From: Sasha Levin Date: Tue, 8 Oct 2024 06:02:23 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v6.6.55~42 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5521a5a86bba48fe8a7de52e3707dacb6335dfb2;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/acpi-battery-fix-possible-crash-when-unregistering-a.patch b/queue-5.10/acpi-battery-fix-possible-crash-when-unregistering-a.patch new file mode 100644 index 00000000000..35014eccac2 --- /dev/null +++ b/queue-5.10/acpi-battery-fix-possible-crash-when-unregistering-a.patch @@ -0,0 +1,69 @@ +From 918af6e53ecf88775cf9f63a94f5881b6a1c9e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 23:28:34 +0200 +Subject: ACPI: battery: Fix possible crash when unregistering a battery hook + +From: Armin Wolf + +[ Upstream commit 76959aff14a0012ad6b984ec7686d163deccdc16 ] + +When a battery hook returns an error when adding a new battery, then +the battery hook is automatically unregistered. +However the battery hook provider cannot know that, so it will later +call battery_hook_unregister() on the already unregistered battery +hook, resulting in a crash. + +Fix this by using the list head to mark already unregistered battery +hooks as already being unregistered so that they can be ignored by +battery_hook_unregister(). + +Fixes: fa93854f7a7e ("battery: Add the battery hooking API") +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20241001212835.341788-3-W_Armin@gmx.de +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 6d6ad6be58f4a..f9fb092f33a26 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -706,7 +706,7 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) + list_for_each_entry(battery, &acpi_battery_list, list) { + hook->remove_battery(battery->bat); + } +- list_del(&hook->list); ++ list_del_init(&hook->list); + + pr_info("extension unregistered: %s\n", hook->name); + } +@@ -714,7 +714,14 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) + void battery_hook_unregister(struct acpi_battery_hook *hook) + { + mutex_lock(&hook_mutex); +- battery_hook_unregister_unlocked(hook); ++ /* ++ * Ignore already unregistered battery hooks. This might happen ++ * if a battery hook was previously unloaded due to an error when ++ * adding a new battery. ++ */ ++ if (!list_empty(&hook->list)) ++ battery_hook_unregister_unlocked(hook); ++ + mutex_unlock(&hook_mutex); + } + EXPORT_SYMBOL_GPL(battery_hook_unregister); +@@ -724,7 +731,6 @@ void battery_hook_register(struct acpi_battery_hook *hook) + struct acpi_battery *battery; + + mutex_lock(&hook_mutex); +- INIT_LIST_HEAD(&hook->list); + list_add(&hook->list, &battery_hook_list); + /* + * Now that the driver is registered, we need +-- +2.43.0 + diff --git a/queue-5.10/acpi-battery-simplify-battery-hook-locking.patch b/queue-5.10/acpi-battery-simplify-battery-hook-locking.patch new file mode 100644 index 00000000000..99264d6a8fa --- /dev/null +++ b/queue-5.10/acpi-battery-simplify-battery-hook-locking.patch @@ -0,0 +1,95 @@ +From cf9aaff23eede3b03b560819d6b81a7dab5c3c63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 23:28:33 +0200 +Subject: ACPI: battery: Simplify battery hook locking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 86309cbed26139e1caae7629dcca1027d9a28e75 ] + +Move the conditional locking from __battery_hook_unregister() +into battery_hook_unregister() and rename the low-level function +to simplify the locking during battery hook removal. + +Reviewed-by: Ilpo Järvinen +Reviewed-by: Pali Rohár +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20241001212835.341788-2-W_Armin@gmx.de +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 76959aff14a0 ("ACPI: battery: Fix possible crash when unregistering a battery hook") +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 2e1462b8929c0..6d6ad6be58f4a 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -695,27 +695,27 @@ static LIST_HEAD(acpi_battery_list); + static LIST_HEAD(battery_hook_list); + static DEFINE_MUTEX(hook_mutex); + +-static void __battery_hook_unregister(struct acpi_battery_hook *hook, int lock) ++static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) + { + struct acpi_battery *battery; ++ + /* + * In order to remove a hook, we first need to + * de-register all the batteries that are registered. + */ +- if (lock) +- mutex_lock(&hook_mutex); + list_for_each_entry(battery, &acpi_battery_list, list) { + hook->remove_battery(battery->bat); + } + list_del(&hook->list); +- if (lock) +- mutex_unlock(&hook_mutex); ++ + pr_info("extension unregistered: %s\n", hook->name); + } + + void battery_hook_unregister(struct acpi_battery_hook *hook) + { +- __battery_hook_unregister(hook, 1); ++ mutex_lock(&hook_mutex); ++ battery_hook_unregister_unlocked(hook); ++ mutex_unlock(&hook_mutex); + } + EXPORT_SYMBOL_GPL(battery_hook_unregister); + +@@ -741,7 +741,7 @@ void battery_hook_register(struct acpi_battery_hook *hook) + * hooks. + */ + pr_err("extension failed to load: %s", hook->name); +- __battery_hook_unregister(hook, 0); ++ battery_hook_unregister_unlocked(hook); + goto end; + } + } +@@ -778,7 +778,7 @@ static void battery_hook_add_battery(struct acpi_battery *battery) + */ + pr_err("error in extension, unloading: %s", + hook_node->name); +- __battery_hook_unregister(hook_node, 0); ++ battery_hook_unregister_unlocked(hook_node); + } + } + mutex_unlock(&hook_mutex); +@@ -811,7 +811,7 @@ static void __exit battery_hook_exit(void) + * need to remove the hooks. + */ + list_for_each_entry_safe(hook, ptr, &battery_hook_list, list) { +- __battery_hook_unregister(hook, 1); ++ battery_hook_unregister(hook); + } + mutex_destroy(&hook_mutex); + } +-- +2.43.0 + diff --git a/queue-5.10/arm64-add-cortex-715-cpu-part-definition.patch b/queue-5.10/arm64-add-cortex-715-cpu-part-definition.patch new file mode 100644 index 00000000000..6d5ccbfb063 --- /dev/null +++ b/queue-5.10/arm64-add-cortex-715-cpu-part-definition.patch @@ -0,0 +1,51 @@ +From d5d06982a8356064c2d8c6a9ae2b82a18927c0fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 13:17:07 +0100 +Subject: arm64: Add Cortex-715 CPU part definition + +From: Anshuman Khandual + +[ Upstream commit 07e39e60bbf0ccd5f895568e1afca032193705c0 ] + +Add the CPU Partnumbers for the new Arm designs. + +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Suzuki K Poulose +Cc: James Morse +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Acked-by: Catalin Marinas +Signed-off-by: Anshuman Khandual +Link: https://lore.kernel.org/r/20221116140915.356601-2-anshuman.khandual@arm.com +Signed-off-by: Will Deacon +[ Mark: Trivial backport ] +Signed-off-by: Mark Rutland +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/cputype.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 91890e9fcb6c8..395d153c565d4 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -81,6 +81,7 @@ + #define ARM_CPU_PART_CORTEX_A510 0xD46 + #define ARM_CPU_PART_CORTEX_A520 0xD80 + #define ARM_CPU_PART_CORTEX_A710 0xD47 ++#define ARM_CPU_PART_CORTEX_A715 0xD4D + #define ARM_CPU_PART_CORTEX_X2 0xD48 + #define ARM_CPU_PART_NEOVERSE_N2 0xD49 + #define ARM_CPU_PART_CORTEX_A78C 0xD4B +@@ -141,6 +142,7 @@ + #define MIDR_CORTEX_A510 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A510) + #define MIDR_CORTEX_A520 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A520) + #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) ++#define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715) + #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) + #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) + #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) +-- +2.43.0 + diff --git a/queue-5.10/arm64-cputype-add-neoverse-n3-definitions.patch b/queue-5.10/arm64-cputype-add-neoverse-n3-definitions.patch new file mode 100644 index 00000000000..045a0ee9487 --- /dev/null +++ b/queue-5.10/arm64-cputype-add-neoverse-n3-definitions.patch @@ -0,0 +1,52 @@ +From d6fe3ba7f4215d15c267f4119e2797116b47b091 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 13:17:08 +0100 +Subject: arm64: cputype: Add Neoverse-N3 definitions + +From: Mark Rutland + +[ Upstream commit 924725707d80bc2588cefafef76ff3f164d299bc ] + +Add cputype definitions for Neoverse-N3. These will be used for errata +detection in subsequent patches. + +These values can be found in Table A-261 ("MIDR_EL1 bit descriptions") +in issue 02 of the Neoverse-N3 TRM, which can be found at: + + https://developer.arm.com/documentation/107997/0000/?lang=en + +Signed-off-by: Mark Rutland +Cc: James Morse +Cc: Will Deacon +Link: https://lore.kernel.org/r/20240930111705.3352047-2-mark.rutland@arm.com +Signed-off-by: Catalin Marinas +[ Mark: trivial backport ] +Signed-off-by: Mark Rutland +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/cputype.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 395d153c565d4..d8305b4657d2e 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -93,6 +93,7 @@ + #define ARM_CPU_PART_NEOVERSE_V3 0xD84 + #define ARM_CPU_PART_CORTEX_X925 0xD85 + #define ARM_CPU_PART_CORTEX_A725 0xD87 ++#define ARM_CPU_PART_NEOVERSE_N3 0xD8E + + #define APM_CPU_PART_POTENZA 0x000 + +@@ -154,6 +155,7 @@ + #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) + #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) + #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++#define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +-- +2.43.0 + diff --git a/queue-5.10/arm64-errata-expand-speculative-ssbs-workaround-once.patch b/queue-5.10/arm64-errata-expand-speculative-ssbs-workaround-once.patch new file mode 100644 index 00000000000..b46a10434fb --- /dev/null +++ b/queue-5.10/arm64-errata-expand-speculative-ssbs-workaround-once.patch @@ -0,0 +1,114 @@ +From 2271e587ccef938f6815cf1488397babb9ce4f8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 13:17:09 +0100 +Subject: arm64: errata: Expand speculative SSBS workaround once more + +From: Mark Rutland + +[ Upstream commit 081eb7932c2b244f63317a982c5e3990e2c7fbdd ] + +A number of Arm Ltd CPUs suffer from errata whereby an MSR to the SSBS +special-purpose register does not affect subsequent speculative +instructions, permitting speculative store bypassing for a window of +time. + +We worked around this for a number of CPUs in commits: + +* 7187bb7d0b5c7dfa ("arm64: errata: Add workaround for Arm errata 3194386 and 3312417") +* 75b3c43eab594bfb ("arm64: errata: Expand speculative SSBS workaround") +* 145502cac7ea70b5 ("arm64: errata: Expand speculative SSBS workaround (again)") + +Since then, a (hopefully final) batch of updates have been published, +with two more affected CPUs. For the affected CPUs the existing +mitigation is sufficient, as described in their respective Software +Developer Errata Notice (SDEN) documents: + +* Cortex-A715 (MP148) SDEN v15.0, erratum 3456084 + https://developer.arm.com/documentation/SDEN-2148827/1500/ + +* Neoverse-N3 (MP195) SDEN v5.0, erratum 3456111 + https://developer.arm.com/documentation/SDEN-3050973/0500/ + +Enable the existing mitigation by adding the relevant MIDRs to +erratum_spec_ssbs_list, and update silicon-errata.rst and the +Kconfig text accordingly. + +Signed-off-by: Mark Rutland +Cc: James Morse +Cc: Will Deacon +Link: https://lore.kernel.org/r/20240930111705.3352047-3-mark.rutland@arm.com +Signed-off-by: Catalin Marinas +[ Mark: fix conflict in silicon-errata.rst, handle move ] +Signed-off-by: Mark Rutland +Signed-off-by: Sasha Levin +--- + Documentation/arm64/silicon-errata.rst | 4 ++++ + arch/arm64/Kconfig | 2 ++ + arch/arm64/kernel/cpu_errata.c | 2 ++ + 3 files changed, 8 insertions(+) + +diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst +index 14eef7e93614b..9ee1349145573 100644 +--- a/Documentation/arm64/silicon-errata.rst ++++ b/Documentation/arm64/silicon-errata.rst +@@ -108,6 +108,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A710 | #3324338 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A720 | #3456091 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A725 | #3456106 | ARM64_ERRATUM_3194386 | +@@ -134,6 +136,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N2 | #3324339 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-N3 | #3456111 | ARM64_ERRATUM_3194386 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V1 | #3324341 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V2 | #3324336 | ARM64_ERRATUM_3194386 | +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 9fdf8b0364288..cd13f02d579b1 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -703,6 +703,7 @@ config ARM64_ERRATUM_3194386 + * ARM Cortex-A78C erratum 3324346 + * ARM Cortex-A78C erratum 3324347 + * ARM Cortex-A710 erratam 3324338 ++ * ARM Cortex-A715 errartum 3456084 + * ARM Cortex-A720 erratum 3456091 + * ARM Cortex-A725 erratum 3456106 + * ARM Cortex-X1 erratum 3324344 +@@ -713,6 +714,7 @@ config ARM64_ERRATUM_3194386 + * ARM Cortex-X925 erratum 3324334 + * ARM Neoverse-N1 erratum 3324349 + * ARM Neoverse N2 erratum 3324339 ++ * ARM Neoverse-N3 erratum 3456111 + * ARM Neoverse-V1 erratum 3324341 + * ARM Neoverse V2 erratum 3324336 + * ARM Neoverse-V3 erratum 3312417 +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 6e63dc8f0e8c6..a77fcc9e7c723 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -371,6 +371,7 @@ static const struct midr_range erratum_spec_ssbs_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A715), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A720), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A725), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), +@@ -381,6 +382,7 @@ static const struct midr_range erratum_spec_ssbs_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_X925), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N3), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), +-- +2.43.0 + diff --git a/queue-5.10/btrfs-fix-a-null-pointer-dereference-when-failed-to-.patch b/queue-5.10/btrfs-fix-a-null-pointer-dereference-when-failed-to-.patch new file mode 100644 index 00000000000..51d88cbe437 --- /dev/null +++ b/queue-5.10/btrfs-fix-a-null-pointer-dereference-when-failed-to-.patch @@ -0,0 +1,95 @@ +From a8f623be9c15c9820e4a9a8a75156f6c3cabc08e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Sep 2024 08:05:58 +0930 +Subject: btrfs: fix a NULL pointer dereference when failed to start a new + trasacntion + +From: Qu Wenruo + +[ Upstream commit c3b47f49e83197e8dffd023ec568403bcdbb774b ] + +[BUG] +Syzbot reported a NULL pointer dereference with the following crash: + + FAULT_INJECTION: forcing a failure. + start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676 + prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642 + relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678 + ... + BTRFS info (device loop0): balance: ended with status: -12 + Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI + KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667] + RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926 + Call Trace: + + commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496 + btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430 + del_balance_item fs/btrfs/volumes.c:3678 [inline] + reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742 + btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574 + btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:907 [inline] + __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +[CAUSE] +The allocation failure happens at the start_transaction() inside +prepare_to_relocate(), and during the error handling we call +unset_reloc_control(), which makes fs_info->balance_ctl to be NULL. + +Then we continue the error path cleanup in btrfs_balance() by calling +reset_balance_state() which will call del_balance_item() to fully delete +the balance item in the root tree. + +However during the small window between set_reloc_contrl() and +unset_reloc_control(), we can have a subvolume tree update and created a +reloc_root for that subvolume. + +Then we go into the final btrfs_commit_transaction() of +del_balance_item(), and into btrfs_update_reloc_root() inside +commit_fs_roots(). + +That function checks if fs_info->reloc_ctl is in the merge_reloc_tree +stage, but since fs_info->reloc_ctl is NULL, it results a NULL pointer +dereference. + +[FIX] +Just add extra check on fs_info->reloc_ctl inside +btrfs_update_reloc_root(), before checking +fs_info->reloc_ctl->merge_reloc_tree. + +That DEAD_RELOC_TREE handling is to prevent further modification to the +reloc tree during merge stage, but since there is no reloc_ctl at all, +we do not need to bother that. + +Reported-by: syzbot+283673dbc38527ef9f3d@syzkaller.appspotmail.com +Link: https://lore.kernel.org/linux-btrfs/66f6bfa7.050a0220.38ace9.0019.GAE@google.com/ +CC: stable@vger.kernel.org # 4.19+ +Reviewed-by: Josef Bacik +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/relocation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 93db4486a9433..cdd16583b2ff0 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -910,7 +910,7 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans, + btrfs_grab_root(reloc_root); + + /* root->reloc_root will stay until current relocation finished */ +- if (fs_info->reloc_ctl->merge_reloc_tree && ++ if (fs_info->reloc_ctl && fs_info->reloc_ctl->merge_reloc_tree && + btrfs_root_refs(root_item) == 0) { + set_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state); + /* +-- +2.43.0 + diff --git a/queue-5.10/clk-imx6ul-add-ethernet-refclock-mux-support.patch b/queue-5.10/clk-imx6ul-add-ethernet-refclock-mux-support.patch new file mode 100644 index 00000000000..7be20de79d0 --- /dev/null +++ b/queue-5.10/clk-imx6ul-add-ethernet-refclock-mux-support.patch @@ -0,0 +1,134 @@ +From 69ec30417f9fdb1d78fac3407b59c9afa0ee6b6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 09:46:39 +0100 +Subject: clk: imx6ul: add ethernet refclock mux support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Oleksij Rempel + +[ Upstream commit 4e197ee880c24ecb63f7fe17449b3653bc64b03c ] + +Add ethernet refclock mux support and set it to internal clock by +default. This configuration will not affect existing boards. + +clock tree before this patch: +fec1 <- enet1_ref_125m (gate) <- enet1_ref (divider) <-, + |- pll6_enet +fec2 <- enet2_ref_125m (gate) <- enet2_ref (divider) <-´ + +after this patch: +fec1 <- enet1_ref_sel(mux) <- enet1_ref_125m (gate) <- ... + `--<> enet1_ref_pad |- pll6_enet +fec2 <- enet2_ref_sel(mux) <- enet2_ref_125m (gate) <- ... + `--<> enet2_ref_pad + +Signed-off-by: Oleksij Rempel +Acked-by: Lee Jones +Reviewed-by: Abel Vesa +Signed-off-by: Abel Vesa +Link: https://lore.kernel.org/r/20230131084642.709385-17-o.rempel@pengutronix.de +Stable-dep-of: 32c055ef563c ("clk: imx6ul: fix clock parent for IMX6UL_CLK_ENETx_REF_SEL") +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx6ul.c | 26 +++++++++++++++++++++ + include/dt-bindings/clock/imx6ul-clock.h | 6 ++++- + include/linux/mfd/syscon/imx6q-iomuxc-gpr.h | 6 +++-- + 3 files changed, 35 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index 1205a1ee339dd..da9f2ca825644 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -94,6 +95,17 @@ static const struct clk_div_table video_div_table[] = { + { } + }; + ++static const char * enet1_ref_sels[] = { "enet1_ref_125m", "enet1_ref_pad", }; ++static const u32 enet1_ref_sels_table[] = { IMX6UL_GPR1_ENET1_TX_CLK_DIR, ++ IMX6UL_GPR1_ENET1_CLK_SEL }; ++static const u32 enet1_ref_sels_table_mask = IMX6UL_GPR1_ENET1_TX_CLK_DIR | ++ IMX6UL_GPR1_ENET1_CLK_SEL; ++static const char * enet2_ref_sels[] = { "enet2_ref_125m", "enet2_ref_pad", }; ++static const u32 enet2_ref_sels_table[] = { IMX6UL_GPR1_ENET2_TX_CLK_DIR, ++ IMX6UL_GPR1_ENET2_CLK_SEL }; ++static const u32 enet2_ref_sels_table_mask = IMX6UL_GPR1_ENET2_TX_CLK_DIR | ++ IMX6UL_GPR1_ENET2_CLK_SEL; ++ + static u32 share_count_asrc; + static u32 share_count_audio; + static u32 share_count_sai1; +@@ -467,6 +479,17 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + /* mask handshake of mmdc */ + imx_mmdc_mask_handshake(base, 0); + ++ hws[IMX6UL_CLK_ENET1_REF_PAD] = imx_obtain_fixed_of_clock(ccm_node, "enet1_ref_pad", 0); ++ ++ hws[IMX6UL_CLK_ENET1_REF_SEL] = imx_clk_gpr_mux("enet1_ref_sel", "fsl,imx6ul-iomuxc-gpr", ++ IOMUXC_GPR1, enet1_ref_sels, ARRAY_SIZE(enet1_ref_sels), ++ enet1_ref_sels_table, enet1_ref_sels_table_mask); ++ hws[IMX6UL_CLK_ENET2_REF_PAD] = imx_obtain_fixed_of_clock(ccm_node, "enet2_ref_pad", 0); ++ ++ hws[IMX6UL_CLK_ENET2_REF_SEL] = imx_clk_gpr_mux("enet2_ref_sel", "fsl,imx6ul-iomuxc-gpr", ++ IOMUXC_GPR1, enet2_ref_sels, ARRAY_SIZE(enet2_ref_sels), ++ enet2_ref_sels_table, enet2_ref_sels_table_mask); ++ + imx_check_clk_hws(hws, IMX6UL_CLK_END); + + of_clk_add_hw_provider(np, of_clk_hw_onecell_get, clk_hw_data); +@@ -511,6 +534,9 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + clk_set_parent(hws[IMX6ULL_CLK_EPDC_PRE_SEL]->clk, hws[IMX6UL_CLK_PLL3_PFD2]->clk); + + clk_set_parent(hws[IMX6UL_CLK_ENFC_SEL]->clk, hws[IMX6UL_CLK_PLL2_PFD2]->clk); ++ ++ clk_set_parent(hws[IMX6UL_CLK_ENET1_REF_SEL]->clk, hws[IMX6UL_CLK_ENET_REF]->clk); ++ clk_set_parent(hws[IMX6UL_CLK_ENET2_REF_SEL]->clk, hws[IMX6UL_CLK_ENET2_REF]->clk); + } + + CLK_OF_DECLARE(imx6ul, "fsl,imx6ul-ccm", imx6ul_clocks_init); +diff --git a/include/dt-bindings/clock/imx6ul-clock.h b/include/dt-bindings/clock/imx6ul-clock.h +index b44920f1edb0d..66239ebc0e233 100644 +--- a/include/dt-bindings/clock/imx6ul-clock.h ++++ b/include/dt-bindings/clock/imx6ul-clock.h +@@ -257,7 +257,11 @@ + #define IMX6UL_CLK_GPIO5 248 + #define IMX6UL_CLK_MMDC_P1_IPG 249 + #define IMX6UL_CLK_ENET1_REF_125M 250 ++#define IMX6UL_CLK_ENET1_REF_SEL 251 ++#define IMX6UL_CLK_ENET1_REF_PAD 252 ++#define IMX6UL_CLK_ENET2_REF_SEL 253 ++#define IMX6UL_CLK_ENET2_REF_PAD 254 + +-#define IMX6UL_CLK_END 251 ++#define IMX6UL_CLK_END 255 + + #endif /* __DT_BINDINGS_CLOCK_IMX6UL_H */ +diff --git a/include/linux/mfd/syscon/imx6q-iomuxc-gpr.h b/include/linux/mfd/syscon/imx6q-iomuxc-gpr.h +index d4b5e527a7a3b..09c6b3184bb04 100644 +--- a/include/linux/mfd/syscon/imx6q-iomuxc-gpr.h ++++ b/include/linux/mfd/syscon/imx6q-iomuxc-gpr.h +@@ -451,8 +451,10 @@ + #define IMX6SX_GPR12_PCIE_RX_EQ_2 (0x2 << 0) + + /* For imx6ul iomux gpr register field define */ +-#define IMX6UL_GPR1_ENET1_CLK_DIR (0x1 << 17) +-#define IMX6UL_GPR1_ENET2_CLK_DIR (0x1 << 18) ++#define IMX6UL_GPR1_ENET2_TX_CLK_DIR BIT(18) ++#define IMX6UL_GPR1_ENET1_TX_CLK_DIR BIT(17) ++#define IMX6UL_GPR1_ENET2_CLK_SEL BIT(14) ++#define IMX6UL_GPR1_ENET1_CLK_SEL BIT(13) + #define IMX6UL_GPR1_ENET1_CLK_OUTPUT (0x1 << 17) + #define IMX6UL_GPR1_ENET2_CLK_OUTPUT (0x1 << 18) + #define IMX6UL_GPR1_ENET_CLK_DIR (0x3 << 17) +-- +2.43.0 + diff --git a/queue-5.10/clk-imx6ul-fix-clock-parent-for-imx6ul_clk_enetx_ref.patch b/queue-5.10/clk-imx6ul-fix-clock-parent-for-imx6ul_clk_enetx_ref.patch new file mode 100644 index 00000000000..f5ada57cf02 --- /dev/null +++ b/queue-5.10/clk-imx6ul-fix-clock-parent-for-imx6ul_clk_enetx_ref.patch @@ -0,0 +1,47 @@ +From 37169e02cdc21e222cacc01847d79a12e4bb031f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2024 09:05:53 +0000 +Subject: clk: imx6ul: fix clock parent for IMX6UL_CLK_ENETx_REF_SEL + +From: Michel Alex + +[ Upstream commit 32c055ef563c3a4a73a477839f591b1b170bde8e ] + +Commit 4e197ee880c24ecb63f7fe17449b3653bc64b03c ("clk: imx6ul: add +ethernet refclock mux support") sets the internal clock as default +ethernet clock. + +Since IMX6UL_CLK_ENET_REF cannot be parent for IMX6UL_CLK_ENET1_REF_SEL, +the call to clk_set_parent() fails. IMX6UL_CLK_ENET1_REF_125M is the correct +parent and shall be used instead. +Same applies for IMX6UL_CLK_ENET2_REF_SEL, for which IMX6UL_CLK_ENET2_REF_125M +is the correct parent. + +Cc: stable@vger.kernel.org +Signed-off-by: Alex Michel +Reviewed-by: Oleksij Rempel +Link: https://lore.kernel.org/r/AS1P250MB0608F9CE4009DCE65C61EEDEA9922@AS1P250MB0608.EURP250.PROD.OUTLOOK.COM +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx6ul.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index bdf98ef60ba0f..7beda28ed2f09 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -535,8 +535,8 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + + clk_set_parent(hws[IMX6UL_CLK_ENFC_SEL]->clk, hws[IMX6UL_CLK_PLL2_PFD2]->clk); + +- clk_set_parent(hws[IMX6UL_CLK_ENET1_REF_SEL]->clk, hws[IMX6UL_CLK_ENET_REF]->clk); +- clk_set_parent(hws[IMX6UL_CLK_ENET2_REF_SEL]->clk, hws[IMX6UL_CLK_ENET2_REF]->clk); ++ clk_set_parent(hws[IMX6UL_CLK_ENET1_REF_SEL]->clk, hws[IMX6UL_CLK_ENET1_REF_125M]->clk); ++ clk_set_parent(hws[IMX6UL_CLK_ENET2_REF_SEL]->clk, hws[IMX6UL_CLK_ENET2_REF_125M]->clk); + + imx_register_uart_clocks(); + } +-- +2.43.0 + diff --git a/queue-5.10/clk-imx6ul-fix-enet1-gate-configuration.patch b/queue-5.10/clk-imx6ul-fix-enet1-gate-configuration.patch new file mode 100644 index 00000000000..effefdd3872 --- /dev/null +++ b/queue-5.10/clk-imx6ul-fix-enet1-gate-configuration.patch @@ -0,0 +1,88 @@ +From cf9dd99c7b32156c3f6e97d494d60bfa1722c6cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 09:46:38 +0100 +Subject: clk: imx6ul: fix enet1 gate configuration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Oleksij Rempel + +[ Upstream commit 5f82bfced6118450cb9ea3f12316568f6fac10ab ] + +According to the "i.MX 6UltraLite Applications Processor Reference Manual, +Rev. 2, 03/2017", BIT(13) is ENET1_125M_EN which is not controlling root +of PLL6. It is controlling ENET1 separately. + +So, instead of this picture (implementation before this patch): +fec1 <- enet_ref (divider) <---------------------------, + |- pll6_enet (gate) +fec2 <- enet2_ref_125m (gate) <- enet2_ref (divider) <-´ + +we should have this one (after this patch): +fec1 <- enet1_ref_125m (gate) <- enet1_ref (divider) <-, + |- pll6_enet +fec2 <- enet2_ref_125m (gate) <- enet2_ref (divider) <-´ + +With this fix, the RMII reference clock will be turned off, after +setting network interface down on each separate interface +(ip l s dev eth0 down). Which was not working before, on system with both +FECs enabled. + +Signed-off-by: Oleksij Rempel +Reviewed-by: Abel Vesa +Signed-off-by: Abel Vesa +Link: https://lore.kernel.org/r/20230131084642.709385-16-o.rempel@pengutronix.de +Stable-dep-of: 32c055ef563c ("clk: imx6ul: fix clock parent for IMX6UL_CLK_ENETx_REF_SEL") +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx6ul.c | 7 ++++--- + include/dt-bindings/clock/imx6ul-clock.h | 3 ++- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index 206e4c43f68f8..1205a1ee339dd 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -176,7 +176,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + hws[IMX6UL_CLK_PLL3_USB_OTG] = imx_clk_hw_gate("pll3_usb_otg", "pll3_bypass", base + 0x10, 13); + hws[IMX6UL_CLK_PLL4_AUDIO] = imx_clk_hw_gate("pll4_audio", "pll4_bypass", base + 0x70, 13); + hws[IMX6UL_CLK_PLL5_VIDEO] = imx_clk_hw_gate("pll5_video", "pll5_bypass", base + 0xa0, 13); +- hws[IMX6UL_CLK_PLL6_ENET] = imx_clk_hw_gate("pll6_enet", "pll6_bypass", base + 0xe0, 13); ++ hws[IMX6UL_CLK_PLL6_ENET] = imx_clk_hw_fixed_factor("pll6_enet", "pll6_bypass", 1, 1); + hws[IMX6UL_CLK_PLL7_USB_HOST] = imx_clk_hw_gate("pll7_usb_host", "pll7_bypass", base + 0x20, 13); + + /* +@@ -205,12 +205,13 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + hws[IMX6UL_CLK_PLL3_PFD2] = imx_clk_hw_pfd("pll3_pfd2_508m", "pll3_usb_otg", base + 0xf0, 2); + hws[IMX6UL_CLK_PLL3_PFD3] = imx_clk_hw_pfd("pll3_pfd3_454m", "pll3_usb_otg", base + 0xf0, 3); + +- hws[IMX6UL_CLK_ENET_REF] = clk_hw_register_divider_table(NULL, "enet_ref", "pll6_enet", 0, ++ hws[IMX6UL_CLK_ENET_REF] = clk_hw_register_divider_table(NULL, "enet1_ref", "pll6_enet", 0, + base + 0xe0, 0, 2, 0, clk_enet_ref_table, &imx_ccm_lock); + hws[IMX6UL_CLK_ENET2_REF] = clk_hw_register_divider_table(NULL, "enet2_ref", "pll6_enet", 0, + base + 0xe0, 2, 2, 0, clk_enet_ref_table, &imx_ccm_lock); + +- hws[IMX6UL_CLK_ENET2_REF_125M] = imx_clk_hw_gate("enet_ref_125m", "enet2_ref", base + 0xe0, 20); ++ hws[IMX6UL_CLK_ENET1_REF_125M] = imx_clk_hw_gate("enet1_ref_125m", "enet1_ref", base + 0xe0, 13); ++ hws[IMX6UL_CLK_ENET2_REF_125M] = imx_clk_hw_gate("enet2_ref_125m", "enet2_ref", base + 0xe0, 20); + hws[IMX6UL_CLK_ENET_PTP_REF] = imx_clk_hw_fixed_factor("enet_ptp_ref", "pll6_enet", 1, 20); + hws[IMX6UL_CLK_ENET_PTP] = imx_clk_hw_gate("enet_ptp", "enet_ptp_ref", base + 0xe0, 21); + +diff --git a/include/dt-bindings/clock/imx6ul-clock.h b/include/dt-bindings/clock/imx6ul-clock.h +index 79094338e6f1e..b44920f1edb0d 100644 +--- a/include/dt-bindings/clock/imx6ul-clock.h ++++ b/include/dt-bindings/clock/imx6ul-clock.h +@@ -256,7 +256,8 @@ + #define IMX6UL_CLK_GPIO4 247 + #define IMX6UL_CLK_GPIO5 248 + #define IMX6UL_CLK_MMDC_P1_IPG 249 ++#define IMX6UL_CLK_ENET1_REF_125M 250 + +-#define IMX6UL_CLK_END 250 ++#define IMX6UL_CLK_END 251 + + #endif /* __DT_BINDINGS_CLOCK_IMX6UL_H */ +-- +2.43.0 + diff --git a/queue-5.10/clk-imx6ul-retain-early-uart-clocks-during-kernel-in.patch b/queue-5.10/clk-imx6ul-retain-early-uart-clocks-during-kernel-in.patch new file mode 100644 index 00000000000..a41a6977acd --- /dev/null +++ b/queue-5.10/clk-imx6ul-retain-early-uart-clocks-during-kernel-in.patch @@ -0,0 +1,38 @@ +From 2195dbfd3dc056e2a9df152876de7c5d0b3aaf34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 13:55:17 +0200 +Subject: clk: imx6ul: retain early UART clocks during kernel init + +From: Alexander Stein + +[ Upstream commit 912d7af473f163ccdeb02aaabc3534177936b86c ] + +Make sure to keep UART clocks enabled during kernel init if +earlyprintk or earlycon are active. + +Signed-off-by: Alexander Stein +Reviewed-by: Peng Fan +Link: https://lore.kernel.org/r/20230421115517.1940990-1-alexander.stein@ew.tq-group.com +Signed-off-by: Abel Vesa +Stable-dep-of: 32c055ef563c ("clk: imx6ul: fix clock parent for IMX6UL_CLK_ENETx_REF_SEL") +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx6ul.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index da9f2ca825644..bdf98ef60ba0f 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -537,6 +537,8 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + + clk_set_parent(hws[IMX6UL_CLK_ENET1_REF_SEL]->clk, hws[IMX6UL_CLK_ENET_REF]->clk); + clk_set_parent(hws[IMX6UL_CLK_ENET2_REF_SEL]->clk, hws[IMX6UL_CLK_ENET2_REF]->clk); ++ ++ imx_register_uart_clocks(); + } + + CLK_OF_DECLARE(imx6ul, "fsl,imx6ul-ccm", imx6ul_clocks_init); +-- +2.43.0 + diff --git a/queue-5.10/clk-qcom-clk-rpmh-fix-overflow-in-bcm-vote.patch-10977 b/queue-5.10/clk-qcom-clk-rpmh-fix-overflow-in-bcm-vote.patch-10977 new file mode 100644 index 00000000000..3596fcc3d07 --- /dev/null +++ b/queue-5.10/clk-qcom-clk-rpmh-fix-overflow-in-bcm-vote.patch-10977 @@ -0,0 +1,41 @@ +From b7b7ce6eef0b55fdf657dd7e496e65a49e187dff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 10:51:29 +0530 +Subject: clk: qcom: clk-rpmh: Fix overflow in BCM vote + +From: Mike Tipton + +[ Upstream commit a4e5af27e6f6a8b0d14bc0d7eb04f4a6c7291586 ] + +Valid frequencies may result in BCM votes that exceed the max HW value. +Set vote ceiling to BCM_TCS_CMD_VOTE_MASK to ensure the votes aren't +truncated, which can result in lower frequencies than desired. + +Fixes: 04053f4d23a4 ("clk: qcom: clk-rpmh: Add IPA clock support") +Cc: stable@vger.kernel.org +Signed-off-by: Mike Tipton +Reviewed-by: Taniya Das +Signed-off-by: Imran Shaik +Link: https://lore.kernel.org/r/20240809-clk-rpmh-bcm-vote-fix-v2-1-240c584b7ef9@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-rpmh.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/clk-rpmh.c b/drivers/clk/qcom/clk-rpmh.c +index e2c669b08affc..6c7cce8e82f71 100644 +--- a/drivers/clk/qcom/clk-rpmh.c ++++ b/drivers/clk/qcom/clk-rpmh.c +@@ -270,6 +270,8 @@ static int clk_rpmh_bcm_send_cmd(struct clk_rpmh *c, bool enable) + cmd_state = 0; + } + ++ cmd_state = min(cmd_state, BCM_TCS_CMD_VOTE_MASK); ++ + if (c->last_sent_aggr_state != cmd_state) { + cmd.addr = c->res_addr; + cmd.data = BCM_TCS_CMD(1, enable, 0, cmd_state); +-- +2.43.0 + diff --git a/queue-5.10/clk-qcom-dispcc-sm8250-use-clk_set_rate_parent-for-b.patch b/queue-5.10/clk-qcom-dispcc-sm8250-use-clk_set_rate_parent-for-b.patch new file mode 100644 index 00000000000..cf6dc6006fa --- /dev/null +++ b/queue-5.10/clk-qcom-dispcc-sm8250-use-clk_set_rate_parent-for-b.patch @@ -0,0 +1,53 @@ +From b9d6a8d36b697f755d0d306cedba980d701b0939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Aug 2024 08:40:05 +0300 +Subject: clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks + +From: Dmitry Baryshkov + +[ Upstream commit 0e93c6320ecde0583de09f3fe801ce8822886fec ] + +Add CLK_SET_RATE_PARENT for several branch clocks. Such clocks don't +have a way to change the rate, so set the parent rate instead. + +Fixes: 80a18f4a8567 ("clk: qcom: Add display clock controller driver for SM8150 and SM8250") +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240804-sm8350-fixes-v1-1-1149dd8399fe@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sm8250.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/qcom/dispcc-sm8250.c b/drivers/clk/qcom/dispcc-sm8250.c +index 07a98d3f882d0..bbdd27946bf1f 100644 +--- a/drivers/clk/qcom/dispcc-sm8250.c ++++ b/drivers/clk/qcom/dispcc-sm8250.c +@@ -665,6 +665,7 @@ static struct clk_branch disp_cc_mdss_dp_link1_intf_clk = { + .hw = &disp_cc_mdss_dp_link1_div_clk_src.clkr.hw, + }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -700,6 +701,7 @@ static struct clk_branch disp_cc_mdss_dp_link_intf_clk = { + .hw = &disp_cc_mdss_dp_link_div_clk_src.clkr.hw, + }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -825,6 +827,7 @@ static struct clk_branch disp_cc_mdss_mdp_lut_clk = { + .hw = &disp_cc_mdss_mdp_clk_src.clkr.hw, + }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +-- +2.43.0 + diff --git a/queue-5.10/drm-omapdrm-add-missing-check-for-alloc_ordered_work.patch b/queue-5.10/drm-omapdrm-add-missing-check-for-alloc_ordered_work.patch new file mode 100644 index 00000000000..6b86a6c5ec8 --- /dev/null +++ b/queue-5.10/drm-omapdrm-add-missing-check-for-alloc_ordered_work.patch @@ -0,0 +1,48 @@ +From 52b3db6cdb0c93e30d1a3a701c771a227a6f71a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2024 14:13:36 +0800 +Subject: drm: omapdrm: Add missing check for alloc_ordered_workqueue + +From: Ma Ke + +[ Upstream commit e794b7b9b92977365c693760a259f8eef940c536 ] + +As it may return NULL pointer and cause NULL pointer dereference. Add check +for the return value of alloc_ordered_workqueue. + +Cc: stable@vger.kernel.org +Fixes: 2f95bc6d324a ("drm: omapdrm: Perform initialization/cleanup at probe/remove time") +Signed-off-by: Ma Ke +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20240808061336.2796729-1-make24@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/omap_drv.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c +index 53d5e184ee77c..8c664ef0cf629 100644 +--- a/drivers/gpu/drm/omapdrm/omap_drv.c ++++ b/drivers/gpu/drm/omapdrm/omap_drv.c +@@ -600,6 +600,10 @@ static int omapdrm_init(struct omap_drm_private *priv, struct device *dev) + soc = soc_device_match(omapdrm_soc_devices); + priv->omaprev = soc ? (unsigned int)soc->data : 0; + priv->wq = alloc_ordered_workqueue("omapdrm", 0); ++ if (!priv->wq) { ++ ret = -ENOMEM; ++ goto err_alloc_workqueue; ++ } + + mutex_init(&priv->list_lock); + INIT_LIST_HEAD(&priv->obj_list); +@@ -649,6 +653,7 @@ static int omapdrm_init(struct omap_drm_private *priv, struct device *dev) + err_gem_deinit: + omap_gem_deinit(ddev); + destroy_workqueue(priv->wq); ++err_alloc_workqueue: + omap_disconnect_pipelines(ddev); + omap_crtc_pre_uninit(priv); + drm_dev_put(ddev); +-- +2.43.0 + diff --git a/queue-5.10/drm-rockchip-define-gamma-registers-for-rk3399.patch b/queue-5.10/drm-rockchip-define-gamma-registers-for-rk3399.patch new file mode 100644 index 00000000000..0e8fa30dec2 --- /dev/null +++ b/queue-5.10/drm-rockchip-define-gamma-registers-for-rk3399.patch @@ -0,0 +1,120 @@ +From 96ecc0e5b78a53f41212d25e5f4450fd3e055410 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Oct 2021 22:58:41 +0100 +Subject: drm/rockchip: define gamma registers for RK3399 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hugh Cole-Baker + +[ Upstream commit 3ba000d6ae999b99f29afd64814877a5c4406786 ] + +The VOP on RK3399 has a different approach from previous versions for +setting a gamma lookup table, using an update_gamma_lut register. As +this differs from RK3288, give RK3399 its own set of "common" register +definitions. + +Signed-off-by: Hugh Cole-Baker +Tested-by: "Milan P. Stanić" +Tested-by: Linus Heckemann +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20211019215843.42718-2-sigmaris@gmail.com +Stable-dep-of: 6b44aa559d6c ("drm/rockchip: vop: clear DMA stop bit on RK3066") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 2 ++ + drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 24 +++++++++++++++++++-- + drivers/gpu/drm/rockchip/rockchip_vop_reg.h | 1 + + 3 files changed, 25 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h +index 857d97cdc67c6..14179e89bd215 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h +@@ -99,6 +99,8 @@ struct vop_common { + struct vop_reg dither_down_en; + struct vop_reg dither_up; + struct vop_reg dsp_lut_en; ++ struct vop_reg update_gamma_lut; ++ struct vop_reg lut_buffer_index; + struct vop_reg gate_en; + struct vop_reg mmu_en; + struct vop_reg out_mode; +diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c +index 39e1e1ebea928..310746468ff33 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c ++++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c +@@ -836,6 +836,24 @@ static const struct vop_output rk3399_output = { + .mipi_dual_channel_en = VOP_REG(RK3288_SYS_CTRL, 0x1, 3), + }; + ++static const struct vop_common rk3399_common = { ++ .standby = VOP_REG_SYNC(RK3399_SYS_CTRL, 0x1, 22), ++ .gate_en = VOP_REG(RK3399_SYS_CTRL, 0x1, 23), ++ .mmu_en = VOP_REG(RK3399_SYS_CTRL, 0x1, 20), ++ .dither_down_sel = VOP_REG(RK3399_DSP_CTRL1, 0x1, 4), ++ .dither_down_mode = VOP_REG(RK3399_DSP_CTRL1, 0x1, 3), ++ .dither_down_en = VOP_REG(RK3399_DSP_CTRL1, 0x1, 2), ++ .pre_dither_down = VOP_REG(RK3399_DSP_CTRL1, 0x1, 1), ++ .dither_up = VOP_REG(RK3399_DSP_CTRL1, 0x1, 6), ++ .dsp_lut_en = VOP_REG(RK3399_DSP_CTRL1, 0x1, 0), ++ .update_gamma_lut = VOP_REG(RK3399_DSP_CTRL1, 0x1, 7), ++ .lut_buffer_index = VOP_REG(RK3399_DBG_POST_REG1, 0x1, 1), ++ .data_blank = VOP_REG(RK3399_DSP_CTRL0, 0x1, 19), ++ .dsp_blank = VOP_REG(RK3399_DSP_CTRL0, 0x3, 18), ++ .out_mode = VOP_REG(RK3399_DSP_CTRL0, 0xf, 0), ++ .cfg_done = VOP_REG_SYNC(RK3399_REG_CFG_DONE, 0x1, 0), ++}; ++ + static const struct vop_yuv2yuv_phy rk3399_yuv2yuv_win01_data = { + .y2r_coefficients = { + VOP_REG(RK3399_WIN0_YUV2YUV_Y2R + 0, 0xffff, 0), +@@ -917,7 +935,7 @@ static const struct vop_data rk3399_vop_big = { + .version = VOP_VERSION(3, 5), + .feature = VOP_FEATURE_OUTPUT_RGB10, + .intr = &rk3366_vop_intr, +- .common = &rk3288_common, ++ .common = &rk3399_common, + .modeset = &rk3288_modeset, + .output = &rk3399_output, + .afbc = &rk3399_vop_afbc, +@@ -925,6 +943,7 @@ static const struct vop_data rk3399_vop_big = { + .win = rk3399_vop_win_data, + .win_size = ARRAY_SIZE(rk3399_vop_win_data), + .win_yuv2yuv = rk3399_vop_big_win_yuv2yuv_data, ++ .lut_size = 1024, + }; + + static const struct vop_win_data rk3399_vop_lit_win_data[] = { +@@ -943,13 +962,14 @@ static const struct vop_win_yuv2yuv_data rk3399_vop_lit_win_yuv2yuv_data[] = { + static const struct vop_data rk3399_vop_lit = { + .version = VOP_VERSION(3, 6), + .intr = &rk3366_vop_intr, +- .common = &rk3288_common, ++ .common = &rk3399_common, + .modeset = &rk3288_modeset, + .output = &rk3399_output, + .misc = &rk3368_misc, + .win = rk3399_vop_lit_win_data, + .win_size = ARRAY_SIZE(rk3399_vop_lit_win_data), + .win_yuv2yuv = rk3399_vop_lit_win_yuv2yuv_data, ++ .lut_size = 256, + }; + + static const struct vop_win_data rk3228_vop_win_data[] = { +diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.h b/drivers/gpu/drm/rockchip/rockchip_vop_reg.h +index 6e9fa5815d4d7..9f410a4ece7b6 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.h ++++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.h +@@ -628,6 +628,7 @@ + #define RK3399_YUV2YUV_WIN 0x02c0 + #define RK3399_YUV2YUV_POST 0x02c4 + #define RK3399_AUTO_GATING_EN 0x02cc ++#define RK3399_DBG_POST_REG1 0x036c + #define RK3399_WIN0_CSC_COE 0x03a0 + #define RK3399_WIN1_CSC_COE 0x03c0 + #define RK3399_WIN2_CSC_COE 0x03e0 +-- +2.43.0 + diff --git a/queue-5.10/drm-rockchip-support-gamma-control-on-rk3399.patch b/queue-5.10/drm-rockchip-support-gamma-control-on-rk3399.patch new file mode 100644 index 00000000000..510ae4224cb --- /dev/null +++ b/queue-5.10/drm-rockchip-support-gamma-control-on-rk3399.patch @@ -0,0 +1,211 @@ +From 374313f7543c211219df9f953fc98e87175d3ce2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Oct 2021 22:58:42 +0100 +Subject: drm/rockchip: support gamma control on RK3399 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hugh Cole-Baker + +[ Upstream commit 7ae7a6211fe7251543796d5af971acb8c9e2da9e ] + +The RK3399 has a 1024-entry gamma LUT with 10 bits per component on its +"big" VOP and a 256-entry, 8 bit per component LUT on the "little" VOP. +Compared to the RK3288, it no longer requires disabling gamma while +updating the LUT. On the RK3399, the LUT can be updated at any time as +the hardware has two LUT buffers, one can be written while the other is +in use. A swap of the buffers is triggered by writing 1 to the +update_gamma_lut register. + +Signed-off-by: Hugh Cole-Baker +Tested-by: "Milan P. Stanić" +Tested-by: Linus Heckemann +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20211019215843.42718-3-sigmaris@gmail.com +Stable-dep-of: 6b44aa559d6c ("drm/rockchip: vop: clear DMA stop bit on RK3066") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 105 +++++++++++++------- + 1 file changed, 71 insertions(+), 34 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index d4a3170d1678c..18ee781ddb79e 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -65,6 +66,9 @@ + #define VOP_REG_SET(vop, group, name, v) \ + vop_reg_set(vop, &vop->data->group->name, 0, ~0, v, #name) + ++#define VOP_HAS_REG(vop, group, name) \ ++ (!!(vop->data->group->name.mask)) ++ + #define VOP_INTR_SET_TYPE(vop, name, type, v) \ + do { \ + int i, reg = 0, mask = 0; \ +@@ -1200,17 +1204,22 @@ static bool vop_dsp_lut_is_enabled(struct vop *vop) + return vop_read_reg(vop, 0, &vop->data->common->dsp_lut_en); + } + ++static u32 vop_lut_buffer_index(struct vop *vop) ++{ ++ return vop_read_reg(vop, 0, &vop->data->common->lut_buffer_index); ++} ++ + static void vop_crtc_write_gamma_lut(struct vop *vop, struct drm_crtc *crtc) + { + struct drm_color_lut *lut = crtc->state->gamma_lut->data; +- unsigned int i; ++ unsigned int i, bpc = ilog2(vop->data->lut_size); + + for (i = 0; i < crtc->gamma_size; i++) { + u32 word; + +- word = (drm_color_lut_extract(lut[i].red, 10) << 20) | +- (drm_color_lut_extract(lut[i].green, 10) << 10) | +- drm_color_lut_extract(lut[i].blue, 10); ++ word = (drm_color_lut_extract(lut[i].red, bpc) << (2 * bpc)) | ++ (drm_color_lut_extract(lut[i].green, bpc) << bpc) | ++ drm_color_lut_extract(lut[i].blue, bpc); + writel(word, vop->lut_regs + i * 4); + } + } +@@ -1220,38 +1229,66 @@ static void vop_crtc_gamma_set(struct vop *vop, struct drm_crtc *crtc, + { + struct drm_crtc_state *state = crtc->state; + unsigned int idle; ++ u32 lut_idx, old_idx; + int ret; + + if (!vop->lut_regs) + return; +- /* +- * To disable gamma (gamma_lut is null) or to write +- * an update to the LUT, clear dsp_lut_en. +- */ +- spin_lock(&vop->reg_lock); +- VOP_REG_SET(vop, common, dsp_lut_en, 0); +- vop_cfg_done(vop); +- spin_unlock(&vop->reg_lock); + +- /* +- * In order to write the LUT to the internal memory, +- * we need to first make sure the dsp_lut_en bit is cleared. +- */ +- ret = readx_poll_timeout(vop_dsp_lut_is_enabled, vop, +- idle, !idle, 5, 30 * 1000); +- if (ret) { +- DRM_DEV_ERROR(vop->dev, "display LUT RAM enable timeout!\n"); +- return; +- } ++ if (!state->gamma_lut || !VOP_HAS_REG(vop, common, update_gamma_lut)) { ++ /* ++ * To disable gamma (gamma_lut is null) or to write ++ * an update to the LUT, clear dsp_lut_en. ++ */ ++ spin_lock(&vop->reg_lock); ++ VOP_REG_SET(vop, common, dsp_lut_en, 0); ++ vop_cfg_done(vop); ++ spin_unlock(&vop->reg_lock); + +- if (!state->gamma_lut) +- return; ++ /* ++ * In order to write the LUT to the internal memory, ++ * we need to first make sure the dsp_lut_en bit is cleared. ++ */ ++ ret = readx_poll_timeout(vop_dsp_lut_is_enabled, vop, ++ idle, !idle, 5, 30 * 1000); ++ if (ret) { ++ DRM_DEV_ERROR(vop->dev, "display LUT RAM enable timeout!\n"); ++ return; ++ } ++ ++ if (!state->gamma_lut) ++ return; ++ } else { ++ /* ++ * On RK3399 the gamma LUT can updated without clearing dsp_lut_en, ++ * by setting update_gamma_lut then waiting for lut_buffer_index change ++ */ ++ old_idx = vop_lut_buffer_index(vop); ++ } + + spin_lock(&vop->reg_lock); + vop_crtc_write_gamma_lut(vop, crtc); + VOP_REG_SET(vop, common, dsp_lut_en, 1); ++ VOP_REG_SET(vop, common, update_gamma_lut, 1); + vop_cfg_done(vop); + spin_unlock(&vop->reg_lock); ++ ++ if (VOP_HAS_REG(vop, common, update_gamma_lut)) { ++ ret = readx_poll_timeout(vop_lut_buffer_index, vop, ++ lut_idx, lut_idx != old_idx, 5, 30 * 1000); ++ if (ret) { ++ DRM_DEV_ERROR(vop->dev, "gamma LUT update timeout!\n"); ++ return; ++ } ++ ++ /* ++ * update_gamma_lut is auto cleared by HW, but write 0 to clear the bit ++ * in our backup of the regs. ++ */ ++ spin_lock(&vop->reg_lock); ++ VOP_REG_SET(vop, common, update_gamma_lut, 0); ++ spin_unlock(&vop->reg_lock); ++ } + } + + static void vop_crtc_atomic_begin(struct drm_crtc *crtc, +@@ -1295,14 +1332,6 @@ static void vop_crtc_atomic_enable(struct drm_crtc *crtc, + return; + } + +- /* +- * If we have a GAMMA LUT in the state, then let's make sure +- * it's updated. We might be coming out of suspend, +- * which means the LUT internal memory needs to be re-written. +- */ +- if (crtc->state->gamma_lut) +- vop_crtc_gamma_set(vop, crtc, old_state); +- + mutex_lock(&vop->vop_lock); + + WARN_ON(vop->event); +@@ -1393,6 +1422,14 @@ static void vop_crtc_atomic_enable(struct drm_crtc *crtc, + + VOP_REG_SET(vop, common, standby, 0); + mutex_unlock(&vop->vop_lock); ++ ++ /* ++ * If we have a GAMMA LUT in the state, then let's make sure ++ * it's updated. We might be coming out of suspend, ++ * which means the LUT internal memory needs to be re-written. ++ */ ++ if (crtc->state->gamma_lut) ++ vop_crtc_gamma_set(vop, crtc, old_state); + } + + static bool vop_fs_irq_is_pending(struct vop *vop) +@@ -2119,8 +2156,8 @@ static int vop_bind(struct device *dev, struct device *master, void *data) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 1); + if (res) { +- if (!vop_data->lut_size) { +- DRM_DEV_ERROR(dev, "no gamma LUT size defined\n"); ++ if (vop_data->lut_size != 1024 && vop_data->lut_size != 256) { ++ DRM_DEV_ERROR(dev, "unsupported gamma LUT size %d\n", vop_data->lut_size); + return -EINVAL; + } + vop->lut_regs = devm_ioremap_resource(dev, res); +-- +2.43.0 + diff --git a/queue-5.10/drm-rockchip-vop-clear-dma-stop-bit-on-rk3066.patch b/queue-5.10/drm-rockchip-vop-clear-dma-stop-bit-on-rk3066.patch new file mode 100644 index 00000000000..fb66bb87e1e --- /dev/null +++ b/queue-5.10/drm-rockchip-vop-clear-dma-stop-bit-on-rk3066.patch @@ -0,0 +1,75 @@ +From d57d7f4cd67bb38049b60a7378e2634a6989f6cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 17:40:48 -0300 +Subject: drm/rockchip: vop: clear DMA stop bit on RK3066 + +From: Val Packett + +[ Upstream commit 6b44aa559d6c7f4ea591ef9d2352a7250138d62a ] + +The RK3066 VOP sets a dma_stop bit when it's done scanning out a frame +and needs the driver to acknowledge that by clearing the bit. + +Unless we clear it "between" frames, the RGB output only shows noise +instead of the picture. atomic_flush is the place for it that least +affects other code (doing it on vblank would require converting all +other usages of the reg_lock to spin_(un)lock_irq, which would affect +performance for everyone). + +This seems to be a redundant synchronization mechanism that was removed +in later iterations of the VOP hardware block. + +Fixes: f4a6de855eae ("drm: rockchip: vop: add rk3066 vop definitions") +Cc: stable@vger.kernel.org +Signed-off-by: Val Packett +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20240624204054.5524-2-val@packett.cool +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 ++++ + drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 1 + + drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 1 + + 3 files changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index 18ee781ddb79e..b4517e338f5ec 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -1523,6 +1523,10 @@ static void vop_crtc_atomic_flush(struct drm_crtc *crtc, + VOP_AFBC_SET(vop, enable, s->enable_afbc); + vop_cfg_done(vop); + ++ /* Ack the DMA transfer of the previous frame (RK3066). */ ++ if (VOP_HAS_REG(vop, common, dma_stop)) ++ VOP_REG_SET(vop, common, dma_stop, 0); ++ + spin_unlock(&vop->reg_lock); + + /* +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h +index 14179e89bd215..32d1783be01d3 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h +@@ -103,6 +103,7 @@ struct vop_common { + struct vop_reg lut_buffer_index; + struct vop_reg gate_en; + struct vop_reg mmu_en; ++ struct vop_reg dma_stop; + struct vop_reg out_mode; + struct vop_reg standby; + }; +diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c +index 310746468ff33..b43b684bee866 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c ++++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c +@@ -401,6 +401,7 @@ static const struct vop_output rk3066_output = { + }; + + static const struct vop_common rk3066_common = { ++ .dma_stop = VOP_REG(RK3066_SYS_CTRL0, 0x1, 0), + .standby = VOP_REG(RK3066_SYS_CTRL0, 0x1, 1), + .out_mode = VOP_REG(RK3066_DSP_CTRL0, 0xf, 0), + .cfg_done = VOP_REG(RK3066_REG_CFG_DONE, 0x1, 0), +-- +2.43.0 + diff --git a/queue-5.10/ext4-dax-fix-overflowing-extents-beyond-inode-size-w.patch b/queue-5.10/ext4-dax-fix-overflowing-extents-beyond-inode-size-w.patch new file mode 100644 index 00000000000..31053e48dc2 --- /dev/null +++ b/queue-5.10/ext4-dax-fix-overflowing-extents-beyond-inode-size-w.patch @@ -0,0 +1,89 @@ +From a72d69b6eddea8507dec924b3637b1b816891512 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 20:15:32 +0800 +Subject: ext4: dax: fix overflowing extents beyond inode size when partially + writing + +From: Zhihao Cheng + +[ Upstream commit dda898d7ffe85931f9cca6d702a51f33717c501e ] + +The dax_iomap_rw() does two things in each iteration: map written blocks +and copy user data to blocks. If the process is killed by user(See signal +handling in dax_iomap_iter()), the copied data will be returned and added +on inode size, which means that the length of written extents may exceed +the inode size, then fsck will fail. An example is given as: + +dd if=/dev/urandom of=file bs=4M count=1 + dax_iomap_rw + iomap_iter // round 1 + ext4_iomap_begin + ext4_iomap_alloc // allocate 0~2M extents(written flag) + dax_iomap_iter // copy 2M data + iomap_iter // round 2 + iomap_iter_advance + iter->pos += iter->processed // iter->pos = 2M + ext4_iomap_begin + ext4_iomap_alloc // allocate 2~4M extents(written flag) + dax_iomap_iter + fatal_signal_pending + done = iter->pos - iocb->ki_pos // done = 2M + ext4_handle_inode_extension + ext4_update_inode_size // inode size = 2M + +fsck reports: Inode 13, i_size is 2097152, should be 4194304. Fix? + +Fix the problem by truncating extents if the written length is smaller +than expected. + +Fixes: 776722e85d3b ("ext4: DAX iomap write support") +CC: stable@vger.kernel.org +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219136 +Signed-off-by: Zhihao Cheng +Reviewed-by: Jan Kara +Reviewed-by: Zhihao Cheng +Link: https://patch.msgid.link/20240809121532.2105494-1-chengzhihao@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/file.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index 15f45499f491a..62c4073b0e568 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -308,10 +308,10 @@ static ssize_t ext4_handle_inode_extension(struct inode *inode, loff_t offset, + * Clean up the inode after DIO or DAX extending write has completed and the + * inode size has been updated using ext4_handle_inode_extension(). + */ +-static void ext4_inode_extension_cleanup(struct inode *inode, ssize_t count) ++static void ext4_inode_extension_cleanup(struct inode *inode, bool need_trunc) + { + lockdep_assert_held_write(&inode->i_rwsem); +- if (count < 0) { ++ if (need_trunc) { + ext4_truncate_failed_write(inode); + /* + * If the truncate operation failed early, then the inode may +@@ -548,7 +548,7 @@ static ssize_t ext4_dio_write_iter(struct kiocb *iocb, struct iov_iter *from) + * writeback of delalloc blocks. + */ + WARN_ON_ONCE(ret == -EIOCBQUEUED); +- ext4_inode_extension_cleanup(inode, ret); ++ ext4_inode_extension_cleanup(inode, ret < 0); + } + + out: +@@ -632,7 +632,7 @@ ext4_dax_write_iter(struct kiocb *iocb, struct iov_iter *from) + + if (extend) { + ret = ext4_handle_inode_extension(inode, offset, ret); +- ext4_inode_extension_cleanup(inode, ret); ++ ext4_inode_extension_cleanup(inode, ret < (ssize_t)count); + } + out: + inode_unlock(inode); +-- +2.43.0 + diff --git a/queue-5.10/ext4-properly-sync-file-size-update-after-o_sync-dir.patch b/queue-5.10/ext4-properly-sync-file-size-update-after-o_sync-dir.patch new file mode 100644 index 00000000000..a6ccbbfc12e --- /dev/null +++ b/queue-5.10/ext4-properly-sync-file-size-update-after-o_sync-dir.patch @@ -0,0 +1,247 @@ +From 80978fd9e7a48203427c01b6d5815619cb4c80bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 14:13:50 +0200 +Subject: ext4: properly sync file size update after O_SYNC direct IO + +From: Jan Kara + +[ Upstream commit 91562895f8030cb9a0470b1db49de79346a69f91 ] + +Gao Xiang has reported that on ext4 O_SYNC direct IO does not properly +sync file size update and thus if we crash at unfortunate moment, the +file can have smaller size although O_SYNC IO has reported successful +completion. The problem happens because update of on-disk inode size is +handled in ext4_dio_write_iter() *after* iomap_dio_rw() (and thus +dio_complete() in particular) has returned and generic_file_sync() gets +called by dio_complete(). Fix the problem by handling on-disk inode size +update directly in our ->end_io completion handler. + +References: https://lore.kernel.org/all/02d18236-26ef-09b0-90ad-030c4fe3ee20@linux.alibaba.com +Reported-by: Gao Xiang +CC: stable@vger.kernel.org +Fixes: 378f32bab371 ("ext4: introduce direct I/O write using iomap infrastructure") +Signed-off-by: Jan Kara +Tested-by: Joseph Qi +Reviewed-by: "Ritesh Harjani (IBM)" +Link: https://lore.kernel.org/r/20231013121350.26872-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Stable-dep-of: dda898d7ffe8 ("ext4: dax: fix overflowing extents beyond inode size when partially writing") +Signed-off-by: Sasha Levin +--- + fs/ext4/file.c | 153 +++++++++++++++++++++---------------------------- + 1 file changed, 65 insertions(+), 88 deletions(-) + +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index f42cc1fe0ba1d..15f45499f491a 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -280,80 +280,38 @@ static ssize_t ext4_buffered_write_iter(struct kiocb *iocb, + } + + static ssize_t ext4_handle_inode_extension(struct inode *inode, loff_t offset, +- ssize_t written, size_t count) ++ ssize_t count) + { + handle_t *handle; +- bool truncate = false; +- u8 blkbits = inode->i_blkbits; +- ext4_lblk_t written_blk, end_blk; +- int ret; +- +- /* +- * Note that EXT4_I(inode)->i_disksize can get extended up to +- * inode->i_size while the I/O was running due to writeback of delalloc +- * blocks. But, the code in ext4_iomap_alloc() is careful to use +- * zeroed/unwritten extents if this is possible; thus we won't leave +- * uninitialized blocks in a file even if we didn't succeed in writing +- * as much as we intended. +- */ +- WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize); +- if (offset + count <= EXT4_I(inode)->i_disksize) { +- /* +- * We need to ensure that the inode is removed from the orphan +- * list if it has been added prematurely, due to writeback of +- * delalloc blocks. +- */ +- if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) { +- handle = ext4_journal_start(inode, EXT4_HT_INODE, 2); +- +- if (IS_ERR(handle)) { +- ext4_orphan_del(NULL, inode); +- return PTR_ERR(handle); +- } +- +- ext4_orphan_del(handle, inode); +- ext4_journal_stop(handle); +- } +- +- return written; +- } +- +- if (written < 0) +- goto truncate; + ++ lockdep_assert_held_write(&inode->i_rwsem); + handle = ext4_journal_start(inode, EXT4_HT_INODE, 2); +- if (IS_ERR(handle)) { +- written = PTR_ERR(handle); +- goto truncate; +- } ++ if (IS_ERR(handle)) ++ return PTR_ERR(handle); + +- if (ext4_update_inode_size(inode, offset + written)) { +- ret = ext4_mark_inode_dirty(handle, inode); ++ if (ext4_update_inode_size(inode, offset + count)) { ++ int ret = ext4_mark_inode_dirty(handle, inode); + if (unlikely(ret)) { +- written = ret; + ext4_journal_stop(handle); +- goto truncate; ++ return ret; + } + } + +- /* +- * We may need to truncate allocated but not written blocks beyond EOF. +- */ +- written_blk = ALIGN(offset + written, 1 << blkbits); +- end_blk = ALIGN(offset + count, 1 << blkbits); +- if (written_blk < end_blk && ext4_can_truncate(inode)) +- truncate = true; +- +- /* +- * Remove the inode from the orphan list if it has been extended and +- * everything went OK. +- */ +- if (!truncate && inode->i_nlink) ++ if (inode->i_nlink) + ext4_orphan_del(handle, inode); + ext4_journal_stop(handle); + +- if (truncate) { +-truncate: ++ return count; ++} ++ ++/* ++ * Clean up the inode after DIO or DAX extending write has completed and the ++ * inode size has been updated using ext4_handle_inode_extension(). ++ */ ++static void ext4_inode_extension_cleanup(struct inode *inode, ssize_t count) ++{ ++ lockdep_assert_held_write(&inode->i_rwsem); ++ if (count < 0) { + ext4_truncate_failed_write(inode); + /* + * If the truncate operation failed early, then the inode may +@@ -362,9 +320,28 @@ static ssize_t ext4_handle_inode_extension(struct inode *inode, loff_t offset, + */ + if (inode->i_nlink) + ext4_orphan_del(NULL, inode); ++ return; + } ++ /* ++ * If i_disksize got extended due to writeback of delalloc blocks while ++ * the DIO was running we could fail to cleanup the orphan list in ++ * ext4_handle_inode_extension(). Do it now. ++ */ ++ if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) { ++ handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2); + +- return written; ++ if (IS_ERR(handle)) { ++ /* ++ * The write has successfully completed. Not much to ++ * do with the error here so just cleanup the orphan ++ * list and hope for the best. ++ */ ++ ext4_orphan_del(NULL, inode); ++ return; ++ } ++ ext4_orphan_del(handle, inode); ++ ext4_journal_stop(handle); ++ } + } + + static int ext4_dio_write_end_io(struct kiocb *iocb, ssize_t size, +@@ -373,31 +350,22 @@ static int ext4_dio_write_end_io(struct kiocb *iocb, ssize_t size, + loff_t pos = iocb->ki_pos; + struct inode *inode = file_inode(iocb->ki_filp); + ++ if (!error && size && flags & IOMAP_DIO_UNWRITTEN) ++ error = ext4_convert_unwritten_extents(NULL, inode, pos, size); + if (error) + return error; +- +- if (size && flags & IOMAP_DIO_UNWRITTEN) { +- error = ext4_convert_unwritten_extents(NULL, inode, pos, size); +- if (error < 0) +- return error; +- } + /* +- * If we are extending the file, we have to update i_size here before +- * page cache gets invalidated in iomap_dio_rw(). Otherwise racing +- * buffered reads could zero out too much from page cache pages. Update +- * of on-disk size will happen later in ext4_dio_write_iter() where +- * we have enough information to also perform orphan list handling etc. +- * Note that we perform all extending writes synchronously under +- * i_rwsem held exclusively so i_size update is safe here in that case. +- * If the write was not extending, we cannot see pos > i_size here +- * because operations reducing i_size like truncate wait for all +- * outstanding DIO before updating i_size. ++ * Note that EXT4_I(inode)->i_disksize can get extended up to ++ * inode->i_size while the I/O was running due to writeback of delalloc ++ * blocks. But the code in ext4_iomap_alloc() is careful to use ++ * zeroed/unwritten extents if this is possible; thus we won't leave ++ * uninitialized blocks in a file even if we didn't succeed in writing ++ * as much as we intended. + */ +- pos += size; +- if (pos > i_size_read(inode)) +- i_size_write(inode, pos); +- +- return 0; ++ WARN_ON_ONCE(i_size_read(inode) < READ_ONCE(EXT4_I(inode)->i_disksize)); ++ if (pos + size <= READ_ONCE(EXT4_I(inode)->i_disksize)) ++ return size; ++ return ext4_handle_inode_extension(inode, pos, size); + } + + static const struct iomap_dio_ops ext4_dio_write_ops = { +@@ -572,9 +540,16 @@ static ssize_t ext4_dio_write_iter(struct kiocb *iocb, struct iov_iter *from) + is_sync_kiocb(iocb) || unaligned_io || extend); + if (ret == -ENOTBLK) + ret = 0; +- +- if (extend) +- ret = ext4_handle_inode_extension(inode, offset, ret, count); ++ if (extend) { ++ /* ++ * We always perform extending DIO write synchronously so by ++ * now the IO is completed and ext4_handle_inode_extension() ++ * was called. Cleanup the inode in case of error or race with ++ * writeback of delalloc blocks. ++ */ ++ WARN_ON_ONCE(ret == -EIOCBQUEUED); ++ ext4_inode_extension_cleanup(inode, ret); ++ } + + out: + if (ilock_shared) +@@ -655,8 +630,10 @@ ext4_dax_write_iter(struct kiocb *iocb, struct iov_iter *from) + + ret = dax_iomap_rw(iocb, from, &ext4_iomap_ops); + +- if (extend) +- ret = ext4_handle_inode_extension(inode, offset, ret, count); ++ if (extend) { ++ ret = ext4_handle_inode_extension(inode, offset, ret); ++ ext4_inode_extension_cleanup(inode, ret); ++ } + out: + inode_unlock(inode); + if (ret > 0) +-- +2.43.0 + diff --git a/queue-5.10/i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-p.patch b/queue-5.10/i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-p.patch new file mode 100644 index 00000000000..27197b0c2e3 --- /dev/null +++ b/queue-5.10/i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-p.patch @@ -0,0 +1,39 @@ +From 076e01a303594486a83fc7524f404d54029ca638 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Sep 2024 11:42:50 +0800 +Subject: i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled + +From: Jinjie Ruan + +[ Upstream commit 0c8d604dea437b69a861479b413d629bc9b3da70 ] + +It is not valid to call pm_runtime_set_suspended() for devices +with runtime PM enabled because it returns -EAGAIN if it is enabled +already and working. So, call pm_runtime_disable() before to fix it. + +Fixes: 36ecbcab84d0 ("i2c: xiic: Implement power management") +Cc: # v4.6+ +Signed-off-by: Jinjie Ruan +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 30839ead38361..e3a1fe8bbe25c 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -871,8 +871,8 @@ static int xiic_i2c_probe(struct platform_device *pdev) + return 0; + + err_pm_disable: +- pm_runtime_set_suspended(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ pm_runtime_set_suspended(&pdev->dev); + + return ret; + } +-- +2.43.0 + diff --git a/queue-5.10/i2c-xiic-simplify-with-dev_err_probe.patch b/queue-5.10/i2c-xiic-simplify-with-dev_err_probe.patch new file mode 100644 index 00000000000..bc9e08642bd --- /dev/null +++ b/queue-5.10/i2c-xiic-simplify-with-dev_err_probe.patch @@ -0,0 +1,44 @@ +From 017c55f60ce4c4d4fc13f9a31cc5fd5684ceed67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 17:06:36 +0200 +Subject: i2c: xiic: Simplify with dev_err_probe() + +From: Krzysztof Kozlowski + +[ Upstream commit 9dbba3f87c7823cf35e63fb7a2449a5d54b3b799 ] + +Common pattern of handling deferred probe can be simplified with +dev_err_probe(). Less code and the error value gets printed. + +Signed-off-by: Krzysztof Kozlowski +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Stable-dep-of: 0c8d604dea43 ("i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled") +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 568e97c3896d1..9652e8bea2d0b 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -816,11 +816,10 @@ static int xiic_i2c_probe(struct platform_device *pdev) + init_waitqueue_head(&i2c->wait); + + i2c->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(i2c->clk)) { +- if (PTR_ERR(i2c->clk) != -EPROBE_DEFER) +- dev_err(&pdev->dev, "input clock not found.\n"); +- return PTR_ERR(i2c->clk); +- } ++ if (IS_ERR(i2c->clk)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(i2c->clk), ++ "input clock not found.\n"); ++ + ret = clk_prepare_enable(i2c->clk); + if (ret) { + dev_err(&pdev->dev, "Unable to enable clock.\n"); +-- +2.43.0 + diff --git a/queue-5.10/i2c-xiic-use-devm_clk_get_enabled.patch b/queue-5.10/i2c-xiic-use-devm_clk_get_enabled.patch new file mode 100644 index 00000000000..563d5638992 --- /dev/null +++ b/queue-5.10/i2c-xiic-use-devm_clk_get_enabled.patch @@ -0,0 +1,94 @@ +From 4e34cf52bf505bb486337b3cdaa658eb175865ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 00:56:49 +0200 +Subject: i2c: xiic: Use devm_clk_get_enabled() + +From: Andi Shyti + +[ Upstream commit 8390dc7477e49e4acc9e553f385f4ff59d186efe ] + +Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), +with a single function devm_clk_get_enabled(). + +Signed-off-by: Andi Shyti +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Stable-dep-of: 0c8d604dea43 ("i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled") +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 20 +++++++------------- + 1 file changed, 7 insertions(+), 13 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 9652e8bea2d0b..30839ead38361 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -815,16 +815,11 @@ static int xiic_i2c_probe(struct platform_device *pdev) + mutex_init(&i2c->lock); + init_waitqueue_head(&i2c->wait); + +- i2c->clk = devm_clk_get(&pdev->dev, NULL); ++ i2c->clk = devm_clk_get_enabled(&pdev->dev, NULL); + if (IS_ERR(i2c->clk)) + return dev_err_probe(&pdev->dev, PTR_ERR(i2c->clk), +- "input clock not found.\n"); ++ "failed to enable input clock.\n"); + +- ret = clk_prepare_enable(i2c->clk); +- if (ret) { +- dev_err(&pdev->dev, "Unable to enable clock.\n"); +- return ret; +- } + i2c->dev = &pdev->dev; + pm_runtime_set_autosuspend_delay(i2c->dev, XIIC_PM_TIMEOUT); + pm_runtime_use_autosuspend(i2c->dev); +@@ -836,7 +831,7 @@ static int xiic_i2c_probe(struct platform_device *pdev) + + if (ret < 0) { + dev_err(&pdev->dev, "Cannot claim IRQ\n"); +- goto err_clk_dis; ++ goto err_pm_disable; + } + + i2c->singlemaster = +@@ -857,14 +852,14 @@ static int xiic_i2c_probe(struct platform_device *pdev) + ret = xiic_reinit(i2c); + if (ret < 0) { + dev_err(&pdev->dev, "Cannot xiic_reinit\n"); +- goto err_clk_dis; ++ goto err_pm_disable; + } + + /* add i2c adapter to i2c tree */ + ret = i2c_add_adapter(&i2c->adap); + if (ret) { + xiic_deinit(i2c); +- goto err_clk_dis; ++ goto err_pm_disable; + } + + if (pdata) { +@@ -875,10 +870,10 @@ static int xiic_i2c_probe(struct platform_device *pdev) + + return 0; + +-err_clk_dis: ++err_pm_disable: + pm_runtime_set_suspended(&pdev->dev); + pm_runtime_disable(&pdev->dev); +- clk_disable_unprepare(i2c->clk); ++ + return ret; + } + +@@ -896,7 +891,6 @@ static int xiic_i2c_remove(struct platform_device *pdev) + + xiic_deinit(i2c); + pm_runtime_put_sync(i2c->dev); +- clk_disable_unprepare(i2c->clk); + pm_runtime_disable(&pdev->dev); + pm_runtime_set_suspended(&pdev->dev); + pm_runtime_dont_use_autosuspend(&pdev->dev); +-- +2.43.0 + diff --git a/queue-5.10/kconfig-qconf-fix-buffer-overflow-in-debug-links.patch b/queue-5.10/kconfig-qconf-fix-buffer-overflow-in-debug-links.patch new file mode 100644 index 00000000000..fd9455b20d6 --- /dev/null +++ b/queue-5.10/kconfig-qconf-fix-buffer-overflow-in-debug-links.patch @@ -0,0 +1,43 @@ +From 33a728a5c5aa4c00eb00d214dad92370d3369775 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 18:02:22 +0900 +Subject: kconfig: qconf: fix buffer overflow in debug links + +From: Masahiro Yamada + +[ Upstream commit 984ed20ece1c6c20789ece040cbff3eb1a388fa9 ] + +If you enable "Option -> Show Debug Info" and click a link, the program +terminates with the following error: + + *** buffer overflow detected ***: terminated + +The buffer overflow is caused by the following line: + + strcat(data, "$"); + +The buffer needs one more byte to accommodate the additional character. + +Fixes: c4f7398bee9c ("kconfig: qconf: make debug links work again") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/qconf.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc +index f7eb093614f27..b889fe604e422 100644 +--- a/scripts/kconfig/qconf.cc ++++ b/scripts/kconfig/qconf.cc +@@ -1167,7 +1167,7 @@ void ConfigInfoView::clicked(const QUrl &url) + { + QByteArray str = url.toEncoded(); + const std::size_t count = str.size(); +- char *data = new char[count + 1]; ++ char *data = new char[count + 2]; // '$' + '\0' + struct symbol **result; + struct menu *m = NULL; + +-- +2.43.0 + diff --git a/queue-5.10/nfsd-fix-delegation_blocked-to-block-correctly-for-a.patch b/queue-5.10/nfsd-fix-delegation_blocked-to-block-correctly-for-a.patch new file mode 100644 index 00000000000..ff5526a37d6 --- /dev/null +++ b/queue-5.10/nfsd-fix-delegation_blocked-to-block-correctly-for-a.patch @@ -0,0 +1,65 @@ +From 93529c612ade28e53bf1b0639f1d519476e164ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 15:06:36 +1000 +Subject: nfsd: fix delegation_blocked() to block correctly for at least 30 + seconds + +From: NeilBrown + +[ Upstream commit 45bb63ed20e02ae146336412889fe5450316a84f ] + +The pair of bloom filtered used by delegation_blocked() was intended to +block delegations on given filehandles for between 30 and 60 seconds. A +new filehandle would be recorded in the "new" bit set. That would then +be switch to the "old" bit set between 0 and 30 seconds later, and it +would remain as the "old" bit set for 30 seconds. + +Unfortunately the code intended to clear the old bit set once it reached +30 seconds old, preparing it to be the next new bit set, instead cleared +the *new* bit set before switching it to be the old bit set. This means +that the "old" bit set is always empty and delegations are blocked +between 0 and 30 seconds. + +This patch updates bd->new before clearing the set with that index, +instead of afterwards. + +Reported-by: Olga Kornievskaia +Cc: stable@vger.kernel.org +Fixes: 6282cd565553 ("NFSD: Don't hand out delegations for 30 seconds after recalling them.") +Signed-off-by: NeilBrown +Reviewed-by: Benjamin Coddington +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 8e84ddccce4bf..18d64a9312a7a 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -1090,7 +1090,8 @@ static void nfs4_free_deleg(struct nfs4_stid *stid) + * When a delegation is recalled, the filehandle is stored in the "new" + * filter. + * Every 30 seconds we swap the filters and clear the "new" one, +- * unless both are empty of course. ++ * unless both are empty of course. This results in delegations for a ++ * given filehandle being blocked for between 30 and 60 seconds. + * + * Each filter is 256 bits. We hash the filehandle to 32bit and use the + * low 3 bytes as hash-table indices. +@@ -1119,9 +1120,9 @@ static int delegation_blocked(struct knfsd_fh *fh) + if (ktime_get_seconds() - bd->swap_time > 30) { + bd->entries -= bd->old_entries; + bd->old_entries = bd->entries; ++ bd->new = 1-bd->new; + memset(bd->set[bd->new], 0, + sizeof(bd->set[0])); +- bd->new = 1-bd->new; + bd->swap_time = ktime_get_seconds(); + } + spin_unlock(&blocked_delegations_lock); +-- +2.43.0 + diff --git a/queue-5.10/nfsd-fix-nfsv4-s-putpubfh-operation.patch-2672 b/queue-5.10/nfsd-fix-nfsv4-s-putpubfh-operation.patch-2672 new file mode 100644 index 00000000000..88d2857b735 --- /dev/null +++ b/queue-5.10/nfsd-fix-nfsv4-s-putpubfh-operation.patch-2672 @@ -0,0 +1,60 @@ +From 8a4e92f880f9caba6dd521e29c331d1a7d8b72ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Aug 2024 13:11:07 -0400 +Subject: NFSD: Fix NFSv4's PUTPUBFH operation + +From: Chuck Lever + +[ Upstream commit 202f39039a11402dcbcd5fece8d9fa6be83f49ae ] + +According to RFC 8881, all minor versions of NFSv4 support PUTPUBFH. + +Replace the XDR decoder for PUTPUBFH with a "noop" since we no +longer want the minorversion check, and PUTPUBFH has no arguments to +decode. (Ideally nfsd4_decode_noop should really be called +nfsd4_decode_void). + +PUTPUBFH should now behave just like PUTROOTFH. + +Reported-by: Cedric Blancher +Fixes: e1a90ebd8b23 ("NFSD: Combine decode operations for v4 and v4.1") +Cc: Dan Shelton +Cc: Roland Mainz +Cc: stable@vger.kernel.org +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4xdr.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 5a68c62864925..d1625a6ff3ce3 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1245,14 +1245,6 @@ nfsd4_decode_putfh(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u) + return nfs_ok; + } + +-static __be32 +-nfsd4_decode_putpubfh(struct nfsd4_compoundargs *argp, union nfsd4_op_u *p) +-{ +- if (argp->minorversion == 0) +- return nfs_ok; +- return nfserr_notsupp; +-} +- + static __be32 + nfsd4_decode_read(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u) + { +@@ -2345,7 +2337,7 @@ static const nfsd4_dec nfsd4_dec_ops[] = { + [OP_OPEN_CONFIRM] = nfsd4_decode_open_confirm, + [OP_OPEN_DOWNGRADE] = nfsd4_decode_open_downgrade, + [OP_PUTFH] = nfsd4_decode_putfh, +- [OP_PUTPUBFH] = nfsd4_decode_putpubfh, ++ [OP_PUTPUBFH] = nfsd4_decode_noop, + [OP_PUTROOTFH] = nfsd4_decode_noop, + [OP_READ] = nfsd4_decode_read, + [OP_READDIR] = nfsd4_decode_readdir, +-- +2.43.0 + diff --git a/queue-5.10/r8169-add-tally-counter-fields-added-with-rtl8125.patch b/queue-5.10/r8169-add-tally-counter-fields-added-with-rtl8125.patch new file mode 100644 index 00000000000..8703d58e0f6 --- /dev/null +++ b/queue-5.10/r8169-add-tally-counter-fields-added-with-rtl8125.patch @@ -0,0 +1,66 @@ +From 8fadd8522cb48116ce85da59510f20248a95fecf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Sep 2024 23:04:46 +0200 +Subject: r8169: add tally counter fields added with RTL8125 + +From: Heiner Kallweit + +[ Upstream commit ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a ] + +RTL8125 added fields to the tally counter, what may result in the chip +dma'ing these new fields to unallocated memory. Therefore make sure +that the allocated memory area is big enough to hold all of the +tally counter values, even if we use only parts of it. + +Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") +Cc: stable@vger.kernel.org +Signed-off-by: Heiner Kallweit +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/741d26a9-2b2b-485d-91d9-ecb302e345b5@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 6017682536e0e..e9296d63450d8 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -570,6 +570,33 @@ struct rtl8169_counters { + __le32 rx_multicast; + __le16 tx_aborted; + __le16 tx_underrun; ++ /* new since RTL8125 */ ++ __le64 tx_octets; ++ __le64 rx_octets; ++ __le64 rx_multicast64; ++ __le64 tx_unicast64; ++ __le64 tx_broadcast64; ++ __le64 tx_multicast64; ++ __le32 tx_pause_on; ++ __le32 tx_pause_off; ++ __le32 tx_pause_all; ++ __le32 tx_deferred; ++ __le32 tx_late_collision; ++ __le32 tx_all_collision; ++ __le32 tx_aborted32; ++ __le32 align_errors32; ++ __le32 rx_frame_too_long; ++ __le32 rx_runt; ++ __le32 rx_pause_on; ++ __le32 rx_pause_off; ++ __le32 rx_pause_all; ++ __le32 rx_unknown_opcode; ++ __le32 rx_mac_error; ++ __le32 tx_underrun32; ++ __le32 rx_mac_missed; ++ __le32 rx_tcam_dropped; ++ __le32 tdu; ++ __le32 rdu; + }; + + struct rtl8169_tc_offsets { +-- +2.43.0 + diff --git a/queue-5.10/r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch b/queue-5.10/r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch new file mode 100644 index 00000000000..0d42dc2114e --- /dev/null +++ b/queue-5.10/r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch @@ -0,0 +1,48 @@ +From d4b83badf8aca204a88b500d08c2593e4515554f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 15:00:21 +0100 +Subject: r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun" + +From: Colin Ian King + +[ Upstream commit 8df9439389a44fb2cc4ef695e08d6a8870b1616c ] + +There is a spelling mistake in the struct field tx_underun, rename +it to tx_underrun. + +Signed-off-by: Colin Ian King +Reviewed-by: Simon Horman +Reviewed-by: Heiner Kallweit +Link: https://patch.msgid.link/20240909140021.64884-1-colin.i.king@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: ced8e8b8f40a ("r8169: add tally counter fields added with RTL8125") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 4c588fc43eb9b..6017682536e0e 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -569,7 +569,7 @@ struct rtl8169_counters { + __le64 rx_broadcast; + __le32 rx_multicast; + __le16 tx_aborted; +- __le16 tx_underun; ++ __le16 tx_underrun; + }; + + struct rtl8169_tc_offsets { +@@ -1670,7 +1670,7 @@ static void rtl8169_get_ethtool_stats(struct net_device *dev, + data[9] = le64_to_cpu(counters->rx_broadcast); + data[10] = le32_to_cpu(counters->rx_multicast); + data[11] = le16_to_cpu(counters->tx_aborted); +- data[12] = le16_to_cpu(counters->tx_underun); ++ data[12] = le16_to_cpu(counters->tx_underrun); + } + + static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data) +-- +2.43.0 + diff --git a/queue-5.10/rtc-at91sam9-fix-of-node-leak-in-probe-error-path.patch-26252 b/queue-5.10/rtc-at91sam9-fix-of-node-leak-in-probe-error-path.patch-26252 new file mode 100644 index 00000000000..77b598219e8 --- /dev/null +++ b/queue-5.10/rtc-at91sam9-fix-of-node-leak-in-probe-error-path.patch-26252 @@ -0,0 +1,37 @@ +From 5b708029a103cf96a12595f381de535455b2cb71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Aug 2024 20:31:03 +0200 +Subject: rtc: at91sam9: fix OF node leak in probe() error path + +From: Krzysztof Kozlowski + +[ Upstream commit 73580e2ee6adfb40276bd420da3bb1abae204e10 ] + +Driver is leaking an OF node reference obtained from +of_parse_phandle_with_fixed_args(). + +Fixes: 43e112bb3dea ("rtc: at91sam9: make use of syscon/regmap to access GPBR registers") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20240825183103.102904-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-at91sam9.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-at91sam9.c b/drivers/rtc/rtc-at91sam9.c +index e39e89867d293..881d750d09005 100644 +--- a/drivers/rtc/rtc-at91sam9.c ++++ b/drivers/rtc/rtc-at91sam9.c +@@ -368,6 +368,7 @@ static int at91_rtc_probe(struct platform_device *pdev) + return ret; + + rtc->gpbr = syscon_node_to_regmap(args.np); ++ of_node_put(args.np); + rtc->gpbr_offset = args.args[0]; + if (IS_ERR(rtc->gpbr)) { + dev_err(&pdev->dev, "failed to retrieve gpbr regmap, aborting.\n"); +-- +2.43.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 947d5e030a9..9dc5501f31f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -420,3 +420,31 @@ btrfs-fix-a-null-pointer-dereference-when-failed-to-start-a-new-trasacntion.patc btrfs-wait-for-fixup-workers-before-stopping-cleaner-kthread-during-umount.patch gpio-davinci-fix-lazy-disable.patch drm-sched-add-locking-to-drm_sched_entity_modify_sched.patch +kconfig-qconf-fix-buffer-overflow-in-debug-links.patch +i2c-xiic-simplify-with-dev_err_probe.patch +i2c-xiic-use-devm_clk_get_enabled.patch +i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-p.patch +ext4-properly-sync-file-size-update-after-o_sync-dir.patch +ext4-dax-fix-overflowing-extents-beyond-inode-size-w.patch +arm64-add-cortex-715-cpu-part-definition.patch +arm64-cputype-add-neoverse-n3-definitions.patch +arm64-errata-expand-speculative-ssbs-workaround-once.patch +uprobes-fix-kernel-info-leak-via-uprobes-vma.patch +drm-omapdrm-add-missing-check-for-alloc_ordered_work.patch +drm-rockchip-define-gamma-registers-for-rk3399.patch +drm-rockchip-support-gamma-control-on-rk3399.patch +drm-rockchip-vop-clear-dma-stop-bit-on-rk3066.patch +nfsd-fix-delegation_blocked-to-block-correctly-for-a.patch +nfsd-fix-nfsv4-s-putpubfh-operation.patch-2672 +clk-imx6ul-fix-enet1-gate-configuration.patch +clk-imx6ul-add-ethernet-refclock-mux-support.patch +clk-imx6ul-retain-early-uart-clocks-during-kernel-in.patch +clk-imx6ul-fix-clock-parent-for-imx6ul_clk_enetx_ref.patch +clk-qcom-dispcc-sm8250-use-clk_set_rate_parent-for-b.patch +clk-qcom-clk-rpmh-fix-overflow-in-bcm-vote.patch-10977 +r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch +r8169-add-tally-counter-fields-added-with-rtl8125.patch +rtc-at91sam9-fix-of-node-leak-in-probe-error-path.patch-26252 +acpi-battery-simplify-battery-hook-locking.patch +acpi-battery-fix-possible-crash-when-unregistering-a.patch +btrfs-fix-a-null-pointer-dereference-when-failed-to-.patch diff --git a/queue-5.10/uprobes-fix-kernel-info-leak-via-uprobes-vma.patch b/queue-5.10/uprobes-fix-kernel-info-leak-via-uprobes-vma.patch new file mode 100644 index 00000000000..7e63a1d4475 --- /dev/null +++ b/queue-5.10/uprobes-fix-kernel-info-leak-via-uprobes-vma.patch @@ -0,0 +1,43 @@ +From f48e18571abd2709a65934818a8c3e930b2b6a8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 19:46:01 +0200 +Subject: uprobes: fix kernel info leak via "[uprobes]" vma + +From: Oleg Nesterov + +commit 34820304cc2cd1804ee1f8f3504ec77813d29c8e upstream. + +xol_add_vma() maps the uninitialized page allocated by __create_xol_area() +into userspace. On some architectures (x86) this memory is readable even +without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, +although this doesn't really matter, debugger can read this memory anyway. + +Link: https://lore.kernel.org/all/20240929162047.GA12611@redhat.com/ + +Reported-by: Will Deacon +Fixes: d4b3b6384f98 ("uprobes/core: Allocate XOL slots for uprobes use") +Cc: stable@vger.kernel.org +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Oleg Nesterov +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + kernel/events/uprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index e91d6aac9855c..1ea2c1f311261 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -1496,7 +1496,7 @@ static struct xol_area *__create_xol_area(unsigned long vaddr) + + area->xol_mapping.name = "[uprobes]"; + area->xol_mapping.pages = area->pages; +- area->pages[0] = alloc_page(GFP_HIGHUSER); ++ area->pages[0] = alloc_page(GFP_HIGHUSER | __GFP_ZERO); + if (!area->pages[0]) + goto free_bitmap; + area->pages[1] = NULL; +-- +2.43.0 +