From: Greg Kroah-Hartman Date: Tue, 20 May 2025 10:27:26 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v5.15.184~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6fcc8fb28d7dc56db3431499f611799cadc8893d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: accel-ivpu-fix-fw-log-printing.patch accel-ivpu-refactor-functions-in-ivpu_fw_log.c.patch accel-ivpu-rename-ivpu_log_level-to-fw_log_level.patch accel-ivpu-reset-fw-log-on-cold-boot.patch bluetooth-btnxpuart-fix-kernel-panic-during-fw-release.patch iio-light-opt3001-fix-deadlock-due-to-concurrent-flag-access.patch --- diff --git a/queue-6.12/accel-ivpu-fix-fw-log-printing.patch b/queue-6.12/accel-ivpu-fix-fw-log-printing.patch new file mode 100644 index 0000000000..4ff8d8a949 --- /dev/null +++ b/queue-6.12/accel-ivpu-fix-fw-log-printing.patch @@ -0,0 +1,117 @@ +From 4bc988b47019536b3b1f7d9c5b83893c712d94d6 Mon Sep 17 00:00:00 2001 +From: Jacek Lawrynowicz +Date: Mon, 30 Sep 2024 21:52:56 +0200 +Subject: accel/ivpu: Fix fw log printing + +From: Jacek Lawrynowicz + +commit 4bc988b47019536b3b1f7d9c5b83893c712d94d6 upstream. + + - Fix empty log detection that couldn't work without read_wrap_count + - Start printing wrapped log from correct position (log_start) + - Properly handle logs that are wrapped multiple times in reference + to reader position + - Don't add a newline when log buffer is wrapped + - Always add a newline after printing a log buffer in case log does + not end with one + +Reviewed-by: Tomasz Rusinowicz +Link: https://patchwork.freedesktop.org/patch/msgid/20240930195322.461209-6-jacek.lawrynowicz@linux.intel.com +Signed-off-by: Jacek Lawrynowicz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/accel/ivpu/ivpu_fw_log.c | 49 +++++++++++++++++++++++++-------------- + 1 file changed, 32 insertions(+), 17 deletions(-) + +--- a/drivers/accel/ivpu/ivpu_fw_log.c ++++ b/drivers/accel/ivpu/ivpu_fw_log.c +@@ -87,7 +87,7 @@ static void fw_log_print_lines(char *buf + } + line[index] = 0; + if (index != 0) +- drm_printf(p, "%s\n", line); ++ drm_printf(p, "%s", line); + } + + static void fw_log_print_buffer(struct vpu_tracing_buffer_header *log, const char *prefix, +@@ -95,23 +95,29 @@ static void fw_log_print_buffer(struct v + { + char *log_data = (void *)log + log->header_size; + u32 data_size = log->size - log->header_size; +- u32 log_start = log->read_index; +- u32 log_end = log->write_index; ++ u32 log_start = only_new_msgs ? READ_ONCE(log->read_index) : 0; ++ u32 log_end = READ_ONCE(log->write_index); + +- if (!(log->write_index || log->wrap_count) || +- (log->write_index == log->read_index && only_new_msgs)) { +- drm_printf(p, "==== %s \"%s\" log empty ====\n", prefix, log->name); +- return; ++ if (log->wrap_count == log->read_wrap_count) { ++ if (log_end <= log_start) { ++ drm_printf(p, "==== %s \"%s\" log empty ====\n", prefix, log->name); ++ return; ++ } ++ } else if (log->wrap_count == log->read_wrap_count + 1) { ++ if (log_end > log_start) ++ log_start = log_end; ++ } else { ++ log_start = log_end; + } + + drm_printf(p, "==== %s \"%s\" log start ====\n", prefix, log->name); +- if (log->write_index > log->read_index) { ++ if (log_end > log_start) { + fw_log_print_lines(log_data + log_start, log_end - log_start, p); + } else { +- fw_log_print_lines(log_data + log_end, data_size - log_end, p); ++ fw_log_print_lines(log_data + log_start, data_size - log_start, p); + fw_log_print_lines(log_data, log_end, p); + } +- drm_printf(p, "\x1b[0m"); ++ drm_printf(p, "\n\x1b[0m"); /* add new line and clear formatting */ + drm_printf(p, "==== %s \"%s\" log end ====\n", prefix, log->name); + } + +@@ -135,14 +141,19 @@ void ivpu_fw_log_print(struct ivpu_devic + void ivpu_fw_log_mark_read(struct ivpu_device *vdev) + { + struct vpu_tracing_buffer_header *log; +- u32 next = 0; ++ u32 next; + +- while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) +- log->read_index = log->write_index; ++ next = 0; ++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) { ++ log->read_index = READ_ONCE(log->write_index); ++ log->read_wrap_count = READ_ONCE(log->wrap_count); ++ } + + next = 0; +- while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) +- log->read_index = log->write_index; ++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) { ++ log->read_index = READ_ONCE(log->write_index); ++ log->read_wrap_count = READ_ONCE(log->wrap_count); ++ } + } + + void ivpu_fw_log_reset(struct ivpu_device *vdev) +@@ -151,10 +162,14 @@ void ivpu_fw_log_reset(struct ivpu_devic + u32 next; + + next = 0; +- while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) ++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) { + log->read_index = 0; ++ log->read_wrap_count = 0; ++ } + + next = 0; +- while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) ++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) { + log->read_index = 0; ++ log->read_wrap_count = 0; ++ } + } diff --git a/queue-6.12/accel-ivpu-refactor-functions-in-ivpu_fw_log.c.patch b/queue-6.12/accel-ivpu-refactor-functions-in-ivpu_fw_log.c.patch new file mode 100644 index 0000000000..7bb005e391 --- /dev/null +++ b/queue-6.12/accel-ivpu-refactor-functions-in-ivpu_fw_log.c.patch @@ -0,0 +1,169 @@ +From 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 Mon Sep 17 00:00:00 2001 +From: Jacek Lawrynowicz +Date: Mon, 30 Sep 2024 21:52:55 +0200 +Subject: accel/ivpu: Refactor functions in ivpu_fw_log.c + +From: Jacek Lawrynowicz + +commit 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 upstream. + +Make function names more consistent and (arguably) readable in +fw log code. Add fw_log_print_all_in_bo() that remove duplicated code in +ivpu_fw_log_print(). + +Reviewed-by: Tomasz Rusinowicz +Link: https://patchwork.freedesktop.org/patch/msgid/20240930195322.461209-5-jacek.lawrynowicz@linux.intel.com +Signed-off-by: Jacek Lawrynowicz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/accel/ivpu/ivpu_debugfs.c | 2 - + drivers/accel/ivpu/ivpu_fw_log.c | 62 ++++++++++++++++++++------------------ + drivers/accel/ivpu/ivpu_fw_log.h | 2 - + 3 files changed, 35 insertions(+), 31 deletions(-) + +--- a/drivers/accel/ivpu/ivpu_debugfs.c ++++ b/drivers/accel/ivpu/ivpu_debugfs.c +@@ -201,7 +201,7 @@ fw_log_fops_write(struct file *file, con + if (!size) + return -EINVAL; + +- ivpu_fw_log_clear(vdev); ++ ivpu_fw_log_mark_read(vdev); + return size; + } + +--- a/drivers/accel/ivpu/ivpu_fw_log.c ++++ b/drivers/accel/ivpu/ivpu_fw_log.c +@@ -26,8 +26,8 @@ MODULE_PARM_DESC(fw_log_level, + " error=" __stringify(IVPU_FW_LOG_ERROR) + " fatal=" __stringify(IVPU_FW_LOG_FATAL)); + +-static int fw_log_ptr(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *offset, +- struct vpu_tracing_buffer_header **log_header) ++static int fw_log_from_bo(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *offset, ++ struct vpu_tracing_buffer_header **out_log) + { + struct vpu_tracing_buffer_header *log; + +@@ -48,7 +48,7 @@ static int fw_log_ptr(struct ivpu_device + return -EINVAL; + } + +- *log_header = log; ++ *out_log = log; + *offset += log->size; + + ivpu_dbg(vdev, FW_BOOT, +@@ -59,7 +59,7 @@ static int fw_log_ptr(struct ivpu_device + return 0; + } + +-static void buffer_print(char *buffer, u32 size, struct drm_printer *p) ++static void fw_log_print_lines(char *buffer, u32 size, struct drm_printer *p) + { + char line[IVPU_FW_LOG_LINE_LENGTH]; + u32 index = 0; +@@ -90,11 +90,11 @@ static void buffer_print(char *buffer, u + drm_printf(p, "%s\n", line); + } + +-static void fw_log_print_buffer(struct ivpu_device *vdev, struct vpu_tracing_buffer_header *log, +- const char *prefix, bool only_new_msgs, struct drm_printer *p) ++static void fw_log_print_buffer(struct vpu_tracing_buffer_header *log, const char *prefix, ++ bool only_new_msgs, struct drm_printer *p) + { +- char *log_buffer = (void *)log + log->header_size; +- u32 log_size = log->size - log->header_size; ++ char *log_data = (void *)log + log->header_size; ++ u32 data_size = log->size - log->header_size; + u32 log_start = log->read_index; + u32 log_end = log->write_index; + +@@ -106,51 +106,55 @@ static void fw_log_print_buffer(struct i + + drm_printf(p, "==== %s \"%s\" log start ====\n", prefix, log->name); + if (log->write_index > log->read_index) { +- buffer_print(log_buffer + log_start, log_end - log_start, p); ++ fw_log_print_lines(log_data + log_start, log_end - log_start, p); + } else { +- buffer_print(log_buffer + log_end, log_size - log_end, p); +- buffer_print(log_buffer, log_end, p); ++ fw_log_print_lines(log_data + log_end, data_size - log_end, p); ++ fw_log_print_lines(log_data, log_end, p); + } + drm_printf(p, "\x1b[0m"); + drm_printf(p, "==== %s \"%s\" log end ====\n", prefix, log->name); + } + +-void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p) ++static void ++fw_log_print_all_in_bo(struct ivpu_device *vdev, const char *name, ++ struct ivpu_bo *bo, bool only_new_msgs, struct drm_printer *p) + { +- struct vpu_tracing_buffer_header *log_header; ++ struct vpu_tracing_buffer_header *log; + u32 next = 0; + +- while (fw_log_ptr(vdev, vdev->fw->mem_log_crit, &next, &log_header) == 0) +- fw_log_print_buffer(vdev, log_header, "NPU critical", only_new_msgs, p); ++ while (fw_log_from_bo(vdev, bo, &next, &log) == 0) ++ fw_log_print_buffer(log, name, only_new_msgs, p); ++} + +- next = 0; +- while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0) +- fw_log_print_buffer(vdev, log_header, "NPU verbose", only_new_msgs, p); ++void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p) ++{ ++ fw_log_print_all_in_bo(vdev, "NPU critical", vdev->fw->mem_log_crit, only_new_msgs, p); ++ fw_log_print_all_in_bo(vdev, "NPU verbose", vdev->fw->mem_log_verb, only_new_msgs, p); + } + +-void ivpu_fw_log_clear(struct ivpu_device *vdev) ++void ivpu_fw_log_mark_read(struct ivpu_device *vdev) + { +- struct vpu_tracing_buffer_header *log_header; ++ struct vpu_tracing_buffer_header *log; + u32 next = 0; + +- while (fw_log_ptr(vdev, vdev->fw->mem_log_crit, &next, &log_header) == 0) +- log_header->read_index = log_header->write_index; ++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) ++ log->read_index = log->write_index; + + next = 0; +- while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0) +- log_header->read_index = log_header->write_index; ++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) ++ log->read_index = log->write_index; + } + + void ivpu_fw_log_reset(struct ivpu_device *vdev) + { +- struct vpu_tracing_buffer_header *log_header; ++ struct vpu_tracing_buffer_header *log; + u32 next; + + next = 0; +- while (fw_log_ptr(vdev, vdev->fw->mem_log_crit, &next, &log_header) == 0) +- log_header->read_index = 0; ++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) ++ log->read_index = 0; + + next = 0; +- while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0) +- log_header->read_index = 0; ++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) ++ log->read_index = 0; + } +--- a/drivers/accel/ivpu/ivpu_fw_log.h ++++ b/drivers/accel/ivpu/ivpu_fw_log.h +@@ -24,7 +24,7 @@ + extern unsigned int ivpu_fw_log_level; + + void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p); +-void ivpu_fw_log_clear(struct ivpu_device *vdev); ++void ivpu_fw_log_mark_read(struct ivpu_device *vdev); + void ivpu_fw_log_reset(struct ivpu_device *vdev); + + diff --git a/queue-6.12/accel-ivpu-rename-ivpu_log_level-to-fw_log_level.patch b/queue-6.12/accel-ivpu-rename-ivpu_log_level-to-fw_log_level.patch new file mode 100644 index 0000000000..6487a749df --- /dev/null +++ b/queue-6.12/accel-ivpu-rename-ivpu_log_level-to-fw_log_level.patch @@ -0,0 +1,96 @@ +From 3a3fb8110c65d361cd9d750c9e16520f740c93f2 Mon Sep 17 00:00:00 2001 +From: Jacek Lawrynowicz +Date: Mon, 30 Sep 2024 21:52:53 +0200 +Subject: accel/ivpu: Rename ivpu_log_level to fw_log_level + +From: Jacek Lawrynowicz + +commit 3a3fb8110c65d361cd9d750c9e16520f740c93f2 upstream. + +Rename module param ivpu_log_level to fw_log_level, so it is clear +what log level is actually changed. + +Reviewed-by: Maciej Falkowski +Reviewed-by: Jeffrey Hugo +Link: https://patchwork.freedesktop.org/patch/msgid/20240930195322.461209-3-jacek.lawrynowicz@linux.intel.com +Signed-off-by: Jacek Lawrynowicz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/accel/ivpu/ivpu_fw.c | 4 ++-- + drivers/accel/ivpu/ivpu_fw_log.c | 12 ++++++------ + drivers/accel/ivpu/ivpu_fw_log.h | 6 +++--- + 3 files changed, 11 insertions(+), 11 deletions(-) + +--- a/drivers/accel/ivpu/ivpu_fw.c ++++ b/drivers/accel/ivpu/ivpu_fw.c +@@ -218,7 +218,7 @@ static int ivpu_fw_parse(struct ivpu_dev + fw->cold_boot_entry_point = fw_hdr->entry_point; + fw->entry_point = fw->cold_boot_entry_point; + +- fw->trace_level = min_t(u32, ivpu_log_level, IVPU_FW_LOG_FATAL); ++ fw->trace_level = min_t(u32, ivpu_fw_log_level, IVPU_FW_LOG_FATAL); + fw->trace_destination_mask = VPU_TRACE_DESTINATION_VERBOSE_TRACING; + fw->trace_hw_component_mask = -1; + +@@ -323,7 +323,7 @@ static int ivpu_fw_mem_init(struct ivpu_ + goto err_free_fw_mem; + } + +- if (ivpu_log_level <= IVPU_FW_LOG_INFO) ++ if (ivpu_fw_log_level <= IVPU_FW_LOG_INFO) + log_verb_size = IVPU_FW_VERBOSE_BUFFER_LARGE_SIZE; + else + log_verb_size = IVPU_FW_VERBOSE_BUFFER_SMALL_SIZE; +--- a/drivers/accel/ivpu/ivpu_fw_log.c ++++ b/drivers/accel/ivpu/ivpu_fw_log.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (C) 2020-2023 Intel Corporation ++ * Copyright (C) 2020-2024 Intel Corporation + */ + + #include +@@ -15,12 +15,12 @@ + #include "ivpu_fw_log.h" + #include "ivpu_gem.h" + +-#define IVPU_FW_LOG_LINE_LENGTH 256 ++#define IVPU_FW_LOG_LINE_LENGTH 256 + +-unsigned int ivpu_log_level = IVPU_FW_LOG_ERROR; +-module_param(ivpu_log_level, uint, 0444); +-MODULE_PARM_DESC(ivpu_log_level, +- "NPU firmware default trace level: debug=" __stringify(IVPU_FW_LOG_DEBUG) ++unsigned int ivpu_fw_log_level = IVPU_FW_LOG_ERROR; ++module_param_named(fw_log_level, ivpu_fw_log_level, uint, 0444); ++MODULE_PARM_DESC(fw_log_level, ++ "NPU firmware default log level: debug=" __stringify(IVPU_FW_LOG_DEBUG) + " info=" __stringify(IVPU_FW_LOG_INFO) + " warn=" __stringify(IVPU_FW_LOG_WARN) + " error=" __stringify(IVPU_FW_LOG_ERROR) +--- a/drivers/accel/ivpu/ivpu_fw_log.h ++++ b/drivers/accel/ivpu/ivpu_fw_log.h +@@ -1,6 +1,6 @@ + /* SPDX-License-Identifier: GPL-2.0-only */ + /* +- * Copyright (C) 2020-2023 Intel Corporation ++ * Copyright (C) 2020-2024 Intel Corporation + */ + + #ifndef __IVPU_FW_LOG_H__ +@@ -17,12 +17,12 @@ + #define IVPU_FW_LOG_ERROR 4 + #define IVPU_FW_LOG_FATAL 5 + +-extern unsigned int ivpu_log_level; +- + #define IVPU_FW_VERBOSE_BUFFER_SMALL_SIZE SZ_1M + #define IVPU_FW_VERBOSE_BUFFER_LARGE_SIZE SZ_8M + #define IVPU_FW_CRITICAL_BUFFER_SIZE SZ_512K + ++extern unsigned int ivpu_fw_log_level; ++ + void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p); + void ivpu_fw_log_clear(struct ivpu_device *vdev); + diff --git a/queue-6.12/accel-ivpu-reset-fw-log-on-cold-boot.patch b/queue-6.12/accel-ivpu-reset-fw-log-on-cold-boot.patch new file mode 100644 index 0000000000..5c6bbf0f14 --- /dev/null +++ b/queue-6.12/accel-ivpu-reset-fw-log-on-cold-boot.patch @@ -0,0 +1,64 @@ +From 4b4d9e394b6f45ac26ac6144b31604c76b7e3705 Mon Sep 17 00:00:00 2001 +From: Tomasz Rusinowicz +Date: Mon, 30 Sep 2024 21:52:54 +0200 +Subject: accel/ivpu: Reset fw log on cold boot + +From: Tomasz Rusinowicz + +commit 4b4d9e394b6f45ac26ac6144b31604c76b7e3705 upstream. + +Add ivpu_fw_log_reset() that resets the read_index of all FW logs +on cold boot so logs are properly read. + +Signed-off-by: Tomasz Rusinowicz +Reviewed-by: Jacek Lawrynowicz +Reviewed-by: Jeffrey Hugo +Link: https://patchwork.freedesktop.org/patch/msgid/20240930195322.461209-4-jacek.lawrynowicz@linux.intel.com +Signed-off-by: Jacek Lawrynowicz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/accel/ivpu/ivpu_fw_log.c | 14 ++++++++++++++ + drivers/accel/ivpu/ivpu_fw_log.h | 1 + + drivers/accel/ivpu/ivpu_pm.c | 1 + + 3 files changed, 16 insertions(+) + +--- a/drivers/accel/ivpu/ivpu_fw_log.c ++++ b/drivers/accel/ivpu/ivpu_fw_log.c +@@ -140,3 +140,17 @@ void ivpu_fw_log_clear(struct ivpu_devic + while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0) + log_header->read_index = log_header->write_index; + } ++ ++void ivpu_fw_log_reset(struct ivpu_device *vdev) ++{ ++ struct vpu_tracing_buffer_header *log_header; ++ u32 next; ++ ++ next = 0; ++ while (fw_log_ptr(vdev, vdev->fw->mem_log_crit, &next, &log_header) == 0) ++ log_header->read_index = 0; ++ ++ next = 0; ++ while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0) ++ log_header->read_index = 0; ++} +--- a/drivers/accel/ivpu/ivpu_fw_log.h ++++ b/drivers/accel/ivpu/ivpu_fw_log.h +@@ -25,6 +25,7 @@ extern unsigned int ivpu_fw_log_level; + + void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p); + void ivpu_fw_log_clear(struct ivpu_device *vdev); ++void ivpu_fw_log_reset(struct ivpu_device *vdev); + + + #endif /* __IVPU_FW_LOG_H__ */ +--- a/drivers/accel/ivpu/ivpu_pm.c ++++ b/drivers/accel/ivpu/ivpu_pm.c +@@ -38,6 +38,7 @@ static void ivpu_pm_prepare_cold_boot(st + + ivpu_cmdq_reset_all_contexts(vdev); + ivpu_ipc_reset(vdev); ++ ivpu_fw_log_reset(vdev); + ivpu_fw_load(vdev); + fw->entry_point = fw->cold_boot_entry_point; + } diff --git a/queue-6.12/bluetooth-btnxpuart-fix-kernel-panic-during-fw-release.patch b/queue-6.12/bluetooth-btnxpuart-fix-kernel-panic-during-fw-release.patch new file mode 100644 index 0000000000..fd9cc14843 --- /dev/null +++ b/queue-6.12/bluetooth-btnxpuart-fix-kernel-panic-during-fw-release.patch @@ -0,0 +1,85 @@ +From 1f77c05408c96bc0b58ae476a9cadc9e5b9cfd0f Mon Sep 17 00:00:00 2001 +From: Neeraj Sanjay Kale +Date: Mon, 10 Mar 2025 17:32:31 +0530 +Subject: Bluetooth: btnxpuart: Fix kernel panic during FW release + +From: Neeraj Sanjay Kale + +commit 1f77c05408c96bc0b58ae476a9cadc9e5b9cfd0f upstream. + +This fixes a kernel panic seen during release FW in a stress test +scenario where WLAN and BT FW download occurs simultaneously, and due to +a HW bug, chip sends out only 1 bootloader signatures. + +When driver receives the bootloader signature, it enters FW download +mode, but since no consequtive bootloader signatures seen, FW file is +not requested. + +After 60 seconds, when FW download times out, release_firmware causes a +kernel panic. + +[ 2601.949184] Unable to handle kernel paging request at virtual address 0000312e6f006573 +[ 2601.992076] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000111802000 +[ 2601.992080] [0000312e6f006573] pgd=0000000000000000, p4d=0000000000000000 +[ 2601.992087] Internal error: Oops: 0000000096000021 [#1] PREEMPT SMP +[ 2601.992091] Modules linked in: algif_hash algif_skcipher af_alg btnxpuart(O) pciexxx(O) mlan(O) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce snd_soc_fsl_easrc snd_soc_fsl_asoc_card imx8_media_dev(C) snd_soc_fsl_micfil polyval_generic snd_soc_fsl_xcvr snd_soc_fsl_sai snd_soc_imx_audmux snd_soc_fsl_asrc snd_soc_imx_card snd_soc_imx_hdmi snd_soc_fsl_aud2htx snd_soc_fsl_utils imx_pcm_dma dw_hdmi_cec flexcan can_dev +[ 2602.001825] CPU: 2 PID: 20060 Comm: hciconfig Tainted: G C O 6.6.23-lts-next-06236-gb586a521770e #1 +[ 2602.010182] Hardware name: NXP i.MX8MPlus EVK board (DT) +[ 2602.010185] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 2602.010191] pc : _raw_spin_lock+0x34/0x68 +[ 2602.010201] lr : free_fw_priv+0x20/0xfc +[ 2602.020561] sp : ffff800089363b30 +[ 2602.020563] x29: ffff800089363b30 x28: ffff0000d0eb5880 x27: 0000000000000000 +[ 2602.020570] x26: 0000000000000000 x25: ffff0000d728b330 x24: 0000000000000000 +[ 2602.020577] x23: ffff0000dc856f38 +[ 2602.033797] x22: ffff800089363b70 x21: ffff0000dc856000 +[ 2602.033802] x20: ff00312e6f006573 x19: ffff0000d0d9ea80 x18: 0000000000000000 +[ 2602.033809] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaad80dd480 +[ 2602.083320] x14: 0000000000000000 x13: 00000000000001b9 x12: 0000000000000002 +[ 2602.083326] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff800089363a30 +[ 2602.083333] x8 : ffff0001793d75c0 x7 : ffff0000d6dbc400 x6 : 0000000000000000 +[ 2602.083339] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000001 +[ 2602.083346] x2 : 0000000000000000 x1 : 0000000000000001 x0 : ff00312e6f006573 +[ 2602.083354] Call trace: +[ 2602.083356] _raw_spin_lock+0x34/0x68 +[ 2602.083364] release_firmware+0x48/0x6c +[ 2602.083370] nxp_setup+0x3c4/0x540 [btnxpuart] +[ 2602.083383] hci_dev_open_sync+0xf0/0xa34 +[ 2602.083391] hci_dev_open+0xd8/0x178 +[ 2602.083399] hci_sock_ioctl+0x3b0/0x590 +[ 2602.083405] sock_do_ioctl+0x60/0x118 +[ 2602.083413] sock_ioctl+0x2f4/0x374 +[ 2602.091430] __arm64_sys_ioctl+0xac/0xf0 +[ 2602.091437] invoke_syscall+0x48/0x110 +[ 2602.091445] el0_svc_common.constprop.0+0xc0/0xe0 +[ 2602.091452] do_el0_svc+0x1c/0x28 +[ 2602.091457] el0_svc+0x40/0xe4 +[ 2602.091465] el0t_64_sync_handler+0x120/0x12c +[ 2602.091470] el0t_64_sync+0x190/0x194 + +Fixes: e3c4891098c8 ("Bluetooth: btnxpuart: Handle FW Download Abort scenario") +Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets") +Signed-off-by: Neeraj Sanjay Kale +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Bin Lan +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btnxpuart.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/bluetooth/btnxpuart.c ++++ b/drivers/bluetooth/btnxpuart.c +@@ -612,8 +612,10 @@ static int nxp_download_firmware(struct + &nxpdev->tx_state), + msecs_to_jiffies(60000)); + +- release_firmware(nxpdev->fw); +- memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name)); ++ if (nxpdev->fw && strlen(nxpdev->fw_name)) { ++ release_firmware(nxpdev->fw); ++ memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name)); ++ } + + if (err == 0) { + bt_dev_err(hdev, "FW Download Timeout. offset: %d", diff --git a/queue-6.12/drm-xe-gsc-do-not-flush-the-gsc-worker-from-the-reset-path.patch b/queue-6.12/drm-xe-gsc-do-not-flush-the-gsc-worker-from-the-reset-path.patch index 26c09ab076..ae1a0ccd77 100644 --- a/queue-6.12/drm-xe-gsc-do-not-flush-the-gsc-worker-from-the-reset-path.patch +++ b/queue-6.12/drm-xe-gsc-do-not-flush-the-gsc-worker-from-the-reset-path.patch @@ -113,7 +113,7 @@ Signed-off-by: Greg Kroah-Hartman + struct xe_gt *gt = gsc_to_gt(gsc); + + /* Proxy init can take up to 500ms, so wait double that for safety */ -+ return xe_mmio_wait32(>->mmio, HECI_FWSTS1(MTL_GSC_HECI1_BASE), ++ return xe_mmio_wait32(gt, HECI_FWSTS1(MTL_GSC_HECI1_BASE), + HECI1_FWSTS1_CURRENT_STATE, + HECI1_FWSTS1_PROXY_STATE_NORMAL, + USEC_PER_SEC, NULL, false); diff --git a/queue-6.12/iio-light-opt3001-fix-deadlock-due-to-concurrent-flag-access.patch b/queue-6.12/iio-light-opt3001-fix-deadlock-due-to-concurrent-flag-access.patch new file mode 100644 index 0000000000..470592eeca --- /dev/null +++ b/queue-6.12/iio-light-opt3001-fix-deadlock-due-to-concurrent-flag-access.patch @@ -0,0 +1,52 @@ +From f063a28002e3350088b4577c5640882bf4ea17ea Mon Sep 17 00:00:00 2001 +From: Luca Ceresoli +Date: Fri, 21 Mar 2025 19:10:00 +0100 +Subject: iio: light: opt3001: fix deadlock due to concurrent flag access + +From: Luca Ceresoli + +commit f063a28002e3350088b4577c5640882bf4ea17ea upstream. + +The threaded IRQ function in this driver is reading the flag twice: once to +lock a mutex and once to unlock it. Even though the code setting the flag +is designed to prevent it, there are subtle cases where the flag could be +true at the mutex_lock stage and false at the mutex_unlock stage. This +results in the mutex not being unlocked, resulting in a deadlock. + +Fix it by making the opt3001_irq() code generally more robust, reading the +flag into a variable and using the variable value at both stages. + +Fixes: 94a9b7b1809f ("iio: light: add support for TI's opt3001 light sensor") +Cc: stable@vger.kernel.org +Signed-off-by: Luca Ceresoli +Link: https://patch.msgid.link/20250321-opt3001-irq-fix-v1-1-6c520d851562@bootlin.com +Signed-off-by: Jonathan Cameron +[Fixed conflict while applying on 6.12] +Signed-off-by: Luca Ceresoli +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/opt3001.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/iio/light/opt3001.c ++++ b/drivers/iio/light/opt3001.c +@@ -692,8 +692,9 @@ static irqreturn_t opt3001_irq(int irq, + struct opt3001 *opt = iio_priv(iio); + int ret; + bool wake_result_ready_queue = false; ++ bool ok_to_ignore_lock = opt->ok_to_ignore_lock; + +- if (!opt->ok_to_ignore_lock) ++ if (!ok_to_ignore_lock) + mutex_lock(&opt->lock); + + ret = i2c_smbus_read_word_swapped(opt->client, OPT3001_CONFIGURATION); +@@ -730,7 +731,7 @@ static irqreturn_t opt3001_irq(int irq, + } + + out: +- if (!opt->ok_to_ignore_lock) ++ if (!ok_to_ignore_lock) + mutex_unlock(&opt->lock); + + if (wake_result_ready_queue) diff --git a/queue-6.12/series b/queue-6.12/series index 2a99f82b4f..f2514c2d95 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -135,3 +135,9 @@ dmaengine-idxd-refactor-remove-call-with-idxd_cleanup-helper.patch cifs-new-mount-option-for-cifs.upcall-namespace-resolution.patch drm-xe-gsc-do-not-flush-the-gsc-worker-from-the-reset-path.patch mm-page_alloc-fix-race-condition-in-unaccepted-memory-handling.patch +accel-ivpu-rename-ivpu_log_level-to-fw_log_level.patch +accel-ivpu-reset-fw-log-on-cold-boot.patch +accel-ivpu-refactor-functions-in-ivpu_fw_log.c.patch +accel-ivpu-fix-fw-log-printing.patch +iio-light-opt3001-fix-deadlock-due-to-concurrent-flag-access.patch +bluetooth-btnxpuart-fix-kernel-panic-during-fw-release.patch