From: Sasha Levin Date: Sun, 23 Feb 2025 17:23:12 +0000 (-0500) Subject: Fixes for 6.13 X-Git-Tag: v6.6.80~25^2~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9936208787bf21473574b0032c019a79944d8024;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.13 Signed-off-by: Sasha Levin --- diff --git a/queue-6.13/arm64-dts-rockchip-adjust-smmu-interrupt-type-on-rk3.patch b/queue-6.13/arm64-dts-rockchip-adjust-smmu-interrupt-type-on-rk3.patch new file mode 100644 index 0000000000..aa8e094036 --- /dev/null +++ b/queue-6.13/arm64-dts-rockchip-adjust-smmu-interrupt-type-on-rk3.patch @@ -0,0 +1,62 @@ +From 339a09449b83903f4641c435cd88f3da0765cdf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Feb 2025 22:37:29 +0100 +Subject: arm64: dts: rockchip: adjust SMMU interrupt type on rk3588 + +From: Patrick Wildt + +[ Upstream commit 8546cfd08aa4b982acd2357403a1f15495d622ec ] + +The SMMU architecture requires wired interrupts to be edge triggered, +which does not align with the DT description for the RK3588. This leads +to interrupt storms, as the SMMU continues to hold the pin high and only +pulls it down for a short amount when issuing an IRQ. Update the DT +description to be in line with the spec and perceived reality. + +Signed-off-by: Patrick Wildt +Fixes: cd81d3a0695c ("arm64: dts: rockchip: add rk3588 pcie and php IOMMUs") +Reviewed-by: Niklas Cassel +Link: https://lore.kernel.org/r/Z6pxme2Chmf3d3uK@windev.fritz.box +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi +index a337f3fb8377e..ba6de3976cf83 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi +@@ -549,10 +549,10 @@ usb_host2_xhci: usb@fcd00000 { + mmu600_pcie: iommu@fc900000 { + compatible = "arm,smmu-v3"; + reg = <0x0 0xfc900000 0x0 0x200000>; +- interrupts = , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ ; + interrupt-names = "eventq", "gerror", "priq", "cmdq-sync"; + #iommu-cells = <1>; + status = "disabled"; +@@ -561,10 +561,10 @@ mmu600_pcie: iommu@fc900000 { + mmu600_php: iommu@fcb00000 { + compatible = "arm,smmu-v3"; + reg = <0x0 0xfcb00000 0x0 0x200000>; +- interrupts = , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ ; + interrupt-names = "eventq", "gerror", "priq", "cmdq-sync"; + #iommu-cells = <1>; + status = "disabled"; +-- +2.39.5 + diff --git a/queue-6.13/arm64-dts-rockchip-fix-fixed-regulator-renames-on-rk.patch b/queue-6.13/arm64-dts-rockchip-fix-fixed-regulator-renames-on-rk.patch new file mode 100644 index 0000000000..736687d4df --- /dev/null +++ b/queue-6.13/arm64-dts-rockchip-fix-fixed-regulator-renames-on-rk.patch @@ -0,0 +1,165 @@ +From 077c62641ad477d6a8f035afe8c3c7c2f11e2b53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 15:36:31 +0100 +Subject: arm64: dts: rockchip: fix fixed-regulator renames on rk3399-gru + devices + +From: Heiko Stuebner + +[ Upstream commit 2f9eb5262e63396a315c7da34a6c80c5d335df9f ] + +rk3399-gru chromebooks have a regulator chains where one named regulator +supplies multiple regulators pp900-usb pp900_pcie that supply +the named peripherals. + +The dtsi used somewhat creative structure to describe that in creating +the base node 3 times with different phandles and describing the EC +dependency in a comment. + +This didn't register in the recent regulator-node renaming, as the +additional nodes were empty, so adapt the missing node names for now. + +Fixes: 5c96e6330197 ("arm64: dts: rockchip: adapt regulator nodenames to preferred form") +Tested-by: Vicente Bergas +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20250116143631.3650469-1-heiko@sntech.de +Signed-off-by: Sasha Levin +--- + .../dts/rockchip/rk3399-gru-chromebook.dtsi | 8 +++---- + .../boot/dts/rockchip/rk3399-gru-scarlet.dtsi | 6 ++--- + arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 22 +++++++++---------- + 3 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +index 988e6ca32fac9..a9ea4b0daa04c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +@@ -22,11 +22,11 @@ pp900_ap: regulator-pp900-ap { + }; + + /* EC turns on w/ pp900_usb_en */ +- pp900_usb: pp900-ap { ++ pp900_usb: regulator-pp900-ap { + }; + + /* EC turns on w/ pp900_pcie_en */ +- pp900_pcie: pp900-ap { ++ pp900_pcie: regulator-pp900-ap { + }; + + pp3000: regulator-pp3000 { +@@ -126,7 +126,7 @@ pp1800_pcie: regulator-pp1800-pcie { + }; + + /* Always on; plain and simple */ +- pp3000_ap: pp3000_emmc: pp3000 { ++ pp3000_ap: pp3000_emmc: regulator-pp3000 { + }; + + pp1500_ap_io: regulator-pp1500-ap-io { +@@ -160,7 +160,7 @@ pp3300_disp: regulator-pp3300-disp { + }; + + /* EC turns on w/ pp3300_usb_en_l */ +- pp3300_usb: pp3300 { ++ pp3300_usb: regulator-pp3300 { + }; + + /* gpio is shared with pp1800_pcie and pinctrl is set there */ +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet.dtsi +index 19b23b4389658..5e068377a0a28 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet.dtsi +@@ -92,7 +92,7 @@ pp900_s3: regulator-pp900-s3 { + }; + + /* EC turns on pp1800_s3_en */ +- pp1800_s3: pp1800 { ++ pp1800_s3: regulator-pp1800 { + }; + + /* pp3300 children, sorted by name */ +@@ -109,11 +109,11 @@ pp2800_cam: regulator-pp2800-avdd { + }; + + /* EC turns on pp3300_s0_en */ +- pp3300_s0: pp3300 { ++ pp3300_s0: regulator-pp3300 { + }; + + /* EC turns on pp3300_s3_en */ +- pp3300_s3: pp3300 { ++ pp3300_s3: regulator-pp3300 { + }; + + /* +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +index 6d9e60b01225e..7eca1da78cffa 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +@@ -189,39 +189,39 @@ ppvar_gpu: ppvar-gpu { + }; + + /* EC turns on w/ pp900_ddrpll_en */ +- pp900_ddrpll: pp900-ap { ++ pp900_ddrpll: regulator-pp900-ap { + }; + + /* EC turns on w/ pp900_pll_en */ +- pp900_pll: pp900-ap { ++ pp900_pll: regulator-pp900-ap { + }; + + /* EC turns on w/ pp900_pmu_en */ +- pp900_pmu: pp900-ap { ++ pp900_pmu: regulator-pp900-ap { + }; + + /* EC turns on w/ pp1800_s0_en_l */ +- pp1800_ap_io: pp1800_emmc: pp1800_nfc: pp1800_s0: pp1800 { ++ pp1800_ap_io: pp1800_emmc: pp1800_nfc: pp1800_s0: regulator-pp1800 { + }; + + /* EC turns on w/ pp1800_avdd_en_l */ +- pp1800_avdd: pp1800 { ++ pp1800_avdd: regulator-pp1800 { + }; + + /* EC turns on w/ pp1800_lid_en_l */ +- pp1800_lid: pp1800_mic: pp1800 { ++ pp1800_lid: pp1800_mic: regulator-pp1800 { + }; + + /* EC turns on w/ lpddr_pwr_en */ +- pp1800_lpddr: pp1800 { ++ pp1800_lpddr: regulator-pp1800 { + }; + + /* EC turns on w/ pp1800_pmu_en_l */ +- pp1800_pmu: pp1800 { ++ pp1800_pmu: regulator-pp1800 { + }; + + /* EC turns on w/ pp1800_usb_en_l */ +- pp1800_usb: pp1800 { ++ pp1800_usb: regulator-pp1800 { + }; + + pp3000_sd_slot: regulator-pp3000-sd-slot { +@@ -259,11 +259,11 @@ ppvar_sd_card_io: ppvar-sd-card-io { + }; + + /* EC turns on w/ pp3300_trackpad_en_l */ +- pp3300_trackpad: pp3300-trackpad { ++ pp3300_trackpad: regulator-pp3300-trackpad { + }; + + /* EC turns on w/ usb_a_en */ +- pp5000_usb_a_vbus: pp5000 { ++ pp5000_usb_a_vbus: regulator-pp5000 { + }; + + ap_rtc_clk: ap-rtc-clk { +-- +2.39.5 + diff --git a/queue-6.13/arm64-dts-rockchip-fix-lcdpwr_en-pin-for-cool-pi-gen.patch b/queue-6.13/arm64-dts-rockchip-fix-lcdpwr_en-pin-for-cool-pi-gen.patch new file mode 100644 index 0000000000..35e3ba590f --- /dev/null +++ b/queue-6.13/arm64-dts-rockchip-fix-lcdpwr_en-pin-for-cool-pi-gen.patch @@ -0,0 +1,46 @@ +From a4d483b8c97b60316ea562db9814934de4a3c745 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 18:47:34 +0800 +Subject: arm64: dts: rockchip: Fix lcdpwr_en pin for Cool Pi GenBook + +From: Andy Yan + +[ Upstream commit a1d939055a22be06d8c12bf53afb258b9d38575f ] + +According to the schematic, the lcdpwr_en pin is GPIO0_C4, +not GPIO1_C4. + +Fixes: 4a8c1161b843 ("arm64: dts: rockchip: Add support for rk3588 based Cool Pi CM5 GenBook") +Signed-off-by: Andy Yan +Link: https://lore.kernel.org/r/20250113104825.2390427-1-andyshrk@163.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5-genbook.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5-genbook.dts b/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5-genbook.dts +index 92f0ed83c9902..bc6b43a771537 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5-genbook.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5-genbook.dts +@@ -113,7 +113,7 @@ vcc3v3_lcd: regulator-vcc3v3-lcd { + compatible = "regulator-fixed"; + regulator-name = "vcc3v3_lcd"; + enable-active-high; +- gpio = <&gpio1 RK_PC4 GPIO_ACTIVE_HIGH>; ++ gpio = <&gpio0 RK_PC4 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&lcdpwr_en>; + vin-supply = <&vcc3v3_sys>; +@@ -241,7 +241,7 @@ &pcie3x4 { + &pinctrl { + lcd { + lcdpwr_en: lcdpwr-en { +- rockchip,pins = <1 RK_PC4 RK_FUNC_GPIO &pcfg_pull_down>; ++ rockchip,pins = <0 RK_PC4 RK_FUNC_GPIO &pcfg_pull_down>; + }; + + bl_en: bl-en { +-- +2.39.5 + diff --git a/queue-6.13/bpf-avoid-holding-freeze_mutex-during-mmap-operation.patch b/queue-6.13/bpf-avoid-holding-freeze_mutex-during-mmap-operation.patch new file mode 100644 index 0000000000..beadb5ad54 --- /dev/null +++ b/queue-6.13/bpf-avoid-holding-freeze_mutex-during-mmap-operation.patch @@ -0,0 +1,79 @@ +From a9a1958779d005cd3834293128ae824fd6730334 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 17:22:46 -0800 +Subject: bpf: avoid holding freeze_mutex during mmap operation + +From: Andrii Nakryiko + +[ Upstream commit bc27c52eea189e8f7492d40739b7746d67b65beb ] + +We use map->freeze_mutex to prevent races between map_freeze() and +memory mapping BPF map contents with writable permissions. The way we +naively do this means we'll hold freeze_mutex for entire duration of all +the mm and VMA manipulations, which is completely unnecessary. This can +potentially also lead to deadlocks, as reported by syzbot in [0]. + +So, instead, hold freeze_mutex only during writeability checks, bump +(proactively) "write active" count for the map, unlock the mutex and +proceed with mmap logic. And only if something went wrong during mmap +logic, then undo that "write active" counter increment. + + [0] https://lore.kernel.org/bpf/678dcbc9.050a0220.303755.0066.GAE@google.com/ + +Fixes: fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY") +Reported-by: syzbot+4dc041c686b7c816a71e@syzkaller.appspotmail.com +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20250129012246.1515826-2-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/syscall.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 60417b79639e5..f086fd8f263f1 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1031,7 +1031,7 @@ static const struct vm_operations_struct bpf_map_default_vmops = { + static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) + { + struct bpf_map *map = filp->private_data; +- int err; ++ int err = 0; + + if (!map->ops->map_mmap || !IS_ERR_OR_NULL(map->record)) + return -ENOTSUPP; +@@ -1055,7 +1055,12 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) + err = -EACCES; + goto out; + } ++ bpf_map_write_active_inc(map); + } ++out: ++ mutex_unlock(&map->freeze_mutex); ++ if (err) ++ return err; + + /* set default open/close callbacks */ + vma->vm_ops = &bpf_map_default_vmops; +@@ -1072,13 +1077,11 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) + vm_flags_clear(vma, VM_MAYWRITE); + + err = map->ops->map_mmap(map, vma); +- if (err) +- goto out; ++ if (err) { ++ if (vma->vm_flags & VM_WRITE) ++ bpf_map_write_active_dec(map); ++ } + +- if (vma->vm_flags & VM_WRITE) +- bpf_map_write_active_inc(map); +-out: +- mutex_unlock(&map->freeze_mutex); + return err; + } + +-- +2.39.5 + diff --git a/queue-6.13/bpf-disable-non-stream-socket-for-strparser.patch b/queue-6.13/bpf-disable-non-stream-socket-for-strparser.patch new file mode 100644 index 0000000000..1e24211ce1 --- /dev/null +++ b/queue-6.13/bpf-disable-non-stream-socket-for-strparser.patch @@ -0,0 +1,51 @@ +From abd2b0f2e8caed33d4ea7044e1e77cd182d61dbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 18:09:15 +0800 +Subject: bpf: Disable non stream socket for strparser + +From: Jiayuan Chen + +[ Upstream commit 5459cce6bf49e72ee29be21865869c2ac42419f5 ] + +Currently, only TCP supports strparser, but sockmap doesn't intercept +non-TCP connections to attach strparser. For example, with UDP, although +the read/write handlers are replaced, strparser is not executed due to +the lack of a read_sock operation. + +Furthermore, in udp_bpf_recvmsg(), it checks whether the psock has data, +and if not, it falls back to the native UDP read interface, making +UDP + strparser appear to read correctly. According to its commit history, +this behavior is unexpected. + +Moreover, since UDP lacks the concept of streams, we intercept it directly. + +Fixes: 1fa1fe8ff161 ("bpf, sockmap: Test shutdown() correctly exits epoll and recv()=0") +Signed-off-by: Jiayuan Chen +Signed-off-by: Martin KaFai Lau +Acked-by: Jakub Sitnicki +Acked-by: John Fastabend +Link: https://patch.msgid.link/20250122100917.49845-4-mrpre@163.com +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index 2f1be9baad057..82a14f131d00c 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -303,7 +303,10 @@ static int sock_map_link(struct bpf_map *map, struct sock *sk) + + write_lock_bh(&sk->sk_callback_lock); + if (stream_parser && stream_verdict && !psock->saved_data_ready) { +- ret = sk_psock_init_strp(sk, psock); ++ if (sk_is_tcp(sk)) ++ ret = sk_psock_init_strp(sk, psock); ++ else ++ ret = -EOPNOTSUPP; + if (ret) { + write_unlock_bh(&sk->sk_callback_lock); + sk_psock_put(sk, psock); +-- +2.39.5 + diff --git a/queue-6.13/bpf-fix-deadlock-when-freeing-cgroup-storage.patch b/queue-6.13/bpf-fix-deadlock-when-freeing-cgroup-storage.patch new file mode 100644 index 0000000000..78e7a906cb --- /dev/null +++ b/queue-6.13/bpf-fix-deadlock-when-freeing-cgroup-storage.patch @@ -0,0 +1,95 @@ +From 2473d94030f1c50268ee0d40f152e1c3dad9a7a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Dec 2024 14:10:16 +0800 +Subject: bpf: Fix deadlock when freeing cgroup storage + +From: Abel Wu + +[ Upstream commit c78f4afbd962f43a3989f45f3ca04300252b19b5 ] + +The following commit +bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]") +first introduced deadlock prevention for fentry/fexit programs attaching +on bpf_task_storage helpers. That commit also employed the logic in map +free path in its v6 version. + +Later bpf_cgrp_storage was first introduced in +c4bcfb38a95e ("bpf: Implement cgroup storage available to non-cgroup-attached bpf progs") +which faces the same issue as bpf_task_storage, instead of its busy +counter, NULL was passed to bpf_local_storage_map_free() which opened +a window to cause deadlock: + + + (acquiring local_storage->lock) + _raw_spin_lock_irqsave+0x3d/0x50 + bpf_local_storage_update+0xd1/0x460 + bpf_cgrp_storage_get+0x109/0x130 + bpf_prog_a4d4a370ba857314_cgrp_ptr+0x139/0x170 + ? __bpf_prog_enter_recur+0x16/0x80 + bpf_trampoline_6442485186+0x43/0xa4 + cgroup_storage_ptr+0x9/0x20 + (holding local_storage->lock) + bpf_selem_unlink_storage_nolock.constprop.0+0x135/0x160 + bpf_selem_unlink_storage+0x6f/0x110 + bpf_local_storage_map_free+0xa2/0x110 + bpf_map_free_deferred+0x5b/0x90 + process_one_work+0x17c/0x390 + worker_thread+0x251/0x360 + kthread+0xd2/0x100 + ret_from_fork+0x34/0x50 + ret_from_fork_asm+0x1a/0x30 + + +Progs: + - A: SEC("fentry/cgroup_storage_ptr") + - cgid (BPF_MAP_TYPE_HASH) + Record the id of the cgroup the current task belonging + to in this hash map, using the address of the cgroup + as the map key. + - cgrpa (BPF_MAP_TYPE_CGRP_STORAGE) + If current task is a kworker, lookup the above hash + map using function parameter @owner as the key to get + its corresponding cgroup id which is then used to get + a trusted pointer to the cgroup through + bpf_cgroup_from_id(). This trusted pointer can then + be passed to bpf_cgrp_storage_get() to finally trigger + the deadlock issue. + - B: SEC("tp_btf/sys_enter") + - cgrpb (BPF_MAP_TYPE_CGRP_STORAGE) + The only purpose of this prog is to fill Prog A's + hash map by calling bpf_cgrp_storage_get() for as + many userspace tasks as possible. + +Steps to reproduce: + - Run A; + - while (true) { Run B; Destroy B; } + +Fix this issue by passing its busy counter to the free procedure so +it can be properly incremented before storage/smap locking. + +Fixes: c4bcfb38a95e ("bpf: Implement cgroup storage available to non-cgroup-attached bpf progs") +Signed-off-by: Abel Wu +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/20241221061018.37717-1-wuyun.abel@bytedance.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/bpf_cgrp_storage.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/bpf_cgrp_storage.c b/kernel/bpf/bpf_cgrp_storage.c +index 20f05de92e9c3..7996fcea3755e 100644 +--- a/kernel/bpf/bpf_cgrp_storage.c ++++ b/kernel/bpf/bpf_cgrp_storage.c +@@ -154,7 +154,7 @@ static struct bpf_map *cgroup_storage_map_alloc(union bpf_attr *attr) + + static void cgroup_storage_map_free(struct bpf_map *map) + { +- bpf_local_storage_map_free(map, &cgroup_cache, NULL); ++ bpf_local_storage_map_free(map, &cgroup_cache, &bpf_cgrp_storage_busy); + } + + /* *gfp_flags* is a hidden argument provided by the verifier */ +-- +2.39.5 + diff --git a/queue-6.13/bpf-fix-softlockup-in-arena_map_free-on-64k-page-ker.patch b/queue-6.13/bpf-fix-softlockup-in-arena_map_free-on-64k-page-ker.patch new file mode 100644 index 0000000000..cb9e2bd237 --- /dev/null +++ b/queue-6.13/bpf-fix-softlockup-in-arena_map_free-on-64k-page-ker.patch @@ -0,0 +1,50 @@ +From f4ceb8e8a08211d696ca281af4e531074160ef4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 17:00:59 +0000 +Subject: bpf: Fix softlockup in arena_map_free on 64k page kernel + +From: Alan Maguire + +[ Upstream commit 517e8a7835e8cfb398a0aeb0133de50e31cae32b ] + +On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, +arena_htab tests cause a segmentation fault and soft lockup. +The same failure is not observed with 4k pages on aarch64. + +It turns out arena_map_free() is calling +apply_to_existing_page_range() with the address returned by +bpf_arena_get_kern_vm_start(). If this address is not page-aligned +the code ends up calling apply_to_pte_range() with that unaligned +address causing soft lockup. + +Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the +division by 2 in bpf_arena_get_kern_vm_start() returns +a page-aligned value. + +Fixes: 317460317a02 ("bpf: Introduce bpf_arena.") +Reported-by: Colm Harrington +Suggested-by: Alexei Starovoitov +Signed-off-by: Alan Maguire +Link: https://lore.kernel.org/r/20250205170059.427458-1-alan.maguire@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/arena.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c +index 8caf56a308d96..eac5d1edefe97 100644 +--- a/kernel/bpf/arena.c ++++ b/kernel/bpf/arena.c +@@ -39,7 +39,7 @@ + */ + + /* number of bytes addressable by LDX/STX insn with 16-bit 'off' field */ +-#define GUARD_SZ (1ull << sizeof_field(struct bpf_insn, off) * 8) ++#define GUARD_SZ round_up(1ull << sizeof_field(struct bpf_insn, off) * 8, PAGE_SIZE << 1) + #define KERN_VM_SZ (SZ_4G + GUARD_SZ) + + struct bpf_arena { +-- +2.39.5 + diff --git a/queue-6.13/bpf-skip-non-exist-keys-in-generic_map_lookup_batch.patch b/queue-6.13/bpf-skip-non-exist-keys-in-generic_map_lookup_batch.patch new file mode 100644 index 0000000000..b2ebe007cd --- /dev/null +++ b/queue-6.13/bpf-skip-non-exist-keys-in-generic_map_lookup_batch.patch @@ -0,0 +1,119 @@ +From c76950da2a3930cfdfcd78fdc016b87a0d08ecf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Feb 2025 23:22:35 -0800 +Subject: bpf: skip non exist keys in generic_map_lookup_batch + +From: Yan Zhai + +[ Upstream commit 5644c6b50ffee0a56c1e01430a8c88e34decb120 ] + +The generic_map_lookup_batch currently returns EINTR if it fails with +ENOENT and retries several times on bpf_map_copy_value. The next batch +would start from the same location, presuming it's a transient issue. +This is incorrect if a map can actually have "holes", i.e. +"get_next_key" can return a key that does not point to a valid value. At +least the array of maps type may contain such holes legitly. Right now +these holes show up, generic batch lookup cannot proceed any more. It +will always fail with EINTR errors. + +Rather, do not retry in generic_map_lookup_batch. If it finds a non +existing element, skip to the next key. This simple solution comes with +a price that transient errors may not be recovered, and the iteration +might cycle back to the first key under parallel deletion. For example, +Hou Tao pointed out a following scenario: + +For LPM trie map: +(1) ->map_get_next_key(map, prev_key, key) returns a valid key + +(2) bpf_map_copy_value() return -ENOMENT +It means the key must be deleted concurrently. + +(3) goto next_key +It swaps the prev_key and key + +(4) ->map_get_next_key(map, prev_key, key) again +prev_key points to a non-existing key, for LPM trie it will treat just +like prev_key=NULL case, the returned key will be duplicated. + +With the retry logic, the iteration can continue to the key next to the +deleted one. But if we directly skip to the next key, the iteration loop +would restart from the first key for the lpm_trie type. + +However, not all races may be recovered. For example, if current key is +deleted after instead of before bpf_map_copy_value, or if the prev_key +also gets deleted, then the loop will still restart from the first key +for lpm_tire anyway. For generic lookup it might be better to stay +simple, i.e. just skip to the next key. To guarantee that the output +keys are not duplicated, it is better to implement map type specific +batch operations, which can properly lock the trie and synchronize with +concurrent mutators. + +Fixes: cb4d03ab499d ("bpf: Add generic support for lookup batch op") +Closes: https://lore.kernel.org/bpf/Z6JXtA1M5jAZx8xD@debian.debian/ +Signed-off-by: Yan Zhai +Acked-by: Hou Tao +Link: https://lore.kernel.org/r/85618439eea75930630685c467ccefeac0942e2b.1739171594.git.yan@cloudflare.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/syscall.c | 18 +++++------------- + 1 file changed, 5 insertions(+), 13 deletions(-) + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index f086fd8f263f1..36cb18b73e725 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1973,8 +1973,6 @@ int generic_map_update_batch(struct bpf_map *map, struct file *map_file, + return err; + } + +-#define MAP_LOOKUP_RETRIES 3 +- + int generic_map_lookup_batch(struct bpf_map *map, + const union bpf_attr *attr, + union bpf_attr __user *uattr) +@@ -1984,8 +1982,8 @@ int generic_map_lookup_batch(struct bpf_map *map, + void __user *values = u64_to_user_ptr(attr->batch.values); + void __user *keys = u64_to_user_ptr(attr->batch.keys); + void *buf, *buf_prevkey, *prev_key, *key, *value; +- int err, retry = MAP_LOOKUP_RETRIES; + u32 value_size, cp, max_count; ++ int err; + + if (attr->batch.elem_flags & ~BPF_F_LOCK) + return -EINVAL; +@@ -2031,14 +2029,8 @@ int generic_map_lookup_batch(struct bpf_map *map, + err = bpf_map_copy_value(map, key, value, + attr->batch.elem_flags); + +- if (err == -ENOENT) { +- if (retry) { +- retry--; +- continue; +- } +- err = -EINTR; +- break; +- } ++ if (err == -ENOENT) ++ goto next_key; + + if (err) + goto free_buf; +@@ -2053,12 +2045,12 @@ int generic_map_lookup_batch(struct bpf_map *map, + goto free_buf; + } + ++ cp++; ++next_key: + if (!prev_key) + prev_key = buf_prevkey; + + swap(prev_key, key); +- retry = MAP_LOOKUP_RETRIES; +- cp++; + cond_resched(); + } + +-- +2.39.5 + diff --git a/queue-6.13/bpf-test_run-fix-use-after-free-issue-in-eth_skb_pkt.patch b/queue-6.13/bpf-test_run-fix-use-after-free-issue-in-eth_skb_pkt.patch new file mode 100644 index 0000000000..a95a903897 --- /dev/null +++ b/queue-6.13/bpf-test_run-fix-use-after-free-issue-in-eth_skb_pkt.patch @@ -0,0 +1,92 @@ +From 614892ba4e863b09383351048b08fd49dbc8ee7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 00:06:42 +0900 +Subject: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() + +From: Shigeru Yoshida + +[ Upstream commit 6b3d638ca897e099fa99bd6d02189d3176f80a47 ] + +KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The +cause of the issue was that eth_skb_pkt_type() accessed skb's data +that didn't contain an Ethernet header. This occurs when +bpf_prog_test_run_xdp() passes an invalid value as the user_data +argument to bpf_test_init(). + +Fix this by returning an error when user_data is less than ETH_HLEN in +bpf_test_init(). Additionally, remove the check for "if (user_size > +size)" as it is unnecessary. + +[1] +BUG: KMSAN: use-after-free in eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] +BUG: KMSAN: use-after-free in eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 + eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] + eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 + __xdp_build_skb_from_frame+0x5a8/0xa50 net/core/xdp.c:635 + xdp_recv_frames net/bpf/test_run.c:272 [inline] + xdp_test_run_batch net/bpf/test_run.c:361 [inline] + bpf_test_run_xdp_live+0x2954/0x3330 net/bpf/test_run.c:390 + bpf_prog_test_run_xdp+0x148e/0x1b10 net/bpf/test_run.c:1318 + bpf_prog_test_run+0x5b7/0xa30 kernel/bpf/syscall.c:4371 + __sys_bpf+0x6a6/0xe20 kernel/bpf/syscall.c:5777 + __do_sys_bpf kernel/bpf/syscall.c:5866 [inline] + __se_sys_bpf kernel/bpf/syscall.c:5864 [inline] + __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:5864 + x64_sys_call+0x2ea0/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:322 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Uninit was created at: + free_pages_prepare mm/page_alloc.c:1056 [inline] + free_unref_page+0x156/0x1320 mm/page_alloc.c:2657 + __free_pages+0xa3/0x1b0 mm/page_alloc.c:4838 + bpf_ringbuf_free kernel/bpf/ringbuf.c:226 [inline] + ringbuf_map_free+0xff/0x1e0 kernel/bpf/ringbuf.c:235 + bpf_map_free kernel/bpf/syscall.c:838 [inline] + bpf_map_free_deferred+0x17c/0x310 kernel/bpf/syscall.c:862 + process_one_work kernel/workqueue.c:3229 [inline] + process_scheduled_works+0xa2b/0x1b60 kernel/workqueue.c:3310 + worker_thread+0xedf/0x1550 kernel/workqueue.c:3391 + kthread+0x535/0x6b0 kernel/kthread.c:389 + ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + +CPU: 1 UID: 0 PID: 17276 Comm: syz.1.16450 Not tainted 6.12.0-05490-g9bb88c659673 #8 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 + +Fixes: be3d72a2896c ("bpf: move user_size out of bpf_test_init") +Reported-by: syzkaller +Suggested-by: Martin KaFai Lau +Signed-off-by: Shigeru Yoshida +Signed-off-by: Martin KaFai Lau +Acked-by: Stanislav Fomichev +Acked-by: Daniel Borkmann +Link: https://patch.msgid.link/20250121150643.671650-1-syoshida@redhat.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/bpf/test_run.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c +index 501ec4249fedc..8612023bec60d 100644 +--- a/net/bpf/test_run.c ++++ b/net/bpf/test_run.c +@@ -660,12 +660,9 @@ static void *bpf_test_init(const union bpf_attr *kattr, u32 user_size, + void __user *data_in = u64_to_user_ptr(kattr->test.data_in); + void *data; + +- if (size < ETH_HLEN || size > PAGE_SIZE - headroom - tailroom) ++ if (user_size < ETH_HLEN || user_size > PAGE_SIZE - headroom - tailroom) + return ERR_PTR(-EINVAL); + +- if (user_size > size) +- return ERR_PTR(-EMSGSIZE); +- + size = SKB_DATA_ALIGN(size); + data = kzalloc(size + headroom + tailroom, GFP_USER); + if (!data) +-- +2.39.5 + diff --git a/queue-6.13/bpf-unify-vm_write-vs-vm_maywrite-use-in-bpf-map-mma.patch b/queue-6.13/bpf-unify-vm_write-vs-vm_maywrite-use-in-bpf-map-mma.patch new file mode 100644 index 0000000000..ba186684cc --- /dev/null +++ b/queue-6.13/bpf-unify-vm_write-vs-vm_maywrite-use-in-bpf-map-mma.patch @@ -0,0 +1,112 @@ +From eade031016822b7ad80c1e9a2a57a2a696914dd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 17:22:45 -0800 +Subject: bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic + +From: Andrii Nakryiko + +[ Upstream commit 98671a0fd1f14e4a518ee06b19037c20014900eb ] + +For all BPF maps we ensure that VM_MAYWRITE is cleared when +memory-mapping BPF map contents as initially read-only VMA. This is +because in some cases BPF verifier relies on the underlying data to not +be modified afterwards by user space, so once something is mapped +read-only, it shouldn't be re-mmap'ed as read-write. + +As such, it's not necessary to check VM_MAYWRITE in bpf_map_mmap() and +map->ops->map_mmap() callbacks: VM_WRITE should be consistently set for +read-write mappings, and if VM_WRITE is not set, there is no way for +user space to upgrade read-only mapping to read-write one. + +This patch cleans up this VM_WRITE vs VM_MAYWRITE handling within +bpf_map_mmap(), which is an entry point for any BPF map mmap()-ing +logic. We also drop unnecessary sanitization of VM_MAYWRITE in BPF +ringbuf's map_mmap() callback implementation, as it is already performed +by common code in bpf_map_mmap(). + +Note, though, that in bpf_map_mmap_{open,close}() callbacks we can't +drop VM_MAYWRITE use, because it's possible (and is outside of +subsystem's control) to have initially read-write memory mapping, which +is subsequently dropped to read-only by user space through mprotect(). +In such case, from BPF verifier POV it's read-write data throughout the +lifetime of BPF map, and is counted as "active writer". + +But its VMAs will start out as VM_WRITE|VM_MAYWRITE, then mprotect() can +change it to just VM_MAYWRITE (and no VM_WRITE), so when its finally +munmap()'ed and bpf_map_mmap_close() is called, vm_flags will be just +VM_MAYWRITE, but we still need to decrement active writer count with +bpf_map_write_active_dec() as it's still considered to be a read-write +mapping by the rest of BPF subsystem. + +Similar reasoning applies to bpf_map_mmap_open(), which is called +whenever mmap(), munmap(), and/or mprotect() forces mm subsystem to +split original VMA into multiple discontiguous VMAs. + +Memory-mapping handling is a bit tricky, yes. + +Cc: Jann Horn +Cc: Suren Baghdasaryan +Cc: Shakeel Butt +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20250129012246.1515826-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Stable-dep-of: bc27c52eea18 ("bpf: avoid holding freeze_mutex during mmap operation") +Signed-off-by: Sasha Levin +--- + kernel/bpf/ringbuf.c | 4 ---- + kernel/bpf/syscall.c | 10 ++++++++-- + 2 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c +index e1cfe890e0be6..1499d8caa9a35 100644 +--- a/kernel/bpf/ringbuf.c ++++ b/kernel/bpf/ringbuf.c +@@ -268,8 +268,6 @@ static int ringbuf_map_mmap_kern(struct bpf_map *map, struct vm_area_struct *vma + /* allow writable mapping for the consumer_pos only */ + if (vma->vm_pgoff != 0 || vma->vm_end - vma->vm_start != PAGE_SIZE) + return -EPERM; +- } else { +- vm_flags_clear(vma, VM_MAYWRITE); + } + /* remap_vmalloc_range() checks size and offset constraints */ + return remap_vmalloc_range(vma, rb_map->rb, +@@ -289,8 +287,6 @@ static int ringbuf_map_mmap_user(struct bpf_map *map, struct vm_area_struct *vma + * position, and the ring buffer data itself. + */ + return -EPERM; +- } else { +- vm_flags_clear(vma, VM_MAYWRITE); + } + /* remap_vmalloc_range() checks size and offset constraints */ + return remap_vmalloc_range(vma, rb_map->rb, vma->vm_pgoff + RINGBUF_PGOFF); +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 5684e8ce132d5..60417b79639e5 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1061,15 +1061,21 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) + vma->vm_ops = &bpf_map_default_vmops; + vma->vm_private_data = map; + vm_flags_clear(vma, VM_MAYEXEC); ++ /* If mapping is read-only, then disallow potentially re-mapping with ++ * PROT_WRITE by dropping VM_MAYWRITE flag. This VM_MAYWRITE clearing ++ * means that as far as BPF map's memory-mapped VMAs are concerned, ++ * VM_WRITE and VM_MAYWRITE and equivalent, if one of them is set, ++ * both should be set, so we can forget about VM_MAYWRITE and always ++ * check just VM_WRITE ++ */ + if (!(vma->vm_flags & VM_WRITE)) +- /* disallow re-mapping with PROT_WRITE */ + vm_flags_clear(vma, VM_MAYWRITE); + + err = map->ops->map_mmap(map, vma); + if (err) + goto out; + +- if (vma->vm_flags & VM_MAYWRITE) ++ if (vma->vm_flags & VM_WRITE) + bpf_map_write_active_inc(map); + out: + mutex_unlock(&map->freeze_mutex); +-- +2.39.5 + diff --git a/queue-6.13/drm-msm-avoid-rounding-up-to-one-jiffy.patch b/queue-6.13/drm-msm-avoid-rounding-up-to-one-jiffy.patch new file mode 100644 index 0000000000..5e385266ed --- /dev/null +++ b/queue-6.13/drm-msm-avoid-rounding-up-to-one-jiffy.patch @@ -0,0 +1,48 @@ +From d001366d35b121a758866ebb5bc4132a3dd0ca1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2025 07:48:41 -0800 +Subject: drm/msm: Avoid rounding up to one jiffy + +From: Rob Clark + +[ Upstream commit 669c285620231786fffe9d87ab432e08a6ed922b ] + +If userspace is trying to achieve a timeout of zero, let 'em have it. +Only round up if the timeout is greater than zero. + +Fixes: 4969bccd5f4e ("drm/msm: Avoid rounding down to zero jiffies") +Signed-off-by: Rob Clark +Reviewed-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/632264/ +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.h | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h +index d8c9a1b192632..f15962cfb373c 100644 +--- a/drivers/gpu/drm/msm/msm_drv.h ++++ b/drivers/gpu/drm/msm/msm_drv.h +@@ -530,15 +530,12 @@ static inline int align_pitch(int width, int bpp) + static inline unsigned long timeout_to_jiffies(const ktime_t *timeout) + { + ktime_t now = ktime_get(); +- s64 remaining_jiffies; + +- if (ktime_compare(*timeout, now) < 0) { +- remaining_jiffies = 0; +- } else { +- ktime_t rem = ktime_sub(*timeout, now); +- remaining_jiffies = ktime_divns(rem, NSEC_PER_SEC / HZ); +- } ++ if (ktime_compare(*timeout, now) <= 0) ++ return 0; + ++ ktime_t rem = ktime_sub(*timeout, now); ++ s64 remaining_jiffies = ktime_divns(rem, NSEC_PER_SEC / HZ); + return clamp(remaining_jiffies, 1LL, (s64)INT_MAX); + } + +-- +2.39.5 + diff --git a/queue-6.13/drm-msm-dpu-don-t-leak-bits_per_component-into-rando.patch b/queue-6.13/drm-msm-dpu-don-t-leak-bits_per_component-into-rando.patch new file mode 100644 index 0000000000..f8cde93295 --- /dev/null +++ b/queue-6.13/drm-msm-dpu-don-t-leak-bits_per_component-into-rando.patch @@ -0,0 +1,68 @@ +From e5d592694722b6d35bf64d7b5112df96afff5165 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Feb 2025 00:19:32 +0100 +Subject: drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC fields + +From: Marijn Suijten + +[ Upstream commit 144429831f447223253a0e4376489f84ff37d1a7 ] + +What used to be the input_10_bits boolean - feeding into the lowest +bit of DSC_ENC - on MSM downstream turned into an accidental OR with +the full bits_per_component number when it was ported to the upstream +kernel. + +On typical bpc=8 setups we don't notice this because line_buf_depth is +always an odd value (it contains bpc+1) and will also set the 4th bit +after left-shifting by 3 (hence this |= bits_per_component is a no-op). + +Now that guards are being removed to allow more bits_per_component +values besides 8 (possible since commit 49fd30a7153b ("drm/msm/dsi: use +DRM DSC helpers for DSC setup")), a bpc of 10 will instead clash with +the 5th bit which is convert_rgb. This is "fortunately" also always set +to true by MSM's dsi_populate_dsc_params() already, but once a bpc of 12 +starts being used it'll write into simple_422 which is normally false. + +To solve all these overlaps, simply replicate downstream code and only +set this lowest bit if bits_per_component is equal to 10. It is unclear +why DSC requires this only for bpc=10 but not bpc=12, and also notice +that this lowest bit wasn't set previously despite having a panel and +patch on the list using it without any mentioned issues. + +Fixes: c110cfd1753e ("drm/msm/disp/dpu1: Add support for DSC") +Signed-off-by: Marijn Suijten +Reviewed-by: Abhinav Kumar +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/636311/ +Link: https://lore.kernel.org/r/20250211-dsc-10-bit-v1-1-1c85a9430d9a@somainline.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c +index 657200401f576..cec6d4e8baec4 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.c +@@ -52,6 +52,7 @@ static void dpu_hw_dsc_config(struct dpu_hw_dsc *hw_dsc, + u32 slice_last_group_size; + u32 det_thresh_flatness; + bool is_cmd_mode = !(mode & DSC_MODE_VIDEO); ++ bool input_10_bits = dsc->bits_per_component == 10; + + DPU_REG_WRITE(c, DSC_COMMON_MODE, mode); + +@@ -68,7 +69,7 @@ static void dpu_hw_dsc_config(struct dpu_hw_dsc *hw_dsc, + data |= (dsc->line_buf_depth << 3); + data |= (dsc->simple_422 << 2); + data |= (dsc->convert_rgb << 1); +- data |= dsc->bits_per_component; ++ data |= input_10_bits; + + DPU_REG_WRITE(c, DSC_ENC, data); + +-- +2.39.5 + diff --git a/queue-6.13/drm-msm-dpu-enable-dpu_wb_input_ctrl-for-dpu-5.x.patch b/queue-6.13/drm-msm-dpu-enable-dpu_wb_input_ctrl-for-dpu-5.x.patch new file mode 100644 index 0000000000..83e03ce6b5 --- /dev/null +++ b/queue-6.13/drm-msm-dpu-enable-dpu_wb_input_ctrl-for-dpu-5.x.patch @@ -0,0 +1,70 @@ +From 6daf7882152dc52d6df4ca78d1fab459b1d6f88a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 00:14:18 +0200 +Subject: drm/msm/dpu: enable DPU_WB_INPUT_CTRL for DPU 5.x + +From: Dmitry Baryshkov + +[ Upstream commit af0a4a2090cce732c70ad6c5f4145b43f39e3fe9 ] + +Several DPU 5.x platforms are supposed to be using DPU_WB_INPUT_CTRL, +to bind WB and PINGPONG blocks, but they do not. Change those platforms +to use WB_SM8250_MASK, which includes that bit. + +Fixes: 1f5bcc4316b3 ("drm/msm/dpu: enable writeback on SC8108X") +Fixes: ab2b03d73a66 ("drm/msm/dpu: enable writeback on SM6125") +Fixes: 47cebb740a83 ("drm/msm/dpu: enable writeback on SM8150") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/628876/ +Link: https://lore.kernel.org/r/20241214-dpu-drop-features-v1-2-988f0662cb7e@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h | 2 +- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 2 +- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_4_sm6125.h | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h +index 421afacb72480..36cc9dbc00b5c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h +@@ -297,7 +297,7 @@ static const struct dpu_wb_cfg sm8150_wb[] = { + { + .name = "wb_2", .id = WB_2, + .base = 0x65000, .len = 0x2c8, +- .features = WB_SDM845_MASK, ++ .features = WB_SM8250_MASK, + .format_list = wb2_formats_rgb, + .num_formats = ARRAY_SIZE(wb2_formats_rgb), + .clk_ctrl = DPU_CLK_CTRL_WB2, +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h +index 641023b102bf5..e8eacdb47967a 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h +@@ -304,7 +304,7 @@ static const struct dpu_wb_cfg sc8180x_wb[] = { + { + .name = "wb_2", .id = WB_2, + .base = 0x65000, .len = 0x2c8, +- .features = WB_SDM845_MASK, ++ .features = WB_SM8250_MASK, + .format_list = wb2_formats_rgb, + .num_formats = ARRAY_SIZE(wb2_formats_rgb), + .clk_ctrl = DPU_CLK_CTRL_WB2, +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_4_sm6125.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_4_sm6125.h +index d039b96beb97c..76f60a2df7a89 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_4_sm6125.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_4_sm6125.h +@@ -144,7 +144,7 @@ static const struct dpu_wb_cfg sm6125_wb[] = { + { + .name = "wb_2", .id = WB_2, + .base = 0x65000, .len = 0x2c8, +- .features = WB_SDM845_MASK, ++ .features = WB_SM8250_MASK, + .format_list = wb2_formats_rgb, + .num_formats = ARRAY_SIZE(wb2_formats_rgb), + .clk_ctrl = DPU_CLK_CTRL_WB2, +-- +2.39.5 + diff --git a/queue-6.13/drm-msm-dpu-skip-watchdog-timer-programming-through-.patch b/queue-6.13/drm-msm-dpu-skip-watchdog-timer-programming-through-.patch new file mode 100644 index 0000000000..84ed471a3d --- /dev/null +++ b/queue-6.13/drm-msm-dpu-skip-watchdog-timer-programming-through-.patch @@ -0,0 +1,41 @@ +From 2187c6fdc4cbfaf49a0fc6f13ce6840648d0e79e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 00:14:17 +0200 +Subject: drm/msm/dpu: skip watchdog timer programming through TOP on >= SM8450 + +From: Dmitry Baryshkov + +[ Upstream commit 2f69e54584475ac85ea0e3407c9198ac7c6ea8ad ] + +The SM8450 and later chips have DPU_MDP_PERIPH_0_REMOVED feature bit +set, which means that those platforms have dropped some of the +registers, including the WD TIMER-related ones. Stop providing the +callback to program WD timer on those platforms. + +Fixes: 100d7ef6995d ("drm/msm/dpu: add support for SM8450") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/628874/ +Link: https://lore.kernel.org/r/20241214-dpu-drop-features-v1-1-988f0662cb7e@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.c +index ad19330de61ab..562a3f4c5238a 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.c +@@ -272,7 +272,7 @@ static void _setup_mdp_ops(struct dpu_hw_mdp_ops *ops, + + if (cap & BIT(DPU_MDP_VSYNC_SEL)) + ops->setup_vsync_source = dpu_hw_setup_vsync_sel; +- else ++ else if (!(cap & BIT(DPU_MDP_PERIPH_0_REMOVED))) + ops->setup_vsync_source = dpu_hw_setup_wd_timer; + + ops->get_safe_status = dpu_hw_get_safe_status; +-- +2.39.5 + diff --git a/queue-6.13/drm-msm-dsi-phy-do-not-overwite-phy_cmn_clk_cfg1-whe.patch b/queue-6.13/drm-msm-dsi-phy-do-not-overwite-phy_cmn_clk_cfg1-whe.patch new file mode 100644 index 0000000000..4d8ec57725 --- /dev/null +++ b/queue-6.13/drm-msm-dsi-phy-do-not-overwite-phy_cmn_clk_cfg1-whe.patch @@ -0,0 +1,72 @@ +From c11e7c6c7dca644d4ba7d30b73b2594d9393c6a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2025 16:08:43 +0100 +Subject: drm/msm/dsi/phy: Do not overwite PHY_CMN_CLK_CFG1 when choosing + bitclk source + +From: Krzysztof Kozlowski + +[ Upstream commit 73f69c6be2a9f22c31c775ec03c6c286bfe12cfa ] + +PHY_CMN_CLK_CFG1 register has four fields being used in the driver: DSI +clock divider, source of bitclk and two for enabling the DSI PHY PLL +clocks. + +dsi_7nm_set_usecase() sets only the source of bitclk, so should leave +all other bits untouched. Use newly introduced +dsi_pll_cmn_clk_cfg1_update() to update respective bits without +overwriting the rest. + +While shuffling the code, define and use PHY_CMN_CLK_CFG1 bitfields to +make the code more readable and obvious. + +Fixes: 1ef7c99d145c ("drm/msm/dsi: add support for 7nm DSI PHY/PLL") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/637380/ +Link: https://lore.kernel.org/r/20250214-drm-msm-phy-pll-cfg-reg-v3-3-0943b850722c@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 4 ++-- + drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml | 1 + + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +index 388017db45d80..798168180c1ab 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +@@ -617,7 +617,6 @@ static int dsi_7nm_pll_restore_state(struct msm_dsi_phy *phy) + static int dsi_7nm_set_usecase(struct msm_dsi_phy *phy) + { + struct dsi_pll_7nm *pll_7nm = to_pll_7nm(phy->vco_hw); +- void __iomem *base = phy->base; + u32 data = 0x0; /* internal PLL */ + + DBG("DSI PLL%d", pll_7nm->phy->id); +@@ -636,7 +635,8 @@ static int dsi_7nm_set_usecase(struct msm_dsi_phy *phy) + } + + /* set PLL src */ +- writel(data << 2, base + REG_DSI_7nm_PHY_CMN_CLK_CFG1); ++ dsi_pll_cmn_clk_cfg1_update(pll_7nm, DSI_7nm_PHY_CMN_CLK_CFG1_BITCLK_SEL__MASK, ++ DSI_7nm_PHY_CMN_CLK_CFG1_BITCLK_SEL(data)); + + return 0; + } +diff --git a/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml b/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml +index cfaf78c028b13..35f7f40e405b7 100644 +--- a/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml ++++ b/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml +@@ -16,6 +16,7 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd"> + + + ++ + + + +-- +2.39.5 + diff --git a/queue-6.13/drm-msm-dsi-phy-protect-phy_cmn_clk_cfg0-updated-fro.patch b/queue-6.13/drm-msm-dsi-phy-protect-phy_cmn_clk_cfg0-updated-fro.patch new file mode 100644 index 0000000000..b22f8ae458 --- /dev/null +++ b/queue-6.13/drm-msm-dsi-phy-protect-phy_cmn_clk_cfg0-updated-fro.patch @@ -0,0 +1,87 @@ +From 06a375aa3f06b3179662aa541580ab8f2fbc2856 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2025 16:08:41 +0100 +Subject: drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG0 updated from driver side + +From: Krzysztof Kozlowski + +[ Upstream commit 588257897058a0b1aa47912db4fe93c6ff5e3887 ] + +PHY_CMN_CLK_CFG0 register is updated by the PHY driver and by two +divider clocks from Common Clock Framework: +devm_clk_hw_register_divider_parent_hw(). Concurrent access by the +clocks side is protected with spinlock, however driver's side in +restoring state is not. Restoring state is called from +msm_dsi_phy_enable(), so there could be a path leading to concurrent and +conflicting updates with clock framework. + +Add missing lock usage on the PHY driver side, encapsulated in its own +function so the code will be still readable. + +While shuffling the code, define and use PHY_CMN_CLK_CFG0 bitfields to +make the code more readable and obvious. + +Fixes: 1ef7c99d145c ("drm/msm/dsi: add support for 7nm DSI PHY/PLL") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Signed-off-by: Krzysztof Kozlowski +Patchwork: https://patchwork.freedesktop.org/patch/637376/ +Link: https://lore.kernel.org/r/20250214-drm-msm-phy-pll-cfg-reg-v3-1-0943b850722c@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 14 ++++++++++++-- + .../gpu/drm/msm/registers/display/dsi_phy_7nm.xml | 5 ++++- + 2 files changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +index 031446c87daec..25ca649de717e 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +@@ -372,6 +372,15 @@ static void dsi_pll_enable_pll_bias(struct dsi_pll_7nm *pll) + ndelay(250); + } + ++static void dsi_pll_cmn_clk_cfg0_write(struct dsi_pll_7nm *pll, u32 val) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&pll->postdiv_lock, flags); ++ writel(val, pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG0); ++ spin_unlock_irqrestore(&pll->postdiv_lock, flags); ++} ++ + static void dsi_pll_disable_global_clk(struct dsi_pll_7nm *pll) + { + u32 data; +@@ -574,8 +583,9 @@ static int dsi_7nm_pll_restore_state(struct msm_dsi_phy *phy) + val |= cached->pll_out_div; + writel(val, pll_7nm->phy->pll_base + REG_DSI_7nm_PHY_PLL_PLL_OUTDIV_RATE); + +- writel(cached->bit_clk_div | (cached->pix_clk_div << 4), +- phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG0); ++ dsi_pll_cmn_clk_cfg0_write(pll_7nm, ++ DSI_7nm_PHY_CMN_CLK_CFG0_DIV_CTRL_3_0(cached->bit_clk_div) | ++ DSI_7nm_PHY_CMN_CLK_CFG0_DIV_CTRL_7_4(cached->pix_clk_div)); + + val = readl(phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG1); + val &= ~0x3; +diff --git a/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml b/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml +index d54b72f924493..e0bf6e016b4ce 100644 +--- a/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml ++++ b/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml +@@ -9,7 +9,10 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd"> + + + +- ++ ++ ++ ++ + + + +-- +2.39.5 + diff --git a/queue-6.13/drm-msm-dsi-phy-protect-phy_cmn_clk_cfg1-against-clo.patch b/queue-6.13/drm-msm-dsi-phy-protect-phy_cmn_clk_cfg1-against-clo.patch new file mode 100644 index 0000000000..407d9b8de8 --- /dev/null +++ b/queue-6.13/drm-msm-dsi-phy-protect-phy_cmn_clk_cfg1-against-clo.patch @@ -0,0 +1,144 @@ +From 25cb30ca08ea55488361ef74d80c30f397c1eb77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2025 16:08:42 +0100 +Subject: drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG1 against clock driver + +From: Krzysztof Kozlowski + +[ Upstream commit 5a97bc924ae0804b8dbf627e357acaa5ef761483 ] + +PHY_CMN_CLK_CFG1 register is updated by the PHY driver and by a mux +clock from Common Clock Framework: +devm_clk_hw_register_mux_parent_hws(). There could be a path leading to +concurrent and conflicting updates between PHY driver and clock +framework, e.g. changing the mux and enabling PLL clocks. + +Add dedicated spinlock to be sure all PHY_CMN_CLK_CFG1 updates are +synchronized. + +While shuffling the code, define and use PHY_CMN_CLK_CFG1 bitfields to +make the code more readable and obvious. + +Fixes: 1ef7c99d145c ("drm/msm/dsi: add support for 7nm DSI PHY/PLL") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/637378/ +Link: https://lore.kernel.org/r/20250214-drm-msm-phy-pll-cfg-reg-v3-2-0943b850722c@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 35 ++++++++++++------- + .../drm/msm/registers/display/dsi_phy_7nm.xml | 5 ++- + 2 files changed, 26 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +index 25ca649de717e..388017db45d80 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +@@ -83,6 +83,9 @@ struct dsi_pll_7nm { + /* protects REG_DSI_7nm_PHY_CMN_CLK_CFG0 register */ + spinlock_t postdiv_lock; + ++ /* protects REG_DSI_7nm_PHY_CMN_CLK_CFG1 register */ ++ spinlock_t pclk_mux_lock; ++ + struct pll_7nm_cached_state cached_state; + + struct dsi_pll_7nm *slave; +@@ -381,22 +384,32 @@ static void dsi_pll_cmn_clk_cfg0_write(struct dsi_pll_7nm *pll, u32 val) + spin_unlock_irqrestore(&pll->postdiv_lock, flags); + } + +-static void dsi_pll_disable_global_clk(struct dsi_pll_7nm *pll) ++static void dsi_pll_cmn_clk_cfg1_update(struct dsi_pll_7nm *pll, u32 mask, ++ u32 val) + { ++ unsigned long flags; + u32 data; + ++ spin_lock_irqsave(&pll->pclk_mux_lock, flags); + data = readl(pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1); +- writel(data & ~BIT(5), pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1); ++ data &= ~mask; ++ data |= val & mask; ++ ++ writel(data, pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1); ++ spin_unlock_irqrestore(&pll->pclk_mux_lock, flags); ++} ++ ++static void dsi_pll_disable_global_clk(struct dsi_pll_7nm *pll) ++{ ++ dsi_pll_cmn_clk_cfg1_update(pll, DSI_7nm_PHY_CMN_CLK_CFG1_CLK_EN, 0); + } + + static void dsi_pll_enable_global_clk(struct dsi_pll_7nm *pll) + { +- u32 data; ++ u32 cfg_1 = DSI_7nm_PHY_CMN_CLK_CFG1_CLK_EN | DSI_7nm_PHY_CMN_CLK_CFG1_CLK_EN_SEL; + + writel(0x04, pll->phy->base + REG_DSI_7nm_PHY_CMN_CTRL_3); +- +- data = readl(pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1); +- writel(data | BIT(5) | BIT(4), pll->phy->base + REG_DSI_7nm_PHY_CMN_CLK_CFG1); ++ dsi_pll_cmn_clk_cfg1_update(pll, cfg_1, cfg_1); + } + + static void dsi_pll_phy_dig_reset(struct dsi_pll_7nm *pll) +@@ -574,7 +587,6 @@ static int dsi_7nm_pll_restore_state(struct msm_dsi_phy *phy) + { + struct dsi_pll_7nm *pll_7nm = to_pll_7nm(phy->vco_hw); + struct pll_7nm_cached_state *cached = &pll_7nm->cached_state; +- void __iomem *phy_base = pll_7nm->phy->base; + u32 val; + int ret; + +@@ -586,11 +598,7 @@ static int dsi_7nm_pll_restore_state(struct msm_dsi_phy *phy) + dsi_pll_cmn_clk_cfg0_write(pll_7nm, + DSI_7nm_PHY_CMN_CLK_CFG0_DIV_CTRL_3_0(cached->bit_clk_div) | + DSI_7nm_PHY_CMN_CLK_CFG0_DIV_CTRL_7_4(cached->pix_clk_div)); +- +- val = readl(phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG1); +- val &= ~0x3; +- val |= cached->pll_mux; +- writel(val, phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG1); ++ dsi_pll_cmn_clk_cfg1_update(pll_7nm, 0x3, cached->pll_mux); + + ret = dsi_pll_7nm_vco_set_rate(phy->vco_hw, + pll_7nm->vco_current_rate, +@@ -743,7 +751,7 @@ static int pll_7nm_register(struct dsi_pll_7nm *pll_7nm, struct clk_hw **provide + pll_by_2_bit, + }), 2, 0, pll_7nm->phy->base + + REG_DSI_7nm_PHY_CMN_CLK_CFG1, +- 0, 1, 0, NULL); ++ 0, 1, 0, &pll_7nm->pclk_mux_lock); + if (IS_ERR(hw)) { + ret = PTR_ERR(hw); + goto fail; +@@ -788,6 +796,7 @@ static int dsi_pll_7nm_init(struct msm_dsi_phy *phy) + pll_7nm_list[phy->id] = pll_7nm; + + spin_lock_init(&pll_7nm->postdiv_lock); ++ spin_lock_init(&pll_7nm->pclk_mux_lock); + + pll_7nm->phy = phy; + +diff --git a/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml b/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml +index e0bf6e016b4ce..cfaf78c028b13 100644 +--- a/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml ++++ b/drivers/gpu/drm/msm/registers/display/dsi_phy_7nm.xml +@@ -13,7 +13,10 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd"> + + + +- ++ ++ ++ ++ + + + +-- +2.39.5 + diff --git a/queue-6.13/drm-nouveau-pmu-fix-gp10b-firmware-guard.patch b/queue-6.13/drm-nouveau-pmu-fix-gp10b-firmware-guard.patch new file mode 100644 index 0000000000..c3fdc5f033 --- /dev/null +++ b/queue-6.13/drm-nouveau-pmu-fix-gp10b-firmware-guard.patch @@ -0,0 +1,38 @@ +From a9bcf5c01e073ea834b68fd2803d963024412447 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 03:28:03 -0600 +Subject: drm/nouveau/pmu: Fix gp10b firmware guard + +From: Aaron Kling + +[ Upstream commit 3dbc0215e3c502a9f3221576da0fdc9847fb9721 ] + +Most kernel configs enable multiple Tegra SoC generations, causing this +typo to go unnoticed. But in the case where a kernel config is strictly +for Tegra186, this is a problem. + +Fixes: 989863d7cbe5 ("drm/nouveau/pmu: select implementation based on available firmware") +Signed-off-by: Aaron Kling +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20250218-nouveau-gm10b-guard-v2-1-a4de71500d48@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c +index a6f410ba60bc9..d393bc540f862 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c +@@ -75,7 +75,7 @@ gp10b_pmu_acr = { + .bootstrap_multiple_falcons = gp10b_pmu_acr_bootstrap_multiple_falcons, + }; + +-#if IS_ENABLED(CONFIG_ARCH_TEGRA_210_SOC) ++#if IS_ENABLED(CONFIG_ARCH_TEGRA_186_SOC) + MODULE_FIRMWARE("nvidia/gp10b/pmu/desc.bin"); + MODULE_FIRMWARE("nvidia/gp10b/pmu/image.bin"); + MODULE_FIRMWARE("nvidia/gp10b/pmu/sig.bin"); +-- +2.39.5 + diff --git a/queue-6.13/drm-xe-fix-error-handling-in-xe_irq_install.patch b/queue-6.13/drm-xe-fix-error-handling-in-xe_irq_install.patch new file mode 100644 index 0000000000..3827ec84a2 --- /dev/null +++ b/queue-6.13/drm-xe-fix-error-handling-in-xe_irq_install.patch @@ -0,0 +1,57 @@ +From 456c92653e4998fbffeaee210c7ac5f24522281c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 11:28:59 -0800 +Subject: drm/xe: Fix error handling in xe_irq_install() + +From: Lucas De Marchi + +[ Upstream commit 0c455f3a12298e9c89a78d2f3327e15e52c0adc5 ] + +When devm_add_action_or_reset() fails, it already calls the function +passed as parameter and that function is already free'ing the irqs. +Drop the goto and just return. + +The caller, xe_device_probe(), should also do the same thing instead of +wrongly doing `goto err` and calling the unrelated xe_display_fini() +function. + +Fixes: 14d25d8d684d ("drm/xe: change old msi irq api to a new one") +Reviewed-by: Rodrigo Vivi +Reviewed-by: Himal Prasad Ghimiray +Link: https://patchwork.freedesktop.org/patch/msgid/20250213192909.996148-3-lucas.demarchi@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit 121b214cdf10d4129b64f2b1f31807154c74ae55) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_irq.c | 14 +------------- + 1 file changed, 1 insertion(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_irq.c b/drivers/gpu/drm/xe/xe_irq.c +index de220ce113c25..ca04327bd6dfb 100644 +--- a/drivers/gpu/drm/xe/xe_irq.c ++++ b/drivers/gpu/drm/xe/xe_irq.c +@@ -757,19 +757,7 @@ int xe_irq_install(struct xe_device *xe) + + xe_irq_postinstall(xe); + +- err = devm_add_action_or_reset(xe->drm.dev, irq_uninstall, xe); +- if (err) +- goto free_irq_handler; +- +- return 0; +- +-free_irq_handler: +- if (xe_device_has_msix(xe)) +- xe_irq_msix_free(xe); +- else +- xe_irq_msi_free(xe); +- +- return err; ++ return devm_add_action_or_reset(xe->drm.dev, irq_uninstall, xe); + } + + static void xe_irq_msi_synchronize_irq(struct xe_device *xe) +-- +2.39.5 + diff --git a/queue-6.13/drm-xe-irq-separate-msi-and-msi-x-flows.patch b/queue-6.13/drm-xe-irq-separate-msi-and-msi-x-flows.patch new file mode 100644 index 0000000000..8ad2a84f68 --- /dev/null +++ b/queue-6.13/drm-xe-irq-separate-msi-and-msi-x-flows.patch @@ -0,0 +1,440 @@ +From ee898a8cdb567ee28c430077fdbf5280a9435985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 09:25:35 +0200 +Subject: drm/xe/irq: Separate MSI and MSI-X flows +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilia Levi + +[ Upstream commit da889070be7b26b91e8b90f072687ca437d3ed7b ] + +A new flow is added for devices that support MSI-X: +- MSI-X vector 0 is used for GuC-to-host interrupt +- MSI-X vector 1 (aka default MSI-X) is used for HW engines + +The default MSI-X will be passed to the HW engines in a subsequent +patch. + +Signed-off-by: Ilia Levi +Reviewed-by: Piotr Piórkowski +Link: https://patchwork.freedesktop.org/patch/msgid/20241213072538.6823-2-ilia.levi@intel.com +Signed-off-by: Rodrigo Vivi +Stable-dep-of: 0c455f3a1229 ("drm/xe: Fix error handling in xe_irq_install()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_device.c | 4 +- + drivers/gpu/drm/xe/xe_device.h | 3 +- + drivers/gpu/drm/xe/xe_device_types.h | 6 + + drivers/gpu/drm/xe/xe_irq.c | 257 +++++++++++++++++++++++---- + drivers/gpu/drm/xe/xe_irq.h | 3 + + 5 files changed, 237 insertions(+), 36 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c +index 06d6db8b50f93..7f902d50ebf69 100644 +--- a/drivers/gpu/drm/xe/xe_device.c ++++ b/drivers/gpu/drm/xe/xe_device.c +@@ -324,7 +324,9 @@ struct xe_device *xe_device_create(struct pci_dev *pdev, + xe->info.revid = pdev->revision; + xe->info.force_execlist = xe_modparam.force_execlist; + +- spin_lock_init(&xe->irq.lock); ++ err = xe_irq_init(xe); ++ if (err) ++ goto err; + + init_waitqueue_head(&xe->ufence_wq); + +diff --git a/drivers/gpu/drm/xe/xe_device.h b/drivers/gpu/drm/xe/xe_device.h +index f1fbfe9168678..fc3c2af3fb7fd 100644 +--- a/drivers/gpu/drm/xe/xe_device.h ++++ b/drivers/gpu/drm/xe/xe_device.h +@@ -157,8 +157,7 @@ static inline bool xe_device_has_sriov(struct xe_device *xe) + + static inline bool xe_device_has_msix(struct xe_device *xe) + { +- /* TODO: change this when MSI-X support is fully integrated */ +- return false; ++ return xe->irq.msix.nvec > 0; + } + + static inline bool xe_device_has_memirq(struct xe_device *xe) +diff --git a/drivers/gpu/drm/xe/xe_device_types.h b/drivers/gpu/drm/xe/xe_device_types.h +index 09068ea7349a8..782eb224a46e7 100644 +--- a/drivers/gpu/drm/xe/xe_device_types.h ++++ b/drivers/gpu/drm/xe/xe_device_types.h +@@ -346,6 +346,12 @@ struct xe_device { + + /** @irq.enabled: interrupts enabled on this device */ + atomic_t enabled; ++ ++ /** @irq.msix: irq info for platforms that support MSI-X */ ++ struct { ++ /** @irq.msix.nvec: number of MSI-X interrupts */ ++ u16 nvec; ++ } msix; + } irq; + + /** @ttm: ttm device */ +diff --git a/drivers/gpu/drm/xe/xe_irq.c b/drivers/gpu/drm/xe/xe_irq.c +index 32547b6a6d1cb..de220ce113c25 100644 +--- a/drivers/gpu/drm/xe/xe_irq.c ++++ b/drivers/gpu/drm/xe/xe_irq.c +@@ -10,6 +10,7 @@ + #include + + #include "display/xe_display.h" ++#include "regs/xe_guc_regs.h" + #include "regs/xe_irq_regs.h" + #include "xe_device.h" + #include "xe_drv.h" +@@ -29,6 +30,11 @@ + #define IIR(offset) XE_REG(offset + 0x8) + #define IER(offset) XE_REG(offset + 0xc) + ++static int xe_irq_msix_init(struct xe_device *xe); ++static void xe_irq_msix_free(struct xe_device *xe); ++static int xe_irq_msix_request_irqs(struct xe_device *xe); ++static void xe_irq_msix_synchronize_irq(struct xe_device *xe); ++ + static void assert_iir_is_zero(struct xe_mmio *mmio, struct xe_reg reg) + { + u32 val = xe_mmio_read32(mmio, reg); +@@ -572,6 +578,11 @@ static void xe_irq_reset(struct xe_device *xe) + if (IS_SRIOV_VF(xe)) + return vf_irq_reset(xe); + ++ if (xe_device_uses_memirq(xe)) { ++ for_each_tile(tile, xe, id) ++ xe_memirq_reset(&tile->memirq); ++ } ++ + for_each_tile(tile, xe, id) { + if (GRAPHICS_VERx100(xe) >= 1210) + dg1_irq_reset(tile); +@@ -614,6 +625,14 @@ static void xe_irq_postinstall(struct xe_device *xe) + if (IS_SRIOV_VF(xe)) + return vf_irq_postinstall(xe); + ++ if (xe_device_uses_memirq(xe)) { ++ struct xe_tile *tile; ++ unsigned int id; ++ ++ for_each_tile(tile, xe, id) ++ xe_memirq_postinstall(&tile->memirq); ++ } ++ + xe_display_irq_postinstall(xe, xe_root_mmio_gt(xe)); + + /* +@@ -656,60 +675,83 @@ static irq_handler_t xe_irq_handler(struct xe_device *xe) + return xelp_irq_handler; + } + +-static void irq_uninstall(void *arg) ++static int xe_irq_msi_request_irqs(struct xe_device *xe) ++{ ++ struct pci_dev *pdev = to_pci_dev(xe->drm.dev); ++ irq_handler_t irq_handler; ++ int irq, err; ++ ++ irq_handler = xe_irq_handler(xe); ++ if (!irq_handler) { ++ drm_err(&xe->drm, "No supported interrupt handler"); ++ return -EINVAL; ++ } ++ ++ irq = pci_irq_vector(pdev, 0); ++ err = request_irq(irq, irq_handler, IRQF_SHARED, DRIVER_NAME, xe); ++ if (err < 0) { ++ drm_err(&xe->drm, "Failed to request MSI IRQ %d\n", err); ++ return err; ++ } ++ ++ return 0; ++} ++ ++static void xe_irq_msi_free(struct xe_device *xe) + { +- struct xe_device *xe = arg; + struct pci_dev *pdev = to_pci_dev(xe->drm.dev); + int irq; + ++ irq = pci_irq_vector(pdev, 0); ++ free_irq(irq, xe); ++} ++ ++static void irq_uninstall(void *arg) ++{ ++ struct xe_device *xe = arg; ++ + if (!atomic_xchg(&xe->irq.enabled, 0)) + return; + + xe_irq_reset(xe); + +- irq = pci_irq_vector(pdev, 0); +- free_irq(irq, xe); ++ if (xe_device_has_msix(xe)) ++ xe_irq_msix_free(xe); ++ else ++ xe_irq_msi_free(xe); ++} ++ ++int xe_irq_init(struct xe_device *xe) ++{ ++ spin_lock_init(&xe->irq.lock); ++ ++ return xe_irq_msix_init(xe); + } + + int xe_irq_install(struct xe_device *xe) + { + struct pci_dev *pdev = to_pci_dev(xe->drm.dev); +- unsigned int irq_flags = PCI_IRQ_MSIX; +- irq_handler_t irq_handler; +- int err, irq, nvec; +- +- irq_handler = xe_irq_handler(xe); +- if (!irq_handler) { +- drm_err(&xe->drm, "No supported interrupt handler"); +- return -EINVAL; +- } ++ unsigned int irq_flags = PCI_IRQ_MSI; ++ int nvec = 1; ++ int err; + + xe_irq_reset(xe); + +- nvec = pci_msix_vec_count(pdev); +- if (nvec <= 0) { +- if (nvec == -EINVAL) { +- /* MSIX capability is not supported in the device, using MSI */ +- irq_flags = PCI_IRQ_MSI; +- nvec = 1; +- } else { +- drm_err(&xe->drm, "MSIX: Failed getting count\n"); +- return nvec; +- } ++ if (xe_device_has_msix(xe)) { ++ nvec = xe->irq.msix.nvec; ++ irq_flags = PCI_IRQ_MSIX; + } + + err = pci_alloc_irq_vectors(pdev, nvec, nvec, irq_flags); + if (err < 0) { +- drm_err(&xe->drm, "MSI/MSIX: Failed to enable support %d\n", err); ++ drm_err(&xe->drm, "Failed to allocate IRQ vectors: %d\n", err); + return err; + } + +- irq = pci_irq_vector(pdev, 0); +- err = request_irq(irq, irq_handler, IRQF_SHARED, DRIVER_NAME, xe); +- if (err < 0) { +- drm_err(&xe->drm, "Failed to request MSI/MSIX IRQ %d\n", err); ++ err = xe_device_has_msix(xe) ? xe_irq_msix_request_irqs(xe) : ++ xe_irq_msi_request_irqs(xe); ++ if (err) + return err; +- } + + atomic_set(&xe->irq.enabled, 1); + +@@ -722,18 +764,28 @@ int xe_irq_install(struct xe_device *xe) + return 0; + + free_irq_handler: +- free_irq(irq, xe); ++ if (xe_device_has_msix(xe)) ++ xe_irq_msix_free(xe); ++ else ++ xe_irq_msi_free(xe); + + return err; + } + +-void xe_irq_suspend(struct xe_device *xe) ++static void xe_irq_msi_synchronize_irq(struct xe_device *xe) + { +- int irq = to_pci_dev(xe->drm.dev)->irq; ++ synchronize_irq(to_pci_dev(xe->drm.dev)->irq); ++} + ++void xe_irq_suspend(struct xe_device *xe) ++{ + atomic_set(&xe->irq.enabled, 0); /* no new irqs */ + +- synchronize_irq(irq); /* flush irqs */ ++ /* flush irqs */ ++ if (xe_device_has_msix(xe)) ++ xe_irq_msix_synchronize_irq(xe); ++ else ++ xe_irq_msi_synchronize_irq(xe); + xe_irq_reset(xe); /* turn irqs off */ + } + +@@ -754,3 +806,142 @@ void xe_irq_resume(struct xe_device *xe) + for_each_gt(gt, xe, id) + xe_irq_enable_hwe(gt); + } ++ ++/* MSI-X related definitions and functions below. */ ++ ++enum xe_irq_msix_static { ++ GUC2HOST_MSIX = 0, ++ DEFAULT_MSIX = XE_IRQ_DEFAULT_MSIX, ++ /* Must be last */ ++ NUM_OF_STATIC_MSIX, ++}; ++ ++static int xe_irq_msix_init(struct xe_device *xe) ++{ ++ struct pci_dev *pdev = to_pci_dev(xe->drm.dev); ++ int nvec = pci_msix_vec_count(pdev); ++ ++ if (nvec == -EINVAL) ++ return 0; /* MSI */ ++ ++ if (nvec < 0) { ++ drm_err(&xe->drm, "Failed getting MSI-X vectors count: %d\n", nvec); ++ return nvec; ++ } ++ ++ xe->irq.msix.nvec = nvec; ++ return 0; ++} ++ ++static irqreturn_t guc2host_irq_handler(int irq, void *arg) ++{ ++ struct xe_device *xe = arg; ++ struct xe_tile *tile; ++ u8 id; ++ ++ if (!atomic_read(&xe->irq.enabled)) ++ return IRQ_NONE; ++ ++ for_each_tile(tile, xe, id) ++ xe_guc_irq_handler(&tile->primary_gt->uc.guc, ++ GUC_INTR_GUC2HOST); ++ ++ return IRQ_HANDLED; ++} ++ ++static irqreturn_t xe_irq_msix_default_hwe_handler(int irq, void *arg) ++{ ++ unsigned int tile_id, gt_id; ++ struct xe_device *xe = arg; ++ struct xe_memirq *memirq; ++ struct xe_hw_engine *hwe; ++ enum xe_hw_engine_id id; ++ struct xe_tile *tile; ++ struct xe_gt *gt; ++ ++ if (!atomic_read(&xe->irq.enabled)) ++ return IRQ_NONE; ++ ++ for_each_tile(tile, xe, tile_id) { ++ memirq = &tile->memirq; ++ if (!memirq->bo) ++ continue; ++ ++ for_each_gt(gt, xe, gt_id) { ++ if (gt->tile != tile) ++ continue; ++ ++ for_each_hw_engine(hwe, gt, id) ++ xe_memirq_hwe_handler(memirq, hwe); ++ } ++ } ++ ++ return IRQ_HANDLED; ++} ++ ++static int xe_irq_msix_request_irq(struct xe_device *xe, irq_handler_t handler, ++ const char *name, u16 msix) ++{ ++ struct pci_dev *pdev = to_pci_dev(xe->drm.dev); ++ int ret, irq; ++ ++ irq = pci_irq_vector(pdev, msix); ++ if (irq < 0) ++ return irq; ++ ++ ret = request_irq(irq, handler, IRQF_SHARED, name, xe); ++ if (ret < 0) ++ return ret; ++ ++ return 0; ++} ++ ++static void xe_irq_msix_free_irq(struct xe_device *xe, u16 msix) ++{ ++ struct pci_dev *pdev = to_pci_dev(xe->drm.dev); ++ int irq; ++ ++ irq = pci_irq_vector(pdev, msix); ++ if (irq < 0) { ++ drm_err(&xe->drm, "MSI-X %u can't be released, there is no matching IRQ\n", msix); ++ return; ++ } ++ ++ free_irq(irq, xe); ++} ++ ++static int xe_irq_msix_request_irqs(struct xe_device *xe) ++{ ++ int err; ++ ++ err = xe_irq_msix_request_irq(xe, guc2host_irq_handler, ++ DRIVER_NAME "-guc2host", GUC2HOST_MSIX); ++ if (err) { ++ drm_err(&xe->drm, "Failed to request MSI-X IRQ %d: %d\n", GUC2HOST_MSIX, err); ++ return err; ++ } ++ ++ err = xe_irq_msix_request_irq(xe, xe_irq_msix_default_hwe_handler, ++ DRIVER_NAME "-default-msix", DEFAULT_MSIX); ++ if (err) { ++ drm_err(&xe->drm, "Failed to request MSI-X IRQ %d: %d\n", DEFAULT_MSIX, err); ++ xe_irq_msix_free_irq(xe, GUC2HOST_MSIX); ++ return err; ++ } ++ ++ return 0; ++} ++ ++static void xe_irq_msix_free(struct xe_device *xe) ++{ ++ xe_irq_msix_free_irq(xe, GUC2HOST_MSIX); ++ xe_irq_msix_free_irq(xe, DEFAULT_MSIX); ++} ++ ++static void xe_irq_msix_synchronize_irq(struct xe_device *xe) ++{ ++ struct pci_dev *pdev = to_pci_dev(xe->drm.dev); ++ ++ synchronize_irq(pci_irq_vector(pdev, GUC2HOST_MSIX)); ++ synchronize_irq(pci_irq_vector(pdev, DEFAULT_MSIX)); ++} +diff --git a/drivers/gpu/drm/xe/xe_irq.h b/drivers/gpu/drm/xe/xe_irq.h +index 067514e13675b..24ff16111b968 100644 +--- a/drivers/gpu/drm/xe/xe_irq.h ++++ b/drivers/gpu/drm/xe/xe_irq.h +@@ -6,10 +6,13 @@ + #ifndef _XE_IRQ_H_ + #define _XE_IRQ_H_ + ++#define XE_IRQ_DEFAULT_MSIX 1 ++ + struct xe_device; + struct xe_tile; + struct xe_gt; + ++int xe_irq_init(struct xe_device *xe); + int xe_irq_install(struct xe_device *xe); + void xe_irq_suspend(struct xe_device *xe); + void xe_irq_resume(struct xe_device *xe); +-- +2.39.5 + diff --git a/queue-6.13/drm-xe-make-irq-enabled-flag-atomic.patch b/queue-6.13/drm-xe-make-irq-enabled-flag-atomic.patch new file mode 100644 index 0000000000..2428df96c5 --- /dev/null +++ b/queue-6.13/drm-xe-make-irq-enabled-flag-atomic.patch @@ -0,0 +1,153 @@ +From ae9e220fbbdfa77e40bc8fa64c974819628da103 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 19:35:06 +0200 +Subject: drm/xe: Make irq enabled flag atomic + +From: Ilia Levi + +[ Upstream commit 4d79a1266d4cc3c967bc8823502466cad1ac8514 ] + +The irq.enabled flag was protected by a spin lock (irq.lock). +By making it atomic we no longer need to wait for the spin lock in +irq handlers. This will become especially useful for MSI-X irq +handlers to prevent lock contention between different interrupts. + +Signed-off-by: Ilia Levi +Reviewed-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20241210173506.202150-1-ilia.levi@intel.com +Signed-off-by: Rodrigo Vivi +Stable-dep-of: 0c455f3a1229 ("drm/xe: Fix error handling in xe_irq_install()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/display/ext/i915_irq.c | 13 +--------- + drivers/gpu/drm/xe/xe_device_types.h | 2 +- + drivers/gpu/drm/xe/xe_irq.c | 29 ++++++----------------- + 3 files changed, 9 insertions(+), 35 deletions(-) + +diff --git a/drivers/gpu/drm/xe/display/ext/i915_irq.c b/drivers/gpu/drm/xe/display/ext/i915_irq.c +index a7dbc6554d694..ac4cda2d81c7a 100644 +--- a/drivers/gpu/drm/xe/display/ext/i915_irq.c ++++ b/drivers/gpu/drm/xe/display/ext/i915_irq.c +@@ -53,18 +53,7 @@ void gen2_irq_init(struct intel_uncore *uncore, struct i915_irq_regs regs, + + bool intel_irqs_enabled(struct xe_device *xe) + { +- /* +- * XXX: i915 has a racy handling of the irq.enabled, since it doesn't +- * lock its transitions. Because of that, the irq.enabled sometimes +- * is not read with the irq.lock in place. +- * However, the most critical cases like vblank and page flips are +- * properly using the locks. +- * We cannot take the lock in here or run any kind of assert because +- * of i915 inconsistency. +- * But at this point the xe irq is better protected against races, +- * although the full solution would be protecting the i915 side. +- */ +- return xe->irq.enabled; ++ return atomic_read(&xe->irq.enabled); + } + + void intel_synchronize_irq(struct xe_device *xe) +diff --git a/drivers/gpu/drm/xe/xe_device_types.h b/drivers/gpu/drm/xe/xe_device_types.h +index b9ea455d6f59f..09068ea7349a8 100644 +--- a/drivers/gpu/drm/xe/xe_device_types.h ++++ b/drivers/gpu/drm/xe/xe_device_types.h +@@ -345,7 +345,7 @@ struct xe_device { + spinlock_t lock; + + /** @irq.enabled: interrupts enabled on this device */ +- bool enabled; ++ atomic_t enabled; + } irq; + + /** @ttm: ttm device */ +diff --git a/drivers/gpu/drm/xe/xe_irq.c b/drivers/gpu/drm/xe/xe_irq.c +index b7995ebd54abd..32547b6a6d1cb 100644 +--- a/drivers/gpu/drm/xe/xe_irq.c ++++ b/drivers/gpu/drm/xe/xe_irq.c +@@ -348,12 +348,8 @@ static irqreturn_t xelp_irq_handler(int irq, void *arg) + unsigned long intr_dw[2]; + u32 identity[32]; + +- spin_lock(&xe->irq.lock); +- if (!xe->irq.enabled) { +- spin_unlock(&xe->irq.lock); ++ if (!atomic_read(&xe->irq.enabled)) + return IRQ_NONE; +- } +- spin_unlock(&xe->irq.lock); + + master_ctl = xelp_intr_disable(xe); + if (!master_ctl) { +@@ -417,12 +413,8 @@ static irqreturn_t dg1_irq_handler(int irq, void *arg) + + /* TODO: This really shouldn't be copied+pasted */ + +- spin_lock(&xe->irq.lock); +- if (!xe->irq.enabled) { +- spin_unlock(&xe->irq.lock); ++ if (!atomic_read(&xe->irq.enabled)) + return IRQ_NONE; +- } +- spin_unlock(&xe->irq.lock); + + master_tile_ctl = dg1_intr_disable(xe); + if (!master_tile_ctl) { +@@ -644,12 +636,8 @@ static irqreturn_t vf_mem_irq_handler(int irq, void *arg) + struct xe_tile *tile; + unsigned int id; + +- spin_lock(&xe->irq.lock); +- if (!xe->irq.enabled) { +- spin_unlock(&xe->irq.lock); ++ if (!atomic_read(&xe->irq.enabled)) + return IRQ_NONE; +- } +- spin_unlock(&xe->irq.lock); + + for_each_tile(tile, xe, id) + xe_memirq_handler(&tile->memirq); +@@ -674,10 +662,9 @@ static void irq_uninstall(void *arg) + struct pci_dev *pdev = to_pci_dev(xe->drm.dev); + int irq; + +- if (!xe->irq.enabled) ++ if (!atomic_xchg(&xe->irq.enabled, 0)) + return; + +- xe->irq.enabled = false; + xe_irq_reset(xe); + + irq = pci_irq_vector(pdev, 0); +@@ -724,7 +711,7 @@ int xe_irq_install(struct xe_device *xe) + return err; + } + +- xe->irq.enabled = true; ++ atomic_set(&xe->irq.enabled, 1); + + xe_irq_postinstall(xe); + +@@ -744,9 +731,7 @@ void xe_irq_suspend(struct xe_device *xe) + { + int irq = to_pci_dev(xe->drm.dev)->irq; + +- spin_lock_irq(&xe->irq.lock); +- xe->irq.enabled = false; /* no new irqs */ +- spin_unlock_irq(&xe->irq.lock); ++ atomic_set(&xe->irq.enabled, 0); /* no new irqs */ + + synchronize_irq(irq); /* flush irqs */ + xe_irq_reset(xe); /* turn irqs off */ +@@ -762,7 +747,7 @@ void xe_irq_resume(struct xe_device *xe) + * 1. no irq will arrive before the postinstall + * 2. display is not yet resumed + */ +- xe->irq.enabled = true; ++ atomic_set(&xe->irq.enabled, 1); + xe_irq_reset(xe); + xe_irq_postinstall(xe); /* turn irqs on */ + +-- +2.39.5 + diff --git a/queue-6.13/firmware-arm_scmi-imx-correct-tx-size-of-scmi_imx_mi.patch b/queue-6.13/firmware-arm_scmi-imx-correct-tx-size-of-scmi_imx_mi.patch new file mode 100644 index 0000000000..98eab7658b --- /dev/null +++ b/queue-6.13/firmware-arm_scmi-imx-correct-tx-size-of-scmi_imx_mi.patch @@ -0,0 +1,48 @@ +From f061b6c1e2c56206aa363260014f53d2e0c5d13e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 14:34:41 +0800 +Subject: firmware: arm_scmi: imx: Correct tx size of scmi_imx_misc_ctrl_set + +From: Peng Fan + +[ Upstream commit ab027c488fc4a1fff0a5b712d4bdb2d2d324e8f8 ] + +'struct scmi_imx_misc_ctrl_set_in' has a zero length array in the end, +The sizeof will not count 'value[]', and hence Tx size will be smaller +than actual size for Tx,and SCMI firmware will flag this as protocol +error. + +Fix this by enlarge the Tx size with 'num * sizeof(__le32)' to count in +the size of data. + +Fixes: 61c9f03e22fc ("firmware: arm_scmi: Add initial support for i.MX MISC protocol") +Reviewed-by: Jacky Bai +Tested-by: Shengjiu Wang +Acked-by: Jason Liu +Signed-off-by: Peng Fan +Message-Id: <20250123063441.392555-1-peng.fan@oss.nxp.com> +(sudeep.holla: Commit rewording and replace hardcoded sizeof(__le32) value) +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c b/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c +index a86ab9b35953f..2641faa329cdd 100644 +--- a/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c ++++ b/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c +@@ -254,8 +254,8 @@ static int scmi_imx_misc_ctrl_set(const struct scmi_protocol_handle *ph, + if (num > max_num) + return -EINVAL; + +- ret = ph->xops->xfer_get_init(ph, SCMI_IMX_MISC_CTRL_SET, sizeof(*in), +- 0, &t); ++ ret = ph->xops->xfer_get_init(ph, SCMI_IMX_MISC_CTRL_SET, ++ sizeof(*in) + num * sizeof(__le32), 0, &t); + if (ret) + return ret; + +-- +2.39.5 + diff --git a/queue-6.13/firmware-imx-imx_scmi_misc_drv-should-depend-on-arch.patch b/queue-6.13/firmware-imx-imx_scmi_misc_drv-should-depend-on-arch.patch new file mode 100644 index 0000000000..476f0f4523 --- /dev/null +++ b/queue-6.13/firmware-imx-imx_scmi_misc_drv-should-depend-on-arch.patch @@ -0,0 +1,38 @@ +From 930c06450341e24215d673a7d0dbbf2b42746da1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 15:41:43 +0100 +Subject: firmware: imx: IMX_SCMI_MISC_DRV should depend on ARCH_MXC + +From: Geert Uytterhoeven + +[ Upstream commit be6686b823b30a69b1f71bde228ce042c78a1941 ] + +The i.MX System Controller Management Interface firmware is only present +on Freescale i.MX SoCs. Hence add a dependency on ARCH_MXC, to prevent +asking the user about this driver when configuring a kernel without +Freescale i.MX platform support. + +Fixes: 514b2262ade48a05 ("firmware: arm_scmi: Fix i.MX build dependency") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Fabio Estevam +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/imx/Kconfig b/drivers/firmware/imx/Kconfig +index 907cd149c40a8..c964f4924359f 100644 +--- a/drivers/firmware/imx/Kconfig ++++ b/drivers/firmware/imx/Kconfig +@@ -25,6 +25,7 @@ config IMX_SCU + + config IMX_SCMI_MISC_DRV + tristate "IMX SCMI MISC Protocol driver" ++ depends on ARCH_MXC || COMPILE_TEST + default y if ARCH_MXC + help + The System Controller Management Interface firmware (SCMI FW) is +-- +2.39.5 + diff --git a/queue-6.13/md-raid-fix-the-set_queue_limits-implementations.patch b/queue-6.13/md-raid-fix-the-set_queue_limits-implementations.patch new file mode 100644 index 0000000000..9ac4f244ad --- /dev/null +++ b/queue-6.13/md-raid-fix-the-set_queue_limits-implementations.patch @@ -0,0 +1,78 @@ +From ac25319d5d42b7f69b80f6ba4fcc81baa72aea38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 09:11:07 -0800 +Subject: md/raid*: Fix the set_queue_limits implementations + +From: Bart Van Assche + +[ Upstream commit fbe8f2fa971c537571994a0df532c511c4fb5537 ] + +queue_limits_cancel_update() must only be called if +queue_limits_start_update() is called first. Remove the +queue_limits_cancel_update() calls from the raid*_set_limits() functions +because there is no corresponding queue_limits_start_update() call. + +Cc: Christoph Hellwig +Fixes: c6e56cf6b2e7 ("block: move integrity information into queue_limits") +Signed-off-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/linux-raid/20250212171108.3483150-1-bvanassche@acm.org/ +Signed-off-by: Yu Kuai +Signed-off-by: Sasha Levin +--- + drivers/md/raid0.c | 4 +--- + drivers/md/raid1.c | 4 +--- + drivers/md/raid10.c | 4 +--- + 3 files changed, 3 insertions(+), 9 deletions(-) + +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index 7049ec7fb8eb4..e8802309ed600 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -386,10 +386,8 @@ static int raid0_set_limits(struct mddev *mddev) + lim.io_opt = lim.io_min * mddev->raid_disks; + lim.features |= BLK_FEAT_ATOMIC_WRITES_STACKED; + err = mddev_stack_rdev_limits(mddev, &lim, MDDEV_STACK_INTEGRITY); +- if (err) { +- queue_limits_cancel_update(mddev->gendisk->queue); ++ if (err) + return err; +- } + return queue_limits_set(mddev->gendisk->queue, &lim); + } + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index a5cd6522fc2d4..3c75a69376f47 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -3219,10 +3219,8 @@ static int raid1_set_limits(struct mddev *mddev) + lim.max_write_zeroes_sectors = 0; + lim.features |= BLK_FEAT_ATOMIC_WRITES_STACKED; + err = mddev_stack_rdev_limits(mddev, &lim, MDDEV_STACK_INTEGRITY); +- if (err) { +- queue_limits_cancel_update(mddev->gendisk->queue); ++ if (err) + return err; +- } + return queue_limits_set(mddev->gendisk->queue, &lim); + } + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index e1e6cd7fb125e..8b736f30ef926 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -4020,10 +4020,8 @@ static int raid10_set_queue_limits(struct mddev *mddev) + lim.io_opt = lim.io_min * raid10_nr_stripes(conf); + lim.features |= BLK_FEAT_ATOMIC_WRITES_STACKED; + err = mddev_stack_rdev_limits(mddev, &lim, MDDEV_STACK_INTEGRITY); +- if (err) { +- queue_limits_cancel_update(mddev->gendisk->queue); ++ if (err) + return err; +- } + return queue_limits_set(mddev->gendisk->queue, &lim); + } + +-- +2.39.5 + diff --git a/queue-6.13/net-add-rx_skb-of-kfree_skb-to-raw_tp_null_args.patch b/queue-6.13/net-add-rx_skb-of-kfree_skb-to-raw_tp_null_args.patch new file mode 100644 index 0000000000..de50c0ed69 --- /dev/null +++ b/queue-6.13/net-add-rx_skb-of-kfree_skb-to-raw_tp_null_args.patch @@ -0,0 +1,89 @@ +From bbd1575c04fa11da5c5fe4c98f1e41a137703c8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jan 2025 19:01:42 -0800 +Subject: net: Add rx_skb of kfree_skb to raw_tp_null_args[]. + +From: Kuniyuki Iwashima + +[ Upstream commit 5da7e15fb5a12e78de974d8908f348e279922ce9 ] + +Yan Zhai reported a BPF prog could trigger a null-ptr-deref [0] +in trace_kfree_skb if the prog does not check if rx_sk is NULL. + +Commit c53795d48ee8 ("net: add rx_sk to trace_kfree_skb") added +rx_sk to trace_kfree_skb, but rx_sk is optional and could be NULL. + +Let's add kfree_skb to raw_tp_null_args[] to let the BPF verifier +validate such a prog and prevent the issue. + +Now we fail to load such a prog: + + libbpf: prog 'drop': -- BEGIN PROG LOAD LOG -- + 0: R1=ctx() R10=fp0 + ; int BPF_PROG(drop, struct sk_buff *skb, void *location, @ kfree_skb_sk_null.bpf.c:21 + 0: (79) r3 = *(u64 *)(r1 +24) + func 'kfree_skb' arg3 has btf_id 5253 type STRUCT 'sock' + 1: R1=ctx() R3_w=trusted_ptr_or_null_sock(id=1) + ; bpf_printk("sk: %d, %d\n", sk, sk->__sk_common.skc_family); @ kfree_skb_sk_null.bpf.c:24 + 1: (69) r4 = *(u16 *)(r3 +16) + R3 invalid mem access 'trusted_ptr_or_null_' + processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 + -- END PROG LOAD LOG -- + +Note this fix requires commit 838a10bd2ebf ("bpf: Augment raw_tp +arguments with PTR_MAYBE_NULL"). + +[0]: +BUG: kernel NULL pointer dereference, address: 0000000000000010 + PF: supervisor read access in kernel mode + PF: error_code(0x0000) - not-present page +PGD 0 P4D 0 +PREEMPT SMP +RIP: 0010:bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d +Call Trace: + + ? __die+0x1f/0x60 + ? page_fault_oops+0x148/0x420 + ? search_bpf_extables+0x5b/0x70 + ? fixup_exception+0x27/0x2c0 + ? exc_page_fault+0x75/0x170 + ? asm_exc_page_fault+0x22/0x30 + ? bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d + bpf_trace_run4+0x68/0xd0 + ? unix_stream_connect+0x1f4/0x6f0 + sk_skb_reason_drop+0x90/0x120 + unix_stream_connect+0x1f4/0x6f0 + __sys_connect+0x7f/0xb0 + __x64_sys_connect+0x14/0x20 + do_syscall_64+0x47/0xc30 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + +Fixes: c53795d48ee8 ("net: add rx_sk to trace_kfree_skb") +Reported-by: Yan Zhai +Closes: https://lore.kernel.org/netdev/Z50zebTRzI962e6X@debian.debian/ +Signed-off-by: Kuniyuki Iwashima +Tested-by: Yan Zhai +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20250201030142.62703-1-kuniyu@amazon.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 10d0975deadab..c89604e6b6aab 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -6507,6 +6507,8 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { + /* rxrpc */ + { "rxrpc_recvdata", 0x1 }, + { "rxrpc_resend", 0x10 }, ++ /* skb */ ++ {"kfree_skb", 0x1000}, + /* sunrpc */ + { "xs_stream_read_data", 0x1 }, + /* ... from xprt_cong_event event class */ +-- +2.39.5 + diff --git a/queue-6.13/nouveau-svm-fix-missing-folio-unlock-put-after-make_.patch b/queue-6.13/nouveau-svm-fix-missing-folio-unlock-put-after-make_.patch new file mode 100644 index 0000000000..ddd7fa128c --- /dev/null +++ b/queue-6.13/nouveau-svm-fix-missing-folio-unlock-put-after-make_.patch @@ -0,0 +1,74 @@ +From 52caec2fcb742f8e1c68d554962faaa718d025a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jan 2025 19:15:23 +0100 +Subject: nouveau/svm: fix missing folio unlock + put after + make_device_exclusive_range() + +From: David Hildenbrand + +[ Upstream commit b3fefbb30a1691533cb905006b69b2a474660744 ] + +In case we have to retry the loop, we are missing to unlock+put the +folio. In that case, we will keep failing make_device_exclusive_range() +because we cannot grab the folio lock, and even return from the function +with the folio locked and referenced, effectively never succeeding the +make_device_exclusive_range(). + +While at it, convert the other unlock+put to use a folio as well. + +This was found by code inspection. + +Fixes: 8f187163eb89 ("nouveau/svm: implement atomic SVM access") +Signed-off-by: David Hildenbrand +Reviewed-by: Alistair Popple +Tested-by: Alistair Popple +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20250124181524.3584236-2-david@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_svm.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c +index b4da82ddbb6b2..8ea98f06d39af 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_svm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_svm.c +@@ -590,6 +590,7 @@ static int nouveau_atomic_range_fault(struct nouveau_svmm *svmm, + unsigned long timeout = + jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT); + struct mm_struct *mm = svmm->notifier.mm; ++ struct folio *folio; + struct page *page; + unsigned long start = args->p.addr; + unsigned long notifier_seq; +@@ -616,12 +617,16 @@ static int nouveau_atomic_range_fault(struct nouveau_svmm *svmm, + ret = -EINVAL; + goto out; + } ++ folio = page_folio(page); + + mutex_lock(&svmm->mutex); + if (!mmu_interval_read_retry(¬ifier->notifier, + notifier_seq)) + break; + mutex_unlock(&svmm->mutex); ++ ++ folio_unlock(folio); ++ folio_put(folio); + } + + /* Map the page on the GPU. */ +@@ -637,8 +642,8 @@ static int nouveau_atomic_range_fault(struct nouveau_svmm *svmm, + ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, size, NULL); + mutex_unlock(&svmm->mutex); + +- unlock_page(page); +- put_page(page); ++ folio_unlock(folio); ++ folio_put(folio); + + out: + mmu_interval_notifier_remove(¬ifier->notifier); +-- +2.39.5 + diff --git a/queue-6.13/nvme-ioctl-add-missing-space-in-err-message.patch b/queue-6.13/nvme-ioctl-add-missing-space-in-err-message.patch new file mode 100644 index 0000000000..742e47ef38 --- /dev/null +++ b/queue-6.13/nvme-ioctl-add-missing-space-in-err-message.patch @@ -0,0 +1,41 @@ +From 57ea2e7cd67daa050065fddc5b70c6782d96aaeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 10:05:14 -0700 +Subject: nvme/ioctl: add missing space in err message + +From: Caleb Sander Mateos + +[ Upstream commit 487a3ea7b1b8ba2ca7d2c2bb3c3594dc360d6261 ] + +nvme_validate_passthru_nsid() logs an err message whose format string is +split over 2 lines. There is a missing space between the two pieces, +resulting in log lines like "... does not match nsid (1)of namespace". +Add the missing space between ")" and "of". Also combine the format +string pieces onto a single line to make the err message easier to grep. + +Fixes: e7d4b5493a2d ("nvme: factor out a nvme_validate_passthru_nsid helper") +Signed-off-by: Caleb Sander Mateos +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/ioctl.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c +index e8930146847af..b1b46c2713e1c 100644 +--- a/drivers/nvme/host/ioctl.c ++++ b/drivers/nvme/host/ioctl.c +@@ -283,8 +283,7 @@ static bool nvme_validate_passthru_nsid(struct nvme_ctrl *ctrl, + { + if (ns && nsid != ns->head->ns_id) { + dev_err(ctrl->device, +- "%s: nsid (%u) in cmd does not match nsid (%u)" +- "of namespace\n", ++ "%s: nsid (%u) in cmd does not match nsid (%u) of namespace\n", + current->comm, nsid, ns->head->ns_id); + return false; + } +-- +2.39.5 + diff --git a/queue-6.13/nvme-tcp-fix-compilation-warning-with-w-1.patch b/queue-6.13/nvme-tcp-fix-compilation-warning-with-w-1.patch new file mode 100644 index 0000000000..46a157e84f --- /dev/null +++ b/queue-6.13/nvme-tcp-fix-compilation-warning-with-w-1.patch @@ -0,0 +1,47 @@ +From 2b2c9cee67f7aba6a71f85effec7f2822e970f80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 15:52:31 +0900 +Subject: nvme: tcp: Fix compilation warning with W=1 + +From: Damien Le Moal + +[ Upstream commit cd513e0434c3e736c549bc99bf7982658b25114d ] + +When compiling with W=1, a warning result for the function +nvme_tcp_set_queue_io_cpu(): + +host/tcp.c:1578: warning: Function parameter or struct member 'queue' +not described in 'nvme_tcp_set_queue_io_cpu' +host/tcp.c:1578: warning: expecting prototype for Track the number of +queues assigned to each cpu using a global per(). Prototype was for +nvme_tcp_set_queue_io_cpu() instead + +Avoid this warning by using the regular comment format for the function +nvme_tcp_set_queue_io_cpu() instead of the kdoc comment format. + +Fixes: 32193789878c ("nvme-tcp: Fix I/O queue cpu spreading for multiple controllers") +Signed-off-by: Damien Le Moal +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 841238f38fdda..4162893d49395 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1565,7 +1565,7 @@ static bool nvme_tcp_poll_queue(struct nvme_tcp_queue *queue) + ctrl->io_queues[HCTX_TYPE_POLL]; + } + +-/** ++/* + * Track the number of queues assigned to each cpu using a global per-cpu + * counter and select the least used cpu from the mq_map. Our goal is to spread + * different controllers I/O threads across different cpu cores. +-- +2.39.5 + diff --git a/queue-6.13/nvme-tcp-fix-connect-failure-on-receiving-partial-ic.patch b/queue-6.13/nvme-tcp-fix-connect-failure-on-receiving-partial-ic.patch new file mode 100644 index 0000000000..d8915eb97d --- /dev/null +++ b/queue-6.13/nvme-tcp-fix-connect-failure-on-receiving-partial-ic.patch @@ -0,0 +1,54 @@ +From 9921ba9ee511b5dde31d3d0a926ebcedeec76e1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jan 2025 11:43:10 -0700 +Subject: nvme-tcp: fix connect failure on receiving partial ICResp PDU + +From: Caleb Sander Mateos + +[ Upstream commit 578539e0969028f711c34d9a4565931edfe1d730 ] + +nvme_tcp_init_connection() attempts to receive an ICResp PDU but only +checks that the return value from recvmsg() is non-negative. If the +sender closes the TCP connection or sends fewer than 128 bytes, this +check will pass even though the full PDU wasn't received. + +Ensure the full ICResp PDU is received by checking that recvmsg() +returns the expected 128 bytes. + +Additionally set the MSG_WAITALL flag for recvmsg(), as a sender could +split the ICResp over multiple TCP frames. Without MSG_WAITALL, +recvmsg() could return prematurely with only part of the PDU. + +Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") +Signed-off-by: Caleb Sander Mateos +Reviewed-by: Sagi Grimberg +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 4162893d49395..d7c193028e7c3 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1449,11 +1449,14 @@ static int nvme_tcp_init_connection(struct nvme_tcp_queue *queue) + msg.msg_control = cbuf; + msg.msg_controllen = sizeof(cbuf); + } ++ msg.msg_flags = MSG_WAITALL; + ret = kernel_recvmsg(queue->sock, &msg, &iov, 1, + iov.iov_len, msg.msg_flags); +- if (ret < 0) { ++ if (ret < sizeof(*icresp)) { + pr_warn("queue %d: failed to receive icresp, error %d\n", + nvme_tcp_queue_id(queue), ret); ++ if (ret >= 0) ++ ret = -ECONNRESET; + goto free_icresp; + } + ret = -ENOTCONN; +-- +2.39.5 + diff --git a/queue-6.13/nvmet-fix-crash-when-a-namespace-is-disabled.patch b/queue-6.13/nvmet-fix-crash-when-a-namespace-is-disabled.patch new file mode 100644 index 0000000000..d51219ad90 --- /dev/null +++ b/queue-6.13/nvmet-fix-crash-when-a-namespace-is-disabled.patch @@ -0,0 +1,131 @@ +From e792f8b54995f957e93f09810763836700ff179e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Feb 2025 13:41:34 +0100 +Subject: nvmet: Fix crash when a namespace is disabled + +From: Hannes Reinecke + +[ Upstream commit 4082326807072b71496501b6a0c55ffe8d5092a5 ] + +The namespace percpu counter protects pending I/O, and we can +only safely diable the namespace once the counter drop to zero. +Otherwise we end up with a crash when running blktests/nvme/058 +(eg for loop transport): + +[ 2352.930426] [ T53909] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN PTI +[ 2352.930431] [ T53909] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] +[ 2352.930434] [ T53909] CPU: 3 UID: 0 PID: 53909 Comm: kworker/u16:5 Tainted: G W 6.13.0-rc6 #232 +[ 2352.930438] [ T53909] Tainted: [W]=WARN +[ 2352.930440] [ T53909] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 +[ 2352.930443] [ T53909] Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] +[ 2352.930449] [ T53909] RIP: 0010:blkcg_set_ioprio+0x44/0x180 + +as the queue is already torn down when calling submit_bio(); + +So we need to init the percpu counter in nvmet_ns_enable(), and +wait for it to drop to zero in nvmet_ns_disable() to avoid having +I/O pending after the namespace has been disabled. + +Fixes: 74d16965d7ac ("nvmet-loop: avoid using mutex in IO hotpath") + +Signed-off-by: Hannes Reinecke +Reviewed-by: Nilay Shroff +Reviewed-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Reviewed-by: Chaitanya Kulkarni +Tested-by: Shin'ichiro Kawasaki +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/core.c | 40 ++++++++++++++++++-------------------- + 1 file changed, 19 insertions(+), 21 deletions(-) + +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index fde6c555af619..56e3c870ab4c3 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -606,6 +606,9 @@ int nvmet_ns_enable(struct nvmet_ns *ns) + goto out_dev_put; + } + ++ if (percpu_ref_init(&ns->ref, nvmet_destroy_namespace, 0, GFP_KERNEL)) ++ goto out_pr_exit; ++ + nvmet_ns_changed(subsys, ns->nsid); + ns->enabled = true; + xa_set_mark(&subsys->namespaces, ns->nsid, NVMET_NS_ENABLED); +@@ -613,6 +616,9 @@ int nvmet_ns_enable(struct nvmet_ns *ns) + out_unlock: + mutex_unlock(&subsys->lock); + return ret; ++out_pr_exit: ++ if (ns->pr.enable) ++ nvmet_pr_exit_ns(ns); + out_dev_put: + list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry) + pci_dev_put(radix_tree_delete(&ctrl->p2p_ns_map, ns->nsid)); +@@ -638,6 +644,19 @@ void nvmet_ns_disable(struct nvmet_ns *ns) + + mutex_unlock(&subsys->lock); + ++ /* ++ * Now that we removed the namespaces from the lookup list, we ++ * can kill the per_cpu ref and wait for any remaining references ++ * to be dropped, as well as a RCU grace period for anyone only ++ * using the namepace under rcu_read_lock(). Note that we can't ++ * use call_rcu here as we need to ensure the namespaces have ++ * been fully destroyed before unloading the module. ++ */ ++ percpu_ref_kill(&ns->ref); ++ synchronize_rcu(); ++ wait_for_completion(&ns->disable_done); ++ percpu_ref_exit(&ns->ref); ++ + if (ns->pr.enable) + nvmet_pr_exit_ns(ns); + +@@ -660,22 +679,6 @@ void nvmet_ns_free(struct nvmet_ns *ns) + if (ns->nsid == subsys->max_nsid) + subsys->max_nsid = nvmet_max_nsid(subsys); + +- mutex_unlock(&subsys->lock); +- +- /* +- * Now that we removed the namespaces from the lookup list, we +- * can kill the per_cpu ref and wait for any remaining references +- * to be dropped, as well as a RCU grace period for anyone only +- * using the namepace under rcu_read_lock(). Note that we can't +- * use call_rcu here as we need to ensure the namespaces have +- * been fully destroyed before unloading the module. +- */ +- percpu_ref_kill(&ns->ref); +- synchronize_rcu(); +- wait_for_completion(&ns->disable_done); +- percpu_ref_exit(&ns->ref); +- +- mutex_lock(&subsys->lock); + subsys->nr_namespaces--; + mutex_unlock(&subsys->lock); + +@@ -705,9 +708,6 @@ struct nvmet_ns *nvmet_ns_alloc(struct nvmet_subsys *subsys, u32 nsid) + ns->nsid = nsid; + ns->subsys = subsys; + +- if (percpu_ref_init(&ns->ref, nvmet_destroy_namespace, 0, GFP_KERNEL)) +- goto out_free; +- + if (ns->nsid > subsys->max_nsid) + subsys->max_nsid = nsid; + +@@ -730,8 +730,6 @@ struct nvmet_ns *nvmet_ns_alloc(struct nvmet_subsys *subsys, u32 nsid) + return ns; + out_exit: + subsys->max_nsid = nvmet_max_nsid(subsys); +- percpu_ref_exit(&ns->ref); +-out_free: + kfree(ns); + out_unlock: + mutex_unlock(&subsys->lock); +-- +2.39.5 + diff --git a/queue-6.13/platform-cznic-cznic_platforms-should-depend-on-arch.patch b/queue-6.13/platform-cznic-cznic_platforms-should-depend-on-arch.patch new file mode 100644 index 0000000000..bbdbfd6b89 --- /dev/null +++ b/queue-6.13/platform-cznic-cznic_platforms-should-depend-on-arch.patch @@ -0,0 +1,37 @@ +From c89565e987964cdafcf51a8b2d5ba944dd23c309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2025 09:31:29 +0100 +Subject: platform: cznic: CZNIC_PLATFORMS should depend on ARCH_MVEBU + +From: Geert Uytterhoeven + +[ Upstream commit dd0f05b98925111f4530d7dab774398cdb32e9e3 ] + +CZ.NIC's Turris devices are based on Marvell EBU SoCs. Hence add a +dependency on ARCH_MVEBU, to prevent asking the user about these drivers +when configuring a kernel that cannot run on an affected CZ.NIC Turris +system. + +Fixes: 992f1a3d4e88498d ("platform: cznic: Add preliminary support for Turris Omnia MCU") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/platform/cznic/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/cznic/Kconfig b/drivers/platform/cznic/Kconfig +index 49c383eb67854..13e37b49d9d01 100644 +--- a/drivers/platform/cznic/Kconfig ++++ b/drivers/platform/cznic/Kconfig +@@ -6,6 +6,7 @@ + + menuconfig CZNIC_PLATFORMS + bool "Platform support for CZ.NIC's Turris hardware" ++ depends on ARCH_MVEBU || COMPILE_TEST + help + Say Y here to be able to choose driver support for CZ.NIC's Turris + devices. This option alone does not add any kernel code. +-- +2.39.5 + diff --git a/queue-6.13/power-supply-axp20x_battery-fix-fault-handling-for-a.patch b/queue-6.13/power-supply-axp20x_battery-fix-fault-handling-for-a.patch new file mode 100644 index 0000000000..f3c9a59cf8 --- /dev/null +++ b/queue-6.13/power-supply-axp20x_battery-fix-fault-handling-for-a.patch @@ -0,0 +1,87 @@ +From 369a770dc5433a544508e87f4259c3ede58c7e97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jan 2025 17:14:51 -0600 +Subject: power: supply: axp20x_battery: Fix fault handling for AXP717 + +From: Chris Morgan + +[ Upstream commit 98380110bd48fbfd6a798ee11fffff893d36062c ] + +Correct the fault handling for the AXP717 by changing the i2c write +from regmap_update_bits() to regmap_write_bits(). The update bits +function does not work properly on a RW1C register where we must +write a 1 back to an existing register to clear it. + +Additionally, as part of this testing I confirmed the behavior of +errors reappearing, so remove comment about assumptions. + +Fixes: 6625767049c2 ("power: supply: axp20x_battery: add support for AXP717") +Signed-off-by: Chris Morgan +Reviewed-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20250131231455.153447-2-macroalpha82@gmail.com +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/axp20x_battery.c | 31 +++++++++++++-------------- + 1 file changed, 15 insertions(+), 16 deletions(-) + +diff --git a/drivers/power/supply/axp20x_battery.c b/drivers/power/supply/axp20x_battery.c +index fa27195f074e7..3c3158f31a484 100644 +--- a/drivers/power/supply/axp20x_battery.c ++++ b/drivers/power/supply/axp20x_battery.c +@@ -466,10 +466,9 @@ static int axp717_battery_get_prop(struct power_supply *psy, + + /* + * If a fault is detected it must also be cleared; if the +- * condition persists it should reappear (This is an +- * assumption, it's actually not documented). A restart was +- * not sufficient to clear the bit in testing despite the +- * register listed as POR. ++ * condition persists it should reappear. A restart was not ++ * sufficient to clear the bit in testing despite the register ++ * listed as POR. + */ + case POWER_SUPPLY_PROP_HEALTH: + ret = regmap_read(axp20x_batt->regmap, AXP717_PMU_FAULT, +@@ -480,26 +479,26 @@ static int axp717_battery_get_prop(struct power_supply *psy, + switch (reg & AXP717_BATT_PMU_FAULT_MASK) { + case AXP717_BATT_UVLO_2_5V: + val->intval = POWER_SUPPLY_HEALTH_DEAD; +- regmap_update_bits(axp20x_batt->regmap, +- AXP717_PMU_FAULT, +- AXP717_BATT_UVLO_2_5V, +- AXP717_BATT_UVLO_2_5V); ++ regmap_write_bits(axp20x_batt->regmap, ++ AXP717_PMU_FAULT, ++ AXP717_BATT_UVLO_2_5V, ++ AXP717_BATT_UVLO_2_5V); + return 0; + + case AXP717_BATT_OVER_TEMP: + val->intval = POWER_SUPPLY_HEALTH_HOT; +- regmap_update_bits(axp20x_batt->regmap, +- AXP717_PMU_FAULT, +- AXP717_BATT_OVER_TEMP, +- AXP717_BATT_OVER_TEMP); ++ regmap_write_bits(axp20x_batt->regmap, ++ AXP717_PMU_FAULT, ++ AXP717_BATT_OVER_TEMP, ++ AXP717_BATT_OVER_TEMP); + return 0; + + case AXP717_BATT_UNDER_TEMP: + val->intval = POWER_SUPPLY_HEALTH_COLD; +- regmap_update_bits(axp20x_batt->regmap, +- AXP717_PMU_FAULT, +- AXP717_BATT_UNDER_TEMP, +- AXP717_BATT_UNDER_TEMP); ++ regmap_write_bits(axp20x_batt->regmap, ++ AXP717_PMU_FAULT, ++ AXP717_BATT_UNDER_TEMP, ++ AXP717_BATT_UNDER_TEMP); + return 0; + + default: +-- +2.39.5 + diff --git a/queue-6.13/power-supply-da9150-fg-fix-potential-overflow.patch b/queue-6.13/power-supply-da9150-fg-fix-potential-overflow.patch new file mode 100644 index 0000000000..55dfd65c64 --- /dev/null +++ b/queue-6.13/power-supply-da9150-fg-fix-potential-overflow.patch @@ -0,0 +1,56 @@ +From 9929272b81698ab763bb0061c9241409f256f261 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jan 2025 09:00:34 +0000 +Subject: power: supply: da9150-fg: fix potential overflow + +From: Andrey Vatoropin + +[ Upstream commit 3fb3cb4350befc4f901c54e0cb4a2a47b1302e08 ] + +Size of variable sd_gain equals four bytes - DA9150_QIF_SD_GAIN_SIZE. +Size of variable shunt_val equals two bytes - DA9150_QIF_SHUNT_VAL_SIZE. + +The expression sd_gain * shunt_val is currently being evaluated using +32-bit arithmetic. So during the multiplication an overflow may occur. + +As the value of type 'u64' is used as storage for the eventual result, put +ULL variable at the first position of each expression in order to give the +compiler complete information about the proper arithmetic to use. According +to C99 the guaranteed width for a variable of type 'unsigned long long' >= +64 bits. + +Remove the explicit cast to u64 as it is meaningless. + +Just for the sake of consistency, perform the similar trick with another +expression concerning 'iavg'. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: a419b4fd9138 ("power: Add support for DA9150 Fuel-Gauge") +Signed-off-by: Andrey Vatoropin +Link: https://lore.kernel.org/r/20250130090030.53422-1-a.vatoropin@crpt.ru +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/da9150-fg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/da9150-fg.c b/drivers/power/supply/da9150-fg.c +index 652c1f213af1c..4f28ef1bba1a3 100644 +--- a/drivers/power/supply/da9150-fg.c ++++ b/drivers/power/supply/da9150-fg.c +@@ -247,9 +247,9 @@ static int da9150_fg_current_avg(struct da9150_fg *fg, + DA9150_QIF_SD_GAIN_SIZE); + da9150_fg_read_sync_end(fg); + +- div = (u64) (sd_gain * shunt_val * 65536ULL); ++ div = 65536ULL * sd_gain * shunt_val; + do_div(div, 1000000); +- res = (u64) (iavg * 1000000ULL); ++ res = 1000000ULL * iavg; + do_div(res, div); + + val->intval = (int) res; +-- +2.39.5 + diff --git a/queue-6.13/series b/queue-6.13/series index b089b05c8f..31ec3757db 100644 --- a/queue-6.13/series +++ b/queue-6.13/series @@ -53,3 +53,36 @@ net-make-netdev_lock-protect-netdev-reg_state.patch net-add-netdev-up-protected-by-netdev_lock.patch net-protect-netdev-napi_list-with-netdev_lock.patch revert-net-skb-introduce-and-use-a-single-page-frag-.patch +bpf-test_run-fix-use-after-free-issue-in-eth_skb_pkt.patch +bpf-unify-vm_write-vs-vm_maywrite-use-in-bpf-map-mma.patch +bpf-avoid-holding-freeze_mutex-during-mmap-operation.patch +bpf-disable-non-stream-socket-for-strparser.patch +bpf-fix-deadlock-when-freeing-cgroup-storage.patch +arm64-dts-rockchip-fix-fixed-regulator-renames-on-rk.patch +arm64-dts-rockchip-fix-lcdpwr_en-pin-for-cool-pi-gen.patch +power-supply-da9150-fg-fix-potential-overflow.patch +power-supply-axp20x_battery-fix-fault-handling-for-a.patch +net-add-rx_skb-of-kfree_skb-to-raw_tp_null_args.patch +bpf-fix-softlockup-in-arena_map_free-on-64k-page-ker.patch +arm64-dts-rockchip-adjust-smmu-interrupt-type-on-rk3.patch +firmware-arm_scmi-imx-correct-tx-size-of-scmi_imx_mi.patch +md-raid-fix-the-set_queue_limits-implementations.patch +firmware-imx-imx_scmi_misc_drv-should-depend-on-arch.patch +platform-cznic-cznic_platforms-should-depend-on-arch.patch +nouveau-svm-fix-missing-folio-unlock-put-after-make_.patch +drm-msm-avoid-rounding-up-to-one-jiffy.patch +drm-msm-dpu-skip-watchdog-timer-programming-through-.patch +drm-msm-dpu-enable-dpu_wb_input_ctrl-for-dpu-5.x.patch +drm-msm-dpu-don-t-leak-bits_per_component-into-rando.patch +drm-msm-dsi-phy-protect-phy_cmn_clk_cfg0-updated-fro.patch +drm-msm-dsi-phy-protect-phy_cmn_clk_cfg1-against-clo.patch +drm-msm-dsi-phy-do-not-overwite-phy_cmn_clk_cfg1-whe.patch +drm-xe-make-irq-enabled-flag-atomic.patch +drm-xe-irq-separate-msi-and-msi-x-flows.patch +drm-xe-fix-error-handling-in-xe_irq_install.patch +nvmet-fix-crash-when-a-namespace-is-disabled.patch +nvme-tcp-fix-compilation-warning-with-w-1.patch +nvme-tcp-fix-connect-failure-on-receiving-partial-ic.patch +nvme-ioctl-add-missing-space-in-err-message.patch +bpf-skip-non-exist-keys-in-generic_map_lookup_batch.patch +drm-nouveau-pmu-fix-gp10b-firmware-guard.patch