limit, and this commit therefore adds a quirk to deal with this limit. + +This issue probably applies to (some of) the other supported ASMedia +parts as well, but we limit it to the PCI IDs known to refer to +ASM1061 parts, as that's the only part we know for sure to be affected +by this issue at this point. + +Link: https://lore.kernel.org/linux-ide/ZaZ2PIpEId-rl6jv@wantstofly.org/ +Signed-off-by: Lennert Buytenhek +[cassel: drop date from error messages in commit log] +Signed-off-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 29 +++++++++++++++++++++++------ + drivers/ata/ahci.h | 1 + + 2 files changed, 24 insertions(+), 6 deletions(-) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 2b8f0c3c3879a..20761eeea4100 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -48,6 +48,7 @@ enum { + enum board_ids { + /* board IDs by feature in alphabetical order */ + board_ahci, ++ board_ahci_43bit_dma, + board_ahci_ign_iferr, + board_ahci_low_power, + board_ahci_no_debounce_delay, +@@ -128,6 +129,13 @@ static const struct ata_port_info ahci_port_info[] = { + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_ops, + }, ++ [board_ahci_43bit_dma] = { ++ AHCI_HFLAGS (AHCI_HFLAG_43BIT_ONLY), ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_ops, ++ }, + [board_ahci_ign_iferr] = { + AHCI_HFLAGS (AHCI_HFLAG_IGN_IRQ_IF_ERR), + .flags = AHCI_FLAG_COMMON, +@@ -596,11 +604,11 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */ + { PCI_VDEVICE(PROMISE, 0x3781), board_ahci }, /* FastTrak TX8660 ahci-mode */ + +- /* Asmedia */ ++ /* ASMedia */ + { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci }, /* ASM1060 */ + { PCI_VDEVICE(ASMEDIA, 0x0602), board_ahci }, /* ASM1060 */ +- { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */ +- { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */ ++ { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci_43bit_dma }, /* ASM1061 */ ++ { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci_43bit_dma }, /* ASM1061/1062 */ + { PCI_VDEVICE(ASMEDIA, 0x0621), board_ahci }, /* ASM1061R */ + { PCI_VDEVICE(ASMEDIA, 0x0622), board_ahci }, /* ASM1062R */ + { PCI_VDEVICE(ASMEDIA, 0x0624), board_ahci }, /* ASM1062+JMB575 */ +@@ -948,11 +956,20 @@ static int ahci_pci_device_resume(struct device *dev) + + #endif /* CONFIG_PM */ + +-static int ahci_configure_dma_masks(struct pci_dev *pdev, int using_dac) ++static int ahci_configure_dma_masks(struct pci_dev *pdev, ++ struct ahci_host_priv *hpriv) + { +- const int dma_bits = using_dac ? 64 : 32; ++ int dma_bits; + int rc; + ++ if (hpriv->cap & HOST_CAP_64) { ++ dma_bits = 64; ++ if (hpriv->flags & AHCI_HFLAG_43BIT_ONLY) ++ dma_bits = 43; ++ } else { ++ dma_bits = 32; ++ } ++ + /* + * If the device fixup already set the dma_mask to some non-standard + * value, don't extend it here. This happens on STA2X11, for example. +@@ -1925,7 +1942,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + ahci_gtf_filter_workaround(host); + + /* initialize adapter */ +- rc = ahci_configure_dma_masks(pdev, hpriv->cap & HOST_CAP_64); ++ rc = ahci_configure_dma_masks(pdev, hpriv); + if (rc) + return rc; + +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index 4bae95b06ae3c..df8f8a1a3a34c 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -247,6 +247,7 @@ enum { + AHCI_HFLAG_SUSPEND_PHYS = BIT(26), /* handle PHYs during + suspend/resume */ + AHCI_HFLAG_NO_SXS = BIT(28), /* SXS not supported */ ++ AHCI_HFLAG_43BIT_ONLY = BIT(29), /* 43bit DMA addr limit */ + + /* ap->flags bits */ + +-- +2.43.0 + diff --git a/queue-6.6/ahci-asm1166-correct-count-of-reported-ports.patch b/queue-6.6/ahci-asm1166-correct-count-of-reported-ports.patch new file mode 100644 index 00000000000..5bf006e47c2 --- /dev/null +++ b/queue-6.6/ahci-asm1166-correct-count-of-reported-ports.patch @@ -0,0 +1,52 @@ +From 5f296addd4d893375697aebb9e6270cc2fbcc9f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 19:30:02 +0100 +Subject: ahci: asm1166: correct count of reported ports + +From: Conrad Kostecki + +[ Upstream commit 0077a504e1a4468669fd2e011108db49133db56e ] + +The ASM1166 SATA host controller always reports wrongly, +that it has 32 ports. But in reality, it only has six ports. + +This seems to be a hardware issue, as all tested ASM1166 +SATA host controllers reports such high count of ports. + +Example output: ahci 0000:09:00.0: AHCI 0001.0301 +32 slots 32 ports 6 Gbps 0xffffff3f impl SATA mode. + +By adjusting the port_map, the count is limited to six ports. + +New output: ahci 0000:09:00.0: AHCI 0001.0301 +32 slots 32 ports 6 Gbps 0x3f impl SATA mode. + +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=211873 +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218346 +Signed-off-by: Conrad Kostecki +Reviewed-by: Hans de Goede +Signed-off-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 08745e7db8201..2b8f0c3c3879a 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -657,6 +657,11 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets"); + static void ahci_pci_save_initial_config(struct pci_dev *pdev, + struct ahci_host_priv *hpriv) + { ++ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && pdev->device == 0x1166) { ++ dev_info(&pdev->dev, "ASM1166 has only six ports\n"); ++ hpriv->saved_port_map = 0x3f; ++ } ++ + if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) { + dev_info(&pdev->dev, "JMB361 has only one port\n"); + hpriv->saved_port_map = 1; +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-increase-default-bdl_pos_adj-for-apollo-lak.patch b/queue-6.6/alsa-hda-increase-default-bdl_pos_adj-for-apollo-lak.patch new file mode 100644 index 00000000000..05c005d42b2 --- /dev/null +++ b/queue-6.6/alsa-hda-increase-default-bdl_pos_adj-for-apollo-lak.patch @@ -0,0 +1,47 @@ +From 7929555090852ba2dc74bc53fa03f8c917f289b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 11:45:13 +0000 +Subject: ALSA: hda: Increase default bdl_pos_adj for Apollo Lake +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rui Salvaterra + +[ Upstream commit 56beedc88405fd8022edfd1c2e63d1bc6c95efcb ] + +Apollo Lake seems to also suffer from IRQ timing issues. After being up for ~4 +minutes, a Pentium N4200 system ends up falling back to workqueue-based IRQ +handling: + +[ 208.019906] snd_hda_intel 0000:00:0e.0: IRQ timing workaround is activated +for card #0. Suggest a bigger bdl_pos_adj. + +Unfortunately, the Baytrail and Braswell workaround value of 32 samples isn't +enough to fix the issue here. Default to 64 samples. + +Signed-off-by: Rui Salvaterra +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20240122114512.55808-3-rsalvaterra@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_intel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 1596157556862..a6a9d353fe635 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1738,6 +1738,8 @@ static int default_bdl_pos_adj(struct azx *chip) + case PCI_DEVICE_ID_INTEL_HDA_BYT: + case PCI_DEVICE_ID_INTEL_HDA_BSW: + return 32; ++ case PCI_DEVICE_ID_INTEL_HDA_APL: ++ return 64; + } + } + +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-replace-numeric-device-ids-with-constant-va.patch b/queue-6.6/alsa-hda-replace-numeric-device-ids-with-constant-va.patch new file mode 100644 index 00000000000..553664cc5c4 --- /dev/null +++ b/queue-6.6/alsa-hda-replace-numeric-device-ids-with-constant-va.patch @@ -0,0 +1,42 @@ +From 5257792105dd5e63b8687bb68fbf035807f98a93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 11:45:12 +0000 +Subject: ALSA: hda: Replace numeric device IDs with constant values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rui Salvaterra + +[ Upstream commit 3526860f26febbe46960f9b37f5dbd5ccc109ea8 ] + +We have self-explanatory constants for Intel HDA devices, let's use them instead +of magic numbers and code comments. + +Signed-off-by: Rui Salvaterra +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20240122114512.55808-2-rsalvaterra@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_intel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 55d3a78112e05..1596157556862 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1735,8 +1735,8 @@ static int default_bdl_pos_adj(struct azx *chip) + /* some exceptions: Atoms seem problematic with value 1 */ + if (chip->pci->vendor == PCI_VENDOR_ID_INTEL) { + switch (chip->pci->device) { +- case 0x0f04: /* Baytrail */ +- case 0x2284: /* Braswell */ ++ case PCI_DEVICE_ID_INTEL_HDA_BYT: ++ case PCI_DEVICE_ID_INTEL_HDA_BSW: + return 32; + } + } +-- +2.43.0 + diff --git a/queue-6.6/alsa-usb-audio-check-presence-of-valid-altsetting-co.patch b/queue-6.6/alsa-usb-audio-check-presence-of-valid-altsetting-co.patch new file mode 100644 index 00000000000..e2d58dd232f --- /dev/null +++ b/queue-6.6/alsa-usb-audio-check-presence-of-valid-altsetting-co.patch @@ -0,0 +1,86 @@ +From b3ada140243c2db843a07dbaba3223d801aa2cb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 15:12:54 +0300 +Subject: ALSA: usb-audio: Check presence of valid altsetting control + +From: Alexander Tsoy + +[ Upstream commit 346f59d1e8ed0eed41c80e1acb657e484c308e6a ] + +Many devices with a single alternate setting do not have a Valid +Alternate Setting Control and validation performed by +validate_sample_rate_table_v2v3() doesn't work on them and is not +really needed. So check the presense of control before sending +altsetting validation requests. + +MOTU Microbook IIc is suffering the most without this check. It +takes up to 40 seconds to bootup due to how slow it switches +sampling rates: + +[ 2659.164824] usb 3-2: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice= 0.60 +[ 2659.164827] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 +[ 2659.164829] usb 3-2: Product: MicroBook IIc +[ 2659.164830] usb 3-2: Manufacturer: MOTU +[ 2659.166204] usb 3-2: Found last interface = 3 +[ 2679.322298] usb 3-2: No valid sample rate available for 1:1, assuming a firmware bug +[ 2679.322306] usb 3-2: 1:1: add audio endpoint 0x3 +[ 2679.322321] usb 3-2: Creating new data endpoint #3 +[ 2679.322552] usb 3-2: 1:1 Set sample rate 96000, clock 1 +[ 2684.362250] usb 3-2: 2:1: cannot get freq (v2/v3): err -110 +[ 2694.444700] usb 3-2: No valid sample rate available for 2:1, assuming a firmware bug +[ 2694.444707] usb 3-2: 2:1: add audio endpoint 0x84 +[ 2694.444721] usb 3-2: Creating new data endpoint #84 +[ 2699.482103] usb 3-2: 2:1 Set sample rate 96000, clock 1 + +Signed-off-by: Alexander Tsoy +Link: https://lore.kernel.org/r/20240129121254.3454481-1-alexander@tsoy.me +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/format.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/sound/usb/format.c b/sound/usb/format.c +index ab5fed9f55b60..3b45d0ee76938 100644 +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -470,9 +470,11 @@ static int validate_sample_rate_table_v2v3(struct snd_usb_audio *chip, + int clock) + { + struct usb_device *dev = chip->dev; ++ struct usb_host_interface *alts; + unsigned int *table; + unsigned int nr_rates; + int i, err; ++ u32 bmControls; + + /* performing the rate verification may lead to unexpected USB bus + * behavior afterwards by some unknown reason. Do this only for the +@@ -481,6 +483,24 @@ static int validate_sample_rate_table_v2v3(struct snd_usb_audio *chip, + if (!(chip->quirk_flags & QUIRK_FLAG_VALIDATE_RATES)) + return 0; /* don't perform the validation as default */ + ++ alts = snd_usb_get_host_interface(chip, fp->iface, fp->altsetting); ++ if (!alts) ++ return 0; ++ ++ if (fp->protocol == UAC_VERSION_3) { ++ struct uac3_as_header_descriptor *as = snd_usb_find_csint_desc( ++ alts->extra, alts->extralen, NULL, UAC_AS_GENERAL); ++ bmControls = le32_to_cpu(as->bmControls); ++ } else { ++ struct uac2_as_header_descriptor *as = snd_usb_find_csint_desc( ++ alts->extra, alts->extralen, NULL, UAC_AS_GENERAL); ++ bmControls = as->bmControls; ++ } ++ ++ if (!uac_v2v3_control_is_readable(bmControls, ++ UAC2_AS_VAL_ALT_SETTINGS)) ++ return 0; ++ + table = kcalloc(fp->nr_rates, sizeof(*table), GFP_KERNEL); + if (!table) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/alsa-usb-audio-ignore-clock-selector-errors-for-sing.patch b/queue-6.6/alsa-usb-audio-ignore-clock-selector-errors-for-sing.patch new file mode 100644 index 00000000000..d2a855ec839 --- /dev/null +++ b/queue-6.6/alsa-usb-audio-ignore-clock-selector-errors-for-sing.patch @@ -0,0 +1,68 @@ +From a6c4b303d3542a5ce308f452055356c459769c1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 14:53:08 +0300 +Subject: ALSA: usb-audio: Ignore clock selector errors for single connection + +From: Alexander Tsoy + +[ Upstream commit eaa1b01fe709d6a236a9cec74813e0400601fd23 ] + +For devices with multiple clock sources connected to a selector, we need +to check what a clock selector control request has returned. This is +needed to ensure that a requested clock source is indeed selected and for +autoclock feature to work. + +For devices with single clock source connected, if we get an error there +is nothing else we can do about it. We can't skip clock selector setup as +it is required by some devices. So lets just ignore error in this case. + +This should fix various buggy Mackie devices: + +[ 649.109785] usb 1-1.3: parse_audio_format_rates_v2v3(): unable to find clock source (clock -32) +[ 649.111946] usb 1-1.3: parse_audio_format_rates_v2v3(): unable to find clock source (clock -32) +[ 649.113822] usb 1-1.3: parse_audio_format_rates_v2v3(): unable to find clock source (clock -32) + +There is also interesting info from the Windows documentation [1] (this +is probably why manufacturers dont't even test this feature): + +"The USB Audio 2.0 driver doesn't support clock selection. The driver +uses the Clock Source Entity, which is selected by default and never +issues a Clock Selector Control SET CUR request." + +Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/audio/usb-2-0-audio-drivers [1] +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217314 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218175 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218342 +Signed-off-by: Alexander Tsoy +Link: https://lore.kernel.org/r/20240201115308.17838-1-alexander@tsoy.me +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/clock.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/sound/usb/clock.c b/sound/usb/clock.c +index 33db334e65566..a676ad093d189 100644 +--- a/sound/usb/clock.c ++++ b/sound/usb/clock.c +@@ -328,8 +328,16 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip, + if (chip->quirk_flags & QUIRK_FLAG_SKIP_CLOCK_SELECTOR) + return ret; + err = uac_clock_selector_set_val(chip, entity_id, cur); +- if (err < 0) ++ if (err < 0) { ++ if (pins == 1) { ++ usb_audio_dbg(chip, ++ "%s(): selector returned an error, " ++ "assuming a firmware bug, id %d, ret %d\n", ++ __func__, clock_id, err); ++ return ret; ++ } + return err; ++ } + } + + if (!validate || ret > 0 || !chip->autoclock) +-- +2.43.0 + diff --git a/queue-6.6/aoe-avoid-potential-deadlock-at-set_capacity.patch b/queue-6.6/aoe-avoid-potential-deadlock-at-set_capacity.patch new file mode 100644 index 00000000000..1712124ff7d --- /dev/null +++ b/queue-6.6/aoe-avoid-potential-deadlock-at-set_capacity.patch @@ -0,0 +1,75 @@ +From 6f1f0cae462a5051abbd6f13d893b1b2e0974237 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 10:24:36 +0300 +Subject: aoe: avoid potential deadlock at set_capacity + +From: Maksim Kiselev + +[ Upstream commit e169bd4fb2b36c4b2bee63c35c740c85daeb2e86 ] + +Move set_capacity() outside of the section procected by (&d->lock). +To avoid possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- +[1] lock(&bdev->bd_size_lock); + local_irq_disable(); + [2] lock(&d->lock); + [3] lock(&bdev->bd_size_lock); + +[4] lock(&d->lock); + + *** DEADLOCK *** + +Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity(). +[2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc() +is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call. +In this situation an attempt to acquire [4]lock(&d->lock) from +aoecmd_cfg_rsp() will lead to deadlock. + +So the simplest solution is breaking lock dependency +[2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity() +outside. + +Signed-off-by: Maksim Kiselev +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20240124072436.3745720-2-bigunclemax@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/aoe/aoeblk.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/block/aoe/aoeblk.c b/drivers/block/aoe/aoeblk.c +index cf6883756155a..37eff1c974515 100644 +--- a/drivers/block/aoe/aoeblk.c ++++ b/drivers/block/aoe/aoeblk.c +@@ -333,6 +333,7 @@ aoeblk_gdalloc(void *vp) + struct gendisk *gd; + mempool_t *mp; + struct blk_mq_tag_set *set; ++ sector_t ssize; + ulong flags; + int late = 0; + int err; +@@ -395,7 +396,7 @@ aoeblk_gdalloc(void *vp) + gd->minors = AOE_PARTITIONS; + gd->fops = &aoe_bdops; + gd->private_data = d; +- set_capacity(gd, d->ssize); ++ ssize = d->ssize; + snprintf(gd->disk_name, sizeof gd->disk_name, "etherd/e%ld.%d", + d->aoemajor, d->aoeminor); + +@@ -404,6 +405,8 @@ aoeblk_gdalloc(void *vp) + + spin_unlock_irqrestore(&d->lock, flags); + ++ set_capacity(gd, ssize); ++ + err = device_add_disk(NULL, gd, aoe_attr_groups); + if (err) + goto out_disk_cleanup; +-- +2.43.0 + diff --git a/queue-6.6/arm-dts-fix-tpm-schema-violations.patch b/queue-6.6/arm-dts-fix-tpm-schema-violations.patch new file mode 100644 index 00000000000..46b732cbc80 --- /dev/null +++ b/queue-6.6/arm-dts-fix-tpm-schema-violations.patch @@ -0,0 +1,157 @@ +From 0fc8bc214755621db6d3097ddc5f3e94bfdc1791 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jan 2024 10:03:51 +0100 +Subject: ARM: dts: Fix TPM schema violations + +From: Lukas Wunner + +[ Upstream commit 8412c47d68436b9f9a260039a4a773daa6824925 ] + +Since commit 26c9d152ebf3 ("dt-bindings: tpm: Consolidate TCG TIS +bindings"), several issues are reported by "make dtbs_check" for ARM +devicetrees: + +The nodename needs to be "tpm@0" rather than "tpmdev@0" and the +compatible property needs to contain the chip's name in addition to the +generic "tcg,tpm_tis-spi" or "tcg,tpm-tis-i2c": + + tpmdev@0: $nodename:0: 'tpmdev@0' does not match '^tpm(@[0-9a-f]+)?$' + from schema $id: http://devicetree.org/schemas/tpm/tcg,tpm_tis-spi.yaml# + + tpm@2e: compatible: 'oneOf' conditional failed, one must be fixed: + ['tcg,tpm-tis-i2c'] is too short + from schema $id: http://devicetree.org/schemas/tpm/tcg,tpm-tis-i2c.yaml# + +Fix these schema violations. + +Aspeed Facebook BMCs use an Infineon SLB9670: +https://lore.kernel.org/all/ZZSmMJ%2F%2Fl972Qbxu@fedora/ +https://lore.kernel.org/all/ZZT4%2Fw2eVzMhtsPx@fedora/ +https://lore.kernel.org/all/ZZTS0p1hdAchIbKp@heinlein.vulture-banana.ts.net/ + +Aspeed Tacoma uses a Nuvoton NPCT75X per commit 39d8a73c53a2 ("ARM: dts: +aspeed: tacoma: Add TPM"). + +phyGATE-Tauri uses an Infineon SLB9670: +https://lore.kernel.org/all/ab45c82485fa272f74adf560cbb58ee60cc42689.camel@phytec.de/ + +A single schema violation remains in am335x-moxa-uc-2100-common.dtsi +because it is unknown which chip is used on the board. The devicetree's +author has been asked for clarification but has not responded so far: +https://lore.kernel.org/all/20231220090910.GA32182@wunner.de/ + +Signed-off-by: Lukas Wunner +Reviewed-by: Patrick Williams +Reviewed-by: Tao Ren +Reviewed-by: Bruno Thomsen +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-bletchley.dts | 4 ++-- + arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-wedge400.dts | 4 ++-- + arch/arm/boot/dts/aspeed/aspeed-bmc-opp-tacoma.dts | 2 +- + arch/arm/boot/dts/aspeed/ast2600-facebook-netbmc-common.dtsi | 4 ++-- + arch/arm/boot/dts/nxp/imx/imx6ull-phytec-tauri.dtsi | 2 +- + arch/arm/boot/dts/nxp/imx/imx7d-flex-concentrator.dts | 2 +- + arch/arm/boot/dts/ti/omap/am335x-moxa-uc-2100-common.dtsi | 2 +- + 7 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-bletchley.dts b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-bletchley.dts +index e899de681f475..5be0e8fd2633c 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-bletchley.dts ++++ b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-bletchley.dts +@@ -45,8 +45,8 @@ + num-chipselects = <1>; + cs-gpios = <&gpio0 ASPEED_GPIO(Z, 0) GPIO_ACTIVE_LOW>; + +- tpmdev@0 { +- compatible = "tcg,tpm_tis-spi"; ++ tpm@0 { ++ compatible = "infineon,slb9670", "tcg,tpm_tis-spi"; + spi-max-frequency = <33000000>; + reg = <0>; + }; +diff --git a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-wedge400.dts b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-wedge400.dts +index a677c827e758f..5a8169bbda879 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-wedge400.dts ++++ b/arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-wedge400.dts +@@ -80,8 +80,8 @@ + gpio-miso = <&gpio ASPEED_GPIO(R, 5) GPIO_ACTIVE_HIGH>; + num-chipselects = <1>; + +- tpmdev@0 { +- compatible = "tcg,tpm_tis-spi"; ++ tpm@0 { ++ compatible = "infineon,slb9670", "tcg,tpm_tis-spi"; + spi-max-frequency = <33000000>; + reg = <0>; + }; +diff --git a/arch/arm/boot/dts/aspeed/aspeed-bmc-opp-tacoma.dts b/arch/arm/boot/dts/aspeed/aspeed-bmc-opp-tacoma.dts +index 3f6010ef2b86f..213023bc5aec4 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-bmc-opp-tacoma.dts ++++ b/arch/arm/boot/dts/aspeed/aspeed-bmc-opp-tacoma.dts +@@ -456,7 +456,7 @@ + status = "okay"; + + tpm: tpm@2e { +- compatible = "tcg,tpm-tis-i2c"; ++ compatible = "nuvoton,npct75x", "tcg,tpm-tis-i2c"; + reg = <0x2e>; + }; + }; +diff --git a/arch/arm/boot/dts/aspeed/ast2600-facebook-netbmc-common.dtsi b/arch/arm/boot/dts/aspeed/ast2600-facebook-netbmc-common.dtsi +index 31590d3186a2e..00e5887c926f1 100644 +--- a/arch/arm/boot/dts/aspeed/ast2600-facebook-netbmc-common.dtsi ++++ b/arch/arm/boot/dts/aspeed/ast2600-facebook-netbmc-common.dtsi +@@ -35,8 +35,8 @@ + gpio-mosi = <&gpio0 ASPEED_GPIO(X, 4) GPIO_ACTIVE_HIGH>; + gpio-miso = <&gpio0 ASPEED_GPIO(X, 5) GPIO_ACTIVE_HIGH>; + +- tpmdev@0 { +- compatible = "tcg,tpm_tis-spi"; ++ tpm@0 { ++ compatible = "infineon,slb9670", "tcg,tpm_tis-spi"; + spi-max-frequency = <33000000>; + reg = <0>; + }; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6ull-phytec-tauri.dtsi b/arch/arm/boot/dts/nxp/imx/imx6ull-phytec-tauri.dtsi +index ea627638e40cf..7dd1fe5a2fb76 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6ull-phytec-tauri.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6ull-phytec-tauri.dtsi +@@ -121,7 +121,7 @@ + tpm_tis: tpm@1 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_tpm>; +- compatible = "tcg,tpm_tis-spi"; ++ compatible = "infineon,slb9670", "tcg,tpm_tis-spi"; + reg = <1>; + spi-max-frequency = <20000000>; + interrupt-parent = <&gpio5>; +diff --git a/arch/arm/boot/dts/nxp/imx/imx7d-flex-concentrator.dts b/arch/arm/boot/dts/nxp/imx/imx7d-flex-concentrator.dts +index 3a723843d5626..9984b343cdf0c 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx7d-flex-concentrator.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx7d-flex-concentrator.dts +@@ -130,7 +130,7 @@ + * TCG specification - Section 6.4.1 Clocking: + * TPM shall support a SPI clock frequency range of 10-24 MHz. + */ +- st33htph: tpm-tis@0 { ++ st33htph: tpm@0 { + compatible = "st,st33htpm-spi", "tcg,tpm_tis-spi"; + reg = <0>; + spi-max-frequency = <24000000>; +diff --git a/arch/arm/boot/dts/ti/omap/am335x-moxa-uc-2100-common.dtsi b/arch/arm/boot/dts/ti/omap/am335x-moxa-uc-2100-common.dtsi +index b8730aa52ce6f..a59331aa58e55 100644 +--- a/arch/arm/boot/dts/ti/omap/am335x-moxa-uc-2100-common.dtsi ++++ b/arch/arm/boot/dts/ti/omap/am335x-moxa-uc-2100-common.dtsi +@@ -217,7 +217,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&spi1_pins>; + +- tpm_spi_tis@0 { ++ tpm@0 { + compatible = "tcg,tpm_tis-spi"; + reg = <0>; + spi-max-frequency = <500000>; +-- +2.43.0 + diff --git a/queue-6.6/asoc-amd-acp-add-check-for-cpu-dai-link-initializati.patch b/queue-6.6/asoc-amd-acp-add-check-for-cpu-dai-link-initializati.patch new file mode 100644 index 00000000000..5886f8cb5a5 --- /dev/null +++ b/queue-6.6/asoc-amd-acp-add-check-for-cpu-dai-link-initializati.patch @@ -0,0 +1,44 @@ +From 2dc2754fa5abc63e96304b16716dbaf82176764a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 20:00:21 +0530 +Subject: ASoC: amd: acp: Add check for cpu dai link initialization + +From: Venkata Prasad Potturu + +[ Upstream commit 6cc2aa9a75f2397d42b78d4c159bc06722183c78 ] + +Add condition check for cpu dai link initialization for amplifier +codec path, as same pcm id uses for both headset and speaker path +for RENOIR platforms. + +Signed-off-by: Venkata Prasad Potturu +Link: https://msgid.link/r/20240118143023.1903984-3-venkataprasad.potturu@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-mach-common.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/amd/acp/acp-mach-common.c b/sound/soc/amd/acp/acp-mach-common.c +index a06af82b80565..fc4e91535578b 100644 +--- a/sound/soc/amd/acp/acp-mach-common.c ++++ b/sound/soc/amd/acp/acp-mach-common.c +@@ -1416,8 +1416,13 @@ int acp_sofdsp_dai_links_create(struct snd_soc_card *card) + if (drv_data->amp_cpu_id == I2S_SP) { + links[i].name = "acp-amp-codec"; + links[i].id = AMP_BE_ID; +- links[i].cpus = sof_sp_virtual; +- links[i].num_cpus = ARRAY_SIZE(sof_sp_virtual); ++ if (drv_data->platform == RENOIR) { ++ links[i].cpus = sof_sp; ++ links[i].num_cpus = ARRAY_SIZE(sof_sp); ++ } else { ++ links[i].cpus = sof_sp_virtual; ++ links[i].num_cpus = ARRAY_SIZE(sof_sp_virtual); ++ } + links[i].platforms = sof_component; + links[i].num_platforms = ARRAY_SIZE(sof_component); + links[i].dpcm_playback = 1; +-- +2.43.0 + diff --git a/queue-6.6/asoc-sunxi-sun4i-spdif-add-support-for-allwinner-h61.patch b/queue-6.6/asoc-sunxi-sun4i-spdif-add-support-for-allwinner-h61.patch new file mode 100644 index 00000000000..a3835ef2ff1 --- /dev/null +++ b/queue-6.6/asoc-sunxi-sun4i-spdif-add-support-for-allwinner-h61.patch @@ -0,0 +1,45 @@ +From 55bfe00210f9bbd07ef301cd91b8c16757fdb3a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 00:32:43 +0800 +Subject: ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 + +From: Chen-Yu Tsai + +[ Upstream commit 0adf963b8463faa44653e22e56ce55f747e68868 ] + +The SPDIF hardware block found in the H616 SoC has the same layout as +the one found in the H6 SoC, except that it is missing the receiver +side. + +Since the driver currently only supports the transmit function, support +for the H616 is identical to what is currently done for the H6. + +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Andre Przywara +Reviewed-by: Jernej Skrabec +Link: https://msgid.link/r/20240127163247.384439-4-wens@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-spdif.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c +index b849bb7cf58e2..2347aeb049bcc 100644 +--- a/sound/soc/sunxi/sun4i-spdif.c ++++ b/sound/soc/sunxi/sun4i-spdif.c +@@ -578,6 +578,11 @@ static const struct of_device_id sun4i_spdif_of_match[] = { + .compatible = "allwinner,sun50i-h6-spdif", + .data = &sun50i_h6_spdif_quirks, + }, ++ { ++ .compatible = "allwinner,sun50i-h616-spdif", ++ /* Essentially the same as the H6, but without RX */ ++ .data = &sun50i_h6_spdif_quirks, ++ }, + { /* sentinel */ } + }; + MODULE_DEVICE_TABLE(of, sun4i_spdif_of_match); +-- +2.43.0 + diff --git a/queue-6.6/asoc-wm_adsp-don-t-overwrite-fwf_name-with-the-defau.patch b/queue-6.6/asoc-wm_adsp-don-t-overwrite-fwf_name-with-the-defau.patch new file mode 100644 index 00000000000..3d0853ff1e2 --- /dev/null +++ b/queue-6.6/asoc-wm_adsp-don-t-overwrite-fwf_name-with-the-defau.patch @@ -0,0 +1,102 @@ +From 59924f57f4072aa5f21b44360b8f5f9d6dab3242 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 16:27:21 +0000 +Subject: ASoC: wm_adsp: Don't overwrite fwf_name with the default + +From: Richard Fitzgerald + +[ Upstream commit daf3f0f99cde93a066240462b7a87cdfeedc04c0 ] + +There's no need to overwrite fwf_name with a kstrdup() of the cs_dsp part +name. It is trivial to select either fwf_name or cs_dsp.part as the string +to use when building the filename in wm_adsp_request_firmware_file(). + +This leaves fwf_name entirely owned by the codec driver. + +It also avoids problems with freeing the pointer. With the original code +fwf_name was either a pointer owned by the codec driver, or a kstrdup() +created by wm_adsp. This meant wm_adsp must free it if it set it, but not +if the codec driver set it. The code was handling this by using +devm_kstrdup(). +But there is no absolute requirement that wm_adsp_common_init() must be +called from probe(), so this was a pseudo-memory leak - each new call to +wm_adsp_common_init() would allocate another block of memory but these +would only be freed if the owning codec driver was removed. + +Signed-off-by: Richard Fitzgerald +Link: https://msgid.link/r/20240129162737.497-3-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 29 ++++++++++++----------------- + 1 file changed, 12 insertions(+), 17 deletions(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index cb654f1b09f10..72b90a7ee4b68 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -739,19 +739,25 @@ static int wm_adsp_request_firmware_file(struct wm_adsp *dsp, + const char *filetype) + { + struct cs_dsp *cs_dsp = &dsp->cs_dsp; ++ const char *fwf; + char *s, c; + int ret = 0; + ++ if (dsp->fwf_name) ++ fwf = dsp->fwf_name; ++ else ++ fwf = dsp->cs_dsp.name; ++ + if (system_name && asoc_component_prefix) + *filename = kasprintf(GFP_KERNEL, "%s%s-%s-%s-%s-%s.%s", dir, dsp->part, +- dsp->fwf_name, wm_adsp_fw[dsp->fw].file, system_name, ++ fwf, wm_adsp_fw[dsp->fw].file, system_name, + asoc_component_prefix, filetype); + else if (system_name) + *filename = kasprintf(GFP_KERNEL, "%s%s-%s-%s-%s.%s", dir, dsp->part, +- dsp->fwf_name, wm_adsp_fw[dsp->fw].file, system_name, ++ fwf, wm_adsp_fw[dsp->fw].file, system_name, + filetype); + else +- *filename = kasprintf(GFP_KERNEL, "%s%s-%s-%s.%s", dir, dsp->part, dsp->fwf_name, ++ *filename = kasprintf(GFP_KERNEL, "%s%s-%s-%s.%s", dir, dsp->part, fwf, + wm_adsp_fw[dsp->fw].file, filetype); + + if (*filename == NULL) +@@ -863,29 +869,18 @@ static int wm_adsp_request_firmware_files(struct wm_adsp *dsp, + } + + adsp_err(dsp, "Failed to request firmware <%s>%s-%s-%s<-%s<%s>>.wmfw\n", +- cirrus_dir, dsp->part, dsp->fwf_name, wm_adsp_fw[dsp->fw].file, +- system_name, asoc_component_prefix); ++ cirrus_dir, dsp->part, ++ dsp->fwf_name ? dsp->fwf_name : dsp->cs_dsp.name, ++ wm_adsp_fw[dsp->fw].file, system_name, asoc_component_prefix); + + return -ENOENT; + } + + static int wm_adsp_common_init(struct wm_adsp *dsp) + { +- char *p; +- + INIT_LIST_HEAD(&dsp->compr_list); + INIT_LIST_HEAD(&dsp->buffer_list); + +- if (!dsp->fwf_name) { +- p = devm_kstrdup(dsp->cs_dsp.dev, dsp->cs_dsp.name, GFP_KERNEL); +- if (!p) +- return -ENOMEM; +- +- dsp->fwf_name = p; +- for (; *p != 0; ++p) +- *p = tolower(*p); +- } +- + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.6/block-fix-warning-in-_copy_from_iter.patch b/queue-6.6/block-fix-warning-in-_copy_from_iter.patch new file mode 100644 index 00000000000..f5cd5d858e5 --- /dev/null +++ b/queue-6.6/block-fix-warning-in-_copy_from_iter.patch @@ -0,0 +1,64 @@ +From e08216397c09b35168ebdc0d87557b7c660450f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 21:26:34 +0100 +Subject: block: Fix WARNING in _copy_from_iter + +From: Christian A. Ehrhardt + +[ Upstream commit 13f3956eb5681a4045a8dfdef48df5dc4d9f58a6 ] + +Syzkaller reports a warning in _copy_from_iter because an +iov_iter is supposedly used in the wrong direction. The reason +is that syzcaller managed to generate a request with +a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs +the kernel to copy user buffers into the kernel, read into +the copied buffers and then copy the data back to user space. + +Thus the iovec is used in both directions. + +Detect this situation in the block layer and construct a new +iterator with the correct direction for the copy-in. + +Reported-by: syzbot+a532b03fdfee2c137666@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/lkml/0000000000009b92c10604d7a5e9@google.com/t/ +Reported-by: syzbot+63dec323ac56c28e644f@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/lkml/0000000000003faaa105f6e7c658@google.com/T/ +Signed-off-by: Christian A. Ehrhardt +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20240121202634.275068-1-lk@c--e.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-map.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/block/blk-map.c b/block/blk-map.c +index 8584babf3ea0c..71210cdb34426 100644 +--- a/block/blk-map.c ++++ b/block/blk-map.c +@@ -205,12 +205,19 @@ static int bio_copy_user_iov(struct request *rq, struct rq_map_data *map_data, + /* + * success + */ +- if ((iov_iter_rw(iter) == WRITE && +- (!map_data || !map_data->null_mapped)) || +- (map_data && map_data->from_user)) { ++ if (iov_iter_rw(iter) == WRITE && ++ (!map_data || !map_data->null_mapped)) { + ret = bio_copy_from_iter(bio, iter); + if (ret) + goto cleanup; ++ } else if (map_data && map_data->from_user) { ++ struct iov_iter iter2 = *iter; ++ ++ /* This is the copy-in part of SG_DXFER_TO_FROM_DEV. */ ++ iter2.data_source = ITER_SOURCE; ++ ret = bio_copy_from_iter(bio, &iter2); ++ if (ret) ++ goto cleanup; + } else { + if (bmd->is_our_pages) + zero_fill_bio(bio); +-- +2.43.0 + diff --git a/queue-6.6/cifs-change-tcon-status-when-need_reconnect-is-set-o.patch b/queue-6.6/cifs-change-tcon-status-when-need_reconnect-is-set-o.patch new file mode 100644 index 00000000000..727eff76aee --- /dev/null +++ b/queue-6.6/cifs-change-tcon-status-when-need_reconnect-is-set-o.patch @@ -0,0 +1,85 @@ +From 1d6167360a368ef7881fe7505aed54b88c990d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 15:00:46 +0000 +Subject: cifs: change tcon status when need_reconnect is set on it + +From: Shyam Prasad N + +[ Upstream commit c6e02eefd6ace3da3369c764f15429f5647056af ] + +When a tcon is marked for need_reconnect, the intention +is to have it reconnected. + +This change adjusts tcon->status in cifs_tree_connect +when need_reconnect is set. Also, this change has a minor +correction in resetting need_reconnect on success. It makes +sure that it is done with tc_lock held. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 5 +++++ + fs/smb/client/dfs.c | 7 ++++++- + fs/smb/client/file.c | 3 +++ + 3 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index 19440255944b0..c19eae07fa69a 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -4226,6 +4226,11 @@ int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon, const stru + + /* only send once per connect */ + spin_lock(&tcon->tc_lock); ++ ++ /* if tcon is marked for needing reconnect, update state */ ++ if (tcon->need_reconnect) ++ tcon->status = TID_NEED_TCON; ++ + if (tcon->status == TID_GOOD) { + spin_unlock(&tcon->tc_lock); + return 0; +diff --git a/fs/smb/client/dfs.c b/fs/smb/client/dfs.c +index a8a1d386da656..449c59830039b 100644 +--- a/fs/smb/client/dfs.c ++++ b/fs/smb/client/dfs.c +@@ -565,6 +565,11 @@ int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon, const stru + + /* only send once per connect */ + spin_lock(&tcon->tc_lock); ++ ++ /* if tcon is marked for needing reconnect, update state */ ++ if (tcon->need_reconnect) ++ tcon->status = TID_NEED_TCON; ++ + if (tcon->status == TID_GOOD) { + spin_unlock(&tcon->tc_lock); + return 0; +@@ -625,8 +630,8 @@ int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon, const stru + spin_lock(&tcon->tc_lock); + if (tcon->status == TID_IN_TCON) + tcon->status = TID_GOOD; +- spin_unlock(&tcon->tc_lock); + tcon->need_reconnect = false; ++ spin_unlock(&tcon->tc_lock); + } + + return rc; +diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c +index 32a8525415d96..4cbb5487bd8d0 100644 +--- a/fs/smb/client/file.c ++++ b/fs/smb/client/file.c +@@ -175,6 +175,9 @@ cifs_mark_open_files_invalid(struct cifs_tcon *tcon) + + /* only send once per connect */ + spin_lock(&tcon->tc_lock); ++ if (tcon->need_reconnect) ++ tcon->status = TID_NEED_RECON; ++ + if (tcon->status != TID_NEED_RECON) { + spin_unlock(&tcon->tc_lock); + return; +-- +2.43.0 + diff --git a/queue-6.6/cifs-cifs_pick_channel-should-try-selecting-active-c.patch b/queue-6.6/cifs-cifs_pick_channel-should-try-selecting-active-c.patch new file mode 100644 index 00000000000..82731c9d3a0 --- /dev/null +++ b/queue-6.6/cifs-cifs_pick_channel-should-try-selecting-active-c.patch @@ -0,0 +1,42 @@ +From 7f9a837cdbaae5c8f287eb4257a146c9f939d5d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 03:32:43 +0000 +Subject: cifs: cifs_pick_channel should try selecting active channels + +From: Shyam Prasad N + +[ Upstream commit fc43a8ac396d302ced1e991e4913827cf72c8eb9 ] + +cifs_pick_channel today just selects a channel based +on the policy of least loaded channel. However, it +does not take into account if the channel needs +reconnect. As a result, we can have failures in send +that can be completely avoided. + +This change doesn't make a channel a candidate for +this selection if it needs reconnect. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/transport.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c +index 4f717ad7c21b4..8695c9961f5aa 100644 +--- a/fs/smb/client/transport.c ++++ b/fs/smb/client/transport.c +@@ -1026,6 +1026,9 @@ struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses) + if (!server || server->terminate) + continue; + ++ if (CIFS_CHAN_NEEDS_RECONNECT(ses, i)) ++ continue; ++ + /* + * strictly speaking, we should pick up req_lock to read + * server->in_flight. But it shouldn't matter much here if we +-- +2.43.0 + diff --git a/queue-6.6/cifs-do-not-search-for-channel-if-server-is-terminat.patch b/queue-6.6/cifs-do-not-search-for-channel-if-server-is-terminat.patch new file mode 100644 index 00000000000..6c821d7b0fc --- /dev/null +++ b/queue-6.6/cifs-do-not-search-for-channel-if-server-is-terminat.patch @@ -0,0 +1,69 @@ +From 3e0a41fa6b4bd5d4471ca6bbfd4c8d0f76408f01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 11:15:28 +0000 +Subject: cifs: do not search for channel if server is terminating + +From: Shyam Prasad N + +[ Upstream commit 88675b22d34e6e815ad4bde09c590ccb2d50c59d ] + +In order to scale down the channels, the following sequence +of operations happen: +1. server struct is marked for terminate +2. the channel is deallocated in the ses->chans array +3. at a later point the cifsd thread actually terminates the server + +Between 2 and 3, there can be calls to find the channel for +a server struct. When that happens, there can be an ugly warning +that's logged. But this is expected. + +So this change does two things: +1. in cifs_ses_get_chan_index, if server->terminate is set, return +2. always make sure server->terminate is set with chan_lock held + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/sess.c | 4 ++++ + fs/smb/client/smb2pdu.c | 2 +- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index a20a5d0836dc9..52f7a411e2bbf 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -75,6 +75,10 @@ cifs_ses_get_chan_index(struct cifs_ses *ses, + { + unsigned int i; + ++ /* if the channel is waiting for termination */ ++ if (server->terminate) ++ return CIFS_INVAL_CHAN_INDEX; ++ + for (i = 0; i < ses->chan_count; i++) { + if (ses->chans[i].server == server) + return i; +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index ce2d28537bc8a..97fc2f85b429d 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -178,6 +178,7 @@ cifs_chan_skip_or_disable(struct cifs_ses *ses, + } + + ses->chans[chan_index].server = NULL; ++ server->terminate = true; + spin_unlock(&ses->chan_lock); + + /* +@@ -188,7 +189,6 @@ cifs_chan_skip_or_disable(struct cifs_ses *ses, + */ + cifs_put_tcp_session(server, from_reconnect); + +- server->terminate = true; + cifs_signal_cifsd_for_reconnect(server, false); + + /* mark primary server as needing reconnect */ +-- +2.43.0 + diff --git a/queue-6.6/cifs-handle-cases-where-multiple-sessions-share-conn.patch b/queue-6.6/cifs-handle-cases-where-multiple-sessions-share-conn.patch new file mode 100644 index 00000000000..ac0537405ca --- /dev/null +++ b/queue-6.6/cifs-handle-cases-where-multiple-sessions-share-conn.patch @@ -0,0 +1,56 @@ +From 7295c428a97bab38ecdf4de4ef43f4ae6d3722f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 15:00:47 +0000 +Subject: cifs: handle cases where multiple sessions share connection + +From: Shyam Prasad N + +[ Upstream commit a39c757bf0596b17482a507f31c3ef0af0d1d2b4 ] + +Based on our implementation of multichannel, it is entirely +possible that a server struct may not be found in any channel +of an SMB session. + +In such cases, we should be prepared to move on and search for +the server struct in the next session. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 6 ++++++ + fs/smb/client/sess.c | 1 - + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index c19eae07fa69a..a4147e999736a 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -229,6 +229,12 @@ cifs_mark_tcp_ses_conns_for_reconnect(struct TCP_Server_Info *server, + list_for_each_entry_safe(ses, nses, &pserver->smb_ses_list, smb_ses_list) { + /* check if iface is still active */ + spin_lock(&ses->chan_lock); ++ if (cifs_ses_get_chan_index(ses, server) == ++ CIFS_INVAL_CHAN_INDEX) { ++ spin_unlock(&ses->chan_lock); ++ continue; ++ } ++ + if (!cifs_chan_is_iface_active(ses, server)) { + spin_unlock(&ses->chan_lock); + cifs_chan_update_iface(ses, server); +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index 52f7a411e2bbf..07726b456a0a8 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -88,7 +88,6 @@ cifs_ses_get_chan_index(struct cifs_ses *ses, + if (server) + cifs_dbg(VFS, "unable to get chan index for server: 0x%llx", + server->conn_id); +- WARN_ON(1); + return CIFS_INVAL_CHAN_INDEX; + } + +-- +2.43.0 + diff --git a/queue-6.6/cifs-helper-function-to-check-replayable-error-codes.patch b/queue-6.6/cifs-helper-function-to-check-replayable-error-codes.patch new file mode 100644 index 00000000000..449b7d5f687 --- /dev/null +++ b/queue-6.6/cifs-helper-function-to-check-replayable-error-codes.patch @@ -0,0 +1,58 @@ +From 4c90bc8e525a7a0c6a9e2c741d02295f45cfb6c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 03:32:46 +0000 +Subject: cifs: helper function to check replayable error codes + +From: Shyam Prasad N + +[ Upstream commit 64cc377b7628b81ffdbdb1c6bacfba895dcac3f8 ] + +The code to check for replay is not just -EAGAIN. In some +cases, the send request or receive response may result in +network errors, which we're now mapping to -ECONNABORTED. + +This change introduces a helper function which checks +if the error returned in one of the above two errors. +And all checks for replays will now use this helper. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cached_dir.c | 1 + + fs/smb/client/cifsglob.h | 7 +++++++ + 2 files changed, 8 insertions(+) + +diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c +index 9718926205047..5730c65ffb40d 100644 +--- a/fs/smb/client/cached_dir.c ++++ b/fs/smb/client/cached_dir.c +@@ -367,6 +367,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + atomic_inc(&tcon->num_remote_opens); + } + kfree(utf16_path); ++ + return rc; + } + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index 942e6ece56b1a..f794b16095e43 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -1820,6 +1820,13 @@ static inline bool is_retryable_error(int error) + return false; + } + ++static inline bool is_replayable_error(int error) ++{ ++ if (error == -EAGAIN || error == -ECONNABORTED) ++ return true; ++ return false; ++} ++ + + /* cifs_get_writable_file() flags */ + #define FIND_WR_ANY 0 +-- +2.43.0 + diff --git a/queue-6.6/cifs-make-sure-that-channel-scaling-is-done-only-onc.patch b/queue-6.6/cifs-make-sure-that-channel-scaling-is-done-only-onc.patch new file mode 100644 index 00000000000..c9fda23e868 --- /dev/null +++ b/queue-6.6/cifs-make-sure-that-channel-scaling-is-done-only-onc.patch @@ -0,0 +1,98 @@ +From 2d07e2ba2e5acc0cd6d97642d55e7de05d8ead29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 13:58:13 +0000 +Subject: cifs: make sure that channel scaling is done only once + +From: Shyam Prasad N + +[ Upstream commit ee36a3b345c433a846effcdcfba437c2298eeda5 ] + +Following a successful cifs_tree_connect, we have the code +to scale up/down the number of channels in the session. +However, it is not protected by a lock today. + +As a result, this code can be executed by several processes +that select the same channel. The core functions handle this +well, as they pick chan_lock. However, we've seen cases where +smb2_reconnect throws some warnings. + +To fix that, this change introduces a flags bitmap inside the +cifs_ses structure. A new flag type is used to ensure that +only one process enters this section at any time. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsglob.h | 3 +++ + fs/smb/client/smb2pdu.c | 18 +++++++++++++++++- + 2 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index f794b16095e43..dcc41fe33b705 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -1018,6 +1018,8 @@ struct cifs_chan { + __u8 signkey[SMB3_SIGN_KEY_SIZE]; + }; + ++#define CIFS_SES_FLAG_SCALE_CHANNELS (0x1) ++ + /* + * Session structure. One of these for each uid session with a particular host + */ +@@ -1050,6 +1052,7 @@ struct cifs_ses { + enum securityEnum sectype; /* what security flavor was specified? */ + bool sign; /* is signing required? */ + bool domainAuto:1; ++ unsigned int flags; + __u16 session_flags; + __u8 smb3signingkey[SMB3_SIGN_KEY_SIZE]; + __u8 smb3encryptionkey[SMB3_ENC_DEC_KEY_SIZE]; +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 5d9c87d2e1e01..ce2d28537bc8a 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -399,6 +399,15 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + goto out; + } + ++ spin_lock(&ses->ses_lock); ++ if (ses->flags & CIFS_SES_FLAG_SCALE_CHANNELS) { ++ spin_unlock(&ses->ses_lock); ++ mutex_unlock(&ses->session_mutex); ++ goto skip_add_channels; ++ } ++ ses->flags |= CIFS_SES_FLAG_SCALE_CHANNELS; ++ spin_unlock(&ses->ses_lock); ++ + if (!rc && + (server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) { + mutex_unlock(&ses->session_mutex); +@@ -428,15 +437,22 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + if (ses->chan_max > ses->chan_count && + ses->iface_count && + !SERVER_IS_CHAN(server)) { +- if (ses->chan_count == 1) ++ if (ses->chan_count == 1) { + cifs_server_dbg(VFS, "supports multichannel now\n"); ++ queue_delayed_work(cifsiod_wq, &tcon->query_interfaces, ++ (SMB_INTERFACE_POLL_INTERVAL * HZ)); ++ } + + cifs_try_adding_channels(ses); + } + } else { + mutex_unlock(&ses->session_mutex); + } ++ + skip_add_channels: ++ spin_lock(&ses->ses_lock); ++ ses->flags &= ~CIFS_SES_FLAG_SCALE_CHANNELS; ++ spin_unlock(&ses->ses_lock); + + if (smb2_command != SMB2_INTERNAL_CMD) + mod_delayed_work(cifsiod_wq, &server->reconnect, 0); +-- +2.43.0 + diff --git a/queue-6.6/cifs-open_cached_dir-should-not-rely-on-primary-chan.patch b/queue-6.6/cifs-open_cached_dir-should-not-rely-on-primary-chan.patch new file mode 100644 index 00000000000..34a8a644962 --- /dev/null +++ b/queue-6.6/cifs-open_cached_dir-should-not-rely-on-primary-chan.patch @@ -0,0 +1,40 @@ +From 1508419f035c4bfb902eaff37085f37ac55d744a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 05:55:39 +0000 +Subject: cifs: open_cached_dir should not rely on primary channel + +From: Shyam Prasad N + +[ Upstream commit 936eba9cfb5cfbf6a2c762cd163605f2b784e03e ] + +open_cached_dir today selects ses->server a.k.a primary channel +to send requests. When multichannel is used, the primary +channel maybe down. So it does not make sense to rely only +on that channel. + +This fix makes this function pick a channel with the standard +helper function cifs_pick_channel. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cached_dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c +index d64a306a414be..9718926205047 100644 +--- a/fs/smb/client/cached_dir.c ++++ b/fs/smb/client/cached_dir.c +@@ -151,7 +151,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, + return -EOPNOTSUPP; + + ses = tcon->ses; +- server = ses->server; ++ server = cifs_pick_channel(ses); + cfids = tcon->cfids; + + if (!server->ops->new_lease_key) +-- +2.43.0 + diff --git a/queue-6.6/cifs-translate-network-errors-on-send-to-econnaborte.patch b/queue-6.6/cifs-translate-network-errors-on-send-to-econnaborte.patch new file mode 100644 index 00000000000..f8f7af31858 --- /dev/null +++ b/queue-6.6/cifs-translate-network-errors-on-send-to-econnaborte.patch @@ -0,0 +1,53 @@ +From 87194eb6ce5193fed515cb78c85954a4d67ff98f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 03:32:45 +0000 +Subject: cifs: translate network errors on send to -ECONNABORTED + +From: Shyam Prasad N + +[ Upstream commit a68106a6928e0a6680f12bcc7338c0dddcfe4d11 ] + +When the network stack returns various errors, we today bubble +up the error to the user (in case of soft mounts). + +This change translates all network errors except -EINTR and +-EAGAIN to -ECONNABORTED. A similar approach is taken when +we receive network errors when reading from the socket. + +The change also forces the cifsd thread to reconnect during +it's next activity. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/transport.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c +index 8695c9961f5aa..e00278fcfa4fa 100644 +--- a/fs/smb/client/transport.c ++++ b/fs/smb/client/transport.c +@@ -400,10 +400,17 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + server->conn_id, server->hostname); + } + smbd_done: +- if (rc < 0 && rc != -EINTR) ++ /* ++ * there's hardly any use for the layers above to know the ++ * actual error code here. All they should do at this point is ++ * to retry the connection and hope it goes away. ++ */ ++ if (rc < 0 && rc != -EINTR && rc != -EAGAIN) { + cifs_server_dbg(VFS, "Error %d sending data on socket to server\n", + rc); +- else if (rc > 0) ++ rc = -ECONNABORTED; ++ cifs_signal_cifsd_for_reconnect(server, false); ++ } else if (rc > 0) + rc = 0; + out: + cifs_in_send_dec(server); +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-apple-admac-keep-upper-bits-of-reg_bus_wid.patch b/queue-6.6/dmaengine-apple-admac-keep-upper-bits-of-reg_bus_wid.patch new file mode 100644 index 00000000000..8a701bb97ff --- /dev/null +++ b/queue-6.6/dmaengine-apple-admac-keep-upper-bits-of-reg_bus_wid.patch @@ -0,0 +1,55 @@ +From d14bfcf4b461da93569fac646fe9d18afe2bdf35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Oct 2023 18:07:04 +0100 +Subject: dmaengine: apple-admac: Keep upper bits of REG_BUS_WIDTH +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hector Martin + +[ Upstream commit 306f5df81fcc89b462fbeb9dbe26d9a8ad7c7582 ] + +For RX channels, REG_BUS_WIDTH seems to default to a value of 0xf00, and +macOS preserves the upper bits when setting the configuration in the +lower ones. If we reset the upper bits to 0, this causes framing errors +on suspend/resume (the data stream "tears" and channels get swapped +around). Keeping the upper bits untouched, like the macOS driver does, +fixes this issue. + +Signed-off-by: Hector Martin +Reviewed-by: Martin Povišer +Signed-off-by: Martin Povišer +Link: https://lore.kernel.org/r/20231029170704.82238-1-povik+lin@cutebit.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/apple-admac.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/apple-admac.c b/drivers/dma/apple-admac.c +index 3af795635c5ce..356298e4dd22b 100644 +--- a/drivers/dma/apple-admac.c ++++ b/drivers/dma/apple-admac.c +@@ -57,6 +57,8 @@ + + #define REG_BUS_WIDTH(ch) (0x8040 + (ch) * 0x200) + ++#define BUS_WIDTH_WORD_SIZE GENMASK(3, 0) ++#define BUS_WIDTH_FRAME_SIZE GENMASK(7, 4) + #define BUS_WIDTH_8BIT 0x00 + #define BUS_WIDTH_16BIT 0x01 + #define BUS_WIDTH_32BIT 0x02 +@@ -740,7 +742,8 @@ static int admac_device_config(struct dma_chan *chan, + struct admac_data *ad = adchan->host; + bool is_tx = admac_chan_direction(adchan->no) == DMA_MEM_TO_DEV; + int wordsize = 0; +- u32 bus_width = 0; ++ u32 bus_width = readl_relaxed(ad->base + REG_BUS_WIDTH(adchan->no)) & ++ ~(BUS_WIDTH_WORD_SIZE | BUS_WIDTH_FRAME_SIZE); + + switch (is_tx ? config->dst_addr_width : config->src_addr_width) { + case DMA_SLAVE_BUSWIDTH_1_BYTE: +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-dw-edma-increase-size-of-name-in-debugfs-c.patch b/queue-6.6/dmaengine-dw-edma-increase-size-of-name-in-debugfs-c.patch new file mode 100644 index 00000000000..401315eb586 --- /dev/null +++ b/queue-6.6/dmaengine-dw-edma-increase-size-of-name-in-debugfs-c.patch @@ -0,0 +1,83 @@ +From 759bb84d5523debb80adca27cbfcdbc54363521a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 18:10:44 +0530 +Subject: dmaengine: dw-edma: increase size of 'name' in debugfs code +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vinod Koul + +[ Upstream commit cb95a4fa50bbc1262bfb7fea482388a50b12948f ] + +We seem to have hit warnings of 'output may be truncated' which is fixed +by increasing the size of 'name' + +drivers/dma/dw-edma/dw-hdma-v0-debugfs.c: In function ‘dw_hdma_v0_debugfs_on’: +drivers/dma/dw-edma/dw-hdma-v0-debugfs.c:125:50: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 8 [-Werror=format-truncation=] + 125 | snprintf(name, sizeof(name), "%s:%d", CHANNEL_STR, i); + | ^~ + +drivers/dma/dw-edma/dw-hdma-v0-debugfs.c: In function ‘dw_hdma_v0_debugfs_on’: +drivers/dma/dw-edma/dw-hdma-v0-debugfs.c:142:50: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 8 [-Werror=format-truncation=] + 142 | snprintf(name, sizeof(name), "%s:%d", CHANNEL_STR, i); + | ^~ +drivers/dma/dw-edma/dw-edma-v0-debugfs.c: In function ‘dw_edma_debugfs_regs_wr’: +drivers/dma/dw-edma/dw-edma-v0-debugfs.c:193:50: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 8 [-Werror=format-truncation=] + 193 | snprintf(name, sizeof(name), "%s:%d", CHANNEL_STR, i); + | ^~ + +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-v0-debugfs.c | 4 ++-- + drivers/dma/dw-edma/dw-hdma-v0-debugfs.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-v0-debugfs.c b/drivers/dma/dw-edma/dw-edma-v0-debugfs.c +index 0745d9e7d259b..406f169b09a75 100644 +--- a/drivers/dma/dw-edma/dw-edma-v0-debugfs.c ++++ b/drivers/dma/dw-edma/dw-edma-v0-debugfs.c +@@ -176,7 +176,7 @@ dw_edma_debugfs_regs_wr(struct dw_edma *dw, struct dentry *dent) + }; + struct dentry *regs_dent, *ch_dent; + int nr_entries, i; +- char name[16]; ++ char name[32]; + + regs_dent = debugfs_create_dir(WRITE_STR, dent); + +@@ -239,7 +239,7 @@ static noinline_for_stack void dw_edma_debugfs_regs_rd(struct dw_edma *dw, + }; + struct dentry *regs_dent, *ch_dent; + int nr_entries, i; +- char name[16]; ++ char name[32]; + + regs_dent = debugfs_create_dir(READ_STR, dent); + +diff --git a/drivers/dma/dw-edma/dw-hdma-v0-debugfs.c b/drivers/dma/dw-edma/dw-hdma-v0-debugfs.c +index 520c81978b085..dcdc57fe976c1 100644 +--- a/drivers/dma/dw-edma/dw-hdma-v0-debugfs.c ++++ b/drivers/dma/dw-edma/dw-hdma-v0-debugfs.c +@@ -116,7 +116,7 @@ static void dw_hdma_debugfs_regs_ch(struct dw_edma *dw, enum dw_edma_dir dir, + static void dw_hdma_debugfs_regs_wr(struct dw_edma *dw, struct dentry *dent) + { + struct dentry *regs_dent, *ch_dent; +- char name[16]; ++ char name[32]; + int i; + + regs_dent = debugfs_create_dir(WRITE_STR, dent); +@@ -133,7 +133,7 @@ static void dw_hdma_debugfs_regs_wr(struct dw_edma *dw, struct dentry *dent) + static void dw_hdma_debugfs_regs_rd(struct dw_edma *dw, struct dentry *dent) + { + struct dentry *regs_dent, *ch_dent; +- char name[16]; ++ char name[32]; + int i; + + regs_dent = debugfs_create_dir(READ_STR, dent); +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-fsl-qdma-increase-size-of-irq_name.patch b/queue-6.6/dmaengine-fsl-qdma-increase-size-of-irq_name.patch new file mode 100644 index 00000000000..4d2b2eec0bd --- /dev/null +++ b/queue-6.6/dmaengine-fsl-qdma-increase-size-of-irq_name.patch @@ -0,0 +1,48 @@ +From c903b4b60405dd8d8f0fa728d755a083508eed40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 18:10:44 +0530 +Subject: dmaengine: fsl-qdma: increase size of 'irq_name' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vinod Koul + +[ Upstream commit 6386f6c995b3ab91c72cfb76e4465553c555a8da ] + +We seem to have hit warnings of 'output may be truncated' which is fixed +by increasing the size of 'irq_name' + +drivers/dma/fsl-qdma.c: In function ‘fsl_qdma_irq_init’: +drivers/dma/fsl-qdma.c:824:46: error: ‘%d’ directive writing between 1 and 11 bytes into a region of size 10 [-Werror=format-overflow=] + 824 | sprintf(irq_name, "qdma-queue%d", i); + | ^~ +drivers/dma/fsl-qdma.c:824:35: note: directive argument in the range [-2147483641, 2147483646] + 824 | sprintf(irq_name, "qdma-queue%d", i); + | ^~~~~~~~~~~~~~ +drivers/dma/fsl-qdma.c:824:17: note: ‘sprintf’ output between 12 and 22 bytes into a destination of size 20 + 824 | sprintf(irq_name, "qdma-queue%d", i); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index e4c293b76e050..781a3180baf2a 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -805,7 +805,7 @@ fsl_qdma_irq_init(struct platform_device *pdev, + int i; + int cpu; + int ret; +- char irq_name[20]; ++ char irq_name[32]; + + fsl_qdma->error_irq = + platform_get_irq_byname(pdev, "qdma-error"); +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-shdma-increase-size-of-dev_id.patch b/queue-6.6/dmaengine-shdma-increase-size-of-dev_id.patch new file mode 100644 index 00000000000..001c25cf660 --- /dev/null +++ b/queue-6.6/dmaengine-shdma-increase-size-of-dev_id.patch @@ -0,0 +1,53 @@ +From 959cab81237698293b4bc8607e95f774614fa179 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 18:10:44 +0530 +Subject: dmaengine: shdma: increase size of 'dev_id' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vinod Koul + +[ Upstream commit 404290240827c3bb5c4e195174a8854eef2f89ac ] + +We seem to have hit warnings of 'output may be truncated' which is fixed +by increasing the size of 'dev_id' + +drivers/dma/sh/shdmac.c: In function ‘sh_dmae_probe’: +drivers/dma/sh/shdmac.c:541:34: error: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 9 [-Werror=format-truncation=] + 541 | "sh-dmae%d.%d", pdev->id, id); + | ^~ +In function ‘sh_dmae_chan_probe’, + inlined from ‘sh_dmae_probe’ at drivers/dma/sh/shdmac.c:845:9: +drivers/dma/sh/shdmac.c:541:26: note: directive argument in the range [0, 2147483647] + 541 | "sh-dmae%d.%d", pdev->id, id); + | ^~~~~~~~~~~~~~ +drivers/dma/sh/shdmac.c:541:26: note: directive argument in the range [0, 19] +drivers/dma/sh/shdmac.c:540:17: note: ‘snprintf’ output between 11 and 21 bytes into a destination of size 16 + 540 | snprintf(sh_chan->dev_id, sizeof(sh_chan->dev_id), + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 541 | "sh-dmae%d.%d", pdev->id, id); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sh/shdma.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/sh/shdma.h b/drivers/dma/sh/shdma.h +index 9c121a4b33ad8..f97d80343aea4 100644 +--- a/drivers/dma/sh/shdma.h ++++ b/drivers/dma/sh/shdma.h +@@ -25,7 +25,7 @@ struct sh_dmae_chan { + const struct sh_dmae_slave_config *config; /* Slave DMA configuration */ + int xmit_shift; /* log_2(bytes_per_xfer) */ + void __iomem *base; +- char dev_id[16]; /* unique name per DMAC of channel */ ++ char dev_id[32]; /* unique name per DMAC of channel */ + int pm_error; + dma_addr_t slave_addr; + }; +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-ti-edma-add-some-null-pointer-checks-to-th.patch b/queue-6.6/dmaengine-ti-edma-add-some-null-pointer-checks-to-th.patch new file mode 100644 index 00000000000..6af5b932526 --- /dev/null +++ b/queue-6.6/dmaengine-ti-edma-add-some-null-pointer-checks-to-th.patch @@ -0,0 +1,52 @@ +From 4ce46d9c43db6e9a690487562d5749b0ae13c8c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 11:19:29 +0800 +Subject: dmaengine: ti: edma: Add some null pointer checks to the edma_probe + +From: Kunwu Chan + +[ Upstream commit 6e2276203ac9ff10fc76917ec9813c660f627369 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Signed-off-by: Kunwu Chan +Link: https://lore.kernel.org/r/20240118031929.192192-1-chentao@kylinos.cn +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/edma.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c +index 33d6d931b33bb..155c409d2b434 100644 +--- a/drivers/dma/ti/edma.c ++++ b/drivers/dma/ti/edma.c +@@ -2404,6 +2404,11 @@ static int edma_probe(struct platform_device *pdev) + if (irq > 0) { + irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint", + dev_name(dev)); ++ if (!irq_name) { ++ ret = -ENOMEM; ++ goto err_disable_pm; ++ } ++ + ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name, + ecc); + if (ret) { +@@ -2420,6 +2425,11 @@ static int edma_probe(struct platform_device *pdev) + if (irq > 0) { + irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint", + dev_name(dev)); ++ if (!irq_name) { ++ ret = -ENOMEM; ++ goto err_disable_pm; ++ } ++ + ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name, + ecc); + if (ret) { +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-increased-min_dcfclk_mhz-and-min_fcl.patch b/queue-6.6/drm-amd-display-increased-min_dcfclk_mhz-and-min_fcl.patch new file mode 100644 index 00000000000..f2afde4d9a0 --- /dev/null +++ b/queue-6.6/drm-amd-display-increased-min_dcfclk_mhz-and-min_fcl.patch @@ -0,0 +1,46 @@ +From d721dcb4d95c6543212e2a1856d0cbb25e9e1dff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 11:00:00 -0500 +Subject: drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz + +From: Sohaib Nadeem + +[ Upstream commit 2ff33c759a4247c84ec0b7815f1f223e155ba82a ] + +[why] +Originally, PMFW said min FCLK is 300Mhz, but min DCFCLK can be increased +to 400Mhz because min FCLK is now 600Mhz so FCLK >= 1.5 * DCFCLK hardware +requirement will still be satisfied. Increasing min DCFCLK addresses +underflow issues (underflow occurs when phantom pipe is turned on for some +Sub-Viewport configs). + +[how] +Increasing DCFCLK by raising the min_dcfclk_mhz + +Reviewed-by: Chaitanya Dhere +Reviewed-by: Alvin Lee +Acked-by: Tom Chung +Signed-off-by: Sohaib Nadeem +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +index cf3b400c8619b..ec09d5a8876be 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +@@ -2452,7 +2452,7 @@ static int build_synthetic_soc_states(bool disable_dc_mode_overwrite, struct clk + struct _vcs_dpi_voltage_scaling_st entry = {0}; + struct clk_limit_table_entry max_clk_data = {0}; + +- unsigned int min_dcfclk_mhz = 199, min_fclk_mhz = 299; ++ unsigned int min_dcfclk_mhz = 399, min_fclk_mhz = 599; + + static const unsigned int num_dcfclk_stas = 5; + unsigned int dcfclk_sta_targets[DC__VOLTAGE_STATES] = {199, 615, 906, 1324, 1564}; +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-fix-hdp-flush-for-vfs-on-nbio-v7.9.patch b/queue-6.6/drm-amdgpu-fix-hdp-flush-for-vfs-on-nbio-v7.9.patch new file mode 100644 index 00000000000..8109240f4a2 --- /dev/null +++ b/queue-6.6/drm-amdgpu-fix-hdp-flush-for-vfs-on-nbio-v7.9.patch @@ -0,0 +1,40 @@ +From 92ff35e40a81337659a94c95f09ee97c3e1cad4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 13:48:22 +0530 +Subject: drm/amdgpu: Fix HDP flush for VFs on nbio v7.9 + +From: Lijo Lazar + +[ Upstream commit 534c8a5b9d5d41d30cdcac93cfa1bca5e17be009 ] + +HDP flush remapping is not done for VFs. Keep the original offsets in VF +environment. + +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c +index ae45656eb8779..0a601336cf697 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c ++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c +@@ -426,6 +426,12 @@ static void nbio_v7_9_init_registers(struct amdgpu_device *adev) + u32 inst_mask; + int i; + ++ if (amdgpu_sriov_vf(adev)) ++ adev->rmmio_remap.reg_offset = ++ SOC15_REG_OFFSET( ++ NBIO, 0, ++ regBIF_BX_DEV0_EPF0_VF0_HDP_MEM_COHERENCY_FLUSH_CNTL) ++ << 2; + WREG32_SOC15(NBIO, 0, regXCC_DOORBELL_FENCE, + 0xff & ~(adev->gfx.xcc_mask)); + +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-fix-shared-buff-copy-to-user.patch b/queue-6.6/drm-amdgpu-fix-shared-buff-copy-to-user.patch new file mode 100644 index 00000000000..1606de5426f --- /dev/null +++ b/queue-6.6/drm-amdgpu-fix-shared-buff-copy-to-user.patch @@ -0,0 +1,42 @@ +From 650a3b085ccbd870d6fe5e166a30c87eaa8519bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Feb 2024 15:55:48 +0800 +Subject: drm/amdgpu: Fix shared buff copy to user + +From: Stanley.Yang + +[ Upstream commit 2dcf82a8e8dc930655787797ef8a3692b527c7a9 ] + +ta if invoke node buffer +|-------- ta type ----------| +|-------- ta id ----------| +|-------- cmd id ----------| +|------ shared buf len -----| +|------ shared buffer ------| + +ta if invoke node buffer is as above, copy shared buffer data to correct location + +Signed-off-by: Stanley.Yang +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c +index 468a67b302d4c..ca5c86e5f7cd6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c +@@ -362,7 +362,7 @@ static ssize_t ta_if_invoke_debugfs_write(struct file *fp, const char *buf, size + } + } + +- if (copy_to_user((char *)buf, context->mem_context.shared_buf, shared_buf_len)) ++ if (copy_to_user((char *)&buf[copy_pos], context->mem_context.shared_buf, shared_buf_len)) + ret = -EFAULT; + + err_free_shared_buf: +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-reset-gpu-for-s3-suspend-abort-case.patch b/queue-6.6/drm-amdgpu-reset-gpu-for-s3-suspend-abort-case.patch new file mode 100644 index 00000000000..a33389473c0 --- /dev/null +++ b/queue-6.6/drm-amdgpu-reset-gpu-for-s3-suspend-abort-case.patch @@ -0,0 +1,63 @@ +From d0d64c6a15508aadf3b32c6347f06428bb9e1cb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 13:39:37 +0800 +Subject: drm/amdgpu: reset gpu for s3 suspend abort case + +From: Prike Liang + +[ Upstream commit 6ef82ac664bb9568ca3956e0d9c9c478e25077ff ] + +In the s3 suspend abort case some type of gfx9 power +rail not turn off from FCH side and this will put the +GPU in an unknown power status, so let's reset the gpu +to a known good power state before reinitialize gpu +device. + +Signed-off-by: Prike Liang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 3667f9a548414..2a7c606d1d191 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1296,10 +1296,32 @@ static int soc15_common_suspend(void *handle) + return soc15_common_hw_fini(adev); + } + ++static bool soc15_need_reset_on_resume(struct amdgpu_device *adev) ++{ ++ u32 sol_reg; ++ ++ sol_reg = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_81); ++ ++ /* Will reset for the following suspend abort cases. ++ * 1) Only reset limit on APU side, dGPU hasn't checked yet. ++ * 2) S3 suspend abort and TOS already launched. ++ */ ++ if (adev->flags & AMD_IS_APU && adev->in_s3 && ++ !adev->suspend_complete && ++ sol_reg) ++ return true; ++ ++ return false; ++} ++ + static int soc15_common_resume(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + ++ if (soc15_need_reset_on_resume(adev)) { ++ dev_info(adev->dev, "S3 suspend abort case, let's reset ASIC.\n"); ++ soc15_asic_reset(adev); ++ } + return soc15_common_hw_init(adev); + } + +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-skip-to-program-gfxdec-registers-for-susp.patch b/queue-6.6/drm-amdgpu-skip-to-program-gfxdec-registers-for-susp.patch new file mode 100644 index 00000000000..038e8b221ee --- /dev/null +++ b/queue-6.6/drm-amdgpu-skip-to-program-gfxdec-registers-for-susp.patch @@ -0,0 +1,79 @@ +From a9aa034694f1c0a27353ca485a343b4aafa8f1b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 19:10:45 +0800 +Subject: drm/amdgpu: skip to program GFXDEC registers for suspend abort + +From: Prike Liang + +[ Upstream commit 93bafa32a6918154aa0caf9f66679a32c2431357 ] + +In the suspend abort cases, the gfx power rail doesn't turn off so +some GFXDEC registers/CSB can't reset to default value and at this +moment reinitialize GFXDEC/CSB will result in an unexpected error. +So let skip those program sequence for the suspend abort case. + +Signed-off-by: Prike Liang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 ++ + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 ++ + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 8 ++++++++ + 3 files changed, 12 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index a79d53bdbe136..85efd686e538d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -1009,6 +1009,8 @@ struct amdgpu_device { + bool in_s3; + bool in_s4; + bool in_s0ix; ++ /* indicate amdgpu suspension status */ ++ bool suspend_complete; + + enum pp_mp1_state mp1_state; + struct amdgpu_doorbell_index doorbell_index; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 2c35036e4ba25..3204c3a42f2a3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -2409,6 +2409,7 @@ static int amdgpu_pmops_suspend(struct device *dev) + struct drm_device *drm_dev = dev_get_drvdata(dev); + struct amdgpu_device *adev = drm_to_adev(drm_dev); + ++ adev->suspend_complete = false; + if (amdgpu_acpi_is_s0ix_active(adev)) + adev->in_s0ix = true; + else if (amdgpu_acpi_is_s3_active(adev)) +@@ -2423,6 +2424,7 @@ static int amdgpu_pmops_suspend_noirq(struct device *dev) + struct drm_device *drm_dev = dev_get_drvdata(dev); + struct amdgpu_device *adev = drm_to_adev(drm_dev); + ++ adev->suspend_complete = true; + if (amdgpu_acpi_should_gpu_reset(adev)) + return amdgpu_asic_reset(adev); + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 2e23d08b45f4a..d7d15b618c374 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -3033,6 +3033,14 @@ static int gfx_v9_0_cp_gfx_start(struct amdgpu_device *adev) + + gfx_v9_0_cp_gfx_enable(adev, true); + ++ /* Now only limit the quirk on the APU gfx9 series and already ++ * confirmed that the APU gfx10/gfx11 needn't such update. ++ */ ++ if (adev->flags & AMD_IS_APU && ++ adev->in_s3 && !adev->suspend_complete) { ++ DRM_INFO(" Will skip the CSB packet resubmit\n"); ++ return 0; ++ } + r = amdgpu_ring_alloc(ring, gfx_v9_0_get_csb_size(adev) + 4 + 3); + if (r) { + DRM_ERROR("amdgpu: cp failed to lock ring (%d).\n", r); +-- +2.43.0 + diff --git a/queue-6.6/drm-amdkfd-use-correct-drm-device-for-cgroup-permiss.patch b/queue-6.6/drm-amdkfd-use-correct-drm-device-for-cgroup-permiss.patch new file mode 100644 index 00000000000..9ebec3ed1f0 --- /dev/null +++ b/queue-6.6/drm-amdkfd-use-correct-drm-device-for-cgroup-permiss.patch @@ -0,0 +1,45 @@ +From b4ab79aa8664ffa1867a40b59f2d3eb4c5af7270 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 15:14:50 -0500 +Subject: drm/amdkfd: Use correct drm device for cgroup permission check + +From: Mukul Joshi + +[ Upstream commit 4119734e06a7f30e7e8eb666692a58b85dca0269 ] + +On GFX 9.4.3, for a given KFD node, fetch the correct drm device from +XCP manager when checking for cgroup permissions. + +Signed-off-by: Mukul Joshi +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +index 3287a39613959..12ee273e87e1e 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +@@ -1482,10 +1482,15 @@ void kfd_dec_compute_active(struct kfd_node *dev); + + /* Cgroup Support */ + /* Check with device cgroup if @kfd device is accessible */ +-static inline int kfd_devcgroup_check_permission(struct kfd_node *kfd) ++static inline int kfd_devcgroup_check_permission(struct kfd_node *node) + { + #if defined(CONFIG_CGROUP_DEVICE) || defined(CONFIG_CGROUP_BPF) +- struct drm_device *ddev = adev_to_drm(kfd->adev); ++ struct drm_device *ddev; ++ ++ if (node->xcp) ++ ddev = node->xcp->ddev; ++ else ++ ddev = adev_to_drm(node->adev); + + return devcgroup_check_permission(DEVCG_DEV_CHAR, DRM_MAJOR, + ddev->render->index, +-- +2.43.0 + diff --git a/queue-6.6/efi-don-t-add-memblocks-for-soft-reserved-memory.patch b/queue-6.6/efi-don-t-add-memblocks-for-soft-reserved-memory.patch new file mode 100644 index 00000000000..e71adccc28a --- /dev/null +++ b/queue-6.6/efi-don-t-add-memblocks-for-soft-reserved-memory.patch @@ -0,0 +1,59 @@ +From cd5ce8baa82162b397e8ac68b1b3dead9e394546 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 10:07:04 -0800 +Subject: efi: Don't add memblocks for soft-reserved memory + +From: Andrew Bresticker + +[ Upstream commit 0bcff59ef7a652fcdc6d535554b63278c2406c8f ] + +Adding memblocks for soft-reserved regions prevents them from later being +hotplugged in by dax_kmem. + +Signed-off-by: Andrew Bresticker +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/efi-init.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/firmware/efi/efi-init.c b/drivers/firmware/efi/efi-init.c +index ef0820f1a9246..59b0d7197b685 100644 +--- a/drivers/firmware/efi/efi-init.c ++++ b/drivers/firmware/efi/efi-init.c +@@ -134,15 +134,6 @@ static __init int is_usable_memory(efi_memory_desc_t *md) + case EFI_BOOT_SERVICES_DATA: + case EFI_CONVENTIONAL_MEMORY: + case EFI_PERSISTENT_MEMORY: +- /* +- * Special purpose memory is 'soft reserved', which means it +- * is set aside initially, but can be hotplugged back in or +- * be assigned to the dax driver after boot. +- */ +- if (efi_soft_reserve_enabled() && +- (md->attribute & EFI_MEMORY_SP)) +- return false; +- + /* + * According to the spec, these regions are no longer reserved + * after calling ExitBootServices(). However, we can only use +@@ -187,6 +178,16 @@ static __init void reserve_regions(void) + size = npages << PAGE_SHIFT; + + if (is_memory(md)) { ++ /* ++ * Special purpose memory is 'soft reserved', which ++ * means it is set aside initially. Don't add a memblock ++ * for it now so that it can be hotplugged back in or ++ * be assigned to the dax driver after boot. ++ */ ++ if (efi_soft_reserve_enabled() && ++ (md->attribute & EFI_MEMORY_SP)) ++ continue; ++ + early_init_dt_add_memory_arch(paddr, size); + + if (!is_usable_memory(md)) +-- +2.43.0 + diff --git a/queue-6.6/efi-runtime-fix-potential-overflow-of-soft-reserved-.patch b/queue-6.6/efi-runtime-fix-potential-overflow-of-soft-reserved-.patch new file mode 100644 index 00000000000..d64a955e2b6 --- /dev/null +++ b/queue-6.6/efi-runtime-fix-potential-overflow-of-soft-reserved-.patch @@ -0,0 +1,49 @@ +From 164b52bc91ee70f7be18e5652f3d56ee618bda98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 10:07:03 -0800 +Subject: efi: runtime: Fix potential overflow of soft-reserved region size + +From: Andrew Bresticker + +[ Upstream commit de1034b38a346ef6be25fe8792f5d1e0684d5ff4 ] + +md_size will have been narrowed if we have >= 4GB worth of pages in a +soft-reserved region. + +Signed-off-by: Andrew Bresticker +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/arm-runtime.c | 2 +- + drivers/firmware/efi/riscv-runtime.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c +index 83f5bb57fa4c4..83092d93f36a6 100644 +--- a/drivers/firmware/efi/arm-runtime.c ++++ b/drivers/firmware/efi/arm-runtime.c +@@ -107,7 +107,7 @@ static int __init arm_enable_runtime_services(void) + efi_memory_desc_t *md; + + for_each_efi_memory_desc(md) { +- int md_size = md->num_pages << EFI_PAGE_SHIFT; ++ u64 md_size = md->num_pages << EFI_PAGE_SHIFT; + struct resource *res; + + if (!(md->attribute & EFI_MEMORY_SP)) +diff --git a/drivers/firmware/efi/riscv-runtime.c b/drivers/firmware/efi/riscv-runtime.c +index 09525fb5c240e..01f0f90ea4183 100644 +--- a/drivers/firmware/efi/riscv-runtime.c ++++ b/drivers/firmware/efi/riscv-runtime.c +@@ -85,7 +85,7 @@ static int __init riscv_enable_runtime_services(void) + efi_memory_desc_t *md; + + for_each_efi_memory_desc(md) { +- int md_size = md->num_pages << EFI_PAGE_SHIFT; ++ u64 md_size = md->num_pages << EFI_PAGE_SHIFT; + struct resource *res; + + if (!(md->attribute & EFI_MEMORY_SP)) +-- +2.43.0 + diff --git a/queue-6.6/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch b/queue-6.6/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch new file mode 100644 index 00000000000..cfde46b385f --- /dev/null +++ b/queue-6.6/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch @@ -0,0 +1,65 @@ +From 8b19935157b0746833fcea7bcb8c69e75b88c6e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 22:20:38 +0800 +Subject: ext4: avoid allocating blocks from corrupted group in + ext4_mb_try_best_found() + +From: Baokun Li + +[ Upstream commit 4530b3660d396a646aad91a787b6ab37cf604b53 ] + +Determine if the group block bitmap is corrupted before using ac_b_ex in +ext4_mb_try_best_found() to avoid allocating blocks from a group with a +corrupted block bitmap in the following concurrency and making the +situation worse. + +ext4_mb_regular_allocator + ext4_lock_group(sb, group) + ext4_mb_good_group + // check if the group bbitmap is corrupted + ext4_mb_complex_scan_group + // Scan group gets ac_b_ex but doesn't use it + ext4_unlock_group(sb, group) + ext4_mark_group_bitmap_corrupted(group) + // The block bitmap was corrupted during + // the group unlock gap. + ext4_mb_try_best_found + ext4_lock_group(ac->ac_sb, group) + ext4_mb_use_best_found + mb_mark_used + // Allocating blocks in block bitmap corrupted group + +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240104142040.2835097-7-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 9eac63e5a251c..bc9630f4c09cb 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2304,6 +2304,9 @@ void ext4_mb_try_best_found(struct ext4_allocation_context *ac, + return; + + ext4_lock_group(ac->ac_sb, group); ++ if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) ++ goto out; ++ + max = mb_find_extent(e4b, ex.fe_start, ex.fe_len, &ex); + + if (max > 0) { +@@ -2311,6 +2314,7 @@ void ext4_mb_try_best_found(struct ext4_allocation_context *ac, + ext4_mb_use_best_found(ac, e4b); + } + ++out: + ext4_unlock_group(ac->ac_sb, group); + ext4_mb_unload_buddy(e4b); + } +-- +2.43.0 + diff --git a/queue-6.6/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch-11720 b/queue-6.6/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch-11720 new file mode 100644 index 00000000000..deb482784f6 --- /dev/null +++ b/queue-6.6/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch-11720 @@ -0,0 +1,54 @@ +From 5ffdc89e58094eac652bfa5b499b01b1008ccd8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 22:20:39 +0800 +Subject: ext4: avoid allocating blocks from corrupted group in + ext4_mb_find_by_goal() + +From: Baokun Li + +[ Upstream commit 832698373a25950942c04a512daa652c18a9b513 ] + +Places the logic for checking if the group's block bitmap is corrupt under +the protection of the group lock to avoid allocating blocks from the group +with a corrupted block bitmap. + +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index bc9630f4c09cb..ea5ac2636632b 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2341,12 +2341,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, + if (err) + return err; + +- if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { +- ext4_mb_unload_buddy(e4b); +- return 0; +- } +- + ext4_lock_group(ac->ac_sb, group); ++ if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) ++ goto out; ++ + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, + ac->ac_g_ex.fe_len, &ex); + ex.fe_logical = 0xDEADFA11; /* debug value */ +@@ -2379,6 +2377,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, + ac->ac_b_ex = ex; + ext4_mb_use_best_found(ac, e4b); + } ++out: + ext4_unlock_group(ac->ac_sb, group); + ext4_mb_unload_buddy(e4b); + +-- +2.43.0 + diff --git a/queue-6.6/ext4-avoid-dividing-by-0-in-mb_update_avg_fragment_s.patch b/queue-6.6/ext4-avoid-dividing-by-0-in-mb_update_avg_fragment_s.patch new file mode 100644 index 00000000000..971b0e19b9f --- /dev/null +++ b/queue-6.6/ext4-avoid-dividing-by-0-in-mb_update_avg_fragment_s.patch @@ -0,0 +1,38 @@ +From 102299f9962232ad4c15ce37181dd91196650012 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 22:20:37 +0800 +Subject: ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block + bitmap corrupt + +From: Baokun Li + +[ Upstream commit 993bf0f4c393b3667830918f9247438a8f6fdb5b ] + +Determine if bb_fragments is 0 instead of determining bb_free to eliminate +the risk of dividing by zero when the block bitmap is corrupted. + +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240104142040.2835097-6-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 7a2d42a84807a..9eac63e5a251c 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -841,7 +841,7 @@ mb_update_avg_fragment_size(struct super_block *sb, struct ext4_group_info *grp) + struct ext4_sb_info *sbi = EXT4_SB(sb); + int new_order; + +- if (!test_opt2(sb, MB_OPTIMIZE_SCAN) || grp->bb_free == 0) ++ if (!test_opt2(sb, MB_OPTIMIZE_SCAN) || grp->bb_fragments == 0) + return; + + new_order = mb_avg_fragment_size_order(sb, +-- +2.43.0 + diff --git a/queue-6.6/ext4-correct-the-hole-length-returned-by-ext4_map_bl.patch b/queue-6.6/ext4-correct-the-hole-length-returned-by-ext4_map_bl.patch new file mode 100644 index 00000000000..ba4c7642673 --- /dev/null +++ b/queue-6.6/ext4-correct-the-hole-length-returned-by-ext4_map_bl.patch @@ -0,0 +1,189 @@ +From ab2799feee909f590f3717bfee1cad0b07f8307b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Jan 2024 09:58:02 +0800 +Subject: ext4: correct the hole length returned by ext4_map_blocks() + +From: Zhang Yi + +[ Upstream commit 6430dea07e85958fa87d0276c0c4388dd51e630b ] + +In ext4_map_blocks(), if we can't find a range of mapping in the +extents cache, we are calling ext4_ext_map_blocks() to search the real +path and ext4_ext_determine_hole() to determine the hole range. But if +the querying range was partially or completely overlaped by a delalloc +extent, we can't find it in the real extent path, so the returned hole +length could be incorrect. + +Fortunately, ext4_ext_put_gap_in_cache() have already handle delalloc +extent, but it searches start from the expanded hole_start, doesn't +start from the querying range, so the delalloc extent found could not be +the one that overlaped the querying range, plus, it also didn't adjust +the hole length. Let's just remove ext4_ext_put_gap_in_cache(), handle +delalloc and insert adjusted hole extent in ext4_ext_determine_hole(). + +Signed-off-by: Zhang Yi +Suggested-by: Jan Kara +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240127015825.1608160-4-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 111 +++++++++++++++++++++++++++++----------------- + 1 file changed, 70 insertions(+), 41 deletions(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 4c3e2f38349de..d393df22431a0 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -2229,7 +2229,7 @@ static int ext4_fill_es_cache_info(struct inode *inode, + + + /* +- * ext4_ext_determine_hole - determine hole around given block ++ * ext4_ext_find_hole - find hole around given block according to the given path + * @inode: inode we lookup in + * @path: path in extent tree to @lblk + * @lblk: pointer to logical block around which we want to determine hole +@@ -2241,9 +2241,9 @@ static int ext4_fill_es_cache_info(struct inode *inode, + * The function returns the length of a hole starting at @lblk. We update @lblk + * to the beginning of the hole if we managed to find it. + */ +-static ext4_lblk_t ext4_ext_determine_hole(struct inode *inode, +- struct ext4_ext_path *path, +- ext4_lblk_t *lblk) ++static ext4_lblk_t ext4_ext_find_hole(struct inode *inode, ++ struct ext4_ext_path *path, ++ ext4_lblk_t *lblk) + { + int depth = ext_depth(inode); + struct ext4_extent *ex; +@@ -2270,30 +2270,6 @@ static ext4_lblk_t ext4_ext_determine_hole(struct inode *inode, + return len; + } + +-/* +- * ext4_ext_put_gap_in_cache: +- * calculate boundaries of the gap that the requested block fits into +- * and cache this gap +- */ +-static void +-ext4_ext_put_gap_in_cache(struct inode *inode, ext4_lblk_t hole_start, +- ext4_lblk_t hole_len) +-{ +- struct extent_status es; +- +- ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start, +- hole_start + hole_len - 1, &es); +- if (es.es_len) { +- /* There's delayed extent containing lblock? */ +- if (es.es_lblk <= hole_start) +- return; +- hole_len = min(es.es_lblk - hole_start, hole_len); +- } +- ext_debug(inode, " -> %u:%u\n", hole_start, hole_len); +- ext4_es_insert_extent(inode, hole_start, hole_len, ~0, +- EXTENT_STATUS_HOLE); +-} +- + /* + * ext4_ext_rm_idx: + * removes index from the index block. +@@ -4062,6 +4038,69 @@ static int get_implied_cluster_alloc(struct super_block *sb, + return 0; + } + ++/* ++ * Determine hole length around the given logical block, first try to ++ * locate and expand the hole from the given @path, and then adjust it ++ * if it's partially or completely converted to delayed extents, insert ++ * it into the extent cache tree if it's indeed a hole, finally return ++ * the length of the determined extent. ++ */ ++static ext4_lblk_t ext4_ext_determine_insert_hole(struct inode *inode, ++ struct ext4_ext_path *path, ++ ext4_lblk_t lblk) ++{ ++ ext4_lblk_t hole_start, len; ++ struct extent_status es; ++ ++ hole_start = lblk; ++ len = ext4_ext_find_hole(inode, path, &hole_start); ++again: ++ ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start, ++ hole_start + len - 1, &es); ++ if (!es.es_len) ++ goto insert_hole; ++ ++ /* ++ * There's a delalloc extent in the hole, handle it if the delalloc ++ * extent is in front of, behind and straddle the queried range. ++ */ ++ if (lblk >= es.es_lblk + es.es_len) { ++ /* ++ * The delalloc extent is in front of the queried range, ++ * find again from the queried start block. ++ */ ++ len -= lblk - hole_start; ++ hole_start = lblk; ++ goto again; ++ } else if (in_range(lblk, es.es_lblk, es.es_len)) { ++ /* ++ * The delalloc extent containing lblk, it must have been ++ * added after ext4_map_blocks() checked the extent status ++ * tree, adjust the length to the delalloc extent's after ++ * lblk. ++ */ ++ len = es.es_lblk + es.es_len - lblk; ++ return len; ++ } else { ++ /* ++ * The delalloc extent is partially or completely behind ++ * the queried range, update hole length until the ++ * beginning of the delalloc extent. ++ */ ++ len = min(es.es_lblk - hole_start, len); ++ } ++ ++insert_hole: ++ /* Put just found gap into cache to speed up subsequent requests */ ++ ext_debug(inode, " -> %u:%u\n", hole_start, len); ++ ext4_es_insert_extent(inode, hole_start, len, ~0, EXTENT_STATUS_HOLE); ++ ++ /* Update hole_len to reflect hole size after lblk */ ++ if (hole_start != lblk) ++ len -= lblk - hole_start; ++ ++ return len; ++} + + /* + * Block allocation/map/preallocation routine for extents based files +@@ -4179,22 +4218,12 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, + * we couldn't try to create block if create flag is zero + */ + if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) { +- ext4_lblk_t hole_start, hole_len; ++ ext4_lblk_t len; + +- hole_start = map->m_lblk; +- hole_len = ext4_ext_determine_hole(inode, path, &hole_start); +- /* +- * put just found gap into cache to speed up +- * subsequent requests +- */ +- ext4_ext_put_gap_in_cache(inode, hole_start, hole_len); ++ len = ext4_ext_determine_insert_hole(inode, path, map->m_lblk); + +- /* Update hole_len to reflect hole size after map->m_lblk */ +- if (hole_start != map->m_lblk) +- hole_len -= map->m_lblk - hole_start; + map->m_pblk = 0; +- map->m_len = min_t(unsigned int, map->m_len, hole_len); +- ++ map->m_len = min_t(unsigned int, map->m_len, len); + goto out; + } + +-- +2.43.0 + diff --git a/queue-6.6/fbdev-savage-error-out-if-pixclock-equals-zero.patch b/queue-6.6/fbdev-savage-error-out-if-pixclock-equals-zero.patch new file mode 100644 index 00000000000..b8796c458e8 --- /dev/null +++ b/queue-6.6/fbdev-savage-error-out-if-pixclock-equals-zero.patch @@ -0,0 +1,45 @@ +From 39fe3b2188a38a2bf2203768822b1493f3a7f043 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 11:49:40 +0800 +Subject: fbdev: savage: Error out if pixclock equals zero + +From: Fullway Wang + +[ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ] + +The userspace program could pass any values to the driver through +ioctl() interface. If the driver doesn't check the value of pixclock, +it may cause divide-by-zero error. + +Although pixclock is checked in savagefb_decode_var(), but it is not +checked properly in savagefb_probe(). Fix this by checking whether +pixclock is zero in the function savagefb_check_var() before +info->var.pixclock is used as the divisor. + +This is similar to CVE-2022-3061 in i740fb which was fixed by +commit 15cf0b8. + +Signed-off-by: Fullway Wang +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/savage/savagefb_driver.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c +index b5f84bd4804b8..4ba5cd55e5a52 100644 +--- a/drivers/video/fbdev/savage/savagefb_driver.c ++++ b/drivers/video/fbdev/savage/savagefb_driver.c +@@ -869,6 +869,9 @@ static int savagefb_check_var(struct fb_var_screeninfo *var, + + DBG("savagefb_check_var"); + ++ if (!var->pixclock) ++ return -EINVAL; ++ + var->transp.offset = 0; + var->transp.length = 0; + switch (var->bits_per_pixel) { +-- +2.43.0 + diff --git a/queue-6.6/fbdev-sis-error-out-if-pixclock-equals-zero.patch b/queue-6.6/fbdev-sis-error-out-if-pixclock-equals-zero.patch new file mode 100644 index 00000000000..7c76d176889 --- /dev/null +++ b/queue-6.6/fbdev-sis-error-out-if-pixclock-equals-zero.patch @@ -0,0 +1,43 @@ +From b48905d6e9ff2eaededaac647a7ef58c3fcf44c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 14:24:43 +0800 +Subject: fbdev: sis: Error out if pixclock equals zero + +From: Fullway Wang + +[ Upstream commit e421946be7d9bf545147bea8419ef8239cb7ca52 ] + +The userspace program could pass any values to the driver through +ioctl() interface. If the driver doesn't check the value of pixclock, +it may cause divide-by-zero error. + +In sisfb_check_var(), var->pixclock is used as a divisor to caculate +drate before it is checked against zero. Fix this by checking it +at the beginning. + +This is similar to CVE-2022-3061 in i740fb which was fixed by +commit 15cf0b8. + +Signed-off-by: Fullway Wang +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sis/sis_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/sis/sis_main.c b/drivers/video/fbdev/sis/sis_main.c +index 0f5374f6ef055..6d524a65af181 100644 +--- a/drivers/video/fbdev/sis/sis_main.c ++++ b/drivers/video/fbdev/sis/sis_main.c +@@ -1475,6 +1475,8 @@ sisfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) + + vtotal = var->upper_margin + var->lower_margin + var->vsync_len; + ++ if (!var->pixclock) ++ return -EINVAL; + pixclock = var->pixclock; + + if((var->vmode & FB_VMODE_MASK) == FB_VMODE_NONINTERLACED) { +-- +2.43.0 + diff --git a/queue-6.6/firewire-core-send-bus-reset-promptly-on-gap-count-e.patch b/queue-6.6/firewire-core-send-bus-reset-promptly-on-gap-count-e.patch new file mode 100644 index 00000000000..702637b730d --- /dev/null +++ b/queue-6.6/firewire-core-send-bus-reset-promptly-on-gap-count-e.patch @@ -0,0 +1,129 @@ +From 6bd30d6e80af9711dc27517a88c48d5a5eb446be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 08:01:17 +0900 +Subject: firewire: core: send bus reset promptly on gap count error + +From: Takashi Sakamoto + +[ Upstream commit 7ed4380009e96d9e9c605e12822e987b35b05648 ] + +If we are bus manager and the bus has inconsistent gap counts, send a +bus reset immediately instead of trying to read the root node's config +ROM first. Otherwise, we could spend a lot of time trying to read the +config ROM but never succeeding. + +This eliminates a 50+ second delay before the FireWire bus is usable after +a newly connected device is powered on in certain circumstances. + +The delay occurs if a gap count inconsistency occurs, we are not the root +node, and we become bus manager. One scenario that causes this is with a TI +XIO2213B OHCI, the first time a Sony DSR-25 is powered on after being +connected to the FireWire cable. In this configuration, the Linux box will +not receive the initial PHY configuration packet sent by the DSR-25 as IRM, +resulting in the DSR-25 having a gap count of 44 while the Linux box has a +gap count of 63. + +FireWire devices have a gap count parameter, which is set to 63 on power-up +and can be changed with a PHY configuration packet. This determines the +duration of the subaction and arbitration gaps. For reliable communication, +all nodes on a FireWire bus must have the same gap count. + +A node may have zero or more of the following roles: root node, bus manager +(BM), isochronous resource manager (IRM), and cycle master. Unless a root +node was forced with a PHY configuration packet, any node might become root +node after a bus reset. Only the root node can become cycle master. If the +root node is not cycle master capable, the BM or IRM should force a change +of root node. + +After a bus reset, each node sends a self-ID packet, which contains its +current gap count. A single bus reset does not change the gap count, but +two bus resets in a row will set the gap count to 63. Because a consistent +gap count is required for reliable communication, IEEE 1394a-2000 requires +that the bus manager generate a bus reset if it detects that the gap count +is inconsistent. + +When the gap count is inconsistent, build_tree() will notice this after the +self identification process. It will set card->gap_count to the invalid +value 0. If we become bus master, this will force bm_work() to send a bus +reset when it performs gap count optimization. + +After a bus reset, there is no bus manager. We will almost always try to +become bus manager. Once we become bus manager, we will first determine +whether the root node is cycle master capable. Then, we will determine if +the gap count should be changed. If either the root node or the gap count +should be changed, we will generate a bus reset. + +To determine if the root node is cycle master capable, we read its +configuration ROM. bm_work() will wait until we have finished trying to +read the configuration ROM. + +However, an inconsistent gap count can make this take a long time. +read_config_rom() will read the first few quadlets from the config ROM. Due +to the gap count inconsistency, eventually one of the reads will time out. +When read_config_rom() fails, fw_device_init() calls it again until +MAX_RETRIES is reached. This takes 50+ seconds. + +Once we give up trying to read the configuration ROM, bm_work() will wake +up, assume that the root node is not cycle master capable, and do a bus +reset. Hopefully, this will resolve the gap count inconsistency. + +This change makes bm_work() check for an inconsistent gap count before +waiting for the root node's configuration ROM. If the gap count is +inconsistent, bm_work() will immediately do a bus reset. This eliminates +the 50+ second delay and rapidly brings the bus to a working state. + +I considered that if the gap count is inconsistent, a PHY configuration +packet might not be successful, so it could be desirable to skip the PHY +configuration packet before the bus reset in this case. However, IEEE +1394a-2000 and IEEE 1394-2008 say that the bus manager may transmit a PHY +configuration packet before a bus reset when correcting a gap count error. +Since the standard endorses this, I decided it's safe to retain the PHY +configuration packet transmission. + +Normally, after a topology change, we will reset the bus a maximum of 5 +times to change the root node and perform gap count optimization. However, +if there is a gap count inconsistency, we must always generate a bus reset. +Otherwise the gap count inconsistency will persist and communication will +be unreliable. For that reason, if there is a gap count inconstency, we +generate a bus reset even if we already reached the 5 reset limit. + +Signed-off-by: Adam Goldman +Reference: https://sourceforge.net/p/linux1394/mailman/message/58727806/ +Signed-off-by: Takashi Sakamoto +Signed-off-by: Sasha Levin +--- + drivers/firewire/core-card.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c +index 6ac5ff20a2fe2..8aaa7fcb2630d 100644 +--- a/drivers/firewire/core-card.c ++++ b/drivers/firewire/core-card.c +@@ -429,7 +429,23 @@ static void bm_work(struct work_struct *work) + */ + card->bm_generation = generation; + +- if (root_device == NULL) { ++ if (card->gap_count == 0) { ++ /* ++ * If self IDs have inconsistent gap counts, do a ++ * bus reset ASAP. The config rom read might never ++ * complete, so don't wait for it. However, still ++ * send a PHY configuration packet prior to the ++ * bus reset. The PHY configuration packet might ++ * fail, but 1394-2008 8.4.5.2 explicitly permits ++ * it in this case, so it should be safe to try. ++ */ ++ new_root_id = local_id; ++ /* ++ * We must always send a bus reset if the gap count ++ * is inconsistent, so bypass the 5-reset limit. ++ */ ++ card->bm_retries = 0; ++ } else if (root_device == NULL) { + /* + * Either link_on is false, or we failed to read the + * config rom. In either case, pick another root. +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-add-file_modified.patch b/queue-6.6/fs-ntfs3-add-file_modified.patch new file mode 100644 index 00000000000..fd5bcdab9f0 --- /dev/null +++ b/queue-6.6/fs-ntfs3-add-file_modified.patch @@ -0,0 +1,61 @@ +From 56a7c579bd179f77fbec59db60187c72f877dc4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:16:49 +0300 +Subject: fs/ntfs3: Add file_modified + +From: Konstantin Komarov + +[ Upstream commit 4dea9cd522424d3002894c20b729c6fbfb6fc22b ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/file.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c +index 1f7a194983c5d..6e1c456c9ae7f 100644 +--- a/fs/ntfs3/file.c ++++ b/fs/ntfs3/file.c +@@ -632,11 +632,17 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len) + &ni->file.run, i_size, &ni->i_valid, + true, NULL); + ni_unlock(ni); ++ if (err) ++ goto out; + } else if (new_size > i_size) { + inode->i_size = new_size; + } + } + ++ err = file_modified(file); ++ if (err) ++ goto out; ++ + out: + if (map_locked) + filemap_invalidate_unlock(mapping); +@@ -1040,6 +1046,7 @@ static ssize_t ntfs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + struct address_space *mapping = file->f_mapping; + struct inode *inode = mapping->host; + ssize_t ret; ++ int err; + struct ntfs_inode *ni = ntfs_i(inode); + + if (is_encrypted(ni)) { +@@ -1067,6 +1074,12 @@ static ssize_t ntfs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + if (ret <= 0) + goto out; + ++ err = file_modified(iocb->ki_filp); ++ if (err) { ++ ret = err; ++ goto out; ++ } ++ + if (WARN_ON(ni->ni_flags & NI_FLAG_COMPRESSED_MASK)) { + /* Should never be here, see ntfs_file_open(). */ + ret = -EOPNOTSUPP; +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-add-null-ptr-dereference-checking-at-the-en.patch b/queue-6.6/fs-ntfs3-add-null-ptr-dereference-checking-at-the-en.patch new file mode 100644 index 00000000000..a051e9697fd --- /dev/null +++ b/queue-6.6/fs-ntfs3-add-null-ptr-dereference-checking-at-the-en.patch @@ -0,0 +1,61 @@ +From d77158e3ec1aaf8a6f1dca90f4635c5930bc0801 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 11:09:34 +0300 +Subject: fs/ntfs3: Add NULL ptr dereference checking at the end of + attr_allocate_frame() + +From: Konstantin Komarov + +[ Upstream commit aaab47f204aaf47838241d57bf8662c8840de60a ] + +It is preferable to exit through the out: label because +internal debugging functions are located there. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 4b78b669a3bdb..646e2dad1b757 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1743,8 +1743,10 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, + le_b = NULL; + attr_b = ni_find_attr(ni, NULL, &le_b, ATTR_DATA, NULL, + 0, NULL, &mi_b); +- if (!attr_b) +- return -ENOENT; ++ if (!attr_b) { ++ err = -ENOENT; ++ goto out; ++ } + + attr = attr_b; + le = le_b; +@@ -1825,13 +1827,15 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, + ok: + run_truncate_around(run, vcn); + out: +- if (new_valid > data_size) +- new_valid = data_size; ++ if (attr_b) { ++ if (new_valid > data_size) ++ new_valid = data_size; + +- valid_size = le64_to_cpu(attr_b->nres.valid_size); +- if (new_valid != valid_size) { +- attr_b->nres.valid_size = cpu_to_le64(valid_size); +- mi_b->dirty = true; ++ valid_size = le64_to_cpu(attr_b->nres.valid_size); ++ if (new_valid != valid_size) { ++ attr_b->nres.valid_size = cpu_to_le64(valid_size); ++ mi_b->dirty = true; ++ } + } + + return err; +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-correct-function-is_rst_area_valid.patch b/queue-6.6/fs-ntfs3-correct-function-is_rst_area_valid.patch new file mode 100644 index 00000000000..415bff7d057 --- /dev/null +++ b/queue-6.6/fs-ntfs3-correct-function-is_rst_area_valid.patch @@ -0,0 +1,53 @@ +From 15f9cecceea636301544b1f6ec41d1a73f4cf797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 11:13:59 +0300 +Subject: fs/ntfs3: Correct function is_rst_area_valid + +From: Konstantin Komarov + +[ Upstream commit 1b7dd28e14c4728ae1a815605ca33ffb4ce1b309 ] + +Reported-by: Robert Morris +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 7dbb000fc6911..855519713bf79 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -465,7 +465,7 @@ static inline bool is_rst_area_valid(const struct RESTART_HDR *rhdr) + { + const struct RESTART_AREA *ra; + u16 cl, fl, ul; +- u32 off, l_size, file_dat_bits, file_size_round; ++ u32 off, l_size, seq_bits; + u16 ro = le16_to_cpu(rhdr->ra_off); + u32 sys_page = le32_to_cpu(rhdr->sys_page_size); + +@@ -511,13 +511,15 @@ static inline bool is_rst_area_valid(const struct RESTART_HDR *rhdr) + /* Make sure the sequence number bits match the log file size. */ + l_size = le64_to_cpu(ra->l_size); + +- file_dat_bits = sizeof(u64) * 8 - le32_to_cpu(ra->seq_num_bits); +- file_size_round = 1u << (file_dat_bits + 3); +- if (file_size_round != l_size && +- (file_size_round < l_size || (file_size_round / 2) > l_size)) { +- return false; ++ seq_bits = sizeof(u64) * 8 + 3; ++ while (l_size) { ++ l_size >>= 1; ++ seq_bits -= 1; + } + ++ if (seq_bits != ra->seq_num_bits) ++ return false; ++ + /* The log page data offset and record header length must be quad-aligned. */ + if (!IS_ALIGNED(le16_to_cpu(ra->data_off), 8) || + !IS_ALIGNED(le16_to_cpu(ra->rec_hdr_len), 8)) +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-correct-hard-links-updating-when-dealing-wi.patch b/queue-6.6/fs-ntfs3-correct-hard-links-updating-when-dealing-wi.patch new file mode 100644 index 00000000000..dda884620b4 --- /dev/null +++ b/queue-6.6/fs-ntfs3-correct-hard-links-updating-when-dealing-wi.patch @@ -0,0 +1,45 @@ +From c5db8e9be7d416e3af1e658a93abf35d895e52f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 11:26:31 +0300 +Subject: fs/ntfs3: Correct hard links updating when dealing with DOS names + +From: Konstantin Komarov + +[ Upstream commit 1918c10e137eae266b8eb0ab1cc14421dcb0e3e2 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/record.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c +index 53629b1f65e99..7b6423584eaee 100644 +--- a/fs/ntfs3/record.c ++++ b/fs/ntfs3/record.c +@@ -535,8 +535,20 @@ bool mi_remove_attr(struct ntfs_inode *ni, struct mft_inode *mi, + return false; + + if (ni && is_attr_indexed(attr)) { +- le16_add_cpu(&ni->mi.mrec->hard_links, -1); +- ni->mi.dirty = true; ++ u16 links = le16_to_cpu(ni->mi.mrec->hard_links); ++ struct ATTR_FILE_NAME *fname = ++ attr->type != ATTR_NAME ? ++ NULL : ++ resident_data_ex(attr, ++ SIZEOF_ATTRIBUTE_FILENAME); ++ if (fname && fname->type == FILE_NAME_DOS) { ++ /* Do not decrease links count deleting DOS name. */ ++ } else if (!links) { ++ /* minor error. Not critical. */ ++ } else { ++ ni->mi.mrec->hard_links = cpu_to_le16(links - 1); ++ ni->mi.dirty = true; ++ } + } + + used -= asize; +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-disable-attr_list_entry-size-check.patch b/queue-6.6/fs-ntfs3-disable-attr_list_entry-size-check.patch new file mode 100644 index 00000000000..d966ca5bd5b --- /dev/null +++ b/queue-6.6/fs-ntfs3-disable-attr_list_entry-size-check.patch @@ -0,0 +1,75 @@ +From c1fe1ba03a8d70aa03a7ee48955b8a7f3e943cd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 13:59:43 +0300 +Subject: fs/ntfs3: Disable ATTR_LIST_ENTRY size check + +From: Konstantin Komarov + +[ Upstream commit 4cdfb6e7bc9c80142d33bf1d4653a73fa678ba56 ] + +The use of sizeof(struct ATTR_LIST_ENTRY) has been replaced with le_size(0) +due to alignment peculiarities on different platforms. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312071005.g6YrbaIe-lkp@intel.com/ +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 8 ++++---- + fs/ntfs3/ntfs.h | 2 -- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index 7c01735d1219d..48e7da47c6b71 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -127,12 +127,13 @@ struct ATTR_LIST_ENTRY *al_enumerate(struct ntfs_inode *ni, + { + size_t off; + u16 sz; ++ const unsigned le_min_size = le_size(0); + + if (!le) { + le = ni->attr_list.le; + } else { + sz = le16_to_cpu(le->size); +- if (sz < sizeof(struct ATTR_LIST_ENTRY)) { ++ if (sz < le_min_size) { + /* Impossible 'cause we should not return such le. */ + return NULL; + } +@@ -141,7 +142,7 @@ struct ATTR_LIST_ENTRY *al_enumerate(struct ntfs_inode *ni, + + /* Check boundary. */ + off = PtrOffset(ni->attr_list.le, le); +- if (off + sizeof(struct ATTR_LIST_ENTRY) > ni->attr_list.size) { ++ if (off + le_min_size > ni->attr_list.size) { + /* The regular end of list. */ + return NULL; + } +@@ -149,8 +150,7 @@ struct ATTR_LIST_ENTRY *al_enumerate(struct ntfs_inode *ni, + sz = le16_to_cpu(le->size); + + /* Check le for errors. */ +- if (sz < sizeof(struct ATTR_LIST_ENTRY) || +- off + sz > ni->attr_list.size || ++ if (sz < le_min_size || off + sz > ni->attr_list.size || + sz < le->name_off + le->name_len * sizeof(short)) { + return NULL; + } +diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h +index 13e96fc63dae5..f61f5b3adb03a 100644 +--- a/fs/ntfs3/ntfs.h ++++ b/fs/ntfs3/ntfs.h +@@ -527,8 +527,6 @@ struct ATTR_LIST_ENTRY { + + }; // sizeof(0x20) + +-static_assert(sizeof(struct ATTR_LIST_ENTRY) == 0x20); +- + static inline u32 le_size(u8 name_len) + { + return ALIGN(offsetof(struct ATTR_LIST_ENTRY, name) + +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-drop-suid-and-sgid-bits-as-a-part-of-fpunch.patch b/queue-6.6/fs-ntfs3-drop-suid-and-sgid-bits-as-a-part-of-fpunch.patch new file mode 100644 index 00000000000..feb457b9b58 --- /dev/null +++ b/queue-6.6/fs-ntfs3-drop-suid-and-sgid-bits-as-a-part-of-fpunch.patch @@ -0,0 +1,63 @@ +From 55a68aeb56cac7b93461b16e6cfa94b6e7409a19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:17:46 +0300 +Subject: fs/ntfs3: Drop suid and sgid bits as a part of fpunch + +From: Konstantin Komarov + +[ Upstream commit e50f9560b8168a625703a3e7fe1fde9fa53f0837 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/file.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c +index 6e1c456c9ae7f..5530b4cf1ee52 100644 +--- a/fs/ntfs3/file.c ++++ b/fs/ntfs3/file.c +@@ -498,10 +498,14 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len) + ni_lock(ni); + err = attr_punch_hole(ni, vbo, len, &frame_size); + ni_unlock(ni); ++ if (!err) ++ goto ok; ++ + if (err != E_NTFS_NOTALIGNED) + goto out; + + /* Process not aligned punch. */ ++ err = 0; + mask = frame_size - 1; + vbo_a = (vbo + mask) & ~mask; + end_a = end & ~mask; +@@ -524,6 +528,8 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len) + ni_lock(ni); + err = attr_punch_hole(ni, vbo_a, end_a - vbo_a, NULL); + ni_unlock(ni); ++ if (err) ++ goto out; + } + } else if (mode & FALLOC_FL_COLLAPSE_RANGE) { + /* +@@ -563,6 +569,8 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len) + ni_lock(ni); + err = attr_insert_range(ni, vbo, len); + ni_unlock(ni); ++ if (err) ++ goto out; + } else { + /* Check new size. */ + u8 cluster_bits = sbi->cluster_bits; +@@ -639,6 +647,7 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len) + } + } + ++ok: + err = file_modified(file); + if (err) + goto out; +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-fix-detected-field-spanning-write-size-8-of.patch b/queue-6.6/fs-ntfs3-fix-detected-field-spanning-write-size-8-of.patch new file mode 100644 index 00000000000..8e6cfa80fed --- /dev/null +++ b/queue-6.6/fs-ntfs3-fix-detected-field-spanning-write-size-8-of.patch @@ -0,0 +1,32 @@ +From 9294c8df0e4859913773788c9de353f30d38c5c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 11:47:30 +0300 +Subject: fs/ntfs3: Fix detected field-spanning write (size 8) of single field + "le->name" + +From: Konstantin Komarov + +[ Upstream commit d155617006ebc172a80d3eb013c4b867f9a8ada4 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/ntfs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h +index 86aecbb01a92f..13e96fc63dae5 100644 +--- a/fs/ntfs3/ntfs.h ++++ b/fs/ntfs3/ntfs.h +@@ -523,7 +523,7 @@ struct ATTR_LIST_ENTRY { + __le64 vcn; // 0x08: Starting VCN of this attribute. + struct MFT_REF ref; // 0x10: MFT record number with attribute. + __le16 id; // 0x18: struct ATTRIB ID. +- __le16 name[3]; // 0x1A: Just to align. To get real name can use bNameOffset. ++ __le16 name[]; // 0x1A: Just to align. To get real name can use name_off. + + }; // sizeof(0x20) + +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-fix-multithreaded-stress-test.patch b/queue-6.6/fs-ntfs3-fix-multithreaded-stress-test.patch new file mode 100644 index 00000000000..8f9e93d3de1 --- /dev/null +++ b/queue-6.6/fs-ntfs3-fix-multithreaded-stress-test.patch @@ -0,0 +1,64 @@ +From 0e907b434dc4153f86bb621851aff39792c64548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 11:46:16 +0300 +Subject: fs/ntfs3: Fix multithreaded stress test + +From: Konstantin Komarov + +[ Upstream commit a8b0c9fc3a2dba07f697ef7825e04363ff12f071 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 63f70259edc0d..4b78b669a3bdb 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -886,7 +886,7 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, + struct runs_tree *run = &ni->file.run; + struct ntfs_sb_info *sbi; + u8 cluster_bits; +- struct ATTRIB *attr = NULL, *attr_b; ++ struct ATTRIB *attr, *attr_b; + struct ATTR_LIST_ENTRY *le, *le_b; + struct mft_inode *mi, *mi_b; + CLST hint, svcn, to_alloc, evcn1, next_svcn, asize, end, vcn0, alen; +@@ -904,12 +904,8 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, + *len = 0; + up_read(&ni->file.run_lock); + +- if (*len) { +- if (*lcn != SPARSE_LCN || !new) +- return 0; /* Fast normal way without allocation. */ +- else if (clen > *len) +- clen = *len; +- } ++ if (*len && (*lcn != SPARSE_LCN || !new)) ++ return 0; /* Fast normal way without allocation. */ + + /* No cluster in cache or we need to allocate cluster in hole. */ + sbi = ni->mi.sbi; +@@ -918,6 +914,17 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, + ni_lock(ni); + down_write(&ni->file.run_lock); + ++ /* Repeat the code above (under write lock). */ ++ if (!run_lookup_entry(run, vcn, lcn, len, NULL)) ++ *len = 0; ++ ++ if (*len) { ++ if (*lcn != SPARSE_LCN || !new) ++ goto out; /* normal way without allocation. */ ++ if (clen > *len) ++ clen = *len; ++ } ++ + le_b = NULL; + attr_b = ni_find_attr(ni, NULL, &le_b, ATTR_DATA, NULL, 0, NULL, &mi_b); + if (!attr_b) { +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-fix-oob-in-ntfs_listxattr.patch b/queue-6.6/fs-ntfs3-fix-oob-in-ntfs_listxattr.patch new file mode 100644 index 00000000000..6f39cb032bb --- /dev/null +++ b/queue-6.6/fs-ntfs3-fix-oob-in-ntfs_listxattr.patch @@ -0,0 +1,36 @@ +From 39cf057fa86d842752b19b2ea7529b8e093e04b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Dec 2023 17:00:03 +0800 +Subject: fs/ntfs3: Fix oob in ntfs_listxattr + +From: Edward Adam Davis + +[ Upstream commit 731ab1f9828800df871c5a7ab9ffe965317d3f15 ] + +The length of name cannot exceed the space occupied by ea. + +Reported-and-tested-by: syzbot+65e940cfb8f99a97aca7@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/xattr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index 838a79157fb99..b50010494e6d0 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -219,6 +219,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, + if (!ea->name_len) + break; + ++ if (ea->name_len > ea_size) ++ break; ++ + if (buffer) { + /* Check if we can use field ea->name */ + if (off + ea_size > size) +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-fixed-overflow-check-in-mi_enum_attr.patch b/queue-6.6/fs-ntfs3-fixed-overflow-check-in-mi_enum_attr.patch new file mode 100644 index 00000000000..2be19c166e5 --- /dev/null +++ b/queue-6.6/fs-ntfs3-fixed-overflow-check-in-mi_enum_attr.patch @@ -0,0 +1,32 @@ +From 26a7d21421014a0ae0c3f9d65ec84a381104652a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 11:14:31 +0300 +Subject: fs/ntfs3: Fixed overflow check in mi_enum_attr() + +From: Konstantin Komarov + +[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ] + +Reported-by: Robert Morris +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/record.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c +index 7b6423584eaee..6aa3a9d44df1b 100644 +--- a/fs/ntfs3/record.c ++++ b/fs/ntfs3/record.c +@@ -279,7 +279,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) + if (t16 > asize) + return NULL; + +- if (t16 + le32_to_cpu(attr->res.data_size) > asize) ++ if (le32_to_cpu(attr->res.data_size) > asize - t16) + return NULL; + + t32 = sizeof(short) * attr->name_len; +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-implement-super_operations-shutdown.patch b/queue-6.6/fs-ntfs3-implement-super_operations-shutdown.patch new file mode 100644 index 00000000000..fdf9f8de72d --- /dev/null +++ b/queue-6.6/fs-ntfs3-implement-super_operations-shutdown.patch @@ -0,0 +1,286 @@ +From 3f1e073738434d25d7ea2a1331c1e8adb2f49a82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:19:37 +0300 +Subject: fs/ntfs3: Implement super_operations::shutdown + +From: Konstantin Komarov + +[ Upstream commit 6c3684e703837d2116b5cf4beb37aa7145a66b60 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/file.c | 18 ++++++++++++++++++ + fs/ntfs3/frecord.c | 3 +++ + fs/ntfs3/inode.c | 21 +++++++++++++++++++-- + fs/ntfs3/namei.c | 12 ++++++++++++ + fs/ntfs3/ntfs_fs.h | 9 ++++++++- + fs/ntfs3/super.c | 12 ++++++++++++ + fs/ntfs3/xattr.c | 3 +++ + 7 files changed, 75 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c +index 5530b4cf1ee52..a5bbf7b5775af 100644 +--- a/fs/ntfs3/file.c ++++ b/fs/ntfs3/file.c +@@ -260,6 +260,9 @@ static int ntfs_file_mmap(struct file *file, struct vm_area_struct *vma) + bool rw = vma->vm_flags & VM_WRITE; + int err; + ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ + if (is_encrypted(ni)) { + ntfs_inode_warn(inode, "mmap encrypted not supported"); + return -EOPNOTSUPP; +@@ -677,6 +680,9 @@ int ntfs3_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + umode_t mode = inode->i_mode; + int err; + ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ + err = setattr_prepare(idmap, dentry, attr); + if (err) + goto out; +@@ -732,6 +738,9 @@ static ssize_t ntfs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) + struct inode *inode = file->f_mapping->host; + struct ntfs_inode *ni = ntfs_i(inode); + ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ + if (is_encrypted(ni)) { + ntfs_inode_warn(inode, "encrypted i/o not supported"); + return -EOPNOTSUPP; +@@ -766,6 +775,9 @@ static ssize_t ntfs_file_splice_read(struct file *in, loff_t *ppos, + struct inode *inode = in->f_mapping->host; + struct ntfs_inode *ni = ntfs_i(inode); + ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ + if (is_encrypted(ni)) { + ntfs_inode_warn(inode, "encrypted i/o not supported"); + return -EOPNOTSUPP; +@@ -1058,6 +1070,9 @@ static ssize_t ntfs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + int err; + struct ntfs_inode *ni = ntfs_i(inode); + ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ + if (is_encrypted(ni)) { + ntfs_inode_warn(inode, "encrypted i/o not supported"); + return -EOPNOTSUPP; +@@ -1118,6 +1133,9 @@ int ntfs_file_open(struct inode *inode, struct file *file) + { + struct ntfs_inode *ni = ntfs_i(inode); + ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ + if (unlikely((is_compressed(ni) || is_encrypted(ni)) && + (file->f_flags & O_DIRECT))) { + return -EOPNOTSUPP; +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index dad976a689859..86b43051f39cd 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -3259,6 +3259,9 @@ int ni_write_inode(struct inode *inode, int sync, const char *hint) + if (is_bad_inode(inode) || sb_rdonly(sb)) + return 0; + ++ if (unlikely(ntfs3_forced_shutdown(sb))) ++ return -EIO; ++ + if (!ni_trylock(ni)) { + /* 'ni' is under modification, skip for now. */ + mark_inode_dirty_sync(inode); +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index fb0466c115040..012dbc8ac5ec7 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -851,9 +851,13 @@ static int ntfs_resident_writepage(struct folio *folio, + struct writeback_control *wbc, void *data) + { + struct address_space *mapping = data; +- struct ntfs_inode *ni = ntfs_i(mapping->host); ++ struct inode *inode = mapping->host; ++ struct ntfs_inode *ni = ntfs_i(inode); + int ret; + ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ + ni_lock(ni); + ret = attr_data_write_resident(ni, &folio->page); + ni_unlock(ni); +@@ -867,7 +871,12 @@ static int ntfs_resident_writepage(struct folio *folio, + static int ntfs_writepages(struct address_space *mapping, + struct writeback_control *wbc) + { +- if (is_resident(ntfs_i(mapping->host))) ++ struct inode *inode = mapping->host; ++ ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ ++ if (is_resident(ntfs_i(inode))) + return write_cache_pages(mapping, wbc, ntfs_resident_writepage, + mapping); + return mpage_writepages(mapping, wbc, ntfs_get_block); +@@ -887,6 +896,9 @@ int ntfs_write_begin(struct file *file, struct address_space *mapping, + struct inode *inode = mapping->host; + struct ntfs_inode *ni = ntfs_i(inode); + ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ + *pagep = NULL; + if (is_resident(ni)) { + struct page *page = +@@ -1303,6 +1315,11 @@ struct inode *ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, + goto out1; + } + ++ if (unlikely(ntfs3_forced_shutdown(sb))) { ++ err = -EIO; ++ goto out2; ++ } ++ + /* Mark rw ntfs as dirty. it will be cleared at umount. */ + ntfs_set_state(sbi, NTFS_DIRTY_DIRTY); + +diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c +index eedacf94edd80..b5687d74b4495 100644 +--- a/fs/ntfs3/namei.c ++++ b/fs/ntfs3/namei.c +@@ -181,6 +181,9 @@ static int ntfs_unlink(struct inode *dir, struct dentry *dentry) + struct ntfs_inode *ni = ntfs_i(dir); + int err; + ++ if (unlikely(ntfs3_forced_shutdown(dir->i_sb))) ++ return -EIO; ++ + ni_lock_dir(ni); + + err = ntfs_unlink_inode(dir, dentry); +@@ -199,6 +202,9 @@ static int ntfs_symlink(struct mnt_idmap *idmap, struct inode *dir, + u32 size = strlen(symname); + struct inode *inode; + ++ if (unlikely(ntfs3_forced_shutdown(dir->i_sb))) ++ return -EIO; ++ + inode = ntfs_create_inode(idmap, dir, dentry, NULL, S_IFLNK | 0777, 0, + symname, size, NULL); + +@@ -227,6 +233,9 @@ static int ntfs_rmdir(struct inode *dir, struct dentry *dentry) + struct ntfs_inode *ni = ntfs_i(dir); + int err; + ++ if (unlikely(ntfs3_forced_shutdown(dir->i_sb))) ++ return -EIO; ++ + ni_lock_dir(ni); + + err = ntfs_unlink_inode(dir, dentry); +@@ -264,6 +273,9 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir, + 1024); + static_assert(PATH_MAX >= 4 * 1024); + ++ if (unlikely(ntfs3_forced_shutdown(sb))) ++ return -EIO; ++ + if (flags & ~RENAME_NOREPLACE) + return -EINVAL; + +diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h +index 29a9b0b29e4f8..466ee5bd62260 100644 +--- a/fs/ntfs3/ntfs_fs.h ++++ b/fs/ntfs3/ntfs_fs.h +@@ -61,6 +61,8 @@ enum utf16_endian; + + /* sbi->flags */ + #define NTFS_FLAGS_NODISCARD 0x00000001 ++/* ntfs in shutdown state. */ ++#define NTFS_FLAGS_SHUTDOWN 0x00000002 + /* Set when LogFile is replaying. */ + #define NTFS_FLAGS_LOG_REPLAYING 0x00000008 + /* Set when we changed first MFT's which copy must be updated in $MftMirr. */ +@@ -226,7 +228,7 @@ struct ntfs_sb_info { + u64 maxbytes; // Maximum size for normal files. + u64 maxbytes_sparse; // Maximum size for sparse file. + +- u32 flags; // See NTFS_FLAGS_XXX. ++ unsigned long flags; // See NTFS_FLAGS_ + + CLST zone_max; // Maximum MFT zone length in clusters + CLST bad_clusters; // The count of marked bad clusters. +@@ -999,6 +1001,11 @@ static inline struct ntfs_sb_info *ntfs_sb(struct super_block *sb) + return sb->s_fs_info; + } + ++static inline bool ntfs3_forced_shutdown(struct super_block *sb) ++{ ++ return test_bit(NTFS_FLAGS_SHUTDOWN, &ntfs_sb(sb)->flags); ++} ++ + /* + * ntfs_up_cluster - Align up on cluster boundary. + */ +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index aa3b2c262ab6e..a313b4ddee16f 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -714,6 +714,14 @@ static int ntfs_show_options(struct seq_file *m, struct dentry *root) + return 0; + } + ++/* ++ * ntfs_shutdown - super_operations::shutdown ++ */ ++static void ntfs_shutdown(struct super_block *sb) ++{ ++ set_bit(NTFS_FLAGS_SHUTDOWN, &ntfs_sb(sb)->flags); ++} ++ + /* + * ntfs_sync_fs - super_operations::sync_fs + */ +@@ -724,6 +732,9 @@ static int ntfs_sync_fs(struct super_block *sb, int wait) + struct ntfs_inode *ni; + struct inode *inode; + ++ if (unlikely(ntfs3_forced_shutdown(sb))) ++ return -EIO; ++ + ni = sbi->security.ni; + if (ni) { + inode = &ni->vfs_inode; +@@ -763,6 +774,7 @@ static const struct super_operations ntfs_sops = { + .put_super = ntfs_put_super, + .statfs = ntfs_statfs, + .show_options = ntfs_show_options, ++ .shutdown = ntfs_shutdown, + .sync_fs = ntfs_sync_fs, + .write_inode = ntfs3_write_inode, + }; +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index 4920548192a0c..838a79157fb99 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -744,6 +744,9 @@ static int ntfs_getxattr(const struct xattr_handler *handler, struct dentry *de, + int err; + struct ntfs_inode *ni = ntfs_i(inode); + ++ if (unlikely(ntfs3_forced_shutdown(inode->i_sb))) ++ return -EIO; ++ + /* Dispatch request. */ + if (!strcmp(name, SYSTEM_DOS_ATTRIB)) { + /* system.dos_attrib */ +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-improve-alternative-boot-processing.patch b/queue-6.6/fs-ntfs3-improve-alternative-boot-processing.patch new file mode 100644 index 00000000000..b6fc20974eb --- /dev/null +++ b/queue-6.6/fs-ntfs3-improve-alternative-boot-processing.patch @@ -0,0 +1,85 @@ +From 8e2a59c111885bdf719ec4c44225e2cd21524466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 11:04:53 +0300 +Subject: fs/ntfs3: Improve alternative boot processing + +From: Konstantin Komarov + +[ Upstream commit c39de951282df9a60ef70664e4378d88006b2670 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/super.c | 35 +++++++++++++++++------------------ + 1 file changed, 17 insertions(+), 18 deletions(-) + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index f763e3256ccc1..aa3b2c262ab6e 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -865,6 +865,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + u16 fn, ao; + u8 cluster_bits; + u32 boot_off = 0; ++ sector_t boot_block = 0; + const char *hint = "Primary boot"; + + /* Save original dev_size. Used with alternative boot. */ +@@ -872,11 +873,11 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + + sbi->volume.blocks = dev_size >> PAGE_SHIFT; + +- bh = ntfs_bread(sb, 0); ++read_boot: ++ bh = ntfs_bread(sb, boot_block); + if (!bh) +- return -EIO; ++ return boot_block ? -EINVAL : -EIO; + +-check_boot: + err = -EINVAL; + + /* Corrupted image; do not read OOB */ +@@ -1107,26 +1108,24 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + } + + out: +- if (err == -EINVAL && !bh->b_blocknr && dev_size0 > PAGE_SHIFT) { ++ brelse(bh); ++ ++ if (err == -EINVAL && !boot_block && dev_size0 > PAGE_SHIFT) { + u32 block_size = min_t(u32, sector_size, PAGE_SIZE); + u64 lbo = dev_size0 - sizeof(*boot); + +- /* +- * Try alternative boot (last sector) +- */ +- brelse(bh); +- +- sb_set_blocksize(sb, block_size); +- bh = ntfs_bread(sb, lbo >> blksize_bits(block_size)); +- if (!bh) +- return -EINVAL; +- ++ boot_block = lbo >> blksize_bits(block_size); + boot_off = lbo & (block_size - 1); +- hint = "Alternative boot"; +- dev_size = dev_size0; /* restore original size. */ +- goto check_boot; ++ if (boot_block && block_size >= boot_off + sizeof(*boot)) { ++ /* ++ * Try alternative boot (last sector) ++ */ ++ sb_set_blocksize(sb, block_size); ++ hint = "Alternative boot"; ++ dev_size = dev_size0; /* restore original size. */ ++ goto read_boot; ++ } + } +- brelse(bh); + + return err; + } +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-improve-ntfs_dir_count.patch b/queue-6.6/fs-ntfs3-improve-ntfs_dir_count.patch new file mode 100644 index 00000000000..b190b6470e8 --- /dev/null +++ b/queue-6.6/fs-ntfs3-improve-ntfs_dir_count.patch @@ -0,0 +1,62 @@ +From 5036371dfcb0fa9a4141055bf6eb5bd4b6714b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 11:24:33 +0300 +Subject: fs/ntfs3: Improve ntfs_dir_count + +From: Konstantin Komarov + +[ Upstream commit 6a799c928b78b14999b7705c4cca0f88e297fe96 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/dir.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index 22ede4da04502..726122ecd39b4 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -515,11 +515,9 @@ static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs, + struct INDEX_HDR *hdr; + const struct ATTR_FILE_NAME *fname; + u32 e_size, off, end; +- u64 vbo = 0; + size_t drs = 0, fles = 0, bit = 0; +- loff_t i_size = ni->vfs_inode.i_size; + struct indx_node *node = NULL; +- u8 index_bits = ni->dir.index_bits; ++ size_t max_indx = ni->vfs_inode.i_size >> ni->dir.index_bits; + + if (is_empty) + *is_empty = true; +@@ -563,7 +561,7 @@ static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs, + fles += 1; + } + +- if (vbo >= i_size) ++ if (bit >= max_indx) + goto out; + + err = indx_used_bit(&ni->dir, ni, &bit); +@@ -573,8 +571,7 @@ static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs, + if (bit == MINUS_ONE_T) + goto out; + +- vbo = (u64)bit << index_bits; +- if (vbo >= i_size) ++ if (bit >= max_indx) + goto out; + + err = indx_read(&ni->dir, ni, bit << ni->dir.idx2vbn_bits, +@@ -584,7 +581,6 @@ static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs, + + hdr = &node->index->ihdr; + bit += 1; +- vbo = (u64)bit << ni->dir.idx2vbn_bits; + } + + out: +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-modified-fix-directory-element-type-detecti.patch b/queue-6.6/fs-ntfs3-modified-fix-directory-element-type-detecti.patch new file mode 100644 index 00000000000..d82265a86e2 --- /dev/null +++ b/queue-6.6/fs-ntfs3-modified-fix-directory-element-type-detecti.patch @@ -0,0 +1,64 @@ +From d8b421ef3e009a47db12b0bebd19b7451e7f7e8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 11:17:07 +0300 +Subject: fs/ntfs3: Modified fix directory element type detection + +From: Konstantin Komarov + +[ Upstream commit 22457c047ed971f2f2e33be593ddfabd9639a409 ] + +Unfortunately reparse attribute is used for many purposes (several dozens). +It is not possible here to know is this name symlink or not. +To get exactly the type of name we should to open inode (read mft). +getattr for opened file (fstat) correctly returns symlink. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/dir.c | 30 +++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index ec0566b322d5d..22ede4da04502 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -309,11 +309,31 @@ static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni, + return 0; + } + +- /* NTFS: symlinks are "dir + reparse" or "file + reparse" */ +- if (fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) +- dt_type = DT_LNK; +- else +- dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG; ++ /* ++ * NTFS: symlinks are "dir + reparse" or "file + reparse" ++ * Unfortunately reparse attribute is used for many purposes (several dozens). ++ * It is not possible here to know is this name symlink or not. ++ * To get exactly the type of name we should to open inode (read mft). ++ * getattr for opened file (fstat) correctly returns symlink. ++ */ ++ dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG; ++ ++ /* ++ * It is not reliable to detect the type of name using duplicated information ++ * stored in parent directory. ++ * The only correct way to get the type of name - read MFT record and find ATTR_STD. ++ * The code below is not good idea. ++ * It does additional locks/reads just to get the type of name. ++ * Should we use additional mount option to enable branch below? ++ */ ++ if ((fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) && ++ ino != ni->mi.rno) { ++ struct inode *inode = ntfs_iget5(sbi->sb, &e->ref, NULL); ++ if (!IS_ERR_OR_NULL(inode)) { ++ dt_type = fs_umode_to_dtype(inode->i_mode); ++ iput(inode); ++ } ++ } + + return !dir_emit(ctx, (s8 *)name, name_len, ino, dt_type); + } +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-ntfs3_forced_shutdown-use-int-instead-of-bo.patch b/queue-6.6/fs-ntfs3-ntfs3_forced_shutdown-use-int-instead-of-bo.patch new file mode 100644 index 00000000000..3d40192fb4b --- /dev/null +++ b/queue-6.6/fs-ntfs3-ntfs3_forced_shutdown-use-int-instead-of-bo.patch @@ -0,0 +1,72 @@ +From 17f6c1ab1e5bb121e79a368548e6ce2e68772724 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 12:21:12 +0300 +Subject: fs/ntfs3: ntfs3_forced_shutdown use int instead of bool + +From: Konstantin Komarov + +[ Upstream commit 97ec56d390a3a0077b36cb38627f671c72dddce6 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 3 ++- + fs/ntfs3/ntfs_fs.h | 6 +++--- + fs/ntfs3/super.c | 2 +- + 3 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index fbfe21dbb4259..350461d8cece5 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -853,7 +853,8 @@ void ntfs_update_mftmirr(struct ntfs_sb_info *sbi, int wait) + /* + * sb can be NULL here. In this case sbi->flags should be 0 too. + */ +- if (!sb || !(sbi->flags & NTFS_FLAGS_MFTMIRR)) ++ if (!sb || !(sbi->flags & NTFS_FLAGS_MFTMIRR) || ++ unlikely(ntfs3_forced_shutdown(sb))) + return; + + blocksize = sb->s_blocksize; +diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h +index 466ee5bd62260..c71a1eca427a3 100644 +--- a/fs/ntfs3/ntfs_fs.h ++++ b/fs/ntfs3/ntfs_fs.h +@@ -62,7 +62,7 @@ enum utf16_endian; + /* sbi->flags */ + #define NTFS_FLAGS_NODISCARD 0x00000001 + /* ntfs in shutdown state. */ +-#define NTFS_FLAGS_SHUTDOWN 0x00000002 ++#define NTFS_FLAGS_SHUTDOWN_BIT 0x00000002 /* == 4*/ + /* Set when LogFile is replaying. */ + #define NTFS_FLAGS_LOG_REPLAYING 0x00000008 + /* Set when we changed first MFT's which copy must be updated in $MftMirr. */ +@@ -1001,9 +1001,9 @@ static inline struct ntfs_sb_info *ntfs_sb(struct super_block *sb) + return sb->s_fs_info; + } + +-static inline bool ntfs3_forced_shutdown(struct super_block *sb) ++static inline int ntfs3_forced_shutdown(struct super_block *sb) + { +- return test_bit(NTFS_FLAGS_SHUTDOWN, &ntfs_sb(sb)->flags); ++ return test_bit(NTFS_FLAGS_SHUTDOWN_BIT, &ntfs_sb(sb)->flags); + } + + /* +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index a313b4ddee16f..378e261e23b04 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -719,7 +719,7 @@ static int ntfs_show_options(struct seq_file *m, struct dentry *root) + */ + static void ntfs_shutdown(struct super_block *sb) + { +- set_bit(NTFS_FLAGS_SHUTDOWN, &ntfs_sb(sb)->flags); ++ set_bit(NTFS_FLAGS_SHUTDOWN_BIT, &ntfs_sb(sb)->flags); + } + + /* +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-prevent-generic-message-attempt-to-access-b.patch b/queue-6.6/fs-ntfs3-prevent-generic-message-attempt-to-access-b.patch new file mode 100644 index 00000000000..30c1971da25 --- /dev/null +++ b/queue-6.6/fs-ntfs3-prevent-generic-message-attempt-to-access-b.patch @@ -0,0 +1,89 @@ +From 1e766adb626edcb79db1db17dcfe2f9e9b256672 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 11:03:21 +0300 +Subject: fs/ntfs3: Prevent generic message "attempt to access beyond end of + device" + +From: Konstantin Komarov + +[ Upstream commit 5ca87d01eba7bdfe9536a157ca33c1455bb8d16c ] + +It used in test environment. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 24 ++++++++++++++++++++++++ + fs/ntfs3/ntfs_fs.h | 14 +------------- + 2 files changed, 25 insertions(+), 13 deletions(-) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 350461d8cece5..c66b0eab6a160 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -1007,6 +1007,30 @@ static inline __le32 security_hash(const void *sd, size_t bytes) + return cpu_to_le32(hash); + } + ++/* ++ * simple wrapper for sb_bread_unmovable. ++ */ ++struct buffer_head *ntfs_bread(struct super_block *sb, sector_t block) ++{ ++ struct ntfs_sb_info *sbi = sb->s_fs_info; ++ struct buffer_head *bh; ++ ++ if (unlikely(block >= sbi->volume.blocks)) { ++ /* prevent generic message "attempt to access beyond end of device" */ ++ ntfs_err(sb, "try to read out of volume at offset 0x%llx", ++ (u64)block << sb->s_blocksize_bits); ++ return NULL; ++ } ++ ++ bh = sb_bread_unmovable(sb, block); ++ if (bh) ++ return bh; ++ ++ ntfs_err(sb, "failed to read volume at offset 0x%llx", ++ (u64)block << sb->s_blocksize_bits); ++ return NULL; ++} ++ + int ntfs_sb_read(struct super_block *sb, u64 lbo, size_t bytes, void *buffer) + { + struct block_device *bdev = sb->s_bdev; +diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h +index 98906e4675171..1ca40c1d966b8 100644 +--- a/fs/ntfs3/ntfs_fs.h ++++ b/fs/ntfs3/ntfs_fs.h +@@ -586,6 +586,7 @@ bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes); + int log_replay(struct ntfs_inode *ni, bool *initialized); + + /* Globals from fsntfs.c */ ++struct buffer_head *ntfs_bread(struct super_block *sb, sector_t block); + bool ntfs_fix_pre_write(struct NTFS_RECORD_HEADER *rhdr, size_t bytes); + int ntfs_fix_post_read(struct NTFS_RECORD_HEADER *rhdr, size_t bytes, + bool simple); +@@ -1032,19 +1033,6 @@ static inline u64 bytes_to_block(const struct super_block *sb, u64 size) + return (size + sb->s_blocksize - 1) >> sb->s_blocksize_bits; + } + +-static inline struct buffer_head *ntfs_bread(struct super_block *sb, +- sector_t block) +-{ +- struct buffer_head *bh = sb_bread_unmovable(sb, block); +- +- if (bh) +- return bh; +- +- ntfs_err(sb, "failed to read volume at offset 0x%llx", +- (u64)block << sb->s_blocksize_bits); +- return NULL; +-} +- + static inline struct ntfs_inode *ntfs_i(struct inode *inode) + { + return container_of(inode, struct ntfs_inode, vfs_inode); +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-print-warning-while-fixing-hard-links-count.patch b/queue-6.6/fs-ntfs3-print-warning-while-fixing-hard-links-count.patch new file mode 100644 index 00000000000..c365e266a10 --- /dev/null +++ b/queue-6.6/fs-ntfs3-print-warning-while-fixing-hard-links-count.patch @@ -0,0 +1,38 @@ +From dcb2f3927922ff61f2b49e7410676ce8ea99191f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 11:34:24 +0300 +Subject: fs/ntfs3: Print warning while fixing hard links count + +From: Konstantin Komarov + +[ Upstream commit 85ba2a75faee759809a7e43b4c103ac59bac1026 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index d6d021e19aaa2..fb0466c115040 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -410,7 +410,6 @@ static struct inode *ntfs_read_mft(struct inode *inode, + goto out; + + if (!is_match && name) { +- /* Reuse rec as buffer for ascii name. */ + err = -ENOENT; + goto out; + } +@@ -425,6 +424,7 @@ static struct inode *ntfs_read_mft(struct inode *inode, + + if (names != le16_to_cpu(rec->hard_links)) { + /* Correct minor error on the fly. Do not mark inode as dirty. */ ++ ntfs_inode_warn(inode, "Correct links count -> %u.", names); + rec->hard_links = cpu_to_le16(names); + ni->mi.dirty = true; + } +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-reduce-stack-usage.patch b/queue-6.6/fs-ntfs3-reduce-stack-usage.patch new file mode 100644 index 00000000000..78dd78581b5 --- /dev/null +++ b/queue-6.6/fs-ntfs3-reduce-stack-usage.patch @@ -0,0 +1,458 @@ +From b26c27a03a717eae817bf7ad03faccf970770000 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 11:42:04 +0300 +Subject: fs/ntfs3: Reduce stack usage + +From: Konstantin Komarov + +[ Upstream commit 865e7a7700d930d34895a70f8af2eb4e778a5b0e ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 218 +++++++++++++++++++++-------------------------- + 1 file changed, 98 insertions(+), 120 deletions(-) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 98ccb66508583..7dbb000fc6911 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -974,6 +974,16 @@ static inline void *alloc_rsttbl_from_idx(struct RESTART_TABLE **tbl, u32 vbo) + return e; + } + ++struct restart_info { ++ u64 last_lsn; ++ struct RESTART_HDR *r_page; ++ u32 vbo; ++ bool chkdsk_was_run; ++ bool valid_page; ++ bool initialized; ++ bool restart; ++}; ++ + #define RESTART_SINGLE_PAGE_IO cpu_to_le16(0x0001) + + #define NTFSLOG_WRAPPED 0x00000001 +@@ -987,6 +997,7 @@ struct ntfs_log { + struct ntfs_inode *ni; + + u32 l_size; ++ u32 orig_file_size; + u32 sys_page_size; + u32 sys_page_mask; + u32 page_size; +@@ -1040,6 +1051,8 @@ struct ntfs_log { + + struct CLIENT_ID client_id; + u32 client_undo_commit; ++ ++ struct restart_info rst_info, rst_info2; + }; + + static inline u32 lsn_to_vbo(struct ntfs_log *log, const u64 lsn) +@@ -1105,16 +1118,6 @@ static inline bool verify_client_lsn(struct ntfs_log *log, + lsn <= le64_to_cpu(log->ra->current_lsn) && lsn; + } + +-struct restart_info { +- u64 last_lsn; +- struct RESTART_HDR *r_page; +- u32 vbo; +- bool chkdsk_was_run; +- bool valid_page; +- bool initialized; +- bool restart; +-}; +- + static int read_log_page(struct ntfs_log *log, u32 vbo, + struct RECORD_PAGE_HDR **buffer, bool *usa_error) + { +@@ -1176,7 +1179,7 @@ static int read_log_page(struct ntfs_log *log, u32 vbo, + * restart page header. It will stop the first time we find a + * valid page header. + */ +-static int log_read_rst(struct ntfs_log *log, u32 l_size, bool first, ++static int log_read_rst(struct ntfs_log *log, bool first, + struct restart_info *info) + { + u32 skip, vbo; +@@ -1192,7 +1195,7 @@ static int log_read_rst(struct ntfs_log *log, u32 l_size, bool first, + } + + /* Loop continuously until we succeed. */ +- for (; vbo < l_size; vbo = 2 * vbo + skip, skip = 0) { ++ for (; vbo < log->l_size; vbo = 2 * vbo + skip, skip = 0) { + bool usa_error; + bool brst, bchk; + struct RESTART_AREA *ra; +@@ -1285,22 +1288,17 @@ static int log_read_rst(struct ntfs_log *log, u32 l_size, bool first, + /* + * Ilog_init_pg_hdr - Init @log from restart page header. + */ +-static void log_init_pg_hdr(struct ntfs_log *log, u32 sys_page_size, +- u32 page_size, u16 major_ver, u16 minor_ver) ++static void log_init_pg_hdr(struct ntfs_log *log, u16 major_ver, u16 minor_ver) + { +- log->sys_page_size = sys_page_size; +- log->sys_page_mask = sys_page_size - 1; +- log->page_size = page_size; +- log->page_mask = page_size - 1; +- log->page_bits = blksize_bits(page_size); ++ log->sys_page_size = log->page_size; ++ log->sys_page_mask = log->page_mask; + + log->clst_per_page = log->page_size >> log->ni->mi.sbi->cluster_bits; + if (!log->clst_per_page) + log->clst_per_page = 1; + +- log->first_page = major_ver >= 2 ? +- 0x22 * page_size : +- ((sys_page_size << 1) + (page_size << 1)); ++ log->first_page = major_ver >= 2 ? 0x22 * log->page_size : ++ 4 * log->page_size; + log->major_ver = major_ver; + log->minor_ver = minor_ver; + } +@@ -1308,12 +1306,11 @@ static void log_init_pg_hdr(struct ntfs_log *log, u32 sys_page_size, + /* + * log_create - Init @log in cases when we don't have a restart area to use. + */ +-static void log_create(struct ntfs_log *log, u32 l_size, const u64 last_lsn, ++static void log_create(struct ntfs_log *log, const u64 last_lsn, + u32 open_log_count, bool wrapped, bool use_multi_page) + { +- log->l_size = l_size; + /* All file offsets must be quadword aligned. */ +- log->file_data_bits = blksize_bits(l_size) - 3; ++ log->file_data_bits = blksize_bits(log->l_size) - 3; + log->seq_num_mask = (8 << log->file_data_bits) - 1; + log->seq_num_bits = sizeof(u64) * 8 - log->file_data_bits; + log->seq_num = (last_lsn >> log->file_data_bits) + 2; +@@ -3720,10 +3717,8 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + struct ntfs_sb_info *sbi = ni->mi.sbi; + struct ntfs_log *log; + +- struct restart_info rst_info, rst_info2; +- u64 rec_lsn, ra_lsn, checkpt_lsn = 0, rlsn = 0; ++ u64 rec_lsn, checkpt_lsn = 0, rlsn = 0; + struct ATTR_NAME_ENTRY *attr_names = NULL; +- struct ATTR_NAME_ENTRY *ane; + struct RESTART_TABLE *dptbl = NULL; + struct RESTART_TABLE *trtbl = NULL; + const struct RESTART_TABLE *rt; +@@ -3741,9 +3736,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + struct TRANSACTION_ENTRY *tr; + struct DIR_PAGE_ENTRY *dp; + u32 i, bytes_per_attr_entry; +- u32 l_size = ni->vfs_inode.i_size; +- u32 orig_file_size = l_size; +- u32 page_size, vbo, tail, off, dlen; ++ u32 vbo, tail, off, dlen; + u32 saved_len, rec_len, transact_id; + bool use_second_page; + struct RESTART_AREA *ra2, *ra = NULL; +@@ -3758,52 +3751,50 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + u16 t16; + u32 t32; + +- /* Get the size of page. NOTE: To replay we can use default page. */ +-#if PAGE_SIZE >= DefaultLogPageSize && PAGE_SIZE <= DefaultLogPageSize * 2 +- page_size = norm_file_page(PAGE_SIZE, &l_size, true); +-#else +- page_size = norm_file_page(PAGE_SIZE, &l_size, false); +-#endif +- if (!page_size) +- return -EINVAL; +- + log = kzalloc(sizeof(struct ntfs_log), GFP_NOFS); + if (!log) + return -ENOMEM; + + log->ni = ni; +- log->l_size = l_size; +- log->one_page_buf = kmalloc(page_size, GFP_NOFS); ++ log->l_size = log->orig_file_size = ni->vfs_inode.i_size; ++ ++ /* Get the size of page. NOTE: To replay we can use default page. */ ++#if PAGE_SIZE >= DefaultLogPageSize && PAGE_SIZE <= DefaultLogPageSize * 2 ++ log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, true); ++#else ++ log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, false); ++#endif ++ if (!log->page_size) { ++ err = -EINVAL; ++ goto out; ++ } + ++ log->one_page_buf = kmalloc(log->page_size, GFP_NOFS); + if (!log->one_page_buf) { + err = -ENOMEM; + goto out; + } + +- log->page_size = page_size; +- log->page_mask = page_size - 1; +- log->page_bits = blksize_bits(page_size); ++ log->page_mask = log->page_size - 1; ++ log->page_bits = blksize_bits(log->page_size); + + /* Look for a restart area on the disk. */ +- memset(&rst_info, 0, sizeof(struct restart_info)); +- err = log_read_rst(log, l_size, true, &rst_info); ++ err = log_read_rst(log, true, &log->rst_info); + if (err) + goto out; + + /* remember 'initialized' */ +- *initialized = rst_info.initialized; ++ *initialized = log->rst_info.initialized; + +- if (!rst_info.restart) { +- if (rst_info.initialized) { ++ if (!log->rst_info.restart) { ++ if (log->rst_info.initialized) { + /* No restart area but the file is not initialized. */ + err = -EINVAL; + goto out; + } + +- log_init_pg_hdr(log, page_size, page_size, 1, 1); +- log_create(log, l_size, 0, get_random_u32(), false, false); +- +- log->ra = ra; ++ log_init_pg_hdr(log, 1, 1); ++ log_create(log, 0, get_random_u32(), false, false); + + ra = log_create_ra(log); + if (!ra) { +@@ -3820,25 +3811,26 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + * If the restart offset above wasn't zero then we won't + * look for a second restart. + */ +- if (rst_info.vbo) ++ if (log->rst_info.vbo) + goto check_restart_area; + +- memset(&rst_info2, 0, sizeof(struct restart_info)); +- err = log_read_rst(log, l_size, false, &rst_info2); ++ err = log_read_rst(log, false, &log->rst_info2); + if (err) + goto out; + + /* Determine which restart area to use. */ +- if (!rst_info2.restart || rst_info2.last_lsn <= rst_info.last_lsn) ++ if (!log->rst_info2.restart || ++ log->rst_info2.last_lsn <= log->rst_info.last_lsn) + goto use_first_page; + + use_second_page = true; + +- if (rst_info.chkdsk_was_run && page_size != rst_info.vbo) { ++ if (log->rst_info.chkdsk_was_run && ++ log->page_size != log->rst_info.vbo) { + struct RECORD_PAGE_HDR *sp = NULL; + bool usa_error; + +- if (!read_log_page(log, page_size, &sp, &usa_error) && ++ if (!read_log_page(log, log->page_size, &sp, &usa_error) && + sp->rhdr.sign == NTFS_CHKD_SIGNATURE) { + use_second_page = false; + } +@@ -3846,52 +3838,43 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + } + + if (use_second_page) { +- kfree(rst_info.r_page); +- memcpy(&rst_info, &rst_info2, sizeof(struct restart_info)); +- rst_info2.r_page = NULL; ++ kfree(log->rst_info.r_page); ++ memcpy(&log->rst_info, &log->rst_info2, ++ sizeof(struct restart_info)); ++ log->rst_info2.r_page = NULL; + } + + use_first_page: +- kfree(rst_info2.r_page); ++ kfree(log->rst_info2.r_page); + + check_restart_area: + /* + * If the restart area is at offset 0, we want + * to write the second restart area first. + */ +- log->init_ra = !!rst_info.vbo; ++ log->init_ra = !!log->rst_info.vbo; + + /* If we have a valid page then grab a pointer to the restart area. */ +- ra2 = rst_info.valid_page ? +- Add2Ptr(rst_info.r_page, +- le16_to_cpu(rst_info.r_page->ra_off)) : ++ ra2 = log->rst_info.valid_page ? ++ Add2Ptr(log->rst_info.r_page, ++ le16_to_cpu(log->rst_info.r_page->ra_off)) : + NULL; + +- if (rst_info.chkdsk_was_run || ++ if (log->rst_info.chkdsk_was_run || + (ra2 && ra2->client_idx[1] == LFS_NO_CLIENT_LE)) { + bool wrapped = false; + bool use_multi_page = false; + u32 open_log_count; + + /* Do some checks based on whether we have a valid log page. */ +- if (!rst_info.valid_page) { +- open_log_count = get_random_u32(); +- goto init_log_instance; +- } +- open_log_count = le32_to_cpu(ra2->open_log_count); +- +- /* +- * If the restart page size isn't changing then we want to +- * check how much work we need to do. +- */ +- if (page_size != le32_to_cpu(rst_info.r_page->sys_page_size)) +- goto init_log_instance; ++ open_log_count = log->rst_info.valid_page ? ++ le32_to_cpu(ra2->open_log_count) : ++ get_random_u32(); + +-init_log_instance: +- log_init_pg_hdr(log, page_size, page_size, 1, 1); ++ log_init_pg_hdr(log, 1, 1); + +- log_create(log, l_size, rst_info.last_lsn, open_log_count, +- wrapped, use_multi_page); ++ log_create(log, log->rst_info.last_lsn, open_log_count, wrapped, ++ use_multi_page); + + ra = log_create_ra(log); + if (!ra) { +@@ -3916,28 +3899,27 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + * use the log file. We must use the system page size instead of the + * default size if there is not a clean shutdown. + */ +- t32 = le32_to_cpu(rst_info.r_page->sys_page_size); +- if (page_size != t32) { +- l_size = orig_file_size; +- page_size = +- norm_file_page(t32, &l_size, t32 == DefaultLogPageSize); ++ t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size); ++ if (log->page_size != t32) { ++ log->l_size = log->orig_file_size; ++ log->page_size = norm_file_page(t32, &log->l_size, ++ t32 == DefaultLogPageSize); + } + +- if (page_size != t32 || +- page_size != le32_to_cpu(rst_info.r_page->page_size)) { ++ if (log->page_size != t32 || ++ log->page_size != le32_to_cpu(log->rst_info.r_page->page_size)) { + err = -EINVAL; + goto out; + } + + /* If the file size has shrunk then we won't mount it. */ +- if (l_size < le64_to_cpu(ra2->l_size)) { ++ if (log->l_size < le64_to_cpu(ra2->l_size)) { + err = -EINVAL; + goto out; + } + +- log_init_pg_hdr(log, page_size, page_size, +- le16_to_cpu(rst_info.r_page->major_ver), +- le16_to_cpu(rst_info.r_page->minor_ver)); ++ log_init_pg_hdr(log, le16_to_cpu(log->rst_info.r_page->major_ver), ++ le16_to_cpu(log->rst_info.r_page->minor_ver)); + + log->l_size = le64_to_cpu(ra2->l_size); + log->seq_num_bits = le32_to_cpu(ra2->seq_num_bits); +@@ -3945,7 +3927,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + log->seq_num_mask = (8 << log->file_data_bits) - 1; + log->last_lsn = le64_to_cpu(ra2->current_lsn); + log->seq_num = log->last_lsn >> log->file_data_bits; +- log->ra_off = le16_to_cpu(rst_info.r_page->ra_off); ++ log->ra_off = le16_to_cpu(log->rst_info.r_page->ra_off); + log->restart_size = log->sys_page_size - log->ra_off; + log->record_header_len = le16_to_cpu(ra2->rec_hdr_len); + log->ra_size = le16_to_cpu(ra2->ra_len); +@@ -4045,7 +4027,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + log->current_avail = current_log_avail(log); + + /* Remember which restart area to write first. */ +- log->init_ra = rst_info.vbo; ++ log->init_ra = log->rst_info.vbo; + + process_log: + /* 1.0, 1.1, 2.0 log->major_ver/minor_ver - short values. */ +@@ -4105,7 +4087,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + log->client_id.seq_num = cr->seq_num; + log->client_id.client_idx = client; + +- err = read_rst_area(log, &rst, &ra_lsn); ++ err = read_rst_area(log, &rst, &checkpt_lsn); + if (err) + goto out; + +@@ -4114,9 +4096,8 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + + bytes_per_attr_entry = !rst->major_ver ? 0x2C : 0x28; + +- checkpt_lsn = le64_to_cpu(rst->check_point_start); +- if (!checkpt_lsn) +- checkpt_lsn = ra_lsn; ++ if (rst->check_point_start) ++ checkpt_lsn = le64_to_cpu(rst->check_point_start); + + /* Allocate and Read the Transaction Table. */ + if (!rst->transact_table_len) +@@ -4330,23 +4311,20 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + lcb = NULL; + + check_attribute_names2: +- if (!rst->attr_names_len) +- goto trace_attribute_table; +- +- ane = attr_names; +- if (!oatbl) +- goto trace_attribute_table; +- while (ane->off) { +- /* TODO: Clear table on exit! */ +- oe = Add2Ptr(oatbl, le16_to_cpu(ane->off)); +- t16 = le16_to_cpu(ane->name_bytes); +- oe->name_len = t16 / sizeof(short); +- oe->ptr = ane->name; +- oe->is_attr_name = 2; +- ane = Add2Ptr(ane, sizeof(struct ATTR_NAME_ENTRY) + t16); +- } +- +-trace_attribute_table: ++ if (rst->attr_names_len && oatbl) { ++ struct ATTR_NAME_ENTRY *ane = attr_names; ++ while (ane->off) { ++ /* TODO: Clear table on exit! */ ++ oe = Add2Ptr(oatbl, le16_to_cpu(ane->off)); ++ t16 = le16_to_cpu(ane->name_bytes); ++ oe->name_len = t16 / sizeof(short); ++ oe->ptr = ane->name; ++ oe->is_attr_name = 2; ++ ane = Add2Ptr(ane, ++ sizeof(struct ATTR_NAME_ENTRY) + t16); ++ } ++ } ++ + /* + * If the checkpt_lsn is zero, then this is a freshly + * formatted disk and we have no work to do. +@@ -5189,7 +5167,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) + kfree(oatbl); + kfree(dptbl); + kfree(attr_names); +- kfree(rst_info.r_page); ++ kfree(log->rst_info.r_page); + + kfree(ra); + kfree(log->one_page_buf); +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-update-inode-i_size-after-success-write-int.patch b/queue-6.6/fs-ntfs3-update-inode-i_size-after-success-write-int.patch new file mode 100644 index 00000000000..c431d623f0b --- /dev/null +++ b/queue-6.6/fs-ntfs3-update-inode-i_size-after-success-write-int.patch @@ -0,0 +1,33 @@ +From 999b70e8ff53ea6553048e5f0bb3886314253b69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 10:30:09 +0300 +Subject: fs/ntfs3: Update inode->i_size after success write into compressed + file + +From: Konstantin Komarov + +[ Upstream commit d68968440b1a75dee05cfac7f368f1aa139e1911 ] + +Reported-by: Giovanni Santini +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/file.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c +index 0f6a78aef90fe..dfd5402a42e44 100644 +--- a/fs/ntfs3/file.c ++++ b/fs/ntfs3/file.c +@@ -1054,6 +1054,8 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from) + iocb->ki_pos += written; + if (iocb->ki_pos > ni->i_valid) + ni->i_valid = iocb->ki_pos; ++ if (iocb->ki_pos > i_size) ++ i_size_write(inode, iocb->ki_pos); + + return written; + } +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-use-i_size_read-and-i_size_write.patch b/queue-6.6/fs-ntfs3-use-i_size_read-and-i_size_write.patch new file mode 100644 index 00000000000..9262e3d4910 --- /dev/null +++ b/queue-6.6/fs-ntfs3-use-i_size_read-and-i_size_write.patch @@ -0,0 +1,210 @@ +From cb5a2b4686a1030a0f3e86d038b44c51fc661d91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 11:12:38 +0300 +Subject: fs/ntfs3: Use i_size_read and i_size_write + +From: Konstantin Komarov + +[ Upstream commit 4fd6c08a16d7f1ba10212c9ef7bc73218144b463 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 4 ++-- + fs/ntfs3/dir.c | 2 +- + fs/ntfs3/file.c | 11 ++++++----- + fs/ntfs3/frecord.c | 10 +++++----- + fs/ntfs3/index.c | 8 ++++---- + fs/ntfs3/inode.c | 2 +- + 6 files changed, 19 insertions(+), 18 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 646e2dad1b757..7aadf50109994 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -2084,7 +2084,7 @@ int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes) + + /* Update inode size. */ + ni->i_valid = valid_size; +- ni->vfs_inode.i_size = data_size; ++ i_size_write(&ni->vfs_inode, data_size); + inode_set_bytes(&ni->vfs_inode, total_size); + ni->ni_flags |= NI_FLAG_UPDATE_PARENT; + mark_inode_dirty(&ni->vfs_inode); +@@ -2499,7 +2499,7 @@ int attr_insert_range(struct ntfs_inode *ni, u64 vbo, u64 bytes) + mi_b->dirty = true; + + done: +- ni->vfs_inode.i_size += bytes; ++ i_size_write(&ni->vfs_inode, ni->vfs_inode.i_size + bytes); + ni->ni_flags |= NI_FLAG_UPDATE_PARENT; + mark_inode_dirty(&ni->vfs_inode); + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index 726122ecd39b4..2c73ca469d514 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -517,7 +517,7 @@ static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs, + u32 e_size, off, end; + size_t drs = 0, fles = 0, bit = 0; + struct indx_node *node = NULL; +- size_t max_indx = ni->vfs_inode.i_size >> ni->dir.index_bits; ++ size_t max_indx = i_size_read(&ni->vfs_inode) >> ni->dir.index_bits; + + if (is_empty) + *is_empty = true; +diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c +index a5bbf7b5775af..0f6a78aef90fe 100644 +--- a/fs/ntfs3/file.c ++++ b/fs/ntfs3/file.c +@@ -646,7 +646,7 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len) + if (err) + goto out; + } else if (new_size > i_size) { +- inode->i_size = new_size; ++ i_size_write(inode, new_size); + } + } + +@@ -696,7 +696,7 @@ int ntfs3_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + goto out; + } + inode_dio_wait(inode); +- oldsize = inode->i_size; ++ oldsize = i_size_read(inode); + newsize = attr->ia_size; + + if (newsize <= oldsize) +@@ -708,7 +708,7 @@ int ntfs3_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + goto out; + + ni->ni_flags |= NI_FLAG_UPDATE_PARENT; +- inode->i_size = newsize; ++ i_size_write(inode, newsize); + } + + setattr_copy(idmap, inode, attr); +@@ -847,7 +847,7 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from) + size_t count = iov_iter_count(from); + loff_t pos = iocb->ki_pos; + struct inode *inode = file_inode(file); +- loff_t i_size = inode->i_size; ++ loff_t i_size = i_size_read(inode); + struct address_space *mapping = inode->i_mapping; + struct ntfs_inode *ni = ntfs_i(inode); + u64 valid = ni->i_valid; +@@ -1177,7 +1177,8 @@ static int ntfs_file_release(struct inode *inode, struct file *file) + down_write(&ni->file.run_lock); + + err = attr_set_size(ni, ATTR_DATA, NULL, 0, &ni->file.run, +- inode->i_size, &ni->i_valid, false, NULL); ++ i_size_read(inode), &ni->i_valid, false, ++ NULL); + + up_write(&ni->file.run_lock); + ni_unlock(ni); +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index a918d7283aca5..61c51650266ef 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -2099,7 +2099,7 @@ int ni_readpage_cmpr(struct ntfs_inode *ni, struct page *page) + gfp_t gfp_mask; + struct page *pg; + +- if (vbo >= ni->vfs_inode.i_size) { ++ if (vbo >= i_size_read(&ni->vfs_inode)) { + SetPageUptodate(page); + err = 0; + goto out; +@@ -2173,7 +2173,7 @@ int ni_decompress_file(struct ntfs_inode *ni) + { + struct ntfs_sb_info *sbi = ni->mi.sbi; + struct inode *inode = &ni->vfs_inode; +- loff_t i_size = inode->i_size; ++ loff_t i_size = i_size_read(inode); + struct address_space *mapping = inode->i_mapping; + gfp_t gfp_mask = mapping_gfp_mask(mapping); + struct page **pages = NULL; +@@ -2457,6 +2457,7 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages, + struct ATTR_LIST_ENTRY *le = NULL; + struct runs_tree *run = &ni->file.run; + u64 valid_size = ni->i_valid; ++ loff_t i_size = i_size_read(&ni->vfs_inode); + u64 vbo_disk; + size_t unc_size; + u32 frame_size, i, npages_disk, ondisk_size; +@@ -2548,7 +2549,7 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages, + } + } + +- frames = (ni->vfs_inode.i_size - 1) >> frame_bits; ++ frames = (i_size - 1) >> frame_bits; + + err = attr_wof_frame_info(ni, attr, run, frame64, frames, + frame_bits, &ondisk_size, &vbo_data); +@@ -2556,8 +2557,7 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages, + goto out2; + + if (frame64 == frames) { +- unc_size = 1 + ((ni->vfs_inode.i_size - 1) & +- (frame_size - 1)); ++ unc_size = 1 + ((i_size - 1) & (frame_size - 1)); + ondisk_size = attr_size(attr) - vbo_data; + } else { + unc_size = frame_size; +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index cf92b2433f7a7..daabaad63aaf6 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1462,7 +1462,7 @@ static int indx_create_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, + goto out2; + + if (in->name == I30_NAME) { +- ni->vfs_inode.i_size = data_size; ++ i_size_write(&ni->vfs_inode, data_size); + inode_set_bytes(&ni->vfs_inode, alloc_size); + } + +@@ -1544,7 +1544,7 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, + } + + if (in->name == I30_NAME) +- ni->vfs_inode.i_size = data_size; ++ i_size_write(&ni->vfs_inode, data_size); + + *vbn = bit << indx->idx2vbn_bits; + +@@ -2090,7 +2090,7 @@ static int indx_shrink(struct ntfs_index *indx, struct ntfs_inode *ni, + return err; + + if (in->name == I30_NAME) +- ni->vfs_inode.i_size = new_data; ++ i_size_write(&ni->vfs_inode, new_data); + + bpb = bitmap_size(bit); + if (bpb * 8 == nbits) +@@ -2576,7 +2576,7 @@ int indx_delete_entry(struct ntfs_index *indx, struct ntfs_inode *ni, + err = attr_set_size(ni, ATTR_ALLOC, in->name, in->name_len, + &indx->alloc_run, 0, NULL, false, NULL); + if (in->name == I30_NAME) +- ni->vfs_inode.i_size = 0; ++ i_size_write(&ni->vfs_inode, 0); + + err = ni_remove_attr(ni, ATTR_ALLOC, in->name, in->name_len, + false, NULL); +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index 012dbc8ac5ec7..34f2e16f3f5b6 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -983,7 +983,7 @@ int ntfs_write_end(struct file *file, struct address_space *mapping, loff_t pos, + } + + if (pos + err > inode->i_size) { +- inode->i_size = pos + err; ++ i_size_write(inode, pos + err); + dirty = true; + } + +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-use-kvfree-to-free-memory-allocated-by-kvma.patch b/queue-6.6/fs-ntfs3-use-kvfree-to-free-memory-allocated-by-kvma.patch new file mode 100644 index 00000000000..762c4556152 --- /dev/null +++ b/queue-6.6/fs-ntfs3-use-kvfree-to-free-memory-allocated-by-kvma.patch @@ -0,0 +1,100 @@ +From 8ea9df76c4e0a829c622f37cfe63da4127e09edd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 10:32:20 +0300 +Subject: fs/ntfs3: Use kvfree to free memory allocated by kvmalloc + +From: Konstantin Komarov + +[ Upstream commit ddb17dc880eeaac37b5a6e984de07b882de7d78d ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 4 ++-- + fs/ntfs3/bitmap.c | 4 ++-- + fs/ntfs3/frecord.c | 4 ++-- + fs/ntfs3/super.c | 2 +- + 4 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index 48e7da47c6b71..9f4bd8d260901 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -29,7 +29,7 @@ static inline bool al_is_valid_le(const struct ntfs_inode *ni, + void al_destroy(struct ntfs_inode *ni) + { + run_close(&ni->attr_list.run); +- kfree(ni->attr_list.le); ++ kvfree(ni->attr_list.le); + ni->attr_list.le = NULL; + ni->attr_list.size = 0; + ni->attr_list.dirty = false; +@@ -318,7 +318,7 @@ int al_add_le(struct ntfs_inode *ni, enum ATTR_TYPE type, const __le16 *name, + memcpy(ptr, al->le, off); + memcpy(Add2Ptr(ptr, off + sz), le, old_size - off); + le = Add2Ptr(ptr, off); +- kfree(al->le); ++ kvfree(al->le); + al->le = ptr; + } else { + memmove(Add2Ptr(le, sz), le, old_size - off); +diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c +index 63f14a0232f6a..845f9b22deef0 100644 +--- a/fs/ntfs3/bitmap.c ++++ b/fs/ntfs3/bitmap.c +@@ -124,7 +124,7 @@ void wnd_close(struct wnd_bitmap *wnd) + { + struct rb_node *node, *next; + +- kfree(wnd->free_bits); ++ kvfree(wnd->free_bits); + wnd->free_bits = NULL; + run_close(&wnd->run); + +@@ -1360,7 +1360,7 @@ int wnd_extend(struct wnd_bitmap *wnd, size_t new_bits) + memcpy(new_free, wnd->free_bits, wnd->nwnd * sizeof(short)); + memset(new_free + wnd->nwnd, 0, + (new_wnd - wnd->nwnd) * sizeof(short)); +- kfree(wnd->free_bits); ++ kvfree(wnd->free_bits); + wnd->free_bits = new_free; + } + +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index 86b43051f39cd..a918d7283aca5 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -778,7 +778,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) + run_deallocate(sbi, &ni->attr_list.run, true); + run_close(&ni->attr_list.run); + ni->attr_list.size = 0; +- kfree(ni->attr_list.le); ++ kvfree(ni->attr_list.le); + ni->attr_list.le = NULL; + ni->attr_list.dirty = false; + +@@ -927,7 +927,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) + return 0; + + out: +- kfree(ni->attr_list.le); ++ kvfree(ni->attr_list.le); + ni->attr_list.le = NULL; + ni->attr_list.size = 0; + return err; +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index 378e261e23b04..eb50602297406 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -625,7 +625,7 @@ static void ntfs3_free_sbi(struct ntfs_sb_info *sbi) + { + kfree(sbi->new_rec); + kvfree(ntfs_put_shared(sbi->upcase)); +- kfree(sbi->def_table); ++ kvfree(sbi->def_table); + kfree(sbi->compress.lznt); + #ifdef CONFIG_NTFS3_LZX_XPRESS + xpress_free_decompressor(sbi->compress.xpress); +-- +2.43.0 + diff --git a/queue-6.6/fs-ntfs3-use-non-movable-memory-for-ntfs3-mft-buffer.patch b/queue-6.6/fs-ntfs3-use-non-movable-memory-for-ntfs3-mft-buffer.patch new file mode 100644 index 00000000000..2127b834122 --- /dev/null +++ b/queue-6.6/fs-ntfs3-use-non-movable-memory-for-ntfs3-mft-buffer.patch @@ -0,0 +1,79 @@ +From fbee9069f29a066674d0aa168d82bf7b241811fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Dec 2023 16:51:41 +0800 +Subject: fs/ntfs3: use non-movable memory for ntfs3 MFT buffer cache + +From: Ism Hong + +[ Upstream commit d6d33f03baa43d763fe094ca926eeae7d3421d07 ] + +Since the buffer cache for ntfs3 metadata is not released until the file +system is unmounted, allocating from the movable zone may result in cma +allocation failures. This is due to the page still being used by ntfs3, +leading to migration failures. + +To address this, this commit use sb_bread_umovable() instead of +sb_bread(). This change prevents allocation from the movable zone, +ensuring compatibility with scenarios where the buffer head is not +released until unmount. This patch is inspired by commit +a8ac900b8163("ext4: use non-movable memory for the ext4 superblock"). + +The issue is found when playing video files stored in NTFS on the +Android TV platform. During this process, the media parser reads the +video file, causing ntfs3 to allocate buffer cache from the CMA area. +Subsequently, the hardware decoder attempts to allocate memory from the +same CMA area. However, the page is still in use by ntfs3, resulting in +a migrate failure in alloc_contig_range(). + +The pinned page and allocating stacktrace reported by page owner shows +below: + +page:ffffffff00b68880 refcount:3 mapcount:0 mapping:ffffff80046aa828 + index:0xc0040 pfn:0x20fa4 + aops:def_blk_aops ino:0 + flags: 0x2020(active|private) + page dumped because: migration failure + page last allocated via order 0, migratetype Movable, + gfp_mask 0x108c48 + (GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), + page_owner tracks the page as allocated + prep_new_page + get_page_from_freelist + __alloc_pages_nodemask + pagecache_get_page + __getblk_gfp + __bread_gfp + ntfs_read_run_nb + ntfs_read_bh + mi_read + ntfs_iget5 + dir_search_u + ntfs_lookup + __lookup_slow + lookup_slow + walk_component + path_lookupat + +Signed-off-by: Ism Hong +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/ntfs_fs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h +index c71a1eca427a3..98906e4675171 100644 +--- a/fs/ntfs3/ntfs_fs.h ++++ b/fs/ntfs3/ntfs_fs.h +@@ -1035,7 +1035,7 @@ static inline u64 bytes_to_block(const struct super_block *sb, u64 size) + static inline struct buffer_head *ntfs_bread(struct super_block *sb, + sector_t block) + { +- struct buffer_head *bh = sb_bread(sb, block); ++ struct buffer_head *bh = sb_bread_unmovable(sb, block); + + if (bh) + return bh; +-- +2.43.0 + diff --git a/queue-6.6/hid-logitech-hidpp-add-support-for-logitech-g-pro-x-.patch b/queue-6.6/hid-logitech-hidpp-add-support-for-logitech-g-pro-x-.patch new file mode 100644 index 00000000000..e5e8d9fc111 --- /dev/null +++ b/queue-6.6/hid-logitech-hidpp-add-support-for-logitech-g-pro-x-.patch @@ -0,0 +1,37 @@ +From f80ac8030bfbed5d26d564cc108d73107628f803 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 21:32:01 +0100 +Subject: HID: logitech-hidpp: add support for Logitech G Pro X Superlight 2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Kosina + +[ Upstream commit afa6ac2690bb9904ff883c6e942281e1032a484d ] + +Let logitech-hidpp driver claim Logitech G Pro X Superlight 2. + +Reported-by: Marcus Rückert +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 7bf12ca0eb4a9..4519ee377aa76 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -4650,6 +4650,8 @@ static const struct hid_device_id hidpp_devices[] = { + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC088) }, + { /* Logitech G Pro X Superlight Gaming Mouse over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC094) }, ++ { /* Logitech G Pro X Superlight 2 Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC09b) }, + + { /* G935 Gaming Headset */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0x0a87), +-- +2.43.0 + diff --git a/queue-6.6/hid-nvidia-shield-add-missing-null-pointer-checks-to.patch b/queue-6.6/hid-nvidia-shield-add-missing-null-pointer-checks-to.patch new file mode 100644 index 00000000000..325096ab34e --- /dev/null +++ b/queue-6.6/hid-nvidia-shield-add-missing-null-pointer-checks-to.patch @@ -0,0 +1,48 @@ +From d03b400864f5b617d4ab2c66e9e7b8d88df3e0a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 14:07:14 +0800 +Subject: HID: nvidia-shield: Add missing null pointer checks to LED + initialization + +From: Kunwu Chan + +[ Upstream commit b6eda11c44dc89a681e1c105f0f4660e69b1e183 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +[jkosina@suse.com: tweak changelog a bit] +Signed-off-by: Kunwu Chan +Reviewed-by: Rahul Rameshbabu +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-nvidia-shield.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-nvidia-shield.c b/drivers/hid/hid-nvidia-shield.c +index c463e54decbce..edd0b0f1193bd 100644 +--- a/drivers/hid/hid-nvidia-shield.c ++++ b/drivers/hid/hid-nvidia-shield.c +@@ -800,6 +800,8 @@ static inline int thunderstrike_led_create(struct thunderstrike *ts) + + led->name = devm_kasprintf(&ts->base.hdev->dev, GFP_KERNEL, + "thunderstrike%d:blue:led", ts->id); ++ if (!led->name) ++ return -ENOMEM; + led->max_brightness = 1; + led->flags = LED_CORE_SUSPENDRESUME | LED_RETAIN_AT_SHUTDOWN; + led->brightness_get = &thunderstrike_led_get_brightness; +@@ -831,6 +833,8 @@ static inline int thunderstrike_psy_create(struct shield_device *shield_dev) + shield_dev->battery_dev.desc.name = + devm_kasprintf(&ts->base.hdev->dev, GFP_KERNEL, + "thunderstrike_%d", ts->id); ++ if (!shield_dev->battery_dev.desc.name) ++ return -ENOMEM; + + shield_dev->battery_dev.psy = power_supply_register( + &hdev->dev, &shield_dev->battery_dev.desc, &psy_cfg); +-- +2.43.0 + diff --git a/queue-6.6/hwmon-coretemp-enlarge-per-package-core-count-limit.patch b/queue-6.6/hwmon-coretemp-enlarge-per-package-core-count-limit.patch new file mode 100644 index 00000000000..00c1b12099f --- /dev/null +++ b/queue-6.6/hwmon-coretemp-enlarge-per-package-core-count-limit.patch @@ -0,0 +1,43 @@ +From 4186386d0a73ecf82a0a873bfbaa9afb494640e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 17:21:36 +0800 +Subject: hwmon: (coretemp) Enlarge per package core count limit + +From: Zhang Rui + +[ Upstream commit 34cf8c657cf0365791cdc658ddbca9cc907726ce ] + +Currently, coretemp driver supports only 128 cores per package. +This loses some core temperature information on systems that have more +than 128 cores per package. + [ 58.685033] coretemp coretemp.0: Adding Core 128 failed + [ 58.692009] coretemp coretemp.0: Adding Core 129 failed + ... + +Enlarge the limitation to 512 because there are platforms with more than +256 cores per package. + +Signed-off-by: Zhang Rui +Link: https://lore.kernel.org/r/20240202092144.71180-4-rui.zhang@intel.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/coretemp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c +index 95f4c0b00b2d8..b8fc8d1ef20df 100644 +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -41,7 +41,7 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius"); + + #define PKG_SYSFS_ATTR_NO 1 /* Sysfs attribute for package temp */ + #define BASE_SYSFS_ATTR_NO 2 /* Sysfs Base attr no for coretemp */ +-#define NUM_REAL_CORES 128 /* Number of Real cores per cpu */ ++#define NUM_REAL_CORES 512 /* Number of Real cores per cpu */ + #define CORETEMP_NAME_LENGTH 28 /* String Length of attrs */ + #define MAX_CORE_ATTRS 4 /* Maximum no of basic attrs */ + #define TOTAL_ATTRS (MAX_CORE_ATTRS + 1) +-- +2.43.0 + diff --git a/queue-6.6/input-goodix-accept-acpi-resources-with-gpio_count-3.patch b/queue-6.6/input-goodix-accept-acpi-resources-with-gpio_count-3.patch new file mode 100644 index 00000000000..09b81150af7 --- /dev/null +++ b/queue-6.6/input-goodix-accept-acpi-resources-with-gpio_count-3.patch @@ -0,0 +1,53 @@ +From 4f85f94ae288a94d3c5f8ff2c3416b5f4bd8c836 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Dec 2023 15:16:50 +0100 +Subject: Input: goodix - accept ACPI resources with gpio_count == 3 && + gpio_int_idx == 0 + +From: Hans de Goede + +[ Upstream commit 180a8f12c21f41740fee09ca7f7aa98ff5bb99f8 ] + +Some devices list 3 Gpio resources in the ACPI resource list for +the touchscreen: + +1. GpioInt resource pointing to the GPIO used for the interrupt +2. GpioIo resource pointing to the reset GPIO +3. GpioIo resource pointing to the GPIO used for the interrupt + +Note how the third extra GpioIo resource really is a duplicate +of the GpioInt provided info. + +Ignore this extra GPIO, treating this setup the same as gpio_count == 2 && +gpio_int_idx == 0 fixes the touchscreen not working on the Thunderbook +Colossus W803 rugged tablet and likely also on the CyberBook_T116K. + +Reported-by: Maarten van der Schrieck +Closes: https://gitlab.com/AdyaAdya/goodix-touchscreen-linux-driver/-/issues/22 +Suggested-by: Maarten van der Schrieck +Tested-by: Maarten van der Schrieck +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20231223141650.10679-1-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/goodix.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index af32fbe57b630..b068ff8afbc9a 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -884,7 +884,8 @@ static int goodix_add_acpi_gpio_mappings(struct goodix_ts_data *ts) + } + } + +- if (ts->gpio_count == 2 && ts->gpio_int_idx == 0) { ++ /* Some devices with gpio_int_idx 0 list a third unused GPIO */ ++ if ((ts->gpio_count == 2 || ts->gpio_count == 3) && ts->gpio_int_idx == 0) { + ts->irq_pin_access_method = IRQ_PIN_ACCESS_ACPI_GPIO; + gpio_mapping = acpi_goodix_int_first_gpios; + } else if (ts->gpio_count == 2 && ts->gpio_int_idx == 1) { +-- +2.43.0 + diff --git a/queue-6.6/input-i8042-add-fujitsu-lifebook-u728-to-i8042-quirk.patch b/queue-6.6/input-i8042-add-fujitsu-lifebook-u728-to-i8042-quirk.patch new file mode 100644 index 00000000000..3d86edf2c29 --- /dev/null +++ b/queue-6.6/input-i8042-add-fujitsu-lifebook-u728-to-i8042-quirk.patch @@ -0,0 +1,55 @@ +From 71c562d58ce40ff9263aa5fcea24f2b1f979ea30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 10:28:59 -0800 +Subject: Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table + +From: Szilard Fabian + +[ Upstream commit 4255447ad34c5c3785fcdcf76cfa0271d6e5ed39 ] + +Another Fujitsu-related patch. + +In the initial boot stage the integrated keyboard of Fujitsu Lifebook U728 +refuses to work and it's not possible to type for example a dm-crypt +passphrase without the help of an external keyboard. + +i8042.nomux kernel parameter resolves this issue but using that a PS/2 +mouse is detected. This input device is unused even when the i2c-hid-acpi +kernel module is blacklisted making the integrated ELAN touchpad +(04F3:3092) not working at all. + +So this notebook uses a hid-over-i2c touchpad which is managed by the +i2c_designware input driver. Since you can't find a PS/2 mouse port on this +computer and you can't connect a PS/2 mouse to it even with an official +port replicator I think it's safe to not use the PS/2 mouse port at all. + +Signed-off-by: Szilard Fabian +Link: https://lore.kernel.org/r/20240103014717.127307-2-szfabian@bluemarch.art +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index cd45a65e17f2c..dfc6c581873b7 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -634,6 +634,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + }, + .driver_data = (void *)(SERIO_QUIRK_NOAUX) + }, ++ { ++ /* Fujitsu Lifebook U728 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U728"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOAUX) ++ }, + { + /* Gigabyte M912 */ + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/input-xpad-add-lenovo-legion-go-controllers.patch b/queue-6.6/input-xpad-add-lenovo-legion-go-controllers.patch new file mode 100644 index 00000000000..68c19c5363a --- /dev/null +++ b/queue-6.6/input-xpad-add-lenovo-legion-go-controllers.patch @@ -0,0 +1,69 @@ +From e657e53bc64a82c632736d7196c5a27aac54f940 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 13:34:16 -0800 +Subject: Input: xpad - add Lenovo Legion Go controllers + +From: Brenton Simpson + +[ Upstream commit 80441f76ee67002437db61f3b317ed80cce085d2 ] + +The Lenovo Legion Go is a handheld gaming system, similar to a Steam Deck. +It has a gamepad (including rear paddles), 3 gyroscopes, a trackpad, +volume buttons, a power button, and 2 LED ring lights. + +The Legion Go firmware presents these controls as a USB hub with various +devices attached. In its default state, the gamepad is presented as an +Xbox controller connected to this hub. (By holding a combination of +buttons, it can be changed to use the older DirectInput API.) + +This patch teaches the existing Xbox controller module `xpad` to bind to +the controller in the Legion Go, which enables support for the: + +- directional pad, +- analog sticks (including clicks), +- X, Y, A, B, +- start and select (or menu and capture), +- shoulder buttons, and +- rumble. + +The trackpad, touchscreen, volume controls, and power button are already +supported via existing kernel modules. Two of the face buttons, the +gyroscopes, rear paddles, and LEDs are not. + +After this patch lands, the Legion Go will be mostly functional in Linux, +out-of-the-box. The various components of the USB hub can be synthesized +into a single logical controller (including the additional buttons) in +userspace with [Handheld Daemon](https://github.com/hhd-dev/hhd), which +makes the Go fully functional. + +Signed-off-by: Brenton Simpson +Link: https://lore.kernel.org/r/20240118183546.418064-1-appsforartists@google.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index e2c1848182de9..d0bb3edfd0a09 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -294,6 +294,7 @@ static const struct xpad_device { + { 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 }, + { 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 }, + { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, ++ { 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 }, + { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, +@@ -491,6 +492,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOX360_VENDOR(0x15e4), /* Numark Xbox 360 controllers */ + XPAD_XBOX360_VENDOR(0x162e), /* Joytech Xbox 360 controllers */ + XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ ++ XPAD_XBOX360_VENDOR(0x17ef), /* Lenovo */ + XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */ + XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */ + XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */ +-- +2.43.0 + diff --git a/queue-6.6/libceph-fail-sparse-read-if-the-data-length-doesn-t-.patch b/queue-6.6/libceph-fail-sparse-read-if-the-data-length-doesn-t-.patch new file mode 100644 index 00000000000..d6074aefef0 --- /dev/null +++ b/queue-6.6/libceph-fail-sparse-read-if-the-data-length-doesn-t-.patch @@ -0,0 +1,81 @@ +From 98ee0a1bfebc2b87af40937440d0083248954e92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 13:55:44 +0800 +Subject: libceph: fail sparse-read if the data length doesn't match + +From: Xiubo Li + +[ Upstream commit cd7d469c25704d414d71bf3644f163fb74e7996b ] + +Once this happens that means there have bugs. + +Signed-off-by: Xiubo Li +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + include/linux/ceph/osd_client.h | 3 ++- + net/ceph/osd_client.c | 18 +++++++++++++++--- + 2 files changed, 17 insertions(+), 4 deletions(-) + +diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h +index bf9823956758c..f703fb8030de2 100644 +--- a/include/linux/ceph/osd_client.h ++++ b/include/linux/ceph/osd_client.h +@@ -45,6 +45,7 @@ enum ceph_sparse_read_state { + CEPH_SPARSE_READ_HDR = 0, + CEPH_SPARSE_READ_EXTENTS, + CEPH_SPARSE_READ_DATA_LEN, ++ CEPH_SPARSE_READ_DATA_PRE, + CEPH_SPARSE_READ_DATA, + }; + +@@ -64,7 +65,7 @@ struct ceph_sparse_read { + u64 sr_req_len; /* orig request length */ + u64 sr_pos; /* current pos in buffer */ + int sr_index; /* current extent index */ +- __le32 sr_datalen; /* length of actual data */ ++ u32 sr_datalen; /* length of actual data */ + u32 sr_count; /* extent count in reply */ + int sr_ext_len; /* length of extent array */ + struct ceph_sparse_extent *sr_extent; /* extent array */ +diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c +index 8d9760397b887..3babcd5e65e16 100644 +--- a/net/ceph/osd_client.c ++++ b/net/ceph/osd_client.c +@@ -5856,8 +5856,8 @@ static int osd_sparse_read(struct ceph_connection *con, + struct ceph_osd *o = con->private; + struct ceph_sparse_read *sr = &o->o_sparse_read; + u32 count = sr->sr_count; +- u64 eoff, elen; +- int ret; ++ u64 eoff, elen, len = 0; ++ int i, ret; + + switch (sr->sr_state) { + case CEPH_SPARSE_READ_HDR: +@@ -5909,8 +5909,20 @@ static int osd_sparse_read(struct ceph_connection *con, + convert_extent_map(sr); + ret = sizeof(sr->sr_datalen); + *pbuf = (char *)&sr->sr_datalen; +- sr->sr_state = CEPH_SPARSE_READ_DATA; ++ sr->sr_state = CEPH_SPARSE_READ_DATA_PRE; + break; ++ case CEPH_SPARSE_READ_DATA_PRE: ++ /* Convert sr_datalen to host-endian */ ++ sr->sr_datalen = le32_to_cpu((__force __le32)sr->sr_datalen); ++ for (i = 0; i < count; i++) ++ len += sr->sr_extent[i].len; ++ if (sr->sr_datalen != len) { ++ pr_warn_ratelimited("data len %u != extent len %llu\n", ++ sr->sr_datalen, len); ++ return -EREMOTEIO; ++ } ++ sr->sr_state = CEPH_SPARSE_READ_DATA; ++ fallthrough; + case CEPH_SPARSE_READ_DATA: + if (sr->sr_index >= count) { + sr->sr_state = CEPH_SPARSE_READ_HDR; +-- +2.43.0 + diff --git a/queue-6.6/loongarch-change-acpi_core_pic-nr_cpus-to-acpi_core_.patch b/queue-6.6/loongarch-change-acpi_core_pic-nr_cpus-to-acpi_core_.patch new file mode 100644 index 00000000000..3a0f60d2e26 --- /dev/null +++ b/queue-6.6/loongarch-change-acpi_core_pic-nr_cpus-to-acpi_core_.patch @@ -0,0 +1,110 @@ +From a01b988f2307ec40f168e9a399b4a5d9bb916cd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 12:32:05 +0800 +Subject: LoongArch: Change acpi_core_pic[NR_CPUS] to + acpi_core_pic[MAX_CORE_PIC] + +From: Huacai Chen + +[ Upstream commit 4551b30525cf3d2f026b92401ffe241eb04dfebe ] + +With default config, the value of NR_CPUS is 64. When HW platform has +more then 64 cpus, system will crash on these platforms. MAX_CORE_PIC +is the maximum cpu number in MADT table (max physical number) which can +exceed the supported maximum cpu number (NR_CPUS, max logical number), +but kernel should not crash. Kernel should boot cpus with NR_CPUS, let +the remainder cpus stay in BIOS. + +The potential crash reason is that the array acpi_core_pic[NR_CPUS] can +be overflowed when parsing MADT table, and it is obvious that CORE_PIC +should be corresponding to physical core rather than logical core, so it +is better to define the array as acpi_core_pic[MAX_CORE_PIC]. + +With the patch, system can boot up 64 vcpus with qemu parameter -smp 128, +otherwise system will crash with the following message. + +[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec +[ 0.000000] Oops[#1]: +[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.8.0-rc2+ #192 +[ 0.000000] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 +[ 0.000000] pc 90000000037a5f0c ra 90000000037a46ec tp 9000000003c90000 sp 9000000003c93d60 +[ 0.000000] a0 0000000000000019 a1 9000000003d93bc0 a2 0000000000000000 a3 9000000003c93bd8 +[ 0.000000] a4 9000000003c93a74 a5 9000000083c93a67 a6 9000000003c938f0 a7 0000000000000005 +[ 0.000000] t0 0000420000004201 t1 0000000000000000 t2 0000000000000001 t3 0000000000000001 +[ 0.000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 0000000000000063 +[ 0.000000] t8 0000000000000014 u0 ffffffffffffffff s9 0000000000000000 s0 9000000003caee98 +[ 0.000000] s1 90000000041b0480 s2 9000000003c93da0 s3 9000000003c93d98 s4 9000000003c93d90 +[ 0.000000] s5 9000000003caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330 +[ 0.000000] ra: 90000000037a46ec platform_init+0x214/0x250 +[ 0.000000] ERA: 90000000037a5f0c efi_runtime_init+0x30/0x94 +[ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) +[ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE) +[ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) +[ 0.000000] ECFG: 00070800 (LIE=11 VS=7) +[ 0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) +[ 0.000000] BADV: 0000420000004259 +[ 0.000000] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) +[ 0.000000] Modules linked in: +[ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____)) +[ 0.000000] Stack : 9000000003c93a14 9000000003800898 90000000041844f8 90000000037a46ec +[ 0.000000] 000000000a7fd000 0000000008290000 0000000000000000 0000000000000000 +[ 0.000000] 0000000000000000 0000000000000000 00000000019d8000 000000000f556b60 +[ 0.000000] 000000000a7fd000 000000000f556b08 9000000003ca7700 9000000003800000 +[ 0.000000] 9000000003c93e50 9000000003800898 9000000003800108 90000000037a484c +[ 0.000000] 000000000e0a4330 000000000f556b60 000000000a7fd000 000000000f556b08 +[ 0.000000] 9000000003ca7700 9000000004184000 0000000000200000 000000000e02b018 +[ 0.000000] 000000000a7fd000 90000000037a0790 9000000003800108 0000000000000000 +[ 0.000000] 0000000000000000 000000000e0a4330 000000000f556b60 000000000a7fd000 +[ 0.000000] 000000000f556b08 000000000eaae298 000000000eaa5040 0000000000200000 +[ 0.000000] ... +[ 0.000000] Call Trace: +[ 0.000000] [<90000000037a5f0c>] efi_runtime_init+0x30/0x94 +[ 0.000000] [<90000000037a46ec>] platform_init+0x214/0x250 +[ 0.000000] [<90000000037a484c>] setup_arch+0x124/0x45c +[ 0.000000] [<90000000037a0790>] start_kernel+0x90/0x670 +[ 0.000000] [<900000000378b0d8>] kernel_entry+0xd8/0xdc + +Signed-off-by: Bibo Mao +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/acpi.h | 4 +++- + arch/loongarch/kernel/acpi.c | 4 +--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/loongarch/include/asm/acpi.h b/arch/loongarch/include/asm/acpi.h +index 8de6c4b83a61a..49e29b29996f0 100644 +--- a/arch/loongarch/include/asm/acpi.h ++++ b/arch/loongarch/include/asm/acpi.h +@@ -32,8 +32,10 @@ static inline bool acpi_has_cpu_in_madt(void) + return true; + } + ++#define MAX_CORE_PIC 256 ++ + extern struct list_head acpi_wakeup_device_list; +-extern struct acpi_madt_core_pic acpi_core_pic[NR_CPUS]; ++extern struct acpi_madt_core_pic acpi_core_pic[MAX_CORE_PIC]; + + extern int __init parse_acpi_topology(void); + +diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c +index 8e00a754e5489..55d6a48c76a82 100644 +--- a/arch/loongarch/kernel/acpi.c ++++ b/arch/loongarch/kernel/acpi.c +@@ -29,11 +29,9 @@ int disabled_cpus; + + u64 acpi_saved_sp; + +-#define MAX_CORE_PIC 256 +- + #define PREFIX "ACPI: " + +-struct acpi_madt_core_pic acpi_core_pic[NR_CPUS]; ++struct acpi_madt_core_pic acpi_core_pic[MAX_CORE_PIC]; + + void __init __iomem * __acpi_map_table(unsigned long phys, unsigned long size) + { +-- +2.43.0 + diff --git a/queue-6.6/loongarch-select-arch_enable_thp_migration-instead-o.patch b/queue-6.6/loongarch-select-arch_enable_thp_migration-instead-o.patch new file mode 100644 index 00000000000..e1aa73f07d7 --- /dev/null +++ b/queue-6.6/loongarch-select-arch_enable_thp_migration-instead-o.patch @@ -0,0 +1,44 @@ +From e64fc2ee8d82598f12f417b65fd2febe51d79041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 12:32:05 +0800 +Subject: LoongArch: Select ARCH_ENABLE_THP_MIGRATION instead of redefining it + +From: Masahiro Yamada + +[ Upstream commit b3ff2d9c3a9c64cd0a011cdd407ffc38a6ea8788 ] + +ARCH_ENABLE_THP_MIGRATION is supposed to be selected by arch Kconfig. + +Signed-off-by: Masahiro Yamada +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/Kconfig | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig +index e14396a2ddcbf..f29a0f2a4f187 100644 +--- a/arch/loongarch/Kconfig ++++ b/arch/loongarch/Kconfig +@@ -11,6 +11,7 @@ config LOONGARCH + select ARCH_DISABLE_KASAN_INLINE + select ARCH_ENABLE_MEMORY_HOTPLUG + select ARCH_ENABLE_MEMORY_HOTREMOVE ++ select ARCH_ENABLE_THP_MIGRATION if TRANSPARENT_HUGEPAGE + select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI + select ARCH_HAS_CPU_FINALIZE_INIT + select ARCH_HAS_FORTIFY_SOURCE +@@ -638,10 +639,6 @@ config ARCH_SPARSEMEM_ENABLE + or have huge holes in the physical address space for other reasons. + See for more. + +-config ARCH_ENABLE_THP_MIGRATION +- def_bool y +- depends on TRANSPARENT_HUGEPAGE +- + config ARCH_MEMORY_PROBE + def_bool y + depends on MEMORY_HOTPLUG +-- +2.43.0 + diff --git a/queue-6.6/loongarch-select-have_arch_seccomp-to-use-the-common.patch b/queue-6.6/loongarch-select-have_arch_seccomp-to-use-the-common.patch new file mode 100644 index 00000000000..c7c3df3f311 --- /dev/null +++ b/queue-6.6/loongarch-select-have_arch_seccomp-to-use-the-common.patch @@ -0,0 +1,62 @@ +From e103f887e9f1c0d39ac0136fee029b7227c2075b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 12:32:05 +0800 +Subject: LoongArch: Select HAVE_ARCH_SECCOMP to use the common SECCOMP menu + +From: Masahiro Yamada + +[ Upstream commit 6b79ecd084c99b31c8b4d0beda08893716d5558e ] + +LoongArch missed the refactoring made by commit 282a181b1a0d ("seccomp: +Move config option SECCOMP to arch/Kconfig") because LoongArch was not +mainlined at that time. + +The 'depends on PROC_FS' statement is stale as described in that commit. +Select HAVE_ARCH_SECCOMP, and remove the duplicated config entry. + +Signed-off-by: Masahiro Yamada +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/Kconfig | 18 +----------------- + 1 file changed, 1 insertion(+), 17 deletions(-) + +diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig +index f29a0f2a4f187..9fd8644a9a4c6 100644 +--- a/arch/loongarch/Kconfig ++++ b/arch/loongarch/Kconfig +@@ -98,6 +98,7 @@ config LOONGARCH + select HAVE_ARCH_KFENCE + select HAVE_ARCH_KGDB if PERF_EVENTS + select HAVE_ARCH_MMAP_RND_BITS if MMU ++ select HAVE_ARCH_SECCOMP + select HAVE_ARCH_SECCOMP_FILTER + select HAVE_ARCH_TRACEHOOK + select HAVE_ARCH_TRANSPARENT_HUGEPAGE +@@ -604,23 +605,6 @@ config RANDOMIZE_BASE_MAX_OFFSET + + This is limited by the size of the lower address memory, 256MB. + +-config SECCOMP +- bool "Enable seccomp to safely compute untrusted bytecode" +- depends on PROC_FS +- default y +- help +- This kernel feature is useful for number crunching applications +- that may need to compute untrusted bytecode during their +- execution. By using pipes or other transports made available to +- the process as file descriptors supporting the read/write +- syscalls, it's possible to isolate those applications in +- their own address space using seccomp. Once seccomp is +- enabled via /proc//seccomp, it cannot be disabled +- and the task is only allowed to execute a few safe syscalls +- defined by each seccomp mode. +- +- If unsure, say Y. Only embedded should say N here. +- + endmenu + + config ARCH_SELECT_MEMORY_MODEL +-- +2.43.0 + diff --git a/queue-6.6/loongarch-vdso-disable-ubsan-instrumentation.patch b/queue-6.6/loongarch-vdso-disable-ubsan-instrumentation.patch new file mode 100644 index 00000000000..f3f80751988 --- /dev/null +++ b/queue-6.6/loongarch-vdso-disable-ubsan-instrumentation.patch @@ -0,0 +1,46 @@ +From 4841c7d590aca668bac8dbc2ad1eb912d81f586c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 12:32:05 +0800 +Subject: LoongArch: vDSO: Disable UBSAN instrumentation + +From: Kees Cook + +[ Upstream commit cca5efe77a6a2d02b3da4960f799fa233e460ab1 ] + +The vDSO executes in userspace, so the kernel's UBSAN should not +instrument it. Solves these kind of build errors: + + loongarch64-linux-ld: arch/loongarch/vdso/vgettimeofday.o: in function `vdso_shift_ns': + lib/vdso/gettimeofday.c:23:(.text+0x3f8): undefined reference to `__ubsan_handle_shift_out_of_bounds' + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202401310530.lZHCj1Zl-lkp@intel.com/ +Cc: Huacai Chen +Cc: WANG Xuerui +Cc: Vincenzo Frascino +Cc: Nathan Chancellor +Cc: Masahiro Yamada +Cc: Fangrui Song +Cc: loongarch@lists.linux.dev +Signed-off-by: Kees Cook +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/vdso/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/loongarch/vdso/Makefile b/arch/loongarch/vdso/Makefile +index 5c97d14633282..4305d99b33130 100644 +--- a/arch/loongarch/vdso/Makefile ++++ b/arch/loongarch/vdso/Makefile +@@ -2,6 +2,7 @@ + # Objects to go into the VDSO. + + KASAN_SANITIZE := n ++UBSAN_SANITIZE := n + KCOV_INSTRUMENT := n + + # Include the generic Makefile to check the built vdso. +-- +2.43.0 + diff --git a/queue-6.6/mips-reserve-exception-vector-space-only-once.patch b/queue-6.6/mips-reserve-exception-vector-space-only-once.patch new file mode 100644 index 00000000000..9eae9298f61 --- /dev/null +++ b/queue-6.6/mips-reserve-exception-vector-space-only-once.patch @@ -0,0 +1,45 @@ +From 10dd76c1dff93fce2c43528df924c90ca43791d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 09:47:57 +0800 +Subject: MIPS: reserve exception vector space ONLY ONCE + +From: Huang Pei + +[ Upstream commit abcabb9e30a1f9a69c76776f8abffc31c377b542 ] + +"cpu_probe" is called both by BP and APs, but reserving exception vector +(like 0x0-0x1000) called by "cpu_probe" need once and calling on APs is +too late since memblock is unavailable at that time. + +So, reserve exception vector ONLY by BP. + +Suggested-by: Thomas Bogendoerfer +Signed-off-by: Huang Pei +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/traps.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index 246c6a6b02614..5b778995d4483 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -2007,7 +2007,13 @@ unsigned long vi_handlers[64]; + + void reserve_exception_space(phys_addr_t addr, unsigned long size) + { +- memblock_reserve(addr, size); ++ /* ++ * reserve exception space on CPUs other than CPU0 ++ * is too late, since memblock is unavailable when APs ++ * up ++ */ ++ if (smp_processor_id() == 0) ++ memblock_reserve(addr, size); + } + + void __init *set_except_vector(int n, void *addr) +-- +2.43.0 + diff --git a/queue-6.6/misc-open-dice-fix-spurious-lockdep-warning.patch b/queue-6.6/misc-open-dice-fix-spurious-lockdep-warning.patch new file mode 100644 index 00000000000..f1a773da995 --- /dev/null +++ b/queue-6.6/misc-open-dice-fix-spurious-lockdep-warning.patch @@ -0,0 +1,54 @@ +From 3903ba4a7b021807febd9731e0f225010f6914a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 15:24:10 +0000 +Subject: misc: open-dice: Fix spurious lockdep warning + +From: Will Deacon + +[ Upstream commit ac9762a74c7ca7cbfcb4c65f5871373653a046ac ] + +When probing the open-dice driver with PROVE_LOCKING=y, lockdep +complains that the mutex in 'drvdata->lock' has a non-static key: + + | INFO: trying to register non-static key. + | The code is fine but needs lockdep annotation, or maybe + | you didn't initialize this object before use? + | turning off the locking correctness validator. + +Fix the problem by initialising the mutex memory with mutex_init() +instead of __MUTEX_INITIALIZER(). + +Cc: Arnd Bergmann +Cc: David Brazdil +Cc: Greg Kroah-Hartman +Signed-off-by: Will Deacon +Link: https://lore.kernel.org/r/20240126152410.10148-1-will@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/open-dice.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/open-dice.c b/drivers/misc/open-dice.c +index 8aea2d070a40c..d279a4f195e2a 100644 +--- a/drivers/misc/open-dice.c ++++ b/drivers/misc/open-dice.c +@@ -140,7 +140,6 @@ static int __init open_dice_probe(struct platform_device *pdev) + return -ENOMEM; + + *drvdata = (struct open_dice_drvdata){ +- .lock = __MUTEX_INITIALIZER(drvdata->lock), + .rmem = rmem, + .misc = (struct miscdevice){ + .parent = dev, +@@ -150,6 +149,7 @@ static int __init open_dice_probe(struct platform_device *pdev) + .mode = 0600, + }, + }; ++ mutex_init(&drvdata->lock); + + /* Index overflow check not needed, misc_register() will fail. */ + snprintf(drvdata->name, sizeof(drvdata->name), DRIVER_NAME"%u", dev_idx++); +-- +2.43.0 + diff --git a/queue-6.6/netfilter-conntrack-check-sctp_cid_shutdown_ack-for-.patch b/queue-6.6/netfilter-conntrack-check-sctp_cid_shutdown_ack-for-.patch new file mode 100644 index 00000000000..15c3e74592e --- /dev/null +++ b/queue-6.6/netfilter-conntrack-check-sctp_cid_shutdown_ack-for-.patch @@ -0,0 +1,71 @@ +From c2ed84d4e251f0e1df41887b95ca9e6f6d421ae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 17:29:46 -0500 +Subject: netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in + sctp_new + +From: Xin Long + +[ Upstream commit 6e348067ee4bc5905e35faa3a8fafa91c9124bc7 ] + +The annotation says in sctp_new(): "If it is a shutdown ack OOTB packet, we +expect a return shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8)". +However, it does not check SCTP_CID_SHUTDOWN_ACK before setting vtag[REPLY] +in the conntrack entry(ct). + +Because of that, if the ct in Router disappears for some reason in [1] +with the packet sequence like below: + + Client > Server: sctp (1) [INIT] [init tag: 3201533963] + Server > Client: sctp (1) [INIT ACK] [init tag: 972498433] + Client > Server: sctp (1) [COOKIE ECHO] + Server > Client: sctp (1) [COOKIE ACK] + Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057809] + Server > Client: sctp (1) [SACK] [cum ack 3075057809] + Server > Client: sctp (1) [HB REQ] + (the ct in Router disappears somehow) <-------- [1] + Client > Server: sctp (1) [HB ACK] + Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810] + Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810] + Client > Server: sctp (1) [HB REQ] + Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810] + Client > Server: sctp (1) [HB REQ] + Client > Server: sctp (1) [ABORT] + +when processing HB ACK packet in Router it calls sctp_new() to initialize +the new ct with vtag[REPLY] set to HB_ACK packet's vtag. + +Later when sending DATA from Client, all the SACKs from Server will get +dropped in Router, as the SACK packet's vtag does not match vtag[REPLY] +in the ct. The worst thing is the vtag in this ct will never get fixed +by the upcoming packets from Server. + +This patch fixes it by checking SCTP_CID_SHUTDOWN_ACK before setting +vtag[REPLY] in the ct in sctp_new() as the annotation says. With this +fix, it will leave vtag[REPLY] in ct to 0 in the case above, and the +next HB REQ/ACK from Server is able to fix the vtag as its value is 0 +in nf_conntrack_sctp_packet(). + +Signed-off-by: Xin Long +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_sctp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c +index c6bd533983c1f..4cc97f971264e 100644 +--- a/net/netfilter/nf_conntrack_proto_sctp.c ++++ b/net/netfilter/nf_conntrack_proto_sctp.c +@@ -283,7 +283,7 @@ sctp_new(struct nf_conn *ct, const struct sk_buff *skb, + pr_debug("Setting vtag %x for secondary conntrack\n", + sh->vtag); + ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] = sh->vtag; +- } else { ++ } else if (sch->type == SCTP_CID_SHUTDOWN_ACK) { + /* If it is a shutdown ack OOTB packet, we expect a return + shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */ + pr_debug("Setting vtag %x for new conn OOTB\n", +-- +2.43.0 + diff --git a/queue-6.6/nvme-fc-do-not-wait-in-vain-when-unloading-module.patch b/queue-6.6/nvme-fc-do-not-wait-in-vain-when-unloading-module.patch new file mode 100644 index 00000000000..b0542e9ca3f --- /dev/null +++ b/queue-6.6/nvme-fc-do-not-wait-in-vain-when-unloading-module.patch @@ -0,0 +1,145 @@ +From fef54104bea6ffd6b1fd75ca8fbb72bdfb30e6ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:01 +0100 +Subject: nvme-fc: do not wait in vain when unloading module + +From: Daniel Wagner + +[ Upstream commit 70fbfc47a392b98e5f8dba70c6efc6839205c982 ] + +The module exit path has race between deleting all controllers and +freeing 'left over IDs'. To prevent double free a synchronization +between nvme_delete_ctrl and ida_destroy has been added by the initial +commit. + +There is some logic around trying to prevent from hanging forever in +wait_for_completion, though it does not handling all cases. E.g. +blktests is able to reproduce the situation where the module unload +hangs forever. + +If we completely rely on the cleanup code executed from the +nvme_delete_ctrl path, all IDs will be freed eventually. This makes +calling ida_destroy unnecessary. We only have to ensure that all +nvme_delete_ctrl code has been executed before we leave +nvme_fc_exit_module. This is done by flushing the nvme_delete_wq +workqueue. + +While at it, remove the unused nvme_fc_wq workqueue too. + +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 47 ++++++------------------------------------ + 1 file changed, 6 insertions(+), 41 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 46cce0ec35e9a..cdb1e706f855e 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -221,11 +221,6 @@ static LIST_HEAD(nvme_fc_lport_list); + static DEFINE_IDA(nvme_fc_local_port_cnt); + static DEFINE_IDA(nvme_fc_ctrl_cnt); + +-static struct workqueue_struct *nvme_fc_wq; +- +-static bool nvme_fc_waiting_to_unload; +-static DECLARE_COMPLETION(nvme_fc_unload_proceed); +- + /* + * These items are short-term. They will eventually be moved into + * a generic FC class. See comments in module init. +@@ -255,8 +250,6 @@ nvme_fc_free_lport(struct kref *ref) + /* remove from transport list */ + spin_lock_irqsave(&nvme_fc_lock, flags); + list_del(&lport->port_list); +- if (nvme_fc_waiting_to_unload && list_empty(&nvme_fc_lport_list)) +- complete(&nvme_fc_unload_proceed); + spin_unlock_irqrestore(&nvme_fc_lock, flags); + + ida_free(&nvme_fc_local_port_cnt, lport->localport.port_num); +@@ -3893,10 +3886,6 @@ static int __init nvme_fc_init_module(void) + { + int ret; + +- nvme_fc_wq = alloc_workqueue("nvme_fc_wq", WQ_MEM_RECLAIM, 0); +- if (!nvme_fc_wq) +- return -ENOMEM; +- + /* + * NOTE: + * It is expected that in the future the kernel will combine +@@ -3914,7 +3903,7 @@ static int __init nvme_fc_init_module(void) + ret = class_register(&fc_class); + if (ret) { + pr_err("couldn't register class fc\n"); +- goto out_destroy_wq; ++ return ret; + } + + /* +@@ -3938,8 +3927,6 @@ static int __init nvme_fc_init_module(void) + device_destroy(&fc_class, MKDEV(0, 0)); + out_destroy_class: + class_unregister(&fc_class); +-out_destroy_wq: +- destroy_workqueue(nvme_fc_wq); + + return ret; + } +@@ -3959,45 +3946,23 @@ nvme_fc_delete_controllers(struct nvme_fc_rport *rport) + spin_unlock(&rport->lock); + } + +-static void +-nvme_fc_cleanup_for_unload(void) ++static void __exit nvme_fc_exit_module(void) + { + struct nvme_fc_lport *lport; + struct nvme_fc_rport *rport; +- +- list_for_each_entry(lport, &nvme_fc_lport_list, port_list) { +- list_for_each_entry(rport, &lport->endp_list, endp_list) { +- nvme_fc_delete_controllers(rport); +- } +- } +-} +- +-static void __exit nvme_fc_exit_module(void) +-{ + unsigned long flags; +- bool need_cleanup = false; + + spin_lock_irqsave(&nvme_fc_lock, flags); +- nvme_fc_waiting_to_unload = true; +- if (!list_empty(&nvme_fc_lport_list)) { +- need_cleanup = true; +- nvme_fc_cleanup_for_unload(); +- } ++ list_for_each_entry(lport, &nvme_fc_lport_list, port_list) ++ list_for_each_entry(rport, &lport->endp_list, endp_list) ++ nvme_fc_delete_controllers(rport); + spin_unlock_irqrestore(&nvme_fc_lock, flags); +- if (need_cleanup) { +- pr_info("%s: waiting for ctlr deletes\n", __func__); +- wait_for_completion(&nvme_fc_unload_proceed); +- pr_info("%s: ctrl deletes complete\n", __func__); +- } ++ flush_workqueue(nvme_delete_wq); + + nvmf_unregister_transport(&nvme_fc_transport); + +- ida_destroy(&nvme_fc_local_port_cnt); +- ida_destroy(&nvme_fc_ctrl_cnt); +- + device_destroy(&fc_class, MKDEV(0, 0)); + class_unregister(&fc_class); +- destroy_workqueue(nvme_fc_wq); + } + + module_init(nvme_fc_init_module); +-- +2.43.0 + diff --git a/queue-6.6/nvmet-fc-abort-command-when-there-is-no-binding.patch b/queue-6.6/nvmet-fc-abort-command-when-there-is-no-binding.patch new file mode 100644 index 00000000000..6da4f59545d --- /dev/null +++ b/queue-6.6/nvmet-fc-abort-command-when-there-is-no-binding.patch @@ -0,0 +1,51 @@ +From b1636e01b52ae5f79604263bf180cd64cd79128b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:09 +0100 +Subject: nvmet-fc: abort command when there is no binding + +From: Daniel Wagner + +[ Upstream commit 3146345c2e9c2f661527054e402b0cfad80105a4 ] + +When the target port has not active port binding, there is no point in +trying to process the command as it has to fail anyway. Instead adding +checks to all commands abort the command early. + +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 64c26b703860c..b4b2631eb530e 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -1101,6 +1101,9 @@ nvmet_fc_alloc_target_assoc(struct nvmet_fc_tgtport *tgtport, void *hosthandle) + int idx; + bool needrandom = true; + ++ if (!tgtport->pe) ++ return NULL; ++ + assoc = kzalloc(sizeof(*assoc), GFP_KERNEL); + if (!assoc) + return NULL; +@@ -2523,8 +2526,9 @@ nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, + + fod->req.cmd = &fod->cmdiubuf.sqe; + fod->req.cqe = &fod->rspiubuf.cqe; +- if (tgtport->pe) +- fod->req.port = tgtport->pe->port; ++ if (!tgtport->pe) ++ goto transport_error; ++ fod->req.port = tgtport->pe->port; + + /* clear any response payload */ + memset(&fod->rspiubuf, 0, sizeof(fod->rspiubuf)); +-- +2.43.0 + diff --git a/queue-6.6/nvmet-fc-avoid-deadlock-on-delete-association-path.patch b/queue-6.6/nvmet-fc-avoid-deadlock-on-delete-association-path.patch new file mode 100644 index 00000000000..ecd380a5f1a --- /dev/null +++ b/queue-6.6/nvmet-fc-avoid-deadlock-on-delete-association-path.patch @@ -0,0 +1,79 @@ +From 5f5778a67253e552bf42d4a1c7afe3521cd49105 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:10 +0100 +Subject: nvmet-fc: avoid deadlock on delete association path + +From: Daniel Wagner + +[ Upstream commit 710c69dbaccdac312e32931abcb8499c1525d397 ] + +When deleting an association the shutdown path is deadlocking because we +try to flush the nvmet_wq nested. Avoid this by deadlock by deferring +the put work into its own work item. + +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index b4b2631eb530e..36cae038eb045 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -111,6 +111,8 @@ struct nvmet_fc_tgtport { + struct nvmet_fc_port_entry *pe; + struct kref ref; + u32 max_sg_cnt; ++ ++ struct work_struct put_work; + }; + + struct nvmet_fc_port_entry { +@@ -248,6 +250,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc); + static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue); + static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue); + static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport); ++static void nvmet_fc_put_tgtport_work(struct work_struct *work) ++{ ++ struct nvmet_fc_tgtport *tgtport = ++ container_of(work, struct nvmet_fc_tgtport, put_work); ++ ++ nvmet_fc_tgtport_put(tgtport); ++} + static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport); + static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, + struct nvmet_fc_fcp_iod *fod); +@@ -359,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + + if (!lsop->req_queued) { + spin_unlock_irqrestore(&tgtport->lock, flags); +- goto out_puttgtport; ++ goto out_putwork; + } + + list_del(&lsop->lsreq_list); +@@ -372,8 +381,8 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + (lsreq->rqstlen + lsreq->rsplen), + DMA_BIDIRECTIONAL); + +-out_puttgtport: +- nvmet_fc_tgtport_put(tgtport); ++out_putwork: ++ queue_work(nvmet_wq, &tgtport->put_work); + } + + static int +@@ -1404,6 +1413,7 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, + kref_init(&newrec->ref); + ida_init(&newrec->assoc_cnt); + newrec->max_sg_cnt = template->max_sgl_segments; ++ INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work); + + ret = nvmet_fc_alloc_ls_iodlist(newrec); + if (ret) { +-- +2.43.0 + diff --git a/queue-6.6/nvmet-fc-defer-cleanup-using-rcu-properly.patch b/queue-6.6/nvmet-fc-defer-cleanup-using-rcu-properly.patch new file mode 100644 index 00000000000..ca654b9f8d7 --- /dev/null +++ b/queue-6.6/nvmet-fc-defer-cleanup-using-rcu-properly.patch @@ -0,0 +1,276 @@ +From 6969787c81349fd7a4b9ff006a943816159c0112 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:04 +0100 +Subject: nvmet-fc: defer cleanup using RCU properly + +From: Daniel Wagner + +[ Upstream commit 4049dc96b8de7aeb3addcea039446e464726a525 ] + +When the target executes a disconnect and the host triggers a reconnect +immediately, the reconnect command still finds an existing association. + +The reconnect crashes later on because nvmet_fc_delete_target_assoc +blindly removes resources while the reconnect code wants to use it. + +To address this, nvmet_fc_find_target_assoc should not be able to +lookup an association which is being removed. The association list +is already under RCU lifetime management, so let's properly use it +and remove the association from the list and wait for a grace period +before cleaning up all. This means we also can drop the RCU management +on the queues, because this is now handled via the association itself. + +A second step split the execution context so that the initial disconnect +command can complete without running the reconnect code in the same +context. As usual, this is done by deferring the ->done to a workqueue. + +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 83 ++++++++++++++++++---------------------- + 1 file changed, 37 insertions(+), 46 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 0075d9636b065..c9ef642313c8f 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -165,7 +165,7 @@ struct nvmet_fc_tgt_assoc { + struct nvmet_fc_hostport *hostport; + struct nvmet_fc_ls_iod *rcv_disconn; + struct list_head a_list; +- struct nvmet_fc_tgt_queue __rcu *queues[NVMET_NR_QUEUES + 1]; ++ struct nvmet_fc_tgt_queue *queues[NVMET_NR_QUEUES + 1]; + struct kref ref; + struct work_struct del_work; + struct rcu_head rcu; +@@ -802,14 +802,11 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc, + if (!queue) + return NULL; + +- if (!nvmet_fc_tgt_a_get(assoc)) +- goto out_free_queue; +- + queue->work_q = alloc_workqueue("ntfc%d.%d.%d", 0, 0, + assoc->tgtport->fc_target_port.port_num, + assoc->a_id, qid); + if (!queue->work_q) +- goto out_a_put; ++ goto out_free_queue; + + queue->qid = qid; + queue->sqsize = sqsize; +@@ -831,15 +828,13 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc, + goto out_fail_iodlist; + + WARN_ON(assoc->queues[qid]); +- rcu_assign_pointer(assoc->queues[qid], queue); ++ assoc->queues[qid] = queue; + + return queue; + + out_fail_iodlist: + nvmet_fc_destroy_fcp_iodlist(assoc->tgtport, queue); + destroy_workqueue(queue->work_q); +-out_a_put: +- nvmet_fc_tgt_a_put(assoc); + out_free_queue: + kfree(queue); + return NULL; +@@ -852,12 +847,8 @@ nvmet_fc_tgt_queue_free(struct kref *ref) + struct nvmet_fc_tgt_queue *queue = + container_of(ref, struct nvmet_fc_tgt_queue, ref); + +- rcu_assign_pointer(queue->assoc->queues[queue->qid], NULL); +- + nvmet_fc_destroy_fcp_iodlist(queue->assoc->tgtport, queue); + +- nvmet_fc_tgt_a_put(queue->assoc); +- + destroy_workqueue(queue->work_q); + + kfree_rcu(queue, rcu); +@@ -969,7 +960,7 @@ nvmet_fc_find_target_queue(struct nvmet_fc_tgtport *tgtport, + rcu_read_lock(); + list_for_each_entry_rcu(assoc, &tgtport->assoc_list, a_list) { + if (association_id == assoc->association_id) { +- queue = rcu_dereference(assoc->queues[qid]); ++ queue = assoc->queues[qid]; + if (queue && + (!atomic_read(&queue->connected) || + !nvmet_fc_tgt_q_get(queue))) +@@ -1172,13 +1163,18 @@ nvmet_fc_target_assoc_free(struct kref *ref) + struct nvmet_fc_tgtport *tgtport = assoc->tgtport; + struct nvmet_fc_ls_iod *oldls; + unsigned long flags; ++ int i; ++ ++ for (i = NVMET_NR_QUEUES; i >= 0; i--) { ++ if (assoc->queues[i]) ++ nvmet_fc_delete_target_queue(assoc->queues[i]); ++ } + + /* Send Disconnect now that all i/o has completed */ + nvmet_fc_xmt_disconnect_assoc(assoc); + + nvmet_fc_free_hostport(assoc->hostport); + spin_lock_irqsave(&tgtport->lock, flags); +- list_del_rcu(&assoc->a_list); + oldls = assoc->rcv_disconn; + spin_unlock_irqrestore(&tgtport->lock, flags); + /* if pending Rcv Disconnect Association LS, send rsp now */ +@@ -1208,7 +1204,7 @@ static void + nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) + { + struct nvmet_fc_tgtport *tgtport = assoc->tgtport; +- struct nvmet_fc_tgt_queue *queue; ++ unsigned long flags; + int i, terminating; + + terminating = atomic_xchg(&assoc->terminating, 1); +@@ -1217,29 +1213,21 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) + if (terminating) + return; + ++ spin_lock_irqsave(&tgtport->lock, flags); ++ list_del_rcu(&assoc->a_list); ++ spin_unlock_irqrestore(&tgtport->lock, flags); + +- for (i = NVMET_NR_QUEUES; i >= 0; i--) { +- rcu_read_lock(); +- queue = rcu_dereference(assoc->queues[i]); +- if (!queue) { +- rcu_read_unlock(); +- continue; +- } ++ synchronize_rcu(); + +- if (!nvmet_fc_tgt_q_get(queue)) { +- rcu_read_unlock(); +- continue; +- } +- rcu_read_unlock(); +- nvmet_fc_delete_target_queue(queue); +- nvmet_fc_tgt_q_put(queue); ++ /* ensure all in-flight I/Os have been processed */ ++ for (i = NVMET_NR_QUEUES; i >= 0; i--) { ++ if (assoc->queues[i]) ++ flush_workqueue(assoc->queues[i]->work_q); + } + + dev_info(tgtport->dev, + "{%d:%d} Association deleted\n", + tgtport->fc_target_port.port_num, assoc->a_id); +- +- nvmet_fc_tgt_a_put(assoc); + } + + static struct nvmet_fc_tgt_assoc * +@@ -1492,9 +1480,8 @@ __nvmet_fc_free_assocs(struct nvmet_fc_tgtport *tgtport) + list_for_each_entry_rcu(assoc, &tgtport->assoc_list, a_list) { + if (!nvmet_fc_tgt_a_get(assoc)) + continue; +- if (!queue_work(nvmet_wq, &assoc->del_work)) +- /* already deleting - release local reference */ +- nvmet_fc_tgt_a_put(assoc); ++ queue_work(nvmet_wq, &assoc->del_work); ++ nvmet_fc_tgt_a_put(assoc); + } + rcu_read_unlock(); + } +@@ -1547,9 +1534,8 @@ nvmet_fc_invalidate_host(struct nvmet_fc_target_port *target_port, + continue; + assoc->hostport->invalid = 1; + noassoc = false; +- if (!queue_work(nvmet_wq, &assoc->del_work)) +- /* already deleting - release local reference */ +- nvmet_fc_tgt_a_put(assoc); ++ queue_work(nvmet_wq, &assoc->del_work); ++ nvmet_fc_tgt_a_put(assoc); + } + spin_unlock_irqrestore(&tgtport->lock, flags); + +@@ -1581,7 +1567,7 @@ nvmet_fc_delete_ctrl(struct nvmet_ctrl *ctrl) + + rcu_read_lock(); + list_for_each_entry_rcu(assoc, &tgtport->assoc_list, a_list) { +- queue = rcu_dereference(assoc->queues[0]); ++ queue = assoc->queues[0]; + if (queue && queue->nvme_sq.ctrl == ctrl) { + if (nvmet_fc_tgt_a_get(assoc)) + found_ctrl = true; +@@ -1593,9 +1579,8 @@ nvmet_fc_delete_ctrl(struct nvmet_ctrl *ctrl) + nvmet_fc_tgtport_put(tgtport); + + if (found_ctrl) { +- if (!queue_work(nvmet_wq, &assoc->del_work)) +- /* already deleting - release local reference */ +- nvmet_fc_tgt_a_put(assoc); ++ queue_work(nvmet_wq, &assoc->del_work); ++ nvmet_fc_tgt_a_put(assoc); + return; + } + +@@ -1625,6 +1610,8 @@ nvmet_fc_unregister_targetport(struct nvmet_fc_target_port *target_port) + /* terminate any outstanding associations */ + __nvmet_fc_free_assocs(tgtport); + ++ flush_workqueue(nvmet_wq); ++ + /* + * should terminate LS's as well. However, LS's will be generated + * at the tail end of association termination, so they likely don't +@@ -1870,9 +1857,6 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport, + sizeof(struct fcnvme_ls_disconnect_assoc_acc)), + FCNVME_LS_DISCONNECT_ASSOC); + +- /* release get taken in nvmet_fc_find_target_assoc */ +- nvmet_fc_tgt_a_put(assoc); +- + /* + * The rules for LS response says the response cannot + * go back until ABTS's have been sent for all outstanding +@@ -1887,8 +1871,6 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport, + assoc->rcv_disconn = iod; + spin_unlock_irqrestore(&tgtport->lock, flags); + +- nvmet_fc_delete_target_assoc(assoc); +- + if (oldls) { + dev_info(tgtport->dev, + "{%d:%d} Multiple Disconnect Association LS's " +@@ -1904,6 +1886,9 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport, + nvmet_fc_xmt_ls_rsp(tgtport, oldls); + } + ++ queue_work(nvmet_wq, &assoc->del_work); ++ nvmet_fc_tgt_a_put(assoc); ++ + return false; + } + +@@ -2902,6 +2887,9 @@ nvmet_fc_remove_port(struct nvmet_port *port) + + nvmet_fc_portentry_unbind(pe); + ++ /* terminate any outstanding associations */ ++ __nvmet_fc_free_assocs(pe->tgtport); ++ + kfree(pe); + } + +@@ -2933,6 +2921,9 @@ static int __init nvmet_fc_init_module(void) + + static void __exit nvmet_fc_exit_module(void) + { ++ /* ensure any shutdown operation, e.g. delete ctrls have finished */ ++ flush_workqueue(nvmet_wq); ++ + /* sanity check - all lports should be removed */ + if (!list_empty(&nvmet_fc_target_list)) + pr_warn("%s: targetport list not empty\n", __func__); +-- +2.43.0 + diff --git a/queue-6.6/nvmet-fc-hold-reference-on-hostport-match.patch b/queue-6.6/nvmet-fc-hold-reference-on-hostport-match.patch new file mode 100644 index 00000000000..d18ddc68ec3 --- /dev/null +++ b/queue-6.6/nvmet-fc-hold-reference-on-hostport-match.patch @@ -0,0 +1,40 @@ +From 20b826362ff926c15d133794b018797667bec0ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:06 +0100 +Subject: nvmet-fc: hold reference on hostport match + +From: Daniel Wagner + +[ Upstream commit ca121a0f7515591dba0eb5532bfa7ace4dc153ce ] + +The hostport data structure is shared between the association, this why +we keep track of the users via a refcount. So we should not decrement +the refcount on a match and free the hostport several times. + +Reported by KASAN. + +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index c9ef642313c8f..64c26b703860c 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -1069,8 +1069,6 @@ nvmet_fc_alloc_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle) + /* new allocation not needed */ + kfree(newhost); + newhost = match; +- /* no new allocation - release reference */ +- nvmet_fc_tgtport_put(tgtport); + } else { + newhost->tgtport = tgtport; + newhost->hosthandle = hosthandle; +-- +2.43.0 + diff --git a/queue-6.6/nvmet-fc-release-reference-on-target-port.patch b/queue-6.6/nvmet-fc-release-reference-on-target-port.patch new file mode 100644 index 00000000000..a5a895b5843 --- /dev/null +++ b/queue-6.6/nvmet-fc-release-reference-on-target-port.patch @@ -0,0 +1,45 @@ +From 4c21818a52465ea79c66bc3de43fef609a5a7199 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:03 +0100 +Subject: nvmet-fc: release reference on target port + +From: Daniel Wagner + +[ Upstream commit c691e6d7e13dab81ac8c7489c83b5dea972522a5 ] + +In case we return early out of __nvmet_fc_finish_ls_req() we still have +to release the reference on the target port. + +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 1ab6601fdd5cf..0075d9636b065 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -359,7 +359,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + + if (!lsop->req_queued) { + spin_unlock_irqrestore(&tgtport->lock, flags); +- return; ++ goto out_puttgtport; + } + + list_del(&lsop->lsreq_list); +@@ -372,6 +372,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + (lsreq->rqstlen + lsreq->rsplen), + DMA_BIDIRECTIONAL); + ++out_puttgtport: + nvmet_fc_tgtport_put(tgtport); + } + +-- +2.43.0 + diff --git a/queue-6.6/nvmet-fc-take-ref-count-on-tgtport-before-delete-ass.patch b/queue-6.6/nvmet-fc-take-ref-count-on-tgtport-before-delete-ass.patch new file mode 100644 index 00000000000..4b31ad602c9 --- /dev/null +++ b/queue-6.6/nvmet-fc-take-ref-count-on-tgtport-before-delete-ass.patch @@ -0,0 +1,104 @@ +From 8d7070276a8b78db38fdaa72b3cf9d319a066f25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:11 +0100 +Subject: nvmet-fc: take ref count on tgtport before delete assoc + +From: Daniel Wagner + +[ Upstream commit fe506a74589326183297d5abdda02d0c76ae5a8b ] + +We have to ensure that the tgtport is not going away +before be have remove all the associations. + +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 31 +++++++++++++++++++++++-------- + 1 file changed, 23 insertions(+), 8 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 36cae038eb045..8a02ed63b1566 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -1092,13 +1092,28 @@ nvmet_fc_alloc_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle) + } + + static void +-nvmet_fc_delete_assoc(struct work_struct *work) ++nvmet_fc_delete_assoc(struct nvmet_fc_tgt_assoc *assoc) ++{ ++ nvmet_fc_delete_target_assoc(assoc); ++ nvmet_fc_tgt_a_put(assoc); ++} ++ ++static void ++nvmet_fc_delete_assoc_work(struct work_struct *work) + { + struct nvmet_fc_tgt_assoc *assoc = + container_of(work, struct nvmet_fc_tgt_assoc, del_work); ++ struct nvmet_fc_tgtport *tgtport = assoc->tgtport; + +- nvmet_fc_delete_target_assoc(assoc); +- nvmet_fc_tgt_a_put(assoc); ++ nvmet_fc_delete_assoc(assoc); ++ nvmet_fc_tgtport_put(tgtport); ++} ++ ++static void ++nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc) ++{ ++ nvmet_fc_tgtport_get(assoc->tgtport); ++ queue_work(nvmet_wq, &assoc->del_work); + } + + static struct nvmet_fc_tgt_assoc * +@@ -1132,7 +1147,7 @@ nvmet_fc_alloc_target_assoc(struct nvmet_fc_tgtport *tgtport, void *hosthandle) + assoc->a_id = idx; + INIT_LIST_HEAD(&assoc->a_list); + kref_init(&assoc->ref); +- INIT_WORK(&assoc->del_work, nvmet_fc_delete_assoc); ++ INIT_WORK(&assoc->del_work, nvmet_fc_delete_assoc_work); + atomic_set(&assoc->terminating, 0); + + while (needrandom) { +@@ -1491,7 +1506,7 @@ __nvmet_fc_free_assocs(struct nvmet_fc_tgtport *tgtport) + list_for_each_entry_rcu(assoc, &tgtport->assoc_list, a_list) { + if (!nvmet_fc_tgt_a_get(assoc)) + continue; +- queue_work(nvmet_wq, &assoc->del_work); ++ nvmet_fc_schedule_delete_assoc(assoc); + nvmet_fc_tgt_a_put(assoc); + } + rcu_read_unlock(); +@@ -1545,7 +1560,7 @@ nvmet_fc_invalidate_host(struct nvmet_fc_target_port *target_port, + continue; + assoc->hostport->invalid = 1; + noassoc = false; +- queue_work(nvmet_wq, &assoc->del_work); ++ nvmet_fc_schedule_delete_assoc(assoc); + nvmet_fc_tgt_a_put(assoc); + } + spin_unlock_irqrestore(&tgtport->lock, flags); +@@ -1590,7 +1605,7 @@ nvmet_fc_delete_ctrl(struct nvmet_ctrl *ctrl) + nvmet_fc_tgtport_put(tgtport); + + if (found_ctrl) { +- queue_work(nvmet_wq, &assoc->del_work); ++ nvmet_fc_schedule_delete_assoc(assoc); + nvmet_fc_tgt_a_put(assoc); + return; + } +@@ -1897,7 +1912,7 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport, + nvmet_fc_xmt_ls_rsp(tgtport, oldls); + } + +- queue_work(nvmet_wq, &assoc->del_work); ++ nvmet_fc_schedule_delete_assoc(assoc); + nvmet_fc_tgt_a_put(assoc); + + return false; +-- +2.43.0 + diff --git a/queue-6.6/nvmet-fcloop-swap-the-list_add_tail-arguments.patch b/queue-6.6/nvmet-fcloop-swap-the-list_add_tail-arguments.patch new file mode 100644 index 00000000000..5f8218bd893 --- /dev/null +++ b/queue-6.6/nvmet-fcloop-swap-the-list_add_tail-arguments.patch @@ -0,0 +1,56 @@ +From d3e34aaedda709209eef4d00f4af9c501f212970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:02 +0100 +Subject: nvmet-fcloop: swap the list_add_tail arguments + +From: Daniel Wagner + +[ Upstream commit dcfad4ab4d6733f2861cd241d8532a0004fc835a ] + +The first argument of list_add_tail function is the new element which +should be added to the list which is the second argument. Swap the +arguments to allow processing more than one element at a time. + +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fcloop.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index c65a73433c05f..e6d4226827b52 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -358,7 +358,7 @@ fcloop_h2t_ls_req(struct nvme_fc_local_port *localport, + if (!rport->targetport) { + tls_req->status = -ECONNREFUSED; + spin_lock(&rport->lock); +- list_add_tail(&rport->ls_list, &tls_req->ls_list); ++ list_add_tail(&tls_req->ls_list, &rport->ls_list); + spin_unlock(&rport->lock); + queue_work(nvmet_wq, &rport->ls_work); + return ret; +@@ -391,7 +391,7 @@ fcloop_h2t_xmt_ls_rsp(struct nvmet_fc_target_port *targetport, + if (remoteport) { + rport = remoteport->private; + spin_lock(&rport->lock); +- list_add_tail(&rport->ls_list, &tls_req->ls_list); ++ list_add_tail(&tls_req->ls_list, &rport->ls_list); + spin_unlock(&rport->lock); + queue_work(nvmet_wq, &rport->ls_work); + } +@@ -446,7 +446,7 @@ fcloop_t2h_ls_req(struct nvmet_fc_target_port *targetport, void *hosthandle, + if (!tport->remoteport) { + tls_req->status = -ECONNREFUSED; + spin_lock(&tport->lock); +- list_add_tail(&tport->ls_list, &tls_req->ls_list); ++ list_add_tail(&tls_req->ls_list, &tport->ls_list); + spin_unlock(&tport->lock); + queue_work(nvmet_wq, &tport->ls_work); + return ret; +-- +2.43.0 + diff --git a/queue-6.6/nvmet-tcp-fix-nvme-tcp-ida-memory-leak.patch b/queue-6.6/nvmet-tcp-fix-nvme-tcp-ida-memory-leak.patch new file mode 100644 index 00000000000..b28375dc65c --- /dev/null +++ b/queue-6.6/nvmet-tcp-fix-nvme-tcp-ida-memory-leak.patch @@ -0,0 +1,36 @@ +From 76bd3fd0bfbe22bc44a432915fb888a558f594f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 16:26:43 +0800 +Subject: nvmet-tcp: fix nvme tcp ida memory leak + +From: Guixin Liu + +[ Upstream commit 47c5dd66c1840524572dcdd956f4af2bdb6fbdff ] + +The nvmet_tcp_queue_ida should be destroy when the nvmet-tcp module +exit. + +Signed-off-by: Guixin Liu +Reviewed-by: Christoph Hellwig +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index a4f802790ca02..8e5d547aa16cb 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1927,6 +1927,7 @@ static void __exit nvmet_tcp_exit(void) + flush_workqueue(nvmet_wq); + + destroy_workqueue(nvmet_tcp_wq); ++ ida_destroy(&nvmet_tcp_queue_ida); + } + + module_init(nvmet_tcp_init); +-- +2.43.0 + diff --git a/queue-6.6/platform-mellanox-mlxbf-tmfifo-drop-tx-network-packe.patch b/queue-6.6/platform-mellanox-mlxbf-tmfifo-drop-tx-network-packe.patch new file mode 100644 index 00000000000..72a7b43ed60 --- /dev/null +++ b/queue-6.6/platform-mellanox-mlxbf-tmfifo-drop-tx-network-packe.patch @@ -0,0 +1,179 @@ +From dba7cdfa823cde39080c57b5868aa9997ca8018a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jan 2024 12:31:06 -0500 +Subject: platform/mellanox: mlxbf-tmfifo: Drop Tx network packet when Tx + TmFIFO is full +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Liming Sun + +[ Upstream commit 8cbc756b802605dee3dd40019bd75960772bacf5 ] + +Starting from Linux 5.16 kernel, Tx timeout mechanism was added +in the virtio_net driver which prints the "Tx timeout" warning +message when a packet stays in Tx queue for too long. Below is an +example of the reported message: + +"[494105.316739] virtio_net virtio1 tmfifo_net0: TX timeout on +queue: 0, sq: output.0, vq: 0×1, name: output.0, usecs since +last trans: 3079892256". + +This issue could happen when external host driver which drains the +FIFO is restared, stopped or upgraded. To avoid such confusing +"Tx timeout" messages, this commit adds logic to drop the outstanding +Tx packet if it's not able to transmit in two seconds due to Tx FIFO +full, which can be considered as congestion or out-of-resource drop. + +This commit also handles the special case that the packet is half- +transmitted into the Tx FIFO. In such case, the packet is discarded +with remaining length stored in vring->rem_padding. So paddings with +zeros can be sent out when Tx space is available to maintain the +integrity of the packet format. The padded packet will be dropped on +the receiving side. + +Signed-off-by: Liming Sun +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240111173106.96958-1-limings@nvidia.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-tmfifo.c | 67 ++++++++++++++++++++++++ + 1 file changed, 67 insertions(+) + +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index ab7d7a1235b83..39828eb84e0ba 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -47,6 +47,9 @@ + /* Message with data needs at least two words (for header & data). */ + #define MLXBF_TMFIFO_DATA_MIN_WORDS 2 + ++/* Tx timeout in milliseconds. */ ++#define TMFIFO_TX_TIMEOUT 2000 ++ + /* ACPI UID for BlueField-3. */ + #define TMFIFO_BF3_UID 1 + +@@ -62,12 +65,14 @@ struct mlxbf_tmfifo; + * @drop_desc: dummy desc for packet dropping + * @cur_len: processed length of the current descriptor + * @rem_len: remaining length of the pending packet ++ * @rem_padding: remaining bytes to send as paddings + * @pkt_len: total length of the pending packet + * @next_avail: next avail descriptor id + * @num: vring size (number of descriptors) + * @align: vring alignment size + * @index: vring index + * @vdev_id: vring virtio id (VIRTIO_ID_xxx) ++ * @tx_timeout: expire time of last tx packet + * @fifo: pointer to the tmfifo structure + */ + struct mlxbf_tmfifo_vring { +@@ -79,12 +84,14 @@ struct mlxbf_tmfifo_vring { + struct vring_desc drop_desc; + int cur_len; + int rem_len; ++ int rem_padding; + u32 pkt_len; + u16 next_avail; + int num; + int align; + int index; + int vdev_id; ++ unsigned long tx_timeout; + struct mlxbf_tmfifo *fifo; + }; + +@@ -819,6 +826,50 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring, + return true; + } + ++static void mlxbf_tmfifo_check_tx_timeout(struct mlxbf_tmfifo_vring *vring) ++{ ++ unsigned long flags; ++ ++ /* Only handle Tx timeout for network vdev. */ ++ if (vring->vdev_id != VIRTIO_ID_NET) ++ return; ++ ++ /* Initialize the timeout or return if not expired. */ ++ if (!vring->tx_timeout) { ++ /* Initialize the timeout. */ ++ vring->tx_timeout = jiffies + ++ msecs_to_jiffies(TMFIFO_TX_TIMEOUT); ++ return; ++ } else if (time_before(jiffies, vring->tx_timeout)) { ++ /* Return if not timeout yet. */ ++ return; ++ } ++ ++ /* ++ * Drop the packet after timeout. The outstanding packet is ++ * released and the remaining bytes will be sent with padding byte 0x00 ++ * as a recovery. On the peer(host) side, the padding bytes 0x00 will be ++ * either dropped directly, or appended into existing outstanding packet ++ * thus dropped as corrupted network packet. ++ */ ++ vring->rem_padding = round_up(vring->rem_len, sizeof(u64)); ++ mlxbf_tmfifo_release_pkt(vring); ++ vring->cur_len = 0; ++ vring->rem_len = 0; ++ vring->fifo->vring[0] = NULL; ++ ++ /* ++ * Make sure the load/store are in order before ++ * returning back to virtio. ++ */ ++ virtio_mb(false); ++ ++ /* Notify upper layer. */ ++ spin_lock_irqsave(&vring->fifo->spin_lock[0], flags); ++ vring_interrupt(0, vring->vq); ++ spin_unlock_irqrestore(&vring->fifo->spin_lock[0], flags); ++} ++ + /* Rx & Tx processing of a queue. */ + static void mlxbf_tmfifo_rxtx(struct mlxbf_tmfifo_vring *vring, bool is_rx) + { +@@ -841,6 +892,7 @@ static void mlxbf_tmfifo_rxtx(struct mlxbf_tmfifo_vring *vring, bool is_rx) + return; + + do { ++retry: + /* Get available FIFO space. */ + if (avail == 0) { + if (is_rx) +@@ -851,6 +903,17 @@ static void mlxbf_tmfifo_rxtx(struct mlxbf_tmfifo_vring *vring, bool is_rx) + break; + } + ++ /* Insert paddings for discarded Tx packet. */ ++ if (!is_rx) { ++ vring->tx_timeout = 0; ++ while (vring->rem_padding >= sizeof(u64)) { ++ writeq(0, vring->fifo->tx.data); ++ vring->rem_padding -= sizeof(u64); ++ if (--avail == 0) ++ goto retry; ++ } ++ } ++ + /* Console output always comes from the Tx buffer. */ + if (!is_rx && devid == VIRTIO_ID_CONSOLE) { + mlxbf_tmfifo_console_tx(fifo, avail); +@@ -860,6 +923,10 @@ static void mlxbf_tmfifo_rxtx(struct mlxbf_tmfifo_vring *vring, bool is_rx) + /* Handle one descriptor. */ + more = mlxbf_tmfifo_rxtx_one_desc(vring, is_rx, &avail); + } while (more); ++ ++ /* Check Tx timeout. */ ++ if (avail <= 0 && !is_rx) ++ mlxbf_tmfifo_check_tx_timeout(vring); + } + + /* Handle Rx or Tx queues. */ +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-touchscreen_dmi-add-info-for-the-teclas.patch b/queue-6.6/platform-x86-touchscreen_dmi-add-info-for-the-teclas.patch new file mode 100644 index 00000000000..17f3dc1b5da --- /dev/null +++ b/queue-6.6/platform-x86-touchscreen_dmi-add-info-for-the-teclas.patch @@ -0,0 +1,77 @@ +From ffa8db9c8ba7705a2444f753c487a70ba3513289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 17:53:08 +0800 +Subject: platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus + tablet + +From: Phoenix Chen + +[ Upstream commit 1abdf288b0ef5606f76b6e191fa6df05330e3d7e ] + +Add touch screen info for TECLAST X16 Plus tablet. + +Signed-off-by: Phoenix Chen +Link: https://lore.kernel.org/r/20240126095308.5042-1-asbeltogf@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 35 ++++++++++++++++++++++++++ + 1 file changed, 35 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index 0c67337726984..7aee5e9ff2b8d 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -944,6 +944,32 @@ static const struct ts_dmi_data teclast_tbook11_data = { + .properties = teclast_tbook11_props, + }; + ++static const struct property_entry teclast_x16_plus_props[] = { ++ PROPERTY_ENTRY_U32("touchscreen-min-x", 8), ++ PROPERTY_ENTRY_U32("touchscreen-min-y", 14), ++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1916), ++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1264), ++ PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"), ++ PROPERTY_ENTRY_STRING("firmware-name", "gsl3692-teclast-x16-plus.fw"), ++ PROPERTY_ENTRY_U32("silead,max-fingers", 10), ++ PROPERTY_ENTRY_BOOL("silead,home-button"), ++ { } ++}; ++ ++static const struct ts_dmi_data teclast_x16_plus_data = { ++ .embedded_fw = { ++ .name = "silead/gsl3692-teclast-x16-plus.fw", ++ .prefix = { 0xf0, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 }, ++ .length = 43560, ++ .sha256 = { 0x9d, 0xb0, 0x3d, 0xf1, 0x00, 0x3c, 0xb5, 0x25, ++ 0x62, 0x8a, 0xa0, 0x93, 0x4b, 0xe0, 0x4e, 0x75, ++ 0xd1, 0x27, 0xb1, 0x65, 0x3c, 0xba, 0xa5, 0x0f, ++ 0xcd, 0xb4, 0xbe, 0x00, 0xbb, 0xf6, 0x43, 0x29 }, ++ }, ++ .acpi_name = "MSSL1680:00", ++ .properties = teclast_x16_plus_props, ++}; ++ + static const struct property_entry teclast_x3_plus_props[] = { + PROPERTY_ENTRY_U32("touchscreen-size-x", 1980), + PROPERTY_ENTRY_U32("touchscreen-size-y", 1500), +@@ -1612,6 +1638,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_SKU, "E5A6_A1"), + }, + }, ++ { ++ /* Teclast X16 Plus */ ++ .driver_data = (void *)&teclast_x16_plus_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TECLAST"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Default string"), ++ DMI_MATCH(DMI_PRODUCT_SKU, "D3A5_A1"), ++ }, ++ }, + { + /* Teclast X3 Plus */ + .driver_data = (void *)&teclast_x3_plus_data, +-- +2.43.0 + diff --git a/queue-6.6/regulator-max5970-fix-irq-handler.patch b/queue-6.6/regulator-max5970-fix-irq-handler.patch new file mode 100644 index 00000000000..17abafdb9e9 --- /dev/null +++ b/queue-6.6/regulator-max5970-fix-irq-handler.patch @@ -0,0 +1,41 @@ +From 733e15cdf27f1201aaa57e8d59fbfb100fa4c3ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 20:32:56 +0530 +Subject: regulator (max5970): Fix IRQ handler + +From: Patrick Rudolph + +[ Upstream commit a3fa9838e8140584a6f338e8516f2b05d3bea812 ] + +The max5970 datasheet gives the impression that IRQ status bits must +be cleared by writing a one to set bits, as those are marked with 'R/C', +however tests showed that a zero must be written. + +Fixes an IRQ storm as the interrupt handler actually clears the IRQ +status bits. + +Signed-off-by: Patrick Rudolph +Signed-off-by: Naresh Solanki +Link: https://msgid.link/r/20240130150257.3643657-1-naresh.solanki@9elements.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/max5970-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/max5970-regulator.c b/drivers/regulator/max5970-regulator.c +index b56a174cde3df..5c2d49ae332fb 100644 +--- a/drivers/regulator/max5970-regulator.c ++++ b/drivers/regulator/max5970-regulator.c +@@ -265,7 +265,7 @@ static int max597x_regmap_read_clear(struct regmap *map, unsigned int reg, + return ret; + + if (*val) +- return regmap_write(map, reg, *val); ++ return regmap_write(map, reg, 0); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.6/regulator-pwm-regulator-add-validity-checks-in-conti.patch b/queue-6.6/regulator-pwm-regulator-add-validity-checks-in-conti.patch new file mode 100644 index 00000000000..f248f136e17 --- /dev/null +++ b/queue-6.6/regulator-pwm-regulator-add-validity-checks-in-conti.patch @@ -0,0 +1,43 @@ +From 78db0115fa1539ed7ec47fced72c72c996b2f842 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jan 2024 23:46:26 +0100 +Subject: regulator: pwm-regulator: Add validity checks in continuous + .get_voltage +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Blumenstingl + +[ Upstream commit c92688cac239794e4a1d976afa5203a4d3a2ac0e ] + +Continuous regulators can be configured to operate only in a certain +duty cycle range (for example from 0..91%). Add a check to error out if +the duty cycle translates to an unsupported (or out of range) voltage. + +Suggested-by: Uwe Kleine-König +Signed-off-by: Martin Blumenstingl +Link: https://msgid.link/r/20240113224628.377993-2-martin.blumenstingl@googlemail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/pwm-regulator.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/regulator/pwm-regulator.c b/drivers/regulator/pwm-regulator.c +index 2aff6db748e2c..e33d10df7a763 100644 +--- a/drivers/regulator/pwm-regulator.c ++++ b/drivers/regulator/pwm-regulator.c +@@ -158,6 +158,9 @@ static int pwm_regulator_get_voltage(struct regulator_dev *rdev) + pwm_get_state(drvdata->pwm, &pstate); + + voltage = pwm_get_relative_duty_cycle(&pstate, duty_unit); ++ if (voltage < min(max_uV_duty, min_uV_duty) || ++ voltage > max(max_uV_duty, min_uV_duty)) ++ return -ENOTRECOVERABLE; + + /* + * The dutycycle for min_uV might be greater than the one for max_uV. +-- +2.43.0 + diff --git a/queue-6.6/scsi-lpfc-use-unsigned-type-for-num_sge.patch b/queue-6.6/scsi-lpfc-use-unsigned-type-for-num_sge.patch new file mode 100644 index 00000000000..c1f8e0e5b0f --- /dev/null +++ b/queue-6.6/scsi-lpfc-use-unsigned-type-for-num_sge.patch @@ -0,0 +1,80 @@ +From 848e004ecaba86aecfda12fbb3d2b10da7d49d8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 17:26:58 +0100 +Subject: scsi: lpfc: Use unsigned type for num_sge + +From: Hannes Reinecke + +[ Upstream commit d6c1b19153f92e95e5e1801d540e98771053afae ] + +LUNs going into "failed ready running" state observed on >1T and on even +numbers of size (2T, 4T, 6T, 8T and 10T). The issue occurs when DIF is +enabled at the host. + +The kernel logs: + + Cannot setup S/G List for HBAIO segs 1/1 SGL 512 SCSI 256: 3 0 + +The host lpfc driver is failing to setup scatter/gather list (protection +data) for the I/Os. + +The return type lpfc_bg_setup_sgl()/lpfc_bg_setup_sgl_prot() causes the +compiler to remove the most significant bit. Use an unsigned type instead. + +Signed-off-by: Hannes Reinecke +[dwagner: added commit message] +Signed-off-by: Daniel Wagner +Link: https://lore.kernel.org/r/20231220162658.12392-1-dwagner@suse.de +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_scsi.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index d26941b131fdb..bf879d81846b6 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -1918,7 +1918,7 @@ lpfc_bg_setup_bpl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + * + * Returns the number of SGEs added to the SGL. + **/ +-static int ++static uint32_t + lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + struct sli4_sge *sgl, int datasegcnt, + struct lpfc_io_buf *lpfc_cmd) +@@ -1926,8 +1926,8 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + struct scatterlist *sgde = NULL; /* s/g data entry */ + struct sli4_sge_diseed *diseed = NULL; + dma_addr_t physaddr; +- int i = 0, num_sge = 0, status; +- uint32_t reftag; ++ int i = 0, status; ++ uint32_t reftag, num_sge = 0; + uint8_t txop, rxop; + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + uint32_t rc; +@@ -2099,7 +2099,7 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + * + * Returns the number of SGEs added to the SGL. + **/ +-static int ++static uint32_t + lpfc_bg_setup_sgl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + struct sli4_sge *sgl, int datacnt, int protcnt, + struct lpfc_io_buf *lpfc_cmd) +@@ -2123,8 +2123,8 @@ lpfc_bg_setup_sgl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + uint32_t rc; + #endif + uint32_t checking = 1; +- uint32_t dma_offset = 0; +- int num_sge = 0, j = 2; ++ uint32_t dma_offset = 0, num_sge = 0; ++ int j = 2; + struct sli4_hybrid_sgl *sgl_xtra = NULL; + + sgpe = scsi_prot_sglist(sc); +-- +2.43.0 + diff --git a/queue-6.6/scsi-smartpqi-add-new-controller-pci-ids.patch b/queue-6.6/scsi-smartpqi-add-new-controller-pci-ids.patch new file mode 100644 index 00000000000..e2e38992b1c --- /dev/null +++ b/queue-6.6/scsi-smartpqi-add-new-controller-pci-ids.patch @@ -0,0 +1,105 @@ +From bf4b2515148372af889b0acce71c1995592d81d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 13:36:50 -0600 +Subject: scsi: smartpqi: Add new controller PCI IDs + +From: David Strahan + +[ Upstream commit c6d5aa44eaf6d119f9ceb3bfc7d22405ac04232a ] + +All PCI ID entries in Hex. + +Add PCI IDs for Cisco controllers: + VID / DID / SVID / SDID + ---- ---- ---- ---- + Cisco 24G TriMode M1 RAID 4GB FBWC 32D 9005 / 028f / 1137 / 02f8 + Cisco 24G TriMode M1 RAID 4GB FBWC 16D 9005 / 028f / 1137 / 02f9 + Cisco 24G TriMode M1 HBA 16D 9005 / 028f / 1137 / 02fa + +Add PCI IDs for CloudNine controllers: + VID / DID / SVID / SDID + ---- ---- ---- ---- + SmartRAID P7604N-16i 9005 / 028f / 1f51 / 100e + SmartRAID P7604N-8i 9005 / 028f / 1f51 / 100f + SmartRAID P7504N-16i 9005 / 028f / 1f51 / 1010 + SmartRAID P7504N-8i 9005 / 028f / 1f51 / 1011 + SmartRAID P7504N-8i 9005 / 028f / 1f51 / 1043 + SmartHBA P6500-8i 9005 / 028f / 1f51 / 1044 + SmartRAID P7504-8i 9005 / 028f / 1f51 / 1045 + +Reviewed-by: Murthy Bhat +Reviewed-by: Mahesh Rajashekhara +Reviewed-by: Scott Teel +Reviewed-by: Scott Benesh +Reviewed-by: Mike McGowen +Reviewed-by: Kevin Barnett +Signed-off-by: David Strahan +Signed-off-by: Don Brace +Link: https://lore.kernel.org/r/20231219193653.277553-2-don.brace@microchip.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 40 +++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 9a58df9312fa7..d562011200877 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -10142,6 +10142,18 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1014, 0x0718) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1137, 0x02f8) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1137, 0x02f9) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1137, 0x02fa) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1e93, 0x1000) +@@ -10198,6 +10210,34 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x1f51, 0x100a) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1f51, 0x100e) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1f51, 0x100f) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1f51, 0x1010) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1f51, 0x1011) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1f51, 0x1043) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1f51, 0x1044) ++ }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x1f51, 0x1045) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_ANY_ID, PCI_ANY_ID) +-- +2.43.0 + diff --git a/queue-6.6/scsi-smartpqi-fix-logical-volume-rescan-race-conditi.patch b/queue-6.6/scsi-smartpqi-fix-logical-volume-rescan-race-conditi.patch new file mode 100644 index 00000000000..510e9371b27 --- /dev/null +++ b/queue-6.6/scsi-smartpqi-fix-logical-volume-rescan-race-conditi.patch @@ -0,0 +1,156 @@ +From 2120a16cdb39e1b8b35585bb1642b03d163a59aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 13:36:51 -0600 +Subject: scsi: smartpqi: Fix logical volume rescan race condition + +From: Mahesh Rajashekhara + +[ Upstream commit fb4cece17b4583f55b34a8538e27a4adc833c9d4 ] + +Correct rescan flag race condition. + +Multiple conditions are being evaluated before notifying OS to do a rescan. + +Driver will skip rescanning the device if any one of the following +conditions are met: + + - Devices that have not yet been added to the OS or devices that have been + removed. + + - Devices which are already marked for removal or in the phase of removal. + +Under very rare conditions, after logical volume size expansion, the OS +still sees the size of the logical volume which was before expansion. + +The rescan flag in the driver is used to signal the need for a logical +volume rescan. A race condition can occur in the driver, and it leads to +one thread overwriting the flag inadvertently. As a result, driver is not +notifying the OS SML to rescan the logical volume. + +Move device->rescan update into new function pqi_mark_volumes_for_rescan() +and protect with a spin lock. + +Move check for device->rescan into new function pqi_volume_rescan_needed() +and protect function call with a spin_lock. + +Reviewed-by: Scott Teel +Reviewed-by: Scott Benesh +Reviewed-by: Mike McGowen +Reviewed-by: Kevin Barnett +Co-developed-by: Murthy Bhat +Signed-off-by: Murthy Bhat +Signed-off-by: Mahesh Rajashekhara +Signed-off-by: Don Brace +Link: https://lore.kernel.org/r/20231219193653.277553-3-don.brace@microchip.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi.h | 1 - + drivers/scsi/smartpqi/smartpqi_init.c | 43 ++++++++++++++++++++++----- + 2 files changed, 36 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/smartpqi/smartpqi.h b/drivers/scsi/smartpqi/smartpqi.h +index 0419401835169..cdedc271857aa 100644 +--- a/drivers/scsi/smartpqi/smartpqi.h ++++ b/drivers/scsi/smartpqi/smartpqi.h +@@ -1347,7 +1347,6 @@ struct pqi_ctrl_info { + bool controller_online; + bool block_requests; + bool scan_blocked; +- u8 logical_volume_rescan_needed : 1; + u8 inbound_spanning_supported : 1; + u8 outbound_spanning_supported : 1; + u8 pqi_mode_enabled : 1; +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index d562011200877..081bb2c098063 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -2093,8 +2093,6 @@ static void pqi_scsi_update_device(struct pqi_ctrl_info *ctrl_info, + if (existing_device->devtype == TYPE_DISK) { + existing_device->raid_level = new_device->raid_level; + existing_device->volume_status = new_device->volume_status; +- if (ctrl_info->logical_volume_rescan_needed) +- existing_device->rescan = true; + memset(existing_device->next_bypass_group, 0, sizeof(existing_device->next_bypass_group)); + if (!pqi_raid_maps_equal(existing_device->raid_map, new_device->raid_map)) { + kfree(existing_device->raid_map); +@@ -2164,6 +2162,20 @@ static inline void pqi_init_device_tmf_work(struct pqi_scsi_dev *device) + INIT_WORK(&tmf_work->work_struct, pqi_tmf_worker); + } + ++static inline bool pqi_volume_rescan_needed(struct pqi_scsi_dev *device) ++{ ++ if (pqi_device_in_remove(device)) ++ return false; ++ ++ if (device->sdev == NULL) ++ return false; ++ ++ if (!scsi_device_online(device->sdev)) ++ return false; ++ ++ return device->rescan; ++} ++ + static void pqi_update_device_list(struct pqi_ctrl_info *ctrl_info, + struct pqi_scsi_dev *new_device_list[], unsigned int num_new_devices) + { +@@ -2284,9 +2296,13 @@ static void pqi_update_device_list(struct pqi_ctrl_info *ctrl_info, + if (device->sdev && device->queue_depth != device->advertised_queue_depth) { + device->advertised_queue_depth = device->queue_depth; + scsi_change_queue_depth(device->sdev, device->advertised_queue_depth); +- if (device->rescan) { +- scsi_rescan_device(device->sdev); ++ spin_lock_irqsave(&ctrl_info->scsi_device_list_lock, flags); ++ if (pqi_volume_rescan_needed(device)) { + device->rescan = false; ++ spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags); ++ scsi_rescan_device(device->sdev); ++ } else { ++ spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags); + } + } + } +@@ -2308,8 +2324,6 @@ static void pqi_update_device_list(struct pqi_ctrl_info *ctrl_info, + } + } + +- ctrl_info->logical_volume_rescan_needed = false; +- + } + + static inline bool pqi_is_supported_device(struct pqi_scsi_dev *device) +@@ -3702,6 +3716,21 @@ static bool pqi_ofa_process_event(struct pqi_ctrl_info *ctrl_info, + return ack_event; + } + ++static void pqi_mark_volumes_for_rescan(struct pqi_ctrl_info *ctrl_info) ++{ ++ unsigned long flags; ++ struct pqi_scsi_dev *device; ++ ++ spin_lock_irqsave(&ctrl_info->scsi_device_list_lock, flags); ++ ++ list_for_each_entry(device, &ctrl_info->scsi_device_list, scsi_device_list_entry) { ++ if (pqi_is_logical_device(device) && device->devtype == TYPE_DISK) ++ device->rescan = true; ++ } ++ ++ spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags); ++} ++ + static void pqi_disable_raid_bypass(struct pqi_ctrl_info *ctrl_info) + { + unsigned long flags; +@@ -3742,7 +3771,7 @@ static void pqi_event_worker(struct work_struct *work) + ack_event = true; + rescan_needed = true; + if (event->event_type == PQI_EVENT_TYPE_LOGICAL_DEVICE) +- ctrl_info->logical_volume_rescan_needed = true; ++ pqi_mark_volumes_for_rescan(ctrl_info); + else if (event->event_type == PQI_EVENT_TYPE_AIO_STATE_CHANGE) + pqi_disable_raid_bypass(ctrl_info); + } +-- +2.43.0 + diff --git a/queue-6.6/scsi-target-core-add-tmf-to-tmr_list-handling.patch b/queue-6.6/scsi-target-core-add-tmf-to-tmr_list-handling.patch new file mode 100644 index 00000000000..f314c17e072 --- /dev/null +++ b/queue-6.6/scsi-target-core-add-tmf-to-tmr_list-handling.patch @@ -0,0 +1,88 @@ +From 79fa2b4efe1da1f7dfab91ed9f37d6ebbd60c38b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jan 2024 15:59:41 +0300 +Subject: scsi: target: core: Add TMF to tmr_list handling + +From: Dmitry Bogdanov + +[ Upstream commit 83ab68168a3d990d5ff39ab030ad5754cbbccb25 ] + +An abort that is responded to by iSCSI itself is added to tmr_list but does +not go to target core. A LUN_RESET that goes through tmr_list takes a +refcounter on the abort and waits for completion. However, the abort will +be never complete because it was not started in target core. + + Unable to locate ITT: 0x05000000 on CID: 0 + Unable to locate RefTaskTag: 0x05000000 on CID: 0. + wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop + wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop +... + INFO: task kworker/0:2:49 blocked for more than 491 seconds. + task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 + Workqueue: events target_tmr_work [target_core_mod] +Call Trace: + __switch_to+0x2c4/0x470 + _schedule+0x314/0x1730 + schedule+0x64/0x130 + schedule_timeout+0x168/0x430 + wait_for_completion+0x140/0x270 + target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] + core_tmr_lun_reset+0x30/0xa0 [target_core_mod] + target_tmr_work+0xc8/0x1b0 [target_core_mod] + process_one_work+0x2d4/0x5d0 + worker_thread+0x78/0x6c0 + +To fix this, only add abort to tmr_list if it will be handled by target +core. + +Signed-off-by: Dmitry Bogdanov +Link: https://lore.kernel.org/r/20240111125941.8688-1-d.bogdanov@yadro.com +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_device.c | 5 ----- + drivers/target/target_core_transport.c | 4 ++++ + 2 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index b6523d4b9259e..86590a7e29f6a 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -147,7 +147,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd) + struct se_session *se_sess = se_cmd->se_sess; + struct se_node_acl *nacl = se_sess->se_node_acl; + struct se_tmr_req *se_tmr = se_cmd->se_tmr_req; +- unsigned long flags; + + rcu_read_lock(); + deve = target_nacl_find_deve(nacl, se_cmd->orig_fe_lun); +@@ -178,10 +177,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd) + se_cmd->se_dev = rcu_dereference_raw(se_lun->lun_se_dev); + se_tmr->tmr_dev = rcu_dereference_raw(se_lun->lun_se_dev); + +- spin_lock_irqsave(&se_tmr->tmr_dev->se_tmr_lock, flags); +- list_add_tail(&se_tmr->tmr_list, &se_tmr->tmr_dev->dev_tmr_list); +- spin_unlock_irqrestore(&se_tmr->tmr_dev->se_tmr_lock, flags); +- + return 0; + } + EXPORT_SYMBOL(transport_lookup_tmr_lun); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 0686882bcbda3..fb93d74c5d0b2 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -3627,6 +3627,10 @@ int transport_generic_handle_tmr( + unsigned long flags; + bool aborted = false; + ++ spin_lock_irqsave(&cmd->se_dev->se_tmr_lock, flags); ++ list_add_tail(&cmd->se_tmr_req->tmr_list, &cmd->se_dev->dev_tmr_list); ++ spin_unlock_irqrestore(&cmd->se_dev->se_tmr_lock, flags); ++ + spin_lock_irqsave(&cmd->t_state_lock, flags); + if (cmd->transport_state & CMD_T_ABORTED) { + aborted = true; +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-core-fix-shift-issue-in-ufshcd_clear_cmd.patch b/queue-6.6/scsi-ufs-core-fix-shift-issue-in-ufshcd_clear_cmd.patch new file mode 100644 index 00000000000..01dbffdb343 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-fix-shift-issue-in-ufshcd_clear_cmd.patch @@ -0,0 +1,86 @@ +From 2b724e1e7252e16d7a7f4cf7f593ea61d93063fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Feb 2024 18:49:04 +0800 +Subject: scsi: ufs: core: Fix shift issue in ufshcd_clear_cmd() + +From: Alice Chao + +[ Upstream commit b513d30d59bb383a6a5d6b533afcab2cee99a8f8 ] + +When task_tag >= 32 (in MCQ mode) and sizeof(unsigned int) == 4, 1U << +task_tag will out of bounds for a u32 mask. Fix this up to prevent +SHIFT_ISSUE (bitwise shifts that are out of bounds for their data type). + +[name:debug_monitors&]Unexpected kernel BRK exception at EL1 +[name:traps&]Internal error: BRK handler: 00000000f2005514 [#1] PREEMPT SMP +[name:mediatek_cpufreq_hw&]cpufreq stop DVFS log done +[name:mrdump&]Kernel Offset: 0x1ba5800000 from 0xffffffc008000000 +[name:mrdump&]PHYS_OFFSET: 0x80000000 +[name:mrdump&]pstate: 22400005 (nzCv daif +PAN -UAO) +[name:mrdump&]pc : [0xffffffdbaf52bb2c] ufshcd_clear_cmd+0x280/0x288 +[name:mrdump&]lr : [0xffffffdbaf52a774] ufshcd_wait_for_dev_cmd+0x3e4/0x82c +[name:mrdump&]sp : ffffffc0081471b0 + +Workqueue: ufs_eh_wq_0 ufshcd_err_handler +Call trace: + dump_backtrace+0xf8/0x144 + show_stack+0x18/0x24 + dump_stack_lvl+0x78/0x9c + dump_stack+0x18/0x44 + mrdump_common_die+0x254/0x480 [mrdump] + ipanic_die+0x20/0x30 [mrdump] + notify_die+0x15c/0x204 + die+0x10c/0x5f8 + arm64_notify_die+0x74/0x13c + do_debug_exception+0x164/0x26c + el1_dbg+0x64/0x80 + el1h_64_sync_handler+0x3c/0x90 + el1h_64_sync+0x68/0x6c + ufshcd_clear_cmd+0x280/0x288 + ufshcd_wait_for_dev_cmd+0x3e4/0x82c + ufshcd_exec_dev_cmd+0x5bc/0x9ac + ufshcd_verify_dev_init+0x84/0x1c8 + ufshcd_probe_hba+0x724/0x1ce0 + ufshcd_host_reset_and_restore+0x260/0x574 + ufshcd_reset_and_restore+0x138/0xbd0 + ufshcd_err_handler+0x1218/0x2f28 + process_one_work+0x5fc/0x1140 + worker_thread+0x7d8/0xe20 + kthread+0x25c/0x468 + ret_from_fork+0x10/0x20 + +Signed-off-by: Alice Chao +Link: https://lore.kernel.org/r/20240205104905.24929-1-alice.chao@mediatek.com +Reviewed-by: Stanley Jhu +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 44e0437bd19d9..f6c83dcff8a8c 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -2949,7 +2949,7 @@ bool ufshcd_cmd_inflight(struct scsi_cmnd *cmd) + */ + static int ufshcd_clear_cmd(struct ufs_hba *hba, u32 task_tag) + { +- u32 mask = 1U << task_tag; ++ u32 mask; + unsigned long flags; + int err; + +@@ -2967,6 +2967,8 @@ static int ufshcd_clear_cmd(struct ufs_hba *hba, u32 task_tag) + return 0; + } + ++ mask = 1U << task_tag; ++ + /* clear outstanding transaction before retry */ + spin_lock_irqsave(hba->host->host_lock, flags); + ufshcd_utrl_clear(hba, mask); +-- +2.43.0 + diff --git a/queue-6.6/scsi-ufs-core-remove-the-ufshcd_release-in-ufshcd_er.patch b/queue-6.6/scsi-ufs-core-remove-the-ufshcd_release-in-ufshcd_er.patch new file mode 100644 index 00000000000..cb5f604f3e9 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-remove-the-ufshcd_release-in-ufshcd_er.patch @@ -0,0 +1,42 @@ +From 5a88c74f7484b3bba54e3b1d00c6fadbf784a926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 17:33:24 +0900 +Subject: scsi: ufs: core: Remove the ufshcd_release() in + ufshcd_err_handling_prepare() + +From: SEO HOYOUNG + +[ Upstream commit 17e94b2585417e04dabc2f13bc03b4665ae687f3 ] + +If ufshcd_err_handler() is called in a suspend/resume situation, +ufs_release() can be called twice and active_reqs end up going negative. +This is because ufshcd_err_handling_prepare() and +ufshcd_err_handling_unprepare() both call ufshcd_release(). + +Remove superfluous call to ufshcd_release(). + +Signed-off-by: SEO HOYOUNG +Link: https://lore.kernel.org/r/20240122083324.11797-1-hy50.seo@samsung.com +Reviewed-by: Bart Van Assche +Reviewed-by: Can Guo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index f6c83dcff8a8c..ee9119b708f01 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -6253,7 +6253,6 @@ static void ufshcd_err_handling_prepare(struct ufs_hba *hba) + ufshcd_hold(hba); + if (!ufshcd_is_clkgating_allowed(hba)) + ufshcd_setup_clocks(hba, true); +- ufshcd_release(hba); + pm_op = hba->is_sys_suspended ? UFS_SYSTEM_PM : UFS_RUNTIME_PM; + ufshcd_vops_resume(hba, pm_op); + } else { +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 1c822238656..f29a628b301 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1,3 +1,120 @@ sched-rt-disallow-writing-invalid-values-to-sched_rt_period_us.patch pci-dwc-fix-a-64bit-bug-in-dw_pcie_ep_raise_msix_irq.patch riscv-efistub-ensure-gp-relative-addressing-is-not-used.patch +xhci-fix-possible-null-pointer-deref-during-xhci-urb.patch +dmaengine-apple-admac-keep-upper-bits-of-reg_bus_wid.patch +scsi-smartpqi-add-new-controller-pci-ids.patch +scsi-smartpqi-fix-logical-volume-rescan-race-conditi.patch +tools-selftests-riscv-fix-compile-warnings-in-vector.patch +tools-selftests-riscv-fix-compile-warnings-in-mm-tes.patch +scsi-target-core-add-tmf-to-tmr_list-handling.patch +cifs-open_cached_dir-should-not-rely-on-primary-chan.patch +dmaengine-shdma-increase-size-of-dev_id.patch +dmaengine-fsl-qdma-increase-size-of-irq_name.patch +dmaengine-dw-edma-increase-size-of-name-in-debugfs-c.patch +wifi-cfg80211-fix-missing-interfaces-when-dumping.patch +wifi-mac80211-fix-race-condition-on-enabling-fast-xm.patch +fbdev-savage-error-out-if-pixclock-equals-zero.patch +fbdev-sis-error-out-if-pixclock-equals-zero.patch +platform-mellanox-mlxbf-tmfifo-drop-tx-network-packe.patch +spi-intel-pci-add-support-for-arrow-lake-spi-serial-.patch +spi-hisi-sfc-v3xx-return-irq_none-if-no-interrupts-w.patch +block-fix-warning-in-_copy_from_iter.patch +smb-work-around-clang-__bdos-type-confusion.patch +cifs-cifs_pick_channel-should-try-selecting-active-c.patch +cifs-translate-network-errors-on-send-to-econnaborte.patch +cifs-helper-function-to-check-replayable-error-codes.patch +ahci-asm1166-correct-count-of-reported-ports.patch +aoe-avoid-potential-deadlock-at-set_capacity.patch +spi-cs42l43-handle-error-from-devm_pm_runtime_enable.patch +ahci-add-43-bit-dma-address-quirk-for-asmedia-asm106.patch +arm-dts-fix-tpm-schema-violations.patch +mips-reserve-exception-vector-space-only-once.patch +platform-x86-touchscreen_dmi-add-info-for-the-teclas.patch +ext4-avoid-dividing-by-0-in-mb_update_avg_fragment_s.patch +ext4-avoid-allocating-blocks-from-corrupted-group-in.patch +ext4-avoid-allocating-blocks-from-corrupted-group-in.patch-11720 +input-goodix-accept-acpi-resources-with-gpio_count-3.patch +dmaengine-ti-edma-add-some-null-pointer-checks-to-th.patch +asoc-amd-acp-add-check-for-cpu-dai-link-initializati.patch +regulator-pwm-regulator-add-validity-checks-in-conti.patch +hid-logitech-hidpp-add-support-for-logitech-g-pro-x-.patch +alsa-hda-replace-numeric-device-ids-with-constant-va.patch +alsa-hda-increase-default-bdl_pos_adj-for-apollo-lak.patch +hid-nvidia-shield-add-missing-null-pointer-checks-to.patch +nvmet-tcp-fix-nvme-tcp-ida-memory-leak.patch +usb-ucsi_acpi-quirk-to-ack-a-connector-change-ack-cm.patch +alsa-usb-audio-check-presence-of-valid-altsetting-co.patch +asoc-sunxi-sun4i-spdif-add-support-for-allwinner-h61.patch +regulator-max5970-fix-irq-handler.patch +spi-sh-msiof-avoid-integer-overflow-in-constants.patch +input-xpad-add-lenovo-legion-go-controllers.patch +misc-open-dice-fix-spurious-lockdep-warning.patch +netfilter-conntrack-check-sctp_cid_shutdown_ack-for-.patch +drm-amdkfd-use-correct-drm-device-for-cgroup-permiss.patch +drm-amd-display-increased-min_dcfclk_mhz-and-min_fcl.patch +cifs-make-sure-that-channel-scaling-is-done-only-onc.patch +asoc-wm_adsp-don-t-overwrite-fwf_name-with-the-defau.patch +alsa-usb-audio-ignore-clock-selector-errors-for-sing.patch +nvme-fc-do-not-wait-in-vain-when-unloading-module.patch +nvmet-fcloop-swap-the-list_add_tail-arguments.patch +nvmet-fc-release-reference-on-target-port.patch +nvmet-fc-defer-cleanup-using-rcu-properly.patch +nvmet-fc-hold-reference-on-hostport-match.patch +nvmet-fc-abort-command-when-there-is-no-binding.patch +nvmet-fc-avoid-deadlock-on-delete-association-path.patch +nvmet-fc-take-ref-count-on-tgtport-before-delete-ass.patch +cifs-do-not-search-for-channel-if-server-is-terminat.patch +smb-client-increase-number-of-pdus-allowed-in-a-comp.patch +ext4-correct-the-hole-length-returned-by-ext4_map_bl.patch +input-i8042-add-fujitsu-lifebook-u728-to-i8042-quirk.patch +fs-ntfs3-improve-alternative-boot-processing.patch +fs-ntfs3-modified-fix-directory-element-type-detecti.patch +fs-ntfs3-improve-ntfs_dir_count.patch +fs-ntfs3-correct-hard-links-updating-when-dealing-wi.patch +fs-ntfs3-print-warning-while-fixing-hard-links-count.patch +fs-ntfs3-reduce-stack-usage.patch +fs-ntfs3-fix-multithreaded-stress-test.patch +fs-ntfs3-fix-detected-field-spanning-write-size-8-of.patch +fs-ntfs3-add-file_modified.patch +fs-ntfs3-drop-suid-and-sgid-bits-as-a-part-of-fpunch.patch +fs-ntfs3-implement-super_operations-shutdown.patch +fs-ntfs3-ntfs3_forced_shutdown-use-int-instead-of-bo.patch +fs-ntfs3-add-null-ptr-dereference-checking-at-the-en.patch +fs-ntfs3-disable-attr_list_entry-size-check.patch +fs-ntfs3-use-kvfree-to-free-memory-allocated-by-kvma.patch +fs-ntfs3-use-non-movable-memory-for-ntfs3-mft-buffer.patch +fs-ntfs3-prevent-generic-message-attempt-to-access-b.patch +fs-ntfs3-use-i_size_read-and-i_size_write.patch +fs-ntfs3-correct-function-is_rst_area_valid.patch +fs-ntfs3-fixed-overflow-check-in-mi_enum_attr.patch +fs-ntfs3-update-inode-i_size-after-success-write-int.patch +fs-ntfs3-fix-oob-in-ntfs_listxattr.patch +wifi-mac80211-set-station-rx-nss-on-reconfig.patch +wifi-mac80211-adding-missing-drv_mgd_complete_tx-cal.patch +wifi-mac80211-accept-broadcast-probe-responses-on-6-.patch +wifi-iwlwifi-do-not-announce-epcs-support.patch +efi-runtime-fix-potential-overflow-of-soft-reserved-.patch +efi-don-t-add-memblocks-for-soft-reserved-memory.patch +hwmon-coretemp-enlarge-per-package-core-count-limit.patch +scsi-lpfc-use-unsigned-type-for-num_sge.patch +scsi-ufs-core-fix-shift-issue-in-ufshcd_clear_cmd.patch +scsi-ufs-core-remove-the-ufshcd_release-in-ufshcd_er.patch +loongarch-select-arch_enable_thp_migration-instead-o.patch +loongarch-select-have_arch_seccomp-to-use-the-common.patch +loongarch-change-acpi_core_pic-nr_cpus-to-acpi_core_.patch +loongarch-vdso-disable-ubsan-instrumentation.patch +accel-ivpu-force-snooping-for-mmu-writes.patch +accel-ivpu-disable-d3hot_delay-on-all-npu-generation.patch +accel-ivpu-40xx-stop-passing-sku-boot-parameters-to-.patch +firewire-core-send-bus-reset-promptly-on-gap-count-e.patch +libceph-fail-sparse-read-if-the-data-length-doesn-t-.patch +drm-amdgpu-skip-to-program-gfxdec-registers-for-susp.patch +drm-amdgpu-reset-gpu-for-s3-suspend-abort-case.patch +drm-amdgpu-fix-shared-buff-copy-to-user.patch +drm-amdgpu-fix-hdp-flush-for-vfs-on-nbio-v7.9.patch +smb-client-set-correct-d_type-for-reparse-points-und.patch +virtio-blk-ensure-no-requests-in-virtqueues-before-d.patch +cifs-change-tcon-status-when-need_reconnect-is-set-o.patch +cifs-handle-cases-where-multiple-sessions-share-conn.patch +smb3-clarify-mount-warning.patch diff --git a/queue-6.6/smb-client-increase-number-of-pdus-allowed-in-a-comp.patch b/queue-6.6/smb-client-increase-number-of-pdus-allowed-in-a-comp.patch new file mode 100644 index 00000000000..718179a51b0 --- /dev/null +++ b/queue-6.6/smb-client-increase-number-of-pdus-allowed-in-a-comp.patch @@ -0,0 +1,61 @@ +From 73d48adb130f44fb92ec6c3f1ad92cb4d3a2f7e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 21:04:44 -0300 +Subject: smb: client: increase number of PDUs allowed in a compound request + +From: Paulo Alcantara + +[ Upstream commit 11d4d1dba3315f73d2d1d386f5bf4811a8241d45 ] + +With the introduction of SMB2_OP_QUERY_WSL_EA, the client may now send +5 commands in a single compound request in order to query xattrs from +potential WSL reparse points, which should be fine as we currently +allow up to 5 PDUs in a single compound request. However, if +encryption is enabled (e.g. 'seal' mount option) or enforced by the +server, current MAX_COMPOUND(5) won't be enough as we require an extra +PDU for the transform header. + +Fix this by increasing MAX_COMPOUND to 7 and, while we're at it, add +an WARN_ON_ONCE() and return -EIO instead of -ENOMEM in case we +attempt to send a compound request that couldn't include the extra +transform header. + +Signed-off-by: Paulo Alcantara +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsglob.h | 2 +- + fs/smb/client/transport.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index dcc41fe33b705..462554917e5a1 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -82,7 +82,7 @@ + #define SMB_INTERFACE_POLL_INTERVAL 600 + + /* maximum number of PDUs in one compound */ +-#define MAX_COMPOUND 5 ++#define MAX_COMPOUND 7 + + /* + * Default number of credits to keep available for SMB3. +diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c +index e00278fcfa4fa..994d701934329 100644 +--- a/fs/smb/client/transport.c ++++ b/fs/smb/client/transport.c +@@ -435,8 +435,8 @@ smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + if (!(flags & CIFS_TRANSFORM_REQ)) + return __smb_send_rqst(server, num_rqst, rqst); + +- if (num_rqst > MAX_COMPOUND - 1) +- return -ENOMEM; ++ if (WARN_ON_ONCE(num_rqst > MAX_COMPOUND - 1)) ++ return -EIO; + + if (!server->ops->init_transform_rq) { + cifs_server_dbg(VFS, "Encryption requested but transform callback is missing\n"); +-- +2.43.0 + diff --git a/queue-6.6/smb-client-set-correct-d_type-for-reparse-points-und.patch b/queue-6.6/smb-client-set-correct-d_type-for-reparse-points-und.patch new file mode 100644 index 00000000000..d8b6f1113fb --- /dev/null +++ b/queue-6.6/smb-client-set-correct-d_type-for-reparse-points-und.patch @@ -0,0 +1,97 @@ +From 790d4ea166244c3e6c995039df8c93edebd31a2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 12:38:24 -0300 +Subject: smb: client: set correct d_type for reparse points under DFS mounts + +From: Paulo Alcantara + +[ Upstream commit 55c7788c37242702868bfac7861cdf0c358d6c3d ] + +Send query dir requests with an info level of +SMB_FIND_FILE_FULL_DIRECTORY_INFO rather than +SMB_FIND_FILE_DIRECTORY_INFO when the client is generating its own +inode numbers (e.g. noserverino) so that reparse tags still +can be parsed directly from the responses, but server won't +send UniqueId (server inode number) + +Signed-off-by: Paulo Alcantara +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/readdir.c | 15 ++++++++------- + fs/smb/client/smb2pdu.c | 6 ++++++ + 2 files changed, 14 insertions(+), 7 deletions(-) + +diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c +index d30ea2005eb36..e23cd216bffbe 100644 +--- a/fs/smb/client/readdir.c ++++ b/fs/smb/client/readdir.c +@@ -299,14 +299,16 @@ cifs_dir_info_to_fattr(struct cifs_fattr *fattr, FILE_DIRECTORY_INFO *info, + } + + static void cifs_fulldir_info_to_fattr(struct cifs_fattr *fattr, +- SEARCH_ID_FULL_DIR_INFO *info, ++ const void *info, + struct cifs_sb_info *cifs_sb) + { ++ const FILE_FULL_DIRECTORY_INFO *di = info; ++ + __dir_info_to_fattr(fattr, info); + +- /* See MS-FSCC 2.4.19 FileIdFullDirectoryInformation */ ++ /* See MS-FSCC 2.4.14, 2.4.19 */ + if (fattr->cf_cifsattrs & ATTR_REPARSE) +- fattr->cf_cifstag = le32_to_cpu(info->EaSize); ++ fattr->cf_cifstag = le32_to_cpu(di->EaSize); + cifs_fill_common_info(fattr, cifs_sb); + } + +@@ -420,7 +422,7 @@ _initiate_cifs_search(const unsigned int xid, struct file *file, + } else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) { + cifsFile->srch_inf.info_level = SMB_FIND_FILE_ID_FULL_DIR_INFO; + } else /* not srvinos - BB fixme add check for backlevel? */ { +- cifsFile->srch_inf.info_level = SMB_FIND_FILE_DIRECTORY_INFO; ++ cifsFile->srch_inf.info_level = SMB_FIND_FILE_FULL_DIRECTORY_INFO; + } + + search_flags = CIFS_SEARCH_CLOSE_AT_END | CIFS_SEARCH_RETURN_RESUME; +@@ -1014,10 +1016,9 @@ static int cifs_filldir(char *find_entry, struct file *file, + (FIND_FILE_STANDARD_INFO *)find_entry, + cifs_sb); + break; ++ case SMB_FIND_FILE_FULL_DIRECTORY_INFO: + case SMB_FIND_FILE_ID_FULL_DIR_INFO: +- cifs_fulldir_info_to_fattr(&fattr, +- (SEARCH_ID_FULL_DIR_INFO *)find_entry, +- cifs_sb); ++ cifs_fulldir_info_to_fattr(&fattr, find_entry, cifs_sb); + break; + default: + cifs_dir_info_to_fattr(&fattr, +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 97fc2f85b429d..9d34a55fdb5e4 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -5092,6 +5092,9 @@ int SMB2_query_directory_init(const unsigned int xid, + case SMB_FIND_FILE_POSIX_INFO: + req->FileInformationClass = SMB_FIND_FILE_POSIX_INFO; + break; ++ case SMB_FIND_FILE_FULL_DIRECTORY_INFO: ++ req->FileInformationClass = FILE_FULL_DIRECTORY_INFORMATION; ++ break; + default: + cifs_tcon_dbg(VFS, "info level %u isn't supported\n", + info_level); +@@ -5161,6 +5164,9 @@ smb2_parse_query_directory(struct cifs_tcon *tcon, + /* note that posix payload are variable size */ + info_buf_size = sizeof(struct smb2_posix_info); + break; ++ case SMB_FIND_FILE_FULL_DIRECTORY_INFO: ++ info_buf_size = sizeof(FILE_FULL_DIRECTORY_INFO); ++ break; + default: + cifs_tcon_dbg(VFS, "info level %u isn't supported\n", + srch_inf->info_level); +-- +2.43.0 + diff --git a/queue-6.6/smb-work-around-clang-__bdos-type-confusion.patch b/queue-6.6/smb-work-around-clang-__bdos-type-confusion.patch new file mode 100644 index 00000000000..b0bdff9000c --- /dev/null +++ b/queue-6.6/smb-work-around-clang-__bdos-type-confusion.patch @@ -0,0 +1,69 @@ +From bea1633de31060e605dc32661b9161d86293bb75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 15:47:34 -0800 +Subject: smb: Work around Clang __bdos() type confusion + +From: Kees Cook + +[ Upstream commit 8deb05c84b63b4fdb8549e08942867a68924a5b8 ] + +Recent versions of Clang gets confused about the possible size of the +"user" allocation, and CONFIG_FORTIFY_SOURCE ends up emitting a +warning[1]: + +repro.c:126:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] + 126 | __write_overflow_field(p_size_field, size); + | ^ + +for this memset(): + + int len; + __le16 *user; + ... + len = ses->user_name ? strlen(ses->user_name) : 0; + user = kmalloc(2 + (len * 2), GFP_KERNEL); + ... + if (len) { + ... + } else { + memset(user, '\0', 2); + } + +While Clang works on this bug[2], switch to using a direct assignment, +which avoids memset() entirely which both simplifies the code and silences +the false positive warning. (Making "len" size_t also silences the +warning, but the direct assignment seems better.) + +Reported-by: Nathan Chancellor +Closes: https://github.com/ClangBuiltLinux/linux/issues/1966 [1] +Link: https://github.com/llvm/llvm-project/issues/77813 [2] +Cc: Steve French +Cc: Paulo Alcantara +Cc: Ronnie Sahlberg +Cc: Shyam Prasad N +Cc: Tom Talpey +Cc: linux-cifs@vger.kernel.org +Cc: llvm@lists.linux.dev +Signed-off-by: Kees Cook +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsencrypt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/cifsencrypt.c b/fs/smb/client/cifsencrypt.c +index ef4c2e3c9fa61..6322f0f68a176 100644 +--- a/fs/smb/client/cifsencrypt.c ++++ b/fs/smb/client/cifsencrypt.c +@@ -572,7 +572,7 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash, + len = cifs_strtoUTF16(user, ses->user_name, len, nls_cp); + UniStrupr(user); + } else { +- memset(user, '\0', 2); ++ *(u16 *)user = 0; + } + + rc = crypto_shash_update(ses->server->secmech.hmacmd5, +-- +2.43.0 + diff --git a/queue-6.6/smb3-clarify-mount-warning.patch b/queue-6.6/smb3-clarify-mount-warning.patch new file mode 100644 index 00000000000..2fa3c2c3ec0 --- /dev/null +++ b/queue-6.6/smb3-clarify-mount-warning.patch @@ -0,0 +1,38 @@ +From fdb6df6b842c0144bd996854f670688fcbf79bc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 23:57:18 -0600 +Subject: smb3: clarify mount warning + +From: Steve French + +[ Upstream commit a5cc98eba2592d6e3c5a4351319595ddde2a5901 ] + +When a user tries to use the "sec=krb5p" mount parameter to encrypt +data on connection to a server (when authenticating with Kerberos), we +indicate that it is not supported, but do not note the equivalent +recommended mount parameter ("sec=krb5,seal") which turns on encryption +for that mount (and uses Kerberos for auth). Update the warning message. + +Reviewed-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/fs_context.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c +index 75f2c8734ff56..6ecbf48d0f0c6 100644 +--- a/fs/smb/client/fs_context.c ++++ b/fs/smb/client/fs_context.c +@@ -210,7 +210,7 @@ cifs_parse_security_flavors(struct fs_context *fc, char *value, struct smb3_fs_c + + switch (match_token(value, cifs_secflavor_tokens, args)) { + case Opt_sec_krb5p: +- cifs_errorf(fc, "sec=krb5p is not supported!\n"); ++ cifs_errorf(fc, "sec=krb5p is not supported. Use sec=krb5,seal instead\n"); + return 1; + case Opt_sec_krb5i: + ctx->sign = true; +-- +2.43.0 + diff --git a/queue-6.6/spi-cs42l43-handle-error-from-devm_pm_runtime_enable.patch b/queue-6.6/spi-cs42l43-handle-error-from-devm_pm_runtime_enable.patch new file mode 100644 index 00000000000..3953c91f19f --- /dev/null +++ b/queue-6.6/spi-cs42l43-handle-error-from-devm_pm_runtime_enable.patch @@ -0,0 +1,40 @@ +From 3225dced1988458e58dff664b8114f9b061720d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 17:41:01 +0000 +Subject: spi: cs42l43: Handle error from devm_pm_runtime_enable + +From: Charles Keepax + +[ Upstream commit f9f4b0c6425eb9ffd9bf62b8b8143e786b6ba695 ] + +As it devm_pm_runtime_enable can fail due to memory allocations, it is +best to handle the error. + +Suggested-by: Andy Shevchenko +Signed-off-by: Charles Keepax +Link: https://msgid.link/r/20240124174101.2270249-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cs42l43.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-cs42l43.c b/drivers/spi/spi-cs42l43.c +index d239fc5a49ccc..c1556b6529092 100644 +--- a/drivers/spi/spi-cs42l43.c ++++ b/drivers/spi/spi-cs42l43.c +@@ -244,7 +244,10 @@ static int cs42l43_spi_probe(struct platform_device *pdev) + priv->ctlr->use_gpio_descriptors = true; + priv->ctlr->auto_runtime_pm = true; + +- devm_pm_runtime_enable(priv->dev); ++ ret = devm_pm_runtime_enable(priv->dev); ++ if (ret) ++ return ret; ++ + pm_runtime_idle(priv->dev); + + regmap_write(priv->regmap, CS42L43_TRAN_CONFIG6, CS42L43_FIFO_SIZE - 1); +-- +2.43.0 + diff --git a/queue-6.6/spi-hisi-sfc-v3xx-return-irq_none-if-no-interrupts-w.patch b/queue-6.6/spi-hisi-sfc-v3xx-return-irq_none-if-no-interrupts-w.patch new file mode 100644 index 00000000000..662e61e0976 --- /dev/null +++ b/queue-6.6/spi-hisi-sfc-v3xx-return-irq_none-if-no-interrupts-w.patch @@ -0,0 +1,47 @@ +From 54566dac9ba84f2420d45a9636703962aa04cfb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 15:11:49 +0800 +Subject: spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected + +From: Devyn Liu + +[ Upstream commit de8b6e1c231a95abf95ad097b993d34b31458ec9 ] + +Return IRQ_NONE from the interrupt handler when no interrupt was +detected. Because an empty interrupt will cause a null pointer error: + + Unable to handle kernel NULL pointer dereference at virtual + address 0000000000000008 + Call trace: + complete+0x54/0x100 + hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx] + __handle_irq_event_percpu+0x64/0x1e0 + handle_irq_event+0x7c/0x1cc + +Signed-off-by: Devyn Liu +Link: https://msgid.link/r/20240123071149.917678-1-liudingyuan@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-hisi-sfc-v3xx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/spi/spi-hisi-sfc-v3xx.c b/drivers/spi/spi-hisi-sfc-v3xx.c +index 9d22018f7985f..1301d14483d48 100644 +--- a/drivers/spi/spi-hisi-sfc-v3xx.c ++++ b/drivers/spi/spi-hisi-sfc-v3xx.c +@@ -377,6 +377,11 @@ static const struct spi_controller_mem_ops hisi_sfc_v3xx_mem_ops = { + static irqreturn_t hisi_sfc_v3xx_isr(int irq, void *data) + { + struct hisi_sfc_v3xx_host *host = data; ++ u32 reg; ++ ++ reg = readl(host->regbase + HISI_SFC_V3XX_INT_STAT); ++ if (!reg) ++ return IRQ_NONE; + + hisi_sfc_v3xx_disable_int(host); + +-- +2.43.0 + diff --git a/queue-6.6/spi-intel-pci-add-support-for-arrow-lake-spi-serial-.patch b/queue-6.6/spi-intel-pci-add-support-for-arrow-lake-spi-serial-.patch new file mode 100644 index 00000000000..8afeac2a256 --- /dev/null +++ b/queue-6.6/spi-intel-pci-add-support-for-arrow-lake-spi-serial-.patch @@ -0,0 +1,36 @@ +From 904e59da62d763c7925187267839ab5f442a7be8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 14:00:34 +0200 +Subject: spi: intel-pci: Add support for Arrow Lake SPI serial flash + +From: Mika Westerberg + +[ Upstream commit 8afe3c7fcaf72fca1e7d3dab16a5b7f4201ece17 ] + +This adds the PCI ID of the Arrow Lake and Meteor Lake-S PCH SPI serial +flash controller. This one supports all the necessary commands Linux +SPI-NOR stack requires. + +Signed-off-by: Mika Westerberg +Link: https://msgid.link/r/20240122120034.2664812-3-mika.westerberg@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-intel-pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c +index b9918dcc38027..07d20ca1164c3 100644 +--- a/drivers/spi/spi-intel-pci.c ++++ b/drivers/spi/spi-intel-pci.c +@@ -76,6 +76,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0x7a24), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0x7aa4), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0x7e23), (unsigned long)&cnl_info }, ++ { PCI_VDEVICE(INTEL, 0x7f24), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0x9d24), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0x9da4), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa0a4), (unsigned long)&cnl_info }, +-- +2.43.0 + diff --git a/queue-6.6/spi-sh-msiof-avoid-integer-overflow-in-constants.patch b/queue-6.6/spi-sh-msiof-avoid-integer-overflow-in-constants.patch new file mode 100644 index 00000000000..58205ff7f2f --- /dev/null +++ b/queue-6.6/spi-sh-msiof-avoid-integer-overflow-in-constants.patch @@ -0,0 +1,53 @@ +From 82ad539b45325c6d7d894872d6ffb05a4fd48302 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 10:40:53 +0100 +Subject: spi: sh-msiof: avoid integer overflow in constants + +From: Wolfram Sang + +[ Upstream commit 6500ad28fd5d67d5ca0fee9da73c463090842440 ] + +cppcheck rightfully warned: + + drivers/spi/spi-sh-msiof.c:792:28: warning: Signed integer overflow for expression '7<<29'. [integerOverflow] + sh_msiof_write(p, SIFCTR, SIFCTR_TFWM_1 | SIFCTR_RFWM_1); + +Signed-off-by: Wolfram Sang +Reviewed-by: Geert Uytterhoeven +Link: https://msgid.link/r/20240130094053.10672-1-wsa+renesas@sang-engineering.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sh-msiof.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index cfc3b1ddbd229..6f12e4fb2e2e1 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -136,14 +136,14 @@ struct sh_msiof_spi_priv { + + /* SIFCTR */ + #define SIFCTR_TFWM_MASK GENMASK(31, 29) /* Transmit FIFO Watermark */ +-#define SIFCTR_TFWM_64 (0 << 29) /* Transfer Request when 64 empty stages */ +-#define SIFCTR_TFWM_32 (1 << 29) /* Transfer Request when 32 empty stages */ +-#define SIFCTR_TFWM_24 (2 << 29) /* Transfer Request when 24 empty stages */ +-#define SIFCTR_TFWM_16 (3 << 29) /* Transfer Request when 16 empty stages */ +-#define SIFCTR_TFWM_12 (4 << 29) /* Transfer Request when 12 empty stages */ +-#define SIFCTR_TFWM_8 (5 << 29) /* Transfer Request when 8 empty stages */ +-#define SIFCTR_TFWM_4 (6 << 29) /* Transfer Request when 4 empty stages */ +-#define SIFCTR_TFWM_1 (7 << 29) /* Transfer Request when 1 empty stage */ ++#define SIFCTR_TFWM_64 (0UL << 29) /* Transfer Request when 64 empty stages */ ++#define SIFCTR_TFWM_32 (1UL << 29) /* Transfer Request when 32 empty stages */ ++#define SIFCTR_TFWM_24 (2UL << 29) /* Transfer Request when 24 empty stages */ ++#define SIFCTR_TFWM_16 (3UL << 29) /* Transfer Request when 16 empty stages */ ++#define SIFCTR_TFWM_12 (4UL << 29) /* Transfer Request when 12 empty stages */ ++#define SIFCTR_TFWM_8 (5UL << 29) /* Transfer Request when 8 empty stages */ ++#define SIFCTR_TFWM_4 (6UL << 29) /* Transfer Request when 4 empty stages */ ++#define SIFCTR_TFWM_1 (7UL << 29) /* Transfer Request when 1 empty stage */ + #define SIFCTR_TFUA_MASK GENMASK(26, 20) /* Transmit FIFO Usable Area */ + #define SIFCTR_TFUA_SHIFT 20 + #define SIFCTR_TFUA(i) ((i) << SIFCTR_TFUA_SHIFT) +-- +2.43.0 + diff --git a/queue-6.6/tools-selftests-riscv-fix-compile-warnings-in-mm-tes.patch b/queue-6.6/tools-selftests-riscv-fix-compile-warnings-in-mm-tes.patch new file mode 100644 index 00000000000..a8f9e7a538f --- /dev/null +++ b/queue-6.6/tools-selftests-riscv-fix-compile-warnings-in-mm-tes.patch @@ -0,0 +1,52 @@ +From 5495b1a8d4eb4e1fe36a419cdbbf8f6f926a9c4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 19:58:21 +0100 +Subject: tools: selftests: riscv: Fix compile warnings in mm tests +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Müllner + +[ Upstream commit 12c16919652b5873f524c8b361336ecfa5ce5e6b ] + +When building the mm tests with a riscv32 compiler, we see a range +of shift-count-overflow errors from shifting 1UL by more than 32 bits +in do_mmaps(). Since, the relevant code is only called from code that +is gated by `__riscv_xlen == 64`, we can just apply the same gating +to do_mmaps(). + +Signed-off-by: Christoph Müllner +Reviewed-by: Alexandre Ghiti +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20231123185821.2272504-6-christoph.muellner@vrull.eu +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/riscv/mm/mmap_test.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/riscv/mm/mmap_test.h b/tools/testing/selftests/riscv/mm/mmap_test.h +index 9b8434f62f570..2e0db9c5be6c3 100644 +--- a/tools/testing/selftests/riscv/mm/mmap_test.h ++++ b/tools/testing/selftests/riscv/mm/mmap_test.h +@@ -18,6 +18,8 @@ struct addresses { + int *on_56_addr; + }; + ++// Only works on 64 bit ++#if __riscv_xlen == 64 + static inline void do_mmaps(struct addresses *mmap_addresses) + { + /* +@@ -50,6 +52,7 @@ static inline void do_mmaps(struct addresses *mmap_addresses) + mmap_addresses->on_56_addr = + mmap(on_56_bits, 5 * sizeof(int), prot, flags, 0, 0); + } ++#endif /* __riscv_xlen == 64 */ + + static inline int memory_layout(void) + { +-- +2.43.0 + diff --git a/queue-6.6/tools-selftests-riscv-fix-compile-warnings-in-vector.patch b/queue-6.6/tools-selftests-riscv-fix-compile-warnings-in-vector.patch new file mode 100644 index 00000000000..4f0dd0d7db8 --- /dev/null +++ b/queue-6.6/tools-selftests-riscv-fix-compile-warnings-in-vector.patch @@ -0,0 +1,65 @@ +From 8120a58ca1b67e02c5faa0e69d70a90684a88750 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 19:58:20 +0100 +Subject: tools: selftests: riscv: Fix compile warnings in vector tests +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Müllner + +[ Upstream commit e1baf5e68ed128c1e22ba43e5190526d85de323c ] + +GCC prints a couple of format string warnings when compiling +the vector tests. Let's follow the recommendation in +Documentation/printk-formats.txt to fix these warnings. + +Signed-off-by: Christoph Müllner +Reviewed-by: Alexandre Ghiti +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20231123185821.2272504-5-christoph.muellner@vrull.eu +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/riscv/vector/v_initval_nolibc.c | 2 +- + tools/testing/selftests/riscv/vector/vstate_prctl.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/riscv/vector/v_initval_nolibc.c b/tools/testing/selftests/riscv/vector/v_initval_nolibc.c +index 66764edb0d526..1dd94197da30c 100644 +--- a/tools/testing/selftests/riscv/vector/v_initval_nolibc.c ++++ b/tools/testing/selftests/riscv/vector/v_initval_nolibc.c +@@ -27,7 +27,7 @@ int main(void) + + datap = malloc(MAX_VSIZE); + if (!datap) { +- ksft_test_result_fail("fail to allocate memory for size = %lu\n", MAX_VSIZE); ++ ksft_test_result_fail("fail to allocate memory for size = %d\n", MAX_VSIZE); + exit(-1); + } + +diff --git a/tools/testing/selftests/riscv/vector/vstate_prctl.c b/tools/testing/selftests/riscv/vector/vstate_prctl.c +index b348b475be570..8ad94e08ff4d0 100644 +--- a/tools/testing/selftests/riscv/vector/vstate_prctl.c ++++ b/tools/testing/selftests/riscv/vector/vstate_prctl.c +@@ -68,7 +68,7 @@ int test_and_compare_child(long provided, long expected, int inherit) + } + rc = launch_test(inherit); + if (rc != expected) { +- ksft_test_result_fail("Test failed, check %d != %d\n", rc, ++ ksft_test_result_fail("Test failed, check %d != %ld\n", rc, + expected); + return -2; + } +@@ -87,7 +87,7 @@ int main(void) + pair.key = RISCV_HWPROBE_KEY_IMA_EXT_0; + rc = riscv_hwprobe(&pair, 1, 0, NULL, 0); + if (rc < 0) { +- ksft_test_result_fail("hwprobe() failed with %d\n", rc); ++ ksft_test_result_fail("hwprobe() failed with %ld\n", rc); + return -1; + } + +-- +2.43.0 + diff --git a/queue-6.6/usb-ucsi_acpi-quirk-to-ack-a-connector-change-ack-cm.patch b/queue-6.6/usb-ucsi_acpi-quirk-to-ack-a-connector-change-ack-cm.patch new file mode 100644 index 00000000000..388654cfaf5 --- /dev/null +++ b/queue-6.6/usb-ucsi_acpi-quirk-to-ack-a-connector-change-ack-cm.patch @@ -0,0 +1,146 @@ +From 662efd58a7a018e18e2dd411ad9a90d8c48c0f65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Jan 2024 21:41:23 +0100 +Subject: usb: ucsi_acpi: Quirk to ack a connector change ack cmd + +From: Christian A. Ehrhardt + +[ Upstream commit f3be347ea42dbb0358cd8b2d8dc543a23b70a976 ] + +The PPM on some Dell laptops seems to expect that the ACK_CC_CI +command to clear the connector change notification is in turn +followed by another ACK_CC_CI to acknowledge the ACK_CC_CI command +itself. This is in violation of the UCSI spec that states: + + "The only notification that is not acknowledged by the OPM is + the command completion notification for the ACK_CC_CI or the + PPM_RESET command." + +Add a quirk to send this ack anyway. +Apply the quirk to all Dell systems. + +On the first command that acks a connector change send a dummy +command to determine if it runs into a timeout. Only activate +the quirk if it does. This ensure that we do not break Dell +systems that do not need the quirk. + +Signed-off-by: "Christian A. Ehrhardt" +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20240121204123.275441-4-lk@c--e.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi_acpi.c | 71 ++++++++++++++++++++++++++++-- + 1 file changed, 68 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c +index fa222080887d5..928eacbeb21ac 100644 +--- a/drivers/usb/typec/ucsi/ucsi_acpi.c ++++ b/drivers/usb/typec/ucsi/ucsi_acpi.c +@@ -25,6 +25,8 @@ struct ucsi_acpi { + unsigned long flags; + guid_t guid; + u64 cmd; ++ bool dell_quirk_probed; ++ bool dell_quirk_active; + }; + + static int ucsi_acpi_dsm(struct ucsi_acpi *ua, int func) +@@ -126,12 +128,73 @@ static const struct ucsi_operations ucsi_zenbook_ops = { + .async_write = ucsi_acpi_async_write + }; + +-static const struct dmi_system_id zenbook_dmi_id[] = { ++/* ++ * Some Dell laptops expect that an ACK command with the ++ * UCSI_ACK_CONNECTOR_CHANGE bit set is followed by a (separate) ++ * ACK command that only has the UCSI_ACK_COMMAND_COMPLETE bit set. ++ * If this is not done events are not delivered to OSPM and ++ * subsequent commands will timeout. ++ */ ++static int ++ucsi_dell_sync_write(struct ucsi *ucsi, unsigned int offset, ++ const void *val, size_t val_len) ++{ ++ struct ucsi_acpi *ua = ucsi_get_drvdata(ucsi); ++ u64 cmd = *(u64 *)val, ack = 0; ++ int ret; ++ ++ if (UCSI_COMMAND(cmd) == UCSI_ACK_CC_CI && ++ cmd & UCSI_ACK_CONNECTOR_CHANGE) ++ ack = UCSI_ACK_CC_CI | UCSI_ACK_COMMAND_COMPLETE; ++ ++ ret = ucsi_acpi_sync_write(ucsi, offset, val, val_len); ++ if (ret != 0) ++ return ret; ++ if (ack == 0) ++ return ret; ++ ++ if (!ua->dell_quirk_probed) { ++ ua->dell_quirk_probed = true; ++ ++ cmd = UCSI_GET_CAPABILITY; ++ ret = ucsi_acpi_sync_write(ucsi, UCSI_CONTROL, &cmd, ++ sizeof(cmd)); ++ if (ret == 0) ++ return ucsi_acpi_sync_write(ucsi, UCSI_CONTROL, ++ &ack, sizeof(ack)); ++ if (ret != -ETIMEDOUT) ++ return ret; ++ ++ ua->dell_quirk_active = true; ++ dev_err(ua->dev, "Firmware bug: Additional ACK required after ACKing a connector change.\n"); ++ dev_err(ua->dev, "Firmware bug: Enabling workaround\n"); ++ } ++ ++ if (!ua->dell_quirk_active) ++ return ret; ++ ++ return ucsi_acpi_sync_write(ucsi, UCSI_CONTROL, &ack, sizeof(ack)); ++} ++ ++static const struct ucsi_operations ucsi_dell_ops = { ++ .read = ucsi_acpi_read, ++ .sync_write = ucsi_dell_sync_write, ++ .async_write = ucsi_acpi_async_write ++}; ++ ++static const struct dmi_system_id ucsi_acpi_quirks[] = { + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"), + }, ++ .driver_data = (void *)&ucsi_zenbook_ops, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ }, ++ .driver_data = (void *)&ucsi_dell_ops, + }, + { } + }; +@@ -160,6 +223,7 @@ static int ucsi_acpi_probe(struct platform_device *pdev) + { + struct acpi_device *adev = ACPI_COMPANION(&pdev->dev); + const struct ucsi_operations *ops = &ucsi_acpi_ops; ++ const struct dmi_system_id *id; + struct ucsi_acpi *ua; + struct resource *res; + acpi_status status; +@@ -189,8 +253,9 @@ static int ucsi_acpi_probe(struct platform_device *pdev) + init_completion(&ua->complete); + ua->dev = &pdev->dev; + +- if (dmi_check_system(zenbook_dmi_id)) +- ops = &ucsi_zenbook_ops; ++ id = dmi_first_match(ucsi_acpi_quirks); ++ if (id) ++ ops = id->driver_data; + + ua->ucsi = ucsi_create(&pdev->dev, ops); + if (IS_ERR(ua->ucsi)) +-- +2.43.0 + diff --git a/queue-6.6/virtio-blk-ensure-no-requests-in-virtqueues-before-d.patch b/queue-6.6/virtio-blk-ensure-no-requests-in-virtqueues-before-d.patch new file mode 100644 index 00000000000..72a9f5070f3 --- /dev/null +++ b/queue-6.6/virtio-blk-ensure-no-requests-in-virtqueues-before-d.patch @@ -0,0 +1,64 @@ +From a8c6724bcbf66d544faea9d0156b18fcbbfc49e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 16:52:50 +0800 +Subject: virtio-blk: Ensure no requests in virtqueues before deleting vqs. + +From: Yi Sun + +[ Upstream commit 4ce6e2db00de8103a0687fb0f65fd17124a51aaa ] + +Ensure no remaining requests in virtqueues before resetting vdev and +deleting virtqueues. Otherwise these requests will never be completed. +It may cause the system to become unresponsive. + +Function blk_mq_quiesce_queue() can ensure that requests have become +in_flight status, but it cannot guarantee that requests have been +processed by the device. Virtqueues should never be deleted before +all requests become complete status. + +Function blk_mq_freeze_queue() ensure that all requests in virtqueues +become complete status. And no requests can enter in virtqueues. + +Signed-off-by: Yi Sun +Reviewed-by: Stefan Hajnoczi +Link: https://lore.kernel.org/r/20240129085250.1550594-1-yi.sun@unisoc.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 225c86c74d4e9..41b2fd7e1b9e5 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -1629,14 +1629,15 @@ static int virtblk_freeze(struct virtio_device *vdev) + { + struct virtio_blk *vblk = vdev->priv; + ++ /* Ensure no requests in virtqueues before deleting vqs. */ ++ blk_mq_freeze_queue(vblk->disk->queue); ++ + /* Ensure we don't receive any more interrupts */ + virtio_reset_device(vdev); + + /* Make sure no work handler is accessing the device. */ + flush_work(&vblk->config_work); + +- blk_mq_quiesce_queue(vblk->disk->queue); +- + vdev->config->del_vqs(vdev); + kfree(vblk->vqs); + +@@ -1654,7 +1655,7 @@ static int virtblk_restore(struct virtio_device *vdev) + + virtio_device_ready(vdev); + +- blk_mq_unquiesce_queue(vblk->disk->queue); ++ blk_mq_unfreeze_queue(vblk->disk->queue); + return 0; + } + #endif +-- +2.43.0 + diff --git a/queue-6.6/wifi-cfg80211-fix-missing-interfaces-when-dumping.patch b/queue-6.6/wifi-cfg80211-fix-missing-interfaces-when-dumping.patch new file mode 100644 index 00000000000..ed1d12e5c05 --- /dev/null +++ b/queue-6.6/wifi-cfg80211-fix-missing-interfaces-when-dumping.patch @@ -0,0 +1,71 @@ +From fd34fd6c79803a47063ce00a5d51ab0b62736474 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 14:22:57 +0000 +Subject: wifi: cfg80211: fix missing interfaces when dumping + +From: Michal Kazior + +[ Upstream commit a6e4f85d3820d00694ed10f581f4c650445dbcda ] + +The nl80211_dump_interface() supports resumption +in case nl80211_send_iface() doesn't have the +resources to complete its work. + +The logic would store the progress as iteration +offsets for rdev and wdev loops. + +However the logic did not properly handle +resumption for non-last rdev. Assuming a system +with 2 rdevs, with 2 wdevs each, this could +happen: + + dump(cb=[0, 0]): + if_start=cb[1] (=0) + send rdev0.wdev0 -> ok + send rdev0.wdev1 -> yield + cb[1] = 1 + + dump(cb=[0, 1]): + if_start=cb[1] (=1) + send rdev0.wdev1 -> ok + // since if_start=1 the rdev0.wdev0 got skipped + // through if_idx < if_start + send rdev1.wdev1 -> ok + +The if_start needs to be reset back to 0 upon wdev +loop end. + +The problem is actually hard to hit on a desktop, +and even on most routers. The prerequisites for +this manifesting was: + - more than 1 wiphy + - a few handful of interfaces + - dump without rdev or wdev filter + +I was seeing this with 4 wiphys 9 interfaces each. +It'd miss 6 interfaces from the last wiphy +reported to userspace. + +Signed-off-by: Michal Kazior +Link: https://msgid.link/20240116142340.89678-1-kazikcz@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 0b0dfecedc50a..c8bfacd5c8f3d 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -4012,6 +4012,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback * + if_idx++; + } + ++ if_start = 0; + wp_idx++; + } + out: +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-do-not-announce-epcs-support.patch b/queue-6.6/wifi-iwlwifi-do-not-announce-epcs-support.patch new file mode 100644 index 00000000000..ecad2982e2c --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-do-not-announce-epcs-support.patch @@ -0,0 +1,56 @@ +From 1b7b640bb00a531d237981beec98f5820ac9944b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 16:17:30 +0200 +Subject: wifi: iwlwifi: do not announce EPCS support + +From: Benjamin Berg + +[ Upstream commit a23c0af103e184bb1252dddddda040f6641bea7b ] + +mac80211 does not have proper support for EPCS currently as that would +require changing the ECDA parameters if EPCS (Emergency Preparedness +Communications Service) is in use. As such, do not announce support for +it in the capabilities. + +Signed-off-by: Benjamin Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240201155157.59d71656addc.Idde91b3018239c49fc6ed231b411d05354fb9fb1@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +index e3120ab893f4e..878d9416a1085 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +@@ -668,7 +668,6 @@ static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = { + .has_eht = true, + .eht_cap_elem = { + .mac_cap_info[0] = +- IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS | + IEEE80211_EHT_MAC_CAP0_OM_CONTROL | + IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 | + IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2, +@@ -792,7 +791,6 @@ static const struct ieee80211_sband_iftype_data iwl_he_eht_capa[] = { + .has_eht = true, + .eht_cap_elem = { + .mac_cap_info[0] = +- IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS | + IEEE80211_EHT_MAC_CAP0_OM_CONTROL | + IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 | + IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2, +@@ -1003,8 +1001,7 @@ iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans, + if (CSR_HW_REV_TYPE(trans->hw_rev) == IWL_CFG_MAC_TYPE_GL && + iftype_data->eht_cap.has_eht) { + iftype_data->eht_cap.eht_cap_elem.mac_cap_info[0] &= +- ~(IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS | +- IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 | ++ ~(IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE1 | + IEEE80211_EHT_MAC_CAP0_TRIG_TXOP_SHARING_MODE2); + iftype_data->eht_cap.eht_cap_elem.phy_cap_info[3] &= + ~(IEEE80211_EHT_PHY_CAP0_PARTIAL_BW_UL_MU_MIMO | +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-accept-broadcast-probe-responses-on-6-.patch b/queue-6.6/wifi-mac80211-accept-broadcast-probe-responses-on-6-.patch new file mode 100644 index 00000000000..3d06bc37e18 --- /dev/null +++ b/queue-6.6/wifi-mac80211-accept-broadcast-probe-responses-on-6-.patch @@ -0,0 +1,97 @@ +From ecaee91d29c4b6bd10fca35f00266b55c64d0047 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 20:09:07 +0100 +Subject: wifi: mac80211: accept broadcast probe responses on 6 GHz + +From: Johannes Berg + +[ Upstream commit 62a6183c13319e4d2227473a04abd104c4f56dcf ] + +On the 6 GHz band, probe responses are sent as broadcast to +optimise medium usage. However, without OCE configuration +we weren't accepting them, which is wrong, even if wpa_s is +by default enabling OCE. Accept them without the OCE config +as well. + +Link: https://msgid.link/20240129200907.5a89c2821897.I92e9dfa0f9b350bc7f37dd4bb38031d156d78d8a@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/scan.c | 30 ++++++++++++++++++------------ + 1 file changed, 18 insertions(+), 12 deletions(-) + +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index 68ec2124c3db5..a52813f2b08cb 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -9,7 +9,7 @@ + * Copyright 2007, Michael Wu + * Copyright 2013-2015 Intel Mobile Communications GmbH + * Copyright 2016-2017 Intel Deutschland GmbH +- * Copyright (C) 2018-2023 Intel Corporation ++ * Copyright (C) 2018-2024 Intel Corporation + */ + + #include +@@ -222,14 +222,18 @@ ieee80211_bss_info_update(struct ieee80211_local *local, + } + + static bool ieee80211_scan_accept_presp(struct ieee80211_sub_if_data *sdata, ++ struct ieee80211_channel *channel, + u32 scan_flags, const u8 *da) + { + if (!sdata) + return false; +- /* accept broadcast for OCE */ +- if (scan_flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP && +- is_broadcast_ether_addr(da)) ++ ++ /* accept broadcast on 6 GHz and for OCE */ ++ if (is_broadcast_ether_addr(da) && ++ (channel->band == NL80211_BAND_6GHZ || ++ scan_flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP)) + return true; ++ + if (scan_flags & NL80211_SCAN_FLAG_RANDOM_ADDR) + return true; + return ether_addr_equal(da, sdata->vif.addr); +@@ -278,6 +282,12 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb) + wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work, 0); + } + ++ channel = ieee80211_get_channel_khz(local->hw.wiphy, ++ ieee80211_rx_status_to_khz(rx_status)); ++ ++ if (!channel || channel->flags & IEEE80211_CHAN_DISABLED) ++ return; ++ + if (ieee80211_is_probe_resp(mgmt->frame_control)) { + struct cfg80211_scan_request *scan_req; + struct cfg80211_sched_scan_request *sched_scan_req; +@@ -295,19 +305,15 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb) + /* ignore ProbeResp to foreign address or non-bcast (OCE) + * unless scanning with randomised address + */ +- if (!ieee80211_scan_accept_presp(sdata1, scan_req_flags, ++ if (!ieee80211_scan_accept_presp(sdata1, channel, ++ scan_req_flags, + mgmt->da) && +- !ieee80211_scan_accept_presp(sdata2, sched_scan_req_flags, ++ !ieee80211_scan_accept_presp(sdata2, channel, ++ sched_scan_req_flags, + mgmt->da)) + return; + } + +- channel = ieee80211_get_channel_khz(local->hw.wiphy, +- ieee80211_rx_status_to_khz(rx_status)); +- +- if (!channel || channel->flags & IEEE80211_CHAN_DISABLED) +- return; +- + bss = ieee80211_bss_info_update(local, rx_status, + mgmt, skb->len, + channel); +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-adding-missing-drv_mgd_complete_tx-cal.patch b/queue-6.6/wifi-mac80211-adding-missing-drv_mgd_complete_tx-cal.patch new file mode 100644 index 00000000000..b15d330fa5b --- /dev/null +++ b/queue-6.6/wifi-mac80211-adding-missing-drv_mgd_complete_tx-cal.patch @@ -0,0 +1,35 @@ +From dc698caa38b6dc6325725503ed4fe0db1a448460 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 16:48:23 +0100 +Subject: wifi: mac80211: adding missing drv_mgd_complete_tx() call + +From: Johannes Berg + +[ Upstream commit c042600c17d8c490279f0ae2baee29475fe8047d ] + +There's a call to drv_mgd_prepare_tx() and so there should +be one to drv_mgd_complete_tx(), but on this path it's not. +Add it. + +Link: https://msgid.link/20240131164824.2f0922a514e1.I5aac89b93bcead88c374187d70cad0599d29d2c8@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index d9e716f38b0e9..c6044ab4e7fc1 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -7800,6 +7800,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, + ieee80211_report_disconnect(sdata, frame_buf, + sizeof(frame_buf), true, + req->reason_code, false); ++ drv_mgd_complete_tx(sdata->local, sdata, &info); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-fix-race-condition-on-enabling-fast-xm.patch b/queue-6.6/wifi-mac80211-fix-race-condition-on-enabling-fast-xm.patch new file mode 100644 index 00000000000..a728136d740 --- /dev/null +++ b/queue-6.6/wifi-mac80211-fix-race-condition-on-enabling-fast-xm.patch @@ -0,0 +1,53 @@ +From 4092f784b72330299e18ad209ae7f5ad8090587f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 19:10:59 +0100 +Subject: wifi: mac80211: fix race condition on enabling fast-xmit + +From: Felix Fietkau + +[ Upstream commit bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f ] + +fast-xmit must only be enabled after the sta has been uploaded to the driver, +otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls +to the driver, leading to potential crashes because of uninitialized drv_priv +data. +Add a missing sta->uploaded check and re-check fast xmit after inserting a sta. + +Signed-off-by: Felix Fietkau +Link: https://msgid.link/20240104181059.84032-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 2 ++ + net/mac80211/tx.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index e112300caaf75..c61eb867bb4a7 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -914,6 +914,8 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) + if (ieee80211_vif_is_mesh(&sdata->vif)) + mesh_accept_plinks_update(sdata); + ++ ieee80211_check_fast_xmit(sta); ++ + return 0; + out_remove: + if (sta->sta.valid_links) +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 5ab9594ae119e..5c6c5254d987f 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -3034,7 +3034,7 @@ void ieee80211_check_fast_xmit(struct sta_info *sta) + sdata->vif.type == NL80211_IFTYPE_STATION) + goto out; + +- if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED)) ++ if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED) || !sta->uploaded) + goto out; + + if (test_sta_flag(sta, WLAN_STA_PS_STA) || +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-set-station-rx-nss-on-reconfig.patch b/queue-6.6/wifi-mac80211-set-station-rx-nss-on-reconfig.patch new file mode 100644 index 00000000000..9650a06a8c6 --- /dev/null +++ b/queue-6.6/wifi-mac80211-set-station-rx-nss-on-reconfig.patch @@ -0,0 +1,36 @@ +From 6e6eb05d55889acae8a388aaa8c7927d09961a7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 15:53:55 +0100 +Subject: wifi: mac80211: set station RX-NSS on reconfig + +From: Johannes Berg + +[ Upstream commit dd6c064cfc3fc18d871107c6f5db8837e88572e4 ] + +When a station is added/reconfigured by userspace, e.g. a TDLS +peer or a SoftAP client STA, rx_nss is currently not always set, +so that it might be left zero. Set it up properly. + +Link: https://msgid.link/20240129155354.98f148a3d654.I193a02155f557ea54dc9d0232da66cf96734119a@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index f7cb50b0dd4ed..daf5212e283dd 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -1887,6 +1887,8 @@ static int sta_link_apply_parameters(struct ieee80211_local *local, + sband->band); + } + ++ ieee80211_sta_set_rx_nss(link_sta); ++ + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.6/xhci-fix-possible-null-pointer-deref-during-xhci-urb.patch b/queue-6.6/xhci-fix-possible-null-pointer-deref-during-xhci-urb.patch new file mode 100644 index 00000000000..cb855bb5b3b --- /dev/null +++ b/queue-6.6/xhci-fix-possible-null-pointer-deref-during-xhci-urb.patch @@ -0,0 +1,98 @@ +From 7cf220348e0433cc6254ec3b8f891f3fc2a941b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 17:06:47 +0200 +Subject: xhci: fix possible null pointer deref during xhci urb enqueue + +From: Mathias Nyman + +[ Upstream commit e2e2aacf042f52854c92775b7800ba668e0bdfe4 ] + +There is a short gap between urb being submitted and actually added to the +endpoint queue (linked). If the device is disconnected during this time +then usb core is not yet aware of the pending urb, and device may be freed +just before xhci_urq_enqueue() continues, dereferencing the freed device. + +Freeing the device is protected by the xhci spinlock, so make sure we take +and keep the lock while checking that device exists, dereference it, and +add the urb to the queue. + +Remove the unnecessary URB check, usb core checks it before calling +xhci_urb_enqueue() + +Suggested-by: Kuen-Han Tsai +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20231201150647.1307406-20-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.c | 40 +++++++++++++++++++++++----------------- + 1 file changed, 23 insertions(+), 17 deletions(-) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 132b76fa7ca60..e39c5ba9b7c76 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1498,24 +1498,7 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + struct urb_priv *urb_priv; + int num_tds; + +- if (!urb) +- return -EINVAL; +- ret = xhci_check_args(hcd, urb->dev, urb->ep, +- true, true, __func__); +- if (ret <= 0) +- return ret ? ret : -EINVAL; +- +- slot_id = urb->dev->slot_id; + ep_index = xhci_get_endpoint_index(&urb->ep->desc); +- ep_state = &xhci->devs[slot_id]->eps[ep_index].ep_state; +- +- if (!HCD_HW_ACCESSIBLE(hcd)) +- return -ESHUTDOWN; +- +- if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR) { +- xhci_dbg(xhci, "Can't queue urb, port error, link inactive\n"); +- return -ENODEV; +- } + + if (usb_endpoint_xfer_isoc(&urb->ep->desc)) + num_tds = urb->number_of_packets; +@@ -1554,12 +1537,35 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + + spin_lock_irqsave(&xhci->lock, flags); + ++ ret = xhci_check_args(hcd, urb->dev, urb->ep, ++ true, true, __func__); ++ if (ret <= 0) { ++ ret = ret ? ret : -EINVAL; ++ goto free_priv; ++ } ++ ++ slot_id = urb->dev->slot_id; ++ ++ if (!HCD_HW_ACCESSIBLE(hcd)) { ++ ret = -ESHUTDOWN; ++ goto free_priv; ++ } ++ ++ if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR) { ++ xhci_dbg(xhci, "Can't queue urb, port error, link inactive\n"); ++ ret = -ENODEV; ++ goto free_priv; ++ } ++ + if (xhci->xhc_state & XHCI_STATE_DYING) { + xhci_dbg(xhci, "Ep 0x%x: URB %p submitted for non-responsive xHCI host.\n", + urb->ep->desc.bEndpointAddress, urb); + ret = -ESHUTDOWN; + goto free_priv; + } ++ ++ ep_state = &xhci->devs[slot_id]->eps[ep_index].ep_state; ++ + if (*ep_state & (EP_GETTING_STREAMS | EP_GETTING_NO_STREAMS)) { + xhci_warn(xhci, "WARN: Can't enqueue URB, ep in streams transition state %x\n", + *ep_state); +-- +2.43.0 +