From: Greg Kroah-Hartman Date: Sun, 22 Dec 2024 07:32:00 +0000 (+0100) Subject: 6.12-stable patches X-Git-Tag: v6.1.122~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a1ef2ec741e4cfb6d984b4c08e05fd5adb9e27f6;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: block-revert-block-fix-potential-deadlock-while-freezing-queue-and-acquiring-sysfs_lock.patch chelsio-chtls-prevent-potential-integer-overflow-on-32bit.patch drm-amd-update-strapping-for-nbio-2.5.0.patch drm-amdgpu-fix-amdgpu_coredump.patch drm-amdgpu-handle-null-bo-tbo.resource-again-in-amdgpu_vm_bo_update.patch drm-display-use-err_ptr-on-dp-tunnel-manager-creation-fail.patch drm-modes-avoid-divide-by-zero-harder-in-drm_mode_vrefresh.patch edac-amd64-simplify-ecc-check-on-unified-memory-controllers.patch efivarfs-fix-error-on-non-existent-file.patch hexagon-disable-constant-extender-optimization-for-llvm-prior-to-19.1.0.patch i2c-riic-always-round-up-when-calculating-bus-period.patch irqchip-gic-v3-work-around-insecure-gic-integrations.patch kvm-arm64-do-not-allow-id_aa64mmfr0_el1.asidbits-to-be-overridden.patch kvm-x86-cache-cpuid.0xd-xstate-offsets-sizes-during-module-init.patch mmc-mtk-sd-disable-wakeup-in-.remove-and-in-the-error-path-of-.probe.patch mmc-sdhci-tegra-remove-sdhci_quirk_broken_adma_zerolen_desc-quirk.patch net-mctp-handle-skb-cleanup-on-sock_queue-failures.patch net-tun-fix-tun_napi_alloc_frags.patch thunderbolt-add-support-for-intel-panther-lake-m-p.patch thunderbolt-don-t-display-nvm_version-unless-upgrade-supported.patch thunderbolt-improve-redrive-mode-handling.patch usb-serial-option-add-mediatek-t7xx-compositions.patch usb-serial-option-add-meig-smart-slm770a.patch usb-serial-option-add-netprisma-lcuk54-modules-for-wwan-ready.patch usb-serial-option-add-tcl-ik512-mbim-ecm.patch usb-serial-option-add-telit-fe910c04-rmnet-compositions.patch xhci-turn-nec-specific-quirk-for-handling-stop-endpoint-errors-generic.patch --- diff --git a/queue-6.12/block-revert-block-fix-potential-deadlock-while-freezing-queue-and-acquiring-sysfs_lock.patch b/queue-6.12/block-revert-block-fix-potential-deadlock-while-freezing-queue-and-acquiring-sysfs_lock.patch new file mode 100644 index 00000000000..7336ef354e0 --- /dev/null +++ b/queue-6.12/block-revert-block-fix-potential-deadlock-while-freezing-queue-and-acquiring-sysfs_lock.patch @@ -0,0 +1,196 @@ +From 224749be6c23efe7fb8a030854f4fc5d1dd813b3 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Wed, 18 Dec 2024 18:16:14 +0800 +Subject: block: Revert "block: Fix potential deadlock while freezing queue and acquiring sysfs_lock" + +From: Ming Lei + +commit 224749be6c23efe7fb8a030854f4fc5d1dd813b3 upstream. + +This reverts commit be26ba96421ab0a8fa2055ccf7db7832a13c44d2. + +Commit be26ba96421a ("block: Fix potential deadlock while freezing queue and +acquiring sysfs_loc") actually reverts commit 22465bbac53c ("blk-mq: move cpuhp +callback registering out of q->sysfs_lock"), and causes the original resctrl +lockdep warning. + +So revert it and we need to fix the issue in another way. + +Cc: Nilay Shroff +Fixes: be26ba96421a ("block: Fix potential deadlock while freezing queue and acquiring sysfs_loc") +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20241218101617.3275704-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-mq-sysfs.c | 16 ++++++++++------ + block/blk-mq.c | 29 +++++++++++------------------ + block/blk-sysfs.c | 4 ++-- + 3 files changed, 23 insertions(+), 26 deletions(-) + +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -275,13 +275,15 @@ void blk_mq_sysfs_unregister_hctxs(struc + struct blk_mq_hw_ctx *hctx; + unsigned long i; + +- lockdep_assert_held(&q->sysfs_dir_lock); +- ++ mutex_lock(&q->sysfs_dir_lock); + if (!q->mq_sysfs_init_done) +- return; ++ goto unlock; + + queue_for_each_hw_ctx(q, hctx, i) + blk_mq_unregister_hctx(hctx); ++ ++unlock: ++ mutex_unlock(&q->sysfs_dir_lock); + } + + int blk_mq_sysfs_register_hctxs(struct request_queue *q) +@@ -290,10 +292,9 @@ int blk_mq_sysfs_register_hctxs(struct r + unsigned long i; + int ret = 0; + +- lockdep_assert_held(&q->sysfs_dir_lock); +- ++ mutex_lock(&q->sysfs_dir_lock); + if (!q->mq_sysfs_init_done) +- return ret; ++ goto unlock; + + queue_for_each_hw_ctx(q, hctx, i) { + ret = blk_mq_register_hctx(hctx); +@@ -301,5 +302,8 @@ int blk_mq_sysfs_register_hctxs(struct r + break; + } + ++unlock: ++ mutex_unlock(&q->sysfs_dir_lock); ++ + return ret; + } +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -4462,8 +4462,7 @@ static void blk_mq_realloc_hw_ctxs(struc + unsigned long i, j; + + /* protect against switching io scheduler */ +- lockdep_assert_held(&q->sysfs_lock); +- ++ mutex_lock(&q->sysfs_lock); + for (i = 0; i < set->nr_hw_queues; i++) { + int old_node; + int node = blk_mq_get_hctx_node(set, i); +@@ -4496,6 +4495,7 @@ static void blk_mq_realloc_hw_ctxs(struc + + xa_for_each_start(&q->hctx_table, j, hctx, j) + blk_mq_exit_hctx(q, set, hctx, j); ++ mutex_unlock(&q->sysfs_lock); + + /* unregister cpuhp callbacks for exited hctxs */ + blk_mq_remove_hw_queues_cpuhp(q); +@@ -4527,14 +4527,10 @@ int blk_mq_init_allocated_queue(struct b + + xa_init(&q->hctx_table); + +- mutex_lock(&q->sysfs_lock); +- + blk_mq_realloc_hw_ctxs(set, q); + if (!q->nr_hw_queues) + goto err_hctxs; + +- mutex_unlock(&q->sysfs_lock); +- + INIT_WORK(&q->timeout_work, blk_mq_timeout_work); + blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ); + +@@ -4553,7 +4549,6 @@ int blk_mq_init_allocated_queue(struct b + return 0; + + err_hctxs: +- mutex_unlock(&q->sysfs_lock); + blk_mq_release(q); + err_exit: + q->mq_ops = NULL; +@@ -4934,12 +4929,12 @@ static bool blk_mq_elv_switch_none(struc + return false; + + /* q->elevator needs protection from ->sysfs_lock */ +- lockdep_assert_held(&q->sysfs_lock); ++ mutex_lock(&q->sysfs_lock); + + /* the check has to be done with holding sysfs_lock */ + if (!q->elevator) { + kfree(qe); +- goto out; ++ goto unlock; + } + + INIT_LIST_HEAD(&qe->node); +@@ -4949,7 +4944,9 @@ static bool blk_mq_elv_switch_none(struc + __elevator_get(qe->type); + list_add(&qe->node, head); + elevator_disable(q); +-out: ++unlock: ++ mutex_unlock(&q->sysfs_lock); ++ + return true; + } + +@@ -4978,9 +4975,11 @@ static void blk_mq_elv_switch_back(struc + list_del(&qe->node); + kfree(qe); + ++ mutex_lock(&q->sysfs_lock); + elevator_switch(q, t); + /* drop the reference acquired in blk_mq_elv_switch_none */ + elevator_put(t); ++ mutex_unlock(&q->sysfs_lock); + } + + static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, +@@ -5000,11 +4999,8 @@ static void __blk_mq_update_nr_hw_queues + if (set->nr_maps == 1 && nr_hw_queues == set->nr_hw_queues) + return; + +- list_for_each_entry(q, &set->tag_list, tag_set_list) { +- mutex_lock(&q->sysfs_dir_lock); +- mutex_lock(&q->sysfs_lock); ++ list_for_each_entry(q, &set->tag_list, tag_set_list) + blk_mq_freeze_queue(q); +- } + /* + * Switch IO scheduler to 'none', cleaning up the data associated + * with the previous scheduler. We will switch back once we are done +@@ -5060,11 +5056,8 @@ switch_back: + list_for_each_entry(q, &set->tag_list, tag_set_list) + blk_mq_elv_switch_back(&head, q); + +- list_for_each_entry(q, &set->tag_list, tag_set_list) { ++ list_for_each_entry(q, &set->tag_list, tag_set_list) + blk_mq_unfreeze_queue(q); +- mutex_unlock(&q->sysfs_lock); +- mutex_unlock(&q->sysfs_dir_lock); +- } + + /* Free the excess tags when nr_hw_queues shrink. */ + for (i = set->nr_hw_queues; i < prev_nr_hw_queues; i++) +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -690,11 +690,11 @@ queue_attr_store(struct kobject *kobj, s + return res; + } + +- mutex_lock(&q->sysfs_lock); + blk_mq_freeze_queue(q); ++ mutex_lock(&q->sysfs_lock); + res = entry->store(disk, page, length); +- blk_mq_unfreeze_queue(q); + mutex_unlock(&q->sysfs_lock); ++ blk_mq_unfreeze_queue(q); + return res; + } + diff --git a/queue-6.12/chelsio-chtls-prevent-potential-integer-overflow-on-32bit.patch b/queue-6.12/chelsio-chtls-prevent-potential-integer-overflow-on-32bit.patch new file mode 100644 index 00000000000..bb08f07ff78 --- /dev/null +++ b/queue-6.12/chelsio-chtls-prevent-potential-integer-overflow-on-32bit.patch @@ -0,0 +1,39 @@ +From fbbd84af6ba70334335bdeba3ae536cf751c14c6 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 13 Dec 2024 12:47:27 +0300 +Subject: chelsio/chtls: prevent potential integer overflow on 32bit + +From: Dan Carpenter + +commit fbbd84af6ba70334335bdeba3ae536cf751c14c6 upstream. + +The "gl->tot_len" variable is controlled by the user. It comes from +process_responses(). On 32bit systems, the "gl->tot_len + +sizeof(struct cpl_pass_accept_req) + sizeof(struct rss_header)" addition +could have an integer wrapping bug. Use size_add() to prevent this. + +Fixes: a08943947873 ("crypto: chtls - Register chtls with net tls") +Cc: stable@vger.kernel.org +Signed-off-by: Dan Carpenter +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/c6bfb23c-2db2-4e1b-b8ab-ba3925c82ef5@stanley.mountain +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_main.c ++++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_main.c +@@ -346,8 +346,9 @@ static struct sk_buff *copy_gl_to_skb_pk + * driver. Once driver synthesizes cpl_pass_accpet_req the skb will go + * through the regular cpl_pass_accept_req processing in TOM. + */ +- skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req) +- - pktshift, GFP_ATOMIC); ++ skb = alloc_skb(size_add(gl->tot_len, ++ sizeof(struct cpl_pass_accept_req)) - ++ pktshift, GFP_ATOMIC); + if (unlikely(!skb)) + return NULL; + __skb_put(skb, gl->tot_len + sizeof(struct cpl_pass_accept_req) diff --git a/queue-6.12/drm-amd-update-strapping-for-nbio-2.5.0.patch b/queue-6.12/drm-amd-update-strapping-for-nbio-2.5.0.patch new file mode 100644 index 00000000000..9e6d3da6e8f --- /dev/null +++ b/queue-6.12/drm-amd-update-strapping-for-nbio-2.5.0.patch @@ -0,0 +1,48 @@ +From a7f9d98eb1202132014ba760c26ad8608ffc9caf Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Tue, 10 Dec 2024 20:44:14 -0600 +Subject: drm/amd: Update strapping for NBIO 2.5.0 + +From: Mario Limonciello + +commit a7f9d98eb1202132014ba760c26ad8608ffc9caf upstream. + +This helps to avoid a spurious PME event on hotplug to Azalia. + +Cc: Vijendar Mukunda +Reported-and-tested-by: ionut_n2001@yahoo.com +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215884 +Tested-by: Gabriel Marcano +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20241211024414.7840-1-mario.limonciello@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 3f6f237b9dd189e1fb85b8a3f7c97a8f27c1e49a) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/nbio_v7_0.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_0.c +@@ -271,8 +271,19 @@ const struct nbio_hdp_flush_reg nbio_v7_ + .ref_and_mask_sdma1 = GPU_HDP_FLUSH_DONE__SDMA1_MASK, + }; + ++#define regRCC_DEV0_EPF6_STRAP4 0xd304 ++#define regRCC_DEV0_EPF6_STRAP4_BASE_IDX 5 ++ + static void nbio_v7_0_init_registers(struct amdgpu_device *adev) + { ++ uint32_t data; ++ ++ switch (adev->ip_versions[NBIO_HWIP][0]) { ++ case IP_VERSION(2, 5, 0): ++ data = RREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF6_STRAP4) & ~BIT(23); ++ WREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF6_STRAP4, data); ++ break; ++ } + } + + #define MMIO_REG_HOLE_OFFSET (0x80000 - PAGE_SIZE) diff --git a/queue-6.12/drm-amdgpu-fix-amdgpu_coredump.patch b/queue-6.12/drm-amdgpu-fix-amdgpu_coredump.patch new file mode 100644 index 00000000000..226c64db90b --- /dev/null +++ b/queue-6.12/drm-amdgpu-fix-amdgpu_coredump.patch @@ -0,0 +1,41 @@ +From 8d1a13816e59254bd3b18f5ae0895230922bd120 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Thu, 12 Dec 2024 16:29:18 +0100 +Subject: drm/amdgpu: fix amdgpu_coredump +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +commit 8d1a13816e59254bd3b18f5ae0895230922bd120 upstream. + +The VM pointer might already be outdated when that function is called. +Use the PASID instead to gather the information instead. + +Signed-off-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 57f812d171af4ba233d3ed7c94dfa5b8e92dcc04) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c +@@ -345,11 +345,10 @@ void amdgpu_coredump(struct amdgpu_devic + coredump->skip_vram_check = skip_vram_check; + coredump->reset_vram_lost = vram_lost; + +- if (job && job->vm) { +- struct amdgpu_vm *vm = job->vm; ++ if (job && job->pasid) { + struct amdgpu_task_info *ti; + +- ti = amdgpu_vm_get_task_info_vm(vm); ++ ti = amdgpu_vm_get_task_info_pasid(adev, job->pasid); + if (ti) { + coredump->reset_task_info = *ti; + amdgpu_vm_put_task_info(ti); diff --git a/queue-6.12/drm-amdgpu-handle-null-bo-tbo.resource-again-in-amdgpu_vm_bo_update.patch b/queue-6.12/drm-amdgpu-handle-null-bo-tbo.resource-again-in-amdgpu_vm_bo_update.patch new file mode 100644 index 00000000000..2e315f286b8 --- /dev/null +++ b/queue-6.12/drm-amdgpu-handle-null-bo-tbo.resource-again-in-amdgpu_vm_bo_update.patch @@ -0,0 +1,42 @@ +From 85230ee36d88e7a09fb062d43203035659dd10a5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Tue, 17 Dec 2024 18:22:56 +0100 +Subject: drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michel Dänzer + +commit 85230ee36d88e7a09fb062d43203035659dd10a5 upstream. + +Third time's the charm, I hope? + +Fixes: d3116756a710 ("drm/ttm: rename bo->mem and make it a pointer") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3837 +Reviewed-by: Christian König +Signed-off-by: Michel Dänzer +Signed-off-by: Alex Deucher +(cherry picked from commit 695c2c745e5dff201b75da8a1d237ce403600d04) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -1260,10 +1260,9 @@ int amdgpu_vm_bo_update(struct amdgpu_de + * next command submission. + */ + if (amdgpu_vm_is_bo_always_valid(vm, bo)) { +- uint32_t mem_type = bo->tbo.resource->mem_type; +- +- if (!(bo->preferred_domains & +- amdgpu_mem_type_to_domain(mem_type))) ++ if (bo->tbo.resource && ++ !(bo->preferred_domains & ++ amdgpu_mem_type_to_domain(bo->tbo.resource->mem_type))) + amdgpu_vm_bo_evicted(&bo_va->base); + else + amdgpu_vm_bo_idle(&bo_va->base); diff --git a/queue-6.12/drm-display-use-err_ptr-on-dp-tunnel-manager-creation-fail.patch b/queue-6.12/drm-display-use-err_ptr-on-dp-tunnel-manager-creation-fail.patch new file mode 100644 index 00000000000..c306e48ccbd --- /dev/null +++ b/queue-6.12/drm-display-use-err_ptr-on-dp-tunnel-manager-creation-fail.patch @@ -0,0 +1,79 @@ +From 080b2e7b5e9ad23343e4b11f0751e4c724a78958 Mon Sep 17 00:00:00 2001 +From: Krzysztof Karas +Date: Thu, 12 Dec 2024 11:00:41 +0000 +Subject: drm/display: use ERR_PTR on DP tunnel manager creation fail + +From: Krzysztof Karas + +commit 080b2e7b5e9ad23343e4b11f0751e4c724a78958 upstream. + +Instead of returning a generic NULL on error from +drm_dp_tunnel_mgr_create(), use error pointers with informative codes +to align the function with stub that is executed when +CONFIG_DRM_DISPLAY_DP_TUNNEL is unset. This will also trigger IS_ERR() +in current caller (intel_dp_tunnerl_mgr_init()) instead of bypassing it +via NULL pointer. + +v2: use error codes inside drm_dp_tunnel_mgr_create() instead of handling + on caller's side (Michal, Imre) + +v3: fixup commit message and add "CC"/"Fixes" lines (Andi), + mention aligning function code with stub + +Fixes: 91888b5b1ad2 ("drm/i915/dp: Add support for DP tunnel BW allocation") +Cc: Imre Deak +Cc: # v6.9+ +Signed-off-by: Krzysztof Karas +Reviewed-by: Andi Shyti +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/7q4fpnmmztmchczjewgm6igy55qt6jsm7tfd4fl4ucfq6yg2oy@q4lxtsu6445c +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_tunnel.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_tunnel.c b/drivers/gpu/drm/display/drm_dp_tunnel.c +index 48b2df120086..90fe07a89260 100644 +--- a/drivers/gpu/drm/display/drm_dp_tunnel.c ++++ b/drivers/gpu/drm/display/drm_dp_tunnel.c +@@ -1896,8 +1896,8 @@ static void destroy_mgr(struct drm_dp_tunnel_mgr *mgr) + * + * Creates a DP tunnel manager for @dev. + * +- * Returns a pointer to the tunnel manager if created successfully or NULL in +- * case of an error. ++ * Returns a pointer to the tunnel manager if created successfully or error ++ * pointer in case of failure. + */ + struct drm_dp_tunnel_mgr * + drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count) +@@ -1907,7 +1907,7 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count) + + mgr = kzalloc(sizeof(*mgr), GFP_KERNEL); + if (!mgr) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + mgr->dev = dev; + init_waitqueue_head(&mgr->bw_req_queue); +@@ -1916,7 +1916,7 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count) + if (!mgr->groups) { + kfree(mgr); + +- return NULL; ++ return ERR_PTR(-ENOMEM); + } + + #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG +@@ -1927,7 +1927,7 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count) + if (!init_group(mgr, &mgr->groups[i])) { + destroy_mgr(mgr); + +- return NULL; ++ return ERR_PTR(-ENOMEM); + } + + mgr->group_count++; +-- +2.47.1 + diff --git a/queue-6.12/drm-modes-avoid-divide-by-zero-harder-in-drm_mode_vrefresh.patch b/queue-6.12/drm-modes-avoid-divide-by-zero-harder-in-drm_mode_vrefresh.patch new file mode 100644 index 00000000000..9c14134ee0b --- /dev/null +++ b/queue-6.12/drm-modes-avoid-divide-by-zero-harder-in-drm_mode_vrefresh.patch @@ -0,0 +1,58 @@ +From 9398332f23fab10c5ec57c168b44e72997d6318e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Fri, 29 Nov 2024 06:26:28 +0200 +Subject: drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 9398332f23fab10c5ec57c168b44e72997d6318e upstream. + +drm_mode_vrefresh() is trying to avoid divide by zero +by checking whether htotal or vtotal are zero. But we may +still end up with a div-by-zero of vtotal*htotal*... + +Cc: stable@vger.kernel.org +Reported-by: syzbot+622bba18029bcde672e1@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=622bba18029bcde672e1 +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20241129042629.18280-2-ville.syrjala@linux.intel.com +Reviewed-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_modes.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/drm_modes.c ++++ b/drivers/gpu/drm/drm_modes.c +@@ -1287,14 +1287,11 @@ EXPORT_SYMBOL(drm_mode_set_name); + */ + int drm_mode_vrefresh(const struct drm_display_mode *mode) + { +- unsigned int num, den; ++ unsigned int num = 1, den = 1; + + if (mode->htotal == 0 || mode->vtotal == 0) + return 0; + +- num = mode->clock; +- den = mode->htotal * mode->vtotal; +- + if (mode->flags & DRM_MODE_FLAG_INTERLACE) + num *= 2; + if (mode->flags & DRM_MODE_FLAG_DBLSCAN) +@@ -1302,6 +1299,12 @@ int drm_mode_vrefresh(const struct drm_d + if (mode->vscan > 1) + den *= mode->vscan; + ++ if (check_mul_overflow(mode->clock, num, &num)) ++ return 0; ++ ++ if (check_mul_overflow(mode->htotal * mode->vtotal, den, &den)) ++ return 0; ++ + return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(num, 1000), den); + } + EXPORT_SYMBOL(drm_mode_vrefresh); diff --git a/queue-6.12/edac-amd64-simplify-ecc-check-on-unified-memory-controllers.patch b/queue-6.12/edac-amd64-simplify-ecc-check-on-unified-memory-controllers.patch new file mode 100644 index 00000000000..e80e4fbed34 --- /dev/null +++ b/queue-6.12/edac-amd64-simplify-ecc-check-on-unified-memory-controllers.patch @@ -0,0 +1,76 @@ +From 747367340ca6b5070728b86ae36ad6747f66b2fb Mon Sep 17 00:00:00 2001 +From: "Borislav Petkov (AMD)" +Date: Wed, 11 Dec 2024 12:07:42 +0100 +Subject: EDAC/amd64: Simplify ECC check on unified memory controllers + +From: Borislav Petkov (AMD) + +commit 747367340ca6b5070728b86ae36ad6747f66b2fb upstream. + +The intent of the check is to see whether at least one UMC has ECC +enabled. So do that instead of tracking which ones are enabled in masks +which are too small in size anyway and lead to not loading the driver on +Zen4 machines with UMCs enabled over UMC8. + +Fixes: e2be5955a886 ("EDAC/amd64: Add support for AMD Family 19h Models 10h-1Fh and A0h-AFh") +Reported-by: Avadhut Naik +Signed-off-by: Borislav Petkov (AMD) +Tested-by: Avadhut Naik +Reviewed-by: Avadhut Naik +Cc: +Link: https://lore.kernel.org/r/20241210212054.3895697-1-avadhut.naik@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/amd64_edac.c | 34 +++++++++++----------------------- + 1 file changed, 11 insertions(+), 23 deletions(-) + +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -3362,36 +3362,24 @@ static bool dct_ecc_enabled(struct amd64 + + static bool umc_ecc_enabled(struct amd64_pvt *pvt) + { +- u8 umc_en_mask = 0, ecc_en_mask = 0; +- u16 nid = pvt->mc_node_id; + struct amd64_umc *umc; +- u8 ecc_en = 0, i; ++ bool ecc_en = false; ++ int i; + ++ /* Check whether at least one UMC is enabled: */ + for_each_umc(i) { + umc = &pvt->umc[i]; + +- /* Only check enabled UMCs. */ +- if (!(umc->sdp_ctrl & UMC_SDP_INIT)) +- continue; +- +- umc_en_mask |= BIT(i); +- +- if (umc->umc_cap_hi & UMC_ECC_ENABLED) +- ecc_en_mask |= BIT(i); ++ if (umc->sdp_ctrl & UMC_SDP_INIT && ++ umc->umc_cap_hi & UMC_ECC_ENABLED) { ++ ecc_en = true; ++ break; ++ } + } + +- /* Check whether at least one UMC is enabled: */ +- if (umc_en_mask) +- ecc_en = umc_en_mask == ecc_en_mask; +- else +- edac_dbg(0, "Node %d: No enabled UMCs.\n", nid); +- +- edac_dbg(3, "Node %d: DRAM ECC %s.\n", nid, (ecc_en ? "enabled" : "disabled")); +- +- if (!ecc_en) +- return false; +- else +- return true; ++ edac_dbg(3, "Node %d: DRAM ECC %s.\n", pvt->mc_node_id, (ecc_en ? "enabled" : "disabled")); ++ ++ return ecc_en; + } + + static inline void diff --git a/queue-6.12/efivarfs-fix-error-on-non-existent-file.patch b/queue-6.12/efivarfs-fix-error-on-non-existent-file.patch new file mode 100644 index 00000000000..414a894367d --- /dev/null +++ b/queue-6.12/efivarfs-fix-error-on-non-existent-file.patch @@ -0,0 +1,64 @@ +From 2ab0837cb91b7de507daa145d17b3b6b2efb3abf Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Sun, 8 Dec 2024 13:34:13 -0500 +Subject: efivarfs: Fix error on non-existent file + +From: James Bottomley + +commit 2ab0837cb91b7de507daa145d17b3b6b2efb3abf upstream. + +When looking up a non-existent file, efivarfs returns -EINVAL if the +file does not conform to the NAME-GUID format and -ENOENT if it does. +This is caused by efivars_d_hash() returning -EINVAL if the name is not +formatted correctly. This error is returned before simple_lookup() +returns a negative dentry, and is the error value that the user sees. + +Fix by removing this check. If the file does not exist, simple_lookup() +will return a negative dentry leading to -ENOENT and efivarfs_create() +already has a validity check before it creates an entry (and will +correctly return -EINVAL) + +Signed-off-by: James Bottomley +Cc: +[ardb: make efivarfs_valid_name() static] +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman +--- + fs/efivarfs/inode.c | 2 +- + fs/efivarfs/internal.h | 1 - + fs/efivarfs/super.c | 3 --- + 3 files changed, 1 insertion(+), 5 deletions(-) + +--- a/fs/efivarfs/inode.c ++++ b/fs/efivarfs/inode.c +@@ -51,7 +51,7 @@ struct inode *efivarfs_get_inode(struct + * + * VariableName-12345678-1234-1234-1234-1234567891bc + */ +-bool efivarfs_valid_name(const char *str, int len) ++static bool efivarfs_valid_name(const char *str, int len) + { + const char *s = str + len - EFI_VARIABLE_GUID_LEN; + +--- a/fs/efivarfs/internal.h ++++ b/fs/efivarfs/internal.h +@@ -60,7 +60,6 @@ bool efivar_variable_is_removable(efi_gu + + extern const struct file_operations efivarfs_file_operations; + extern const struct inode_operations efivarfs_dir_inode_operations; +-extern bool efivarfs_valid_name(const char *str, int len); + extern struct inode *efivarfs_get_inode(struct super_block *sb, + const struct inode *dir, int mode, dev_t dev, + bool is_removable); +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -144,9 +144,6 @@ static int efivarfs_d_hash(const struct + const unsigned char *s = qstr->name; + unsigned int len = qstr->len; + +- if (!efivarfs_valid_name(s, len)) +- return -EINVAL; +- + while (len-- > EFI_VARIABLE_GUID_LEN) + hash = partial_name_hash(*s++, hash); + diff --git a/queue-6.12/hexagon-disable-constant-extender-optimization-for-llvm-prior-to-19.1.0.patch b/queue-6.12/hexagon-disable-constant-extender-optimization-for-llvm-prior-to-19.1.0.patch new file mode 100644 index 00000000000..f4c059f953a --- /dev/null +++ b/queue-6.12/hexagon-disable-constant-extender-optimization-for-llvm-prior-to-19.1.0.patch @@ -0,0 +1,52 @@ +From aef25be35d23ec768eed08bfcf7ca3cf9685bc28 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Thu, 21 Nov 2024 11:22:18 -0700 +Subject: hexagon: Disable constant extender optimization for LLVM prior to 19.1.0 + +From: Nathan Chancellor + +commit aef25be35d23ec768eed08bfcf7ca3cf9685bc28 upstream. + +The Hexagon-specific constant extender optimization in LLVM may crash on +Linux kernel code [1], such as fs/bcache/btree_io.c after +commit 32ed4a620c54 ("bcachefs: Btree path tracepoints") in 6.12: + + clang: llvm/lib/Target/Hexagon/HexagonConstExtenders.cpp:745: bool (anonymous namespace)::HexagonConstExtenders::ExtRoot::operator<(const HCE::ExtRoot &) const: Assertion `ThisB->getParent() == OtherB->getParent()' failed. + Stack dump: + 0. Program arguments: clang --target=hexagon-linux-musl ... fs/bcachefs/btree_io.c + 1. parser at end of file + 2. Code generation + 3. Running pass 'Function Pass Manager' on module 'fs/bcachefs/btree_io.c'. + 4. Running pass 'Hexagon constant-extender optimization' on function '@__btree_node_lock_nopath' + +Without assertions enabled, there is just a hang during compilation. + +This has been resolved in LLVM main (20.0.0) [2] and backported to LLVM +19.1.0 but the kernel supports LLVM 13.0.1 and newer, so disable the +constant expander optimization using the '-mllvm' option when using a +toolchain that is not fixed. + +Cc: stable@vger.kernel.org +Link: https://github.com/llvm/llvm-project/issues/99714 [1] +Link: https://github.com/llvm/llvm-project/commit/68df06a0b2998765cb0a41353fcf0919bbf57ddb [2] +Link: https://github.com/llvm/llvm-project/commit/2ab8d93061581edad3501561722ebd5632d73892 [3] +Reviewed-by: Brian Cain +Signed-off-by: Nathan Chancellor +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + arch/hexagon/Makefile | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/hexagon/Makefile ++++ b/arch/hexagon/Makefile +@@ -32,3 +32,9 @@ KBUILD_LDFLAGS += $(ldflags-y) + TIR_NAME := r19 + KBUILD_CFLAGS += -ffixed-$(TIR_NAME) -DTHREADINFO_REG=$(TIR_NAME) -D__linux__ + KBUILD_AFLAGS += -DTHREADINFO_REG=$(TIR_NAME) ++ ++# Disable HexagonConstExtenders pass for LLVM versions prior to 19.1.0 ++# https://github.com/llvm/llvm-project/issues/99714 ++ifneq ($(call clang-min-version, 190100),y) ++KBUILD_CFLAGS += -mllvm -hexagon-cext=false ++endif diff --git a/queue-6.12/i2c-riic-always-round-up-when-calculating-bus-period.patch b/queue-6.12/i2c-riic-always-round-up-when-calculating-bus-period.patch new file mode 100644 index 00000000000..0eeb4989788 --- /dev/null +++ b/queue-6.12/i2c-riic-always-round-up-when-calculating-bus-period.patch @@ -0,0 +1,47 @@ +From de6b43798d9043a7c749a0428dbb02d5fff156e5 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Fri, 22 Nov 2024 15:14:35 +0100 +Subject: i2c: riic: Always round-up when calculating bus period + +From: Geert Uytterhoeven + +commit de6b43798d9043a7c749a0428dbb02d5fff156e5 upstream. + +Currently, the RIIC driver may run the I2C bus faster than requested, +which may cause subtle failures. E.g. Biju reported a measured bus +speed of 450 kHz instead of the expected maximum of 400 kHz on RZ/G2L. + +The initial calculation of the bus period uses DIV_ROUND_UP(), to make +sure the actual bus speed never becomes faster than the requested bus +speed. However, the subsequent division-by-two steps do not use +round-up, which may lead to a too-small period, hence a too-fast and +possible out-of-spec bus speed. E.g. on RZ/Five, requesting a bus speed +of 100 resp. 400 kHz will yield too-fast target bus speeds of 100806 +resp. 403226 Hz instead of 97656 resp. 390625 Hz. + +Fix this by using DIV_ROUND_UP() in the subsequent divisions, too. + +Tested on RZ/A1H, RZ/A2M, and RZ/Five. + +Fixes: d982d66514192cdb ("i2c: riic: remove clock and frequency restrictions") +Reported-by: Biju Das +Signed-off-by: Geert Uytterhoeven +Cc: # v4.15+ +Link: https://lore.kernel.org/r/c59aea77998dfea1b4456c4b33b55ab216fcbf5e.1732284746.git.geert+renesas@glider.be +Signed-off-by: Andi Shyti +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-riic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-riic.c ++++ b/drivers/i2c/busses/i2c-riic.c +@@ -352,7 +352,7 @@ static int riic_init_hw(struct riic_dev + if (brl <= (0x1F + 3)) + break; + +- total_ticks /= 2; ++ total_ticks = DIV_ROUND_UP(total_ticks, 2); + rate /= 2; + } + diff --git a/queue-6.12/irqchip-gic-v3-work-around-insecure-gic-integrations.patch b/queue-6.12/irqchip-gic-v3-work-around-insecure-gic-integrations.patch new file mode 100644 index 00000000000..8556f137bae --- /dev/null +++ b/queue-6.12/irqchip-gic-v3-work-around-insecure-gic-integrations.patch @@ -0,0 +1,71 @@ +From 773c05f417fa14e1ac94776619e9c978ec001f0b Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Fri, 13 Dec 2024 14:10:37 +0000 +Subject: irqchip/gic-v3: Work around insecure GIC integrations + +From: Marc Zyngier + +commit 773c05f417fa14e1ac94776619e9c978ec001f0b upstream. + +It appears that the relatively popular RK3399 SoC has been put together +using a large amount of illicit substances, as experiments reveal that its +integration of GIC500 exposes the *secure* programming interface to +non-secure. + +This has some pretty bad effects on the way priorities are handled, and +results in a dead machine if booting with pseudo-NMI enabled +(irqchip.gicv3_pseudo_nmi=1) if the kernel contains 18fdb6348c480 ("arm64: +irqchip/gic-v3: Select priorities at boot time"), which relies on the +priorities being programmed using the NS view. + +Let's restore some sanity by going one step further and disable security +altogether in this case. This is not any worse, and puts us in a mode where +priorities actually make some sense. + +Huge thanks to Mark Kettenis who initially identified this issue on +OpenBSD, and to Chen-Yu Tsai who reported the problem in Linux. + +Fixes: 18fdb6348c480 ("arm64: irqchip/gic-v3: Select priorities at boot time") +Reported-by: Mark Kettenis +Reported-by: Chen-Yu Tsai +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Tested-by: Chen-Yu Tsai +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20241213141037.3995049-1-maz@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-gic-v3.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index 34db379d066a..79d8cc80693c 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -161,7 +161,22 @@ static bool cpus_have_group0 __ro_after_init; + + static void __init gic_prio_init(void) + { +- cpus_have_security_disabled = gic_dist_security_disabled(); ++ bool ds; ++ ++ ds = gic_dist_security_disabled(); ++ if (!ds) { ++ u32 val; ++ ++ val = readl_relaxed(gic_data.dist_base + GICD_CTLR); ++ val |= GICD_CTLR_DS; ++ writel_relaxed(val, gic_data.dist_base + GICD_CTLR); ++ ++ ds = gic_dist_security_disabled(); ++ if (ds) ++ pr_warn("Broken GIC integration, security disabled"); ++ } ++ ++ cpus_have_security_disabled = ds; + cpus_have_group0 = gic_has_group0(); + + /* +-- +2.47.1 + diff --git a/queue-6.12/kvm-arm64-do-not-allow-id_aa64mmfr0_el1.asidbits-to-be-overridden.patch b/queue-6.12/kvm-arm64-do-not-allow-id_aa64mmfr0_el1.asidbits-to-be-overridden.patch new file mode 100644 index 00000000000..d463549b1bf --- /dev/null +++ b/queue-6.12/kvm-arm64-do-not-allow-id_aa64mmfr0_el1.asidbits-to-be-overridden.patch @@ -0,0 +1,61 @@ +From 03c7527e97f73081633d773f9f8c2373f9854b25 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Tue, 3 Dec 2024 19:02:36 +0000 +Subject: KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden + +From: Marc Zyngier + +commit 03c7527e97f73081633d773f9f8c2373f9854b25 upstream. + +Catalin reports that a hypervisor lying to a guest about the size +of the ASID field may result in unexpected issues: + +- if the underlying HW does only supports 8 bit ASIDs, the ASID + field in a TLBI VAE1* operation is only 8 bits, and the HW will + ignore the other 8 bits + +- if on the contrary the HW is 16 bit capable, the ASID field + in the same TLBI operation is always 16 bits, irrespective of + the value of TCR_ELx.AS. + +This could lead to missed invalidations if the guest was lead to +assume that the HW had 8 bit ASIDs while they really are 16 bit wide. + +In order to avoid any potential disaster that would be hard to debug, +prenent the migration between a host with 8 bit ASIDs to one with +wider ASIDs (the converse was obviously always forbidden). This is +also consistent with what we already do for VMIDs. + +If it becomes absolutely mandatory to support such a migration path +in the future, we will have to trap and emulate all TLBIs, something +that nobody should look forward to. + +Fixes: d5a32b60dc18 ("KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1") +Reported-by: Catalin Marinas +Signed-off-by: Marc Zyngier +Cc: stable@vger.kernel.org +Cc: Will Deacon +Cc: Mark Rutland +Cc: Marc Zyngier +Cc: James Morse +Cc: Oliver Upton +Acked-by: Catalin Marinas +Link: https://lore.kernel.org/r/20241203190236.505759-1-maz@kernel.org +Signed-off-by: Oliver Upton +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/sys_regs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -2503,7 +2503,8 @@ static const struct sys_reg_desc sys_reg + ID_WRITABLE(ID_AA64MMFR0_EL1, ~(ID_AA64MMFR0_EL1_RES0 | + ID_AA64MMFR0_EL1_TGRAN4_2 | + ID_AA64MMFR0_EL1_TGRAN64_2 | +- ID_AA64MMFR0_EL1_TGRAN16_2)), ++ ID_AA64MMFR0_EL1_TGRAN16_2 | ++ ID_AA64MMFR0_EL1_ASIDBITS)), + ID_WRITABLE(ID_AA64MMFR1_EL1, ~(ID_AA64MMFR1_EL1_RES0 | + ID_AA64MMFR1_EL1_HCX | + ID_AA64MMFR1_EL1_TWED | diff --git a/queue-6.12/kvm-x86-cache-cpuid.0xd-xstate-offsets-sizes-during-module-init.patch b/queue-6.12/kvm-x86-cache-cpuid.0xd-xstate-offsets-sizes-during-module-init.patch new file mode 100644 index 00000000000..6936b9601d0 --- /dev/null +++ b/queue-6.12/kvm-x86-cache-cpuid.0xd-xstate-offsets-sizes-during-module-init.patch @@ -0,0 +1,161 @@ +From 1201f226c863b7da739f7420ddba818cedf372fc Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Tue, 10 Dec 2024 17:32:58 -0800 +Subject: KVM: x86: Cache CPUID.0xD XSTATE offsets+sizes during module init + +From: Sean Christopherson + +commit 1201f226c863b7da739f7420ddba818cedf372fc upstream. + +Snapshot the output of CPUID.0xD.[1..n] during kvm.ko initiliaization to +avoid the overead of CPUID during runtime. The offset, size, and metadata +for CPUID.0xD.[1..n] sub-leaves does not depend on XCR0 or XSS values, i.e. +is constant for a given CPU, and thus can be cached during module load. + +On Intel's Emerald Rapids, CPUID is *wildly* expensive, to the point where +recomputing XSAVE offsets and sizes results in a 4x increase in latency of +nested VM-Enter and VM-Exit (nested transitions can trigger +xstate_required_size() multiple times per transition), relative to using +cached values. The issue is easily visible by running `perf top` while +triggering nested transitions: kvm_update_cpuid_runtime() shows up at a +whopping 50%. + +As measured via RDTSC from L2 (using KVM-Unit-Test's CPUID VM-Exit test +and a slightly modified L1 KVM to handle CPUID in the fastpath), a nested +roundtrip to emulate CPUID on Skylake (SKX), Icelake (ICX), and Emerald +Rapids (EMR) takes: + + SKX 11650 + ICX 22350 + EMR 28850 + +Using cached values, the latency drops to: + + SKX 6850 + ICX 9000 + EMR 7900 + +The underlying issue is that CPUID itself is slow on ICX, and comically +slow on EMR. The problem is exacerbated on CPUs which support XSAVES +and/or XSAVEC, as KVM invokes xstate_required_size() twice on each +runtime CPUID update, and because there are more supported XSAVE features +(CPUID for supported XSAVE feature sub-leafs is significantly slower). + + SKX: + CPUID.0xD.2 = 348 cycles + CPUID.0xD.3 = 400 cycles + CPUID.0xD.4 = 276 cycles + CPUID.0xD.5 = 236 cycles + + + EMR: + CPUID.0xD.2 = 1138 cycles + CPUID.0xD.3 = 1362 cycles + CPUID.0xD.4 = 1068 cycles + CPUID.0xD.5 = 910 cycles + CPUID.0xD.6 = 914 cycles + CPUID.0xD.7 = 1350 cycles + CPUID.0xD.8 = 734 cycles + CPUID.0xD.9 = 766 cycles + CPUID.0xD.10 = 732 cycles + CPUID.0xD.11 = 718 cycles + CPUID.0xD.12 = 734 cycles + CPUID.0xD.13 = 1700 cycles + CPUID.0xD.14 = 1126 cycles + CPUID.0xD.15 = 898 cycles + CPUID.0xD.16 = 716 cycles + CPUID.0xD.17 = 748 cycles + CPUID.0xD.18 = 776 cycles + +Note, updating runtime CPUID information multiple times per nested +transition is itself a flaw, especially since CPUID is a mandotory +intercept on both Intel and AMD. E.g. KVM doesn't need to ensure emulated +CPUID state is up-to-date while running L2. That flaw will be fixed in a +future patch, as deferring runtime CPUID updates is more subtle than it +appears at first glance, the benefits aren't super critical to have once +the XSAVE issue is resolved, and caching CPUID output is desirable even if +KVM's updates are deferred. + +Cc: Jim Mattson +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Message-ID: <20241211013302.1347853-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/cpuid.c | 31 ++++++++++++++++++++++++++----- + arch/x86/kvm/cpuid.h | 1 + + arch/x86/kvm/x86.c | 2 ++ + 3 files changed, 29 insertions(+), 5 deletions(-) + +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -36,6 +36,26 @@ + u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly; + EXPORT_SYMBOL_GPL(kvm_cpu_caps); + ++struct cpuid_xstate_sizes { ++ u32 eax; ++ u32 ebx; ++ u32 ecx; ++}; ++ ++static struct cpuid_xstate_sizes xstate_sizes[XFEATURE_MAX] __ro_after_init; ++ ++void __init kvm_init_xstate_sizes(void) ++{ ++ u32 ign; ++ int i; ++ ++ for (i = XFEATURE_YMM; i < ARRAY_SIZE(xstate_sizes); i++) { ++ struct cpuid_xstate_sizes *xs = &xstate_sizes[i]; ++ ++ cpuid_count(0xD, i, &xs->eax, &xs->ebx, &xs->ecx, &ign); ++ } ++} ++ + u32 xstate_required_size(u64 xstate_bv, bool compacted) + { + int feature_bit = 0; +@@ -44,14 +64,15 @@ u32 xstate_required_size(u64 xstate_bv, + xstate_bv &= XFEATURE_MASK_EXTEND; + while (xstate_bv) { + if (xstate_bv & 0x1) { +- u32 eax, ebx, ecx, edx, offset; +- cpuid_count(0xD, feature_bit, &eax, &ebx, &ecx, &edx); ++ struct cpuid_xstate_sizes *xs = &xstate_sizes[feature_bit]; ++ u32 offset; ++ + /* ECX[1]: 64B alignment in compacted form */ + if (compacted) +- offset = (ecx & 0x2) ? ALIGN(ret, 64) : ret; ++ offset = (xs->ecx & 0x2) ? ALIGN(ret, 64) : ret; + else +- offset = ebx; +- ret = max(ret, offset + eax); ++ offset = xs->ebx; ++ ret = max(ret, offset + xs->eax); + } + + xstate_bv >>= 1; +--- a/arch/x86/kvm/cpuid.h ++++ b/arch/x86/kvm/cpuid.h +@@ -32,6 +32,7 @@ int kvm_vcpu_ioctl_get_cpuid2(struct kvm + bool kvm_cpuid(struct kvm_vcpu *vcpu, u32 *eax, u32 *ebx, + u32 *ecx, u32 *edx, bool exact_only); + ++void __init kvm_init_xstate_sizes(void); + u32 xstate_required_size(u64 xstate_bv, bool compacted); + + int cpuid_query_maxphyaddr(struct kvm_vcpu *vcpu); +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -14010,6 +14010,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_rmp_fau + + static int __init kvm_x86_init(void) + { ++ kvm_init_xstate_sizes(); ++ + kvm_mmu_x86_module_init(); + mitigate_smt_rsb &= boot_cpu_has_bug(X86_BUG_SMT_RSB) && cpu_smt_possible(); + return 0; diff --git a/queue-6.12/mmc-mtk-sd-disable-wakeup-in-.remove-and-in-the-error-path-of-.probe.patch b/queue-6.12/mmc-mtk-sd-disable-wakeup-in-.remove-and-in-the-error-path-of-.probe.patch new file mode 100644 index 00000000000..25343874758 --- /dev/null +++ b/queue-6.12/mmc-mtk-sd-disable-wakeup-in-.remove-and-in-the-error-path-of-.probe.patch @@ -0,0 +1,41 @@ +From f3d87abe11ed04d1b23a474a212f0e5deeb50892 Mon Sep 17 00:00:00 2001 +From: Joe Hattori +Date: Tue, 3 Dec 2024 11:34:42 +0900 +Subject: mmc: mtk-sd: disable wakeup in .remove() and in the error path of .probe() + +From: Joe Hattori + +commit f3d87abe11ed04d1b23a474a212f0e5deeb50892 upstream. + +Current implementation leaves pdev->dev as a wakeup source. Add a +device_init_wakeup(&pdev->dev, false) call in the .remove() function and +in the error path of the .probe() function. + +Signed-off-by: Joe Hattori +Fixes: 527f36f5efa4 ("mmc: mediatek: add support for SDIO eint wakup IRQ") +Cc: stable@vger.kernel.org +Message-ID: <20241203023442.2434018-1-joe@pf.is.s.u-tokyo.ac.jp> +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/mtk-sd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -2924,6 +2924,7 @@ release_clk: + msdc_gate_clock(host); + platform_set_drvdata(pdev, NULL); + release_mem: ++ device_init_wakeup(&pdev->dev, false); + if (host->dma.gpd) + dma_free_coherent(&pdev->dev, + 2 * sizeof(struct mt_gpdma_desc), +@@ -2957,6 +2958,7 @@ static void msdc_drv_remove(struct platf + host->dma.gpd, host->dma.gpd_addr); + dma_free_coherent(&pdev->dev, MAX_BD_NUM * sizeof(struct mt_bdma_desc), + host->dma.bd, host->dma.bd_addr); ++ device_init_wakeup(&pdev->dev, false); + } + + static void msdc_save_reg(struct msdc_host *host) diff --git a/queue-6.12/mmc-sdhci-tegra-remove-sdhci_quirk_broken_adma_zerolen_desc-quirk.patch b/queue-6.12/mmc-sdhci-tegra-remove-sdhci_quirk_broken_adma_zerolen_desc-quirk.patch new file mode 100644 index 00000000000..99fef96587a --- /dev/null +++ b/queue-6.12/mmc-sdhci-tegra-remove-sdhci_quirk_broken_adma_zerolen_desc-quirk.patch @@ -0,0 +1,35 @@ +From a56335c85b592cb2833db0a71f7112b7d9f0d56b Mon Sep 17 00:00:00 2001 +From: Prathamesh Shete +Date: Mon, 9 Dec 2024 15:40:09 +0530 +Subject: mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk + +From: Prathamesh Shete + +commit a56335c85b592cb2833db0a71f7112b7d9f0d56b upstream. + +Value 0 in ADMA length descriptor is interpreted as 65536 on new Tegra +chips, remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk to make sure max +ADMA2 length is 65536. + +Fixes: 4346b7c7941d ("mmc: tegra: Add Tegra186 support") +Cc: stable@vger.kernel.org +Signed-off-by: Prathamesh Shete +Acked-by: Thierry Reding +Acked-by: Adrian Hunter +Message-ID: <20241209101009.22710-1-pshete@nvidia.com> +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-tegra.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/mmc/host/sdhci-tegra.c ++++ b/drivers/mmc/host/sdhci-tegra.c +@@ -1525,7 +1525,6 @@ static const struct sdhci_pltfm_data sdh + .quirks = SDHCI_QUIRK_BROKEN_TIMEOUT_VAL | + SDHCI_QUIRK_SINGLE_POWER_WRITE | + SDHCI_QUIRK_NO_HISPD_BIT | +- SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC | + SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN, + .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | + SDHCI_QUIRK2_ISSUE_CMD_DAT_RESET_TOGETHER, diff --git a/queue-6.12/net-mctp-handle-skb-cleanup-on-sock_queue-failures.patch b/queue-6.12/net-mctp-handle-skb-cleanup-on-sock_queue-failures.patch new file mode 100644 index 00000000000..cc98107be78 --- /dev/null +++ b/queue-6.12/net-mctp-handle-skb-cleanup-on-sock_queue-failures.patch @@ -0,0 +1,226 @@ +From ce1219c3f76bb131d095e90521506d3c6ccfa086 Mon Sep 17 00:00:00 2001 +From: Jeremy Kerr +Date: Wed, 18 Dec 2024 11:53:01 +0800 +Subject: net: mctp: handle skb cleanup on sock_queue failures + +From: Jeremy Kerr + +commit ce1219c3f76bb131d095e90521506d3c6ccfa086 upstream. + +Currently, we don't use the return value from sock_queue_rcv_skb, which +means we may leak skbs if a message is not successfully queued to a +socket. + +Instead, ensure that we're freeing the skb where the sock hasn't +otherwise taken ownership of the skb by adding checks on the +sock_queue_rcv_skb() to invoke a kfree on failure. + +In doing so, rather than using the 'rc' value to trigger the +kfree_skb(), use the skb pointer itself, which is more explicit. + +Also, add a kunit test for the sock delivery failure cases. + +Fixes: 4a992bbd3650 ("mctp: Implement message fragmentation & reassembly") +Cc: stable@vger.kernel.org +Signed-off-by: Jeremy Kerr +Link: https://patch.msgid.link/20241218-mctp-next-v2-1-1c1729645eaa@codeconstruct.com.au +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/mctp/route.c | 36 +++++++++++++----- + net/mctp/test/route-test.c | 86 +++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 112 insertions(+), 10 deletions(-) + +--- a/net/mctp/route.c ++++ b/net/mctp/route.c +@@ -374,8 +374,13 @@ static int mctp_route_input(struct mctp_ + msk = NULL; + rc = -EINVAL; + +- /* we may be receiving a locally-routed packet; drop source sk +- * accounting ++ /* We may be receiving a locally-routed packet; drop source sk ++ * accounting. ++ * ++ * From here, we will either queue the skb - either to a frag_queue, or ++ * to a receiving socket. When that succeeds, we clear the skb pointer; ++ * a non-NULL skb on exit will be otherwise unowned, and hence ++ * kfree_skb()-ed. + */ + skb_orphan(skb); + +@@ -434,7 +439,9 @@ static int mctp_route_input(struct mctp_ + * pending key. + */ + if (flags & MCTP_HDR_FLAG_EOM) { +- sock_queue_rcv_skb(&msk->sk, skb); ++ rc = sock_queue_rcv_skb(&msk->sk, skb); ++ if (!rc) ++ skb = NULL; + if (key) { + /* we've hit a pending reassembly; not much we + * can do but drop it +@@ -443,7 +450,6 @@ static int mctp_route_input(struct mctp_ + MCTP_TRACE_KEY_REPLIED); + key = NULL; + } +- rc = 0; + goto out_unlock; + } + +@@ -470,8 +476,10 @@ static int mctp_route_input(struct mctp_ + * this function. + */ + rc = mctp_key_add(key, msk); +- if (!rc) ++ if (!rc) { + trace_mctp_key_acquire(key); ++ skb = NULL; ++ } + + /* we don't need to release key->lock on exit, so + * clean up here and suppress the unlock via +@@ -489,6 +497,8 @@ static int mctp_route_input(struct mctp_ + key = NULL; + } else { + rc = mctp_frag_queue(key, skb); ++ if (!rc) ++ skb = NULL; + } + } + +@@ -503,12 +513,19 @@ static int mctp_route_input(struct mctp_ + else + rc = mctp_frag_queue(key, skb); + ++ if (rc) ++ goto out_unlock; ++ ++ /* we've queued; the queue owns the skb now */ ++ skb = NULL; ++ + /* end of message? deliver to socket, and we're done with + * the reassembly/response key + */ +- if (!rc && flags & MCTP_HDR_FLAG_EOM) { +- sock_queue_rcv_skb(key->sk, key->reasm_head); +- key->reasm_head = NULL; ++ if (flags & MCTP_HDR_FLAG_EOM) { ++ rc = sock_queue_rcv_skb(key->sk, key->reasm_head); ++ if (!rc) ++ key->reasm_head = NULL; + __mctp_key_done_in(key, net, f, MCTP_TRACE_KEY_REPLIED); + key = NULL; + } +@@ -527,8 +544,7 @@ out_unlock: + if (any_key) + mctp_key_unref(any_key); + out: +- if (rc) +- kfree_skb(skb); ++ kfree_skb(skb); + return rc; + } + +--- a/net/mctp/test/route-test.c ++++ b/net/mctp/test/route-test.c +@@ -837,6 +837,90 @@ static void mctp_test_route_input_multip + mctp_test_route_input_multiple_nets_key_fini(test, &t2); + } + ++/* Input route to socket, using a single-packet message, where sock delivery ++ * fails. Ensure we're handling the failure appropriately. ++ */ ++static void mctp_test_route_input_sk_fail_single(struct kunit *test) ++{ ++ const struct mctp_hdr hdr = RX_HDR(1, 10, 8, FL_S | FL_E | FL_TO); ++ struct mctp_test_route *rt; ++ struct mctp_test_dev *dev; ++ struct socket *sock; ++ struct sk_buff *skb; ++ int rc; ++ ++ __mctp_route_test_init(test, &dev, &rt, &sock, MCTP_NET_ANY); ++ ++ /* No rcvbuf space, so delivery should fail. __sock_set_rcvbuf will ++ * clamp the minimum to SOCK_MIN_RCVBUF, so we open-code this. ++ */ ++ lock_sock(sock->sk); ++ WRITE_ONCE(sock->sk->sk_rcvbuf, 0); ++ release_sock(sock->sk); ++ ++ skb = mctp_test_create_skb(&hdr, 10); ++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, skb); ++ skb_get(skb); ++ ++ mctp_test_skb_set_dev(skb, dev); ++ ++ /* do route input, which should fail */ ++ rc = mctp_route_input(&rt->rt, skb); ++ KUNIT_EXPECT_NE(test, rc, 0); ++ ++ /* we should hold the only reference to skb */ ++ KUNIT_EXPECT_EQ(test, refcount_read(&skb->users), 1); ++ kfree_skb(skb); ++ ++ __mctp_route_test_fini(test, dev, rt, sock); ++} ++ ++/* Input route to socket, using a fragmented message, where sock delivery fails. ++ */ ++static void mctp_test_route_input_sk_fail_frag(struct kunit *test) ++{ ++ const struct mctp_hdr hdrs[2] = { RX_FRAG(FL_S, 0), RX_FRAG(FL_E, 1) }; ++ struct mctp_test_route *rt; ++ struct mctp_test_dev *dev; ++ struct sk_buff *skbs[2]; ++ struct socket *sock; ++ unsigned int i; ++ int rc; ++ ++ __mctp_route_test_init(test, &dev, &rt, &sock, MCTP_NET_ANY); ++ ++ lock_sock(sock->sk); ++ WRITE_ONCE(sock->sk->sk_rcvbuf, 0); ++ release_sock(sock->sk); ++ ++ for (i = 0; i < ARRAY_SIZE(skbs); i++) { ++ skbs[i] = mctp_test_create_skb(&hdrs[i], 10); ++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, skbs[i]); ++ skb_get(skbs[i]); ++ ++ mctp_test_skb_set_dev(skbs[i], dev); ++ } ++ ++ /* first route input should succeed, we're only queueing to the ++ * frag list ++ */ ++ rc = mctp_route_input(&rt->rt, skbs[0]); ++ KUNIT_EXPECT_EQ(test, rc, 0); ++ ++ /* final route input should fail to deliver to the socket */ ++ rc = mctp_route_input(&rt->rt, skbs[1]); ++ KUNIT_EXPECT_NE(test, rc, 0); ++ ++ /* we should hold the only reference to both skbs */ ++ KUNIT_EXPECT_EQ(test, refcount_read(&skbs[0]->users), 1); ++ kfree_skb(skbs[0]); ++ ++ KUNIT_EXPECT_EQ(test, refcount_read(&skbs[1]->users), 1); ++ kfree_skb(skbs[1]); ++ ++ __mctp_route_test_fini(test, dev, rt, sock); ++} ++ + #if IS_ENABLED(CONFIG_MCTP_FLOWS) + + static void mctp_test_flow_init(struct kunit *test, +@@ -1053,6 +1137,8 @@ static struct kunit_case mctp_test_cases + mctp_route_input_sk_reasm_gen_params), + KUNIT_CASE_PARAM(mctp_test_route_input_sk_keys, + mctp_route_input_sk_keys_gen_params), ++ KUNIT_CASE(mctp_test_route_input_sk_fail_single), ++ KUNIT_CASE(mctp_test_route_input_sk_fail_frag), + KUNIT_CASE(mctp_test_route_input_multiple_nets_bind), + KUNIT_CASE(mctp_test_route_input_multiple_nets_key), + KUNIT_CASE(mctp_test_packet_flow), diff --git a/queue-6.12/net-tun-fix-tun_napi_alloc_frags.patch b/queue-6.12/net-tun-fix-tun_napi_alloc_frags.patch new file mode 100644 index 00000000000..ce47a45fa16 --- /dev/null +++ b/queue-6.12/net-tun-fix-tun_napi_alloc_frags.patch @@ -0,0 +1,84 @@ +From 429fde2d81bcef0ebab002215358955704586457 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 12 Dec 2024 22:22:47 +0000 +Subject: net: tun: fix tun_napi_alloc_frags() + +From: Eric Dumazet + +commit 429fde2d81bcef0ebab002215358955704586457 upstream. + +syzbot reported the following crash [1] + +Issue came with the blamed commit. Instead of going through +all the iov components, we keep using the first one +and end up with a malformed skb. + +[1] + +kernel BUG at net/core/skbuff.c:2849 ! +Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI +CPU: 0 UID: 0 PID: 6230 Comm: syz-executor132 Not tainted 6.13.0-rc1-syzkaller-00407-g96b6fcc0ee41 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 + RIP: 0010:__pskb_pull_tail+0x1568/0x1570 net/core/skbuff.c:2848 +Code: 38 c1 0f 8c 32 f1 ff ff 4c 89 f7 e8 92 96 74 f8 e9 25 f1 ff ff e8 e8 ae 09 f8 48 8b 5c 24 08 e9 eb fb ff ff e8 d9 ae 09 f8 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 +RSP: 0018:ffffc90004cbef30 EFLAGS: 00010293 +RAX: ffffffff8995c347 RBX: 00000000fffffff2 RCX: ffff88802cf45a00 +RDX: 0000000000000000 RSI: 00000000fffffff2 RDI: 0000000000000000 +RBP: ffff88807df0c06a R08: ffffffff8995b084 R09: 1ffff1100fbe185c +R10: dffffc0000000000 R11: ffffed100fbe185d R12: ffff888076e85d50 +R13: ffff888076e85c80 R14: ffff888076e85cf4 R15: ffff888076e85c80 +FS: 00007f0dca6ea6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f0dca6ead58 CR3: 00000000119da000 CR4: 00000000003526f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + skb_cow_data+0x2da/0xcb0 net/core/skbuff.c:5284 + tipc_aead_decrypt net/tipc/crypto.c:894 [inline] + tipc_crypto_rcv+0x402/0x24e0 net/tipc/crypto.c:1844 + tipc_rcv+0x57e/0x12a0 net/tipc/node.c:2109 + tipc_l2_rcv_msg+0x2bd/0x450 net/tipc/bearer.c:668 + __netif_receive_skb_list_ptype net/core/dev.c:5720 [inline] + __netif_receive_skb_list_core+0x8b7/0x980 net/core/dev.c:5762 + __netif_receive_skb_list net/core/dev.c:5814 [inline] + netif_receive_skb_list_internal+0xa51/0xe30 net/core/dev.c:5905 + gro_normal_list include/net/gro.h:515 [inline] + napi_complete_done+0x2b5/0x870 net/core/dev.c:6256 + napi_complete include/linux/netdevice.h:567 [inline] + tun_get_user+0x2ea0/0x4890 drivers/net/tun.c:1982 + tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2057 + do_iter_readv_writev+0x600/0x880 + vfs_writev+0x376/0xba0 fs/read_write.c:1050 + do_writev+0x1b6/0x360 fs/read_write.c:1096 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Fixes: de4f5fed3f23 ("iov_iter: add iter_iovec() helper") +Reported-by: syzbot+4f66250f6663c0c1d67e@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/675b61aa.050a0220.599f4.00bb.GAE@google.com/T/#u +Cc: stable@vger.kernel.org +Signed-off-by: Eric Dumazet +Reviewed-by: Joe Damato +Reviewed-by: Jens Axboe +Acked-by: Willem de Bruijn +Acked-by: Michael S. Tsirkin +Link: https://patch.msgid.link/20241212222247.724674-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1481,7 +1481,7 @@ static struct sk_buff *tun_napi_alloc_fr + skb->truesize += skb->data_len; + + for (i = 1; i < it->nr_segs; i++) { +- const struct iovec *iov = iter_iov(it); ++ const struct iovec *iov = iter_iov(it) + i; + size_t fragsz = iov->iov_len; + struct page *page; + void *frag; diff --git a/queue-6.12/series b/queue-6.12/series index c44626bc568..11bf2239810 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -60,3 +60,30 @@ net-dsa-restore-dsa_software_vlan_untag-ability-to-o.patch netdev-genl-avoid-empty-messages-in-queue-dump.patch psample-adjust-size-if-rate_as_probability-is-set.patch net-mdiobus-fix-an-of-node-reference-leak.patch +mmc-sdhci-tegra-remove-sdhci_quirk_broken_adma_zerolen_desc-quirk.patch +mmc-mtk-sd-disable-wakeup-in-.remove-and-in-the-error-path-of-.probe.patch +irqchip-gic-v3-work-around-insecure-gic-integrations.patch +edac-amd64-simplify-ecc-check-on-unified-memory-controllers.patch +kvm-arm64-do-not-allow-id_aa64mmfr0_el1.asidbits-to-be-overridden.patch +kvm-x86-cache-cpuid.0xd-xstate-offsets-sizes-during-module-init.patch +net-tun-fix-tun_napi_alloc_frags.patch +chelsio-chtls-prevent-potential-integer-overflow-on-32bit.patch +net-mctp-handle-skb-cleanup-on-sock_queue-failures.patch +block-revert-block-fix-potential-deadlock-while-freezing-queue-and-acquiring-sysfs_lock.patch +i2c-riic-always-round-up-when-calculating-bus-period.patch +efivarfs-fix-error-on-non-existent-file.patch +hexagon-disable-constant-extender-optimization-for-llvm-prior-to-19.1.0.patch +usb-serial-option-add-tcl-ik512-mbim-ecm.patch +usb-serial-option-add-meig-smart-slm770a.patch +usb-serial-option-add-netprisma-lcuk54-modules-for-wwan-ready.patch +usb-serial-option-add-mediatek-t7xx-compositions.patch +usb-serial-option-add-telit-fe910c04-rmnet-compositions.patch +xhci-turn-nec-specific-quirk-for-handling-stop-endpoint-errors-generic.patch +thunderbolt-add-support-for-intel-panther-lake-m-p.patch +thunderbolt-improve-redrive-mode-handling.patch +thunderbolt-don-t-display-nvm_version-unless-upgrade-supported.patch +drm-display-use-err_ptr-on-dp-tunnel-manager-creation-fail.patch +drm-amd-update-strapping-for-nbio-2.5.0.patch +drm-modes-avoid-divide-by-zero-harder-in-drm_mode_vrefresh.patch +drm-amdgpu-fix-amdgpu_coredump.patch +drm-amdgpu-handle-null-bo-tbo.resource-again-in-amdgpu_vm_bo_update.patch diff --git a/queue-6.12/thunderbolt-add-support-for-intel-panther-lake-m-p.patch b/queue-6.12/thunderbolt-add-support-for-intel-panther-lake-m-p.patch new file mode 100644 index 00000000000..a4486f57cf2 --- /dev/null +++ b/queue-6.12/thunderbolt-add-support-for-intel-panther-lake-m-p.patch @@ -0,0 +1,51 @@ +From 8644b48714dca8bf2f42a4ff8311de8efc9bd8c3 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Tue, 14 May 2024 10:15:14 +0300 +Subject: thunderbolt: Add support for Intel Panther Lake-M/P + +From: Mika Westerberg + +commit 8644b48714dca8bf2f42a4ff8311de8efc9bd8c3 upstream. + +Intel Panther Lake-M/P has the same integrated Thunderbolt/USB4 +controller as Lunar Lake. Add these PCI IDs to the driver list of +supported devices. + +Cc: stable@vger.kernel.org +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thunderbolt/nhi.c | 8 ++++++++ + drivers/thunderbolt/nhi.h | 4 ++++ + 2 files changed, 12 insertions(+) + +--- a/drivers/thunderbolt/nhi.c ++++ b/drivers/thunderbolt/nhi.c +@@ -1520,6 +1520,14 @@ static struct pci_device_id nhi_ids[] = + .driver_data = (kernel_ulong_t)&icl_nhi_ops }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_LNL_NHI1), + .driver_data = (kernel_ulong_t)&icl_nhi_ops }, ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_M_NHI0), ++ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_M_NHI1), ++ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI0), ++ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1), ++ .driver_data = (kernel_ulong_t)&icl_nhi_ops }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) }, + +--- a/drivers/thunderbolt/nhi.h ++++ b/drivers/thunderbolt/nhi.h +@@ -92,6 +92,10 @@ extern const struct tb_nhi_ops icl_nhi_o + #define PCI_DEVICE_ID_INTEL_RPL_NHI1 0xa76d + #define PCI_DEVICE_ID_INTEL_LNL_NHI0 0xa833 + #define PCI_DEVICE_ID_INTEL_LNL_NHI1 0xa834 ++#define PCI_DEVICE_ID_INTEL_PTL_M_NHI0 0xe333 ++#define PCI_DEVICE_ID_INTEL_PTL_M_NHI1 0xe334 ++#define PCI_DEVICE_ID_INTEL_PTL_P_NHI0 0xe433 ++#define PCI_DEVICE_ID_INTEL_PTL_P_NHI1 0xe434 + + #define PCI_CLASS_SERIAL_USB_USB4 0x0c0340 + diff --git a/queue-6.12/thunderbolt-don-t-display-nvm_version-unless-upgrade-supported.patch b/queue-6.12/thunderbolt-don-t-display-nvm_version-unless-upgrade-supported.patch new file mode 100644 index 00000000000..6d02535fcac --- /dev/null +++ b/queue-6.12/thunderbolt-don-t-display-nvm_version-unless-upgrade-supported.patch @@ -0,0 +1,81 @@ +From e34f1717ef0632fcec5cb827e5e0e9f223d70c9b Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Mon, 9 Dec 2024 10:25:51 -0600 +Subject: thunderbolt: Don't display nvm_version unless upgrade supported + +From: Mario Limonciello + +commit e34f1717ef0632fcec5cb827e5e0e9f223d70c9b upstream. + +The read will never succeed if NVM wasn't initialized due to an unknown +format. + +Add a new callback for visibility to only show when supported. + +Cc: stable@vger.kernel.org +Fixes: aef9c693e7e5 ("thunderbolt: Move vendor specific NVM handling into nvm.c") +Reported-by: Richard Hughes +Closes: https://github.com/fwupd/fwupd/issues/8200 +Signed-off-by: Mario Limonciello +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thunderbolt/retimer.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/thunderbolt/retimer.c ++++ b/drivers/thunderbolt/retimer.c +@@ -103,6 +103,7 @@ static int tb_retimer_nvm_add(struct tb_ + + err_nvm: + dev_dbg(&rt->dev, "NVM upgrade disabled\n"); ++ rt->no_nvm_upgrade = true; + if (!IS_ERR(nvm)) + tb_nvm_free(nvm); + +@@ -182,8 +183,6 @@ static ssize_t nvm_authenticate_show(str + + if (!rt->nvm) + ret = -EAGAIN; +- else if (rt->no_nvm_upgrade) +- ret = -EOPNOTSUPP; + else + ret = sysfs_emit(buf, "%#x\n", rt->auth_status); + +@@ -323,8 +322,6 @@ static ssize_t nvm_version_show(struct d + + if (!rt->nvm) + ret = -EAGAIN; +- else if (rt->no_nvm_upgrade) +- ret = -EOPNOTSUPP; + else + ret = sysfs_emit(buf, "%x.%x\n", rt->nvm->major, rt->nvm->minor); + +@@ -342,6 +339,19 @@ static ssize_t vendor_show(struct device + } + static DEVICE_ATTR_RO(vendor); + ++static umode_t retimer_is_visible(struct kobject *kobj, struct attribute *attr, ++ int n) ++{ ++ struct device *dev = kobj_to_dev(kobj); ++ struct tb_retimer *rt = tb_to_retimer(dev); ++ ++ if (attr == &dev_attr_nvm_authenticate.attr || ++ attr == &dev_attr_nvm_version.attr) ++ return rt->no_nvm_upgrade ? 0 : attr->mode; ++ ++ return attr->mode; ++} ++ + static struct attribute *retimer_attrs[] = { + &dev_attr_device.attr, + &dev_attr_nvm_authenticate.attr, +@@ -351,6 +361,7 @@ static struct attribute *retimer_attrs[] + }; + + static const struct attribute_group retimer_group = { ++ .is_visible = retimer_is_visible, + .attrs = retimer_attrs, + }; + diff --git a/queue-6.12/thunderbolt-improve-redrive-mode-handling.patch b/queue-6.12/thunderbolt-improve-redrive-mode-handling.patch new file mode 100644 index 00000000000..6dfc8fbcdca --- /dev/null +++ b/queue-6.12/thunderbolt-improve-redrive-mode-handling.patch @@ -0,0 +1,124 @@ +From 24740385cb0d6d22ab7fa7adf36546d5b3cdcf73 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Fri, 15 Nov 2024 11:54:40 +0200 +Subject: thunderbolt: Improve redrive mode handling + +From: Mika Westerberg + +commit 24740385cb0d6d22ab7fa7adf36546d5b3cdcf73 upstream. + +When USB-C monitor is connected directly to Intel Barlow Ridge host, it +goes into "redrive" mode that basically routes the DisplayPort signals +directly from the GPU to the USB-C monitor without any tunneling needed. +However, the host router must be powered on for this to work. Aaron +reported that there are a couple of cases where this will not work with +the current code: + + - Booting with USB-C monitor plugged in. + - Plugging in USB-C monitor when the host router is in sleep state + (runtime suspended). + - Plugging in USB-C device while the system is in system sleep state. + +In all these cases once the host router is runtime suspended the picture +on the connected USB-C display disappears too. This is certainly not +what the user expected. + +For this reason improve the redrive mode handling to keep the host +router from runtime suspending when detect that any of the above cases +is happening. + +Fixes: a75e0684efe5 ("thunderbolt: Keep the domain powered when USB4 port is in redrive mode") +Reported-by: Aaron Rainbolt +Closes: https://lore.kernel.org/linux-usb/20241009220118.70bfedd0@kf-ir16/ +Cc: stable@vger.kernel.org +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thunderbolt/tb.c | 41 +++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 41 insertions(+) + +--- a/drivers/thunderbolt/tb.c ++++ b/drivers/thunderbolt/tb.c +@@ -2059,6 +2059,37 @@ static void tb_exit_redrive(struct tb_po + } + } + ++static void tb_switch_enter_redrive(struct tb_switch *sw) ++{ ++ struct tb_port *port; ++ ++ tb_switch_for_each_port(sw, port) ++ tb_enter_redrive(port); ++} ++ ++/* ++ * Called during system and runtime suspend to forcefully exit redrive ++ * mode without querying whether the resource is available. ++ */ ++static void tb_switch_exit_redrive(struct tb_switch *sw) ++{ ++ struct tb_port *port; ++ ++ if (!(sw->quirks & QUIRK_KEEP_POWER_IN_DP_REDRIVE)) ++ return; ++ ++ tb_switch_for_each_port(sw, port) { ++ if (!tb_port_is_dpin(port)) ++ continue; ++ ++ if (port->redrive) { ++ port->redrive = false; ++ pm_runtime_put(&sw->dev); ++ tb_port_dbg(port, "exit redrive mode\n"); ++ } ++ } ++} ++ + static void tb_dp_resource_unavailable(struct tb *tb, struct tb_port *port) + { + struct tb_port *in, *out; +@@ -2909,6 +2940,7 @@ static int tb_start(struct tb *tb, bool + tb_create_usb3_tunnels(tb->root_switch); + /* Add DP IN resources for the root switch */ + tb_add_dp_resources(tb->root_switch); ++ tb_switch_enter_redrive(tb->root_switch); + /* Make the discovered switches available to the userspace */ + device_for_each_child(&tb->root_switch->dev, NULL, + tb_scan_finalize_switch); +@@ -2924,6 +2956,7 @@ static int tb_suspend_noirq(struct tb *t + + tb_dbg(tb, "suspending...\n"); + tb_disconnect_and_release_dp(tb); ++ tb_switch_exit_redrive(tb->root_switch); + tb_switch_suspend(tb->root_switch, false); + tcm->hotplug_active = false; /* signal tb_handle_hotplug to quit */ + tb_dbg(tb, "suspend finished\n"); +@@ -3016,6 +3049,7 @@ static int tb_resume_noirq(struct tb *tb + tb_dbg(tb, "tunnels restarted, sleeping for 100ms\n"); + msleep(100); + } ++ tb_switch_enter_redrive(tb->root_switch); + /* Allow tb_handle_hotplug to progress events */ + tcm->hotplug_active = true; + tb_dbg(tb, "resume finished\n"); +@@ -3079,6 +3113,12 @@ static int tb_runtime_suspend(struct tb + struct tb_cm *tcm = tb_priv(tb); + + mutex_lock(&tb->lock); ++ /* ++ * The below call only releases DP resources to allow exiting and ++ * re-entering redrive mode. ++ */ ++ tb_disconnect_and_release_dp(tb); ++ tb_switch_exit_redrive(tb->root_switch); + tb_switch_suspend(tb->root_switch, true); + tcm->hotplug_active = false; + mutex_unlock(&tb->lock); +@@ -3110,6 +3150,7 @@ static int tb_runtime_resume(struct tb * + tb_restore_children(tb->root_switch); + list_for_each_entry_safe(tunnel, n, &tcm->tunnel_list, list) + tb_tunnel_restart(tunnel); ++ tb_switch_enter_redrive(tb->root_switch); + tcm->hotplug_active = true; + mutex_unlock(&tb->lock); + diff --git a/queue-6.12/usb-serial-option-add-mediatek-t7xx-compositions.patch b/queue-6.12/usb-serial-option-add-mediatek-t7xx-compositions.patch new file mode 100644 index 00000000000..792fb06f382 --- /dev/null +++ b/queue-6.12/usb-serial-option-add-mediatek-t7xx-compositions.patch @@ -0,0 +1,89 @@ +From f07dfa6a1b65034a5c3ba3a555950d972f252757 Mon Sep 17 00:00:00 2001 +From: Jack Wu +Date: Thu, 28 Nov 2024 10:22:27 +0800 +Subject: USB: serial: option: add MediaTek T7XX compositions + +From: Jack Wu + +commit f07dfa6a1b65034a5c3ba3a555950d972f252757 upstream. + +Add the MediaTek T7XX compositions: + +T: Bus=03 Lev=01 Prnt=01 Port=05 Cnt=01 Dev#= 74 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0e8d ProdID=7129 Rev= 0.01 +S: Manufacturer=MediaTek Inc. +S: Product=USB DATA CARD +S: SerialNumber=004402459035402 +C:* #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +------------------------------- +| If Number | Function | +------------------------------- +| 2 | USB AP Log Port | +------------------------------- +| 3 | USB AP GNSS Port| +------------------------------- +| 4 | USB AP META Port| +------------------------------- +| 5 | ADB port | +------------------------------- +| 6 | USB MD AT Port | +------------------------------ +| 7 | USB MD META Port| +------------------------------- +| 8 | USB NTZ Port | +------------------------------- +| 9 | USB Debug port | +------------------------------- + +Signed-off-by: Jack Wu +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2249,6 +2249,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7127, 0xff, 0x00, 0x00), + .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7129, 0xff, 0x00, 0x00), /* MediaTek T7XX */ ++ .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) }, + { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, + { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200), + .driver_info = RSVD(1) | RSVD(4) }, diff --git a/queue-6.12/usb-serial-option-add-meig-smart-slm770a.patch b/queue-6.12/usb-serial-option-add-meig-smart-slm770a.patch new file mode 100644 index 00000000000..dff81e08e12 --- /dev/null +++ b/queue-6.12/usb-serial-option-add-meig-smart-slm770a.patch @@ -0,0 +1,71 @@ +From 724d461e44dfc0815624d2a9792f2f2beb7ee46d Mon Sep 17 00:00:00 2001 +From: Michal Hrusecky +Date: Tue, 19 Nov 2024 14:00:18 +0100 +Subject: USB: serial: option: add MeiG Smart SLM770A + +From: Michal Hrusecky + +commit 724d461e44dfc0815624d2a9792f2f2beb7ee46d upstream. + +Update the USB serial option driver to support MeiG Smart SLM770A. + +ID 2dee:4d57 Marvell Mobile Composite Device Bus + +T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2dee ProdID=4d57 Rev= 1.00 +S: Manufacturer=Marvell +S: Product=Mobile Composite Device Bus +C:* #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0e(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Tested successfully connecting to the Internet via rndis interface after +dialing via AT commands on If#=3 or If#=4. +Not sure of the purpose of the other serial interfaces. + +Signed-off-by: Michal Hrusecky +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -625,6 +625,8 @@ static void option_instat_callback(struc + #define MEIGSMART_PRODUCT_SRM825L 0x4d22 + /* MeiG Smart SLM320 based on UNISOC UIS8910 */ + #define MEIGSMART_PRODUCT_SLM320 0x4d41 ++/* MeiG Smart SLM770A based on ASR1803 */ ++#define MEIGSMART_PRODUCT_SLM770A 0x4d57 + + /* Device flags */ + +@@ -2382,6 +2384,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, diff --git a/queue-6.12/usb-serial-option-add-netprisma-lcuk54-modules-for-wwan-ready.patch b/queue-6.12/usb-serial-option-add-netprisma-lcuk54-modules-for-wwan-ready.patch new file mode 100644 index 00000000000..8d6dc74a9b4 --- /dev/null +++ b/queue-6.12/usb-serial-option-add-netprisma-lcuk54-modules-for-wwan-ready.patch @@ -0,0 +1,83 @@ +From aa954ae08262bb5cd6ab18dd56a0b58c1315db8b Mon Sep 17 00:00:00 2001 +From: Mank Wang +Date: Fri, 22 Nov 2024 09:06:00 +0000 +Subject: USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready + +From: Mank Wang + +commit aa954ae08262bb5cd6ab18dd56a0b58c1315db8b upstream. + +LCUK54-WRD's pid/vid +0x3731/0x010a +0x3731/0x010c + +LCUK54-WWD's pid/vid +0x3731/0x010b +0x3731/0x010d + +Above products use the exact same interface layout and option +driver: +MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL + +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=3731 ProdID=0101 Rev= 5.04 +S: Manufacturer=NetPrisma +S: Product=LCUK54-WRD +S: SerialNumber=feeba631 +C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Mank Wang +[ johan: use lower case hex notation ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2377,6 +2377,18 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Golbal EDU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for WWAN Ready */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for WWAN Ready */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for WWAN Ready */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for WWAN Ready */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) }, diff --git a/queue-6.12/usb-serial-option-add-tcl-ik512-mbim-ecm.patch b/queue-6.12/usb-serial-option-add-tcl-ik512-mbim-ecm.patch new file mode 100644 index 00000000000..4ab6fac7ccd --- /dev/null +++ b/queue-6.12/usb-serial-option-add-tcl-ik512-mbim-ecm.patch @@ -0,0 +1,82 @@ +From fdad4fb7c506bea8b419f70ff2163d99962e8ede Mon Sep 17 00:00:00 2001 +From: Daniel Swanemar +Date: Mon, 4 Nov 2024 14:42:17 +0100 +Subject: USB: serial: option: add TCL IK512 MBIM & ECM + +From: Daniel Swanemar + +commit fdad4fb7c506bea8b419f70ff2163d99962e8ede upstream. + +Add the following TCL IK512 compositions: + +0x0530: Modem + Diag + AT + MBIM +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=10000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=1bbb ProdID=0530 Rev=05.04 +S: Manufacturer=TCL +S: Product=TCL 5G USB Dongle +S: SerialNumber=3136b91a +C: #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +0x0640: ECM + Modem + Diag + AT +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=10000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=1bbb ProdID=0640 Rev=05.04 +S: Manufacturer=TCL +S: Product=TCL 5G USB Dongle +S: SerialNumber=3136b91a +C: #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +Signed-off-by: Daniel Swanemar +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2385,6 +2385,10 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ ++ .driver_info = NCTRL(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ ++ .driver_info = NCTRL(3) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-6.12/usb-serial-option-add-telit-fe910c04-rmnet-compositions.patch b/queue-6.12/usb-serial-option-add-telit-fe910c04-rmnet-compositions.patch new file mode 100644 index 00000000000..7faa98cdac2 --- /dev/null +++ b/queue-6.12/usb-serial-option-add-telit-fe910c04-rmnet-compositions.patch @@ -0,0 +1,107 @@ +From 8366e64a4454481339e7c56a8ad280161f2e441d Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Mon, 9 Dec 2024 16:32:54 +0100 +Subject: USB: serial: option: add Telit FE910C04 rmnet compositions + +From: Daniele Palmas + +commit 8366e64a4454481339e7c56a8ad280161f2e441d upstream. + +Add the following Telit FE910C04 compositions: + +0x10c0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag) +T: Bus=02 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10c0 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE910 +S: SerialNumber=f71b8b32 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10c4: rmnet + tty (AT) + tty (AT) + tty (diag) +T: Bus=02 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 14 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10c4 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE910 +S: SerialNumber=f71b8b32 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10c8: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb +T: Bus=02 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10c8 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE910 +S: SerialNumber=f71b8b32 +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Daniele Palmas +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1397,6 +1397,12 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ ++ .driver_info = RSVD(0) | NCTRL(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */ ++ .driver_info = RSVD(0) | NCTRL(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ ++ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), diff --git a/queue-6.12/xhci-turn-nec-specific-quirk-for-handling-stop-endpoint-errors-generic.patch b/queue-6.12/xhci-turn-nec-specific-quirk-for-handling-stop-endpoint-errors-generic.patch new file mode 100644 index 00000000000..74921f22dc3 --- /dev/null +++ b/queue-6.12/xhci-turn-nec-specific-quirk-for-handling-stop-endpoint-errors-generic.patch @@ -0,0 +1,38 @@ +From e21ebe51af688eb98fd6269240212a3c7300deea Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 17 Dec 2024 12:21:21 +0200 +Subject: xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic + +From: Mathias Nyman + +commit e21ebe51af688eb98fd6269240212a3c7300deea upstream. + +xHC hosts from several vendors have the same issue where endpoints start +so slowly that a later queued 'Stop Endpoint' command may complete before +endpoint is up and running. + +The 'Stop Endpoint' command fails with context state error as the endpoint +still appears as stopped. + +See commit 42b758137601 ("usb: xhci: Limit Stop Endpoint retries") for +details + +CC: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20241217102122.2316814-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-ring.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1192,8 +1192,6 @@ static void xhci_handle_cmd_stop_ep(stru + * Keep retrying until the EP starts and stops again, on + * chips where this is known to help. Wait for 100ms. + */ +- if (!(xhci->quirks & XHCI_NEC_HOST)) +- break; + if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100))) + break; + fallthrough;