From: Sasha Levin Date: Thu, 14 Nov 2024 18:07:16 +0000 (-0500) Subject: Fixes for 6.11 X-Git-Tag: v4.19.324~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=754148cf3290167f529fd5c95d69507d26fbcb58;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.11 Signed-off-by: Sasha Levin --- diff --git a/queue-6.11/afs-fix-lock-recursion.patch b/queue-6.11/afs-fix-lock-recursion.patch new file mode 100644 index 00000000000..e1f60335861 --- /dev/null +++ b/queue-6.11/afs-fix-lock-recursion.patch @@ -0,0 +1,214 @@ +From 3e1336457b4e879cdb0978fae4ff7137cb930a55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 11:58:52 +0100 +Subject: afs: Fix lock recursion + +From: David Howells + +[ Upstream commit 610a79ffea02102899a1373fe226d949944a7ed6 ] + +afs_wake_up_async_call() can incur lock recursion. The problem is that it +is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to +take a ref on the afs_call struct in order to pass it to a work queue - but +if the afs_call is already queued, we then have an extraneous ref that must +be put... calling afs_put_call() may call back down into AF_RXRPC through +rxrpc_kernel_shutdown_call(), however, which might try taking the +->notify_lock again. + +This case isn't very common, however, so defer it to a workqueue. The oops +looks something like: + + BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646 + lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0 + CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351 + Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 + Call Trace: + + dump_stack_lvl+0x47/0x70 + do_raw_spin_lock+0x3c/0x90 + rxrpc_kernel_shutdown_call+0x83/0xb0 + afs_put_call+0xd7/0x180 + rxrpc_notify_socket+0xa0/0x190 + rxrpc_input_split_jumbo+0x198/0x1d0 + rxrpc_input_data+0x14b/0x1e0 + ? rxrpc_input_call_packet+0xc2/0x1f0 + rxrpc_input_call_event+0xad/0x6b0 + rxrpc_input_packet_on_conn+0x1e1/0x210 + rxrpc_input_packet+0x3f2/0x4d0 + rxrpc_io_thread+0x243/0x410 + ? __pfx_rxrpc_io_thread+0x10/0x10 + kthread+0xcf/0xe0 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x24/0x40 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1a/0x30 + + +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/1394602.1729162732@warthog.procyon.org.uk +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/internal.h | 2 ++ + fs/afs/rxrpc.c | 83 +++++++++++++++++++++++++++++++++-------------- + 2 files changed, 61 insertions(+), 24 deletions(-) + +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index b306c09808706..c9d620175e80c 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -130,6 +130,7 @@ struct afs_call { + wait_queue_head_t waitq; /* processes awaiting completion */ + struct work_struct async_work; /* async I/O processor */ + struct work_struct work; /* actual work processor */ ++ struct work_struct free_work; /* Deferred free processor */ + struct rxrpc_call *rxcall; /* RxRPC call handle */ + struct rxrpc_peer *peer; /* Remote endpoint */ + struct key *key; /* security for this call */ +@@ -1333,6 +1334,7 @@ extern int __net_init afs_open_socket(struct afs_net *); + extern void __net_exit afs_close_socket(struct afs_net *); + extern void afs_charge_preallocation(struct work_struct *); + extern void afs_put_call(struct afs_call *); ++void afs_deferred_put_call(struct afs_call *call); + void afs_make_call(struct afs_call *call, gfp_t gfp); + void afs_wait_for_call_to_complete(struct afs_call *call); + extern struct afs_call *afs_alloc_flat_call(struct afs_net *, +diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c +index c453428f3c8ba..9f2a3bb56ec69 100644 +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -18,6 +18,7 @@ + + struct workqueue_struct *afs_async_calls; + ++static void afs_deferred_free_worker(struct work_struct *work); + static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long); + static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long); + static void afs_process_async_call(struct work_struct *); +@@ -149,6 +150,7 @@ static struct afs_call *afs_alloc_call(struct afs_net *net, + call->debug_id = atomic_inc_return(&rxrpc_debug_id); + refcount_set(&call->ref, 1); + INIT_WORK(&call->async_work, afs_process_async_call); ++ INIT_WORK(&call->free_work, afs_deferred_free_worker); + init_waitqueue_head(&call->waitq); + spin_lock_init(&call->state_lock); + call->iter = &call->def_iter; +@@ -159,6 +161,36 @@ static struct afs_call *afs_alloc_call(struct afs_net *net, + return call; + } + ++static void afs_free_call(struct afs_call *call) ++{ ++ struct afs_net *net = call->net; ++ int o; ++ ++ ASSERT(!work_pending(&call->async_work)); ++ ++ rxrpc_kernel_put_peer(call->peer); ++ ++ if (call->rxcall) { ++ rxrpc_kernel_shutdown_call(net->socket, call->rxcall); ++ rxrpc_kernel_put_call(net->socket, call->rxcall); ++ call->rxcall = NULL; ++ } ++ if (call->type->destructor) ++ call->type->destructor(call); ++ ++ afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call); ++ kfree(call->request); ++ ++ o = atomic_read(&net->nr_outstanding_calls); ++ trace_afs_call(call->debug_id, afs_call_trace_free, 0, o, ++ __builtin_return_address(0)); ++ kfree(call); ++ ++ o = atomic_dec_return(&net->nr_outstanding_calls); ++ if (o == 0) ++ wake_up_var(&net->nr_outstanding_calls); ++} ++ + /* + * Dispose of a reference on a call. + */ +@@ -173,32 +205,34 @@ void afs_put_call(struct afs_call *call) + o = atomic_read(&net->nr_outstanding_calls); + trace_afs_call(debug_id, afs_call_trace_put, r - 1, o, + __builtin_return_address(0)); ++ if (zero) ++ afs_free_call(call); ++} + +- if (zero) { +- ASSERT(!work_pending(&call->async_work)); +- ASSERT(call->type->name != NULL); +- +- rxrpc_kernel_put_peer(call->peer); +- +- if (call->rxcall) { +- rxrpc_kernel_shutdown_call(net->socket, call->rxcall); +- rxrpc_kernel_put_call(net->socket, call->rxcall); +- call->rxcall = NULL; +- } +- if (call->type->destructor) +- call->type->destructor(call); ++static void afs_deferred_free_worker(struct work_struct *work) ++{ ++ struct afs_call *call = container_of(work, struct afs_call, free_work); + +- afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call); +- kfree(call->request); ++ afs_free_call(call); ++} + +- trace_afs_call(call->debug_id, afs_call_trace_free, 0, o, +- __builtin_return_address(0)); +- kfree(call); ++/* ++ * Dispose of a reference on a call, deferring the cleanup to a workqueue ++ * to avoid lock recursion. ++ */ ++void afs_deferred_put_call(struct afs_call *call) ++{ ++ struct afs_net *net = call->net; ++ unsigned int debug_id = call->debug_id; ++ bool zero; ++ int r, o; + +- o = atomic_dec_return(&net->nr_outstanding_calls); +- if (o == 0) +- wake_up_var(&net->nr_outstanding_calls); +- } ++ zero = __refcount_dec_and_test(&call->ref, &r); ++ o = atomic_read(&net->nr_outstanding_calls); ++ trace_afs_call(debug_id, afs_call_trace_put, r - 1, o, ++ __builtin_return_address(0)); ++ if (zero) ++ schedule_work(&call->free_work); + } + + static struct afs_call *afs_get_call(struct afs_call *call, +@@ -640,7 +674,8 @@ static void afs_wake_up_call_waiter(struct sock *sk, struct rxrpc_call *rxcall, + } + + /* +- * wake up an asynchronous call ++ * Wake up an asynchronous call. The caller is holding the call notify ++ * spinlock around this, so we can't call afs_put_call(). + */ + static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall, + unsigned long call_user_ID) +@@ -657,7 +692,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall, + __builtin_return_address(0)); + + if (!queue_work(afs_async_calls, &call->async_work)) +- afs_put_call(call); ++ afs_deferred_put_call(call); + } + } + +-- +2.43.0 + diff --git a/queue-6.11/asoc-amd-yc-add-quirk-for-asus-vivobook-s15-m3502ra.patch b/queue-6.11/asoc-amd-yc-add-quirk-for-asus-vivobook-s15-m3502ra.patch new file mode 100644 index 00000000000..0a2f4b87760 --- /dev/null +++ b/queue-6.11/asoc-amd-yc-add-quirk-for-asus-vivobook-s15-m3502ra.patch @@ -0,0 +1,42 @@ +From cd28ebd28850a4f13480612f2fbc307a1e867579 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2024 15:32:11 +0200 +Subject: ASoC: amd: yc: Add quirk for ASUS Vivobook S15 M3502RA + +From: Christian Heusel + +[ Upstream commit 182fff3a2aafe4e7f3717a0be9df2fe2ed1a77de ] + +As reported the builtin microphone doesn't work on the ASUS Vivobook +model S15 OLED M3502RA. Therefore add a quirk for it to make it work. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219345 +Signed-off-by: Christian Heusel +Link: https://patch.msgid.link/20241010-bugzilla-219345-asus-vivobook-v1-1-3bb24834e2c3@heusel.eu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 601785ee2f0b8..275faf25e5a76 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -339,6 +339,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "M7600RE"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "M3502RA"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.11/asoc-amd-yc-fix-non-functional-mic-on-asus-e1404fa.patch b/queue-6.11/asoc-amd-yc-fix-non-functional-mic-on-asus-e1404fa.patch new file mode 100644 index 00000000000..ab991ef8efc --- /dev/null +++ b/queue-6.11/asoc-amd-yc-fix-non-functional-mic-on-asus-e1404fa.patch @@ -0,0 +1,40 @@ +From 2ef987f57c0c1fc45fd4da30162c74548cce9b35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 10:40:37 +0700 +Subject: ASoC: amd: yc: Fix non-functional mic on ASUS E1404FA + +From: Ilya Dudikov + +[ Upstream commit b0867999e3282378a0b26a7ad200233044d31eca ] + +ASUS Vivobook E1404FA needs a quirks-table entry for the internal microphone to function properly. + +Signed-off-by: Ilya Dudikov +Link: https://patch.msgid.link/20241016034038.13481-1-ilyadud25@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 275faf25e5a76..dc476bfb6da40 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -325,6 +325,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "E1404FA"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.11/asoc-codecs-fix-error-handling-in-aw_dev_get_dsp_sta.patch b/queue-6.11/asoc-codecs-fix-error-handling-in-aw_dev_get_dsp_sta.patch new file mode 100644 index 00000000000..de9e232165d --- /dev/null +++ b/queue-6.11/asoc-codecs-fix-error-handling-in-aw_dev_get_dsp_sta.patch @@ -0,0 +1,36 @@ +From 0033290c8b3f12e34fe1dedaf9df65e2a3c61ccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 00:39:38 -0700 +Subject: ASoC: codecs: Fix error handling in aw_dev_get_dsp_status function + +From: Zhu Jun + +[ Upstream commit 251ce34a446ef0e1d6acd65cf5947abd5d10b8b6 ] + +Added proper error handling for register value check that +return -EPERM when register value does not meet expected condition + +Signed-off-by: Zhu Jun +Link: https://patch.msgid.link/20241009073938.7472-1-zhujun2@cmss.chinamobile.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/aw88399.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/aw88399.c b/sound/soc/codecs/aw88399.c +index 8dc2b8aa6832d..bba59885242d0 100644 +--- a/sound/soc/codecs/aw88399.c ++++ b/sound/soc/codecs/aw88399.c +@@ -656,7 +656,7 @@ static int aw_dev_get_dsp_status(struct aw_device *aw_dev) + if (ret) + return ret; + if (!(reg_val & (~AW88399_WDT_CNT_MASK))) +- ret = -EPERM; ++ return -EPERM; + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.11/asoc-codecs-lpass-rx-macro-fix-rxn-rx-n-macro-for-ds.patch b/queue-6.11/asoc-codecs-lpass-rx-macro-fix-rxn-rx-n-macro-for-ds.patch new file mode 100644 index 00000000000..2bf6e169fa7 --- /dev/null +++ b/queue-6.11/asoc-codecs-lpass-rx-macro-fix-rxn-rx-n-macro-for-ds.patch @@ -0,0 +1,113 @@ +From 634b71f4529ca319dd178edf70bbdc5dbb5235ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 23:10:49 +0100 +Subject: ASoC: codecs: lpass-rx-macro: fix RXn(rx,n) macro for DSM_CTL and + SEC7 regs + +From: Alexey Klimov + +[ Upstream commit 9fc9ef05727ccb45fd881770f2aa5c3774b2e8e2 ] + +Turns out some registers of pre-2.5 version of rxmacro codecs are not +located at the expected offsets but 0xc further away in memory. So far +the detected registers are CDC_RX_RX2_RX_PATH_SEC7 and +CDC_RX_RX2_RX_PATH_DSM_CTL. + +CDC_RX_RXn_RX_PATH_DSM_CTL(rx, n) macro incorrectly generates the address +0x540 for RX2 but it should be 0x54C and it also overwrites +CDC_RX_RX2_RX_PATH_SEC7 which is located at 0x540. +The same goes for CDC_RX_RXn_RX_PATH_SEC7(rx, n). + +Fix this by introducing additional rxn_reg_stride2 offset. For 2.5 version +and above this offset will be equal to 0. +With such change the corresponding RXn() macros will generate the same +values for 2.5 codec version for all RX paths and the same old values +for pre-2.5 version for RX0 and RX1. However for the latter case with +RX2 path it will also add rxn_reg_stride2 on top. + +While at this, also remove specific if-check for INTERP_AUX from +rx_macro_digital_mute() and rx_macro_enable_interp_clk(). These if-check +was used to handle such special offset for AUX interpolator but since +CDC_RX_RXn_RX_PATH_SEC7(rx, n) and CDC_RX_RXn_RX_PATH_DSM_CTL(rx, n) +macros will generate the correst addresses of dsm register, they are no +longer needed. + +Cc: Srinivas Kandagatla +Cc: Krzysztof Kozlowski +Signed-off-by: Alexey Klimov +Reviewed-by: Dmitry Baryshkov +Link: https://patch.msgid.link/20241016221049.1145101-1-alexey.klimov@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-rx-macro.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index ac759f4a880d0..3be83c74d4099 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -202,12 +202,14 @@ + #define CDC_RX_RXn_RX_PATH_SEC3(rx, n) (0x042c + rx->rxn_reg_stride * n) + #define CDC_RX_RX0_RX_PATH_SEC4 (0x0430) + #define CDC_RX_RX0_RX_PATH_SEC7 (0x0434) +-#define CDC_RX_RXn_RX_PATH_SEC7(rx, n) (0x0434 + rx->rxn_reg_stride * n) ++#define CDC_RX_RXn_RX_PATH_SEC7(rx, n) \ ++ (0x0434 + (rx->rxn_reg_stride * n) + ((n > 1) ? rx->rxn_reg_stride2 : 0)) + #define CDC_RX_DSM_OUT_DELAY_SEL_MASK GENMASK(2, 0) + #define CDC_RX_DSM_OUT_DELAY_TWO_SAMPLE 0x2 + #define CDC_RX_RX0_RX_PATH_MIX_SEC0 (0x0438) + #define CDC_RX_RX0_RX_PATH_MIX_SEC1 (0x043C) +-#define CDC_RX_RXn_RX_PATH_DSM_CTL(rx, n) (0x0440 + rx->rxn_reg_stride * n) ++#define CDC_RX_RXn_RX_PATH_DSM_CTL(rx, n) \ ++ (0x0440 + (rx->rxn_reg_stride * n) + ((n > 1) ? rx->rxn_reg_stride2 : 0)) + #define CDC_RX_RXn_DSM_CLK_EN_MASK BIT(0) + #define CDC_RX_RX0_RX_PATH_DSM_CTL (0x0440) + #define CDC_RX_RX0_RX_PATH_DSM_DATA1 (0x0444) +@@ -645,6 +647,7 @@ struct rx_macro { + int rx_mclk_cnt; + enum lpass_codec_version codec_version; + int rxn_reg_stride; ++ int rxn_reg_stride2; + bool is_ear_mode_on; + bool hph_pwr_mode; + bool hph_hd2_mode; +@@ -1929,9 +1932,6 @@ static int rx_macro_digital_mute(struct snd_soc_dai *dai, int mute, int stream) + CDC_RX_PATH_PGA_MUTE_MASK, 0x0); + } + +- if (j == INTERP_AUX) +- dsm_reg = CDC_RX_RXn_RX_PATH_DSM_CTL(rx, 2); +- + int_mux_cfg0 = CDC_RX_INP_MUX_RX_INT0_CFG0 + j * 8; + int_mux_cfg1 = int_mux_cfg0 + 4; + int_mux_cfg0_val = snd_soc_component_read(component, int_mux_cfg0); +@@ -2702,9 +2702,6 @@ static int rx_macro_enable_interp_clk(struct snd_soc_component *component, + + main_reg = CDC_RX_RXn_RX_PATH_CTL(rx, interp_idx); + dsm_reg = CDC_RX_RXn_RX_PATH_DSM_CTL(rx, interp_idx); +- if (interp_idx == INTERP_AUX) +- dsm_reg = CDC_RX_RXn_RX_PATH_DSM_CTL(rx, 2); +- + rx_cfg2_reg = CDC_RX_RXn_RX_PATH_CFG2(rx, interp_idx); + + if (SND_SOC_DAPM_EVENT_ON(event)) { +@@ -3821,6 +3818,7 @@ static int rx_macro_probe(struct platform_device *pdev) + case LPASS_CODEC_VERSION_2_0: + case LPASS_CODEC_VERSION_2_1: + rx->rxn_reg_stride = 0x80; ++ rx->rxn_reg_stride2 = 0xc; + def_count = ARRAY_SIZE(rx_defaults) + ARRAY_SIZE(rx_pre_2_5_defaults); + reg_defaults = kmalloc_array(def_count, sizeof(struct reg_default), GFP_KERNEL); + if (!reg_defaults) +@@ -3834,6 +3832,7 @@ static int rx_macro_probe(struct platform_device *pdev) + case LPASS_CODEC_VERSION_2_7: + case LPASS_CODEC_VERSION_2_8: + rx->rxn_reg_stride = 0xc0; ++ rx->rxn_reg_stride2 = 0x0; + def_count = ARRAY_SIZE(rx_defaults) + ARRAY_SIZE(rx_2_5_defaults); + reg_defaults = kmalloc_array(def_count, sizeof(struct reg_default), GFP_KERNEL); + if (!reg_defaults) +-- +2.43.0 + diff --git a/queue-6.11/asoc-fsl_micfil-add-sample-rate-constraint.patch b/queue-6.11/asoc-fsl_micfil-add-sample-rate-constraint.patch new file mode 100644 index 00000000000..744c49ad5a6 --- /dev/null +++ b/queue-6.11/asoc-fsl_micfil-add-sample-rate-constraint.patch @@ -0,0 +1,108 @@ +From 4101f6868cfa5e1d55c939452697907fdc9acfe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 13:38:33 +0800 +Subject: ASoC: fsl_micfil: Add sample rate constraint + +From: Shengjiu Wang + +[ Upstream commit b9a8ecf81066e01e8a3de35517481bc5aa0439e5 ] + +On some platforms, for example i.MX93, there is only one +audio PLL source, so some sample rate can't be supported. +If the PLL source is used for 8kHz series rates, then 11kHz +series rates can't be supported. + +So add constraints according to the frequency of available +clock sources, then alsa-lib will help to convert the +unsupported rate for the driver. + +Signed-off-by: Shengjiu Wang +Link: https://patch.msgid.link/1728884313-6778-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_micfil.c | 38 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c +index a3d580b2bbf46..1ecfa1184adac 100644 +--- a/sound/soc/fsl/fsl_micfil.c ++++ b/sound/soc/fsl/fsl_micfil.c +@@ -28,6 +28,13 @@ + + #define MICFIL_OSR_DEFAULT 16 + ++#define MICFIL_NUM_RATES 7 ++#define MICFIL_CLK_SRC_NUM 3 ++/* clock source ids */ ++#define MICFIL_AUDIO_PLL1 0 ++#define MICFIL_AUDIO_PLL2 1 ++#define MICFIL_CLK_EXT3 2 ++ + enum quality { + QUALITY_HIGH, + QUALITY_MEDIUM, +@@ -45,9 +52,12 @@ struct fsl_micfil { + struct clk *mclk; + struct clk *pll8k_clk; + struct clk *pll11k_clk; ++ struct clk *clk_src[MICFIL_CLK_SRC_NUM]; + struct snd_dmaengine_dai_dma_data dma_params_rx; + struct sdma_peripheral_config sdmacfg; + struct snd_soc_card *card; ++ struct snd_pcm_hw_constraint_list constraint_rates; ++ unsigned int constraint_rates_list[MICFIL_NUM_RATES]; + unsigned int dataline; + char name[32]; + int irq[MICFIL_IRQ_LINES]; +@@ -475,12 +485,34 @@ static int fsl_micfil_startup(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { + struct fsl_micfil *micfil = snd_soc_dai_get_drvdata(dai); ++ unsigned int rates[MICFIL_NUM_RATES] = {8000, 11025, 16000, 22050, 32000, 44100, 48000}; ++ int i, j, k = 0; ++ u64 clk_rate; + + if (!micfil) { + dev_err(dai->dev, "micfil dai priv_data not set\n"); + return -EINVAL; + } + ++ micfil->constraint_rates.list = micfil->constraint_rates_list; ++ micfil->constraint_rates.count = 0; ++ ++ for (j = 0; j < MICFIL_NUM_RATES; j++) { ++ for (i = 0; i < MICFIL_CLK_SRC_NUM; i++) { ++ clk_rate = clk_get_rate(micfil->clk_src[i]); ++ if (clk_rate != 0 && do_div(clk_rate, rates[j]) == 0) { ++ micfil->constraint_rates_list[k++] = rates[j]; ++ micfil->constraint_rates.count++; ++ break; ++ } ++ } ++ } ++ ++ if (micfil->constraint_rates.count > 0) ++ snd_pcm_hw_constraint_list(substream->runtime, 0, ++ SNDRV_PCM_HW_PARAM_RATE, ++ &micfil->constraint_rates); ++ + return 0; + } + +@@ -1175,6 +1207,12 @@ static int fsl_micfil_probe(struct platform_device *pdev) + fsl_asoc_get_pll_clocks(&pdev->dev, &micfil->pll8k_clk, + &micfil->pll11k_clk); + ++ micfil->clk_src[MICFIL_AUDIO_PLL1] = micfil->pll8k_clk; ++ micfil->clk_src[MICFIL_AUDIO_PLL2] = micfil->pll11k_clk; ++ micfil->clk_src[MICFIL_CLK_EXT3] = devm_clk_get(&pdev->dev, "clkext3"); ++ if (IS_ERR(micfil->clk_src[MICFIL_CLK_EXT3])) ++ micfil->clk_src[MICFIL_CLK_EXT3] = NULL; ++ + /* init regmap */ + regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res); + if (IS_ERR(regs)) +-- +2.43.0 + diff --git a/queue-6.11/asoc-intel-avs-update-stream-status-in-a-separate-th.patch b/queue-6.11/asoc-intel-avs-update-stream-status-in-a-separate-th.patch new file mode 100644 index 00000000000..fe5d68434e8 --- /dev/null +++ b/queue-6.11/asoc-intel-avs-update-stream-status-in-a-separate-th.patch @@ -0,0 +1,131 @@ +From 77d05d30f916fd53bcdccf1393701e52e147770f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 10:37:58 +0200 +Subject: ASoC: Intel: avs: Update stream status in a separate thread +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 0dbb186c3510cad4e9f443e801bf2e6ab5770c00 ] + +Function snd_pcm_period_elapsed() is part of sequence servicing HDAudio +stream IRQs. It's called under Global Interrupt Enable (GIE) disabled - +no HDAudio interrupts will be raised. At the same time, the function may +end up calling __snd_pcm_xrun() or snd_pcm_drain_done(). On the +avs-driver side, this translates to IPCs and as GIE is disabled, these +will never complete successfully. + +Improve system stability by scheduling stream-IRQ handling in a separate +thread. + +Signed-off-by: Amadeusz Sławiński +Reviewed-by: Cezary Rojewski +Link: https://patch.msgid.link/20241008083758.756578-1-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/core.c | 3 ++- + sound/soc/intel/avs/pcm.c | 19 +++++++++++++++++++ + sound/soc/intel/avs/pcm.h | 16 ++++++++++++++++ + 3 files changed, 37 insertions(+), 1 deletion(-) + create mode 100644 sound/soc/intel/avs/pcm.h + +diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c +index f2dc82a2abc71..4d1e6c84918c6 100644 +--- a/sound/soc/intel/avs/core.c ++++ b/sound/soc/intel/avs/core.c +@@ -28,6 +28,7 @@ + #include "avs.h" + #include "cldma.h" + #include "messages.h" ++#include "pcm.h" + + static u32 pgctl_mask = AZX_PGCTL_LSRMD_MASK; + module_param(pgctl_mask, uint, 0444); +@@ -247,7 +248,7 @@ static void hdac_stream_update_pos(struct hdac_stream *stream, u64 buffer_size) + static void hdac_update_stream(struct hdac_bus *bus, struct hdac_stream *stream) + { + if (stream->substream) { +- snd_pcm_period_elapsed(stream->substream); ++ avs_period_elapsed(stream->substream); + } else if (stream->cstream) { + u64 buffer_size = stream->cstream->runtime->buffer_size; + +diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c +index c76b86254a8b4..37b1880c81141 100644 +--- a/sound/soc/intel/avs/pcm.c ++++ b/sound/soc/intel/avs/pcm.c +@@ -16,6 +16,7 @@ + #include + #include "avs.h" + #include "path.h" ++#include "pcm.h" + #include "topology.h" + #include "../../codecs/hda.h" + +@@ -30,6 +31,7 @@ struct avs_dma_data { + struct hdac_ext_stream *host_stream; + }; + ++ struct work_struct period_elapsed_work; + struct snd_pcm_substream *substream; + }; + +@@ -56,6 +58,22 @@ avs_dai_find_path_template(struct snd_soc_dai *dai, bool is_fe, int direction) + return dw->priv; + } + ++static void avs_period_elapsed_work(struct work_struct *work) ++{ ++ struct avs_dma_data *data = container_of(work, struct avs_dma_data, period_elapsed_work); ++ ++ snd_pcm_period_elapsed(data->substream); ++} ++ ++void avs_period_elapsed(struct snd_pcm_substream *substream) ++{ ++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); ++ struct snd_soc_dai *dai = snd_soc_rtd_to_cpu(rtd, 0); ++ struct avs_dma_data *data = snd_soc_dai_get_dma_data(dai, substream); ++ ++ schedule_work(&data->period_elapsed_work); ++} ++ + static int avs_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) + { + struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream); +@@ -77,6 +95,7 @@ static int avs_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_d + data->substream = substream; + data->template = template; + data->adev = adev; ++ INIT_WORK(&data->period_elapsed_work, avs_period_elapsed_work); + snd_soc_dai_set_dma_data(dai, substream, data); + + if (rtd->dai_link->ignore_suspend) +diff --git a/sound/soc/intel/avs/pcm.h b/sound/soc/intel/avs/pcm.h +new file mode 100644 +index 0000000000000..0f3615c903982 +--- /dev/null ++++ b/sound/soc/intel/avs/pcm.h +@@ -0,0 +1,16 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++/* ++ * Copyright(c) 2024 Intel Corporation ++ * ++ * Authors: Cezary Rojewski ++ * Amadeusz Slawinski ++ */ ++ ++#ifndef __SOUND_SOC_INTEL_AVS_PCM_H ++#define __SOUND_SOC_INTEL_AVS_PCM_H ++ ++#include ++ ++void avs_period_elapsed(struct snd_pcm_substream *substream); ++ ++#endif +-- +2.43.0 + diff --git a/queue-6.11/asoc-intel-soc-acpi-lnl-add-match-entry-for-tm2-lapt.patch b/queue-6.11/asoc-intel-soc-acpi-lnl-add-match-entry-for-tm2-lapt.patch new file mode 100644 index 00000000000..f6083bf951d --- /dev/null +++ b/queue-6.11/asoc-intel-soc-acpi-lnl-add-match-entry-for-tm2-lapt.patch @@ -0,0 +1,99 @@ +From a1243a1e4c7483dfb4bf656da30de0ab648d1cf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 11:07:03 +0800 +Subject: ASoC: Intel: soc-acpi: lnl: Add match entry for TM2 laptops +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Derek Fang + +[ Upstream commit 6924565a04e5f424c95e6d894584e3059f257373 ] + +Add a new match table entry on Lunarlake for the TM2 laptops +with rt713 and rt1318. + +Signed-off-by: Derek Fang +Reviewed-by: Péter Ujfalusi +Reviewed-by: Ranjani Sridharan +Signed-off-by: Bard Liao +Link: https://patch.msgid.link/20241016030703.13669-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../intel/common/soc-acpi-intel-lnl-match.c | 38 +++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/sound/soc/intel/common/soc-acpi-intel-lnl-match.c b/sound/soc/intel/common/soc-acpi-intel-lnl-match.c +index edfb668d0580d..8452b66149119 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-lnl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-lnl-match.c +@@ -166,6 +166,15 @@ static const struct snd_soc_acpi_adr_device rt1316_3_group1_adr[] = { + } + }; + ++static const struct snd_soc_acpi_adr_device rt1318_1_adr[] = { ++ { ++ .adr = 0x000133025D131801ull, ++ .num_endpoints = 1, ++ .endpoints = &single_endpoint, ++ .name_prefix = "rt1318-1" ++ } ++}; ++ + static const struct snd_soc_acpi_adr_device rt1318_1_group1_adr[] = { + { + .adr = 0x000130025D131801ull, +@@ -184,6 +193,15 @@ static const struct snd_soc_acpi_adr_device rt1318_2_group1_adr[] = { + } + }; + ++static const struct snd_soc_acpi_adr_device rt713_0_adr[] = { ++ { ++ .adr = 0x000031025D071301ull, ++ .num_endpoints = 1, ++ .endpoints = &single_endpoint, ++ .name_prefix = "rt713" ++ } ++}; ++ + static const struct snd_soc_acpi_adr_device rt714_0_adr[] = { + { + .adr = 0x000030025D071401ull, +@@ -286,6 +304,20 @@ static const struct snd_soc_acpi_link_adr lnl_sdw_rt1318_l12_rt714_l0[] = { + {} + }; + ++static const struct snd_soc_acpi_link_adr lnl_sdw_rt713_l0_rt1318_l1[] = { ++ { ++ .mask = BIT(0), ++ .num_adr = ARRAY_SIZE(rt713_0_adr), ++ .adr_d = rt713_0_adr, ++ }, ++ { ++ .mask = BIT(1), ++ .num_adr = ARRAY_SIZE(rt1318_1_adr), ++ .adr_d = rt1318_1_adr, ++ }, ++ {} ++}; ++ + /* this table is used when there is no I2S codec present */ + struct snd_soc_acpi_mach snd_soc_acpi_intel_lnl_sdw_machines[] = { + /* mockup tests need to be first */ +@@ -343,6 +375,12 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_lnl_sdw_machines[] = { + .drv_name = "sof_sdw", + .sof_tplg_filename = "sof-lnl-rt1318-l12-rt714-l0.tplg" + }, ++ { ++ .link_mask = BIT(0) | BIT(1), ++ .links = lnl_sdw_rt713_l0_rt1318_l1, ++ .drv_name = "sof_sdw", ++ .sof_tplg_filename = "sof-lnl-rt713-l0-rt1318-l1.tplg" ++ }, + {}, + }; + EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_lnl_sdw_machines); +-- +2.43.0 + diff --git a/queue-6.11/asoc-rt722-sdca-increase-clk_stop_timeout-to-fix-clo.patch b/queue-6.11/asoc-rt722-sdca-increase-clk_stop_timeout-to-fix-clo.patch new file mode 100644 index 00000000000..de7dbe0b238 --- /dev/null +++ b/queue-6.11/asoc-rt722-sdca-increase-clk_stop_timeout-to-fix-clo.patch @@ -0,0 +1,35 @@ +From 73231eb100b796ce2db9ac23b2bc2f109adfbce2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2024 06:15:44 +0000 +Subject: ASoC: rt722-sdca: increase clk_stop_timeout to fix clock stop issue + +From: Jack Yu + +[ Upstream commit 038fa6ddf5d22694f61ff7a7a53c8887c6b08c45 ] + +clk_stop_timeout should be increased to 900ms to fix clock stop issue. + +Signed-off-by: Jack Yu +Link: https://patch.msgid.link/cd26275d9fc54374a18dc016755cb72d@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt722-sdca-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c +index 87354bb1564e8..d5c985ff5ac55 100644 +--- a/sound/soc/codecs/rt722-sdca-sdw.c ++++ b/sound/soc/codecs/rt722-sdca-sdw.c +@@ -253,7 +253,7 @@ static int rt722_sdca_read_prop(struct sdw_slave *slave) + } + + /* set the timeout values */ +- prop->clk_stop_timeout = 200; ++ prop->clk_stop_timeout = 900; + + /* wake-up event */ + prop->wake_capable = 1; +-- +2.43.0 + diff --git a/queue-6.11/bpf-add-sk_is_inet-and-is_icsk-check-in-tls_sw_has_c.patch b/queue-6.11/bpf-add-sk_is_inet-and-is_icsk-check-in-tls_sw_has_c.patch new file mode 100644 index 00000000000..3a7a1551668 --- /dev/null +++ b/queue-6.11/bpf-add-sk_is_inet-and-is_icsk-check-in-tls_sw_has_c.patch @@ -0,0 +1,88 @@ +From 732c0df5fd383726b768098c83979ccebb8c6b90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 00:37:42 +0000 +Subject: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx + +From: Zijian Zhang + +[ Upstream commit 44d0469f79bd3d0b3433732877358df7dc6b17b1 ] + +As the introduction of the support for vsock and unix sockets in sockmap, +tls_sw_has_ctx_tx/rx cannot presume the socket passed in must be IS_ICSK. +vsock and af_unix sockets have vsock_sock and unix_sock instead of +inet_connection_sock. For these sockets, tls_get_ctx may return an invalid +pointer and cause page fault in function tls_sw_ctx_rx. + +BUG: unable to handle page fault for address: 0000000000040030 +Workqueue: vsock-loopback vsock_loopback_work +RIP: 0010:sk_psock_strp_data_ready+0x23/0x60 +Call Trace: + ? __die+0x81/0xc3 + ? no_context+0x194/0x350 + ? do_page_fault+0x30/0x110 + ? async_page_fault+0x3e/0x50 + ? sk_psock_strp_data_ready+0x23/0x60 + virtio_transport_recv_pkt+0x750/0x800 + ? update_load_avg+0x7e/0x620 + vsock_loopback_work+0xd0/0x100 + process_one_work+0x1a7/0x360 + worker_thread+0x30/0x390 + ? create_worker+0x1a0/0x1a0 + kthread+0x112/0x130 + ? __kthread_cancel_work+0x40/0x40 + ret_from_fork+0x1f/0x40 + +v2: + - Add IS_ICSK check +v3: + - Update the commits in Fixes + +Fixes: 634f1a7110b4 ("vsock: support sockmap") +Fixes: 94531cfcbe79 ("af_unix: Add unix_stream_proto for sockmap") +Signed-off-by: Zijian Zhang +Acked-by: Stanislav Fomichev +Acked-by: Jakub Kicinski +Reviewed-by: Cong Wang +Acked-by: Stefano Garzarella +Link: https://lore.kernel.org/r/20241106003742.399240-1-zijianzhang@bytedance.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + include/net/tls.h | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/include/net/tls.h b/include/net/tls.h +index 3a33924db2bc7..61fef28801140 100644 +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -390,8 +390,12 @@ tls_offload_ctx_tx(const struct tls_context *tls_ctx) + + static inline bool tls_sw_has_ctx_tx(const struct sock *sk) + { +- struct tls_context *ctx = tls_get_ctx(sk); ++ struct tls_context *ctx; ++ ++ if (!sk_is_inet(sk) || !inet_test_bit(IS_ICSK, sk)) ++ return false; + ++ ctx = tls_get_ctx(sk); + if (!ctx) + return false; + return !!tls_sw_ctx_tx(ctx); +@@ -399,8 +403,12 @@ static inline bool tls_sw_has_ctx_tx(const struct sock *sk) + + static inline bool tls_sw_has_ctx_rx(const struct sock *sk) + { +- struct tls_context *ctx = tls_get_ctx(sk); ++ struct tls_context *ctx; ++ ++ if (!sk_is_inet(sk) || !inet_test_bit(IS_ICSK, sk)) ++ return false; + ++ ctx = tls_get_ctx(sk); + if (!ctx) + return false; + return !!tls_sw_ctx_rx(ctx); +-- +2.43.0 + diff --git a/queue-6.11/bpf-check-validity-of-link-type-in-bpf_link_show_fdi.patch b/queue-6.11/bpf-check-validity-of-link-type-in-bpf_link_show_fdi.patch new file mode 100644 index 00000000000..f5909370948 --- /dev/null +++ b/queue-6.11/bpf-check-validity-of-link-type-in-bpf_link_show_fdi.patch @@ -0,0 +1,54 @@ +From 4a9ec83a28aa89ec4299fc8cdbd37ee01cb6353c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2024 09:35:58 +0800 +Subject: bpf: Check validity of link->type in bpf_link_show_fdinfo() + +From: Hou Tao + +[ Upstream commit 8421d4c8762bd022cb491f2f0f7019ef51b4f0a7 ] + +If a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing +bpf_link_type_strs[link->type] may result in an out-of-bounds access. + +To spot such missed invocations early in the future, checking the +validity of link->type in bpf_link_show_fdinfo() and emitting a warning +when such invocations are missed. + +Signed-off-by: Hou Tao +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20241024013558.1135167-3-houtao@huaweicloud.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/syscall.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 19b590b5aaec9..b282ed1250358 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -3136,13 +3136,17 @@ static void bpf_link_show_fdinfo(struct seq_file *m, struct file *filp) + { + const struct bpf_link *link = filp->private_data; + const struct bpf_prog *prog = link->prog; ++ enum bpf_link_type type = link->type; + char prog_tag[sizeof(prog->tag) * 2 + 1] = { }; + +- seq_printf(m, +- "link_type:\t%s\n" +- "link_id:\t%u\n", +- bpf_link_type_strs[link->type], +- link->id); ++ if (type < ARRAY_SIZE(bpf_link_type_strs) && bpf_link_type_strs[type]) { ++ seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]); ++ } else { ++ WARN_ONCE(1, "missing BPF_LINK_TYPE(...) for link type %u\n", type); ++ seq_printf(m, "link_type:\t<%u>\n", type); ++ } ++ seq_printf(m, "link_id:\t%u\n", link->id); ++ + if (prog) { + bin2hex(prog_tag, prog->tag, sizeof(prog->tag)); + seq_printf(m, +-- +2.43.0 + diff --git a/queue-6.11/bpf-fix-mismatched-rcu-unlock-flavour-in-bpf_out_nei.patch b/queue-6.11/bpf-fix-mismatched-rcu-unlock-flavour-in-bpf_out_nei.patch new file mode 100644 index 00000000000..e33fdece055 --- /dev/null +++ b/queue-6.11/bpf-fix-mismatched-rcu-unlock-flavour-in-bpf_out_nei.patch @@ -0,0 +1,50 @@ +From ab3bbb39c05e00dd2ba548e5bb14acbb316288e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2024 08:18:52 +0000 +Subject: bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6 + +From: Jiawei Ye + +[ Upstream commit fb86c42a2a5d44e849ddfbc98b8d2f4f40d36ee3 ] + +In the bpf_out_neigh_v6 function, rcu_read_lock() is used to begin an RCU +read-side critical section. However, when unlocking, one branch +incorrectly uses a different RCU unlock flavour rcu_read_unlock_bh() +instead of rcu_read_unlock(). This mismatch in RCU locking flavours can +lead to unexpected behavior and potential concurrency issues. + +This possible bug was identified using a static analysis tool developed +by myself, specifically designed to detect RCU-related issues. + +This patch corrects the mismatched unlock flavour by replacing the +incorrect rcu_read_unlock_bh() with the appropriate rcu_read_unlock(), +ensuring that the RCU critical section is properly exited. This change +prevents potential synchronization issues and aligns with proper RCU +usage patterns. + +Fixes: 09eed1192cec ("neighbour: switch to standard rcu, instead of rcu_bh") +Signed-off-by: Jiawei Ye +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/tencent_CFD3D1C3D68B45EA9F52D8EC76D2C4134306@qq.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index b2b551401bc29..fe5ac8da5022f 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2248,7 +2248,7 @@ static int bpf_out_neigh_v6(struct net *net, struct sk_buff *skb, + rcu_read_unlock(); + return ret; + } +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + if (dst) + IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); + out_drop: +-- +2.43.0 + diff --git a/queue-6.11/drm-xe-don-t-restart-parallel-queues-multiple-times-.patch b/queue-6.11/drm-xe-don-t-restart-parallel-queues-multiple-times-.patch new file mode 100644 index 00000000000..fcc63063655 --- /dev/null +++ b/queue-6.11/drm-xe-don-t-restart-parallel-queues-multiple-times-.patch @@ -0,0 +1,69 @@ +From 0713714fadc370b52210d1a06bc24ade218edefb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2024 12:35:55 +0200 +Subject: drm/xe: Don't restart parallel queues multiple times on GT reset + +From: Nirmoy Das + +[ Upstream commit cdc21021f0351226a4845715564afd5dc50ed44b ] + +In case of parallel submissions multiple GuC id will point to the +same exec queue and on GT reset such exec queues will get restarted +multiple times which is not desirable. + +v2: don't use exec_queue_enabled() which could race, + do the same for xe_guc_submit_stop (Matt B) + +Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2295 +Cc: Jonathan Cavitt +Cc: Himal Prasad Ghimiray +Cc: Matthew Auld +Cc: Matthew Brost +Cc: Tejas Upadhyay +Reviewed-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20241022103555.731557-1-nirmoy.das@intel.com +Signed-off-by: Nirmoy Das +(cherry picked from commit c8b0acd6d8745fd7e6450f5acc38f0227bd253b3) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_submit.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index cbdd44567d107..792024c28da86 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -1771,8 +1771,13 @@ void xe_guc_submit_stop(struct xe_guc *guc) + + mutex_lock(&guc->submission_state.lock); + +- xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) ++ xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) { ++ /* Prevent redundant attempts to stop parallel queues */ ++ if (q->guc->id != index) ++ continue; ++ + guc_exec_queue_stop(guc, q); ++ } + + mutex_unlock(&guc->submission_state.lock); + +@@ -1810,8 +1815,13 @@ int xe_guc_submit_start(struct xe_guc *guc) + + mutex_lock(&guc->submission_state.lock); + atomic_dec(&guc->submission_state.stopped); +- xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) ++ xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) { ++ /* Prevent redundant attempts to start parallel queues */ ++ if (q->guc->id != index) ++ continue; ++ + guc_exec_queue_start(q); ++ } + mutex_unlock(&guc->submission_state.lock); + + wake_up_all(&guc->ct.wq); +-- +2.43.0 + diff --git a/queue-6.11/drm-xe-enlarge-the-invalidation-timeout-from-150-to-.patch b/queue-6.11/drm-xe-enlarge-the-invalidation-timeout-from-150-to-.patch new file mode 100644 index 00000000000..50fb4ced3cb --- /dev/null +++ b/queue-6.11/drm-xe-enlarge-the-invalidation-timeout-from-150-to-.patch @@ -0,0 +1,61 @@ +From 7a6e2ac974af4db9a277c0a479c9cbb4d79645dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 16:12:07 +0000 +Subject: drm/xe: Enlarge the invalidation timeout from 150 to 500 + +From: Shuicheng Lin + +[ Upstream commit c8fb95e7a54315460b45090f0968167a332e1657 ] + +There are error messages like below that are occurring during stress +testing: "[ 31.004009] xe 0000:03:00.0: [drm] ERROR GT0: Global +invalidation timeout". Previously it was hitting this 3 out of 1000 +executions of warm reboot. After raising it to 500, 1000 warm reboot +executions passed and it didn't fail. + +Due to the way xe_mmio_wait32() is implemented, the timeout is able to +expire early when the register matches the expected value due to the +wait increments starting small. So, the larger timeout value should have +no effect during normal use cases. + +v2 (Jonathan): + - rework the commit message +v3 (Lucas): + - add conclusive message for the fail rate and test case +v4: + - add suggested-by + +Suggested-by: Jia Yao +Signed-off-by: Shuicheng Lin +Cc: Lucas De Marchi +Cc: Matthew Auld +Cc: Nirmoy Das +Reviewed-by: Jonathan Cavitt +Tested-by: Zongyao Bai +Reviewed-by: Nirmoy Das +Signed-off-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20241015161207.1373401-1-shuicheng.lin@intel.com +(cherry picked from commit 2eb460ab9f4bc5b575f52568d17936da0af681d8) +[ Fix conflict with gt->mmio ] +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c +index fb394189d9e23..13213f39e52f9 100644 +--- a/drivers/gpu/drm/xe/xe_device.c ++++ b/drivers/gpu/drm/xe/xe_device.c +@@ -870,7 +870,7 @@ void xe_device_l2_flush(struct xe_device *xe) + spin_lock(>->global_invl_lock); + xe_mmio_write32(gt, XE2_GLOBAL_INVAL, 0x1); + +- if (xe_mmio_wait32(gt, XE2_GLOBAL_INVAL, 0x1, 0x0, 150, NULL, true)) ++ if (xe_mmio_wait32(gt, XE2_GLOBAL_INVAL, 0x1, 0x0, 500, NULL, true)) + xe_gt_err_once(gt, "Global invalidation timeout\n"); + spin_unlock(>->global_invl_lock); + +-- +2.43.0 + diff --git a/queue-6.11/drm-xe-guc-ct-flush-g2h-worker-in-case-of-g2h-respon.patch b/queue-6.11/drm-xe-guc-ct-flush-g2h-worker-in-case-of-g2h-respon.patch new file mode 100644 index 00000000000..501e8e30df2 --- /dev/null +++ b/queue-6.11/drm-xe-guc-ct-flush-g2h-worker-in-case-of-g2h-respon.patch @@ -0,0 +1,69 @@ +From b13f3b3fae2bbbf169a173dca10d7b7b28e7da25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 16:44:10 +0530 +Subject: drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout + +From: Badal Nilawar + +[ Upstream commit 22ef43c78647dd37b0dafe2182b8650b99dbbe59 ] + +In case if g2h worker doesn't get opportunity to within specified +timeout delay then flush the g2h worker explicitly. + +v2: + - Describe change in the comment and add TODO (Matt B/John H) + - Add xe_gt_warn on fence done after G2H flush (John H) +v3: + - Updated the comment with root cause + - Clean up xe_gt_warn message (John H) + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1620 +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2902 +Signed-off-by: Badal Nilawar +Cc: Matthew Brost +Cc: Matthew Auld +Cc: John Harrison +Cc: Himal Prasad Ghimiray +Reviewed-by: Himal Prasad Ghimiray +Acked-by: Matthew Brost +Signed-off-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20241017111410.2553784-2-badal.nilawar@intel.com +(cherry picked from commit e5152723380404acb8175e0777b1cea57f319a01) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_guc_ct.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c +index 12e1fe6a8da28..1e8bb8b28a23e 100644 +--- a/drivers/gpu/drm/xe/xe_guc_ct.c ++++ b/drivers/gpu/drm/xe/xe_guc_ct.c +@@ -897,6 +897,24 @@ static int guc_ct_send_recv(struct xe_guc_ct *ct, const u32 *action, u32 len, + } + } + ++ /* ++ * Occasionally it is seen that the G2H worker starts running after a delay of more than ++ * a second even after being queued and activated by the Linux workqueue subsystem. This ++ * leads to G2H timeout error. The root cause of issue lies with scheduling latency of ++ * Lunarlake Hybrid CPU. Issue dissappears if we disable Lunarlake atom cores from BIOS ++ * and this is beyond xe kmd. ++ * ++ * TODO: Drop this change once workqueue scheduling delay issue is fixed on LNL Hybrid CPU. ++ */ ++ if (!ret) { ++ flush_work(&ct->g2h_worker); ++ if (g2h_fence.done) { ++ xe_gt_warn(gt, "G2H fence %u, action %04x, done\n", ++ g2h_fence.seqno, action[0]); ++ ret = 1; ++ } ++ } ++ + /* + * Ensure we serialize with completion side to prevent UAF with fence going out of scope on + * the stack, since we have no clue if it will fire after the timeout before we can erase +-- +2.43.0 + diff --git a/queue-6.11/drm-xe-handle-unreliable-mmio-reads-during-forcewake.patch b/queue-6.11/drm-xe-handle-unreliable-mmio-reads-during-forcewake.patch new file mode 100644 index 00000000000..f2407ee90dc --- /dev/null +++ b/queue-6.11/drm-xe-handle-unreliable-mmio-reads-during-forcewake.patch @@ -0,0 +1,69 @@ +From fde7df4e95b9569fd290013b6186f0b5010fd50d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 22:15:47 +0000 +Subject: drm/xe: Handle unreliable MMIO reads during forcewake + +From: Shuicheng Lin + +[ Upstream commit 69418db678567bdf9a4992c83d448da462ffa78c ] + +In some cases, when the driver attempts to read an MMIO register, +the hardware may return 0xFFFFFFFF. The current force wake path +code treats this as a valid response, as it only checks the BIT. +However, 0xFFFFFFFF should be considered an invalid value, indicating +a potential issue. To address this, we should add a log entry to +highlight this condition and return failure. +The force wake failure log level is changed from notice to err +to match the failure return value. + +v2 (Matt Brost): + - set ret value (-EIO) to kick the error to upper layers +v3 (Rodrigo): + - add commit message for the log level promotion from notice to err +v4: + - update reviewed info + +Suggested-by: Alex Zuo +Signed-off-by: Shuicheng Lin +Cc: Matthew Brost +Cc: Michal Wajdeczko +Reviewed-by: Himal Prasad Ghimiray +Acked-by: Badal Nilawar +Cc: Anshuman Gupta +Cc: Matt Roper +Cc: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20241017221547.1564029-1-shuicheng.lin@intel.com +Signed-off-by: Rodrigo Vivi +(cherry picked from commit a9fbeabe7226a3bf90f82d0e28a02c18e3c67447) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_force_wake.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_force_wake.c b/drivers/gpu/drm/xe/xe_force_wake.c +index b263fff152737..7d9fc489dcb81 100644 +--- a/drivers/gpu/drm/xe/xe_force_wake.c ++++ b/drivers/gpu/drm/xe/xe_force_wake.c +@@ -115,9 +115,15 @@ static int __domain_wait(struct xe_gt *gt, struct xe_force_wake_domain *domain, + XE_FORCE_WAKE_ACK_TIMEOUT_MS * USEC_PER_MSEC, + &value, true); + if (ret) +- xe_gt_notice(gt, "Force wake domain %d failed to ack %s (%pe) reg[%#x] = %#x\n", +- domain->id, str_wake_sleep(wake), ERR_PTR(ret), +- domain->reg_ack.addr, value); ++ xe_gt_err(gt, "Force wake domain %d failed to ack %s (%pe) reg[%#x] = %#x\n", ++ domain->id, str_wake_sleep(wake), ERR_PTR(ret), ++ domain->reg_ack.addr, value); ++ if (value == ~0) { ++ xe_gt_err(gt, ++ "Force wake domain %d: %s. MMIO unreliable (forcewake register returns 0xFFFFFFFF)!\n", ++ domain->id, str_wake_sleep(wake)); ++ ret = -EIO; ++ } + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.11/drm-xe-ufence-prefetch-ufence-addr-to-catch-bogus-ad.patch b/queue-6.11/drm-xe-ufence-prefetch-ufence-addr-to-catch-bogus-ad.patch new file mode 100644 index 00000000000..34f4afa9a7e --- /dev/null +++ b/queue-6.11/drm-xe-ufence-prefetch-ufence-addr-to-catch-bogus-ad.patch @@ -0,0 +1,45 @@ +From 035c3926fabf10689cb99170abb11d8f202f9730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 10:23:03 +0200 +Subject: drm/xe/ufence: Prefetch ufence addr to catch bogus address + +From: Nirmoy Das + +[ Upstream commit 9c1813b3253480b30604c680026c7dc721ce86d1 ] + +access_ok() only checks for addr overflow so also try to read the addr +to catch invalid addr sent from userspace. + +Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1630 +Cc: Francois Dugast +Cc: Maarten Lankhorst +Cc: Matthew Auld +Cc: Matthew Brost +Reviewed-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20241016082304.66009-2-nirmoy.das@intel.com +Signed-off-by: Nirmoy Das +(cherry picked from commit 9408c4508483ffc60811e910a93d6425b8e63928) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_sync.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_sync.c b/drivers/gpu/drm/xe/xe_sync.c +index de80c8b7c8913..9d77f2d4096f5 100644 +--- a/drivers/gpu/drm/xe/xe_sync.c ++++ b/drivers/gpu/drm/xe/xe_sync.c +@@ -54,8 +54,9 @@ static struct xe_user_fence *user_fence_create(struct xe_device *xe, u64 addr, + { + struct xe_user_fence *ufence; + u64 __user *ptr = u64_to_user_ptr(addr); ++ u64 __maybe_unused prefetch_val; + +- if (!access_ok(ptr, sizeof(*ptr))) ++ if (get_user(prefetch_val, ptr)) + return ERR_PTR(-EFAULT); + + ufence = kzalloc(sizeof(*ufence), GFP_KERNEL); +-- +2.43.0 + diff --git a/queue-6.11/fs-fix-uninitialized-value-issue-in-from_kuid-and-fr.patch b/queue-6.11/fs-fix-uninitialized-value-issue-in-from_kuid-and-fr.patch new file mode 100644 index 00000000000..11810d5d99b --- /dev/null +++ b/queue-6.11/fs-fix-uninitialized-value-issue-in-from_kuid-and-fr.patch @@ -0,0 +1,49 @@ +From 9e17649e51db8f3b3e617e99a6832b5b2d5b6ac0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 14:05:51 +0200 +Subject: fs: Fix uninitialized value issue in from_kuid and from_kgid + +From: Alessandro Zanni + +[ Upstream commit 15f34347481648a567db67fb473c23befb796af5 ] + +ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in +a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. + +Initialize all fields of newattrs to avoid uninitialized variables, by +checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. + +Reported-by: syzbot+6c55f725d1bdc8c52058@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 +Signed-off-by: Alessandro Zanni +Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.com +Reviewed-by: Jan Kara +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/ocfs2/file.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index 02d2beb7ddb95..c6d0d17a759c1 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -1128,9 +1128,12 @@ int ocfs2_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + trace_ocfs2_setattr(inode, dentry, + (unsigned long long)OCFS2_I(inode)->ip_blkno, + dentry->d_name.len, dentry->d_name.name, +- attr->ia_valid, attr->ia_mode, +- from_kuid(&init_user_ns, attr->ia_uid), +- from_kgid(&init_user_ns, attr->ia_gid)); ++ attr->ia_valid, ++ attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, ++ attr->ia_valid & ATTR_UID ? ++ from_kuid(&init_user_ns, attr->ia_uid) : 0, ++ attr->ia_valid & ATTR_GID ? ++ from_kgid(&init_user_ns, attr->ia_gid) : 0); + + /* ensuring we don't even attempt to truncate a symlink */ + if (S_ISLNK(inode->i_mode)) +-- +2.43.0 + diff --git a/queue-6.11/hid-i2c-hid-delayed-i2c-resume-wakeup-for-0x0d42-goo.patch b/queue-6.11/hid-i2c-hid-delayed-i2c-resume-wakeup-for-0x0d42-goo.patch new file mode 100644 index 00000000000..c3eac0a4228 --- /dev/null +++ b/queue-6.11/hid-i2c-hid-delayed-i2c-resume-wakeup-for-0x0d42-goo.patch @@ -0,0 +1,90 @@ +From 89282be1c7ffa686db1fa39c7d7b0edd1e2a948b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 00:25:42 +0200 +Subject: HID: i2c-hid: Delayed i2c resume wakeup for 0x0d42 Goodix touchpad +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bartłomiej Maryńczak + +[ Upstream commit 293c485cbac2607595fdaae2b1fb390fc7b2d014 ] + +Patch for Goodix 27c6:0d42 touchpads found in Inspiron 5515 laptops. + +After resume from suspend, one can communicate with this device just fine. +We can read data from it or request a reset, +but for some reason the interrupt line will not go up +when new events are available. +(it can correctly respond to a reset with an interrupt tho) + +The only way I found to wake this device up +is to send anything to it after ~1.5s mark, +for example a simple read request, or power mode change. + +In this patch, I simply delay the resume steps with msleep, +this will cause the set_power request to happen after +the ~1.5s barrier causing the device to resume its event interrupts. + +Sleep was used rather than delayed_work +to make this workaround as non-invasive as possible. + +[jkosina@suse.com: shortlog update] +Signed-off-by: Bartłomiej Maryńczak +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/i2c-hid/i2c-hid-core.c | 10 ++++++++++ + 2 files changed, 11 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 8a991b30e3c6d..25f96494700d8 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -509,6 +509,7 @@ + #define I2C_DEVICE_ID_GOODIX_01E8 0x01e8 + #define I2C_DEVICE_ID_GOODIX_01E9 0x01e9 + #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 ++#define I2C_DEVICE_ID_GOODIX_0D42 0x0d42 + + #define USB_VENDOR_ID_GOODTOUCH 0x1aad + #define USB_DEVICE_ID_GOODTOUCH_000f 0x000f +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 2f8a9d3f1e861..8914c7db94718 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -50,6 +50,7 @@ + #define I2C_HID_QUIRK_BAD_INPUT_SIZE BIT(3) + #define I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET BIT(4) + #define I2C_HID_QUIRK_NO_SLEEP_ON_SUSPEND BIT(5) ++#define I2C_HID_QUIRK_DELAY_WAKEUP_AFTER_RESUME BIT(6) + + /* Command opcodes */ + #define I2C_HID_OPCODE_RESET 0x01 +@@ -140,6 +141,8 @@ static const struct i2c_hid_quirks { + { USB_VENDOR_ID_ELAN, HID_ANY_ID, + I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET | + I2C_HID_QUIRK_BOGUS_IRQ }, ++ { I2C_VENDOR_ID_GOODIX, I2C_DEVICE_ID_GOODIX_0D42, ++ I2C_HID_QUIRK_DELAY_WAKEUP_AFTER_RESUME }, + { 0, 0 } + }; + +@@ -981,6 +984,13 @@ static int i2c_hid_core_resume(struct i2c_hid *ihid) + return -ENXIO; + } + ++ /* On Goodix 27c6:0d42 wait extra time before device wakeup. ++ * It's not clear why but if we send wakeup too early, the device will ++ * never trigger input interrupts. ++ */ ++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_WAKEUP_AFTER_RESUME) ++ msleep(1500); ++ + /* Instead of resetting device, simply powers the device on. This + * solves "incomplete reports" on Raydium devices 2386:3118 and + * 2386:4B33 and fixes various SIS touchscreens no longer sending +-- +2.43.0 + diff --git a/queue-6.11/hid-lenovo-add-support-for-thinkpad-x1-tablet-gen-3-.patch b/queue-6.11/hid-lenovo-add-support-for-thinkpad-x1-tablet-gen-3-.patch new file mode 100644 index 00000000000..0b88aef23cb --- /dev/null +++ b/queue-6.11/hid-lenovo-add-support-for-thinkpad-x1-tablet-gen-3-.patch @@ -0,0 +1,88 @@ +From 67fc3450db9146f9940be73158305623ae346a6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2024 11:45:12 +0200 +Subject: HID: lenovo: Add support for Thinkpad X1 Tablet Gen 3 keyboard + +From: Hans de Goede + +[ Upstream commit 51268879eb2bfc563a91cdce69362d9dbf707e7e ] + +The Thinkpad X1 Tablet Gen 3 keyboard has the same Lenovo specific quirks +as the original Thinkpad X1 Tablet keyboard. + +Add the PID for the "Thinkpad X1 Tablet Gen 3 keyboard" to the hid-lenovo +driver to fix the FnLock, Mute and media buttons not working. + +Suggested-by: Izhar Firdaus +Closes https://bugzilla.redhat.com/show_bug.cgi?id=2315395 +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-lenovo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c +index e5e72aa5260a9..24654c7ecb04e 100644 +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -473,6 +473,7 @@ static int lenovo_input_mapping(struct hid_device *hdev, + return lenovo_input_mapping_tp10_ultrabook_kbd(hdev, hi, field, + usage, bit, max); + case USB_DEVICE_ID_LENOVO_X1_TAB: ++ case USB_DEVICE_ID_LENOVO_X1_TAB3: + return lenovo_input_mapping_x1_tab_kbd(hdev, hi, field, usage, bit, max); + default: + return 0; +@@ -583,6 +584,7 @@ static ssize_t attr_fn_lock_store(struct device *dev, + break; + case USB_DEVICE_ID_LENOVO_TP10UBKBD: + case USB_DEVICE_ID_LENOVO_X1_TAB: ++ case USB_DEVICE_ID_LENOVO_X1_TAB3: + ret = lenovo_led_set_tp10ubkbd(hdev, TP10UBKBD_FN_LOCK_LED, value); + if (ret) + return ret; +@@ -776,6 +778,7 @@ static int lenovo_event(struct hid_device *hdev, struct hid_field *field, + return lenovo_event_cptkbd(hdev, field, usage, value); + case USB_DEVICE_ID_LENOVO_TP10UBKBD: + case USB_DEVICE_ID_LENOVO_X1_TAB: ++ case USB_DEVICE_ID_LENOVO_X1_TAB3: + return lenovo_event_tp10ubkbd(hdev, field, usage, value); + default: + return 0; +@@ -1056,6 +1059,7 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev, + break; + case USB_DEVICE_ID_LENOVO_TP10UBKBD: + case USB_DEVICE_ID_LENOVO_X1_TAB: ++ case USB_DEVICE_ID_LENOVO_X1_TAB3: + ret = lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value); + break; + } +@@ -1286,6 +1290,7 @@ static int lenovo_probe(struct hid_device *hdev, + break; + case USB_DEVICE_ID_LENOVO_TP10UBKBD: + case USB_DEVICE_ID_LENOVO_X1_TAB: ++ case USB_DEVICE_ID_LENOVO_X1_TAB3: + ret = lenovo_probe_tp10ubkbd(hdev); + break; + default: +@@ -1372,6 +1377,7 @@ static void lenovo_remove(struct hid_device *hdev) + break; + case USB_DEVICE_ID_LENOVO_TP10UBKBD: + case USB_DEVICE_ID_LENOVO_X1_TAB: ++ case USB_DEVICE_ID_LENOVO_X1_TAB3: + lenovo_remove_tp10ubkbd(hdev); + break; + } +@@ -1421,6 +1427,8 @@ static const struct hid_device_id lenovo_devices[] = { + */ + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB) }, ++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, ++ USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB3) }, + { } + }; + +-- +2.43.0 + diff --git a/queue-6.11/hid-multitouch-add-quirk-for-logitech-bolt-receiver-.patch b/queue-6.11/hid-multitouch-add-quirk-for-logitech-bolt-receiver-.patch new file mode 100644 index 00000000000..5afba70c72f --- /dev/null +++ b/queue-6.11/hid-multitouch-add-quirk-for-logitech-bolt-receiver-.patch @@ -0,0 +1,58 @@ +From 3b87252fc5d2b8602e834147d3d8469963b66710 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2024 10:24:29 -0700 +Subject: HID: multitouch: Add quirk for Logitech Bolt receiver w/ Casa + touchpad + +From: Kenneth Albanowski + +[ Upstream commit 526748b925185e95f1415900ee13c2469d4b64cc ] + +The Logitech Casa Touchpad does not reliably send touch release signals +when communicating through the Logitech Bolt wireless-to-USB receiver. + +Adjusting the device class to add MT_QUIRK_NOT_SEEN_MEANS_UP to make +sure that no touches become stuck, MT_QUIRK_FORCE_MULTI_INPUT is not +needed, but harmless. + +Linux does not have information on which devices are connected to the +Bolt receiver, so we have to enable this for the entire device. + +Signed-off-by: Kenneth Albanowski +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 25f96494700d8..92cff3f2658cf 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -869,6 +869,7 @@ + #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1 0xc539 + #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1 0xc53f + #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY 0xc53a ++#define USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER 0xc548 + #define USB_DEVICE_ID_SPACETRAVELLER 0xc623 + #define USB_DEVICE_ID_SPACENAVIGATOR 0xc626 + #define USB_DEVICE_ID_DINOVO_DESKTOP 0xc704 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 871d7417824b8..24da739647635 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2137,6 +2137,10 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_LOGITECH, + USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD) }, ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, ++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_LOGITECH, ++ USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER) }, + + /* MosArt panels */ + { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE, +-- +2.43.0 + diff --git a/queue-6.11/loongarch-kvm-mark-hrtimer-to-expire-in-hard-interru.patch b/queue-6.11/loongarch-kvm-mark-hrtimer-to-expire-in-hard-interru.patch new file mode 100644 index 00000000000..92bfb782f77 --- /dev/null +++ b/queue-6.11/loongarch-kvm-mark-hrtimer-to-expire-in-hard-interru.patch @@ -0,0 +1,101 @@ +From b63e5757bb41a6fff846b116104a3c9b7770eabc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 22:15:44 +0800 +Subject: LoongArch: KVM: Mark hrtimer to expire in hard interrupt context + +From: Huacai Chen + +[ Upstream commit 73adbd92f3223dc0c3506822b71c6b259d5d537b ] + +Like commit 2c0d278f3293f ("KVM: LAPIC: Mark hrtimer to expire in hard +interrupt context") and commit 9090825fa9974 ("KVM: arm/arm64: Let the +timer expire in hardirq context on RT"), On PREEMPT_RT enabled kernels +unmarked hrtimers are moved into soft interrupt expiry mode by default. +Then the timers are canceled from an preempt-notifier which is invoked +with disabled preemption which is not allowed on PREEMPT_RT. + +The timer callback is short so in could be invoked in hard-IRQ context. +So let the timer expire on hard-IRQ context even on -RT. + +This fix a "scheduling while atomic" bug for PREEMPT_RT enabled kernels: + + BUG: scheduling while atomic: qemu-system-loo/1011/0x00000002 + Modules linked in: amdgpu rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ns + CPU: 1 UID: 0 PID: 1011 Comm: qemu-system-loo Tainted: G W 6.12.0-rc2+ #1774 + Tainted: [W]=WARN + Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022 + Stack : ffffffffffffffff 0000000000000000 9000000004e3ea38 9000000116744000 + 90000001167475a0 0000000000000000 90000001167475a8 9000000005644830 + 90000000058dc000 90000000058dbff8 9000000116747420 0000000000000001 + 0000000000000001 6a613fc938313980 000000000790c000 90000001001c1140 + 00000000000003fe 0000000000000001 000000000000000d 0000000000000003 + 0000000000000030 00000000000003f3 000000000790c000 9000000116747830 + 90000000057ef000 0000000000000000 9000000005644830 0000000000000004 + 0000000000000000 90000000057f4b58 0000000000000001 9000000116747868 + 900000000451b600 9000000005644830 9000000003a13998 0000000010000020 + 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d + ... + Call Trace: + [<9000000003a13998>] show_stack+0x38/0x180 + [<9000000004e3ea34>] dump_stack_lvl+0x84/0xc0 + [<9000000003a71708>] __schedule_bug+0x48/0x60 + [<9000000004e45734>] __schedule+0x1114/0x1660 + [<9000000004e46040>] schedule_rtlock+0x20/0x60 + [<9000000004e4e330>] rtlock_slowlock_locked+0x3f0/0x10a0 + [<9000000004e4f038>] rt_spin_lock+0x58/0x80 + [<9000000003b02d68>] hrtimer_cancel_wait_running+0x68/0xc0 + [<9000000003b02e30>] hrtimer_cancel+0x70/0x80 + [] kvm_restore_timer+0x50/0x1a0 [kvm] + [] kvm_arch_vcpu_load+0x68/0x2a0 [kvm] + [] kvm_sched_in+0x34/0x60 [kvm] + [<9000000003a749a0>] finish_task_switch.isra.0+0x140/0x2e0 + [<9000000004e44a70>] __schedule+0x450/0x1660 + [<9000000004e45cb0>] schedule+0x30/0x180 + [] kvm_vcpu_block+0x70/0x120 [kvm] + [] kvm_vcpu_halt+0x60/0x3e0 [kvm] + [] kvm_handle_gspr+0x3f4/0x4e0 [kvm] + [] kvm_handle_exit+0x1c8/0x260 [kvm] + +Reviewed-by: Bibo Mao +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kvm/timer.c | 7 ++++--- + arch/loongarch/kvm/vcpu.c | 2 +- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/loongarch/kvm/timer.c b/arch/loongarch/kvm/timer.c +index 74a4b5c272d60..32dc213374bea 100644 +--- a/arch/loongarch/kvm/timer.c ++++ b/arch/loongarch/kvm/timer.c +@@ -161,10 +161,11 @@ static void _kvm_save_timer(struct kvm_vcpu *vcpu) + if (kvm_vcpu_is_blocking(vcpu)) { + + /* +- * HRTIMER_MODE_PINNED is suggested since vcpu may run in +- * the same physical cpu in next time ++ * HRTIMER_MODE_PINNED_HARD is suggested since vcpu may run in ++ * the same physical cpu in next time, and the timer should run ++ * in hardirq context even in the PREEMPT_RT case. + */ +- hrtimer_start(&vcpu->arch.swtimer, expire, HRTIMER_MODE_ABS_PINNED); ++ hrtimer_start(&vcpu->arch.swtimer, expire, HRTIMER_MODE_ABS_PINNED_HARD); + } + } + +diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c +index 6905283f535b9..9218fc521c22d 100644 +--- a/arch/loongarch/kvm/vcpu.c ++++ b/arch/loongarch/kvm/vcpu.c +@@ -1144,7 +1144,7 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu) + vcpu->arch.vpid = 0; + vcpu->arch.flush_gpa = INVALID_GPA; + +- hrtimer_init(&vcpu->arch.swtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED); ++ hrtimer_init(&vcpu->arch.swtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED_HARD); + vcpu->arch.swtimer.function = kvm_swtimer_wakeup; + + vcpu->arch.handle_exit = kvm_handle_exit; +-- +2.43.0 + diff --git a/queue-6.11/loongarch-use-exception-return-address-to-comment-er.patch b/queue-6.11/loongarch-use-exception-return-address-to-comment-er.patch new file mode 100644 index 00000000000..9af68843999 --- /dev/null +++ b/queue-6.11/loongarch-use-exception-return-address-to-comment-er.patch @@ -0,0 +1,36 @@ +From b634b8952bb2ca0772da3871119a22ee1dcbabe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2024 22:11:18 +0800 +Subject: LoongArch: Use "Exception return address" to comment ERA + +From: Yanteng Si + +[ Upstream commit b69269c870ece1bc7d2e3e39ca76f4602f2cb0dd ] + +The information contained in the comment for LOONGARCH_CSR_ERA is even +less informative than the macro itself, which can cause confusion for +junior developers. Let's use the full English term. + +Signed-off-by: Yanteng Si +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/loongarch.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/include/asm/loongarch.h b/arch/loongarch/include/asm/loongarch.h +index 04a78010fc725..ab6985d9e49f0 100644 +--- a/arch/loongarch/include/asm/loongarch.h ++++ b/arch/loongarch/include/asm/loongarch.h +@@ -256,7 +256,7 @@ + #define CSR_ESTAT_IS_WIDTH 14 + #define CSR_ESTAT_IS (_ULCAST_(0x3fff) << CSR_ESTAT_IS_SHIFT) + +-#define LOONGARCH_CSR_ERA 0x6 /* ERA */ ++#define LOONGARCH_CSR_ERA 0x6 /* Exception return address */ + + #define LOONGARCH_CSR_BADV 0x7 /* Bad virtual address */ + +-- +2.43.0 + diff --git a/queue-6.11/net-usb-qmi_wwan-add-fibocom-fg132-0x0112-compositio.patch b/queue-6.11/net-usb-qmi_wwan-add-fibocom-fg132-0x0112-compositio.patch new file mode 100644 index 00000000000..31a859db8f8 --- /dev/null +++ b/queue-6.11/net-usb-qmi_wwan-add-fibocom-fg132-0x0112-compositio.patch @@ -0,0 +1,57 @@ +From 1e57699bf194fea776096a698e737ecefd5a7ac6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2024 22:52:55 +0200 +Subject: net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition + +From: Reinhard Speyerer + +[ Upstream commit 64761c980cbf71fb7a532a8c7299907ea972a88c ] + +Add Fibocom FG132 0x0112 composition: + +T: Bus=03 Lev=02 Prnt=06 Port=01 Cnt=02 Dev#= 10 Spd=12 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0112 Rev= 5.15 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=Fibocom Module +S: SerialNumber=xxxxxxxx +C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms + +Signed-off-by: Reinhard Speyerer + +Link: https://patch.msgid.link/ZxLKp5YZDy-OM0-e@arcor.de +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 4823dbdf54656..f137c82f1c0f7 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1426,6 +1426,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)}, /* Quectel EM05GV2 */ + {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */ ++ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0112, 0)}, /* Fibocom FG132 */ + {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */ + {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ + {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */ +-- +2.43.0 + diff --git a/queue-6.11/netfs-downgrade-i_rwsem-for-a-buffered-write.patch b/queue-6.11/netfs-downgrade-i_rwsem-for-a-buffered-write.patch new file mode 100644 index 00000000000..215da777fce --- /dev/null +++ b/queue-6.11/netfs-downgrade-i_rwsem-for-a-buffered-write.patch @@ -0,0 +1,63 @@ +From 0745bbe17bfe17f2696d4d6436dc344aede6a630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 17:28:33 +0100 +Subject: netfs: Downgrade i_rwsem for a buffered write + +From: David Howells + +[ Upstream commit d6a77668a708f0b5ca6713b39c178c9d9563c35b ] + +In the I/O locking code borrowed from NFS into netfslib, i_rwsem is held +locked across a buffered write - but this causes a performance regression +in cifs as it excludes buffered reads for the duration (cifs didn't use any +locking for buffered reads). + +Mitigate this somewhat by downgrading the i_rwsem to a read lock across the +buffered write. This at least allows parallel reads to occur whilst +excluding other writes, DIO, truncate and setattr. + +Note that this shouldn't be a problem for a buffered write as a read +through an mmap can circumvent i_rwsem anyway. + +Also note that we might want to make this change in NFS also. + +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/1317958.1729096113@warthog.procyon.org.uk +cc: Steve French +cc: Paulo Alcantara +cc: Trond Myklebust +cc: Jeff Layton +cc: netfs@lists.linux.dev +cc: linux-cifs@vger.kernel.org +cc: linux-nfs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/locking.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/netfs/locking.c b/fs/netfs/locking.c +index 75dc52a49b3a4..709a6aa101028 100644 +--- a/fs/netfs/locking.c ++++ b/fs/netfs/locking.c +@@ -121,6 +121,7 @@ int netfs_start_io_write(struct inode *inode) + up_write(&inode->i_rwsem); + return -ERESTARTSYS; + } ++ downgrade_write(&inode->i_rwsem); + return 0; + } + EXPORT_SYMBOL(netfs_start_io_write); +@@ -135,7 +136,7 @@ EXPORT_SYMBOL(netfs_start_io_write); + void netfs_end_io_write(struct inode *inode) + __releases(inode->i_rwsem) + { +- up_write(&inode->i_rwsem); ++ up_read(&inode->i_rwsem); + } + EXPORT_SYMBOL(netfs_end_io_write); + +-- +2.43.0 + diff --git a/queue-6.11/riscv-kvm-use-raw_spinlock-for-critical-section-in-i.patch b/queue-6.11/riscv-kvm-use-raw_spinlock-for-critical-section-in-i.patch new file mode 100644 index 00000000000..cf98389215d --- /dev/null +++ b/queue-6.11/riscv-kvm-use-raw_spinlock-for-critical-section-in-i.patch @@ -0,0 +1,67 @@ +From 6000a1a00d5fd05d935adf0019db91c4628caf65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Sep 2024 00:01:26 +0800 +Subject: RISCV: KVM: use raw_spinlock for critical section in imsic + +From: Cyan Yang + +[ Upstream commit 3ec4350d4efb5ccb6bd0e11d9cf7f2be4f47297d ] + +For the external interrupt updating procedure in imsic, there was a +spinlock to protect it already. But since it should not be preempted in +any cases, we should turn to use raw_spinlock to prevent any preemption +in case PREEMPT_RT was enabled. + +Signed-off-by: Cyan Yang +Reviewed-by: Yong-Xuan Wang +Reviewed-by: Anup Patel +Message-ID: <20240919160126.44487-1-cyan.yang@sifive.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/riscv/kvm/aia_imsic.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/kvm/aia_imsic.c b/arch/riscv/kvm/aia_imsic.c +index 0a1e859323b45..a8085cd8215e3 100644 +--- a/arch/riscv/kvm/aia_imsic.c ++++ b/arch/riscv/kvm/aia_imsic.c +@@ -55,7 +55,7 @@ struct imsic { + /* IMSIC SW-file */ + struct imsic_mrif *swfile; + phys_addr_t swfile_pa; +- spinlock_t swfile_extirq_lock; ++ raw_spinlock_t swfile_extirq_lock; + }; + + #define imsic_vs_csr_read(__c) \ +@@ -622,7 +622,7 @@ static void imsic_swfile_extirq_update(struct kvm_vcpu *vcpu) + * interruptions between reading topei and updating pending status. + */ + +- spin_lock_irqsave(&imsic->swfile_extirq_lock, flags); ++ raw_spin_lock_irqsave(&imsic->swfile_extirq_lock, flags); + + if (imsic_mrif_atomic_read(mrif, &mrif->eidelivery) && + imsic_mrif_topei(mrif, imsic->nr_eix, imsic->nr_msis)) +@@ -630,7 +630,7 @@ static void imsic_swfile_extirq_update(struct kvm_vcpu *vcpu) + else + kvm_riscv_vcpu_unset_interrupt(vcpu, IRQ_VS_EXT); + +- spin_unlock_irqrestore(&imsic->swfile_extirq_lock, flags); ++ raw_spin_unlock_irqrestore(&imsic->swfile_extirq_lock, flags); + } + + static void imsic_swfile_read(struct kvm_vcpu *vcpu, bool clear, +@@ -1051,7 +1051,7 @@ int kvm_riscv_vcpu_aia_imsic_init(struct kvm_vcpu *vcpu) + } + imsic->swfile = page_to_virt(swfile_page); + imsic->swfile_pa = page_to_phys(swfile_page); +- spin_lock_init(&imsic->swfile_extirq_lock); ++ raw_spin_lock_init(&imsic->swfile_extirq_lock); + + /* Setup IO device */ + kvm_iodevice_init(&imsic->iodev, &imsic_iodoev_ops); +-- +2.43.0 + diff --git a/queue-6.11/samples-landlock-fix-port-parsing-in-sandboxer.patch b/queue-6.11/samples-landlock-fix-port-parsing-in-sandboxer.patch new file mode 100644 index 00000000000..10a3ab04faa --- /dev/null +++ b/queue-6.11/samples-landlock-fix-port-parsing-in-sandboxer.patch @@ -0,0 +1,104 @@ +From 8c6cefc885112c6abe92890cd3b586f338267cf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Oct 2024 17:15:32 +0200 +Subject: samples/landlock: Fix port parsing in sandboxer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthieu Buffet + +[ Upstream commit 387285530d1d4bdba8c5dff5aeabd8d71638173f ] + +If you want to specify that no port can be bind()ed, you would think +(looking quickly at both help message and code) that setting +LL_TCP_BIND="" would do it. + +However the code splits on ":" then applies atoi(), which does not allow +checking for errors. Passing an empty string returns 0, which is +interpreted as "allow bind(0)", which means bind to any ephemeral port. +This bug occurs whenever passing an empty string or when leaving a +trailing/leading colon, making it impossible to completely deny bind(). + +To reproduce: +export LL_FS_RO="/" LL_FS_RW="" LL_TCP_BIND="" +./sandboxer strace -e bind nc -n -vvv -l -p 0 +Executing the sandboxed command... +bind(3, {sa_family=AF_INET, sin_port=htons(0), + sin_addr=inet_addr("0.0.0.0")}, 16) = 0 +Listening on 0.0.0.0 37629 + +Use strtoull(3) instead, which allows error checking. Check that the +entire string has been parsed correctly without overflows/underflows, +but not that the __u64 (the type of struct landlock_net_port_attr.port) +is a valid __u16 port: that is already done by the kernel. + +Fixes: 5e990dcef12e ("samples/landlock: Support TCP restrictions") +Signed-off-by: Matthieu Buffet +Link: https://lore.kernel.org/r/20241019151534.1400605-2-matthieu@buffet.re +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + samples/landlock/sandboxer.c | 32 ++++++++++++++++++++++++++++++-- + 1 file changed, 30 insertions(+), 2 deletions(-) + +diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c +index e8223c3e781ab..5d8a9df5273f5 100644 +--- a/samples/landlock/sandboxer.c ++++ b/samples/landlock/sandboxer.c +@@ -57,6 +57,25 @@ static inline int landlock_restrict_self(const int ruleset_fd, + #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT" + #define ENV_DELIMITER ":" + ++static int str2num(const char *numstr, __u64 *num_dst) ++{ ++ char *endptr = NULL; ++ int err = 0; ++ __u64 num; ++ ++ errno = 0; ++ num = strtoull(numstr, &endptr, 10); ++ if (errno != 0) ++ err = errno; ++ /* Was the string empty, or not entirely parsed successfully? */ ++ else if ((*numstr == '\0') || (*endptr != '\0')) ++ err = EINVAL; ++ else ++ *num_dst = num; ++ ++ return err; ++} ++ + static int parse_path(char *env_path, const char ***const path_list) + { + int i, num_paths = 0; +@@ -157,7 +176,6 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, + char *env_port_name, *env_port_name_next, *strport; + struct landlock_net_port_attr net_port = { + .allowed_access = allowed_access, +- .port = 0, + }; + + env_port_name = getenv(env_var); +@@ -168,7 +186,17 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd, + + env_port_name_next = env_port_name; + while ((strport = strsep(&env_port_name_next, ENV_DELIMITER))) { +- net_port.port = atoi(strport); ++ __u64 port; ++ ++ if (strcmp(strport, "") == 0) ++ continue; ++ ++ if (str2num(strport, &port)) { ++ fprintf(stderr, "Failed to parse port at \"%s\"\n", ++ strport); ++ goto out_free_name; ++ } ++ net_port.port = port; + if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT, + &net_port, 0)) { + fprintf(stderr, +-- +2.43.0 + diff --git a/queue-6.11/series b/queue-6.11/series index 321ccaca879..223f58d6404 100644 --- a/queue-6.11/series +++ b/queue-6.11/series @@ -30,3 +30,32 @@ net-phy-mdio-bcm-unimac-add-bcm6846-support.patch drm-xe-query-increase-timestamp-width.patch nvme-loop-flush-off-pending-i-o-while-shutting-down-.patch nvme-make-keep-alive-synchronous-operation.patch +samples-landlock-fix-port-parsing-in-sandboxer.patch +vdpa-ifcvf-fix-pci_read_config_byte-return-code-hand.patch +virtio_pci-fix-admin-vq-cleanup-by-using-correct-inf.patch +bpf-add-sk_is_inet-and-is_icsk-check-in-tls_sw_has_c.patch +bpf-fix-mismatched-rcu-unlock-flavour-in-bpf_out_nei.patch +asoc-intel-avs-update-stream-status-in-a-separate-th.patch +asoc-codecs-fix-error-handling-in-aw_dev_get_dsp_sta.patch +asoc-amd-yc-add-quirk-for-asus-vivobook-s15-m3502ra.patch +asoc-amd-yc-fix-non-functional-mic-on-asus-e1404fa.patch +asoc-intel-soc-acpi-lnl-add-match-entry-for-tm2-lapt.patch +netfs-downgrade-i_rwsem-for-a-buffered-write.patch +fs-fix-uninitialized-value-issue-in-from_kuid-and-fr.patch +afs-fix-lock-recursion.patch +hid-i2c-hid-delayed-i2c-resume-wakeup-for-0x0d42-goo.patch +hid-multitouch-add-quirk-for-logitech-bolt-receiver-.patch +hid-lenovo-add-support-for-thinkpad-x1-tablet-gen-3-.patch +asoc-codecs-lpass-rx-macro-fix-rxn-rx-n-macro-for-ds.patch +riscv-kvm-use-raw_spinlock-for-critical-section-in-i.patch +asoc-rt722-sdca-increase-clk_stop_timeout-to-fix-clo.patch +loongarch-use-exception-return-address-to-comment-er.patch +asoc-fsl_micfil-add-sample-rate-constraint.patch +loongarch-kvm-mark-hrtimer-to-expire-in-hard-interru.patch +net-usb-qmi_wwan-add-fibocom-fg132-0x0112-compositio.patch +bpf-check-validity-of-link-type-in-bpf_link_show_fdi.patch +drm-xe-enlarge-the-invalidation-timeout-from-150-to-.patch +drm-xe-guc-ct-flush-g2h-worker-in-case-of-g2h-respon.patch +drm-xe-handle-unreliable-mmio-reads-during-forcewake.patch +drm-xe-ufence-prefetch-ufence-addr-to-catch-bogus-ad.patch +drm-xe-don-t-restart-parallel-queues-multiple-times-.patch diff --git a/queue-6.11/vdpa-ifcvf-fix-pci_read_config_byte-return-code-hand.patch b/queue-6.11/vdpa-ifcvf-fix-pci_read_config_byte-return-code-hand.patch new file mode 100644 index 00000000000..4f85a604830 --- /dev/null +++ b/queue-6.11/vdpa-ifcvf-fix-pci_read_config_byte-return-code-hand.patch @@ -0,0 +1,41 @@ +From 641b96aa7a501f997980023b3ec7e7ee05e541e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 09:38:12 +0800 +Subject: vDPA/ifcvf: Fix pci_read_config_byte() return code handling + +From: Yuan Can + +[ Upstream commit 7f8825b2a78ac392d3fbb3a2e65e56d9e39d75e9 ] + +ifcvf_init_hw() uses pci_read_config_byte() that returns +PCIBIOS_* codes. The error handling, however, assumes the codes are +normal errnos because it checks for < 0. +Convert the error check to plain non-zero check. + +Fixes: 5a2414bc454e ("virtio: Intel IFC VF driver for VDPA") +Signed-off-by: Yuan Can +Message-Id: <20241017013812.129952-1-yuancan@huawei.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Acked-by: Zhu Lingshan +Signed-off-by: Sasha Levin +--- + drivers/vdpa/ifcvf/ifcvf_base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vdpa/ifcvf/ifcvf_base.c b/drivers/vdpa/ifcvf/ifcvf_base.c +index 472daa588a9d2..d5507b63b6cdb 100644 +--- a/drivers/vdpa/ifcvf/ifcvf_base.c ++++ b/drivers/vdpa/ifcvf/ifcvf_base.c +@@ -108,7 +108,7 @@ int ifcvf_init_hw(struct ifcvf_hw *hw, struct pci_dev *pdev) + u32 i; + + ret = pci_read_config_byte(pdev, PCI_CAPABILITY_LIST, &pos); +- if (ret < 0) { ++ if (ret) { + IFCVF_ERR(pdev, "Failed to read PCI capability list\n"); + return -EIO; + } +-- +2.43.0 + diff --git a/queue-6.11/virtio_pci-fix-admin-vq-cleanup-by-using-correct-inf.patch b/queue-6.11/virtio_pci-fix-admin-vq-cleanup-by-using-correct-inf.patch new file mode 100644 index 00000000000..e5ed489ed2f --- /dev/null +++ b/queue-6.11/virtio_pci-fix-admin-vq-cleanup-by-using-correct-inf.patch @@ -0,0 +1,166 @@ +From 96d5eac73a8bac30d7f57358fb03d69c38cc8ac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2024 09:54:06 -0400 +Subject: virtio_pci: Fix admin vq cleanup by using correct info pointer + +From: Feng Liu + +[ Upstream commit 97ee04feb682c906a1fa973ebe586fe91567d165 ] + +vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq +resources by virtio_pci_vq_info pointer. The info pointer of admin +vq is stored in vp_dev->admin_vq.info instead of vp_dev->vqs[]. +Using the info pointer from vp_dev->vqs[] for admin vq causes a +kernel NULL pointer dereference bug. +In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer +from vp_dev->admin_vq.info for admin vq to clean up the resources. +Also make info ptr as argument of vp_del_vq() to be symmetric with +vp_setup_vq(). + +vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace: +================================================================== +BUG: kernel NULL pointer dereference, address:0000000000000000 +... +CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1 +RIP: 0010:vp_reset+0x57/0x90 [virtio_pci] +Call Trace: + +... + ? vp_reset+0x57/0x90 [virtio_pci] + ? vp_reset+0x38/0x90 [virtio_pci] + virtio_reset_device+0x1d/0x30 + remove_vq_common+0x1c/0x1a0 [virtio_net] + virtnet_remove+0xa1/0xc0 [virtio_net] + virtio_dev_remove+0x46/0xa0 +... + virtio_pci_driver_exit+0x14/0x810 [virtio_pci] +================================================================== + +Fixes: 4c3b54af907e ("virtio_pci_modern: use completion instead of busy loop to wait on admin cmd result") +Signed-off-by: Feng Liu +Signed-off-by: Jiri Pirko +Reviewed-by: Parav Pandit +Message-Id: <20241024135406.81388-1-feliu@nvidia.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_pci_common.c | 24 ++++++++++++++++++------ + drivers/virtio/virtio_pci_common.h | 1 + + drivers/virtio/virtio_pci_modern.c | 12 +----------- + 3 files changed, 20 insertions(+), 17 deletions(-) + +diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c +index c44d8ba00c02c..88074451dd615 100644 +--- a/drivers/virtio/virtio_pci_common.c ++++ b/drivers/virtio/virtio_pci_common.c +@@ -24,6 +24,16 @@ MODULE_PARM_DESC(force_legacy, + "Force legacy mode for transitional virtio 1 devices"); + #endif + ++bool vp_is_avq(struct virtio_device *vdev, unsigned int index) ++{ ++ struct virtio_pci_device *vp_dev = to_vp_device(vdev); ++ ++ if (!virtio_has_feature(vdev, VIRTIO_F_ADMIN_VQ)) ++ return false; ++ ++ return index == vp_dev->admin_vq.vq_index; ++} ++ + /* wait for pending irq handlers */ + void vp_synchronize_vectors(struct virtio_device *vdev) + { +@@ -234,10 +244,9 @@ static struct virtqueue *vp_setup_vq(struct virtio_device *vdev, unsigned int in + return vq; + } + +-static void vp_del_vq(struct virtqueue *vq) ++static void vp_del_vq(struct virtqueue *vq, struct virtio_pci_vq_info *info) + { + struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev); +- struct virtio_pci_vq_info *info = vp_dev->vqs[vq->index]; + unsigned long flags; + + /* +@@ -258,13 +267,16 @@ static void vp_del_vq(struct virtqueue *vq) + void vp_del_vqs(struct virtio_device *vdev) + { + struct virtio_pci_device *vp_dev = to_vp_device(vdev); ++ struct virtio_pci_vq_info *info; + struct virtqueue *vq, *n; + int i; + + list_for_each_entry_safe(vq, n, &vdev->vqs, list) { +- if (vp_dev->per_vq_vectors) { +- int v = vp_dev->vqs[vq->index]->msix_vector; ++ info = vp_is_avq(vdev, vq->index) ? vp_dev->admin_vq.info : ++ vp_dev->vqs[vq->index]; + ++ if (vp_dev->per_vq_vectors) { ++ int v = info->msix_vector; + if (v != VIRTIO_MSI_NO_VECTOR && + !vp_is_slow_path_vector(v)) { + int irq = pci_irq_vector(vp_dev->pci_dev, v); +@@ -273,7 +285,7 @@ void vp_del_vqs(struct virtio_device *vdev) + free_irq(irq, vq); + } + } +- vp_del_vq(vq); ++ vp_del_vq(vq, info); + } + vp_dev->per_vq_vectors = false; + +@@ -354,7 +366,7 @@ vp_find_one_vq_msix(struct virtio_device *vdev, int queue_idx, + vring_interrupt, 0, + vp_dev->msix_names[msix_vec], vq); + if (err) { +- vp_del_vq(vq); ++ vp_del_vq(vq, *p_info); + return ERR_PTR(err); + } + +diff --git a/drivers/virtio/virtio_pci_common.h b/drivers/virtio/virtio_pci_common.h +index 1d9c49947f52d..8beecf23ec85e 100644 +--- a/drivers/virtio/virtio_pci_common.h ++++ b/drivers/virtio/virtio_pci_common.h +@@ -178,6 +178,7 @@ struct virtio_device *virtio_pci_vf_get_pf_dev(struct pci_dev *pdev); + #define VIRTIO_ADMIN_CMD_BITMAP 0 + #endif + ++bool vp_is_avq(struct virtio_device *vdev, unsigned int index); + void vp_modern_avq_done(struct virtqueue *vq); + int vp_modern_admin_cmd_exec(struct virtio_device *vdev, + struct virtio_admin_cmd *cmd); +diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c +index 9193c30d640ae..4fbcbc7a9ae1c 100644 +--- a/drivers/virtio/virtio_pci_modern.c ++++ b/drivers/virtio/virtio_pci_modern.c +@@ -43,16 +43,6 @@ static int vp_avq_index(struct virtio_device *vdev, u16 *index, u16 *num) + return 0; + } + +-static bool vp_is_avq(struct virtio_device *vdev, unsigned int index) +-{ +- struct virtio_pci_device *vp_dev = to_vp_device(vdev); +- +- if (!virtio_has_feature(vdev, VIRTIO_F_ADMIN_VQ)) +- return false; +- +- return index == vp_dev->admin_vq.vq_index; +-} +- + void vp_modern_avq_done(struct virtqueue *vq) + { + struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev); +@@ -245,7 +235,7 @@ static void vp_modern_avq_cleanup(struct virtio_device *vdev) + if (!virtio_has_feature(vdev, VIRTIO_F_ADMIN_VQ)) + return; + +- vq = vp_dev->vqs[vp_dev->admin_vq.vq_index]->vq; ++ vq = vp_dev->admin_vq.info->vq; + if (!vq) + return; + +-- +2.43.0 +