From: Sasha Levin Date: Tue, 8 Oct 2024 06:02:20 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v6.6.55~45 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=99c7d142c78eaf4f48c7cd867e897c049e85eaab;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/acpi-battery-fix-possible-crash-when-unregistering-a.patch b/queue-6.6/acpi-battery-fix-possible-crash-when-unregistering-a.patch new file mode 100644 index 00000000000..a3c1266084f --- /dev/null +++ b/queue-6.6/acpi-battery-fix-possible-crash-when-unregistering-a.patch @@ -0,0 +1,69 @@ +From b9b13c86d7f5f592e2e25c775c75c9fc2a7d09ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 23:28:34 +0200 +Subject: ACPI: battery: Fix possible crash when unregistering a battery hook + +From: Armin Wolf + +[ Upstream commit 76959aff14a0012ad6b984ec7686d163deccdc16 ] + +When a battery hook returns an error when adding a new battery, then +the battery hook is automatically unregistered. +However the battery hook provider cannot know that, so it will later +call battery_hook_unregister() on the already unregistered battery +hook, resulting in a crash. + +Fix this by using the list head to mark already unregistered battery +hooks as already being unregistered so that they can be ignored by +battery_hook_unregister(). + +Fixes: fa93854f7a7e ("battery: Add the battery hooking API") +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20241001212835.341788-3-W_Armin@gmx.de +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index a14852b612bba..e3cbaf3c3bbc1 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -715,7 +715,7 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) + if (!hook->remove_battery(battery->bat, hook)) + power_supply_changed(battery->bat); + } +- list_del(&hook->list); ++ list_del_init(&hook->list); + + pr_info("extension unregistered: %s\n", hook->name); + } +@@ -723,7 +723,14 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) + void battery_hook_unregister(struct acpi_battery_hook *hook) + { + mutex_lock(&hook_mutex); +- battery_hook_unregister_unlocked(hook); ++ /* ++ * Ignore already unregistered battery hooks. This might happen ++ * if a battery hook was previously unloaded due to an error when ++ * adding a new battery. ++ */ ++ if (!list_empty(&hook->list)) ++ battery_hook_unregister_unlocked(hook); ++ + mutex_unlock(&hook_mutex); + } + EXPORT_SYMBOL_GPL(battery_hook_unregister); +@@ -733,7 +740,6 @@ void battery_hook_register(struct acpi_battery_hook *hook) + struct acpi_battery *battery; + + mutex_lock(&hook_mutex); +- INIT_LIST_HEAD(&hook->list); + list_add(&hook->list, &battery_hook_list); + /* + * Now that the driver is registered, we need +-- +2.43.0 + diff --git a/queue-6.6/acpi-battery-simplify-battery-hook-locking.patch b/queue-6.6/acpi-battery-simplify-battery-hook-locking.patch new file mode 100644 index 00000000000..6a57f0121b6 --- /dev/null +++ b/queue-6.6/acpi-battery-simplify-battery-hook-locking.patch @@ -0,0 +1,96 @@ +From 325417cada364a3a96e8e344f5d88a325ed88a3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 23:28:33 +0200 +Subject: ACPI: battery: Simplify battery hook locking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 86309cbed26139e1caae7629dcca1027d9a28e75 ] + +Move the conditional locking from __battery_hook_unregister() +into battery_hook_unregister() and rename the low-level function +to simplify the locking during battery hook removal. + +Reviewed-by: Ilpo Järvinen +Reviewed-by: Pali Rohár +Signed-off-by: Armin Wolf +Link: https://patch.msgid.link/20241001212835.341788-2-W_Armin@gmx.de +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 76959aff14a0 ("ACPI: battery: Fix possible crash when unregistering a battery hook") +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 7f7ad94f22b91..a14852b612bba 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -703,28 +703,28 @@ static LIST_HEAD(acpi_battery_list); + static LIST_HEAD(battery_hook_list); + static DEFINE_MUTEX(hook_mutex); + +-static void __battery_hook_unregister(struct acpi_battery_hook *hook, int lock) ++static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) + { + struct acpi_battery *battery; ++ + /* + * In order to remove a hook, we first need to + * de-register all the batteries that are registered. + */ +- if (lock) +- mutex_lock(&hook_mutex); + list_for_each_entry(battery, &acpi_battery_list, list) { + if (!hook->remove_battery(battery->bat, hook)) + power_supply_changed(battery->bat); + } + list_del(&hook->list); +- if (lock) +- mutex_unlock(&hook_mutex); ++ + pr_info("extension unregistered: %s\n", hook->name); + } + + void battery_hook_unregister(struct acpi_battery_hook *hook) + { +- __battery_hook_unregister(hook, 1); ++ mutex_lock(&hook_mutex); ++ battery_hook_unregister_unlocked(hook); ++ mutex_unlock(&hook_mutex); + } + EXPORT_SYMBOL_GPL(battery_hook_unregister); + +@@ -750,7 +750,7 @@ void battery_hook_register(struct acpi_battery_hook *hook) + * hooks. + */ + pr_err("extension failed to load: %s", hook->name); +- __battery_hook_unregister(hook, 0); ++ battery_hook_unregister_unlocked(hook); + goto end; + } + +@@ -789,7 +789,7 @@ static void battery_hook_add_battery(struct acpi_battery *battery) + */ + pr_err("error in extension, unloading: %s", + hook_node->name); +- __battery_hook_unregister(hook_node, 0); ++ battery_hook_unregister_unlocked(hook_node); + } + } + mutex_unlock(&hook_mutex); +@@ -822,7 +822,7 @@ static void __exit battery_hook_exit(void) + * need to remove the hooks. + */ + list_for_each_entry_safe(hook, ptr, &battery_hook_list, list) { +- __battery_hook_unregister(hook, 1); ++ battery_hook_unregister(hook); + } + mutex_destroy(&hook_mutex); + } +-- +2.43.0 + diff --git a/queue-6.6/arm64-cputype-add-neoverse-n3-definitions.patch b/queue-6.6/arm64-cputype-add-neoverse-n3-definitions.patch new file mode 100644 index 00000000000..96de5befc7e --- /dev/null +++ b/queue-6.6/arm64-cputype-add-neoverse-n3-definitions.patch @@ -0,0 +1,52 @@ +From 3249efc382a1a762d4bcb98330144da4fe7afc37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 13:08:20 +0100 +Subject: arm64: cputype: Add Neoverse-N3 definitions + +From: Mark Rutland + +[ Upstream commit 924725707d80bc2588cefafef76ff3f164d299bc ] + +Add cputype definitions for Neoverse-N3. These will be used for errata +detection in subsequent patches. + +These values can be found in Table A-261 ("MIDR_EL1 bit descriptions") +in issue 02 of the Neoverse-N3 TRM, which can be found at: + + https://developer.arm.com/documentation/107997/0000/?lang=en + +Signed-off-by: Mark Rutland +Cc: James Morse +Cc: Will Deacon +Link: https://lore.kernel.org/r/20240930111705.3352047-2-mark.rutland@arm.com +Signed-off-by: Catalin Marinas +[ Mark: trivial backport ] +Signed-off-by: Mark Rutland +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/cputype.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 5a7dfeb8e8eb5..488f8e7513495 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -94,6 +94,7 @@ + #define ARM_CPU_PART_NEOVERSE_V3 0xD84 + #define ARM_CPU_PART_CORTEX_X925 0xD85 + #define ARM_CPU_PART_CORTEX_A725 0xD87 ++#define ARM_CPU_PART_NEOVERSE_N3 0xD8E + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@ -176,6 +177,7 @@ + #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) + #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) + #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++#define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +-- +2.43.0 + diff --git a/queue-6.6/arm64-errata-expand-speculative-ssbs-workaround-once.patch b/queue-6.6/arm64-errata-expand-speculative-ssbs-workaround-once.patch new file mode 100644 index 00000000000..bf20acc2678 --- /dev/null +++ b/queue-6.6/arm64-errata-expand-speculative-ssbs-workaround-once.patch @@ -0,0 +1,114 @@ +From c75df3e79cdaefa147a071b7ee2cc648b0445124 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 13:08:21 +0100 +Subject: arm64: errata: Expand speculative SSBS workaround once more + +From: Mark Rutland + +[ Upstream commit 081eb7932c2b244f63317a982c5e3990e2c7fbdd ] + +A number of Arm Ltd CPUs suffer from errata whereby an MSR to the SSBS +special-purpose register does not affect subsequent speculative +instructions, permitting speculative store bypassing for a window of +time. + +We worked around this for a number of CPUs in commits: + +* 7187bb7d0b5c7dfa ("arm64: errata: Add workaround for Arm errata 3194386 and 3312417") +* 75b3c43eab594bfb ("arm64: errata: Expand speculative SSBS workaround") +* 145502cac7ea70b5 ("arm64: errata: Expand speculative SSBS workaround (again)") + +Since then, a (hopefully final) batch of updates have been published, +with two more affected CPUs. For the affected CPUs the existing +mitigation is sufficient, as described in their respective Software +Developer Errata Notice (SDEN) documents: + +* Cortex-A715 (MP148) SDEN v15.0, erratum 3456084 + https://developer.arm.com/documentation/SDEN-2148827/1500/ + +* Neoverse-N3 (MP195) SDEN v5.0, erratum 3456111 + https://developer.arm.com/documentation/SDEN-3050973/0500/ + +Enable the existing mitigation by adding the relevant MIDRs to +erratum_spec_ssbs_list, and update silicon-errata.rst and the +Kconfig text accordingly. + +Signed-off-by: Mark Rutland +Cc: James Morse +Cc: Will Deacon +Link: https://lore.kernel.org/r/20240930111705.3352047-3-mark.rutland@arm.com +Signed-off-by: Catalin Marinas +[ Mark: fix conflict in silicon-errata.rst ] +Signed-off-by: Mark Rutland +Signed-off-by: Sasha Levin +--- + Documentation/arch/arm64/silicon-errata.rst | 4 ++++ + arch/arm64/Kconfig | 2 ++ + arch/arm64/kernel/cpu_errata.c | 2 ++ + 3 files changed, 8 insertions(+) + +diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst +index 815be40244f79..3cf806733083c 100644 +--- a/Documentation/arch/arm64/silicon-errata.rst ++++ b/Documentation/arch/arm64/silicon-errata.rst +@@ -141,6 +141,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A720 | #3456091 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Cortex-A725 | #3456106 | ARM64_ERRATUM_3194386 | +@@ -177,6 +179,8 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-N2 | #3324339 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ ++| ARM | Neoverse-N3 | #3456111 | ARM64_ERRATUM_3194386 | +++----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V1 | #3324341 | ARM64_ERRATUM_3194386 | + +----------------+-----------------+-----------------+-----------------------------+ + | ARM | Neoverse-V2 | #3324336 | ARM64_ERRATUM_3194386 | +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index fbd840c0948b5..eab866d690334 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1079,6 +1079,7 @@ config ARM64_ERRATUM_3194386 + * ARM Cortex-A78C erratum 3324346 + * ARM Cortex-A78C erratum 3324347 + * ARM Cortex-A710 erratam 3324338 ++ * ARM Cortex-A715 errartum 3456084 + * ARM Cortex-A720 erratum 3456091 + * ARM Cortex-A725 erratum 3456106 + * ARM Cortex-X1 erratum 3324344 +@@ -1089,6 +1090,7 @@ config ARM64_ERRATUM_3194386 + * ARM Cortex-X925 erratum 3324334 + * ARM Neoverse-N1 erratum 3324349 + * ARM Neoverse N2 erratum 3324339 ++ * ARM Neoverse-N3 erratum 3456111 + * ARM Neoverse-V1 erratum 3324341 + * ARM Neoverse V2 erratum 3324336 + * ARM Neoverse-V3 erratum 3312417 +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 437f96205e4fc..463b48d0f9250 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -455,6 +455,7 @@ static const struct midr_range erratum_spec_ssbs_list[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A715), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A720), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A725), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), +@@ -466,6 +467,7 @@ static const struct midr_range erratum_spec_ssbs_list[] = { + MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N3), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), +-- +2.43.0 + diff --git a/queue-6.6/btrfs-drop-the-backref-cache-during-relocation-if-we.patch b/queue-6.6/btrfs-drop-the-backref-cache-during-relocation-if-we.patch new file mode 100644 index 00000000000..e4815e5c9f5 --- /dev/null +++ b/queue-6.6/btrfs-drop-the-backref-cache-during-relocation-if-we.patch @@ -0,0 +1,214 @@ +From 6b98c95b9f5cb72dfb253611015d57f67ce8e133 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2024 16:50:22 -0400 +Subject: btrfs: drop the backref cache during relocation if we commit + +From: Josef Bacik + +[ Upstream commit db7e68b522c01eb666cfe1f31637775f18997811 ] + +Since the inception of relocation we have maintained the backref cache +across transaction commits, updating the backref cache with the new +bytenr whenever we COWed blocks that were in the cache, and then +updating their bytenr once we detected a transaction id change. + +This works as long as we're only ever modifying blocks, not changing the +structure of the tree. + +However relocation does in fact change the structure of the tree. For +example, if we are relocating a data extent, we will look up all the +leaves that point to this data extent. We will then call +do_relocation() on each of these leaves, which will COW down to the leaf +and then update the file extent location. + +But, a key feature of do_relocation() is the pending list. This is all +the pending nodes that we modified when we updated the file extent item. +We will then process all of these blocks via finish_pending_nodes, which +calls do_relocation() on all of the nodes that led up to that leaf. + +The purpose of this is to make sure we don't break sharing unless we +absolutely have to. Consider the case that we have 3 snapshots that all +point to this leaf through the same nodes, the initial COW would have +created a whole new path. If we did this for all 3 snapshots we would +end up with 3x the number of nodes we had originally. To avoid this we +will cycle through each of the snapshots that point to each of these +nodes and update their pointers to point at the new nodes. + +Once we update the pointer to the new node we will drop the node we +removed the link for and all of its children via btrfs_drop_subtree(). +This is essentially just btrfs_drop_snapshot(), but for an arbitrary +point in the snapshot. + +The problem with this is that we will never reflect this in the backref +cache. If we do this btrfs_drop_snapshot() for a node that is in the +backref tree, we will leave the node in the backref tree. This becomes +a problem when we change the transid, as now the backref cache has +entire subtrees that no longer exist, but exist as if they still are +pointed to by the same roots. + +In the best case scenario you end up with "adding refs to an existing +tree ref" errors from insert_inline_extent_backref(), where we attempt +to link in nodes on roots that are no longer valid. + +Worst case you will double free some random block and re-use it when +there's still references to the block. + +This is extremely subtle, and the consequences are quite bad. There +isn't a way to make sure our backref cache is consistent between +transid's. + +In order to fix this we need to simply evict the entire backref cache +anytime we cross transid's. This reduces performance in that we have to +rebuild this backref cache every time we change transid's, but fixes the +bug. + +This has existed since relocation was added, and is a pretty critical +bug. There's a lot more cleanup that can be done now that this +functionality is going away, but this patch is as small as possible in +order to fix the problem and make it easy for us to backport it to all +the kernels it needs to be backported to. + +Followup series will dismantle more of this code and simplify relocation +drastically to remove this functionality. + +We have a reproducer that reproduced the corruption within a few minutes +of running. With this patch it survives several iterations/hours of +running the reproducer. + +Fixes: 3fd0a5585eb9 ("Btrfs: Metadata ENOSPC handling for balance") +CC: stable@vger.kernel.org +Reviewed-by: Boris Burkov +Signed-off-by: Josef Bacik +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/backref.c | 12 ++++--- + fs/btrfs/relocation.c | 75 ++----------------------------------------- + 2 files changed, 11 insertions(+), 76 deletions(-) + +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index df223ebf2551c..a2ba1c7fc16af 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -3098,10 +3098,14 @@ void btrfs_backref_release_cache(struct btrfs_backref_cache *cache) + btrfs_backref_cleanup_node(cache, node); + } + +- cache->last_trans = 0; +- +- for (i = 0; i < BTRFS_MAX_LEVEL; i++) +- ASSERT(list_empty(&cache->pending[i])); ++ for (i = 0; i < BTRFS_MAX_LEVEL; i++) { ++ while (!list_empty(&cache->pending[i])) { ++ node = list_first_entry(&cache->pending[i], ++ struct btrfs_backref_node, ++ list); ++ btrfs_backref_cleanup_node(cache, node); ++ } ++ } + ASSERT(list_empty(&cache->pending_edge)); + ASSERT(list_empty(&cache->useless_node)); + ASSERT(list_empty(&cache->changed)); +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 6e590da98742b..299eac696eb42 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -235,70 +235,6 @@ static struct btrfs_backref_node *walk_down_backref( + return NULL; + } + +-static void update_backref_node(struct btrfs_backref_cache *cache, +- struct btrfs_backref_node *node, u64 bytenr) +-{ +- struct rb_node *rb_node; +- rb_erase(&node->rb_node, &cache->rb_root); +- node->bytenr = bytenr; +- rb_node = rb_simple_insert(&cache->rb_root, node->bytenr, &node->rb_node); +- if (rb_node) +- btrfs_backref_panic(cache->fs_info, bytenr, -EEXIST); +-} +- +-/* +- * update backref cache after a transaction commit +- */ +-static int update_backref_cache(struct btrfs_trans_handle *trans, +- struct btrfs_backref_cache *cache) +-{ +- struct btrfs_backref_node *node; +- int level = 0; +- +- if (cache->last_trans == 0) { +- cache->last_trans = trans->transid; +- return 0; +- } +- +- if (cache->last_trans == trans->transid) +- return 0; +- +- /* +- * detached nodes are used to avoid unnecessary backref +- * lookup. transaction commit changes the extent tree. +- * so the detached nodes are no longer useful. +- */ +- while (!list_empty(&cache->detached)) { +- node = list_entry(cache->detached.next, +- struct btrfs_backref_node, list); +- btrfs_backref_cleanup_node(cache, node); +- } +- +- while (!list_empty(&cache->changed)) { +- node = list_entry(cache->changed.next, +- struct btrfs_backref_node, list); +- list_del_init(&node->list); +- BUG_ON(node->pending); +- update_backref_node(cache, node, node->new_bytenr); +- } +- +- /* +- * some nodes can be left in the pending list if there were +- * errors during processing the pending nodes. +- */ +- for (level = 0; level < BTRFS_MAX_LEVEL; level++) { +- list_for_each_entry(node, &cache->pending[level], list) { +- BUG_ON(!node->pending); +- if (node->bytenr == node->new_bytenr) +- continue; +- update_backref_node(cache, node, node->new_bytenr); +- } +- } +- +- cache->last_trans = 0; +- return 1; +-} +- + static bool reloc_root_is_dead(const struct btrfs_root *root) + { + /* +@@ -557,9 +493,6 @@ static int clone_backref_node(struct btrfs_trans_handle *trans, + struct btrfs_backref_edge *new_edge; + struct rb_node *rb_node; + +- if (cache->last_trans > 0) +- update_backref_cache(trans, cache); +- + rb_node = rb_simple_search(&cache->rb_root, src->commit_root->start); + if (rb_node) { + node = rb_entry(rb_node, struct btrfs_backref_node, rb_node); +@@ -3682,11 +3615,9 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc) + break; + } + restart: +- if (update_backref_cache(trans, &rc->backref_cache)) { +- btrfs_end_transaction(trans); +- trans = NULL; +- continue; +- } ++ if (rc->backref_cache.last_trans != trans->transid) ++ btrfs_backref_release_cache(&rc->backref_cache); ++ rc->backref_cache.last_trans = trans->transid; + + ret = find_next_extent(rc, path, &key); + if (ret < 0) +-- +2.43.0 + diff --git a/queue-6.6/btrfs-relocation-constify-parameters-where-possible.patch b/queue-6.6/btrfs-relocation-constify-parameters-where-possible.patch new file mode 100644 index 00000000000..c7b54ad16b3 --- /dev/null +++ b/queue-6.6/btrfs-relocation-constify-parameters-where-possible.patch @@ -0,0 +1,229 @@ +From 861e1398f70e051251ee35ea90353554dee616c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Sep 2023 13:07:29 +0200 +Subject: btrfs: relocation: constify parameters where possible + +From: David Sterba + +[ Upstream commit ab7c8bbf3a088730e58da224bcad512f1dd9ca74 ] + +Lots of the functions in relocation.c don't change pointer parameters +but lack the annotations. Add them and reformat according to current +coding style if needed. + +Reviewed-by: Johannes Thumshirn +Signed-off-by: David Sterba +Stable-dep-of: db7e68b522c0 ("btrfs: drop the backref cache during relocation if we commit") +Signed-off-by: Sasha Levin +--- + fs/btrfs/relocation.c | 56 +++++++++++++++++++++---------------------- + fs/btrfs/relocation.h | 9 +++---- + 2 files changed, 33 insertions(+), 32 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 1f4fd6c86fb00..6e590da98742b 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -299,7 +299,7 @@ static int update_backref_cache(struct btrfs_trans_handle *trans, + return 1; + } + +-static bool reloc_root_is_dead(struct btrfs_root *root) ++static bool reloc_root_is_dead(const struct btrfs_root *root) + { + /* + * Pair with set_bit/clear_bit in clean_dirty_subvols and +@@ -320,7 +320,7 @@ static bool reloc_root_is_dead(struct btrfs_root *root) + * from no reloc root. But btrfs_should_ignore_reloc_root() below is a + * special case. + */ +-static bool have_reloc_root(struct btrfs_root *root) ++static bool have_reloc_root(const struct btrfs_root *root) + { + if (reloc_root_is_dead(root)) + return false; +@@ -329,7 +329,7 @@ static bool have_reloc_root(struct btrfs_root *root) + return true; + } + +-bool btrfs_should_ignore_reloc_root(struct btrfs_root *root) ++bool btrfs_should_ignore_reloc_root(const struct btrfs_root *root) + { + struct btrfs_root *reloc_root; + +@@ -546,7 +546,7 @@ static noinline_for_stack struct btrfs_backref_node *build_backref_tree( + */ + static int clone_backref_node(struct btrfs_trans_handle *trans, + struct reloc_control *rc, +- struct btrfs_root *src, ++ const struct btrfs_root *src, + struct btrfs_root *dest) + { + struct btrfs_root *reloc_root = src->reloc_root; +@@ -1186,9 +1186,9 @@ int replace_file_extents(struct btrfs_trans_handle *trans, + return ret; + } + +-static noinline_for_stack +-int memcmp_node_keys(struct extent_buffer *eb, int slot, +- struct btrfs_path *path, int level) ++static noinline_for_stack int memcmp_node_keys(const struct extent_buffer *eb, ++ int slot, const struct btrfs_path *path, ++ int level) + { + struct btrfs_disk_key key1; + struct btrfs_disk_key key2; +@@ -1517,8 +1517,8 @@ int walk_down_reloc_tree(struct btrfs_root *root, struct btrfs_path *path, + * [min_key, max_key) + */ + static int invalidate_extent_cache(struct btrfs_root *root, +- struct btrfs_key *min_key, +- struct btrfs_key *max_key) ++ const struct btrfs_key *min_key, ++ const struct btrfs_key *max_key) + { + struct btrfs_fs_info *fs_info = root->fs_info; + struct inode *inode = NULL; +@@ -2829,7 +2829,7 @@ int relocate_tree_blocks(struct btrfs_trans_handle *trans, + + static noinline_for_stack int prealloc_file_extent_cluster( + struct btrfs_inode *inode, +- struct file_extent_cluster *cluster) ++ const struct file_extent_cluster *cluster) + { + u64 alloc_hint = 0; + u64 start; +@@ -2964,7 +2964,7 @@ static noinline_for_stack int setup_relocation_extent_mapping(struct inode *inod + /* + * Allow error injection to test balance/relocation cancellation + */ +-noinline int btrfs_should_cancel_balance(struct btrfs_fs_info *fs_info) ++noinline int btrfs_should_cancel_balance(const struct btrfs_fs_info *fs_info) + { + return atomic_read(&fs_info->balance_cancel_req) || + atomic_read(&fs_info->reloc_cancel_req) || +@@ -2972,7 +2972,7 @@ noinline int btrfs_should_cancel_balance(struct btrfs_fs_info *fs_info) + } + ALLOW_ERROR_INJECTION(btrfs_should_cancel_balance, TRUE); + +-static u64 get_cluster_boundary_end(struct file_extent_cluster *cluster, ++static u64 get_cluster_boundary_end(const struct file_extent_cluster *cluster, + int cluster_nr) + { + /* Last extent, use cluster end directly */ +@@ -2984,7 +2984,7 @@ static u64 get_cluster_boundary_end(struct file_extent_cluster *cluster, + } + + static int relocate_one_page(struct inode *inode, struct file_ra_state *ra, +- struct file_extent_cluster *cluster, ++ const struct file_extent_cluster *cluster, + int *cluster_nr, unsigned long page_index) + { + struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); +@@ -3119,7 +3119,7 @@ static int relocate_one_page(struct inode *inode, struct file_ra_state *ra, + } + + static int relocate_file_extent_cluster(struct inode *inode, +- struct file_extent_cluster *cluster) ++ const struct file_extent_cluster *cluster) + { + u64 offset = BTRFS_I(inode)->index_cnt; + unsigned long index; +@@ -3157,9 +3157,9 @@ static int relocate_file_extent_cluster(struct inode *inode, + return ret; + } + +-static noinline_for_stack +-int relocate_data_extent(struct inode *inode, struct btrfs_key *extent_key, +- struct file_extent_cluster *cluster) ++static noinline_for_stack int relocate_data_extent(struct inode *inode, ++ const struct btrfs_key *extent_key, ++ struct file_extent_cluster *cluster) + { + int ret; + +@@ -3192,7 +3192,7 @@ int relocate_data_extent(struct inode *inode, struct btrfs_key *extent_key, + * the major work is getting the generation and level of the block + */ + static int add_tree_block(struct reloc_control *rc, +- struct btrfs_key *extent_key, ++ const struct btrfs_key *extent_key, + struct btrfs_path *path, + struct rb_root *blocks) + { +@@ -3443,11 +3443,10 @@ static int delete_v1_space_cache(struct extent_buffer *leaf, + /* + * helper to find all tree blocks that reference a given data extent + */ +-static noinline_for_stack +-int add_data_references(struct reloc_control *rc, +- struct btrfs_key *extent_key, +- struct btrfs_path *path, +- struct rb_root *blocks) ++static noinline_for_stack int add_data_references(struct reloc_control *rc, ++ const struct btrfs_key *extent_key, ++ struct btrfs_path *path, ++ struct rb_root *blocks) + { + struct btrfs_backref_walk_ctx ctx = { 0 }; + struct ulist_iterator leaf_uiter; +@@ -3873,9 +3872,9 @@ static void delete_orphan_inode(struct btrfs_trans_handle *trans, + * helper to create inode for data relocation. + * the inode is in data relocation tree and its link count is 0 + */ +-static noinline_for_stack +-struct inode *create_reloc_inode(struct btrfs_fs_info *fs_info, +- struct btrfs_block_group *group) ++static noinline_for_stack struct inode *create_reloc_inode( ++ struct btrfs_fs_info *fs_info, ++ const struct btrfs_block_group *group) + { + struct inode *inode = NULL; + struct btrfs_trans_handle *trans; +@@ -4421,7 +4420,8 @@ int btrfs_reloc_clone_csums(struct btrfs_ordered_extent *ordered) + } + + int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans, +- struct btrfs_root *root, struct extent_buffer *buf, ++ struct btrfs_root *root, ++ const struct extent_buffer *buf, + struct extent_buffer *cow) + { + struct btrfs_fs_info *fs_info = root->fs_info; +@@ -4560,7 +4560,7 @@ int btrfs_reloc_post_snapshot(struct btrfs_trans_handle *trans, + * + * Return U64_MAX if no running relocation. + */ +-u64 btrfs_get_reloc_bg_bytenr(struct btrfs_fs_info *fs_info) ++u64 btrfs_get_reloc_bg_bytenr(const struct btrfs_fs_info *fs_info) + { + u64 logical = U64_MAX; + +diff --git a/fs/btrfs/relocation.h b/fs/btrfs/relocation.h +index af749c780b4e7..5fb60f2deb530 100644 +--- a/fs/btrfs/relocation.h ++++ b/fs/btrfs/relocation.h +@@ -10,15 +10,16 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans, + int btrfs_recover_relocation(struct btrfs_fs_info *fs_info); + int btrfs_reloc_clone_csums(struct btrfs_ordered_extent *ordered); + int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans, +- struct btrfs_root *root, struct extent_buffer *buf, ++ struct btrfs_root *root, ++ const struct extent_buffer *buf, + struct extent_buffer *cow); + void btrfs_reloc_pre_snapshot(struct btrfs_pending_snapshot *pending, + u64 *bytes_to_reserve); + int btrfs_reloc_post_snapshot(struct btrfs_trans_handle *trans, + struct btrfs_pending_snapshot *pending); +-int btrfs_should_cancel_balance(struct btrfs_fs_info *fs_info); ++int btrfs_should_cancel_balance(const struct btrfs_fs_info *fs_info); + struct btrfs_root *find_reloc_root(struct btrfs_fs_info *fs_info, u64 bytenr); +-bool btrfs_should_ignore_reloc_root(struct btrfs_root *root); +-u64 btrfs_get_reloc_bg_bytenr(struct btrfs_fs_info *fs_info); ++bool btrfs_should_ignore_reloc_root(const struct btrfs_root *root); ++u64 btrfs_get_reloc_bg_bytenr(const struct btrfs_fs_info *fs_info); + + #endif +-- +2.43.0 + diff --git a/queue-6.6/btrfs-relocation-return-bool-from-btrfs_should_ignor.patch b/queue-6.6/btrfs-relocation-return-bool-from-btrfs_should_ignor.patch new file mode 100644 index 00000000000..855f97fa56b --- /dev/null +++ b/queue-6.6/btrfs-relocation-return-bool-from-btrfs_should_ignor.patch @@ -0,0 +1,83 @@ +From 672bbdb39106b9f2e610300cdd2bb15f287c2630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Sep 2023 13:07:25 +0200 +Subject: btrfs: relocation: return bool from btrfs_should_ignore_reloc_root + +From: David Sterba + +[ Upstream commit 32f2abca380fedc60f7a8d3288e4c9586672e207 ] + +btrfs_should_ignore_reloc_root() is a predicate so it should return +bool. + +Reviewed-by: Johannes Thumshirn +Reviewed-by: Qu Wenruo +Signed-off-by: David Sterba +Stable-dep-of: db7e68b522c0 ("btrfs: drop the backref cache during relocation if we commit") +Signed-off-by: Sasha Levin +--- + fs/btrfs/relocation.c | 19 +++++++++---------- + fs/btrfs/relocation.h | 2 +- + 2 files changed, 10 insertions(+), 11 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 05b2a59ce8897..1f4fd6c86fb00 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -329,31 +329,30 @@ static bool have_reloc_root(struct btrfs_root *root) + return true; + } + +-int btrfs_should_ignore_reloc_root(struct btrfs_root *root) ++bool btrfs_should_ignore_reloc_root(struct btrfs_root *root) + { + struct btrfs_root *reloc_root; + + if (!test_bit(BTRFS_ROOT_SHAREABLE, &root->state)) +- return 0; ++ return false; + + /* This root has been merged with its reloc tree, we can ignore it */ + if (reloc_root_is_dead(root)) +- return 1; ++ return true; + + reloc_root = root->reloc_root; + if (!reloc_root) +- return 0; ++ return false; + + if (btrfs_header_generation(reloc_root->commit_root) == + root->fs_info->running_transaction->transid) +- return 0; ++ return false; + /* +- * if there is reloc tree and it was created in previous +- * transaction backref lookup can find the reloc tree, +- * so backref node for the fs tree root is useless for +- * relocation. ++ * If there is reloc tree and it was created in previous transaction ++ * backref lookup can find the reloc tree, so backref node for the fs ++ * tree root is useless for relocation. + */ +- return 1; ++ return true; + } + + /* +diff --git a/fs/btrfs/relocation.h b/fs/btrfs/relocation.h +index 77d69f6ae967c..af749c780b4e7 100644 +--- a/fs/btrfs/relocation.h ++++ b/fs/btrfs/relocation.h +@@ -18,7 +18,7 @@ int btrfs_reloc_post_snapshot(struct btrfs_trans_handle *trans, + struct btrfs_pending_snapshot *pending); + int btrfs_should_cancel_balance(struct btrfs_fs_info *fs_info); + struct btrfs_root *find_reloc_root(struct btrfs_fs_info *fs_info, u64 bytenr); +-int btrfs_should_ignore_reloc_root(struct btrfs_root *root); ++bool btrfs_should_ignore_reloc_root(struct btrfs_root *root); + u64 btrfs_get_reloc_bg_bytenr(struct btrfs_fs_info *fs_info); + + #endif +-- +2.43.0 + diff --git a/queue-6.6/build-id-require-program-headers-to-be-right-after-e.patch b/queue-6.6/build-id-require-program-headers-to-be-right-after-e.patch new file mode 100644 index 00000000000..9c81ac25326 --- /dev/null +++ b/queue-6.6/build-id-require-program-headers-to-be-right-after-e.patch @@ -0,0 +1,66 @@ +From 5806715b646c58b9f18a3ddc2baa1e1e79c4ae94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 21:39:33 +0300 +Subject: build-id: require program headers to be right after ELF header + +From: Alexey Dobriyan + +[ Upstream commit 961a2851324561caed579764ffbee3db82b32829 ] + +Neither ELF spec not ELF loader require program header to be placed right +after ELF header, but build-id code very much assumes such placement: + +See + + find_get_page(vma->vm_file->f_mapping, 0); + +line and checks against PAGE_SIZE. + +Returns errors for now until someone rewrites build-id parser +to be more inline with load_elf_binary(). + +Link: https://lkml.kernel.org/r/d58bc281-6ca7-467a-9a64-40fa214bd63e@p183 +Signed-off-by: Alexey Dobriyan +Reviewed-by: Jiri Olsa +Signed-off-by: Andrew Morton +Stable-dep-of: 905415ff3ffb ("lib/buildid: harden build ID parsing logic") +Signed-off-by: Sasha Levin +--- + lib/buildid.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/lib/buildid.c b/lib/buildid.c +index e3a7acdeef0ed..cdc0950f73843 100644 +--- a/lib/buildid.c ++++ b/lib/buildid.c +@@ -73,6 +73,13 @@ static int get_build_id_32(const void *page_addr, unsigned char *build_id, + Elf32_Phdr *phdr; + int i; + ++ /* ++ * FIXME ++ * Neither ELF spec nor ELF loader require that program headers ++ * start immediately after ELF header. ++ */ ++ if (ehdr->e_phoff != sizeof(Elf32_Ehdr)) ++ return -EINVAL; + /* only supports phdr that fits in one page */ + if (ehdr->e_phnum > + (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr)) +@@ -98,6 +105,13 @@ static int get_build_id_64(const void *page_addr, unsigned char *build_id, + Elf64_Phdr *phdr; + int i; + ++ /* ++ * FIXME ++ * Neither ELF spec nor ELF loader require that program headers ++ * start immediately after ELF header. ++ */ ++ if (ehdr->e_phoff != sizeof(Elf64_Ehdr)) ++ return -EINVAL; + /* only supports phdr that fits in one page */ + if (ehdr->e_phnum > + (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr)) +-- +2.43.0 + diff --git a/queue-6.6/clk-qcom-gcc-sc8180x-add-gpll9-support.patch b/queue-6.6/clk-qcom-gcc-sc8180x-add-gpll9-support.patch new file mode 100644 index 00000000000..cf03e22e716 --- /dev/null +++ b/queue-6.6/clk-qcom-gcc-sc8180x-add-gpll9-support.patch @@ -0,0 +1,71 @@ +From 2cbac7e701d4dd122454b2ffe93683c8d35b99d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2024 10:43:03 +0530 +Subject: clk: qcom: gcc-sc8180x: Add GPLL9 support + +From: Satya Priya Kakitapalli + +[ Upstream commit 818a2f8d5e4ad2c1e39a4290158fe8e39a744c70 ] + +Add the missing GPLL9 pll and fix the gcc_parents_7 data to use +the correct pll hw. + +Fixes: 4433594bbe5d ("clk: qcom: gcc: Add global clock controller driver for SC8180x") +Cc: stable@vger.kernel.org +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Satya Priya Kakitapalli +Link: https://lore.kernel.org/r/20240812-gcc-sc8180x-fixes-v2-3-8b3eaa5fb856@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc8180x.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-sc8180x.c b/drivers/clk/qcom/gcc-sc8180x.c +index 283bda4d1e701..ec0c45881c67a 100644 +--- a/drivers/clk/qcom/gcc-sc8180x.c ++++ b/drivers/clk/qcom/gcc-sc8180x.c +@@ -142,6 +142,23 @@ static struct clk_alpha_pll gpll7 = { + }, + }; + ++static struct clk_alpha_pll gpll9 = { ++ .offset = 0x1c000, ++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_TRION], ++ .clkr = { ++ .enable_reg = 0x52000, ++ .enable_mask = BIT(9), ++ .hw.init = &(const struct clk_init_data) { ++ .name = "gpll9", ++ .parent_data = &(const struct clk_parent_data) { ++ .fw_name = "bi_tcxo", ++ }, ++ .num_parents = 1, ++ .ops = &clk_alpha_pll_fixed_trion_ops, ++ }, ++ }, ++}; ++ + static const struct parent_map gcc_parent_map_0[] = { + { P_BI_TCXO, 0 }, + { P_GPLL0_OUT_MAIN, 1 }, +@@ -241,7 +258,7 @@ static const struct parent_map gcc_parent_map_7[] = { + static const struct clk_parent_data gcc_parents_7[] = { + { .fw_name = "bi_tcxo", }, + { .hw = &gpll0.clkr.hw }, +- { .name = "gppl9" }, ++ { .hw = &gpll9.clkr.hw }, + { .hw = &gpll4.clkr.hw }, + { .hw = &gpll0_out_even.clkr.hw }, + }; +@@ -4419,6 +4436,7 @@ static struct clk_regmap *gcc_sc8180x_clocks[] = { + [GPLL1] = &gpll1.clkr, + [GPLL4] = &gpll4.clkr, + [GPLL7] = &gpll7.clkr, ++ [GPLL9] = &gpll9.clkr, + }; + + static const struct qcom_reset_map gcc_sc8180x_resets[] = { +-- +2.43.0 + diff --git a/queue-6.6/cpufreq-intel_pstate-make-hwp_notify_lock-a-raw-spin.patch b/queue-6.6/cpufreq-intel_pstate-make-hwp_notify_lock-a-raw-spin.patch new file mode 100644 index 00000000000..3a4c87515d3 --- /dev/null +++ b/queue-6.6/cpufreq-intel_pstate-make-hwp_notify_lock-a-raw-spin.patch @@ -0,0 +1,113 @@ +From 12ece7b7eda838489b08fbe44e0445d67af49266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Oct 2024 22:51:07 +0200 +Subject: cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit 8b4865cd904650cbed7f2407e653934c621b8127 upstream. + +notify_hwp_interrupt() is called via sysvec_thermal() -> +smp_thermal_vector() -> intel_thermal_interrupt() in hard irq context. +For this reason it must not use a simple spin_lock that sleeps with +PREEMPT_RT enabled. So convert it to a raw spinlock. + +Reported-by: xiao sheng wen +Link: https://bugs.debian.org/1076483 +Signed-off-by: Uwe Kleine-König +Acked-by: Srinivas Pandruvada +Acked-by: Sebastian Andrzej Siewior +Tested-by: xiao sheng wen +Link: https://patch.msgid.link/20240919081121.10784-2-ukleinek@debian.org +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +[ukleinek: Backport to v6.6.y] +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/intel_pstate.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 0ee3a04bb1022..8a4fdf212ce0d 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -1632,7 +1632,7 @@ static void intel_pstate_notify_work(struct work_struct *work) + wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_STATUS, 0); + } + +-static DEFINE_SPINLOCK(hwp_notify_lock); ++static DEFINE_RAW_SPINLOCK(hwp_notify_lock); + static cpumask_t hwp_intr_enable_mask; + + void notify_hwp_interrupt(void) +@@ -1649,7 +1649,7 @@ void notify_hwp_interrupt(void) + if (!(value & 0x01)) + return; + +- spin_lock_irqsave(&hwp_notify_lock, flags); ++ raw_spin_lock_irqsave(&hwp_notify_lock, flags); + + if (!cpumask_test_cpu(this_cpu, &hwp_intr_enable_mask)) + goto ack_intr; +@@ -1673,13 +1673,13 @@ void notify_hwp_interrupt(void) + + schedule_delayed_work(&cpudata->hwp_notify_work, msecs_to_jiffies(10)); + +- spin_unlock_irqrestore(&hwp_notify_lock, flags); ++ raw_spin_unlock_irqrestore(&hwp_notify_lock, flags); + + return; + + ack_intr: + wrmsrl_safe(MSR_HWP_STATUS, 0); +- spin_unlock_irqrestore(&hwp_notify_lock, flags); ++ raw_spin_unlock_irqrestore(&hwp_notify_lock, flags); + } + + static void intel_pstate_disable_hwp_interrupt(struct cpudata *cpudata) +@@ -1692,10 +1692,10 @@ static void intel_pstate_disable_hwp_interrupt(struct cpudata *cpudata) + /* wrmsrl_on_cpu has to be outside spinlock as this can result in IPC */ + wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_INTERRUPT, 0x00); + +- spin_lock_irqsave(&hwp_notify_lock, flags); ++ raw_spin_lock_irqsave(&hwp_notify_lock, flags); + if (cpumask_test_and_clear_cpu(cpudata->cpu, &hwp_intr_enable_mask)) + cancel_delayed_work(&cpudata->hwp_notify_work); +- spin_unlock_irqrestore(&hwp_notify_lock, flags); ++ raw_spin_unlock_irqrestore(&hwp_notify_lock, flags); + } + + static void intel_pstate_enable_hwp_interrupt(struct cpudata *cpudata) +@@ -1704,10 +1704,10 @@ static void intel_pstate_enable_hwp_interrupt(struct cpudata *cpudata) + if (boot_cpu_has(X86_FEATURE_HWP_NOTIFY)) { + unsigned long flags; + +- spin_lock_irqsave(&hwp_notify_lock, flags); ++ raw_spin_lock_irqsave(&hwp_notify_lock, flags); + INIT_DELAYED_WORK(&cpudata->hwp_notify_work, intel_pstate_notify_work); + cpumask_set_cpu(cpudata->cpu, &hwp_intr_enable_mask); +- spin_unlock_irqrestore(&hwp_notify_lock, flags); ++ raw_spin_unlock_irqrestore(&hwp_notify_lock, flags); + + /* wrmsrl_on_cpu has to be outside spinlock as this can result in IPC */ + wrmsrl_on_cpu(cpudata->cpu, MSR_HWP_INTERRUPT, 0x01); +@@ -3136,10 +3136,10 @@ static void intel_pstate_driver_cleanup(void) + if (intel_pstate_driver == &intel_pstate) + intel_pstate_clear_update_util_hook(cpu); + +- spin_lock(&hwp_notify_lock); ++ raw_spin_lock(&hwp_notify_lock); + kfree(all_cpu_data[cpu]); + WRITE_ONCE(all_cpu_data[cpu], NULL); +- spin_unlock(&hwp_notify_lock); ++ raw_spin_unlock(&hwp_notify_lock); + } + } + cpus_read_unlock(); +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-allow-backlight-to-go-below-amdgpu_d.patch b/queue-6.6/drm-amd-display-allow-backlight-to-go-below-amdgpu_d.patch new file mode 100644 index 00000000000..4014e596947 --- /dev/null +++ b/queue-6.6/drm-amd-display-allow-backlight-to-go-below-amdgpu_d.patch @@ -0,0 +1,47 @@ +From 4412a727ca15c4487cf841c233a737f74df89f09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Sep 2024 14:28:37 -0500 +Subject: drm/amd/display: Allow backlight to go below + `AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit 87d749a6aab73d8069d0345afaa98297816cb220 ] + +The issue with panel power savings compatibility below +`AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` happens at +`AMDGPU_DM_DEFAULT_MIN_BACKLIGHT` as well. + +That issue will be fixed separately, so don't prevent the backlight +brightness from going that low. + +Cc: Harry Wentland +Cc: Thomas Weißschuh +Link: https://lore.kernel.org/amd-gfx/be04226a-a9e3-4a45-a83b-6d263c6557d8@t-8ch.de/T/#m400dee4e2fc61fe9470334d20a7c8c89c9aef44f +Reviewed-by: Harry Wentland +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 3636872429d19..a3f17c572bf06 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4064,7 +4064,7 @@ static void amdgpu_dm_update_backlight_caps(struct amdgpu_display_manager *dm, + int spread = caps.max_input_signal - caps.min_input_signal; + + if (caps.max_input_signal > AMDGPU_DM_DEFAULT_MAX_BACKLIGHT || +- caps.min_input_signal < AMDGPU_DM_DEFAULT_MIN_BACKLIGHT || ++ caps.min_input_signal < 0 || + spread > AMDGPU_DM_DEFAULT_MAX_BACKLIGHT || + spread < AMDGPU_DM_MIN_SPREAD) { + DRM_DEBUG_KMS("DM: Invalid backlight caps: min=%d, max=%d\n", +-- +2.43.0 + diff --git a/queue-6.6/dt-bindings-clock-qcom-add-gpll9-support-on-gcc-sc81.patch b/queue-6.6/dt-bindings-clock-qcom-add-gpll9-support-on-gcc-sc81.patch new file mode 100644 index 00000000000..99b4744e86b --- /dev/null +++ b/queue-6.6/dt-bindings-clock-qcom-add-gpll9-support-on-gcc-sc81.patch @@ -0,0 +1,37 @@ +From d24ccf1e2ce7475dcd16e7a0958701575f501240 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2024 10:43:02 +0530 +Subject: dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x + +From: Satya Priya Kakitapalli + +[ Upstream commit 648b4bde0aca2980ebc0b90cdfbb80d222370c3d ] + +Add the missing GPLL9 which is required for the gcc sdcc2 clock. + +Fixes: 0fadcdfdcf57 ("dt-bindings: clock: Add SC8180x GCC binding") +Cc: stable@vger.kernel.org +Acked-by: Krzysztof Kozlowski +Signed-off-by: Satya Priya Kakitapalli +Link: https://lore.kernel.org/r/20240812-gcc-sc8180x-fixes-v2-2-8b3eaa5fb856@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + include/dt-bindings/clock/qcom,gcc-sc8180x.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/dt-bindings/clock/qcom,gcc-sc8180x.h b/include/dt-bindings/clock/qcom,gcc-sc8180x.h +index 90c6e021a0356..2569f874fe13c 100644 +--- a/include/dt-bindings/clock/qcom,gcc-sc8180x.h ++++ b/include/dt-bindings/clock/qcom,gcc-sc8180x.h +@@ -248,6 +248,7 @@ + #define GCC_USB3_SEC_CLKREF_CLK 238 + #define GCC_UFS_MEM_CLKREF_EN 239 + #define GCC_UFS_CARD_CLKREF_EN 240 ++#define GPLL9 241 + + #define GCC_EMAC_BCR 0 + #define GCC_GPU_BCR 1 +-- +2.43.0 + diff --git a/queue-6.6/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch b/queue-6.6/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch new file mode 100644 index 00000000000..2fd56442d1e --- /dev/null +++ b/queue-6.6/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch @@ -0,0 +1,38 @@ +From f704a2be34d9edf3ac7b0ca9f646bd39fd21ecef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:37:26 +0530 +Subject: dt-bindings: clock: qcom: Add missing UFS QREF clocks + +From: Manivannan Sadhasivam + +[ Upstream commit 26447dad8119fd084d7c6f167c3026700b701666 ] + +Add missing QREF clocks for UFS MEM and UFS CARD controllers. + +Fixes: 0fadcdfdcf57 ("dt-bindings: clock: Add SC8180x GCC binding") +Acked-by: Krzysztof Kozlowski +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-3-58a49d2f4605@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: 648b4bde0aca ("dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x") +Signed-off-by: Sasha Levin +--- + include/dt-bindings/clock/qcom,gcc-sc8180x.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/dt-bindings/clock/qcom,gcc-sc8180x.h b/include/dt-bindings/clock/qcom,gcc-sc8180x.h +index e893415ae13d0..90c6e021a0356 100644 +--- a/include/dt-bindings/clock/qcom,gcc-sc8180x.h ++++ b/include/dt-bindings/clock/qcom,gcc-sc8180x.h +@@ -246,6 +246,8 @@ + #define GCC_PCIE_3_CLKREF_CLK 236 + #define GCC_USB3_PRIM_CLKREF_CLK 237 + #define GCC_USB3_SEC_CLKREF_CLK 238 ++#define GCC_UFS_MEM_CLKREF_EN 239 ++#define GCC_UFS_CARD_CLKREF_EN 240 + + #define GCC_EMAC_BCR 0 + #define GCC_GPU_BCR 1 +-- +2.43.0 + diff --git a/queue-6.6/i2c-core-lock-address-during-client-device-instantia.patch b/queue-6.6/i2c-core-lock-address-during-client-device-instantia.patch new file mode 100644 index 00000000000..002f4f43996 --- /dev/null +++ b/queue-6.6/i2c-core-lock-address-during-client-device-instantia.patch @@ -0,0 +1,118 @@ +From b0dcbd43674eae6796c28e524d86431cbbe2ee09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2024 21:44:50 +0200 +Subject: i2c: core: Lock address during client device instantiation + +From: Heiner Kallweit + +[ Upstream commit 8d3cefaf659265aa82b0373a563fdb9d16a2b947 ] + +Krzysztof reported an issue [0] which is caused by parallel attempts to +instantiate the same I2C client device. This can happen if driver +supports auto-detection, but certain devices are also instantiated +explicitly. +The original change isn't actually wrong, it just revealed that I2C core +isn't prepared yet to handle this scenario. +Calls to i2c_new_client_device() can be nested, therefore we can't use a +simple mutex here. Parallel instantiation of devices at different addresses +is ok, so we just have to prevent parallel instantiation at the same address. +We can use a bitmap with one bit per 7-bit I2C client address, and atomic +bit operations to set/check/clear bits. +Now a parallel attempt to instantiate a device at the same address will +result in -EBUSY being returned, avoiding the "sysfs: cannot create duplicate +filename" splash. + +Note: This patch version includes small cosmetic changes to the Tested-by + version, only functional change is that address locking is supported + for slave addresses too. + +[0] https://lore.kernel.org/linux-i2c/9479fe4e-eb0c-407e-84c0-bd60c15baf74@ans.pl/T/#m12706546e8e2414d8f1a0dc61c53393f731685cc + +Fixes: caba40ec3531 ("eeprom: at24: Probe for DDR3 thermal sensor in the SPD case") +Cc: stable@vger.kernel.org +Tested-by: Krzysztof Piotr Oledzki +Signed-off-by: Heiner Kallweit +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-base.c | 28 ++++++++++++++++++++++++++++ + include/linux/i2c.h | 3 +++ + 2 files changed, 31 insertions(+) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 9d918a7dfddae..943f0021d6a2c 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -915,6 +915,27 @@ int i2c_dev_irq_from_resources(const struct resource *resources, + return 0; + } + ++/* ++ * Serialize device instantiation in case it can be instantiated explicitly ++ * and by auto-detection ++ */ ++static int i2c_lock_addr(struct i2c_adapter *adap, unsigned short addr, ++ unsigned short flags) ++{ ++ if (!(flags & I2C_CLIENT_TEN) && ++ test_and_set_bit(addr, adap->addrs_in_instantiation)) ++ return -EBUSY; ++ ++ return 0; ++} ++ ++static void i2c_unlock_addr(struct i2c_adapter *adap, unsigned short addr, ++ unsigned short flags) ++{ ++ if (!(flags & I2C_CLIENT_TEN)) ++ clear_bit(addr, adap->addrs_in_instantiation); ++} ++ + /** + * i2c_new_client_device - instantiate an i2c device + * @adap: the adapter managing the device +@@ -962,6 +983,10 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf + goto out_err_silent; + } + ++ status = i2c_lock_addr(adap, client->addr, client->flags); ++ if (status) ++ goto out_err_silent; ++ + /* Check for address business */ + status = i2c_check_addr_busy(adap, i2c_encode_flags_to_addr(client)); + if (status) +@@ -993,6 +1018,8 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf + dev_dbg(&adap->dev, "client [%s] registered with bus id %s\n", + client->name, dev_name(&client->dev)); + ++ i2c_unlock_addr(adap, client->addr, client->flags); ++ + return client; + + out_remove_swnode: +@@ -1004,6 +1031,7 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf + dev_err(&adap->dev, + "Failed to register i2c client %s at 0x%02x (%d)\n", + client->name, client->addr, status); ++ i2c_unlock_addr(adap, client->addr, client->flags); + out_err_silent: + if (need_put) + put_device(&client->dev); +diff --git a/include/linux/i2c.h b/include/linux/i2c.h +index 033de64d09bba..a3166100f0cce 100644 +--- a/include/linux/i2c.h ++++ b/include/linux/i2c.h +@@ -748,6 +748,9 @@ struct i2c_adapter { + struct regulator *bus_regulator; + + struct dentry *debugfs; ++ ++ /* 7bit address space */ ++ DECLARE_BITMAP(addrs_in_instantiation, 1 << 7); + }; + #define to_i2c_adapter(d) container_of(d, struct i2c_adapter, dev) + +-- +2.43.0 + diff --git a/queue-6.6/i2c-create-debugfs-entry-per-adapter.patch b/queue-6.6/i2c-create-debugfs-entry-per-adapter.patch new file mode 100644 index 00000000000..1c7cb5a639d --- /dev/null +++ b/queue-6.6/i2c-create-debugfs-entry-per-adapter.patch @@ -0,0 +1,102 @@ +From 9aa01d4ec68b0fb752f0491873c5f1b941566b92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Nov 2023 17:54:41 -0500 +Subject: i2c: create debugfs entry per adapter + +From: Wolfram Sang + +[ Upstream commit 73febd775bdbdb98c81255ff85773ac410ded5c4 ] + +Two drivers already implement custom debugfs handling for their +i2c_adapter and more will come. So, let the core create a debugfs +directory per adapter and pass that to drivers for their debugfs files. + +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Stable-dep-of: 8d3cefaf6592 ("i2c: core: Lock address during client device instantiation") +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-base.c | 11 +++++++++++ + include/linux/i2c.h | 2 ++ + 2 files changed, 13 insertions(+) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 1e873ff0a624d..9d918a7dfddae 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -67,6 +68,8 @@ static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver); + static DEFINE_STATIC_KEY_FALSE(i2c_trace_msg_key); + static bool is_registered; + ++static struct dentry *i2c_debugfs_root; ++ + int i2c_transfer_trace_reg(void) + { + static_branch_inc(&i2c_trace_msg_key); +@@ -1523,6 +1526,8 @@ static int i2c_register_adapter(struct i2c_adapter *adap) + goto out_list; + } + ++ adap->debugfs = debugfs_create_dir(dev_name(&adap->dev), i2c_debugfs_root); ++ + res = i2c_setup_smbus_alert(adap); + if (res) + goto out_reg; +@@ -1562,6 +1567,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap) + return 0; + + out_reg: ++ debugfs_remove_recursive(adap->debugfs); + init_completion(&adap->dev_released); + device_unregister(&adap->dev); + wait_for_completion(&adap->dev_released); +@@ -1763,6 +1769,8 @@ void i2c_del_adapter(struct i2c_adapter *adap) + + i2c_host_notify_irq_teardown(adap); + ++ debugfs_remove_recursive(adap->debugfs); ++ + /* wait until all references to the device are gone + * + * FIXME: This is old code and should ideally be replaced by an +@@ -2060,6 +2068,8 @@ static int __init i2c_init(void) + + is_registered = true; + ++ i2c_debugfs_root = debugfs_create_dir("i2c", NULL); ++ + #ifdef CONFIG_I2C_COMPAT + i2c_adapter_compat_class = class_compat_register("i2c-adapter"); + if (!i2c_adapter_compat_class) { +@@ -2098,6 +2108,7 @@ static void __exit i2c_exit(void) + #ifdef CONFIG_I2C_COMPAT + class_compat_unregister(i2c_adapter_compat_class); + #endif ++ debugfs_remove_recursive(i2c_debugfs_root); + bus_unregister(&i2c_bus_type); + tracepoint_synchronize_unregister(); + } +diff --git a/include/linux/i2c.h b/include/linux/i2c.h +index 32cf5708d5a5b..033de64d09bba 100644 +--- a/include/linux/i2c.h ++++ b/include/linux/i2c.h +@@ -746,6 +746,8 @@ struct i2c_adapter { + + struct irq_domain *host_notify_domain; + struct regulator *bus_regulator; ++ ++ struct dentry *debugfs; + }; + #define to_i2c_adapter(d) container_of(d, struct i2c_adapter, dev) + +-- +2.43.0 + diff --git a/queue-6.6/i2c-synquacer-deal-with-optional-pclk-correctly.patch b/queue-6.6/i2c-synquacer-deal-with-optional-pclk-correctly.patch new file mode 100644 index 00000000000..aa41e19554c --- /dev/null +++ b/queue-6.6/i2c-synquacer-deal-with-optional-pclk-correctly.patch @@ -0,0 +1,47 @@ +From 57c15c027cad8dd14a8916fa165abb4341459f82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2024 12:46:31 +0200 +Subject: i2c: synquacer: Deal with optional PCLK correctly + +From: Ard Biesheuvel + +[ Upstream commit f2990f8630531a99cad4dc5c44cb2a11ded42492 ] + +ACPI boot does not provide clocks and regulators, but instead, provides +the PCLK rate directly, and enables the clock in firmware. So deal +gracefully with this. + +Fixes: 55750148e559 ("i2c: synquacer: Fix an error handling path in synquacer_i2c_probe()") +Cc: stable@vger.kernel.org # v6.10+ +Cc: Andi Shyti +Cc: Christophe JAILLET +Signed-off-by: Ard Biesheuvel +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-synquacer.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c +index e774b9f499b63..9bb69a8ab6582 100644 +--- a/drivers/i2c/busses/i2c-synquacer.c ++++ b/drivers/i2c/busses/i2c-synquacer.c +@@ -550,12 +550,13 @@ static int synquacer_i2c_probe(struct platform_device *pdev) + device_property_read_u32(&pdev->dev, "socionext,pclk-rate", + &i2c->pclkrate); + +- pclk = devm_clk_get_enabled(&pdev->dev, "pclk"); ++ pclk = devm_clk_get_optional_enabled(&pdev->dev, "pclk"); + if (IS_ERR(pclk)) + return dev_err_probe(&pdev->dev, PTR_ERR(pclk), + "failed to get and enable clock\n"); + +- i2c->pclkrate = clk_get_rate(pclk); ++ if (pclk) ++ i2c->pclkrate = clk_get_rate(pclk); + + if (i2c->pclkrate < SYNQUACER_I2C_MIN_CLK_RATE || + i2c->pclkrate > SYNQUACER_I2C_MAX_CLK_RATE) +-- +2.43.0 + diff --git a/queue-6.6/i2c-synquacer-remove-a-clk-reference-from-struct-syn.patch b/queue-6.6/i2c-synquacer-remove-a-clk-reference-from-struct-syn.patch new file mode 100644 index 00000000000..2714722b0d4 --- /dev/null +++ b/queue-6.6/i2c-synquacer-remove-a-clk-reference-from-struct-syn.patch @@ -0,0 +1,64 @@ +From fc6f41807cd7c6bc8cc6889e28b4f5a3afefb43d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jan 2024 13:48:25 +0100 +Subject: i2c: synquacer: Remove a clk reference from struct synquacer_i2c + +From: Christophe JAILLET + +[ Upstream commit e6722ea6b9ed731f7392277d76ca912dfffca7ee ] + +'pclk' is only used locally in the probe. Remove it from the +'synquacer_i2c' structure. + +Also remove a useless debug message. + +Signed-off-by: Christophe JAILLET +Acked-by: Ard Biesheuvel +Signed-off-by: Andi Shyti +Stable-dep-of: f2990f863053 ("i2c: synquacer: Deal with optional PCLK correctly") +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-synquacer.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c +index a73f5bb9a1645..e774b9f499b63 100644 +--- a/drivers/i2c/busses/i2c-synquacer.c ++++ b/drivers/i2c/busses/i2c-synquacer.c +@@ -138,7 +138,6 @@ struct synquacer_i2c { + int irq; + struct device *dev; + void __iomem *base; +- struct clk *pclk; + u32 pclkrate; + u32 speed_khz; + u32 timeout_ms; +@@ -535,6 +534,7 @@ static const struct i2c_adapter synquacer_i2c_ops = { + static int synquacer_i2c_probe(struct platform_device *pdev) + { + struct synquacer_i2c *i2c; ++ struct clk *pclk; + u32 bus_speed; + int ret; + +@@ -550,13 +550,12 @@ static int synquacer_i2c_probe(struct platform_device *pdev) + device_property_read_u32(&pdev->dev, "socionext,pclk-rate", + &i2c->pclkrate); + +- i2c->pclk = devm_clk_get_enabled(&pdev->dev, "pclk"); +- if (IS_ERR(i2c->pclk)) +- return dev_err_probe(&pdev->dev, PTR_ERR(i2c->pclk), ++ pclk = devm_clk_get_enabled(&pdev->dev, "pclk"); ++ if (IS_ERR(pclk)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(pclk), + "failed to get and enable clock\n"); + +- dev_dbg(&pdev->dev, "clock source %p\n", i2c->pclk); +- i2c->pclkrate = clk_get_rate(i2c->pclk); ++ i2c->pclkrate = clk_get_rate(pclk); + + if (i2c->pclkrate < SYNQUACER_I2C_MIN_CLK_RATE || + i2c->pclkrate > SYNQUACER_I2C_MAX_CLK_RATE) +-- +2.43.0 + diff --git a/queue-6.6/iio-pressure-bmp280-allow-multiple-chips-id-per-fami.patch b/queue-6.6/iio-pressure-bmp280-allow-multiple-chips-id-per-fami.patch new file mode 100644 index 00000000000..1ccbde0f7ca --- /dev/null +++ b/queue-6.6/iio-pressure-bmp280-allow-multiple-chips-id-per-fami.patch @@ -0,0 +1,145 @@ +From 399b83593538517e48cdd1e53b8ca0924cca50ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Oct 2023 19:22:20 +0200 +Subject: iio: pressure: bmp280: Allow multiple chips id per family of devices + +From: Angel Iglesias + +[ Upstream commit 33564435c8084ff29837c9ed9bb9574ec957751d ] + +Improve device detection in certain chip families known to have +various chip IDs. When no ID matches, give a warning but follow +along what device said on the firmware side and try to configure +it. + +Signed-off-by: Angel Iglesias +Link: https://lore.kernel.org/r/eade22d11e9de4405ea19fdaa5a8249143ae94df.1697994521.git.ang.iglesiasg@gmail.com +Signed-off-by: Jonathan Cameron +Stable-dep-of: b9065b0250e1 ("iio: pressure: bmp280: Fix regmap for BMP280 device") +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/bmp280-core.c | 35 ++++++++++++++++++++++-------- + drivers/iio/pressure/bmp280.h | 3 ++- + 2 files changed, 28 insertions(+), 10 deletions(-) + +diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c +index a65630d5742f0..ac72b175ffcc1 100644 +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -794,10 +794,12 @@ static int bmp280_chip_config(struct bmp280_data *data) + } + + static const int bmp280_oversampling_avail[] = { 1, 2, 4, 8, 16 }; ++static const u8 bmp280_chip_ids[] = { BMP280_CHIP_ID }; + + const struct bmp280_chip_info bmp280_chip_info = { + .id_reg = BMP280_REG_ID, +- .chip_id = BMP280_CHIP_ID, ++ .chip_id = bmp280_chip_ids, ++ .num_chip_id = ARRAY_SIZE(bmp280_chip_ids), + .regmap_config = &bmp280_regmap_config, + .start_up_time = 2000, + .channels = bmp280_channels, +@@ -846,9 +848,12 @@ static int bme280_chip_config(struct bmp280_data *data) + return bmp280_chip_config(data); + } + ++static const u8 bme280_chip_ids[] = { BME280_CHIP_ID }; ++ + const struct bmp280_chip_info bme280_chip_info = { + .id_reg = BMP280_REG_ID, +- .chip_id = BME280_CHIP_ID, ++ .chip_id = bme280_chip_ids, ++ .num_chip_id = ARRAY_SIZE(bme280_chip_ids), + .regmap_config = &bmp280_regmap_config, + .start_up_time = 2000, + .channels = bmp280_channels, +@@ -1220,10 +1225,12 @@ static int bmp380_chip_config(struct bmp280_data *data) + + static const int bmp380_oversampling_avail[] = { 1, 2, 4, 8, 16, 32 }; + static const int bmp380_iir_filter_coeffs_avail[] = { 1, 2, 4, 8, 16, 32, 64, 128}; ++static const u8 bmp380_chip_ids[] = { BMP380_CHIP_ID }; + + const struct bmp280_chip_info bmp380_chip_info = { + .id_reg = BMP380_REG_ID, +- .chip_id = BMP380_CHIP_ID, ++ .chip_id = bmp380_chip_ids, ++ .num_chip_id = ARRAY_SIZE(bmp380_chip_ids), + .regmap_config = &bmp380_regmap_config, + .start_up_time = 2000, + .channels = bmp380_channels, +@@ -1720,10 +1727,12 @@ static int bmp580_chip_config(struct bmp280_data *data) + } + + static const int bmp580_oversampling_avail[] = { 1, 2, 4, 8, 16, 32, 64, 128 }; ++static const u8 bmp580_chip_ids[] = { BMP580_CHIP_ID, BMP580_CHIP_ID_ALT }; + + const struct bmp280_chip_info bmp580_chip_info = { + .id_reg = BMP580_REG_CHIP_ID, +- .chip_id = BMP580_CHIP_ID, ++ .chip_id = bmp580_chip_ids, ++ .num_chip_id = ARRAY_SIZE(bmp580_chip_ids), + .regmap_config = &bmp580_regmap_config, + .start_up_time = 2000, + .channels = bmp380_channels, +@@ -1983,10 +1992,12 @@ static int bmp180_chip_config(struct bmp280_data *data) + + static const int bmp180_oversampling_temp_avail[] = { 1 }; + static const int bmp180_oversampling_press_avail[] = { 1, 2, 4, 8 }; ++static const u8 bmp180_chip_ids[] = { BMP180_CHIP_ID }; + + const struct bmp280_chip_info bmp180_chip_info = { + .id_reg = BMP280_REG_ID, +- .chip_id = BMP180_CHIP_ID, ++ .chip_id = bmp180_chip_ids, ++ .num_chip_id = ARRAY_SIZE(bmp180_chip_ids), + .regmap_config = &bmp180_regmap_config, + .start_up_time = 2000, + .channels = bmp280_channels, +@@ -2077,6 +2088,7 @@ int bmp280_common_probe(struct device *dev, + struct bmp280_data *data; + struct gpio_desc *gpiod; + unsigned int chip_id; ++ unsigned int i; + int ret; + + indio_dev = devm_iio_device_alloc(dev, sizeof(*data)); +@@ -2142,12 +2154,17 @@ int bmp280_common_probe(struct device *dev, + ret = regmap_read(regmap, data->chip_info->id_reg, &chip_id); + if (ret < 0) + return ret; +- if (chip_id != data->chip_info->chip_id) { +- dev_err(dev, "bad chip id: expected %x got %x\n", +- data->chip_info->chip_id, chip_id); +- return -EINVAL; ++ ++ for (i = 0; i < data->chip_info->num_chip_id; i++) { ++ if (chip_id == data->chip_info->chip_id[i]) { ++ dev_info(dev, "0x%x is a known chip id for %s\n", chip_id, name); ++ break; ++ } + } + ++ if (i == data->chip_info->num_chip_id) ++ dev_warn(dev, "bad chip id: 0x%x is not a known chip id\n", chip_id); ++ + if (data->chip_info->preinit) { + ret = data->chip_info->preinit(data); + if (ret) +diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h +index 9d9f4ce2baa6e..a44ea33221635 100644 +--- a/drivers/iio/pressure/bmp280.h ++++ b/drivers/iio/pressure/bmp280.h +@@ -418,7 +418,8 @@ struct bmp280_data { + + struct bmp280_chip_info { + unsigned int id_reg; +- const unsigned int chip_id; ++ const u8 *chip_id; ++ int num_chip_id; + + const struct regmap_config *regmap_config; + +-- +2.43.0 + diff --git a/queue-6.6/iio-pressure-bmp280-fix-regmap-for-bmp280-device.patch b/queue-6.6/iio-pressure-bmp280-fix-regmap-for-bmp280-device.patch new file mode 100644 index 00000000000..a40cb16b16b --- /dev/null +++ b/queue-6.6/iio-pressure-bmp280-fix-regmap-for-bmp280-device.patch @@ -0,0 +1,137 @@ +From 66c0d6e31094c10458bed2eee0926c8682e61f60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 23:15:49 +0200 +Subject: iio: pressure: bmp280: Fix regmap for BMP280 device + +From: Vasileios Amoiridis + +[ Upstream commit b9065b0250e1705935445ede0a18c1850afe7b75 ] + +Up to now, the BMP280 device is using the regmap of the BME280 which +has registers that exist only in the BME280 device. + +Fixes: 14e8015f8569 ("iio: pressure: bmp280: split driver in logical parts") +Signed-off-by: Vasileios Amoiridis +Link: https://patch.msgid.link/20240711211558.106327-2-vassilisamir@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/bmp280-core.c | 2 +- + drivers/iio/pressure/bmp280-regmap.c | 45 ++++++++++++++++++++++++++-- + drivers/iio/pressure/bmp280.h | 1 + + 3 files changed, 44 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c +index 8f70fd72f132a..3ba718b11c464 100644 +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -852,7 +852,7 @@ const struct bmp280_chip_info bme280_chip_info = { + .id_reg = BMP280_REG_ID, + .chip_id = bme280_chip_ids, + .num_chip_id = ARRAY_SIZE(bme280_chip_ids), +- .regmap_config = &bmp280_regmap_config, ++ .regmap_config = &bme280_regmap_config, + .start_up_time = 2000, + .channels = bmp280_channels, + .num_channels = 3, +diff --git a/drivers/iio/pressure/bmp280-regmap.c b/drivers/iio/pressure/bmp280-regmap.c +index fa52839474b18..d27d68edd9065 100644 +--- a/drivers/iio/pressure/bmp280-regmap.c ++++ b/drivers/iio/pressure/bmp280-regmap.c +@@ -41,7 +41,7 @@ const struct regmap_config bmp180_regmap_config = { + }; + EXPORT_SYMBOL_NS(bmp180_regmap_config, IIO_BMP280); + +-static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) ++static bool bme280_is_writeable_reg(struct device *dev, unsigned int reg) + { + switch (reg) { + case BMP280_REG_CONFIG: +@@ -54,7 +54,35 @@ static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) + } + } + ++static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) ++{ ++ switch (reg) { ++ case BMP280_REG_CONFIG: ++ case BMP280_REG_CTRL_MEAS: ++ case BMP280_REG_RESET: ++ return true; ++ default: ++ return false; ++ } ++} ++ + static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg) ++{ ++ switch (reg) { ++ case BMP280_REG_TEMP_XLSB: ++ case BMP280_REG_TEMP_LSB: ++ case BMP280_REG_TEMP_MSB: ++ case BMP280_REG_PRESS_XLSB: ++ case BMP280_REG_PRESS_LSB: ++ case BMP280_REG_PRESS_MSB: ++ case BMP280_REG_STATUS: ++ return true; ++ default: ++ return false; ++ } ++} ++ ++static bool bme280_is_volatile_reg(struct device *dev, unsigned int reg) + { + switch (reg) { + case BME280_REG_HUMIDITY_LSB: +@@ -71,7 +99,6 @@ static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg) + return false; + } + } +- + static bool bmp380_is_writeable_reg(struct device *dev, unsigned int reg) + { + switch (reg) { +@@ -167,7 +194,7 @@ const struct regmap_config bmp280_regmap_config = { + .reg_bits = 8, + .val_bits = 8, + +- .max_register = BME280_REG_HUMIDITY_LSB, ++ .max_register = BMP280_REG_TEMP_XLSB, + .cache_type = REGCACHE_RBTREE, + + .writeable_reg = bmp280_is_writeable_reg, +@@ -175,6 +202,18 @@ const struct regmap_config bmp280_regmap_config = { + }; + EXPORT_SYMBOL_NS(bmp280_regmap_config, IIO_BMP280); + ++const struct regmap_config bme280_regmap_config = { ++ .reg_bits = 8, ++ .val_bits = 8, ++ ++ .max_register = BME280_REG_HUMIDITY_LSB, ++ .cache_type = REGCACHE_RBTREE, ++ ++ .writeable_reg = bme280_is_writeable_reg, ++ .volatile_reg = bme280_is_volatile_reg, ++}; ++EXPORT_SYMBOL_NS(bme280_regmap_config, IIO_BMP280); ++ + const struct regmap_config bmp380_regmap_config = { + .reg_bits = 8, + .val_bits = 8, +diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h +index 1a6903a917add..b60e551b7d318 100644 +--- a/drivers/iio/pressure/bmp280.h ++++ b/drivers/iio/pressure/bmp280.h +@@ -468,6 +468,7 @@ extern const struct bmp280_chip_info bmp580_chip_info; + /* Regmap configurations */ + extern const struct regmap_config bmp180_regmap_config; + extern const struct regmap_config bmp280_regmap_config; ++extern const struct regmap_config bme280_regmap_config; + extern const struct regmap_config bmp380_regmap_config; + extern const struct regmap_config bmp580_regmap_config; + +-- +2.43.0 + diff --git a/queue-6.6/iio-pressure-bmp280-fix-waiting-time-for-bmp3xx-conf.patch b/queue-6.6/iio-pressure-bmp280-fix-waiting-time-for-bmp3xx-conf.patch new file mode 100644 index 00000000000..c264d9045e5 --- /dev/null +++ b/queue-6.6/iio-pressure-bmp280-fix-waiting-time-for-bmp3xx-conf.patch @@ -0,0 +1,47 @@ +From 29b97d5e12a4580ac3af54f98065bc4a03b40b13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 23:15:50 +0200 +Subject: iio: pressure: bmp280: Fix waiting time for BMP3xx configuration + +From: Vasileios Amoiridis + +[ Upstream commit 262a6634bcc4f0c1c53d13aa89882909f281a6aa ] + +According to the datasheet, both pressure and temperature can go up to +oversampling x32. With this option, the maximum measurement time is not +80ms (this is for press x32 and temp x2), but it is 130ms nominal +(calculated from table 3.9.2) and since most of the maximum values +are around +15%, it is configured to 150ms. + +Fixes: 8d329309184d ("iio: pressure: bmp280: Add support for BMP380 sensor family") +Signed-off-by: Vasileios Amoiridis +Link: https://patch.msgid.link/20240711211558.106327-3-vassilisamir@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/bmp280-core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c +index 3ba718b11c464..84f6b333c9195 100644 +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -1203,10 +1203,11 @@ static int bmp380_chip_config(struct bmp280_data *data) + } + /* + * Waits for measurement before checking configuration error +- * flag. Selected longest measure time indicated in +- * section 3.9.1 in the datasheet. ++ * flag. Selected longest measurement time, calculated from ++ * formula in datasheet section 3.9.2 with an offset of ~+15% ++ * as it seen as well in table 3.9.1. + */ +- msleep(80); ++ msleep(150); + + /* Check config error flag */ + ret = regmap_read(data->regmap, BMP380_REG_ERROR, &tmp); +-- +2.43.0 + diff --git a/queue-6.6/iio-pressure-bmp280-improve-indentation-and-line-wra.patch b/queue-6.6/iio-pressure-bmp280-improve-indentation-and-line-wra.patch new file mode 100644 index 00000000000..1a0f4fb7022 --- /dev/null +++ b/queue-6.6/iio-pressure-bmp280-improve-indentation-and-line-wra.patch @@ -0,0 +1,368 @@ +From 042ba03dc0ccd66bc07b06eef215ebf984319d8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 21:00:37 +0200 +Subject: iio: pressure: bmp280: Improve indentation and line wrapping + +From: Vasileios Amoiridis + +[ Upstream commit 439ce8961bdd2e925c1f6adc82ce9fe3931e2c08 ] + +Fix indentations that are not following the standards, remove +extra white lines and add missing white lines. + +Signed-off-by: Vasileios Amoiridis +Link: https://lore.kernel.org/r/20240429190046.24252-2-vassilisamir@gmail.com +Signed-off-by: Jonathan Cameron +Stable-dep-of: b9065b0250e1 ("iio: pressure: bmp280: Fix regmap for BMP280 device") +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/bmp280-core.c | 108 ++++++++++++++++------------- + drivers/iio/pressure/bmp280-spi.c | 4 +- + 2 files changed, 61 insertions(+), 51 deletions(-) + +diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c +index ac72b175ffcc1..dac2a4e237929 100644 +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -51,7 +51,6 @@ + */ + enum { AC1, AC2, AC3, AC4, AC5, AC6, B1, B2, MB, MC, MD }; + +- + enum bmp380_odr { + BMP380_ODR_200HZ, + BMP380_ODR_100HZ, +@@ -180,18 +179,19 @@ static int bmp280_read_calib(struct bmp280_data *data) + struct bmp280_calib *calib = &data->calib.bmp280; + int ret; + +- + /* Read temperature and pressure calibration values. */ + ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_TEMP_START, +- data->bmp280_cal_buf, sizeof(data->bmp280_cal_buf)); ++ data->bmp280_cal_buf, ++ sizeof(data->bmp280_cal_buf)); + if (ret < 0) { + dev_err(data->dev, +- "failed to read temperature and pressure calibration parameters\n"); ++ "failed to read calibration parameters\n"); + return ret; + } + +- /* Toss the temperature and pressure calibration data into the entropy pool */ +- add_device_randomness(data->bmp280_cal_buf, sizeof(data->bmp280_cal_buf)); ++ /* Toss calibration data into the entropy pool */ ++ add_device_randomness(data->bmp280_cal_buf, ++ sizeof(data->bmp280_cal_buf)); + + /* Parse temperature calibration values. */ + calib->T1 = le16_to_cpu(data->bmp280_cal_buf[T1]); +@@ -222,7 +222,7 @@ static int bme280_read_calib(struct bmp280_data *data) + /* Load shared calibration params with bmp280 first */ + ret = bmp280_read_calib(data); + if (ret < 0) { +- dev_err(dev, "failed to read common bmp280 calibration parameters\n"); ++ dev_err(dev, "failed to read calibration parameters\n"); + return ret; + } + +@@ -282,6 +282,7 @@ static int bme280_read_calib(struct bmp280_data *data) + + return 0; + } ++ + /* + * Returns humidity in percent, resolution is 0.01 percent. Output value of + * "47445" represents 47445/1024 = 46.333 %RH. +@@ -304,7 +305,7 @@ static u32 bmp280_compensate_humidity(struct bmp280_data *data, + var = clamp_val(var, 0, 419430400); + + return var >> 12; +-}; ++} + + /* + * Returns temperature in DegC, resolution is 0.01 DegC. Output value of +@@ -537,7 +538,7 @@ static int bmp280_read_raw(struct iio_dev *indio_dev, + } + + static int bmp280_write_oversampling_ratio_humid(struct bmp280_data *data, +- int val) ++ int val) + { + const int *avail = data->chip_info->oversampling_humid_avail; + const int n = data->chip_info->num_oversampling_humid_avail; +@@ -562,7 +563,7 @@ static int bmp280_write_oversampling_ratio_humid(struct bmp280_data *data, + } + + static int bmp280_write_oversampling_ratio_temp(struct bmp280_data *data, +- int val) ++ int val) + { + const int *avail = data->chip_info->oversampling_temp_avail; + const int n = data->chip_info->num_oversampling_temp_avail; +@@ -587,7 +588,7 @@ static int bmp280_write_oversampling_ratio_temp(struct bmp280_data *data, + } + + static int bmp280_write_oversampling_ratio_press(struct bmp280_data *data, +- int val) ++ int val) + { + const int *avail = data->chip_info->oversampling_press_avail; + const int n = data->chip_info->num_oversampling_press_avail; +@@ -771,13 +772,12 @@ static int bmp280_chip_config(struct bmp280_data *data) + int ret; + + ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS, +- BMP280_OSRS_TEMP_MASK | +- BMP280_OSRS_PRESS_MASK | +- BMP280_MODE_MASK, +- osrs | BMP280_MODE_NORMAL); ++ BMP280_OSRS_TEMP_MASK | ++ BMP280_OSRS_PRESS_MASK | ++ BMP280_MODE_MASK, ++ osrs | BMP280_MODE_NORMAL); + if (ret < 0) { +- dev_err(data->dev, +- "failed to write ctrl_meas register\n"); ++ dev_err(data->dev, "failed to write ctrl_meas register\n"); + return ret; + } + +@@ -785,8 +785,7 @@ static int bmp280_chip_config(struct bmp280_data *data) + BMP280_FILTER_MASK, + BMP280_FILTER_4X); + if (ret < 0) { +- dev_err(data->dev, +- "failed to write config register\n"); ++ dev_err(data->dev, "failed to write config register\n"); + return ret; + } + +@@ -925,8 +924,8 @@ static int bmp380_cmd(struct bmp280_data *data, u8 cmd) + } + + /* +- * Returns temperature in Celsius degrees, resolution is 0.01º C. Output value of +- * "5123" equals 51.2º C. t_fine carries fine temperature as global value. ++ * Returns temperature in Celsius degrees, resolution is 0.01º C. Output value ++ * of "5123" equals 51.2º C. t_fine carries fine temperature as global value. + * + * Taken from datasheet, Section Appendix 9, "Compensation formula" and repo + * https://github.com/BoschSensortec/BMP3-Sensor-API. +@@ -1068,7 +1067,8 @@ static int bmp380_read_calib(struct bmp280_data *data) + + /* Read temperature and pressure calibration data */ + ret = regmap_bulk_read(data->regmap, BMP380_REG_CALIB_TEMP_START, +- data->bmp380_cal_buf, sizeof(data->bmp380_cal_buf)); ++ data->bmp380_cal_buf, ++ sizeof(data->bmp380_cal_buf)); + if (ret) { + dev_err(data->dev, + "failed to read temperature calibration parameters\n"); +@@ -1076,7 +1076,8 @@ static int bmp380_read_calib(struct bmp280_data *data) + } + + /* Toss the temperature calibration data into the entropy pool */ +- add_device_randomness(data->bmp380_cal_buf, sizeof(data->bmp380_cal_buf)); ++ add_device_randomness(data->bmp380_cal_buf, ++ sizeof(data->bmp380_cal_buf)); + + /* Parse calibration values */ + calib->T1 = get_unaligned_le16(&data->bmp380_cal_buf[BMP380_T1]); +@@ -1158,7 +1159,8 @@ static int bmp380_chip_config(struct bmp280_data *data) + + /* Configure output data rate */ + ret = regmap_update_bits_check(data->regmap, BMP380_REG_ODR, +- BMP380_ODRS_MASK, data->sampling_freq, &aux); ++ BMP380_ODRS_MASK, data->sampling_freq, ++ &aux); + if (ret) { + dev_err(data->dev, "failed to write ODR selection register\n"); + return ret; +@@ -1177,12 +1179,13 @@ static int bmp380_chip_config(struct bmp280_data *data) + + if (change) { + /* +- * The configurations errors are detected on the fly during a measurement +- * cycle. If the sampling frequency is too low, it's faster to reset +- * the measurement loop than wait until the next measurement is due. ++ * The configurations errors are detected on the fly during a ++ * measurement cycle. If the sampling frequency is too low, it's ++ * faster to reset the measurement loop than wait until the next ++ * measurement is due. + * +- * Resets sensor measurement loop toggling between sleep and normal +- * operating modes. ++ * Resets sensor measurement loop toggling between sleep and ++ * normal operating modes. + */ + ret = regmap_write_bits(data->regmap, BMP380_REG_POWER_CONTROL, + BMP380_MODE_MASK, +@@ -1200,22 +1203,21 @@ static int bmp380_chip_config(struct bmp280_data *data) + return ret; + } + /* +- * Waits for measurement before checking configuration error flag. +- * Selected longest measure time indicated in section 3.9.1 +- * in the datasheet. ++ * Waits for measurement before checking configuration error ++ * flag. Selected longest measure time indicated in ++ * section 3.9.1 in the datasheet. + */ + msleep(80); + + /* Check config error flag */ + ret = regmap_read(data->regmap, BMP380_REG_ERROR, &tmp); + if (ret) { +- dev_err(data->dev, +- "failed to read error register\n"); ++ dev_err(data->dev, "failed to read error register\n"); + return ret; + } + if (tmp & BMP380_ERR_CONF_MASK) { + dev_warn(data->dev, +- "sensor flagged configuration as incompatible\n"); ++ "sensor flagged configuration as incompatible\n"); + return -EINVAL; + } + } +@@ -1315,9 +1317,11 @@ static int bmp580_nvm_operation(struct bmp280_data *data, bool is_write) + } + + /* Start NVM operation sequence */ +- ret = regmap_write(data->regmap, BMP580_REG_CMD, BMP580_CMD_NVM_OP_SEQ_0); ++ ret = regmap_write(data->regmap, BMP580_REG_CMD, ++ BMP580_CMD_NVM_OP_SEQ_0); + if (ret) { +- dev_err(data->dev, "failed to send nvm operation's first sequence\n"); ++ dev_err(data->dev, ++ "failed to send nvm operation's first sequence\n"); + return ret; + } + if (is_write) { +@@ -1325,7 +1329,8 @@ static int bmp580_nvm_operation(struct bmp280_data *data, bool is_write) + ret = regmap_write(data->regmap, BMP580_REG_CMD, + BMP580_CMD_NVM_WRITE_SEQ_1); + if (ret) { +- dev_err(data->dev, "failed to send nvm write sequence\n"); ++ dev_err(data->dev, ++ "failed to send nvm write sequence\n"); + return ret; + } + /* Datasheet says on 4.8.1.2 it takes approximately 10ms */ +@@ -1336,7 +1341,8 @@ static int bmp580_nvm_operation(struct bmp280_data *data, bool is_write) + ret = regmap_write(data->regmap, BMP580_REG_CMD, + BMP580_CMD_NVM_READ_SEQ_1); + if (ret) { +- dev_err(data->dev, "failed to send nvm read sequence\n"); ++ dev_err(data->dev, ++ "failed to send nvm read sequence\n"); + return ret; + } + /* Datasheet says on 4.8.1.1 it takes approximately 200us */ +@@ -1499,8 +1505,8 @@ static int bmp580_nvmem_read(void *priv, unsigned int offset, void *val, + if (ret) + goto exit; + +- ret = regmap_bulk_read(data->regmap, BMP580_REG_NVM_DATA_LSB, &data->le16, +- sizeof(data->le16)); ++ ret = regmap_bulk_read(data->regmap, BMP580_REG_NVM_DATA_LSB, ++ &data->le16, sizeof(data->le16)); + if (ret) { + dev_err(data->dev, "error reading nvm data regs\n"); + goto exit; +@@ -1544,7 +1550,8 @@ static int bmp580_nvmem_write(void *priv, unsigned int offset, void *val, + while (bytes >= sizeof(*buf)) { + addr = bmp580_nvmem_addrs[offset / sizeof(*buf)]; + +- ret = regmap_write(data->regmap, BMP580_REG_NVM_ADDR, BMP580_NVM_PROG_EN | ++ ret = regmap_write(data->regmap, BMP580_REG_NVM_ADDR, ++ BMP580_NVM_PROG_EN | + FIELD_PREP(BMP580_NVM_ROW_ADDR_MASK, addr)); + if (ret) { + dev_err(data->dev, "error writing nvm address\n"); +@@ -1552,8 +1559,8 @@ static int bmp580_nvmem_write(void *priv, unsigned int offset, void *val, + } + data->le16 = cpu_to_le16(*buf++); + +- ret = regmap_bulk_write(data->regmap, BMP580_REG_NVM_DATA_LSB, &data->le16, +- sizeof(data->le16)); ++ ret = regmap_bulk_write(data->regmap, BMP580_REG_NVM_DATA_LSB, ++ &data->le16, sizeof(data->le16)); + if (ret) { + dev_err(data->dev, "error writing LSB NVM data regs\n"); + goto exit; +@@ -1660,7 +1667,8 @@ static int bmp580_chip_config(struct bmp280_data *data) + BMP580_OSR_PRESS_EN; + + ret = regmap_update_bits_check(data->regmap, BMP580_REG_OSR_CONFIG, +- BMP580_OSR_TEMP_MASK | BMP580_OSR_PRESS_MASK | ++ BMP580_OSR_TEMP_MASK | ++ BMP580_OSR_PRESS_MASK | + BMP580_OSR_PRESS_EN, + reg_val, &aux); + if (ret) { +@@ -1711,7 +1719,8 @@ static int bmp580_chip_config(struct bmp280_data *data) + */ + ret = regmap_read(data->regmap, BMP580_REG_EFF_OSR, &tmp); + if (ret) { +- dev_err(data->dev, "error reading effective OSR register\n"); ++ dev_err(data->dev, ++ "error reading effective OSR register\n"); + return ret; + } + if (!(tmp & BMP580_EFF_OSR_VALID_ODR)) { +@@ -1846,7 +1855,8 @@ static int bmp180_read_calib(struct bmp280_data *data) + } + + /* Toss the calibration data into the entropy pool */ +- add_device_randomness(data->bmp180_cal_buf, sizeof(data->bmp180_cal_buf)); ++ add_device_randomness(data->bmp180_cal_buf, ++ sizeof(data->bmp180_cal_buf)); + + calib->AC1 = be16_to_cpu(data->bmp180_cal_buf[AC1]); + calib->AC2 = be16_to_cpu(data->bmp180_cal_buf[AC2]); +@@ -1961,8 +1971,7 @@ static u32 bmp180_compensate_press(struct bmp280_data *data, s32 adc_press) + return p + ((x1 + x2 + 3791) >> 4); + } + +-static int bmp180_read_press(struct bmp280_data *data, +- int *val, int *val2) ++static int bmp180_read_press(struct bmp280_data *data, int *val, int *val2) + { + u32 comp_press; + s32 adc_press; +@@ -2239,6 +2248,7 @@ static int bmp280_runtime_resume(struct device *dev) + ret = regulator_bulk_enable(BMP280_NUM_SUPPLIES, data->supplies); + if (ret) + return ret; ++ + usleep_range(data->start_up_time, data->start_up_time + 100); + return data->chip_info->chip_config(data); + } +diff --git a/drivers/iio/pressure/bmp280-spi.c b/drivers/iio/pressure/bmp280-spi.c +index 9de923228a9f4..47122da8e716d 100644 +--- a/drivers/iio/pressure/bmp280-spi.c ++++ b/drivers/iio/pressure/bmp280-spi.c +@@ -12,7 +12,7 @@ + #include "bmp280.h" + + static int bmp280_regmap_spi_write(void *context, const void *data, +- size_t count) ++ size_t count) + { + struct device *dev = context; + struct spi_device *spi = to_spi_device(dev); +@@ -29,7 +29,7 @@ static int bmp280_regmap_spi_write(void *context, const void *data, + } + + static int bmp280_regmap_spi_read(void *context, const void *reg, +- size_t reg_size, void *val, size_t val_size) ++ size_t reg_size, void *val, size_t val_size) + { + struct device *dev = context; + struct spi_device *spi = to_spi_device(dev); +-- +2.43.0 + diff --git a/queue-6.6/iio-pressure-bmp280-use-bme-prefix-for-bme280-specif.patch b/queue-6.6/iio-pressure-bmp280-use-bme-prefix-for-bme280-specif.patch new file mode 100644 index 00000000000..b47068e1810 --- /dev/null +++ b/queue-6.6/iio-pressure-bmp280-use-bme-prefix-for-bme280-specif.patch @@ -0,0 +1,290 @@ +From b50e8262fc726c3792745b124299512510b77530 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 21:00:38 +0200 +Subject: iio: pressure: bmp280: Use BME prefix for BME280 specifics + +From: Vasileios Amoiridis + +[ Upstream commit b23be4cd99a6f1f46963b87952632268174e62c1 ] + +Change the rest of the defines and function names that are +used specifically by the BME280 humidity sensor to BME280 +as it is done for the rest of the BMP{0,1,3,5}80 sensors. + +Signed-off-by: Vasileios Amoiridis +Link: https://lore.kernel.org/r/20240429190046.24252-3-vassilisamir@gmail.com +Signed-off-by: Jonathan Cameron +Stable-dep-of: b9065b0250e1 ("iio: pressure: bmp280: Fix regmap for BMP280 device") +Signed-off-by: Sasha Levin +--- + drivers/iio/pressure/bmp280-core.c | 37 +++++++++++------------ + drivers/iio/pressure/bmp280-regmap.c | 8 ++--- + drivers/iio/pressure/bmp280.h | 45 +++++++++++++++------------- + 3 files changed, 46 insertions(+), 44 deletions(-) + +diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c +index dac2a4e237929..8f70fd72f132a 100644 +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -234,14 +234,14 @@ static int bme280_read_calib(struct bmp280_data *data) + * Humidity data is only available on BME280. + */ + +- ret = regmap_read(data->regmap, BMP280_REG_COMP_H1, &tmp); ++ ret = regmap_read(data->regmap, BME280_REG_COMP_H1, &tmp); + if (ret < 0) { + dev_err(dev, "failed to read H1 comp value\n"); + return ret; + } + calib->H1 = tmp; + +- ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_H2, ++ ret = regmap_bulk_read(data->regmap, BME280_REG_COMP_H2, + &data->le16, sizeof(data->le16)); + if (ret < 0) { + dev_err(dev, "failed to read H2 comp value\n"); +@@ -249,14 +249,14 @@ static int bme280_read_calib(struct bmp280_data *data) + } + calib->H2 = sign_extend32(le16_to_cpu(data->le16), 15); + +- ret = regmap_read(data->regmap, BMP280_REG_COMP_H3, &tmp); ++ ret = regmap_read(data->regmap, BME280_REG_COMP_H3, &tmp); + if (ret < 0) { + dev_err(dev, "failed to read H3 comp value\n"); + return ret; + } + calib->H3 = tmp; + +- ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_H4, ++ ret = regmap_bulk_read(data->regmap, BME280_REG_COMP_H4, + &data->be16, sizeof(data->be16)); + if (ret < 0) { + dev_err(dev, "failed to read H4 comp value\n"); +@@ -265,15 +265,15 @@ static int bme280_read_calib(struct bmp280_data *data) + calib->H4 = sign_extend32(((be16_to_cpu(data->be16) >> 4) & 0xff0) | + (be16_to_cpu(data->be16) & 0xf), 11); + +- ret = regmap_bulk_read(data->regmap, BMP280_REG_COMP_H5, ++ ret = regmap_bulk_read(data->regmap, BME280_REG_COMP_H5, + &data->le16, sizeof(data->le16)); + if (ret < 0) { + dev_err(dev, "failed to read H5 comp value\n"); + return ret; + } +- calib->H5 = sign_extend32(FIELD_GET(BMP280_COMP_H5_MASK, le16_to_cpu(data->le16)), 11); ++ calib->H5 = sign_extend32(FIELD_GET(BME280_COMP_H5_MASK, le16_to_cpu(data->le16)), 11); + +- ret = regmap_read(data->regmap, BMP280_REG_COMP_H6, &tmp); ++ ret = regmap_read(data->regmap, BME280_REG_COMP_H6, &tmp); + if (ret < 0) { + dev_err(dev, "failed to read H6 comp value\n"); + return ret; +@@ -289,7 +289,7 @@ static int bme280_read_calib(struct bmp280_data *data) + * + * Taken from BME280 datasheet, Section 4.2.3, "Compensation formula". + */ +-static u32 bmp280_compensate_humidity(struct bmp280_data *data, ++static u32 bme280_compensate_humidity(struct bmp280_data *data, + s32 adc_humidity) + { + struct bmp280_calib *calib = &data->calib.bmp280; +@@ -429,7 +429,7 @@ static int bmp280_read_press(struct bmp280_data *data, + return IIO_VAL_FRACTIONAL; + } + +-static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2) ++static int bme280_read_humid(struct bmp280_data *data, int *val, int *val2) + { + u32 comp_humidity; + s32 adc_humidity; +@@ -440,7 +440,7 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2) + if (ret < 0) + return ret; + +- ret = regmap_bulk_read(data->regmap, BMP280_REG_HUMIDITY_MSB, ++ ret = regmap_bulk_read(data->regmap, BME280_REG_HUMIDITY_MSB, + &data->be16, sizeof(data->be16)); + if (ret < 0) { + dev_err(data->dev, "failed to read humidity\n"); +@@ -453,7 +453,7 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2) + dev_err(data->dev, "reading humidity skipped\n"); + return -EIO; + } +- comp_humidity = bmp280_compensate_humidity(data, adc_humidity); ++ comp_humidity = bme280_compensate_humidity(data, adc_humidity); + + *val = comp_humidity * 1000 / 1024; + +@@ -537,7 +537,7 @@ static int bmp280_read_raw(struct iio_dev *indio_dev, + return ret; + } + +-static int bmp280_write_oversampling_ratio_humid(struct bmp280_data *data, ++static int bme280_write_oversampling_ratio_humid(struct bmp280_data *data, + int val) + { + const int *avail = data->chip_info->oversampling_humid_avail; +@@ -681,7 +681,7 @@ static int bmp280_write_raw(struct iio_dev *indio_dev, + mutex_lock(&data->lock); + switch (chan->type) { + case IIO_HUMIDITYRELATIVE: +- ret = bmp280_write_oversampling_ratio_humid(data, val); ++ ret = bme280_write_oversampling_ratio_humid(data, val); + break; + case IIO_PRESSURE: + ret = bmp280_write_oversampling_ratio_press(data, val); +@@ -831,16 +831,15 @@ EXPORT_SYMBOL_NS(bmp280_chip_info, IIO_BMP280); + + static int bme280_chip_config(struct bmp280_data *data) + { +- u8 osrs = FIELD_PREP(BMP280_OSRS_HUMIDITY_MASK, data->oversampling_humid + 1); ++ u8 osrs = FIELD_PREP(BME280_OSRS_HUMIDITY_MASK, data->oversampling_humid + 1); + int ret; + + /* + * Oversampling of humidity must be set before oversampling of + * temperature/pressure is set to become effective. + */ +- ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_HUMIDITY, +- BMP280_OSRS_HUMIDITY_MASK, osrs); +- ++ ret = regmap_update_bits(data->regmap, BME280_REG_CTRL_HUMIDITY, ++ BME280_OSRS_HUMIDITY_MASK, osrs); + if (ret < 0) + return ret; + +@@ -868,12 +867,12 @@ const struct bmp280_chip_info bme280_chip_info = { + + .oversampling_humid_avail = bmp280_oversampling_avail, + .num_oversampling_humid_avail = ARRAY_SIZE(bmp280_oversampling_avail), +- .oversampling_humid_default = BMP280_OSRS_HUMIDITY_16X - 1, ++ .oversampling_humid_default = BME280_OSRS_HUMIDITY_16X - 1, + + .chip_config = bme280_chip_config, + .read_temp = bmp280_read_temp, + .read_press = bmp280_read_press, +- .read_humid = bmp280_read_humid, ++ .read_humid = bme280_read_humid, + .read_calib = bme280_read_calib, + }; + EXPORT_SYMBOL_NS(bme280_chip_info, IIO_BMP280); +diff --git a/drivers/iio/pressure/bmp280-regmap.c b/drivers/iio/pressure/bmp280-regmap.c +index 3ee56720428c5..fa52839474b18 100644 +--- a/drivers/iio/pressure/bmp280-regmap.c ++++ b/drivers/iio/pressure/bmp280-regmap.c +@@ -45,7 +45,7 @@ static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) + { + switch (reg) { + case BMP280_REG_CONFIG: +- case BMP280_REG_CTRL_HUMIDITY: ++ case BME280_REG_CTRL_HUMIDITY: + case BMP280_REG_CTRL_MEAS: + case BMP280_REG_RESET: + return true; +@@ -57,8 +57,8 @@ static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) + static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg) + { + switch (reg) { +- case BMP280_REG_HUMIDITY_LSB: +- case BMP280_REG_HUMIDITY_MSB: ++ case BME280_REG_HUMIDITY_LSB: ++ case BME280_REG_HUMIDITY_MSB: + case BMP280_REG_TEMP_XLSB: + case BMP280_REG_TEMP_LSB: + case BMP280_REG_TEMP_MSB: +@@ -167,7 +167,7 @@ const struct regmap_config bmp280_regmap_config = { + .reg_bits = 8, + .val_bits = 8, + +- .max_register = BMP280_REG_HUMIDITY_LSB, ++ .max_register = BME280_REG_HUMIDITY_LSB, + .cache_type = REGCACHE_RBTREE, + + .writeable_reg = bmp280_is_writeable_reg, +diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h +index a44ea33221635..1a6903a917add 100644 +--- a/drivers/iio/pressure/bmp280.h ++++ b/drivers/iio/pressure/bmp280.h +@@ -192,8 +192,6 @@ + #define BMP380_PRESS_SKIPPED 0x800000 + + /* BMP280 specific registers */ +-#define BMP280_REG_HUMIDITY_LSB 0xFE +-#define BMP280_REG_HUMIDITY_MSB 0xFD + #define BMP280_REG_TEMP_XLSB 0xFC + #define BMP280_REG_TEMP_LSB 0xFB + #define BMP280_REG_TEMP_MSB 0xFA +@@ -207,15 +205,6 @@ + #define BMP280_REG_CONFIG 0xF5 + #define BMP280_REG_CTRL_MEAS 0xF4 + #define BMP280_REG_STATUS 0xF3 +-#define BMP280_REG_CTRL_HUMIDITY 0xF2 +- +-/* Due to non linear mapping, and data sizes we can't do a bulk read */ +-#define BMP280_REG_COMP_H1 0xA1 +-#define BMP280_REG_COMP_H2 0xE1 +-#define BMP280_REG_COMP_H3 0xE3 +-#define BMP280_REG_COMP_H4 0xE4 +-#define BMP280_REG_COMP_H5 0xE5 +-#define BMP280_REG_COMP_H6 0xE7 + + #define BMP280_REG_COMP_TEMP_START 0x88 + #define BMP280_COMP_TEMP_REG_COUNT 6 +@@ -223,8 +212,6 @@ + #define BMP280_REG_COMP_PRESS_START 0x8E + #define BMP280_COMP_PRESS_REG_COUNT 18 + +-#define BMP280_COMP_H5_MASK GENMASK(15, 4) +- + #define BMP280_CONTIGUOUS_CALIB_REGS (BMP280_COMP_TEMP_REG_COUNT + \ + BMP280_COMP_PRESS_REG_COUNT) + +@@ -235,14 +222,6 @@ + #define BMP280_FILTER_8X 3 + #define BMP280_FILTER_16X 4 + +-#define BMP280_OSRS_HUMIDITY_MASK GENMASK(2, 0) +-#define BMP280_OSRS_HUMIDITY_SKIP 0 +-#define BMP280_OSRS_HUMIDITY_1X 1 +-#define BMP280_OSRS_HUMIDITY_2X 2 +-#define BMP280_OSRS_HUMIDITY_4X 3 +-#define BMP280_OSRS_HUMIDITY_8X 4 +-#define BMP280_OSRS_HUMIDITY_16X 5 +- + #define BMP280_OSRS_TEMP_MASK GENMASK(7, 5) + #define BMP280_OSRS_TEMP_SKIP 0 + #define BMP280_OSRS_TEMP_1X 1 +@@ -264,6 +243,30 @@ + #define BMP280_MODE_FORCED 1 + #define BMP280_MODE_NORMAL 3 + ++/* BME280 specific registers */ ++#define BME280_REG_HUMIDITY_LSB 0xFE ++#define BME280_REG_HUMIDITY_MSB 0xFD ++ ++#define BME280_REG_CTRL_HUMIDITY 0xF2 ++ ++/* Due to non linear mapping, and data sizes we can't do a bulk read */ ++#define BME280_REG_COMP_H1 0xA1 ++#define BME280_REG_COMP_H2 0xE1 ++#define BME280_REG_COMP_H3 0xE3 ++#define BME280_REG_COMP_H4 0xE4 ++#define BME280_REG_COMP_H5 0xE5 ++#define BME280_REG_COMP_H6 0xE7 ++ ++#define BME280_COMP_H5_MASK GENMASK(15, 4) ++ ++#define BME280_OSRS_HUMIDITY_MASK GENMASK(2, 0) ++#define BME280_OSRS_HUMIDITY_SKIP 0 ++#define BME280_OSRS_HUMIDITY_1X 1 ++#define BME280_OSRS_HUMIDITY_2X 2 ++#define BME280_OSRS_HUMIDITY_4X 3 ++#define BME280_OSRS_HUMIDITY_8X 4 ++#define BME280_OSRS_HUMIDITY_16X 5 ++ + /* BMP180 specific registers */ + #define BMP180_REG_OUT_XLSB 0xF8 + #define BMP180_REG_OUT_LSB 0xF7 +-- +2.43.0 + diff --git a/queue-6.6/io_uring-net-harden-multishot-termination-case-for-r.patch b/queue-6.6/io_uring-net-harden-multishot-termination-case-for-r.patch new file mode 100644 index 00000000000..5584cce583a --- /dev/null +++ b/queue-6.6/io_uring-net-harden-multishot-termination-case-for-r.patch @@ -0,0 +1,61 @@ +From cb7ff26400e66e2ce214690e6a2325fbb827511e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 07:08:10 -0600 +Subject: io_uring/net: harden multishot termination case for recv + +From: Jens Axboe + +[ Upstream commit c314094cb4cfa6fc5a17f4881ead2dfebfa717a7 ] + +If the recv returns zero, or an error, then it doesn't matter if more +data has already been received for this buffer. A condition like that +should terminate the multishot receive. Rather than pass in the +collected return value, pass in whether to terminate or keep the recv +going separately. + +Note that this isn't a bug right now, as the only way to get there is +via setting MSG_WAITALL with multishot receive. And if an application +does that, then -EINVAL is returned anyway. But it seems like an easy +bug to introduce, so let's make it a bit more explicit. + +Link: https://github.com/axboe/liburing/issues/1246 +Cc: stable@vger.kernel.org +Fixes: b3fdea6ecb55 ("io_uring: multishot recv") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/net.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/io_uring/net.c b/io_uring/net.c +index cf1060fb04f43..7412904387bfa 100644 +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -930,6 +930,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags) + int ret, min_ret = 0; + bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK; + size_t len = sr->len; ++ bool mshot_finished; + + if (!(req->flags & REQ_F_POLLED) && + (sr->flags & IORING_RECVSEND_POLL_FIRST)) +@@ -999,6 +1000,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags) + req_set_fail(req); + } + ++ mshot_finished = ret <= 0; + if (ret > 0) + ret += sr->done_io; + else if (sr->done_io) +@@ -1006,7 +1008,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags) + else + io_kbuf_recycle(req, issue_flags); + +- if (!io_recv_finish(req, &ret, &msg, ret <= 0, issue_flags)) ++ if (!io_recv_finish(req, &ret, &msg, mshot_finished, issue_flags)) + goto retry_multishot; + + return ret; +-- +2.43.0 + diff --git a/queue-6.6/kconfig-qconf-fix-buffer-overflow-in-debug-links.patch b/queue-6.6/kconfig-qconf-fix-buffer-overflow-in-debug-links.patch new file mode 100644 index 00000000000..d514129c256 --- /dev/null +++ b/queue-6.6/kconfig-qconf-fix-buffer-overflow-in-debug-links.patch @@ -0,0 +1,43 @@ +From ededfd6433c92f64522122c3e546ad8b2b13f264 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 18:02:22 +0900 +Subject: kconfig: qconf: fix buffer overflow in debug links + +From: Masahiro Yamada + +[ Upstream commit 984ed20ece1c6c20789ece040cbff3eb1a388fa9 ] + +If you enable "Option -> Show Debug Info" and click a link, the program +terminates with the following error: + + *** buffer overflow detected ***: terminated + +The buffer overflow is caused by the following line: + + strcat(data, "$"); + +The buffer needs one more byte to accommodate the additional character. + +Fixes: c4f7398bee9c ("kconfig: qconf: make debug links work again") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/qconf.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc +index 620a3527c767a..4f3ba3debc08e 100644 +--- a/scripts/kconfig/qconf.cc ++++ b/scripts/kconfig/qconf.cc +@@ -1174,7 +1174,7 @@ void ConfigInfoView::clicked(const QUrl &url) + { + QByteArray str = url.toEncoded(); + const std::size_t count = str.size(); +- char *data = new char[count + 1]; ++ char *data = new char[count + 2]; // '$' + '\0' + struct symbol **result; + struct menu *m = NULL; + +-- +2.43.0 + diff --git a/queue-6.6/lib-buildid-harden-build-id-parsing-logic.patch b/queue-6.6/lib-buildid-harden-build-id-parsing-logic.patch new file mode 100644 index 00000000000..e6db9ca5d39 --- /dev/null +++ b/queue-6.6/lib-buildid-harden-build-id-parsing-logic.patch @@ -0,0 +1,177 @@ +From 56ac1f323f02ee15ed9f42f99fb78356abfda50e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2024 10:42:23 -0700 +Subject: lib/buildid: harden build ID parsing logic + +From: Andrii Nakryiko + +[ Upstream commit 905415ff3ffb1d7e5afa62bacabd79776bd24606 ] + +Harden build ID parsing logic, adding explicit READ_ONCE() where it's +important to have a consistent value read and validated just once. + +Also, as pointed out by Andi Kleen, we need to make sure that entire ELF +note is within a page bounds, so move the overflow check up and add an +extra note_size boundaries validation. + +Fixes tag below points to the code that moved this code into +lib/buildid.c, and then subsequently was used in perf subsystem, making +this code exposed to perf_event_open() users in v5.12+. + +Cc: stable@vger.kernel.org +Reviewed-by: Eduard Zingerman +Reviewed-by: Jann Horn +Suggested-by: Andi Kleen +Fixes: bd7525dacd7e ("bpf: Move stack_map_get_build_id into lib") +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20240829174232.3133883-2-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + lib/buildid.c | 76 +++++++++++++++++++++++++++++---------------------- + 1 file changed, 44 insertions(+), 32 deletions(-) + +diff --git a/lib/buildid.c b/lib/buildid.c +index cdc0950f73843..d3bc3d0528d5c 100644 +--- a/lib/buildid.c ++++ b/lib/buildid.c +@@ -18,31 +18,37 @@ static int parse_build_id_buf(unsigned char *build_id, + const void *note_start, + Elf32_Word note_size) + { +- Elf32_Word note_offs = 0, new_offs; +- +- while (note_offs + sizeof(Elf32_Nhdr) < note_size) { +- Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_offs); ++ const char note_name[] = "GNU"; ++ const size_t note_name_sz = sizeof(note_name); ++ u64 note_off = 0, new_off, name_sz, desc_sz; ++ const char *data; ++ ++ while (note_off + sizeof(Elf32_Nhdr) < note_size && ++ note_off + sizeof(Elf32_Nhdr) > note_off /* overflow */) { ++ Elf32_Nhdr *nhdr = (Elf32_Nhdr *)(note_start + note_off); ++ ++ name_sz = READ_ONCE(nhdr->n_namesz); ++ desc_sz = READ_ONCE(nhdr->n_descsz); ++ ++ new_off = note_off + sizeof(Elf32_Nhdr); ++ if (check_add_overflow(new_off, ALIGN(name_sz, 4), &new_off) || ++ check_add_overflow(new_off, ALIGN(desc_sz, 4), &new_off) || ++ new_off > note_size) ++ break; + + if (nhdr->n_type == BUILD_ID && +- nhdr->n_namesz == sizeof("GNU") && +- !strcmp((char *)(nhdr + 1), "GNU") && +- nhdr->n_descsz > 0 && +- nhdr->n_descsz <= BUILD_ID_SIZE_MAX) { +- memcpy(build_id, +- note_start + note_offs + +- ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr), +- nhdr->n_descsz); +- memset(build_id + nhdr->n_descsz, 0, +- BUILD_ID_SIZE_MAX - nhdr->n_descsz); ++ name_sz == note_name_sz && ++ memcmp(nhdr + 1, note_name, note_name_sz) == 0 && ++ desc_sz > 0 && desc_sz <= BUILD_ID_SIZE_MAX) { ++ data = note_start + note_off + ALIGN(note_name_sz, 4); ++ memcpy(build_id, data, desc_sz); ++ memset(build_id + desc_sz, 0, BUILD_ID_SIZE_MAX - desc_sz); + if (size) +- *size = nhdr->n_descsz; ++ *size = desc_sz; + return 0; + } +- new_offs = note_offs + sizeof(Elf32_Nhdr) + +- ALIGN(nhdr->n_namesz, 4) + ALIGN(nhdr->n_descsz, 4); +- if (new_offs <= note_offs) /* overflow */ +- break; +- note_offs = new_offs; ++ ++ note_off = new_off; + } + + return -EINVAL; +@@ -71,7 +77,7 @@ static int get_build_id_32(const void *page_addr, unsigned char *build_id, + { + Elf32_Ehdr *ehdr = (Elf32_Ehdr *)page_addr; + Elf32_Phdr *phdr; +- int i; ++ __u32 i, phnum; + + /* + * FIXME +@@ -80,18 +86,19 @@ static int get_build_id_32(const void *page_addr, unsigned char *build_id, + */ + if (ehdr->e_phoff != sizeof(Elf32_Ehdr)) + return -EINVAL; ++ ++ phnum = READ_ONCE(ehdr->e_phnum); + /* only supports phdr that fits in one page */ +- if (ehdr->e_phnum > +- (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr)) ++ if (phnum > (PAGE_SIZE - sizeof(Elf32_Ehdr)) / sizeof(Elf32_Phdr)) + return -EINVAL; + + phdr = (Elf32_Phdr *)(page_addr + sizeof(Elf32_Ehdr)); + +- for (i = 0; i < ehdr->e_phnum; ++i) { ++ for (i = 0; i < phnum; ++i) { + if (phdr[i].p_type == PT_NOTE && + !parse_build_id(page_addr, build_id, size, +- page_addr + phdr[i].p_offset, +- phdr[i].p_filesz)) ++ page_addr + READ_ONCE(phdr[i].p_offset), ++ READ_ONCE(phdr[i].p_filesz))) + return 0; + } + return -EINVAL; +@@ -103,7 +110,7 @@ static int get_build_id_64(const void *page_addr, unsigned char *build_id, + { + Elf64_Ehdr *ehdr = (Elf64_Ehdr *)page_addr; + Elf64_Phdr *phdr; +- int i; ++ __u32 i, phnum; + + /* + * FIXME +@@ -112,18 +119,19 @@ static int get_build_id_64(const void *page_addr, unsigned char *build_id, + */ + if (ehdr->e_phoff != sizeof(Elf64_Ehdr)) + return -EINVAL; ++ ++ phnum = READ_ONCE(ehdr->e_phnum); + /* only supports phdr that fits in one page */ +- if (ehdr->e_phnum > +- (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr)) ++ if (phnum > (PAGE_SIZE - sizeof(Elf64_Ehdr)) / sizeof(Elf64_Phdr)) + return -EINVAL; + + phdr = (Elf64_Phdr *)(page_addr + sizeof(Elf64_Ehdr)); + +- for (i = 0; i < ehdr->e_phnum; ++i) { ++ for (i = 0; i < phnum; ++i) { + if (phdr[i].p_type == PT_NOTE && + !parse_build_id(page_addr, build_id, size, +- page_addr + phdr[i].p_offset, +- phdr[i].p_filesz)) ++ page_addr + READ_ONCE(phdr[i].p_offset), ++ READ_ONCE(phdr[i].p_filesz))) + return 0; + } + return -EINVAL; +@@ -152,6 +160,10 @@ int build_id_parse(struct vm_area_struct *vma, unsigned char *build_id, + page = find_get_page(vma->vm_file->f_mapping, 0); + if (!page) + return -EFAULT; /* page not mapped */ ++ if (!PageUptodate(page)) { ++ put_page(page); ++ return -EFAULT; ++ } + + ret = -EINVAL; + page_addr = kmap_atomic(page); +-- +2.43.0 + diff --git a/queue-6.6/media-i2c-imx335-enable-regulator-supplies.patch b/queue-6.6/media-i2c-imx335-enable-regulator-supplies.patch new file mode 100644 index 00000000000..14e562a4c4c --- /dev/null +++ b/queue-6.6/media-i2c-imx335-enable-regulator-supplies.patch @@ -0,0 +1,122 @@ +From d7c20dae9f77c5eabca99ec8dabef42c03c47498 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 18:29:46 +0530 +Subject: media: i2c: imx335: Enable regulator supplies + +From: Kieran Bingham + +[ Upstream commit fea91ee73b7cd19f08017221923d789f984abc54 ] + +Provide support for enabling and disabling regulator supplies to control +power to the camera sensor. + +While updating the power on function, document that a sleep is +represented as 'T4' in the datasheet power on sequence. + +Signed-off-by: Kieran Bingham +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Stable-dep-of: 99d30e2fdea4 ("media: imx335: Fix reset-gpio handling") +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx335.c | 36 ++++++++++++++++++++++++++++++++++-- + 1 file changed, 34 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/imx335.c b/drivers/media/i2c/imx335.c +index 26869abd77a67..771f13b524baf 100644 +--- a/drivers/media/i2c/imx335.c ++++ b/drivers/media/i2c/imx335.c +@@ -75,6 +75,12 @@ struct imx335_reg_list { + const struct imx335_reg *regs; + }; + ++static const char * const imx335_supply_name[] = { ++ "avdd", /* Analog (2.9V) supply */ ++ "ovdd", /* Digital I/O (1.8V) supply */ ++ "dvdd", /* Digital Core (1.2V) supply */ ++}; ++ + /** + * struct imx335_mode - imx335 sensor mode structure + * @width: Frame width +@@ -108,6 +114,7 @@ struct imx335_mode { + * @sd: V4L2 sub-device + * @pad: Media pad. Only one pad supported + * @reset_gpio: Sensor reset gpio ++ * @supplies: Regulator supplies to handle power control + * @inclk: Sensor input clock + * @ctrl_handler: V4L2 control handler + * @link_freq_ctrl: Pointer to link frequency control +@@ -127,6 +134,8 @@ struct imx335 { + struct v4l2_subdev sd; + struct media_pad pad; + struct gpio_desc *reset_gpio; ++ struct regulator_bulk_data supplies[ARRAY_SIZE(imx335_supply_name)]; ++ + struct clk *inclk; + struct v4l2_ctrl_handler ctrl_handler; + struct v4l2_ctrl *link_freq_ctrl; +@@ -790,6 +799,17 @@ static int imx335_parse_hw_config(struct imx335 *imx335) + return PTR_ERR(imx335->reset_gpio); + } + ++ for (i = 0; i < ARRAY_SIZE(imx335_supply_name); i++) ++ imx335->supplies[i].supply = imx335_supply_name[i]; ++ ++ ret = devm_regulator_bulk_get(imx335->dev, ++ ARRAY_SIZE(imx335_supply_name), ++ imx335->supplies); ++ if (ret) { ++ dev_err(imx335->dev, "Failed to get regulators\n"); ++ return ret; ++ } ++ + /* Get sensor input clock */ + imx335->inclk = devm_clk_get(imx335->dev, NULL); + if (IS_ERR(imx335->inclk)) { +@@ -868,6 +888,17 @@ static int imx335_power_on(struct device *dev) + struct imx335 *imx335 = to_imx335(sd); + int ret; + ++ ret = regulator_bulk_enable(ARRAY_SIZE(imx335_supply_name), ++ imx335->supplies); ++ if (ret) { ++ dev_err(dev, "%s: failed to enable regulators\n", ++ __func__); ++ return ret; ++ } ++ ++ usleep_range(500, 550); /* Tlow */ ++ ++ /* Set XCLR */ + gpiod_set_value_cansleep(imx335->reset_gpio, 1); + + ret = clk_prepare_enable(imx335->inclk); +@@ -876,12 +907,13 @@ static int imx335_power_on(struct device *dev) + goto error_reset; + } + +- usleep_range(20, 22); ++ usleep_range(20, 22); /* T4 */ + + return 0; + + error_reset: + gpiod_set_value_cansleep(imx335->reset_gpio, 0); ++ regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies); + + return ret; + } +@@ -898,8 +930,8 @@ static int imx335_power_off(struct device *dev) + struct imx335 *imx335 = to_imx335(sd); + + gpiod_set_value_cansleep(imx335->reset_gpio, 0); +- + clk_disable_unprepare(imx335->inclk); ++ regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.6/media-imx335-fix-reset-gpio-handling.patch b/queue-6.6/media-imx335-fix-reset-gpio-handling.patch new file mode 100644 index 00000000000..c85d0d53ab6 --- /dev/null +++ b/queue-6.6/media-imx335-fix-reset-gpio-handling.patch @@ -0,0 +1,79 @@ +From 9e988135d9903a31a781ebbad70549fbf87b4b77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2024 11:41:52 +0530 +Subject: media: imx335: Fix reset-gpio handling + +From: Umang Jain + +[ Upstream commit 99d30e2fdea4086be4e66e2deb10de854b547ab8 ] + +Rectify the logical value of reset-gpio so that it is set to +0 (disabled) during power-on and to 1 (enabled) during power-off. + +Set the reset-gpio to GPIO_OUT_HIGH at initialization time to make +sure it starts off in reset. Also drop the "Set XCLR" comment which +is not-so-informative. + +The existing usage of imx335 had reset-gpios polarity inverted +(GPIO_ACTIVE_HIGH) in their device-tree sources. With this patch +included, those DTS will not be able to stream imx335 anymore. The +reset-gpio polarity will need to be rectified in the device-tree +sources as shown in [1] example, in order to get imx335 functional +again (as it remains in reset prior to this fix). + +Cc: stable@vger.kernel.org +Fixes: 45d19b5fb9ae ("media: i2c: Add imx335 camera sensor driver") +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/linux-media/20240729110437.199428-1-umang.jain@ideasonboard.com/ +Signed-off-by: Umang Jain +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx335.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/i2c/imx335.c b/drivers/media/i2c/imx335.c +index 771f13b524baf..cb3f4fc66a174 100644 +--- a/drivers/media/i2c/imx335.c ++++ b/drivers/media/i2c/imx335.c +@@ -792,7 +792,7 @@ static int imx335_parse_hw_config(struct imx335 *imx335) + + /* Request optional reset pin */ + imx335->reset_gpio = devm_gpiod_get_optional(imx335->dev, "reset", +- GPIOD_OUT_LOW); ++ GPIOD_OUT_HIGH); + if (IS_ERR(imx335->reset_gpio)) { + dev_err(imx335->dev, "failed to get reset gpio %ld", + PTR_ERR(imx335->reset_gpio)); +@@ -898,8 +898,7 @@ static int imx335_power_on(struct device *dev) + + usleep_range(500, 550); /* Tlow */ + +- /* Set XCLR */ +- gpiod_set_value_cansleep(imx335->reset_gpio, 1); ++ gpiod_set_value_cansleep(imx335->reset_gpio, 0); + + ret = clk_prepare_enable(imx335->inclk); + if (ret) { +@@ -912,7 +911,7 @@ static int imx335_power_on(struct device *dev) + return 0; + + error_reset: +- gpiod_set_value_cansleep(imx335->reset_gpio, 0); ++ gpiod_set_value_cansleep(imx335->reset_gpio, 1); + regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies); + + return ret; +@@ -929,7 +928,7 @@ static int imx335_power_off(struct device *dev) + struct v4l2_subdev *sd = dev_get_drvdata(dev); + struct imx335 *imx335 = to_imx335(sd); + +- gpiod_set_value_cansleep(imx335->reset_gpio, 0); ++ gpiod_set_value_cansleep(imx335->reset_gpio, 1); + clk_disable_unprepare(imx335->inclk); + regulator_bulk_disable(ARRAY_SIZE(imx335_supply_name), imx335->supplies); + +-- +2.43.0 + diff --git a/queue-6.6/mm-z3fold-deprecate-config_z3fold.patch b/queue-6.6/mm-z3fold-deprecate-config_z3fold.patch new file mode 100644 index 00000000000..5ab67217528 --- /dev/null +++ b/queue-6.6/mm-z3fold-deprecate-config_z3fold.patch @@ -0,0 +1,163 @@ +From 28bbb2e3f6fbb1c8679803834e8646c7a5369e7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 19:25:12 +0000 +Subject: mm: z3fold: deprecate CONFIG_Z3FOLD + +From: Yosry Ahmed + +The z3fold compressed pages allocator is rarely used, most users use +zsmalloc. The only disadvantage of zsmalloc in comparison is the +dependency on MMU, and zbud is a more common option for !MMU as it was the +default zswap allocator for a long time. + +Historically, zsmalloc had worse latency than zbud and z3fold but offered +better memory savings. This is no longer the case as shown by a simple +recent analysis [1]. That analysis showed that z3fold does not have any +advantage over zsmalloc or zbud considering both performance and memory +usage. In a kernel build test on tmpfs in a limited cgroup, z3fold took +3% more time and used 1.8% more memory. The latency of zswap_load() was +7% higher, and that of zswap_store() was 10% higher. Zsmalloc is better +in all metrics. + +Moreover, z3fold apparently has latent bugs, which was made noticeable by +a recent soft lockup bug report with z3fold [2]. Switching to zsmalloc +not only fixed the problem, but also reduced the swap usage from 6~8G to +1~2G. Other users have also reported being bitten by mistakenly enabling +z3fold. + +Other than hurting users, z3fold is repeatedly causing wasted engineering +effort. Apart from investigating the above bug, it came up in multiple +development discussions (e.g. [3]) as something we need to handle, when +there aren't any legit users (at least not intentionally). + +The natural course of action is to deprecate z3fold, and remove in a few +cycles if no objections are raised from active users. Next on the list +should be zbud, as it offers marginal latency gains at the cost of huge +memory waste when compared to zsmalloc. That one will need to wait until +zsmalloc does not depend on MMU. + +Rename the user-visible config option from CONFIG_Z3FOLD to +CONFIG_Z3FOLD_DEPRECATED so that users with CONFIG_Z3FOLD=y get a new +prompt with explanation during make oldconfig. Also, remove +CONFIG_Z3FOLD=y from defconfigs. + +[1]https://lore.kernel.org/lkml/CAJD7tkbRF6od-2x_L8-A1QL3=2Ww13sCj4S3i4bNndqF+3+_Vg@mail.gmail.com/ +[2]https://lore.kernel.org/lkml/EF0ABD3E-A239-4111-A8AB-5C442E759CF3@gmail.com/ +[3]https://lore.kernel.org/lkml/CAJD7tkbnmeVugfunffSovJf9FAgy9rhBVt_tx=nxUveLUfqVsA@mail.gmail.com/ + +[arnd@arndb.de: deprecate ZSWAP_ZPOOL_DEFAULT_Z3FOLD as well] + Link: https://lkml.kernel.org/r/20240909202625.1054880-1-arnd@kernel.org +Link: https://lkml.kernel.org/r/20240904233343.933462-1-yosryahmed@google.com +Signed-off-by: Yosry Ahmed +Signed-off-by: Arnd Bergmann +Acked-by: Chris Down +Acked-by: Nhat Pham +Acked-by: Johannes Weiner +Acked-by: Vitaly Wool +Acked-by: Christoph Hellwig +Cc: Aneesh Kumar K.V +Cc: Christophe Leroy +Cc: Huacai Chen +Cc: Miaohe Lin +Cc: Michael Ellerman +Cc: Naveen N. Rao +Cc: Nicholas Piggin +Cc: Sergey Senozhatsky +Cc: WANG Xuerui +Cc: +Signed-off-by: Andrew Morton +(cherry picked from commit 7a2369b74abf76cd3e54c45b30f6addb497f831b) +Signed-off-by: Sasha Levin +--- + arch/loongarch/configs/loongson3_defconfig | 1 - + arch/powerpc/configs/ppc64_defconfig | 1 - + mm/Kconfig | 25 ++++++++++++++++------ + 3 files changed, 19 insertions(+), 8 deletions(-) + +diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig +index a3b52aaa83b33..e5f70642ed206 100644 +--- a/arch/loongarch/configs/loongson3_defconfig ++++ b/arch/loongarch/configs/loongson3_defconfig +@@ -83,7 +83,6 @@ CONFIG_ZPOOL=y + CONFIG_ZSWAP=y + CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD=y + CONFIG_ZBUD=y +-CONFIG_Z3FOLD=y + CONFIG_ZSMALLOC=m + # CONFIG_COMPAT_BRK is not set + CONFIG_MEMORY_HOTPLUG=y +diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig +index 6e7b9e8fd2251..65e518dde2c2f 100644 +--- a/arch/powerpc/configs/ppc64_defconfig ++++ b/arch/powerpc/configs/ppc64_defconfig +@@ -81,7 +81,6 @@ CONFIG_MODULE_SIG_SHA512=y + CONFIG_PARTITION_ADVANCED=y + CONFIG_BINFMT_MISC=m + CONFIG_ZSWAP=y +-CONFIG_Z3FOLD=y + CONFIG_ZSMALLOC=y + # CONFIG_SLAB_MERGE_DEFAULT is not set + CONFIG_SLAB_FREELIST_RANDOM=y +diff --git a/mm/Kconfig b/mm/Kconfig +index ece4f2847e2b4..c11cd01169e8d 100644 +--- a/mm/Kconfig ++++ b/mm/Kconfig +@@ -147,12 +147,15 @@ config ZSWAP_ZPOOL_DEFAULT_ZBUD + help + Use the zbud allocator as the default allocator. + +-config ZSWAP_ZPOOL_DEFAULT_Z3FOLD +- bool "z3fold" +- select Z3FOLD ++config ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED ++ bool "z3foldi (DEPRECATED)" ++ select Z3FOLD_DEPRECATED + help + Use the z3fold allocator as the default allocator. + ++ Deprecated and scheduled for removal in a few cycles, ++ see CONFIG_Z3FOLD_DEPRECATED. ++ + config ZSWAP_ZPOOL_DEFAULT_ZSMALLOC + bool "zsmalloc" + select ZSMALLOC +@@ -164,7 +167,7 @@ config ZSWAP_ZPOOL_DEFAULT + string + depends on ZSWAP + default "zbud" if ZSWAP_ZPOOL_DEFAULT_ZBUD +- default "z3fold" if ZSWAP_ZPOOL_DEFAULT_Z3FOLD ++ default "z3fold" if ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED + default "zsmalloc" if ZSWAP_ZPOOL_DEFAULT_ZSMALLOC + default "" + +@@ -178,15 +181,25 @@ config ZBUD + deterministic reclaim properties that make it preferable to a higher + density approach when reclaim will be used. + +-config Z3FOLD +- tristate "3:1 compression allocator (z3fold)" ++config Z3FOLD_DEPRECATED ++ tristate "3:1 compression allocator (z3fold) (DEPRECATED)" + depends on ZSWAP + help ++ Deprecated and scheduled for removal in a few cycles. If you have ++ a good reason for using Z3FOLD over ZSMALLOC, please contact ++ linux-mm@kvack.org and the zswap maintainers. ++ + A special purpose allocator for storing compressed pages. + It is designed to store up to three compressed pages per physical + page. It is a ZBUD derivative so the simplicity and determinism are + still there. + ++config Z3FOLD ++ tristate ++ default y if Z3FOLD_DEPRECATED=y ++ default m if Z3FOLD_DEPRECATED=m ++ depends on Z3FOLD_DEPRECATED ++ + config ZSMALLOC + tristate + prompt "N:1 compression allocator (zsmalloc)" if ZSWAP +-- +2.43.0 + diff --git a/queue-6.6/net-mana-add-support-for-page-sizes-other-than-4kb-o.patch b/queue-6.6/net-mana-add-support-for-page-sizes-other-than-4kb-o.patch new file mode 100644 index 00000000000..5f2da813a2b --- /dev/null +++ b/queue-6.6/net-mana-add-support-for-page-sizes-other-than-4kb-o.patch @@ -0,0 +1,259 @@ +From 2464c87876ed0c7a9978ae776305f00dc823f868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 13:17:26 -0700 +Subject: net: mana: Add support for page sizes other than 4KB on ARM64 + +From: Haiyang Zhang + +[ Upstream commit 382d1741b5b2feffef7942dd074206372afe1a96 ] + +As defined by the MANA Hardware spec, the queue size for DMA is 4KB +minimal, and power of 2. And, the HWC queue size has to be exactly +4KB. + +To support page sizes other than 4KB on ARM64, define the minimal +queue size as a macro separately from the PAGE_SIZE, which we always +assumed it to be 4KB before supporting ARM64. + +Also, add MANA specific macros and update code related to size +alignment, DMA region calculations, etc. + +Signed-off-by: Haiyang Zhang +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/1718655446-6576-1-git-send-email-haiyangz@microsoft.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 9e517a8e9d9a ("RDMA/mana_ib: use the correct page table index based on hardware page size") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microsoft/Kconfig | 2 +- + drivers/net/ethernet/microsoft/mana/gdma_main.c | 10 +++++----- + drivers/net/ethernet/microsoft/mana/hw_channel.c | 14 +++++++------- + drivers/net/ethernet/microsoft/mana/mana_en.c | 8 ++++---- + drivers/net/ethernet/microsoft/mana/shm_channel.c | 13 +++++++------ + include/net/mana/gdma.h | 10 +++++++++- + include/net/mana/mana.h | 3 ++- + 7 files changed, 35 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/ethernet/microsoft/Kconfig b/drivers/net/ethernet/microsoft/Kconfig +index 286f0d5697a16..901fbffbf718e 100644 +--- a/drivers/net/ethernet/microsoft/Kconfig ++++ b/drivers/net/ethernet/microsoft/Kconfig +@@ -18,7 +18,7 @@ if NET_VENDOR_MICROSOFT + config MICROSOFT_MANA + tristate "Microsoft Azure Network Adapter (MANA) support" + depends on PCI_MSI +- depends on X86_64 || (ARM64 && !CPU_BIG_ENDIAN && ARM64_4K_PAGES) ++ depends on X86_64 || (ARM64 && !CPU_BIG_ENDIAN) + depends on PCI_HYPERV + select AUXILIARY_BUS + select PAGE_POOL +diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c +index 6367de0c2c2e8..ae014e21eb605 100644 +--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c ++++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c +@@ -179,7 +179,7 @@ int mana_gd_alloc_memory(struct gdma_context *gc, unsigned int length, + dma_addr_t dma_handle; + void *buf; + +- if (length < PAGE_SIZE || !is_power_of_2(length)) ++ if (length < MANA_PAGE_SIZE || !is_power_of_2(length)) + return -EINVAL; + + gmi->dev = gc->dev; +@@ -720,7 +720,7 @@ EXPORT_SYMBOL_NS(mana_gd_destroy_dma_region, NET_MANA); + static int mana_gd_create_dma_region(struct gdma_dev *gd, + struct gdma_mem_info *gmi) + { +- unsigned int num_page = gmi->length / PAGE_SIZE; ++ unsigned int num_page = gmi->length / MANA_PAGE_SIZE; + struct gdma_create_dma_region_req *req = NULL; + struct gdma_create_dma_region_resp resp = {}; + struct gdma_context *gc = gd->gdma_context; +@@ -730,10 +730,10 @@ static int mana_gd_create_dma_region(struct gdma_dev *gd, + int err; + int i; + +- if (length < PAGE_SIZE || !is_power_of_2(length)) ++ if (length < MANA_PAGE_SIZE || !is_power_of_2(length)) + return -EINVAL; + +- if (offset_in_page(gmi->virt_addr) != 0) ++ if (!MANA_PAGE_ALIGNED(gmi->virt_addr)) + return -EINVAL; + + hwc = gc->hwc.driver_data; +@@ -754,7 +754,7 @@ static int mana_gd_create_dma_region(struct gdma_dev *gd, + req->page_addr_list_len = num_page; + + for (i = 0; i < num_page; i++) +- req->page_addr_list[i] = gmi->dma_handle + i * PAGE_SIZE; ++ req->page_addr_list[i] = gmi->dma_handle + i * MANA_PAGE_SIZE; + + err = mana_gd_send_request(gc, req_msg_size, req, sizeof(resp), &resp); + if (err) +diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c +index 236daa0535ba0..9d6426d4158e3 100644 +--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c ++++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c +@@ -366,12 +366,12 @@ static int mana_hwc_create_cq(struct hw_channel_context *hwc, u16 q_depth, + int err; + + eq_size = roundup_pow_of_two(GDMA_EQE_SIZE * q_depth); +- if (eq_size < MINIMUM_SUPPORTED_PAGE_SIZE) +- eq_size = MINIMUM_SUPPORTED_PAGE_SIZE; ++ if (eq_size < MANA_MIN_QSIZE) ++ eq_size = MANA_MIN_QSIZE; + + cq_size = roundup_pow_of_two(GDMA_CQE_SIZE * q_depth); +- if (cq_size < MINIMUM_SUPPORTED_PAGE_SIZE) +- cq_size = MINIMUM_SUPPORTED_PAGE_SIZE; ++ if (cq_size < MANA_MIN_QSIZE) ++ cq_size = MANA_MIN_QSIZE; + + hwc_cq = kzalloc(sizeof(*hwc_cq), GFP_KERNEL); + if (!hwc_cq) +@@ -433,7 +433,7 @@ static int mana_hwc_alloc_dma_buf(struct hw_channel_context *hwc, u16 q_depth, + + dma_buf->num_reqs = q_depth; + +- buf_size = PAGE_ALIGN(q_depth * max_msg_size); ++ buf_size = MANA_PAGE_ALIGN(q_depth * max_msg_size); + + gmi = &dma_buf->mem_info; + err = mana_gd_alloc_memory(gc, buf_size, gmi); +@@ -501,8 +501,8 @@ static int mana_hwc_create_wq(struct hw_channel_context *hwc, + else + queue_size = roundup_pow_of_two(GDMA_MAX_SQE_SIZE * q_depth); + +- if (queue_size < MINIMUM_SUPPORTED_PAGE_SIZE) +- queue_size = MINIMUM_SUPPORTED_PAGE_SIZE; ++ if (queue_size < MANA_MIN_QSIZE) ++ queue_size = MANA_MIN_QSIZE; + + hwc_wq = kzalloc(sizeof(*hwc_wq), GFP_KERNEL); + if (!hwc_wq) +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +index d8cce3771af21..89852bbc877c1 100644 +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -1902,10 +1902,10 @@ static int mana_create_txq(struct mana_port_context *apc, + * to prevent overflow. + */ + txq_size = MAX_SEND_BUFFERS_PER_QUEUE * 32; +- BUILD_BUG_ON(!PAGE_ALIGNED(txq_size)); ++ BUILD_BUG_ON(!MANA_PAGE_ALIGNED(txq_size)); + + cq_size = MAX_SEND_BUFFERS_PER_QUEUE * COMP_ENTRY_SIZE; +- cq_size = PAGE_ALIGN(cq_size); ++ cq_size = MANA_PAGE_ALIGN(cq_size); + + gc = gd->gdma_context; + +@@ -2203,8 +2203,8 @@ static struct mana_rxq *mana_create_rxq(struct mana_port_context *apc, + if (err) + goto out; + +- rq_size = PAGE_ALIGN(rq_size); +- cq_size = PAGE_ALIGN(cq_size); ++ rq_size = MANA_PAGE_ALIGN(rq_size); ++ cq_size = MANA_PAGE_ALIGN(cq_size); + + /* Create RQ */ + memset(&spec, 0, sizeof(spec)); +diff --git a/drivers/net/ethernet/microsoft/mana/shm_channel.c b/drivers/net/ethernet/microsoft/mana/shm_channel.c +index 5553af9c8085a..0f1679ebad96b 100644 +--- a/drivers/net/ethernet/microsoft/mana/shm_channel.c ++++ b/drivers/net/ethernet/microsoft/mana/shm_channel.c +@@ -6,6 +6,7 @@ + #include + #include + ++#include + #include + + #define PAGE_FRAME_L48_WIDTH_BYTES 6 +@@ -155,8 +156,8 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr, + return err; + } + +- if (!PAGE_ALIGNED(eq_addr) || !PAGE_ALIGNED(cq_addr) || +- !PAGE_ALIGNED(rq_addr) || !PAGE_ALIGNED(sq_addr)) ++ if (!MANA_PAGE_ALIGNED(eq_addr) || !MANA_PAGE_ALIGNED(cq_addr) || ++ !MANA_PAGE_ALIGNED(rq_addr) || !MANA_PAGE_ALIGNED(sq_addr)) + return -EINVAL; + + if ((eq_msix_index & VECTOR_MASK) != eq_msix_index) +@@ -183,7 +184,7 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr, + + /* EQ addr: low 48 bits of frame address */ + shmem = (u64 *)ptr; +- frame_addr = PHYS_PFN(eq_addr); ++ frame_addr = MANA_PFN(eq_addr); + *shmem = frame_addr & PAGE_FRAME_L48_MASK; + all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) << + (frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS); +@@ -191,7 +192,7 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr, + + /* CQ addr: low 48 bits of frame address */ + shmem = (u64 *)ptr; +- frame_addr = PHYS_PFN(cq_addr); ++ frame_addr = MANA_PFN(cq_addr); + *shmem = frame_addr & PAGE_FRAME_L48_MASK; + all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) << + (frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS); +@@ -199,7 +200,7 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr, + + /* RQ addr: low 48 bits of frame address */ + shmem = (u64 *)ptr; +- frame_addr = PHYS_PFN(rq_addr); ++ frame_addr = MANA_PFN(rq_addr); + *shmem = frame_addr & PAGE_FRAME_L48_MASK; + all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) << + (frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS); +@@ -207,7 +208,7 @@ int mana_smc_setup_hwc(struct shm_channel *sc, bool reset_vf, u64 eq_addr, + + /* SQ addr: low 48 bits of frame address */ + shmem = (u64 *)ptr; +- frame_addr = PHYS_PFN(sq_addr); ++ frame_addr = MANA_PFN(sq_addr); + *shmem = frame_addr & PAGE_FRAME_L48_MASK; + all_addr_h4bits |= (frame_addr >> PAGE_FRAME_L48_WIDTH_BITS) << + (frame_addr_seq++ * PAGE_FRAME_H4_WIDTH_BITS); +diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h +index 88b6ef7ce1a6e..3965343fdee0c 100644 +--- a/include/net/mana/gdma.h ++++ b/include/net/mana/gdma.h +@@ -222,7 +222,15 @@ struct gdma_dev { + struct auxiliary_device *adev; + }; + +-#define MINIMUM_SUPPORTED_PAGE_SIZE PAGE_SIZE ++/* MANA_PAGE_SIZE is the DMA unit */ ++#define MANA_PAGE_SHIFT 12 ++#define MANA_PAGE_SIZE BIT(MANA_PAGE_SHIFT) ++#define MANA_PAGE_ALIGN(x) ALIGN((x), MANA_PAGE_SIZE) ++#define MANA_PAGE_ALIGNED(addr) IS_ALIGNED((unsigned long)(addr), MANA_PAGE_SIZE) ++#define MANA_PFN(a) ((a) >> MANA_PAGE_SHIFT) ++ ++/* Required by HW */ ++#define MANA_MIN_QSIZE MANA_PAGE_SIZE + + #define GDMA_CQE_SIZE 64 + #define GDMA_EQE_SIZE 16 +diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h +index 28e110f733ffd..7892b79854f62 100644 +--- a/include/net/mana/mana.h ++++ b/include/net/mana/mana.h +@@ -42,7 +42,8 @@ enum TRI_STATE { + + #define MAX_SEND_BUFFERS_PER_QUEUE 256 + +-#define EQ_SIZE (8 * PAGE_SIZE) ++#define EQ_SIZE (8 * MANA_PAGE_SIZE) ++ + #define LOG2_EQ_THROTTLE 3 + + #define MAX_PORTS_IN_MANA_DEV 256 +-- +2.43.0 + diff --git a/queue-6.6/net-mana-enable-mana-driver-on-arm64-with-4k-page-si.patch b/queue-6.6/net-mana-enable-mana-driver-on-arm64-with-4k-page-si.patch new file mode 100644 index 00000000000..31d380a7d38 --- /dev/null +++ b/queue-6.6/net-mana-enable-mana-driver-on-arm64-with-4k-page-si.patch @@ -0,0 +1,39 @@ +From f6f355125170e3b913622aeb514bd5202f91eb99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 13:29:01 -0700 +Subject: net: mana: Enable MANA driver on ARM64 with 4K page size + +From: Haiyang Zhang + +[ Upstream commit 40a1d11fc670ac03c5dc2e5a9724b330e74f38b0 ] + +Change the Kconfig dependency, so this driver can be built and run on ARM64 +with 4K page size. +16/64K page sizes are not supported yet. + +Signed-off-by: Haiyang Zhang +Link: https://lore.kernel.org/r/1715632141-8089-1-git-send-email-haiyangz@microsoft.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 9e517a8e9d9a ("RDMA/mana_ib: use the correct page table index based on hardware page size") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microsoft/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/microsoft/Kconfig b/drivers/net/ethernet/microsoft/Kconfig +index 01eb7445ead95..286f0d5697a16 100644 +--- a/drivers/net/ethernet/microsoft/Kconfig ++++ b/drivers/net/ethernet/microsoft/Kconfig +@@ -17,7 +17,8 @@ if NET_VENDOR_MICROSOFT + + config MICROSOFT_MANA + tristate "Microsoft Azure Network Adapter (MANA) support" +- depends on PCI_MSI && X86_64 ++ depends on PCI_MSI ++ depends on X86_64 || (ARM64 && !CPU_BIG_ENDIAN && ARM64_4K_PAGES) + depends on PCI_HYPERV + select AUXILIARY_BUS + select PAGE_POOL +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-x86-android-tablets-create-a-platform_d.patch b/queue-6.6/platform-x86-x86-android-tablets-create-a-platform_d.patch new file mode 100644 index 00000000000..e100affcd65 --- /dev/null +++ b/queue-6.6/platform-x86-x86-android-tablets-create-a-platform_d.patch @@ -0,0 +1,189 @@ +From 825a577f1cd2fb4ed109c396a3015f1c139a73f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Sep 2023 16:18:13 +0200 +Subject: platform/x86: x86-android-tablets: Create a platform_device from + module_init() + +From: Hans de Goede + +[ Upstream commit 8b57d33a6fdbb53d03da762b31e65a1027f74caf ] + +Create a platform_device from module_init() and change +x86_android_tablet_init() / cleanup() into platform_device +probe() and remove() functions. + +This is a preparation patch for refactoring x86_android_tablet_get_gpiod() +to no longer use gpiolib private functions like gpiochip_find(). + +Signed-off-by: Hans de Goede +Acked-by: Linus Walleij +Link: https://lore.kernel.org/r/20230909141816.58358-6-hdegoede@redhat.com +Stable-dep-of: 2fae3129c0c0 ("platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors") +Signed-off-by: Sasha Levin +--- + .../platform/x86/x86-android-tablets/core.c | 51 ++++++++++++++----- + 1 file changed, 38 insertions(+), 13 deletions(-) + +diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c +index 2fd6060a31bb0..ebfd9a3dac957 100644 +--- a/drivers/platform/x86/x86-android-tablets/core.c ++++ b/drivers/platform/x86/x86-android-tablets/core.c +@@ -25,6 +25,8 @@ + #include "../../../gpio/gpiolib.h" + #include "../../../gpio/gpiolib-acpi.h" + ++static struct platform_device *x86_android_tablet_device; ++ + static int gpiochip_find_match_label(struct gpio_chip *gc, void *data) + { + return gc->label && !strcmp(gc->label, data); +@@ -224,7 +226,7 @@ static __init int x86_instantiate_serdev(const struct x86_serdev_info *info, int + return ret; + } + +-static void x86_android_tablet_cleanup(void) ++static void x86_android_tablet_remove(struct platform_device *pdev) + { + int i; + +@@ -255,7 +257,7 @@ static void x86_android_tablet_cleanup(void) + software_node_unregister(bat_swnode); + } + +-static __init int x86_android_tablet_init(void) ++static __init int x86_android_tablet_probe(struct platform_device *pdev) + { + const struct x86_dev_info *dev_info; + const struct dmi_system_id *id; +@@ -267,6 +269,8 @@ static __init int x86_android_tablet_init(void) + return -ENODEV; + + dev_info = id->driver_data; ++ /* Allow x86_android_tablet_device use before probe() exits */ ++ x86_android_tablet_device = pdev; + + /* + * The broken DSDTs on these devices often also include broken +@@ -303,7 +307,7 @@ static __init int x86_android_tablet_init(void) + if (dev_info->init) { + ret = dev_info->init(); + if (ret < 0) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return ret; + } + exit_handler = dev_info->exit; +@@ -311,7 +315,7 @@ static __init int x86_android_tablet_init(void) + + i2c_clients = kcalloc(dev_info->i2c_client_count, sizeof(*i2c_clients), GFP_KERNEL); + if (!i2c_clients) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return -ENOMEM; + } + +@@ -319,7 +323,7 @@ static __init int x86_android_tablet_init(void) + for (i = 0; i < i2c_client_count; i++) { + ret = x86_instantiate_i2c_client(dev_info, i); + if (ret < 0) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return ret; + } + } +@@ -327,7 +331,7 @@ static __init int x86_android_tablet_init(void) + /* + 1 to make space for (optional) gpio_keys_button pdev */ + pdevs = kcalloc(dev_info->pdev_count + 1, sizeof(*pdevs), GFP_KERNEL); + if (!pdevs) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return -ENOMEM; + } + +@@ -335,14 +339,14 @@ static __init int x86_android_tablet_init(void) + for (i = 0; i < pdev_count; i++) { + pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]); + if (IS_ERR(pdevs[i])) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return PTR_ERR(pdevs[i]); + } + } + + serdevs = kcalloc(dev_info->serdev_count, sizeof(*serdevs), GFP_KERNEL); + if (!serdevs) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return -ENOMEM; + } + +@@ -350,7 +354,7 @@ static __init int x86_android_tablet_init(void) + for (i = 0; i < serdev_count; i++) { + ret = x86_instantiate_serdev(&dev_info->serdev_info[i], i); + if (ret < 0) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return ret; + } + } +@@ -361,7 +365,7 @@ static __init int x86_android_tablet_init(void) + + buttons = kcalloc(dev_info->gpio_button_count, sizeof(*buttons), GFP_KERNEL); + if (!buttons) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return -ENOMEM; + } + +@@ -369,7 +373,7 @@ static __init int x86_android_tablet_init(void) + ret = x86_android_tablet_get_gpiod(dev_info->gpio_button[i].chip, + dev_info->gpio_button[i].pin, &gpiod); + if (ret < 0) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return ret; + } + +@@ -384,7 +388,7 @@ static __init int x86_android_tablet_init(void) + PLATFORM_DEVID_AUTO, + &pdata, sizeof(pdata)); + if (IS_ERR(pdevs[pdev_count])) { +- x86_android_tablet_cleanup(); ++ x86_android_tablet_remove(pdev); + return PTR_ERR(pdevs[pdev_count]); + } + pdev_count++; +@@ -393,8 +397,29 @@ static __init int x86_android_tablet_init(void) + return 0; + } + ++static struct platform_driver x86_android_tablet_driver = { ++ .driver = { ++ .name = KBUILD_MODNAME, ++ }, ++ .remove_new = x86_android_tablet_remove, ++}; ++ ++static int __init x86_android_tablet_init(void) ++{ ++ x86_android_tablet_device = platform_create_bundle(&x86_android_tablet_driver, ++ x86_android_tablet_probe, ++ NULL, 0, NULL, 0); ++ ++ return PTR_ERR_OR_ZERO(x86_android_tablet_device); ++} + module_init(x86_android_tablet_init); +-module_exit(x86_android_tablet_cleanup); ++ ++static void __exit x86_android_tablet_exit(void) ++{ ++ platform_device_unregister(x86_android_tablet_device); ++ platform_driver_unregister(&x86_android_tablet_driver); ++} ++module_exit(x86_android_tablet_exit); + + MODULE_AUTHOR("Hans de Goede "); + MODULE_DESCRIPTION("X86 Android tablets DSDT fixups driver"); +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-x86-android-tablets-fix-use-after-free-.patch b/queue-6.6/platform-x86-x86-android-tablets-fix-use-after-free-.patch new file mode 100644 index 00000000000..f5b8488084f --- /dev/null +++ b/queue-6.6/platform-x86-x86-android-tablets-fix-use-after-free-.patch @@ -0,0 +1,58 @@ +From 43f954625e8f70e0b77928d363f85ee86b5be406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Oct 2024 15:05:45 +0200 +Subject: platform/x86: x86-android-tablets: Fix use after free on + platform_device_register() errors + +From: Hans de Goede + +[ Upstream commit 2fae3129c0c08e72b1fe93e61fd8fd203252094a ] + +x86_android_tablet_remove() frees the pdevs[] array, so it should not +be used after calling x86_android_tablet_remove(). + +When platform_device_register() fails, store the pdevs[x] PTR_ERR() value +into the local ret variable before calling x86_android_tablet_remove() +to avoid using pdevs[] after it has been freed. + +Fixes: 5eba0141206e ("platform/x86: x86-android-tablets: Add support for instantiating platform-devs") +Fixes: e2200d3f26da ("platform/x86: x86-android-tablets: Add gpio_keys support to x86_android_tablet_init()") +Cc: stable@vger.kernel.org +Reported-by: Aleksandr Burakov +Closes: https://lore.kernel.org/platform-driver-x86/20240917120458.7300-1-a.burakov@rosalinux.ru/ +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20241005130545.64136-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/x86-android-tablets/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c +index ebfd9a3dac957..a0fa0b6859c9c 100644 +--- a/drivers/platform/x86/x86-android-tablets/core.c ++++ b/drivers/platform/x86/x86-android-tablets/core.c +@@ -339,8 +339,9 @@ static __init int x86_android_tablet_probe(struct platform_device *pdev) + for (i = 0; i < pdev_count; i++) { + pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]); + if (IS_ERR(pdevs[i])) { ++ ret = PTR_ERR(pdevs[i]); + x86_android_tablet_remove(pdev); +- return PTR_ERR(pdevs[i]); ++ return ret; + } + } + +@@ -388,8 +389,9 @@ static __init int x86_android_tablet_probe(struct platform_device *pdev) + PLATFORM_DEVID_AUTO, + &pdata, sizeof(pdata)); + if (IS_ERR(pdevs[pdev_count])) { ++ ret = PTR_ERR(pdevs[pdev_count]); + x86_android_tablet_remove(pdev); +- return PTR_ERR(pdevs[pdev_count]); ++ return ret; + } + pdev_count++; + } +-- +2.43.0 + diff --git a/queue-6.6/r8169-add-tally-counter-fields-added-with-rtl8125.patch b/queue-6.6/r8169-add-tally-counter-fields-added-with-rtl8125.patch new file mode 100644 index 00000000000..7858bc76c3c --- /dev/null +++ b/queue-6.6/r8169-add-tally-counter-fields-added-with-rtl8125.patch @@ -0,0 +1,66 @@ +From 684b9f7be346ee40a627d3b957b07c29a3fabc74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Sep 2024 23:04:46 +0200 +Subject: r8169: add tally counter fields added with RTL8125 + +From: Heiner Kallweit + +[ Upstream commit ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a ] + +RTL8125 added fields to the tally counter, what may result in the chip +dma'ing these new fields to unallocated memory. Therefore make sure +that the allocated memory area is big enough to hold all of the +tally counter values, even if we use only parts of it. + +Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") +Cc: stable@vger.kernel.org +Signed-off-by: Heiner Kallweit +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/741d26a9-2b2b-485d-91d9-ecb302e345b5@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 382ba8b04cbfa..b499d8ea6d216 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -567,6 +567,33 @@ struct rtl8169_counters { + __le32 rx_multicast; + __le16 tx_aborted; + __le16 tx_underrun; ++ /* new since RTL8125 */ ++ __le64 tx_octets; ++ __le64 rx_octets; ++ __le64 rx_multicast64; ++ __le64 tx_unicast64; ++ __le64 tx_broadcast64; ++ __le64 tx_multicast64; ++ __le32 tx_pause_on; ++ __le32 tx_pause_off; ++ __le32 tx_pause_all; ++ __le32 tx_deferred; ++ __le32 tx_late_collision; ++ __le32 tx_all_collision; ++ __le32 tx_aborted32; ++ __le32 align_errors32; ++ __le32 rx_frame_too_long; ++ __le32 rx_runt; ++ __le32 rx_pause_on; ++ __le32 rx_pause_off; ++ __le32 rx_pause_all; ++ __le32 rx_unknown_opcode; ++ __le32 rx_mac_error; ++ __le32 tx_underrun32; ++ __le32 rx_mac_missed; ++ __le32 rx_tcam_dropped; ++ __le32 tdu; ++ __le32 rdu; + }; + + struct rtl8169_tc_offsets { +-- +2.43.0 + diff --git a/queue-6.6/r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch b/queue-6.6/r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch new file mode 100644 index 00000000000..033c1583d0a --- /dev/null +++ b/queue-6.6/r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch @@ -0,0 +1,48 @@ +From 4d8f89ef94b242465c79b909f07bc2ad9b1f8ecb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 15:00:21 +0100 +Subject: r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun" + +From: Colin Ian King + +[ Upstream commit 8df9439389a44fb2cc4ef695e08d6a8870b1616c ] + +There is a spelling mistake in the struct field tx_underun, rename +it to tx_underrun. + +Signed-off-by: Colin Ian King +Reviewed-by: Simon Horman +Reviewed-by: Heiner Kallweit +Link: https://patch.msgid.link/20240909140021.64884-1-colin.i.king@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: ced8e8b8f40a ("r8169: add tally counter fields added with RTL8125") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 8a732edac15a0..382ba8b04cbfa 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -566,7 +566,7 @@ struct rtl8169_counters { + __le64 rx_broadcast; + __le32 rx_multicast; + __le16 tx_aborted; +- __le16 tx_underun; ++ __le16 tx_underrun; + }; + + struct rtl8169_tc_offsets { +@@ -1726,7 +1726,7 @@ static void rtl8169_get_ethtool_stats(struct net_device *dev, + data[9] = le64_to_cpu(counters->rx_broadcast); + data[10] = le32_to_cpu(counters->rx_multicast); + data[11] = le16_to_cpu(counters->tx_aborted); +- data[12] = le16_to_cpu(counters->tx_underun); ++ data[12] = le16_to_cpu(counters->tx_underrun); + } + + static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data) +-- +2.43.0 + diff --git a/queue-6.6/rdma-mana_ib-use-the-correct-page-table-index-based-.patch b/queue-6.6/rdma-mana_ib-use-the-correct-page-table-index-based-.patch new file mode 100644 index 00000000000..51cb91edffa --- /dev/null +++ b/queue-6.6/rdma-mana_ib-use-the-correct-page-table-index-based-.patch @@ -0,0 +1,39 @@ +From eae359c686f29ebbb8f381bd6d96df6711c2f451 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2024 08:16:32 -0700 +Subject: RDMA/mana_ib: use the correct page table index based on hardware page + size + +From: Long Li + +[ Upstream commit 9e517a8e9d9a303bf9bde35e5c5374795544c152 ] + +MANA hardware uses 4k page size. When calculating the page table index, +it should use the hardware page size, not the system page size. + +Cc: stable@vger.kernel.org +Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") +Signed-off-by: Long Li +Link: https://patch.msgid.link/1725030993-16213-1-git-send-email-longli@linuxonhyperv.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mana/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c +index 5dd5b9803f4e5..85717482a616e 100644 +--- a/drivers/infiniband/hw/mana/main.c ++++ b/drivers/infiniband/hw/mana/main.c +@@ -359,7 +359,7 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem, + + create_req->length = umem->length; + create_req->offset_in_page = ib_umem_dma_offset(umem, page_sz); +- create_req->gdma_page_type = order_base_2(page_sz) - PAGE_SHIFT; ++ create_req->gdma_page_type = order_base_2(page_sz) - MANA_PAGE_SHIFT; + create_req->page_count = num_pages_total; + + ibdev_dbg(&dev->ib_dev, "size_dma_region %lu num_pages_total %lu\n", +-- +2.43.0 + diff --git a/queue-6.6/remoteproc-k3-r5-acquire-mailbox-handle-during-probe.patch b/queue-6.6/remoteproc-k3-r5-acquire-mailbox-handle-during-probe.patch new file mode 100644 index 00000000000..9d9e583b414 --- /dev/null +++ b/queue-6.6/remoteproc-k3-r5-acquire-mailbox-handle-during-probe.patch @@ -0,0 +1,195 @@ +From 3bd46c452f19aa999fbb5dea93093d4c8a176d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2024 13:11:26 +0530 +Subject: remoteproc: k3-r5: Acquire mailbox handle during probe routine + +From: Beleswar Padhi + +[ Upstream commit f3f11cfe890733373ddbb1ce8991ccd4ee5e79e1 ] + +Acquire the mailbox handle during device probe and do not release handle +in stop/detach routine or error paths. This removes the redundant +requests for mbox handle later during rproc start/attach. This also +allows to defer remoteproc driver's probe if mailbox is not probed yet. + +Signed-off-by: Beleswar Padhi +Link: https://lore.kernel.org/r/20240808074127.2688131-3-b-padhi@ti.com +Signed-off-by: Mathieu Poirier +Stable-dep-of: 8fa052c29e50 ("remoteproc: k3-r5: Delay notification of wakeup event") +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/ti_k3_r5_remoteproc.c | 78 +++++++++--------------- + 1 file changed, 30 insertions(+), 48 deletions(-) + +diff --git a/drivers/remoteproc/ti_k3_r5_remoteproc.c b/drivers/remoteproc/ti_k3_r5_remoteproc.c +index 7c48f41808fa3..15fc663389096 100644 +--- a/drivers/remoteproc/ti_k3_r5_remoteproc.c ++++ b/drivers/remoteproc/ti_k3_r5_remoteproc.c +@@ -194,6 +194,10 @@ static void k3_r5_rproc_mbox_callback(struct mbox_client *client, void *data) + const char *name = kproc->rproc->name; + u32 msg = omap_mbox_message(data); + ++ /* Do not forward message from a detached core */ ++ if (kproc->rproc->state == RPROC_DETACHED) ++ return; ++ + dev_dbg(dev, "mbox msg: 0x%x\n", msg); + + switch (msg) { +@@ -229,6 +233,10 @@ static void k3_r5_rproc_kick(struct rproc *rproc, int vqid) + mbox_msg_t msg = (mbox_msg_t)vqid; + int ret; + ++ /* Do not forward message to a detached core */ ++ if (kproc->rproc->state == RPROC_DETACHED) ++ return; ++ + /* send the index of the triggered virtqueue in the mailbox payload */ + ret = mbox_send_message(kproc->mbox, (void *)msg); + if (ret < 0) +@@ -399,12 +407,9 @@ static int k3_r5_rproc_request_mbox(struct rproc *rproc) + client->knows_txdone = false; + + kproc->mbox = mbox_request_channel(client, 0); +- if (IS_ERR(kproc->mbox)) { +- ret = -EBUSY; +- dev_err(dev, "mbox_request_channel failed: %ld\n", +- PTR_ERR(kproc->mbox)); +- return ret; +- } ++ if (IS_ERR(kproc->mbox)) ++ return dev_err_probe(dev, PTR_ERR(kproc->mbox), ++ "mbox_request_channel failed\n"); + + /* + * Ping the remote processor, this is only for sanity-sake for now; +@@ -552,10 +557,6 @@ static int k3_r5_rproc_start(struct rproc *rproc) + u32 boot_addr; + int ret; + +- ret = k3_r5_rproc_request_mbox(rproc); +- if (ret) +- return ret; +- + boot_addr = rproc->bootaddr; + /* TODO: add boot_addr sanity checking */ + dev_dbg(dev, "booting R5F core using boot addr = 0x%x\n", boot_addr); +@@ -564,7 +565,7 @@ static int k3_r5_rproc_start(struct rproc *rproc) + core = kproc->core; + ret = ti_sci_proc_set_config(core->tsp, boot_addr, 0, 0); + if (ret) +- goto put_mbox; ++ return ret; + + /* unhalt/run all applicable cores */ + if (cluster->mode == CLUSTER_MODE_LOCKSTEP) { +@@ -580,13 +581,12 @@ static int k3_r5_rproc_start(struct rproc *rproc) + if (core != core0 && core0->rproc->state == RPROC_OFFLINE) { + dev_err(dev, "%s: can not start core 1 before core 0\n", + __func__); +- ret = -EPERM; +- goto put_mbox; ++ return -EPERM; + } + + ret = k3_r5_core_run(core); + if (ret) +- goto put_mbox; ++ return ret; + } + + return 0; +@@ -596,8 +596,6 @@ static int k3_r5_rproc_start(struct rproc *rproc) + if (k3_r5_core_halt(core)) + dev_warn(core->dev, "core halt back failed\n"); + } +-put_mbox: +- mbox_free_channel(kproc->mbox); + return ret; + } + +@@ -658,8 +656,6 @@ static int k3_r5_rproc_stop(struct rproc *rproc) + goto out; + } + +- mbox_free_channel(kproc->mbox); +- + return 0; + + unroll_core_halt: +@@ -674,42 +670,22 @@ static int k3_r5_rproc_stop(struct rproc *rproc) + /* + * Attach to a running R5F remote processor (IPC-only mode) + * +- * The R5F attach callback only needs to request the mailbox, the remote +- * processor is already booted, so there is no need to issue any TI-SCI +- * commands to boot the R5F cores in IPC-only mode. This callback is invoked +- * only in IPC-only mode. ++ * The R5F attach callback is a NOP. The remote processor is already booted, and ++ * all required resources have been acquired during probe routine, so there is ++ * no need to issue any TI-SCI commands to boot the R5F cores in IPC-only mode. ++ * This callback is invoked only in IPC-only mode and exists because ++ * rproc_validate() checks for its existence. + */ +-static int k3_r5_rproc_attach(struct rproc *rproc) +-{ +- struct k3_r5_rproc *kproc = rproc->priv; +- struct device *dev = kproc->dev; +- int ret; +- +- ret = k3_r5_rproc_request_mbox(rproc); +- if (ret) +- return ret; +- +- dev_info(dev, "R5F core initialized in IPC-only mode\n"); +- return 0; +-} ++static int k3_r5_rproc_attach(struct rproc *rproc) { return 0; } + + /* + * Detach from a running R5F remote processor (IPC-only mode) + * +- * The R5F detach callback performs the opposite operation to attach callback +- * and only needs to release the mailbox, the R5F cores are not stopped and +- * will be left in booted state in IPC-only mode. This callback is invoked +- * only in IPC-only mode. ++ * The R5F detach callback is a NOP. The R5F cores are not stopped and will be ++ * left in booted state in IPC-only mode. This callback is invoked only in ++ * IPC-only mode and exists for sanity sake. + */ +-static int k3_r5_rproc_detach(struct rproc *rproc) +-{ +- struct k3_r5_rproc *kproc = rproc->priv; +- struct device *dev = kproc->dev; +- +- mbox_free_channel(kproc->mbox); +- dev_info(dev, "R5F core deinitialized in IPC-only mode\n"); +- return 0; +-} ++static int k3_r5_rproc_detach(struct rproc *rproc) { return 0; } + + /* + * This function implements the .get_loaded_rsc_table() callback and is used +@@ -1277,6 +1253,10 @@ static int k3_r5_cluster_rproc_init(struct platform_device *pdev) + kproc->rproc = rproc; + core->rproc = rproc; + ++ ret = k3_r5_rproc_request_mbox(rproc); ++ if (ret) ++ return ret; ++ + ret = k3_r5_rproc_configure_mode(kproc); + if (ret < 0) + goto err_config; +@@ -1395,6 +1375,8 @@ static void k3_r5_cluster_rproc_exit(void *data) + } + } + ++ mbox_free_channel(kproc->mbox); ++ + rproc_del(rproc); + + k3_r5_reserved_mem_exit(kproc); +-- +2.43.0 + diff --git a/queue-6.6/remoteproc-k3-r5-delay-notification-of-wakeup-event.patch b/queue-6.6/remoteproc-k3-r5-delay-notification-of-wakeup-event.patch new file mode 100644 index 00000000000..142b5c7e145 --- /dev/null +++ b/queue-6.6/remoteproc-k3-r5-delay-notification-of-wakeup-event.patch @@ -0,0 +1,57 @@ +From 776d9622c6d6a3b926e67c8bb1af1b5c35a9e15b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2024 16:20:04 +0530 +Subject: remoteproc: k3-r5: Delay notification of wakeup event + +From: Udit Kumar + +[ Upstream commit 8fa052c29e509f3e47d56d7fc2ca28094d78c60a ] + +Few times, core1 was scheduled to boot first before core0, which leads +to error: + +'k3_r5_rproc_start: can not start core 1 before core 0'. + +This was happening due to some scheduling between prepare and start +callback. The probe function waits for event, which is getting +triggered by prepare callback. To avoid above condition move event +trigger to start instead of prepare callback. + +Fixes: 61f6f68447ab ("remoteproc: k3-r5: Wait for core0 power-up before powering up core1") +Signed-off-by: Udit Kumar +[ Applied wakeup event trigger only for Split-Mode booted rprocs ] +Signed-off-by: Beleswar Padhi +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240820105004.2788327-1-b-padhi@ti.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/ti_k3_r5_remoteproc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/remoteproc/ti_k3_r5_remoteproc.c b/drivers/remoteproc/ti_k3_r5_remoteproc.c +index 15fc663389096..5491b1b17ca36 100644 +--- a/drivers/remoteproc/ti_k3_r5_remoteproc.c ++++ b/drivers/remoteproc/ti_k3_r5_remoteproc.c +@@ -469,8 +469,6 @@ static int k3_r5_rproc_prepare(struct rproc *rproc) + ret); + return ret; + } +- core->released_from_reset = true; +- wake_up_interruptible(&cluster->core_transition); + + /* + * Newer IP revisions like on J7200 SoCs support h/w auto-initialization +@@ -587,6 +585,9 @@ static int k3_r5_rproc_start(struct rproc *rproc) + ret = k3_r5_core_run(core); + if (ret) + return ret; ++ ++ core->released_from_reset = true; ++ wake_up_interruptible(&cluster->core_transition); + } + + return 0; +-- +2.43.0 + diff --git a/queue-6.6/sched-psi-fix-bogus-pressure-spikes-from-aggregation.patch b/queue-6.6/sched-psi-fix-bogus-pressure-spikes-from-aggregation.patch new file mode 100644 index 00000000000..eaf2b3292cc --- /dev/null +++ b/queue-6.6/sched-psi-fix-bogus-pressure-spikes-from-aggregation.patch @@ -0,0 +1,185 @@ +From 07c94e3c55806362787fcb3fb61f17303f871a27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 07:29:05 -0400 +Subject: sched: psi: fix bogus pressure spikes from aggregation race + +From: Johannes Weiner + +[ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] + +Brandon reports sporadic, non-sensical spikes in cumulative pressure +time (total=) when reading cpu.pressure at a high rate. This is due to +a race condition between reader aggregation and tasks changing states. + +While it affects all states and all resources captured by PSI, in +practice it most likely triggers with CPU pressure, since scheduling +events are so frequent compared to other resource events. + +The race context is the live snooping of ongoing stalls during a +pressure read. The read aggregates per-cpu records for stalls that +have concluded, but will also incorporate ad-hoc the duration of any +active state that hasn't been recorded yet. This is important to get +timely measurements of ongoing stalls. Those ad-hoc samples are +calculated on-the-fly up to the current time on that CPU; since the +stall hasn't concluded, it's expected that this is the minimum amount +of stall time that will enter the per-cpu records once it does. + +The problem is that the path that concludes the state uses a CPU clock +read that is not synchronized against aggregators; the clock is read +outside of the seqlock protection. This allows aggregators to race and +snoop a stall with a longer duration than will actually be recorded. + +With the recorded stall time being less than the last snapshot +remembered by the aggregator, a subsequent sample will underflow and +observe a bogus delta value, resulting in an erratic jump in pressure. + +Fix this by moving the clock read of the state change into the seqlock +protection. This ensures no aggregation can snoop live stalls past the +time that's recorded when the state concludes. + +Reported-by: Brandon Duffany +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 +Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ +Fixes: df77430639c9 ("psi: Reduce calls to sched_clock() in psi") +Cc: stable@vger.kernel.org +Signed-off-by: Johannes Weiner +Reviewed-by: Chengming Zhou +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/sched/psi.c | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c +index 431971acc7632..f97e1473389ff 100644 +--- a/kernel/sched/psi.c ++++ b/kernel/sched/psi.c +@@ -776,13 +776,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) + } + + static void psi_group_change(struct psi_group *group, int cpu, +- unsigned int clear, unsigned int set, u64 now, ++ unsigned int clear, unsigned int set, + bool wake_clock) + { + struct psi_group_cpu *groupc; + unsigned int t, m; + enum psi_states s; + u32 state_mask; ++ u64 now; + + lockdep_assert_rq_held(cpu_rq(cpu)); + groupc = per_cpu_ptr(group->pcpu, cpu); +@@ -797,6 +798,7 @@ static void psi_group_change(struct psi_group *group, int cpu, + * SOME and FULL time these may have resulted in. + */ + write_seqcount_begin(&groupc->seq); ++ now = cpu_clock(cpu); + + /* + * Start with TSK_ONCPU, which doesn't have a corresponding +@@ -910,18 +912,15 @@ void psi_task_change(struct task_struct *task, int clear, int set) + { + int cpu = task_cpu(task); + struct psi_group *group; +- u64 now; + + if (!task->pid) + return; + + psi_flags_change(task, clear, set); + +- now = cpu_clock(cpu); +- + group = task_psi_group(task); + do { +- psi_group_change(group, cpu, clear, set, now, true); ++ psi_group_change(group, cpu, clear, set, true); + } while ((group = group->parent)); + } + +@@ -930,7 +929,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, + { + struct psi_group *group, *common = NULL; + int cpu = task_cpu(prev); +- u64 now = cpu_clock(cpu); + + if (next->pid) { + psi_flags_change(next, 0, TSK_ONCPU); +@@ -947,7 +945,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, + break; + } + +- psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); ++ psi_group_change(group, cpu, 0, TSK_ONCPU, true); + } while ((group = group->parent)); + } + +@@ -985,7 +983,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, + do { + if (group == common) + break; +- psi_group_change(group, cpu, clear, set, now, wake_clock); ++ psi_group_change(group, cpu, clear, set, wake_clock); + } while ((group = group->parent)); + + /* +@@ -997,7 +995,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, + if ((prev->psi_flags ^ next->psi_flags) & ~TSK_ONCPU) { + clear &= ~TSK_ONCPU; + for (; group; group = group->parent) +- psi_group_change(group, cpu, clear, set, now, wake_clock); ++ psi_group_change(group, cpu, clear, set, wake_clock); + } + } + } +@@ -1008,8 +1006,8 @@ void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_st + int cpu = task_cpu(curr); + struct psi_group *group; + struct psi_group_cpu *groupc; +- u64 now, irq; + s64 delta; ++ u64 irq; + + if (!curr->pid) + return; +@@ -1019,7 +1017,6 @@ void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_st + if (prev && task_psi_group(prev) == group) + return; + +- now = cpu_clock(cpu); + irq = irq_time_read(cpu); + delta = (s64)(irq - rq->psi_irq_time); + if (delta < 0) +@@ -1027,12 +1024,15 @@ void psi_account_irqtime(struct rq *rq, struct task_struct *curr, struct task_st + rq->psi_irq_time = irq; + + do { ++ u64 now; ++ + if (!group->enabled) + continue; + + groupc = per_cpu_ptr(group->pcpu, cpu); + + write_seqcount_begin(&groupc->seq); ++ now = cpu_clock(cpu); + + record_times(groupc, now); + groupc->times[PSI_IRQ_FULL] += delta; +@@ -1231,11 +1231,9 @@ void psi_cgroup_restart(struct psi_group *group) + for_each_possible_cpu(cpu) { + struct rq *rq = cpu_rq(cpu); + struct rq_flags rf; +- u64 now; + + rq_lock_irq(rq, &rf); +- now = cpu_clock(cpu); +- psi_group_change(group, cpu, 0, 0, now, true); ++ psi_group_change(group, cpu, 0, 0, true); + rq_unlock_irq(rq, &rf); + } + } +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 4c523281985..d6fffca1fbf 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -324,3 +324,42 @@ drm-i915-gem-fix-bitwise-and-logical-and-mixup.patch drm-sched-add-locking-to-drm_sched_entity_modify_sched.patch drm-amd-display-add-hdr-workaround-for-specific-edp.patch drm-amd-display-fix-system-hang-while-resume-with-tbt-monitor.patch +cpufreq-intel_pstate-make-hwp_notify_lock-a-raw-spin.patch +kconfig-qconf-fix-buffer-overflow-in-debug-links.patch +platform-x86-x86-android-tablets-create-a-platform_d.patch +platform-x86-x86-android-tablets-fix-use-after-free-.patch +i2c-create-debugfs-entry-per-adapter.patch +i2c-core-lock-address-during-client-device-instantia.patch +i2c-synquacer-remove-a-clk-reference-from-struct-syn.patch +i2c-synquacer-deal-with-optional-pclk-correctly.patch +arm64-cputype-add-neoverse-n3-definitions.patch +arm64-errata-expand-speculative-ssbs-workaround-once.patch +io_uring-net-harden-multishot-termination-case-for-r.patch +uprobes-fix-kernel-info-leak-via-uprobes-vma.patch +mm-z3fold-deprecate-config_z3fold.patch +drm-amd-display-allow-backlight-to-go-below-amdgpu_d.patch +build-id-require-program-headers-to-be-right-after-e.patch +lib-buildid-harden-build-id-parsing-logic.patch +sched-psi-fix-bogus-pressure-spikes-from-aggregation.patch +net-mana-enable-mana-driver-on-arm64-with-4k-page-si.patch +net-mana-add-support-for-page-sizes-other-than-4kb-o.patch +rdma-mana_ib-use-the-correct-page-table-index-based-.patch +media-i2c-imx335-enable-regulator-supplies.patch +media-imx335-fix-reset-gpio-handling.patch +remoteproc-k3-r5-acquire-mailbox-handle-during-probe.patch +remoteproc-k3-r5-delay-notification-of-wakeup-event.patch +dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch +dt-bindings-clock-qcom-add-gpll9-support-on-gcc-sc81.patch +iio-pressure-bmp280-allow-multiple-chips-id-per-fami.patch +iio-pressure-bmp280-improve-indentation-and-line-wra.patch +iio-pressure-bmp280-use-bme-prefix-for-bme280-specif.patch +iio-pressure-bmp280-fix-regmap-for-bmp280-device.patch +iio-pressure-bmp280-fix-waiting-time-for-bmp3xx-conf.patch +r8169-fix-spelling-mistake-tx_underun-tx_underrun.patch +r8169-add-tally-counter-fields-added-with-rtl8125.patch +clk-qcom-gcc-sc8180x-add-gpll9-support.patch +acpi-battery-simplify-battery-hook-locking.patch +acpi-battery-fix-possible-crash-when-unregistering-a.patch +btrfs-relocation-return-bool-from-btrfs_should_ignor.patch +btrfs-relocation-constify-parameters-where-possible.patch +btrfs-drop-the-backref-cache-during-relocation-if-we.patch diff --git a/queue-6.6/uprobes-fix-kernel-info-leak-via-uprobes-vma.patch b/queue-6.6/uprobes-fix-kernel-info-leak-via-uprobes-vma.patch new file mode 100644 index 00000000000..10498c25f3c --- /dev/null +++ b/queue-6.6/uprobes-fix-kernel-info-leak-via-uprobes-vma.patch @@ -0,0 +1,43 @@ +From c2a609463a8899c64a7d844f37dde9dedd6abf0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 19:46:01 +0200 +Subject: uprobes: fix kernel info leak via "[uprobes]" vma + +From: Oleg Nesterov + +commit 34820304cc2cd1804ee1f8f3504ec77813d29c8e upstream. + +xol_add_vma() maps the uninitialized page allocated by __create_xol_area() +into userspace. On some architectures (x86) this memory is readable even +without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, +although this doesn't really matter, debugger can read this memory anyway. + +Link: https://lore.kernel.org/all/20240929162047.GA12611@redhat.com/ + +Reported-by: Will Deacon +Fixes: d4b3b6384f98 ("uprobes/core: Allocate XOL slots for uprobes use") +Cc: stable@vger.kernel.org +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Oleg Nesterov +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + kernel/events/uprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index 6876b7f152b10..6dac0b5798213 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -1491,7 +1491,7 @@ static struct xol_area *__create_xol_area(unsigned long vaddr) + + area->xol_mapping.name = "[uprobes]"; + area->xol_mapping.pages = area->pages; +- area->pages[0] = alloc_page(GFP_HIGHUSER); ++ area->pages[0] = alloc_page(GFP_HIGHUSER | __GFP_ZERO); + if (!area->pages[0]) + goto free_bitmap; + area->pages[1] = NULL; +-- +2.43.0 +