From: Sasha Levin Date: Tue, 10 Dec 2024 20:35:46 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v6.6.65~4^2~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ac4ae84ef8d38ec72f3fe14b7bf2800efb38ef08;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/af_packet-avoid-erroring-out-after-sock_init_data-in.patch b/queue-6.1/af_packet-avoid-erroring-out-after-sock_init_data-in.patch new file mode 100644 index 00000000000..74920316ba3 --- /dev/null +++ b/queue-6.1/af_packet-avoid-erroring-out-after-sock_init_data-in.patch @@ -0,0 +1,67 @@ +From 616e755a3c4087c1ba9712ec0f3ea053f7e294d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 16:38:00 +0100 +Subject: af_packet: avoid erroring out after sock_init_data() in + packet_create() + +From: Ignat Korchagin + +[ Upstream commit 46f2a11cb82b657fd15bab1c47821b635e03838b ] + +After sock_init_data() the allocated sk object is attached to the provided +sock object. On error, packet_create() frees the sk object leaving the +dangling pointer in the sock object on return. Some other code may try +to use this pointer and cause use-after-free. + +Suggested-by: Eric Dumazet +Signed-off-by: Ignat Korchagin +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Willem de Bruijn +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20241014153808.51894-2-ignat@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index c9c813f731c6e..9da9e41899c65 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3418,18 +3418,18 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, + if (sock->type == SOCK_PACKET) + sock->ops = &packet_ops_spkt; + ++ po = pkt_sk(sk); ++ err = packet_alloc_pending(po); ++ if (err) ++ goto out_sk_free; ++ + sock_init_data(sock, sk); + +- po = pkt_sk(sk); + init_completion(&po->skb_completion); + sk->sk_family = PF_PACKET; + po->num = proto; + po->xmit = dev_queue_xmit; + +- err = packet_alloc_pending(po); +- if (err) +- goto out2; +- + packet_cached_dev_reset(po); + + sk->sk_destruct = packet_sock_destruct; +@@ -3462,7 +3462,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, + sock_prot_inuse_add(net, &packet_proto, 1); + + return 0; +-out2: ++out_sk_free: + sk_free(sk); + out: + return err; +-- +2.43.0 + diff --git a/queue-6.1/alsa-usb-audio-make-mic-volume-workarounds-globally-.patch b/queue-6.1/alsa-usb-audio-make-mic-volume-workarounds-globally-.patch new file mode 100644 index 00000000000..e2e3f0e71f0 --- /dev/null +++ b/queue-6.1/alsa-usb-audio-make-mic-volume-workarounds-globally-.patch @@ -0,0 +1,197 @@ +From 7b7b6e81a4350f344bfc2c7187619b2c6a0c6855 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2024 13:02:18 +0100 +Subject: ALSA: usb-audio: Make mic volume workarounds globally applicable + +From: Takashi Iwai + +[ Upstream commit d6e6b9218ced5249b9136833ef5ec3f554ec7fde ] + +It seems that many webcams have buggy firmware and don't expose the +mic capture volume with the proper resolution. We have workarounds in +mixer.c, but judging from the numbers, those can be better managed as +global quirk flags. + +Link: https://patch.msgid.link/20241105120220.5740-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer.c | 58 ++++++++++++-------------------------------- + sound/usb/quirks.c | 31 +++++++++++++++++++---- + sound/usb/usbaudio.h | 4 +++ + 3 files changed, 45 insertions(+), 48 deletions(-) + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 102a9b3ba3bef..4cded91d22a8d 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1084,6 +1084,21 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + struct snd_kcontrol *kctl) + { + struct snd_usb_audio *chip = cval->head.mixer->chip; ++ ++ if (chip->quirk_flags & QUIRK_FLAG_MIC_RES_384) { ++ if (!strcmp(kctl->id.name, "Mic Capture Volume")) { ++ usb_audio_info(chip, ++ "set resolution quirk: cval->res = 384\n"); ++ cval->res = 384; ++ } ++ } else if (chip->quirk_flags & QUIRK_FLAG_MIC_RES_16) { ++ if (!strcmp(kctl->id.name, "Mic Capture Volume")) { ++ usb_audio_info(chip, ++ "set resolution quirk: cval->res = 16\n"); ++ cval->res = 16; ++ } ++ } ++ + switch (chip->usb_id) { + case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */ + case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */ +@@ -1168,27 +1183,6 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + } + break; + +- case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */ +- case USB_ID(0x046d, 0x0808): +- case USB_ID(0x046d, 0x0809): +- case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */ +- case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */ +- case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */ +- case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */ +- case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */ +- case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */ +- case USB_ID(0x046d, 0x0991): +- case USB_ID(0x046d, 0x09a2): /* QuickCam Communicate Deluxe/S7500 */ +- /* Most audio usb devices lie about volume resolution. +- * Most Logitech webcams have res = 384. +- * Probably there is some logitech magic behind this number --fishor +- */ +- if (!strcmp(kctl->id.name, "Mic Capture Volume")) { +- usb_audio_info(chip, +- "set resolution quirk: cval->res = 384\n"); +- cval->res = 384; +- } +- break; + case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */ + if ((strstr(kctl->id.name, "Playback Volume") != NULL) || + strstr(kctl->id.name, "Capture Volume") != NULL) { +@@ -1197,28 +1191,6 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + cval->res = 1; + } + break; +- case USB_ID(0x1224, 0x2a25): /* Jieli Technology USB PHY 2.0 */ +- if (!strcmp(kctl->id.name, "Mic Capture Volume")) { +- usb_audio_info(chip, +- "set resolution quirk: cval->res = 16\n"); +- cval->res = 16; +- } +- break; +- case USB_ID(0x1bcf, 0x2283): /* NexiGo N930AF FHD Webcam */ +- case USB_ID(0x03f0, 0x654a): /* HP 320 FHD Webcam */ +- if (!strcmp(kctl->id.name, "Mic Capture Volume")) { +- usb_audio_info(chip, +- "set resolution quirk: cval->res = 16\n"); +- cval->res = 16; +- } +- break; +- case USB_ID(0x1bcf, 0x2281): /* HD Webcam */ +- if (!strcmp(kctl->id.name, "Mic Capture Volume")) { +- usb_audio_info(chip, +- "set resolution quirk: cval->res = 16\n"); +- cval->res = 16; +- } +- break; + } + } + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 795c8aa6564bc..ecb49ba8432c2 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2030,7 +2030,7 @@ struct usb_audio_quirk_flags_table { + static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + /* Device matches */ + DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */ +- QUIRK_FLAG_GET_SAMPLE_RATE), ++ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x041e, 0x4080, /* Creative Live Cam VF0610 */ +@@ -2038,10 +2038,31 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + DEVICE_FLG(0x045e, 0x083c, /* MS USB Link headset */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY | + QUIRK_FLAG_DISABLE_AUTOSUSPEND), ++ DEVICE_FLG(0x046d, 0x0807, /* Logitech Webcam C500 */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), ++ DEVICE_FLG(0x046d, 0x0808, /* Logitech Webcam C600 */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), ++ DEVICE_FLG(0x046d, 0x0809, ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), ++ DEVICE_FLG(0x046d, 0x0819, /* Logitech Webcam C210 */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), ++ DEVICE_FLG(0x046d, 0x081b, /* HD Webcam c310 */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), ++ DEVICE_FLG(0x046d, 0x081d, /* HD Webcam c510 */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), ++ DEVICE_FLG(0x046d, 0x0825, /* HD Webcam c270 */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), ++ DEVICE_FLG(0x046d, 0x0826, /* HD Webcam c525 */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), + DEVICE_FLG(0x046d, 0x084c, /* Logitech ConferenceCam Connect */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY_1M), ++ DEVICE_FLG(0x046d, 0x08ca, /* Logitech Quickcam Fusion */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), + DEVICE_FLG(0x046d, 0x0991, /* Logitech QuickCam Pro */ +- QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR), ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR | ++ QUIRK_FLAG_MIC_RES_384), ++ DEVICE_FLG(0x046d, 0x09a2, /* QuickCam Communicate Deluxe/S7500 */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIC_RES_384), + DEVICE_FLG(0x046d, 0x09a4, /* Logitech QuickCam E 3500 */ + QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x0499, 0x1509, /* Steinberg UR22 */ +@@ -2109,7 +2130,7 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + DEVICE_FLG(0x0fd9, 0x0008, /* Hauppauge HVR-950Q */ + QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER), + DEVICE_FLG(0x1224, 0x2a25, /* Jieli Technology USB PHY 2.0 */ +- QUIRK_FLAG_GET_SAMPLE_RATE), ++ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x1397, 0x0507, /* Behringer UMC202HD */ +@@ -2147,9 +2168,9 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + DEVICE_FLG(0x19f7, 0x0035, /* RODE NT-USB+ */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x1bcf, 0x2281, /* HD Webcam */ +- QUIRK_FLAG_GET_SAMPLE_RATE), ++ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x1bcf, 0x2283, /* NexiGo N930AF FHD Webcam */ +- QUIRK_FLAG_GET_SAMPLE_RATE), ++ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16), + DEVICE_FLG(0x2040, 0x7200, /* Hauppauge HVR-950Q */ + QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER), + DEVICE_FLG(0x2040, 0x7201, /* Hauppauge HVR-950Q-MXL */ +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index f5a8dca66457f..65dcb1a02e976 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -178,6 +178,8 @@ extern bool snd_usb_skip_validation; + * QUIRK_FLAG_FIXED_RATE + * Do not set PCM rate (frequency) when only one rate is available + * for the given endpoint. ++ * QUIRK_FLAG_MIC_RES_16 and QUIRK_FLAG_MIC_RES_384 ++ * Set the fixed resolution for Mic Capture Volume (mostly for webcams) + */ + + #define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0) +@@ -202,5 +204,7 @@ extern bool snd_usb_skip_validation; + #define QUIRK_FLAG_IFACE_SKIP_CLOSE (1U << 19) + #define QUIRK_FLAG_FORCE_IFACE_RESET (1U << 20) + #define QUIRK_FLAG_FIXED_RATE (1U << 21) ++#define QUIRK_FLAG_MIC_RES_16 (1U << 22) ++#define QUIRK_FLAG_MIC_RES_384 (1U << 23) + + #endif /* __USBAUDIO_H */ +-- +2.43.0 + diff --git a/queue-6.1/asoc-amd-yc-add-quirk-for-microphone-on-lenovo-think.patch b/queue-6.1/asoc-amd-yc-add-quirk-for-microphone-on-lenovo-think.patch new file mode 100644 index 00000000000..bc34b9f3300 --- /dev/null +++ b/queue-6.1/asoc-amd-yc-add-quirk-for-microphone-on-lenovo-think.patch @@ -0,0 +1,46 @@ +From 0e4d7d58c7b8e88a701b6853fbbba1a8948b38e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Nov 2024 08:56:05 +0100 +Subject: ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 + 21M1CTO1WW +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit cbc86dd0a4fe9f8c41075328c2e740b68419d639 ] + +Add a quirk for Tova's Lenovo Thinkpad T14s with product name 21M1. + +Suggested-by: Tova +Link: https://bugs.debian.org/1087673 +Signed-off-by: Uwe Kleine-König +Link: https://patch.msgid.link/20241122075606.213132-2-ukleinek@debian.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index f38f882fd55ec..af9601bea275e 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -220,6 +220,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21J6"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21M1"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.1/asoc-hdmi-codec-reorder-channel-allocation-list.patch b/queue-6.1/asoc-hdmi-codec-reorder-channel-allocation-list.patch new file mode 100644 index 00000000000..f2926d9a81e --- /dev/null +++ b/queue-6.1/asoc-hdmi-codec-reorder-channel-allocation-list.patch @@ -0,0 +1,210 @@ +From 999305bd1b3bccef2d055e66d9226d92d614abdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 04:43:44 +0000 +Subject: ASoC: hdmi-codec: reorder channel allocation list + +From: Jonas Karlman + +[ Upstream commit 82ff5abc2edcfba0c0f1a1be807795e2876f46e9 ] + +The ordering in hdmi_codec_get_ch_alloc_table_idx() results in +wrong channel allocation for a number of cases, e.g. when ELD +reports FL|FR|LFE|FC|RL|RR or FL|FR|LFE|FC|RL|RR|RC|RLC|RRC: + +ca_id 0x01 with speaker mask FL|FR|LFE is selected instead of +ca_id 0x03 with speaker mask FL|FR|LFE|FC for 4 channels + +and + +ca_id 0x04 with speaker mask FL|FR|RC gets selected instead of +ca_id 0x0b with speaker mask FL|FR|LFE|FC|RL|RR for 6 channels + +Fix this by reordering the channel allocation list with most +specific speaker masks at the top. + +Signed-off-by: Jonas Karlman +Signed-off-by: Christian Hewitt +Link: https://patch.msgid.link/20241115044344.3510979-1-christianshewitt@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/hdmi-codec.c | 140 +++++++++++++++++++--------------- + 1 file changed, 77 insertions(+), 63 deletions(-) + +diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c +index d8259afc60b08..cb664d3d02dd0 100644 +--- a/sound/soc/codecs/hdmi-codec.c ++++ b/sound/soc/codecs/hdmi-codec.c +@@ -184,84 +184,97 @@ static const struct snd_pcm_chmap_elem hdmi_codec_8ch_chmaps[] = { + /* + * hdmi_codec_channel_alloc: speaker configuration available for CEA + * +- * This is an ordered list that must match with hdmi_codec_8ch_chmaps struct ++ * This is an ordered list where ca_id must exist in hdmi_codec_8ch_chmaps + * The preceding ones have better chances to be selected by + * hdmi_codec_get_ch_alloc_table_idx(). + */ + static const struct hdmi_codec_cea_spk_alloc hdmi_codec_channel_alloc[] = { + { .ca_id = 0x00, .n_ch = 2, +- .mask = FL | FR}, +- /* 2.1 */ +- { .ca_id = 0x01, .n_ch = 4, +- .mask = FL | FR | LFE}, +- /* Dolby Surround */ ++ .mask = FL | FR }, ++ { .ca_id = 0x03, .n_ch = 4, ++ .mask = FL | FR | LFE | FC }, + { .ca_id = 0x02, .n_ch = 4, + .mask = FL | FR | FC }, +- /* surround51 */ ++ { .ca_id = 0x01, .n_ch = 4, ++ .mask = FL | FR | LFE }, + { .ca_id = 0x0b, .n_ch = 6, +- .mask = FL | FR | LFE | FC | RL | RR}, +- /* surround40 */ +- { .ca_id = 0x08, .n_ch = 6, +- .mask = FL | FR | RL | RR }, +- /* surround41 */ +- { .ca_id = 0x09, .n_ch = 6, +- .mask = FL | FR | LFE | RL | RR }, +- /* surround50 */ ++ .mask = FL | FR | LFE | FC | RL | RR }, + { .ca_id = 0x0a, .n_ch = 6, + .mask = FL | FR | FC | RL | RR }, +- /* 6.1 */ +- { .ca_id = 0x0f, .n_ch = 8, +- .mask = FL | FR | LFE | FC | RL | RR | RC }, +- /* surround71 */ ++ { .ca_id = 0x09, .n_ch = 6, ++ .mask = FL | FR | LFE | RL | RR }, ++ { .ca_id = 0x08, .n_ch = 6, ++ .mask = FL | FR | RL | RR }, ++ { .ca_id = 0x07, .n_ch = 6, ++ .mask = FL | FR | LFE | FC | RC }, ++ { .ca_id = 0x06, .n_ch = 6, ++ .mask = FL | FR | FC | RC }, ++ { .ca_id = 0x05, .n_ch = 6, ++ .mask = FL | FR | LFE | RC }, ++ { .ca_id = 0x04, .n_ch = 6, ++ .mask = FL | FR | RC }, + { .ca_id = 0x13, .n_ch = 8, + .mask = FL | FR | LFE | FC | RL | RR | RLC | RRC }, +- /* others */ +- { .ca_id = 0x03, .n_ch = 8, +- .mask = FL | FR | LFE | FC }, +- { .ca_id = 0x04, .n_ch = 8, +- .mask = FL | FR | RC}, +- { .ca_id = 0x05, .n_ch = 8, +- .mask = FL | FR | LFE | RC }, +- { .ca_id = 0x06, .n_ch = 8, +- .mask = FL | FR | FC | RC }, +- { .ca_id = 0x07, .n_ch = 8, +- .mask = FL | FR | LFE | FC | RC }, +- { .ca_id = 0x0c, .n_ch = 8, +- .mask = FL | FR | RC | RL | RR }, +- { .ca_id = 0x0d, .n_ch = 8, +- .mask = FL | FR | LFE | RL | RR | RC }, +- { .ca_id = 0x0e, .n_ch = 8, +- .mask = FL | FR | FC | RL | RR | RC }, +- { .ca_id = 0x10, .n_ch = 8, +- .mask = FL | FR | RL | RR | RLC | RRC }, +- { .ca_id = 0x11, .n_ch = 8, +- .mask = FL | FR | LFE | RL | RR | RLC | RRC }, ++ { .ca_id = 0x1f, .n_ch = 8, ++ .mask = FL | FR | LFE | FC | RL | RR | FLC | FRC }, + { .ca_id = 0x12, .n_ch = 8, + .mask = FL | FR | FC | RL | RR | RLC | RRC }, +- { .ca_id = 0x14, .n_ch = 8, +- .mask = FL | FR | FLC | FRC }, +- { .ca_id = 0x15, .n_ch = 8, +- .mask = FL | FR | LFE | FLC | FRC }, +- { .ca_id = 0x16, .n_ch = 8, +- .mask = FL | FR | FC | FLC | FRC }, +- { .ca_id = 0x17, .n_ch = 8, +- .mask = FL | FR | LFE | FC | FLC | FRC }, +- { .ca_id = 0x18, .n_ch = 8, +- .mask = FL | FR | RC | FLC | FRC }, +- { .ca_id = 0x19, .n_ch = 8, +- .mask = FL | FR | LFE | RC | FLC | FRC }, +- { .ca_id = 0x1a, .n_ch = 8, +- .mask = FL | FR | RC | FC | FLC | FRC }, +- { .ca_id = 0x1b, .n_ch = 8, +- .mask = FL | FR | LFE | RC | FC | FLC | FRC }, +- { .ca_id = 0x1c, .n_ch = 8, +- .mask = FL | FR | RL | RR | FLC | FRC }, +- { .ca_id = 0x1d, .n_ch = 8, +- .mask = FL | FR | LFE | RL | RR | FLC | FRC }, + { .ca_id = 0x1e, .n_ch = 8, + .mask = FL | FR | FC | RL | RR | FLC | FRC }, +- { .ca_id = 0x1f, .n_ch = 8, +- .mask = FL | FR | LFE | FC | RL | RR | FLC | FRC }, ++ { .ca_id = 0x11, .n_ch = 8, ++ .mask = FL | FR | LFE | RL | RR | RLC | RRC }, ++ { .ca_id = 0x1d, .n_ch = 8, ++ .mask = FL | FR | LFE | RL | RR | FLC | FRC }, ++ { .ca_id = 0x10, .n_ch = 8, ++ .mask = FL | FR | RL | RR | RLC | RRC }, ++ { .ca_id = 0x1c, .n_ch = 8, ++ .mask = FL | FR | RL | RR | FLC | FRC }, ++ { .ca_id = 0x0f, .n_ch = 8, ++ .mask = FL | FR | LFE | FC | RL | RR | RC }, ++ { .ca_id = 0x1b, .n_ch = 8, ++ .mask = FL | FR | LFE | RC | FC | FLC | FRC }, ++ { .ca_id = 0x0e, .n_ch = 8, ++ .mask = FL | FR | FC | RL | RR | RC }, ++ { .ca_id = 0x1a, .n_ch = 8, ++ .mask = FL | FR | RC | FC | FLC | FRC }, ++ { .ca_id = 0x0d, .n_ch = 8, ++ .mask = FL | FR | LFE | RL | RR | RC }, ++ { .ca_id = 0x19, .n_ch = 8, ++ .mask = FL | FR | LFE | RC | FLC | FRC }, ++ { .ca_id = 0x0c, .n_ch = 8, ++ .mask = FL | FR | RC | RL | RR }, ++ { .ca_id = 0x18, .n_ch = 8, ++ .mask = FL | FR | RC | FLC | FRC }, ++ { .ca_id = 0x17, .n_ch = 8, ++ .mask = FL | FR | LFE | FC | FLC | FRC }, ++ { .ca_id = 0x16, .n_ch = 8, ++ .mask = FL | FR | FC | FLC | FRC }, ++ { .ca_id = 0x15, .n_ch = 8, ++ .mask = FL | FR | LFE | FLC | FRC }, ++ { .ca_id = 0x14, .n_ch = 8, ++ .mask = FL | FR | FLC | FRC }, ++ { .ca_id = 0x0b, .n_ch = 8, ++ .mask = FL | FR | LFE | FC | RL | RR }, ++ { .ca_id = 0x0a, .n_ch = 8, ++ .mask = FL | FR | FC | RL | RR }, ++ { .ca_id = 0x09, .n_ch = 8, ++ .mask = FL | FR | LFE | RL | RR }, ++ { .ca_id = 0x08, .n_ch = 8, ++ .mask = FL | FR | RL | RR }, ++ { .ca_id = 0x07, .n_ch = 8, ++ .mask = FL | FR | LFE | FC | RC }, ++ { .ca_id = 0x06, .n_ch = 8, ++ .mask = FL | FR | FC | RC }, ++ { .ca_id = 0x05, .n_ch = 8, ++ .mask = FL | FR | LFE | RC }, ++ { .ca_id = 0x04, .n_ch = 8, ++ .mask = FL | FR | RC }, ++ { .ca_id = 0x03, .n_ch = 8, ++ .mask = FL | FR | LFE | FC }, ++ { .ca_id = 0x02, .n_ch = 8, ++ .mask = FL | FR | FC }, ++ { .ca_id = 0x01, .n_ch = 8, ++ .mask = FL | FR | LFE }, + }; + + struct hdmi_codec_priv { +@@ -370,7 +383,8 @@ static int hdmi_codec_chmap_ctl_get(struct snd_kcontrol *kcontrol, + struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol); + struct hdmi_codec_priv *hcp = info->private_data; + +- map = info->chmap[hcp->chmap_idx].map; ++ if (hcp->chmap_idx != HDMI_CODEC_CHMAP_IDX_UNKNOWN) ++ map = info->chmap[hcp->chmap_idx].map; + + for (i = 0; i < info->max_channels; i++) { + if (hcp->chmap_idx == HDMI_CODEC_CHMAP_IDX_UNKNOWN) +-- +2.43.0 + diff --git a/queue-6.1/bluetooth-btusb-add-rtl8852be-device-0489-e123-to-de.patch b/queue-6.1/bluetooth-btusb-add-rtl8852be-device-0489-e123-to-de.patch new file mode 100644 index 00000000000..88966308a8f --- /dev/null +++ b/queue-6.1/bluetooth-btusb-add-rtl8852be-device-0489-e123-to-de.patch @@ -0,0 +1,67 @@ +From 451df206c3920415e85c708180778d85df3a4036 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 16:37:29 +0800 +Subject: Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables + +From: Hilda Wu + +[ Upstream commit 69b84ffce260ff13826dc10aeb3c3e5c2288a552 ] + +Add the support ID 0489:e123 to usb_device_id table for +Realtek RTL8852B chip. + +The device info from /sys/kernel/debug/usb/devices as below. + +T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=04 Dev#= 7 Spd=12 MxCh= 0 +D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0489 ProdID=e123 Rev= 0.00 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Hilda Wu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 0b915f2c76078..4c9747de0d6de 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -549,6 +549,8 @@ static const struct usb_device_id blacklist_table[] = { + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3591), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, ++ { USB_DEVICE(0x0489, 0xe123), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + +-- +2.43.0 + diff --git a/queue-6.1/bluetooth-hci_core-fix-not-checking-skb-length-on-hc.patch b/queue-6.1/bluetooth-hci_core-fix-not-checking-skb-length-on-hc.patch new file mode 100644 index 00000000000..7a975568198 --- /dev/null +++ b/queue-6.1/bluetooth-hci_core-fix-not-checking-skb-length-on-hc.patch @@ -0,0 +1,65 @@ +From f538d1348df388b947f740eac83d7c1e92060f67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 10:16:48 -0400 +Subject: Bluetooth: hci_core: Fix not checking skb length on + hci_acldata_packet + +From: Luiz Augusto von Dentz + +[ Upstream commit 3fe288a8214e7dd784d1f9b7c9e448244d316b47 ] + +This fixes not checking if skb really contains an ACL header otherwise +the code may attempt to access some uninitilized/invalid memory past the +valid skb->data. + +Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com +Tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 789f7f4a09089..3cd7c212375fc 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3829,18 +3829,22 @@ static void hci_tx_work(struct work_struct *work) + /* ACL data packet */ + static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) + { +- struct hci_acl_hdr *hdr = (void *) skb->data; ++ struct hci_acl_hdr *hdr; + struct hci_conn *conn; + __u16 handle, flags; + +- skb_pull(skb, HCI_ACL_HDR_SIZE); ++ hdr = skb_pull_data(skb, sizeof(*hdr)); ++ if (!hdr) { ++ bt_dev_err(hdev, "ACL packet too small"); ++ goto drop; ++ } + + handle = __le16_to_cpu(hdr->handle); + flags = hci_flags(handle); + handle = hci_handle(handle); + +- BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len, +- handle, flags); ++ bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len, ++ handle, flags); + + hdev->stat.acl_rx++; + +@@ -3859,6 +3863,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) + handle); + } + ++drop: + kfree_skb(skb); + } + +-- +2.43.0 + diff --git a/queue-6.1/bluetooth-l2cap-do-not-leave-dangling-sk-pointer-on-.patch b/queue-6.1/bluetooth-l2cap-do-not-leave-dangling-sk-pointer-on-.patch new file mode 100644 index 00000000000..c3801421265 --- /dev/null +++ b/queue-6.1/bluetooth-l2cap-do-not-leave-dangling-sk-pointer-on-.patch @@ -0,0 +1,40 @@ +From 634393b830cddd2333f0f908451576823f57e1aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 16:38:01 +0100 +Subject: Bluetooth: L2CAP: do not leave dangling sk pointer on error in + l2cap_sock_create() + +From: Ignat Korchagin + +[ Upstream commit 7c4f78cdb8e7501e9f92d291a7d956591bf73be9 ] + +bt_sock_alloc() allocates the sk object and attaches it to the provided +sock object. On error l2cap_sock_alloc() frees the sk object, but the +dangling pointer is still attached to the sock object, which may create +use-after-free in other code. + +Signed-off-by: Ignat Korchagin +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20241014153808.51894-3-ignat@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_sock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index b17782dc513b5..4e965916c17c1 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1920,6 +1920,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, + chan = l2cap_chan_create(); + if (!chan) { + sk_free(sk); ++ sock->sk = NULL; + return NULL; + } + +-- +2.43.0 + diff --git a/queue-6.1/bluetooth-rfcomm-avoid-leaving-dangling-sk-pointer-i.patch b/queue-6.1/bluetooth-rfcomm-avoid-leaving-dangling-sk-pointer-i.patch new file mode 100644 index 00000000000..9422e24bb56 --- /dev/null +++ b/queue-6.1/bluetooth-rfcomm-avoid-leaving-dangling-sk-pointer-i.patch @@ -0,0 +1,52 @@ +From 2c15b739ef48c89ebdfe226a625781409f36a5d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 16:38:02 +0100 +Subject: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in + rfcomm_sock_alloc() + +From: Ignat Korchagin + +[ Upstream commit 3945c799f12b8d1f49a3b48369ca494d981ac465 ] + +bt_sock_alloc() attaches allocated sk object to the provided sock object. +If rfcomm_dlc_alloc() fails, we release the sk object, but leave the +dangling pointer in the sock object, which may cause use-after-free. + +Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc(). + +Signed-off-by: Ignat Korchagin +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20241014153808.51894-4-ignat@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/rfcomm/sock.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c +index 4fae82fedccaf..1cf6543bdec55 100644 +--- a/net/bluetooth/rfcomm/sock.c ++++ b/net/bluetooth/rfcomm/sock.c +@@ -274,13 +274,13 @@ static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, + struct rfcomm_dlc *d; + struct sock *sk; + +- sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); +- if (!sk) ++ d = rfcomm_dlc_alloc(prio); ++ if (!d) + return NULL; + +- d = rfcomm_dlc_alloc(prio); +- if (!d) { +- sk_free(sk); ++ sk = bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); ++ if (!sk) { ++ rfcomm_dlc_free(d); + return NULL; + } + +-- +2.43.0 + diff --git a/queue-6.1/btrfs-avoid-unnecessary-device-path-update-for-the-s.patch b/queue-6.1/btrfs-avoid-unnecessary-device-path-update-for-the-s.patch new file mode 100644 index 00000000000..75e1bf8fb46 --- /dev/null +++ b/queue-6.1/btrfs-avoid-unnecessary-device-path-update-for-the-s.patch @@ -0,0 +1,126 @@ +From 33d59f44dc9f8caeeea4aad25bd00cb95f32880e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2024 12:52:17 +0930 +Subject: btrfs: avoid unnecessary device path update for the same device + +From: Qu Wenruo + +[ Upstream commit 2e8b6bc0ab41ce41e6dfcc204b6cc01d5abbc952 ] + +[PROBLEM] +It is very common for udev to trigger device scan, and every time a +mounted btrfs device got re-scan from different soft links, we will get +some of unnecessary device path updates, this is especially common +for LVM based storage: + + # lvs + scratch1 test -wi-ao---- 10.00g + scratch2 test -wi-a----- 10.00g + scratch3 test -wi-a----- 10.00g + scratch4 test -wi-a----- 10.00g + scratch5 test -wi-a----- 10.00g + test test -wi-a----- 10.00g + + # mkfs.btrfs -f /dev/test/scratch1 + # mount /dev/test/scratch1 /mnt/btrfs + # dmesg -c + [ 205.705234] BTRFS: device fsid 7be2602f-9e35-4ecf-a6ff-9e91d2c182c9 devid 1 transid 6 /dev/mapper/test-scratch1 (253:4) scanned by mount (1154) + [ 205.710864] BTRFS info (device dm-4): first mount of filesystem 7be2602f-9e35-4ecf-a6ff-9e91d2c182c9 + [ 205.711923] BTRFS info (device dm-4): using crc32c (crc32c-intel) checksum algorithm + [ 205.713856] BTRFS info (device dm-4): using free-space-tree + [ 205.722324] BTRFS info (device dm-4): checking UUID tree + +So far so good, but even if we just touched any soft link of +"dm-4", we will get quite some unnecessary device path updates. + + # touch /dev/mapper/test-scratch1 + # dmesg -c + [ 469.295796] BTRFS info: devid 1 device path /dev/mapper/test-scratch1 changed to /dev/dm-4 scanned by (udev-worker) (1221) + [ 469.300494] BTRFS info: devid 1 device path /dev/dm-4 changed to /dev/mapper/test-scratch1 scanned by (udev-worker) (1221) + +Such device path rename is unnecessary and can lead to random path +change due to the udev race. + +[CAUSE] +Inside device_list_add(), we are using a very primitive way checking if +the device has changed, strcmp(). + +Which can never handle links well, no matter if it's hard or soft links. + +So every different link of the same device will be treated as a different +device, causing the unnecessary device path update. + +[FIX] +Introduce a helper, is_same_device(), and use path_equal() to properly +detect the same block device. +So that the different soft links won't trigger the rename race. + +Reviewed-by: Filipe Manana +Link: https://bugzilla.suse.com/show_bug.cgi?id=1230641 +Reported-by: Fabian Vogt +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 38 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 37 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 8c7e74499ed17..9779ab410f8fa 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -671,6 +671,42 @@ u8 *btrfs_sb_fsid_ptr(struct btrfs_super_block *sb) + return has_metadata_uuid ? sb->metadata_uuid : sb->fsid; + } + ++static bool is_same_device(struct btrfs_device *device, const char *new_path) ++{ ++ struct path old = { .mnt = NULL, .dentry = NULL }; ++ struct path new = { .mnt = NULL, .dentry = NULL }; ++ char *old_path = NULL; ++ bool is_same = false; ++ int ret; ++ ++ if (!device->name) ++ goto out; ++ ++ old_path = kzalloc(PATH_MAX, GFP_NOFS); ++ if (!old_path) ++ goto out; ++ ++ rcu_read_lock(); ++ ret = strscpy(old_path, rcu_str_deref(device->name), PATH_MAX); ++ rcu_read_unlock(); ++ if (ret < 0) ++ goto out; ++ ++ ret = kern_path(old_path, LOOKUP_FOLLOW, &old); ++ if (ret) ++ goto out; ++ ret = kern_path(new_path, LOOKUP_FOLLOW, &new); ++ if (ret) ++ goto out; ++ if (path_equal(&old, &new)) ++ is_same = true; ++out: ++ kfree(old_path); ++ path_put(&old); ++ path_put(&new); ++ return is_same; ++} ++ + /* + * Handle scanned device having its CHANGING_FSID_V2 flag set and the fs_devices + * being created with a disk that has already completed its fsid change. Such +@@ -889,7 +925,7 @@ static noinline struct btrfs_device *device_list_add(const char *path, + disk_super->fsid, devid, found_transid, path, + current->comm, task_pid_nr(current)); + +- } else if (!device->name || strcmp(device->name->str, path)) { ++ } else if (!device->name || !is_same_device(device, path)) { + /* + * When FS is already mounted. + * 1. If you are here and if the device->name is NULL that +-- +2.43.0 + diff --git a/queue-6.1/btrfs-do-not-clear-read-only-when-adding-sprout-devi.patch b/queue-6.1/btrfs-do-not-clear-read-only-when-adding-sprout-devi.patch new file mode 100644 index 00000000000..9d49955bbfd --- /dev/null +++ b/queue-6.1/btrfs-do-not-clear-read-only-when-adding-sprout-devi.patch @@ -0,0 +1,66 @@ +From 702f8b963a083807c64f600f9990cecc6336e68d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 14:27:32 -0700 +Subject: btrfs: do not clear read-only when adding sprout device + +From: Boris Burkov + +[ Upstream commit 70958a949d852cbecc3d46127bf0b24786df0130 ] + +If you follow the seed/sprout wiki, it suggests the following workflow: + +btrfstune -S 1 seed_dev +mount seed_dev mnt +btrfs device add sprout_dev +mount -o remount,rw mnt + +The first mount mounts the FS readonly, which results in not setting +BTRFS_FS_OPEN, and setting the readonly bit on the sb. The device add +somewhat surprisingly clears the readonly bit on the sb (though the +mount is still practically readonly, from the users perspective...). +Finally, the remount checks the readonly bit on the sb against the flag +and sees no change, so it does not run the code intended to run on +ro->rw transitions, leaving BTRFS_FS_OPEN unset. + +As a result, when the cleaner_kthread runs, it sees no BTRFS_FS_OPEN and +does no work. This results in leaking deleted snapshots until we run out +of space. + +I propose fixing it at the first departure from what feels reasonable: +when we clear the readonly bit on the sb during device add. + +A new fstest I have written reproduces the bug and confirms the fix. + +Reviewed-by: Qu Wenruo +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 9779ab410f8fa..a4177014eb8b0 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -2767,8 +2767,6 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path + set_blocksize(device->bdev, BTRFS_BDEV_BLOCKSIZE); + + if (seeding_dev) { +- btrfs_clear_sb_rdonly(sb); +- + /* GFP_KERNEL allocation must not be under device_list_mutex */ + seed_devices = btrfs_init_sprout(fs_info); + if (IS_ERR(seed_devices)) { +@@ -2911,8 +2909,6 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path + mutex_unlock(&fs_info->chunk_mutex); + mutex_unlock(&fs_info->fs_devices->device_list_mutex); + error_trans: +- if (seeding_dev) +- btrfs_set_sb_rdonly(sb); + if (trans) + btrfs_end_transaction(trans); + error_free_zone: +-- +2.43.0 + diff --git a/queue-6.1/dma-debug-fix-a-possible-deadlock-on-radix_lock.patch b/queue-6.1/dma-debug-fix-a-possible-deadlock-on-radix_lock.patch new file mode 100644 index 00000000000..bc559fd675c --- /dev/null +++ b/queue-6.1/dma-debug-fix-a-possible-deadlock-on-radix_lock.patch @@ -0,0 +1,68 @@ +From 4ac4b5d45f45d29397e1b19cbe244b13d8a5dd46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 11:06:00 +0100 +Subject: dma-debug: fix a possible deadlock on radix_lock + +From: Levi Yun + +[ Upstream commit 7543c3e3b9b88212fcd0aaf5cab5588797bdc7de ] + +radix_lock() shouldn't be held while holding dma_hash_entry[idx].lock +otherwise, there's a possible deadlock scenario when +dma debug API is called holding rq_lock(): + +CPU0 CPU1 CPU2 +dma_free_attrs() +check_unmap() add_dma_entry() __schedule() //out + (A) rq_lock() +get_hash_bucket() +(A) dma_entry_hash + check_sync() + (A) radix_lock() (W) dma_entry_hash +dma_entry_free() +(W) radix_lock() + // CPU2's one + (W) rq_lock() + +CPU1 situation can happen when it extending radix tree and +it tries to wake up kswapd via wake_all_kswapd(). + +CPU2 situation can happen while perf_event_task_sched_out() +(i.e. dma sync operation is called while deleting perf_event using + etm and etr tmc which are Arm Coresight hwtracing driver backends). + +To remove this possible situation, call dma_entry_free() after +put_hash_bucket() in check_unmap(). + +Reported-by: Denis Nikitin +Closes: https://lists.linaro.org/archives/list/coresight@lists.linaro.org/thread/2WMS7BBSF5OZYB63VT44U5YWLFP5HL6U/#RWM6MLQX5ANBTEQ2PRM7OXCBGCE6NPWU +Signed-off-by: Levi Yun +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/debug.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index de02c0808fb83..3e6f2a39beb3b 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -1044,9 +1044,13 @@ static void check_unmap(struct dma_debug_entry *ref) + } + + hash_bucket_del(entry); +- dma_entry_free(entry); +- + put_hash_bucket(bucket, flags); ++ ++ /* ++ * Free the entry outside of bucket_lock to avoid ABBA deadlocks ++ * between that and radix_lock. ++ */ ++ dma_entry_free(entry); + } + + static void check_for_stack(struct device *dev, +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-clear-rb_overflow-bit-when-enabling-inter.patch b/queue-6.1/drm-amdgpu-clear-rb_overflow-bit-when-enabling-inter.patch new file mode 100644 index 00000000000..870bfe9d235 --- /dev/null +++ b/queue-6.1/drm-amdgpu-clear-rb_overflow-bit-when-enabling-inter.patch @@ -0,0 +1,73 @@ +From 9c866f8c608c42d60dd9c97f7410fa12a4cefca4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jul 2024 18:01:23 -0400 +Subject: drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for + vega20_ih + +From: Victor Lu + +[ Upstream commit 8b22f048331dfd45fdfbf0efdfb1d43deff7518d ] + +Port this change to vega20_ih.c: +commit afbf7955ff01 ("drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts") + +Original commit message: +"Why: +Setting IH_RB_WPTR register to 0 will not clear the RB_OVERFLOW bit +if RB_ENABLE is not set. + +How to fix: +Set WPTR_OVERFLOW_CLEAR bit after RB_ENABLE bit is set. +The RB_ENABLE bit is required to be set, together with +WPTR_OVERFLOW_ENABLE bit so that setting WPTR_OVERFLOW_CLEAR bit +would clear the RB_OVERFLOW." + +Signed-off-by: Victor Lu +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vega20_ih.c | 27 ++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vega20_ih.c b/drivers/gpu/drm/amd/amdgpu/vega20_ih.c +index f1ba76c35cd6e..e85a0fb227d4e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vega20_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/vega20_ih.c +@@ -109,6 +109,33 @@ static int vega20_ih_toggle_ring_interrupts(struct amdgpu_device *adev, + tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, RB_ENABLE, (enable ? 1 : 0)); + tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, RB_GPU_TS_ENABLE, 1); + ++ if (enable) { ++ /* Unset the CLEAR_OVERFLOW bit to make sure the next step ++ * is switching the bit from 0 to 1 ++ */ ++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0); ++ if (amdgpu_sriov_vf(adev) && amdgpu_sriov_reg_indirect_ih(adev)) { ++ if (psp_reg_program(&adev->psp, ih_regs->psp_reg_id, tmp)) ++ return -ETIMEDOUT; ++ } else { ++ WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp); ++ } ++ ++ /* Clear RB_OVERFLOW bit */ ++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); ++ if (amdgpu_sriov_vf(adev) && amdgpu_sriov_reg_indirect_ih(adev)) { ++ if (psp_reg_program(&adev->psp, ih_regs->psp_reg_id, tmp)) ++ return -ETIMEDOUT; ++ } else { ++ WREG32_NO_KIQ(ih_regs->ih_rb_cntl, tmp); ++ } ++ ++ /* Unset the CLEAR_OVERFLOW bit immediately so new overflows ++ * can be detected. ++ */ ++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 0); ++ } ++ + /* enable_intr field is only valid in ring0 */ + if (ih == &adev->irq.ih) + tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, ENABLE_INTR, (enable ? 1 : 0)); +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-dereference-the-atcs-acpi-buffer.patch b/queue-6.1/drm-amdgpu-dereference-the-atcs-acpi-buffer.patch new file mode 100644 index 00000000000..4d84aaa50ca --- /dev/null +++ b/queue-6.1/drm-amdgpu-dereference-the-atcs-acpi-buffer.patch @@ -0,0 +1,36 @@ +From 186d75836560ed3fdd4501e630e0f5aba742058e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 14:54:31 +0800 +Subject: drm/amdgpu: Dereference the ATCS ACPI buffer + +From: Prike Liang + +[ Upstream commit 32e7ee293ff476c67b51be006e986021967bc525 ] + +Need to dereference the atcs acpi buffer after +the method is executed, otherwise it will result in +a memory leak. + +Signed-off-by: Prike Liang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index 7ad7ebaaa93cd..5fa7f6d8aa309 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -758,6 +758,7 @@ int amdgpu_acpi_power_shift_control(struct amdgpu_device *adev, + return -EIO; + } + ++ kfree(info); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-refine-error-handling-in-amdgpu_ttm_tt_pi.patch b/queue-6.1/drm-amdgpu-refine-error-handling-in-amdgpu_ttm_tt_pi.patch new file mode 100644 index 00000000000..5b5bf6e2bac --- /dev/null +++ b/queue-6.1/drm-amdgpu-refine-error-handling-in-amdgpu_ttm_tt_pi.patch @@ -0,0 +1,44 @@ +From 27f601472ddaae5695f1abc799686275e94a8b35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2024 17:21:09 +0800 +Subject: drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr + +From: Lang Yu + +[ Upstream commit 46186667f98fb7158c98f4ff5da62c427761ffcd ] + +Free sg table when dma_map_sgtable() failed to avoid memory leak. + +Signed-off-by: Lang Yu +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 7afefaa374276..2b15d938c779f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -776,7 +776,7 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_device *bdev, + /* Map SG to device */ + r = dma_map_sgtable(adev->dev, ttm->sg, direction, 0); + if (r) +- goto release_sg; ++ goto release_sg_table; + + /* convert SG to linear array of pages and dma addresses */ + drm_prime_sg_to_dma_addr_array(ttm->sg, gtt->ttm.dma_address, +@@ -784,6 +784,8 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_device *bdev, + + return 0; + ++release_sg_table: ++ sg_free_table(ttm->sg); + release_sg: + kfree(ttm->sg); + ttm->sg = NULL; +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-set-the-right-amdgpu-sg-segment-limitatio.patch b/queue-6.1/drm-amdgpu-set-the-right-amdgpu-sg-segment-limitatio.patch new file mode 100644 index 00000000000..4eb2eeaaaa8 --- /dev/null +++ b/queue-6.1/drm-amdgpu-set-the-right-amdgpu-sg-segment-limitatio.patch @@ -0,0 +1,85 @@ +From ce599a703f06af43c2251633b3cd203b4e241398 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 10:59:17 +0800 +Subject: drm/amdgpu: set the right AMDGPU sg segment limitation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Prike Liang + +[ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ] + +The driver needs to set the correct max_segment_size; +otherwise debug_dma_map_sg() will complain about the +over-mapping of the AMDGPU sg length as following: + +WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 +[ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd +[ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii +[ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 +[ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 +[ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 +[ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 +[ 364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 +[ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 +[ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 +[ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 +[ 364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 +[ 364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 +[ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 +[ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 +[ 364.049605] Call Trace: +[ 364.049607] +[ 364.049609] ? show_regs+0x6d/0x80 +[ 364.049614] ? __warn+0x8c/0x140 +[ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 +[ 364.049621] ? report_bug+0x193/0x1a0 +[ 364.049627] ? handle_bug+0x46/0x80 +[ 364.049631] ? exc_invalid_op+0x1d/0x80 +[ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 +[ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 +[ 364.049647] __dma_map_sg_attrs+0x90/0xe0 +[ 364.049651] dma_map_sgtable+0x25/0x40 +[ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] +[ 364.049935] ? srso_return_thunk+0x5/0x5f +[ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] +[ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] +[ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] +[ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] +[ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] +[ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] +[ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] +[ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] +[ 364.051054] ? srso_return_thunk+0x5/0x5f +[ 364.051057] ? tomoyo_file_ioctl+0x20/0x30 +[ 364.051063] __x64_sys_ioctl+0x9c/0xd0 +[ 364.051068] x64_sys_call+0x1219/0x20d0 +[ 364.051073] do_syscall_64+0x51/0x120 +[ 364.051077] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[ 364.051081] RIP: 0033:0x7fb2d2f1a94f + +Signed-off-by: Prike Liang +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 2b15d938c779f..725afb497805c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -1732,6 +1732,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev) + + mutex_init(&adev->mman.gtt_window_lock); + ++ dma_set_max_seg_size(adev->dev, UINT_MAX); + /* No others user of address space so set it to 0 */ + r = ttm_device_init(&adev->mman.bdev, &amdgpu_bo_driver, adev->dev, + adev_to_drm(adev)->anon_inode->i_mapping, +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-skip-amdgpu_device_cache_pci_state-under-.patch b/queue-6.1/drm-amdgpu-skip-amdgpu_device_cache_pci_state-under-.patch new file mode 100644 index 00000000000..c856b69a115 --- /dev/null +++ b/queue-6.1/drm-amdgpu-skip-amdgpu_device_cache_pci_state-under-.patch @@ -0,0 +1,41 @@ +From 386fff59ac5dc6ce6badb989ee91a87792071844 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2024 13:40:39 +0800 +Subject: drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov + +From: Victor Zhao + +[ Upstream commit afe260df55ac280cd56306248cb6d8a6b0db095c ] + +Under sriov, host driver will save and restore vf pci cfg space during +reset. And during device init, under sriov, pci_restore_state happens after +fullaccess released, and it can have race condition with mmio protection +enable from host side leading to missing interrupts. + +So skip amdgpu_device_cache_pci_state for sriov. + +Signed-off-by: Victor Zhao +Acked-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 1d0f6628f1d69..aca1a4e9b7ae9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -6013,6 +6013,9 @@ bool amdgpu_device_cache_pci_state(struct pci_dev *pdev) + struct amdgpu_device *adev = drm_to_adev(dev); + int r; + ++ if (amdgpu_sriov_vf(adev)) ++ return false; ++ + r = pci_save_state(pdev); + if (!r) { + kfree(adev->pci_state); +-- +2.43.0 + diff --git a/queue-6.1/drm-bridge-it6505-enable-module-autoloading.patch b/queue-6.1/drm-bridge-it6505-enable-module-autoloading.patch new file mode 100644 index 00000000000..1d5a9470169 --- /dev/null +++ b/queue-6.1/drm-bridge-it6505-enable-module-autoloading.patch @@ -0,0 +1,36 @@ +From dfbc812a74aea31efa6d695cca69408a4e8ef98c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2024 11:33:18 +0000 +Subject: drm/bridge: it6505: Enable module autoloading + +From: Liao Chen + +[ Upstream commit 1e2ab24cd708b1c864ff983ee1504c0a409d2f8e ] + +Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based +on the alias from of_device_id table. + +Signed-off-by: Liao Chen +Reviewed-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240902113320.903147-2-liaochen4@huawei.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it6505.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index fbccf7835f700..5a23277be4445 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -3349,6 +3349,7 @@ static const struct of_device_id it6505_of_match[] = { + { .compatible = "ite,it6505" }, + { } + }; ++MODULE_DEVICE_TABLE(of, it6505_of_match); + + static struct i2c_driver it6505_i2c_driver = { + .driver = { +-- +2.43.0 + diff --git a/queue-6.1/drm-display-fix-building-with-gcc-15.patch b/queue-6.1/drm-display-fix-building-with-gcc-15.patch new file mode 100644 index 00000000000..0e7277eb4ae --- /dev/null +++ b/queue-6.1/drm-display-fix-building-with-gcc-15.patch @@ -0,0 +1,55 @@ +From c82e0413bca6731e2ae5d11b92fbd882ea917f73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2024 14:53:11 +0530 +Subject: drm/display: Fix building with GCC 15 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit a500f3751d3c861be7e4463c933cf467240cca5d ] + +GCC 15 enables -Werror=unterminated-string-initialization by default. +This results in the following build error + +drivers/gpu/drm/display/drm_dp_dual_mode_helper.c: In function ‘is_hdmi_adaptor’: +drivers/gpu/drm/display/drm_dp_dual_mode_helper.c:164:17: error: initializer-string for array of + ‘char’ is too long [-Werror=unterminated-string-initialization] + 164 | "DP-HDMI ADAPTOR\x04"; + | ^~~~~~~~~~~~~~~~~~~~~ + +After discussion with Ville, the fix was to increase the size of +dp_dual_mode_hdmi_id array by one, so that it can accommodate the NULL +line character. This should let us build the kernel with GCC 15. + +Signed-off-by: Brahmajit Das +Reviewed-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20241002092311.942822-1-brahmajit.xyz@gmail.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_dual_mode_helper.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c b/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c +index bd61e20770a5b..719da3610310f 100644 +--- a/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c ++++ b/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c +@@ -160,11 +160,11 @@ EXPORT_SYMBOL(drm_dp_dual_mode_write); + + static bool is_hdmi_adaptor(const char hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN]) + { +- static const char dp_dual_mode_hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN] = ++ static const char dp_dual_mode_hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN + 1] = + "DP-HDMI ADAPTOR\x04"; + + return memcmp(hdmi_id, dp_dual_mode_hdmi_id, +- sizeof(dp_dual_mode_hdmi_id)) == 0; ++ DP_DUAL_MODE_HDMI_ID_LEN) == 0; + } + + static bool is_type1_adaptor(uint8_t adaptor_id) +-- +2.43.0 + diff --git a/queue-6.1/drm-mcde-enable-module-autoloading.patch b/queue-6.1/drm-mcde-enable-module-autoloading.patch new file mode 100644 index 00000000000..d8f56a8bd32 --- /dev/null +++ b/queue-6.1/drm-mcde-enable-module-autoloading.patch @@ -0,0 +1,36 @@ +From ed041799af3c31342ff2a58ed68a85ed7baafd32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2024 11:33:20 +0000 +Subject: drm/mcde: Enable module autoloading + +From: Liao Chen + +[ Upstream commit 8a16b5cdae26207ff4c22834559384ad3d7bc970 ] + +Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based +on the alias from of_device_id table. + +Signed-off-by: Liao Chen +Reviewed-by: Linus Walleij +Link: https://patchwork.freedesktop.org/patch/msgid/20240902113320.903147-4-liaochen4@huawei.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mcde/mcde_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c +index 1c4482ad507d9..78bdfd855d11b 100644 +--- a/drivers/gpu/drm/mcde/mcde_drv.c ++++ b/drivers/gpu/drm/mcde/mcde_drv.c +@@ -468,6 +468,7 @@ static const struct of_device_id mcde_of_match[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(of, mcde_of_match); + + static struct platform_driver mcde_driver = { + .driver = { +-- +2.43.0 + diff --git a/queue-6.1/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch b/queue-6.1/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch new file mode 100644 index 00000000000..44592df16e3 --- /dev/null +++ b/queue-6.1/drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch @@ -0,0 +1,51 @@ +From f701bb197a1ac28fa7473929f9de89d6b190fe90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2024 15:18:51 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Joaquín Ignacio Aramendía + +[ Upstream commit 361ebf5ef843b0aa1704c72eb26b91cf76c3c5b7 ] + +Add quirk orientation for AYA NEO 2. The name appears without spaces in +DMI strings. That made it difficult to reuse the 2021 match. Also the +display is larger in resolution. + +Tested by the JELOS team that has been patching their own kernel for a +while now and confirmed by users in the AYA NEO and ChimeraOS discord +servers. + +Signed-off-by: Joaquín Ignacio Aramendía +Signed-off-by: Tobias Jakobi +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/2b35545b77a9fd8c9699b751ca282226dcecb1dd.1726492131.git.tjakobi@math.uni-bielefeld.de +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 259a0c765bafb..55635c7bfcefc 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -184,6 +184,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* AYA NEO AYANEO 2 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYANEO 2"), ++ }, ++ .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* AYA NEO 2021 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"), +-- +2.43.0 + diff --git a/queue-6.1/drm-panel-orientation-quirks-add-quirk-for-aya-neo-f.patch b/queue-6.1/drm-panel-orientation-quirks-add-quirk-for-aya-neo-f.patch new file mode 100644 index 00000000000..cbcb87ab2a7 --- /dev/null +++ b/queue-6.1/drm-panel-orientation-quirks-add-quirk-for-aya-neo-f.patch @@ -0,0 +1,52 @@ +From e548e311f60cd04b0cb3ae6a7fa97f45d8e9cb8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2024 15:18:53 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Joaquín Ignacio Aramendía + +[ Upstream commit d7972d735ca80a40a571bf753c138263981a5698 ] + +Add quirk orientation for AYA NEO Founder. The name appears with spaces in +DMI strings as other devices of the brand. The panel is the same as the +NEXT and 2021 models. Those could not be reused as the former has VENDOR +name as "AYANEO" without spaces and the latter has "AYADEVICE". + +Tested by the JELOS team that has been patching their own kernel for a +while now and confirmed by users in the AYA NEO and ChimeraOS discord +servers. + +Signed-off-by: Joaquín Ignacio Aramendía +Signed-off-by: Tobias Jakobi +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/f71889a0b39f13f4b78481bd030377ca15035680.1726492131.git.tjakobi@math.uni-bielefeld.de +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 55635c7bfcefc..2ee14c6b6fd62 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -202,6 +202,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "AIR"), + }, + .driver_data = (void *)&lcd1080x1920_leftside_up, ++ }, { /* AYA NEO Founder */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYA NEO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "AYA NEO Founder"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* AYA NEO NEXT */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"), +-- +2.43.0 + diff --git a/queue-6.1/drm-panel-orientation-quirks-add-quirk-for-aya-neo-g.patch b/queue-6.1/drm-panel-orientation-quirks-add-quirk-for-aya-neo-g.patch new file mode 100644 index 00000000000..0bbbcc79080 --- /dev/null +++ b/queue-6.1/drm-panel-orientation-quirks-add-quirk-for-aya-neo-g.patch @@ -0,0 +1,52 @@ +From 640e9c860203534bd7f572c9aa95aab224b274c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2024 15:18:55 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Joaquín Ignacio Aramendía + +[ Upstream commit 428656feb972ca99200fc127b5aecb574efd9d3d ] + +Add quirk orientation for AYA NEO GEEK. The name appears without +spaces in DMI strings. The board name is completely different to +the previous models making it difficult to reuse their quirks +despite being the same resolution and using the same orientation. + +Tested by the JELOS team that has been patching their own kernel for a +while now and confirmed by users in the AYA NEO and ChimeraOS discord +servers. + +Signed-off-by: Joaquín Ignacio Aramendía +Signed-off-by: Tobias Jakobi +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/40350b0d63fe2b54e7cba1e14be50917203f0079.1726492131.git.tjakobi@math.uni-bielefeld.de +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 2ee14c6b6fd62..c00f6f16244c0 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -208,6 +208,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "AYA NEO Founder"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* AYA NEO GEEK */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYANEO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GEEK"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* AYA NEO NEXT */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"), +-- +2.43.0 + diff --git a/queue-6.1/drm-panel-simple-add-microchip-ac69t88a-lvds-display.patch b/queue-6.1/drm-panel-simple-add-microchip-ac69t88a-lvds-display.patch new file mode 100644 index 00000000000..2c2f90d2cf8 --- /dev/null +++ b/queue-6.1/drm-panel-simple-add-microchip-ac69t88a-lvds-display.patch @@ -0,0 +1,72 @@ +From 7d53633e8954559889c3d23bbac461b360385f9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Sep 2024 14:45:48 +0530 +Subject: drm/panel: simple: Add Microchip AC69T88A LVDS Display panel + +From: Manikandan Muralidharan + +[ Upstream commit 40da1463cd6879f542238b36c1148f517927c595 ] + +Add support for Microchip AC69T88A 5 inch TFT LCD 800x480 +Display module with LVDS interface.The panel uses the Sitronix +ST7262 800x480 Display driver + +Signed-off-by: Manikandan Muralidharan +Signed-off-by: Dharma Balasubiramani +Reviewed-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20240919091548.430285-2-manikandan.m@microchip.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index b560d62b6e219..a35e94e2ffd06 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -3908,6 +3908,31 @@ static const struct panel_desc yes_optoelectronics_ytc700tlag_05_201c = { + .connector_type = DRM_MODE_CONNECTOR_LVDS, + }; + ++static const struct drm_display_mode mchp_ac69t88a_mode = { ++ .clock = 25000, ++ .hdisplay = 800, ++ .hsync_start = 800 + 88, ++ .hsync_end = 800 + 88 + 5, ++ .htotal = 800 + 88 + 5 + 40, ++ .vdisplay = 480, ++ .vsync_start = 480 + 23, ++ .vsync_end = 480 + 23 + 5, ++ .vtotal = 480 + 23 + 5 + 1, ++}; ++ ++static const struct panel_desc mchp_ac69t88a = { ++ .modes = &mchp_ac69t88a_mode, ++ .num_modes = 1, ++ .bpc = 8, ++ .size = { ++ .width = 108, ++ .height = 65, ++ }, ++ .bus_flags = DRM_BUS_FLAG_DE_HIGH, ++ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA, ++ .connector_type = DRM_MODE_CONNECTOR_LVDS, ++}; ++ + static const struct drm_display_mode arm_rtsm_mode[] = { + { + .clock = 65000, +@@ -4325,6 +4350,9 @@ static const struct of_device_id platform_of_match[] = { + }, { + .compatible = "yes-optoelectronics,ytc700tlag-05-201c", + .data = &yes_optoelectronics_ytc700tlag_05_201c, ++ }, { ++ .compatible = "microchip,ac69t88a", ++ .data = &mchp_ac69t88a, + }, { + /* Must be the last entry */ + .compatible = "panel-dpi", +-- +2.43.0 + diff --git a/queue-6.1/drm-radeon-r600_cs-fix-possible-int-overflow-in-r600.patch b/queue-6.1/drm-radeon-r600_cs-fix-possible-int-overflow-in-r600.patch new file mode 100644 index 00000000000..c835b555535 --- /dev/null +++ b/queue-6.1/drm-radeon-r600_cs-fix-possible-int-overflow-in-r600.patch @@ -0,0 +1,40 @@ +From a415ddffd3863d6df05c48132cfbff61c3d92eb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2024 18:07:19 +0300 +Subject: drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() + +From: Igor Artemiev + +[ Upstream commit a1e2da6a5072f8abe5b0feaa91a5bcd9dc544a04 ] + +It is possible, although unlikely, that an integer overflow will occur +when the result of radeon_get_ib_value() is shifted to the left. + +Avoid it by casting one of the operands to larger data type (u64). + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Signed-off-by: Igor Artemiev +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index 6cf54a747749d..780352f794e91 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -2104,7 +2104,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p, + return -EINVAL; + } + +- offset = radeon_get_ib_value(p, idx+1) << 8; ++ offset = (u64)radeon_get_ib_value(p, idx+1) << 8; + if (offset != track->vgt_strmout_bo_offset[idx_value]) { + DRM_ERROR("bad STRMOUT_BASE_UPDATE, bo offset does not match: 0x%llx, 0x%x\n", + offset, track->vgt_strmout_bo_offset[idx_value]); +-- +2.43.0 + diff --git a/queue-6.1/drm-sched-memset-job-in-drm_sched_job_init.patch b/queue-6.1/drm-sched-memset-job-in-drm_sched_job_init.patch new file mode 100644 index 00000000000..3d2a4ad3252 --- /dev/null +++ b/queue-6.1/drm-sched-memset-job-in-drm_sched_job_init.patch @@ -0,0 +1,56 @@ +From 3e92957dccfb61f20458869a4267217f0a0f85a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2024 12:50:28 +0200 +Subject: drm/sched: memset() 'job' in drm_sched_job_init() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philipp Stanner + +[ Upstream commit 2320c9e6a768d135c7b0039995182bb1a4e4fd22 ] + +drm_sched_job_init() has no control over how users allocate struct +drm_sched_job. Unfortunately, the function can also not set some struct +members such as job->sched. + +This could theoretically lead to UB by users dereferencing the struct's +pointer members too early. + +It is easier to debug such issues if these pointers are initialized to +NULL, so dereferencing them causes a NULL pointer exception. +Accordingly, drm_sched_entity_init() does precisely that and initializes +its struct with memset(). + +Initialize parameter "job" to 0 in drm_sched_job_init(). + +Signed-off-by: Philipp Stanner +Link: https://patchwork.freedesktop.org/patch/msgid/20241021105028.19794-2-pstanner@redhat.com +Reviewed-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/scheduler/sched_main.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c +index f138b3be1646f..dbdd00c61315b 100644 +--- a/drivers/gpu/drm/scheduler/sched_main.c ++++ b/drivers/gpu/drm/scheduler/sched_main.c +@@ -595,6 +595,14 @@ int drm_sched_job_init(struct drm_sched_job *job, + if (!entity->rq) + return -ENOENT; + ++ /* ++ * We don't know for sure how the user has allocated. Thus, zero the ++ * struct so that unallowed (i.e., too early) usage of pointers that ++ * this function does not set is guaranteed to lead to a NULL pointer ++ * exception instead of UB. ++ */ ++ memset(job, 0, sizeof(*job)); ++ + job->entity = entity; + job->s_fence = drm_sched_fence_alloc(entity, owner); + if (!job->s_fence) +-- +2.43.0 + diff --git a/queue-6.1/drm-vc4-hdmi-avoid-log-spam-for-audio-start-failure.patch b/queue-6.1/drm-vc4-hdmi-avoid-log-spam-for-audio-start-failure.patch new file mode 100644 index 00000000000..7554e68f08d --- /dev/null +++ b/queue-6.1/drm-vc4-hdmi-avoid-log-spam-for-audio-start-failure.patch @@ -0,0 +1,46 @@ +From 0b5bc830c9ea88c77da8ad0ec5121c43f54247b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 16:20:28 +0100 +Subject: drm/vc4: hdmi: Avoid log spam for audio start failure + +From: Dom Cobley + +[ Upstream commit b4e5646178e86665f5caef2894578600f597098a ] + +We regularly get dmesg error reports of: +[ 18.184066] hdmi-audio-codec hdmi-audio-codec.3.auto: ASoC: error at snd_soc_dai_startup on i2s-hifi: -19 +[ 18.184098] MAI: soc_pcm_open() failed (-19) + +These are generated for any disconnected hdmi interface when pulseaudio +attempts to open the associated ALSA device (numerous times). Each open +generates a kernel error message, generating general log spam. + +The error messages all come from _soc_pcm_ret in sound/soc/soc-pcm.c#L39 +which suggests returning ENOTSUPP, rather that ENODEV will be quiet. +And indeed it is. + +Signed-off-by: Dom Cobley +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-5-dave.stevenson@raspberrypi.com +Signed-off-by: Dave Stevenson +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 649fd5c03f21d..3573db34a26b7 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -2160,7 +2160,7 @@ static int vc4_hdmi_audio_startup(struct device *dev, void *data) + } + + if (!vc4_hdmi_audio_can_stream(vc4_hdmi)) { +- ret = -ENODEV; ++ ret = -ENOTSUPP; + goto out_dev_exit; + } + +-- +2.43.0 + diff --git a/queue-6.1/drm-vc4-hvs-set-axi-panic-modes-for-the-hvs.patch b/queue-6.1/drm-vc4-hvs-set-axi-panic-modes-for-the-hvs.patch new file mode 100644 index 00000000000..f3401cc9b76 --- /dev/null +++ b/queue-6.1/drm-vc4-hvs-set-axi-panic-modes-for-the-hvs.patch @@ -0,0 +1,51 @@ +From 4f0413113fd38edff3e90664214b4becd90e3079 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 16:20:30 +0100 +Subject: drm/vc4: hvs: Set AXI panic modes for the HVS + +From: Dave Stevenson + +[ Upstream commit 014eccc9da7bfc76a3107fceea37dd60f1d63630 ] + +The HVS can change AXI request mode based on how full the COB +FIFOs are. +Until now the vc4 driver has been relying on the firmware to +have set these to sensible values. + +With HVS channel 2 now being used for live video, change the +panic mode for all channels to be explicitly set by the driver, +and the same for all channels. + +Reviewed-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-7-dave.stevenson@raspberrypi.com +Signed-off-by: Dave Stevenson +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c +index 82c8eda2d4358..88442cb65915f 100644 +--- a/drivers/gpu/drm/vc4/vc4_hvs.c ++++ b/drivers/gpu/drm/vc4/vc4_hvs.c +@@ -910,6 +910,17 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) + SCALER_DISPCTRL_SCLEIRQ); + + ++ /* Set AXI panic mode. ++ * VC4 panics when < 2 lines in FIFO. ++ * VC5 panics when less than 1 line in the FIFO. ++ */ ++ dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK | ++ SCALER_DISPCTRL_PANIC1_MASK | ++ SCALER_DISPCTRL_PANIC2_MASK); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2); ++ + /* Set AXI panic mode. + * VC4 panics when < 2 lines in FIFO. + * VC5 panics when less than 1 line in the FIFO. +-- +2.43.0 + diff --git a/queue-6.1/dsa-qca8k-use-nested-lock-to-avoid-splat.patch b/queue-6.1/dsa-qca8k-use-nested-lock-to-avoid-splat.patch new file mode 100644 index 00000000000..270d50880b4 --- /dev/null +++ b/queue-6.1/dsa-qca8k-use-nested-lock-to-avoid-splat.patch @@ -0,0 +1,39 @@ +From d12eb0e20a56817d923beb1ce1df32026b1797d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Nov 2024 18:59:55 +0100 +Subject: dsa: qca8k: Use nested lock to avoid splat + +From: Andrew Lunn + +[ Upstream commit 078e0d596f7b5952dad8662ace8f20ed2165e2ce ] + +qca8k_phy_eth_command() is used to probe the child MDIO bus while the +parent MDIO is locked. This causes lockdep splat, reporting a possible +deadlock. It is not an actually deadlock, because different locks are +used. By making use of mutex_lock_nested() we can avoid this false +positive. + +Signed-off-by: Andrew Lunn +Link: https://patch.msgid.link/20241110175955.3053664-1-andrew@lunn.ch +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca/qca8k-8xxx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c +index 641692f716f86..47e9b2c303831 100644 +--- a/drivers/net/dsa/qca/qca8k-8xxx.c ++++ b/drivers/net/dsa/qca/qca8k-8xxx.c +@@ -551,7 +551,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy, + * We therefore need to lock the MDIO bus onto which the switch is + * connected. + */ +- mutex_lock(&priv->bus->mdio_lock); ++ mutex_lock_nested(&priv->bus->mdio_lock, MDIO_MUTEX_NESTED); + + /* Actually start the request: + * 1. Send mdio master packet +-- +2.43.0 + diff --git a/queue-6.1/epoll-annotate-racy-check.patch b/queue-6.1/epoll-annotate-racy-check.patch new file mode 100644 index 00000000000..57c3e946f71 --- /dev/null +++ b/queue-6.1/epoll-annotate-racy-check.patch @@ -0,0 +1,64 @@ +From fe93a1a27106b78dc9de1a6130245230cf441b00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2024 11:05:16 +0200 +Subject: epoll: annotate racy check + +From: Christian Brauner + +[ Upstream commit 6474353a5e3d0b2cf610153cea0c61f576a36d0a ] + +Epoll relies on a racy fastpath check during __fput() in +eventpoll_release() to avoid the hit of pointlessly acquiring a +semaphore. Annotate that race by using WRITE_ONCE() and READ_ONCE(). + +Link: https://lore.kernel.org/r/66edfb3c.050a0220.3195df.001a.GAE@google.com +Link: https://lore.kernel.org/r/20240925-fungieren-anbauen-79b334b00542@brauner +Reviewed-by: Jan Kara +Reported-by: syzbot+3b6b32dc50537a49bb4a@syzkaller.appspotmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/eventpoll.c | 6 ++++-- + include/linux/eventpoll.h | 2 +- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 7221072f39fad..f296ffb57d052 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -703,7 +703,8 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi) + to_free = NULL; + head = file->f_ep; + if (head->first == &epi->fllink && !epi->fllink.next) { +- file->f_ep = NULL; ++ /* See eventpoll_release() for details. */ ++ WRITE_ONCE(file->f_ep, NULL); + if (!is_file_epoll(file)) { + struct epitems_head *v; + v = container_of(head, struct epitems_head, epitems); +@@ -1467,7 +1468,8 @@ static int attach_epitem(struct file *file, struct epitem *epi) + spin_unlock(&file->f_lock); + goto allocate; + } +- file->f_ep = head; ++ /* See eventpoll_release() for details. */ ++ WRITE_ONCE(file->f_ep, head); + to_free = NULL; + } + hlist_add_head_rcu(&epi->fllink, file->f_ep); +diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h +index 3337745d81bd6..0c0d00fcd131f 100644 +--- a/include/linux/eventpoll.h ++++ b/include/linux/eventpoll.h +@@ -42,7 +42,7 @@ static inline void eventpoll_release(struct file *file) + * because the file in on the way to be removed and nobody ( but + * eventpoll ) has still a reference to this file. + */ +- if (likely(!file->f_ep)) ++ if (likely(!READ_ONCE(file->f_ep))) + return; + + /* +-- +2.43.0 + diff --git a/queue-6.1/f2fs-fix-f2fs_bug_on-when-uninstalling-filesystem-ca.patch b/queue-6.1/f2fs-fix-f2fs_bug_on-when-uninstalling-filesystem-ca.patch new file mode 100644 index 00000000000..844712e8c0e --- /dev/null +++ b/queue-6.1/f2fs-fix-f2fs_bug_on-when-uninstalling-filesystem-ca.patch @@ -0,0 +1,85 @@ +From 6df2543b6a74d06625dafa6cc9b2392c10e0d58f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2024 02:44:00 -0600 +Subject: f2fs: fix f2fs_bug_on when uninstalling filesystem call + f2fs_evict_inode. + +From: Qi Han + +[ Upstream commit d5c367ef8287fb4d235c46a2f8c8d68715f3a0ca ] + +creating a large files during checkpoint disable until it runs out of +space and then delete it, then remount to enable checkpoint again, and +then unmount the filesystem triggers the f2fs_bug_on as below: + +------------[ cut here ]------------ +kernel BUG at fs/f2fs/inode.c:896! +CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 +Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI +RIP: 0010:f2fs_evict_inode+0x58c/0x610 +Call Trace: + __die_body+0x15/0x60 + die+0x33/0x50 + do_trap+0x10a/0x120 + f2fs_evict_inode+0x58c/0x610 + do_error_trap+0x60/0x80 + f2fs_evict_inode+0x58c/0x610 + exc_invalid_op+0x53/0x60 + f2fs_evict_inode+0x58c/0x610 + asm_exc_invalid_op+0x16/0x20 + f2fs_evict_inode+0x58c/0x610 + evict+0x101/0x260 + dispose_list+0x30/0x50 + evict_inodes+0x140/0x190 + generic_shutdown_super+0x2f/0x150 + kill_block_super+0x11/0x40 + kill_f2fs_super+0x7d/0x140 + deactivate_locked_super+0x2a/0x70 + cleanup_mnt+0xb3/0x140 + task_work_run+0x61/0x90 + +The root cause is: creating large files during disable checkpoint +period results in not enough free segments, so when writing back root +inode will failed in f2fs_enable_checkpoint. When umount the file +system after enabling checkpoint, the root inode is dirty in +f2fs_evict_inode function, which triggers BUG_ON. The steps to +reproduce are as follows: + +dd if=/dev/zero of=f2fs.img bs=1M count=55 +mount f2fs.img f2fs_dir -o checkpoint=disable:10% +dd if=/dev/zero of=big bs=1M count=50 +sync +rm big +mount -o remount,checkpoint=enable f2fs_dir +umount f2fs_dir + +Let's redirty inode when there is not free segments during checkpoint +is disable. + +Signed-off-by: Qi Han +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/inode.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index 5b672df194a99..0f350368dea73 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -719,8 +719,10 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) + !is_inode_flag_set(inode, FI_DIRTY_INODE)) + return 0; + +- if (!f2fs_is_checkpoint_ready(sbi)) ++ if (!f2fs_is_checkpoint_ready(sbi)) { ++ f2fs_mark_inode_dirty_sync(inode, true); + return -ENOSPC; ++ } + + /* + * We need to balance fs here to prevent from producing dirty node pages +-- +2.43.0 + diff --git a/queue-6.1/hid-bpf-fix-nkro-on-mistel-md770.patch b/queue-6.1/hid-bpf-fix-nkro-on-mistel-md770.patch new file mode 100644 index 00000000000..f342b437771 --- /dev/null +++ b/queue-6.1/hid-bpf-fix-nkro-on-mistel-md770.patch @@ -0,0 +1,191 @@ +From 6801fc048d7f85f5a555f46e1961f9c64e33fd8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 18:34:58 +0200 +Subject: HID: bpf: Fix NKRO on Mistel MD770 + +From: Benjamin Tissoires + +[ Upstream commit 9bc089307e8dff7797233308372b4a90ce8f79be ] + +Mistel MD770 keyboard (using Holtek Semiconductor, Inc. controller) has +a quirk in report descriptor in one of its interfaces (more detail in +the source file). Fix up the descriptor to allow NKRO to work again. + +Tested by loading the BPF program and confirming that 8 simultaneous +keypresses work. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218495 +Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/122 +Signed-off-by: Tatsuyuki Ishi +Acked-by: Jiri Kosina +Link: https://patch.msgid.link/20241017-import_bpf_6-13-v2-1-6a7acb89a97f@kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/bpf/progs/Mistel__MD770.bpf.c | 154 ++++++++++++++++++++++ + 1 file changed, 154 insertions(+) + create mode 100644 drivers/hid/bpf/progs/Mistel__MD770.bpf.c + +diff --git a/drivers/hid/bpf/progs/Mistel__MD770.bpf.c b/drivers/hid/bpf/progs/Mistel__MD770.bpf.c +new file mode 100644 +index 0000000000000..fb8b5a6968b12 +--- /dev/null ++++ b/drivers/hid/bpf/progs/Mistel__MD770.bpf.c +@@ -0,0 +1,154 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* Copyright (c) 2024 Tatsuyuki Ishi ++ */ ++ ++#include "vmlinux.h" ++#include "hid_bpf.h" ++#include "hid_bpf_helpers.h" ++#include ++ ++#define VID_HOLTEK 0x04D9 ++#define PID_MD770 0x0339 ++#define RDESC_SIZE 203 ++ ++HID_BPF_CONFIG( ++ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, VID_HOLTEK, PID_MD770) ++); ++ ++/* ++ * The Mistel MD770 keyboard reports the first 6 simultaneous key presses ++ * through the first interface, and anything beyond that through a second ++ * interface. Unfortunately, the second interface's report descriptor has an ++ * error, causing events to be malformed and ignored. This HID-BPF driver ++ * fixes the descriptor to allow NKRO to work again. ++ * ++ * For reference, this is the original report descriptor: ++ * ++ * 0x05, 0x01, // Usage Page (Generic Desktop) 0 ++ * 0x09, 0x80, // Usage (System Control) 2 ++ * 0xa1, 0x01, // Collection (Application) 4 ++ * 0x85, 0x01, // Report ID (1) 6 ++ * 0x19, 0x81, // Usage Minimum (129) 8 ++ * 0x29, 0x83, // Usage Maximum (131) 10 ++ * 0x15, 0x00, // Logical Minimum (0) 12 ++ * 0x25, 0x01, // Logical Maximum (1) 14 ++ * 0x95, 0x03, // Report Count (3) 16 ++ * 0x75, 0x01, // Report Size (1) 18 ++ * 0x81, 0x02, // Input (Data,Var,Abs) 20 ++ * 0x95, 0x01, // Report Count (1) 22 ++ * 0x75, 0x05, // Report Size (5) 24 ++ * 0x81, 0x01, // Input (Cnst,Arr,Abs) 26 ++ * 0xc0, // End Collection 28 ++ * 0x05, 0x0c, // Usage Page (Consumer Devices) 29 ++ * 0x09, 0x01, // Usage (Consumer Control) 31 ++ * 0xa1, 0x01, // Collection (Application) 33 ++ * 0x85, 0x02, // Report ID (2) 35 ++ * 0x15, 0x00, // Logical Minimum (0) 37 ++ * 0x25, 0x01, // Logical Maximum (1) 39 ++ * 0x95, 0x12, // Report Count (18) 41 ++ * 0x75, 0x01, // Report Size (1) 43 ++ * 0x0a, 0x83, 0x01, // Usage (AL Consumer Control Config) 45 ++ * 0x0a, 0x8a, 0x01, // Usage (AL Email Reader) 48 ++ * 0x0a, 0x92, 0x01, // Usage (AL Calculator) 51 ++ * 0x0a, 0x94, 0x01, // Usage (AL Local Machine Browser) 54 ++ * 0x09, 0xcd, // Usage (Play/Pause) 57 ++ * 0x09, 0xb7, // Usage (Stop) 59 ++ * 0x09, 0xb6, // Usage (Scan Previous Track) 61 ++ * 0x09, 0xb5, // Usage (Scan Next Track) 63 ++ * 0x09, 0xe2, // Usage (Mute) 65 ++ * 0x09, 0xea, // Usage (Volume Down) 67 ++ * 0x09, 0xe9, // Usage (Volume Up) 69 ++ * 0x0a, 0x21, 0x02, // Usage (AC Search) 71 ++ * 0x0a, 0x23, 0x02, // Usage (AC Home) 74 ++ * 0x0a, 0x24, 0x02, // Usage (AC Back) 77 ++ * 0x0a, 0x25, 0x02, // Usage (AC Forward) 80 ++ * 0x0a, 0x26, 0x02, // Usage (AC Stop) 83 ++ * 0x0a, 0x27, 0x02, // Usage (AC Refresh) 86 ++ * 0x0a, 0x2a, 0x02, // Usage (AC Bookmarks) 89 ++ * 0x81, 0x02, // Input (Data,Var,Abs) 92 ++ * 0x95, 0x01, // Report Count (1) 94 ++ * 0x75, 0x0e, // Report Size (14) 96 ++ * 0x81, 0x01, // Input (Cnst,Arr,Abs) 98 ++ * 0xc0, // End Collection 100 ++ * 0x05, 0x01, // Usage Page (Generic Desktop) 101 ++ * 0x09, 0x02, // Usage (Mouse) 103 ++ * 0xa1, 0x01, // Collection (Application) 105 ++ * 0x09, 0x01, // Usage (Pointer) 107 ++ * 0xa1, 0x00, // Collection (Physical) 109 ++ * 0x85, 0x03, // Report ID (3) 111 ++ * 0x05, 0x09, // Usage Page (Button) 113 ++ * 0x19, 0x01, // Usage Minimum (1) 115 ++ * 0x29, 0x08, // Usage Maximum (8) 117 ++ * 0x15, 0x00, // Logical Minimum (0) 119 ++ * 0x25, 0x01, // Logical Maximum (1) 121 ++ * 0x75, 0x01, // Report Size (1) 123 ++ * 0x95, 0x08, // Report Count (8) 125 ++ * 0x81, 0x02, // Input (Data,Var,Abs) 127 ++ * 0x05, 0x01, // Usage Page (Generic Desktop) 129 ++ * 0x09, 0x30, // Usage (X) 131 ++ * 0x09, 0x31, // Usage (Y) 133 ++ * 0x16, 0x01, 0x80, // Logical Minimum (-32767) 135 ++ * 0x26, 0xff, 0x7f, // Logical Maximum (32767) 138 ++ * 0x75, 0x10, // Report Size (16) 141 ++ * 0x95, 0x02, // Report Count (2) 143 ++ * 0x81, 0x06, // Input (Data,Var,Rel) 145 ++ * 0x09, 0x38, // Usage (Wheel) 147 ++ * 0x15, 0x81, // Logical Minimum (-127) 149 ++ * 0x25, 0x7f, // Logical Maximum (127) 151 ++ * 0x75, 0x08, // Report Size (8) 153 ++ * 0x95, 0x01, // Report Count (1) 155 ++ * 0x81, 0x06, // Input (Data,Var,Rel) 157 ++ * 0x05, 0x0c, // Usage Page (Consumer Devices) 159 ++ * 0x0a, 0x38, 0x02, // Usage (AC Pan) 161 ++ * 0x95, 0x01, // Report Count (1) 164 ++ * 0x81, 0x06, // Input (Data,Var,Rel) 166 ++ * 0xc0, // End Collection 168 ++ * 0xc0, // End Collection 169 ++ * 0x05, 0x01, // Usage Page (Generic Desktop) 170 ++ * 0x09, 0x06, // Usage (Keyboard) 172 ++ * 0xa1, 0x01, // Collection (Application) 174 ++ * 0x85, 0x04, // Report ID (4) 176 ++ * 0x05, 0x07, // Usage Page (Keyboard) 178 ++ * 0x95, 0x01, // Report Count (1) 180 ++ * 0x75, 0x08, // Report Size (8) 182 ++ * 0x81, 0x03, // Input (Cnst,Var,Abs) 184 ++ * 0x95, 0xe8, // Report Count (232) 186 ++ * 0x75, 0x01, // Report Size (1) 188 ++ * 0x15, 0x00, // Logical Minimum (0) 190 ++ * 0x25, 0x01, // Logical Maximum (1) 192 ++ * 0x05, 0x07, // Usage Page (Keyboard) 194 ++ * 0x19, 0x00, // Usage Minimum (0) 196 ++ * 0x29, 0xe7, // Usage Maximum (231) 198 ++ * 0x81, 0x00, // Input (Data,Arr,Abs) 200 <- change to 0x81, 0x02 (Data,Var,Abs) ++ * 0xc0, // End Collection 202 ++ */ ++ ++SEC(HID_BPF_RDESC_FIXUP) ++int BPF_PROG(hid_rdesc_fixup_mistel_md770, struct hid_bpf_ctx *hctx) ++{ ++ __u8 *data = hid_bpf_get_data(hctx, 0, HID_MAX_DESCRIPTOR_SIZE); ++ ++ if (!data) ++ return 0; /* EPERM check */ ++ ++ if (data[201] == 0x00) ++ data[201] = 0x02; ++ ++ return 0; ++} ++ ++HID_BPF_OPS(mistel_md770) = { ++ .hid_rdesc_fixup = (void *)hid_rdesc_fixup_mistel_md770, ++}; ++ ++SEC("syscall") ++int probe(struct hid_bpf_probe_args *ctx) ++{ ++ ctx->retval = ctx->rdesc_size != RDESC_SIZE; ++ if (ctx->retval) ++ ctx->retval = -EINVAL; ++ ++ return 0; ++} ++ ++char _license[] SEC("license") = "GPL"; +-- +2.43.0 + diff --git a/queue-6.1/hid-magicmouse-apple-magic-trackpad-2-usb-c-driver-s.patch b/queue-6.1/hid-magicmouse-apple-magic-trackpad-2-usb-c-driver-s.patch new file mode 100644 index 00000000000..2f9c8f922b8 --- /dev/null +++ b/queue-6.1/hid-magicmouse-apple-magic-trackpad-2-usb-c-driver-s.patch @@ -0,0 +1,203 @@ +From 2256b8430bc76f951bfcddbb8d268f701923d8ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 22:49:28 +0100 +Subject: HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support + +From: Callahan Kovacs + +[ Upstream commit 87a2f10395c82c2b4687bb8611a6c5663a12f9e7 ] + +Adds driver support for the USB-C model of Apple's Magic Trackpad 2. + +The 2024 USB-C model is compatible with the existing Magic Trackpad 2 +driver but has a different hardware ID. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219470 +Signed-off-by: Callahan Kovacs +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-magicmouse.c | 56 ++++++++++++++++++++++++++---------- + 2 files changed, 42 insertions(+), 15 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index f1c106f5e90b9..790966e5b6ec4 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -94,6 +94,7 @@ + #define USB_DEVICE_ID_APPLE_MAGICMOUSE2 0x0269 + #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD 0x030e + #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 0x0265 ++#define USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC 0x0324 + #define USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI 0x020e + #define USB_DEVICE_ID_APPLE_FOUNTAIN_ISO 0x020f + #define USB_DEVICE_ID_APPLE_GEYSER_ANSI 0x0214 +diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c +index c9c968d4b36a3..9bb8daf7f7860 100644 +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -224,7 +224,9 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda + touch_minor = tdata[4]; + state = tdata[7] & TOUCH_STATE_MASK; + down = state != TOUCH_STATE_NONE; +- } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) { ++ } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ input->id.product == ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) { + id = tdata[8] & 0xf; + x = (tdata[1] << 27 | tdata[0] << 19) >> 19; + y = -((tdata[3] << 30 | tdata[2] << 22 | tdata[1] << 14) >> 19); +@@ -256,8 +258,9 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda + /* If requested, emulate a scroll wheel by detecting small + * vertical touch motions. + */ +- if (emulate_scroll_wheel && (input->id.product != +- USB_DEVICE_ID_APPLE_MAGICTRACKPAD2)) { ++ if (emulate_scroll_wheel && ++ input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 && ++ input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) { + unsigned long now = jiffies; + int step_x = msc->touches[id].scroll_x - x; + int step_y = msc->touches[id].scroll_y - y; +@@ -356,7 +359,9 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda + input_report_abs(input, ABS_MT_POSITION_X, x); + input_report_abs(input, ABS_MT_POSITION_Y, y); + +- if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) ++ if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ input->id.product == ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) + input_report_abs(input, ABS_MT_PRESSURE, pressure); + + if (report_undeciphered) { +@@ -364,7 +369,9 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda + input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE2) + input_event(input, EV_MSC, MSC_RAW, tdata[7]); + else if (input->id.product != +- USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 && ++ input->id.product != ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) + input_event(input, EV_MSC, MSC_RAW, tdata[8]); + } + } +@@ -490,7 +497,9 @@ static int magicmouse_raw_event(struct hid_device *hdev, + magicmouse_emit_buttons(msc, clicks & 3); + input_report_rel(input, REL_X, x); + input_report_rel(input, REL_Y, y); +- } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) { ++ } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ input->id.product == ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) { + input_mt_sync_frame(input); + input_report_key(input, BTN_MOUSE, clicks & 1); + } else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */ +@@ -542,7 +551,9 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd + __set_bit(REL_WHEEL_HI_RES, input->relbit); + __set_bit(REL_HWHEEL_HI_RES, input->relbit); + } +- } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) { ++ } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ input->id.product == ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) { + /* If the trackpad has been connected to a Mac, the name is + * automatically personalized, e.g., "José Expósito's Trackpad". + * When connected through Bluetooth, the personalized name is +@@ -618,7 +629,9 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd + MOUSE_RES_X); + input_abs_set_res(input, ABS_MT_POSITION_Y, + MOUSE_RES_Y); +- } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) { ++ } else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ input->id.product == ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) { + input_set_abs_params(input, ABS_MT_PRESSURE, 0, 253, 0, 0); + input_set_abs_params(input, ABS_PRESSURE, 0, 253, 0, 0); + input_set_abs_params(input, ABS_MT_ORIENTATION, -3, 4, 0, 0); +@@ -657,7 +670,8 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd + input_set_events_per_packet(input, 60); + + if (report_undeciphered && +- input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) { ++ input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 && ++ input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) { + __set_bit(EV_MSC, input->evbit); + __set_bit(MSC_RAW, input->mscbit); + } +@@ -682,7 +696,9 @@ static int magicmouse_input_mapping(struct hid_device *hdev, + + /* Magic Trackpad does not give relative data after switching to MT */ + if ((hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD || +- hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) && ++ hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ hi->input->id.product == ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) && + field->flags & HID_MAIN_ITEM_RELATIVE) + return -1; + +@@ -718,7 +734,8 @@ static int magicmouse_enable_multitouch(struct hid_device *hdev) + int ret; + int feature_size; + +- if (hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) { ++ if (hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) { + if (hdev->vendor == BT_VENDOR_ID_APPLE) { + feature_size = sizeof(feature_mt_trackpad2_bt); + feature = feature_mt_trackpad2_bt; +@@ -763,7 +780,8 @@ static int magicmouse_fetch_battery(struct hid_device *hdev) + + if (!hdev->battery || hdev->vendor != USB_VENDOR_ID_APPLE || + (hdev->product != USB_DEVICE_ID_APPLE_MAGICMOUSE2 && +- hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2)) ++ hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 && ++ hdev->product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC)) + return -1; + + report_enum = &hdev->report_enum[hdev->battery_report_type]; +@@ -832,7 +850,9 @@ static int magicmouse_probe(struct hid_device *hdev, + + if (id->vendor == USB_VENDOR_ID_APPLE && + (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2 || +- (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 && hdev->type != HID_TYPE_USBMOUSE))) ++ ((id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) && ++ hdev->type != HID_TYPE_USBMOUSE))) + return 0; + + if (!msc->input) { +@@ -847,7 +867,8 @@ static int magicmouse_probe(struct hid_device *hdev, + else if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2) + report = hid_register_report(hdev, HID_INPUT_REPORT, + MOUSE2_REPORT_ID, 0); +- else if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) { ++ else if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) { + if (id->vendor == BT_VENDOR_ID_APPLE) + report = hid_register_report(hdev, HID_INPUT_REPORT, + TRACKPAD2_BT_REPORT_ID, 0); +@@ -917,7 +938,8 @@ static __u8 *magicmouse_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + if (hdev->vendor == USB_VENDOR_ID_APPLE && + (hdev->product == USB_DEVICE_ID_APPLE_MAGICMOUSE2 || +- hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) && ++ hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 || ++ hdev->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC) && + *rsize == 83 && rdesc[46] == 0x84 && rdesc[58] == 0x85) { + hid_info(hdev, + "fixing up magicmouse battery report descriptor\n"); +@@ -948,6 +970,10 @@ static const struct hid_device_id magic_mice[] = { + USB_DEVICE_ID_APPLE_MAGICTRACKPAD2), .driver_data = 0 }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, + USB_DEVICE_ID_APPLE_MAGICTRACKPAD2), .driver_data = 0 }, ++ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC), .driver_data = 0 }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, ++ USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC), .driver_data = 0 }, + { } + }; + MODULE_DEVICE_TABLE(hid, magic_mice); +-- +2.43.0 + diff --git a/queue-6.1/i3c-mipi-i3c-hci-mask-ring-interrupts-before-ring-st.patch b/queue-6.1/i3c-mipi-i3c-hci-mask-ring-interrupts-before-ring-st.patch new file mode 100644 index 00000000000..0a4a42e7b28 --- /dev/null +++ b/queue-6.1/i3c-mipi-i3c-hci-mask-ring-interrupts-before-ring-st.patch @@ -0,0 +1,44 @@ +From 2fb05db535216a99e5ce0941c9a25f4c0ecb778e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Sep 2024 17:44:31 +0300 +Subject: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request + +From: Jarkko Nikula + +[ Upstream commit 6ca2738174e4ee44edb2ab2d86ce74f015a0cc32 ] + +Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when +the ring is being stopped. Depending on timing between ring stop request +completion, interrupt handler removal and code execution this may lead +to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run +after the io_data pointer is set to NULL in hci_dma_cleanup(). + +Prevent this my masking the ring interrupts before ring stop request. + +Signed-off-by: Jarkko Nikula +Link: https://lore.kernel.org/r/20240920144432.62370-2-jarkko.nikula@linux.intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c +index edc3a69bfe31f..bcc0c7d4131f2 100644 +--- a/drivers/i3c/master/mipi-i3c-hci/dma.c ++++ b/drivers/i3c/master/mipi-i3c-hci/dma.c +@@ -174,10 +174,10 @@ static void hci_dma_cleanup(struct i3c_hci *hci) + for (i = 0; i < rings->total; i++) { + rh = &rings->headers[i]; + ++ rh_reg_write(INTR_SIGNAL_ENABLE, 0); + rh_reg_write(RING_CONTROL, 0); + rh_reg_write(CR_SETUP, 0); + rh_reg_write(IBI_SETUP, 0); +- rh_reg_write(INTR_SIGNAL_ENABLE, 0); + + if (rh->xfer) + dma_free_coherent(&hci->master.dev, +-- +2.43.0 + diff --git a/queue-6.1/i3c-use-i3cdev-desc-info-instead-of-calling-i3c_devi.patch b/queue-6.1/i3c-use-i3cdev-desc-info-instead-of-calling-i3c_devi.patch new file mode 100644 index 00000000000..d5ce339e60e --- /dev/null +++ b/queue-6.1/i3c-use-i3cdev-desc-info-instead-of-calling-i3c_devi.patch @@ -0,0 +1,113 @@ +From bedee0fab3dbafb322616a1cd2d7001756fd7e09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 21:25:39 +0800 +Subject: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() + to avoid deadlock + +From: Defa Li + +[ Upstream commit 6cf7b65f7029914dc0cd7db86fac9ee5159008c6 ] + +A deadlock may happen since the i3c_master_register() acquires +&i3cbus->lock twice. See the log below. +Use i3cdev->desc->info instead of calling i3c_device_info() to +avoid acquiring the lock twice. + +v2: + - Modified the title and commit message + +============================================ +WARNING: possible recursive locking detected +6.11.0-mainline +-------------------------------------------- +init/1 is trying to acquire lock: +f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_bus_normaluse_lock + +but task is already holding lock: +f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register + +other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&i3cbus->lock); + lock(&i3cbus->lock); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + +2 locks held by init/1: + #0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: __driver_attach + #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register + +stack backtrace: +CPU: 6 UID: 0 PID: 1 Comm: init +Call trace: + dump_backtrace+0xfc/0x17c + show_stack+0x18/0x28 + dump_stack_lvl+0x40/0xc0 + dump_stack+0x18/0x24 + print_deadlock_bug+0x388/0x390 + __lock_acquire+0x18bc/0x32ec + lock_acquire+0x134/0x2b0 + down_read+0x50/0x19c + i3c_bus_normaluse_lock+0x14/0x24 + i3c_device_get_info+0x24/0x58 + i3c_device_uevent+0x34/0xa4 + dev_uevent+0x310/0x384 + kobject_uevent_env+0x244/0x414 + kobject_uevent+0x14/0x20 + device_add+0x278/0x460 + device_register+0x20/0x34 + i3c_master_register_new_i3c_devs+0x78/0x154 + i3c_master_register+0x6a0/0x6d4 + mtk_i3c_master_probe+0x3b8/0x4d8 + platform_probe+0xa0/0xe0 + really_probe+0x114/0x454 + __driver_probe_device+0xa0/0x15c + driver_probe_device+0x3c/0x1ac + __driver_attach+0xc4/0x1f0 + bus_for_each_dev+0x104/0x160 + driver_attach+0x24/0x34 + bus_add_driver+0x14c/0x294 + driver_register+0x68/0x104 + __platform_driver_register+0x20/0x30 + init_module+0x20/0xfe4 + do_one_initcall+0x184/0x464 + do_init_module+0x58/0x1ec + load_module+0xefc/0x10c8 + __arm64_sys_finit_module+0x238/0x33c + invoke_syscall+0x58/0x10c + el0_svc_common+0xa8/0xdc + do_el0_svc+0x1c/0x28 + el0_svc+0x50/0xac + el0t_64_sync_handler+0x70/0xbc + el0t_64_sync+0x1a8/0x1ac + +Signed-off-by: Defa Li +Link: https://lore.kernel.org/r/20241107132549.25439-1-defa.li@mediatek.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c +index 41ecc0d898f0c..505cfd367e6b2 100644 +--- a/drivers/i3c/master.c ++++ b/drivers/i3c/master.c +@@ -279,7 +279,8 @@ static int i3c_device_uevent(struct device *dev, struct kobj_uevent_env *env) + struct i3c_device_info devinfo; + u16 manuf, part, ext; + +- i3c_device_get_info(i3cdev, &devinfo); ++ if (i3cdev->desc) ++ devinfo = i3cdev->desc->info; + manuf = I3C_PID_MANUF_ID(devinfo.pid); + part = I3C_PID_PART_ID(devinfo.pid); + ext = I3C_PID_EXTRA_INFO(devinfo.pid); +-- +2.43.0 + diff --git a/queue-6.1/iio-light-ltr501-add-lter0303-to-the-supported-devic.patch b/queue-6.1/iio-light-ltr501-add-lter0303-to-the-supported-devic.patch new file mode 100644 index 00000000000..2961da41730 --- /dev/null +++ b/queue-6.1/iio-light-ltr501-add-lter0303-to-the-supported-devic.patch @@ -0,0 +1,41 @@ +From b8e08d06e2a242441bf5466ee4a9d9db9694c7d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2024 22:05:12 +0300 +Subject: iio: light: ltr501: Add LTER0303 to the supported devices + +From: Andy Shevchenko + +[ Upstream commit c26acb09ccbef47d1fddaf0783c1392d0462122c ] + +It has been found that the (non-vendor issued) ACPI ID for Lite-On +LTR303 is present in Microsoft catalog. Add it to the list of the +supported devices. + +Link: https://www.catalog.update.microsoft.com/Search.aspx?q=lter0303 +Closes: https://lore.kernel.org/r/9cdda3e0-d56e-466f-911f-96ffd6f602c8@redhat.com +Reported-by: Hans de Goede +Reviewed-by: Hans de Goede +Signed-off-by: Andy Shevchenko +Link: https://patch.msgid.link/20241024191200.229894-24-andriy.shevchenko@linux.intel.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/light/ltr501.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c +index 74a1ccda8b9c4..49f293232a709 100644 +--- a/drivers/iio/light/ltr501.c ++++ b/drivers/iio/light/ltr501.c +@@ -1631,6 +1631,8 @@ static const struct acpi_device_id ltr_acpi_match[] = { + { "LTER0501", ltr501 }, + { "LTER0559", ltr559 }, + { "LTER0301", ltr301 }, ++ /* https://www.catalog.update.microsoft.com/Search.aspx?q=lter0303 */ ++ { "LTER0303", ltr303 }, + { }, + }; + MODULE_DEVICE_TABLE(acpi, ltr_acpi_match); +-- +2.43.0 + diff --git a/queue-6.1/io_uring-tctx-work-around-xa_store-allocation-error-.patch b/queue-6.1/io_uring-tctx-work-around-xa_store-allocation-error-.patch new file mode 100644 index 00000000000..ae79d1ba89a --- /dev/null +++ b/queue-6.1/io_uring-tctx-work-around-xa_store-allocation-error-.patch @@ -0,0 +1,62 @@ +From c28b2b281bd1b8fa8906edc7830e8a376a5a17c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 07:20:28 -0700 +Subject: io_uring/tctx: work around xa_store() allocation error issue + +From: Jens Axboe + +[ Upstream commit 7eb75ce7527129d7f1fee6951566af409a37a1c4 ] + +syzbot triggered the following WARN_ON: + +WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 + +which is the + +WARN_ON_ONCE(!xa_empty(&tctx->xa)); + +sanity check in __io_uring_free() when a io_uring_task is going through +its final put. The syzbot test case includes injecting memory allocation +failures, and it very much looks like xa_store() can fail one of its +memory allocations and end up with ->head being non-NULL even though no +entries exist in the xarray. + +Until this issue gets sorted out, work around it by attempting to +iterate entries in our xarray, and WARN_ON_ONCE() if one is found. + +Reported-by: syzbot+cc36d44ec9f368e443d3@syzkaller.appspotmail.com +Link: https://lore.kernel.org/io-uring/673c1643.050a0220.87769.0066.GAE@google.com/ +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/tctx.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/io_uring/tctx.c b/io_uring/tctx.c +index 4324b1cf1f6af..51b05fda8e455 100644 +--- a/io_uring/tctx.c ++++ b/io_uring/tctx.c +@@ -47,8 +47,19 @@ static struct io_wq *io_init_wq_offload(struct io_ring_ctx *ctx, + void __io_uring_free(struct task_struct *tsk) + { + struct io_uring_task *tctx = tsk->io_uring; ++ struct io_tctx_node *node; ++ unsigned long index; + +- WARN_ON_ONCE(!xa_empty(&tctx->xa)); ++ /* ++ * Fault injection forcing allocation errors in the xa_store() path ++ * can lead to xa_empty() returning false, even though no actual ++ * node is stored in the xarray. Until that gets sorted out, attempt ++ * an iteration here and warn if any entries are found. ++ */ ++ xa_for_each(&tctx->xa, index, node) { ++ WARN_ON_ONCE(1); ++ break; ++ } + WARN_ON_ONCE(tctx->io_wq); + WARN_ON_ONCE(tctx->cached_refs); + +-- +2.43.0 + diff --git a/queue-6.1/jfs-add-a-check-to-prevent-array-index-out-of-bounds.patch b/queue-6.1/jfs-add-a-check-to-prevent-array-index-out-of-bounds.patch new file mode 100644 index 00000000000..0109ae563c3 --- /dev/null +++ b/queue-6.1/jfs-add-a-check-to-prevent-array-index-out-of-bounds.patch @@ -0,0 +1,39 @@ +From d79cc7fbdb273ffe951f92012732a6c8a380b00f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 01:51:38 +0530 +Subject: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree + +From: Nihar Chaithanya + +[ Upstream commit a174706ba4dad895c40b1d2277bade16dfacdcd9 ] + +When the value of lp is 0 at the beginning of the for loop, it will +become negative in the next assignment and we should bail out. + +Reported-by: syzbot+412dea214d8baa3f7483@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=412dea214d8baa3f7483 +Tested-by: syzbot+412dea214d8baa3f7483@syzkaller.appspotmail.com +Signed-off-by: Nihar Chaithanya +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 30a56c37d9ecf..6509102e581a1 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -2891,6 +2891,9 @@ static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl) + /* bubble the new value up the tree as required. + */ + for (k = 0; k < le32_to_cpu(tp->dmt_height); k++) { ++ if (lp == 0) ++ break; ++ + /* get the index of the first leaf of the 4 leaf + * group containing the specified leaf (leafno). + */ +-- +2.43.0 + diff --git a/queue-6.1/jfs-array-index-out-of-bounds-fix-in-dtreadfirst.patch b/queue-6.1/jfs-array-index-out-of-bounds-fix-in-dtreadfirst.patch new file mode 100644 index 00000000000..76b250b6144 --- /dev/null +++ b/queue-6.1/jfs-array-index-out-of-bounds-fix-in-dtreadfirst.patch @@ -0,0 +1,43 @@ +From 841010a4c354f49afa4a5a913c9a1b86c1528f04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Sep 2024 14:07:22 +0530 +Subject: jfs: array-index-out-of-bounds fix in dtReadFirst + +From: Ghanshyam Agrawal + +[ Upstream commit ca84a2c9be482836b86d780244f0357e5a778c46 ] + +The value of stbl can be sometimes out of bounds due +to a bad filesystem. Added a check with appopriate return +of error code in that case. + +Reported-by: syzbot+65fa06e29859e41a83f3@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 +Signed-off-by: Ghanshyam Agrawal +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dtree.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c +index 5d3127ca68a42..69fd936fbdb37 100644 +--- a/fs/jfs/jfs_dtree.c ++++ b/fs/jfs/jfs_dtree.c +@@ -3086,6 +3086,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack) + + /* get the leftmost entry */ + stbl = DT_GETSTBL(p); ++ ++ if (stbl[0] < 0 || stbl[0] > 127) { ++ DT_PUTPAGE(mp); ++ jfs_error(ip->i_sb, "stbl[0] out of bound\n"); ++ return -EIO; ++ } ++ + xd = (pxd_t *) & p->slot[stbl[0]]; + + /* get the child page block address */ +-- +2.43.0 + diff --git a/queue-6.1/jfs-fix-array-index-out-of-bounds-in-jfs_readdir.patch b/queue-6.1/jfs-fix-array-index-out-of-bounds-in-jfs_readdir.patch new file mode 100644 index 00000000000..f367a02a9d6 --- /dev/null +++ b/queue-6.1/jfs-fix-array-index-out-of-bounds-in-jfs_readdir.patch @@ -0,0 +1,43 @@ +From 9453f925fc33823a286ce05424ac4d829b5d6213 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 11:35:47 +0530 +Subject: jfs: fix array-index-out-of-bounds in jfs_readdir + +From: Ghanshyam Agrawal + +[ Upstream commit 839f102efb168f02dfdd46717b7c6dddb26b015e ] + +The stbl might contain some invalid values. Added a check to +return error code in that case. + +Reported-by: syzbot+0315f8fe99120601ba88@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=0315f8fe99120601ba88 +Signed-off-by: Ghanshyam Agrawal +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dtree.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c +index 69fd936fbdb37..8f85177f284b5 100644 +--- a/fs/jfs/jfs_dtree.c ++++ b/fs/jfs/jfs_dtree.c +@@ -2891,6 +2891,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) + stbl = DT_GETSTBL(p); + + for (i = index; i < p->header.nextindex; i++) { ++ if (stbl[i] < 0 || stbl[i] > 127) { ++ jfs_err("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld", ++ i, stbl[i], (long)ip->i_ino, (long long)bn); ++ free_page(dirent_buf); ++ DT_PUTPAGE(mp); ++ return -EIO; ++ } ++ + d = (struct ldtentry *) & p->slot[stbl[i]]; + + if (((long) jfs_dirent + d->namlen + 1) > +-- +2.43.0 + diff --git a/queue-6.1/jfs-fix-shift-out-of-bounds-in-dbsplit.patch b/queue-6.1/jfs-fix-shift-out-of-bounds-in-dbsplit.patch new file mode 100644 index 00000000000..923c2a4738a --- /dev/null +++ b/queue-6.1/jfs-fix-shift-out-of-bounds-in-dbsplit.patch @@ -0,0 +1,39 @@ +From 82a65fe3e9351cfcc1c487e54fe78a33be266bf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2024 13:42:18 +0530 +Subject: jfs: fix shift-out-of-bounds in dbSplit + +From: Ghanshyam Agrawal + +[ Upstream commit a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d ] + +When dmt_budmin is less than zero, it causes errors +in the later stages. Added a check to return an error beforehand +in dbAllocCtl itself. + +Reported-by: syzbot+b5ca8a249162c4b9a7d0@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0 +Signed-off-by: Ghanshyam Agrawal +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index a6b1d748df16b..30a56c37d9ecf 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -1820,6 +1820,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results) + return -EIO; + dp = (struct dmap *) mp->data; + ++ if (dp->tree.budmin < 0) ++ return -EIO; ++ + /* try to allocate the blocks. + */ + rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results); +-- +2.43.0 + diff --git a/queue-6.1/kcsan-turn-report_filterlist_lock-into-a-raw_spinloc.patch b/queue-6.1/kcsan-turn-report_filterlist_lock-into-a-raw_spinloc.patch new file mode 100644 index 00000000000..4d4c1658a25 --- /dev/null +++ b/queue-6.1/kcsan-turn-report_filterlist_lock-into-a-raw_spinloc.patch @@ -0,0 +1,212 @@ +From bccd299552a039562fadc0eb9e08357c7b88df83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 16:00:45 +0200 +Subject: kcsan: Turn report_filterlist_lock into a raw_spinlock + +From: Marco Elver + +[ Upstream commit 59458fa4ddb47e7891c61b4a928d13d5f5b00aa0 ] + +Ran Xiaokai reports that with a KCSAN-enabled PREEMPT_RT kernel, we can see +splats like: + +| BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +| in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 +| preempt_count: 10002, expected: 0 +| RCU nest depth: 0, expected: 0 +| no locks held by swapper/1/0. +| irq event stamp: 156674 +| hardirqs last enabled at (156673): [] do_idle+0x1f9/0x240 +| hardirqs last disabled at (156674): [] sysvec_apic_timer_interrupt+0x14/0xc0 +| softirqs last enabled at (0): [] copy_process+0xfc7/0x4b60 +| softirqs last disabled at (0): [<0000000000000000>] 0x0 +| Preemption disabled at: +| [] paint_ptr+0x2a/0x90 +| CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.11.0+ #3 +| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014 +| Call Trace: +| +| dump_stack_lvl+0x7e/0xc0 +| dump_stack+0x1d/0x30 +| __might_resched+0x1a2/0x270 +| rt_spin_lock+0x68/0x170 +| kcsan_skip_report_debugfs+0x43/0xe0 +| print_report+0xb5/0x590 +| kcsan_report_known_origin+0x1b1/0x1d0 +| kcsan_setup_watchpoint+0x348/0x650 +| __tsan_unaligned_write1+0x16d/0x1d0 +| hrtimer_interrupt+0x3d6/0x430 +| __sysvec_apic_timer_interrupt+0xe8/0x3a0 +| sysvec_apic_timer_interrupt+0x97/0xc0 +| + +On a detected data race, KCSAN's reporting logic checks if it should +filter the report. That list is protected by the report_filterlist_lock +*non-raw* spinlock which may sleep on RT kernels. + +Since KCSAN may report data races in any context, convert it to a +raw_spinlock. + +This requires being careful about when to allocate memory for the filter +list itself which can be done via KCSAN's debugfs interface. Concurrent +modification of the filter list via debugfs should be rare: the chosen +strategy is to optimistically pre-allocate memory before the critical +section and discard if unused. + +Link: https://lore.kernel.org/all/20240925143154.2322926-1-ranxiaokai627@163.com/ +Reported-by: Ran Xiaokai +Tested-by: Ran Xiaokai +Signed-off-by: Marco Elver +Signed-off-by: Sasha Levin +--- + kernel/kcsan/debugfs.c | 74 ++++++++++++++++++++---------------------- + 1 file changed, 36 insertions(+), 38 deletions(-) + +diff --git a/kernel/kcsan/debugfs.c b/kernel/kcsan/debugfs.c +index 1d1d1b0e42489..f4623910fb1f2 100644 +--- a/kernel/kcsan/debugfs.c ++++ b/kernel/kcsan/debugfs.c +@@ -46,14 +46,8 @@ static struct { + int used; /* number of elements used */ + bool sorted; /* if elements are sorted */ + bool whitelist; /* if list is a blacklist or whitelist */ +-} report_filterlist = { +- .addrs = NULL, +- .size = 8, /* small initial size */ +- .used = 0, +- .sorted = false, +- .whitelist = false, /* default is blacklist */ +-}; +-static DEFINE_SPINLOCK(report_filterlist_lock); ++} report_filterlist; ++static DEFINE_RAW_SPINLOCK(report_filterlist_lock); + + /* + * The microbenchmark allows benchmarking KCSAN core runtime only. To run +@@ -110,7 +104,7 @@ bool kcsan_skip_report_debugfs(unsigned long func_addr) + return false; + func_addr -= offset; /* Get function start */ + +- spin_lock_irqsave(&report_filterlist_lock, flags); ++ raw_spin_lock_irqsave(&report_filterlist_lock, flags); + if (report_filterlist.used == 0) + goto out; + +@@ -127,7 +121,7 @@ bool kcsan_skip_report_debugfs(unsigned long func_addr) + ret = !ret; + + out: +- spin_unlock_irqrestore(&report_filterlist_lock, flags); ++ raw_spin_unlock_irqrestore(&report_filterlist_lock, flags); + return ret; + } + +@@ -135,9 +129,9 @@ static void set_report_filterlist_whitelist(bool whitelist) + { + unsigned long flags; + +- spin_lock_irqsave(&report_filterlist_lock, flags); ++ raw_spin_lock_irqsave(&report_filterlist_lock, flags); + report_filterlist.whitelist = whitelist; +- spin_unlock_irqrestore(&report_filterlist_lock, flags); ++ raw_spin_unlock_irqrestore(&report_filterlist_lock, flags); + } + + /* Returns 0 on success, error-code otherwise. */ +@@ -145,6 +139,9 @@ static ssize_t insert_report_filterlist(const char *func) + { + unsigned long flags; + unsigned long addr = kallsyms_lookup_name(func); ++ unsigned long *delay_free = NULL; ++ unsigned long *new_addrs = NULL; ++ size_t new_size = 0; + ssize_t ret = 0; + + if (!addr) { +@@ -152,32 +149,33 @@ static ssize_t insert_report_filterlist(const char *func) + return -ENOENT; + } + +- spin_lock_irqsave(&report_filterlist_lock, flags); ++retry_alloc: ++ /* ++ * Check if we need an allocation, and re-validate under the lock. Since ++ * the report_filterlist_lock is a raw, cannot allocate under the lock. ++ */ ++ if (data_race(report_filterlist.used == report_filterlist.size)) { ++ new_size = (report_filterlist.size ?: 4) * 2; ++ delay_free = new_addrs = kmalloc_array(new_size, sizeof(unsigned long), GFP_KERNEL); ++ if (!new_addrs) ++ return -ENOMEM; ++ } + +- if (report_filterlist.addrs == NULL) { +- /* initial allocation */ +- report_filterlist.addrs = +- kmalloc_array(report_filterlist.size, +- sizeof(unsigned long), GFP_ATOMIC); +- if (report_filterlist.addrs == NULL) { +- ret = -ENOMEM; +- goto out; +- } +- } else if (report_filterlist.used == report_filterlist.size) { +- /* resize filterlist */ +- size_t new_size = report_filterlist.size * 2; +- unsigned long *new_addrs = +- krealloc(report_filterlist.addrs, +- new_size * sizeof(unsigned long), GFP_ATOMIC); +- +- if (new_addrs == NULL) { +- /* leave filterlist itself untouched */ +- ret = -ENOMEM; +- goto out; ++ raw_spin_lock_irqsave(&report_filterlist_lock, flags); ++ if (report_filterlist.used == report_filterlist.size) { ++ /* Check we pre-allocated enough, and retry if not. */ ++ if (report_filterlist.used >= new_size) { ++ raw_spin_unlock_irqrestore(&report_filterlist_lock, flags); ++ kfree(new_addrs); /* kfree(NULL) is safe */ ++ delay_free = new_addrs = NULL; ++ goto retry_alloc; + } + ++ if (report_filterlist.used) ++ memcpy(new_addrs, report_filterlist.addrs, report_filterlist.used * sizeof(unsigned long)); ++ delay_free = report_filterlist.addrs; /* free the old list */ ++ report_filterlist.addrs = new_addrs; /* switch to the new list */ + report_filterlist.size = new_size; +- report_filterlist.addrs = new_addrs; + } + + /* Note: deduplicating should be done in userspace. */ +@@ -185,9 +183,9 @@ static ssize_t insert_report_filterlist(const char *func) + kallsyms_lookup_name(func); + report_filterlist.sorted = false; + +-out: +- spin_unlock_irqrestore(&report_filterlist_lock, flags); ++ raw_spin_unlock_irqrestore(&report_filterlist_lock, flags); + ++ kfree(delay_free); + return ret; + } + +@@ -204,13 +202,13 @@ static int show_info(struct seq_file *file, void *v) + } + + /* show filter functions, and filter type */ +- spin_lock_irqsave(&report_filterlist_lock, flags); ++ raw_spin_lock_irqsave(&report_filterlist_lock, flags); + seq_printf(file, "\n%s functions: %s\n", + report_filterlist.whitelist ? "whitelisted" : "blacklisted", + report_filterlist.used == 0 ? "none" : ""); + for (i = 0; i < report_filterlist.used; ++i) + seq_printf(file, " %ps\n", (void *)report_filterlist.addrs[i]); +- spin_unlock_irqrestore(&report_filterlist_lock, flags); ++ raw_spin_unlock_irqrestore(&report_filterlist_lock, flags); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.1/kselftest-arm64-don-t-leak-pipe-fds-in-pac.exec_sign.patch b/queue-6.1/kselftest-arm64-don-t-leak-pipe-fds-in-pac.exec_sign.patch new file mode 100644 index 00000000000..25ff651d96f --- /dev/null +++ b/queue-6.1/kselftest-arm64-don-t-leak-pipe-fds-in-pac.exec_sign.patch @@ -0,0 +1,39 @@ +From 3d3db19e7db8ac2b2b21859973128bd33ef1f390 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 16:18:55 +0000 +Subject: kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all() + +From: Mark Brown + +[ Upstream commit 27141b690547da5650a420f26ec369ba142a9ebb ] + +The PAC exec_sign_all() test spawns some child processes, creating pipes +to be stdin and stdout for the child. It cleans up most of the file +descriptors that are created as part of this but neglects to clean up the +parent end of the child stdin and stdout. Add the missing close() calls. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20241111-arm64-pac-test-collisions-v1-1-171875f37e44@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/pauth/pac.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/arm64/pauth/pac.c b/tools/testing/selftests/arm64/pauth/pac.c +index b743daa772f55..5a07b3958fbf2 100644 +--- a/tools/testing/selftests/arm64/pauth/pac.c ++++ b/tools/testing/selftests/arm64/pauth/pac.c +@@ -182,6 +182,9 @@ int exec_sign_all(struct signatures *signed_vals, size_t val) + return -1; + } + ++ close(new_stdin[1]); ++ close(new_stdout[0]); ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.1/leds-class-protect-brightness_show-with-led_cdev-led.patch b/queue-6.1/leds-class-protect-brightness_show-with-led_cdev-led.patch new file mode 100644 index 00000000000..8fc77c3134c --- /dev/null +++ b/queue-6.1/leds-class-protect-brightness_show-with-led_cdev-led.patch @@ -0,0 +1,174 @@ +From a70459fa961a362bcbcafd076969c032d7cfbf9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2024 21:35:27 +0530 +Subject: leds: class: Protect brightness_show() with led_cdev->led_access + mutex + +From: Mukesh Ojha + +[ Upstream commit 4ca7cd938725a4050dcd62ae9472e931d603118d ] + +There is NULL pointer issue observed if from Process A where hid device +being added which results in adding a led_cdev addition and later a +another call to access of led_cdev attribute from Process B can result +in NULL pointer issue. + +Use mutex led_cdev->led_access to protect access to led->cdev and its +attribute inside brightness_show() and max_brightness_show() and also +update the comment for mutex that it should be used to protect the led +class device fields. + + Process A Process B + + kthread+0x114 + worker_thread+0x244 + process_scheduled_works+0x248 + uhid_device_add_worker+0x24 + hid_add_device+0x120 + device_add+0x268 + bus_probe_device+0x94 + device_initial_probe+0x14 + __device_attach+0xfc + bus_for_each_drv+0x10c + __device_attach_driver+0x14c + driver_probe_device+0x3c + __driver_probe_device+0xa0 + really_probe+0x190 + hid_device_probe+0x130 + ps_probe+0x990 + ps_led_register+0x94 + devm_led_classdev_register_ext+0x58 + led_classdev_register_ext+0x1f8 + device_create_with_groups+0x48 + device_create_groups_vargs+0xc8 + device_add+0x244 + kobject_uevent+0x14 + kobject_uevent_env[jt]+0x224 + mutex_unlock[jt]+0xc4 + __mutex_unlock_slowpath+0xd4 + wake_up_q+0x70 + try_to_wake_up[jt]+0x48c + preempt_schedule_common+0x28 + __schedule+0x628 + __switch_to+0x174 + el0t_64_sync+0x1a8/0x1ac + el0t_64_sync_handler+0x68/0xbc + el0_svc+0x38/0x68 + do_el0_svc+0x1c/0x28 + el0_svc_common+0x80/0xe0 + invoke_syscall+0x58/0x114 + __arm64_sys_read+0x1c/0x2c + ksys_read+0x78/0xe8 + vfs_read+0x1e0/0x2c8 + kernfs_fop_read_iter+0x68/0x1b4 + seq_read_iter+0x158/0x4ec + kernfs_seq_show+0x44/0x54 + sysfs_kf_seq_show+0xb4/0x130 + dev_attr_show+0x38/0x74 + brightness_show+0x20/0x4c + dualshock4_led_get_brightness+0xc/0x74 + +[ 3313.874295][ T4013] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 +[ 3313.874301][ T4013] Mem abort info: +[ 3313.874303][ T4013] ESR = 0x0000000096000006 +[ 3313.874305][ T4013] EC = 0x25: DABT (current EL), IL = 32 bits +[ 3313.874307][ T4013] SET = 0, FnV = 0 +[ 3313.874309][ T4013] EA = 0, S1PTW = 0 +[ 3313.874311][ T4013] FSC = 0x06: level 2 translation fault +[ 3313.874313][ T4013] Data abort info: +[ 3313.874314][ T4013] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 +[ 3313.874316][ T4013] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +[ 3313.874318][ T4013] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +[ 3313.874320][ T4013] user pgtable: 4k pages, 39-bit VAs, pgdp=00000008f2b0a000 +.. + +[ 3313.874332][ T4013] Dumping ftrace buffer: +[ 3313.874334][ T4013] (ftrace buffer empty) +.. +.. +[ dd3313.874639][ T4013] CPU: 6 PID: 4013 Comm: InputReader +[ 3313.874648][ T4013] pc : dualshock4_led_get_brightness+0xc/0x74 +[ 3313.874653][ T4013] lr : led_update_brightness+0x38/0x60 +[ 3313.874656][ T4013] sp : ffffffc0b910bbd0 +.. +.. +[ 3313.874685][ T4013] Call trace: +[ 3313.874687][ T4013] dualshock4_led_get_brightness+0xc/0x74 +[ 3313.874690][ T4013] brightness_show+0x20/0x4c +[ 3313.874692][ T4013] dev_attr_show+0x38/0x74 +[ 3313.874696][ T4013] sysfs_kf_seq_show+0xb4/0x130 +[ 3313.874700][ T4013] kernfs_seq_show+0x44/0x54 +[ 3313.874703][ T4013] seq_read_iter+0x158/0x4ec +[ 3313.874705][ T4013] kernfs_fop_read_iter+0x68/0x1b4 +[ 3313.874708][ T4013] vfs_read+0x1e0/0x2c8 +[ 3313.874711][ T4013] ksys_read+0x78/0xe8 +[ 3313.874714][ T4013] __arm64_sys_read+0x1c/0x2c +[ 3313.874718][ T4013] invoke_syscall+0x58/0x114 +[ 3313.874721][ T4013] el0_svc_common+0x80/0xe0 +[ 3313.874724][ T4013] do_el0_svc+0x1c/0x28 +[ 3313.874727][ T4013] el0_svc+0x38/0x68 +[ 3313.874730][ T4013] el0t_64_sync_handler+0x68/0xbc +[ 3313.874732][ T4013] el0t_64_sync+0x1a8/0x1ac + +Signed-off-by: Mukesh Ojha +Reviewed-by: Anish Kumar +Link: https://lore.kernel.org/r/20241103160527.82487-1-quic_mojha@quicinc.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/led-class.c | 14 +++++++++++--- + include/linux/leds.h | 2 +- + 2 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index 7391d2cf1370a..93fdca5c7dc5d 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -28,11 +28,14 @@ static ssize_t brightness_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct led_classdev *led_cdev = dev_get_drvdata(dev); ++ unsigned int brightness; + +- /* no lock needed for this */ ++ mutex_lock(&led_cdev->led_access); + led_update_brightness(led_cdev); ++ brightness = led_cdev->brightness; ++ mutex_unlock(&led_cdev->led_access); + +- return sprintf(buf, "%u\n", led_cdev->brightness); ++ return sprintf(buf, "%u\n", brightness); + } + + static ssize_t brightness_store(struct device *dev, +@@ -69,8 +72,13 @@ static ssize_t max_brightness_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct led_classdev *led_cdev = dev_get_drvdata(dev); ++ unsigned int max_brightness; ++ ++ mutex_lock(&led_cdev->led_access); ++ max_brightness = led_cdev->max_brightness; ++ mutex_unlock(&led_cdev->led_access); + +- return sprintf(buf, "%u\n", led_cdev->max_brightness); ++ return sprintf(buf, "%u\n", max_brightness); + } + static DEVICE_ATTR_RO(max_brightness); + +diff --git a/include/linux/leds.h b/include/linux/leds.h +index 79ab2dfd3c72f..01fccb1c50010 100644 +--- a/include/linux/leds.h ++++ b/include/linux/leds.h +@@ -161,7 +161,7 @@ struct led_classdev { + struct kernfs_node *brightness_hw_changed_kn; + #endif + +- /* Ensures consistent access to the LED Flash Class device */ ++ /* Ensures consistent access to the LED class device */ + struct mutex led_access; + }; + +-- +2.43.0 + diff --git a/queue-6.1/loongarch-fix-sleeping-in-atomic-context-for-preempt.patch b/queue-6.1/loongarch-fix-sleeping-in-atomic-context-for-preempt.patch new file mode 100644 index 00000000000..d92f3b2978a --- /dev/null +++ b/queue-6.1/loongarch-fix-sleeping-in-atomic-context-for-preempt.patch @@ -0,0 +1,80 @@ +From 37178670760921d5efdb4fdd38ce1295ffcb6ea8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Nov 2024 15:47:48 +0800 +Subject: LoongArch: Fix sleeping in atomic context for PREEMPT_RT + +From: Huacai Chen + +[ Upstream commit 88fd2b70120d52c1010257d36776876941375490 ] + +Commit bab1c299f3945ffe79 ("LoongArch: Fix sleeping in atomic context in +setup_tlb_handler()") changes the gfp flag from GFP_KERNEL to GFP_ATOMIC +for alloc_pages_node(). However, for PREEMPT_RT kernels we can still get +a "sleeping in atomic context" error: + +[ 0.372259] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +[ 0.372266] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 +[ 0.372268] preempt_count: 1, expected: 0 +[ 0.372270] RCU nest depth: 1, expected: 1 +[ 0.372272] 3 locks held by swapper/1/0: +[ 0.372274] #0: 900000000c9f5e60 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x524/0x1c60 +[ 0.372294] #1: 90000000087013b8 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x50/0x140 +[ 0.372305] #2: 900000047fffd388 (&zone->lock){+.+.}-{3:3}, at: __rmqueue_pcplist+0x30c/0xea0 +[ 0.372314] irq event stamp: 0 +[ 0.372316] hardirqs last enabled at (0): [<0000000000000000>] 0x0 +[ 0.372322] hardirqs last disabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 +[ 0.372329] softirqs last enabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 +[ 0.372335] softirqs last disabled at (0): [<0000000000000000>] 0x0 +[ 0.372341] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7+ #1891 +[ 0.372346] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022 +[ 0.372349] Stack : 0000000000000089 9000000005a0db9c 90000000071519c8 9000000100388000 +[ 0.372486] 900000010038b890 0000000000000000 900000010038b898 9000000007e53788 +[ 0.372492] 900000000815bcc8 900000000815bcc0 900000010038b700 0000000000000001 +[ 0.372498] 0000000000000001 4b031894b9d6b725 00000000055ec000 9000000100338fc0 +[ 0.372503] 00000000000000c4 0000000000000001 000000000000002d 0000000000000003 +[ 0.372509] 0000000000000030 0000000000000003 00000000055ec000 0000000000000003 +[ 0.372515] 900000000806d000 9000000007e53788 00000000000000b0 0000000000000004 +[ 0.372521] 0000000000000000 0000000000000000 900000000c9f5f10 0000000000000000 +[ 0.372526] 90000000076f12d8 9000000007e53788 9000000005924778 0000000000000000 +[ 0.372532] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 +[ 0.372537] ... +[ 0.372540] Call Trace: +[ 0.372542] [<9000000005924778>] show_stack+0x38/0x180 +[ 0.372548] [<90000000071519c4>] dump_stack_lvl+0x94/0xe4 +[ 0.372555] [<900000000599b880>] __might_resched+0x1a0/0x260 +[ 0.372561] [<90000000071675cc>] rt_spin_lock+0x4c/0x140 +[ 0.372565] [<9000000005cbb768>] __rmqueue_pcplist+0x308/0xea0 +[ 0.372570] [<9000000005cbed84>] get_page_from_freelist+0x564/0x1c60 +[ 0.372575] [<9000000005cc0d98>] __alloc_pages_noprof+0x218/0x1820 +[ 0.372580] [<900000000593b36c>] tlb_init+0x1ac/0x298 +[ 0.372585] [<9000000005924b74>] per_cpu_trap_init+0x114/0x140 +[ 0.372589] [<9000000005921964>] cpu_probe+0x4e4/0xa60 +[ 0.372592] [<9000000005934874>] start_secondary+0x34/0xc0 +[ 0.372599] [<900000000715615c>] smpboot_entry+0x64/0x6c + +This is because in PREEMPT_RT kernels normal spinlocks are replaced by +rt spinlocks and rt_spin_lock() will cause sleeping. Fix it by disabling +NUMA optimization completely for PREEMPT_RT kernels. + +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/mm/tlb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c +index eeb2d815cfa2a..faf44cac403b4 100644 +--- a/arch/loongarch/mm/tlb.c ++++ b/arch/loongarch/mm/tlb.c +@@ -279,7 +279,7 @@ void setup_tlb_handler(int cpu) + /* Avoid lockdep warning */ + rcu_cpu_starting(cpu); + +-#ifdef CONFIG_NUMA ++#if defined(CONFIG_NUMA) && !defined(CONFIG_PREEMPT_RT) + vec_sz = sizeof(exception_handlers); + + if (pcpu_handlers[cpu]) +-- +2.43.0 + diff --git a/queue-6.1/media-cx231xx-add-support-for-dexatek-usb-video-grab.patch b/queue-6.1/media-cx231xx-add-support-for-dexatek-usb-video-grab.patch new file mode 100644 index 00000000000..bbcb343d95b --- /dev/null +++ b/queue-6.1/media-cx231xx-add-support-for-dexatek-usb-video-grab.patch @@ -0,0 +1,50 @@ +From 0cf2f452405966137c46975a978aa3a023997693 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 19:40:40 +1000 +Subject: media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 + +From: Rohan Barar + +[ Upstream commit 61a830bc0ea69a05d8a4534f825c6aa618263649 ] + +Add Dexatek Technology Ltd USB Video Grabber 1d19:6108 to the cx231xx +driver. This device is sold under the name "BAUHN DVD Maker (DK8723)" by +ALDI in Australia. + +This device is similar to 1d19:6109, which is already included in cx231xx. + +Both video and audio capture function correctly after installing the +patched cx231xx driver. + +Patch Changelog +v1: + - Initial submission. +v2: + - Fix SoB + Improve subject. +v3: + - Rephrase message to not exceed 75 characters per line. + - Removed reference to external GitHub URL. + +Signed-off-by: Rohan Barar +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/cx231xx/cx231xx-cards.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c +index 92efe6c1f47ba..bda729b42d05f 100644 +--- a/drivers/media/usb/cx231xx/cx231xx-cards.c ++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c +@@ -994,6 +994,8 @@ const unsigned int cx231xx_bcount = ARRAY_SIZE(cx231xx_boards); + + /* table of devices that work with this driver */ + struct usb_device_id cx231xx_id_table[] = { ++ {USB_DEVICE(0x1D19, 0x6108), ++ .driver_info = CX231XX_BOARD_PV_XCAPTURE_USB}, + {USB_DEVICE(0x1D19, 0x6109), + .driver_info = CX231XX_BOARD_PV_XCAPTURE_USB}, + {USB_DEVICE(0x0572, 0x5A3C), +-- +2.43.0 + diff --git a/queue-6.1/media-uvcvideo-add-a-quirk-for-the-kaiweets-kti-w02-.patch b/queue-6.1/media-uvcvideo-add-a-quirk-for-the-kaiweets-kti-w02-.patch new file mode 100644 index 00000000000..77c591f00a9 --- /dev/null +++ b/queue-6.1/media-uvcvideo-add-a-quirk-for-the-kaiweets-kti-w02-.patch @@ -0,0 +1,245 @@ +From 44c24c6deb43049f7c914be7ebc8a0a1ef2c089e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2024 20:05:40 +0200 +Subject: media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera + +From: David Given + +[ Upstream commit b2ec92bb5605452d539a7aa1e42345b95acd8583 ] + +Adds a quirk to make the NXP Semiconductors 1fc9:009b chipset work. + +lsusb for the device reports: + +Bus 003 Device 011: ID 1fc9:009b NXP Semiconductors IR VIDEO +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 2.00 + bDeviceClass 239 Miscellaneous Device + bDeviceSubClass 2 [unknown] + bDeviceProtocol 1 Interface Association + bMaxPacketSize0 64 + idVendor 0x1fc9 NXP Semiconductors + idProduct 0x009b IR VIDEO + bcdDevice 1.01 + iManufacturer 1 Guide sensmart + iProduct 2 IR VIDEO + iSerial 0 + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 0x00c2 + bNumInterfaces 2 + bConfigurationValue 1 + iConfiguration 0 + bmAttributes 0xc0 + Self Powered + MaxPower 100mA + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 0 + bInterfaceCount 2 + bFunctionClass 14 Video + bFunctionSubClass 3 Video Interface Collection + bFunctionProtocol 0 + iFunction 3 IR Camera + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 14 Video + bInterfaceSubClass 1 Video Control + bInterfaceProtocol 0 + iInterface 0 + VideoControl Interface Descriptor: + bLength 13 + bDescriptorType 36 + bDescriptorSubtype 1 (HEADER) + bcdUVC 1.00 + wTotalLength 0x0033 + dwClockFrequency 6.000000MHz + bInCollection 1 + baInterfaceNr( 0) 1 + VideoControl Interface Descriptor: + bLength 18 + bDescriptorType 36 + bDescriptorSubtype 2 (INPUT_TERMINAL) + bTerminalID 1 + wTerminalType 0x0201 Camera Sensor + bAssocTerminal 0 + iTerminal 0 + wObjectiveFocalLengthMin 0 + wObjectiveFocalLengthMax 0 + wOcularFocalLength 0 + bControlSize 3 + bmControls 0x00000000 + VideoControl Interface Descriptor: + bLength 9 + bDescriptorType 36 + bDescriptorSubtype 3 (OUTPUT_TERMINAL) + bTerminalID 2 + wTerminalType 0x0101 USB Streaming + bAssocTerminal 0 + bSourceID 1 + iTerminal 0 + VideoControl Interface Descriptor: + bLength 11 + bDescriptorType 36 + bDescriptorSubtype 5 (PROCESSING_UNIT) + Warning: Descriptor too short + bUnitID 3 + bSourceID 1 + wMaxMultiplier 0 + bControlSize 2 + bmControls 0x00000000 + iProcessing 0 + bmVideoStandards 0x62 + NTSC - 525/60 + PAL - 525/60 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0008 1x 8 bytes + bInterval 1 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 0 + bInterfaceClass 14 Video + bInterfaceSubClass 2 Video Streaming + bInterfaceProtocol 0 + iInterface 0 + VideoStreaming Interface Descriptor: + bLength 14 + bDescriptorType 36 + bDescriptorSubtype 1 (INPUT_HEADER) + bNumFormats 1 + wTotalLength 0x0055 + bEndpointAddress 0x82 EP 2 IN + bmInfo 0 + bTerminalLink 2 + bStillCaptureMethod 2 + bTriggerSupport 0 + bTriggerUsage 0 + bControlSize 1 + bmaControls( 0) 0 + VideoStreaming Interface Descriptor: + bLength 27 + bDescriptorType 36 + bDescriptorSubtype 4 (FORMAT_UNCOMPRESSED) + bFormatIndex 1 + bNumFrameDescriptors 1 + guidFormat {e436eb7b-524f-11ce-9f53-0020af0ba770} + bBitsPerPixel 16 + bDefaultFrameIndex 1 + bAspectRatioX 0 + bAspectRatioY 0 + bmInterlaceFlags 0x00 + Interlaced stream or variable: No + Fields per frame: 2 fields + Field 1 first: No + Field pattern: Field 1 only + bCopyProtect 0 + VideoStreaming Interface Descriptor: + bLength 34 + bDescriptorType 36 + bDescriptorSubtype 5 (FRAME_UNCOMPRESSED) + bFrameIndex 1 + bmCapabilities 0x00 + Still image unsupported + wWidth 240 + wHeight 322 + dwMinBitRate 12364800 + dwMaxBitRate 30912000 + dwMaxVideoFrameBufferSize 154560 + dwDefaultFrameInterval 400000 + bFrameIntervalType 2 + dwFrameInterval( 0) 400000 + dwFrameInterval( 1) 1000000 + VideoStreaming Interface Descriptor: + bLength 10 + bDescriptorType 36 + bDescriptorSubtype 3 (STILL_IMAGE_FRAME) + bEndpointAddress 0x00 EP 0 OUT + bNumImageSizePatterns 1 + wWidth( 0) 240 + wHeight( 0) 322 + bNumCompressionPatterns 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 1 + bNumEndpoints 1 + bInterfaceClass 14 Video + bInterfaceSubClass 2 Video Streaming + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 5 + Transfer Type Isochronous + Synch Type Asynchronous + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 1 +Device Status: 0x0001 + Self Powered + +Signed-off-by: David Given +Reviewed-by: Laurent Pinchart +Reviewed-by: Ricardo Ribalda +Link: https://lore.kernel.org/r/20240918180540.10830-2-dg@cowlark.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 08c70ad5ea1bd..3da5ae475f392 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -2441,6 +2441,8 @@ static const struct uvc_device_info uvc_quirk_force_y8 = { + * The Logitech cameras listed below have their interface class set to + * VENDOR_SPEC because they don't announce themselves as UVC devices, even + * though they are compliant. ++ * ++ * Sort these by vendor/product ID. + */ + static const struct usb_device_id uvc_ids[] = { + /* Quanta USB2.0 HD UVC Webcam */ +@@ -2983,6 +2985,15 @@ static const struct usb_device_id uvc_ids[] = { + .bInterfaceProtocol = 0, + .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_PROBE_MINMAX + | UVC_QUIRK_IGNORE_SELECTOR_UNIT) }, ++ /* NXP Semiconductors IR VIDEO */ ++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = 0x1fc9, ++ .idProduct = 0x009b, ++ .bInterfaceClass = USB_CLASS_VIDEO, ++ .bInterfaceSubClass = 1, ++ .bInterfaceProtocol = 0, ++ .driver_info = (kernel_ulong_t)&uvc_quirk_probe_minmax }, + /* Oculus VR Positional Tracker DK2 */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, +-- +2.43.0 + diff --git a/queue-6.1/mips-loongson64-dts-really-fix-pcie-port-nodes-for-l.patch b/queue-6.1/mips-loongson64-dts-really-fix-pcie-port-nodes-for-l.patch new file mode 100644 index 00000000000..ac1b2cae26d --- /dev/null +++ b/queue-6.1/mips-loongson64-dts-really-fix-pcie-port-nodes-for-l.patch @@ -0,0 +1,268 @@ +From 50fa12e9c223a6a9fc790a6c2ce29285ee4d0a08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Nov 2024 11:57:37 +0800 +Subject: MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a + +From: Xi Ruoyao + +[ Upstream commit 4fbd66d8254cedfd1218393f39d83b6c07a01917 ] + +Fix the dtc warnings: + + arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: '#interrupt-cells' found, but node is not an interrupt provider + arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: '#interrupt-cells' found, but node is not an interrupt provider + arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider' + +And a runtime warning introduced in commit 045b14ca5c36 ("of: WARN on +deprecated #address-cells/#size-cells handling"): + + WARNING: CPU: 0 PID: 1 at drivers/of/base.c:106 of_bus_n_addr_cells+0x9c/0xe0 + Missing '#address-cells' in /bus@10000000/pci@1a000000/pci_bridge@9,0 + +The fix is similar to commit d89a415ff8d5 ("MIPS: Loongson64: DTS: Fix PCIe +port nodes for ls7a"), which has fixed the issue for ls2k (despite its +subject mentions ls7a). + +Signed-off-by: Xi Ruoyao +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 73 +++++++++++++++++++---- + 1 file changed, 60 insertions(+), 13 deletions(-) + +diff --git a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi +index ed99ee316febb..1292e9ab282ad 100644 +--- a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi ++++ b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi +@@ -63,7 +63,6 @@ + device_type = "pci"; + #address-cells = <3>; + #size-cells = <2>; +- #interrupt-cells = <2>; + msi-parent = <&msi>; + + reg = <0 0x1a000000 0 0x02000000>, +@@ -227,7 +226,7 @@ + }; + }; + +- pci_bridge@9,0 { ++ pcie@9,0 { + compatible = "pci0014,7a19.1", + "pci0014,7a19", + "pciclass060400", +@@ -237,12 +236,16 @@ + interrupts = <32 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 32 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@a,0 { ++ pcie@a,0 { + compatible = "pci0014,7a09.1", + "pci0014,7a09", + "pciclass060400", +@@ -252,12 +255,16 @@ + interrupts = <33 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 33 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@b,0 { ++ pcie@b,0 { + compatible = "pci0014,7a09.1", + "pci0014,7a09", + "pciclass060400", +@@ -267,12 +274,16 @@ + interrupts = <34 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 34 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@c,0 { ++ pcie@c,0 { + compatible = "pci0014,7a09.1", + "pci0014,7a09", + "pciclass060400", +@@ -282,12 +293,16 @@ + interrupts = <35 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 35 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@d,0 { ++ pcie@d,0 { + compatible = "pci0014,7a19.1", + "pci0014,7a19", + "pciclass060400", +@@ -297,12 +312,16 @@ + interrupts = <36 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 36 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@e,0 { ++ pcie@e,0 { + compatible = "pci0014,7a09.1", + "pci0014,7a09", + "pciclass060400", +@@ -312,12 +331,16 @@ + interrupts = <37 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 37 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@f,0 { ++ pcie@f,0 { + compatible = "pci0014,7a29.1", + "pci0014,7a29", + "pciclass060400", +@@ -327,12 +350,16 @@ + interrupts = <40 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 40 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@10,0 { ++ pcie@10,0 { + compatible = "pci0014,7a19.1", + "pci0014,7a19", + "pciclass060400", +@@ -342,12 +369,16 @@ + interrupts = <41 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 41 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@11,0 { ++ pcie@11,0 { + compatible = "pci0014,7a29.1", + "pci0014,7a29", + "pciclass060400", +@@ -357,12 +388,16 @@ + interrupts = <42 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 42 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@12,0 { ++ pcie@12,0 { + compatible = "pci0014,7a19.1", + "pci0014,7a19", + "pciclass060400", +@@ -372,12 +407,16 @@ + interrupts = <43 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 43 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@13,0 { ++ pcie@13,0 { + compatible = "pci0014,7a29.1", + "pci0014,7a29", + "pciclass060400", +@@ -387,12 +426,16 @@ + interrupts = <38 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 38 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + +- pci_bridge@14,0 { ++ pcie@14,0 { + compatible = "pci0014,7a19.1", + "pci0014,7a19", + "pciclass060400", +@@ -402,9 +445,13 @@ + interrupts = <39 IRQ_TYPE_LEVEL_HIGH>; + interrupt-parent = <&pic>; + ++ #address-cells = <3>; ++ #size-cells = <2>; ++ device_type = "pci"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &pic 39 IRQ_TYPE_LEVEL_HIGH>; ++ ranges; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.1/misc-eeprom-eeprom_93cx6-add-quirk-for-extra-read-cl.patch b/queue-6.1/misc-eeprom-eeprom_93cx6-add-quirk-for-extra-read-cl.patch new file mode 100644 index 00000000000..80d76071ca2 --- /dev/null +++ b/queue-6.1/misc-eeprom-eeprom_93cx6-add-quirk-for-extra-read-cl.patch @@ -0,0 +1,119 @@ +From 13c473fd344030bef9aebcf36b5749d4eca07b61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2024 11:12:33 -0400 +Subject: misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle + +From: Parker Newman + +[ Upstream commit 7738a7ab9d12c5371ed97114ee2132d4512e9fd5 ] + +Add a quirk similar to eeprom_93xx46 to add an extra clock cycle before +reading data from the EEPROM. + +The 93Cx6 family of EEPROMs output a "dummy 0 bit" between the writing +of the op-code/address from the host to the EEPROM and the reading of +the actual data from the EEPROM. + +More info can be found on page 6 of the AT93C46 datasheet (linked below). +Similar notes are found in other 93xx6 datasheets. + +In summary the read operation for a 93Cx6 EEPROM is: +Write to EEPROM: 110[A5-A0] (9 bits) +Read from EEPROM: 0[D15-D0] (17 bits) + +Where: + 110 is the start bit and READ OpCode + [A5-A0] is the address to read from + 0 is a "dummy bit" preceding the actual data + [D15-D0] is the actual data. + +Looking at the READ timing diagrams in the 93Cx6 datasheets the dummy +bit should be clocked out on the last address bit clock cycle meaning it +should be discarded naturally. + +However, depending on the hardware configuration sometimes this dummy +bit is not discarded. This is the case with Exar PCI UARTs which require +an extra clock cycle between sending the address and reading the data. + +Datasheet: https://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-5193-SEEPROM-AT93C46D-Datasheet.pdf +Reviewed-by: Andy Shevchenko +Signed-off-by: Parker Newman +Link: https://lore.kernel.org/r/0f23973efefccd2544705a0480b4ad4c2353e407.1727880931.git.pnewman@connecttech.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/eeprom_93cx6.c | 10 ++++++++++ + include/linux/eeprom_93cx6.h | 11 +++++++++++ + 2 files changed, 21 insertions(+) + +diff --git a/drivers/misc/eeprom/eeprom_93cx6.c b/drivers/misc/eeprom/eeprom_93cx6.c +index 9627294fe3e95..4c9827fe92173 100644 +--- a/drivers/misc/eeprom/eeprom_93cx6.c ++++ b/drivers/misc/eeprom/eeprom_93cx6.c +@@ -186,6 +186,11 @@ void eeprom_93cx6_read(struct eeprom_93cx6 *eeprom, const u8 word, + eeprom_93cx6_write_bits(eeprom, command, + PCI_EEPROM_WIDTH_OPCODE + eeprom->width); + ++ if (has_quirk_extra_read_cycle(eeprom)) { ++ eeprom_93cx6_pulse_high(eeprom); ++ eeprom_93cx6_pulse_low(eeprom); ++ } ++ + /* + * Read the requested 16 bits. + */ +@@ -252,6 +257,11 @@ void eeprom_93cx6_readb(struct eeprom_93cx6 *eeprom, const u8 byte, + eeprom_93cx6_write_bits(eeprom, command, + PCI_EEPROM_WIDTH_OPCODE + eeprom->width + 1); + ++ if (has_quirk_extra_read_cycle(eeprom)) { ++ eeprom_93cx6_pulse_high(eeprom); ++ eeprom_93cx6_pulse_low(eeprom); ++ } ++ + /* + * Read the requested 8 bits. + */ +diff --git a/include/linux/eeprom_93cx6.h b/include/linux/eeprom_93cx6.h +index c860c72a921d0..3a485cc0e0fa0 100644 +--- a/include/linux/eeprom_93cx6.h ++++ b/include/linux/eeprom_93cx6.h +@@ -11,6 +11,8 @@ + Supported chipsets: 93c46, 93c56 and 93c66. + */ + ++#include ++ + /* + * EEPROM operation defines. + */ +@@ -34,6 +36,7 @@ + * @register_write(struct eeprom_93cx6 *eeprom): handler to + * write to the eeprom register by using all reg_* fields. + * @width: eeprom width, should be one of the PCI_EEPROM_WIDTH_* defines ++ * @quirks: eeprom or controller quirks + * @drive_data: Set if we're driving the data line. + * @reg_data_in: register field to indicate data input + * @reg_data_out: register field to indicate data output +@@ -50,6 +53,9 @@ struct eeprom_93cx6 { + void (*register_write)(struct eeprom_93cx6 *eeprom); + + int width; ++ unsigned int quirks; ++/* Some EEPROMs require an extra clock cycle before reading */ ++#define PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE BIT(0) + + char drive_data; + char reg_data_in; +@@ -71,3 +77,8 @@ extern void eeprom_93cx6_wren(struct eeprom_93cx6 *eeprom, bool enable); + + extern void eeprom_93cx6_write(struct eeprom_93cx6 *eeprom, + u8 addr, u16 data); ++ ++static inline bool has_quirk_extra_read_cycle(struct eeprom_93cx6 *eeprom) ++{ ++ return eeprom->quirks & PCI_EEPROM_QUIRK_EXTRA_READ_CYCLE; ++} +-- +2.43.0 + diff --git a/queue-6.1/mmc-core-add-sd-card-quirk-for-broken-poweroff-notif.patch b/queue-6.1/mmc-core-add-sd-card-quirk-for-broken-poweroff-notif.patch new file mode 100644 index 00000000000..8bacd300c3e --- /dev/null +++ b/queue-6.1/mmc-core-add-sd-card-quirk-for-broken-poweroff-notif.patch @@ -0,0 +1,114 @@ +From 06a26922e9ea607f2415001bf2ab01c8a6976431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Sep 2024 18:44:17 +0900 +Subject: mmc: core: Add SD card quirk for broken poweroff notification + +From: Keita Aihara + +[ Upstream commit cd068d51594d9635bf6688fc78717572b78bce6a ] + +GIGASTONE Gaming Plus microSD cards manufactured on 02/2022 report that +they support poweroff notification and cache, but they are not working +correctly. + +Flush Cache bit never gets cleared in sd_flush_cache() and Poweroff +Notification Ready bit also never gets set to 1 within 1 second from the +end of busy of CMD49 in sd_poweroff_notify(). + +This leads to I/O error and runtime PM error state. + +I observed that the same card manufactured on 01/2024 works as expected. + +This problem seems similar to the Kingston cards fixed with +commit c467c8f08185 ("mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston +Canvas Go Plus from 11/2019") and should be handled using quirks. + +CID for the problematic card is here. +12345641535443002000000145016200 + +Manufacturer ID is 0x12 and defined as CID_MANFID_GIGASTONE as of now, +but would like comments on what naming is appropriate because MID list +is not public and not sure it's right. + +Signed-off-by: Keita Aihara +Link: https://lore.kernel.org/r/20240913094417.GA4191647@sony.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/card.h | 7 +++++++ + drivers/mmc/core/quirks.h | 9 +++++++++ + drivers/mmc/core/sd.c | 2 +- + include/linux/mmc/card.h | 1 + + 4 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h +index b7754a1b8d978..8476754b1b170 100644 +--- a/drivers/mmc/core/card.h ++++ b/drivers/mmc/core/card.h +@@ -82,6 +82,7 @@ struct mmc_fixup { + #define CID_MANFID_SANDISK_SD 0x3 + #define CID_MANFID_ATP 0x9 + #define CID_MANFID_TOSHIBA 0x11 ++#define CID_MANFID_GIGASTONE 0x12 + #define CID_MANFID_MICRON 0x13 + #define CID_MANFID_SAMSUNG 0x15 + #define CID_MANFID_APACER 0x27 +@@ -284,4 +285,10 @@ static inline int mmc_card_broken_cache_flush(const struct mmc_card *c) + { + return c->quirks & MMC_QUIRK_BROKEN_CACHE_FLUSH; + } ++ ++static inline int mmc_card_broken_sd_poweroff_notify(const struct mmc_card *c) ++{ ++ return c->quirks & MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY; ++} ++ + #endif +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index 4b327b4815262..12c90b567ce38 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -25,6 +25,15 @@ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = { + 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd, + MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY), + ++ /* ++ * GIGASTONE Gaming Plus microSD cards manufactured on 02/2022 never ++ * clear Flush Cache bit and set Poweroff Notification Ready bit. ++ */ ++ _FIXUP_EXT("ASTC", CID_MANFID_GIGASTONE, 0x3456, 2022, 2, ++ 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd, ++ MMC_QUIRK_BROKEN_SD_CACHE | MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY, ++ EXT_CSD_REV_ANY), ++ + END_FIXUP + }; + +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index 30f6dbaa712ff..819af50ae175c 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -1118,7 +1118,7 @@ static int sd_parse_ext_reg_power(struct mmc_card *card, u8 fno, u8 page, + card->ext_power.rev = reg_buf[0] & 0xf; + + /* Power Off Notification support at bit 4. */ +- if (reg_buf[1] & BIT(4)) ++ if ((reg_buf[1] & BIT(4)) && !mmc_card_broken_sd_poweroff_notify(card)) + card->ext_power.feature_support |= SD_EXT_POWER_OFF_NOTIFY; + + /* Power Sustenance support at bit 5. */ +diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h +index 7b12eebc5586d..afa575e362a47 100644 +--- a/include/linux/mmc/card.h ++++ b/include/linux/mmc/card.h +@@ -296,6 +296,7 @@ struct mmc_card { + #define MMC_QUIRK_BROKEN_SD_DISCARD (1<<14) /* Disable broken SD discard support */ + #define MMC_QUIRK_BROKEN_SD_CACHE (1<<15) /* Disable broken SD cache support */ + #define MMC_QUIRK_BROKEN_CACHE_FLUSH (1<<16) /* Don't flush cache until the write has occurred */ ++#define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY (1<<17) /* Disable broken SD poweroff notify support */ + + bool written_flag; /* Indicates eMMC has been written since power on */ + bool reenable_cmdq; /* Re-enable Command Queue */ +-- +2.43.0 + diff --git a/queue-6.1/net-af_can-do-not-leave-a-dangling-sk-pointer-in-can.patch b/queue-6.1/net-af_can-do-not-leave-a-dangling-sk-pointer-in-can.patch new file mode 100644 index 00000000000..c3c8de44be6 --- /dev/null +++ b/queue-6.1/net-af_can-do-not-leave-a-dangling-sk-pointer-in-can.patch @@ -0,0 +1,39 @@ +From 810e46d8df029b584e902b518d44111297d46422 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 16:38:03 +0100 +Subject: net: af_can: do not leave a dangling sk pointer in can_create() + +From: Ignat Korchagin + +[ Upstream commit 811a7ca7320c062e15d0f5b171fe6ad8592d1434 ] + +On error can_create() frees the allocated sk object, but sock_init_data() +has already attached it to the provided sock object. This will leave a +dangling sk pointer in the sock object and may cause use-after-free later. + +Signed-off-by: Ignat Korchagin +Reviewed-by: Vincent Mailhol +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Marc Kleine-Budde +Link: https://patch.msgid.link/20241014153808.51894-5-ignat@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/can/af_can.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/can/af_can.c b/net/can/af_can.c +index c69168f11e44a..7d8543e877b44 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -171,6 +171,7 @@ static int can_create(struct net *net, struct socket *sock, int protocol, + /* release sk on errors */ + sock_orphan(sk); + sock_put(sk); ++ sock->sk = NULL; + } + + errout: +-- +2.43.0 + diff --git a/queue-6.1/net-ethernet-fs_enet-use-pa-to-format-resource_size_.patch b/queue-6.1/net-ethernet-fs_enet-use-pa-to-format-resource_size_.patch new file mode 100644 index 00000000000..2dd5064bc6f --- /dev/null +++ b/queue-6.1/net-ethernet-fs_enet-use-pa-to-format-resource_size_.patch @@ -0,0 +1,57 @@ +From e762327ee49b86c3692279cebc0bdf155e015e29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 11:48:08 +0100 +Subject: net: ethernet: fs_enet: Use %pa to format resource_size_t + +From: Simon Horman + +[ Upstream commit 45fe45fada261e1e83fce2a07fa22835aec1cf0a ] + +The correct format string for resource_size_t is %pa which +acts on the address of the variable to be formatted [1]. + +[1] https://elixir.bootlin.com/linux/v6.11.3/source/Documentation/core-api/printk-formats.rst#L229 + +Introduced by commit 9d9326d3bc0e ("phy: Change mii_bus id field to a string") + +Flagged by gcc-14 as: + +drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c: In function 'fs_mii_bitbang_init': +drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c:126:46: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Wformat=] + 126 | snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start); + | ~^ ~~~~~~~~~ + | | | + | | resource_size_t {aka long long unsigned int} + | unsigned int + | %llx + +No functional change intended. +Compile tested only. + +Reported-by: Geert Uytterhoeven +Closes: https://lore.kernel.org/netdev/711d7f6d-b785-7560-f4dc-c6aad2cce99@linux-m68k.org/ +Signed-off-by: Simon Horman +Reviewed-by: Daniel Machon +Link: https://patch.msgid.link/20241014-net-pa-fmt-v1-2-dcc9afb8858b@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c +index 21de56345503f..f743112730194 100644 +--- a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c ++++ b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c +@@ -126,7 +126,7 @@ static int fs_mii_bitbang_init(struct mii_bus *bus, struct device_node *np) + * we get is an int, and the odds of multiple bitbang mdio buses + * is low enough that it's not worth going too crazy. + */ +- snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start); ++ snprintf(bus->id, MII_BUS_ID_SIZE, "%pa", &res.start); + + data = of_get_property(np, "fsl,mdio-pin", &len); + if (!data || len != 4) +-- +2.43.0 + diff --git a/queue-6.1/net-fec_mpc52xx_phy-use-pa-to-format-resource_size_t.patch b/queue-6.1/net-fec_mpc52xx_phy-use-pa-to-format-resource_size_t.patch new file mode 100644 index 00000000000..722fee611b2 --- /dev/null +++ b/queue-6.1/net-fec_mpc52xx_phy-use-pa-to-format-resource_size_t.patch @@ -0,0 +1,57 @@ +From 67aac25e3224125e42320b8dcb121040ff7f36c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 11:48:07 +0100 +Subject: net: fec_mpc52xx_phy: Use %pa to format resource_size_t + +From: Simon Horman + +[ Upstream commit 020bfdc4ed94be472138c891bde4d14241cf00fd ] + +The correct format string for resource_size_t is %pa which +acts on the address of the variable to be formatted [1]. + +[1] https://elixir.bootlin.com/linux/v6.11.3/source/Documentation/core-api/printk-formats.rst#L229 + +Introduced by commit 9d9326d3bc0e ("phy: Change mii_bus id field to a string") + +Flagged by gcc-14 as: + +drivers/net/ethernet/freescale/fec_mpc52xx_phy.c: In function 'mpc52xx_fec_mdio_probe': +drivers/net/ethernet/freescale/fec_mpc52xx_phy.c:97:46: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Wformat=] + 97 | snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start); + | ~^ ~~~~~~~~~ + | | | + | | resource_size_t {aka long long unsigned int} + | unsigned int + | %llx + +No functional change intended. +Compile tested only. + +Reported-by: Geert Uytterhoeven +Closes: https://lore.kernel.org/netdev/711d7f6d-b785-7560-f4dc-c6aad2cce99@linux-m68k.org/ +Signed-off-by: Simon Horman +Reviewed-by: Daniel Machon +Link: https://patch.msgid.link/20241014-net-pa-fmt-v1-1-dcc9afb8858b@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_mpc52xx_phy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c b/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c +index 95f778cce98cb..e4911a76f08eb 100644 +--- a/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c ++++ b/drivers/net/ethernet/freescale/fec_mpc52xx_phy.c +@@ -93,7 +93,7 @@ static int mpc52xx_fec_mdio_probe(struct platform_device *of) + goto out_free; + } + +- snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start); ++ snprintf(bus->id, MII_BUS_ID_SIZE, "%pa", &res.start); + bus->priv = priv; + + bus->parent = dev; +-- +2.43.0 + diff --git a/queue-6.1/net-ieee802154-do-not-leave-a-dangling-sk-pointer-in.patch b/queue-6.1/net-ieee802154-do-not-leave-a-dangling-sk-pointer-in.patch new file mode 100644 index 00000000000..38340425fd8 --- /dev/null +++ b/queue-6.1/net-ieee802154-do-not-leave-a-dangling-sk-pointer-in.patch @@ -0,0 +1,62 @@ +From 03fadba995b8e027e5e2d19ba880eda37e852201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 16:38:04 +0100 +Subject: net: ieee802154: do not leave a dangling sk pointer in + ieee802154_create() + +From: Ignat Korchagin + +[ Upstream commit b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d ] + +sock_init_data() attaches the allocated sk object to the provided sock +object. If ieee802154_create() fails later, the allocated sk object is +freed, but the dangling pointer remains in the provided sock object, which +may allow use-after-free. + +Clear the sk pointer in the sock object on error. + +Signed-off-by: Ignat Korchagin +Reviewed-by: Miquel Raynal +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20241014153808.51894-6-ignat@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ieee802154/socket.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c +index 1fa2fe041ec03..9f74be2aad000 100644 +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -1046,19 +1046,21 @@ static int ieee802154_create(struct net *net, struct socket *sock, + + if (sk->sk_prot->hash) { + rc = sk->sk_prot->hash(sk); +- if (rc) { +- sk_common_release(sk); +- goto out; +- } ++ if (rc) ++ goto out_sk_release; + } + + if (sk->sk_prot->init) { + rc = sk->sk_prot->init(sk); + if (rc) +- sk_common_release(sk); ++ goto out_sk_release; + } + out: + return rc; ++out_sk_release: ++ sk_common_release(sk); ++ sock->sk = NULL; ++ goto out; + } + + static const struct net_proto_family ieee802154_family_ops = { +-- +2.43.0 + diff --git a/queue-6.1/net-inet-do-not-leave-a-dangling-sk-pointer-in-inet_.patch b/queue-6.1/net-inet-do-not-leave-a-dangling-sk-pointer-in-inet_.patch new file mode 100644 index 00000000000..68bd7a14371 --- /dev/null +++ b/queue-6.1/net-inet-do-not-leave-a-dangling-sk-pointer-in-inet_.patch @@ -0,0 +1,76 @@ +From d47a6235dc137bddfc93a4e7a9a11ee1ac7d4bff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 16:38:05 +0100 +Subject: net: inet: do not leave a dangling sk pointer in inet_create() + +From: Ignat Korchagin + +[ Upstream commit 9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff ] + +sock_init_data() attaches the allocated sk object to the provided sock +object. If inet_create() fails later, the sk object is freed, but the +sock object retains the dangling pointer, which may create use-after-free +later. + +Clear the sk pointer in the sock object on error. + +Signed-off-by: Ignat Korchagin +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20241014153808.51894-7-ignat@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/af_inet.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index cc013be9b02c4..4f3c932e37ed5 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -371,32 +371,30 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, + inet->inet_sport = htons(inet->inet_num); + /* Add to protocol hash chains. */ + err = sk->sk_prot->hash(sk); +- if (err) { +- sk_common_release(sk); +- goto out; +- } ++ if (err) ++ goto out_sk_release; + } + + if (sk->sk_prot->init) { + err = sk->sk_prot->init(sk); +- if (err) { +- sk_common_release(sk); +- goto out; +- } ++ if (err) ++ goto out_sk_release; + } + + if (!kern) { + err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk); +- if (err) { +- sk_common_release(sk); +- goto out; +- } ++ if (err) ++ goto out_sk_release; + } + out: + return err; + out_rcu_unlock: + rcu_read_unlock(); + goto out; ++out_sk_release: ++ sk_common_release(sk); ++ sock->sk = NULL; ++ goto out; + } + + +-- +2.43.0 + diff --git a/queue-6.1/net-inet6-do-not-leave-a-dangling-sk-pointer-in-inet.patch b/queue-6.1/net-inet6-do-not-leave-a-dangling-sk-pointer-in-inet.patch new file mode 100644 index 00000000000..a25b3f645f9 --- /dev/null +++ b/queue-6.1/net-inet6-do-not-leave-a-dangling-sk-pointer-in-inet.patch @@ -0,0 +1,75 @@ +From 08177fb5fccf6e48c05e96d77d0a902446f7d114 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Oct 2024 16:38:06 +0100 +Subject: net: inet6: do not leave a dangling sk pointer in inet6_create() + +From: Ignat Korchagin + +[ Upstream commit 9df99c395d0f55fb444ef39f4d6f194ca437d884 ] + +sock_init_data() attaches the allocated sk pointer to the provided sock +object. If inet6_create() fails later, the sk object is released, but the +sock object retains the dangling sk pointer, which may cause use-after-free +later. + +Clear the sock sk pointer on error. + +Signed-off-by: Ignat Korchagin +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20241014153808.51894-8-ignat@cloudflare.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/af_inet6.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index ea16c40cfb211..49031e40551f7 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -260,31 +260,29 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, + */ + inet->inet_sport = htons(inet->inet_num); + err = sk->sk_prot->hash(sk); +- if (err) { +- sk_common_release(sk); +- goto out; +- } ++ if (err) ++ goto out_sk_release; + } + if (sk->sk_prot->init) { + err = sk->sk_prot->init(sk); +- if (err) { +- sk_common_release(sk); +- goto out; +- } ++ if (err) ++ goto out_sk_release; + } + + if (!kern) { + err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk); +- if (err) { +- sk_common_release(sk); +- goto out; +- } ++ if (err) ++ goto out_sk_release; + } + out: + return err; + out_rcu_unlock: + rcu_read_unlock(); + goto out; ++out_sk_release: ++ sk_common_release(sk); ++ sock->sk = NULL; ++ goto out; + } + + static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len, +-- +2.43.0 + diff --git a/queue-6.1/net-neighbor-clear-error-in-case-strict-check-is-not.patch b/queue-6.1/net-neighbor-clear-error-in-case-strict-check-is-not.patch new file mode 100644 index 00000000000..6b27347c401 --- /dev/null +++ b/queue-6.1/net-neighbor-clear-error-in-case-strict-check-is-not.patch @@ -0,0 +1,42 @@ +From 9342fd5df17b7cb9b32b080ce9c6c7e34860c1c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2024 16:32:21 -0800 +Subject: net/neighbor: clear error in case strict check is not set + +From: Jakub Kicinski + +[ Upstream commit 0de6a472c3b38432b2f184bd64eb70d9ea36d107 ] + +Commit 51183d233b5a ("net/neighbor: Update neigh_dump_info for strict +data checking") added strict checking. The err variable is not cleared, +so if we find no table to dump we will return the validation error even +if user did not want strict checking. + +I think the only way to hit this is to send an buggy request, and ask +for a table which doesn't exist, so there's no point treating this +as a real fix. I only noticed it because a syzbot repro depended on it +to trigger another bug. + +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20241115003221.733593-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index c842f150c3048..dd0965e1afe85 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -2865,6 +2865,7 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb) + err = neigh_valid_dump_req(nlh, cb->strict_check, &filter, cb->extack); + if (err < 0 && cb->strict_check) + return err; ++ err = 0; + + s_t = cb->args[0]; + +-- +2.43.0 + diff --git a/queue-6.1/net-sched-cbs-fix-integer-overflow-in-cbs_set_port_r.patch b/queue-6.1/net-sched-cbs-fix-integer-overflow-in-cbs_set_port_r.patch new file mode 100644 index 00000000000..371bf9f9fa6 --- /dev/null +++ b/queue-6.1/net-sched-cbs-fix-integer-overflow-in-cbs_set_port_r.patch @@ -0,0 +1,40 @@ +From 256dff1a6efc5c6eb22c9715c2ec1b294ca9ac07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Oct 2024 15:45:29 +0300 +Subject: net/sched: cbs: Fix integer overflow in cbs_set_port_rate() + +From: Elena Salomatkina + +[ Upstream commit 397006ba5d918f9b74e734867e8fddbc36dc2282 ] + +The subsequent calculation of port_rate = speed * 1000 * BYTES_PER_KBIT, +where the BYTES_PER_KBIT is of type LL, may cause an overflow. +At least when speed = SPEED_20000, the expression to the left of port_rate +will be greater than INT_MAX. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Elena Salomatkina +Link: https://patch.msgid.link/20241013124529.1043-1-esalomatkina@ispras.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_cbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c +index cac870eb78973..0567a15d0f850 100644 +--- a/net/sched/sch_cbs.c ++++ b/net/sched/sch_cbs.c +@@ -310,7 +310,7 @@ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q) + { + struct ethtool_link_ksettings ecmd; + int speed = SPEED_10; +- int port_rate; ++ s64 port_rate; + int err; + + err = __ethtool_get_link_ksettings(dev, &ecmd); +-- +2.43.0 + diff --git a/queue-6.1/net-sfp-change-quirks-for-alcatel-lucent-g-010s-p.patch b/queue-6.1/net-sfp-change-quirks-for-alcatel-lucent-g-010s-p.patch new file mode 100644 index 00000000000..86128680981 --- /dev/null +++ b/queue-6.1/net-sfp-change-quirks-for-alcatel-lucent-g-010s-p.patch @@ -0,0 +1,37 @@ +From 1c3525be07a0d1ecafd5c6bed39f32bbd59b8344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Oct 2024 01:39:17 +0800 +Subject: net: sfp: change quirks for Alcatel Lucent G-010S-P + +From: Shengyu Qu + +[ Upstream commit 90cb5f1776ba371478e2b08fbf7018c7bd781a8d ] + +Seems Alcatel Lucent G-010S-P also have the same problem that it uses +TX_FAULT pin for SOC uart. So apply sfp_fixup_ignore_tx_fault to it. + +Signed-off-by: Shengyu Qu +Link: https://patch.msgid.link/TYCPR01MB84373677E45A7BFA5A28232C98792@TYCPR01MB8437.jpnprd01.prod.outlook.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index 06dce78d7b0c9..0666a39dc4859 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -386,7 +386,8 @@ static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id, + static const struct sfp_quirk sfp_quirks[] = { + // Alcatel Lucent G-010S-P can operate at 2500base-X, but incorrectly + // report 2500MBd NRZ in their EEPROM +- SFP_QUIRK_M("ALCATELLUCENT", "G010SP", sfp_quirk_2500basex), ++ SFP_QUIRK("ALCATELLUCENT", "G010SP", sfp_quirk_2500basex, ++ sfp_fixup_ignore_tx_fault), + + // Alcatel Lucent G-010S-A can operate at 2500base-X, but report 3.2GBd + // NRZ in their EEPROM +-- +2.43.0 + diff --git a/queue-6.1/netpoll-use-rcu_access_pointer-in-__netpoll_setup.patch b/queue-6.1/netpoll-use-rcu_access_pointer-in-__netpoll_setup.patch new file mode 100644 index 00000000000..360a5ac9558 --- /dev/null +++ b/queue-6.1/netpoll-use-rcu_access_pointer-in-__netpoll_setup.patch @@ -0,0 +1,44 @@ +From d1c122cb5d3320109a4c3c00207390b8fe6785f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2024 03:15:17 -0800 +Subject: netpoll: Use rcu_access_pointer() in __netpoll_setup + +From: Breno Leitao + +[ Upstream commit c69c5e10adb903ae2438d4f9c16eccf43d1fcbc1 ] + +The ndev->npinfo pointer in __netpoll_setup() is RCU-protected but is being +accessed directly for a NULL check. While no RCU read lock is held in this +context, we should still use proper RCU primitives for consistency and +correctness. + +Replace the direct NULL check with rcu_access_pointer(), which is the +appropriate primitive when only checking for NULL without dereferencing +the pointer. This function provides the necessary ordering guarantees +without requiring RCU read-side protection. + +Reviewed-by: Michal Kubiak +Signed-off-by: Breno Leitao +Link: https://patch.msgid.link/20241118-netpoll_rcu-v1-1-a1888dcb4a02@debian.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/netpoll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/netpoll.c b/net/core/netpoll.c +index fd2195cfcb4aa..681eeb2b73992 100644 +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -636,7 +636,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev) + goto out; + } + +- if (!ndev->npinfo) { ++ if (!rcu_access_pointer(ndev->npinfo)) { + npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL); + if (!npinfo) { + err = -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.1/nvdimm-rectify-the-illogical-code-within-nd_dax_prob.patch b/queue-6.1/nvdimm-rectify-the-illogical-code-within-nd_dax_prob.patch new file mode 100644 index 00000000000..cb83a719ecf --- /dev/null +++ b/queue-6.1/nvdimm-rectify-the-illogical-code-within-nd_dax_prob.patch @@ -0,0 +1,65 @@ +From 485f02108cc28f976d501d404b2d777ccc851246 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2024 08:55:26 +0000 +Subject: nvdimm: rectify the illogical code within nd_dax_probe() + +From: Yi Yang + +[ Upstream commit b61352101470f8b68c98af674e187cfaa7c43504 ] + +When nd_dax is NULL, nd_pfn is consequently NULL as well. Nevertheless, +it is inadvisable to perform pointer arithmetic or address-taking on a +NULL pointer. +Introduce the nd_dax_devinit() function to enhance the code's logic and +improve its readability. + +Signed-off-by: Yi Yang +Reviewed-by: Dave Jiang +Link: https://patch.msgid.link/20241108085526.527957-1-yiyang13@huawei.com +Signed-off-by: Ira Weiny +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/dax_devs.c | 4 ++-- + drivers/nvdimm/nd.h | 7 +++++++ + 2 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c +index 7f4a9d28b6702..5cafca6ba1da3 100644 +--- a/drivers/nvdimm/dax_devs.c ++++ b/drivers/nvdimm/dax_devs.c +@@ -106,12 +106,12 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns) + + nvdimm_bus_lock(&ndns->dev); + nd_dax = nd_dax_alloc(nd_region); +- nd_pfn = &nd_dax->nd_pfn; +- dax_dev = nd_pfn_devinit(nd_pfn, ndns); ++ dax_dev = nd_dax_devinit(nd_dax, ndns); + nvdimm_bus_unlock(&ndns->dev); + if (!dax_dev) + return -ENOMEM; + pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL); ++ nd_pfn = &nd_dax->nd_pfn; + nd_pfn->pfn_sb = pfn_sb; + rc = nd_pfn_validate(nd_pfn, DAX_SIG); + dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : ""); +diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h +index ec5219680092d..cce728f5409d6 100644 +--- a/drivers/nvdimm/nd.h ++++ b/drivers/nvdimm/nd.h +@@ -601,6 +601,13 @@ struct nd_dax *to_nd_dax(struct device *dev); + int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns); + bool is_nd_dax(struct device *dev); + struct device *nd_dax_create(struct nd_region *nd_region); ++static inline struct device *nd_dax_devinit(struct nd_dax *nd_dax, ++ struct nd_namespace_common *ndns) ++{ ++ if (!nd_dax) ++ return NULL; ++ return nd_pfn_devinit(&nd_dax->nd_pfn, ndns); ++} + #else + static inline int nd_dax_probe(struct device *dev, + struct nd_namespace_common *ndns) +-- +2.43.0 + diff --git a/queue-6.1/pci-add-acs-quirk-for-wangxun-ff5xxx-nics.patch b/queue-6.1/pci-add-acs-quirk-for-wangxun-ff5xxx-nics.patch new file mode 100644 index 00000000000..477cb650638 --- /dev/null +++ b/queue-6.1/pci-add-acs-quirk-for-wangxun-ff5xxx-nics.patch @@ -0,0 +1,63 @@ +From 51f752b2b91872ad00b2c1b89a736ced65e92454 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 10:46:04 +0800 +Subject: PCI: Add ACS quirk for Wangxun FF5xxx NICs + +From: Mengyuan Lou + +[ Upstream commit aa46a3736afcb7b0793766d22479b8b99fc1b322 ] + +Wangxun FF5xxx NICs are similar to SFxxx, RP1000 and RP2000 NICs. They may +be multi-function devices, but they do not advertise an ACS capability. + +But the hardware does isolate FF5xxx functions as though it had an ACS +capability and PCI_ACS_RR and PCI_ACS_CR were set in the ACS Control +register, i.e., all peer-to-peer traffic is directed upstream instead of +being routed internally. + +Add ACS quirk for FF5xxx NICs in pci_quirk_wangxun_nic_acs() so the +functions can be in independent IOMMU groups. + +Link: https://lore.kernel.org/r/E16053DB2B80E9A5+20241115024604.30493-1-mengyuanlou@net-swift.com +Signed-off-by: Mengyuan Lou +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 8887f3b3b38f0..d0da564ac94bf 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4881,18 +4881,21 @@ static int pci_quirk_brcm_acs(struct pci_dev *dev, u16 acs_flags) + } + + /* +- * Wangxun 10G/1G NICs have no ACS capability, and on multi-function +- * devices, peer-to-peer transactions are not be used between the functions. +- * So add an ACS quirk for below devices to isolate functions. ++ * Wangxun 40G/25G/10G/1G NICs have no ACS capability, but on ++ * multi-function devices, the hardware isolates the functions by ++ * directing all peer-to-peer traffic upstream as though PCI_ACS_RR and ++ * PCI_ACS_CR were set. + * SFxxx 1G NICs(em). + * RP1000/RP2000 10G NICs(sp). ++ * FF5xxx 40G/25G/10G NICs(aml). + */ + static int pci_quirk_wangxun_nic_acs(struct pci_dev *dev, u16 acs_flags) + { + switch (dev->device) { +- case 0x0100 ... 0x010F: +- case 0x1001: +- case 0x2001: ++ case 0x0100 ... 0x010F: /* EM */ ++ case 0x1001: case 0x2001: /* SP */ ++ case 0x5010: case 0x5025: case 0x5040: /* AML */ ++ case 0x5110: case 0x5125: case 0x5140: /* AML */ + return pci_acs_ctrl_enabled(acs_flags, + PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); + } +-- +2.43.0 + diff --git a/queue-6.1/pci-add-reset_subordinate-to-reset-hierarchy-below-b.patch b/queue-6.1/pci-add-reset_subordinate-to-reset-hierarchy-below-b.patch new file mode 100644 index 00000000000..3128eafeebe --- /dev/null +++ b/queue-6.1/pci-add-reset_subordinate-to-reset-hierarchy-below-b.patch @@ -0,0 +1,130 @@ +From a43ca18e8bcf9970a2a924ce051235fb755f6517 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 15:27:54 -0700 +Subject: PCI: Add 'reset_subordinate' to reset hierarchy below bridge + +From: Keith Busch + +[ Upstream commit 2fa046449a82a7d0f6d9721dd83e348816038444 ] + +The "bus" and "cxl_bus" reset methods reset a device by asserting Secondary +Bus Reset on the bridge leading to the device. These only work if the +device is the only device below the bridge. + +Add a sysfs 'reset_subordinate' attribute on bridges that can assert +Secondary Bus Reset regardless of how many devices are below the bridge. + +This resets all the devices below a bridge in a single command, including +the locking and config space save/restore that reset methods normally do. + +This may be the only way to reset devices that don't support other reset +methods (ACPI, FLR, PM reset, etc). + +Link: https://lore.kernel.org/r/20241025222755.3756162-1-kbusch@meta.com +Signed-off-by: Keith Busch +[bhelgaas: commit log, add capable(CAP_SYS_ADMIN) check] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Alex Williamson +Reviewed-by: Amey Narkhede +Signed-off-by: Sasha Levin +--- + Documentation/ABI/testing/sysfs-bus-pci | 11 +++++++++++ + drivers/pci/pci-sysfs.c | 26 +++++++++++++++++++++++++ + drivers/pci/pci.c | 2 +- + drivers/pci/pci.h | 1 + + 4 files changed, 39 insertions(+), 1 deletion(-) + +diff --git a/Documentation/ABI/testing/sysfs-bus-pci b/Documentation/ABI/testing/sysfs-bus-pci +index 840727fc75dcf..6c5ca95a94105 100644 +--- a/Documentation/ABI/testing/sysfs-bus-pci ++++ b/Documentation/ABI/testing/sysfs-bus-pci +@@ -163,6 +163,17 @@ Description: + will be present in sysfs. Writing 1 to this file + will perform reset. + ++What: /sys/bus/pci/devices/.../reset_subordinate ++Date: October 2024 ++Contact: linux-pci@vger.kernel.org ++Description: ++ This is visible only for bridge devices. If you want to reset ++ all devices attached through the subordinate bus of a specific ++ bridge device, writing 1 to this will try to do it. This will ++ affect all devices attached to the system through this bridge ++ similiar to writing 1 to their individual "reset" file, so use ++ with caution. ++ + What: /sys/bus/pci/devices/.../vpd + Date: February 2008 + Contact: Ben Hutchings +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index df1c44a5c886c..e1a980179dc14 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -517,6 +517,31 @@ static ssize_t bus_rescan_store(struct device *dev, + static struct device_attribute dev_attr_bus_rescan = __ATTR(rescan, 0200, NULL, + bus_rescan_store); + ++static ssize_t reset_subordinate_store(struct device *dev, ++ struct device_attribute *attr, ++ const char *buf, size_t count) ++{ ++ struct pci_dev *pdev = to_pci_dev(dev); ++ struct pci_bus *bus = pdev->subordinate; ++ unsigned long val; ++ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ ++ if (kstrtoul(buf, 0, &val) < 0) ++ return -EINVAL; ++ ++ if (val) { ++ int ret = __pci_reset_bus(bus); ++ ++ if (ret) ++ return ret; ++ } ++ ++ return count; ++} ++static DEVICE_ATTR_WO(reset_subordinate); ++ + #if defined(CONFIG_PM) && defined(CONFIG_ACPI) + static ssize_t d3cold_allowed_store(struct device *dev, + struct device_attribute *attr, +@@ -621,6 +646,7 @@ static struct attribute *pci_dev_attrs[] = { + static struct attribute *pci_bridge_attrs[] = { + &dev_attr_subordinate_bus_number.attr, + &dev_attr_secondary_bus_number.attr, ++ &dev_attr_reset_subordinate.attr, + NULL, + }; + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index e08354b811073..8a35a9887302d 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -5933,7 +5933,7 @@ EXPORT_SYMBOL_GPL(pci_probe_reset_bus); + * + * Same as above except return -EAGAIN if the bus cannot be locked + */ +-static int __pci_reset_bus(struct pci_bus *bus) ++int __pci_reset_bus(struct pci_bus *bus) + { + int rc; + +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 5d5813aa5b458..38ad75ce52c32 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -37,6 +37,7 @@ bool pci_reset_supported(struct pci_dev *dev); + void pci_init_reset_methods(struct pci_dev *dev); + int pci_bridge_secondary_bus_reset(struct pci_dev *dev); + int pci_bus_error_reset(struct pci_dev *dev); ++int __pci_reset_bus(struct pci_bus *bus); + + struct pci_cap_saved_data { + u16 cap_nr; +-- +2.43.0 + diff --git a/queue-6.1/pci-detect-and-trust-built-in-thunderbolt-chips.patch b/queue-6.1/pci-detect-and-trust-built-in-thunderbolt-chips.patch new file mode 100644 index 00000000000..0c02404b7f4 --- /dev/null +++ b/queue-6.1/pci-detect-and-trust-built-in-thunderbolt-chips.patch @@ -0,0 +1,276 @@ +From 997ac0e01dd9c471f165a8e3d14eb2aa3570a639 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Sep 2024 17:57:45 +0000 +Subject: PCI: Detect and trust built-in Thunderbolt chips + +From: Esther Shimanovich + +[ Upstream commit 3b96b895127b7c0aed63d82c974b46340e8466c1 ] + +Some computers with CPUs that lack Thunderbolt features use discrete +Thunderbolt chips to add Thunderbolt functionality. These Thunderbolt +chips are located within the chassis; between the Root Port labeled +ExternalFacingPort and the USB-C port. + +These Thunderbolt PCIe devices should be labeled as fixed and trusted, as +they are built into the computer. Otherwise, security policies that rely on +those flags may have unintended results, such as preventing USB-C ports +from enumerating. + +Detect the above scenario through the process of elimination. + + 1) Integrated Thunderbolt host controllers already have Thunderbolt + implemented, so anything outside their external facing Root Port is + removable and untrusted. + + Detect them using the following properties: + + - Most integrated host controllers have the "usb4-host-interface" + ACPI property, as described here: + + https://learn.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports#mapping-native-protocols-pcie-displayport-tunneled-through-usb4-to-usb4-host-routers + + - Integrated Thunderbolt PCIe Root Ports before Alder Lake do not + have the "usb4-host-interface" ACPI property. Identify those by + their PCI IDs instead. + + 2) If a Root Port does not have integrated Thunderbolt capabilities, but + has the "ExternalFacingPort" ACPI property, that means the + manufacturer has opted to use a discrete Thunderbolt host controller + that is built into the computer. + + This host controller can be identified by virtue of being located + directly below an external-facing Root Port that lacks integrated + Thunderbolt. Label it as trusted and fixed. + + Everything downstream from it is untrusted and removable. + +The "ExternalFacingPort" ACPI property is described here: +https://learn.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports#identifying-externally-exposed-pcie-root-ports + +Link: https://lore.kernel.org/r/20240910-trust-tbt-fix-v5-1-7a7a42a5f496@chromium.org +Suggested-by: Mika Westerberg +Signed-off-by: Esther Shimanovich +Signed-off-by: Bjorn Helgaas +Tested-by: Mika Westerberg +Tested-by: Mario Limonciello +Reviewed-by: Mika Westerberg +Reviewed-by: Mario Limonciello +Signed-off-by: Sasha Levin +--- + arch/x86/pci/acpi.c | 119 ++++++++++++++++++++++++++++++++++++++++++++ + drivers/pci/probe.c | 30 ++++++++--- + include/linux/pci.h | 6 +++ + 3 files changed, 148 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c +index 2f82480fd4305..4421560a5e825 100644 +--- a/arch/x86/pci/acpi.c ++++ b/arch/x86/pci/acpi.c +@@ -248,6 +248,125 @@ void __init pci_acpi_crs_quirks(void) + printk(KERN_INFO "PCI: Please notify linux-pci@vger.kernel.org so future kernels can this automatically\n"); + } + ++/* ++ * Check if pdev is part of a PCIe switch that is directly below the ++ * specified bridge. ++ */ ++static bool pcie_switch_directly_under(struct pci_dev *bridge, ++ struct pci_dev *pdev) ++{ ++ struct pci_dev *parent = pci_upstream_bridge(pdev); ++ ++ /* If the device doesn't have a parent, it's not under anything */ ++ if (!parent) ++ return false; ++ ++ /* ++ * If the device has a PCIe type, check if it is below the ++ * corresponding PCIe switch components (if applicable). Then check ++ * if its upstream port is directly beneath the specified bridge. ++ */ ++ switch (pci_pcie_type(pdev)) { ++ case PCI_EXP_TYPE_UPSTREAM: ++ return parent == bridge; ++ ++ case PCI_EXP_TYPE_DOWNSTREAM: ++ if (pci_pcie_type(parent) != PCI_EXP_TYPE_UPSTREAM) ++ return false; ++ parent = pci_upstream_bridge(parent); ++ return parent == bridge; ++ ++ case PCI_EXP_TYPE_ENDPOINT: ++ if (pci_pcie_type(parent) != PCI_EXP_TYPE_DOWNSTREAM) ++ return false; ++ parent = pci_upstream_bridge(parent); ++ if (!parent || pci_pcie_type(parent) != PCI_EXP_TYPE_UPSTREAM) ++ return false; ++ parent = pci_upstream_bridge(parent); ++ return parent == bridge; ++ } ++ ++ return false; ++} ++ ++static bool pcie_has_usb4_host_interface(struct pci_dev *pdev) ++{ ++ struct fwnode_handle *fwnode; ++ ++ /* ++ * For USB4, the tunneled PCIe Root or Downstream Ports are marked ++ * with the "usb4-host-interface" ACPI property, so we look for ++ * that first. This should cover most cases. ++ */ ++ fwnode = fwnode_find_reference(dev_fwnode(&pdev->dev), ++ "usb4-host-interface", 0); ++ if (!IS_ERR(fwnode)) { ++ fwnode_handle_put(fwnode); ++ return true; ++ } ++ ++ /* ++ * Any integrated Thunderbolt 3/4 PCIe Root Ports from Intel ++ * before Alder Lake do not have the "usb4-host-interface" ++ * property so we use their PCI IDs instead. All these are ++ * tunneled. This list is not expected to grow. ++ */ ++ if (pdev->vendor == PCI_VENDOR_ID_INTEL) { ++ switch (pdev->device) { ++ /* Ice Lake Thunderbolt 3 PCIe Root Ports */ ++ case 0x8a1d: ++ case 0x8a1f: ++ case 0x8a21: ++ case 0x8a23: ++ /* Tiger Lake-LP Thunderbolt 4 PCIe Root Ports */ ++ case 0x9a23: ++ case 0x9a25: ++ case 0x9a27: ++ case 0x9a29: ++ /* Tiger Lake-H Thunderbolt 4 PCIe Root Ports */ ++ case 0x9a2b: ++ case 0x9a2d: ++ case 0x9a2f: ++ case 0x9a31: ++ return true; ++ } ++ } ++ ++ return false; ++} ++ ++bool arch_pci_dev_is_removable(struct pci_dev *pdev) ++{ ++ struct pci_dev *parent, *root; ++ ++ /* pdev without a parent or Root Port is never tunneled */ ++ parent = pci_upstream_bridge(pdev); ++ if (!parent) ++ return false; ++ root = pcie_find_root_port(pdev); ++ if (!root) ++ return false; ++ ++ /* Internal PCIe devices are not tunneled */ ++ if (!root->external_facing) ++ return false; ++ ++ /* Anything directly behind a "usb4-host-interface" is tunneled */ ++ if (pcie_has_usb4_host_interface(parent)) ++ return true; ++ ++ /* ++ * Check if this is a discrete Thunderbolt/USB4 controller that is ++ * directly behind the non-USB4 PCIe Root Port marked as ++ * "ExternalFacingPort". Those are not behind a PCIe tunnel. ++ */ ++ if (pcie_switch_directly_under(root, pdev)) ++ return false; ++ ++ /* PCIe devices after the discrete chip are tunneled */ ++ return true; ++} ++ + #ifdef CONFIG_PCI_MMCONFIG + static int check_segment(u16 seg, struct device *dev, char *estr) + { +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index e19b79821dd6d..5c1ab9ee65eb3 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1593,23 +1593,33 @@ static void set_pcie_thunderbolt(struct pci_dev *dev) + + static void set_pcie_untrusted(struct pci_dev *dev) + { +- struct pci_dev *parent; ++ struct pci_dev *parent = pci_upstream_bridge(dev); + ++ if (!parent) ++ return; + /* +- * If the upstream bridge is untrusted we treat this device ++ * If the upstream bridge is untrusted we treat this device as + * untrusted as well. + */ +- parent = pci_upstream_bridge(dev); +- if (parent && (parent->untrusted || parent->external_facing)) ++ if (parent->untrusted) { ++ dev->untrusted = true; ++ return; ++ } ++ ++ if (arch_pci_dev_is_removable(dev)) { ++ pci_dbg(dev, "marking as untrusted\n"); + dev->untrusted = true; ++ } + } + + static void pci_set_removable(struct pci_dev *dev) + { + struct pci_dev *parent = pci_upstream_bridge(dev); + ++ if (!parent) ++ return; + /* +- * We (only) consider everything downstream from an external_facing ++ * We (only) consider everything tunneled below an external_facing + * device to be removable by the user. We're mainly concerned with + * consumer platforms with user accessible thunderbolt ports that are + * vulnerable to DMA attacks, and we expect those ports to be marked by +@@ -1619,9 +1629,15 @@ static void pci_set_removable(struct pci_dev *dev) + * accessible to user / may not be removed by end user, and thus not + * exposed as "removable" to userspace. + */ +- if (parent && +- (parent->external_facing || dev_is_removable(&parent->dev))) ++ if (dev_is_removable(&parent->dev)) { ++ dev_set_removable(&dev->dev, DEVICE_REMOVABLE); ++ return; ++ } ++ ++ if (arch_pci_dev_is_removable(dev)) { ++ pci_dbg(dev, "marking as removable\n"); + dev_set_removable(&dev->dev, DEVICE_REMOVABLE); ++ } + } + + /** +diff --git a/include/linux/pci.h b/include/linux/pci.h +index df73fb26b8250..9e58e5400d783 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -2471,6 +2471,12 @@ pci_host_bridge_acpi_msi_domain(struct pci_bus *bus) { return NULL; } + static inline bool pci_pr3_present(struct pci_dev *pdev) { return false; } + #endif + ++#if defined(CONFIG_X86) && defined(CONFIG_ACPI) ++bool arch_pci_dev_is_removable(struct pci_dev *pdev); ++#else ++static inline bool arch_pci_dev_is_removable(struct pci_dev *pdev) { return false; } ++#endif ++ + #ifdef CONFIG_EEH + static inline struct eeh_dev *pci_dev_to_eeh_dev(struct pci_dev *pdev) + { +-- +2.43.0 + diff --git a/queue-6.1/perf-x86-amd-warn-only-on-new-bits-set.patch b/queue-6.1/perf-x86-amd-warn-only-on-new-bits-set.patch new file mode 100644 index 00000000000..10b4d82bd3b --- /dev/null +++ b/queue-6.1/perf-x86-amd-warn-only-on-new-bits-set.patch @@ -0,0 +1,70 @@ +From e80239f84a42a092d90beb551f30c28421cb415b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 07:10:19 -0700 +Subject: perf/x86/amd: Warn only on new bits set + +From: Breno Leitao + +[ Upstream commit de20037e1b3c2f2ca97b8c12b8c7bca8abd509a7 ] + +Warning at every leaking bits can cause a flood of message, triggering +various stall-warning mechanisms to fire, including CSD locks, which +makes the machine to be unusable. + +Track the bits that are being leaked, and only warn when a new bit is +set. + +That said, this patch will help with the following issues: + +1) It will tell us which bits are being set, so, it is easy to + communicate it back to vendor, and to do a root-cause analyzes. + +2) It avoid the machine to be unusable, because, worst case + scenario, the user gets less than 60 WARNs (one per unhandled bit). + +Suggested-by: Paul E. McKenney +Signed-off-by: Breno Leitao +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Sandipan Das +Reviewed-by: Paul E. McKenney +Link: https://lkml.kernel.org/r/20241001141020.2620361-1-leitao@debian.org +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/core.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c +index 3ac069a4559b0..1282f1a702139 100644 +--- a/arch/x86/events/amd/core.c ++++ b/arch/x86/events/amd/core.c +@@ -881,11 +881,12 @@ static int amd_pmu_handle_irq(struct pt_regs *regs) + static int amd_pmu_v2_handle_irq(struct pt_regs *regs) + { + struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); ++ static atomic64_t status_warned = ATOMIC64_INIT(0); ++ u64 reserved, status, mask, new_bits, prev_bits; + struct perf_sample_data data; + struct hw_perf_event *hwc; + struct perf_event *event; + int handled = 0, idx; +- u64 reserved, status, mask; + bool pmu_enabled; + + /* +@@ -952,7 +953,12 @@ static int amd_pmu_v2_handle_irq(struct pt_regs *regs) + * the corresponding PMCs are expected to be inactive according to the + * active_mask + */ +- WARN_ON(status > 0); ++ if (status > 0) { ++ prev_bits = atomic64_fetch_or(status, &status_warned); ++ // A new bit was set for the very first time. ++ new_bits = status & ~prev_bits; ++ WARN(new_bits, "New overflows for inactive PMCs: %llx\n", new_bits); ++ } + + /* Clear overflow and freeze bits */ + amd_pmu_ack_global_status(~status); +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-freescale-fix-compile_test-error-with-pinctr.patch b/queue-6.1/pinctrl-freescale-fix-compile_test-error-with-pinctr.patch new file mode 100644 index 00000000000..53f70bcb7e6 --- /dev/null +++ b/queue-6.1/pinctrl-freescale-fix-compile_test-error-with-pinctr.patch @@ -0,0 +1,40 @@ +From 78fa1a6ee8f870f68ea6313b6ff4dc02cbb75760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2024 11:23:09 +0200 +Subject: pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU + +From: Esben Haabendal + +[ Upstream commit 58414a31c5713afb5449fd74a26a843d34cc62e8 ] + +When PINCTRL_IMX_SCU was selected by PINCTRL_IMX8DXL or PINCTRL_IMX8QM +combined with COMPILE_TEST on a non-arm platforms, the IMX_SCU +dependency could not be enabled. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202410031439.GyTSa0kX-lkp@intel.com/ +Closes: https://lore.kernel.org/oe-kbuild-all/202410030852.q0Hukplf-lkp@intel.com/ +Signed-off-by: Esben Haabendal +Link: https://lore.kernel.org/20241003-imx-pinctrl-compile-test-fix-v1-1-145ca1948cc3@geanix.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/freescale/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/freescale/Kconfig b/drivers/pinctrl/freescale/Kconfig +index 7a32f77792d9a..86110fc3c1465 100644 +--- a/drivers/pinctrl/freescale/Kconfig ++++ b/drivers/pinctrl/freescale/Kconfig +@@ -9,7 +9,7 @@ config PINCTRL_IMX + + config PINCTRL_IMX_SCU + tristate +- depends on IMX_SCU ++ depends on IMX_SCU || COMPILE_TEST + select PINCTRL_IMX + + config PINCTRL_IMX1_CORE +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-qcom-pmic-gpio-add-support-for-pm8937.patch b/queue-6.1/pinctrl-qcom-pmic-gpio-add-support-for-pm8937.patch new file mode 100644 index 00000000000..052cf4994c3 --- /dev/null +++ b/queue-6.1/pinctrl-qcom-pmic-gpio-add-support-for-pm8937.patch @@ -0,0 +1,39 @@ +From 2c36d94572d4d4ef274c8e0dabbc991bedfbade1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 02:19:43 +0100 +Subject: pinctrl: qcom-pmic-gpio: add support for PM8937 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Czémán + +[ Upstream commit 89265a58ff24e3885c2c9ca722bc3aaa47018be9 ] + +PM8937 has 8 GPIO-s with holes on GPIO3, GPIO4 and GPIO6. + +Signed-off-by: Barnabás Czémán +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/20241031-msm8917-v2-2-8a075faa89b1@mainlining.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index effe32996bac6..63255cd35bd70 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -1219,6 +1219,8 @@ static const struct of_device_id pmic_gpio_of_match[] = { + { .compatible = "qcom,pm8350c-gpio", .data = (void *) 9 }, + { .compatible = "qcom,pm8450-gpio", .data = (void *) 4 }, + { .compatible = "qcom,pm8916-gpio", .data = (void *) 4 }, ++ /* pm8937 has 8 GPIOs with holes on 3, 4 and 6 */ ++ { .compatible = "qcom,pm8937-gpio", .data = (void *) 8 }, + { .compatible = "qcom,pm8941-gpio", .data = (void *) 36 }, + /* pm8950 has 8 GPIOs with holes on 3 */ + { .compatible = "qcom,pm8950-gpio", .data = (void *) 8 }, +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-qcom-spmi-mpp-add-pm8937-compatible.patch b/queue-6.1/pinctrl-qcom-spmi-mpp-add-pm8937-compatible.patch new file mode 100644 index 00000000000..42106598cf6 --- /dev/null +++ b/queue-6.1/pinctrl-qcom-spmi-mpp-add-pm8937-compatible.patch @@ -0,0 +1,39 @@ +From 958ee08e24dec498be8983912530f5ded523d7e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 02:19:45 +0100 +Subject: pinctrl: qcom: spmi-mpp: Add PM8937 compatible +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Czémán + +[ Upstream commit f755261190e88f5d19fe0a3b762f0bbaff6bd438 ] + +The PM8937 provides 4 MPPs. +Add a compatible to support them. + +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Barnabás Czémán +Link: https://lore.kernel.org/20241031-msm8917-v2-4-8a075faa89b1@mainlining.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-spmi-mpp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c +index 6937157f50b3c..148cc107b7aff 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c +@@ -964,6 +964,7 @@ static const struct of_device_id pmic_mpp_of_match[] = { + { .compatible = "qcom,pm8226-mpp", .data = (void *) 8 }, + { .compatible = "qcom,pm8841-mpp", .data = (void *) 4 }, + { .compatible = "qcom,pm8916-mpp", .data = (void *) 4 }, ++ { .compatible = "qcom,pm8937-mpp", .data = (void *) 4 }, + { .compatible = "qcom,pm8941-mpp", .data = (void *) 8 }, + { .compatible = "qcom,pm8950-mpp", .data = (void *) 4 }, + { .compatible = "qcom,pmi8950-mpp", .data = (void *) 4 }, +-- +2.43.0 + diff --git a/queue-6.1/powerpc-prom_init-fixup-missing-powermac-size-cells.patch b/queue-6.1/powerpc-prom_init-fixup-missing-powermac-size-cells.patch new file mode 100644 index 00000000000..2bdf51df4e1 --- /dev/null +++ b/queue-6.1/powerpc-prom_init-fixup-missing-powermac-size-cells.patch @@ -0,0 +1,103 @@ +From 509fb053a8f125a2d7273949a487cb5ade275fb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 13:57:10 +1100 +Subject: powerpc/prom_init: Fixup missing powermac #size-cells + +From: Michael Ellerman + +[ Upstream commit cf89c9434af122f28a3552e6f9cc5158c33ce50a ] + +On some powermacs `escc` nodes are missing `#size-cells` properties, +which is deprecated and now triggers a warning at boot since commit +045b14ca5c36 ("of: WARN on deprecated #address-cells/#size-cells +handling"). + +For example: + + Missing '#size-cells' in /pci@f2000000/mac-io@c/escc@13000 + WARNING: CPU: 0 PID: 0 at drivers/of/base.c:133 of_bus_n_size_cells+0x98/0x108 + Hardware name: PowerMac3,1 7400 0xc0209 PowerMac + ... + Call Trace: + of_bus_n_size_cells+0x98/0x108 (unreliable) + of_bus_default_count_cells+0x40/0x60 + __of_get_address+0xc8/0x21c + __of_address_to_resource+0x5c/0x228 + pmz_init_port+0x5c/0x2ec + pmz_probe.isra.0+0x144/0x1e4 + pmz_console_init+0x10/0x48 + console_init+0xcc/0x138 + start_kernel+0x5c4/0x694 + +As powermacs boot via prom_init it's possible to add the missing +properties to the device tree during boot, avoiding the warning. Note +that `escc-legacy` nodes are also missing `#size-cells` properties, but +they are skipped by the macio driver, so leave them alone. + +Depends-on: 045b14ca5c36 ("of: WARN on deprecated #address-cells/#size-cells handling") +Signed-off-by: Michael Ellerman +Reviewed-by: Rob Herring +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20241126025710.591683-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom_init.c | 29 +++++++++++++++++++++++++++-- + 1 file changed, 27 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c +index d464ba412084d..a6090896f7497 100644 +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -2924,7 +2924,7 @@ static void __init fixup_device_tree_chrp(void) + #endif + + #if defined(CONFIG_PPC64) && defined(CONFIG_PPC_PMAC) +-static void __init fixup_device_tree_pmac(void) ++static void __init fixup_device_tree_pmac64(void) + { + phandle u3, i2c, mpic; + u32 u3_rev; +@@ -2964,7 +2964,31 @@ static void __init fixup_device_tree_pmac(void) + &parent, sizeof(parent)); + } + #else +-#define fixup_device_tree_pmac() ++#define fixup_device_tree_pmac64() ++#endif ++ ++#ifdef CONFIG_PPC_PMAC ++static void __init fixup_device_tree_pmac(void) ++{ ++ __be32 val = 1; ++ char type[8]; ++ phandle node; ++ ++ // Some pmacs are missing #size-cells on escc nodes ++ for (node = 0; prom_next_node(&node); ) { ++ type[0] = '\0'; ++ prom_getprop(node, "device_type", type, sizeof(type)); ++ if (prom_strcmp(type, "escc")) ++ continue; ++ ++ if (prom_getproplen(node, "#size-cells") != PROM_ERROR) ++ continue; ++ ++ prom_setprop(node, NULL, "#size-cells", &val, sizeof(val)); ++ } ++} ++#else ++static inline void fixup_device_tree_pmac(void) { } + #endif + + #ifdef CONFIG_PPC_EFIKA +@@ -3189,6 +3213,7 @@ static void __init fixup_device_tree(void) + fixup_device_tree_maple_memory_controller(); + fixup_device_tree_chrp(); + fixup_device_tree_pmac(); ++ fixup_device_tree_pmac64(); + fixup_device_tree_efika(); + fixup_device_tree_pasemi(); + } +-- +2.43.0 + diff --git a/queue-6.1/r8169-don-t-apply-udp-padding-quirk-on-rtl8126a.patch b/queue-6.1/r8169-don-t-apply-udp-padding-quirk-on-rtl8126a.patch new file mode 100644 index 00000000000..bb7225264be --- /dev/null +++ b/queue-6.1/r8169-don-t-apply-udp-padding-quirk-on-rtl8126a.patch @@ -0,0 +1,57 @@ +From f1f2d14c0ee265557228074dfa3ddafb06ae7d68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 07:44:23 +0200 +Subject: r8169: don't apply UDP padding quirk on RTL8126A + +From: Heiner Kallweit + +[ Upstream commit 87e26448dbda4523b73a894d96f0f788506d3795 ] + +Vendor drivers r8125/r8126 indicate that this quirk isn't needed +any longer for RTL8126A. Mimic this in r8169. + +Signed-off-by: Heiner Kallweit +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/d1317187-aa81-4a69-b831-678436e4de62@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index a74e33bf0302e..4b461e93ffe9d 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4139,8 +4139,8 @@ static unsigned int rtl8125_quirk_udp_padto(struct rtl8169_private *tp, + { + unsigned int padto = 0, len = skb->len; + +- if (rtl_is_8125(tp) && len < 128 + RTL_MIN_PATCH_LEN && +- rtl_skb_is_udp(skb) && skb_transport_header_was_set(skb)) { ++ if (len < 128 + RTL_MIN_PATCH_LEN && rtl_skb_is_udp(skb) && ++ skb_transport_header_was_set(skb)) { + unsigned int trans_data_len = skb_tail_pointer(skb) - + skb_transport_header(skb); + +@@ -4164,9 +4164,15 @@ static unsigned int rtl8125_quirk_udp_padto(struct rtl8169_private *tp, + static unsigned int rtl_quirk_packet_padto(struct rtl8169_private *tp, + struct sk_buff *skb) + { +- unsigned int padto; ++ unsigned int padto = 0; + +- padto = rtl8125_quirk_udp_padto(tp, skb); ++ switch (tp->mac_version) { ++ case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_63: ++ padto = rtl8125_quirk_udp_padto(tp, skb); ++ break; ++ default: ++ break; ++ } + + switch (tp->mac_version) { + case RTL_GIGA_MAC_VER_34: +-- +2.43.0 + diff --git a/queue-6.1/rocker-fix-link-status-detection-in-rocker_carrier_i.patch b/queue-6.1/rocker-fix-link-status-detection-in-rocker_carrier_i.patch new file mode 100644 index 00000000000..e1791c1641a --- /dev/null +++ b/queue-6.1/rocker-fix-link-status-detection-in-rocker_carrier_i.patch @@ -0,0 +1,39 @@ +From ddb92ea635d080127e839a3c21ac41dffe690476 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2024 18:19:46 +0300 +Subject: rocker: fix link status detection in rocker_carrier_init() + +From: Dmitry Antipov + +[ Upstream commit e64285ff41bb7a934bd815bd38f31119be62ac37 ] + +Since '1 << rocker_port->pport' may be undefined for port >= 32, +cast the left operand to 'unsigned long long' like it's done in +'rocker_port_set_enable()' above. Compile tested only. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Dmitry Antipov +Link: https://patch.msgid.link/20241114151946.519047-1-dmantipov@yandex.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/rocker/rocker_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c +index 9e59669a93dd3..2e2826c901fcc 100644 +--- a/drivers/net/ethernet/rocker/rocker_main.c ++++ b/drivers/net/ethernet/rocker/rocker_main.c +@@ -2504,7 +2504,7 @@ static void rocker_carrier_init(const struct rocker_port *rocker_port) + u64 link_status = rocker_read64(rocker, PORT_PHYS_LINK_STATUS); + bool link_up; + +- link_up = link_status & (1 << rocker_port->pport); ++ link_up = link_status & (1ULL << rocker_port->pport); + if (link_up) + netif_carrier_on(rocker_port->dev); + else +-- +2.43.0 + diff --git a/queue-6.1/rtc-cmos-avoid-taking-rtc_lock-for-extended-period-o.patch b/queue-6.1/rtc-cmos-avoid-taking-rtc_lock-for-extended-period-o.patch new file mode 100644 index 00000000000..cadab498ada --- /dev/null +++ b/queue-6.1/rtc-cmos-avoid-taking-rtc_lock-for-extended-period-o.patch @@ -0,0 +1,95 @@ +From 17d773cfab06eb96c70c0b688b8141e59d4e3d61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 13:14:57 -0700 +Subject: rtc: cmos: avoid taking rtc_lock for extended period of time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Torokhov + +[ Upstream commit 0a6efab33eab4e973db26d9f90c3e97a7a82e399 ] + +On my device reading entirety of /sys/devices/pnp0/00:03/cmos_nvram0/nvmem +takes about 9 msec during which time interrupts are off on the CPU that +does the read and the thread that performs the read can not be migrated +or preempted by another higher priority thread (RT or not). + +Allow readers and writers be preempted by taking and releasing rtc_lock +spinlock for each individual byte read or written rather than once per +read/write request. + +Signed-off-by: Dmitry Torokhov +Reviewed-by: Mateusz Jończyk +Link: https://lore.kernel.org/r/Zxv8QWR21AV4ztC5@google.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 31 +++++++++++++++---------------- + 1 file changed, 15 insertions(+), 16 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 542568cd72b32..5f43773900d18 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -645,18 +645,17 @@ static int cmos_nvram_read(void *priv, unsigned int off, void *val, + unsigned char *buf = val; + + off += NVRAM_OFFSET; +- spin_lock_irq(&rtc_lock); +- for (; count; count--, off++) { ++ for (; count; count--, off++, buf++) { ++ guard(spinlock_irq)(&rtc_lock); + if (off < 128) +- *buf++ = CMOS_READ(off); ++ *buf = CMOS_READ(off); + else if (can_bank2) +- *buf++ = cmos_read_bank2(off); ++ *buf = cmos_read_bank2(off); + else +- break; ++ return -EIO; + } +- spin_unlock_irq(&rtc_lock); + +- return count ? -EIO : 0; ++ return 0; + } + + static int cmos_nvram_write(void *priv, unsigned int off, void *val, +@@ -671,23 +670,23 @@ static int cmos_nvram_write(void *priv, unsigned int off, void *val, + * NVRAM to update, updating checksums is also part of its job. + */ + off += NVRAM_OFFSET; +- spin_lock_irq(&rtc_lock); +- for (; count; count--, off++) { ++ for (; count; count--, off++, buf++) { + /* don't trash RTC registers */ + if (off == cmos->day_alrm + || off == cmos->mon_alrm + || off == cmos->century) +- buf++; +- else if (off < 128) +- CMOS_WRITE(*buf++, off); ++ continue; ++ ++ guard(spinlock_irq)(&rtc_lock); ++ if (off < 128) ++ CMOS_WRITE(*buf, off); + else if (can_bank2) +- cmos_write_bank2(*buf++, off); ++ cmos_write_bank2(*buf, off); + else +- break; ++ return -EIO; + } +- spin_unlock_irq(&rtc_lock); + +- return count ? -EIO : 0; ++ return 0; + } + + /*----------------------------------------------------------------*/ +-- +2.43.0 + diff --git a/queue-6.1/s390-cpum_sf-handle-cpu-hotplug-remove-during-sampli.patch b/queue-6.1/s390-cpum_sf-handle-cpu-hotplug-remove-during-sampli.patch new file mode 100644 index 00000000000..5ae16fa6a0f --- /dev/null +++ b/queue-6.1/s390-cpum_sf-handle-cpu-hotplug-remove-during-sampli.patch @@ -0,0 +1,80 @@ +From db24015cf9a9c5e19146299c15e599ffb7eb018d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 12:27:53 +0200 +Subject: s390/cpum_sf: Handle CPU hotplug remove during sampling + +From: Thomas Richter + +[ Upstream commit a0bd7dacbd51c632b8e2c0500b479af564afadf3 ] + +CPU hotplug remove handling triggers the following function +call sequence: + + CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() + ... + CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu() + +The s390 CPUMF sampling CPU hotplug handler invokes: + + s390_pmu_sf_offline_cpu() + +--> cpusf_pmu_setup() + +--> setup_pmc_cpu() + +--> deallocate_buffers() + +This function de-allocates all sampling data buffers (SDBs) allocated +for that CPU at event initialization. It also clears the +PMU_F_RESERVED bit. The CPU is gone and can not be sampled. + +With the event still being active on the removed CPU, the CPU event +hotplug support in kernel performance subsystem triggers the +following function calls on the removed CPU: + + perf_event_exit_cpu() + +--> perf_event_exit_cpu_context() + +--> __perf_event_exit_context() + +--> __perf_remove_from_context() + +--> event_sched_out() + +--> cpumsf_pmu_del() + +--> cpumsf_pmu_stop() + +--> hw_perf_event_update() + +to stop and remove the event. During removal of the event, the +sampling device driver tries to read out the remaining samples from +the sample data buffers (SDBs). But they have already been freed +(and may have been re-assigned). This may lead to a use after free +situation in which case the samples are most likely invalid. In the +best case the memory has not been reassigned and still contains +valid data. + +Remedy this situation and check if the CPU is still in reserved +state (bit PMU_F_RESERVED set). In this case the SDBs have not been +released an contain valid data. This is always the case when +the event is removed (and no CPU hotplug off occured). +If the PMU_F_RESERVED bit is not set, the SDB buffers are gone. + +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index f3b0a106f7227..46a1a85a0e440 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -1896,7 +1896,9 @@ static void cpumsf_pmu_stop(struct perf_event *event, int flags) + event->hw.state |= PERF_HES_STOPPED; + + if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) { +- hw_perf_event_update(event, 1); ++ /* CPU hotplug off removes SDBs. No samples to extract. */ ++ if (cpuhw->flags & PMU_F_RESERVED) ++ hw_perf_event_update(event, 1); + event->hw.state |= PERF_HES_UPTODATE; + } + perf_pmu_enable(event->pmu); +-- +2.43.0 + diff --git a/queue-6.1/samples-bpf-fix-a-resource-leak.patch b/queue-6.1/samples-bpf-fix-a-resource-leak.patch new file mode 100644 index 00000000000..9cbaf9711a4 --- /dev/null +++ b/queue-6.1/samples-bpf-fix-a-resource-leak.patch @@ -0,0 +1,39 @@ +From 1ba17e79b40d91b038a73e56e47e3f8d79316680 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 18:41:26 -0700 +Subject: samples/bpf: Fix a resource leak + +From: Zhu Jun + +[ Upstream commit f3ef53174b23246fe9bc2bbc2542f3a3856fa1e2 ] + +The opened file should be closed in show_sockopts(), otherwise resource +leak will occur that this problem was discovered by reading code + +Signed-off-by: Zhu Jun +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20241010014126.2573-1-zhujun2@cmss.chinamobile.com +Signed-off-by: Sasha Levin +--- + samples/bpf/test_cgrp2_sock.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/samples/bpf/test_cgrp2_sock.c b/samples/bpf/test_cgrp2_sock.c +index a0811df888f45..8ca2a445ffa15 100644 +--- a/samples/bpf/test_cgrp2_sock.c ++++ b/samples/bpf/test_cgrp2_sock.c +@@ -178,8 +178,10 @@ static int show_sockopts(int family) + return 1; + } + +- if (get_bind_to_device(sd, name, sizeof(name)) < 0) ++ if (get_bind_to_device(sd, name, sizeof(name)) < 0) { ++ close(sd); + return 1; ++ } + + mark = get_somark(sd); + prio = get_priority(sd); +-- +2.43.0 + diff --git a/queue-6.1/scsi-hisi_sas-add-cond_resched-for-no-forced-preempt.patch b/queue-6.1/scsi-hisi_sas-add-cond_resched-for-no-forced-preempt.patch new file mode 100644 index 00000000000..c0e4a25f090 --- /dev/null +++ b/queue-6.1/scsi-hisi_sas-add-cond_resched-for-no-forced-preempt.patch @@ -0,0 +1,87 @@ +From 0fe8524ce8d8323a508b6f5c414f5b4bc9db0f78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 10:18:16 +0800 +Subject: scsi: hisi_sas: Add cond_resched() for no forced preemption model + +From: Yihang Li + +[ Upstream commit 2233c4a0b948211743659b24c13d6bd059fa75fc ] + +For no forced preemption model kernel, in the scenario where the +expander is connected to 12 high performance SAS SSDs, the following +call trace may occur: + +[ 214.409199][ C240] watchdog: BUG: soft lockup - CPU#240 stuck for 22s! [irq/149-hisi_sa:3211] +[ 214.568533][ C240] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) +[ 214.575224][ C240] pc : fput_many+0x8c/0xdc +[ 214.579480][ C240] lr : fput+0x1c/0xf0 +[ 214.583302][ C240] sp : ffff80002de2b900 +[ 214.587298][ C240] x29: ffff80002de2b900 x28: ffff1082aa412000 +[ 214.593291][ C240] x27: ffff3062a0348c08 x26: ffff80003a9f6000 +[ 214.599284][ C240] x25: ffff1062bbac5c40 x24: 0000000000001000 +[ 214.605277][ C240] x23: 000000000000000a x22: 0000000000000001 +[ 214.611270][ C240] x21: 0000000000001000 x20: 0000000000000000 +[ 214.617262][ C240] x19: ffff3062a41ae580 x18: 0000000000010000 +[ 214.623255][ C240] x17: 0000000000000001 x16: ffffdb3a6efe5fc0 +[ 214.629248][ C240] x15: ffffffffffffffff x14: 0000000003ffffff +[ 214.635241][ C240] x13: 000000000000ffff x12: 000000000000029c +[ 214.641234][ C240] x11: 0000000000000006 x10: ffff80003a9f7fd0 +[ 214.647226][ C240] x9 : ffffdb3a6f0482fc x8 : 0000000000000001 +[ 214.653219][ C240] x7 : 0000000000000002 x6 : 0000000000000080 +[ 214.659212][ C240] x5 : ffff55480ee9b000 x4 : fffffde7f94c6554 +[ 214.665205][ C240] x3 : 0000000000000002 x2 : 0000000000000020 +[ 214.671198][ C240] x1 : 0000000000000021 x0 : ffff3062a41ae5b8 +[ 214.677191][ C240] Call trace: +[ 214.680320][ C240] fput_many+0x8c/0xdc +[ 214.684230][ C240] fput+0x1c/0xf0 +[ 214.687707][ C240] aio_complete_rw+0xd8/0x1fc +[ 214.692225][ C240] blkdev_bio_end_io+0x98/0x140 +[ 214.696917][ C240] bio_endio+0x160/0x1bc +[ 214.701001][ C240] blk_update_request+0x1c8/0x3bc +[ 214.705867][ C240] scsi_end_request+0x3c/0x1f0 +[ 214.710471][ C240] scsi_io_completion+0x7c/0x1a0 +[ 214.715249][ C240] scsi_finish_command+0x104/0x140 +[ 214.720200][ C240] scsi_softirq_done+0x90/0x180 +[ 214.724892][ C240] blk_mq_complete_request+0x5c/0x70 +[ 214.730016][ C240] scsi_mq_done+0x48/0xac +[ 214.734194][ C240] sas_scsi_task_done+0xbc/0x16c [libsas] +[ 214.739758][ C240] slot_complete_v3_hw+0x260/0x760 [hisi_sas_v3_hw] +[ 214.746185][ C240] cq_thread_v3_hw+0xbc/0x190 [hisi_sas_v3_hw] +[ 214.752179][ C240] irq_thread_fn+0x34/0xa4 +[ 214.756435][ C240] irq_thread+0xc4/0x130 +[ 214.760520][ C240] kthread+0x108/0x13c +[ 214.764430][ C240] ret_from_fork+0x10/0x18 + +This is because in the hisi_sas driver, both the hardware interrupt +handler and the interrupt thread are executed on the same CPU. In the +performance test scenario, function irq_wait_for_interrupt() will always +return 0 if lots of interrupts occurs and the CPU will be continuously +consumed. As a result, the CPU cannot run the watchdog thread. When the +watchdog time exceeds the specified time, call trace occurs. + +To fix it, add cond_resched() to execute the watchdog thread. + +Signed-off-by: Yihang Li +Link: https://lore.kernel.org/r/20241008021822.2617339-8-liyihang9@huawei.com +Reviewed-by: Xiang Chen +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 7ae56a2fe2325..05dcd925a3fab 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -2410,6 +2410,7 @@ static irqreturn_t cq_thread_v3_hw(int irq_no, void *p) + /* update rd_point */ + cq->rd_point = rd_point; + hisi_sas_write32(hisi_hba, COMPL_Q_0_RD_PTR + (0x14 * queue), rd_point); ++ cond_resched(); + + return IRQ_HANDLED; + } +-- +2.43.0 + diff --git a/queue-6.1/scsi-st-add-mtiocget-and-mtload-to-ioctls-allowed-af.patch b/queue-6.1/scsi-st-add-mtiocget-and-mtload-to-ioctls-allowed-af.patch new file mode 100644 index 00000000000..89ccbda00bb --- /dev/null +++ b/queue-6.1/scsi-st-add-mtiocget-and-mtload-to-ioctls-allowed-af.patch @@ -0,0 +1,90 @@ +From 5ca49a7a8e56285577666fb999716d0581582cbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 11:57:22 +0200 +Subject: scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device + reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai Mäkisara + +[ Upstream commit 0b120edb37dc9dd8ca82893d386922eb6b16f860 ] + +Most drives rewind the tape when the device is reset. Reading and writing +are not allowed until something is done to make the tape position match the +user's expectation (e.g., rewind the tape). Add MTIOCGET and MTLOAD to +operations allowed after reset. MTIOCGET is modified to not touch the tape +if pos_unknown is non-zero. The tape location is known after MTLOAD. + +Signed-off-by: Kai Mäkisara +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219419#c14 +Link: https://lore.kernel.org/r/20241106095723.63254-3-Kai.Makisara@kolumbus.fi +Reviewed-by: John Meneghini +Tested-by: John Meneghini +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/st.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c +index b91da7b51814a..b3caa3b9722d1 100644 +--- a/drivers/scsi/st.c ++++ b/drivers/scsi/st.c +@@ -3504,6 +3504,7 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg) + int i, cmd_nr, cmd_type, bt; + int retval = 0; + unsigned int blk; ++ bool cmd_mtiocget; + struct scsi_tape *STp = file->private_data; + struct st_modedef *STm; + struct st_partstat *STps; +@@ -3617,6 +3618,7 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg) + */ + if (mtc.mt_op != MTREW && + mtc.mt_op != MTOFFL && ++ mtc.mt_op != MTLOAD && + mtc.mt_op != MTRETEN && + mtc.mt_op != MTERASE && + mtc.mt_op != MTSEEK && +@@ -3730,17 +3732,28 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg) + goto out; + } + ++ cmd_mtiocget = cmd_type == _IOC_TYPE(MTIOCGET) && cmd_nr == _IOC_NR(MTIOCGET); ++ + if ((i = flush_buffer(STp, 0)) < 0) { +- retval = i; +- goto out; +- } +- if (STp->can_partitions && +- (i = switch_partition(STp)) < 0) { +- retval = i; +- goto out; ++ if (cmd_mtiocget && STp->pos_unknown) { ++ /* flush fails -> modify status accordingly */ ++ reset_state(STp); ++ STp->pos_unknown = 1; ++ } else { /* return error */ ++ retval = i; ++ goto out; ++ } ++ } else { /* flush_buffer succeeds */ ++ if (STp->can_partitions) { ++ i = switch_partition(STp); ++ if (i < 0) { ++ retval = i; ++ goto out; ++ } ++ } + } + +- if (cmd_type == _IOC_TYPE(MTIOCGET) && cmd_nr == _IOC_NR(MTIOCGET)) { ++ if (cmd_mtiocget) { + struct mtget mt_status; + + if (_IOC_SIZE(cmd_in) != sizeof(struct mtget)) { +-- +2.43.0 + diff --git a/queue-6.1/scsi-st-don-t-modify-unknown-block-number-in-mtiocge.patch b/queue-6.1/scsi-st-don-t-modify-unknown-block-number-in-mtiocge.patch new file mode 100644 index 00000000000..0b33524e81f --- /dev/null +++ b/queue-6.1/scsi-st-don-t-modify-unknown-block-number-in-mtiocge.patch @@ -0,0 +1,42 @@ +From 4d93d8b6143a2905f0f612d673ad20f6f9e2b646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 11:57:21 +0200 +Subject: scsi: st: Don't modify unknown block number in MTIOCGET +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai Mäkisara + +[ Upstream commit 5bb2d6179d1a8039236237e1e94cfbda3be1ed9e ] + +Struct mtget field mt_blkno -1 means it is unknown. Don't add anything to +it. + +Signed-off-by: Kai Mäkisara +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219419#c14 +Link: https://lore.kernel.org/r/20241106095723.63254-2-Kai.Makisara@kolumbus.fi +Reviewed-by: John Meneghini +Tested-by: John Meneghini +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/st.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c +index b90a440e135dc..b91da7b51814a 100644 +--- a/drivers/scsi/st.c ++++ b/drivers/scsi/st.c +@@ -3754,7 +3754,7 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg) + ((STp->density << MT_ST_DENSITY_SHIFT) & MT_ST_DENSITY_MASK); + mt_status.mt_blkno = STps->drv_block; + mt_status.mt_fileno = STps->drv_file; +- if (STp->block_size != 0) { ++ if (STp->block_size != 0 && mt_status.mt_blkno >= 0) { + if (STps->rw == ST_WRITING) + mt_status.mt_blkno += + (STp->buffer)->buffer_bytes / STp->block_size; +-- +2.43.0 + diff --git a/queue-6.1/scsi-ufs-core-make-dma-mask-configuration-more-flexi.patch b/queue-6.1/scsi-ufs-core-make-dma-mask-configuration-more-flexi.patch new file mode 100644 index 00000000000..3d838eab434 --- /dev/null +++ b/queue-6.1/scsi-ufs-core-make-dma-mask-configuration-more-flexi.patch @@ -0,0 +1,119 @@ +From 30a5ddf3f569ed0eed965cfd1646de65bb2f3710 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2024 12:47:39 -0700 +Subject: scsi: ufs: core: Make DMA mask configuration more flexible + +From: Bart Van Assche + +[ Upstream commit 78bc671bd1501e2f6c571e063301a4fdc5db53b2 ] + +Replace UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS with +ufs_hba_variant_ops::set_dma_mask. Update the Renesas driver +accordingly. This patch enables supporting other configurations than +32-bit or 64-bit DMA addresses, e.g. 36-bit DMA addresses. + +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20241018194753.775074-1-bvanassche@acm.org +Reviewed-by: Avri Altman +Reviewed-by: Peter Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 4 ++-- + drivers/ufs/host/ufs-renesas.c | 9 ++++++++- + include/ufs/ufshcd.h | 9 +++------ + 3 files changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index c4a308963faa9..1ea7ae78fca2c 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -2230,8 +2230,6 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba) + int err; + + hba->capabilities = ufshcd_readl(hba, REG_CONTROLLER_CAPABILITIES); +- if (hba->quirks & UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS) +- hba->capabilities &= ~MASK_64_ADDRESSING_SUPPORT; + + /* nutrs and nutmrs are 0 based values */ + hba->nutrs = (hba->capabilities & MASK_TRANSFER_REQUESTS_SLOTS) + 1; +@@ -9649,6 +9647,8 @@ EXPORT_SYMBOL_GPL(ufshcd_dealloc_host); + */ + static int ufshcd_set_dma_mask(struct ufs_hba *hba) + { ++ if (hba->vops && hba->vops->set_dma_mask) ++ return hba->vops->set_dma_mask(hba); + if (hba->capabilities & MASK_64_ADDRESSING_SUPPORT) { + if (!dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(64))) + return 0; +diff --git a/drivers/ufs/host/ufs-renesas.c b/drivers/ufs/host/ufs-renesas.c +index ab0652d8705ac..481ad0a3a6c7c 100644 +--- a/drivers/ufs/host/ufs-renesas.c ++++ b/drivers/ufs/host/ufs-renesas.c +@@ -7,6 +7,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -364,14 +365,20 @@ static int ufs_renesas_init(struct ufs_hba *hba) + return -ENOMEM; + ufshcd_set_variant(hba, priv); + +- hba->quirks |= UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS | UFSHCD_QUIRK_HIBERN_FASTAUTO; ++ hba->quirks |= UFSHCD_QUIRK_HIBERN_FASTAUTO; + + return 0; + } + ++static int ufs_renesas_set_dma_mask(struct ufs_hba *hba) ++{ ++ return dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(32)); ++} ++ + static const struct ufs_hba_variant_ops ufs_renesas_vops = { + .name = "renesas", + .init = ufs_renesas_init, ++ .set_dma_mask = ufs_renesas_set_dma_mask, + .setup_clocks = ufs_renesas_setup_clocks, + .hce_enable_notify = ufs_renesas_hce_enable_notify, + .dbg_register_dump = ufs_renesas_dbg_register_dump, +diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h +index 32591d29881dd..0a56374064856 100644 +--- a/include/ufs/ufshcd.h ++++ b/include/ufs/ufshcd.h +@@ -272,6 +272,8 @@ struct ufs_pwr_mode_info { + * @name: variant name + * @init: called when the driver is initialized + * @exit: called to cleanup everything done in init ++ * @set_dma_mask: For setting another DMA mask than indicated by the 64AS ++ * capability bit. + * @get_ufs_hci_version: called to get UFS HCI version + * @clk_scale_notify: notifies that clks are scaled up/down + * @setup_clocks: called before touching any of the controller registers +@@ -305,6 +307,7 @@ struct ufs_hba_variant_ops { + int (*init)(struct ufs_hba *); + void (*exit)(struct ufs_hba *); + u32 (*get_ufs_hci_version)(struct ufs_hba *); ++ int (*set_dma_mask)(struct ufs_hba *); + int (*clk_scale_notify)(struct ufs_hba *, bool, + enum ufs_notify_change_status); + int (*setup_clocks)(struct ufs_hba *, bool, +@@ -584,12 +587,6 @@ enum ufshcd_quirks { + */ + UFSHCD_QUIRK_SKIP_PH_CONFIGURATION = 1 << 16, + +- /* +- * This quirk needs to be enabled if the host controller has +- * 64-bit addressing supported capability but it doesn't work. +- */ +- UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS = 1 << 17, +- + /* + * This quirk needs to be enabled if the host controller has + * auto-hibernate capability but it's FASTAUTO only. +-- +2.43.0 + diff --git a/queue-6.1/serial-8250_dw-add-sophgo-sg2044-quirk.patch b/queue-6.1/serial-8250_dw-add-sophgo-sg2044-quirk.patch new file mode 100644 index 00000000000..e9f88b979ea --- /dev/null +++ b/queue-6.1/serial-8250_dw-add-sophgo-sg2044-quirk.patch @@ -0,0 +1,53 @@ +From 240e1f0b4b62dbb4b507e7cdb9c7e27703816e31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2024 14:21:03 +0800 +Subject: serial: 8250_dw: Add Sophgo SG2044 quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Inochi Amaoto + +[ Upstream commit cad4dda82c7eedcfc22597267e710ccbcf39d572 ] + +SG2044 relys on an internal divisor when calculating bitrate, which +means a wrong clock for the most common bitrates. So add a quirk for +this uart device to skip the set rate call and only relys on the +internal UART divisor. + +Reviewed-by: Andy Shevchenko +Reviewed-by: Ilpo Järvinen +Signed-off-by: Inochi Amaoto +Link: https://lore.kernel.org/r/20241024062105.782330-4-inochiama@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_dw.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index a1f2259cc9a98..72f9aab75ab12 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -770,7 +770,7 @@ static const struct dw8250_platform_data dw8250_renesas_rzn1_data = { + .quirks = DW_UART_QUIRK_IS_DMA_FC, + }; + +-static const struct dw8250_platform_data dw8250_starfive_jh7100_data = { ++static const struct dw8250_platform_data dw8250_skip_set_rate_data = { + .usr_reg = DW_UART_USR, + .quirks = DW_UART_QUIRK_SKIP_SET_RATE, + }; +@@ -780,7 +780,8 @@ static const struct of_device_id dw8250_of_match[] = { + { .compatible = "cavium,octeon-3860-uart", .data = &dw8250_octeon_3860_data }, + { .compatible = "marvell,armada-38x-uart", .data = &dw8250_armada_38x_data }, + { .compatible = "renesas,rzn1-uart", .data = &dw8250_renesas_rzn1_data }, +- { .compatible = "starfive,jh7100-uart", .data = &dw8250_starfive_jh7100_data }, ++ { .compatible = "sophgo,sg2044-uart", .data = &dw8250_skip_set_rate_data }, ++ { .compatible = "starfive,jh7100-uart", .data = &dw8250_skip_set_rate_data }, + { /* Sentinel */ } + }; + MODULE_DEVICE_TABLE(of, dw8250_of_match); +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 4080378a6b6..e16459129c4 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -652,3 +652,93 @@ mmc-core-further-prevent-card-detect-during-shutdown.patch ocfs2-update-seq_file-index-in-ocfs2_dlm_seq_next.patch lib-stackinit-hide-never-taken-branch-from-compiler.patch iommu-arm-smmu-defer-probe-of-clients-after-smmu-device-bound.patch +epoll-annotate-racy-check.patch +s390-cpum_sf-handle-cpu-hotplug-remove-during-sampli.patch +btrfs-avoid-unnecessary-device-path-update-for-the-s.patch +btrfs-do-not-clear-read-only-when-adding-sprout-devi.patch +kselftest-arm64-don-t-leak-pipe-fds-in-pac.exec_sign.patch +kcsan-turn-report_filterlist_lock-into-a-raw_spinloc.patch +perf-x86-amd-warn-only-on-new-bits-set.patch +timekeeping-always-check-for-negative-motion.patch +media-uvcvideo-add-a-quirk-for-the-kaiweets-kti-w02-.patch +media-cx231xx-add-support-for-dexatek-usb-video-grab.patch +mmc-core-add-sd-card-quirk-for-broken-poweroff-notif.patch +soc-imx8m-probe-the-soc-driver-as-platform-driver.patch +hid-bpf-fix-nkro-on-mistel-md770.patch +hid-magicmouse-apple-magic-trackpad-2-usb-c-driver-s.patch +drm-vc4-hdmi-avoid-log-spam-for-audio-start-failure.patch +drm-vc4-hvs-set-axi-panic-modes-for-the-hvs.patch +drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch +drm-panel-orientation-quirks-add-quirk-for-aya-neo-f.patch +drm-panel-orientation-quirks-add-quirk-for-aya-neo-g.patch +drm-bridge-it6505-enable-module-autoloading.patch +drm-mcde-enable-module-autoloading.patch +drm-radeon-r600_cs-fix-possible-int-overflow-in-r600.patch +drm-display-fix-building-with-gcc-15.patch +r8169-don-t-apply-udp-padding-quirk-on-rtl8126a.patch +samples-bpf-fix-a-resource-leak.patch +net-fec_mpc52xx_phy-use-pa-to-format-resource_size_t.patch +net-ethernet-fs_enet-use-pa-to-format-resource_size_.patch +net-sched-cbs-fix-integer-overflow-in-cbs_set_port_r.patch +af_packet-avoid-erroring-out-after-sock_init_data-in.patch +bluetooth-l2cap-do-not-leave-dangling-sk-pointer-on-.patch +bluetooth-rfcomm-avoid-leaving-dangling-sk-pointer-i.patch +net-af_can-do-not-leave-a-dangling-sk-pointer-in-can.patch +net-ieee802154-do-not-leave-a-dangling-sk-pointer-in.patch +net-inet-do-not-leave-a-dangling-sk-pointer-in-inet_.patch +net-inet6-do-not-leave-a-dangling-sk-pointer-in-inet.patch +wifi-ath5k-add-pci-id-for-sx76x.patch +wifi-ath5k-add-pci-id-for-arcadyan-devices.patch +drm-panel-simple-add-microchip-ac69t88a-lvds-display.patch +net-sfp-change-quirks-for-alcatel-lucent-g-010s-p.patch +drm-sched-memset-job-in-drm_sched_job_init.patch +drm-amdgpu-clear-rb_overflow-bit-when-enabling-inter.patch +drm-amdgpu-dereference-the-atcs-acpi-buffer.patch +drm-amdgpu-refine-error-handling-in-amdgpu_ttm_tt_pi.patch +dma-debug-fix-a-possible-deadlock-on-radix_lock.patch +jfs-array-index-out-of-bounds-fix-in-dtreadfirst.patch +jfs-fix-shift-out-of-bounds-in-dbsplit.patch +jfs-fix-array-index-out-of-bounds-in-jfs_readdir.patch +jfs-add-a-check-to-prevent-array-index-out-of-bounds.patch +drm-amdgpu-skip-amdgpu_device_cache_pci_state-under-.patch +alsa-usb-audio-make-mic-volume-workarounds-globally-.patch +drm-amdgpu-set-the-right-amdgpu-sg-segment-limitatio.patch +wifi-ipw2x00-libipw_rx_any-fix-bad-alignment.patch +wifi-brcmfmac-fix-oops-due-to-null-pointer-dereferen.patch +dsa-qca8k-use-nested-lock-to-avoid-splat.patch +bluetooth-btusb-add-rtl8852be-device-0489-e123-to-de.patch +bluetooth-hci_core-fix-not-checking-skb-length-on-hc.patch +asoc-hdmi-codec-reorder-channel-allocation-list.patch +rocker-fix-link-status-detection-in-rocker_carrier_i.patch +net-neighbor-clear-error-in-case-strict-check-is-not.patch +netpoll-use-rcu_access_pointer-in-__netpoll_setup.patch +pinctrl-freescale-fix-compile_test-error-with-pinctr.patch +tracing-ftrace-disable-preemption-in-syscall-probe.patch +tracing-use-atomic64_inc_return-in-trace_clock_count.patch +tools-rtla-fix-collision-with-glibc-sched_attr-sched.patch +scsi-hisi_sas-add-cond_resched-for-no-forced-preempt.patch +scsi-ufs-core-make-dma-mask-configuration-more-flexi.patch +leds-class-protect-brightness_show-with-led_cdev-led.patch +scsi-st-don-t-modify-unknown-block-number-in-mtiocge.patch +scsi-st-add-mtiocget-and-mtload-to-ioctls-allowed-af.patch +pinctrl-qcom-pmic-gpio-add-support-for-pm8937.patch +pinctrl-qcom-spmi-mpp-add-pm8937-compatible.patch +nvdimm-rectify-the-illogical-code-within-nd_dax_prob.patch +smb-client-memcpy-with-surrounding-object-base-addre.patch +verification-dot2-improve-dot-parser-robustness.patch +f2fs-fix-f2fs_bug_on-when-uninstalling-filesystem-ca.patch +i3c-mipi-i3c-hci-mask-ring-interrupts-before-ring-st.patch +pci-detect-and-trust-built-in-thunderbolt-chips.patch +pci-add-reset_subordinate-to-reset-hierarchy-below-b.patch +pci-add-acs-quirk-for-wangxun-ff5xxx-nics.patch +i3c-use-i3cdev-desc-info-instead-of-calling-i3c_devi.patch +loongarch-fix-sleeping-in-atomic-context-for-preempt.patch +usb-chipidea-udc-handle-usb-error-interrupt-if-ioc-n.patch +iio-light-ltr501-add-lter0303-to-the-supported-devic.patch +mips-loongson64-dts-really-fix-pcie-port-nodes-for-l.patch +asoc-amd-yc-add-quirk-for-microphone-on-lenovo-think.patch +powerpc-prom_init-fixup-missing-powermac-size-cells.patch +misc-eeprom-eeprom_93cx6-add-quirk-for-extra-read-cl.patch +rtc-cmos-avoid-taking-rtc_lock-for-extended-period-o.patch +serial-8250_dw-add-sophgo-sg2044-quirk.patch +io_uring-tctx-work-around-xa_store-allocation-error-.patch diff --git a/queue-6.1/smb-client-memcpy-with-surrounding-object-base-addre.patch b/queue-6.1/smb-client-memcpy-with-surrounding-object-base-addre.patch new file mode 100644 index 00000000000..3c86902c386 --- /dev/null +++ b/queue-6.1/smb-client-memcpy-with-surrounding-object-base-addre.patch @@ -0,0 +1,44 @@ +From 5f3523d73b0d09b686c88bfa946cf0ecf5f2ab23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Nov 2024 03:32:09 -0800 +Subject: smb: client: memcpy() with surrounding object base address + +From: Kees Cook + +[ Upstream commit f69b0187f8745a7a9584f6b13f5e792594b88b2e ] + +Like commit f1f047bd7ce0 ("smb: client: Fix -Wstringop-overflow issues"), +adjust the memcpy() destination address to be based off the surrounding +object rather than based off the 4-byte "Protocol" member. This avoids a +build-time warning when compiling under CONFIG_FORTIFY_SOURCE with GCC 15: + +In function 'fortify_memcpy_chk', + inlined from 'CIFSSMBSetPathInfo' at ../fs/smb/client/cifssmb.c:5358:2: +../include/linux/fortify-string.h:571:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] + 571 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Kees Cook +Reviewed-by: Gustavo A. R. Silva +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifssmb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c +index 67c5fc2b2db94..6077fe1dcc9ce 100644 +--- a/fs/smb/client/cifssmb.c ++++ b/fs/smb/client/cifssmb.c +@@ -5349,7 +5349,7 @@ CIFSSMBSetPathInfo(const unsigned int xid, struct cifs_tcon *tcon, + param_offset = offsetof(struct smb_com_transaction2_spi_req, + InformationLevel) - 4; + offset = param_offset + params; +- data_offset = (char *) (&pSMB->hdr.Protocol) + offset; ++ data_offset = (char *)pSMB + offsetof(typeof(*pSMB), hdr.Protocol) + offset; + pSMB->ParameterOffset = cpu_to_le16(param_offset); + pSMB->DataOffset = cpu_to_le16(offset); + pSMB->SetupCount = 1; +-- +2.43.0 + diff --git a/queue-6.1/soc-imx8m-probe-the-soc-driver-as-platform-driver.patch b/queue-6.1/soc-imx8m-probe-the-soc-driver-as-platform-driver.patch new file mode 100644 index 00000000000..3d73a387df5 --- /dev/null +++ b/queue-6.1/soc-imx8m-probe-the-soc-driver-as-platform-driver.patch @@ -0,0 +1,271 @@ +From 60d614ad8e84c41e51642597ac630578d490a47e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2024 20:49:16 +0200 +Subject: soc: imx8m: Probe the SoC driver as platform driver + +From: Marek Vasut + +[ Upstream commit 9cc832d37799dbea950c4c8a34721b02b8b5a8ff ] + +With driver_async_probe=* on kernel command line, the following trace is +produced because on i.MX8M Plus hardware because the soc-imx8m.c driver +calls of_clk_get_by_name() which returns -EPROBE_DEFER because the clock +driver is not yet probed. This was not detected during regular testing +without driver_async_probe. + +Convert the SoC code to platform driver and instantiate a platform device +in its current device_initcall() to probe the platform driver. Rework +.soc_revision callback to always return valid error code and return SoC +revision via parameter. This way, if anything in the .soc_revision callback +return -EPROBE_DEFER, it gets propagated to .probe and the .probe will get +retried later. + +" +------------[ cut here ]------------ +WARNING: CPU: 1 PID: 1 at drivers/soc/imx/soc-imx8m.c:115 imx8mm_soc_revision+0xdc/0x180 +CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-next-20240924-00002-g2062bb554dea #603 +Hardware name: DH electronics i.MX8M Plus DHCOM Premium Developer Kit (3) (DT) +pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : imx8mm_soc_revision+0xdc/0x180 +lr : imx8mm_soc_revision+0xd0/0x180 +sp : ffff8000821fbcc0 +x29: ffff8000821fbce0 x28: 0000000000000000 x27: ffff800081810120 +x26: ffff8000818a9970 x25: 0000000000000006 x24: 0000000000824311 +x23: ffff8000817f42c8 x22: ffff0000df8be210 x21: fffffffffffffdfb +x20: ffff800082780000 x19: 0000000000000001 x18: ffffffffffffffff +x17: ffff800081fff418 x16: ffff8000823e1000 x15: ffff0000c03b65e8 +x14: ffff0000c00051b0 x13: ffff800082790000 x12: 0000000000000801 +x11: ffff80008278ffff x10: ffff80008209d3a6 x9 : ffff80008062e95c +x8 : ffff8000821fb9a0 x7 : 0000000000000000 x6 : 00000000000080e3 +x5 : ffff0000df8c03d8 x4 : 0000000000000000 x3 : 0000000000000000 +x2 : 0000000000000000 x1 : fffffffffffffdfb x0 : fffffffffffffdfb +Call trace: + imx8mm_soc_revision+0xdc/0x180 + imx8_soc_init+0xb0/0x1e0 + do_one_initcall+0x94/0x1a8 + kernel_init_freeable+0x240/0x2a8 + kernel_init+0x28/0x140 + ret_from_fork+0x10/0x20 +---[ end trace 0000000000000000 ]--- +SoC: i.MX8MP revision 1.1 +" + +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 107 ++++++++++++++++++++++++++++-------- + 1 file changed, 85 insertions(+), 22 deletions(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index 08197b03955dd..a160854a19178 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -30,7 +30,7 @@ + + struct imx8_soc_data { + char *name; +- u32 (*soc_revision)(void); ++ int (*soc_revision)(u32 *socrev); + }; + + static u64 soc_uid; +@@ -51,24 +51,29 @@ static u32 imx8mq_soc_revision_from_atf(void) + static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; }; + #endif + +-static u32 __init imx8mq_soc_revision(void) ++static int imx8mq_soc_revision(u32 *socrev) + { + struct device_node *np; + void __iomem *ocotp_base; + u32 magic; + u32 rev; + struct clk *clk; ++ int ret; + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); + if (!np) +- return 0; ++ return -EINVAL; + + ocotp_base = of_iomap(np, 0); +- WARN_ON(!ocotp_base); ++ if (!ocotp_base) { ++ ret = -EINVAL; ++ goto err_iomap; ++ } ++ + clk = of_clk_get_by_name(np, NULL); + if (IS_ERR(clk)) { +- WARN_ON(IS_ERR(clk)); +- return 0; ++ ret = PTR_ERR(clk); ++ goto err_clk; + } + + clk_prepare_enable(clk); +@@ -88,32 +93,45 @@ static u32 __init imx8mq_soc_revision(void) + soc_uid <<= 32; + soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); + ++ *socrev = rev; ++ + clk_disable_unprepare(clk); + clk_put(clk); + iounmap(ocotp_base); + of_node_put(np); + +- return rev; ++ return 0; ++ ++err_clk: ++ iounmap(ocotp_base); ++err_iomap: ++ of_node_put(np); ++ return ret; + } + +-static void __init imx8mm_soc_uid(void) ++static int imx8mm_soc_uid(void) + { + void __iomem *ocotp_base; + struct device_node *np; + struct clk *clk; ++ int ret = 0; + u32 offset = of_machine_is_compatible("fsl,imx8mp") ? + IMX8MP_OCOTP_UID_OFFSET : 0; + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp"); + if (!np) +- return; ++ return -EINVAL; + + ocotp_base = of_iomap(np, 0); +- WARN_ON(!ocotp_base); ++ if (!ocotp_base) { ++ ret = -EINVAL; ++ goto err_iomap; ++ } ++ + clk = of_clk_get_by_name(np, NULL); + if (IS_ERR(clk)) { +- WARN_ON(IS_ERR(clk)); +- return; ++ ret = PTR_ERR(clk); ++ goto err_clk; + } + + clk_prepare_enable(clk); +@@ -124,31 +142,41 @@ static void __init imx8mm_soc_uid(void) + + clk_disable_unprepare(clk); + clk_put(clk); ++ ++err_clk: + iounmap(ocotp_base); ++err_iomap: + of_node_put(np); ++ ++ return ret; + } + +-static u32 __init imx8mm_soc_revision(void) ++static int imx8mm_soc_revision(u32 *socrev) + { + struct device_node *np; + void __iomem *anatop_base; +- u32 rev; ++ int ret; + + np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop"); + if (!np) +- return 0; ++ return -EINVAL; + + anatop_base = of_iomap(np, 0); +- WARN_ON(!anatop_base); ++ if (!anatop_base) { ++ ret = -EINVAL; ++ goto err_iomap; ++ } + +- rev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM); ++ *socrev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM); + + iounmap(anatop_base); + of_node_put(np); + +- imx8mm_soc_uid(); ++ return imx8mm_soc_uid(); + +- return rev; ++err_iomap: ++ of_node_put(np); ++ return ret; + } + + static const struct imx8_soc_data imx8mq_soc_data = { +@@ -184,7 +212,7 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { + kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf, soc_rev & 0xf) : \ + "unknown" + +-static int __init imx8_soc_init(void) ++static int imx8m_soc_probe(struct platform_device *pdev) + { + struct soc_device_attribute *soc_dev_attr; + struct soc_device *soc_dev; +@@ -212,8 +240,11 @@ static int __init imx8_soc_init(void) + data = id->data; + if (data) { + soc_dev_attr->soc_id = data->name; +- if (data->soc_revision) +- soc_rev = data->soc_revision(); ++ if (data->soc_revision) { ++ ret = data->soc_revision(&soc_rev); ++ if (ret) ++ goto free_soc; ++ } + } + + soc_dev_attr->revision = imx8_revision(soc_rev); +@@ -251,4 +282,36 @@ static int __init imx8_soc_init(void) + kfree(soc_dev_attr); + return ret; + } ++ ++static struct platform_driver imx8m_soc_driver = { ++ .probe = imx8m_soc_probe, ++ .driver = { ++ .name = "imx8m-soc", ++ }, ++}; ++ ++static int __init imx8_soc_init(void) ++{ ++ struct platform_device *pdev; ++ int ret; ++ ++ /* No match means this is non-i.MX8M hardware, do nothing. */ ++ if (!of_match_node(imx8_soc_match, of_root)) ++ return 0; ++ ++ ret = platform_driver_register(&imx8m_soc_driver); ++ if (ret) { ++ pr_err("Failed to register imx8m-soc platform driver: %d\n", ret); ++ return ret; ++ } ++ ++ pdev = platform_device_register_simple("imx8m-soc", -1, NULL, 0); ++ if (IS_ERR(pdev)) { ++ pr_err("Failed to register imx8m-soc platform device: %ld\n", PTR_ERR(pdev)); ++ platform_driver_unregister(&imx8m_soc_driver); ++ return PTR_ERR(pdev); ++ } ++ ++ return 0; ++} + device_initcall(imx8_soc_init); +-- +2.43.0 + diff --git a/queue-6.1/timekeeping-always-check-for-negative-motion.patch b/queue-6.1/timekeeping-always-check-for-negative-motion.patch new file mode 100644 index 00000000000..c702ab70ca4 --- /dev/null +++ b/queue-6.1/timekeeping-always-check-for-negative-motion.patch @@ -0,0 +1,88 @@ +From 676cf17c4fdd5031d8122492e663ad1f5b057285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 13:04:08 +0100 +Subject: timekeeping: Always check for negative motion + +From: Thomas Gleixner + +[ Upstream commit c163e40af9b2331b2c629fd4ec8b703ed4d4ae39 ] + +clocksource_delta() has two variants. One with a check for negative motion, +which is only selected by x86. This is a historic leftover as this function +was previously used in the time getter hot paths. + +Since 135225a363ae timekeeping_cycles_to_ns() has unconditional protection +against this as a by-product of the protection against 64bit math overflow. + +clocksource_delta() is only used in the clocksource watchdog and in +timekeeping_advance(). The extra conditional there is not hurting anyone. + +Remove the config option and unconditionally prevent negative motion of the +readout. + +Signed-off-by: Thomas Gleixner +Acked-by: John Stultz +Link: https://lore.kernel.org/all/20241031120328.599430157@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig | 1 - + kernel/time/Kconfig | 5 ----- + kernel/time/timekeeping_internal.h | 7 ------- + 3 files changed, 13 deletions(-) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 49cea5b81649d..c75e18346c89b 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -131,7 +131,6 @@ config X86 + select ARCH_HAS_PARANOID_L1D_FLUSH + select BUILDTIME_TABLE_SORT + select CLKEVT_I8253 +- select CLOCKSOURCE_VALIDATE_LAST_CYCLE + select CLOCKSOURCE_WATCHDOG + # Word-size accesses may read uninitialized data past the trailing \0 + # in strings and cause false KMSAN reports. +diff --git a/kernel/time/Kconfig b/kernel/time/Kconfig +index a41753be1a2bf..6ce5b66643f0b 100644 +--- a/kernel/time/Kconfig ++++ b/kernel/time/Kconfig +@@ -17,11 +17,6 @@ config ARCH_CLOCKSOURCE_DATA + config ARCH_CLOCKSOURCE_INIT + bool + +-# Clocksources require validation of the clocksource against the last +-# cycle update - x86/TSC misfeature +-config CLOCKSOURCE_VALIDATE_LAST_CYCLE +- bool +- + # Timekeeping vsyscall support + config GENERIC_TIME_VSYSCALL + bool +diff --git a/kernel/time/timekeeping_internal.h b/kernel/time/timekeeping_internal.h +index 4ca2787d1642e..1d4854d5c386e 100644 +--- a/kernel/time/timekeeping_internal.h ++++ b/kernel/time/timekeeping_internal.h +@@ -15,7 +15,6 @@ extern void tk_debug_account_sleep_time(const struct timespec64 *t); + #define tk_debug_account_sleep_time(x) + #endif + +-#ifdef CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE + static inline u64 clocksource_delta(u64 now, u64 last, u64 mask) + { + u64 ret = (now - last) & mask; +@@ -26,12 +25,6 @@ static inline u64 clocksource_delta(u64 now, u64 last, u64 mask) + */ + return ret & ~(mask >> 1) ? 0 : ret; + } +-#else +-static inline u64 clocksource_delta(u64 now, u64 last, u64 mask) +-{ +- return (now - last) & mask; +-} +-#endif + + /* Semi public for serialization of non timekeeper VDSO updates. */ + extern raw_spinlock_t timekeeper_lock; +-- +2.43.0 + diff --git a/queue-6.1/tools-rtla-fix-collision-with-glibc-sched_attr-sched.patch b/queue-6.1/tools-rtla-fix-collision-with-glibc-sched_attr-sched.patch new file mode 100644 index 00000000000..1370a31a0f4 --- /dev/null +++ b/queue-6.1/tools-rtla-fix-collision-with-glibc-sched_attr-sched.patch @@ -0,0 +1,86 @@ +From aaed64f9a7b9fa2d3f2d0226f9322caa1b127907 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2024 17:09:48 +0200 +Subject: tools/rtla: fix collision with glibc sched_attr/sched_set_attr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jan Stancek + +[ Upstream commit 0eecee340672c4b512f6f4a8c6add26df05d130c ] + +glibc commit 21571ca0d703 ("Linux: Add the sched_setattr +and sched_getattr functions") now also provides 'struct sched_attr' +and sched_setattr() which collide with the ones from rtla. + + In file included from src/trace.c:11: + src/utils.h:49:8: error: redefinition of ‘struct sched_attr’ + 49 | struct sched_attr { + | ^~~~~~~~~~ + In file included from /usr/include/bits/sched.h:60, + from /usr/include/sched.h:43, + from /usr/include/tracefs/tracefs.h:10, + from src/trace.c:4: + /usr/include/linux/sched/types.h:98:8: note: originally defined here + 98 | struct sched_attr { + | ^~~~~~~~~~ + +Define 'struct sched_attr' conditionally, similar to what strace did: + https://lore.kernel.org/all/20240930222913.3981407-1-raj.khem@gmail.com/ +and rename rtla's version of sched_setattr() to avoid collision. + +Link: https://lore.kernel.org/8088f66a7a57c1b209cd8ae0ae7c336a7f8c930d.1728572865.git.jstancek@redhat.com +Signed-off-by: Jan Stancek +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + tools/tracing/rtla/src/utils.c | 4 ++-- + tools/tracing/rtla/src/utils.h | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/tools/tracing/rtla/src/utils.c b/tools/tracing/rtla/src/utils.c +index 8c8d63c7196cf..02194773ef12d 100644 +--- a/tools/tracing/rtla/src/utils.c ++++ b/tools/tracing/rtla/src/utils.c +@@ -238,7 +238,7 @@ long parse_ns_duration(char *val) + + #define SCHED_DEADLINE 6 + +-static inline int sched_setattr(pid_t pid, const struct sched_attr *attr, ++static inline int syscall_sched_setattr(pid_t pid, const struct sched_attr *attr, + unsigned int flags) { + return syscall(__NR_sched_setattr, pid, attr, flags); + } +@@ -248,7 +248,7 @@ int __set_sched_attr(int pid, struct sched_attr *attr) + int flags = 0; + int retval; + +- retval = sched_setattr(pid, attr, flags); ++ retval = syscall_sched_setattr(pid, attr, flags); + if (retval < 0) { + err_msg("Failed to set sched attributes to the pid %d: %s\n", + pid, strerror(errno)); +diff --git a/tools/tracing/rtla/src/utils.h b/tools/tracing/rtla/src/utils.h +index 92da41aaf4c4c..e445ccf15e701 100644 +--- a/tools/tracing/rtla/src/utils.h ++++ b/tools/tracing/rtla/src/utils.h +@@ -44,6 +44,7 @@ update_sum(unsigned long long *a, unsigned long long *b) + *a += *b; + } + ++#ifndef SCHED_ATTR_SIZE_VER0 + struct sched_attr { + uint32_t size; + uint32_t sched_policy; +@@ -54,6 +55,7 @@ struct sched_attr { + uint64_t sched_deadline; + uint64_t sched_period; + }; ++#endif /* SCHED_ATTR_SIZE_VER0 */ + + int parse_prio(char *arg, struct sched_attr *sched_param); + int set_comm_sched_attr(const char *comm_prefix, struct sched_attr *attr); +-- +2.43.0 + diff --git a/queue-6.1/tracing-ftrace-disable-preemption-in-syscall-probe.patch b/queue-6.1/tracing-ftrace-disable-preemption-in-syscall-probe.patch new file mode 100644 index 00000000000..d25eb2ee8df --- /dev/null +++ b/queue-6.1/tracing-ftrace-disable-preemption-in-syscall-probe.patch @@ -0,0 +1,145 @@ +From 4556111a20bb7796acf7525b3c9c3de4282ee3da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 21:07:12 -0400 +Subject: tracing/ftrace: disable preemption in syscall probe + +From: Mathieu Desnoyers + +[ Upstream commit 13d750c2c03e9861e15268574ed2c239cca9c9d5 ] + +In preparation for allowing system call enter/exit instrumentation to +handle page faults, make sure that ftrace can handle this change by +explicitly disabling preemption within the ftrace system call tracepoint +probes to respect the current expectations within ftrace ring buffer +code. + +This change does not yet allow ftrace to take page faults per se within +its probe, but allows its existing probes to adapt to the upcoming +change. + +Cc: Michael Jeanson +Cc: Masami Hiramatsu +Cc: Peter Zijlstra +Cc: Alexei Starovoitov +Cc: Yonghong Song +Cc: Paul E. McKenney +Cc: Ingo Molnar +Cc: Arnaldo Carvalho de Melo +Cc: Mark Rutland +Cc: Alexander Shishkin +Cc: Namhyung Kim +Cc: Andrii Nakryiko +Cc: bpf@vger.kernel.org +Cc: Joel Fernandes +Link: https://lore.kernel.org/20241009010718.2050182-3-mathieu.desnoyers@efficios.com +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Mathieu Desnoyers +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + include/trace/trace_events.h | 36 +++++++++++++++++++++++++++++++---- + kernel/trace/trace_syscalls.c | 12 ++++++++++++ + 2 files changed, 44 insertions(+), 4 deletions(-) + +diff --git a/include/trace/trace_events.h b/include/trace/trace_events.h +index c2f9cabf154d1..fa0d51cad57a8 100644 +--- a/include/trace/trace_events.h ++++ b/include/trace/trace_events.h +@@ -244,6 +244,9 @@ static struct trace_event_fields trace_event_fields_##call[] = { \ + tstruct \ + {} }; + ++#undef DECLARE_EVENT_SYSCALL_CLASS ++#define DECLARE_EVENT_SYSCALL_CLASS DECLARE_EVENT_CLASS ++ + #undef DEFINE_EVENT_PRINT + #define DEFINE_EVENT_PRINT(template, name, proto, args, print) + +@@ -374,11 +377,11 @@ static inline notrace int trace_event_get_offsets_##call( \ + + #include "stages/stage6_event_callback.h" + +-#undef DECLARE_EVENT_CLASS +-#define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print) \ +- \ ++ ++#undef __DECLARE_EVENT_CLASS ++#define __DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print) \ + static notrace void \ +-trace_event_raw_event_##call(void *__data, proto) \ ++do_trace_event_raw_event_##call(void *__data, proto) \ + { \ + struct trace_event_file *trace_file = __data; \ + struct trace_event_data_offsets_##call __maybe_unused __data_offsets;\ +@@ -403,6 +406,29 @@ trace_event_raw_event_##call(void *__data, proto) \ + \ + trace_event_buffer_commit(&fbuffer); \ + } ++ ++#undef DECLARE_EVENT_CLASS ++#define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print) \ ++__DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \ ++ PARAMS(assign), PARAMS(print)) \ ++static notrace void \ ++trace_event_raw_event_##call(void *__data, proto) \ ++{ \ ++ do_trace_event_raw_event_##call(__data, args); \ ++} ++ ++#undef DECLARE_EVENT_SYSCALL_CLASS ++#define DECLARE_EVENT_SYSCALL_CLASS(call, proto, args, tstruct, assign, print) \ ++__DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \ ++ PARAMS(assign), PARAMS(print)) \ ++static notrace void \ ++trace_event_raw_event_##call(void *__data, proto) \ ++{ \ ++ preempt_disable_notrace(); \ ++ do_trace_event_raw_event_##call(__data, args); \ ++ preempt_enable_notrace(); \ ++} ++ + /* + * The ftrace_test_probe is compiled out, it is only here as a build time check + * to make sure that if the tracepoint handling changes, the ftrace probe will +@@ -418,6 +444,8 @@ static inline void ftrace_test_probe_##call(void) \ + + #include TRACE_INCLUDE(TRACE_INCLUDE_FILE) + ++#undef __DECLARE_EVENT_CLASS ++ + #include "stages/stage7_class_define.h" + + #undef DECLARE_EVENT_CLASS +diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c +index 942ddbdace4a4..e39c5ca76eabb 100644 +--- a/kernel/trace/trace_syscalls.c ++++ b/kernel/trace/trace_syscalls.c +@@ -299,6 +299,12 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id) + int syscall_nr; + int size; + ++ /* ++ * Syscall probe called with preemption enabled, but the ring ++ * buffer and per-cpu data require preemption to be disabled. ++ */ ++ guard(preempt_notrace)(); ++ + syscall_nr = trace_get_syscall_nr(current, regs); + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) + return; +@@ -338,6 +344,12 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret) + struct trace_event_buffer fbuffer; + int syscall_nr; + ++ /* ++ * Syscall probe called with preemption enabled, but the ring ++ * buffer and per-cpu data require preemption to be disabled. ++ */ ++ guard(preempt_notrace)(); ++ + syscall_nr = trace_get_syscall_nr(current, regs); + if (syscall_nr < 0 || syscall_nr >= NR_syscalls) + return; +-- +2.43.0 + diff --git a/queue-6.1/tracing-use-atomic64_inc_return-in-trace_clock_count.patch b/queue-6.1/tracing-use-atomic64_inc_return-in-trace_clock_count.patch new file mode 100644 index 00000000000..b03f070410a --- /dev/null +++ b/queue-6.1/tracing-use-atomic64_inc_return-in-trace_clock_count.patch @@ -0,0 +1,38 @@ +From 2a561e61199d26aff5718191a2fd548bf2b4aba9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 10:56:28 +0200 +Subject: tracing: Use atomic64_inc_return() in trace_clock_counter() + +From: Uros Bizjak + +[ Upstream commit eb887c4567d1b0e7684c026fe7df44afa96589e6 ] + +Use atomic64_inc_return(&ref) instead of atomic64_add_return(1, &ref) +to use optimized implementation and ease register pressure around +the primitive for targets that implement optimized variant. + +Cc: Steven Rostedt +Cc: Masami Hiramatsu +Cc: Mathieu Desnoyers +Link: https://lore.kernel.org/20241007085651.48544-1-ubizjak@gmail.com +Signed-off-by: Uros Bizjak +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_clock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c +index 4702efb00ff21..4cb2ebc439be6 100644 +--- a/kernel/trace/trace_clock.c ++++ b/kernel/trace/trace_clock.c +@@ -154,5 +154,5 @@ static atomic64_t trace_counter; + */ + u64 notrace trace_clock_counter(void) + { +- return atomic64_add_return(1, &trace_counter); ++ return atomic64_inc_return(&trace_counter); + } +-- +2.43.0 + diff --git a/queue-6.1/usb-chipidea-udc-handle-usb-error-interrupt-if-ioc-n.patch b/queue-6.1/usb-chipidea-udc-handle-usb-error-interrupt-if-ioc-n.patch new file mode 100644 index 00000000000..416044b159d --- /dev/null +++ b/queue-6.1/usb-chipidea-udc-handle-usb-error-interrupt-if-ioc-n.patch @@ -0,0 +1,44 @@ +From 99669767b257d2830d62953d77cef92761984e7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 10:29:04 +0800 +Subject: usb: chipidea: udc: handle USB Error Interrupt if IOC not set + +From: Xu Yang + +[ Upstream commit 548f48b66c0c5d4b9795a55f304b7298cde2a025 ] + +As per USBSTS register description about UEI: + + When completion of a USB transaction results in an error condition, this + bit is set by the Host/Device Controller. This bit is set along with the + USBINT bit, if the TD on which the error interrupt occurred also had its + interrupt on complete (IOC) bit set. + +UI is set only when IOC set. Add checking UEI to fix miss call +isr_tr_complete_handler() when IOC have not set and transfer error happen. + +Acked-by: Peter Chen +Signed-off-by: Xu Yang +Link: https://lore.kernel.org/r/20240926022906.473319-1-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 35dfc05854fb7..3795c70a31555 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -2052,7 +2052,7 @@ static irqreturn_t udc_irq(struct ci_hdrc *ci) + } + } + +- if (USBi_UI & intr) ++ if ((USBi_UI | USBi_UEI) & intr) + isr_tr_complete_handler(ci); + + if ((USBi_SLI & intr) && !(ci->suspended)) { +-- +2.43.0 + diff --git a/queue-6.1/verification-dot2-improve-dot-parser-robustness.patch b/queue-6.1/verification-dot2-improve-dot-parser-robustness.patch new file mode 100644 index 00000000000..8348b6d3bef --- /dev/null +++ b/queue-6.1/verification-dot2-improve-dot-parser-robustness.patch @@ -0,0 +1,99 @@ +From 7b98bdda0ba286bcfe0d97fd206fd203bc32d3b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 08:42:39 +0200 +Subject: verification/dot2: Improve dot parser robustness + +From: Gabriele Monaco + +[ Upstream commit 571f8b3f866a6d990a50fe5c89fe0ea78784d70b ] + +This patch makes the dot parser used by dot2c and dot2k slightly more +robust, namely: +* allows parsing files with the gv extension (GraphViz) +* correctly parses edges with any indentation + * used to work only with a single character (e.g. '\t') +Additionally it fixes a couple of warnings reported by pylint such as +wrong indentation and comparison to False instead of `not ...` + +Link: https://lore.kernel.org/20241017064238.41394-2-gmonaco@redhat.com +Signed-off-by: Gabriele Monaco +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + tools/verification/dot2/automata.py | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/tools/verification/dot2/automata.py b/tools/verification/dot2/automata.py +index baffeb960ff0b..bdeb98baa8b06 100644 +--- a/tools/verification/dot2/automata.py ++++ b/tools/verification/dot2/automata.py +@@ -29,11 +29,11 @@ class Automata: + + def __get_model_name(self): + basename = ntpath.basename(self.__dot_path) +- if basename.endswith(".dot") == False: ++ if not basename.endswith(".dot") and not basename.endswith(".gv"): + print("not a dot file") + raise Exception("not a dot file: %s" % self.__dot_path) + +- model_name = basename[0:-4] ++ model_name = ntpath.splitext(basename)[0] + if model_name.__len__() == 0: + raise Exception("not a dot file: %s" % self.__dot_path) + +@@ -68,9 +68,9 @@ class Automata: + def __get_cursor_begin_events(self): + cursor = 0 + while self.__dot_lines[cursor].split()[0] != "{node": +- cursor += 1 ++ cursor += 1 + while self.__dot_lines[cursor].split()[0] == "{node": +- cursor += 1 ++ cursor += 1 + # skip initial state transition + cursor += 1 + return cursor +@@ -94,11 +94,11 @@ class Automata: + initial_state = state[7:] + else: + states.append(state) +- if self.__dot_lines[cursor].__contains__("doublecircle") == True: ++ if "doublecircle" in self.__dot_lines[cursor]: + final_states.append(state) + has_final_states = True + +- if self.__dot_lines[cursor].__contains__("ellipse") == True: ++ if "ellipse" in self.__dot_lines[cursor]: + final_states.append(state) + has_final_states = True + +@@ -110,7 +110,7 @@ class Automata: + # Insert the initial state at the bein og the states + states.insert(0, initial_state) + +- if has_final_states == False: ++ if not has_final_states: + final_states.append(initial_state) + + return states, initial_state, final_states +@@ -120,7 +120,7 @@ class Automata: + cursor = self.__get_cursor_begin_events() + + events = [] +- while self.__dot_lines[cursor][1] == '"': ++ while self.__dot_lines[cursor].lstrip()[0] == '"': + # transitions have the format: + # "all_fired" -> "both_fired" [ label = "disable_irq" ]; + # ------------ event is here ------------^^^^^ +@@ -161,7 +161,7 @@ class Automata: + # and we are back! Let's fill the matrix + cursor = self.__get_cursor_begin_events() + +- while self.__dot_lines[cursor][1] == '"': ++ while self.__dot_lines[cursor].lstrip()[0] == '"': + if self.__dot_lines[cursor].split()[1] == "->": + line = self.__dot_lines[cursor].split() + origin_state = line[0].replace('"','').replace(',','_') +-- +2.43.0 + diff --git a/queue-6.1/wifi-ath5k-add-pci-id-for-arcadyan-devices.patch b/queue-6.1/wifi-ath5k-add-pci-id-for-arcadyan-devices.patch new file mode 100644 index 00000000000..9b04203d904 --- /dev/null +++ b/queue-6.1/wifi-ath5k-add-pci-id-for-arcadyan-devices.patch @@ -0,0 +1,34 @@ +From 6a3dc6d04b3d450e4a9887ac27d9ae4b97310cd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2024 11:07:16 -0700 +Subject: wifi: ath5k: add PCI ID for Arcadyan devices + +From: Rosen Penev + +[ Upstream commit f3ced9bb90b0a287a1fa6184d16b0f104a78fa90 ] + +Arcadyan made routers with this PCI ID containing an AR2417. + +Signed-off-by: Rosen Penev +Link: https://patch.msgid.link/20240930180716.139894-3-rosenp@gmail.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath5k/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c +index 35a6a7b1047a3..f583e0f3932b8 100644 +--- a/drivers/net/wireless/ath/ath5k/pci.c ++++ b/drivers/net/wireless/ath/ath5k/pci.c +@@ -47,6 +47,7 @@ static const struct pci_device_id ath5k_pci_id_table[] = { + { PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */ + { PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */ + { PCI_VDEVICE(ATHEROS, 0xff16) }, /* Gigaset SX76[23] AR241[34]A */ ++ { PCI_VDEVICE(ATHEROS, 0xff1a) }, /* Arcadyan ARV45XX AR2417 */ + { PCI_VDEVICE(ATHEROS, 0xff1b) }, /* AR5BXB63 */ + { 0 } + }; +-- +2.43.0 + diff --git a/queue-6.1/wifi-ath5k-add-pci-id-for-sx76x.patch b/queue-6.1/wifi-ath5k-add-pci-id-for-sx76x.patch new file mode 100644 index 00000000000..a1518ef5dc4 --- /dev/null +++ b/queue-6.1/wifi-ath5k-add-pci-id-for-sx76x.patch @@ -0,0 +1,34 @@ +From 5f0557abcf35d456e65d140c415969962e1c578d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2024 11:07:15 -0700 +Subject: wifi: ath5k: add PCI ID for SX76X + +From: Rosen Penev + +[ Upstream commit da0474012402d4729b98799d71a54c35dc5c5de3 ] + +This is in two devices made by Gigaset, SX762 and SX763. + +Signed-off-by: Rosen Penev +Link: https://patch.msgid.link/20240930180716.139894-2-rosenp@gmail.com +Signed-off-by: Jeff Johnson +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath5k/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c +index 86b8cb975b1ac..35a6a7b1047a3 100644 +--- a/drivers/net/wireless/ath/ath5k/pci.c ++++ b/drivers/net/wireless/ath/ath5k/pci.c +@@ -46,6 +46,7 @@ static const struct pci_device_id ath5k_pci_id_table[] = { + { PCI_VDEVICE(ATHEROS, 0x001b) }, /* 5413 Eagle */ + { PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */ + { PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */ ++ { PCI_VDEVICE(ATHEROS, 0xff16) }, /* Gigaset SX76[23] AR241[34]A */ + { PCI_VDEVICE(ATHEROS, 0xff1b) }, /* AR5BXB63 */ + { 0 } + }; +-- +2.43.0 + diff --git a/queue-6.1/wifi-brcmfmac-fix-oops-due-to-null-pointer-dereferen.patch b/queue-6.1/wifi-brcmfmac-fix-oops-due-to-null-pointer-dereferen.patch new file mode 100644 index 00000000000..cffd56f548f --- /dev/null +++ b/queue-6.1/wifi-brcmfmac-fix-oops-due-to-null-pointer-dereferen.patch @@ -0,0 +1,52 @@ +From 4247792e7aa8223bfcc557389e515ed7a2cc00b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 14:28:13 +0100 +Subject: wifi: brcmfmac: Fix oops due to NULL pointer dereference in + brcmf_sdiod_sglist_rw() + +From: Norbert van Bolhuis + +[ Upstream commit 857282b819cbaa0675aaab1e7542e2c0579f52d7 ] + +This patch fixes a NULL pointer dereference bug in brcmfmac that occurs +when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs +are sent from the pkt queue. + +The problem is the number of entries in the pre-allocated sgtable, it is +nents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1. +Given the default [rt]xglom_size=32 it's actually 35 which is too small. +Worst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB +is added for each original SKB if tailroom isn't enough to hold tail_pad. +At least one sg entry is needed for each SKB. So, eventually the "skb_queue_walk loop" +in brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return +NULL and this causes the oops. + +The patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle +the worst-case. +Btw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464 +additional bytes of memory. + +Signed-off-by: Norbert van Bolhuis +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20241107132903.13513-1-nvbolhuis@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +index e300278ea38c6..9217e9f6e9076 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -770,7 +770,7 @@ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev) + + nents = max_t(uint, BRCMF_DEFAULT_RXGLOM_SIZE, + sdiodev->settings->bus.sdio.txglomsz); +- nents += (nents >> 4) + 1; ++ nents *= 2; + + WARN_ON(nents > sdiodev->max_segment_count); + +-- +2.43.0 + diff --git a/queue-6.1/wifi-ipw2x00-libipw_rx_any-fix-bad-alignment.patch b/queue-6.1/wifi-ipw2x00-libipw_rx_any-fix-bad-alignment.patch new file mode 100644 index 00000000000..cff1eede608 --- /dev/null +++ b/queue-6.1/wifi-ipw2x00-libipw_rx_any-fix-bad-alignment.patch @@ -0,0 +1,53 @@ +From 3e2e5fb4928dc2c00f98b60bd148b47d30d988c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2024 14:07:25 +0800 +Subject: wifi: ipw2x00: libipw_rx_any(): fix bad alignment + +From: Jiapeng Chong + +[ Upstream commit 4fa4f049dc0d9741b16c96bcbf0108c85368a2b9 ] + +This patch fixes incorrect code alignment. + +./drivers/net/wireless/intel/ipw2x00/libipw_rx.c:871:2-3: code aligned with following code on line 882. +./drivers/net/wireless/intel/ipw2x00/libipw_rx.c:886:2-3: code aligned with following code on line 900. + +Reported-by: Abaci Robot +Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=11381 +Signed-off-by: Jiapeng Chong +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20241101060725.54640-1-jiapeng.chong@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_rx.c b/drivers/net/wireless/intel/ipw2x00/libipw_rx.c +index 48d6870bbf4e2..9a97ab9b89ae8 100644 +--- a/drivers/net/wireless/intel/ipw2x00/libipw_rx.c ++++ b/drivers/net/wireless/intel/ipw2x00/libipw_rx.c +@@ -870,8 +870,8 @@ void libipw_rx_any(struct libipw_device *ieee, + switch (ieee->iw_mode) { + case IW_MODE_ADHOC: + /* our BSS and not from/to DS */ +- if (ether_addr_equal(hdr->addr3, ieee->bssid)) +- if ((fc & (IEEE80211_FCTL_TODS+IEEE80211_FCTL_FROMDS)) == 0) { ++ if (ether_addr_equal(hdr->addr3, ieee->bssid) && ++ ((fc & (IEEE80211_FCTL_TODS + IEEE80211_FCTL_FROMDS)) == 0)) { + /* promisc: get all */ + if (ieee->dev->flags & IFF_PROMISC) + is_packet_for_us = 1; +@@ -885,8 +885,8 @@ void libipw_rx_any(struct libipw_device *ieee, + break; + case IW_MODE_INFRA: + /* our BSS (== from our AP) and from DS */ +- if (ether_addr_equal(hdr->addr2, ieee->bssid)) +- if ((fc & (IEEE80211_FCTL_TODS+IEEE80211_FCTL_FROMDS)) == IEEE80211_FCTL_FROMDS) { ++ if (ether_addr_equal(hdr->addr2, ieee->bssid) && ++ ((fc & (IEEE80211_FCTL_TODS + IEEE80211_FCTL_FROMDS)) == IEEE80211_FCTL_FROMDS)) { + /* promisc: get all */ + if (ieee->dev->flags & IFF_PROMISC) + is_packet_for_us = 1; +-- +2.43.0 +