From: Sasha Levin Date: Sat, 8 Feb 2025 16:15:24 +0000 (-0500) Subject: Fixes for 6.13 X-Git-Tag: v6.6.77~46 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=77d31bb2cb070a91d1a6321f7e58ce9bd0e6d0f5;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.13 Signed-off-by: Sasha Levin --- diff --git a/queue-6.13/apei-ghes-have-ghes-honor-the-panic-setting.patch b/queue-6.13/apei-ghes-have-ghes-honor-the-panic-setting.patch new file mode 100644 index 0000000000..b3cfd92276 --- /dev/null +++ b/queue-6.13/apei-ghes-have-ghes-honor-the-panic-setting.patch @@ -0,0 +1,72 @@ +From cf64c2ef7d06be41322fbbf3fccff644ffc65241 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 13:52:24 +0100 +Subject: APEI: GHES: Have GHES honor the panic= setting + +From: Borislav Petkov + +[ Upstream commit 5c0e00a391dd0099fe95991bb2f962848d851916 ] + +The GHES driver overrides the panic= setting by force-rebooting the +system after a fatal hw error has been reported. The intent being that +such an error would be reported earlier. + +However, this is not optimal when a hard-to-debug issue requires long +time to reproduce and when that happens, the box will get rebooted after +30 seconds and thus destroy the whole hw context of when the error +happened. + +So rip out the default GHES panic timeout and honor the global one. + +In the panic disabled (panic=0) case, the error will still be logged to +dmesg for later inspection and if panic after a hw error is really +required, then that can be controlled the usual way - use panic= on the +cmdline or set it in the kernel .config's CONFIG_PANIC_TIMEOUT. + +Reported-by: Feng Tang +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Feng Tang +Reviewed-by: Ira Weiny +Link: https://patch.msgid.link/20250113125224.GFZ4UMiNtWIJvgpveU@fat_crate.local +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 07789f0b59bcd..b727724946556 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -173,8 +173,6 @@ static struct gen_pool *ghes_estatus_pool; + static struct ghes_estatus_cache __rcu *ghes_estatus_caches[GHES_ESTATUS_CACHES_SIZE]; + static atomic_t ghes_estatus_cache_alloced; + +-static int ghes_panic_timeout __read_mostly = 30; +- + static void __iomem *ghes_map(u64 pfn, enum fixed_addresses fixmap_idx) + { + phys_addr_t paddr; +@@ -983,14 +981,16 @@ static void __ghes_panic(struct ghes *ghes, + struct acpi_hest_generic_status *estatus, + u64 buf_paddr, enum fixed_addresses fixmap_idx) + { ++ const char *msg = GHES_PFX "Fatal hardware error"; ++ + __ghes_print_estatus(KERN_EMERG, ghes->generic, estatus); + + ghes_clear_estatus(ghes, estatus, buf_paddr, fixmap_idx); + +- /* reboot to log the error! */ + if (!panic_timeout) +- panic_timeout = ghes_panic_timeout; +- panic("Fatal hardware error!"); ++ pr_emerg("%s but panic disabled\n", msg); ++ ++ panic(msg); + } + + static int ghes_proc(struct ghes *ghes) +-- +2.39.5 + diff --git a/queue-6.13/arm64-mm-ensure-adequate-huge_max_hstate.patch b/queue-6.13/arm64-mm-ensure-adequate-huge_max_hstate.patch new file mode 100644 index 0000000000..534e26ae6f --- /dev/null +++ b/queue-6.13/arm64-mm-ensure-adequate-huge_max_hstate.patch @@ -0,0 +1,56 @@ +From 8278355ff43db04113c0b3441ba994595d0cf6f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 12:14:07 +0530 +Subject: arm64/mm: Ensure adequate HUGE_MAX_HSTATE + +From: Anshuman Khandual + +[ Upstream commit 1e5823c8e86de83a43d59a522b4de29066d3b306 ] + +This asserts that HUGE_MAX_HSTATE is sufficient enough preventing potential +hugetlb_max_hstate runtime overflow in hugetlb_add_hstate() thus triggering +a BUG_ON() there after. + +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Ard Biesheuvel +Cc: Ryan Roberts +Cc: Mark Rutland +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Anshuman Khandual +Reviewed-by: Ryan Roberts +Reviewed-by: Gavin Shan +Link: https://lore.kernel.org/r/20241202064407.53807-1-anshuman.khandual@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/hugetlbpage.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c +index 3215adf48a1b6..98a2a0e64e255 100644 +--- a/arch/arm64/mm/hugetlbpage.c ++++ b/arch/arm64/mm/hugetlbpage.c +@@ -519,6 +519,18 @@ pte_t huge_ptep_clear_flush(struct vm_area_struct *vma, + + static int __init hugetlbpage_init(void) + { ++ /* ++ * HugeTLB pages are supported on maximum four page table ++ * levels (PUD, CONT PMD, PMD, CONT PTE) for a given base ++ * page size, corresponding to hugetlb_add_hstate() calls ++ * here. ++ * ++ * HUGE_MAX_HSTATE should at least match maximum supported ++ * HugeTLB page sizes on the platform. Any new addition to ++ * supported HugeTLB page sizes will also require changing ++ * HUGE_MAX_HSTATE as well. ++ */ ++ BUILD_BUG_ON(HUGE_MAX_HSTATE < 4); + if (pud_sect_supported()) + hugetlb_add_hstate(PUD_SHIFT - PAGE_SHIFT); + +-- +2.39.5 + diff --git a/queue-6.13/asoc-amd-add-acpi-dependency-to-fix-build-error.patch b/queue-6.13/asoc-amd-add-acpi-dependency-to-fix-build-error.patch new file mode 100644 index 0000000000..a776f43833 --- /dev/null +++ b/queue-6.13/asoc-amd-add-acpi-dependency-to-fix-build-error.patch @@ -0,0 +1,48 @@ +From 15da39e7f377c68df04925e20bf40afba936d102 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 01:15:47 +0800 +Subject: ASoC: amd: Add ACPI dependency to fix build error + +From: Yu-Chun Lin + +[ Upstream commit 7e24ec93aecd12e33d31e38e5af4625553bbc727 ] + +As reported by the kernel test robot, the following error occurs: + + sound/soc/amd/yc/acp6x-mach.c: In function 'acp6x_probe': +>> sound/soc/amd/yc/acp6x-mach.c:573:15: error: implicit declaration of function 'acpi_evaluate_integer'; did you mean 'acpi_evaluate_object'? [-Werror=implicit-function-declaration] + 573 | ret = acpi_evaluate_integer(handle, "_WOV", NULL, &dmic_status); + | ^~~~~~~~~~~~~~~~~~~~~ + | acpi_evaluate_object + cc1: some warnings being treated as errors + +The function 'acpi_evaluate_integer' and its prototype in 'acpi_bus.h' +are only available when 'CONFIG_ACPI' is enabled. Add a 'depends on ACPI' +directive in Kconfig to ensure proper compilation. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202501090345.pBIDRTym-lkp@intel.com/ +Signed-off-by: Yu-Chun Lin +Link: https://patch.msgid.link/20250109171547.362412-1-eleanor15x@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/amd/Kconfig b/sound/soc/amd/Kconfig +index c7590d4989bba..8035211782791 100644 +--- a/sound/soc/amd/Kconfig ++++ b/sound/soc/amd/Kconfig +@@ -105,7 +105,7 @@ config SND_SOC_AMD_ACP6x + config SND_SOC_AMD_YC_MACH + tristate "AMD YC support for DMIC" + select SND_SOC_DMIC +- depends on SND_SOC_AMD_ACP6x ++ depends on SND_SOC_AMD_ACP6x && ACPI + help + This option enables machine driver for Yellow Carp platform + using dmic. ACP IP has PDM Decoder block with DMA controller. +-- +2.39.5 + diff --git a/queue-6.13/asoc-intel-sof_sdw-correct-quirk-for-lenovo-yoga-sli.patch b/queue-6.13/asoc-intel-sof_sdw-correct-quirk-for-lenovo-yoga-sli.patch new file mode 100644 index 0000000000..0e26014875 --- /dev/null +++ b/queue-6.13/asoc-intel-sof_sdw-correct-quirk-for-lenovo-yoga-sli.patch @@ -0,0 +1,43 @@ +From cdaeb6489d382bb04ad0cb4aba8233ab66a32238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 15:58:57 +0800 +Subject: ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7 + +From: Simon Trimmer + +[ Upstream commit 7662f0e5d55728a009229112ec820e963ed0e21c ] + +In addition to changing the DMI match to examine the product name rather +than the SKU, this adds the quirk to inform the machine driver to not +bind in the cs42l43 microphone DAI link. + +Signed-off-by: Simon Trimmer +Reviewed-by: Liam Girdwood +Signed-off-by: Bard Liao +Link: https://patch.msgid.link/20241206075903.195730-5-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 5554ad4e7c787..65e55c46fb064 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -641,9 +641,10 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "380E") ++ DMI_MATCH(DMI_PRODUCT_NAME, "83HM") + }, +- .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS), ++ .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS | ++ SOC_SDW_CODEC_MIC), + }, + { + .callback = sof_sdw_quirk_cb, +-- +2.39.5 + diff --git a/queue-6.13/asoc-soc-pcm-don-t-use-soc_pcm_ret-on-.prepare-callb.patch b/queue-6.13/asoc-soc-pcm-don-t-use-soc_pcm_ret-on-.prepare-callb.patch new file mode 100644 index 0000000000..91e47e7db1 --- /dev/null +++ b/queue-6.13/asoc-soc-pcm-don-t-use-soc_pcm_ret-on-.prepare-callb.patch @@ -0,0 +1,104 @@ +From 10ca34d2fe7cb9ffd02daf9cde5760dcbf8eb1fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 01:21:10 +0000 +Subject: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback + +From: Kuninori Morimoto + +[ Upstream commit 301c26a018acb94dd537a4418cefa0f654500c6f ] + +commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" +log severity") ignores -EINVAL error message on common soc_pcm_ret(). +It is used from many functions, ignoring -EINVAL is over-kill. + +The reason why -EINVAL was ignored was it really should only be used +upon invalid parameters coming from userspace and in that case we don't +want to log an error since we do not want to give userspace a way to do +a denial-of-service attack on the syslog / diskspace. + +So don't use soc_pcm_ret() on .prepare callback is better idea. + +Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com +Cc: Hans de Goede +Signed-off-by: Kuninori Morimoto +Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- + 1 file changed, 28 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 1150455619aa4..88b3ad5a25520 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, + switch (ret) { + case -EPROBE_DEFER: + case -ENOTSUPP: +- case -EINVAL: + break; + default: + dev_err(rtd->dev, +@@ -986,7 +985,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, + } + + out: +- return soc_pcm_ret(rtd, ret); ++ /* ++ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity ++ * ++ * We don't want to log an error since we do not want to give userspace a way to do a ++ * denial-of-service attack on the syslog / diskspace. ++ */ ++ return ret; + } + + /* PCM prepare ops for non-DPCM streams */ +@@ -998,6 +1003,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) + snd_soc_dpcm_mutex_lock(rtd); + ret = __soc_pcm_prepare(rtd, substream); + snd_soc_dpcm_mutex_unlock(rtd); ++ ++ /* ++ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity ++ * ++ * We don't want to log an error since we do not want to give userspace a way to do a ++ * denial-of-service attack on the syslog / diskspace. ++ */ + return ret; + } + +@@ -2539,7 +2551,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) + be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; + } + +- return soc_pcm_ret(fe, ret); ++ /* ++ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity ++ * ++ * We don't want to log an error since we do not want to give userspace a way to do a ++ * denial-of-service attack on the syslog / diskspace. ++ */ ++ return ret; + } + + static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) +@@ -2579,7 +2597,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) + dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); + snd_soc_dpcm_mutex_unlock(fe); + +- return soc_pcm_ret(fe, ret); ++ /* ++ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity ++ * ++ * We don't want to log an error since we do not want to give userspace a way to do a ++ * denial-of-service attack on the syslog / diskspace. ++ */ ++ return ret; + } + + static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) +-- +2.39.5 + diff --git a/queue-6.13/asoc-sof-intel-hda-dai-ensure-dai-widget-is-valid-du.patch b/queue-6.13/asoc-sof-intel-hda-dai-ensure-dai-widget-is-valid-du.patch new file mode 100644 index 0000000000..9acc8ebf75 --- /dev/null +++ b/queue-6.13/asoc-sof-intel-hda-dai-ensure-dai-widget-is-valid-du.patch @@ -0,0 +1,80 @@ +From f1be88b1e78906a4fb0886ed33dcfc1485de35ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 18:48:53 +0800 +Subject: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bard Liao + +[ Upstream commit 569922b82ca660f8b24e705f6cf674e6b1f99cc7 ] + +Each cpu DAI should associate with a widget. However, the topology might +not create the right number of DAI widgets for aggregated amps. And it +will cause NULL pointer deference. +Check that the DAI widget associated with the CPU DAI is valid to prevent +NULL pointer deference due to missing DAI widgets in topologies with +aggregated amps. + +Signed-off-by: Bard Liao +Reviewed-by: Ranjani Sridharan +Reviewed-by: Péter Ujfalusi +Reviewed-by: Liam Girdwood +Link: https://patch.msgid.link/20241203104853.56956-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-dai.c | 12 ++++++++++++ + sound/soc/sof/intel/hda.c | 5 +++++ + 2 files changed, 17 insertions(+) + +diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c +index 0db2a3e554fb2..da12aabc1bb85 100644 +--- a/sound/soc/sof/intel/hda-dai.c ++++ b/sound/soc/sof/intel/hda-dai.c +@@ -503,6 +503,12 @@ int sdw_hda_dai_hw_params(struct snd_pcm_substream *substream, + int ret; + int i; + ++ if (!w) { ++ dev_err(cpu_dai->dev, "%s widget not found, check amp link num in the topology\n", ++ cpu_dai->name); ++ return -EINVAL; ++ } ++ + ops = hda_dai_get_ops(substream, cpu_dai); + if (!ops) { + dev_err(cpu_dai->dev, "DAI widget ops not set\n"); +@@ -582,6 +588,12 @@ int sdw_hda_dai_hw_params(struct snd_pcm_substream *substream, + */ + for_each_rtd_cpu_dais(rtd, i, dai) { + w = snd_soc_dai_get_widget(dai, substream->stream); ++ if (!w) { ++ dev_err(cpu_dai->dev, ++ "%s widget not found, check amp link num in the topology\n", ++ dai->name); ++ return -EINVAL; ++ } + ipc4_copier = widget_to_copier(w); + memcpy(&ipc4_copier->dma_config_tlv[cpu_dai_id], dma_config_tlv, + sizeof(*dma_config_tlv)); +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index f991785f727e9..be689f6e10c81 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -63,6 +63,11 @@ static int sdw_params_stream(struct device *dev, + struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(d, params_data->substream->stream); + struct snd_sof_dai_config_data data = { 0 }; + ++ if (!w) { ++ dev_err(dev, "%s widget not found, check amp link num in the topology\n", ++ d->name); ++ return -EINVAL; ++ } + data.dai_index = (params_data->link_id << 8) | d->id; + data.dai_data = params_data->alh_stream_id; + data.dai_node_id = data.dai_data; +-- +2.39.5 + diff --git a/queue-6.13/bluetooth-btusb-add-id-0x2c7c-0x0130-for-qualcomm-wc.patch b/queue-6.13/bluetooth-btusb-add-id-0x2c7c-0x0130-for-qualcomm-wc.patch new file mode 100644 index 0000000000..3c7216e5d9 --- /dev/null +++ b/queue-6.13/bluetooth-btusb-add-id-0x2c7c-0x0130-for-qualcomm-wc.patch @@ -0,0 +1,68 @@ +From 5d7663f2e462457b4750a89d5b5e0258e8aef3e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 16:02:55 -0800 +Subject: Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x + +From: Mark Dietzer + +[ Upstream commit a6587d7ed2cd8341f8a92112ac772f2c44f09824 ] + +Adds a new entry with VID 0x2c7c and PID 0x0130 to the btusb quirks table as it uses a Qualcomm WCN785x chipset + +The device information from /sys/kernel/debug/usb/devices is provided below: +T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=05 Dev#= 7 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0130 Rev= 0.01 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I: If#= 1 Alt= 7 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 65 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 65 Ivl=1ms + +Signed-off-by: Mark Dietzer +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index f69df515d668b..41132d02fd7d9 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -377,6 +377,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3623), .driver_info = BTUSB_QCA_WCN6855 | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x2c7c, 0x0130), .driver_info = BTUSB_QCA_WCN6855 | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Broadcom BCM2035 */ + { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, +-- +2.39.5 + diff --git a/queue-6.13/bluetooth-btusb-add-new-vid-pid-13d3-3610-for-mt7922.patch b/queue-6.13/bluetooth-btusb-add-new-vid-pid-13d3-3610-for-mt7922.patch new file mode 100644 index 0000000000..af6d203c75 --- /dev/null +++ b/queue-6.13/bluetooth-btusb-add-new-vid-pid-13d3-3610-for-mt7922.patch @@ -0,0 +1,98 @@ +From 799ecb24a201ae3cae178f147c088d6a883fcf8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 14:42:11 -0600 +Subject: Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922 + +From: Andrew Halaney + +[ Upstream commit 45e7d389bf2e52dfc893779c611dd5cff461b590 ] + +A new machine has a Archer AX3000 / TX55e in it, +and out the box reported issues resetting hci0. It looks like +this is a MT7922 from the lspci output, so treat it as a MediaTek +device and use the proper callbacks. With that in place an xbox +controller can be used without issue as seen below: + + [ 7.047388] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20241106163512 + [ 9.583883] Bluetooth: hci0: Device setup in 2582842 usecs + [ 9.583895] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported. + [ 9.644780] Bluetooth: hci0: AOSP extensions version v1.00 + [ 9.644784] Bluetooth: hci0: AOSP quality report is supported + [ 876.379876] input: Xbox Wireless Controller as /devices/virtual/misc/uhid/0005:045E:0B13.0006/input/input27 + [ 876.380215] hid-generic 0005:045E:0B13.0006: input,hidraw3: BLUETOOTH HID v5.15 Gamepad [Xbox Wireless Controller] on c0:bf:be:27:de:f7 + [ 876.429368] input: Xbox Wireless Controller as /devices/virtual/misc/uhid/0005:045E:0B13.0006/input/input28 + [ 876.429423] microsoft 0005:045E:0B13.0006: input,hidraw3: BLUETOOTH HID v5.15 Gamepad [Xbox Wireless Controller] on c0:bf:be:27:de:f7 + +lspci output: + + root@livingroom:/home/ajhalaney/git# lspci + ... + 05:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter + +and USB device: + + root@livingroom:/home/ajhalaney/git# cat /sys/kernel/debug/usb/devices + ... + T: Bus=01 Lev=01 Prnt=01 Port=10 Cnt=03 Dev#= 4 Spd=480 MxCh= 0 + D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 + P: Vendor=13d3 ProdID=3610 Rev= 1.00 + S: Manufacturer=MediaTek Inc. + S: Product=Wireless_Device + S: SerialNumber=000000000 + C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA + A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 + I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us + E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms + E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms + I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms + E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms + I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms + E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms + I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms + E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms + I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms + E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms + I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms + I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms + E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms + I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us + E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us + I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us + E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us + +Signed-off-by: Andrew Halaney +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 41132d02fd7d9..744c34a5e4774 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -612,6 +612,8 @@ static const struct usb_device_id quirks_table[] = { + /* MediaTek MT7922 Bluetooth devices */ + { USB_DEVICE(0x13d3, 0x3585), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3610), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* MediaTek MT7922A Bluetooth devices */ + { USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK | +-- +2.39.5 + diff --git a/queue-6.13/bluetooth-btusb-add-new-vid-pid-13d3-3628-for-mt7925.patch b/queue-6.13/bluetooth-btusb-add-new-vid-pid-13d3-3628-for-mt7925.patch new file mode 100644 index 0000000000..aa916442d3 --- /dev/null +++ b/queue-6.13/bluetooth-btusb-add-new-vid-pid-13d3-3628-for-mt7925.patch @@ -0,0 +1,77 @@ +From 9399a86b4834c2390d9257428f9cabd12585cc8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 14:35:22 +0800 +Subject: Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925 + +From: En-Wei Wu + +[ Upstream commit f63f401130e5c5cd0dd2f18c9df967ab75cd4732 ] + +Add VID 13d3 & PID 3628 for MediaTek MT7925 USB Bluetooth chip. + +The information in /sys/kernel/debug/usb/devices about the Bluetooth +device is listed as the below. + +T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3628 Rev= 1.00 +S: Manufacturer=MediaTek Inc. +S: Product=Wireless_Device +S: SerialNumber=000000000 +C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA +A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us +I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us +E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us + +Signed-off-by: En-Wei Wu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 744c34a5e4774..72e85673b7095 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -678,6 +678,8 @@ static const struct usb_device_id quirks_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3608), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x13d3, 0x3628), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH }, + + /* Additional Realtek 8723AE Bluetooth devices */ + { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, +-- +2.39.5 + diff --git a/queue-6.13/bluetooth-mgmt-fix-slab-use-after-free-read-in-mgmt_.patch b/queue-6.13/bluetooth-mgmt-fix-slab-use-after-free-read-in-mgmt_.patch new file mode 100644 index 0000000000..c4a1922e52 --- /dev/null +++ b/queue-6.13/bluetooth-mgmt-fix-slab-use-after-free-read-in-mgmt_.patch @@ -0,0 +1,130 @@ +From 23c82609a6ef8a56fe5101544eeacb7a4ef27e43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 05:06:16 +0300 +Subject: Bluetooth: MGMT: Fix slab-use-after-free Read in + mgmt_remove_adv_monitor_sync + +From: Mazin Al Haddad + +[ Upstream commit 26fbd3494a7dd26269cb0817c289267dbcfdec06 ] + +This fixes the following crash: + +================================================================== +BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 +Read of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961 + +CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Workqueue: hci0 hci_cmd_sync_work +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0x169/0x550 mm/kasan/report.c:489 + kasan_report+0x143/0x180 mm/kasan/report.c:602 + mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 + hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 + process_one_work kernel/workqueue.c:3229 [inline] + process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 + worker_thread+0x870/0xd30 kernel/workqueue.c:3391 + kthread+0x2f0/0x390 kernel/kthread.c:389 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + + +Allocated by task 16026: + kasan_save_stack mm/kasan/common.c:47 [inline] + kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 + poison_kmalloc_redzone mm/kasan/common.c:377 [inline] + __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 + kasan_kmalloc include/linux/kasan.h:260 [inline] + __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314 + kmalloc_noprof include/linux/slab.h:901 [inline] + kzalloc_noprof include/linux/slab.h:1037 [inline] + mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 + mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296 + remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568 + hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 + hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832 + sock_sendmsg_nosec net/socket.c:711 [inline] + __sock_sendmsg+0x221/0x270 net/socket.c:726 + sock_write_iter+0x2d7/0x3f0 net/socket.c:1147 + new_sync_write fs/read_write.c:586 [inline] + vfs_write+0xaeb/0xd30 fs/read_write.c:679 + ksys_write+0x18f/0x2b0 fs/read_write.c:731 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Freed by task 16022: + kasan_save_stack mm/kasan/common.c:47 [inline] + kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 + kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 + poison_slab_object mm/kasan/common.c:247 [inline] + __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 + kasan_slab_free include/linux/kasan.h:233 [inline] + slab_free_hook mm/slub.c:2338 [inline] + slab_free mm/slub.c:4598 [inline] + kfree+0x196/0x420 mm/slub.c:4746 + mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 + __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550 + hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 + hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] + hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 + sock_do_ioctl+0x158/0x460 net/socket.c:1209 + sock_ioctl+0x626/0x8e0 net/socket.c:1328 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:906 [inline] + __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Reported-by: syzbot+479aff51bb361ef5aa18@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=479aff51bb361ef5aa18 +Tested-by: syzbot+479aff51bb361ef5aa18@syzkaller.appspotmail.com +Signed-off-by: Mazin Al Haddad +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index de47ad999d7b6..71dda10f6a24f 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -5519,10 +5519,16 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, + { + struct mgmt_rp_remove_adv_monitor rp; + struct mgmt_pending_cmd *cmd = data; +- struct mgmt_cp_remove_adv_monitor *cp = cmd->param; ++ struct mgmt_cp_remove_adv_monitor *cp; ++ ++ if (status == -ECANCELED || ++ cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) ++ return; + + hci_dev_lock(hdev); + ++ cp = cmd->param; ++ + rp.monitor_handle = cp->monitor_handle; + + if (!status) +@@ -5540,6 +5546,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, + static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) + { + struct mgmt_pending_cmd *cmd = data; ++ ++ if (cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) ++ return -ECANCELED; ++ + struct mgmt_cp_remove_adv_monitor *cp = cmd->param; + u16 handle = __le16_to_cpu(cp->monitor_handle); + +-- +2.39.5 + diff --git a/queue-6.13/bpf-improve-verifier-log-for-resource-leak-on-exit.patch b/queue-6.13/bpf-improve-verifier-log-for-resource-leak-on-exit.patch new file mode 100644 index 0000000000..b1b346e308 --- /dev/null +++ b/queue-6.13/bpf-improve-verifier-log-for-resource-leak-on-exit.patch @@ -0,0 +1,145 @@ +From 87cf277585d50c2813290a05c7d19956dbc77ac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 19:03:58 -0800 +Subject: bpf: Improve verifier log for resource leak on exit + +From: Kumar Kartikeya Dwivedi + +[ Upstream commit cbd8730aea8d79cda6b0f3c18b406dfdef0c1b80 ] + +The verifier log when leaking resources on BPF_EXIT may be a bit +confusing, as it's a problem only when finally existing from the main +prog, not from any of the subprogs. Hence, update the verifier error +string and the corresponding selftests matching on it. + +Acked-by: Eduard Zingerman +Suggested-by: Eduard Zingerman +Signed-off-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/r/20241204030400.208005-6-memxor@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 2 +- + .../testing/selftests/bpf/progs/exceptions_fail.c | 4 ++-- + tools/testing/selftests/bpf/progs/preempt_lock.c | 14 +++++++------- + .../selftests/bpf/progs/verifier_spin_lock.c | 2 +- + 4 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 77f56674aaa99..4f02345b764fd 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -18803,7 +18803,7 @@ static int do_check(struct bpf_verifier_env *env) + * match caller reference state when it exits. + */ + err = check_resource_leak(env, exception_exit, !env->cur_state->curframe, +- "BPF_EXIT instruction"); ++ "BPF_EXIT instruction in main prog"); + if (err) + return err; + +diff --git a/tools/testing/selftests/bpf/progs/exceptions_fail.c b/tools/testing/selftests/bpf/progs/exceptions_fail.c +index fe0f3fa5aab68..8a0fdff899271 100644 +--- a/tools/testing/selftests/bpf/progs/exceptions_fail.c ++++ b/tools/testing/selftests/bpf/progs/exceptions_fail.c +@@ -131,7 +131,7 @@ int reject_subprog_with_lock(void *ctx) + } + + SEC("?tc") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_rcu_read_lock-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region") + int reject_with_rcu_read_lock(void *ctx) + { + bpf_rcu_read_lock(); +@@ -147,7 +147,7 @@ __noinline static int throwing_subprog(struct __sk_buff *ctx) + } + + SEC("?tc") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_rcu_read_lock-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region") + int reject_subprog_with_rcu_read_lock(void *ctx) + { + bpf_rcu_read_lock(); +diff --git a/tools/testing/selftests/bpf/progs/preempt_lock.c b/tools/testing/selftests/bpf/progs/preempt_lock.c +index 885377e836077..5269571cf7b57 100644 +--- a/tools/testing/selftests/bpf/progs/preempt_lock.c ++++ b/tools/testing/selftests/bpf/progs/preempt_lock.c +@@ -6,7 +6,7 @@ + #include "bpf_experimental.h" + + SEC("?tc") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region") + int preempt_lock_missing_1(struct __sk_buff *ctx) + { + bpf_preempt_disable(); +@@ -14,7 +14,7 @@ int preempt_lock_missing_1(struct __sk_buff *ctx) + } + + SEC("?tc") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region") + int preempt_lock_missing_2(struct __sk_buff *ctx) + { + bpf_preempt_disable(); +@@ -23,7 +23,7 @@ int preempt_lock_missing_2(struct __sk_buff *ctx) + } + + SEC("?tc") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region") + int preempt_lock_missing_3(struct __sk_buff *ctx) + { + bpf_preempt_disable(); +@@ -33,7 +33,7 @@ int preempt_lock_missing_3(struct __sk_buff *ctx) + } + + SEC("?tc") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region") + int preempt_lock_missing_3_minus_2(struct __sk_buff *ctx) + { + bpf_preempt_disable(); +@@ -55,7 +55,7 @@ static __noinline void preempt_enable(void) + } + + SEC("?tc") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region") + int preempt_lock_missing_1_subprog(struct __sk_buff *ctx) + { + preempt_disable(); +@@ -63,7 +63,7 @@ int preempt_lock_missing_1_subprog(struct __sk_buff *ctx) + } + + SEC("?tc") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region") + int preempt_lock_missing_2_subprog(struct __sk_buff *ctx) + { + preempt_disable(); +@@ -72,7 +72,7 @@ int preempt_lock_missing_2_subprog(struct __sk_buff *ctx) + } + + SEC("?tc") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region") + int preempt_lock_missing_2_minus_1_subprog(struct __sk_buff *ctx) + { + preempt_disable(); +diff --git a/tools/testing/selftests/bpf/progs/verifier_spin_lock.c b/tools/testing/selftests/bpf/progs/verifier_spin_lock.c +index 3f679de73229f..25599eac9a702 100644 +--- a/tools/testing/selftests/bpf/progs/verifier_spin_lock.c ++++ b/tools/testing/selftests/bpf/progs/verifier_spin_lock.c +@@ -187,7 +187,7 @@ l0_%=: r6 = r0; \ + + SEC("cgroup/skb") + __description("spin_lock: test6 missing unlock") +-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_spin_lock-ed region") ++__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_spin_lock-ed region") + __failure_unpriv __msg_unpriv("") + __naked void spin_lock_test6_missing_unlock(void) + { +-- +2.39.5 + diff --git a/queue-6.13/btrfs-convert-bug_on-in-btrfs_reloc_cow_block-to-pro.patch b/queue-6.13/btrfs-convert-bug_on-in-btrfs_reloc_cow_block-to-pro.patch new file mode 100644 index 0000000000..26b3896016 --- /dev/null +++ b/queue-6.13/btrfs-convert-bug_on-in-btrfs_reloc_cow_block-to-pro.patch @@ -0,0 +1,51 @@ +From 190c9a146bb19fda0f5de66c2c4a0f9f776307d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 11:43:03 -0400 +Subject: btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error + handling + +From: Josef Bacik + +[ Upstream commit 6a4730b325aaa48f7a5d5ba97aff0a955e2d9cec ] + +This BUG_ON is meant to catch backref cache problems, but these can +arise from either bugs in the backref cache or corruption in the extent +tree. Fix it to be a proper error. + +Reviewed-by: Boris Burkov +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/relocation.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index db8b42f674b7c..ab2de2d1b2bee 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4405,8 +4405,18 @@ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans, + WARN_ON(!first_cow && level == 0); + + node = rc->backref_cache.path[level]; +- BUG_ON(node->bytenr != buf->start && +- node->new_bytenr != buf->start); ++ ++ /* ++ * If node->bytenr != buf->start and node->new_bytenr != ++ * buf->start then we've got the wrong backref node for what we ++ * expected to see here and the cache is incorrect. ++ */ ++ if (unlikely(node->bytenr != buf->start && node->new_bytenr != buf->start)) { ++ btrfs_err(fs_info, ++"bytenr %llu was found but our backref cache was expecting %llu or %llu", ++ buf->start, node->bytenr, node->new_bytenr); ++ return -EUCLEAN; ++ } + + btrfs_backref_drop_node_buffer(node); + atomic_inc(&cow->refs); +-- +2.39.5 + diff --git a/queue-6.13/btrfs-do-not-output-error-message-if-a-qgroup-has-be.patch b/queue-6.13/btrfs-do-not-output-error-message-if-a-qgroup-has-be.patch new file mode 100644 index 0000000000..12a6f657db --- /dev/null +++ b/queue-6.13/btrfs-do-not-output-error-message-if-a-qgroup-has-be.patch @@ -0,0 +1,68 @@ +From 88af943149cf5a32f92246e0e952fb47d08f7862 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 09:40:43 +1030 +Subject: btrfs: do not output error message if a qgroup has been already + cleaned up + +From: Qu Wenruo + +[ Upstream commit c9c863793395cf0a66c2778a29d72c48c02fbb66 ] + +[BUG] +There is a bug report that btrfs outputs the following error message: + + BTRFS info (device nvme0n1p2): qgroup scan completed (inconsistency flag cleared) + BTRFS warning (device nvme0n1p2): failed to cleanup qgroup 0/1179: -2 + +[CAUSE] +The error itself is pretty harmless, and the end user should ignore it. + +When a subvolume is fully dropped, btrfs will call +btrfs_qgroup_cleanup_dropped_subvolume() to delete the qgroup. + +However if a qgroup rescan happened before a subvolume fully dropped, +qgroup for that subvolume will not be re-created, as rescan will only +create new qgroup if there is a BTRFS_ROOT_REF_KEY found. + +But before we drop a subvolume, the subvolume is unlinked thus there is no +BTRFS_ROOT_REF_KEY. + +In that case, btrfs_remove_qgroup() will fail with -ENOENT and trigger +the above error message. + +[FIX] +Just ignore -ENOENT error from btrfs_remove_qgroup() inside +btrfs_qgroup_cleanup_dropped_subvolume(). + +Reported-by: John Shand +Link: https://bugzilla.suse.com/show_bug.cgi?id=1236056 +Fixes: 839d6ea4f86d ("btrfs: automatically remove the subvolume qgroup") +Reviewed-by: Filipe Manana +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/qgroup.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 993b5e803699e..5ab51781d0e4f 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -1915,8 +1915,11 @@ int btrfs_qgroup_cleanup_dropped_subvolume(struct btrfs_fs_info *fs_info, u64 su + /* + * It's squota and the subvolume still has numbers needed for future + * accounting, in this case we can not delete it. Just skip it. ++ * ++ * Or the qgroup is already removed by a qgroup rescan. For both cases we're ++ * safe to ignore them. + */ +- if (ret == -EBUSY) ++ if (ret == -EBUSY || ret == -ENOENT) + ret = 0; + return ret; + } +-- +2.39.5 + diff --git a/queue-6.13/btrfs-don-t-use-btrfs_set_item_key_safe-on-raid-stri.patch b/queue-6.13/btrfs-don-t-use-btrfs_set_item_key_safe-on-raid-stri.patch new file mode 100644 index 0000000000..6e21c0c558 --- /dev/null +++ b/queue-6.13/btrfs-don-t-use-btrfs_set_item_key_safe-on-raid-stri.patch @@ -0,0 +1,153 @@ +From 9f402d6cdb19404b6d83c9ff5c728a3da0aa77be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 20:31:49 +0100 +Subject: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents + +From: Johannes Thumshirn + +[ Upstream commit dc14ba10781bd2629835696b7cc1febf914768e9 ] + +Don't use btrfs_set_item_key_safe() to modify the keys in the RAID +stripe-tree, as this can lead to corruption of the tree, which is caught +by the checks in btrfs_set_item_key_safe(): + + BTRFS info (device nvme1n1): leaf 49168384 gen 15 total ptrs 194 free space 8329 owner 12 + BTRFS info (device nvme1n1): refs 2 lock_owner 1030 current 1030 + [ snip ] + item 105 key (354549760 230 20480) itemoff 14587 itemsize 16 + stride 0 devid 5 physical 67502080 + item 106 key (354631680 230 4096) itemoff 14571 itemsize 16 + stride 0 devid 1 physical 88559616 + item 107 key (354631680 230 32768) itemoff 14555 itemsize 16 + stride 0 devid 1 physical 88555520 + item 108 key (354717696 230 28672) itemoff 14539 itemsize 16 + stride 0 devid 2 physical 67604480 + [ snip ] + BTRFS critical (device nvme1n1): slot 106 key (354631680 230 32768) new key (354635776 230 4096) + ------------[ cut here ]------------ + kernel BUG at fs/btrfs/ctree.c:2602! + Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI + CPU: 1 UID: 0 PID: 1055 Comm: fsstress Not tainted 6.13.0-rc1+ #1464 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 + RIP: 0010:btrfs_set_item_key_safe+0xf7/0x270 + Code: + RSP: 0018:ffffc90001337ab0 EFLAGS: 00010287 + RAX: 0000000000000000 RBX: ffff8881115fd000 RCX: 0000000000000000 + RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff + RBP: ffff888110ed6f50 R08: 00000000ffffefff R09: ffffffff8244c500 + R10: 00000000ffffefff R11: 00000000ffffffff R12: ffff888100586000 + R13: 00000000000000c9 R14: ffffc90001337b1f R15: ffff888110f23b58 + FS: 00007f7d75c72740(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fa811652c60 CR3: 0000000111398001 CR4: 0000000000370eb0 + Call Trace: + + ? __die_body.cold+0x14/0x1a + ? die+0x2e/0x50 + ? do_trap+0xca/0x110 + ? do_error_trap+0x65/0x80 + ? btrfs_set_item_key_safe+0xf7/0x270 + ? exc_invalid_op+0x50/0x70 + ? btrfs_set_item_key_safe+0xf7/0x270 + ? asm_exc_invalid_op+0x1a/0x20 + ? btrfs_set_item_key_safe+0xf7/0x270 + btrfs_partially_delete_raid_extent+0xc4/0xe0 + btrfs_delete_raid_extent+0x227/0x240 + __btrfs_free_extent.isra.0+0x57f/0x9c0 + ? exc_coproc_segment_overrun+0x40/0x40 + __btrfs_run_delayed_refs+0x2fa/0xe80 + btrfs_run_delayed_refs+0x81/0xe0 + btrfs_commit_transaction+0x2dd/0xbe0 + ? preempt_count_add+0x52/0xb0 + btrfs_sync_file+0x375/0x4c0 + do_fsync+0x39/0x70 + __x64_sys_fsync+0x13/0x20 + do_syscall_64+0x54/0x110 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + RIP: 0033:0x7f7d7550ef90 + Code: + RSP: 002b:00007ffd70237248 EFLAGS: 00000202 ORIG_RAX: 000000000000004a + RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f7d7550ef90 + RDX: 000000000000013a RSI: 000000000040eb28 RDI: 0000000000000004 + RBP: 000000000000001b R08: 0000000000000078 R09: 00007ffd7023725c + R10: 00007f7d75400390 R11: 0000000000000202 R12: 028f5c28f5c28f5c + R13: 8f5c28f5c28f5c29 R14: 000000000040b520 R15: 00007f7d75c726c8 + + +While the root cause of the tree order corruption isn't clear, using +btrfs_duplicate_item() to copy the item and then adjusting both the key +and the per-device physical addresses is a safe way to counter this +problem. + +Signed-off-by: Johannes Thumshirn +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/raid-stripe-tree.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/fs/btrfs/raid-stripe-tree.c b/fs/btrfs/raid-stripe-tree.c +index 9ffc79f250fbb..10781c015ee8d 100644 +--- a/fs/btrfs/raid-stripe-tree.c ++++ b/fs/btrfs/raid-stripe-tree.c +@@ -13,12 +13,13 @@ + #include "volumes.h" + #include "print-tree.h" + +-static void btrfs_partially_delete_raid_extent(struct btrfs_trans_handle *trans, ++static int btrfs_partially_delete_raid_extent(struct btrfs_trans_handle *trans, + struct btrfs_path *path, + const struct btrfs_key *oldkey, + u64 newlen, u64 frontpad) + { +- struct btrfs_stripe_extent *extent; ++ struct btrfs_root *stripe_root = trans->fs_info->stripe_root; ++ struct btrfs_stripe_extent *extent, *newitem; + struct extent_buffer *leaf; + int slot; + size_t item_size; +@@ -27,23 +28,38 @@ static void btrfs_partially_delete_raid_extent(struct btrfs_trans_handle *trans, + .type = BTRFS_RAID_STRIPE_KEY, + .offset = newlen, + }; ++ int ret; + + ASSERT(oldkey->type == BTRFS_RAID_STRIPE_KEY); + + leaf = path->nodes[0]; + slot = path->slots[0]; + item_size = btrfs_item_size(leaf, slot); ++ ++ newitem = kzalloc(item_size, GFP_NOFS); ++ if (!newitem) ++ return -ENOMEM; ++ + extent = btrfs_item_ptr(leaf, slot, struct btrfs_stripe_extent); + + for (int i = 0; i < btrfs_num_raid_stripes(item_size); i++) { + struct btrfs_raid_stride *stride = &extent->strides[i]; + u64 phys; + +- phys = btrfs_raid_stride_physical(leaf, stride); +- btrfs_set_raid_stride_physical(leaf, stride, phys + frontpad); ++ phys = btrfs_raid_stride_physical(leaf, stride) + frontpad; ++ btrfs_set_stack_raid_stride_physical(&newitem->strides[i], phys); + } + +- btrfs_set_item_key_safe(trans, path, &newkey); ++ ret = btrfs_del_item(trans, stripe_root, path); ++ if (ret) ++ goto out; ++ ++ btrfs_release_path(path); ++ ret = btrfs_insert_item(trans, stripe_root, &newkey, newitem, item_size); ++ ++out: ++ kfree(newitem); ++ return ret; + } + + int btrfs_delete_raid_extent(struct btrfs_trans_handle *trans, u64 start, u64 length) +-- +2.39.5 + diff --git a/queue-6.13/btrfs-fix-assertion-failure-when-splitting-ordered-e.patch b/queue-6.13/btrfs-fix-assertion-failure-when-splitting-ordered-e.patch new file mode 100644 index 0000000000..dc8660d4a2 --- /dev/null +++ b/queue-6.13/btrfs-fix-assertion-failure-when-splitting-ordered-e.patch @@ -0,0 +1,182 @@ +From b69324b7bc17c099905758e1f95dc4fab1adaa60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 15:01:08 +0000 +Subject: btrfs: fix assertion failure when splitting ordered extent after + transaction abort + +From: Filipe Manana + +[ Upstream commit 0d85f5c2dd91df6b5da454406756f463ba923b69 ] + +If while we are doing a direct IO write a transaction abort happens, we +mark all existing ordered extents with the BTRFS_ORDERED_IOERR flag (done +at btrfs_destroy_ordered_extents()), and then after that if we enter +btrfs_split_ordered_extent() and the ordered extent has bytes left +(meaning we have a bio that doesn't cover the whole ordered extent, see +details at btrfs_extract_ordered_extent()), we will fail on the following +assertion at btrfs_split_ordered_extent(): + + ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS)); + +because the BTRFS_ORDERED_IOERR flag is set and the definition of +BTRFS_ORDERED_TYPE_FLAGS is just the union of all flags that identify the +type of write (regular, nocow, prealloc, compressed, direct IO, encoded). + +Fix this by returning an error from btrfs_extract_ordered_extent() if we +find the BTRFS_ORDERED_IOERR flag in the ordered extent. The error will +be the error that resulted in the transaction abort or -EIO if no +transaction abort happened. + +This was recently reported by syzbot with the following trace: + + FAULT_INJECTION: forcing a failure. + name failslab, interval 1, probability 0, space 0, times 1 + CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller #0 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 + Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + fail_dump lib/fault-inject.c:53 [inline] + should_fail_ex+0x3b0/0x4e0 lib/fault-inject.c:154 + should_failslab+0xac/0x100 mm/failslab.c:46 + slab_pre_alloc_hook mm/slub.c:4072 [inline] + slab_alloc_node mm/slub.c:4148 [inline] + __do_kmalloc_node mm/slub.c:4297 [inline] + __kmalloc_noprof+0xdd/0x4c0 mm/slub.c:4310 + kmalloc_noprof include/linux/slab.h:905 [inline] + kzalloc_noprof include/linux/slab.h:1037 [inline] + btrfs_chunk_alloc_add_chunk_item+0x244/0x1100 fs/btrfs/volumes.c:5742 + reserve_chunk_space+0x1ca/0x2c0 fs/btrfs/block-group.c:4292 + check_system_chunk fs/btrfs/block-group.c:4319 [inline] + do_chunk_alloc fs/btrfs/block-group.c:3891 [inline] + btrfs_chunk_alloc+0x77b/0xf80 fs/btrfs/block-group.c:4187 + find_free_extent_update_loop fs/btrfs/extent-tree.c:4166 [inline] + find_free_extent+0x42d1/0x5810 fs/btrfs/extent-tree.c:4579 + btrfs_reserve_extent+0x422/0x810 fs/btrfs/extent-tree.c:4672 + btrfs_new_extent_direct fs/btrfs/direct-io.c:186 [inline] + btrfs_get_blocks_direct_write+0x706/0xfa0 fs/btrfs/direct-io.c:321 + btrfs_dio_iomap_begin+0xbb7/0x1180 fs/btrfs/direct-io.c:525 + iomap_iter+0x697/0xf60 fs/iomap/iter.c:90 + __iomap_dio_rw+0xeb9/0x25b0 fs/iomap/direct-io.c:702 + btrfs_dio_write fs/btrfs/direct-io.c:775 [inline] + btrfs_direct_write+0x610/0xa30 fs/btrfs/direct-io.c:880 + btrfs_do_write_iter+0x2a0/0x760 fs/btrfs/file.c:1397 + do_iter_readv_writev+0x600/0x880 + vfs_writev+0x376/0xba0 fs/read_write.c:1050 + do_pwritev fs/read_write.c:1146 [inline] + __do_sys_pwritev2 fs/read_write.c:1204 [inline] + __se_sys_pwritev2+0x196/0x2b0 fs/read_write.c:1195 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + RIP: 0033:0x7f1281f85d29 + RSP: 002b:00007f12819fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 + RAX: ffffffffffffffda RBX: 00007f1282176080 RCX: 00007f1281f85d29 + RDX: 0000000000000001 RSI: 0000000020000240 RDI: 0000000000000005 + RBP: 00007f12819fe090 R08: 0000000000000000 R09: 0000000000000003 + R10: 0000000000007000 R11: 0000000000000246 R12: 0000000000000002 + R13: 0000000000000000 R14: 00007f1282176080 R15: 00007ffcb9e23328 + + BTRFS error (device loop0 state A): Transaction aborted (error -12) + BTRFS: error (device loop0 state A) in btrfs_chunk_alloc_add_chunk_item:5745: errno=-12 Out of memory + BTRFS info (device loop0 state EA): forced readonly + assertion failed: !(flags & ~BTRFS_ORDERED_TYPE_FLAGS), in fs/btrfs/ordered-data.c:1234 + ------------[ cut here ]------------ + kernel BUG at fs/btrfs/ordered-data.c:1234! + Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI + CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller #0 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 + RIP: 0010:btrfs_split_ordered_extent+0xd8d/0xe20 fs/btrfs/ordered-data.c:1234 + RSP: 0018:ffffc9000d1df2b8 EFLAGS: 00010246 + RAX: 0000000000000057 RBX: 000000000006a000 RCX: 9ce21886c4195300 + RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 + RBP: 0000000000000091 R08: ffffffff817f0a3c R09: 1ffff92001a3bdf4 + R10: dffffc0000000000 R11: fffff52001a3bdf5 R12: 1ffff1100a45f401 + R13: ffff8880522fa018 R14: dffffc0000000000 R15: 000000000006a000 + FS: 00007f12819fe6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000557750bd7da8 CR3: 00000000400ea000 CR4: 0000000000352ef0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + btrfs_extract_ordered_extent fs/btrfs/direct-io.c:702 [inline] + btrfs_dio_submit_io+0x4be/0x6d0 fs/btrfs/direct-io.c:737 + iomap_dio_submit_bio fs/iomap/direct-io.c:85 [inline] + iomap_dio_bio_iter+0x1022/0x1740 fs/iomap/direct-io.c:447 + __iomap_dio_rw+0x13b7/0x25b0 fs/iomap/direct-io.c:703 + btrfs_dio_write fs/btrfs/direct-io.c:775 [inline] + btrfs_direct_write+0x610/0xa30 fs/btrfs/direct-io.c:880 + btrfs_do_write_iter+0x2a0/0x760 fs/btrfs/file.c:1397 + do_iter_readv_writev+0x600/0x880 + vfs_writev+0x376/0xba0 fs/read_write.c:1050 + do_pwritev fs/read_write.c:1146 [inline] + __do_sys_pwritev2 fs/read_write.c:1204 [inline] + __se_sys_pwritev2+0x196/0x2b0 fs/read_write.c:1195 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + RIP: 0033:0x7f1281f85d29 + RSP: 002b:00007f12819fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 + RAX: ffffffffffffffda RBX: 00007f1282176080 RCX: 00007f1281f85d29 + RDX: 0000000000000001 RSI: 0000000020000240 RDI: 0000000000000005 + RBP: 00007f12819fe090 R08: 0000000000000000 R09: 0000000000000003 + R10: 0000000000007000 R11: 0000000000000246 R12: 0000000000000002 + R13: 0000000000000000 R14: 00007f1282176080 R15: 00007ffcb9e23328 + + Modules linked in: + ---[ end trace 0000000000000000 ]--- + RIP: 0010:btrfs_split_ordered_extent+0xd8d/0xe20 fs/btrfs/ordered-data.c:1234 + RSP: 0018:ffffc9000d1df2b8 EFLAGS: 00010246 + RAX: 0000000000000057 RBX: 000000000006a000 RCX: 9ce21886c4195300 + RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 + RBP: 0000000000000091 R08: ffffffff817f0a3c R09: 1ffff92001a3bdf4 + R10: dffffc0000000000 R11: fffff52001a3bdf5 R12: 1ffff1100a45f401 + R13: ffff8880522fa018 R14: dffffc0000000000 R15: 000000000006a000 + FS: 00007f12819fe6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000557750bd7da8 CR3: 00000000400ea000 CR4: 0000000000352ef0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + +In this case the transaction abort was due to (an injected) memory +allocation failure when attempting to allocate a new chunk. + +Reported-by: syzbot+f60d8337a5c8e8d92a77@syzkaller.appspotmail.com +Link: https://lore.kernel.org/linux-btrfs/6777f2dd.050a0220.178762.0045.GAE@google.com/ +Fixes: 52b1fdca23ac ("btrfs: handle completed ordered extents in btrfs_split_ordered_extent") +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ordered-data.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c +index 30eceaf829a7e..4aca7475fd82c 100644 +--- a/fs/btrfs/ordered-data.c ++++ b/fs/btrfs/ordered-data.c +@@ -1229,6 +1229,18 @@ struct btrfs_ordered_extent *btrfs_split_ordered_extent( + */ + if (WARN_ON_ONCE(len >= ordered->num_bytes)) + return ERR_PTR(-EINVAL); ++ /* ++ * If our ordered extent had an error there's no point in continuing. ++ * The error may have come from a transaction abort done either by this ++ * task or some other concurrent task, and the transaction abort path ++ * iterates over all existing ordered extents and sets the flag ++ * BTRFS_ORDERED_IOERR on them. ++ */ ++ if (unlikely(flags & (1U << BTRFS_ORDERED_IOERR))) { ++ const int fs_error = BTRFS_FS_ERROR(fs_info); ++ ++ return fs_error ? ERR_PTR(fs_error) : ERR_PTR(-EIO); ++ } + /* We cannot split partially completed ordered extents. */ + if (ordered->bytes_left) { + ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS)); +-- +2.39.5 + diff --git a/queue-6.13/btrfs-fix-data-race-when-accessing-the-inode-s-disk_.patch b/queue-6.13/btrfs-fix-data-race-when-accessing-the-inode-s-disk_.patch new file mode 100644 index 0000000000..8d6ae71742 --- /dev/null +++ b/queue-6.13/btrfs-fix-data-race-when-accessing-the-inode-s-disk_.patch @@ -0,0 +1,85 @@ +From 42695268098bba8afa518d1f776abfd94abc32fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 15:56:51 +0800 +Subject: btrfs: fix data race when accessing the inode's disk_i_size at + btrfs_drop_extents() + +From: Hao-ran Zheng + +[ Upstream commit 5324c4e10e9c2ce307a037e904c0d9671d7137d9 ] + +A data race occurs when the function `insert_ordered_extent_file_extent()` +and the function `btrfs_inode_safe_disk_i_size_write()` are executed +concurrently. The function `insert_ordered_extent_file_extent()` is not +locked when reading inode->disk_i_size, causing +`btrfs_inode_safe_disk_i_size_write()` to cause data competition when +writing inode->disk_i_size, thus affecting the value of `modify_tree`. + +The specific call stack that appears during testing is as follows: + + ============DATA_RACE============ + btrfs_drop_extents+0x89a/0xa060 [btrfs] + insert_reserved_file_extent+0xb54/0x2960 [btrfs] + insert_ordered_extent_file_extent+0xff5/0x1760 [btrfs] + btrfs_finish_one_ordered+0x1b85/0x36a0 [btrfs] + btrfs_finish_ordered_io+0x37/0x60 [btrfs] + finish_ordered_fn+0x3e/0x50 [btrfs] + btrfs_work_helper+0x9c9/0x27a0 [btrfs] + process_scheduled_works+0x716/0xf10 + worker_thread+0xb6a/0x1190 + kthread+0x292/0x330 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + ============OTHER_INFO============ + btrfs_inode_safe_disk_i_size_write+0x4ec/0x600 [btrfs] + btrfs_finish_one_ordered+0x24c7/0x36a0 [btrfs] + btrfs_finish_ordered_io+0x37/0x60 [btrfs] + finish_ordered_fn+0x3e/0x50 [btrfs] + btrfs_work_helper+0x9c9/0x27a0 [btrfs] + process_scheduled_works+0x716/0xf10 + worker_thread+0xb6a/0x1190 + kthread+0x292/0x330 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + ================================= + +The main purpose of the check of the inode's disk_i_size is to avoid +taking write locks on a btree path when we have a write at or beyond +EOF, since in these cases we don't expect to find extent items in the +root to drop. However if we end up taking write locks due to a data +race on disk_i_size, everything is still correct, we only add extra +lock contention on the tree in case there's concurrency from other tasks. +If the race causes us to not take write locks when we actually need them, +then everything is functionally correct as well, since if we find out we +have extent items to drop and we took read locks (modify_tree set to 0), +we release the path and retry again with write locks. + +Since this data race does not affect the correctness of the function, +it is a harmless data race, use data_race() to check inode->disk_i_size. + +Reviewed-by: Filipe Manana +Signed-off-by: Hao-ran Zheng +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 14e27473c5bce..4d7c7a296d2d1 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -224,7 +224,7 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, + if (args->drop_cache) + btrfs_drop_extent_map_range(inode, args->start, args->end - 1, false); + +- if (args->start >= inode->disk_i_size && !args->replace_extent) ++ if (data_race(args->start >= inode->disk_i_size) && !args->replace_extent) + modify_tree = 0; + + update_refs = (btrfs_root_id(root) != BTRFS_TREE_LOG_OBJECTID); +-- +2.39.5 + diff --git a/queue-6.13/btrfs-fix-lockdep-splat-while-merging-a-relocation-r.patch b/queue-6.13/btrfs-fix-lockdep-splat-while-merging-a-relocation-r.patch new file mode 100644 index 0000000000..6aa9a3206c --- /dev/null +++ b/queue-6.13/btrfs-fix-lockdep-splat-while-merging-a-relocation-r.patch @@ -0,0 +1,222 @@ +From 280fef5d47f4fa0e49d2fd034de9b0c336a61e91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 15:22:24 +0000 +Subject: btrfs: fix lockdep splat while merging a relocation root + +From: Filipe Manana + +[ Upstream commit a216542027b892e6651c1b4e076012140d04afaf ] + +When COWing a relocation tree path, at relocation.c:replace_path(), we +can trigger a lockdep splat while we are in the btrfs_search_slot() call +against the relocation root. This happens in that callchain at +ctree.c:read_block_for_search() when we happen to find a child extent +buffer already loaded through the fs tree with a lockdep class set to +the fs tree. So when we attempt to lock that extent buffer through a +relocation tree we have to reset the lockdep class to the class for a +relocation tree, since a relocation tree has extent buffers that used +to belong to a fs tree and may currently be already loaded (we swap +extent buffers between the two trees at the end of replace_path()). + +However we are missing calls to btrfs_maybe_reset_lockdep_class() to reset +the lockdep class at ctree.c:read_block_for_search() before we read lock +an extent buffer, just like we did for btrfs_search_slot() in commit +b40130b23ca4 ("btrfs: fix lockdep splat with reloc root extent buffers"). + +So add the missing btrfs_maybe_reset_lockdep_class() calls before the +attempts to read lock an extent buffer at ctree.c:read_block_for_search(). + +The lockdep splat was reported by syzbot and it looks like this: + + ====================================================== + WARNING: possible circular locking dependency detected + 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 Not tainted + ------------------------------------------------------ + syz.0.0/5335 is trying to acquire lock: + ffff8880545dbc38 (btrfs-tree-01){++++}-{4:4}, at: btrfs_tree_read_lock_nested+0x2f/0x250 fs/btrfs/locking.c:146 + + but task is already holding lock: + ffff8880545dba58 (btrfs-treloc-02/1){+.+.}-{4:4}, at: btrfs_tree_lock_nested+0x2f/0x250 fs/btrfs/locking.c:189 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #2 (btrfs-treloc-02/1){+.+.}-{4:4}: + reacquire_held_locks+0x3eb/0x690 kernel/locking/lockdep.c:5374 + __lock_release kernel/locking/lockdep.c:5563 [inline] + lock_release+0x396/0xa30 kernel/locking/lockdep.c:5870 + up_write+0x79/0x590 kernel/locking/rwsem.c:1629 + btrfs_force_cow_block+0x14b3/0x1fd0 fs/btrfs/ctree.c:660 + btrfs_cow_block+0x371/0x830 fs/btrfs/ctree.c:755 + btrfs_search_slot+0xc01/0x3180 fs/btrfs/ctree.c:2153 + replace_path+0x1243/0x2740 fs/btrfs/relocation.c:1224 + merge_reloc_root+0xc46/0x1ad0 fs/btrfs/relocation.c:1692 + merge_reloc_roots+0x3b3/0x980 fs/btrfs/relocation.c:1942 + relocate_block_group+0xb0a/0xd40 fs/btrfs/relocation.c:3754 + btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4087 + btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3494 + __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4278 + btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4655 + btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:906 [inline] + __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #1 (btrfs-tree-01/1){+.+.}-{4:4}: + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 + down_write_nested+0xa2/0x220 kernel/locking/rwsem.c:1693 + btrfs_tree_lock_nested+0x2f/0x250 fs/btrfs/locking.c:189 + btrfs_init_new_buffer fs/btrfs/extent-tree.c:5052 [inline] + btrfs_alloc_tree_block+0x41c/0x1440 fs/btrfs/extent-tree.c:5132 + btrfs_force_cow_block+0x526/0x1fd0 fs/btrfs/ctree.c:573 + btrfs_cow_block+0x371/0x830 fs/btrfs/ctree.c:755 + btrfs_search_slot+0xc01/0x3180 fs/btrfs/ctree.c:2153 + btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4351 + btrfs_insert_empty_item fs/btrfs/ctree.h:688 [inline] + btrfs_insert_inode_ref+0x2bb/0xf80 fs/btrfs/inode-item.c:330 + btrfs_rename_exchange fs/btrfs/inode.c:7990 [inline] + btrfs_rename2+0xcb7/0x2b90 fs/btrfs/inode.c:8374 + vfs_rename+0xbdb/0xf00 fs/namei.c:5067 + do_renameat2+0xd94/0x13f0 fs/namei.c:5224 + __do_sys_renameat2 fs/namei.c:5258 [inline] + __se_sys_renameat2 fs/namei.c:5255 [inline] + __x64_sys_renameat2+0xce/0xe0 fs/namei.c:5255 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #0 (btrfs-tree-01){++++}-{4:4}: + check_prev_add kernel/locking/lockdep.c:3161 [inline] + check_prevs_add kernel/locking/lockdep.c:3280 [inline] + validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 + __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 + down_read_nested+0xb5/0xa50 kernel/locking/rwsem.c:1649 + btrfs_tree_read_lock_nested+0x2f/0x250 fs/btrfs/locking.c:146 + btrfs_tree_read_lock fs/btrfs/locking.h:188 [inline] + read_block_for_search+0x718/0xbb0 fs/btrfs/ctree.c:1610 + btrfs_search_slot+0x1274/0x3180 fs/btrfs/ctree.c:2237 + replace_path+0x1243/0x2740 fs/btrfs/relocation.c:1224 + merge_reloc_root+0xc46/0x1ad0 fs/btrfs/relocation.c:1692 + merge_reloc_roots+0x3b3/0x980 fs/btrfs/relocation.c:1942 + relocate_block_group+0xb0a/0xd40 fs/btrfs/relocation.c:3754 + btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4087 + btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3494 + __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4278 + btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4655 + btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:906 [inline] + __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + other info that might help us debug this: + + Chain exists of: + btrfs-tree-01 --> btrfs-tree-01/1 --> btrfs-treloc-02/1 + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(btrfs-treloc-02/1); + lock(btrfs-tree-01/1); + lock(btrfs-treloc-02/1); + rlock(btrfs-tree-01); + + *** DEADLOCK *** + + 8 locks held by syz.0.0/5335: + #0: ffff88801e3ae420 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write_file+0x5e/0x200 fs/namespace.c:559 + #1: ffff888052c760d0 (&fs_info->reclaim_bgs_lock){+.+.}-{4:4}, at: __btrfs_balance+0x4c2/0x26b0 fs/btrfs/volumes.c:4183 + #2: ffff888052c74850 (&fs_info->cleaner_mutex){+.+.}-{4:4}, at: btrfs_relocate_block_group+0x775/0xd90 fs/btrfs/relocation.c:4086 + #3: ffff88801e3ae610 (sb_internal#2){.+.+}-{0:0}, at: merge_reloc_root+0xf11/0x1ad0 fs/btrfs/relocation.c:1659 + #4: ffff888052c76470 (btrfs_trans_num_writers){++++}-{0:0}, at: join_transaction+0x405/0xda0 fs/btrfs/transaction.c:288 + #5: ffff888052c76498 (btrfs_trans_num_extwriters){++++}-{0:0}, at: join_transaction+0x405/0xda0 fs/btrfs/transaction.c:288 + #6: ffff8880545db878 (btrfs-tree-01/1){+.+.}-{4:4}, at: btrfs_tree_lock_nested+0x2f/0x250 fs/btrfs/locking.c:189 + #7: ffff8880545dba58 (btrfs-treloc-02/1){+.+.}-{4:4}, at: btrfs_tree_lock_nested+0x2f/0x250 fs/btrfs/locking.c:189 + + stack backtrace: + CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 + Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074 + check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206 + check_prev_add kernel/locking/lockdep.c:3161 [inline] + check_prevs_add kernel/locking/lockdep.c:3280 [inline] + validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 + __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 + down_read_nested+0xb5/0xa50 kernel/locking/rwsem.c:1649 + btrfs_tree_read_lock_nested+0x2f/0x250 fs/btrfs/locking.c:146 + btrfs_tree_read_lock fs/btrfs/locking.h:188 [inline] + read_block_for_search+0x718/0xbb0 fs/btrfs/ctree.c:1610 + btrfs_search_slot+0x1274/0x3180 fs/btrfs/ctree.c:2237 + replace_path+0x1243/0x2740 fs/btrfs/relocation.c:1224 + merge_reloc_root+0xc46/0x1ad0 fs/btrfs/relocation.c:1692 + merge_reloc_roots+0x3b3/0x980 fs/btrfs/relocation.c:1942 + relocate_block_group+0xb0a/0xd40 fs/btrfs/relocation.c:3754 + btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4087 + btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3494 + __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4278 + btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4655 + btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:906 [inline] + __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + RIP: 0033:0x7f1ac6985d29 + Code: ff ff c3 (...) + RSP: 002b:00007f1ac63fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + RAX: ffffffffffffffda RBX: 00007f1ac6b76160 RCX: 00007f1ac6985d29 + RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000007 + RBP: 00007f1ac6a01b08 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 + R13: 0000000000000001 R14: 00007f1ac6b76160 R15: 00007fffda145a88 + + +Reported-by: syzbot+63913e558c084f7f8fdc@syzkaller.appspotmail.com +Link: https://lore.kernel.org/linux-btrfs/677b3014.050a0220.3b53b0.0064.GAE@google.com/ +Fixes: 99785998ed1c ("btrfs: reduce lock contention when eb cache miss for btree search") +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ctree.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index 185985a337b30..5d2613b16cd24 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -1563,6 +1563,7 @@ read_block_for_search(struct btrfs_root *root, struct btrfs_path *p, + + if (!p->skip_locking) { + btrfs_unlock_up_safe(p, parent_level + 1); ++ btrfs_maybe_reset_lockdep_class(root, tmp); + tmp_locked = true; + btrfs_tree_read_lock(tmp); + btrfs_release_path(p); +@@ -1606,6 +1607,7 @@ read_block_for_search(struct btrfs_root *root, struct btrfs_path *p, + + if (!p->skip_locking) { + ASSERT(ret == -EAGAIN); ++ btrfs_maybe_reset_lockdep_class(root, tmp); + tmp_locked = true; + btrfs_tree_read_lock(tmp); + btrfs_release_path(p); +-- +2.39.5 + diff --git a/queue-6.13/btrfs-fix-use-after-free-when-attempting-to-join-an-.patch b/queue-6.13/btrfs-fix-use-after-free-when-attempting-to-join-an-.patch new file mode 100644 index 0000000000..8840998482 --- /dev/null +++ b/queue-6.13/btrfs-fix-use-after-free-when-attempting-to-join-an-.patch @@ -0,0 +1,212 @@ +From 85976e51804b2d5585c6df9028ac1a8ec184a8d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 17:26:10 +0000 +Subject: btrfs: fix use-after-free when attempting to join an aborted + transaction + +From: Filipe Manana + +[ Upstream commit e2f0943cf37305dbdeaf9846e3c941451bcdef63 ] + +When we are trying to join the current transaction and if it's aborted, +we read its 'aborted' field after unlocking fs_info->trans_lock and +without holding any extra reference count on it. This means that a +concurrent task that is aborting the transaction may free the transaction +before we read its 'aborted' field, leading to a use-after-free. + +Fix this by reading the 'aborted' field while holding fs_info->trans_lock +since any freeing task must first acquire that lock and set +fs_info->running_transaction to NULL before freeing the transaction. + +This was reported by syzbot and Dmitry with the following stack traces +from KASAN: + + ================================================================== + BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 + Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128 + + CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 + Workqueue: events_unbound btrfs_async_reclaim_data_space + Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0x169/0x550 mm/kasan/report.c:489 + kasan_report+0x143/0x180 mm/kasan/report.c:602 + join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 + start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 + flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803 + btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321 + process_one_work kernel/workqueue.c:3236 [inline] + process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 + worker_thread+0x870/0xd30 kernel/workqueue.c:3398 + kthread+0x2f0/0x390 kernel/kthread.c:389 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + + + Allocated by task 5315: + kasan_save_stack mm/kasan/common.c:47 [inline] + kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 + poison_kmalloc_redzone mm/kasan/common.c:377 [inline] + __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 + kasan_kmalloc include/linux/kasan.h:260 [inline] + __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 + kmalloc_noprof include/linux/slab.h:901 [inline] + join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308 + start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 + btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572 + lookup_open fs/namei.c:3649 [inline] + open_last_lookups fs/namei.c:3748 [inline] + path_openat+0x1c03/0x3590 fs/namei.c:3984 + do_filp_open+0x27f/0x4e0 fs/namei.c:4014 + do_sys_openat2+0x13e/0x1d0 fs/open.c:1402 + do_sys_open fs/open.c:1417 [inline] + __do_sys_creat fs/open.c:1495 [inline] + __se_sys_creat fs/open.c:1489 [inline] + __x64_sys_creat+0x123/0x170 fs/open.c:1489 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + Freed by task 5336: + kasan_save_stack mm/kasan/common.c:47 [inline] + kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 + kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 + poison_slab_object mm/kasan/common.c:247 [inline] + __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 + kasan_slab_free include/linux/kasan.h:233 [inline] + slab_free_hook mm/slub.c:2353 [inline] + slab_free mm/slub.c:4613 [inline] + kfree+0x196/0x430 mm/slub.c:4761 + cleanup_transaction fs/btrfs/transaction.c:2063 [inline] + btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598 + insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757 + btrfs_balance+0x992/0x10c0 fs/btrfs/volumes.c:4633 + btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:906 [inline] + __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + The buggy address belongs to the object at ffff888011839000 + which belongs to the cache kmalloc-2k of size 2048 + The buggy address is located 36 bytes inside of + freed 2048-byte region [ffff888011839000, ffff888011839800) + + The buggy address belongs to the physical page: + page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11838 + head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 + flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) + page_type: f5(slab) + raw: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 + raw: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 + head: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 + head: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 + head: 00fff00000000003 ffffea0000460e01 ffffffffffffffff 0000000000000000 + head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 + page dumped because: kasan: bad access detected + page_owner tracks the page as allocated + page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 57, tgid 57 (kworker/0:2), ts 67248182943, free_ts 67229742023 + set_page_owner include/linux/page_owner.h:32 [inline] + post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558 + prep_new_page mm/page_alloc.c:1566 [inline] + get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476 + __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753 + alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269 + alloc_slab_page+0x6a/0x110 mm/slub.c:2423 + allocate_slab+0x5a/0x2b0 mm/slub.c:2589 + new_slab mm/slub.c:2642 [inline] + ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 + __slab_alloc+0x58/0xa0 mm/slub.c:3920 + __slab_alloc_node mm/slub.c:3995 [inline] + slab_alloc_node mm/slub.c:4156 [inline] + __do_kmalloc_node mm/slub.c:4297 [inline] + __kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317 + kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609 + __alloc_skb+0x1f3/0x440 net/core/skbuff.c:678 + alloc_skb include/linux/skbuff.h:1323 [inline] + alloc_skb_with_frags+0xc3/0x820 net/core/skbuff.c:6612 + sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2884 + sock_alloc_send_skb include/net/sock.h:1803 [inline] + mld_newpack+0x1c3/0xaf0 net/ipv6/mcast.c:1747 + add_grhead net/ipv6/mcast.c:1850 [inline] + add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1988 + mld_send_cr net/ipv6/mcast.c:2114 [inline] + mld_ifc_work+0x691/0xd90 net/ipv6/mcast.c:2651 + page last free pid 5300 tgid 5300 stack trace: + reset_page_owner include/linux/page_owner.h:25 [inline] + free_pages_prepare mm/page_alloc.c:1127 [inline] + free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2659 + __slab_free+0x2c2/0x380 mm/slub.c:4524 + qlink_free mm/kasan/quarantine.c:163 [inline] + qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 + kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 + __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 + kasan_slab_alloc include/linux/kasan.h:250 [inline] + slab_post_alloc_hook mm/slub.c:4119 [inline] + slab_alloc_node mm/slub.c:4168 [inline] + __do_kmalloc_node mm/slub.c:4297 [inline] + __kmalloc_noprof+0x236/0x4c0 mm/slub.c:4310 + kmalloc_noprof include/linux/slab.h:905 [inline] + kzalloc_noprof include/linux/slab.h:1037 [inline] + fib_create_info+0xc14/0x25b0 net/ipv4/fib_semantics.c:1435 + fib_table_insert+0x1f6/0x1f20 net/ipv4/fib_trie.c:1231 + fib_magic+0x3d8/0x620 net/ipv4/fib_frontend.c:1112 + fib_add_ifaddr+0x40c/0x5e0 net/ipv4/fib_frontend.c:1156 + fib_netdev_event+0x375/0x490 net/ipv4/fib_frontend.c:1494 + notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85 + __dev_notify_flags+0x207/0x400 + dev_change_flags+0xf0/0x1a0 net/core/dev.c:9045 + do_setlink+0xc90/0x4210 net/core/rtnetlink.c:3109 + rtnl_changelink net/core/rtnetlink.c:3723 [inline] + __rtnl_newlink net/core/rtnetlink.c:3875 [inline] + rtnl_newlink+0x1bb6/0x2210 net/core/rtnetlink.c:4012 + + Memory state around the buggy address: + ffff888011838f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff888011838f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + >ffff888011839000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff888011839080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888011839100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ================================================================== + +Reported-by: syzbot+45212e9d87a98c3f5b42@syzkaller.appspotmail.com +Link: https://lore.kernel.org/linux-btrfs/678e7da5.050a0220.303755.007c.GAE@google.com/ +Reported-by: Dmitry Vyukov +Link: https://lore.kernel.org/linux-btrfs/CACT4Y+ZFBdo7pT8L2AzM=vegZwjp-wNkVJZQf0Ta3vZqtExaSw@mail.gmail.com/ +Fixes: 871383be592b ("btrfs: add missing unlocks to transaction abort paths") +Reviewed-by: Johannes Thumshirn +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/transaction.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index dc0b837efd5df..914a22cc950b5 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -274,8 +274,10 @@ static noinline int join_transaction(struct btrfs_fs_info *fs_info, + cur_trans = fs_info->running_transaction; + if (cur_trans) { + if (TRANS_ABORTED(cur_trans)) { ++ const int abort_error = cur_trans->aborted; ++ + spin_unlock(&fs_info->trans_lock); +- return cur_trans->aborted; ++ return abort_error; + } + if (btrfs_blocked_trans_types[cur_trans->state] & type) { + spin_unlock(&fs_info->trans_lock); +-- +2.39.5 + diff --git a/queue-6.13/clk-qcom-make-gcc_8150-depend-on-qcom_gdsc.patch b/queue-6.13/clk-qcom-make-gcc_8150-depend-on-qcom_gdsc.patch new file mode 100644 index 0000000000..ebe24ab9b4 --- /dev/null +++ b/queue-6.13/clk-qcom-make-gcc_8150-depend-on-qcom_gdsc.patch @@ -0,0 +1,41 @@ +From ec1595a25489ad81bfbf60a8cef062233d23afe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Oct 2024 12:58:13 +0200 +Subject: clk: qcom: Make GCC_8150 depend on QCOM_GDSC + +From: Konrad Dybcio + +[ Upstream commit 1474149c4209943b37a2c01b82f07ba39465e5fe ] + +Like all other non-ancient Qualcomm clock drivers, QCOM_GDSC is +required, as the GCC driver defines and instantiates a bunch of GDSCs. + +Add the missing dependency. + +Reported-by: Vladimir Zapolskiy +Closes: https://lore.kernel.org/linux-arm-msm/ab85f2ae-6c97-4fbb-a15b-31cc9e1f77fc@linaro.org/ +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Vladimir Zapolskiy +Link: https://lore.kernel.org/r/20241026-topic-8150gcc_kconfig-v1-1-3772013d8804@oss.qualcomm.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig +index ef89d686cbc4e..c27ea46283fd9 100644 +--- a/drivers/clk/qcom/Kconfig ++++ b/drivers/clk/qcom/Kconfig +@@ -1079,6 +1079,7 @@ config SM_GCC_7150 + config SM_GCC_8150 + tristate "SM8150 Global Clock Controller" + depends on ARM64 || COMPILE_TEST ++ select QCOM_GDSC + help + Support for the global clock controller on SM8150 devices. + Say Y if you want to use peripheral devices such as UART, +-- +2.39.5 + diff --git a/queue-6.13/drm-add-panel-backlight-quirks.patch b/queue-6.13/drm-add-panel-backlight-quirks.patch new file mode 100644 index 0000000000..94c751a8b6 --- /dev/null +++ b/queue-6.13/drm-add-panel-backlight-quirks.patch @@ -0,0 +1,174 @@ +From 06d657e223a49b173d9e955e1cfc05a0e0c93baf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 19:09:35 +0100 +Subject: drm: Add panel backlight quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 22e5c7ae12145af13785e3ff138395d5b1a22116 ] + +Panels using a PWM-controlled backlight source do not have a standard +way to communicate their valid PWM ranges. +On x86 the ranges are read from ACPI through driver-specific tables. +The built-in ranges are not necessarily correct, or may grow stale if an +older device can be retrofitted with newer panels. + +Add a quirk infrastructure with which the minimum valid backlight value +can be maintained as part of the kernel. + +Signed-off-by: Thomas Weißschuh +Tested-by: Dustin L. Howett +Reviewed-by: Mario Limonciello +Reviewed-by: Harry Wentland +Signed-off-by: Mario Limonciello +Link: https://patchwork.freedesktop.org/patch/msgid/20241111-amdgpu-min-backlight-quirk-v7-1-f662851fda69@weissschuh.net +Signed-off-by: Sasha Levin +--- + Documentation/gpu/drm-kms-helpers.rst | 3 + + drivers/gpu/drm/Kconfig | 4 ++ + drivers/gpu/drm/Makefile | 1 + + drivers/gpu/drm/drm_panel_backlight_quirks.c | 70 ++++++++++++++++++++ + include/drm/drm_utils.h | 4 ++ + 5 files changed, 82 insertions(+) + create mode 100644 drivers/gpu/drm/drm_panel_backlight_quirks.c + +diff --git a/Documentation/gpu/drm-kms-helpers.rst b/Documentation/gpu/drm-kms-helpers.rst +index 8cf2f041af470..b4ee25af1702b 100644 +--- a/Documentation/gpu/drm-kms-helpers.rst ++++ b/Documentation/gpu/drm-kms-helpers.rst +@@ -221,6 +221,9 @@ Panel Helper Reference + .. kernel-doc:: drivers/gpu/drm/drm_panel_orientation_quirks.c + :export: + ++.. kernel-doc:: drivers/gpu/drm/drm_panel_backlight_quirks.c ++ :export: ++ + Panel Self Refresh Helper Reference + =================================== + +diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig +index 772fc7625639d..b55be8889e2ca 100644 +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -530,6 +530,10 @@ config DRM_HYPERV + config DRM_EXPORT_FOR_TESTS + bool + ++# Separate option as not all DRM drivers use it ++config DRM_PANEL_BACKLIGHT_QUIRKS ++ tristate ++ + config DRM_LIB_RANDOM + bool + default n +diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile +index 463afad1b5ca6..06b73068d2483 100644 +--- a/drivers/gpu/drm/Makefile ++++ b/drivers/gpu/drm/Makefile +@@ -95,6 +95,7 @@ drm-$(CONFIG_DRM_PANIC_SCREEN_QR_CODE) += drm_panic_qr.o + obj-$(CONFIG_DRM) += drm.o + + obj-$(CONFIG_DRM_PANEL_ORIENTATION_QUIRKS) += drm_panel_orientation_quirks.o ++obj-$(CONFIG_DRM_PANEL_BACKLIGHT_QUIRKS) += drm_panel_backlight_quirks.o + + # + # Memory-management helpers +diff --git a/drivers/gpu/drm/drm_panel_backlight_quirks.c b/drivers/gpu/drm/drm_panel_backlight_quirks.c +new file mode 100644 +index 0000000000000..6b8bbed77c7f1 +--- /dev/null ++++ b/drivers/gpu/drm/drm_panel_backlight_quirks.c +@@ -0,0 +1,70 @@ ++// SPDX-License-Identifier: GPL-2.0 ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++struct drm_panel_min_backlight_quirk { ++ struct { ++ enum dmi_field field; ++ const char * const value; ++ } dmi_match; ++ struct drm_edid_ident ident; ++ u8 min_brightness; ++}; ++ ++static const struct drm_panel_min_backlight_quirk drm_panel_min_backlight_quirks[] = { ++}; ++ ++static bool drm_panel_min_backlight_quirk_matches(const struct drm_panel_min_backlight_quirk *quirk, ++ const struct drm_edid *edid) ++{ ++ if (!dmi_match(quirk->dmi_match.field, quirk->dmi_match.value)) ++ return false; ++ ++ if (!drm_edid_match(edid, &quirk->ident)) ++ return false; ++ ++ return true; ++} ++ ++/** ++ * drm_get_panel_min_brightness_quirk - Get minimum supported brightness level for a panel. ++ * @edid: EDID of the panel to check ++ * ++ * This function checks for platform specific (e.g. DMI based) quirks ++ * providing info on the minimum backlight brightness for systems where this ++ * cannot be probed correctly from the hard-/firm-ware. ++ * ++ * Returns: ++ * A negative error value or ++ * an override value in the range [0, 255] representing 0-100% to be scaled to ++ * the drivers target range. ++ */ ++int drm_get_panel_min_brightness_quirk(const struct drm_edid *edid) ++{ ++ const struct drm_panel_min_backlight_quirk *quirk; ++ size_t i; ++ ++ if (!IS_ENABLED(CONFIG_DMI)) ++ return -ENODATA; ++ ++ if (!edid) ++ return -EINVAL; ++ ++ for (i = 0; i < ARRAY_SIZE(drm_panel_min_backlight_quirks); i++) { ++ quirk = &drm_panel_min_backlight_quirks[i]; ++ ++ if (drm_panel_min_backlight_quirk_matches(quirk, edid)) ++ return quirk->min_brightness; ++ } ++ ++ return -ENODATA; ++} ++EXPORT_SYMBOL(drm_get_panel_min_brightness_quirk); ++ ++MODULE_DESCRIPTION("Quirks for panel backlight overrides"); ++MODULE_LICENSE("GPL"); +diff --git a/include/drm/drm_utils.h b/include/drm/drm_utils.h +index 70775748d243b..15fa9b6865f44 100644 +--- a/include/drm/drm_utils.h ++++ b/include/drm/drm_utils.h +@@ -12,8 +12,12 @@ + + #include + ++struct drm_edid; ++ + int drm_get_panel_orientation_quirk(int width, int height); + ++int drm_get_panel_min_brightness_quirk(const struct drm_edid *edid); ++ + signed long drm_timeout_abs_to_jiffies(int64_t timeout_nsec); + + #endif +-- +2.39.5 + diff --git a/queue-6.13/drm-amd-display-add-support-for-minimum-backlight-qu.patch b/queue-6.13/drm-amd-display-add-support-for-minimum-backlight-qu.patch new file mode 100644 index 0000000000..42edcfbef8 --- /dev/null +++ b/queue-6.13/drm-amd-display-add-support-for-minimum-backlight-qu.patch @@ -0,0 +1,80 @@ +From e533a09f8e54c8a6aba3fb1e95064fce1b69b622 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 19:09:36 +0100 +Subject: drm/amd/display: Add support for minimum backlight quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c2753b2471c65955de18cbc58530641447e5bfe9 ] + +Not all platforms provide the full range of PWM backlight capabilities +supported by the hardware through ATIF. +Use the generic drm panel minimum backlight quirk infrastructure to +override the capabilities where necessary. + +Testing the backlight quirk together with the "panel_power_savings" +sysfs file has not shown any negative impact. +One quirk seems to be that 0% at panel_power_savings=0 seems to be +slightly darker than at panel_power_savings=4. + +Signed-off-by: Thomas Weißschuh +Tested-by: Dustin L. Howett +Reviewed-by: Mario Limonciello +Reviewed-by: Harry Wentland +Signed-off-by: Mario Limonciello +Link: https://patchwork.freedesktop.org/patch/msgid/20241111-amdgpu-min-backlight-quirk-v7-2-f662851fda69@weissschuh.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/Kconfig | 1 + + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++++ + 2 files changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/Kconfig b/drivers/gpu/drm/amd/amdgpu/Kconfig +index 41fa3377d9cf5..1a11cab741aca 100644 +--- a/drivers/gpu/drm/amd/amdgpu/Kconfig ++++ b/drivers/gpu/drm/amd/amdgpu/Kconfig +@@ -26,6 +26,7 @@ config DRM_AMDGPU + select DRM_BUDDY + select DRM_SUBALLOC_HELPER + select DRM_EXEC ++ select DRM_PANEL_BACKLIGHT_QUIRKS + # amdgpu depends on ACPI_VIDEO when ACPI is enabled, for select to work + # ACPI_VIDEO's dependencies must also be selected. + select INPUT if ACPI +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 53694baca9663..92e1d59921f49 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -93,6 +93,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -3457,6 +3458,7 @@ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector) + struct drm_connector *conn_base; + struct amdgpu_device *adev; + struct drm_luminance_range_info *luminance_range; ++ int min_input_signal_override; + + if (aconnector->bl_idx == -1 || + aconnector->dc_link->connector_signal != SIGNAL_TYPE_EDP) +@@ -3493,6 +3495,10 @@ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector) + caps->aux_min_input_signal = 0; + caps->aux_max_input_signal = 512; + } ++ ++ min_input_signal_override = drm_get_panel_min_brightness_quirk(aconnector->drm_edid); ++ if (min_input_signal_override >= 0) ++ caps->min_input_signal = min_input_signal_override; + } + + void amdgpu_dm_update_connector_after_detect( +-- +2.39.5 + diff --git a/queue-6.13/drm-amd-display-fix-mode-cutoff-in-dsc-passthrough-t.patch b/queue-6.13/drm-amd-display-fix-mode-cutoff-in-dsc-passthrough-t.patch new file mode 100644 index 0000000000..5717199d1c --- /dev/null +++ b/queue-6.13/drm-amd-display-fix-mode-cutoff-in-dsc-passthrough-t.patch @@ -0,0 +1,61 @@ +From 86640f59dc8f771d8fb49e8e473d1a4a615481cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 13:30:37 -0500 +Subject: drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor + +From: Fangzhi Zuo + +[ Upstream commit e56ad45e991128bf4db160b75a1d9f647a341d8f ] + +Source --> DP2.1 MST hub --> DP1.4/2.1 monitor + +When change from DP1.4 to DP2.1 from monitor manual, modes higher than +4k120 are all cutoff by mode validation. Switch back to DP1.4 gets all +the modes up to 4k240 available to be enabled by dsc passthrough. + +[why] +Compared to DP1.4 link from hub to monitor, DP2.1 link has larger +full_pbn value that causes overflow in the process of doing conversion +from pbn to kbps. + +[how] +Change the data type accordingly to fit into the data limit during +conversion calculation. + +Tested-by: Daniel Wheeler +Reviewed-by: Wayne Lin +Signed-off-by: Fangzhi Zuo +Signed-off-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 1080075ccb17c..e096fb5621229 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -1695,16 +1695,16 @@ int pre_validate_dsc(struct drm_atomic_state *state, + return ret; + } + +-static unsigned int kbps_from_pbn(unsigned int pbn) ++static uint32_t kbps_from_pbn(unsigned int pbn) + { +- unsigned int kbps = pbn; ++ uint64_t kbps = (uint64_t)pbn; + + kbps *= (1000000 / PEAK_FACTOR_X1000); + kbps *= 8; + kbps *= 54; + kbps /= 64; + +- return kbps; ++ return (uint32_t)kbps; + } + + static bool is_dsc_common_config_possible(struct dc_stream_state *stream, +-- +2.39.5 + diff --git a/queue-6.13/drm-amd-display-increase-sanitizer-frame-larger-than.patch b/queue-6.13/drm-amd-display-increase-sanitizer-frame-larger-than.patch new file mode 100644 index 0000000000..a70c061f07 --- /dev/null +++ b/queue-6.13/drm-amd-display-increase-sanitizer-frame-larger-than.patch @@ -0,0 +1,83 @@ +From 2e3d7dd635ce063ba328753ed9bc7bcab19a4fdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 16:46:35 -0700 +Subject: drm/amd/display: Increase sanitizer frame larger than limit when + compile testing with clang + +From: Nathan Chancellor + +[ Upstream commit e4479aecf6581af81bc0908575447878d2a07e01 ] + +Commit 24909d9ec7c3 ("drm/amd/display: Overwriting dualDPP UBF values +before usage") added a new warning in dml2/display_mode_core.c when +building allmodconfig with clang: + + drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/display_mode_core.c:6268:13: error: stack frame size (3128) exceeds limit (3072) in 'dml_prefetch_check' [-Werror,-Wframe-larger-than] + 6268 | static void dml_prefetch_check(struct display_mode_lib_st *mode_lib) + | ^ + +Commit be4e3509314a ("drm/amd/display: DML21 Reintegration For Various +Fixes") introduced one in dml2_core/dml2_core_dcn4_calcs.c with the same +configuration: + + drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:7236:13: error: stack frame size (3256) exceeds limit (3072) in 'dml_core_mode_support' [-Werror,-Wframe-larger-than] + 7236 | static bool dml_core_mode_support(struct dml2_core_calcs_mode_support_ex *in_out_params) + | ^ + +In the case of the first warning, the stack usage was already at the +limit at the parent change, so the offending change was rather +innocuous. In the case of the second warning, there was a rather +dramatic increase in stack usage compared to the parent: + + drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:7032:13: error: stack frame size (2696) exceeds limit (2048) in 'dml_core_mode_support' [-Werror,-Wframe-larger-than] + 7032 | static bool dml_core_mode_support(struct dml2_core_calcs_mode_support_ex *in_out_params) + | ^ + +This is an unfortunate interaction between an issue with stack slot +reuse in LLVM that gets exacerbated by sanitization (which gets enabled +with all{mod,yes}config) and function calls using a much higher number +of parameters than is typical in the kernel, necessitating passing most +of these values on the stack. + +While it is possible that there should be source code changes to address +these warnings, this code is difficult to modify for various reasons, as +has been noted in other changes that have occurred for similar reasons, +such as commit 6740ec97bcdb ("drm/amd/display: Increase frame warning +limit with KASAN or KCSAN in dml2"). + +Increase the frame larger than limit when compile testing with clang and +the sanitizers enabled to avoid this breakage in all{mod,yes}config, as +they are commonly used and valuable testing targets. While it is not the +best to hide this issue, it is not really relevant when compile testing, +as the sanitizers are commonly stressful on optimizations and they are +only truly useful at runtime, which COMPILE_TEST states will not occur +with the current build. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202412121748.chuX4sap-lkp@intel.com/ +Signed-off-by: Nathan Chancellor +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml2/Makefile | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/Makefile b/drivers/gpu/drm/amd/display/dc/dml2/Makefile +index c4378e620cbf9..986a69c5bd4bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/Makefile ++++ b/drivers/gpu/drm/amd/display/dc/dml2/Makefile +@@ -29,7 +29,11 @@ dml2_rcflags := $(CC_FLAGS_NO_FPU) + + ifneq ($(CONFIG_FRAME_WARN),0) + ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y) ++ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_COMPILE_TEST),yy) ++frame_warn_flag := -Wframe-larger-than=4096 ++else + frame_warn_flag := -Wframe-larger-than=3072 ++endif + else + frame_warn_flag := -Wframe-larger-than=2048 + endif +-- +2.39.5 + diff --git a/queue-6.13/drm-amd-display-limit-scaling-ratio-on-dcn3.01.patch b/queue-6.13/drm-amd-display-limit-scaling-ratio-on-dcn3.01.patch new file mode 100644 index 0000000000..0ec2f5618e --- /dev/null +++ b/queue-6.13/drm-amd-display-limit-scaling-ratio-on-dcn3.01.patch @@ -0,0 +1,55 @@ +From 244d557f5ce169eaad2ea417cf951c1d22bda432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 15:15:00 -0500 +Subject: drm/amd/display: Limit Scaling Ratio on DCN3.01 + +From: Gabe Teeger + +[ Upstream commit abc0ad6d08440761b199988c329ad7ac83f41c9b ] + +[why] +Underflow and flickering was occuring due to high scaling ratios +when resizing videos. + +[how] +Limit the scaling ratios by increasing the max scaling factor + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Gabe Teeger +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/resource/dcn301/dcn301_resource.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c +index a9816affd312d..0cc8a27be5935 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c +@@ -671,9 +671,9 @@ static const struct dc_plane_cap plane_cap = { + + /* 6:1 downscaling ratio: 1000/6 = 166.666 */ + .max_downscale_factor = { +- .argb8888 = 167, +- .nv12 = 167, +- .fp16 = 167 ++ .argb8888 = 358, ++ .nv12 = 358, ++ .fp16 = 358 + }, + 64, + 64 +@@ -693,7 +693,7 @@ static const struct dc_debug_options debug_defaults_drv = { + .disable_dcc = DCC_ENABLE, + .vsr_support = true, + .performance_trace = false, +- .max_downscale_src_width = 7680,/*upto 8K*/ ++ .max_downscale_src_width = 4096,/*upto true 4k*/ + .scl_reset_length10 = true, + .sanity_checks = false, + .underflow_assert_delay_us = 0xFFFFFFFF, +-- +2.39.5 + diff --git a/queue-6.13/drm-amd-display-overwriting-dualdpp-ubf-values-befor.patch b/queue-6.13/drm-amd-display-overwriting-dualdpp-ubf-values-befor.patch new file mode 100644 index 0000000000..45ad35f2e2 --- /dev/null +++ b/queue-6.13/drm-amd-display-overwriting-dualdpp-ubf-values-befor.patch @@ -0,0 +1,131 @@ +From f10a903bd307599df14b1dea21895d673f26fff5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 15:26:01 -0500 +Subject: drm/amd/display: Overwriting dualDPP UBF values before usage + +From: Ausef Yousof + +[ Upstream commit 24909d9ec7c3afa8da2f3c9afa312e7a4a61f250 ] + +[WHY] +Right now in dml2 mode validation we are calculating UBF parameters for +prefetch calculation for single and dual DPP scenarios. Data structure +to store such values are just 1D arrays, the single DPP values are +overwritten by the dualDPP values, and we end up using dualDPP for +prefetch calculations twice (once in place of singleDPP support check +and again for dual). + +This naturally leads to many problems, one of which validating a mode in +"singleDPP" (when we used dual DPP parameters) and sending the singleDPP +parameters to mode programming, if we cannot support then we observe the +corruption as described in the ticket. + +[HOW] +UBF values need to have 2d arrays to store values specific to single and +dual DPP states to avoid single DPP values being overwritten. Other +parameters are recorded on a per state basis such as prefetch UBF values +but they are in the same loop used for calculation and at that point its +fine to overwrite them, its not the case for plain UBF values. + +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Ausef Yousof +Signed-off-by: Aurabindo Pillai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/dml2/display_mode_core.c | 30 +++++++++---------- + .../dc/dml2/display_mode_core_structs.h | 6 ++-- + 2 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c +index be87dc0f07799..6822b07951204 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c +@@ -6301,9 +6301,9 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib) + mode_lib->ms.meta_row_bandwidth_this_state, + mode_lib->ms.dpte_row_bandwidth_this_state, + mode_lib->ms.NoOfDPPThisState, +- mode_lib->ms.UrgentBurstFactorLuma, +- mode_lib->ms.UrgentBurstFactorChroma, +- mode_lib->ms.UrgentBurstFactorCursor); ++ mode_lib->ms.UrgentBurstFactorLuma[j], ++ mode_lib->ms.UrgentBurstFactorChroma[j], ++ mode_lib->ms.UrgentBurstFactorCursor[j]); + + s->VMDataOnlyReturnBWPerState = dml_get_return_bw_mbps_vm_only( + &mode_lib->ms.soc, +@@ -6458,9 +6458,9 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib) + mode_lib->ms.cursor_bw_pre, + mode_lib->ms.prefetch_vmrow_bw, + mode_lib->ms.NoOfDPPThisState, +- mode_lib->ms.UrgentBurstFactorLuma, +- mode_lib->ms.UrgentBurstFactorChroma, +- mode_lib->ms.UrgentBurstFactorCursor, ++ mode_lib->ms.UrgentBurstFactorLuma[j], ++ mode_lib->ms.UrgentBurstFactorChroma[j], ++ mode_lib->ms.UrgentBurstFactorCursor[j], + mode_lib->ms.UrgentBurstFactorLumaPre, + mode_lib->ms.UrgentBurstFactorChromaPre, + mode_lib->ms.UrgentBurstFactorCursorPre, +@@ -6517,9 +6517,9 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib) + mode_lib->ms.cursor_bw, + mode_lib->ms.cursor_bw_pre, + mode_lib->ms.NoOfDPPThisState, +- mode_lib->ms.UrgentBurstFactorLuma, +- mode_lib->ms.UrgentBurstFactorChroma, +- mode_lib->ms.UrgentBurstFactorCursor, ++ mode_lib->ms.UrgentBurstFactorLuma[j], ++ mode_lib->ms.UrgentBurstFactorChroma[j], ++ mode_lib->ms.UrgentBurstFactorCursor[j], + mode_lib->ms.UrgentBurstFactorLumaPre, + mode_lib->ms.UrgentBurstFactorChromaPre, + mode_lib->ms.UrgentBurstFactorCursorPre); +@@ -6586,9 +6586,9 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib) + mode_lib->ms.cursor_bw_pre, + mode_lib->ms.prefetch_vmrow_bw, + mode_lib->ms.NoOfDPP[j], // VBA_ERROR DPPPerSurface is not assigned at this point, should use NoOfDpp here +- mode_lib->ms.UrgentBurstFactorLuma, +- mode_lib->ms.UrgentBurstFactorChroma, +- mode_lib->ms.UrgentBurstFactorCursor, ++ mode_lib->ms.UrgentBurstFactorLuma[j], ++ mode_lib->ms.UrgentBurstFactorChroma[j], ++ mode_lib->ms.UrgentBurstFactorCursor[j], + mode_lib->ms.UrgentBurstFactorLumaPre, + mode_lib->ms.UrgentBurstFactorChromaPre, + mode_lib->ms.UrgentBurstFactorCursorPre, +@@ -7809,9 +7809,9 @@ dml_bool_t dml_core_mode_support(struct display_mode_lib_st *mode_lib) + mode_lib->ms.DETBufferSizeYThisState[k], + mode_lib->ms.DETBufferSizeCThisState[k], + /* Output */ +- &mode_lib->ms.UrgentBurstFactorCursor[k], +- &mode_lib->ms.UrgentBurstFactorLuma[k], +- &mode_lib->ms.UrgentBurstFactorChroma[k], ++ &mode_lib->ms.UrgentBurstFactorCursor[j][k], ++ &mode_lib->ms.UrgentBurstFactorLuma[j][k], ++ &mode_lib->ms.UrgentBurstFactorChroma[j][k], + &mode_lib->ms.NotUrgentLatencyHiding[k]); + } + +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h +index f951936bb579e..504c427b3b319 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h ++++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h +@@ -884,11 +884,11 @@ struct mode_support_st { + dml_uint_t meta_row_height[__DML_NUM_PLANES__]; + dml_uint_t meta_row_height_chroma[__DML_NUM_PLANES__]; + dml_float_t UrgLatency; +- dml_float_t UrgentBurstFactorCursor[__DML_NUM_PLANES__]; ++ dml_float_t UrgentBurstFactorCursor[2][__DML_NUM_PLANES__]; + dml_float_t UrgentBurstFactorCursorPre[__DML_NUM_PLANES__]; +- dml_float_t UrgentBurstFactorLuma[__DML_NUM_PLANES__]; ++ dml_float_t UrgentBurstFactorLuma[2][__DML_NUM_PLANES__]; + dml_float_t UrgentBurstFactorLumaPre[__DML_NUM_PLANES__]; +- dml_float_t UrgentBurstFactorChroma[__DML_NUM_PLANES__]; ++ dml_float_t UrgentBurstFactorChroma[2][__DML_NUM_PLANES__]; + dml_float_t UrgentBurstFactorChromaPre[__DML_NUM_PLANES__]; + dml_float_t MaximumSwathWidthInLineBufferLuma; + dml_float_t MaximumSwathWidthInLineBufferChroma; +-- +2.39.5 + diff --git a/queue-6.13/drm-amd-display-populate-chroma-prefetch-parameters-.patch b/queue-6.13/drm-amd-display-populate-chroma-prefetch-parameters-.patch new file mode 100644 index 0000000000..1124c389fe --- /dev/null +++ b/queue-6.13/drm-amd-display-populate-chroma-prefetch-parameters-.patch @@ -0,0 +1,138 @@ +From bc9c5866d6f21c4421063847b495b390f3f8ad2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2024 12:38:11 -0500 +Subject: drm/amd/display: Populate chroma prefetch parameters, DET buffer fix + +From: Ausef Yousof + +[ Upstream commit 70fec46519fca859aa209f5f02e7e0a0123aca4a ] + +[WHY] +Soft hang/lag observed during 10bit playback + moving cursor, corruption +observed in other tickets for same reason, also failing MPO. + +1. Currently, we are always running + calculate_lowest_supported_state_for_temp_read which is only + necessary on dGPU +2. Fast validate path does not apply DET buffer allocation policy +3. Prefetch UrgBFactor chroma parameter not populated in prefetch + calculation + +[HOW] +1. Add a check to see if we are on APU, if so, skip the code +2. Add det buffer alloc policy checks to fast validate path +3. Populate UrgentBurstChroma param in call to calculate + UrgBChroma prefetch values + +-revision commits: small formatting/brackets/null check addition + remove test change + dGPU code + +Reviewed-by: Charlene Liu +Signed-off-by: Ausef Yousof +Signed-off-by: Fangzhi Zuo +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/dml2/display_mode_core.c | 5 ++- + .../drm/amd/display/dc/dml2/dml2_wrapper.c | 35 +++++++++++++------ + 2 files changed, 29 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c +index 8dabb1ac0b684..be87dc0f07799 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c +@@ -6434,7 +6434,7 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib) + /* Output */ + &mode_lib->ms.UrgentBurstFactorCursorPre[k], + &mode_lib->ms.UrgentBurstFactorLumaPre[k], +- &mode_lib->ms.UrgentBurstFactorChroma[k], ++ &mode_lib->ms.UrgentBurstFactorChromaPre[k], + &mode_lib->ms.NotUrgentLatencyHidingPre[k]); + + mode_lib->ms.cursor_bw_pre[k] = mode_lib->ms.cache_display_cfg.plane.NumberOfCursors[k] * mode_lib->ms.cache_display_cfg.plane.CursorWidth[k] * +@@ -9190,6 +9190,8 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc + &locals->FractionOfUrgentBandwidth, + &s->dummy_boolean[0]); // dml_bool_t *PrefetchBandwidthSupport + ++ ++ + if (s->VRatioPrefetchMoreThanMax != false || s->DestinationLineTimesForPrefetchLessThan2 != false) { + dml_print("DML::%s: VRatioPrefetchMoreThanMax = %u\n", __func__, s->VRatioPrefetchMoreThanMax); + dml_print("DML::%s: DestinationLineTimesForPrefetchLessThan2 = %u\n", __func__, s->DestinationLineTimesForPrefetchLessThan2); +@@ -9204,6 +9206,7 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc + } + } + ++ + if (locals->PrefetchModeSupported == true && mode_lib->ms.support.ImmediateFlipSupport == true) { + locals->BandwidthAvailableForImmediateFlip = CalculateBandwidthAvailableForImmediateFlip( + mode_lib->ms.num_active_planes, +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c +index 9190c1328d5b2..340791d40ecbf 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c +@@ -531,14 +531,21 @@ static bool optimize_pstate_with_svp_and_drr(struct dml2_context *dml2, struct d + static bool call_dml_mode_support_and_programming(struct dc_state *context) + { + unsigned int result = 0; +- unsigned int min_state; ++ unsigned int min_state = 0; + int min_state_for_g6_temp_read = 0; ++ ++ ++ if (!context) ++ return false; ++ + struct dml2_context *dml2 = context->bw_ctx.dml2; + struct dml2_wrapper_scratch *s = &dml2->v20.scratch; + +- min_state_for_g6_temp_read = calculate_lowest_supported_state_for_temp_read(dml2, context); ++ if (!context->streams[0]->sink->link->dc->caps.is_apu) { ++ min_state_for_g6_temp_read = calculate_lowest_supported_state_for_temp_read(dml2, context); + +- ASSERT(min_state_for_g6_temp_read >= 0); ++ ASSERT(min_state_for_g6_temp_read >= 0); ++ } + + if (!dml2->config.use_native_pstate_optimization) { + result = optimize_pstate_with_svp_and_drr(dml2, context); +@@ -549,14 +556,20 @@ static bool call_dml_mode_support_and_programming(struct dc_state *context) + /* Upon trying to sett certain frequencies in FRL, min_state_for_g6_temp_read is reported as -1. This leads to an invalid value of min_state causing crashes later on. + * Use the default logic for min_state only when min_state_for_g6_temp_read is a valid value. In other cases, use the value calculated by the DML directly. + */ +- if (min_state_for_g6_temp_read >= 0) +- min_state = min_state_for_g6_temp_read > s->mode_support_params.out_lowest_state_idx ? min_state_for_g6_temp_read : s->mode_support_params.out_lowest_state_idx; +- else +- min_state = s->mode_support_params.out_lowest_state_idx; +- +- if (result) +- result = dml_mode_programming(&dml2->v20.dml_core_ctx, min_state, &s->cur_display_config, true); ++ if (!context->streams[0]->sink->link->dc->caps.is_apu) { ++ if (min_state_for_g6_temp_read >= 0) ++ min_state = min_state_for_g6_temp_read > s->mode_support_params.out_lowest_state_idx ? min_state_for_g6_temp_read : s->mode_support_params.out_lowest_state_idx; ++ else ++ min_state = s->mode_support_params.out_lowest_state_idx; ++ } + ++ if (result) { ++ if (!context->streams[0]->sink->link->dc->caps.is_apu) { ++ result = dml_mode_programming(&dml2->v20.dml_core_ctx, min_state, &s->cur_display_config, true); ++ } else { ++ result = dml_mode_programming(&dml2->v20.dml_core_ctx, s->mode_support_params.out_lowest_state_idx, &s->cur_display_config, true); ++ } ++ } + return result; + } + +@@ -685,6 +698,8 @@ static bool dml2_validate_only(struct dc_state *context) + build_unoptimized_policy_settings(dml2->v20.dml_core_ctx.project, &dml2->v20.dml_core_ctx.policy); + + map_dc_state_into_dml_display_cfg(dml2, context, &dml2->v20.scratch.cur_display_config); ++ if (!dml2->config.skip_hw_state_mapping) ++ dml2_apply_det_buffer_allocation_policy(dml2, &dml2->v20.scratch.cur_display_config); + + result = pack_and_call_dml_mode_support_ex(dml2, + &dml2->v20.scratch.cur_display_config, +-- +2.39.5 + diff --git a/queue-6.13/drm-amd-display-use-eld_mutex-to-protect-access-to-c.patch b/queue-6.13/drm-amd-display-use-eld_mutex-to-protect-access-to-c.patch new file mode 100644 index 0000000000..1b19861b1b --- /dev/null +++ b/queue-6.13/drm-amd-display-use-eld_mutex-to-protect-access-to-c.patch @@ -0,0 +1,40 @@ +From 6cbdccefa8a43ed412f9ecd77e6aded411cb220d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 11:43:07 +0200 +Subject: drm/amd/display: use eld_mutex to protect access to connector->eld + +From: Dmitry Baryshkov + +[ Upstream commit 819bee01eea06282d7bda17d46caf29cae4f6d84 ] + +Reading access to connector->eld can happen at the same time the +drm_edid_to_eld() updates the data. Take the newly added eld_mutex in +order to protect connector->eld from concurrent access. + +Reviewed-by: Maxime Ripard +Reviewed-by: Harry Wentland +Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-4-c9bce1ee8bea@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 92e1d59921f49..cff07681e0f4c 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1037,8 +1037,10 @@ static int amdgpu_dm_audio_component_get_eld(struct device *kdev, int port, + continue; + + *enabled = true; ++ mutex_lock(&connector->eld_mutex); + ret = drm_eld_size(connector->eld); + memcpy(buf, connector->eld, min(max_bytes, ret)); ++ mutex_unlock(&connector->eld_mutex); + + break; + } +-- +2.39.5 + diff --git a/queue-6.13/drm-amdgpu-don-t-enable-sdma-4.4.5-ctxempty-interrup.patch b/queue-6.13/drm-amdgpu-don-t-enable-sdma-4.4.5-ctxempty-interrup.patch new file mode 100644 index 0000000000..d2bcf7bc0a --- /dev/null +++ b/queue-6.13/drm-amdgpu-don-t-enable-sdma-4.4.5-ctxempty-interrup.patch @@ -0,0 +1,46 @@ +From 40b22710b5f6a238ccb888b6c4407988e5b3914b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 15:45:32 -0500 +Subject: drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt + +From: Philip Yang + +[ Upstream commit b4b7271e5ca95b581f2fcc4ae852c4079215e92d ] + +The sdma context empty interrupt is dropped in amdgpu_irq_dispatch +as unregistered interrupt src_id 243, this interrupt accounts to 1/3 of +total interrupts and causes IH primary ring overflow when running +stressful benchmark application. Disable this interrupt has no side +effect found. + +Signed-off-by: Philip Yang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c +index a38553f38fdc8..ed68d7971a93a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c +@@ -953,10 +953,12 @@ static int sdma_v4_4_2_inst_start(struct amdgpu_device *adev, + /* set utc l1 enable flag always to 1 */ + temp = RREG32_SDMA(i, regSDMA_CNTL); + temp = REG_SET_FIELD(temp, SDMA_CNTL, UTC_L1_ENABLE, 1); +- /* enable context empty interrupt during initialization */ +- temp = REG_SET_FIELD(temp, SDMA_CNTL, CTXEMPTY_INT_ENABLE, 1); +- WREG32_SDMA(i, regSDMA_CNTL, temp); + ++ if (amdgpu_ip_version(adev, SDMA0_HWIP, 0) < IP_VERSION(4, 4, 5)) { ++ /* enable context empty interrupt during initialization */ ++ temp = REG_SET_FIELD(temp, SDMA_CNTL, CTXEMPTY_INT_ENABLE, 1); ++ WREG32_SDMA(i, regSDMA_CNTL, temp); ++ } + if (!amdgpu_sriov_vf(adev)) { + if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) { + /* unhalt engine */ +-- +2.39.5 + diff --git a/queue-6.13/drm-amdkfd-queue-interrupt-work-to-different-cpu.patch b/queue-6.13/drm-amdkfd-queue-interrupt-work-to-different-cpu.patch new file mode 100644 index 0000000000..d758f8b408 --- /dev/null +++ b/queue-6.13/drm-amdkfd-queue-interrupt-work-to-different-cpu.patch @@ -0,0 +1,152 @@ +From 17e704cc6b592ac66ee72b3a3001646a8d58154b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 11:33:15 -0500 +Subject: drm/amdkfd: Queue interrupt work to different CPU + +From: Philip Yang + +[ Upstream commit 34db5a32617d102e8042151bb87590e43c97132e ] + +For CPX mode, each KFD node has interrupt worker to process ih_fifo to +send events to user space. Currently all interrupt workers of same adev +queue to same CPU, all workers execution are actually serialized and +this cause KFD ih_fifo overflow when CPU usage is high. + +Use per-GPU unbounded highpri queue with number of workers equals to +number of partitions, let queue_work select the next CPU round robin +among the local CPUs of same NUMA. + +Signed-off-by: Philip Yang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 25 ++++++++-------------- + drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 25 ++++++++-------------- + drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 ++- + 3 files changed, 20 insertions(+), 33 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +index 9b51dd75fefc7..35caa71f317dc 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +@@ -638,6 +638,14 @@ static void kfd_cleanup_nodes(struct kfd_dev *kfd, unsigned int num_nodes) + struct kfd_node *knode; + unsigned int i; + ++ /* ++ * flush_work ensures that there are no outstanding ++ * work-queue items that will access interrupt_ring. New work items ++ * can't be created because we stopped interrupt handling above. ++ */ ++ flush_workqueue(kfd->ih_wq); ++ destroy_workqueue(kfd->ih_wq); ++ + for (i = 0; i < num_nodes; i++) { + knode = kfd->nodes[i]; + device_queue_manager_uninit(knode->dqm); +@@ -1059,21 +1067,6 @@ static int kfd_resume(struct kfd_node *node) + return err; + } + +-static inline void kfd_queue_work(struct workqueue_struct *wq, +- struct work_struct *work) +-{ +- int cpu, new_cpu; +- +- cpu = new_cpu = smp_processor_id(); +- do { +- new_cpu = cpumask_next(new_cpu, cpu_online_mask) % nr_cpu_ids; +- if (cpu_to_node(new_cpu) == numa_node_id()) +- break; +- } while (cpu != new_cpu); +- +- queue_work_on(new_cpu, wq, work); +-} +- + /* This is called directly from KGD at ISR. */ + void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry) + { +@@ -1099,7 +1092,7 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry) + patched_ihre, &is_patched) + && enqueue_ih_ring_entry(node, + is_patched ? patched_ihre : ih_ring_entry)) { +- kfd_queue_work(node->ih_wq, &node->interrupt_work); ++ queue_work(node->kfd->ih_wq, &node->interrupt_work); + spin_unlock_irqrestore(&node->interrupt_lock, flags); + return; + } +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c +index 9b6b6e8825934..15b4b70cf1997 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c +@@ -62,11 +62,14 @@ int kfd_interrupt_init(struct kfd_node *node) + return r; + } + +- node->ih_wq = alloc_workqueue("KFD IH", WQ_HIGHPRI, 1); +- if (unlikely(!node->ih_wq)) { +- kfifo_free(&node->ih_fifo); +- dev_err(node->adev->dev, "Failed to allocate KFD IH workqueue\n"); +- return -ENOMEM; ++ if (!node->kfd->ih_wq) { ++ node->kfd->ih_wq = alloc_workqueue("KFD IH", WQ_HIGHPRI | WQ_UNBOUND, ++ node->kfd->num_nodes); ++ if (unlikely(!node->kfd->ih_wq)) { ++ kfifo_free(&node->ih_fifo); ++ dev_err(node->adev->dev, "Failed to allocate KFD IH workqueue\n"); ++ return -ENOMEM; ++ } + } + spin_lock_init(&node->interrupt_lock); + +@@ -96,16 +99,6 @@ void kfd_interrupt_exit(struct kfd_node *node) + spin_lock_irqsave(&node->interrupt_lock, flags); + node->interrupts_active = false; + spin_unlock_irqrestore(&node->interrupt_lock, flags); +- +- /* +- * flush_work ensures that there are no outstanding +- * work-queue items that will access interrupt_ring. New work items +- * can't be created because we stopped interrupt handling above. +- */ +- flush_workqueue(node->ih_wq); +- +- destroy_workqueue(node->ih_wq); +- + kfifo_free(&node->ih_fifo); + } + +@@ -162,7 +155,7 @@ static void interrupt_wq(struct work_struct *work) + /* If we spent more than a second processing signals, + * reschedule the worker to avoid soft-lockup warnings + */ +- queue_work(dev->ih_wq, &dev->interrupt_work); ++ queue_work(dev->kfd->ih_wq, &dev->interrupt_work); + break; + } + } +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +index 9e5ca0b93b2a2..74881a5ca59ad 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +@@ -273,7 +273,6 @@ struct kfd_node { + + /* Interrupts */ + struct kfifo ih_fifo; +- struct workqueue_struct *ih_wq; + struct work_struct interrupt_work; + spinlock_t interrupt_lock; + +@@ -366,6 +365,8 @@ struct kfd_dev { + struct kfd_node *nodes[MAX_KFD_NODES]; + unsigned int num_nodes; + ++ struct workqueue_struct *ih_wq; ++ + /* Kernel doorbells for KFD device */ + struct amdgpu_bo *doorbells; + +-- +2.39.5 + diff --git a/queue-6.13/drm-bridge-anx7625-use-eld_mutex-to-protect-access-t.patch b/queue-6.13/drm-bridge-anx7625-use-eld_mutex-to-protect-access-t.patch new file mode 100644 index 0000000000..d5fe361fe3 --- /dev/null +++ b/queue-6.13/drm-bridge-anx7625-use-eld_mutex-to-protect-access-t.patch @@ -0,0 +1,40 @@ +From 04ebb98cca048f38354b06aa26f5e6ef7ae1ebdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 11:43:05 +0200 +Subject: drm/bridge: anx7625: use eld_mutex to protect access to + connector->eld + +From: Dmitry Baryshkov + +[ Upstream commit e72bf423a60afd744d13e40ab2194044a3af5217 ] + +Reading access to connector->eld can happen at the same time the +drm_edid_to_eld() updates the data. Take the newly added eld_mutex in +order to protect connector->eld from concurrent access. + +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-2-c9bce1ee8bea@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index a2675b121fe44..c036bbc92ba96 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2002,8 +2002,10 @@ static int anx7625_audio_get_eld(struct device *dev, void *data, + memset(buf, 0, len); + } else { + dev_dbg(dev, "audio copy eld\n"); ++ mutex_lock(&ctx->connector->eld_mutex); + memcpy(buf, ctx->connector->eld, + min(sizeof(ctx->connector->eld), len)); ++ mutex_unlock(&ctx->connector->eld_mutex); + } + + return 0; +-- +2.39.5 + diff --git a/queue-6.13/drm-bridge-it6505-change-definition-max_hdcp_down_st.patch b/queue-6.13/drm-bridge-it6505-change-definition-max_hdcp_down_st.patch new file mode 100644 index 0000000000..3d1408ce3a --- /dev/null +++ b/queue-6.13/drm-bridge-it6505-change-definition-max_hdcp_down_st.patch @@ -0,0 +1,41 @@ +From 17fb2dbec334dc11ec9346e1e8a44d0d77d7651a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 18:51:22 +0800 +Subject: drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT + +From: Hermes Wu + +[ Upstream commit 85597bc0d70c287ba41f17d14d3d857a38a3d727 ] + +A HDCP source device shall support max downstream to 127 devices. +Change definition MAX_HDCP_DOWN_STREAM_COUNT to 127 + +KSVs shall save for DRM blocked devices check. +This results in struct it6505 growth by ~0.5 KiB. + +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Hermes Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-4-e0fdd4844703@ite.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it6505.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index cf891e7677c0e..d55d7dad9545f 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -296,7 +296,7 @@ + #define MAX_LANE_COUNT 4 + #define MAX_LINK_RATE HBR + #define AUTO_TRAIN_RETRY 3 +-#define MAX_HDCP_DOWN_STREAM_COUNT 10 ++#define MAX_HDCP_DOWN_STREAM_COUNT 127 + #define MAX_CR_LEVEL 0x03 + #define MAX_EQ_LEVEL 0x03 + #define AUX_WAIT_TIMEOUT_MS 15 +-- +2.39.5 + diff --git a/queue-6.13/drm-bridge-it6505-fix-hdcp-bstatus-check.patch b/queue-6.13/drm-bridge-it6505-fix-hdcp-bstatus-check.patch new file mode 100644 index 0000000000..b1d311ff75 --- /dev/null +++ b/queue-6.13/drm-bridge-it6505-fix-hdcp-bstatus-check.patch @@ -0,0 +1,54 @@ +From 98fc30b1af2eb7fa3e00c8dacd557246b4a17e1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 18:51:23 +0800 +Subject: drm/bridge: it6505: fix HDCP Bstatus check + +From: Hermes Wu + +[ Upstream commit 0fd2ff47d8c207fa3173661de04bb9e8201c0ad2 ] + +When HDCP is activated, +a DisplayPort source receiving CP_IRQ from the sink +shall check Bstatus from DPCD and process the corresponding value + +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Hermes Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-5-e0fdd4844703@ite.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it6505.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index d55d7dad9545f..0f7d50da56835 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -2312,14 +2312,20 @@ static int it6505_process_hpd_irq(struct it6505 *it6505) + DRM_DEV_DEBUG_DRIVER(dev, "dp_irq_vector = 0x%02x", dp_irq_vector); + + if (dp_irq_vector & DP_CP_IRQ) { +- it6505_set_bits(it6505, REG_HDCP_TRIGGER, HDCP_TRIGGER_CPIRQ, +- HDCP_TRIGGER_CPIRQ); +- + bstatus = it6505_dpcd_read(it6505, DP_AUX_HDCP_BSTATUS); + if (bstatus < 0) + return bstatus; + + DRM_DEV_DEBUG_DRIVER(dev, "Bstatus = 0x%02x", bstatus); ++ ++ /*Check BSTATUS when recive CP_IRQ */ ++ if (bstatus & DP_BSTATUS_R0_PRIME_READY && ++ it6505->hdcp_status == HDCP_AUTH_GOING) ++ it6505_set_bits(it6505, REG_HDCP_TRIGGER, HDCP_TRIGGER_CPIRQ, ++ HDCP_TRIGGER_CPIRQ); ++ else if (bstatus & (DP_BSTATUS_REAUTH_REQ | DP_BSTATUS_LINK_FAILURE) && ++ it6505->hdcp_status == HDCP_AUTH_DONE) ++ it6505_start_hdcp(it6505); + } + + ret = drm_dp_dpcd_read_link_status(&it6505->aux, link_status); +-- +2.39.5 + diff --git a/queue-6.13/drm-bridge-it6505-fix-hdcp-cts-compare-v-matching.patch b/queue-6.13/drm-bridge-it6505-fix-hdcp-cts-compare-v-matching.patch new file mode 100644 index 0000000000..8f13e2f7cf --- /dev/null +++ b/queue-6.13/drm-bridge-it6505-fix-hdcp-cts-compare-v-matching.patch @@ -0,0 +1,78 @@ +From df89bc5865c21c039d6ea925ffc6fe50cb68060d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 18:51:26 +0800 +Subject: drm/bridge: it6505: fix HDCP CTS compare V matching + +From: Hermes Wu + +[ Upstream commit 0989c02c7a5c887c70afeae80c64d0291624e1a7 ] + +When HDCP negotiation with a repeater device. +Checking SHA V' matching must retry 3 times before restarting HDCP. + +Signed-off-by: Hermes Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-8-e0fdd4844703@ite.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it6505.c | 32 +++++++++++++++++------------ + 1 file changed, 19 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index 15873e7f07626..029755ee21e23 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -2023,7 +2023,7 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505) + { + struct device *dev = it6505->dev; + u8 av[5][4], bv[5][4]; +- int i, err; ++ int i, err, retry; + + i = it6505_setup_sha1_input(it6505, it6505->sha1_input); + if (i <= 0) { +@@ -2032,22 +2032,28 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505) + } + + it6505_sha1_digest(it6505, it6505->sha1_input, i, (u8 *)av); ++ /*1B-05 V' must retry 3 times */ ++ for (retry = 0; retry < 3; retry++) { ++ err = it6505_get_dpcd(it6505, DP_AUX_HDCP_V_PRIME(0), (u8 *)bv, ++ sizeof(bv)); + +- err = it6505_get_dpcd(it6505, DP_AUX_HDCP_V_PRIME(0), (u8 *)bv, +- sizeof(bv)); ++ if (err < 0) { ++ dev_err(dev, "Read V' value Fail %d", retry); ++ continue; ++ } + +- if (err < 0) { +- dev_err(dev, "Read V' value Fail"); +- return false; +- } ++ for (i = 0; i < 5; i++) { ++ if (bv[i][3] != av[i][0] || bv[i][2] != av[i][1] || ++ av[i][1] != av[i][2] || bv[i][0] != av[i][3]) ++ break; + +- for (i = 0; i < 5; i++) +- if (bv[i][3] != av[i][0] || bv[i][2] != av[i][1] || +- bv[i][1] != av[i][2] || bv[i][0] != av[i][3]) +- return false; ++ DRM_DEV_DEBUG_DRIVER(dev, "V' all match!! %d, %d", retry, i); ++ return true; ++ } ++ } + +- DRM_DEV_DEBUG_DRIVER(dev, "V' all match!!"); +- return true; ++ DRM_DEV_DEBUG_DRIVER(dev, "V' NOT match!! %d", retry); ++ return false; + } + + static void it6505_hdcp_wait_ksv_list(struct work_struct *work) +-- +2.39.5 + diff --git a/queue-6.13/drm-bridge-it6505-fix-hdcp-cts-ksv-list-wait-timer.patch b/queue-6.13/drm-bridge-it6505-fix-hdcp-cts-ksv-list-wait-timer.patch new file mode 100644 index 0000000000..2e0a10ee54 --- /dev/null +++ b/queue-6.13/drm-bridge-it6505-fix-hdcp-cts-ksv-list-wait-timer.patch @@ -0,0 +1,68 @@ +From e74726c8ef0a7efa06d0807640a4e2722c00d374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 18:51:27 +0800 +Subject: drm/bridge: it6505: fix HDCP CTS KSV list wait timer + +From: Hermes Wu + +[ Upstream commit 9f9eef9ec1a2b57d95a86fe81df758e8253a7766 ] + +HDCP must disabled encryption and restart authentication after +waiting KSV for 5s. +The original method uses a counter in a waitting loop that may +wait much longer than it is supposed to. +Use time_after() for KSV wait timeout. + +Signed-off-by: Hermes Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-9-e0fdd4844703@ite.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it6505.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index 029755ee21e23..faee8e2e82a05 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -2061,12 +2061,13 @@ static void it6505_hdcp_wait_ksv_list(struct work_struct *work) + struct it6505 *it6505 = container_of(work, struct it6505, + hdcp_wait_ksv_list); + struct device *dev = it6505->dev; +- unsigned int timeout = 5000; +- u8 bstatus = 0; ++ u8 bstatus; + bool ksv_list_check; ++ /* 1B-04 wait ksv list for 5s */ ++ unsigned long timeout = jiffies + ++ msecs_to_jiffies(5000) + 1; + +- timeout /= 20; +- while (timeout > 0) { ++ for (;;) { + if (!it6505_get_sink_hpd_status(it6505)) + return; + +@@ -2075,13 +2076,12 @@ static void it6505_hdcp_wait_ksv_list(struct work_struct *work) + if (bstatus & DP_BSTATUS_READY) + break; + +- msleep(20); +- timeout--; +- } ++ if (time_after(jiffies, timeout)) { ++ DRM_DEV_DEBUG_DRIVER(dev, "KSV list wait timeout"); ++ goto timeout; ++ } + +- if (timeout == 0) { +- DRM_DEV_DEBUG_DRIVER(dev, "timeout and ksv list wait failed"); +- goto timeout; ++ msleep(20); + } + + ksv_list_check = it6505_hdcp_part2_ksvlist_check(it6505); +-- +2.39.5 + diff --git a/queue-6.13/drm-bridge-it6505-fix-hdcp-encryption-when-r0-ready.patch b/queue-6.13/drm-bridge-it6505-fix-hdcp-encryption-when-r0-ready.patch new file mode 100644 index 0000000000..7067f6a07f --- /dev/null +++ b/queue-6.13/drm-bridge-it6505-fix-hdcp-encryption-when-r0-ready.patch @@ -0,0 +1,65 @@ +From 5e1696280e22603163a555dba68e9d02f2e091d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 18:51:24 +0800 +Subject: drm/bridge: it6505: fix HDCP encryption when R0 ready + +From: Hermes Wu + +[ Upstream commit 8c01b0bae2f9e58f2fee0e811cb90d8331986554 ] + +When starting HDCP authentication, HDCP encryption should be enabled +when R0'is checked. + +Change encryption enables time at R0' ready. +The hardware HDCP engine trigger is changed and the repeater KSV fails +will restart HDCP. + +Signed-off-by: Hermes Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-6-e0fdd4844703@ite.corp-partner.google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it6505.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index 0f7d50da56835..15873e7f07626 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -2081,15 +2081,12 @@ static void it6505_hdcp_wait_ksv_list(struct work_struct *work) + ksv_list_check = it6505_hdcp_part2_ksvlist_check(it6505); + DRM_DEV_DEBUG_DRIVER(dev, "ksv list ready, ksv list check %s", + ksv_list_check ? "pass" : "fail"); +- if (ksv_list_check) { +- it6505_set_bits(it6505, REG_HDCP_TRIGGER, +- HDCP_TRIGGER_KSV_DONE, HDCP_TRIGGER_KSV_DONE); ++ ++ if (ksv_list_check) + return; +- } ++ + timeout: +- it6505_set_bits(it6505, REG_HDCP_TRIGGER, +- HDCP_TRIGGER_KSV_DONE | HDCP_TRIGGER_KSV_FAIL, +- HDCP_TRIGGER_KSV_DONE | HDCP_TRIGGER_KSV_FAIL); ++ it6505_start_hdcp(it6505); + } + + static void it6505_hdcp_work(struct work_struct *work) +@@ -2462,7 +2459,11 @@ static void it6505_irq_hdcp_ksv_check(struct it6505 *it6505) + { + struct device *dev = it6505->dev; + +- DRM_DEV_DEBUG_DRIVER(dev, "HDCP event Interrupt"); ++ DRM_DEV_DEBUG_DRIVER(dev, "HDCP repeater R0 event Interrupt"); ++ /* 1B01 HDCP encription should start when R0 is ready*/ ++ it6505_set_bits(it6505, REG_HDCP_TRIGGER, ++ HDCP_TRIGGER_KSV_DONE, HDCP_TRIGGER_KSV_DONE); ++ + schedule_work(&it6505->hdcp_wait_ksv_list); + } + +-- +2.39.5 + diff --git a/queue-6.13/drm-bridge-ite-it66121-use-eld_mutex-to-protect-acce.patch b/queue-6.13/drm-bridge-ite-it66121-use-eld_mutex-to-protect-acce.patch new file mode 100644 index 0000000000..639beaded2 --- /dev/null +++ b/queue-6.13/drm-bridge-ite-it66121-use-eld_mutex-to-protect-acce.patch @@ -0,0 +1,40 @@ +From 90b24ca42bf92d99fd083f96a7f41ab2167391cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 11:43:06 +0200 +Subject: drm/bridge: ite-it66121: use eld_mutex to protect access to + connector->eld + +From: Dmitry Baryshkov + +[ Upstream commit 39ead6e02ea7d19b421e9d42299d4293fed3064e ] + +Reading access to connector->eld can happen at the same time the +drm_edid_to_eld() updates the data. Take the newly added eld_mutex in +order to protect connector->eld from concurrent access. + +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-3-c9bce1ee8bea@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it66121.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ite-it66121.c b/drivers/gpu/drm/bridge/ite-it66121.c +index 35ae3f0e8f51f..940083e5d2ddb 100644 +--- a/drivers/gpu/drm/bridge/ite-it66121.c ++++ b/drivers/gpu/drm/bridge/ite-it66121.c +@@ -1450,8 +1450,10 @@ static int it66121_audio_get_eld(struct device *dev, void *data, + dev_dbg(dev, "No connector present, passing empty EDID data"); + memset(buf, 0, len); + } else { ++ mutex_lock(&ctx->connector->eld_mutex); + memcpy(buf, ctx->connector->eld, + min(sizeof(ctx->connector->eld), len)); ++ mutex_unlock(&ctx->connector->eld_mutex); + } + mutex_unlock(&ctx->lock); + +-- +2.39.5 + diff --git a/queue-6.13/drm-connector-add-mutex-to-protect-eld-from-concurre.patch b/queue-6.13/drm-connector-add-mutex-to-protect-eld-from-concurre.patch new file mode 100644 index 0000000000..a6bbad50a3 --- /dev/null +++ b/queue-6.13/drm-connector-add-mutex-to-protect-eld-from-concurre.patch @@ -0,0 +1,90 @@ +From 357fad8beabce0d56e2ecc8ffd7056cf34d683ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 11:43:04 +0200 +Subject: drm/connector: add mutex to protect ELD from concurrent access + +From: Dmitry Baryshkov + +[ Upstream commit df7c8e3dde37a9d81c0613285b43600f3cc70f34 ] + +The connector->eld is accessed by the .get_eld() callback. This access +can collide with the drm_edid_to_eld() updating the data at the same +time. Add drm_connector.eld_mutex to protect the data from concurrenct +access. Individual drivers are not updated (to reduce possible issues +while applying the patch), maintainers are to find a best suitable way +to lock that mutex while accessing the ELD data. + +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-1-c9bce1ee8bea@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_connector.c | 1 + + drivers/gpu/drm/drm_edid.c | 6 ++++++ + include/drm/drm_connector.h | 5 ++++- + 3 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c +index ca7f43c8d6f1b..0e6021235a930 100644 +--- a/drivers/gpu/drm/drm_connector.c ++++ b/drivers/gpu/drm/drm_connector.c +@@ -277,6 +277,7 @@ static int __drm_connector_init(struct drm_device *dev, + INIT_LIST_HEAD(&connector->probed_modes); + INIT_LIST_HEAD(&connector->modes); + mutex_init(&connector->mutex); ++ mutex_init(&connector->eld_mutex); + mutex_init(&connector->edid_override_mutex); + mutex_init(&connector->hdmi.infoframes.lock); + connector->edid_blob_ptr = NULL; +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 855beafb76ffb..13bc4c290b17d 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -5605,7 +5605,9 @@ EXPORT_SYMBOL(drm_edid_get_monitor_name); + + static void clear_eld(struct drm_connector *connector) + { ++ mutex_lock(&connector->eld_mutex); + memset(connector->eld, 0, sizeof(connector->eld)); ++ mutex_unlock(&connector->eld_mutex); + + connector->latency_present[0] = false; + connector->latency_present[1] = false; +@@ -5657,6 +5659,8 @@ static void drm_edid_to_eld(struct drm_connector *connector, + if (!drm_edid) + return; + ++ mutex_lock(&connector->eld_mutex); ++ + mnl = get_monitor_name(drm_edid, &eld[DRM_ELD_MONITOR_NAME_STRING]); + drm_dbg_kms(connector->dev, "[CONNECTOR:%d:%s] ELD monitor %s\n", + connector->base.id, connector->name, +@@ -5717,6 +5721,8 @@ static void drm_edid_to_eld(struct drm_connector *connector, + drm_dbg_kms(connector->dev, "[CONNECTOR:%d:%s] ELD size %d, SAD count %d\n", + connector->base.id, connector->name, + drm_eld_size(eld), total_sad_count); ++ ++ mutex_unlock(&connector->eld_mutex); + } + + static int _drm_edid_to_sad(const struct drm_edid *drm_edid, +diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h +index e3fa43291f449..1e2b25e204cb5 100644 +--- a/include/drm/drm_connector.h ++++ b/include/drm/drm_connector.h +@@ -2001,8 +2001,11 @@ struct drm_connector { + struct drm_encoder *encoder; + + #define MAX_ELD_BYTES 128 +- /** @eld: EDID-like data, if present */ ++ /** @eld: EDID-like data, if present, protected by @eld_mutex */ + uint8_t eld[MAX_ELD_BYTES]; ++ /** @eld_mutex: protection for concurrenct access to @eld */ ++ struct mutex eld_mutex; ++ + /** @latency_present: AV delay info from ELD, if found */ + bool latency_present[2]; + /** +-- +2.39.5 + diff --git a/queue-6.13/drm-exynos-hdmi-use-eld_mutex-to-protect-access-to-c.patch b/queue-6.13/drm-exynos-hdmi-use-eld_mutex-to-protect-access-to-c.patch new file mode 100644 index 0000000000..5cf7707a21 --- /dev/null +++ b/queue-6.13/drm-exynos-hdmi-use-eld_mutex-to-protect-access-to-c.patch @@ -0,0 +1,38 @@ +From a1b80d121e3cc8b29769dbd13d2d325c75b97396 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 11:43:08 +0200 +Subject: drm/exynos: hdmi: use eld_mutex to protect access to connector->eld + +From: Dmitry Baryshkov + +[ Upstream commit 5e8436d334ed7f6785416447c50b42077c6503e0 ] + +Reading access to connector->eld can happen at the same time the +drm_edid_to_eld() updates the data. Take the newly added eld_mutex in +order to protect connector->eld from concurrent access. + +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-5-c9bce1ee8bea@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index 466a9e514aa1c..7a57d4a23e410 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -1648,7 +1648,9 @@ static int hdmi_audio_get_eld(struct device *dev, void *data, uint8_t *buf, + struct hdmi_context *hdata = dev_get_drvdata(dev); + struct drm_connector *connector = &hdata->connector; + ++ mutex_lock(&connector->eld_mutex); + memcpy(buf, connector->eld, min(sizeof(connector->eld), len)); ++ mutex_unlock(&connector->eld_mutex); + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.13/drm-msm-dp-use-eld_mutex-to-protect-access-to-connec.patch b/queue-6.13/drm-msm-dp-use-eld_mutex-to-protect-access-to-connec.patch new file mode 100644 index 0000000000..eee2d1d86f --- /dev/null +++ b/queue-6.13/drm-msm-dp-use-eld_mutex-to-protect-access-to-connec.patch @@ -0,0 +1,41 @@ +From 0ce4f44504b9f6d1b7aa617856708180fd5b27e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 11:43:10 +0200 +Subject: drm/msm/dp: use eld_mutex to protect access to connector->eld + +From: Dmitry Baryshkov + +[ Upstream commit 9aad030dc64f6994dc5de7bb81ceca55dbc555c3 ] + +Reading access to connector->eld can happen at the same time the +drm_edid_to_eld() updates the data. Take the newly added eld_mutex in +order to protect connector->eld from concurrent access. + +Reviewed-by: Maxime Ripard +Acked-by: Abhinav Kumar +Reviewed-by: Abhinav Kumar +Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-7-c9bce1ee8bea@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_audio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dp/dp_audio.c b/drivers/gpu/drm/msm/dp/dp_audio.c +index 5cbb11986460d..c179ed0e9e2bd 100644 +--- a/drivers/gpu/drm/msm/dp/dp_audio.c ++++ b/drivers/gpu/drm/msm/dp/dp_audio.c +@@ -414,8 +414,10 @@ static int msm_dp_audio_get_eld(struct device *dev, + return -ENODEV; + } + ++ mutex_lock(&msm_dp_display->connector->eld_mutex); + memcpy(buf, msm_dp_display->connector->eld, + min(sizeof(msm_dp_display->connector->eld), len)); ++ mutex_unlock(&msm_dp_display->connector->eld_mutex); + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.13/drm-msm-dpu-filter-out-too-wide-modes-if-no-3dmux-is.patch b/queue-6.13/drm-msm-dpu-filter-out-too-wide-modes-if-no-3dmux-is.patch new file mode 100644 index 0000000000..60e9c3ae03 --- /dev/null +++ b/queue-6.13/drm-msm-dpu-filter-out-too-wide-modes-if-no-3dmux-is.patch @@ -0,0 +1,62 @@ +From c64c3fa9e46658b7357427784f45697bcbbc96e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 13:18:36 -0800 +Subject: drm/msm/dpu: filter out too wide modes if no 3dmux is present + +From: Abhinav Kumar + +[ Upstream commit dbc7bb1a93f41c533fe31ddc97bdf777d7a61faa ] + +On chipsets such as QCS615, there is no 3dmux present. In such +a case, a layer exceeding the max_mixer_width cannot be split, +hence cannot be supported. + +Filter out the modes which exceed the max_mixer_width when there +is no 3dmux present. Also, add a check in the dpu_crtc_atomic_check() +to return failure for such modes. + +Signed-off-by: Abhinav Kumar +Reviewed-by: Dmitry Baryshkov +Tested-by: Xiangxu Yin # QCS615 +Patchwork: https://patchwork.freedesktop.org/patch/627974/ +Link: https://lore.kernel.org/r/20241209-no_3dmux-v3-1-48aaa555b0d3@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index 9f6ffd344693e..ad3462476a143 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -732,6 +732,13 @@ static int _dpu_crtc_check_and_setup_lm_bounds(struct drm_crtc *crtc, + struct dpu_kms *dpu_kms = _dpu_crtc_get_kms(crtc); + int i; + ++ /* if we cannot merge 2 LMs (no 3d mux) better to fail earlier ++ * before even checking the width after the split ++ */ ++ if (!dpu_kms->catalog->caps->has_3d_merge && ++ adj_mode->hdisplay > dpu_kms->catalog->caps->max_mixer_width) ++ return -E2BIG; ++ + for (i = 0; i < cstate->num_mixers; i++) { + struct drm_rect *r = &cstate->lm_bounds[i]; + r->x1 = crtc_split_width * i; +@@ -1251,6 +1258,12 @@ static enum drm_mode_status dpu_crtc_mode_valid(struct drm_crtc *crtc, + { + struct dpu_kms *dpu_kms = _dpu_crtc_get_kms(crtc); + ++ /* if there is no 3d_mux block we cannot merge LMs so we cannot ++ * split the large layer into 2 LMs, filter out such modes ++ */ ++ if (!dpu_kms->catalog->caps->has_3d_merge && ++ mode->hdisplay > dpu_kms->catalog->caps->max_mixer_width) ++ return MODE_BAD_HVALUE; + /* + * max crtc width is equal to the max mixer width * 2 and max height is 4K + */ +-- +2.39.5 + diff --git a/queue-6.13/drm-panel-backlight-quirks-add-framework-13-glossy-a.patch b/queue-6.13/drm-panel-backlight-quirks-add-framework-13-glossy-a.patch new file mode 100644 index 0000000000..e6896af149 --- /dev/null +++ b/queue-6.13/drm-panel-backlight-quirks-add-framework-13-glossy-a.patch @@ -0,0 +1,56 @@ +From 8ea114461cc03106052b8e6abd4f4403c04a91cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 19:09:38 +0100 +Subject: drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dustin L. Howett + +[ Upstream commit d80b5c5b9be6b2e1cdeaaeaa8259523b63cae292 ] + +I have tested these panels on the Framework Laptop 13 AMD with firmware +revision 3.05 (latest at time of submission). + +Signed-off-by: Dustin L. Howett +Signed-off-by: Thomas Weißschuh +Reviewed-by: Mario Limonciello +Reviewed-by: Harry Wentland +Signed-off-by: Mario Limonciello +Link: https://patchwork.freedesktop.org/patch/msgid/20241111-amdgpu-min-backlight-quirk-v7-4-f662851fda69@weissschuh.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_backlight_quirks.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_backlight_quirks.c b/drivers/gpu/drm/drm_panel_backlight_quirks.c +index f2aefff618ddb..c477d98ade2b4 100644 +--- a/drivers/gpu/drm/drm_panel_backlight_quirks.c ++++ b/drivers/gpu/drm/drm_panel_backlight_quirks.c +@@ -25,6 +25,22 @@ static const struct drm_panel_min_backlight_quirk drm_panel_min_backlight_quirks + .ident.name = "NE135FBM-N41", + .min_brightness = 0, + }, ++ /* 13 inch glossy panel */ ++ { ++ .dmi_match.field = DMI_BOARD_VENDOR, ++ .dmi_match.value = "Framework", ++ .ident.panel_id = drm_edid_encode_panel_id('B', 'O', 'E', 0x095f), ++ .ident.name = "NE135FBM-N41", ++ .min_brightness = 0, ++ }, ++ /* 13 inch 2.8k panel */ ++ { ++ .dmi_match.field = DMI_BOARD_VENDOR, ++ .dmi_match.value = "Framework", ++ .ident.panel_id = drm_edid_encode_panel_id('B', 'O', 'E', 0x0cb4), ++ .ident.name = "NE135A1M-NY1", ++ .min_brightness = 0, ++ }, + }; + + static bool drm_panel_min_backlight_quirk_matches(const struct drm_panel_min_backlight_quirk *quirk, +-- +2.39.5 + diff --git a/queue-6.13/drm-panel-backlight-quirks-add-framework-13-matte-pa.patch b/queue-6.13/drm-panel-backlight-quirks-add-framework-13-matte-pa.patch new file mode 100644 index 0000000000..663c301ed9 --- /dev/null +++ b/queue-6.13/drm-panel-backlight-quirks-add-framework-13-matte-pa.patch @@ -0,0 +1,55 @@ +From e72ee80fbd88b2d99007f8d79507aef609a5868a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 19:09:37 +0100 +Subject: drm: panel-backlight-quirks: Add Framework 13 matte panel +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 916ecc0db336768d80e14ef28a8c64a775274f95 ] + +The value of "min_input_signal" returned from ATIF on a Framework AMD 13 +is "12". This leads to a fairly bright minimum display backlight. + +Add a quirk to override that the minimum backlight PWM to "0" which +leads to a much lower minimum brightness, which is still visible. + +Tested on a Framework AMD 13 BIOS 3.05 with the matte panel. + +Link: https://community.frame.work/t/25711/9 +Link: https://community.frame.work/t/47036 +Signed-off-by: Thomas Weißschuh +Tested-by: Dustin L. Howett +Reviewed-by: Mario Limonciello +Reviewed-by: Harry Wentland +Signed-off-by: Mario Limonciello +Link: https://patchwork.freedesktop.org/patch/msgid/20241111-amdgpu-min-backlight-quirk-v7-3-f662851fda69@weissschuh.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_backlight_quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_backlight_quirks.c b/drivers/gpu/drm/drm_panel_backlight_quirks.c +index 6b8bbed77c7f1..f2aefff618ddb 100644 +--- a/drivers/gpu/drm/drm_panel_backlight_quirks.c ++++ b/drivers/gpu/drm/drm_panel_backlight_quirks.c +@@ -17,6 +17,14 @@ struct drm_panel_min_backlight_quirk { + }; + + static const struct drm_panel_min_backlight_quirk drm_panel_min_backlight_quirks[] = { ++ /* 13 inch matte panel */ ++ { ++ .dmi_match.field = DMI_BOARD_VENDOR, ++ .dmi_match.value = "Framework", ++ .ident.panel_id = drm_edid_encode_panel_id('B', 'O', 'E', 0x0bca), ++ .ident.name = "NE135FBM-N41", ++ .min_brightness = 0, ++ }, + }; + + static bool drm_panel_min_backlight_quirk_matches(const struct drm_panel_min_backlight_quirk *quirk, +-- +2.39.5 + diff --git a/queue-6.13/drm-radeon-use-eld_mutex-to-protect-access-to-connec.patch b/queue-6.13/drm-radeon-use-eld_mutex-to-protect-access-to-connec.patch new file mode 100644 index 0000000000..72e34342fb --- /dev/null +++ b/queue-6.13/drm-radeon-use-eld_mutex-to-protect-access-to-connec.patch @@ -0,0 +1,39 @@ +From 5e48d27b1ba3bc452e6e4da3fbb766add885eee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 11:43:11 +0200 +Subject: drm/radeon: use eld_mutex to protect access to connector->eld + +From: Dmitry Baryshkov + +[ Upstream commit b54c14f82428c8a602392d4cae1958a71a578132 ] + +Reading access to connector->eld can happen at the same time the +drm_edid_to_eld() updates the data. Take the newly added eld_mutex in +order to protect connector->eld from concurrent access. + +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-8-c9bce1ee8bea@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_audio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c +index 5b69cc8011b42..8d64ba18572ec 100644 +--- a/drivers/gpu/drm/radeon/radeon_audio.c ++++ b/drivers/gpu/drm/radeon/radeon_audio.c +@@ -775,8 +775,10 @@ static int radeon_audio_component_get_eld(struct device *kdev, int port, + if (!dig->pin || dig->pin->id != port) + continue; + *enabled = true; ++ mutex_lock(&connector->eld_mutex); + ret = drm_eld_size(connector->eld); + memcpy(buf, connector->eld, min(max_bytes, ret)); ++ mutex_unlock(&connector->eld_mutex); + break; + } + +-- +2.39.5 + diff --git a/queue-6.13/drm-sti-hdmi-use-eld_mutex-to-protect-access-to-conn.patch b/queue-6.13/drm-sti-hdmi-use-eld_mutex-to-protect-access-to-conn.patch new file mode 100644 index 0000000000..ae5c75e072 --- /dev/null +++ b/queue-6.13/drm-sti-hdmi-use-eld_mutex-to-protect-access-to-conn.patch @@ -0,0 +1,39 @@ +From d96b584bce63cb16aa9d92b1866c215397784462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 11:43:12 +0200 +Subject: drm/sti: hdmi: use eld_mutex to protect access to connector->eld + +From: Dmitry Baryshkov + +[ Upstream commit e99c0b517bcd53cf61f998a3c4291333401cb391 ] + +Reading access to connector->eld can happen at the same time the +drm_edid_to_eld() updates the data. Take the newly added eld_mutex in +order to protect connector->eld from concurrent access. + +Reviewed-by: Maxime Ripard +Acked-by: Raphael Gallais-Pou +Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-9-c9bce1ee8bea@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sti/sti_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c +index 21b46a6465f08..f8bbae6393ef8 100644 +--- a/drivers/gpu/drm/sti/sti_hdmi.c ++++ b/drivers/gpu/drm/sti/sti_hdmi.c +@@ -1225,7 +1225,9 @@ static int hdmi_audio_get_eld(struct device *dev, void *data, uint8_t *buf, size + struct drm_connector *connector = hdmi->drm_connector; + + DRM_DEBUG_DRIVER("\n"); ++ mutex_lock(&connector->eld_mutex); + memcpy(buf, connector->eld, min(sizeof(connector->eld), len)); ++ mutex_unlock(&connector->eld_mutex); + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.13/drm-tests-hdmi-handle-empty-modes-in-find_preferred_.patch b/queue-6.13/drm-tests-hdmi-handle-empty-modes-in-find_preferred_.patch new file mode 100644 index 0000000000..da4ba1ac70 --- /dev/null +++ b/queue-6.13/drm-tests-hdmi-handle-empty-modes-in-find_preferred_.patch @@ -0,0 +1,36 @@ +From 577145a94e4e613516ad43534bd876be5fcba64b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Nov 2024 03:52:26 +0200 +Subject: drm/tests: hdmi: handle empty modes in find_preferred_mode() + +From: Dmitry Baryshkov + +[ Upstream commit d3314efd6ebf335a3682b1d6b1b81cdab3d8254a ] + +If the connector->modes list is empty, then list_first_entry() returns a +bogus entry. Change that to use list_first_entry_or_null(). + +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20241130-hdmi-mode-valid-v5-1-742644ec3b1f@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c +index 294773342e710..1e77689af6549 100644 +--- a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c ++++ b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c +@@ -46,7 +46,7 @@ static struct drm_display_mode *find_preferred_mode(struct drm_connector *connec + struct drm_display_mode *mode, *preferred; + + mutex_lock(&drm->mode_config.mutex); +- preferred = list_first_entry(&connector->modes, struct drm_display_mode, head); ++ preferred = list_first_entry_or_null(&connector->modes, struct drm_display_mode, head); + list_for_each_entry(mode, &connector->modes, head) + if (mode->type & DRM_MODE_TYPE_PREFERRED) + preferred = mode; +-- +2.39.5 + diff --git a/queue-6.13/drm-tests-hdmi-return-meaningful-value-from-set_conn.patch b/queue-6.13/drm-tests-hdmi-return-meaningful-value-from-set_conn.patch new file mode 100644 index 0000000000..f44b4dbb53 --- /dev/null +++ b/queue-6.13/drm-tests-hdmi-return-meaningful-value-from-set_conn.patch @@ -0,0 +1,166 @@ +From ed971b27b6cb6307e8f1082acb2afe99687ca74e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Nov 2024 03:52:28 +0200 +Subject: drm/tests: hdmi: return meaningful value from set_connector_edid() + +From: Dmitry Baryshkov + +[ Upstream commit a8403be6eea91e4f5d8ad5dbc463dd08339eaece ] + +The set_connector_edid() function returns a bogus 0, performing the +check on the connector->funcs->fill_modes() result internally. Make the +function pass the fill_modes()'s return value to the caller and move +corresponding checks to the caller site. + +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20241130-hdmi-mode-valid-v5-3-742644ec3b1f@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + .../drm/tests/drm_hdmi_state_helper_test.c | 31 +++++++++---------- + 1 file changed, 15 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c +index 1e77689af6549..4ba869e0e794c 100644 +--- a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c ++++ b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c +@@ -105,9 +105,8 @@ static int set_connector_edid(struct kunit *test, struct drm_connector *connecto + mutex_lock(&drm->mode_config.mutex); + ret = connector->funcs->fill_modes(connector, 4096, 4096); + mutex_unlock(&drm->mode_config.mutex); +- KUNIT_ASSERT_GT(test, ret, 0); + +- return 0; ++ return ret; + } + + static const struct drm_connector_hdmi_funcs dummy_connector_hdmi_funcs = { +@@ -223,7 +222,7 @@ drm_atomic_helper_connector_hdmi_init(struct kunit *test, + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_max_200mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_200mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + return priv; + } +@@ -728,7 +727,7 @@ static void drm_test_check_output_bpc_crtc_mode_changed(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + ctx = drm_kunit_helper_acquire_ctx_alloc(test); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx); +@@ -802,7 +801,7 @@ static void drm_test_check_output_bpc_crtc_mode_not_changed(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + ctx = drm_kunit_helper_acquire_ctx_alloc(test); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx); +@@ -873,7 +872,7 @@ static void drm_test_check_output_bpc_dvi(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_dvi_1080p, + ARRAY_SIZE(test_edid_dvi_1080p)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + info = &conn->display_info; + KUNIT_ASSERT_FALSE(test, info->is_hdmi); +@@ -920,7 +919,7 @@ static void drm_test_check_tmds_char_rate_rgb_8bpc(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_max_200mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_200mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + ctx = drm_kunit_helper_acquire_ctx_alloc(test); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx); +@@ -967,7 +966,7 @@ static void drm_test_check_tmds_char_rate_rgb_10bpc(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + ctx = drm_kunit_helper_acquire_ctx_alloc(test); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx); +@@ -1014,7 +1013,7 @@ static void drm_test_check_tmds_char_rate_rgb_12bpc(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + ctx = drm_kunit_helper_acquire_ctx_alloc(test); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx); +@@ -1121,7 +1120,7 @@ static void drm_test_check_max_tmds_rate_bpc_fallback(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + info = &conn->display_info; + KUNIT_ASSERT_TRUE(test, info->is_hdmi); +@@ -1190,7 +1189,7 @@ static void drm_test_check_max_tmds_rate_format_fallback(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + info = &conn->display_info; + KUNIT_ASSERT_TRUE(test, info->is_hdmi); +@@ -1254,7 +1253,7 @@ static void drm_test_check_output_bpc_format_vic_1(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + info = &conn->display_info; + KUNIT_ASSERT_TRUE(test, info->is_hdmi); +@@ -1314,7 +1313,7 @@ static void drm_test_check_output_bpc_format_driver_rgb_only(struct kunit *test) + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + info = &conn->display_info; + KUNIT_ASSERT_TRUE(test, info->is_hdmi); +@@ -1381,7 +1380,7 @@ static void drm_test_check_output_bpc_format_display_rgb_only(struct kunit *test + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_max_200mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_200mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + info = &conn->display_info; + KUNIT_ASSERT_TRUE(test, info->is_hdmi); +@@ -1447,7 +1446,7 @@ static void drm_test_check_output_bpc_format_driver_8bpc_only(struct kunit *test + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + info = &conn->display_info; + KUNIT_ASSERT_TRUE(test, info->is_hdmi); +@@ -1507,7 +1506,7 @@ static void drm_test_check_output_bpc_format_display_8bpc_only(struct kunit *tes + ret = set_connector_edid(test, conn, + test_edid_hdmi_1080p_rgb_max_340mhz, + ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_340mhz)); +- KUNIT_ASSERT_EQ(test, ret, 0); ++ KUNIT_ASSERT_GT(test, ret, 0); + + info = &conn->display_info; + KUNIT_ASSERT_TRUE(test, info->is_hdmi); +-- +2.39.5 + diff --git a/queue-6.13/drm-vc4-hdmi-use-eld_mutex-to-protect-access-to-conn.patch b/queue-6.13/drm-vc4-hdmi-use-eld_mutex-to-protect-access-to-conn.patch new file mode 100644 index 0000000000..9a8b47607f --- /dev/null +++ b/queue-6.13/drm-vc4-hdmi-use-eld_mutex-to-protect-access-to-conn.patch @@ -0,0 +1,40 @@ +From a75a503cc5066f3f47454f421e430a562f5d1e95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 11:43:13 +0200 +Subject: drm/vc4: hdmi: use eld_mutex to protect access to connector->eld + +From: Dmitry Baryshkov + +[ Upstream commit 81a9a93b169a273ccc4a9a1ee56f17e9981d3f98 ] + +Reading access to connector->eld can happen at the same time the +drm_edid_to_eld() updates the data. Take the newly added eld_mutex in +order to protect connector->eld from concurrent access. + +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-10-c9bce1ee8bea@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index e3818c48c9b8c..e86123009c905 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -2193,9 +2193,9 @@ static int vc4_hdmi_audio_get_eld(struct device *dev, void *data, + struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev); + struct drm_connector *connector = &vc4_hdmi->connector; + +- mutex_lock(&vc4_hdmi->mutex); ++ mutex_lock(&connector->eld_mutex); + memcpy(buf, connector->eld, min(sizeof(connector->eld), len)); +- mutex_unlock(&vc4_hdmi->mutex); ++ mutex_unlock(&connector->eld_mutex); + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.13/drm-virtio-new-fence-for-every-plane-update.patch b/queue-6.13/drm-virtio-new-fence-for-every-plane-update.patch new file mode 100644 index 0000000000..5ed00738ea --- /dev/null +++ b/queue-6.13/drm-virtio-new-fence-for-every-plane-update.patch @@ -0,0 +1,192 @@ +From acc5a75bfb266766e6fbea725bb6be295a45a683 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2024 02:08:03 +0300 +Subject: drm/virtio: New fence for every plane update + +From: Dongwon Kim + +[ Upstream commit d3c55b8ab6fe5fa2e7ab02efd36d09c39ee5022f ] + +Having a fence linked to a virtio_gpu_framebuffer in the plane update +sequence would cause conflict when several planes referencing the same +framebuffer (e.g. Xorg screen covering multi-displays configured for an +extended mode) and those planes are updated concurrently. So it is needed +to allocate a fence for every plane state instead of the framebuffer. + +Signed-off-by: Dongwon Kim +[dmitry.osipenko@collabora.com: rebase, fix up, edit commit message] +Signed-off-by: Dmitry Osipenko +Acked-by: Vivek Kasireddy +Reviewed-by: Rob Clark +Link: https://patchwork.freedesktop.org/patch/msgid/20241020230803.247419-2-dmitry.osipenko@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/virtio/virtgpu_drv.h | 7 ++++ + drivers/gpu/drm/virtio/virtgpu_plane.c | 58 +++++++++++++++++--------- + 2 files changed, 46 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h +index 64c236169db88..5dc8eeaf7123c 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_drv.h ++++ b/drivers/gpu/drm/virtio/virtgpu_drv.h +@@ -194,6 +194,13 @@ struct virtio_gpu_framebuffer { + #define to_virtio_gpu_framebuffer(x) \ + container_of(x, struct virtio_gpu_framebuffer, base) + ++struct virtio_gpu_plane_state { ++ struct drm_plane_state base; ++ struct virtio_gpu_fence *fence; ++}; ++#define to_virtio_gpu_plane_state(x) \ ++ container_of(x, struct virtio_gpu_plane_state, base) ++ + struct virtio_gpu_queue { + struct virtqueue *vq; + spinlock_t qlock; +diff --git a/drivers/gpu/drm/virtio/virtgpu_plane.c b/drivers/gpu/drm/virtio/virtgpu_plane.c +index a72a2dbda031c..7acd38b962c62 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_plane.c ++++ b/drivers/gpu/drm/virtio/virtgpu_plane.c +@@ -66,11 +66,28 @@ uint32_t virtio_gpu_translate_format(uint32_t drm_fourcc) + return format; + } + ++static struct ++drm_plane_state *virtio_gpu_plane_duplicate_state(struct drm_plane *plane) ++{ ++ struct virtio_gpu_plane_state *new; ++ ++ if (WARN_ON(!plane->state)) ++ return NULL; ++ ++ new = kzalloc(sizeof(*new), GFP_KERNEL); ++ if (!new) ++ return NULL; ++ ++ __drm_atomic_helper_plane_duplicate_state(plane, &new->base); ++ ++ return &new->base; ++} ++ + static const struct drm_plane_funcs virtio_gpu_plane_funcs = { + .update_plane = drm_atomic_helper_update_plane, + .disable_plane = drm_atomic_helper_disable_plane, + .reset = drm_atomic_helper_plane_reset, +- .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state, ++ .atomic_duplicate_state = virtio_gpu_plane_duplicate_state, + .atomic_destroy_state = drm_atomic_helper_plane_destroy_state, + }; + +@@ -138,11 +155,13 @@ static void virtio_gpu_resource_flush(struct drm_plane *plane, + struct drm_device *dev = plane->dev; + struct virtio_gpu_device *vgdev = dev->dev_private; + struct virtio_gpu_framebuffer *vgfb; ++ struct virtio_gpu_plane_state *vgplane_st; + struct virtio_gpu_object *bo; + + vgfb = to_virtio_gpu_framebuffer(plane->state->fb); ++ vgplane_st = to_virtio_gpu_plane_state(plane->state); + bo = gem_to_virtio_gpu_obj(vgfb->base.obj[0]); +- if (vgfb->fence) { ++ if (vgplane_st->fence) { + struct virtio_gpu_object_array *objs; + + objs = virtio_gpu_array_alloc(1); +@@ -151,13 +170,11 @@ static void virtio_gpu_resource_flush(struct drm_plane *plane, + virtio_gpu_array_add_obj(objs, vgfb->base.obj[0]); + virtio_gpu_array_lock_resv(objs); + virtio_gpu_cmd_resource_flush(vgdev, bo->hw_res_handle, x, y, +- width, height, objs, vgfb->fence); ++ width, height, objs, ++ vgplane_st->fence); + virtio_gpu_notify(vgdev); +- +- dma_fence_wait_timeout(&vgfb->fence->f, true, ++ dma_fence_wait_timeout(&vgplane_st->fence->f, true, + msecs_to_jiffies(50)); +- dma_fence_put(&vgfb->fence->f); +- vgfb->fence = NULL; + } else { + virtio_gpu_cmd_resource_flush(vgdev, bo->hw_res_handle, x, y, + width, height, NULL, NULL); +@@ -247,20 +264,23 @@ static int virtio_gpu_plane_prepare_fb(struct drm_plane *plane, + struct drm_device *dev = plane->dev; + struct virtio_gpu_device *vgdev = dev->dev_private; + struct virtio_gpu_framebuffer *vgfb; ++ struct virtio_gpu_plane_state *vgplane_st; + struct virtio_gpu_object *bo; + + if (!new_state->fb) + return 0; + + vgfb = to_virtio_gpu_framebuffer(new_state->fb); ++ vgplane_st = to_virtio_gpu_plane_state(new_state); + bo = gem_to_virtio_gpu_obj(vgfb->base.obj[0]); + if (!bo || (plane->type == DRM_PLANE_TYPE_PRIMARY && !bo->guest_blob)) + return 0; + +- if (bo->dumb && (plane->state->fb != new_state->fb)) { +- vgfb->fence = virtio_gpu_fence_alloc(vgdev, vgdev->fence_drv.context, ++ if (bo->dumb) { ++ vgplane_st->fence = virtio_gpu_fence_alloc(vgdev, ++ vgdev->fence_drv.context, + 0); +- if (!vgfb->fence) ++ if (!vgplane_st->fence) + return -ENOMEM; + } + +@@ -270,15 +290,15 @@ static int virtio_gpu_plane_prepare_fb(struct drm_plane *plane, + static void virtio_gpu_plane_cleanup_fb(struct drm_plane *plane, + struct drm_plane_state *state) + { +- struct virtio_gpu_framebuffer *vgfb; ++ struct virtio_gpu_plane_state *vgplane_st; + + if (!state->fb) + return; + +- vgfb = to_virtio_gpu_framebuffer(state->fb); +- if (vgfb->fence) { +- dma_fence_put(&vgfb->fence->f); +- vgfb->fence = NULL; ++ vgplane_st = to_virtio_gpu_plane_state(state); ++ if (vgplane_st->fence) { ++ dma_fence_put(&vgplane_st->fence->f); ++ vgplane_st->fence = NULL; + } + } + +@@ -291,6 +311,7 @@ static void virtio_gpu_cursor_plane_update(struct drm_plane *plane, + struct virtio_gpu_device *vgdev = dev->dev_private; + struct virtio_gpu_output *output = NULL; + struct virtio_gpu_framebuffer *vgfb; ++ struct virtio_gpu_plane_state *vgplane_st; + struct virtio_gpu_object *bo = NULL; + uint32_t handle; + +@@ -303,6 +324,7 @@ static void virtio_gpu_cursor_plane_update(struct drm_plane *plane, + + if (plane->state->fb) { + vgfb = to_virtio_gpu_framebuffer(plane->state->fb); ++ vgplane_st = to_virtio_gpu_plane_state(plane->state); + bo = gem_to_virtio_gpu_obj(vgfb->base.obj[0]); + handle = bo->hw_res_handle; + } else { +@@ -322,11 +344,9 @@ static void virtio_gpu_cursor_plane_update(struct drm_plane *plane, + (vgdev, 0, + plane->state->crtc_w, + plane->state->crtc_h, +- 0, 0, objs, vgfb->fence); ++ 0, 0, objs, vgplane_st->fence); + virtio_gpu_notify(vgdev); +- dma_fence_wait(&vgfb->fence->f, true); +- dma_fence_put(&vgfb->fence->f); +- vgfb->fence = NULL; ++ dma_fence_wait(&vgplane_st->fence->f, true); + } + + if (plane->state->fb != old_state->fb) { +-- +2.39.5 + diff --git a/queue-6.13/exec-fix-up-proc-pid-comm-in-the-execveat-at_empty_p.patch b/queue-6.13/exec-fix-up-proc-pid-comm-in-the-execveat-at_empty_p.patch new file mode 100644 index 0000000000..8faf81d0a7 --- /dev/null +++ b/queue-6.13/exec-fix-up-proc-pid-comm-in-the-execveat-at_empty_p.patch @@ -0,0 +1,110 @@ +From ed83047391f1c65626b32abd09da7057da980e02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2024 07:07:05 -0800 +Subject: exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kees Cook + +[ Upstream commit 543841d1806029889c2f69f040e88b247aba8e22 ] + +Zbigniew mentioned at Linux Plumber's that systemd is interested in +switching to execveat() for service execution, but can't, because the +contents of /proc/pid/comm are the file descriptor which was used, +instead of the path to the binary[1]. This makes the output of tools like +top and ps useless, especially in a world where most fds are opened +CLOEXEC so the number is truly meaningless. + +When the filename passed in is empty (e.g. with AT_EMPTY_PATH), use the +dentry's filename for "comm" instead of using the useless numeral from +the synthetic fdpath construction. This way the actual exec machinery +is unchanged, but cosmetically the comm looks reasonable to admins +investigating things. + +Instead of adding TASK_COMM_LEN more bytes to bprm, use one of the unused +flag bits to indicate that we need to set "comm" from the dentry. + +Suggested-by: Zbigniew Jędrzejewski-Szmek +Suggested-by: Tycho Andersen +Suggested-by: Al Viro +Suggested-by: Linus Torvalds +Link: https://github.com/uapi-group/kernel-features#set-comm-field-before-exec [1] +Reviewed-by: Aleksa Sarai +Tested-by: Zbigniew Jędrzejewski-Szmek +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/exec.c | 29 ++++++++++++++++++++++++++--- + include/linux/binfmts.h | 4 +++- + 2 files changed, 29 insertions(+), 4 deletions(-) + +diff --git a/fs/exec.c b/fs/exec.c +index 98cb7ba9983c7..b1f6b47ad20e1 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1341,7 +1341,28 @@ int begin_new_exec(struct linux_binprm * bprm) + set_dumpable(current->mm, SUID_DUMP_USER); + + perf_event_exec(); +- __set_task_comm(me, kbasename(bprm->filename), true); ++ ++ /* ++ * If the original filename was empty, alloc_bprm() made up a path ++ * that will probably not be useful to admins running ps or similar. ++ * Let's fix it up to be something reasonable. ++ */ ++ if (bprm->comm_from_dentry) { ++ /* ++ * Hold RCU lock to keep the name from being freed behind our back. ++ * Use acquire semantics to make sure the terminating NUL from ++ * __d_alloc() is seen. ++ * ++ * Note, we're deliberately sloppy here. We don't need to care about ++ * detecting a concurrent rename and just want a terminated name. ++ */ ++ rcu_read_lock(); ++ __set_task_comm(me, smp_load_acquire(&bprm->file->f_path.dentry->d_name.name), ++ true); ++ rcu_read_unlock(); ++ } else { ++ __set_task_comm(me, kbasename(bprm->filename), true); ++ } + + /* An exec changes our domain. We are no longer part of the thread + group */ +@@ -1517,11 +1538,13 @@ static struct linux_binprm *alloc_bprm(int fd, struct filename *filename, int fl + if (fd == AT_FDCWD || filename->name[0] == '/') { + bprm->filename = filename->name; + } else { +- if (filename->name[0] == '\0') ++ if (filename->name[0] == '\0') { + bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd); +- else ++ bprm->comm_from_dentry = 1; ++ } else { + bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s", + fd, filename->name); ++ } + if (!bprm->fdpath) + goto out_free; + +diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h +index e6c00e860951a..3305c849abd66 100644 +--- a/include/linux/binfmts.h ++++ b/include/linux/binfmts.h +@@ -42,7 +42,9 @@ struct linux_binprm { + * Set when errors can no longer be returned to the + * original userspace. + */ +- point_of_no_return:1; ++ point_of_no_return:1, ++ /* Set when "comm" must come from the dentry. */ ++ comm_from_dentry:1; + struct file *executable; /* Executable to pass to the interpreter */ + struct file *interpreter; + struct file *file; +-- +2.39.5 + diff --git a/queue-6.13/hid-hid-asus-disable-oobe-mode-on-the-proart-p16.patch b/queue-6.13/hid-hid-asus-disable-oobe-mode-on-the-proart-p16.patch new file mode 100644 index 0000000000..5cda920dc7 --- /dev/null +++ b/queue-6.13/hid-hid-asus-disable-oobe-mode-on-the-proart-p16.patch @@ -0,0 +1,91 @@ +From d8b999cfe54a46b81faadeb8d3700a1357d323cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jan 2025 14:01:53 +1300 +Subject: HID: hid-asus: Disable OOBE mode on the ProArt P16 + +From: Luke D. Jones + +[ Upstream commit 53078a736fbc60e5d3a1e14f4cd4214003815026 ] + +The new ASUS ProArt 16" laptop series come with their keyboards stuck in +an Out-Of-Box-Experience mode. While in this mode most functions will +not work such as LED control or Fn key combos. The correct init sequence +is now done to disable this OOBE. + +This patch addresses only the ProArt series so far and it is unknown if +there may be others, in which case a new quirk may be required. + +Signed-off-by: Luke D. Jones +Co-developed-by: Connor Belli +Signed-off-by: Connor Belli +Tested-by: Jan Schmidt +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-asus.c | 26 ++++++++++++++++++++++ + include/linux/platform_data/x86/asus-wmi.h | 5 +++++ + 2 files changed, 31 insertions(+) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index 506c6f377e7d6..46e3e42f9eb5f 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -432,6 +432,26 @@ static int asus_kbd_get_functions(struct hid_device *hdev, + return ret; + } + ++static int asus_kbd_disable_oobe(struct hid_device *hdev) ++{ ++ const u8 init[][6] = { ++ { FEATURE_KBD_REPORT_ID, 0x05, 0x20, 0x31, 0x00, 0x08 }, ++ { FEATURE_KBD_REPORT_ID, 0xBA, 0xC5, 0xC4 }, ++ { FEATURE_KBD_REPORT_ID, 0xD0, 0x8F, 0x01 }, ++ { FEATURE_KBD_REPORT_ID, 0xD0, 0x85, 0xFF } ++ }; ++ int ret; ++ ++ for (size_t i = 0; i < ARRAY_SIZE(init); i++) { ++ ret = asus_kbd_set_report(hdev, init[i], sizeof(init[i])); ++ if (ret < 0) ++ return ret; ++ } ++ ++ hid_info(hdev, "Disabled OOBE for keyboard\n"); ++ return 0; ++} ++ + static void asus_schedule_work(struct asus_kbd_leds *led) + { + unsigned long flags; +@@ -534,6 +554,12 @@ static int asus_kbd_register_leds(struct hid_device *hdev) + ret = asus_kbd_init(hdev, FEATURE_KBD_LED_REPORT_ID2); + if (ret < 0) + return ret; ++ ++ if (dmi_match(DMI_PRODUCT_FAMILY, "ProArt P16")) { ++ ret = asus_kbd_disable_oobe(hdev); ++ if (ret < 0) ++ return ret; ++ } + } else { + /* Initialize keyboard */ + ret = asus_kbd_init(hdev, FEATURE_KBD_REPORT_ID); +diff --git a/include/linux/platform_data/x86/asus-wmi.h b/include/linux/platform_data/x86/asus-wmi.h +index 365e119bebaa2..783e2a336861b 100644 +--- a/include/linux/platform_data/x86/asus-wmi.h ++++ b/include/linux/platform_data/x86/asus-wmi.h +@@ -184,6 +184,11 @@ static const struct dmi_system_id asus_use_hid_led_dmi_ids[] = { + DMI_MATCH(DMI_PRODUCT_FAMILY, "ROG Flow"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "ProArt P16"), ++ }, ++ }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GA403U"), +-- +2.39.5 + diff --git a/queue-6.13/hid-multitouch-add-quirk-for-hantick-5288-touchpad.patch b/queue-6.13/hid-multitouch-add-quirk-for-hantick-5288-touchpad.patch new file mode 100644 index 0000000000..de5de9ed46 --- /dev/null +++ b/queue-6.13/hid-multitouch-add-quirk-for-hantick-5288-touchpad.patch @@ -0,0 +1,40 @@ +From b1244e8eaba7e36cdaaf417158b9e08c3b8f2dd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 10:18:01 +0800 +Subject: HID: multitouch: Add quirk for Hantick 5288 touchpad + +From: Youwan Wang + +[ Upstream commit b5e65ae557da9fd17b08482ee44ee108ba636182 ] + +This device sometimes doesn't send touch release signals when moving +from >=2 fingers to <2 fingers. Using MT_QUIRK_NOT_SEEN_MEANS_UP instead +of MT_QUIRK_ALWAYS_VALID makes sure that no touches become stuck. + +Signed-off-by: Enze Xie +Signed-off-by: Youwan Wang +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 42c0bd9d2f31e..82900857bfd87 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2314,6 +2314,11 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_SIS_TOUCH, + HID_ANY_ID) }, + ++ /* Hantick */ ++ { .driver_data = MT_CLS_NSMU, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288) }, ++ + /* Generic MT device */ + { HID_DEVICE(HID_BUS_ANY, HID_GROUP_MULTITOUCH, HID_ANY_ID, HID_ANY_ID) }, + +-- +2.39.5 + diff --git a/queue-6.13/hid-wacom-add-pci-wacom-device-support.patch b/queue-6.13/hid-wacom-add-pci-wacom-device-support.patch new file mode 100644 index 0000000000..e4b540d28c --- /dev/null +++ b/queue-6.13/hid-wacom-add-pci-wacom-device-support.patch @@ -0,0 +1,46 @@ +From 4657cf9ca5a3e4619e7ac0f415b48529733fb7b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Dec 2024 09:35:27 +0800 +Subject: HID: Wacom: Add PCI Wacom device support + +From: Even Xu + +[ Upstream commit c4c123504a65583e3689b3de04a61dc5272e453a ] + +Add PCI device ID of wacom device into driver support list. + +Signed-off-by: Even Xu +Tested-by: Tatsunosuke Tobita +Reviewed-by: Ping Cheng +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/wacom_wac.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 5501a560fb07f..b60bfafc6a8fb 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -4946,6 +4946,10 @@ static const struct wacom_features wacom_features_0x94 = + HID_DEVICE(BUS_I2C, HID_GROUP_WACOM, USB_VENDOR_ID_WACOM, prod),\ + .driver_data = (kernel_ulong_t)&wacom_features_##prod + ++#define PCI_DEVICE_WACOM(prod) \ ++ HID_DEVICE(BUS_PCI, HID_GROUP_WACOM, USB_VENDOR_ID_WACOM, prod),\ ++ .driver_data = (kernel_ulong_t)&wacom_features_##prod ++ + #define USB_DEVICE_LENOVO(prod) \ + HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, prod), \ + .driver_data = (kernel_ulong_t)&wacom_features_##prod +@@ -5115,6 +5119,7 @@ const struct hid_device_id wacom_ids[] = { + + { USB_DEVICE_WACOM(HID_ANY_ID) }, + { I2C_DEVICE_WACOM(HID_ANY_ID) }, ++ { PCI_DEVICE_WACOM(HID_ANY_ID) }, + { BT_DEVICE_WACOM(HID_ANY_ID) }, + { } + }; +-- +2.39.5 + diff --git a/queue-6.13/i2c-force-elan06fa-touchpad-i2c-bus-freq-to-100khz.patch b/queue-6.13/i2c-force-elan06fa-touchpad-i2c-bus-freq-to-100khz.patch new file mode 100644 index 0000000000..6abfe78377 --- /dev/null +++ b/queue-6.13/i2c-force-elan06fa-touchpad-i2c-bus-freq-to-100khz.patch @@ -0,0 +1,73 @@ +From 222c6e333b4ed63341e90c9ccfe65fd943485126 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 14:52:37 -0500 +Subject: i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz + +From: Randolph Ha + +[ Upstream commit bfd74cd1fbc026f04446e67d6915c7e199c2bffd ] + +When a 400KHz freq is used on this model of ELAN touchpad in Linux, +excessive smoothing (similar to when the touchpad's firmware detects +a noisy signal) is sometimes applied. As some devices' (e.g, Lenovo +V15 G4) ACPI tables specify a 400KHz frequency for this device and +some I2C busses (e.g, Designware I2C) default to a 400KHz freq, +force the speed to 100KHz as a workaround. + +For future investigation: This problem may be related to the default +HCNT/LCNT values given by some busses' drivers, because they are not +specified in the aforementioned devices' ACPI tables, and because +the device works without issues on Windows at what is expected to be +a 400KHz frequency. The root cause of the issue is not known. + +Signed-off-by: Randolph Ha +Reviewed-by: Mika Westerberg +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-acpi.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c +index 14ae0cfc325ef..d2499f302b508 100644 +--- a/drivers/i2c/i2c-core-acpi.c ++++ b/drivers/i2c/i2c-core-acpi.c +@@ -355,6 +355,25 @@ static const struct acpi_device_id i2c_acpi_force_400khz_device_ids[] = { + {} + }; + ++static const struct acpi_device_id i2c_acpi_force_100khz_device_ids[] = { ++ /* ++ * When a 400KHz freq is used on this model of ELAN touchpad in Linux, ++ * excessive smoothing (similar to when the touchpad's firmware detects ++ * a noisy signal) is sometimes applied. As some devices' (e.g, Lenovo ++ * V15 G4) ACPI tables specify a 400KHz frequency for this device and ++ * some I2C busses (e.g, Designware I2C) default to a 400KHz freq, ++ * force the speed to 100KHz as a workaround. ++ * ++ * For future investigation: This problem may be related to the default ++ * HCNT/LCNT values given by some busses' drivers, because they are not ++ * specified in the aforementioned devices' ACPI tables, and because ++ * the device works without issues on Windows at what is expected to be ++ * a 400KHz frequency. The root cause of the issue is not known. ++ */ ++ { "ELAN06FA", 0 }, ++ {} ++}; ++ + static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level, + void *data, void **return_value) + { +@@ -373,6 +392,9 @@ static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level, + if (acpi_match_device_ids(adev, i2c_acpi_force_400khz_device_ids) == 0) + lookup->force_speed = I2C_MAX_FAST_MODE_FREQ; + ++ if (acpi_match_device_ids(adev, i2c_acpi_force_100khz_device_ids) == 0) ++ lookup->force_speed = I2C_MAX_STANDARD_MODE_FREQ; ++ + return AE_OK; + } + +-- +2.39.5 + diff --git a/queue-6.13/input-allocate-keycode-for-phone-linking.patch b/queue-6.13/input-allocate-keycode-for-phone-linking.patch new file mode 100644 index 0000000000..b356ed1c3c --- /dev/null +++ b/queue-6.13/input-allocate-keycode-for-phone-linking.patch @@ -0,0 +1,45 @@ +From bdb01c592f0404496ec218ceb15e8f030e76e3ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2024 18:39:29 +0100 +Subject: Input: allocate keycode for phone linking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Illia Ostapyshyn + +[ Upstream commit 1bebc7869c99d466f819dd2cffaef0edf7d7a035 ] + +The F11 key on the new Lenovo Thinkpad T14 Gen 5, T16 Gen 3, and P14s +Gen 5 laptops includes a symbol showing a smartphone and a laptop +chained together. According to the user manual, it starts the Microsoft +Phone Link software used to connect to Android/iOS devices and relay +messages/calls or sync data. + +As there are no suitable keycodes for this action, introduce a new one. + +Signed-off-by: Illia Ostapyshyn +Acked-by: Dmitry Torokhov +Link: https://lore.kernel.org/r/20241114173930.44983-2-illia@yshyn.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + include/uapi/linux/input-event-codes.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h +index a4206723f5033..5a199f3d4a26a 100644 +--- a/include/uapi/linux/input-event-codes.h ++++ b/include/uapi/linux/input-event-codes.h +@@ -519,6 +519,7 @@ + #define KEY_NOTIFICATION_CENTER 0x1bc /* Show/hide the notification center */ + #define KEY_PICKUP_PHONE 0x1bd /* Answer incoming call */ + #define KEY_HANGUP_PHONE 0x1be /* Decline incoming call */ ++#define KEY_LINK_PHONE 0x1bf /* AL Phone Syncing */ + + #define KEY_DEL_EOL 0x1c0 + #define KEY_DEL_EOS 0x1c1 +-- +2.39.5 + diff --git a/queue-6.13/iommu-arm-smmu-qcom-add-sdm670-adreno-iommu-compatib.patch b/queue-6.13/iommu-arm-smmu-qcom-add-sdm670-adreno-iommu-compatib.patch new file mode 100644 index 0000000000..6733fc7b44 --- /dev/null +++ b/queue-6.13/iommu-arm-smmu-qcom-add-sdm670-adreno-iommu-compatib.patch @@ -0,0 +1,46 @@ +From 869c6f1444d8dabf838b69f5df14e3655a46f58b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 19:47:16 -0500 +Subject: iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible + +From: Richard Acayan + +[ Upstream commit 42314738906380cbd3b6e9caf3ad34e1b2d66035 ] + +Add the compatible for the separate IOMMU on SDM670 for the Adreno GPU. + +This IOMMU has the compatible strings: + + "qcom,sdm670-smmu-v2", "qcom,adreno-smmu", "qcom,smmu-v2" + +While the SMMU 500 doesn't need an entry for this specific SoC, the +SMMU v2 compatible should have its own entry, as the fallback entry in +arm-smmu.c handles "qcom,smmu-v2" without per-process page table support +unless there is an entry here. This entry can't be the +"qcom,adreno-smmu" compatible because dedicated GPU IOMMUs can also be +SMMU 500 with different handling. + +Signed-off-by: Richard Acayan +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20241114004713.42404-6-mailingradian@gmail.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +index 6372f3e25c4bc..601fb878d0ef2 100644 +--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c ++++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +@@ -567,6 +567,7 @@ static const struct of_device_id __maybe_unused qcom_smmu_impl_of_match[] = { + { .compatible = "qcom,sc8180x-smmu-500", .data = &qcom_smmu_500_impl0_data }, + { .compatible = "qcom,sc8280xp-smmu-500", .data = &qcom_smmu_500_impl0_data }, + { .compatible = "qcom,sdm630-smmu-v2", .data = &qcom_smmu_v2_data }, ++ { .compatible = "qcom,sdm670-smmu-v2", .data = &qcom_smmu_v2_data }, + { .compatible = "qcom,sdm845-smmu-v2", .data = &qcom_smmu_v2_data }, + { .compatible = "qcom,sdm845-smmu-500", .data = &sdm845_smmu_500_data }, + { .compatible = "qcom,sm6115-smmu-500", .data = &qcom_smmu_500_impl0_data}, +-- +2.39.5 + diff --git a/queue-6.13/iommu-arm-smmu-v3-clean-up-more-on-probe-failure.patch b/queue-6.13/iommu-arm-smmu-v3-clean-up-more-on-probe-failure.patch new file mode 100644 index 0000000000..b7460b7bd8 --- /dev/null +++ b/queue-6.13/iommu-arm-smmu-v3-clean-up-more-on-probe-failure.patch @@ -0,0 +1,75 @@ +From 85ae8de0b17e1b0a779741179e7a5d7ec2d6ef7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 16:33:57 +0000 +Subject: iommu/arm-smmu-v3: Clean up more on probe failure + +From: Robin Murphy + +[ Upstream commit fcbd621567420b3a2f21f49bbc056de8b273c625 ] + +kmemleak noticed that the iopf queue allocated deep down within +arm_smmu_init_structures() can be leaked by a subsequent error return +from arm_smmu_device_probe(). Furthermore, after arm_smmu_device_reset() +we will also leave the SMMU enabled with an empty Stream Table, silently +blocking all DMA. This proves rather annoying for debugging said probe +failure, so let's handle it a bit better by putting the SMMU back into +(more or less) the same state as if it hadn't probed at all. + +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/5137901958471cf67f2fad5c2229f8a8f1ae901a.1733406914.git.robin.murphy@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 6d15405f0ea3e..42a89d499cda8 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -4670,7 +4670,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev) + /* Initialise in-memory data structures */ + ret = arm_smmu_init_structures(smmu); + if (ret) +- return ret; ++ goto err_free_iopf; + + /* Record our private device structure */ + platform_set_drvdata(pdev, smmu); +@@ -4681,22 +4681,29 @@ static int arm_smmu_device_probe(struct platform_device *pdev) + /* Reset the device */ + ret = arm_smmu_device_reset(smmu); + if (ret) +- return ret; ++ goto err_disable; + + /* And we're up. Go go go! */ + ret = iommu_device_sysfs_add(&smmu->iommu, dev, NULL, + "smmu3.%pa", &ioaddr); + if (ret) +- return ret; ++ goto err_disable; + + ret = iommu_device_register(&smmu->iommu, &arm_smmu_ops, dev); + if (ret) { + dev_err(dev, "Failed to register iommu\n"); +- iommu_device_sysfs_remove(&smmu->iommu); +- return ret; ++ goto err_free_sysfs; + } + + return 0; ++ ++err_free_sysfs: ++ iommu_device_sysfs_remove(&smmu->iommu); ++err_disable: ++ arm_smmu_device_disable(smmu); ++err_free_iopf: ++ iopf_queue_free(smmu->evtq.iopf); ++ return ret; + } + + static void arm_smmu_device_remove(struct platform_device *pdev) +-- +2.39.5 + diff --git a/queue-6.13/iommu-vt-d-avoid-use-of-null-after-warn_on_once.patch b/queue-6.13/iommu-vt-d-avoid-use-of-null-after-warn_on_once.patch new file mode 100644 index 0000000000..87953243f2 --- /dev/null +++ b/queue-6.13/iommu-vt-d-avoid-use-of-null-after-warn_on_once.patch @@ -0,0 +1,47 @@ +From a389c1442ad7d69a81c9b4658c017f074aab9065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 10:17:42 +0800 +Subject: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE + +From: Kees Bakker + +[ Upstream commit 60f030f7418d3f1d94f2fb207fe3080e1844630b ] + +There is a WARN_ON_ONCE to catch an unlikely situation when +domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless +happens we must avoid using a NULL pointer. + +Signed-off-by: Kees Bakker +Link: https://lore.kernel.org/r/20241218201048.E544818E57E@bout3.ijzerbout.nl +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 79e0da9eb626c..8f75c11a3ec48 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -4090,13 +4090,14 @@ void domain_remove_dev_pasid(struct iommu_domain *domain, + break; + } + } +- WARN_ON_ONCE(!dev_pasid); + spin_unlock_irqrestore(&dmar_domain->lock, flags); + + cache_tag_unassign_domain(dmar_domain, dev, pasid); + domain_detach_iommu(dmar_domain, iommu); +- intel_iommu_debugfs_remove_dev_pasid(dev_pasid); +- kfree(dev_pasid); ++ if (!WARN_ON_ONCE(!dev_pasid)) { ++ intel_iommu_debugfs_remove_dev_pasid(dev_pasid); ++ kfree(dev_pasid); ++ } + } + + static void intel_iommu_remove_dev_pasid(struct device *dev, ioasid_t pasid, +-- +2.39.5 + diff --git a/queue-6.13/irqchip-lan966x-oic-make-config_lan966x_oic-depend-o.patch b/queue-6.13/irqchip-lan966x-oic-make-config_lan966x_oic-depend-o.patch new file mode 100644 index 0000000000..f94232d78a --- /dev/null +++ b/queue-6.13/irqchip-lan966x-oic-make-config_lan966x_oic-depend-o.patch @@ -0,0 +1,40 @@ +From 338c57a1be471d7b4b801dfe4a7a6554735217b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 15:35:02 +0100 +Subject: irqchip/lan966x-oic: Make CONFIG_LAN966X_OIC depend on + CONFIG_MCHP_LAN966X_PCI + +From: Geert Uytterhoeven + +[ Upstream commit e06c9e3682f58fbeb632b7b866bb4fe66a4a4b42 ] + +The Microchip LAN966x outband interrupt controller is only present on +Microchip LAN966x SoCs, and only used in PCI endpoint mode. Hence add a +dependency on MCHP_LAN966X_PCI, to prevent asking the user about this +driver when configuring a kernel without Microchip LAN966x PCIe support. + +Fixes: 3e3a7b35332924c8 ("irqchip: Add support for LAN966x OIC") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Thomas Gleixner +Acked-by: Herve Codina +Link: https://lore.kernel.org/all/28e8a605e72ee45e27f0d06b2b71366159a9c782.1737383314.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/irqchip/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig +index 9bee02db16439..990674713b863 100644 +--- a/drivers/irqchip/Kconfig ++++ b/drivers/irqchip/Kconfig +@@ -169,6 +169,7 @@ config IXP4XX_IRQ + + config LAN966X_OIC + tristate "Microchip LAN966x OIC Support" ++ depends on MCHP_LAN966X_PCI || COMPILE_TEST + select GENERIC_IRQ_CHIP + select IRQ_DOMAIN + help +-- +2.39.5 + diff --git a/queue-6.13/lockdep-fix-upper-limit-for-lockdep_-_bits-configs.patch b/queue-6.13/lockdep-fix-upper-limit-for-lockdep_-_bits-configs.patch new file mode 100644 index 0000000000..37822cadb1 --- /dev/null +++ b/queue-6.13/lockdep-fix-upper-limit-for-lockdep_-_bits-configs.patch @@ -0,0 +1,86 @@ +From 2b049a10e2c77c22d1af9033325e961183fc0be0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2024 18:36:26 +0000 +Subject: lockdep: Fix upper limit for LOCKDEP_*_BITS configs + +From: Carlos Llamas + +[ Upstream commit e638072e61726cae363d48812815197a2a0e097f ] + +Lockdep has a set of configs used to determine the size of the static +arrays that it uses. However, the upper limit that was initially setup +for these configs is too high (30 bit shift). This equates to several +GiB of static memory for individual symbols. Using such high values +leads to linker errors: + + $ make defconfig + $ ./scripts/config -e PROVE_LOCKING --set-val LOCKDEP_BITS 30 + $ make olddefconfig all + [...] + ld: kernel image bigger than KERNEL_IMAGE_SIZE + ld: section .bss VMA wraps around address space + +Adjust the upper limits to the maximum values that avoid these issues. +The need for anything more, likely points to a problem elsewhere. Note +that LOCKDEP_CHAINS_BITS was intentionally left out as its upper limit +had a different symptom and has already been fixed [1]. + +Reported-by: J. R. Okajima +Closes: https://lore.kernel.org/all/30795.1620913191@jrobl/ [1] +Cc: Peter Zijlstra +Cc: Boqun Feng +Cc: Ingo Molnar +Cc: Waiman Long +Cc: Will Deacon +Acked-by: Waiman Long +Signed-off-by: Carlos Llamas +Signed-off-by: Boqun Feng +Link: https://lore.kernel.org/r/20241024183631.643450-2-cmllamas@google.com +Signed-off-by: Sasha Levin +--- + lib/Kconfig.debug | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug +index f3d7237058793..bc725add84f46 100644 +--- a/lib/Kconfig.debug ++++ b/lib/Kconfig.debug +@@ -1504,7 +1504,7 @@ config LOCKDEP_SMALL + config LOCKDEP_BITS + int "Bitsize for MAX_LOCKDEP_ENTRIES" + depends on LOCKDEP && !LOCKDEP_SMALL +- range 10 30 ++ range 10 24 + default 15 + help + Try increasing this value if you hit "BUG: MAX_LOCKDEP_ENTRIES too low!" message. +@@ -1520,7 +1520,7 @@ config LOCKDEP_CHAINS_BITS + config LOCKDEP_STACK_TRACE_BITS + int "Bitsize for MAX_STACK_TRACE_ENTRIES" + depends on LOCKDEP && !LOCKDEP_SMALL +- range 10 30 ++ range 10 26 + default 19 + help + Try increasing this value if you hit "BUG: MAX_STACK_TRACE_ENTRIES too low!" message. +@@ -1528,7 +1528,7 @@ config LOCKDEP_STACK_TRACE_BITS + config LOCKDEP_STACK_TRACE_HASH_BITS + int "Bitsize for STACK_TRACE_HASH_SIZE" + depends on LOCKDEP && !LOCKDEP_SMALL +- range 10 30 ++ range 10 26 + default 14 + help + Try increasing this value if you need large STACK_TRACE_HASH_SIZE. +@@ -1536,7 +1536,7 @@ config LOCKDEP_STACK_TRACE_HASH_BITS + config LOCKDEP_CIRCULAR_QUEUE_BITS + int "Bitsize for elements in circular_queue struct" + depends on LOCKDEP +- range 10 30 ++ range 10 26 + default 12 + help + Try increasing this value if you hit "lockdep bfs error:-1" warning due to __cq_enqueue() failure. +-- +2.39.5 + diff --git a/queue-6.13/locking-ww_mutex-test-use-swap-macro.patch b/queue-6.13/locking-ww_mutex-test-use-swap-macro.patch new file mode 100644 index 0000000000..9b703d53b7 --- /dev/null +++ b/queue-6.13/locking-ww_mutex-test-use-swap-macro.patch @@ -0,0 +1,61 @@ +From f9cb8b9493c42cd975ae75aef4d854c8420245df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2024 15:58:51 +0200 +Subject: locking/ww_mutex/test: Use swap() macro + +From: Thorsten Blum + +[ Upstream commit 0d3547df6934b8f9600630322799a2a76b4567d8 ] + +Fixes the following Coccinelle/coccicheck warning reported by +swap.cocci: + + WARNING opportunity for swap() + +Compile-tested only. + +[Boqun: Add the report tags from Jiapeng and Abaci Robot [1].] + +Reported-by: Abaci Robot +Reported-by: Jiapeng Chong +Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=11531 +Link: https://lore.kernel.org/r/20241025081455.55089-1-jiapeng.chong@linux.alibaba.com [1] +Acked-by: Waiman Long +Signed-off-by: Thorsten Blum +Signed-off-by: Boqun Feng +Link: https://lore.kernel.org/r/20240731135850.81018-2-thorsten.blum@toblux.com +Signed-off-by: Sasha Levin +--- + kernel/locking/test-ww_mutex.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c +index 5d58b2c0ef98b..bcb1b9fea5880 100644 +--- a/kernel/locking/test-ww_mutex.c ++++ b/kernel/locking/test-ww_mutex.c +@@ -404,7 +404,7 @@ static inline u32 prandom_u32_below(u32 ceil) + static int *get_random_order(int count) + { + int *order; +- int n, r, tmp; ++ int n, r; + + order = kmalloc_array(count, sizeof(*order), GFP_KERNEL); + if (!order) +@@ -415,11 +415,8 @@ static int *get_random_order(int count) + + for (n = count - 1; n > 1; n--) { + r = prandom_u32_below(n + 1); +- if (r != n) { +- tmp = order[n]; +- order[n] = order[r]; +- order[r] = tmp; +- } ++ if (r != n) ++ swap(order[n], order[r]); + } + + return order; +-- +2.39.5 + diff --git a/queue-6.13/mfd-lpc_ich-add-another-gemini-lake-isa-bridge-pci-d.patch b/queue-6.13/mfd-lpc_ich-add-another-gemini-lake-isa-bridge-pci-d.patch new file mode 100644 index 0000000000..87d74d5974 --- /dev/null +++ b/queue-6.13/mfd-lpc_ich-add-another-gemini-lake-isa-bridge-pci-d.patch @@ -0,0 +1,42 @@ +From f0a71905fc16048d04d4ec1a2fd62d8dd515d358 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2024 20:38:08 +0100 +Subject: mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id + +From: Hans de Goede + +[ Upstream commit 1e89d21f8189d286f80b900e1b7cf57cb1f3037e ] + +On N4100 / N4120 Gemini Lake SoCs the ISA bridge PCI device-id is 31e8 +rather the 3197 found on e.g. the N4000 / N4020. + +While at fix the existing GLK PCI-id table entry breaking the table +being sorted by device-id. + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20241114193808.110132-1-hdegoede@redhat.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/lpc_ich.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c +index f14901660147f..4b7d0cb9340f1 100644 +--- a/drivers/mfd/lpc_ich.c ++++ b/drivers/mfd/lpc_ich.c +@@ -834,8 +834,9 @@ static const struct pci_device_id lpc_ich_ids[] = { + { PCI_VDEVICE(INTEL, 0x2917), LPC_ICH9ME}, + { PCI_VDEVICE(INTEL, 0x2918), LPC_ICH9}, + { PCI_VDEVICE(INTEL, 0x2919), LPC_ICH9M}, +- { PCI_VDEVICE(INTEL, 0x3197), LPC_GLK}, + { PCI_VDEVICE(INTEL, 0x2b9c), LPC_COUGARMOUNTAIN}, ++ { PCI_VDEVICE(INTEL, 0x3197), LPC_GLK}, ++ { PCI_VDEVICE(INTEL, 0x31e8), LPC_GLK}, + { PCI_VDEVICE(INTEL, 0x3a14), LPC_ICH10DO}, + { PCI_VDEVICE(INTEL, 0x3a16), LPC_ICH10R}, + { PCI_VDEVICE(INTEL, 0x3a18), LPC_ICH10}, +-- +2.39.5 + diff --git a/queue-6.13/mmc-core-respect-quirk_max_rate-for-non-uhs-sdio-car.patch b/queue-6.13/mmc-core-respect-quirk_max_rate-for-non-uhs-sdio-car.patch new file mode 100644 index 0000000000..e673d18081 --- /dev/null +++ b/queue-6.13/mmc-core-respect-quirk_max_rate-for-non-uhs-sdio-car.patch @@ -0,0 +1,37 @@ +From f6a4a7fa02c2f37dcea706ec8ecb75eb810a5c12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Nov 2024 17:37:22 +0800 +Subject: mmc: core: Respect quirk_max_rate for non-UHS SDIO card + +From: Shawn Lin + +[ Upstream commit a2a44f8da29352f76c99c6904ee652911b8dc7dd ] + +The card-quirk was added to limit the clock-rate for a card with UHS-mode +support, although let's respect the quirk for non-UHS mode too, to make the +behaviour consistent. + +Signed-off-by: Shawn Lin +Message-ID: <1732268242-72799-1-git-send-email-shawn.lin@rock-chips.com> +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/sdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c +index 9566837c9848e..4b19b8a16b096 100644 +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -458,6 +458,8 @@ static unsigned mmc_sdio_get_max_clock(struct mmc_card *card) + if (mmc_card_sd_combo(card)) + max_dtr = min(max_dtr, mmc_sd_get_max_clock(card)); + ++ max_dtr = min_not_zero(max_dtr, card->quirk_max_rate); ++ + return max_dtr; + } + +-- +2.39.5 + diff --git a/queue-6.13/mmc-sdhci-esdhc-imx-enable-sdhci_quirk_no_led-quirk-.patch b/queue-6.13/mmc-sdhci-esdhc-imx-enable-sdhci_quirk_no_led-quirk-.patch new file mode 100644 index 0000000000..51716841ce --- /dev/null +++ b/queue-6.13/mmc-sdhci-esdhc-imx-enable-sdhci_quirk_no_led-quirk-.patch @@ -0,0 +1,38 @@ +From e2ba891a5a740a3ccafbef4b5697e1122e2abc68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 10:33:56 +0200 +Subject: mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G + +From: Ciprian Marian Costea + +[ Upstream commit 0202dfbdc5dea70e213205aa42ab49a1a08aad3a ] + +Enable SDHCI_QUIRK_NO_LED quirk for S32G2/S32G3 variants as the controller +does not have a LED signal line. + +Signed-off-by: Ciprian Marian Costea +Reviewed-by: Frank Li +Acked-by: Adrian Hunter +Reviewed-by: Haibo Chen +Message-ID: <20241125083357.1041949-1-ciprianmarian.costea@oss.nxp.com> +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-esdhc-imx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index d55d045ef2363..e23177ea9d916 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -304,6 +304,7 @@ static struct esdhc_soc_data usdhc_s32g2_data = { + | ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200 + | ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES + | ESDHC_FLAG_SKIP_ERR004536 | ESDHC_FLAG_SKIP_CD_WAKE, ++ .quirks = SDHCI_QUIRK_NO_LED, + }; + + static struct esdhc_soc_data usdhc_imx7ulp_data = { +-- +2.39.5 + diff --git a/queue-6.13/mmc-sdhci-msm-correctly-set-the-load-for-the-regulat.patch b/queue-6.13/mmc-sdhci-msm-correctly-set-the-load-for-the-regulat.patch new file mode 100644 index 0000000000..27f1ce50f5 --- /dev/null +++ b/queue-6.13/mmc-sdhci-msm-correctly-set-the-load-for-the-regulat.patch @@ -0,0 +1,122 @@ +From ac478c2c52c37dfa77bcb61c6d9345dde558267d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 16:35:14 +0800 +Subject: mmc: sdhci-msm: Correctly set the load for the regulator + +From: Yuanjie Yang + +[ Upstream commit 20a0c37e44063997391430c4ae09973e9cbc3911 ] + +Qualcomm regulator supports two power supply modes: HPM and LPM. +Currently, the sdhci-msm.c driver does not set the load to adjust +the current for eMMC and SD. If the regulator dont't set correct +load in LPM state, it will lead to the inability to properly +initialize eMMC and SD. + +Set the correct regulator current for eMMC and SD to ensure that the +device can work normally even when the regulator is in LPM. + +Signed-off-by: Yuanjie Yang +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250114083514.258379-1-quic_yuanjiey@quicinc.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-msm.c | 53 ++++++++++++++++++++++++++++++++++-- + 1 file changed, 51 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c +index 319f0ebbe652d..1fcaaf683d68c 100644 +--- a/drivers/mmc/host/sdhci-msm.c ++++ b/drivers/mmc/host/sdhci-msm.c +@@ -134,9 +134,18 @@ + /* Timeout value to avoid infinite waiting for pwr_irq */ + #define MSM_PWR_IRQ_TIMEOUT_MS 5000 + ++/* Max load for eMMC Vdd supply */ ++#define MMC_VMMC_MAX_LOAD_UA 570000 ++ + /* Max load for eMMC Vdd-io supply */ + #define MMC_VQMMC_MAX_LOAD_UA 325000 + ++/* Max load for SD Vdd supply */ ++#define SD_VMMC_MAX_LOAD_UA 800000 ++ ++/* Max load for SD Vdd-io supply */ ++#define SD_VQMMC_MAX_LOAD_UA 22000 ++ + #define msm_host_readl(msm_host, host, offset) \ + msm_host->var_ops->msm_readl_relaxed(host, offset) + +@@ -1403,11 +1412,48 @@ static int sdhci_msm_set_pincfg(struct sdhci_msm_host *msm_host, bool level) + return ret; + } + +-static int sdhci_msm_set_vmmc(struct mmc_host *mmc) ++static void msm_config_vmmc_regulator(struct mmc_host *mmc, bool hpm) ++{ ++ int load; ++ ++ if (!hpm) ++ load = 0; ++ else if (!mmc->card) ++ load = max(MMC_VMMC_MAX_LOAD_UA, SD_VMMC_MAX_LOAD_UA); ++ else if (mmc_card_mmc(mmc->card)) ++ load = MMC_VMMC_MAX_LOAD_UA; ++ else if (mmc_card_sd(mmc->card)) ++ load = SD_VMMC_MAX_LOAD_UA; ++ else ++ return; ++ ++ regulator_set_load(mmc->supply.vmmc, load); ++} ++ ++static void msm_config_vqmmc_regulator(struct mmc_host *mmc, bool hpm) ++{ ++ int load; ++ ++ if (!hpm) ++ load = 0; ++ else if (!mmc->card) ++ load = max(MMC_VQMMC_MAX_LOAD_UA, SD_VQMMC_MAX_LOAD_UA); ++ else if (mmc_card_sd(mmc->card)) ++ load = SD_VQMMC_MAX_LOAD_UA; ++ else ++ return; ++ ++ regulator_set_load(mmc->supply.vqmmc, load); ++} ++ ++static int sdhci_msm_set_vmmc(struct sdhci_msm_host *msm_host, ++ struct mmc_host *mmc, bool hpm) + { + if (IS_ERR(mmc->supply.vmmc)) + return 0; + ++ msm_config_vmmc_regulator(mmc, hpm); ++ + return mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, mmc->ios.vdd); + } + +@@ -1420,6 +1466,8 @@ static int msm_toggle_vqmmc(struct sdhci_msm_host *msm_host, + if (msm_host->vqmmc_enabled == level) + return 0; + ++ msm_config_vqmmc_regulator(mmc, level); ++ + if (level) { + /* Set the IO voltage regulator to default voltage level */ + if (msm_host->caps_0 & CORE_3_0V_SUPPORT) +@@ -1642,7 +1690,8 @@ static void sdhci_msm_handle_pwr_irq(struct sdhci_host *host, int irq) + } + + if (pwr_state) { +- ret = sdhci_msm_set_vmmc(mmc); ++ ret = sdhci_msm_set_vmmc(msm_host, mmc, ++ pwr_state & REQ_BUS_ON); + if (!ret) + ret = sdhci_msm_set_vqmmc(msm_host, mmc, + pwr_state & REQ_BUS_ON); +-- +2.39.5 + diff --git a/queue-6.13/net-ethernet-ti-am65-cpsw-ensure-proper-channel-clea.patch b/queue-6.13/net-ethernet-ti-am65-cpsw-ensure-proper-channel-clea.patch new file mode 100644 index 0000000000..1730876439 --- /dev/null +++ b/queue-6.13/net-ethernet-ti-am65-cpsw-ensure-proper-channel-clea.patch @@ -0,0 +1,230 @@ +From 46a1002114554930b36c4e7ff09330223509b288 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 16:06:33 +0200 +Subject: net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error + path + +From: Roger Quadros + +[ Upstream commit 681eb2beb3efe21e630bcc4881595e3b42dd7948 ] + +We are missing netif_napi_del() and am65_cpsw_nuss_free_tx/rx_chns() +in error path when am65_cpsw_nuss_init_tx/rx_chns() is used anywhere +other than at probe(). i.e. am65_cpsw_nuss_update_tx_rx_chns and +am65_cpsw_nuss_resume() + +As reported, in am65_cpsw_nuss_update_tx_rx_chns(), +if am65_cpsw_nuss_init_tx_chns() partially fails then +devm_add_action(dev, am65_cpsw_nuss_free_tx_chns,..) is added +but the cleanup via am65_cpsw_nuss_free_tx_chns() will not run. + +Same issue exists for am65_cpsw_nuss_init_tx/rx_chns() failures +in am65_cpsw_nuss_resume() as well. + +This would otherwise require more instances of devm_add/remove_action +and is clearly more of a distraction than any benefit. + +So, drop devm_add/remove_action for am65_cpsw_nuss_free_tx/rx_chns() +and call am65_cpsw_nuss_free_tx/rx_chns() and netif_napi_del() +where required. + +Reported-by: Siddharth Vadapalli +Closes: https://lore.kernel.org/all/m4rhkzcr7dlylxr54udyt6lal5s2q4krrvmyay6gzgzhcu4q2c@r34snfumzqxy/ +Signed-off-by: Roger Quadros +Link: https://patch.msgid.link/20250117-am65-cpsw-streamline-v2-1-91a29c97e569@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 67 ++++++++++++++++-------- + 1 file changed, 44 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index e1de45fb18aee..2be2889d0646b 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -2242,8 +2242,6 @@ static void am65_cpsw_nuss_remove_tx_chns(struct am65_cpsw_common *common) + struct device *dev = common->dev; + int i; + +- devm_remove_action(dev, am65_cpsw_nuss_free_tx_chns, common); +- + common->tx_ch_rate_msk = 0; + for (i = 0; i < common->tx_ch_num; i++) { + struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i]; +@@ -2265,8 +2263,6 @@ static int am65_cpsw_nuss_ndev_add_tx_napi(struct am65_cpsw_common *common) + for (i = 0; i < common->tx_ch_num; i++) { + struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i]; + +- netif_napi_add_tx(common->dma_ndev, &tx_chn->napi_tx, +- am65_cpsw_nuss_tx_poll); + hrtimer_init(&tx_chn->tx_hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_PINNED); + tx_chn->tx_hrtimer.function = &am65_cpsw_nuss_tx_timer_callback; + +@@ -2279,9 +2275,21 @@ static int am65_cpsw_nuss_ndev_add_tx_napi(struct am65_cpsw_common *common) + tx_chn->id, tx_chn->irq, ret); + goto err; + } ++ ++ netif_napi_add_tx(common->dma_ndev, &tx_chn->napi_tx, ++ am65_cpsw_nuss_tx_poll); + } + ++ return 0; ++ + err: ++ for (--i ; i >= 0 ; i--) { ++ struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i]; ++ ++ netif_napi_del(&tx_chn->napi_tx); ++ devm_free_irq(dev, tx_chn->irq, tx_chn); ++ } ++ + return ret; + } + +@@ -2362,12 +2370,10 @@ static int am65_cpsw_nuss_init_tx_chns(struct am65_cpsw_common *common) + goto err; + } + ++ return 0; ++ + err: +- i = devm_add_action(dev, am65_cpsw_nuss_free_tx_chns, common); +- if (i) { +- dev_err(dev, "Failed to add free_tx_chns action %d\n", i); +- return i; +- } ++ am65_cpsw_nuss_free_tx_chns(common); + + return ret; + } +@@ -2395,7 +2401,6 @@ static void am65_cpsw_nuss_remove_rx_chns(struct am65_cpsw_common *common) + + rx_chn = &common->rx_chns; + flows = rx_chn->flows; +- devm_remove_action(dev, am65_cpsw_nuss_free_rx_chns, common); + + for (i = 0; i < common->rx_ch_num_flows; i++) { + if (!(flows[i].irq < 0)) +@@ -2494,7 +2499,7 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common) + i, &rx_flow_cfg); + if (ret) { + dev_err(dev, "Failed to init rx flow%d %d\n", i, ret); +- goto err; ++ goto err_flow; + } + if (!i) + fdqring_id = +@@ -2506,14 +2511,12 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common) + dev_err(dev, "Failed to get rx dma irq %d\n", + flow->irq); + ret = flow->irq; +- goto err; ++ goto err_flow; + } + + snprintf(flow->name, + sizeof(flow->name), "%s-rx%d", + dev_name(dev), i); +- netif_napi_add(common->dma_ndev, &flow->napi_rx, +- am65_cpsw_nuss_rx_poll); + hrtimer_init(&flow->rx_hrtimer, CLOCK_MONOTONIC, + HRTIMER_MODE_REL_PINNED); + flow->rx_hrtimer.function = &am65_cpsw_nuss_rx_timer_callback; +@@ -2526,20 +2529,28 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common) + dev_err(dev, "failure requesting rx %d irq %u, %d\n", + i, flow->irq, ret); + flow->irq = -EINVAL; +- goto err; ++ goto err_flow; + } ++ ++ netif_napi_add(common->dma_ndev, &flow->napi_rx, ++ am65_cpsw_nuss_rx_poll); + } + + /* setup classifier to route priorities to flows */ + cpsw_ale_classifier_setup_default(common->ale, common->rx_ch_num_flows); + +-err: +- i = devm_add_action(dev, am65_cpsw_nuss_free_rx_chns, common); +- if (i) { +- dev_err(dev, "Failed to add free_rx_chns action %d\n", i); +- return i; ++ return 0; ++ ++err_flow: ++ for (--i; i >= 0 ; i--) { ++ flow = &rx_chn->flows[i]; ++ netif_napi_del(&flow->napi_rx); ++ devm_free_irq(dev, flow->irq, flow); + } + ++err: ++ am65_cpsw_nuss_free_rx_chns(common); ++ + return ret; + } + +@@ -3349,7 +3360,7 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common) + return ret; + ret = am65_cpsw_nuss_init_rx_chns(common); + if (ret) +- return ret; ++ goto err_remove_tx; + + /* The DMA Channels are not guaranteed to be in a clean state. + * Reset and disable them to ensure that they are back to the +@@ -3370,7 +3381,7 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common) + + ret = am65_cpsw_nuss_register_devlink(common); + if (ret) +- return ret; ++ goto err_remove_rx; + + for (i = 0; i < common->port_num; i++) { + port = &common->ports[i]; +@@ -3401,6 +3412,10 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common) + err_cleanup_ndev: + am65_cpsw_nuss_cleanup_ndev(common); + am65_cpsw_unregister_devlink(common); ++err_remove_rx: ++ am65_cpsw_nuss_remove_rx_chns(common); ++err_remove_tx: ++ am65_cpsw_nuss_remove_tx_chns(common); + + return ret; + } +@@ -3420,6 +3435,8 @@ int am65_cpsw_nuss_update_tx_rx_chns(struct am65_cpsw_common *common, + return ret; + + ret = am65_cpsw_nuss_init_rx_chns(common); ++ if (ret) ++ am65_cpsw_nuss_remove_tx_chns(common); + + return ret; + } +@@ -3678,6 +3695,8 @@ static void am65_cpsw_nuss_remove(struct platform_device *pdev) + */ + am65_cpsw_nuss_cleanup_ndev(common); + am65_cpsw_unregister_devlink(common); ++ am65_cpsw_nuss_remove_rx_chns(common); ++ am65_cpsw_nuss_remove_tx_chns(common); + am65_cpsw_nuss_phylink_cleanup(common); + am65_cpts_release(common->cpts); + am65_cpsw_disable_serdes_phy(common); +@@ -3739,8 +3758,10 @@ static int am65_cpsw_nuss_resume(struct device *dev) + if (ret) + return ret; + ret = am65_cpsw_nuss_init_rx_chns(common); +- if (ret) ++ if (ret) { ++ am65_cpsw_nuss_remove_tx_chns(common); + return ret; ++ } + + /* If RX IRQ was disabled before suspend, keep it disabled */ + for (i = 0; i < common->rx_ch_num_flows; i++) { +-- +2.39.5 + diff --git a/queue-6.13/net-mlx5-hws-change-error-flow-on-matcher-disconnect.patch b/queue-6.13/net-mlx5-hws-change-error-flow-on-matcher-disconnect.patch new file mode 100644 index 0000000000..e94832d6b3 --- /dev/null +++ b/queue-6.13/net-mlx5-hws-change-error-flow-on-matcher-disconnect.patch @@ -0,0 +1,96 @@ +From a8a1b78f5ba01a25479c9f5c11f02b73d70c5d39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 20:14:05 +0200 +Subject: net/mlx5: HWS, change error flow on matcher disconnect + +From: Yevgeny Kliteynik + +[ Upstream commit 1ce840c7a659aa53a31ef49f0271b4fd0dc10296 ] + +Currently, when firmware failure occurs during matcher disconnect flow, +the error flow of the function reconnects the matcher back and returns +an error, which continues running the calling function and eventually +frees the matcher that is being disconnected. +This leads to a case where we have a freed matcher on the matchers list, +which in turn leads to use-after-free and eventual crash. + +This patch fixes that by not trying to reconnect the matcher back when +some FW command fails during disconnect. + +Note that we're dealing here with FW error. We can't overcome this +problem. This might lead to bad steering state (e.g. wrong connection +between matchers), and will also lead to resource leakage, as it is +the case with any other error handling during resource destruction. + +However, the goal here is to allow the driver to continue and not crash +the machine with use-after-free error. + +Signed-off-by: Yevgeny Kliteynik +Signed-off-by: Itamar Gozlan +Reviewed-by: Mark Bloch +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/20250102181415.1477316-7-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/steering/hws/matcher.c | 24 +++++++------------ + 1 file changed, 8 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c +index 1bb3a6f8c3cda..e94f96c0c781f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c +@@ -165,14 +165,14 @@ static int hws_matcher_disconnect(struct mlx5hws_matcher *matcher) + next->match_ste.rtc_0_id, + next->match_ste.rtc_1_id); + if (ret) { +- mlx5hws_err(tbl->ctx, "Failed to disconnect matcher\n"); +- goto matcher_reconnect; ++ mlx5hws_err(tbl->ctx, "Fatal error, failed to disconnect matcher\n"); ++ return ret; + } + } else { + ret = mlx5hws_table_connect_to_miss_table(tbl, tbl->default_miss.miss_tbl); + if (ret) { +- mlx5hws_err(tbl->ctx, "Failed to disconnect last matcher\n"); +- goto matcher_reconnect; ++ mlx5hws_err(tbl->ctx, "Fatal error, failed to disconnect last matcher\n"); ++ return ret; + } + } + +@@ -180,27 +180,19 @@ static int hws_matcher_disconnect(struct mlx5hws_matcher *matcher) + if (prev_ft_id == tbl->ft_id) { + ret = mlx5hws_table_update_connected_miss_tables(tbl); + if (ret) { +- mlx5hws_err(tbl->ctx, "Fatal error, failed to update connected miss table\n"); +- goto matcher_reconnect; ++ mlx5hws_err(tbl->ctx, ++ "Fatal error, failed to update connected miss table\n"); ++ return ret; + } + } + + ret = mlx5hws_table_ft_set_default_next_ft(tbl, prev_ft_id); + if (ret) { + mlx5hws_err(tbl->ctx, "Fatal error, failed to restore matcher ft default miss\n"); +- goto matcher_reconnect; ++ return ret; + } + + return 0; +- +-matcher_reconnect: +- if (list_empty(&tbl->matchers_list) || !prev) +- list_add(&matcher->list_node, &tbl->matchers_list); +- else +- /* insert after prev matcher */ +- list_add(&matcher->list_node, &prev->list_node); +- +- return ret; + } + + static void hws_matcher_set_rtc_attr_sz(struct mlx5hws_matcher *matcher, +-- +2.39.5 + diff --git a/queue-6.13/net-mlx5-hws-num_of_rules-counter-on-matcher-should-.patch b/queue-6.13/net-mlx5-hws-num_of_rules-counter-on-matcher-should-.patch new file mode 100644 index 0000000000..2918dd626b --- /dev/null +++ b/queue-6.13/net-mlx5-hws-num_of_rules-counter-on-matcher-should-.patch @@ -0,0 +1,116 @@ +From cfcd26dd34f49860586eb27146d76620f61d0893 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 20:14:08 +0200 +Subject: net/mlx5: HWS, num_of_rules counter on matcher should be atomic + +From: Yevgeny Kliteynik + +[ Upstream commit 61fb92701b8ac9174857c417cfa988adc24e32c2 ] + +Rule counter in matcher's struct is used in two places: + +1. As heuristics to decide when the number of rules have crossed a +certain percentage threshold and the matcher should be resized. +We don't mind here if the number will be off by 1-2 due to concurrency. + +2. When destroying matcher, the counter value is checked and the +user is warned if it is not 0. Here we lock all the queues, so the +counter will be correct. + +We don't need to always have *exact* number, but we do need this +number to not be corrupted, which is what is happening when the +counter isn't atomic, due to update by different threads. + +Signed-off-by: Yevgeny Kliteynik +Reviewed-by: Erez Shitrit +Reviewed-by: Mark Bloch +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/20250102181415.1477316-10-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/steering/hws/bwc.c | 17 +++++++++++------ + .../mellanox/mlx5/core/steering/hws/bwc.h | 2 +- + 2 files changed, 12 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c +index baacf662c0ab8..ae2849cf4dd49 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c +@@ -152,6 +152,8 @@ mlx5hws_bwc_matcher_create(struct mlx5hws_table *table, + if (!bwc_matcher) + return NULL; + ++ atomic_set(&bwc_matcher->num_of_rules, 0); ++ + /* Check if the required match params can be all matched + * in single STE, otherwise complex matcher is needed. + */ +@@ -199,10 +201,12 @@ int mlx5hws_bwc_matcher_destroy_simple(struct mlx5hws_bwc_matcher *bwc_matcher) + + int mlx5hws_bwc_matcher_destroy(struct mlx5hws_bwc_matcher *bwc_matcher) + { +- if (bwc_matcher->num_of_rules) ++ u32 num_of_rules = atomic_read(&bwc_matcher->num_of_rules); ++ ++ if (num_of_rules) + mlx5hws_err(bwc_matcher->matcher->tbl->ctx, + "BWC matcher destroy: matcher still has %d rules\n", +- bwc_matcher->num_of_rules); ++ num_of_rules); + + mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); + +@@ -309,7 +313,7 @@ static void hws_bwc_rule_list_add(struct mlx5hws_bwc_rule *bwc_rule, u16 idx) + { + struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; + +- bwc_matcher->num_of_rules++; ++ atomic_inc(&bwc_matcher->num_of_rules); + bwc_rule->bwc_queue_idx = idx; + list_add(&bwc_rule->list_node, &bwc_matcher->rules[idx]); + } +@@ -318,7 +322,7 @@ static void hws_bwc_rule_list_remove(struct mlx5hws_bwc_rule *bwc_rule) + { + struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; + +- bwc_matcher->num_of_rules--; ++ atomic_dec(&bwc_matcher->num_of_rules); + list_del_init(&bwc_rule->list_node); + } + +@@ -704,7 +708,8 @@ hws_bwc_matcher_rehash_size(struct mlx5hws_bwc_matcher *bwc_matcher) + * Need to check again if we really need rehash. + * If the reason for rehash was size, but not any more - skip rehash. + */ +- if (!hws_bwc_matcher_rehash_size_needed(bwc_matcher, bwc_matcher->num_of_rules)) ++ if (!hws_bwc_matcher_rehash_size_needed(bwc_matcher, ++ atomic_read(&bwc_matcher->num_of_rules))) + return 0; + + /* Now we're done all the checking - do the rehash: +@@ -797,7 +802,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, + } + + /* check if number of rules require rehash */ +- num_of_rules = bwc_matcher->num_of_rules; ++ num_of_rules = atomic_read(&bwc_matcher->num_of_rules); + + if (unlikely(hws_bwc_matcher_rehash_size_needed(bwc_matcher, num_of_rules))) { + mutex_unlock(queue_lock); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h +index 0b745968e21e1..655fa7a22d84f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h +@@ -19,7 +19,7 @@ struct mlx5hws_bwc_matcher { + u8 num_of_at; + u16 priority; + u8 size_log; +- u32 num_of_rules; /* atomically accessed */ ++ atomic_t num_of_rules; + struct list_head *rules; + }; + +-- +2.39.5 + diff --git a/queue-6.13/net-mlx5-use-do_aux_work-for-phc-overflow-checks.patch b/queue-6.13/net-mlx5-use-do_aux_work-for-phc-overflow-checks.patch new file mode 100644 index 0000000000..97bcc583bb --- /dev/null +++ b/queue-6.13/net-mlx5-use-do_aux_work-for-phc-overflow-checks.patch @@ -0,0 +1,129 @@ +From 4ae2cb0fd577818710454e95672640b62578a41e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 02:48:12 -0800 +Subject: net/mlx5: use do_aux_work for PHC overflow checks + +From: Vadim Fedorenko + +[ Upstream commit e61e6c415ba9ff2b32bb6780ce1b17d1d76238f1 ] + +The overflow_work is using system wq to do overflow checks and updates +for PHC device timecounter, which might be overhelmed by other tasks. +But there is dedicated kthread in PTP subsystem designed for such +things. This patch changes the work queue to proper align with PTP +subsystem and to avoid overloading system work queue. +The adjfine() function acts the same way as overflow check worker, +we can postpone ptp aux worker till the next overflow period after +adjfine() was called. + +Reviewed-by: Dragos Tatulea +Signed-off-by: Vadim Fedorenko +Acked-by: Tariq Toukan +Link: https://patch.msgid.link/20250107104812.380225-1-vadfed@meta.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/lib/clock.c | 24 ++++++++++--------- + include/linux/mlx5/driver.h | 1 - + 2 files changed, 13 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +index 4822d01123b45..d61a1a9297c90 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +@@ -322,17 +322,16 @@ static void mlx5_pps_out(struct work_struct *work) + } + } + +-static void mlx5_timestamp_overflow(struct work_struct *work) ++static long mlx5_timestamp_overflow(struct ptp_clock_info *ptp_info) + { +- struct delayed_work *dwork = to_delayed_work(work); + struct mlx5_core_dev *mdev; + struct mlx5_timer *timer; + struct mlx5_clock *clock; + unsigned long flags; + +- timer = container_of(dwork, struct mlx5_timer, overflow_work); +- clock = container_of(timer, struct mlx5_clock, timer); ++ clock = container_of(ptp_info, struct mlx5_clock, ptp_info); + mdev = container_of(clock, struct mlx5_core_dev, clock); ++ timer = &clock->timer; + + if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) + goto out; +@@ -343,7 +342,7 @@ static void mlx5_timestamp_overflow(struct work_struct *work) + write_sequnlock_irqrestore(&clock->lock, flags); + + out: +- schedule_delayed_work(&timer->overflow_work, timer->overflow_period); ++ return timer->overflow_period; + } + + static int mlx5_ptp_settime_real_time(struct mlx5_core_dev *mdev, +@@ -517,6 +516,7 @@ static int mlx5_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm) + timer->cycles.mult = mult; + mlx5_update_clock_info_page(mdev); + write_sequnlock_irqrestore(&clock->lock, flags); ++ ptp_schedule_worker(clock->ptp, timer->overflow_period); + + return 0; + } +@@ -852,6 +852,7 @@ static const struct ptp_clock_info mlx5_ptp_clock_info = { + .settime64 = mlx5_ptp_settime, + .enable = NULL, + .verify = NULL, ++ .do_aux_work = mlx5_timestamp_overflow, + }; + + static int mlx5_query_mtpps_pin_mode(struct mlx5_core_dev *mdev, u8 pin, +@@ -1052,12 +1053,11 @@ static void mlx5_init_overflow_period(struct mlx5_clock *clock) + do_div(ns, NSEC_PER_SEC / HZ); + timer->overflow_period = ns; + +- INIT_DELAYED_WORK(&timer->overflow_work, mlx5_timestamp_overflow); +- if (timer->overflow_period) +- schedule_delayed_work(&timer->overflow_work, 0); +- else ++ if (!timer->overflow_period) { ++ timer->overflow_period = HZ; + mlx5_core_warn(mdev, +- "invalid overflow period, overflow_work is not scheduled\n"); ++ "invalid overflow period, overflow_work is scheduled once per second\n"); ++ } + + if (clock_info) + clock_info->overflow_period = timer->overflow_period; +@@ -1172,6 +1172,9 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev) + + MLX5_NB_INIT(&clock->pps_nb, mlx5_pps_event, PPS_EVENT); + mlx5_eq_notifier_register(mdev, &clock->pps_nb); ++ ++ if (clock->ptp) ++ ptp_schedule_worker(clock->ptp, 0); + } + + void mlx5_cleanup_clock(struct mlx5_core_dev *mdev) +@@ -1188,7 +1191,6 @@ void mlx5_cleanup_clock(struct mlx5_core_dev *mdev) + } + + cancel_work_sync(&clock->pps_info.out_work); +- cancel_delayed_work_sync(&clock->timer.overflow_work); + + if (mdev->clock_info) { + free_page((unsigned long)mdev->clock_info); +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index ea48eb879a0f5..fed666c5bd163 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -691,7 +691,6 @@ struct mlx5_timer { + struct timecounter tc; + u32 nominal_c_mult; + unsigned long overflow_period; +- struct delayed_work overflow_work; + }; + + struct mlx5_clock { +-- +2.39.5 + diff --git a/queue-6.13/net-wwan-iosm-fix-hibernation-by-re-binding-the-driv.patch b/queue-6.13/net-wwan-iosm-fix-hibernation-by-re-binding-the-driv.patch new file mode 100644 index 0000000000..913abf325d --- /dev/null +++ b/queue-6.13/net-wwan-iosm-fix-hibernation-by-re-binding-the-driv.patch @@ -0,0 +1,146 @@ +From 3d577c224bf471ad63e5f9c7b72f90cbbd0d2827 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 00:33:50 +0100 +Subject: net: wwan: iosm: Fix hibernation by re-binding the driver around it + +From: Maciej S. Szmigiero + +[ Upstream commit 0b6f6593aa8c3a05f155c12fd0e7ad33a5149c31 ] + +Currently, the driver is seriously broken with respect to the +hibernation (S4): after image restore the device is back into +IPC_MEM_EXEC_STAGE_BOOT (which AFAIK means bootloader stage) and needs +full re-launch of the rest of its firmware, but the driver restore +handler treats the device as merely sleeping and just sends it a +wake-up command. + +This wake-up command times out but device nodes (/dev/wwan*) remain +accessible. +However attempting to use them causes the bootloader to crash and +enter IPC_MEM_EXEC_STAGE_CD_READY stage (which apparently means "a crash +dump is ready"). + +It seems that the device cannot be re-initialized from this crashed +stage without toggling some reset pin (on my test platform that's +apparently what the device _RST ACPI method does). + +While it would theoretically be possible to rewrite the driver to tear +down the whole MUX / IPC layers on hibernation (so the bootloader does +not crash from improper access) and then re-launch the device on +restore this would require significant refactoring of the driver +(believe me, I've tried), since there are quite a few assumptions +hard-coded in the driver about the device never being partially +de-initialized (like channels other than devlink cannot be closed, +for example). +Probably this would also need some programming guide for this hardware. + +Considering that the driver seems orphaned [1] and other people are +hitting this issue too [2] fix it by simply unbinding the PCI driver +before hibernation and re-binding it after restore, much like +USB_QUIRK_RESET_RESUME does for USB devices that exhibit a similar +problem. + +Tested on XMM7360 in HP EliteBook 855 G7 both with s2idle (which uses +the existing suspend / resume handlers) and S4 (which uses the new code). + +[1]: https://lore.kernel.org/all/c248f0b4-2114-4c61-905f-466a786bdebb@leemhuis.info/ +[2]: +https://github.com/xmm7360/xmm7360-pci/issues/211#issuecomment-1804139413 + +Reviewed-by: Sergey Ryazanov +Signed-off-by: Maciej S. Szmigiero +Link: https://patch.msgid.link/e60287ebdb0ab54c4075071b72568a40a75d0205.1736372610.git.mail@maciej.szmigiero.name +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/iosm/iosm_ipc_pcie.c | 56 ++++++++++++++++++++++++++- + 1 file changed, 55 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wwan/iosm/iosm_ipc_pcie.c b/drivers/net/wwan/iosm/iosm_ipc_pcie.c +index 04517bd3325a2..a066977af0be5 100644 +--- a/drivers/net/wwan/iosm/iosm_ipc_pcie.c ++++ b/drivers/net/wwan/iosm/iosm_ipc_pcie.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + + #include "iosm_ipc_imem.h" +@@ -18,6 +19,7 @@ MODULE_LICENSE("GPL v2"); + /* WWAN GUID */ + static guid_t wwan_acpi_guid = GUID_INIT(0xbad01b75, 0x22a8, 0x4f48, 0x87, 0x92, + 0xbd, 0xde, 0x94, 0x67, 0x74, 0x7d); ++static bool pci_registered; + + static void ipc_pcie_resources_release(struct iosm_pcie *ipc_pcie) + { +@@ -448,7 +450,6 @@ static struct pci_driver iosm_ipc_driver = { + }, + .id_table = iosm_ipc_ids, + }; +-module_pci_driver(iosm_ipc_driver); + + int ipc_pcie_addr_map(struct iosm_pcie *ipc_pcie, unsigned char *data, + size_t size, dma_addr_t *mapping, int direction) +@@ -530,3 +531,56 @@ void ipc_pcie_kfree_skb(struct iosm_pcie *ipc_pcie, struct sk_buff *skb) + IPC_CB(skb)->mapping = 0; + dev_kfree_skb(skb); + } ++ ++static int pm_notify(struct notifier_block *nb, unsigned long mode, void *_unused) ++{ ++ if (mode == PM_HIBERNATION_PREPARE || mode == PM_RESTORE_PREPARE) { ++ if (pci_registered) { ++ pci_unregister_driver(&iosm_ipc_driver); ++ pci_registered = false; ++ } ++ } else if (mode == PM_POST_HIBERNATION || mode == PM_POST_RESTORE) { ++ if (!pci_registered) { ++ int ret; ++ ++ ret = pci_register_driver(&iosm_ipc_driver); ++ if (ret) { ++ pr_err(KBUILD_MODNAME ": unable to re-register PCI driver: %d\n", ++ ret); ++ } else { ++ pci_registered = true; ++ } ++ } ++ } ++ ++ return 0; ++} ++ ++static struct notifier_block pm_notifier = { ++ .notifier_call = pm_notify, ++}; ++ ++static int __init iosm_ipc_driver_init(void) ++{ ++ int ret; ++ ++ ret = pci_register_driver(&iosm_ipc_driver); ++ if (ret) ++ return ret; ++ ++ pci_registered = true; ++ ++ register_pm_notifier(&pm_notifier); ++ ++ return 0; ++} ++module_init(iosm_ipc_driver_init); ++ ++static void __exit iosm_ipc_driver_exit(void) ++{ ++ unregister_pm_notifier(&pm_notifier); ++ ++ if (pci_registered) ++ pci_unregister_driver(&iosm_ipc_driver); ++} ++module_exit(iosm_ipc_driver_exit); +-- +2.39.5 + diff --git a/queue-6.13/nvkm-correctly-calculate-the-available-space-of-the-.patch b/queue-6.13/nvkm-correctly-calculate-the-available-space-of-the-.patch new file mode 100644 index 0000000000..94649a1595 --- /dev/null +++ b/queue-6.13/nvkm-correctly-calculate-the-available-space-of-the-.patch @@ -0,0 +1,109 @@ +From 4fa0349d4e95264a0b2caf68dd375f9d45c38e1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 00:19:21 -0700 +Subject: nvkm: correctly calculate the available space of the GSP cmdq buffer + +From: Zhi Wang + +[ Upstream commit 01ed662bdd6fce4f59c1804b334610d710d79fa0 ] + +r535_gsp_cmdq_push() waits for the available page in the GSP cmdq +buffer when handling a large RPC request. When it sees at least one +available page in the cmdq, it quits the waiting with the amount of +free buffer pages in the queue. + +Unfortunately, it always takes the [write pointer, buf_size) as +available buffer pages before rolling back and wrongly calculates the +size of the data should be copied. Thus, it can overwrite the RPC +request that GSP is currently reading, which causes GSP hang due +to corrupted RPC request: + +[ 549.209389] ------------[ cut here ]------------ +[ 549.214010] WARNING: CPU: 8 PID: 6314 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:116 r535_gsp_msgq_wait+0xd0/0x190 [nvkm] +[ 549.225678] Modules linked in: nvkm(E+) gsp_log(E) snd_seq_dummy(E) snd_hrtimer(E) snd_seq(E) snd_timer(E) snd_seq_device(E) snd(E) soundcore(E) rfkill(E) qrtr(E) vfat(E) fat(E) ipmi_ssif(E) amd_atl(E) intel_rapl_msr(E) intel_rapl_common(E) mlx5_ib(E) amd64_edac(E) edac_mce_amd(E) kvm_amd(E) ib_uverbs(E) kvm(E) ib_core(E) acpi_ipmi(E) ipmi_si(E) mxm_wmi(E) ipmi_devintf(E) rapl(E) i2c_piix4(E) wmi_bmof(E) joydev(E) ptdma(E) acpi_cpufreq(E) k10temp(E) pcspkr(E) ipmi_msghandler(E) xfs(E) libcrc32c(E) ast(E) i2c_algo_bit(E) crct10dif_pclmul(E) drm_shmem_helper(E) nvme_tcp(E) crc32_pclmul(E) ahci(E) drm_kms_helper(E) libahci(E) nvme_fabrics(E) crc32c_intel(E) nvme(E) cdc_ether(E) mlx5_core(E) nvme_core(E) usbnet(E) drm(E) libata(E) ccp(E) ghash_clmulni_intel(E) mii(E) t10_pi(E) mlxfw(E) sp5100_tco(E) psample(E) pci_hyperv_intf(E) wmi(E) dm_multipath(E) sunrpc(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) be2iscsi(E) bnx2i(E) cnic(E) uio(E) cxgb4i(E) cxgb4(E) tls(E) libcxgbi(E) libcxgb(E) qla4xxx(E) +[ 549.225752] iscsi_boot_sysfs(E) iscsi_tcp(E) libiscsi_tcp(E) libiscsi(E) scsi_transport_iscsi(E) fuse(E) [last unloaded: gsp_log(E)] +[ 549.326293] CPU: 8 PID: 6314 Comm: insmod Tainted: G E 6.9.0-rc6+ #1 +[ 549.334039] Hardware name: ASRockRack 1U1G-MILAN/N/ROMED8-NL, BIOS L3.12E 09/06/2022 +[ 549.341781] RIP: 0010:r535_gsp_msgq_wait+0xd0/0x190 [nvkm] +[ 549.347343] Code: 08 00 00 89 da c1 e2 0c 48 8d ac 11 00 10 00 00 48 8b 0c 24 48 85 c9 74 1f c1 e0 0c 4c 8d 6d 30 83 e8 30 89 01 e9 68 ff ff ff <0f> 0b 49 c7 c5 92 ff ff ff e9 5a ff ff ff ba ff ff ff ff be c0 0c +[ 549.366090] RSP: 0018:ffffacbccaaeb7d0 EFLAGS: 00010246 +[ 549.371315] RAX: 0000000000000000 RBX: 0000000000000012 RCX: 0000000000923e28 +[ 549.378451] RDX: 0000000000000000 RSI: 0000000055555554 RDI: ffffacbccaaeb730 +[ 549.385590] RBP: 0000000000000001 R08: ffff8bd14d235f70 R09: ffff8bd14d235f70 +[ 549.392721] R10: 0000000000000002 R11: ffff8bd14d233864 R12: 0000000000000020 +[ 549.399854] R13: ffffacbccaaeb818 R14: 0000000000000020 R15: ffff8bb298c67000 +[ 549.406988] FS: 00007f5179244740(0000) GS:ffff8bd14d200000(0000) knlGS:0000000000000000 +[ 549.415076] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 549.420829] CR2: 00007fa844000010 CR3: 00000001567dc005 CR4: 0000000000770ef0 +[ 549.427963] PKRU: 55555554 +[ 549.430672] Call Trace: +[ 549.433126] +[ 549.435233] ? __warn+0x7f/0x130 +[ 549.438473] ? r535_gsp_msgq_wait+0xd0/0x190 [nvkm] +[ 549.443426] ? report_bug+0x18a/0x1a0 +[ 549.447098] ? handle_bug+0x3c/0x70 +[ 549.450589] ? exc_invalid_op+0x14/0x70 +[ 549.454430] ? asm_exc_invalid_op+0x16/0x20 +[ 549.458619] ? r535_gsp_msgq_wait+0xd0/0x190 [nvkm] +[ 549.463565] r535_gsp_msg_recv+0x46/0x230 [nvkm] +[ 549.468257] r535_gsp_rpc_push+0x106/0x160 [nvkm] +[ 549.473033] r535_gsp_rpc_rm_ctrl_push+0x40/0x130 [nvkm] +[ 549.478422] nvidia_grid_init_vgpu_types+0xbc/0xe0 [nvkm] +[ 549.483899] nvidia_grid_init+0xb1/0xd0 [nvkm] +[ 549.488420] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 549.493213] nvkm_device_pci_probe+0x305/0x420 [nvkm] +[ 549.498338] local_pci_probe+0x46/0xa0 +[ 549.502096] pci_call_probe+0x56/0x170 +[ 549.505851] pci_device_probe+0x79/0xf0 +[ 549.509690] ? driver_sysfs_add+0x59/0xc0 +[ 549.513702] really_probe+0xd9/0x380 +[ 549.517282] __driver_probe_device+0x78/0x150 +[ 549.521640] driver_probe_device+0x1e/0x90 +[ 549.525746] __driver_attach+0xd2/0x1c0 +[ 549.529594] ? __pfx___driver_attach+0x10/0x10 +[ 549.534045] bus_for_each_dev+0x78/0xd0 +[ 549.537893] bus_add_driver+0x112/0x210 +[ 549.541750] driver_register+0x5c/0x120 +[ 549.545596] ? __pfx_nvkm_init+0x10/0x10 [nvkm] +[ 549.550224] do_one_initcall+0x44/0x300 +[ 549.554063] ? do_init_module+0x23/0x240 +[ 549.557989] do_init_module+0x64/0x240 + +Calculate the available buffer page before rolling back based on +the result from the waiting. + +Signed-off-by: Zhi Wang +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20241017071922.2518724-3-zhiw@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c +index bd4b5d6a7bd36..9c83bab0a5309 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c +@@ -161,7 +161,7 @@ r535_gsp_cmdq_push(struct nvkm_gsp *gsp, void *argv) + u64 *end; + u64 csum = 0; + int free, time = 1000000; +- u32 wptr, size; ++ u32 wptr, size, step; + u32 off = 0; + + argc = ALIGN(GSP_MSG_HDR_SIZE + argc, GSP_PAGE_SIZE); +@@ -195,7 +195,9 @@ r535_gsp_cmdq_push(struct nvkm_gsp *gsp, void *argv) + } + + cqe = (void *)((u8 *)gsp->shm.cmdq.ptr + 0x1000 + wptr * 0x1000); +- size = min_t(u32, argc, (gsp->cmdq.cnt - wptr) * GSP_PAGE_SIZE); ++ step = min_t(u32, free, (gsp->cmdq.cnt - wptr)); ++ size = min_t(u32, argc, step * GSP_PAGE_SIZE); ++ + memcpy(cqe, (u8 *)cmd + off, size); + + wptr += DIV_ROUND_UP(size, 0x1000); +-- +2.39.5 + diff --git a/queue-6.13/nvkm-gsp-correctly-advance-the-read-pointer-of-gsp-m.patch b/queue-6.13/nvkm-gsp-correctly-advance-the-read-pointer-of-gsp-m.patch new file mode 100644 index 0000000000..db3bb23919 --- /dev/null +++ b/queue-6.13/nvkm-gsp-correctly-advance-the-read-pointer-of-gsp-m.patch @@ -0,0 +1,158 @@ +From 18e98a7228d888c45fc89a0e7c3f92cf26f7ba57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 00:19:20 -0700 +Subject: nvkm/gsp: correctly advance the read pointer of GSP message queue + +From: Zhi Wang + +[ Upstream commit 8d9beb4aebc02c4bd09e1d39c9c5f1c68c786dbc ] + +A GSP event message consists three parts: message header, RPC header, +message body. GSP calculates the number of pages to write from the +total size of a GSP message. This behavior can be observed from the +movement of the write pointer. + +However, nvkm takes only the size of RPC header and message body as +the message size when advancing the read pointer. When handling a +two-page GSP message in the non rollback case, It wrongly takes the +message body of the previous message as the message header of the next +message. As the "message length" tends to be zero, in the calculation of +size needs to be copied (0 - size of (message header)), the size needs to +be copied will be "0xffffffxx". It also triggers a kernel panic due to a +NULL pointer error. + +[ 547.614102] msg: 00000f90: ff ff ff ff ff ff ff ff 40 d7 18 fb 8b 00 00 00 ........@....... +[ 547.622533] msg: 00000fa0: 00 00 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ +[ 547.630965] msg: 00000fb0: ff ff ff ff ff ff ff ff 00 00 00 00 ff ff ff ff ................ +[ 547.639397] msg: 00000fc0: ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ +[ 547.647832] nvkm 0000:c1:00.0: gsp: peek msg rpc fn:0 len:0x0/0xffffffffffffffe0 +[ 547.655225] nvkm 0000:c1:00.0: gsp: get msg rpc fn:0 len:0x0/0xffffffffffffffe0 +[ 547.662532] BUG: kernel NULL pointer dereference, address: 0000000000000020 +[ 547.669485] #PF: supervisor read access in kernel mode +[ 547.674624] #PF: error_code(0x0000) - not-present page +[ 547.679755] PGD 0 P4D 0 +[ 547.682294] Oops: 0000 [#1] PREEMPT SMP NOPTI +[ 547.686643] CPU: 22 PID: 322 Comm: kworker/22:1 Tainted: G E 6.9.0-rc6+ #1 +[ 547.694893] Hardware name: ASRockRack 1U1G-MILAN/N/ROMED8-NL, BIOS L3.12E 09/06/2022 +[ 547.702626] Workqueue: events r535_gsp_msgq_work [nvkm] +[ 547.707921] RIP: 0010:r535_gsp_msg_recv+0x87/0x230 [nvkm] +[ 547.713375] Code: 00 8b 70 08 48 89 e1 31 d2 4c 89 f7 e8 12 f5 ff ff 48 89 c5 48 85 c0 0f 84 cf 00 00 00 48 81 fd 00 f0 ff ff 0f 87 c4 00 00 00 <8b> 55 10 41 8b 46 30 85 d2 0f 85 f6 00 00 00 83 f8 04 76 10 ba 05 +[ 547.732119] RSP: 0018:ffffabe440f87e10 EFLAGS: 00010203 +[ 547.737335] RAX: 0000000000000010 RBX: 0000000000000008 RCX: 000000000000003f +[ 547.744461] RDX: 0000000000000000 RSI: ffffabe4480a8030 RDI: 0000000000000010 +[ 547.751585] RBP: 0000000000000010 R08: 0000000000000000 R09: ffffabe440f87bb0 +[ 547.758707] R10: ffffabe440f87dc8 R11: 0000000000000010 R12: 0000000000000000 +[ 547.765834] R13: 0000000000000000 R14: ffff9351df1e5000 R15: 0000000000000000 +[ 547.772958] FS: 0000000000000000(0000) GS:ffff93708eb00000(0000) knlGS:0000000000000000 +[ 547.781035] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 547.786771] CR2: 0000000000000020 CR3: 00000003cc220002 CR4: 0000000000770ef0 +[ 547.793896] PKRU: 55555554 +[ 547.796600] Call Trace: +[ 547.799046] +[ 547.801152] ? __die+0x20/0x70 +[ 547.804211] ? page_fault_oops+0x75/0x170 +[ 547.808221] ? print_hex_dump+0x100/0x160 +[ 547.812226] ? exc_page_fault+0x64/0x150 +[ 547.816152] ? asm_exc_page_fault+0x22/0x30 +[ 547.820341] ? r535_gsp_msg_recv+0x87/0x230 [nvkm] +[ 547.825184] r535_gsp_msgq_work+0x42/0x50 [nvkm] +[ 547.829845] process_one_work+0x196/0x3d0 +[ 547.833861] worker_thread+0x2fc/0x410 +[ 547.837613] ? __pfx_worker_thread+0x10/0x10 +[ 547.841885] kthread+0xdf/0x110 +[ 547.845031] ? __pfx_kthread+0x10/0x10 +[ 547.848775] ret_from_fork+0x30/0x50 +[ 547.852354] ? __pfx_kthread+0x10/0x10 +[ 547.856097] ret_from_fork_asm+0x1a/0x30 +[ 547.860019] +[ 547.862208] Modules linked in: nvkm(E) gsp_log(E) snd_seq_dummy(E) snd_hrtimer(E) snd_seq(E) snd_timer(E) snd_seq_device(E) snd(E) soundcore(E) rfkill(E) qrtr(E) vfat(E) fat(E) ipmi_ssif(E) amd_atl(E) intel_rapl_msr(E) intel_rapl_common(E) amd64_edac(E) mlx5_ib(E) edac_mce_amd(E) kvm_amd(E) ib_uverbs(E) kvm(E) ib_core(E) acpi_ipmi(E) ipmi_si(E) ipmi_devintf(E) mxm_wmi(E) joydev(E) rapl(E) ptdma(E) i2c_piix4(E) acpi_cpufreq(E) wmi_bmof(E) pcspkr(E) k10temp(E) ipmi_msghandler(E) xfs(E) libcrc32c(E) ast(E) i2c_algo_bit(E) drm_shmem_helper(E) crct10dif_pclmul(E) drm_kms_helper(E) ahci(E) crc32_pclmul(E) nvme_tcp(E) libahci(E) nvme(E) crc32c_intel(E) nvme_fabrics(E) cdc_ether(E) nvme_core(E) usbnet(E) mlx5_core(E) ghash_clmulni_intel(E) drm(E) libata(E) ccp(E) mii(E) t10_pi(E) mlxfw(E) sp5100_tco(E) psample(E) pci_hyperv_intf(E) wmi(E) dm_multipath(E) sunrpc(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) be2iscsi(E) bnx2i(E) cnic(E) uio(E) cxgb4i(E) cxgb4(E) tls(E) libcxgbi(E) libcxgb(E) qla4xxx(E) +[ 547.862283] iscsi_boot_sysfs(E) iscsi_tcp(E) libiscsi_tcp(E) libiscsi(E) scsi_transport_iscsi(E) fuse(E) [last unloaded: gsp_log(E)] +[ 547.962691] CR2: 0000000000000020 +[ 547.966003] ---[ end trace 0000000000000000 ]--- +[ 549.012012] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 1370499158 wd_nsec: 1370498904 +[ 549.043676] pstore: backend (erst) writing error (-28) +[ 549.050924] RIP: 0010:r535_gsp_msg_recv+0x87/0x230 [nvkm] +[ 549.056389] Code: 00 8b 70 08 48 89 e1 31 d2 4c 89 f7 e8 12 f5 ff ff 48 89 c5 48 85 c0 0f 84 cf 00 00 00 48 81 fd 00 f0 ff ff 0f 87 c4 00 00 00 <8b> 55 10 41 8b 46 30 85 d2 0f 85 f6 00 00 00 83 f8 04 76 10 ba 05 +[ 549.075138] RSP: 0018:ffffabe440f87e10 EFLAGS: 00010203 +[ 549.080361] RAX: 0000000000000010 RBX: 0000000000000008 RCX: 000000000000003f +[ 549.087484] RDX: 0000000000000000 RSI: ffffabe4480a8030 RDI: 0000000000000010 +[ 549.094609] RBP: 0000000000000010 R08: 0000000000000000 R09: ffffabe440f87bb0 +[ 549.101733] R10: ffffabe440f87dc8 R11: 0000000000000010 R12: 0000000000000000 +[ 549.108857] R13: 0000000000000000 R14: ffff9351df1e5000 R15: 0000000000000000 +[ 549.115982] FS: 0000000000000000(0000) GS:ffff93708eb00000(0000) knlGS:0000000000000000 +[ 549.124061] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 549.129807] CR2: 0000000000000020 CR3: 00000003cc220002 CR4: 0000000000770ef0 +[ 549.136940] PKRU: 55555554 +[ 549.139653] Kernel panic - not syncing: Fatal exception +[ 549.145054] Kernel Offset: 0x18c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) +[ 549.165074] ---[ end Kernel panic - not syncing: Fatal exception ]--- + +Also, nvkm wrongly advances the read pointer when handling a two-page GSP +message in the rollback case. In the rollback case, the GSP message will +be copied in two rounds. When handling a two-page GSP message, nvkm first +copies amount of (GSP_PAGE_SIZE - header) data into the buffer, then +advances the read pointer by the result of DIV_ROUND_UP(size, +GSP_PAGE_SIZE). Thus, the read pointer is advanced by 1. + +Next, nvkm copies the amount of (total size - (GSP_PAGE_SIZE - +header)) data into the buffer. The left amount of the data will be always +larger than one page since the message header is not taken into account +in the first copy. Thus, the read pointer is advanced by DIV_ROUND_UP( +size(larger than one page), GSP_PAGE_SIZE) = 2. + +In the end, the read pointer is wrongly advanced by 3 when handling a +two-page GSP message in the rollback case. + +Fix the problems by taking the total size of the message into account +when advancing the read pointer and calculate the read pointer in the end +of the all copies for the rollback case. + +BTW: the two-page GSP message can be observed in the msgq when vGPU is +enabled. + +Signed-off-by: Zhi Wang +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20241017071922.2518724-2-zhiw@nvidia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c +index d586aea308984..bd4b5d6a7bd36 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c +@@ -121,6 +121,8 @@ r535_gsp_msgq_wait(struct nvkm_gsp *gsp, u32 repc, u32 *prepc, int *ptime) + return mqe->data; + } + ++ size = ALIGN(repc + GSP_MSG_HDR_SIZE, GSP_PAGE_SIZE); ++ + msg = kvmalloc(repc, GFP_KERNEL); + if (!msg) + return ERR_PTR(-ENOMEM); +@@ -129,19 +131,15 @@ r535_gsp_msgq_wait(struct nvkm_gsp *gsp, u32 repc, u32 *prepc, int *ptime) + len = min_t(u32, repc, len); + memcpy(msg, mqe->data, len); + +- rptr += DIV_ROUND_UP(len, GSP_PAGE_SIZE); +- if (rptr == gsp->msgq.cnt) +- rptr = 0; +- + repc -= len; + + if (repc) { + mqe = (void *)((u8 *)gsp->shm.msgq.ptr + 0x1000 + 0 * 0x1000); + memcpy(msg + len, mqe, repc); +- +- rptr += DIV_ROUND_UP(repc, GSP_PAGE_SIZE); + } + ++ rptr = (rptr + DIV_ROUND_UP(size, GSP_PAGE_SIZE)) % gsp->msgq.cnt; ++ + mb(); + (*gsp->msgq.rptr) = rptr; + return msg; +-- +2.39.5 + diff --git a/queue-6.13/octeon_ep-update-tx-rx-stats-locally-for-persistence.patch b/queue-6.13/octeon_ep-update-tx-rx-stats-locally-for-persistence.patch new file mode 100644 index 0000000000..1196cf1aba --- /dev/null +++ b/queue-6.13/octeon_ep-update-tx-rx-stats-locally-for-persistence.patch @@ -0,0 +1,270 @@ +From 65ae708d056fa9b57d1c388a1313e112fc87166b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 01:46:51 -0800 +Subject: octeon_ep: update tx/rx stats locally for persistence + +From: Shinas Rasheed + +[ Upstream commit 10fad79846e49f67ad1a0a05910837125c6ca9ad ] + +Update tx/rx stats locally, so that ndo_get_stats64() +can use that and not rely on per queue resources to obtain statistics. +The latter used to cause race conditions when the device stopped. + +Signed-off-by: Shinas Rasheed +Link: https://patch.msgid.link/20250117094653.2588578-3-srasheed@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../marvell/octeon_ep/octep_ethtool.c | 41 ++++++++----------- + .../ethernet/marvell/octeon_ep/octep_main.c | 19 ++++----- + .../ethernet/marvell/octeon_ep/octep_main.h | 6 +++ + .../net/ethernet/marvell/octeon_ep/octep_rx.c | 11 ++--- + .../net/ethernet/marvell/octeon_ep/octep_rx.h | 4 +- + .../net/ethernet/marvell/octeon_ep/octep_tx.c | 7 ++-- + .../net/ethernet/marvell/octeon_ep/octep_tx.h | 4 +- + 7 files changed, 45 insertions(+), 47 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_ethtool.c b/drivers/net/ethernet/marvell/octeon_ep/octep_ethtool.c +index 4f4d581891188..a88c006ea65b7 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_ethtool.c ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_ethtool.c +@@ -150,17 +150,14 @@ octep_get_ethtool_stats(struct net_device *netdev, + iface_rx_stats, + iface_tx_stats); + +- for (q = 0; q < oct->num_oqs; q++) { +- struct octep_iq *iq = oct->iq[q]; +- struct octep_oq *oq = oct->oq[q]; +- +- tx_packets += iq->stats.instr_completed; +- tx_bytes += iq->stats.bytes_sent; +- tx_busy_errors += iq->stats.tx_busy; +- +- rx_packets += oq->stats.packets; +- rx_bytes += oq->stats.bytes; +- rx_alloc_errors += oq->stats.alloc_failures; ++ for (q = 0; q < OCTEP_MAX_QUEUES; q++) { ++ tx_packets += oct->stats_iq[q].instr_completed; ++ tx_bytes += oct->stats_iq[q].bytes_sent; ++ tx_busy_errors += oct->stats_iq[q].tx_busy; ++ ++ rx_packets += oct->stats_oq[q].packets; ++ rx_bytes += oct->stats_oq[q].bytes; ++ rx_alloc_errors += oct->stats_oq[q].alloc_failures; + } + i = 0; + data[i++] = rx_packets; +@@ -198,22 +195,18 @@ octep_get_ethtool_stats(struct net_device *netdev, + data[i++] = iface_rx_stats->err_pkts; + + /* Per Tx Queue stats */ +- for (q = 0; q < oct->num_iqs; q++) { +- struct octep_iq *iq = oct->iq[q]; +- +- data[i++] = iq->stats.instr_posted; +- data[i++] = iq->stats.instr_completed; +- data[i++] = iq->stats.bytes_sent; +- data[i++] = iq->stats.tx_busy; ++ for (q = 0; q < OCTEP_MAX_QUEUES; q++) { ++ data[i++] = oct->stats_iq[q].instr_posted; ++ data[i++] = oct->stats_iq[q].instr_completed; ++ data[i++] = oct->stats_iq[q].bytes_sent; ++ data[i++] = oct->stats_iq[q].tx_busy; + } + + /* Per Rx Queue stats */ +- for (q = 0; q < oct->num_oqs; q++) { +- struct octep_oq *oq = oct->oq[q]; +- +- data[i++] = oq->stats.packets; +- data[i++] = oq->stats.bytes; +- data[i++] = oq->stats.alloc_failures; ++ for (q = 0; q < OCTEP_MAX_QUEUES; q++) { ++ data[i++] = oct->stats_oq[q].packets; ++ data[i++] = oct->stats_oq[q].bytes; ++ data[i++] = oct->stats_oq[q].alloc_failures; + } + } + +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +index 730aa5632ccee..a89f80bac39b8 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +@@ -822,7 +822,7 @@ static inline int octep_iq_full_check(struct octep_iq *iq) + if (unlikely(IQ_INSTR_SPACE(iq) > + OCTEP_WAKE_QUEUE_THRESHOLD)) { + netif_start_subqueue(iq->netdev, iq->q_no); +- iq->stats.restart_cnt++; ++ iq->stats->restart_cnt++; + return 0; + } + +@@ -960,7 +960,7 @@ static netdev_tx_t octep_start_xmit(struct sk_buff *skb, + wmb(); + /* Ring Doorbell to notify the NIC of new packets */ + writel(iq->fill_cnt, iq->doorbell_reg); +- iq->stats.instr_posted += iq->fill_cnt; ++ iq->stats->instr_posted += iq->fill_cnt; + iq->fill_cnt = 0; + return NETDEV_TX_OK; + +@@ -991,22 +991,19 @@ static netdev_tx_t octep_start_xmit(struct sk_buff *skb, + static void octep_get_stats64(struct net_device *netdev, + struct rtnl_link_stats64 *stats) + { +- u64 tx_packets, tx_bytes, rx_packets, rx_bytes; + struct octep_device *oct = netdev_priv(netdev); ++ u64 tx_packets, tx_bytes, rx_packets, rx_bytes; + int q; + + tx_packets = 0; + tx_bytes = 0; + rx_packets = 0; + rx_bytes = 0; +- for (q = 0; q < oct->num_oqs; q++) { +- struct octep_iq *iq = oct->iq[q]; +- struct octep_oq *oq = oct->oq[q]; +- +- tx_packets += iq->stats.instr_completed; +- tx_bytes += iq->stats.bytes_sent; +- rx_packets += oq->stats.packets; +- rx_bytes += oq->stats.bytes; ++ for (q = 0; q < OCTEP_MAX_QUEUES; q++) { ++ tx_packets += oct->stats_iq[q].instr_completed; ++ tx_bytes += oct->stats_iq[q].bytes_sent; ++ rx_packets += oct->stats_oq[q].packets; ++ rx_bytes += oct->stats_oq[q].bytes; + } + stats->tx_packets = tx_packets; + stats->tx_bytes = tx_bytes; +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.h b/drivers/net/ethernet/marvell/octeon_ep/octep_main.h +index fee59e0e0138f..936b786f42816 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.h ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.h +@@ -257,11 +257,17 @@ struct octep_device { + /* Pointers to Octeon Tx queues */ + struct octep_iq *iq[OCTEP_MAX_IQ]; + ++ /* Per iq stats */ ++ struct octep_iq_stats stats_iq[OCTEP_MAX_IQ]; ++ + /* Rx queues (OQ: Output Queue) */ + u16 num_oqs; + /* Pointers to Octeon Rx queues */ + struct octep_oq *oq[OCTEP_MAX_OQ]; + ++ /* Per oq stats */ ++ struct octep_oq_stats stats_oq[OCTEP_MAX_OQ]; ++ + /* Hardware port number of the PCIe interface */ + u16 pcie_port; + +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c +index 8af75cb37c3ee..82b6b19e76b47 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c +@@ -87,7 +87,7 @@ static int octep_oq_refill(struct octep_device *oct, struct octep_oq *oq) + page = dev_alloc_page(); + if (unlikely(!page)) { + dev_err(oq->dev, "refill: rx buffer alloc failed\n"); +- oq->stats.alloc_failures++; ++ oq->stats->alloc_failures++; + break; + } + +@@ -98,7 +98,7 @@ static int octep_oq_refill(struct octep_device *oct, struct octep_oq *oq) + "OQ-%d buffer refill: DMA mapping error!\n", + oq->q_no); + put_page(page); +- oq->stats.alloc_failures++; ++ oq->stats->alloc_failures++; + break; + } + oq->buff_info[refill_idx].page = page; +@@ -134,6 +134,7 @@ static int octep_setup_oq(struct octep_device *oct, int q_no) + oq->netdev = oct->netdev; + oq->dev = &oct->pdev->dev; + oq->q_no = q_no; ++ oq->stats = &oct->stats_oq[q_no]; + oq->max_count = CFG_GET_OQ_NUM_DESC(oct->conf); + oq->ring_size_mask = oq->max_count - 1; + oq->buffer_size = CFG_GET_OQ_BUF_SIZE(oct->conf); +@@ -443,7 +444,7 @@ static int __octep_oq_process_rx(struct octep_device *oct, + if (!skb) { + octep_oq_drop_rx(oq, buff_info, + &read_idx, &desc_used); +- oq->stats.alloc_failures++; ++ oq->stats->alloc_failures++; + continue; + } + skb_reserve(skb, data_offset); +@@ -494,8 +495,8 @@ static int __octep_oq_process_rx(struct octep_device *oct, + + oq->host_read_idx = read_idx; + oq->refill_count += desc_used; +- oq->stats.packets += pkt; +- oq->stats.bytes += rx_bytes; ++ oq->stats->packets += pkt; ++ oq->stats->bytes += rx_bytes; + + return pkt; + } +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.h b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.h +index 3b08e2d560dc3..b4696c93d0e6a 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.h ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.h +@@ -186,8 +186,8 @@ struct octep_oq { + */ + u8 __iomem *pkts_sent_reg; + +- /* Statistics for this OQ. */ +- struct octep_oq_stats stats; ++ /* Pointer to statistics for this OQ. */ ++ struct octep_oq_stats *stats; + + /* Packets pending to be processed */ + u32 pkts_pending; +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_tx.c b/drivers/net/ethernet/marvell/octeon_ep/octep_tx.c +index 06851b78aa28c..08ee90013fef3 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_tx.c ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_tx.c +@@ -81,9 +81,9 @@ int octep_iq_process_completions(struct octep_iq *iq, u16 budget) + } + + iq->pkts_processed += compl_pkts; +- iq->stats.instr_completed += compl_pkts; +- iq->stats.bytes_sent += compl_bytes; +- iq->stats.sgentry_sent += compl_sg; ++ iq->stats->instr_completed += compl_pkts; ++ iq->stats->bytes_sent += compl_bytes; ++ iq->stats->sgentry_sent += compl_sg; + iq->flush_index = fi; + + netdev_tx_completed_queue(iq->netdev_q, compl_pkts, compl_bytes); +@@ -187,6 +187,7 @@ static int octep_setup_iq(struct octep_device *oct, int q_no) + iq->netdev = oct->netdev; + iq->dev = &oct->pdev->dev; + iq->q_no = q_no; ++ iq->stats = &oct->stats_iq[q_no]; + iq->max_count = CFG_GET_IQ_NUM_DESC(oct->conf); + iq->ring_size_mask = iq->max_count - 1; + iq->fill_threshold = CFG_GET_IQ_DB_MIN(oct->conf); +diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_tx.h b/drivers/net/ethernet/marvell/octeon_ep/octep_tx.h +index 875a2c34091ff..58fb39dda977c 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep/octep_tx.h ++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_tx.h +@@ -170,8 +170,8 @@ struct octep_iq { + */ + u16 flush_index; + +- /* Statistics for this input queue. */ +- struct octep_iq_stats stats; ++ /* Pointer to statistics for this input queue. */ ++ struct octep_iq_stats *stats; + + /* Pointer to the Virtual Base addr of the input ring. */ + struct octep_tx_desc_hw *desc_ring; +-- +2.39.5 + diff --git a/queue-6.13/octeon_ep_vf-update-tx-rx-stats-locally-for-persiste.patch b/queue-6.13/octeon_ep_vf-update-tx-rx-stats-locally-for-persiste.patch new file mode 100644 index 0000000000..67477b8500 --- /dev/null +++ b/queue-6.13/octeon_ep_vf-update-tx-rx-stats-locally-for-persiste.patch @@ -0,0 +1,237 @@ +From d4d6d05a8731a45a4ae169c9b25cdb6f41c16b5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 01:46:53 -0800 +Subject: octeon_ep_vf: update tx/rx stats locally for persistence + +From: Shinas Rasheed + +[ Upstream commit f84039939512e6d88b0f2f353695530f123be789 ] + +Update tx/rx stats locally, so that ndo_get_stats64() +can use that and not rely on per queue resources to obtain statistics. +The latter used to cause race conditions when the device stopped. + +Signed-off-by: Shinas Rasheed +Link: https://patch.msgid.link/20250117094653.2588578-5-srasheed@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../marvell/octeon_ep_vf/octep_vf_ethtool.c | 29 +++++++------------ + .../marvell/octeon_ep_vf/octep_vf_main.c | 17 +++++------ + .../marvell/octeon_ep_vf/octep_vf_main.h | 6 ++++ + .../marvell/octeon_ep_vf/octep_vf_rx.c | 9 +++--- + .../marvell/octeon_ep_vf/octep_vf_rx.h | 2 +- + .../marvell/octeon_ep_vf/octep_vf_tx.c | 7 +++-- + .../marvell/octeon_ep_vf/octep_vf_tx.h | 2 +- + 7 files changed, 35 insertions(+), 37 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_ethtool.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_ethtool.c +index 7b21439a315f2..d60441928ba96 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_ethtool.c ++++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_ethtool.c +@@ -114,12 +114,9 @@ static void octep_vf_get_ethtool_stats(struct net_device *netdev, + iface_tx_stats = &oct->iface_tx_stats; + iface_rx_stats = &oct->iface_rx_stats; + +- for (q = 0; q < oct->num_oqs; q++) { +- struct octep_vf_iq *iq = oct->iq[q]; +- struct octep_vf_oq *oq = oct->oq[q]; +- +- tx_busy_errors += iq->stats.tx_busy; +- rx_alloc_errors += oq->stats.alloc_failures; ++ for (q = 0; q < OCTEP_VF_MAX_QUEUES; q++) { ++ tx_busy_errors += oct->stats_iq[q].tx_busy; ++ rx_alloc_errors += oct->stats_oq[q].alloc_failures; + } + i = 0; + data[i++] = rx_alloc_errors; +@@ -134,22 +131,18 @@ static void octep_vf_get_ethtool_stats(struct net_device *netdev, + data[i++] = iface_rx_stats->dropped_octets_fifo_full; + + /* Per Tx Queue stats */ +- for (q = 0; q < oct->num_iqs; q++) { +- struct octep_vf_iq *iq = oct->iq[q]; +- +- data[i++] = iq->stats.instr_posted; +- data[i++] = iq->stats.instr_completed; +- data[i++] = iq->stats.bytes_sent; +- data[i++] = iq->stats.tx_busy; ++ for (q = 0; q < OCTEP_VF_MAX_QUEUES; q++) { ++ data[i++] = oct->stats_iq[q].instr_posted; ++ data[i++] = oct->stats_iq[q].instr_completed; ++ data[i++] = oct->stats_iq[q].bytes_sent; ++ data[i++] = oct->stats_iq[q].tx_busy; + } + + /* Per Rx Queue stats */ + for (q = 0; q < oct->num_oqs; q++) { +- struct octep_vf_oq *oq = oct->oq[q]; +- +- data[i++] = oq->stats.packets; +- data[i++] = oq->stats.bytes; +- data[i++] = oq->stats.alloc_failures; ++ data[i++] = oct->stats_oq[q].packets; ++ data[i++] = oct->stats_oq[q].bytes; ++ data[i++] = oct->stats_oq[q].alloc_failures; + } + } + +diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c +index 4c699514fd57a..18c922dd5fc64 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c ++++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c +@@ -574,7 +574,7 @@ static int octep_vf_iq_full_check(struct octep_vf_iq *iq) + * caused queues to get re-enabled after + * being stopped + */ +- iq->stats.restart_cnt++; ++ iq->stats->restart_cnt++; + fallthrough; + case 1: /* Queue left enabled, since IQ is not yet full*/ + return 0; +@@ -731,7 +731,7 @@ static netdev_tx_t octep_vf_start_xmit(struct sk_buff *skb, + /* Flush the hw descriptors before writing to doorbell */ + smp_wmb(); + writel(iq->fill_cnt, iq->doorbell_reg); +- iq->stats.instr_posted += iq->fill_cnt; ++ iq->stats->instr_posted += iq->fill_cnt; + iq->fill_cnt = 0; + return NETDEV_TX_OK; + } +@@ -786,14 +786,11 @@ static void octep_vf_get_stats64(struct net_device *netdev, + tx_bytes = 0; + rx_packets = 0; + rx_bytes = 0; +- for (q = 0; q < oct->num_oqs; q++) { +- struct octep_vf_iq *iq = oct->iq[q]; +- struct octep_vf_oq *oq = oct->oq[q]; +- +- tx_packets += iq->stats.instr_completed; +- tx_bytes += iq->stats.bytes_sent; +- rx_packets += oq->stats.packets; +- rx_bytes += oq->stats.bytes; ++ for (q = 0; q < OCTEP_VF_MAX_QUEUES; q++) { ++ tx_packets += oct->stats_iq[q].instr_completed; ++ tx_bytes += oct->stats_iq[q].bytes_sent; ++ rx_packets += oct->stats_oq[q].packets; ++ rx_bytes += oct->stats_oq[q].bytes; + } + stats->tx_packets = tx_packets; + stats->tx_bytes = tx_bytes; +diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.h b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.h +index 5769f62545cd4..1a352f41f823c 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.h ++++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.h +@@ -246,11 +246,17 @@ struct octep_vf_device { + /* Pointers to Octeon Tx queues */ + struct octep_vf_iq *iq[OCTEP_VF_MAX_IQ]; + ++ /* Per iq stats */ ++ struct octep_vf_iq_stats stats_iq[OCTEP_VF_MAX_IQ]; ++ + /* Rx queues (OQ: Output Queue) */ + u16 num_oqs; + /* Pointers to Octeon Rx queues */ + struct octep_vf_oq *oq[OCTEP_VF_MAX_OQ]; + ++ /* Per oq stats */ ++ struct octep_vf_oq_stats stats_oq[OCTEP_VF_MAX_OQ]; ++ + /* Hardware port number of the PCIe interface */ + u16 pcie_port; + +diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c +index 82821bc28634b..d70c8be3cfc40 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c ++++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c +@@ -87,7 +87,7 @@ static int octep_vf_oq_refill(struct octep_vf_device *oct, struct octep_vf_oq *o + page = dev_alloc_page(); + if (unlikely(!page)) { + dev_err(oq->dev, "refill: rx buffer alloc failed\n"); +- oq->stats.alloc_failures++; ++ oq->stats->alloc_failures++; + break; + } + +@@ -98,7 +98,7 @@ static int octep_vf_oq_refill(struct octep_vf_device *oct, struct octep_vf_oq *o + "OQ-%d buffer refill: DMA mapping error!\n", + oq->q_no); + put_page(page); +- oq->stats.alloc_failures++; ++ oq->stats->alloc_failures++; + break; + } + oq->buff_info[refill_idx].page = page; +@@ -134,6 +134,7 @@ static int octep_vf_setup_oq(struct octep_vf_device *oct, int q_no) + oq->netdev = oct->netdev; + oq->dev = &oct->pdev->dev; + oq->q_no = q_no; ++ oq->stats = &oct->stats_oq[q_no]; + oq->max_count = CFG_GET_OQ_NUM_DESC(oct->conf); + oq->ring_size_mask = oq->max_count - 1; + oq->buffer_size = CFG_GET_OQ_BUF_SIZE(oct->conf); +@@ -458,8 +459,8 @@ static int __octep_vf_oq_process_rx(struct octep_vf_device *oct, + + oq->host_read_idx = read_idx; + oq->refill_count += desc_used; +- oq->stats.packets += pkt; +- oq->stats.bytes += rx_bytes; ++ oq->stats->packets += pkt; ++ oq->stats->bytes += rx_bytes; + + return pkt; + } +diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.h b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.h +index fe46838b5200f..9e296b7d7e349 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.h ++++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.h +@@ -187,7 +187,7 @@ struct octep_vf_oq { + u8 __iomem *pkts_sent_reg; + + /* Statistics for this OQ. */ +- struct octep_vf_oq_stats stats; ++ struct octep_vf_oq_stats *stats; + + /* Packets pending to be processed */ + u32 pkts_pending; +diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.c +index 47a5c054fdb63..8180e5ce3d7ef 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.c ++++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.c +@@ -82,9 +82,9 @@ int octep_vf_iq_process_completions(struct octep_vf_iq *iq, u16 budget) + } + + iq->pkts_processed += compl_pkts; +- iq->stats.instr_completed += compl_pkts; +- iq->stats.bytes_sent += compl_bytes; +- iq->stats.sgentry_sent += compl_sg; ++ iq->stats->instr_completed += compl_pkts; ++ iq->stats->bytes_sent += compl_bytes; ++ iq->stats->sgentry_sent += compl_sg; + iq->flush_index = fi; + + netif_subqueue_completed_wake(iq->netdev, iq->q_no, compl_pkts, +@@ -186,6 +186,7 @@ static int octep_vf_setup_iq(struct octep_vf_device *oct, int q_no) + iq->netdev = oct->netdev; + iq->dev = &oct->pdev->dev; + iq->q_no = q_no; ++ iq->stats = &oct->stats_iq[q_no]; + iq->max_count = CFG_GET_IQ_NUM_DESC(oct->conf); + iq->ring_size_mask = iq->max_count - 1; + iq->fill_threshold = CFG_GET_IQ_DB_MIN(oct->conf); +diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.h b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.h +index f338b975103c3..1cede90e3a5fa 100644 +--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.h ++++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.h +@@ -129,7 +129,7 @@ struct octep_vf_iq { + u16 flush_index; + + /* Statistics for this input queue. */ +- struct octep_vf_iq_stats stats; ++ struct octep_vf_iq_stats *stats; + + /* Pointer to the Virtual Base addr of the input ring. */ + struct octep_vf_tx_desc_hw *desc_ring; +-- +2.39.5 + diff --git a/queue-6.13/platform-x86-acer-wmi-add-support-for-acer-nitro-an5.patch b/queue-6.13/platform-x86-acer-wmi-add-support-for-acer-nitro-an5.patch new file mode 100644 index 0000000000..377a59532b --- /dev/null +++ b/queue-6.13/platform-x86-acer-wmi-add-support-for-acer-nitro-an5.patch @@ -0,0 +1,48 @@ +From c7081835e287869f64ab7d9a61486ed0406b273d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 18:44:13 +0530 +Subject: platform/x86: acer-wmi: add support for Acer Nitro AN515-58 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hridesh MG + +[ Upstream commit 549fcf58cf5837d401d0de906093169b05365609 ] + +Add predator_v4 quirk for the Acer Nitro AN515-58 to enable fan speed +monitoring and platform_profile handling. + +Signed-off-by: Hridesh MG +Reviewed-by: Kurt Borja +Link: https://lore.kernel.org/r/20250113-platform_profile-v4-5-23be0dff19f1@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 3c211eee95f42..1b966b75cb979 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -578,6 +578,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = { + }, + .driver_data = &quirk_acer_travelmate_2490, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "Acer Nitro AN515-58", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Nitro AN515-58"), ++ }, ++ .driver_data = &quirk_acer_predator_v4, ++ }, + { + .callback = dmi_matched, + .ident = "Acer Predator PH315-53", +-- +2.39.5 + diff --git a/queue-6.13/platform-x86-acer-wmi-add-support-for-acer-ph14-51.patch b/queue-6.13/platform-x86-acer-wmi-add-support-for-acer-ph14-51.patch new file mode 100644 index 0000000000..cec397834f --- /dev/null +++ b/queue-6.13/platform-x86-acer-wmi-add-support-for-acer-ph14-51.patch @@ -0,0 +1,65 @@ +From 5e4faf1aee93b0cf776192aa8b353bd514d7131a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 01:16:53 +0100 +Subject: platform/x86: acer-wmi: Add support for Acer PH14-51 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 9741f9aa13f6dc3ff24e1d006b2ced5f460e6b6f ] + +Add the Acer Predator PT14-51 to acer_quirks to provide support +for the turbo button and predator_v4 hwmon interface. + +Reported-by: Rayan Margham +Closes: https://lore.kernel.org/platform-driver-x86/CACzB==6tUsCnr5musVMz-EymjTUCJfNtKzhMFYqMRU_h=kydXA@mail.gmail.com +Tested-by: Rayan Margham +Signed-off-by: Armin Wolf +Reviewed-by: Kurt Borja +Link: https://lore.kernel.org/r/20241210001657.3362-2-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index d09baa3d3d902..5cff538ee67fa 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -393,6 +393,13 @@ static struct quirk_entry quirk_acer_predator_ph315_53 = { + .gpu_fans = 1, + }; + ++static struct quirk_entry quirk_acer_predator_pt14_51 = { ++ .turbo = 1, ++ .cpu_fans = 1, ++ .gpu_fans = 1, ++ .predator_v4 = 1, ++}; ++ + static struct quirk_entry quirk_acer_predator_v4 = { + .predator_v4 = 1, + }; +@@ -600,6 +607,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = { + }, + .driver_data = &quirk_acer_predator_v4, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "Acer Predator PT14-51", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Predator PT14-51"), ++ }, ++ .driver_data = &quirk_acer_predator_pt14_51, ++ }, + { + .callback = set_force_caps, + .ident = "Acer Aspire Switch 10E SW3-016", +-- +2.39.5 + diff --git a/queue-6.13/platform-x86-acer-wmi-add-support-for-acer-predator-.patch b/queue-6.13/platform-x86-acer-wmi-add-support-for-acer-predator-.patch new file mode 100644 index 0000000000..3127681247 --- /dev/null +++ b/queue-6.13/platform-x86-acer-wmi-add-support-for-acer-predator-.patch @@ -0,0 +1,62 @@ +From b5019dac552bbeb83b4c8097d7a90364cf4bb35f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 18:56:52 +0100 +Subject: platform/x86: acer-wmi: Add support for Acer Predator PH16-72 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit c85b516b44d21e9cf751c4f73a6c235ed170d887 ] + +Add the Acer Predator PT16-72 to acer_quirks to provide support +for the turbo button and predator_v4 interfaces. + +Tested-by: Eric Johnsten +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20250107175652.3171-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 5cff538ee67fa..3c211eee95f42 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -393,6 +393,13 @@ static struct quirk_entry quirk_acer_predator_ph315_53 = { + .gpu_fans = 1, + }; + ++static struct quirk_entry quirk_acer_predator_ph16_72 = { ++ .turbo = 1, ++ .cpu_fans = 1, ++ .gpu_fans = 1, ++ .predator_v4 = 1, ++}; ++ + static struct quirk_entry quirk_acer_predator_pt14_51 = { + .turbo = 1, + .cpu_fans = 1, +@@ -598,6 +605,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = { + }, + .driver_data = &quirk_acer_predator_v4, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "Acer Predator PH16-72", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Predator PH16-72"), ++ }, ++ .driver_data = &quirk_acer_predator_ph16_72, ++ }, + { + .callback = dmi_matched, + .ident = "Acer Predator PH18-71", +-- +2.39.5 + diff --git a/queue-6.13/platform-x86-acer-wmi-ignore-ac-events.patch b/queue-6.13/platform-x86-acer-wmi-ignore-ac-events.patch new file mode 100644 index 0000000000..7df96649d9 --- /dev/null +++ b/queue-6.13/platform-x86-acer-wmi-ignore-ac-events.patch @@ -0,0 +1,53 @@ +From 8d3a489bdc47c727a7b36c61192a69cafa96fb95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jan 2025 21:17:22 +0100 +Subject: platform/x86: acer-wmi: Ignore AC events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit f6bfa25c6665f8721421ea94fe506cc22f1d4b43 ] + +On the Acer Swift SFG14-41, the events 8 - 1 and 8 - 0 are printed on +AC connect/disconnect. Ignore those events to avoid spamming the +kernel log with error messages. + +Reported-by: Farhan Anwar +Closes: https://lore.kernel.org/platform-driver-x86/2ffb529d-e7c8-4026-a3b8-120c8e7afec8@gmail.com +Tested-by: Rayan Margham +Reviewed-by: Ilpo Järvinen +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20250119201723.11102-2-W_Armin@gmx.de +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acer-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 1b966b75cb979..ac4f8ab45bdc0 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -95,6 +95,7 @@ enum acer_wmi_event_ids { + WMID_HOTKEY_EVENT = 0x1, + WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5, + WMID_GAMING_TURBO_KEY_EVENT = 0x7, ++ WMID_AC_EVENT = 0x8, + }; + + enum acer_wmi_predator_v4_sys_info_command { +@@ -2321,6 +2322,9 @@ static void acer_wmi_notify(union acpi_object *obj, void *context) + if (return_value.key_num == 0x5 && has_cap(ACER_CAP_PLATFORM_PROFILE)) + acer_thermal_profile_change(); + break; ++ case WMID_AC_EVENT: ++ /* We ignore AC events here */ ++ break; + default: + pr_warn("Unknown function number - %d - %d\n", + return_value.function, return_value.key_num); +-- +2.39.5 + diff --git a/queue-6.13/platform-x86-int3472-check-for-adev-null.patch b/queue-6.13/platform-x86-int3472-check-for-adev-null.patch new file mode 100644 index 0000000000..4b0a01dbc1 --- /dev/null +++ b/queue-6.13/platform-x86-int3472-check-for-adev-null.patch @@ -0,0 +1,60 @@ +From aeead13be369b91657eabd7d1f04de3220293611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2024 23:05:19 +0100 +Subject: platform/x86: int3472: Check for adev == NULL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit cd2fd6eab480dfc247b737cf7a3d6b009c4d0f1c ] + +Not all devices have an ACPI companion fwnode, so adev might be NULL. This +can e.g. (theoretically) happen when a user manually binds one of +the int3472 drivers to another i2c/platform device through sysfs. + +Add a check for adev not being set and return -ENODEV in that case to +avoid a possible NULL pointer deref in skl_int3472_get_acpi_buffer(). + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20241209220522.25288-1-hdegoede@redhat.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/int3472/discrete.c | 3 +++ + drivers/platform/x86/intel/int3472/tps68470.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c +index d881b2cfcdfcf..09fff213b0911 100644 +--- a/drivers/platform/x86/intel/int3472/discrete.c ++++ b/drivers/platform/x86/intel/int3472/discrete.c +@@ -336,6 +336,9 @@ static int skl_int3472_discrete_probe(struct platform_device *pdev) + struct int3472_cldb cldb; + int ret; + ++ if (!adev) ++ return -ENODEV; ++ + ret = skl_int3472_fill_cldb(adev, &cldb); + if (ret) { + dev_err(&pdev->dev, "Couldn't fill CLDB structure\n"); +diff --git a/drivers/platform/x86/intel/int3472/tps68470.c b/drivers/platform/x86/intel/int3472/tps68470.c +index 1e107fd49f828..81ac4c6919630 100644 +--- a/drivers/platform/x86/intel/int3472/tps68470.c ++++ b/drivers/platform/x86/intel/int3472/tps68470.c +@@ -152,6 +152,9 @@ static int skl_int3472_tps68470_probe(struct i2c_client *client) + int ret; + int i; + ++ if (!adev) ++ return -ENODEV; ++ + n_consumers = skl_int3472_fill_clk_pdata(&client->dev, &clk_pdata); + if (n_consumers < 0) + return n_consumers; +-- +2.39.5 + diff --git a/queue-6.13/printk-fix-signed-integer-overflow-when-defining-log.patch b/queue-6.13/printk-fix-signed-integer-overflow-when-defining-log.patch new file mode 100644 index 0000000000..a257c22abd --- /dev/null +++ b/queue-6.13/printk-fix-signed-integer-overflow-when-defining-log.patch @@ -0,0 +1,41 @@ +From cc52f0dfa0ba1c79fb02fc6e8656d5633988a7a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Sep 2024 19:36:08 +0800 +Subject: printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX + +From: Kuan-Wei Chiu + +[ Upstream commit 3d6f83df8ff2d5de84b50377e4f0d45e25311c7a ] + +Shifting 1 << 31 on a 32-bit int causes signed integer overflow, which +leads to undefined behavior. To prevent this, cast 1 to u32 before +performing the shift, ensuring well-defined behavior. + +This change explicitly avoids any potential overflow by ensuring that +the shift occurs on an unsigned 32-bit integer. + +Signed-off-by: Kuan-Wei Chiu +Acked-by: Petr Mladek +Link: https://lore.kernel.org/r/20240928113608.1438087-1-visitorckw@gmail.com +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + kernel/printk/printk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index f446a06b4da8c..07668433644b8 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -523,7 +523,7 @@ static struct latched_seq clear_seq = { + /* record buffer */ + #define LOG_ALIGN __alignof__(unsigned long) + #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT) +-#define LOG_BUF_LEN_MAX (u32)(1 << 31) ++#define LOG_BUF_LEN_MAX ((u32)1 << 31) + static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN); + static char *log_buf = __log_buf; + static u32 log_buf_len = __LOG_BUF_LEN; +-- +2.39.5 + diff --git a/queue-6.13/revert-mfd-axp20x-allow-multiple-regulators.patch b/queue-6.13/revert-mfd-axp20x-allow-multiple-regulators.patch new file mode 100644 index 0000000000..9df520ee54 --- /dev/null +++ b/queue-6.13/revert-mfd-axp20x-allow-multiple-regulators.patch @@ -0,0 +1,56 @@ +From fa4b5362220350f22cc67072848bda63d3fc3bd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 16:43:59 +0000 +Subject: Revert "mfd: axp20x: Allow multiple regulators" + +From: Andre Przywara + +[ Upstream commit b246bd32a34c1b0d80670e60e4e4102be6366191 ] + +As Chris and Vasily reported, the attempt to support multiple AXP PMICs +in one system [1] breaks some of the battery and charging functionality +on devices with AXP PMICs. The reason is that the drivers now fail to get +the correct IIO channel for the ADC component, as the current code seems +to rely on the zero-based enumeration of the regulator devices. +A fix is possible, but not trivial, as it requires some rework in the AXP +MFD driver, which cannot be fully reviewed or tested in time for the +6.13 release. + +So revert this patch for now, to avoid regressions on battery powered +devices. This patch was really only necessary for devices with two +PMICs, support for which is not mainline yet anyway, so we don't lose +any functionality. + +This reverts commit e37ec32188701efa01455b9be42a392adab06ce4. + +[1] https://lore.kernel.org/linux-sunxi/20241007001408.27249-4-andre.przywara@arm.com/ + +Reported-by: Chris Morgan +Closes: https://lore.kernel.org/linux-sunxi/675489c1.050a0220.8d73f.6e90@mx.google.com/ +Reported-by: Vasily Khoruzhick +Closes: https://lore.kernel.org/linux-sunxi/CA+E=qVf8_9gn0y=mcdKXvj2PFoHT2eF+JN=CmtTNdRGaSnpgKg@mail.gmail.com/ +Signed-off-by: Andre Przywara +Acked-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20250108164359.2609078-1-andre.przywara@arm.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/axp20x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c +index 251465a656d09..bce85a58944ac 100644 +--- a/drivers/mfd/axp20x.c ++++ b/drivers/mfd/axp20x.c +@@ -1445,7 +1445,7 @@ int axp20x_device_probe(struct axp20x_dev *axp20x) + } + } + +- ret = mfd_add_devices(axp20x->dev, PLATFORM_DEVID_AUTO, axp20x->cells, ++ ret = mfd_add_devices(axp20x->dev, PLATFORM_DEVID_NONE, axp20x->cells, + axp20x->nr_cells, NULL, 0, NULL); + + if (ret) { +-- +2.39.5 + diff --git a/queue-6.13/ring-buffer-make-reading-page-consistent-with-the-co.patch b/queue-6.13/ring-buffer-make-reading-page-consistent-with-the-co.patch new file mode 100644 index 0000000000..e7b3566d1c --- /dev/null +++ b/queue-6.13/ring-buffer-make-reading-page-consistent-with-the-co.patch @@ -0,0 +1,57 @@ +From d4d88f94612d99e7bd7681582f7544d75890d2c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jan 2025 01:26:12 +0900 +Subject: ring-buffer: Make reading page consistent with the code logic + +From: Jeongjun Park + +[ Upstream commit 6e31b759b076eebb4184117234f0c4eb9e4bc460 ] + +In the loop of __rb_map_vma(), the 's' variable is calculated from the +same logic that nr_pages is and they both come from nr_subbufs. But the +relationship is not obvious and there's a WARN_ON_ONCE() around the 's' +variable to make sure it never becomes equal to nr_subbufs within the +loop. If that happens, then the code is buggy and needs to be fixed. + +The 'page' variable is calculated from cpu_buffer->subbuf_ids[s] which is +an array of 'nr_subbufs' entries. If the code becomes buggy and 's' +becomes equal to or greater than 'nr_subbufs' then this will be an out of +bounds hit before the WARN_ON() is triggered and the code exiting safely. + +Make the 'page' initialization consistent with the code logic and assign +it after the out of bounds check. + +Link: https://lore.kernel.org/20250110162612.13983-1-aha310510@gmail.com +Signed-off-by: Jeongjun Park +[ sdr: rewrote change log ] +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 60210fb5b2110..6804ab126802b 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -7059,7 +7059,7 @@ static int __rb_map_vma(struct ring_buffer_per_cpu *cpu_buffer, + } + + while (p < nr_pages) { +- struct page *page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]); ++ struct page *page; + int off = 0; + + if (WARN_ON_ONCE(s >= nr_subbufs)) { +@@ -7067,6 +7067,8 @@ static int __rb_map_vma(struct ring_buffer_per_cpu *cpu_buffer, + goto out; + } + ++ page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]); ++ + for (; off < (1 << (subbuf_order)); off++, page++) { + if (p >= nr_pages) + break; +-- +2.39.5 + diff --git a/queue-6.13/s390-stackleak-use-exrl-instead-of-ex-in-__stackleak.patch b/queue-6.13/s390-stackleak-use-exrl-instead-of-ex-in-__stackleak.patch new file mode 100644 index 0000000000..b5d486f47b --- /dev/null +++ b/queue-6.13/s390-stackleak-use-exrl-instead-of-ex-in-__stackleak.patch @@ -0,0 +1,38 @@ +From b1e8957e6b327d590a859adf7c9ce97237132dce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 15:27:02 +0100 +Subject: s390/stackleak: Use exrl instead of ex in __stackleak_poison() + +From: Sven Schnelle + +[ Upstream commit a88c26bb8e04ee5f2678225c0130a5fbc08eef85 ] + +exrl is present in all machines currently supported, therefore prefer +it over ex. This saves one instruction and doesn't need an additional +register to hold the address of the target instruction. + +Signed-off-by: Sven Schnelle +Reviewed-by: Heiko Carstens +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/processor.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h +index 8761fd01a9f09..4f8d5592c2981 100644 +--- a/arch/s390/include/asm/processor.h ++++ b/arch/s390/include/asm/processor.h +@@ -163,8 +163,7 @@ static __always_inline void __stackleak_poison(unsigned long erase_low, + " la %[addr],256(%[addr])\n" + " brctg %[tmp],0b\n" + "1: stg %[poison],0(%[addr])\n" +- " larl %[tmp],3f\n" +- " ex %[count],0(%[tmp])\n" ++ " exrl %[count],3f\n" + " j 4f\n" + "2: stg %[poison],0(%[addr])\n" + " j 4f\n" +-- +2.39.5 + diff --git a/queue-6.13/safesetid-check-size-of-policy-writes.patch b/queue-6.13/safesetid-check-size-of-policy-writes.patch new file mode 100644 index 0000000000..7ef3f2c7aa --- /dev/null +++ b/queue-6.13/safesetid-check-size-of-policy-writes.patch @@ -0,0 +1,42 @@ +From cac16cda3cf61e1a22b8a1c7a31df6e4fa8d2b72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 10:26:57 -0800 +Subject: safesetid: check size of policy writes + +From: Leo Stone + +[ Upstream commit f09ff307c7299392f1c88f763299e24bc99811c7 ] + +syzbot attempts to write a buffer with a large size to a sysfs entry +with writes handled by handle_policy_update(), triggering a warning +in kmalloc. + +Check the size specified for write buffers before allocating. + +Reported-by: syzbot+4eb7a741b3216020043a@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=4eb7a741b3216020043a +Signed-off-by: Leo Stone +[PM: subject tweak] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/safesetid/securityfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/security/safesetid/securityfs.c b/security/safesetid/securityfs.c +index 25310468bcddf..8e1ffd70b18ab 100644 +--- a/security/safesetid/securityfs.c ++++ b/security/safesetid/securityfs.c +@@ -143,6 +143,9 @@ static ssize_t handle_policy_update(struct file *file, + char *buf, *p, *end; + int err; + ++ if (len >= KMALLOC_MAX_SIZE) ++ return -EINVAL; ++ + pol = kmalloc(sizeof(struct setid_ruleset), GFP_KERNEL); + if (!pol) + return -ENOMEM; +-- +2.39.5 + diff --git a/queue-6.13/sched-deadline-check-bandwidth-overflow-earlier-for-.patch b/queue-6.13/sched-deadline-check-bandwidth-overflow-earlier-for-.patch new file mode 100644 index 0000000000..336a0d502d --- /dev/null +++ b/queue-6.13/sched-deadline-check-bandwidth-overflow-earlier-for-.patch @@ -0,0 +1,126 @@ +From d902de6614ea6cc8b786caf2d2a2d0ae7955449d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 11:48:29 +0000 +Subject: sched/deadline: Check bandwidth overflow earlier for hotplug + +From: Juri Lelli + +[ Upstream commit 53916d5fd3c0b658de3463439dd2b7ce765072cb ] + +Currently we check for bandwidth overflow potentially due to hotplug +operations at the end of sched_cpu_deactivate(), after the cpu going +offline has already been removed from scheduling, active_mask, etc. +This can create issues for DEADLINE tasks, as there is a substantial +race window between the start of sched_cpu_deactivate() and the moment +we possibly decide to roll-back the operation if dl_bw_deactivate() +returns failure in cpuset_cpu_inactive(). An example is a throttled +task that sees its replenishment timer firing while the cpu it was +previously running on is considered offline, but before +dl_bw_deactivate() had a chance to say no and roll-back happened. + +Fix this by directly calling dl_bw_deactivate() first thing in +sched_cpu_deactivate() and do the required calculation in the former +function considering the cpu passed as an argument as offline already. + +By doing so we also simplify sched_cpu_deactivate(), as there is no need +anymore for any kind of roll-back if we fail early. + +Signed-off-by: Juri Lelli +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Phil Auld +Tested-by: Waiman Long +Link: https://lore.kernel.org/r/Zzc1DfPhbvqDDIJR@jlelli-thinkpadt14gen4.remote.csb +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 22 +++++++--------------- + kernel/sched/deadline.c | 12 ++++++++++-- + 2 files changed, 17 insertions(+), 17 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 141bbe97d7e5f..a4fc6d357e08a 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -8182,19 +8182,14 @@ static void cpuset_cpu_active(void) + cpuset_update_active_cpus(); + } + +-static int cpuset_cpu_inactive(unsigned int cpu) ++static void cpuset_cpu_inactive(unsigned int cpu) + { + if (!cpuhp_tasks_frozen) { +- int ret = dl_bw_deactivate(cpu); +- +- if (ret) +- return ret; + cpuset_update_active_cpus(); + } else { + num_cpus_frozen++; + partition_sched_domains(1, NULL, NULL); + } +- return 0; + } + + static inline void sched_smt_present_inc(int cpu) +@@ -8256,6 +8251,11 @@ int sched_cpu_deactivate(unsigned int cpu) + struct rq *rq = cpu_rq(cpu); + int ret; + ++ ret = dl_bw_deactivate(cpu); ++ ++ if (ret) ++ return ret; ++ + /* + * Remove CPU from nohz.idle_cpus_mask to prevent participating in + * load balancing when not active +@@ -8301,15 +8301,7 @@ int sched_cpu_deactivate(unsigned int cpu) + return 0; + + sched_update_numa(cpu, false); +- ret = cpuset_cpu_inactive(cpu); +- if (ret) { +- sched_smt_present_inc(cpu); +- sched_set_rq_online(rq, cpu); +- balance_push_set(cpu, false); +- set_cpu_active(cpu, true); +- sched_update_numa(cpu, true); +- return ret; +- } ++ cpuset_cpu_inactive(cpu); + sched_domains_numa_masks_clear(cpu); + return 0; + } +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index b078014273d9e..b6781ddea7650 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -3488,6 +3488,13 @@ static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw) + } + break; + case dl_bw_req_deactivate: ++ /* ++ * cpu is not off yet, but we need to do the math by ++ * considering it off already (i.e., what would happen if we ++ * turn cpu off?). ++ */ ++ cap -= arch_scale_cpu_capacity(cpu); ++ + /* + * cpu is going offline and NORMAL tasks will be moved away + * from it. We can thus discount dl_server bandwidth +@@ -3505,9 +3512,10 @@ static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw) + if (dl_b->total_bw - fair_server_bw > 0) { + /* + * Leaving at least one CPU for DEADLINE tasks seems a +- * wise thing to do. ++ * wise thing to do. As said above, cpu is not offline ++ * yet, so account for that. + */ +- if (dl_bw_cpus(cpu)) ++ if (dl_bw_cpus(cpu) - 1) + overflow = __dl_overflow(dl_b, cap, fair_server_bw, 0); + else + overflow = 1; +-- +2.39.5 + diff --git a/queue-6.13/sched-deadline-correctly-account-for-allocated-bandw.patch b/queue-6.13/sched-deadline-correctly-account-for-allocated-bandw.patch new file mode 100644 index 0000000000..c408bddcbf --- /dev/null +++ b/queue-6.13/sched-deadline-correctly-account-for-allocated-bandw.patch @@ -0,0 +1,151 @@ +From 4a75049f87443321e24f1cfc4f168e1d8512898c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2024 14:28:10 +0000 +Subject: sched/deadline: Correctly account for allocated bandwidth during + hotplug + +From: Juri Lelli + +[ Upstream commit d4742f6ed7ea6df56e381f82ba4532245fa1e561 ] + +For hotplug operations, DEADLINE needs to check that there is still enough +bandwidth left after removing the CPU that is going offline. We however +fail to do so currently. + +Restore the correct behavior by restructuring dl_bw_manage() a bit, so +that overflow conditions (not enough bandwidth left) are properly +checked. Also account for dl_server bandwidth, i.e. discount such +bandwidth in the calculation since NORMAL tasks will be anyway moved +away from the CPU as a result of the hotplug operation. + +Signed-off-by: Juri Lelli +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Phil Auld +Tested-by: Waiman Long +Link: https://lore.kernel.org/r/20241114142810.794657-3-juri.lelli@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 2 +- + kernel/sched/deadline.c | 48 +++++++++++++++++++++++++++++++++-------- + kernel/sched/sched.h | 2 +- + 3 files changed, 41 insertions(+), 11 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index ffceb5ff4c5c3..141bbe97d7e5f 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -8185,7 +8185,7 @@ static void cpuset_cpu_active(void) + static int cpuset_cpu_inactive(unsigned int cpu) + { + if (!cpuhp_tasks_frozen) { +- int ret = dl_bw_check_overflow(cpu); ++ int ret = dl_bw_deactivate(cpu); + + if (ret) + return ret; +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index d94f2ed6d1f46..b078014273d9e 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -3453,29 +3453,31 @@ int dl_cpuset_cpumask_can_shrink(const struct cpumask *cur, + } + + enum dl_bw_request { +- dl_bw_req_check_overflow = 0, ++ dl_bw_req_deactivate = 0, + dl_bw_req_alloc, + dl_bw_req_free + }; + + static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw) + { +- unsigned long flags; ++ unsigned long flags, cap; + struct dl_bw *dl_b; + bool overflow = 0; ++ u64 fair_server_bw = 0; + + rcu_read_lock_sched(); + dl_b = dl_bw_of(cpu); + raw_spin_lock_irqsave(&dl_b->lock, flags); + +- if (req == dl_bw_req_free) { ++ cap = dl_bw_capacity(cpu); ++ switch (req) { ++ case dl_bw_req_free: + __dl_sub(dl_b, dl_bw, dl_bw_cpus(cpu)); +- } else { +- unsigned long cap = dl_bw_capacity(cpu); +- ++ break; ++ case dl_bw_req_alloc: + overflow = __dl_overflow(dl_b, cap, 0, dl_bw); + +- if (req == dl_bw_req_alloc && !overflow) { ++ if (!overflow) { + /* + * We reserve space in the destination + * root_domain, as we can't fail after this point. +@@ -3484,6 +3486,34 @@ static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw) + */ + __dl_add(dl_b, dl_bw, dl_bw_cpus(cpu)); + } ++ break; ++ case dl_bw_req_deactivate: ++ /* ++ * cpu is going offline and NORMAL tasks will be moved away ++ * from it. We can thus discount dl_server bandwidth ++ * contribution as it won't need to be servicing tasks after ++ * the cpu is off. ++ */ ++ if (cpu_rq(cpu)->fair_server.dl_server) ++ fair_server_bw = cpu_rq(cpu)->fair_server.dl_bw; ++ ++ /* ++ * Not much to check if no DEADLINE bandwidth is present. ++ * dl_servers we can discount, as tasks will be moved out the ++ * offlined CPUs anyway. ++ */ ++ if (dl_b->total_bw - fair_server_bw > 0) { ++ /* ++ * Leaving at least one CPU for DEADLINE tasks seems a ++ * wise thing to do. ++ */ ++ if (dl_bw_cpus(cpu)) ++ overflow = __dl_overflow(dl_b, cap, fair_server_bw, 0); ++ else ++ overflow = 1; ++ } ++ ++ break; + } + + raw_spin_unlock_irqrestore(&dl_b->lock, flags); +@@ -3492,9 +3522,9 @@ static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw) + return overflow ? -EBUSY : 0; + } + +-int dl_bw_check_overflow(int cpu) ++int dl_bw_deactivate(int cpu) + { +- return dl_bw_manage(dl_bw_req_check_overflow, cpu, 0); ++ return dl_bw_manage(dl_bw_req_deactivate, cpu, 0); + } + + int dl_bw_alloc(int cpu, u64 dl_bw) +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index c5d67a43fe524..96d9bbba94acc 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -362,7 +362,7 @@ extern void __getparam_dl(struct task_struct *p, struct sched_attr *attr); + extern bool __checkparam_dl(const struct sched_attr *attr); + extern bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr); + extern int dl_cpuset_cpumask_can_shrink(const struct cpumask *cur, const struct cpumask *trial); +-extern int dl_bw_check_overflow(int cpu); ++extern int dl_bw_deactivate(int cpu); + extern s64 dl_scaled_delta_exec(struct rq *rq, struct sched_dl_entity *dl_se, s64 delta_exec); + /* + * SCHED_DEADLINE supports servers (nested scheduling) with the following +-- +2.39.5 + diff --git a/queue-6.13/sched-don-t-try-to-catch-up-excess-steal-time.patch b/queue-6.13/sched-don-t-try-to-catch-up-excess-steal-time.patch new file mode 100644 index 0000000000..8ef5543f11 --- /dev/null +++ b/queue-6.13/sched-don-t-try-to-catch-up-excess-steal-time.patch @@ -0,0 +1,76 @@ +From 652f56138b311888f13dbd13435a40ae75b55fd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2024 13:37:45 +0900 +Subject: sched: Don't try to catch up excess steal time. + +From: Suleiman Souhlal + +[ Upstream commit 108ad0999085df2366dd9ef437573955cb3f5586 ] + +When steal time exceeds the measured delta when updating clock_task, we +currently try to catch up the excess in future updates. +However, this results in inaccurate run times for the future things using +clock_task, in some situations, as they end up getting additional steal +time that did not actually happen. +This is because there is a window between reading the elapsed time in +update_rq_clock() and sampling the steal time in update_rq_clock_task(). +If the VCPU gets preempted between those two points, any additional +steal time is accounted to the outgoing task even though the calculated +delta did not actually contain any of that "stolen" time. +When this race happens, we can end up with steal time that exceeds the +calculated delta, and the previous code would try to catch up that excess +steal time in future clock updates, which is given to the next, +incoming task, even though it did not actually have any time stolen. + +This behavior is particularly bad when steal time can be very long, +which we've seen when trying to extend steal time to contain the duration +that the host was suspended [0]. When this happens, clock_task stays +frozen, during which the running task stays running for the whole +duration, since its run time doesn't increase. +However the race can happen even under normal operation. + +Ideally we would read the elapsed cpu time and the steal time atomically, +to prevent this race from happening in the first place, but doing so +is non-trivial. + +Since the time between those two points isn't otherwise accounted anywhere, +neither to the outgoing task nor the incoming task (because the "end of +outgoing task" and "start of incoming task" timestamps are the same), +I would argue that the right thing to do is to simply drop any excess steal +time, in order to prevent these issues. + +[0] https://lore.kernel.org/kvm/20240820043543.837914-1-suleiman@google.com/ + +Signed-off-by: Suleiman Souhlal +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20241118043745.1857272-1-suleiman@google.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index e0fd8069c60e6..ffceb5ff4c5c3 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -766,13 +766,15 @@ static void update_rq_clock_task(struct rq *rq, s64 delta) + #endif + #ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING + if (static_key_false((¶virt_steal_rq_enabled))) { +- steal = paravirt_steal_clock(cpu_of(rq)); ++ u64 prev_steal; ++ ++ steal = prev_steal = paravirt_steal_clock(cpu_of(rq)); + steal -= rq->prev_steal_time_rq; + + if (unlikely(steal > delta)) + steal = delta; + +- rq->prev_steal_time_rq += steal; ++ rq->prev_steal_time_rq = prev_steal; + delta -= steal; + } + #endif +-- +2.39.5 + diff --git a/queue-6.13/selftests-net-ipsec-fix-null-pointer-dereference-in-.patch b/queue-6.13/selftests-net-ipsec-fix-null-pointer-dereference-in-.patch new file mode 100644 index 0000000000..4fdfc3283a --- /dev/null +++ b/queue-6.13/selftests-net-ipsec-fix-null-pointer-dereference-in-.patch @@ -0,0 +1,50 @@ +From e3e2fb13ce960cef8f4d4c12523043f0d2f46212 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 09:30:37 +0800 +Subject: selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack() + +From: Liu Ye + +[ Upstream commit 3a0b7fa095212b51ed63892540c4f249991a2d74 ] + +Address Null pointer dereference / undefined behavior in rtattr_pack +(note that size is 0 in the bad case). + +Flagged by cppcheck as: + tools/testing/selftests/net/ipsec.c:230:25: warning: Possible null pointer + dereference: payload [nullPointer] + memcpy(RTA_DATA(attr), payload, size); + ^ + tools/testing/selftests/net/ipsec.c:1618:54: note: Calling function 'rtattr_pack', + 4th argument 'NULL' value is 0 + if (rtattr_pack(&req.nh, sizeof(req), XFRMA_IF_ID, NULL, 0)) { + ^ + tools/testing/selftests/net/ipsec.c:230:25: note: Null pointer dereference + memcpy(RTA_DATA(attr), payload, size); + ^ +Signed-off-by: Liu Ye + +Link: https://patch.msgid.link/20250116013037.29470-1-liuye@kylinos.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/ipsec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/ipsec.c b/tools/testing/selftests/net/ipsec.c +index be4a30a0d02ae..9b44a091802cb 100644 +--- a/tools/testing/selftests/net/ipsec.c ++++ b/tools/testing/selftests/net/ipsec.c +@@ -227,7 +227,8 @@ static int rtattr_pack(struct nlmsghdr *nh, size_t req_sz, + + attr->rta_len = RTA_LENGTH(size); + attr->rta_type = rta_type; +- memcpy(RTA_DATA(attr), payload, size); ++ if (payload) ++ memcpy(RTA_DATA(attr), payload, size); + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.13/series b/queue-6.13/series new file mode 100644 index 0000000000..bf52f12a32 --- /dev/null +++ b/queue-6.13/series @@ -0,0 +1,101 @@ +irqchip-lan966x-oic-make-config_lan966x_oic-depend-o.patch +btrfs-fix-lockdep-splat-while-merging-a-relocation-r.patch +btrfs-fix-assertion-failure-when-splitting-ordered-e.patch +btrfs-do-not-output-error-message-if-a-qgroup-has-be.patch +btrfs-fix-use-after-free-when-attempting-to-join-an-.patch +arm64-mm-ensure-adequate-huge_max_hstate.patch +exec-fix-up-proc-pid-comm-in-the-execveat-at_empty_p.patch +s390-stackleak-use-exrl-instead-of-ex-in-__stackleak.patch +btrfs-fix-data-race-when-accessing-the-inode-s-disk_.patch +btrfs-convert-bug_on-in-btrfs_reloc_cow_block-to-pro.patch +btrfs-don-t-use-btrfs_set_item_key_safe-on-raid-stri.patch +sched-don-t-try-to-catch-up-excess-steal-time.patch +sched-deadline-correctly-account-for-allocated-bandw.patch +sched-deadline-check-bandwidth-overflow-earlier-for-.patch +x86-convert-unreachable-to-bug.patch +locking-ww_mutex-test-use-swap-macro.patch +lockdep-fix-upper-limit-for-lockdep_-_bits-configs.patch +x86-amd_nb-restrict-init-function-to-amd-based-syste.patch +drm-virtio-new-fence-for-every-plane-update.patch +drm-add-panel-backlight-quirks.patch +drm-amd-display-add-support-for-minimum-backlight-qu.patch +drm-panel-backlight-quirks-add-framework-13-matte-pa.patch +drm-panel-backlight-quirks-add-framework-13-glossy-a.patch +nvkm-gsp-correctly-advance-the-read-pointer-of-gsp-m.patch +nvkm-correctly-calculate-the-available-space-of-the-.patch +drm-tests-hdmi-handle-empty-modes-in-find_preferred_.patch +drm-tests-hdmi-return-meaningful-value-from-set_conn.patch +drm-amd-display-populate-chroma-prefetch-parameters-.patch +drm-amd-display-overwriting-dualdpp-ubf-values-befor.patch +printk-fix-signed-integer-overflow-when-defining-log.patch +drm-msm-dpu-filter-out-too-wide-modes-if-no-3dmux-is.patch +drm-connector-add-mutex-to-protect-eld-from-concurre.patch +drm-bridge-anx7625-use-eld_mutex-to-protect-access-t.patch +drm-bridge-ite-it66121-use-eld_mutex-to-protect-acce.patch +drm-amd-display-use-eld_mutex-to-protect-access-to-c.patch +drm-exynos-hdmi-use-eld_mutex-to-protect-access-to-c.patch +drm-msm-dp-use-eld_mutex-to-protect-access-to-connec.patch +drm-radeon-use-eld_mutex-to-protect-access-to-connec.patch +drm-sti-hdmi-use-eld_mutex-to-protect-access-to-conn.patch +drm-vc4-hdmi-use-eld_mutex-to-protect-access-to-conn.patch +drm-amd-display-fix-mode-cutoff-in-dsc-passthrough-t.patch +drm-amdgpu-don-t-enable-sdma-4.4.5-ctxempty-interrup.patch +drm-amdkfd-queue-interrupt-work-to-different-cpu.patch +drm-bridge-it6505-change-definition-max_hdcp_down_st.patch +drm-bridge-it6505-fix-hdcp-bstatus-check.patch +drm-bridge-it6505-fix-hdcp-encryption-when-r0-ready.patch +drm-bridge-it6505-fix-hdcp-cts-compare-v-matching.patch +drm-bridge-it6505-fix-hdcp-cts-ksv-list-wait-timer.patch +safesetid-check-size-of-policy-writes.patch +drm-amd-display-increase-sanitizer-frame-larger-than.patch +drm-amd-display-limit-scaling-ratio-on-dcn3.01.patch +ring-buffer-make-reading-page-consistent-with-the-co.patch +wifi-ath12k-fix-for-out-of-bound-access-error.patch +wifi-ath12k-ath12k_mac_op_set_key-fix-uninitialized-.patch +wifi-rtw89-add-crystal_cap-check-to-avoid-setting-as.patch +tun-fix-group-permission-check.patch +mmc-core-respect-quirk_max_rate-for-non-uhs-sdio-car.patch +mmc-sdhci-esdhc-imx-enable-sdhci_quirk_no_led-quirk-.patch +wifi-brcmsmac-add-gain-range-check-to-wlc_phy_iqcal_.patch +tomoyo-don-t-emit-warning-in-tomoyo_write_control.patch +mfd-lpc_ich-add-another-gemini-lake-isa-bridge-pci-d.patch +wifi-rtw88-add-__packed-attribute-to-efuse-layout-st.patch +clk-qcom-make-gcc_8150-depend-on-qcom_gdsc.patch +net-mlx5-hws-change-error-flow-on-matcher-disconnect.patch +net-mlx5-hws-num_of_rules-counter-on-matcher-should-.patch +hid-multitouch-add-quirk-for-hantick-5288-touchpad.patch +hid-wacom-add-pci-wacom-device-support.patch +net-mlx5-use-do_aux_work-for-phc-overflow-checks.patch +revert-mfd-axp20x-allow-multiple-regulators.patch +wifi-brcmfmac-check-the-return-value-of-of_property_.patch +wifi-iwlwifi-pcie-add-support-for-new-device-ids.patch +wifi-iwlwifi-avoid-memory-leak.patch +i2c-force-elan06fa-touchpad-i2c-bus-freq-to-100khz.patch +apei-ghes-have-ghes-honor-the-panic-setting.patch +bluetooth-btusb-add-id-0x2c7c-0x0130-for-qualcomm-wc.patch +bluetooth-btusb-add-new-vid-pid-13d3-3610-for-mt7922.patch +bluetooth-btusb-add-new-vid-pid-13d3-3628-for-mt7925.patch +bluetooth-mgmt-fix-slab-use-after-free-read-in-mgmt_.patch +net-wwan-iosm-fix-hibernation-by-re-binding-the-driv.patch +hid-hid-asus-disable-oobe-mode-on-the-proart-p16.patch +mmc-sdhci-msm-correctly-set-the-load-for-the-regulat.patch +octeon_ep-update-tx-rx-stats-locally-for-persistence.patch +octeon_ep_vf-update-tx-rx-stats-locally-for-persiste.patch +tipc-re-order-conditions-in-tipc_crypto_key_rcv.patch +selftests-net-ipsec-fix-null-pointer-dereference-in-.patch +net-ethernet-ti-am65-cpsw-ensure-proper-channel-clea.patch +asoc-sof-intel-hda-dai-ensure-dai-widget-is-valid-du.patch +bpf-improve-verifier-log-for-resource-leak-on-exit.patch +x86-kexec-allocate-pgd-for-x86_64-transition-page-ta.patch +asoc-intel-sof_sdw-correct-quirk-for-lenovo-yoga-sli.patch +iommu-arm-smmu-qcom-add-sdm670-adreno-iommu-compatib.patch +iommu-arm-smmu-v3-clean-up-more-on-probe-failure.patch +platform-x86-int3472-check-for-adev-null.patch +platform-x86-acer-wmi-add-support-for-acer-ph14-51.patch +asoc-soc-pcm-don-t-use-soc_pcm_ret-on-.prepare-callb.patch +iommu-vt-d-avoid-use-of-null-after-warn_on_once.patch +platform-x86-acer-wmi-add-support-for-acer-predator-.patch +asoc-amd-add-acpi-dependency-to-fix-build-error.patch +input-allocate-keycode-for-phone-linking.patch +platform-x86-acer-wmi-add-support-for-acer-nitro-an5.patch +platform-x86-acer-wmi-ignore-ac-events.patch diff --git a/queue-6.13/tipc-re-order-conditions-in-tipc_crypto_key_rcv.patch b/queue-6.13/tipc-re-order-conditions-in-tipc_crypto_key_rcv.patch new file mode 100644 index 0000000000..bd04e7fe1b --- /dev/null +++ b/queue-6.13/tipc-re-order-conditions-in-tipc_crypto_key_rcv.patch @@ -0,0 +1,41 @@ +From caee00638635dc64df7e21ad80b26efcb275191d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 12:36:14 +0300 +Subject: tipc: re-order conditions in tipc_crypto_key_rcv() + +From: Dan Carpenter + +[ Upstream commit 5fe71fda89745fc3cd95f70d06e9162b595c3702 ] + +On a 32bit system the "keylen + sizeof(struct tipc_aead_key)" math could +have an integer wrapping issue. It doesn't matter because the "keylen" +is checked on the next line, but just to make life easier for static +analysis tools, let's re-order these conditions and avoid the integer +overflow. + +Signed-off-by: Dan Carpenter +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/crypto.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c +index 43c3f1c971b8f..c524421ec6525 100644 +--- a/net/tipc/crypto.c ++++ b/net/tipc/crypto.c +@@ -2293,8 +2293,8 @@ static bool tipc_crypto_key_rcv(struct tipc_crypto *rx, struct tipc_msg *hdr) + keylen = ntohl(*((__be32 *)(data + TIPC_AEAD_ALG_NAME))); + + /* Verify the supplied size values */ +- if (unlikely(size != keylen + sizeof(struct tipc_aead_key) || +- keylen > TIPC_AEAD_KEY_SIZE_MAX)) { ++ if (unlikely(keylen > TIPC_AEAD_KEY_SIZE_MAX || ++ size != keylen + sizeof(struct tipc_aead_key))) { + pr_debug("%s: invalid MSG_CRYPTO key size\n", rx->name); + goto exit; + } +-- +2.39.5 + diff --git a/queue-6.13/tomoyo-don-t-emit-warning-in-tomoyo_write_control.patch b/queue-6.13/tomoyo-don-t-emit-warning-in-tomoyo_write_control.patch new file mode 100644 index 0000000000..3cf656258e --- /dev/null +++ b/queue-6.13/tomoyo-don-t-emit-warning-in-tomoyo_write_control.patch @@ -0,0 +1,46 @@ +From 5aa0b88692a8a2c6d2eff879868c39f78420633a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 19:38:40 +0900 +Subject: tomoyo: don't emit warning in tomoyo_write_control() + +From: Tetsuo Handa + +[ Upstream commit 3df7546fc03b8f004eee0b9e3256369f7d096685 ] + +syzbot is reporting too large allocation warning at tomoyo_write_control(), +for one can write a very very long line without new line character. To fix +this warning, I use __GFP_NOWARN rather than checking for KMALLOC_MAX_SIZE, +for practically a valid line should be always shorter than 32KB where the +"too small to fail" memory-allocation rule applies. + +One might try to write a valid line that is longer than 32KB, but such +request will likely fail with -ENOMEM. Therefore, I feel that separately +returning -EINVAL when a line is longer than KMALLOC_MAX_SIZE is redundant. +There is no need to distinguish over-32KB and over-KMALLOC_MAX_SIZE. + +Reported-by: syzbot+7536f77535e5210a5c76@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=7536f77535e5210a5c76 +Reported-by: Leo Stone +Closes: https://lkml.kernel.org/r/20241216021459.178759-2-leocstone@gmail.com +Signed-off-by: Tetsuo Handa +Signed-off-by: Sasha Levin +--- + security/tomoyo/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c +index 5c7b059a332aa..972664962e8f6 100644 +--- a/security/tomoyo/common.c ++++ b/security/tomoyo/common.c +@@ -2665,7 +2665,7 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, + + if (head->w.avail >= head->writebuf_size - 1) { + const int len = head->writebuf_size * 2; +- char *cp = kzalloc(len, GFP_NOFS); ++ char *cp = kzalloc(len, GFP_NOFS | __GFP_NOWARN); + + if (!cp) { + error = -ENOMEM; +-- +2.39.5 + diff --git a/queue-6.13/tun-fix-group-permission-check.patch b/queue-6.13/tun-fix-group-permission-check.patch new file mode 100644 index 0000000000..4e4d7d8644 --- /dev/null +++ b/queue-6.13/tun-fix-group-permission-check.patch @@ -0,0 +1,72 @@ +From ac24e00b45fbccfbab0c11e9bb593e93e67609e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 10:36:14 +0300 +Subject: tun: fix group permission check + +From: Stas Sergeev + +[ Upstream commit 3ca459eaba1bf96a8c7878de84fa8872259a01e3 ] + +Currently tun checks the group permission even if the user have matched. +Besides going against the usual permission semantic, this has a +very interesting implication: if the tun group is not among the +supplementary groups of the tun user, then effectively no one can +access the tun device. CAP_SYS_ADMIN still can, but its the same as +not setting the tun ownership. + +This patch relaxes the group checking so that either the user match +or the group match is enough. This avoids the situation when no one +can access the device even though the ownership is properly set. + +Also I simplified the logic by removing the redundant inversions: +tun_not_capable() --> !tun_capable() + +Signed-off-by: Stas Sergeev +Reviewed-by: Willem de Bruijn +Acked-by: Jason Wang +Link: https://patch.msgid.link/20241205073614.294773-1-stsp2@yandex.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/tun.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 148c7bc66c0af..28624cca91f8d 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -574,14 +574,18 @@ static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb, + return ret; + } + +-static inline bool tun_not_capable(struct tun_struct *tun) ++static inline bool tun_capable(struct tun_struct *tun) + { + const struct cred *cred = current_cred(); + struct net *net = dev_net(tun->dev); + +- return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) || +- (gid_valid(tun->group) && !in_egroup_p(tun->group))) && +- !ns_capable(net->user_ns, CAP_NET_ADMIN); ++ if (ns_capable(net->user_ns, CAP_NET_ADMIN)) ++ return 1; ++ if (uid_valid(tun->owner) && uid_eq(cred->euid, tun->owner)) ++ return 1; ++ if (gid_valid(tun->group) && in_egroup_p(tun->group)) ++ return 1; ++ return 0; + } + + static void tun_set_real_num_queues(struct tun_struct *tun) +@@ -2778,7 +2782,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) + !!(tun->flags & IFF_MULTI_QUEUE)) + return -EINVAL; + +- if (tun_not_capable(tun)) ++ if (!tun_capable(tun)) + return -EPERM; + err = security_tun_dev_open(tun->security); + if (err < 0) +-- +2.39.5 + diff --git a/queue-6.13/wifi-ath12k-ath12k_mac_op_set_key-fix-uninitialized-.patch b/queue-6.13/wifi-ath12k-ath12k_mac_op_set_key-fix-uninitialized-.patch new file mode 100644 index 0000000000..e3c2e41c53 --- /dev/null +++ b/queue-6.13/wifi-ath12k-ath12k_mac_op_set_key-fix-uninitialized-.patch @@ -0,0 +1,119 @@ +From 011e349903026febe40ee7a2c7f1138de9d5f231 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 19:11:38 +0200 +Subject: wifi: ath12k: ath12k_mac_op_set_key(): fix uninitialized symbol 'ret' + +From: Kalle Valo + +[ Upstream commit ad969bc9ee73fa9eda6223be2a7c0c6caf937d71 ] + +Dan reported that in some cases the ret variable could be uninitialized. Fix +that by removing the out label entirely and returning zero explicitly on +succesful cases. + +Also remove the unnecessary else branches to follow more the style used in +ath12k and now it's easier to see the error handling. + +No functional changes. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/7e7afd00-ad84-4744-8d94-416bab7e7dd9@stanley.mountain/ +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20241126171139.2350704-10-kvalo@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 57 +++++++++++++++------------ + 1 file changed, 32 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index ef2736fb5f53f..e8639ad8761a2 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -4378,6 +4378,7 @@ static int ath12k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + + if (sta) { + ahsta = ath12k_sta_to_ahsta(sta); ++ + /* For an ML STA Pairwise key is same for all associated link Stations, + * hence do set key for all link STAs which are active. + */ +@@ -4400,41 +4401,47 @@ static int ath12k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + if (ret) + break; + } +- } else { +- arsta = &ahsta->deflink; +- arvif = arsta->arvif; +- if (WARN_ON(!arvif)) { +- ret = -EINVAL; +- goto out; +- } + +- ret = ath12k_mac_set_key(arvif->ar, cmd, arvif, arsta, key); +- } +- } else { +- if (key->link_id >= 0 && key->link_id < IEEE80211_MLD_MAX_NUM_LINKS) { +- link_id = key->link_id; +- arvif = wiphy_dereference(hw->wiphy, ahvif->link[link_id]); +- } else { +- link_id = 0; +- arvif = &ahvif->deflink; ++ return 0; + } + +- if (!arvif || !arvif->is_created) { +- cache = ath12k_ahvif_get_link_cache(ahvif, link_id); +- if (!cache) +- return -ENOSPC; ++ arsta = &ahsta->deflink; ++ arvif = arsta->arvif; ++ if (WARN_ON(!arvif)) ++ return -EINVAL; + +- ret = ath12k_mac_update_key_cache(cache, cmd, sta, key); ++ ret = ath12k_mac_set_key(arvif->ar, cmd, arvif, arsta, key); ++ if (ret) ++ return ret; + ++ return 0; ++ } ++ ++ if (key->link_id >= 0 && key->link_id < IEEE80211_MLD_MAX_NUM_LINKS) { ++ link_id = key->link_id; ++ arvif = wiphy_dereference(hw->wiphy, ahvif->link[link_id]); ++ } else { ++ link_id = 0; ++ arvif = &ahvif->deflink; ++ } ++ ++ if (!arvif || !arvif->is_created) { ++ cache = ath12k_ahvif_get_link_cache(ahvif, link_id); ++ if (!cache) ++ return -ENOSPC; ++ ++ ret = ath12k_mac_update_key_cache(cache, cmd, sta, key); ++ if (ret) + return ret; +- } + +- ret = ath12k_mac_set_key(arvif->ar, cmd, arvif, NULL, key); ++ return 0; + } + +-out: ++ ret = ath12k_mac_set_key(arvif->ar, cmd, arvif, NULL, key); ++ if (ret) ++ return ret; + +- return ret; ++ return 0; + } + + static int +-- +2.39.5 + diff --git a/queue-6.13/wifi-ath12k-fix-for-out-of-bound-access-error.patch b/queue-6.13/wifi-ath12k-fix-for-out-of-bound-access-error.patch new file mode 100644 index 0000000000..98590ceadb --- /dev/null +++ b/queue-6.13/wifi-ath12k-fix-for-out-of-bound-access-error.patch @@ -0,0 +1,51 @@ +From b99ebf542b5cb42da3c3df1d1127ac6fabd4852a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2024 11:11:31 +0100 +Subject: wifi: ath12k: Fix for out-of bound access error + +From: Karol Przybylski + +[ Upstream commit eb8c0534713865d190856f10bfc97cf0b88475b1 ] + +Selfgen stats are placed in a buffer using print_array_to_buf_index() function. +Array length parameter passed to the function is too big, resulting in possible +out-of bound memory error. +Decreasing buffer size by one fixes faulty upper bound of passed array. + +Discovered in coverity scan, CID 1600742 and CID 1600758 + +Signed-off-by: Karol Przybylski +Acked-by: Kalle Valo +Link: https://patch.msgid.link/20241105101132.374372-1-karprzy7@gmail.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c b/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c +index c9980c0193d1d..43ea87e981f42 100644 +--- a/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c ++++ b/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c +@@ -1562,7 +1562,8 @@ ath12k_htt_print_tx_selfgen_ac_stats_tlv(const void *tag_buf, u16 tag_len, + le32_to_cpu(htt_stats_buf->ac_mu_mimo_ndp)); + len += print_array_to_buf_index(buf, len, "ac_mu_mimo_brpollX_tried = ", 1, + htt_stats_buf->ac_mu_mimo_brpoll, +- ATH12K_HTT_TX_NUM_AC_MUMIMO_USER_STATS, "\n\n"); ++ ATH12K_HTT_TX_NUM_AC_MUMIMO_USER_STATS - 1, ++ "\n\n"); + + stats_req->buf_len = len; + } +@@ -1590,7 +1591,7 @@ ath12k_htt_print_tx_selfgen_ax_stats_tlv(const void *tag_buf, u16 tag_len, + le32_to_cpu(htt_stats_buf->ax_mu_mimo_ndp)); + len += print_array_to_buf_index(buf, len, "ax_mu_mimo_brpollX_tried = ", 1, + htt_stats_buf->ax_mu_mimo_brpoll, +- ATH12K_HTT_TX_NUM_AX_MUMIMO_USER_STATS, "\n"); ++ ATH12K_HTT_TX_NUM_AX_MUMIMO_USER_STATS - 1, "\n"); + len += scnprintf(buf + len, buf_len - len, "ax_basic_trigger = %u\n", + le32_to_cpu(htt_stats_buf->ax_basic_trigger)); + len += scnprintf(buf + len, buf_len - len, "ax_ulmumimo_total_trigger = %u\n", +-- +2.39.5 + diff --git a/queue-6.13/wifi-brcmfmac-check-the-return-value-of-of_property_.patch b/queue-6.13/wifi-brcmfmac-check-the-return-value-of-of_property_.patch new file mode 100644 index 0000000000..c8ec01ad8c --- /dev/null +++ b/queue-6.13/wifi-brcmfmac-check-the-return-value-of-of_property_.patch @@ -0,0 +1,87 @@ +From bd7ba0077e061950763ce7cf855d161e4d66a3ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 20:09:58 +0300 +Subject: wifi: brcmfmac: Check the return value of + of_property_read_string_index() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Dösinger + +[ Upstream commit 082d9e263af8de68f0c34f67b251818205160f6e ] + +Somewhen between 6.10 and 6.11 the driver started to crash on my +MacBookPro14,3. The property doesn't exist and 'tmp' remains +uninitialized, so we pass a random pointer to devm_kstrdup(). + +The crash I am getting looks like this: + +BUG: unable to handle page fault for address: 00007f033c669379 +PF: supervisor read access in kernel mode +PF: error_code(0x0001) - permissions violation +PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025 +Oops: Oops: 0001 [#1] SMP PTI +CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1 +Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024 +RIP: 0010:strlen+0x4/0x30 +Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc +RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202 +RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001 +RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379 +RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a +R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8 +R13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30 +FS: 00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + ? __die+0x23/0x70 + ? page_fault_oops+0x149/0x4c0 + ? raw_spin_rq_lock_nested+0xe/0x20 + ? sched_balance_newidle+0x22b/0x3c0 + ? update_load_avg+0x78/0x770 + ? exc_page_fault+0x6f/0x150 + ? asm_exc_page_fault+0x26/0x30 + ? __pfx_pci_conf1_write+0x10/0x10 + ? strlen+0x4/0x30 + devm_kstrdup+0x25/0x70 + brcmf_of_probe+0x273/0x350 [brcmfmac] + +Signed-off-by: Stefan Dösinger +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20250106170958.3595-1-stefan@codeweavers.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c +index c1f18e2fe540d..1681ad00f82ec 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c +@@ -99,13 +99,13 @@ int brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type, + /* Set board-type to the first string of the machine compatible prop */ + root = of_find_node_by_path("/"); + if (root && err) { +- char *board_type; ++ char *board_type = NULL; + const char *tmp; + +- of_property_read_string_index(root, "compatible", 0, &tmp); +- + /* get rid of '/' in the compatible string to be able to find the FW */ +- board_type = devm_kstrdup(dev, tmp, GFP_KERNEL); ++ if (!of_property_read_string_index(root, "compatible", 0, &tmp)) ++ board_type = devm_kstrdup(dev, tmp, GFP_KERNEL); ++ + if (!board_type) { + of_node_put(root); + return 0; +-- +2.39.5 + diff --git a/queue-6.13/wifi-brcmsmac-add-gain-range-check-to-wlc_phy_iqcal_.patch b/queue-6.13/wifi-brcmsmac-add-gain-range-check-to-wlc_phy_iqcal_.patch new file mode 100644 index 0000000000..573ae1d069 --- /dev/null +++ b/queue-6.13/wifi-brcmsmac-add-gain-range-check-to-wlc_phy_iqcal_.patch @@ -0,0 +1,42 @@ +From d44e3665ba1706318a85061b37378701c28d72dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 10:04:41 +0300 +Subject: wifi: brcmsmac: add gain range check to + wlc_phy_iqcal_gainparams_nphy() + +From: Dmitry Antipov + +[ Upstream commit 3f4a0948c3524ae50f166dbc6572a3296b014e62 ] + +In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN() +instead of possible out-of-bounds 'tbl_iqcal_gainparams_nphy' access. +Compile tested only. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Dmitry Antipov +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20241210070441.836362-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c +index d69879e1bd870..d362c4337616b 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c +@@ -23423,6 +23423,9 @@ wlc_phy_iqcal_gainparams_nphy(struct brcms_phy *pi, u16 core_no, + break; + } + ++ if (WARN_ON(k == NPHY_IQCAL_NUMGAINS)) ++ return; ++ + params->txgm = tbl_iqcal_gainparams_nphy[band_idx][k][1]; + params->pga = tbl_iqcal_gainparams_nphy[band_idx][k][2]; + params->pad = tbl_iqcal_gainparams_nphy[band_idx][k][3]; +-- +2.39.5 + diff --git a/queue-6.13/wifi-iwlwifi-avoid-memory-leak.patch b/queue-6.13/wifi-iwlwifi-avoid-memory-leak.patch new file mode 100644 index 0000000000..0fd3d649d5 --- /dev/null +++ b/queue-6.13/wifi-iwlwifi-avoid-memory-leak.patch @@ -0,0 +1,69 @@ +From 43ceacd481b678093b1f4838fcf96fb68ba8649a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Dec 2024 22:34:15 +0200 +Subject: wifi: iwlwifi: avoid memory leak + +From: Miri Korenblit + +[ Upstream commit 80e96206a3ef348fbd658d98f2f43149c36df8bc ] + +A caller of iwl_acpi_get_dsm_object must free the returned object. +iwl_acpi_get_dsm_integer returns immediately without freeing +it if the expected size is more than 8 bytes. Fix that. + +Note that with the current code this will never happen, since the caller +of iwl_acpi_get_dsm_integer already checks that the expected size if +either 1 or 4 bytes, so it can't exceed 8 bytes. + +While at it, print the DSM value instead of the return value, as this +was the intention in the first place. + +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20241228223206.bf61eaab99f8.Ibdc5df02f885208c222456d42c889c43b7e3b2f7@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c +index 0bc32291815e1..a26c5573d2091 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c +@@ -108,7 +108,7 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func, + size_t expected_size) + { + union acpi_object *obj; +- int ret = 0; ++ int ret; + + obj = iwl_acpi_get_dsm_object(dev, rev, func, NULL, guid); + if (IS_ERR(obj)) { +@@ -123,8 +123,10 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func, + } else if (obj->type == ACPI_TYPE_BUFFER) { + __le64 le_value = 0; + +- if (WARN_ON_ONCE(expected_size > sizeof(le_value))) +- return -EINVAL; ++ if (WARN_ON_ONCE(expected_size > sizeof(le_value))) { ++ ret = -EINVAL; ++ goto out; ++ } + + /* if the buffer size doesn't match the expected size */ + if (obj->buffer.length != expected_size) +@@ -145,8 +147,9 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func, + } + + IWL_DEBUG_DEV_RADIO(dev, +- "ACPI: DSM method evaluated: func=%d, ret=%d\n", +- func, ret); ++ "ACPI: DSM method evaluated: func=%d, value=%lld\n", ++ func, *value); ++ ret = 0; + out: + ACPI_FREE(obj); + return ret; +-- +2.39.5 + diff --git a/queue-6.13/wifi-iwlwifi-pcie-add-support-for-new-device-ids.patch b/queue-6.13/wifi-iwlwifi-pcie-add-support-for-new-device-ids.patch new file mode 100644 index 0000000000..303f56b161 --- /dev/null +++ b/queue-6.13/wifi-iwlwifi-pcie-add-support-for-new-device-ids.patch @@ -0,0 +1,303 @@ +From 2e149f48044d5a093de0b6f21027a621b608416f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Dec 2024 17:44:53 +0200 +Subject: wifi: iwlwifi: pcie: Add support for new device ids + +From: Somashekhar(Som) + +[ Upstream commit 9b45ba3976945e8d53f2dd40541a66c690f12286 ] + +Add support for new device-ids 0x2730 and 0x272F. + +Signed-off-by: Somashekhar(Som) +Reviewed-by: Johannes Berg +Link: https://patch.msgid.link/20241226174257.6a0db60436e7.I50a66544dde6c88acd9abe4b31badab96ef04cfc@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/Makefile | 2 +- + drivers/net/wireless/intel/iwlwifi/cfg/dr.c | 167 ++++++++++++++++++ + .../net/wireless/intel/iwlwifi/iwl-config.h | 10 ++ + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 16 ++ + 4 files changed, 194 insertions(+), 1 deletion(-) + create mode 100644 drivers/net/wireless/intel/iwlwifi/cfg/dr.c + +diff --git a/drivers/net/wireless/intel/iwlwifi/Makefile b/drivers/net/wireless/intel/iwlwifi/Makefile +index 64c1233142451..a3052684b341f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/Makefile ++++ b/drivers/net/wireless/intel/iwlwifi/Makefile +@@ -11,7 +11,7 @@ iwlwifi-objs += pcie/ctxt-info.o pcie/ctxt-info-gen3.o + iwlwifi-objs += pcie/trans-gen2.o pcie/tx-gen2.o + iwlwifi-$(CONFIG_IWLDVM) += cfg/1000.o cfg/2000.o cfg/5000.o cfg/6000.o + iwlwifi-$(CONFIG_IWLMVM) += cfg/7000.o cfg/8000.o cfg/9000.o cfg/22000.o +-iwlwifi-$(CONFIG_IWLMVM) += cfg/ax210.o cfg/bz.o cfg/sc.o ++iwlwifi-$(CONFIG_IWLMVM) += cfg/ax210.o cfg/bz.o cfg/sc.o cfg/dr.o + iwlwifi-objs += iwl-dbg-tlv.o + iwlwifi-objs += iwl-trans.o + +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/dr.c b/drivers/net/wireless/intel/iwlwifi/cfg/dr.c +new file mode 100644 +index 0000000000000..ab7c0f8d54f42 +--- /dev/null ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/dr.c +@@ -0,0 +1,167 @@ ++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause ++/* ++ * Copyright (C) 2024 Intel Corporation ++ */ ++#include ++#include ++#include "iwl-config.h" ++#include "iwl-prph.h" ++#include "fw/api/txq.h" ++ ++/* Highest firmware API version supported */ ++#define IWL_DR_UCODE_API_MAX 96 ++ ++/* Lowest firmware API version supported */ ++#define IWL_DR_UCODE_API_MIN 96 ++ ++/* NVM versions */ ++#define IWL_DR_NVM_VERSION 0x0a1d ++ ++/* Memory offsets and lengths */ ++#define IWL_DR_DCCM_OFFSET 0x800000 /* LMAC1 */ ++#define IWL_DR_DCCM_LEN 0x10000 /* LMAC1 */ ++#define IWL_DR_DCCM2_OFFSET 0x880000 ++#define IWL_DR_DCCM2_LEN 0x8000 ++#define IWL_DR_SMEM_OFFSET 0x400000 ++#define IWL_DR_SMEM_LEN 0xD0000 ++ ++#define IWL_DR_A_PE_A_FW_PRE "iwlwifi-dr-a0-pe-a0" ++#define IWL_BR_A_PET_A_FW_PRE "iwlwifi-br-a0-petc-a0" ++#define IWL_BR_A_PE_A_FW_PRE "iwlwifi-br-a0-pe-a0" ++ ++#define IWL_DR_A_PE_A_FW_MODULE_FIRMWARE(api) \ ++ IWL_DR_A_PE_A_FW_PRE "-" __stringify(api) ".ucode" ++#define IWL_BR_A_PET_A_FW_MODULE_FIRMWARE(api) \ ++ IWL_BR_A_PET_A_FW_PRE "-" __stringify(api) ".ucode" ++#define IWL_BR_A_PE_A_FW_MODULE_FIRMWARE(api) \ ++ IWL_BR_A_PE_A_FW_PRE "-" __stringify(api) ".ucode" ++ ++static const struct iwl_base_params iwl_dr_base_params = { ++ .eeprom_size = OTP_LOW_IMAGE_SIZE_32K, ++ .num_of_queues = 512, ++ .max_tfd_queue_size = 65536, ++ .shadow_ram_support = true, ++ .led_compensation = 57, ++ .wd_timeout = IWL_LONG_WD_TIMEOUT, ++ .max_event_log_size = 512, ++ .shadow_reg_enable = true, ++ .pcie_l1_allowed = true, ++}; ++ ++#define IWL_DEVICE_DR_COMMON \ ++ .ucode_api_max = IWL_DR_UCODE_API_MAX, \ ++ .ucode_api_min = IWL_DR_UCODE_API_MIN, \ ++ .led_mode = IWL_LED_RF_STATE, \ ++ .nvm_hw_section_num = 10, \ ++ .non_shared_ant = ANT_B, \ ++ .dccm_offset = IWL_DR_DCCM_OFFSET, \ ++ .dccm_len = IWL_DR_DCCM_LEN, \ ++ .dccm2_offset = IWL_DR_DCCM2_OFFSET, \ ++ .dccm2_len = IWL_DR_DCCM2_LEN, \ ++ .smem_offset = IWL_DR_SMEM_OFFSET, \ ++ .smem_len = IWL_DR_SMEM_LEN, \ ++ .apmg_not_supported = true, \ ++ .trans.mq_rx_supported = true, \ ++ .vht_mu_mimo_supported = true, \ ++ .mac_addr_from_csr = 0x30, \ ++ .nvm_ver = IWL_DR_NVM_VERSION, \ ++ .trans.rf_id = true, \ ++ .trans.gen2 = true, \ ++ .nvm_type = IWL_NVM_EXT, \ ++ .dbgc_supported = true, \ ++ .min_umac_error_event_table = 0xD0000, \ ++ .d3_debug_data_base_addr = 0x401000, \ ++ .d3_debug_data_length = 60 * 1024, \ ++ .mon_smem_regs = { \ ++ .write_ptr = { \ ++ .addr = LDBG_M2S_BUF_WPTR, \ ++ .mask = LDBG_M2S_BUF_WPTR_VAL_MSK, \ ++ }, \ ++ .cycle_cnt = { \ ++ .addr = LDBG_M2S_BUF_WRAP_CNT, \ ++ .mask = LDBG_M2S_BUF_WRAP_CNT_VAL_MSK, \ ++ }, \ ++ }, \ ++ .trans.umac_prph_offset = 0x300000, \ ++ .trans.device_family = IWL_DEVICE_FAMILY_DR, \ ++ .trans.base_params = &iwl_dr_base_params, \ ++ .min_txq_size = 128, \ ++ .gp2_reg_addr = 0xd02c68, \ ++ .min_ba_txq_size = IWL_DEFAULT_QUEUE_SIZE_EHT, \ ++ .mon_dram_regs = { \ ++ .write_ptr = { \ ++ .addr = DBGC_CUR_DBGBUF_STATUS, \ ++ .mask = DBGC_CUR_DBGBUF_STATUS_OFFSET_MSK, \ ++ }, \ ++ .cycle_cnt = { \ ++ .addr = DBGC_DBGBUF_WRAP_AROUND, \ ++ .mask = 0xffffffff, \ ++ }, \ ++ .cur_frag = { \ ++ .addr = DBGC_CUR_DBGBUF_STATUS, \ ++ .mask = DBGC_CUR_DBGBUF_STATUS_IDX_MSK, \ ++ }, \ ++ }, \ ++ .mon_dbgi_regs = { \ ++ .write_ptr = { \ ++ .addr = DBGI_SRAM_FIFO_POINTERS, \ ++ .mask = DBGI_SRAM_FIFO_POINTERS_WR_PTR_MSK, \ ++ }, \ ++ } ++ ++#define IWL_DEVICE_DR \ ++ IWL_DEVICE_DR_COMMON, \ ++ .uhb_supported = true, \ ++ .features = IWL_TX_CSUM_NETIF_FLAGS | NETIF_F_RXCSUM, \ ++ .num_rbds = IWL_NUM_RBDS_DR_EHT, \ ++ .ht_params = &iwl_22000_ht_params ++ ++/* ++ * This size was picked according to 8 MSDUs inside 512 A-MSDUs in an ++ * A-MPDU, with additional overhead to account for processing time. ++ */ ++#define IWL_NUM_RBDS_DR_EHT (512 * 16) ++ ++const struct iwl_cfg_trans_params iwl_dr_trans_cfg = { ++ .device_family = IWL_DEVICE_FAMILY_DR, ++ .base_params = &iwl_dr_base_params, ++ .mq_rx_supported = true, ++ .rf_id = true, ++ .gen2 = true, ++ .integrated = true, ++ .umac_prph_offset = 0x300000, ++ .xtal_latency = 12000, ++ .low_latency_xtal = true, ++ .ltr_delay = IWL_CFG_TRANS_LTR_DELAY_2500US, ++}; ++ ++const char iwl_dr_name[] = "Intel(R) TBD Dr device"; ++ ++const struct iwl_cfg iwl_cfg_dr = { ++ .fw_name_mac = "dr", ++ IWL_DEVICE_DR, ++}; ++ ++const struct iwl_cfg_trans_params iwl_br_trans_cfg = { ++ .device_family = IWL_DEVICE_FAMILY_DR, ++ .base_params = &iwl_dr_base_params, ++ .mq_rx_supported = true, ++ .rf_id = true, ++ .gen2 = true, ++ .integrated = true, ++ .umac_prph_offset = 0x300000, ++ .xtal_latency = 12000, ++ .low_latency_xtal = true, ++ .ltr_delay = IWL_CFG_TRANS_LTR_DELAY_2500US, ++}; ++ ++const char iwl_br_name[] = "Intel(R) TBD Br device"; ++ ++const struct iwl_cfg iwl_cfg_br = { ++ .fw_name_mac = "br", ++ IWL_DEVICE_DR, ++}; ++ ++MODULE_FIRMWARE(IWL_DR_A_PE_A_FW_MODULE_FIRMWARE(IWL_DR_UCODE_API_MAX)); ++MODULE_FIRMWARE(IWL_BR_A_PET_A_FW_MODULE_FIRMWARE(IWL_DR_UCODE_API_MAX)); ++MODULE_FIRMWARE(IWL_BR_A_PE_A_FW_MODULE_FIRMWARE(IWL_DR_UCODE_API_MAX)); +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +index 17721bb47e251..89744dbedb4a5 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +@@ -38,6 +38,7 @@ enum iwl_device_family { + IWL_DEVICE_FAMILY_AX210, + IWL_DEVICE_FAMILY_BZ, + IWL_DEVICE_FAMILY_SC, ++ IWL_DEVICE_FAMILY_DR, + }; + + /* +@@ -424,6 +425,8 @@ struct iwl_cfg { + #define IWL_CFG_MAC_TYPE_SC2 0x49 + #define IWL_CFG_MAC_TYPE_SC2F 0x4A + #define IWL_CFG_MAC_TYPE_BZ_W 0x4B ++#define IWL_CFG_MAC_TYPE_BR 0x4C ++#define IWL_CFG_MAC_TYPE_DR 0x4D + + #define IWL_CFG_RF_TYPE_TH 0x105 + #define IWL_CFG_RF_TYPE_TH1 0x108 +@@ -434,6 +437,7 @@ struct iwl_cfg { + #define IWL_CFG_RF_TYPE_GF 0x10D + #define IWL_CFG_RF_TYPE_FM 0x112 + #define IWL_CFG_RF_TYPE_WH 0x113 ++#define IWL_CFG_RF_TYPE_PE 0x114 + + #define IWL_CFG_RF_ID_TH 0x1 + #define IWL_CFG_RF_ID_TH1 0x1 +@@ -506,6 +510,8 @@ extern const struct iwl_cfg_trans_params iwl_ma_trans_cfg; + extern const struct iwl_cfg_trans_params iwl_bz_trans_cfg; + extern const struct iwl_cfg_trans_params iwl_gl_trans_cfg; + extern const struct iwl_cfg_trans_params iwl_sc_trans_cfg; ++extern const struct iwl_cfg_trans_params iwl_dr_trans_cfg; ++extern const struct iwl_cfg_trans_params iwl_br_trans_cfg; + extern const char iwl9162_name[]; + extern const char iwl9260_name[]; + extern const char iwl9260_1_name[]; +@@ -551,6 +557,8 @@ extern const char iwl_mtp_name[]; + extern const char iwl_sc_name[]; + extern const char iwl_sc2_name[]; + extern const char iwl_sc2f_name[]; ++extern const char iwl_dr_name[]; ++extern const char iwl_br_name[]; + #if IS_ENABLED(CONFIG_IWLDVM) + extern const struct iwl_cfg iwl5300_agn_cfg; + extern const struct iwl_cfg iwl5100_agn_cfg; +@@ -658,6 +666,8 @@ extern const struct iwl_cfg iwl_cfg_gl; + extern const struct iwl_cfg iwl_cfg_sc; + extern const struct iwl_cfg iwl_cfg_sc2; + extern const struct iwl_cfg iwl_cfg_sc2f; ++extern const struct iwl_cfg iwl_cfg_dr; ++extern const struct iwl_cfg iwl_cfg_br; + #endif /* CONFIG_IWLMVM */ + + #endif /* __IWL_CONFIG_H__ */ +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 8fb2aa2822421..9dd0e0a51ce5c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -540,6 +540,9 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0xE340, PCI_ANY_ID, iwl_sc_trans_cfg)}, + {IWL_PCI_DEVICE(0xD340, PCI_ANY_ID, iwl_sc_trans_cfg)}, + {IWL_PCI_DEVICE(0x6E70, PCI_ANY_ID, iwl_sc_trans_cfg)}, ++ ++/* Dr devices */ ++ {IWL_PCI_DEVICE(0x272F, PCI_ANY_ID, iwl_dr_trans_cfg)}, + #endif /* CONFIG_IWLMVM */ + + {0} +@@ -1182,6 +1185,19 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct iwl_dev_info iwl_dev_info_table[] = { + IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, + IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, + iwl_cfg_sc2f, iwl_sc2f_name), ++/* Dr */ ++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_MAC_TYPE_DR, IWL_CFG_ANY, ++ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, ++ iwl_cfg_dr, iwl_dr_name), ++ ++/* Br */ ++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_MAC_TYPE_BR, IWL_CFG_ANY, ++ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY, ++ iwl_cfg_br, iwl_br_name), + #endif /* CONFIG_IWLMVM */ + }; + EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_dev_info_table); +-- +2.39.5 + diff --git a/queue-6.13/wifi-rtw88-add-__packed-attribute-to-efuse-layout-st.patch b/queue-6.13/wifi-rtw88-add-__packed-attribute-to-efuse-layout-st.patch new file mode 100644 index 0000000000..eaa42456b2 --- /dev/null +++ b/queue-6.13/wifi-rtw88-add-__packed-attribute-to-efuse-layout-st.patch @@ -0,0 +1,213 @@ +From f999aff962c67e353a6097f2a8d6cc0150a3969c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 13:42:03 +0800 +Subject: wifi: rtw88: add __packed attribute to efuse layout struct + +From: Ping-Ke Shih + +[ Upstream commit 0daa521a1c8c29ffbefe6530f0d276e74e2749d0 ] + +The layout struct of efuse should not do address alignment by compiler. +Otherwise it leads unexpected layout and size for certain arch suc as arm. +In x86-64, the results are identical before and after this patch. + +Also adjust bit-field to prevent over adjacent byte to avoid warning: + rtw88/rtw8822b.h:66:1: note: offset of packed bit-field `res2` has changed in GCC 4.4 + 66 | } __packed; + | ^ + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202412120131.qk0x6OhE-lkp@intel.com/ +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241212054203.135046-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.h | 4 ++-- + drivers/net/wireless/realtek/rtw88/rtw8723x.h | 8 ++++---- + drivers/net/wireless/realtek/rtw88/rtw8821c.h | 9 +++++---- + drivers/net/wireless/realtek/rtw88/rtw8822b.h | 9 +++++---- + drivers/net/wireless/realtek/rtw88/rtw8822c.h | 9 +++++---- + 5 files changed, 21 insertions(+), 18 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h +index cd09fb6f7b8b3..65c7acea41aff 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.h ++++ b/drivers/net/wireless/realtek/rtw88/main.h +@@ -510,12 +510,12 @@ struct rtw_5g_txpwr_idx { + struct rtw_5g_vht_ns_pwr_idx_diff vht_2s_diff; + struct rtw_5g_vht_ns_pwr_idx_diff vht_3s_diff; + struct rtw_5g_vht_ns_pwr_idx_diff vht_4s_diff; +-}; ++} __packed; + + struct rtw_txpwr_idx { + struct rtw_2g_txpwr_idx pwr_idx_2g; + struct rtw_5g_txpwr_idx pwr_idx_5g; +-}; ++} __packed; + + struct rtw_channel_params { + u8 center_chan; +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8723x.h b/drivers/net/wireless/realtek/rtw88/rtw8723x.h +index e93bfce994bf8..a99af527c92cf 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8723x.h ++++ b/drivers/net/wireless/realtek/rtw88/rtw8723x.h +@@ -47,7 +47,7 @@ struct rtw8723xe_efuse { + u8 device_id[2]; + u8 sub_vendor_id[2]; + u8 sub_device_id[2]; +-}; ++} __packed; + + struct rtw8723xu_efuse { + u8 res4[48]; /* 0xd0 */ +@@ -56,12 +56,12 @@ struct rtw8723xu_efuse { + u8 usb_option; /* 0x104 */ + u8 res5[2]; /* 0x105 */ + u8 mac_addr[ETH_ALEN]; /* 0x107 */ +-}; ++} __packed; + + struct rtw8723xs_efuse { + u8 res4[0x4a]; /* 0xd0 */ + u8 mac_addr[ETH_ALEN]; /* 0x11a */ +-}; ++} __packed; + + struct rtw8723x_efuse { + __le16 rtl_id; +@@ -96,7 +96,7 @@ struct rtw8723x_efuse { + struct rtw8723xu_efuse u; + struct rtw8723xs_efuse s; + }; +-}; ++} __packed; + + #define RTW8723X_IQK_ADDA_REG_NUM 16 + #define RTW8723X_IQK_MAC8_REG_NUM 3 +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821c.h b/drivers/net/wireless/realtek/rtw88/rtw8821c.h +index 7a33ebd612eda..954e93c8020d8 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.h ++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.h +@@ -27,7 +27,7 @@ struct rtw8821cu_efuse { + u8 res11[0xcf]; + u8 package_type; /* 0x1fb */ + u8 res12[0x4]; +-}; ++} __packed; + + struct rtw8821ce_efuse { + u8 mac_addr[ETH_ALEN]; /* 0xd0 */ +@@ -47,7 +47,8 @@ struct rtw8821ce_efuse { + u8 ltr_en:1; + u8 res1:2; + u8 obff:2; +- u8 res2:3; ++ u8 res2_1:1; ++ u8 res2_2:2; + u8 obff_cap:2; + u8 res3:4; + u8 res4[3]; +@@ -63,7 +64,7 @@ struct rtw8821ce_efuse { + u8 res6:1; + u8 port_t_power_on_value:5; + u8 res7; +-}; ++} __packed; + + struct rtw8821cs_efuse { + u8 res4[0x4a]; /* 0xd0 */ +@@ -101,7 +102,7 @@ struct rtw8821c_efuse { + struct rtw8821cu_efuse u; + struct rtw8821cs_efuse s; + }; +-}; ++} __packed; + + static inline void + _rtw_write32s_mask(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 data) +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.h b/drivers/net/wireless/realtek/rtw88/rtw8822b.h +index 0514958fb57c3..9fca9ba67c90f 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.h ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.h +@@ -27,7 +27,7 @@ struct rtw8822bu_efuse { + u8 res11[0xcf]; + u8 package_type; /* 0x1fb */ + u8 res12[0x4]; +-}; ++} __packed; + + struct rtw8822be_efuse { + u8 mac_addr[ETH_ALEN]; /* 0xd0 */ +@@ -47,7 +47,8 @@ struct rtw8822be_efuse { + u8 ltr_en:1; + u8 res1:2; + u8 obff:2; +- u8 res2:3; ++ u8 res2_1:1; ++ u8 res2_2:2; + u8 obff_cap:2; + u8 res3:4; + u8 res4[3]; +@@ -63,7 +64,7 @@ struct rtw8822be_efuse { + u8 res6:1; + u8 port_t_power_on_value:5; + u8 res7; +-}; ++} __packed; + + struct rtw8822bs_efuse { + u8 res4[0x4a]; /* 0xd0 */ +@@ -103,7 +104,7 @@ struct rtw8822b_efuse { + struct rtw8822bu_efuse u; + struct rtw8822bs_efuse s; + }; +-}; ++} __packed; + + static inline void + _rtw_write32s_mask(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 data) +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.h b/drivers/net/wireless/realtek/rtw88/rtw8822c.h +index e2b383d633cd2..fc62b67a15f21 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.h ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.h +@@ -14,7 +14,7 @@ struct rtw8822cu_efuse { + u8 res1[3]; + u8 mac_addr[ETH_ALEN]; /* 0x157 */ + u8 res2[0x3d]; +-}; ++} __packed; + + struct rtw8822cs_efuse { + u8 res0[0x4a]; /* 0x120 */ +@@ -39,7 +39,8 @@ struct rtw8822ce_efuse { + u8 ltr_en:1; + u8 res1:2; + u8 obff:2; +- u8 res2:3; ++ u8 res2_1:1; ++ u8 res2_2:2; + u8 obff_cap:2; + u8 res3:4; + u8 class_code[3]; +@@ -55,7 +56,7 @@ struct rtw8822ce_efuse { + u8 res6:1; + u8 port_t_power_on_value:5; + u8 res7; +-}; ++} __packed; + + struct rtw8822c_efuse { + __le16 rtl_id; +@@ -102,7 +103,7 @@ struct rtw8822c_efuse { + struct rtw8822cu_efuse u; + struct rtw8822cs_efuse s; + }; +-}; ++} __packed; + + enum rtw8822c_dpk_agc_phase { + RTW_DPK_GAIN_CHECK, +-- +2.39.5 + diff --git a/queue-6.13/wifi-rtw89-add-crystal_cap-check-to-avoid-setting-as.patch b/queue-6.13/wifi-rtw89-add-crystal_cap-check-to-avoid-setting-as.patch new file mode 100644 index 0000000000..6352a6b7a5 --- /dev/null +++ b/queue-6.13/wifi-rtw89-add-crystal_cap-check-to-avoid-setting-as.patch @@ -0,0 +1,81 @@ +From 00bf967b37a2ed1df0f913ab819919698a6b76bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 13:54:33 +0800 +Subject: wifi: rtw89: add crystal_cap check to avoid setting as overflow value + +From: Chih-Kang Chang + +[ Upstream commit 7b98caea39676561f22db58752551161bb36462b ] + +In the original flow, the crystal_cap might be calculated as a negative +value and set as an overflow value. Therefore, we added a check to limit +the calculated crystal_cap value. Additionally, we shrank the crystal_cap +adjustment according to specific CFO. + +Signed-off-by: Chih-Kang Chang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241128055433.11851-7-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/phy.c | 11 ++++++----- + drivers/net/wireless/realtek/rtw89/phy.h | 2 +- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c +index f24aca663cf00..b9171f6ccae07 100644 +--- a/drivers/net/wireless/realtek/rtw89/phy.c ++++ b/drivers/net/wireless/realtek/rtw89/phy.c +@@ -4058,7 +4058,6 @@ static void rtw89_phy_cfo_set_crystal_cap(struct rtw89_dev *rtwdev, + + if (!force && cfo->crystal_cap == crystal_cap) + return; +- crystal_cap = clamp_t(u8, crystal_cap, 0, 127); + if (chip->chip_id == RTL8852A || chip->chip_id == RTL8851B) { + rtw89_phy_cfo_set_xcap_reg(rtwdev, true, crystal_cap); + rtw89_phy_cfo_set_xcap_reg(rtwdev, false, crystal_cap); +@@ -4181,7 +4180,7 @@ static void rtw89_phy_cfo_crystal_cap_adjust(struct rtw89_dev *rtwdev, + s32 curr_cfo) + { + struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking; +- s8 crystal_cap = cfo->crystal_cap; ++ int crystal_cap = cfo->crystal_cap; + s32 cfo_abs = abs(curr_cfo); + int sign; + +@@ -4202,15 +4201,17 @@ static void rtw89_phy_cfo_crystal_cap_adjust(struct rtw89_dev *rtwdev, + } + sign = curr_cfo > 0 ? 1 : -1; + if (cfo_abs > CFO_TRK_STOP_TH_4) +- crystal_cap += 7 * sign; ++ crystal_cap += 3 * sign; + else if (cfo_abs > CFO_TRK_STOP_TH_3) +- crystal_cap += 5 * sign; +- else if (cfo_abs > CFO_TRK_STOP_TH_2) + crystal_cap += 3 * sign; ++ else if (cfo_abs > CFO_TRK_STOP_TH_2) ++ crystal_cap += 1 * sign; + else if (cfo_abs > CFO_TRK_STOP_TH_1) + crystal_cap += 1 * sign; + else + return; ++ ++ crystal_cap = clamp(crystal_cap, 0, 127); + rtw89_phy_cfo_set_crystal_cap(rtwdev, (u8)crystal_cap, false); + rtw89_debug(rtwdev, RTW89_DBG_CFO, + "X_cap{Curr,Default}={0x%x,0x%x}\n", +diff --git a/drivers/net/wireless/realtek/rtw89/phy.h b/drivers/net/wireless/realtek/rtw89/phy.h +index c683f4d7d29b0..bc6912b3a2fba 100644 +--- a/drivers/net/wireless/realtek/rtw89/phy.h ++++ b/drivers/net/wireless/realtek/rtw89/phy.h +@@ -57,7 +57,7 @@ + #define CFO_TRK_STOP_TH_4 (30 << 2) + #define CFO_TRK_STOP_TH_3 (20 << 2) + #define CFO_TRK_STOP_TH_2 (10 << 2) +-#define CFO_TRK_STOP_TH_1 (00 << 2) ++#define CFO_TRK_STOP_TH_1 (03 << 2) + #define CFO_TRK_STOP_TH (2 << 2) + #define CFO_SW_COMP_FINE_TUNE (2 << 2) + #define CFO_PERIOD_CNT 15 +-- +2.39.5 + diff --git a/queue-6.13/x86-amd_nb-restrict-init-function-to-amd-based-syste.patch b/queue-6.13/x86-amd_nb-restrict-init-function-to-amd-based-syste.patch new file mode 100644 index 0000000000..3b7246b2b1 --- /dev/null +++ b/queue-6.13/x86-amd_nb-restrict-init-function-to-amd-based-syste.patch @@ -0,0 +1,40 @@ +From 95146fb3988ae0e2bf0613f70064780b9029ca1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 16:11:55 +0000 +Subject: x86/amd_nb: Restrict init function to AMD-based systems + +From: Yazen Ghannam + +[ Upstream commit bee9e840609cc67d0a7d82f22a2130fb7a0a766d ] + +The code implicitly operates on AMD-based systems by matching on PCI +IDs. However, the use of these IDs is going away. + +Add an explicit CPU vendor check instead of relying on PCI IDs. + +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20241206161210.163701-3-yazen.ghannam@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/amd_nb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c +index 9fe9972d2071b..37b8244899d89 100644 +--- a/arch/x86/kernel/amd_nb.c ++++ b/arch/x86/kernel/amd_nb.c +@@ -582,6 +582,10 @@ static __init void fix_erratum_688(void) + + static __init int init_amd_nbs(void) + { ++ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD && ++ boot_cpu_data.x86_vendor != X86_VENDOR_HYGON) ++ return 0; ++ + amd_cache_northbridges(); + amd_cache_gart(); + +-- +2.39.5 + diff --git a/queue-6.13/x86-convert-unreachable-to-bug.patch b/queue-6.13/x86-convert-unreachable-to-bug.patch new file mode 100644 index 0000000000..2719bc10d8 --- /dev/null +++ b/queue-6.13/x86-convert-unreachable-to-bug.patch @@ -0,0 +1,65 @@ +From 45465127be86393a35686e43bd787e06d0584034 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 10:39:02 +0100 +Subject: x86: Convert unreachable() to BUG() + +From: Peter Zijlstra + +[ Upstream commit 2190966fbc14ca2cd4ea76eefeb96a47d8e390df ] + +Avoid unreachable() as it can (and will in the absence of UBSAN) +generate fallthrough code. Use BUG() so we get a UD2 trap (with +unreachable annotation). + +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Josh Poimboeuf +Link: https://lore.kernel.org/r/20241128094312.028316261@infradead.org +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/process.c | 2 +- + arch/x86/kernel/reboot.c | 2 +- + arch/x86/kvm/svm/sev.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index f63f8fd00a91f..15507e739c255 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -838,7 +838,7 @@ void __noreturn stop_this_cpu(void *dummy) + #ifdef CONFIG_SMP + if (smp_ops.stop_this_cpu) { + smp_ops.stop_this_cpu(); +- unreachable(); ++ BUG(); + } + #endif + +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index 615922838c510..dc1dd3f3e67fc 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -883,7 +883,7 @@ static int crash_nmi_callback(unsigned int val, struct pt_regs *regs) + + if (smp_ops.stop_this_cpu) { + smp_ops.stop_this_cpu(); +- unreachable(); ++ BUG(); + } + + /* Assume hlt works */ +diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c +index 943bd074a5d37..fe6cc763fd518 100644 +--- a/arch/x86/kvm/svm/sev.c ++++ b/arch/x86/kvm/svm/sev.c +@@ -3820,7 +3820,7 @@ static int snp_begin_psc(struct vcpu_svm *svm, struct psc_buffer *psc) + goto next_range; + } + +- unreachable(); ++ BUG(); + } + + static int __sev_snp_update_protected_guest_state(struct kvm_vcpu *vcpu) +-- +2.39.5 + diff --git a/queue-6.13/x86-kexec-allocate-pgd-for-x86_64-transition-page-ta.patch b/queue-6.13/x86-kexec-allocate-pgd-for-x86_64-transition-page-ta.patch new file mode 100644 index 0000000000..f55e3c57cd --- /dev/null +++ b/queue-6.13/x86-kexec-allocate-pgd-for-x86_64-transition-page-ta.patch @@ -0,0 +1,231 @@ +From eec193c8a5fdfcbabad329fd0cda72e4ed715733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 15:05:11 +0000 +Subject: x86/kexec: Allocate PGD for x86_64 transition page tables separately + +From: David Woodhouse + +[ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ] + +Now that the following fix: + + d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables") + +stops kernel_ident_mapping_init() from scribbling over the end of a +4KiB PGD by assuming the following 4KiB will be a userspace PGD, +there's no good reason for the kexec PGD to be part of a single +8KiB allocation with the control_code_page. + +( It's not clear that that was the reason for x86_64 kexec doing it that + way in the first place either; there were no comments to that effect and + it seems to have been the case even before PTI came along. It looks like + it was just a happy accident which prevented memory corruption on kexec. ) + +Either way, it definitely isn't needed now. Just allocate the PGD +separately on x86_64, like i386 already does. + +Signed-off-by: David Woodhouse +Signed-off-by: Ingo Molnar +Cc: Baoquan He +Cc: Vivek Goyal +Cc: Dave Young +Cc: Eric Biederman +Cc: Ard Biesheuvel +Cc: "H. Peter Anvin" +Link: https://lore.kernel.org/r/20241205153343.3275139-6-dwmw2@infradead.org +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/kexec.h | 18 +++++++++--- + arch/x86/kernel/machine_kexec_64.c | 45 ++++++++++++++++-------------- + 2 files changed, 38 insertions(+), 25 deletions(-) + +diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h +index ae5482a2f0ca0..ccb8ff37fa9d4 100644 +--- a/arch/x86/include/asm/kexec.h ++++ b/arch/x86/include/asm/kexec.h +@@ -16,6 +16,7 @@ + # define PAGES_NR 4 + #endif + ++# define KEXEC_CONTROL_PAGE_SIZE 4096 + # define KEXEC_CONTROL_CODE_MAX_SIZE 2048 + + #ifndef __ASSEMBLY__ +@@ -43,7 +44,6 @@ struct kimage; + /* Maximum address we can use for the control code buffer */ + # define KEXEC_CONTROL_MEMORY_LIMIT TASK_SIZE + +-# define KEXEC_CONTROL_PAGE_SIZE 4096 + + /* The native architecture */ + # define KEXEC_ARCH KEXEC_ARCH_386 +@@ -58,9 +58,6 @@ struct kimage; + /* Maximum address we can use for the control pages */ + # define KEXEC_CONTROL_MEMORY_LIMIT (MAXMEM-1) + +-/* Allocate one page for the pdp and the second for the code */ +-# define KEXEC_CONTROL_PAGE_SIZE (4096UL + 4096UL) +- + /* The native architecture */ + # define KEXEC_ARCH KEXEC_ARCH_X86_64 + #endif +@@ -145,6 +142,19 @@ struct kimage_arch { + }; + #else + struct kimage_arch { ++ /* ++ * This is a kimage control page, as it must not overlap with either ++ * source or destination address ranges. ++ */ ++ pgd_t *pgd; ++ /* ++ * The virtual mapping of the control code page itself is used only ++ * during the transition, while the current kernel's pages are all ++ * in place. Thus the intermediate page table pages used to map it ++ * are not control pages, but instead just normal pages obtained ++ * with get_zeroed_page(). And have to be tracked (below) so that ++ * they can be freed. ++ */ + p4d_t *p4d; + pud_t *pud; + pmd_t *pmd; +diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c +index 9c9ac606893e9..7223c38a8708f 100644 +--- a/arch/x86/kernel/machine_kexec_64.c ++++ b/arch/x86/kernel/machine_kexec_64.c +@@ -146,7 +146,8 @@ static void free_transition_pgtable(struct kimage *image) + image->arch.pte = NULL; + } + +-static int init_transition_pgtable(struct kimage *image, pgd_t *pgd) ++static int init_transition_pgtable(struct kimage *image, pgd_t *pgd, ++ unsigned long control_page) + { + pgprot_t prot = PAGE_KERNEL_EXEC_NOENC; + unsigned long vaddr, paddr; +@@ -157,7 +158,7 @@ static int init_transition_pgtable(struct kimage *image, pgd_t *pgd) + pte_t *pte; + + vaddr = (unsigned long)relocate_kernel; +- paddr = __pa(page_address(image->control_code_page)+PAGE_SIZE); ++ paddr = control_page; + pgd += pgd_index(vaddr); + if (!pgd_present(*pgd)) { + p4d = (p4d_t *)get_zeroed_page(GFP_KERNEL); +@@ -216,7 +217,7 @@ static void *alloc_pgt_page(void *data) + return p; + } + +-static int init_pgtable(struct kimage *image, unsigned long start_pgtable) ++static int init_pgtable(struct kimage *image, unsigned long control_page) + { + struct x86_mapping_info info = { + .alloc_pgt_page = alloc_pgt_page, +@@ -225,12 +226,12 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable) + .kernpg_flag = _KERNPG_TABLE_NOENC, + }; + unsigned long mstart, mend; +- pgd_t *level4p; + int result; + int i; + +- level4p = (pgd_t *)__va(start_pgtable); +- clear_page(level4p); ++ image->arch.pgd = alloc_pgt_page(image); ++ if (!image->arch.pgd) ++ return -ENOMEM; + + if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) { + info.page_flag |= _PAGE_ENC; +@@ -244,8 +245,8 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable) + mstart = pfn_mapped[i].start << PAGE_SHIFT; + mend = pfn_mapped[i].end << PAGE_SHIFT; + +- result = kernel_ident_mapping_init(&info, +- level4p, mstart, mend); ++ result = kernel_ident_mapping_init(&info, image->arch.pgd, ++ mstart, mend); + if (result) + return result; + } +@@ -260,8 +261,8 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable) + mstart = image->segment[i].mem; + mend = mstart + image->segment[i].memsz; + +- result = kernel_ident_mapping_init(&info, +- level4p, mstart, mend); ++ result = kernel_ident_mapping_init(&info, image->arch.pgd, ++ mstart, mend); + + if (result) + return result; +@@ -271,15 +272,19 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable) + * Prepare EFI systab and ACPI tables for kexec kernel since they are + * not covered by pfn_mapped. + */ +- result = map_efi_systab(&info, level4p); ++ result = map_efi_systab(&info, image->arch.pgd); + if (result) + return result; + +- result = map_acpi_tables(&info, level4p); ++ result = map_acpi_tables(&info, image->arch.pgd); + if (result) + return result; + +- return init_transition_pgtable(image, level4p); ++ /* ++ * This must be last because the intermediate page table pages it ++ * allocates will not be control pages and may overlap the image. ++ */ ++ return init_transition_pgtable(image, image->arch.pgd, control_page); + } + + static void load_segments(void) +@@ -296,14 +301,14 @@ static void load_segments(void) + + int machine_kexec_prepare(struct kimage *image) + { +- unsigned long start_pgtable; ++ unsigned long control_page; + int result; + + /* Calculate the offsets */ +- start_pgtable = page_to_pfn(image->control_code_page) << PAGE_SHIFT; ++ control_page = page_to_pfn(image->control_code_page) << PAGE_SHIFT; + + /* Setup the identity mapped 64bit page table */ +- result = init_pgtable(image, start_pgtable); ++ result = init_pgtable(image, control_page); + if (result) + return result; + +@@ -357,13 +362,12 @@ void machine_kexec(struct kimage *image) + #endif + } + +- control_page = page_address(image->control_code_page) + PAGE_SIZE; ++ control_page = page_address(image->control_code_page); + __memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE); + + page_list[PA_CONTROL_PAGE] = virt_to_phys(control_page); + page_list[VA_CONTROL_PAGE] = (unsigned long)control_page; +- page_list[PA_TABLE_PAGE] = +- (unsigned long)__pa(page_address(image->control_code_page)); ++ page_list[PA_TABLE_PAGE] = (unsigned long)__pa(image->arch.pgd); + + if (image->type == KEXEC_TYPE_DEFAULT) + page_list[PA_SWAP_PAGE] = (page_to_pfn(image->swap_page) +@@ -573,8 +577,7 @@ static void kexec_mark_crashkres(bool protect) + + /* Don't touch the control code page used in crash_kexec().*/ + control = PFN_PHYS(page_to_pfn(kexec_crash_image->control_code_page)); +- /* Control code page is located in the 2nd page. */ +- kexec_mark_range(crashk_res.start, control + PAGE_SIZE - 1, protect); ++ kexec_mark_range(crashk_res.start, control - 1, protect); + control += KEXEC_CONTROL_PAGE_SIZE; + kexec_mark_range(control, crashk_res.end, protect); + } +-- +2.39.5 +